From 9a062f0846aa4e9b3ca7eeb203daba2b8b67176f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 11:26:30 +0100
Subject: [PATCH 01/37] claude-connector: token from a systemd credential, pin
 before every spawn, prompts in prompt_dir, door set 401/403/429

Delete EnvLookup and the connector's own environment as a token source; a
TokenSource port reads $CREDENTIALS_DIRECTORY/<token_credential> at each use
(claude-connector-token-credential). binary_matches_pin is the one pin check,
used by ready() and before every spawn. PromptFile::create stages into the
configured prompt_dir instead of temp_dir(). The zero-bill door set is exactly
401, 403 and 429 with explicitly empty since-last usage, pinned by a table over
statuses and usage shapes. Soul s2's stderr-join probe is committed. The three
price types gain serde derives so the price table can live in the config
document.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                   |   2 +
 crates/claude-connector/Cargo.toml           |   3 +
 crates/claude-connector/src/backend.rs       |  80 +++-
 crates/claude-connector/src/backend/tests.rs | 367 +++++++++++++++----
 crates/claude-connector/src/config.rs        |   6 +
 crates/claude-connector/src/launch.rs        |  67 +++-
 crates/claude-connector/src/lib.rs           |   2 +-
 crates/claude-connector/src/stream.rs        |   4 +-
 crates/model-connector/src/service.rs        |   6 +-
 9 files changed, 442 insertions(+), 95 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 34dec06..524654e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -138,6 +138,8 @@ dependencies = [
 name = "claude-connector"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "cultcache-rs",
  "libc",
  "model-connector",
  "rmp-serde",
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index a35bb4a..454dad6 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -7,7 +7,10 @@ license.workspace = true
 repository.workspace = true
 publish = false
 
+
 [dependencies]
+anyhow = "1"
+cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "a4eae9056152335662f1115f97bf35fb00ab6d23", package = "cultcache-rs" }
 model-connector = { path = "../model-connector", features = ["daemon"] }
 rmp-serde = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index ad3fb8c..2b27368 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -1,5 +1,6 @@
 use std::fs::File;
 use std::io;
+use std::path::PathBuf;
 use std::time::Instant;
 
 use model_connector::{
@@ -11,12 +12,54 @@ use zeroize::Zeroizing;
 
 use crate::config::{ClaudeCodeConfig, PROVIDER};
 use crate::handle::{ClaudeCodeHandle, SessionStore, plan, prefix_digest, stdin_bytes};
-use crate::launch::{PromptFile, TOKEN_VAR, argv, child_env};
+use crate::launch::{PromptFile, argv, child_env};
 use crate::process::{ProcessPort, RunningChild, StdoutRead};
 use crate::stream::{Failure, Finished, Step, StreamState};
 
-/// How the backend reads its own environment.
-type EnvLookup = Box<dyn Fn(&str) -> Option<String> + Send + Sync>;
+/// Where the child's credential comes from, read afresh at every use. The
+/// connector's own environment is never a source (ruling
+/// claude-connector-token-credential).
+pub trait TokenSource: Send + Sync {
+    /// The token, or `None` when there is none or it is empty.
+    fn read(&self) -> Option<Zeroizing<String>>;
+}
+
+/// A token in a file named by a systemd credential: the file
+/// `$CREDENTIALS_DIRECTORY/<name>`, read on every call so a rotated credential
+/// is picked up by the next spawn.
+pub struct CredentialTokenSource {
+    directory: Option<PathBuf>,
+    name: String,
+}
+
+impl CredentialTokenSource {
+    /// The credential `name` under the directory systemd names in
+    /// `CREDENTIALS_DIRECTORY`; with no such variable the source has no token.
+    /// The variable names a directory, never a token.
+    pub fn from_environment(name: impl Into<String>) -> Self {
+        Self {
+            directory: std::env::var_os("CREDENTIALS_DIRECTORY").map(PathBuf::from),
+            name: name.into(),
+        }
+    }
+
+    pub fn in_directory(directory: impl Into<PathBuf>, name: impl Into<String>) -> Self {
+        Self {
+            directory: Some(directory.into()),
+            name: name.into(),
+        }
+    }
+}
+
+impl TokenSource for CredentialTokenSource {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        let directory = self.directory.as_ref()?;
+        let mut token = Zeroizing::new(std::fs::read_to_string(directory.join(&self.name)).ok()?);
+        let trimmed = token.trim_end_matches(['\r', '\n']).len();
+        token.truncate(trimmed);
+        (!token.is_empty()).then_some(token)
+    }
+}
 
 /// Where the tail of a child's stderr goes. The backend never puts it in a
 /// result; the connector binary wires this to its log.
@@ -31,7 +74,7 @@ pub struct ClaudeCodeBackend {
     port: Box<dyn ProcessPort>,
     sessions: Box<dyn SessionStore>,
     sink: Box<dyn StderrSink>,
-    env_lookup: EnvLookup,
+    tokens: Box<dyn TokenSource>,
 }
 
 impl ClaudeCodeBackend {
@@ -42,7 +85,10 @@ impl ClaudeCodeBackend {
         let sessions = Box::new(crate::handle::FsSessionStore::new(
             config.config_dir.clone(),
         ));
-        Self::with_ports(config, port, sessions, sink)
+        let tokens = Box::new(CredentialTokenSource::from_environment(
+            config.token_credential.clone(),
+        ));
+        Self::with_ports(config, port, sessions, sink, tokens)
     }
 
     pub fn with_ports(
@@ -50,22 +96,19 @@ impl ClaudeCodeBackend {
         port: Box<dyn ProcessPort>,
         sessions: Box<dyn SessionStore>,
         sink: Box<dyn StderrSink>,
+        tokens: Box<dyn TokenSource>,
     ) -> Self {
         Self {
             config,
             port,
             sessions,
             sink,
-            env_lookup: Box::new(|name| std::env::var(name).ok()),
+            tokens,
         }
     }
 
-    fn token(&self) -> Option<Zeroizing<String>> {
-        (self.env_lookup)(TOKEN_VAR)
-            .filter(|value| !value.is_empty())
-            .map(Zeroizing::new)
-    }
-
+    /// The one pin check: `ready` and every spawn use it, and nothing caches
+    /// its answer.
     fn binary_matches_pin(&self) -> bool {
         let Ok(mut file) = File::open(&self.config.claude_binary) else {
             return false;
@@ -86,14 +129,20 @@ impl ClaudeCodeBackend {
                 );
             }
         };
-        let Some(token) = self.token() else {
+        let Some(token) = self.tokens.read() else {
             return failed(
                 FailureKind::Authentication,
                 "claude-code: the connector has no credential to give the child".to_string(),
                 Some(zero_usage()),
             );
         };
-        let Ok(prompt) = PromptFile::create(&request.instructions) else {
+        if !self.binary_matches_pin() {
+            return failure(Failure::unbilled(
+                FailureKind::Provider,
+                "claude-code: the claude binary does not match its pin",
+            ));
+        }
+        let Ok(prompt) = PromptFile::create(&self.config.prompt_dir, &request.instructions) else {
             return failure(Failure::unbilled(
                 FailureKind::Provider,
                 "claude-code: the system prompt could not be staged",
@@ -178,7 +227,8 @@ impl ProviderBackend for ClaudeCodeBackend {
     fn ready(&self) -> bool {
         self.config.work_dir.is_dir()
             && self.config.config_dir.is_dir()
-            && self.token().is_some()
+            && self.config.prompt_dir.is_dir()
+            && self.tokens.read().is_some()
             && self.binary_matches_pin()
     }
 
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 309e2d1..5a8939d 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -13,7 +13,7 @@ use model_connector::{
 use super::*;
 use crate::config::ClaudeCodeLimits;
 use crate::handle::{FsSessionStore, SessionStore};
-use crate::launch::ChildEnv;
+use crate::launch::{ChildEnv, TOKEN_VAR};
 
 const CANARY_TOKEN: &str = "canary-oauth-token-value";
 const MODEL: &str = "claude-haiku-5-5";
@@ -243,17 +243,47 @@ impl StderrSink for Sink {
     }
 }
 
-fn config(instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeConfig {
+/// The bytes of the stand-in `claude` the scripted rigs pin.
+const PINNED: &[u8] = b"the pinned claude bytes";
+
+fn pin_of(bytes: &[u8]) -> [u8; 32] {
+    Sha256::digest(bytes).into()
+}
+
+/// A directory holding a pinned `claude` file and an empty `prompts` directory.
+fn sandbox() -> TempDir {
+    let dir = TempDir::new();
+    std::fs::write(dir.path().join("claude"), PINNED).unwrap();
+    std::fs::create_dir_all(dir.path().join("prompts")).unwrap();
+    dir
+}
+
+fn config(dir: &Path, instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeConfig {
     ClaudeCodeConfig {
-        claude_binary: PathBuf::from("/opt/claude"),
-        claude_binary_sha256: [9; 32],
+        claude_binary: dir.join("claude"),
+        claude_binary_sha256: pin_of(PINNED),
         work_dir: PathBuf::from("/work"),
         config_dir: PathBuf::from("/cfg"),
+        prompt_dir: dir.join("prompts"),
+        token_credential: "claude-token".to_string(),
         instance: instance.to_string(),
         limits,
     }
 }
 
+/// A token source with a fixed answer.
+struct FixedToken(Option<&'static str>);
+
+impl TokenSource for FixedToken {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        self.0.map(|token| Zeroizing::new(token.to_string()))
+    }
+}
+
+fn canary_token() -> Box<dyn TokenSource> {
+    Box::new(FixedToken(Some(CANARY_TOKEN)))
+}
+
 fn limits() -> ClaudeCodeLimits {
     ClaudeCodeLimits {
         deadline: Duration::from_secs(30),
@@ -263,12 +293,8 @@ fn limits() -> ClaudeCodeLimits {
     }
 }
 
-fn with_canary_token(mut backend: ClaudeCodeBackend) -> ClaudeCodeBackend {
-    backend.env_lookup = Box::new(|name| (name == TOKEN_VAR).then(|| CANARY_TOKEN.to_string()));
-    backend
-}
-
 struct Rig {
+    dir: TempDir,
     backend: ClaudeCodeBackend,
     spawns: Arc<AtomicUsize>,
     seen: Arc<Mutex<Seen>>,
@@ -285,13 +311,16 @@ fn rig_for(instance: &str, scripts: Vec<Script>, sessions: &[&str], stderr: &[u8
         seen: seen.clone(),
         stderr: stderr.to_vec(),
     };
-    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
-        config(instance, limits()),
+    let dir = sandbox();
+    let backend = ClaudeCodeBackend::with_ports(
+        config(dir.path(), instance, limits()),
         Box::new(port),
         Box::new(Sessions(sessions.iter().map(|s| s.to_string()).collect())),
         Box::new(sink.clone()),
-    ));
+        canary_token(),
+    );
     Rig {
+        dir,
         backend,
         spawns,
         seen,
@@ -443,7 +472,7 @@ fn argv_is_the_fixed_hygiene_set() {
         .expect("the prompt is passed as a file")
         .to_string();
     let expected: Vec<String> = [
-        "/opt/claude",
+        rig.dir.path().join("claude").to_str().unwrap(),
         "-p",
         "--output-format",
         "stream-json",
@@ -569,7 +598,7 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
     );
 
     let env = child_env(
-        &config(INSTANCE, limits()),
+        &config(rig.dir.path(), INSTANCE, limits()),
         &request(vec![user("x")]),
         Zeroizing::new(CANARY_TOKEN.to_string()),
     );
@@ -580,59 +609,144 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
 
 // ---- ready ----
 
+/// A backend over a scripted port that never has a script: `ready` runs nothing.
+fn ready_backend(config: ClaudeCodeConfig, tokens: Box<dyn TokenSource>) -> ClaudeCodeBackend {
+    ClaudeCodeBackend::with_ports(
+        config,
+        Box::new(ScriptedPort {
+            scripts: Mutex::new(VecDeque::new()),
+            spawns: Arc::new(AtomicUsize::new(0)),
+            seen: Arc::new(Mutex::new(Seen::default())),
+            stderr: Vec::new(),
+        }),
+        Box::new(Sessions(vec![])),
+        Box::new(Sink::default()),
+        tokens,
+    )
+}
+
 #[test]
 fn ready_checks_the_pinned_binary_digest() {
-    let dir = TempDir::new();
+    let dir = sandbox();
     let (work, cfg) = (dir.path().join("work"), dir.path().join("cfg"));
     std::fs::create_dir_all(&work).unwrap();
     std::fs::create_dir_all(&cfg).unwrap();
     let binary = dir.path().join("claude");
-    std::fs::write(&binary, b"the pinned bytes").unwrap();
-    let pin: [u8; 32] = Sha256::digest(b"the pinned bytes").into();
 
-    let ready = |sha: [u8; 32], binary: &Path, work: &Path, token: bool| {
-        let mut config = config(INSTANCE, limits());
+    let ready = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
+        let mut config = config(dir.path(), INSTANCE, limits());
         config.claude_binary = binary.to_path_buf();
         config.claude_binary_sha256 = sha;
         config.work_dir = work.to_path_buf();
         config.config_dir = cfg.clone();
-        let rig = rig(vec![]);
-        let mut backend = ClaudeCodeBackend::with_ports(
-            config,
-            Box::new(ScriptedPort {
-                scripts: Mutex::new(VecDeque::new()),
-                spawns: rig.spawns.clone(),
-                seen: rig.seen.clone(),
-                stderr: Vec::new(),
-            }),
-            Box::new(Sessions(vec![])),
-            Box::new(Sink::default()),
-        );
-        backend.env_lookup =
-            Box::new(move |name| (token && name == TOKEN_VAR).then(|| "t".to_string()));
-        let answer = backend.ready();
-        assert_eq!(rig.spawns(), 0, "ready runs nothing");
-        answer
+        config.prompt_dir = prompts.to_path_buf();
+        let tokens = Box::new(FixedToken(token.then_some("t")));
+        ready_backend(config, tokens).ready()
     };
+    let prompts = dir.path().join("prompts");
+    let pin = pin_of(PINNED);
 
-    assert!(ready(pin, &binary, &work, true));
-    assert!(!ready([0; 32], &binary, &work, true), "other pin");
+    assert!(ready(pin, &binary, &work, &prompts, true));
+    assert!(!ready([0; 32], &binary, &work, &prompts, true), "other pin");
     assert!(
-        !ready(pin, &dir.path().join("absent"), &work, true),
+        !ready(pin, &dir.path().join("absent"), &work, &prompts, true),
         "no binary"
     );
     assert!(
-        !ready(pin, &binary, &dir.path().join("absent"), true),
+        !ready(pin, &binary, &dir.path().join("absent"), &prompts, true),
         "no work dir"
     );
-    assert!(!ready(pin, &binary, &work, false), "no token");
+    assert!(
+        !ready(pin, &binary, &work, &dir.path().join("absent"), true),
+        "no prompt dir"
+    );
+    assert!(!ready(pin, &binary, &work, &prompts, false), "no token");
     std::fs::write(&binary, b"other bytes").unwrap();
     assert!(
-        !ready(pin, &binary, &work, true),
+        !ready(pin, &binary, &work, &prompts, true),
         "bytes differ from the pin"
     );
 }
 
+#[test]
+fn token_comes_from_the_credential_file_not_the_environment() {
+    static CANARY_PARENT: std::sync::Once = std::sync::Once::new();
+    CANARY_PARENT.call_once(|| {
+        // SAFETY: set once to a value no code path reads; the test proves none does.
+        unsafe { std::env::set_var(TOKEN_VAR, "canary-environment-token") };
+    });
+    let dir = sandbox();
+    let credentials = dir.path().join("credentials");
+    for sub in ["credentials", "work", "cfg"] {
+        std::fs::create_dir_all(dir.path().join(sub)).unwrap();
+    }
+    let seen = Arc::new(Mutex::new(Seen::default()));
+    let mut config = config(dir.path(), INSTANCE, limits());
+    config.work_dir = dir.path().join("work");
+    config.config_dir = dir.path().join("cfg");
+    let backend = ClaudeCodeBackend::with_ports(
+        config,
+        Box::new(ScriptedPort {
+            scripts: Mutex::new(vec![ok_script(SESSION, "x")].into()),
+            spawns: Arc::new(AtomicUsize::new(0)),
+            seen: seen.clone(),
+            stderr: Vec::new(),
+        }),
+        Box::new(Sessions(vec![])),
+        Box::new(Sink::default()),
+        Box::new(CredentialTokenSource::in_directory(
+            &credentials,
+            "claude-token",
+        )),
+    );
+    let mut door = Door::new();
+
+    // The variable is set and the file is absent: nothing to give the child.
+    assert!(!backend.ready());
+    let (claim, _) = door.begin(request(vec![user("hi")]));
+    let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
+    assert_eq!(kind, FailureKind::Authentication);
+    assert_eq!(usage, Some(usage_zero()));
+    assert!(!message.contains("canary-environment-token"));
+    assert!(seen.lock().unwrap().argv.is_empty(), "no child was spawned");
+
+    // The file is read afresh at the call, its trailing newline trimmed, and
+    // the child's environment carries the file's value.
+    std::fs::write(
+        credentials.join("claude-token"),
+        format!("{CANARY_TOKEN}\n"),
+    )
+    .unwrap();
+    assert!(backend.ready());
+    let mut door = Door::new();
+    let (claim, _) = door.begin(request(vec![user("hi")]));
+    let result = backend.execute(claim.call());
+    assert!(matches!(
+        outcome(&result),
+        TransportOutcome::Completed { .. }
+    ));
+    let env = seen.lock().unwrap().env.clone();
+    assert!(env.contains(&(TOKEN_VAR.to_string(), CANARY_TOKEN.to_string())));
+
+    // An empty credential is no token.
+    std::fs::write(credentials.join("claude-token"), "\n").unwrap();
+    assert!(!backend.ready());
+}
+
+#[test]
+fn an_unreadable_credential_is_no_token() {
+    // A credential that is a directory, or a directory that is absent.
+    let dir = sandbox();
+    std::fs::create_dir_all(dir.path().join("claude-token")).unwrap();
+    let source = CredentialTokenSource::in_directory(dir.path(), "claude-token");
+    assert!(source.read().is_none());
+    assert!(
+        CredentialTokenSource::in_directory(dir.path().join("absent"), "x")
+            .read()
+            .is_none()
+    );
+}
+
 // ---- planning ----
 
 #[test]
@@ -1224,7 +1338,7 @@ fn one_spawn_per_execute() {
 #[test]
 fn a_missing_token_fails_before_spawn() {
     let mut rig = rig(vec![ok_script(SESSION, "x")]);
-    rig.backend.env_lookup = Box::new(|_| None);
+    rig.backend.tokens = Box::new(FixedToken(None));
     let (kind, _, usage) = failure_of(&rig.run(request(vec![user("hi")])));
     assert_eq!(kind, FailureKind::Authentication);
     assert_eq!(usage, Some(usage_zero()));
@@ -1245,18 +1359,23 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
             Err(io::Error::from(io::ErrorKind::NotFound))
         }
     }
-    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
-        config(INSTANCE, limits()),
+    let dir = sandbox();
+    let backend = ClaudeCodeBackend::with_ports(
+        config(dir.path(), INSTANCE, limits()),
         Box::new(Refusing),
         Box::new(Sessions(vec![])),
         Box::new(Sink::default()),
-    ));
+        canary_token(),
+    );
     let mut door = Door::new();
     let (claim, _) = door.begin(request(vec![user("hi")]));
     let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
     assert_eq!(kind, FailureKind::Provider);
     assert_eq!(usage, None);
-    assert!(!message.contains("/opt/claude"), "no path in a message");
+    assert!(
+        !message.contains(dir.path().to_str().unwrap()),
+        "no path in a message"
+    );
 }
 
 #[test]
@@ -1384,28 +1503,60 @@ fn usage_the_result_does_not_report_is_billed_the_reservation() {
 }
 
 #[test]
-fn a_refusal_at_the_door_is_billed_nothing() {
-    // Ruling spend-bills-on-identity-not-validity: a bound result is charged
-    // its true cost, and the provider bills nothing for a 401 or 403.
-    // The shape is a real claude 2.1.312 capture with a bogus token.
+fn door_set_is_exactly_401_403_429() {
+    // Ruling claude-code-plan-quota-fuse-2 with spend-bills-on-identity-not-
+    // validity: a refusal at the door is charged nothing, for exactly the
+    // statuses the provider cannot have billed (401, 403, 429) and only when
+    // the result says its usage is explicitly empty. Every other shape is
+    // billed the reservation. The 401 shape is a real claude 2.1.312 capture
+    // with a bogus token.
     let retry = r#"{"type":"system","subtype":"api_retry","error":"authentication_failed"}"#;
     let synthetic = r#"{"type":"assistant","api_error_status":401,"error":"authentication_failed","message":{"id":"e48001b7-cf4f-49b1-9810-db8fd7f73c73","model":"<synthetic>","stop_reason":"stop_sequence","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 OAuth access token is invalid."}]}}"#;
-    for status in [401, 403] {
-        let result_line = format!(
-            r#"{{"type":"result","subtype":"success","is_error":true,"api_error_status":{status},"stop_reason":"stop_sequence","result":"Failed to authenticate.","modelUsage":{{}},"model_usage_since_last_result":{{}},"terminal_reason":"api_error"}}"#
-        );
-        let result = rig(vec![Script::lines(vec![
-            init_line(MODEL, SESSION),
-            retry.to_string(),
-            retry.to_string(),
-            synthetic.to_string(),
-            result_line,
-        ])])
-        .run(request(vec![user("hi")]));
-        let (kind, _, usage) = failure_of(&result);
-        assert_eq!(kind, FailureKind::Authentication, "{status}");
-        assert_eq!(usage, Some(usage_zero()), "{status}");
-        assert_eq!(parts(&result).1.cost_micro_usd, 0, "{status}");
+    let reservation = reservation();
+    let statuses: [Option<u16>; 9] = [
+        Some(400),
+        Some(401),
+        Some(402),
+        Some(403),
+        Some(404),
+        Some(429),
+        Some(500),
+        Some(529),
+        None,
+    ];
+    let shapes = [
+        (Some("{}"), "empty"),
+        (None, "absent"),
+        (Some("null"), "null"),
+    ];
+    for status in statuses {
+        for (since_last, shape) in shapes {
+            let status_field = status
+                .map(|status| format!(r#""api_error_status":{status},"#))
+                .unwrap_or_default();
+            let usage_field = since_last
+                .map(|usage| format!(r#","model_usage_since_last_result":{usage}"#))
+                .unwrap_or_default();
+            let result_line = format!(
+                r#"{{"type":"result","subtype":"success","is_error":true,{status_field}"stop_reason":"stop_sequence","result":"Failed.","modelUsage":{CUMULATIVE}{usage_field},"terminal_reason":"api_error"}}"#
+            );
+            let result = rig(vec![Script::lines(vec![
+                init_line(MODEL, SESSION),
+                retry.to_string(),
+                synthetic.to_string(),
+                result_line,
+            ])])
+            .run(request(vec![user("hi")]));
+            let (_, _, usage) = failure_of(&result);
+            let case = format!("{status:?} {shape}");
+            if matches!(status, Some(401 | 403 | 429)) && shape == "empty" {
+                assert_eq!(usage, Some(usage_zero()), "{case}");
+                assert_eq!(parts(&result).1.cost_micro_usd, 0, "{case}");
+            } else {
+                assert_eq!(usage, None, "{case}");
+                assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{case}");
+            }
+        }
     }
 }
 
@@ -1458,6 +1609,49 @@ fn the_prompt_file_is_removed_when_the_call_fails() {
     }
 }
 
+#[test]
+fn prompt_file_lives_in_prompt_dir_exclusively() {
+    let rig = rig(vec![ok_script(SESSION, "x")]);
+    rig.run(request(vec![user("hi")]));
+    let (path, _) = rig.seen().prompt_file.expect("a prompt file");
+    assert_eq!(
+        path.parent(),
+        Some(rig.dir.path().join("prompts").as_path())
+    );
+
+    // A prompt directory that cannot take the file fails staging: the failure
+    // is the unbilled constructor's, and no child runs.
+    let rig = rig_for(INSTANCE, vec![ok_script(SESSION, "x")], &[SESSION], b"");
+    std::fs::remove_dir_all(rig.dir.path().join("prompts")).unwrap();
+    let (kind, _, usage) = failure_of(&rig.run(request(vec![user("hi")])));
+    assert_eq!((kind, usage), (FailureKind::Provider, None));
+    assert_eq!(rig.spawns(), 0);
+}
+
+#[test]
+fn pin_is_checked_before_every_spawn() {
+    let rig = rig(vec![ok_script(SESSION, "x"), ok_script(SESSION, "y")]);
+    let binary = rig.dir.path().join("claude");
+    assert!(rig.backend.binary_matches_pin());
+    rig.run(request(vec![user("hi")]));
+    assert_eq!(rig.spawns(), 1);
+
+    // The binary is swapped after readiness: the next call never spawns.
+    std::fs::write(&binary, b"swapped bytes").unwrap();
+    let (kind, message, usage) = failure_of(&rig.run(request(vec![user("hi")])));
+    assert_eq!((kind, usage), (FailureKind::Provider, None));
+    assert!(!message.contains(rig.dir.path().to_str().unwrap()));
+    assert_eq!(rig.spawns(), 1, "no child for a binary off its pin");
+    assert!(!rig.backend.binary_matches_pin());
+    let staged = std::fs::read_dir(rig.dir.path().join("prompts")).unwrap();
+    assert_eq!(staged.count(), 0, "no prompt was staged for it");
+
+    // Restoring the pinned bytes is enough: nothing remembers the verdict.
+    std::fs::write(&binary, PINNED).unwrap();
+    rig.run(request(vec![user("hi")]));
+    assert_eq!(rig.spawns(), 2);
+}
+
 #[test]
 fn the_provider_tag_is_claude_code() {
     assert_eq!(rig(vec![]).backend.provider(), "claude-code");
@@ -1540,12 +1734,21 @@ mod real {
         let binary = dir.path().join("claude");
         std::fs::write(&binary, format!("#!/bin/sh\n{body}\n")).unwrap();
         std::fs::set_permissions(&binary, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let mut config = config(INSTANCE, limits);
+        let prompts = dir.path().join("prompts");
+        std::fs::create_dir_all(&prompts).unwrap();
+        let mut config = config(dir.path(), INSTANCE, limits);
+        config.claude_binary_sha256 = pin_of(&std::fs::read(&binary).unwrap());
         config.claude_binary = binary;
         config.work_dir = work;
         config.config_dir = cfg;
         let sink = Sink::default();
-        let backend = with_canary_token(ClaudeCodeBackend::new(config, Box::new(sink.clone())));
+        let backend = ClaudeCodeBackend::with_ports(
+            config.clone(),
+            Box::new(crate::process::StdProcessPort::new(config.limits)),
+            Box::new(FsSessionStore::new(config.config_dir.clone())),
+            Box::new(sink.clone()),
+            canary_token(),
+        );
         Fake {
             _guard: guard,
             dir,
@@ -1655,7 +1858,7 @@ mod real {
             leader.display()
         );
         let fake = fake(&body, limits());
-        let config = config(INSTANCE, limits());
+        let config = config(fake.dir.path(), INSTANCE, limits());
         let env = child_env(
             &config,
             &request(vec![user("x")]),
@@ -1801,6 +2004,11 @@ mod real {
             "600"
         );
         let path = std::fs::read_to_string(probe.path().join("path")).unwrap();
+        assert_eq!(
+            Path::new(path.trim()).parent(),
+            Some(fake.dir.path().join("prompts").as_path()),
+            "staged in the configured prompt directory"
+        );
         assert!(!Path::new(path.trim()).exists(), "removed after the call");
     }
 
@@ -1837,6 +2045,25 @@ mod real {
         assert!(sunk.trim_end().ends_with("END-OF-STDERR"), "{}", sunk.len());
     }
 
+    #[test]
+    fn stderr_join_survives_a_megabyte_after_result() {
+        // Soul s2's probe: the result line first, then a megabyte of stderr
+        // before the child exits. The call must wait for the stderr reader to
+        // finish, or the tail handed to the sink is cut short.
+        let body = format!(
+            "{}\nhead -c 1000000 /dev/zero | tr '\\0' x >&2\necho END-OF-STDERR >&2",
+            printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        let result = fake.run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        let sunk = String::from_utf8(fake.sink.0.lock().unwrap().clone()).unwrap();
+        assert!(sunk.trim_end().ends_with("END-OF-STDERR"), "{}", sunk.len());
+    }
+
     #[test]
     fn a_result_is_enough_even_if_the_child_keeps_stdout_open() {
         let body = format!("{}\nexec sleep 300", printf_lines(&good_lines()));
diff --git a/crates/claude-connector/src/config.rs b/crates/claude-connector/src/config.rs
index 1dd0e8a..3bd0e1f 100644
--- a/crates/claude-connector/src/config.rs
+++ b/crates/claude-connector/src/config.rs
@@ -19,6 +19,12 @@ pub struct ClaudeCodeConfig {
     /// Passed to the child as `CLAUDE_CONFIG_DIR` and `HOME`; it holds the
     /// CLI's session store.
     pub config_dir: PathBuf,
+    /// A directory the connector owns (mode 0700), where each call's system
+    /// prompt is staged for the child.
+    pub prompt_dir: PathBuf,
+    /// The name of the systemd credential that holds the child's token, under
+    /// `$CREDENTIALS_DIRECTORY`.
+    pub token_credential: String,
     /// The connector instance id written into every handle.
     pub instance: String,
     pub limits: ClaudeCodeLimits,
diff --git a/crates/claude-connector/src/launch.rs b/crates/claude-connector/src/launch.rs
index 22c8813..c94134c 100644
--- a/crates/claude-connector/src/launch.rs
+++ b/crates/claude-connector/src/launch.rs
@@ -14,8 +14,8 @@ use zeroize::Zeroizing;
 use crate::config::ClaudeCodeConfig;
 use crate::handle::Plan;
 
-/// The one credential variable, copied by name from the connector's own
-/// environment into the child and nowhere else.
+/// The one credential variable: the child's environment is the only
+/// environment the token ever enters.
 pub(crate) const TOKEN_VAR: &str = "CLAUDE_CODE_OAUTH_TOKEN";
 const CHILD_PATH: &str = "/usr/local/bin:/usr/bin:/bin";
 
@@ -62,13 +62,18 @@ pub(crate) struct PromptFile(PathBuf);
 static PROMPT_FILES: AtomicU64 = AtomicU64::new(0);
 
 impl PromptFile {
-    pub(crate) fn create(instructions: &str) -> io::Result<Self> {
+    pub(crate) fn create(dir: &Path, instructions: &str) -> io::Result<Self> {
         let name = format!(
             "claude-connector-prompt-{}-{}",
             std::process::id(),
             PROMPT_FILES.fetch_add(1, Ordering::Relaxed)
         );
-        let path = std::env::temp_dir().join(name);
+        Self::create_at(dir.join(name), instructions)
+    }
+
+    /// Creates `path` and nothing that already exists there: a file, a link
+    /// (dangling or not) or a directory at the name fails, and is left alone.
+    fn create_at(path: PathBuf, instructions: &str) -> io::Result<Self> {
         let mut options = OpenOptions::new();
         options.write(true).create_new(true);
         #[cfg(unix)]
@@ -146,3 +151,57 @@ pub(crate) fn argv(
     }
     argv
 }
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    use super::*;
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "claude-connector-launch-{name}-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[test]
+    fn a_prompt_is_created_private_and_removed_on_drop() {
+        let dir = scratch("private");
+        let prompt = PromptFile::create(&dir, "the prompt").unwrap();
+        let path = prompt.path().to_path_buf();
+        assert_eq!(path.parent(), Some(dir.as_path()));
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "the prompt");
+        let mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600);
+        drop(prompt);
+        assert!(!path.exists());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn a_name_already_taken_is_never_written_or_removed() {
+        let dir = scratch("taken");
+        let victim = dir.join("victim");
+        std::fs::write(&victim, "keep").unwrap();
+
+        let file = dir.join("file");
+        std::fs::write(&file, "mine").unwrap();
+        let link = dir.join("link");
+        symlink(&victim, &link).unwrap();
+        let dangling = dir.join("dangling");
+        symlink(dir.join("nowhere"), &dangling).unwrap();
+
+        for taken in [&file, &link, &dangling] {
+            assert!(PromptFile::create_at(taken.clone(), "the prompt").is_err());
+        }
+        assert_eq!(std::fs::read_to_string(&victim).unwrap(), "keep");
+        assert_eq!(std::fs::read_to_string(&file).unwrap(), "mine");
+        assert!(!dir.join("nowhere").exists());
+        assert!(link.exists() && dangling.symlink_metadata().is_ok());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 28ad7f5..a7de84f 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -10,7 +10,7 @@ mod launch;
 mod process;
 mod stream;
 
-pub use backend::{ClaudeCodeBackend, StderrSink};
+pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
 pub use handle::{FsSessionStore, SessionStore};
 pub use launch::ChildEnv;
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index 7bb336b..e323662 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -181,7 +181,7 @@ impl<'a> StreamState<'a> {
         let door_refusal = !success
             && matches!(
                 line.api_error_status.as_ref().and_then(Value::as_u64),
-                Some(401 | 403)
+                Some(401 | 403 | 429)
             );
         let usage = read_usage(line.model_usage_since_last_result, door_refusal);
         if !success {
@@ -258,7 +258,7 @@ fn fail(kind: FailureKind, message: &'static str) -> Step {
 /// What this turn consumed, summed over every model it used (harness side
 /// calls included), or `None` when the result does not say: the field absent,
 /// of another shape, or empty. An empty report is believed only for a refusal
-/// at the door (401 or 403), which the provider cannot have billed; elsewhere
+/// at the door (401, 403 or 429), which the provider cannot have billed; elsewhere
 /// the CLI also zeroes usage on crashes after real work. `None` is billed the
 /// reservation by the kit.
 fn read_usage(reported: Option<Value>, door_refusal: bool) -> Option<Usage> {
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 8d4fd80..6d10cb9 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -119,7 +119,7 @@ impl CallerAdmission {
 }
 
 /// What one million tokens of each class cost, in micro-USD.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Rates {
     pub input: u64,
     pub cache_write_short: u64,
@@ -129,7 +129,7 @@ pub struct Rates {
 }
 
 /// The rates a prompt strictly above `above_prompt_tokens` is priced at.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LongContext {
     pub above_prompt_tokens: u64,
     pub rates: Rates,
@@ -138,7 +138,7 @@ pub struct LongContext {
 /// One model's price. Explicit zero rates are admitted (a local model is
 /// free); a missing price is not. `overhead_tokens` is added to the byte
 /// bound of a request when its worst case is reserved.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ModelPrice {
     pub rates: Rates,
     pub long_context: Option<LongContext>,

From b44c5a3b757fce1895bed83e6accd5e7bf8438f3 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 11:26:32 +0100
Subject: [PATCH 02/37] claude-connector: the binary over one typed CultCache
 config document

gamecult.model_connector.claude_connector_config.v1 owns every bound and path
the backend and serve loop run with: read as an exact single-record canonical
snapshot, validated once for config init, config check and serve (loopback
listen, absolute paths, one caller, canonical priced claude- models). Refusals
name a field and never echo a value. serve refuses a prompt_dir that is not a
directory owned by the process uid with mode 0700.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/Cargo.toml            |   3 +
 crates/claude-connector/src/daemon.rs         | 318 ++++++++++
 crates/claude-connector/src/lib.rs            |   4 +
 crates/claude-connector/src/main.rs           | 238 ++++++++
 .../claude-connector/tests/config_document.rs | 571 ++++++++++++++++++
 5 files changed, 1134 insertions(+)
 create mode 100644 crates/claude-connector/src/daemon.rs
 create mode 100644 crates/claude-connector/src/main.rs
 create mode 100644 crates/claude-connector/tests/config_document.rs

diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index 454dad6..7f9b042 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -7,6 +7,9 @@ license.workspace = true
 repository.workspace = true
 publish = false
 
+[[bin]]
+name = "claude-connector"
+path = "src/main.rs"
 
 [dependencies]
 anyhow = "1"
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
new file mode 100644
index 0000000..8debb4b
--- /dev/null
+++ b/crates/claude-connector/src/daemon.rs
@@ -0,0 +1,318 @@
+//! The claude-connector's configuration document and its serve verb. One typed
+//! CultCache record owns every bound and path the backend and the serve loop
+//! run with; nothing in the connector's environment, flags or JSON can change
+//! them. Validation errors name a field and never echo a value.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::{SocketAddr, TcpListener};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
+use model_connector::{
+    CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ServeError, ServeLimits, load_admissions, serve,
+};
+use thiserror::Error;
+
+use crate::{ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, StderrSink};
+
+const CONFIG_KEY: &str = "runtime";
+const MODEL_PREFIX: &str = "claude-";
+
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "gamecult.model_connector.claude_connector_config.v1")]
+pub struct ClaudeConnectorConfig {
+    /// A loopback socket address.
+    #[cultcache(key = 0)]
+    pub listen: String,
+    #[cultcache(key = 1)]
+    pub replay_store: PathBuf,
+    #[cultcache(key = 2)]
+    pub claude_binary: PathBuf,
+    #[cultcache(key = 3)]
+    pub claude_binary_sha256: [u8; 32],
+    #[cultcache(key = 4)]
+    pub work_dir: PathBuf,
+    #[cultcache(key = 5)]
+    pub config_dir: PathBuf,
+    /// Where each call's system prompt is staged: a directory the connector
+    /// owns, mode 0700.
+    #[cultcache(key = 6)]
+    pub prompt_dir: PathBuf,
+    #[cultcache(key = 7)]
+    pub instance: String,
+    /// The name of the systemd credential that holds the child's token.
+    #[cultcache(key = 8)]
+    pub token_credential: String,
+    #[cultcache(key = 9)]
+    pub deadline_ms: u64,
+    #[cultcache(key = 10)]
+    pub max_line_bytes: usize,
+    #[cultcache(key = 11)]
+    pub max_total_bytes: usize,
+    #[cultcache(key = 12)]
+    pub stderr_tail_bytes: usize,
+    #[cultcache(key = 13)]
+    pub max_frame_bytes: usize,
+    #[cultcache(key = 14)]
+    pub max_connections: usize,
+    #[cultcache(key = 15)]
+    pub socket_timeout_ms: u64,
+    #[cultcache(key = 16)]
+    pub max_expiry_skew_ms: u64,
+    /// Exactly one caller until claude-handle-caller-binding lands.
+    #[cultcache(key = 17)]
+    pub callers: Vec<CallerConfig>,
+    /// What each allowed model costs; keys are canonical model ids.
+    #[cultcache(key = 18)]
+    pub prices: BTreeMap<String, ModelPrice>,
+}
+
+/// A refusal. It names the field or stage that failed and nothing the
+/// operator or the file typed.
+#[derive(Debug, Error)]
+pub enum ConfigError {
+    #[error("invalid configuration field {0}")]
+    Invalid(&'static str),
+    #[error("the configuration store could not be read as a claude connector document")]
+    Store,
+    #[error("the prompt directory is not a directory owned by this process with mode 0700")]
+    PromptDir,
+    #[error("the listener could not be bound")]
+    Listen,
+    #[error(transparent)]
+    Serve(#[from] ServeError),
+}
+
+impl ClaudeConnectorConfig {
+    /// The one validation: `config init`, `config check` and `serve` all pass
+    /// through it. Returns the listen address.
+    pub fn validate(&self) -> Result<SocketAddr, ConfigError> {
+        let listen = self
+            .listen
+            .parse::<SocketAddr>()
+            .ok()
+            .filter(|address| address.ip().is_loopback())
+            .ok_or(ConfigError::Invalid("listen"))?;
+        let paths = [
+            ("replay_store", &self.replay_store),
+            ("claude_binary", &self.claude_binary),
+            ("work_dir", &self.work_dir),
+            ("config_dir", &self.config_dir),
+            ("prompt_dir", &self.prompt_dir),
+        ];
+        for (field, path) in paths {
+            if !path.is_absolute() {
+                return Err(ConfigError::Invalid(field));
+            }
+        }
+        if self.claude_binary_sha256 == [0; 32] {
+            return Err(ConfigError::Invalid("claude_binary_sha256"));
+        }
+        if !is_trimmed_nonempty(&self.instance) {
+            return Err(ConfigError::Invalid("instance"));
+        }
+        if !is_credential_name(&self.token_credential) {
+            return Err(ConfigError::Invalid("token_credential"));
+        }
+        if self.deadline_ms == 0
+            || self.max_line_bytes == 0
+            || self.max_total_bytes < self.max_line_bytes
+            || self.stderr_tail_bytes == 0
+        {
+            return Err(ConfigError::Invalid("child limits"));
+        }
+        if self.max_frame_bytes == 0
+            || self.max_connections == 0
+            || self.socket_timeout_ms == 0
+            || self.max_expiry_skew_ms == 0
+        {
+            return Err(ConfigError::Invalid("serve limits"));
+        }
+        let [caller] = self.callers.as_slice() else {
+            return Err(ConfigError::Invalid("callers"));
+        };
+        if !is_trimmed_nonempty(&caller.caller_runtime_id) {
+            return Err(ConfigError::Invalid("caller_runtime_id"));
+        }
+        if !caller.connection_key_file.is_absolute() {
+            return Err(ConfigError::Invalid("connection_key_file"));
+        }
+        if caller.connection_key_epoch == 0 {
+            return Err(ConfigError::Invalid("connection_key_epoch"));
+        }
+        if caller.max_concurrent_requests == 0
+            || caller.max_payload_bytes < MIN_PAYLOAD_BYTES
+            || caller.max_output_tokens == 0
+            || caller.spend_ceiling_micro_usd == 0
+            || caller.spend_window_ms == 0
+        {
+            return Err(ConfigError::Invalid("caller bounds"));
+        }
+        if caller.allowed_models.is_empty() {
+            return Err(ConfigError::Invalid("allowed_models"));
+        }
+        let mut seen = BTreeSet::new();
+        for model in &caller.allowed_models {
+            if !is_canonical_model(model)
+                || !seen.insert(model.as_str())
+                || !self.prices.contains_key(model)
+            {
+                return Err(ConfigError::Invalid("allowed_models"));
+            }
+        }
+        if !self.prices.keys().all(|model| is_canonical_model(model)) {
+            return Err(ConfigError::Invalid("prices"));
+        }
+        Ok(listen)
+    }
+
+    fn backend_config(&self) -> ClaudeCodeConfig {
+        ClaudeCodeConfig {
+            claude_binary: self.claude_binary.clone(),
+            claude_binary_sha256: self.claude_binary_sha256,
+            work_dir: self.work_dir.clone(),
+            config_dir: self.config_dir.clone(),
+            prompt_dir: self.prompt_dir.clone(),
+            token_credential: self.token_credential.clone(),
+            instance: self.instance.clone(),
+            limits: ClaudeCodeLimits {
+                deadline: Duration::from_millis(self.deadline_ms),
+                max_line_bytes: self.max_line_bytes,
+                max_total_bytes: self.max_total_bytes,
+                stderr_tail_bytes: self.stderr_tail_bytes,
+            },
+        }
+    }
+
+    fn serve_limits(&self) -> ServeLimits {
+        ServeLimits {
+            max_frame_bytes: self.max_frame_bytes,
+            max_connections: self.max_connections,
+            socket_timeout_ms: self.socket_timeout_ms,
+            max_expiry_skew_ms: self.max_expiry_skew_ms,
+        }
+    }
+}
+
+fn is_trimmed_nonempty(text: &str) -> bool {
+    !text.is_empty() && text.trim() == text
+}
+
+/// A model id the CLI echoes back unchanged: aliases are refused because the
+/// stream's `init.model` must equal the requested model.
+fn is_canonical_model(model: &str) -> bool {
+    model.starts_with(MODEL_PREFIX)
+        && model.len() > MODEL_PREFIX.len()
+        && model
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_'))
+}
+
+/// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
+fn is_credential_name(name: &str) -> bool {
+    !name.is_empty()
+        && name != "."
+        && name != ".."
+        && name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_'))
+}
+
+/// Reads the document without writing: a shared snapshot of exactly one
+/// record, with the exact key, type and schema id, in canonical positional
+/// MessagePack, then validated.
+pub fn load_config(path: &Path) -> Result<ClaudeConnectorConfig, ConfigError> {
+    let store = SingleFileMessagePackBackingStore::new(path);
+    let config = store
+        .with_read_only_shared_snapshot(|entries| {
+            let [envelope] = entries.as_slice() else {
+                anyhow::bail!("not exactly one record");
+            };
+            if envelope.key != CONFIG_KEY
+                || envelope.r#type != ClaudeConnectorConfig::TYPE
+                || envelope.schema_id.as_deref() != Some(ClaudeConnectorConfig::TYPE)
+            {
+                anyhow::bail!("wrong typed envelope");
+            }
+            let config: ClaudeConnectorConfig = rmp_serde::from_slice(&envelope.payload)?;
+            if rmp_serde::to_vec(&config)? != envelope.payload {
+                anyhow::bail!("not canonical positional MessagePack");
+            }
+            Ok(config)
+        })
+        .map_err(|_| ConfigError::Store)?;
+    config.validate()?;
+    Ok(config)
+}
+
+/// Validates, then writes the document as the store's only record.
+pub fn write_config(path: &Path, config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
+    config.validate()?;
+    let mut cache = CultCache::new();
+    cache
+        .register_entry_type::<ClaudeConnectorConfig>()
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(path))
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .pull_all_backing_stores()
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .put(CONFIG_KEY, config)
+        .map_err(|_| ConfigError::Store)?;
+    Ok(())
+}
+
+/// The prompt directory holds every system prompt in flight: it must be a
+/// real directory (not a link) that this process owns and nobody else can
+/// enter.
+#[cfg(unix)]
+pub fn check_prompt_dir(dir: &Path) -> Result<(), ConfigError> {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+    let metadata = std::fs::symlink_metadata(dir).map_err(|_| ConfigError::PromptDir)?;
+    // SAFETY: geteuid has no preconditions and cannot fail.
+    let uid = unsafe { libc::geteuid() };
+    if !metadata.is_dir()
+        || metadata.uid() != uid
+        || metadata.permissions().mode() & 0o7777 != 0o700
+    {
+        return Err(ConfigError::PromptDir);
+    }
+    Ok(())
+}
+
+/// The child's stderr is the log's business by size only: its bytes are never
+/// written anywhere the connector controls.
+struct LogSink;
+
+impl StderrSink for LogSink {
+    fn stderr_tail(&self, tail: &[u8]) {
+        eprintln!("claude-connector: child stderr, {} bytes", tail.len());
+    }
+}
+
+/// Loads the document and serves until the listener fails.
+#[cfg(unix)]
+pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
+    let config = load_config(path)?;
+    let listen = config.validate()?;
+    check_prompt_dir(&config.prompt_dir)?;
+    let admissions = load_admissions(&config.callers)?;
+    let backend = Arc::new(ClaudeCodeBackend::new(
+        config.backend_config(),
+        Box::new(LogSink),
+    ));
+    let listener = TcpListener::bind(listen).map_err(|_| ConfigError::Listen)?;
+    serve(
+        listener,
+        config.serve_limits(),
+        admissions,
+        config.prices.clone(),
+        &config.replay_store,
+        backend,
+    )?;
+    Ok(())
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index a7de84f..2ca22bf 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -5,6 +5,7 @@
 
 mod backend;
 mod config;
+mod daemon;
 mod handle;
 mod launch;
 mod process;
@@ -12,6 +13,9 @@ mod stream;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
+pub use daemon::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+#[cfg(unix)]
+pub use daemon::{check_prompt_dir, serve_config};
 pub use handle::{FsSessionStore, SessionStore};
 pub use launch::ChildEnv;
 #[cfg(unix)]
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
new file mode 100644
index 0000000..f4b7004
--- /dev/null
+++ b/crates/claude-connector/src/main.rs
@@ -0,0 +1,238 @@
+//! The claude-connector binary.
+//!
+//!   claude-connector serve --config PATH.cc
+//!   claude-connector config init PATH.cc --flag value ...
+//!   claude-connector config check PATH.cc
+//!
+//! `serve` takes its configuration from the typed document alone. The flags of
+//! `config init` exist only to author that document. No message here echoes a
+//! value that was typed or stored; refusals name a field or a flag.
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
+
+fn main() -> ExitCode {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let args: Vec<&str> = args.iter().map(String::as_str).collect();
+    let result = match args.as_slice() {
+        ["serve", "--config", path] => serve(path),
+        ["config", "init", path, flags @ ..] => init(path, flags),
+        ["config", "check", path] => check(path),
+        _ => Err(Failure::Usage),
+    };
+    match result {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(failure) => {
+            eprintln!("claude-connector: {failure}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+enum Failure {
+    #[error("usage: serve --config PATH | config init PATH --flag value ... | config check PATH")]
+    Usage,
+    #[error(transparent)]
+    Config(#[from] ConfigError),
+    #[error("flag {0} is missing")]
+    Missing(&'static str),
+    #[error("flag {0} is malformed")]
+    Malformed(&'static str),
+    #[error("a flag is unknown, repeated or has no value")]
+    Flags,
+}
+
+#[cfg(unix)]
+fn serve(path: &str) -> Result<(), Failure> {
+    Ok(claude_connector::serve_config(path.as_ref())?)
+}
+
+#[cfg(not(unix))]
+fn serve(_: &str) -> Result<(), Failure> {
+    Err(Failure::Usage)
+}
+
+fn check(path: &str) -> Result<(), Failure> {
+    let config = load_config(path.as_ref())?;
+    println!("claude connector configuration is valid");
+    println!("callers: {}", config.callers.len());
+    println!("allowed_models: {}", config.callers[0].allowed_models.len());
+    println!("prices: {}", config.prices.len());
+    Ok(())
+}
+
+/// The flags of `config init`, each given at most once except the two lists.
+struct Flags {
+    single: BTreeMap<&'static str, String>,
+    models: Vec<String>,
+    prices: Vec<String>,
+}
+
+const SINGLE: [&str; 22] = [
+    "--listen",
+    "--replay-store",
+    "--claude-binary",
+    "--claude-sha256",
+    "--work-dir",
+    "--config-dir",
+    "--prompt-dir",
+    "--instance",
+    "--token-credential",
+    "--caller-id",
+    "--connection-key-file",
+    "--connection-key-epoch",
+    "--spend-ceiling-micro-usd",
+    "--spend-window-ms",
+    "--deadline-ms",
+    "--max-line-bytes",
+    "--max-total-bytes",
+    "--stderr-tail-bytes",
+    "--max-concurrent-requests",
+    "--max-payload-bytes",
+    "--max-output-tokens",
+    "--socket-timeout-ms",
+];
+
+impl Flags {
+    fn parse(args: &[&str]) -> Result<Self, Failure> {
+        let mut flags = Flags {
+            single: BTreeMap::new(),
+            models: Vec::new(),
+            prices: Vec::new(),
+        };
+        let mut args = args.iter();
+        while let Some(&name) = args.next() {
+            let Some(&value) = args.next() else {
+                return Err(Failure::Flags);
+            };
+            match name {
+                "--allowed-model" => flags.models.push(value.to_string()),
+                "--price" => flags.prices.push(value.to_string()),
+                _ => {
+                    let Some(known) = SINGLE.iter().find(|known| **known == name) else {
+                        return Err(Failure::Flags);
+                    };
+                    if flags.single.insert(*known, value.to_string()).is_some() {
+                        return Err(Failure::Flags);
+                    }
+                }
+            }
+        }
+        Ok(flags)
+    }
+
+    fn text(&self, name: &'static str) -> Result<String, Failure> {
+        self.single.get(name).cloned().ok_or(Failure::Missing(name))
+    }
+
+    fn path(&self, name: &'static str) -> Result<PathBuf, Failure> {
+        self.text(name).map(PathBuf::from)
+    }
+
+    fn number<T: std::str::FromStr>(&self, name: &'static str) -> Result<T, Failure> {
+        self.text(name)?
+            .parse()
+            .map_err(|_| Failure::Malformed(name))
+    }
+
+    fn number_or<T: std::str::FromStr>(
+        &self,
+        name: &'static str,
+        default: T,
+    ) -> Result<T, Failure> {
+        match self.single.get(name) {
+            None => Ok(default),
+            Some(text) => text.parse().map_err(|_| Failure::Malformed(name)),
+        }
+    }
+}
+
+fn sha256(hex: &str) -> Option<[u8; 32]> {
+    if hex.len() != 64 || !hex.is_ascii() {
+        return None;
+    }
+    let mut digest = [0_u8; 32];
+    for (byte, pair) in digest.iter_mut().zip(hex.as_bytes().chunks(2)) {
+        *byte = u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok()?;
+    }
+    Some(digest)
+}
+
+/// MODEL:INPUT:OUTPUT:CACHE_WRITE:CACHE_READ:OVERHEAD, rates in micro-USD per
+/// million tokens. The one cache-write rate prices both retentions.
+fn price(text: &str) -> Option<(String, ModelPrice)> {
+    let mut parts = text.split(':');
+    let model = parts.next()?.to_string();
+    let mut next = || parts.next()?.parse::<u64>().ok();
+    let (input, output, cache_write, cache_read, overhead_tokens) =
+        (next()?, next()?, next()?, next()?, next()?);
+    if parts.next().is_some() {
+        return None;
+    }
+    Some((
+        model,
+        ModelPrice {
+            rates: Rates {
+                input,
+                cache_write_short: cache_write,
+                cache_write_long: cache_write,
+                cache_read,
+                output,
+            },
+            long_context: None,
+            overhead_tokens,
+        },
+    ))
+}
+
+fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
+    let flags = Flags::parse(args)?;
+    let max_payload_bytes: usize = flags.number_or("--max-payload-bytes", 1 << 20)?;
+    let max_concurrent_requests: usize = flags.number_or("--max-concurrent-requests", 4)?;
+    let mut prices = BTreeMap::new();
+    for text in &flags.prices {
+        let (model, price) = price(text).ok_or(Failure::Malformed("--price"))?;
+        if prices.insert(model, price).is_some() {
+            return Err(Failure::Malformed("--price"));
+        }
+    }
+    let config = ClaudeConnectorConfig {
+        listen: flags.text("--listen")?,
+        replay_store: flags.path("--replay-store")?,
+        claude_binary: flags.path("--claude-binary")?,
+        claude_binary_sha256: sha256(&flags.text("--claude-sha256")?)
+            .ok_or(Failure::Malformed("--claude-sha256"))?,
+        work_dir: flags.path("--work-dir")?,
+        config_dir: flags.path("--config-dir")?,
+        prompt_dir: flags.path("--prompt-dir")?,
+        instance: flags.text("--instance")?,
+        token_credential: flags.text("--token-credential")?,
+        deadline_ms: flags.number_or("--deadline-ms", 600_000)?,
+        max_line_bytes: flags.number_or("--max-line-bytes", 4 << 20)?,
+        max_total_bytes: flags.number_or("--max-total-bytes", 64 << 20)?,
+        stderr_tail_bytes: flags.number_or("--stderr-tail-bytes", 8192)?,
+        max_frame_bytes: frame_bytes_for_payload(max_payload_bytes),
+        max_connections: max_concurrent_requests.max(8),
+        socket_timeout_ms: flags.number_or("--socket-timeout-ms", 10_000)?,
+        max_expiry_skew_ms: 300_000,
+        callers: vec![CallerConfig {
+            caller_runtime_id: flags.text("--caller-id")?,
+            connection_key_file: flags.path("--connection-key-file")?,
+            connection_key_epoch: flags.number("--connection-key-epoch")?,
+            allowed_models: flags.models.clone(),
+            max_concurrent_requests,
+            max_payload_bytes,
+            max_output_tokens: flags.number_or("--max-output-tokens", 32_768)?,
+            spend_ceiling_micro_usd: flags.number("--spend-ceiling-micro-usd")?,
+            spend_window_ms: flags.number("--spend-window-ms")?,
+        }],
+        prices,
+    };
+    write_config(path.as_ref(), &config)?;
+    Ok(())
+}
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
new file mode 100644
index 0000000..89f92bf
--- /dev/null
+++ b/crates/claude-connector/tests/config_document.rs
@@ -0,0 +1,571 @@
+//! The claude-connector's configuration document and binary: what the
+//! document accepts, what it refuses, and that no refusal or output echoes a
+//! byte of a value that was typed, stored or read from a credential.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
+use model_connector::{CallerConfig, ModelPrice, Rates};
+
+const CANARY: &str = "canary-9f3b7c1d";
+const OPUS: &str = "claude-opus-5";
+const HAIKU: &str = "claude-haiku-5-5";
+
+/// An edit that should make the valid document refuse.
+type Change = Box<dyn Fn(&mut ClaudeConnectorConfig)>;
+
+static SEQUENCE: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!(
+            "claude-connector-config-{}-{}",
+            std::process::id(),
+            SEQUENCE.fetch_add(1, Ordering::SeqCst)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+    fn path(&self, name: &str) -> PathBuf {
+        self.0.join(name)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn price() -> ModelPrice {
+    ModelPrice {
+        rates: Rates {
+            input: 3_000_000,
+            cache_write_short: 3_750_000,
+            cache_write_long: 3_750_000,
+            cache_read: 300_000,
+            output: 15_000_000,
+        },
+        long_context: None,
+        overhead_tokens: 100,
+    }
+}
+
+fn valid() -> ClaudeConnectorConfig {
+    ClaudeConnectorConfig {
+        listen: "127.0.0.1:7443".to_string(),
+        replay_store: "/var/lib/claude-connector/replay.cc".into(),
+        claude_binary: "/opt/claude/bin/claude".into(),
+        claude_binary_sha256: [7; 32],
+        work_dir: "/var/lib/claude-connector/work".into(),
+        config_dir: "/var/lib/claude-connector/home".into(),
+        prompt_dir: "/var/lib/claude-connector/prompts".into(),
+        instance: "persona-a".to_string(),
+        token_credential: "claude-token".to_string(),
+        deadline_ms: 600_000,
+        max_line_bytes: 4 << 20,
+        max_total_bytes: 64 << 20,
+        stderr_tail_bytes: 8192,
+        max_frame_bytes: 2 << 20,
+        max_connections: 8,
+        socket_timeout_ms: 10_000,
+        max_expiry_skew_ms: 300_000,
+        callers: vec![CallerConfig {
+            caller_runtime_id: "persona-a-caller".to_string(),
+            connection_key_file: "/etc/claude-connector/caller.key".into(),
+            connection_key_epoch: 1,
+            allowed_models: vec![HAIKU.to_string(), OPUS.to_string()],
+            max_concurrent_requests: 4,
+            max_payload_bytes: 1 << 20,
+            max_output_tokens: 32_768,
+            spend_ceiling_micro_usd: 50_000_000,
+            spend_window_ms: 3_600_000,
+        }],
+        prices: BTreeMap::from([(HAIKU.to_string(), price()), (OPUS.to_string(), price())]),
+    }
+}
+
+fn refused(config: &ClaudeConnectorConfig) -> &'static str {
+    match config.validate() {
+        Err(ConfigError::Invalid(field)) => field,
+        other => panic!("expected a refusal naming a field, got {other:?}"),
+    }
+}
+
+#[test]
+fn config_round_trips_through_cultcache() {
+    let scratch = Scratch::new();
+    let path = scratch.path("connector.cc");
+    let config = valid();
+    write_config(&path, &config).unwrap();
+    assert_eq!(load_config(&path).unwrap(), config);
+}
+
+#[test]
+fn a_second_record_or_the_wrong_type_is_refused() {
+    let scratch = Scratch::new();
+    let path = scratch.path("two.cc");
+    let config = valid();
+    write_config(&path, &config).unwrap();
+    let mut cache = CultCache::new();
+    cache
+        .register_entry_type::<ClaudeConnectorConfig>()
+        .unwrap();
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&path))
+        .unwrap();
+    cache.pull_all_backing_stores().unwrap();
+    cache.put("extra", &config).unwrap();
+    assert!(matches!(load_config(&path), Err(ConfigError::Store)));
+
+    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+    #[cultcache(type = "gamecult.other.document.v1")]
+    struct Other {
+        #[cultcache(key = 0)]
+        value: u32,
+    }
+    let other = scratch.path("other.cc");
+    let mut cache = CultCache::new();
+    cache.register_entry_type::<Other>().unwrap();
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&other))
+        .unwrap();
+    cache.pull_all_backing_stores().unwrap();
+    cache.put("runtime", &Other { value: 1 }).unwrap();
+    assert!(matches!(load_config(&other), Err(ConfigError::Store)));
+
+    assert!(matches!(
+        load_config(&scratch.path("absent.cc")),
+        Err(ConfigError::Store)
+    ));
+}
+
+#[test]
+fn a_write_refuses_an_invalid_document_and_leaves_no_file() {
+    let scratch = Scratch::new();
+    let path = scratch.path("bad.cc");
+    let mut config = valid();
+    config.callers[0].allowed_models = vec!["opus".to_string()];
+    assert!(write_config(&path, &config).is_err());
+    assert!(!path.exists());
+}
+
+#[test]
+fn config_refuses_aliases_unpriced_models_and_second_callers() {
+    let valid_config = valid();
+    assert_eq!(valid_config.validate().unwrap().port(), 7443);
+
+    let cases: Vec<(&str, Change)> = vec![
+        (
+            "alias allowed",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["opus".to_string()];
+            }),
+        ),
+        (
+            "alias price key",
+            Box::new(|c| {
+                c.prices.insert("sonnet".to_string(), price());
+            }),
+        ),
+        (
+            "bare prefix",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-".to_string()];
+            }),
+        ),
+        (
+            "unpriced allowed",
+            Box::new(|c| {
+                c.prices.remove(OPUS);
+            }),
+        ),
+        (
+            "duplicate allowed",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec![HAIKU.to_string(), HAIKU.to_string()];
+            }),
+        ),
+        (
+            "no allowed",
+            Box::new(|c| c.callers[0].allowed_models.clear()),
+        ),
+        (
+            "second caller",
+            Box::new(|c| {
+                let mut second = c.callers[0].clone();
+                second.caller_runtime_id = "other".to_string();
+                c.callers.push(second);
+            }),
+        ),
+        ("no caller", Box::new(|c| c.callers.clear())),
+    ];
+    let fields = [
+        "allowed_models",
+        "prices",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "callers",
+        "callers",
+    ];
+    for ((name, change), field) in cases.iter().zip(fields) {
+        let mut config = valid();
+        change(&mut config);
+        assert_eq!(refused(&config), field, "{name}");
+    }
+}
+
+#[test]
+fn config_refuses_exposed_listeners_relative_paths_and_empty_bounds() {
+    let cases: Vec<(&str, &str, Change)> = vec![
+        (
+            "wildcard listen",
+            "listen",
+            Box::new(|c| c.listen = "0.0.0.0:7443".into()),
+        ),
+        (
+            "lan listen",
+            "listen",
+            Box::new(|c| c.listen = "192.168.1.9:7443".into()),
+        ),
+        (
+            "hostname listen",
+            "listen",
+            Box::new(|c| c.listen = "localhost:7443".into()),
+        ),
+        (
+            "replay",
+            "replay_store",
+            Box::new(|c| c.replay_store = "replay.cc".into()),
+        ),
+        (
+            "binary",
+            "claude_binary",
+            Box::new(|c| c.claude_binary = "claude".into()),
+        ),
+        ("work", "work_dir", Box::new(|c| c.work_dir = "work".into())),
+        (
+            "config",
+            "config_dir",
+            Box::new(|c| c.config_dir = "cfg".into()),
+        ),
+        (
+            "prompts",
+            "prompt_dir",
+            Box::new(|c| c.prompt_dir = "prompts".into()),
+        ),
+        (
+            "key file",
+            "connection_key_file",
+            Box::new(|c| {
+                c.callers[0].connection_key_file = "caller.key".into();
+            }),
+        ),
+        (
+            "zero pin",
+            "claude_binary_sha256",
+            Box::new(|c| c.claude_binary_sha256 = [0; 32]),
+        ),
+        (
+            "blank instance",
+            "instance",
+            Box::new(|c| c.instance = " ".into()),
+        ),
+        (
+            "credential path",
+            "token_credential",
+            Box::new(|c| c.token_credential = "a/b".into()),
+        ),
+        (
+            "credential parent",
+            "token_credential",
+            Box::new(|c| c.token_credential = "..".into()),
+        ),
+        (
+            "credential empty",
+            "token_credential",
+            Box::new(|c| c.token_credential = String::new()),
+        ),
+        (
+            "zero deadline",
+            "child limits",
+            Box::new(|c| c.deadline_ms = 0),
+        ),
+        (
+            "total below line",
+            "child limits",
+            Box::new(|c| c.max_total_bytes = c.max_line_bytes - 1),
+        ),
+        (
+            "zero frame",
+            "serve limits",
+            Box::new(|c| c.max_frame_bytes = 0),
+        ),
+        (
+            "zero epoch",
+            "connection_key_epoch",
+            Box::new(|c| c.callers[0].connection_key_epoch = 0),
+        ),
+        (
+            "tiny payload",
+            "caller bounds",
+            Box::new(|c| c.callers[0].max_payload_bytes = 16),
+        ),
+        (
+            "no ceiling",
+            "caller bounds",
+            Box::new(|c| c.callers[0].spend_ceiling_micro_usd = 0),
+        ),
+    ];
+    for (name, field, change) in cases {
+        let mut config = valid();
+        change(&mut config);
+        assert_eq!(refused(&config), field, "{name}");
+    }
+}
+
+#[test]
+fn no_refusal_echoes_a_value() {
+    let canary_path: PathBuf = format!("{CANARY}/relative").into();
+    let canaried: Vec<Change> = vec![
+        Box::new(|c| c.listen = format!("{CANARY}:1")),
+        Box::new(|c| c.instance = format!(" {CANARY} ")),
+        Box::new(|c| c.token_credential = format!("{CANARY}/x")),
+        Box::new(|c| c.callers[0].allowed_models = vec![format!("{CANARY}-model")]),
+        Box::new(|c| {
+            c.prices.insert(format!("{CANARY}-alias"), price());
+        }),
+        Box::new(|c| c.callers[0].caller_runtime_id = format!(" {CANARY}")),
+        Box::new({
+            let path = canary_path.clone();
+            move |c| c.replay_store = path.clone()
+        }),
+        Box::new({
+            let path = canary_path.clone();
+            move |c| c.callers[0].connection_key_file = path.clone()
+        }),
+        Box::new(|c| {
+            let mut second = c.callers[0].clone();
+            second.caller_runtime_id = CANARY.to_string();
+            c.callers.push(second);
+        }),
+    ];
+    for change in canaried {
+        let mut config = valid();
+        change(&mut config);
+        let error = config.validate().unwrap_err();
+        for shown in [error.to_string(), format!("{error:?}")] {
+            assert!(!shown.contains(CANARY), "{shown}");
+        }
+        let scratch = Scratch::new();
+        let write = write_config(&scratch.path("x.cc"), &config).unwrap_err();
+        assert!(!format!("{write} {write:?}").contains(CANARY));
+    }
+}
+
+// ---- the binary ----
+
+fn run(args: &[&str], envs: &[(&str, &Path)]) -> Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_claude-connector"));
+    command.args(args).env_clear();
+    for (name, value) in envs {
+        command.env(name, value);
+    }
+    command.output().unwrap()
+}
+
+fn shown(output: &Output) -> String {
+    format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    )
+}
+
+fn init_flags<'a>(scratch: &'a Scratch, extra: &[&'a str]) -> Vec<String> {
+    let path = |name: &str| scratch.path(name).to_string_lossy().into_owned();
+    let mut flags: Vec<String> = [
+        "--listen",
+        "127.0.0.1:0",
+        "--replay-store",
+        &path("replay.cc"),
+        "--claude-binary",
+        &path("claude"),
+        "--claude-sha256",
+        &"ab".repeat(32),
+        "--work-dir",
+        &path("work"),
+        "--config-dir",
+        &path("home"),
+        "--prompt-dir",
+        &path("prompts"),
+        "--instance",
+        "persona-a",
+        "--token-credential",
+        "claude-token",
+        "--caller-id",
+        "persona-a-caller",
+        "--connection-key-file",
+        &path("caller.key"),
+        "--connection-key-epoch",
+        "1",
+        "--spend-ceiling-micro-usd",
+        "50000000",
+        "--spend-window-ms",
+        "3600000",
+        "--allowed-model",
+        HAIKU,
+        "--price",
+        &format!("{HAIKU}:1000000:5000000:1250000:100000:100"),
+    ]
+    .map(String::from)
+    .to_vec();
+    flags.extend(extra.iter().map(|flag| flag.to_string()));
+    flags
+}
+
+fn init(scratch: &Scratch, flags: &[String]) -> Output {
+    let config = scratch.path("connector.cc");
+    let mut args = vec!["config", "init", config.to_str().unwrap()];
+    args.extend(flags.iter().map(String::as_str));
+    run(&args, &[])
+}
+
+#[test]
+fn config_init_then_check_reports_counts_only() {
+    let scratch = Scratch::new();
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = load_config(&scratch.path("connector.cc")).unwrap();
+    assert_eq!(config.callers[0].allowed_models, [HAIKU]);
+    assert_eq!(config.prices[HAIKU].rates.output, 5_000_000);
+    assert_eq!(config.prices[HAIKU].rates.cache_write_long, 1_250_000);
+    assert_eq!(config.prices[HAIKU].overhead_tokens, 100);
+    assert_eq!(config.claude_binary_sha256, [0xab; 32]);
+
+    let checked = run(
+        &[
+            "config",
+            "check",
+            scratch.path("connector.cc").to_str().unwrap(),
+        ],
+        &[],
+    );
+    assert!(checked.status.success());
+    let text = shown(&checked);
+    assert!(text.contains("callers: 1") && text.contains("allowed_models: 1"));
+    assert!(text.contains("prices: 1"));
+    assert!(!text.contains("persona-a") && !text.contains(HAIKU));
+}
+
+#[test]
+fn the_binary_refuses_without_echoing_what_it_was_given() {
+    let spaced = format!(" {CANARY}");
+    // Each pair replaces the value of an existing flag; the others are appended.
+    let replaced: Vec<(&str, &str)> = vec![
+        ("--listen", CANARY),
+        ("--claude-sha256", CANARY),
+        ("--price", CANARY),
+        ("--instance", &spaced),
+        ("--connection-key-epoch", CANARY),
+        ("--allowed-model", CANARY),
+    ];
+    let appended: Vec<Vec<&str>> = vec![
+        vec![CANARY, CANARY],
+        vec!["--listen"],
+        vec!["--listen", "127.0.0.1:1"],
+    ];
+    let mut attempts: Vec<Vec<String>> = Vec::new();
+    for (name, value) in replaced {
+        let scratch = Scratch::new();
+        let mut flags = init_flags(&scratch, &[]);
+        let at = flags.iter().position(|flag| flag == name).unwrap();
+        flags[at + 1] = value.to_string();
+        attempts.push(flags);
+    }
+    for extra in appended {
+        let scratch = Scratch::new();
+        attempts.push(init_flags(&scratch, &extra));
+    }
+    for flags in attempts {
+        let scratch = Scratch::new();
+        let made = init(&scratch, &flags);
+        assert!(!made.status.success(), "{flags:?}");
+        assert!(!shown(&made).contains(CANARY), "{}", shown(&made));
+        assert!(!scratch.path("connector.cc").exists());
+    }
+
+    // A missing flag is refused by name.
+    let scratch = Scratch::new();
+    let mut flags = init_flags(&scratch, &[]);
+    let at = flags.iter().position(|f| f == "--instance").unwrap();
+    flags.drain(at..at + 2);
+    let made = init(&scratch, &flags);
+    assert!(!made.status.success());
+    assert!(shown(&made).contains("--instance"));
+}
+
+#[cfg(unix)]
+#[test]
+fn serve_refuses_an_unsafe_prompt_dir_and_prints_no_credential() {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    let scratch = Scratch::new();
+    let credentials = scratch.path("credentials");
+    std::fs::create_dir_all(&credentials).unwrap();
+    std::fs::write(credentials.join("claude-token"), CANARY).unwrap();
+    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = scratch.path("connector.cc");
+    let serve = |config: &Path| {
+        run(
+            &["serve", "--config", config.to_str().unwrap()],
+            &[("CREDENTIALS_DIRECTORY", &credentials)],
+        )
+    };
+
+    // No prompt directory, then one others can enter, then a link to a good one.
+    let prompts = scratch.path("prompts");
+    let refused = serve(&config);
+    assert!(!refused.status.success());
+    assert!(
+        shown(&refused).contains("prompt directory"),
+        "{}",
+        shown(&refused)
+    );
+    std::fs::create_dir_all(&prompts).unwrap();
+    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o755)).unwrap();
+    let open = serve(&config);
+    assert!(
+        shown(&open).contains("prompt directory"),
+        "{}",
+        shown(&open)
+    );
+    assert!(claude_connector::check_prompt_dir(&prompts).is_err());
+    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o700)).unwrap();
+    assert!(claude_connector::check_prompt_dir(&prompts).is_ok());
+    let linked = scratch.path("linked");
+    symlink(&prompts, &linked).unwrap();
+    assert!(claude_connector::check_prompt_dir(&linked).is_err());
+
+    // A safe directory but no claude binary: the backend is not ready, and
+    // nothing the credential holds is printed.
+    let not_ready = serve(&config);
+    assert!(!not_ready.status.success());
+    for output in [&refused, &open, &not_ready] {
+        let text = shown(output);
+        assert!(
+            !text.contains(CANARY) && !text.contains("caller-secret"),
+            "{text}"
+        );
+    }
+}

From 83c93b2bb845e77c9ea8934d3e8c2744299f6c89 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 11:35:44 +0100
Subject: [PATCH 03/37] claude-connector: pin the config envelope, exact bounds
 and the prompt-dir type check

Mutation survivors of the first pass: each part of the typed envelope (key,
type, schema id, canonical encoding) is refused alone; the exact boundaries of
the child and caller bounds, every serve limit and the bare model prefix are
pinned; a private regular file is not a prompt directory; a short sha256 is
refused.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../claude-connector/tests/config_document.rs | 99 ++++++++++++++++++-
 1 file changed, 97 insertions(+), 2 deletions(-)

diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 89f92bf..2bc14f2 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -8,8 +8,11 @@ use std::process::{Command, Output};
 use std::sync::atomic::{AtomicUsize, Ordering};
 
 use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
-use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
-use model_connector::{CallerConfig, ModelPrice, Rates};
+use cultcache_rs::{
+    CacheBackingStore, CultCache, CultCacheEnvelope, DatabaseEntry,
+    SingleFileMessagePackBackingStore,
+};
+use model_connector::{CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
 
 const CANARY: &str = "canary-9f3b7c1d";
 const OPUS: &str = "claude-opus-5";
@@ -146,6 +149,85 @@ fn a_second_record_or_the_wrong_type_is_refused() {
     ));
 }
 
+fn store_raw(path: &Path, key: &str, ty: &str, schema: Option<&str>, payload: Vec<u8>) {
+    let mut store = SingleFileMessagePackBackingStore::new(path);
+    store
+        .push(&CultCacheEnvelope {
+            key: key.to_string(),
+            r#type: ty.to_string(),
+            payload,
+            stored_at: "2026-10-29T00:00:00Z".to_string(),
+            schema_id: schema.map(str::to_string),
+        })
+        .unwrap();
+}
+
+#[test]
+fn the_envelope_must_be_exactly_the_documents_key_type_schema_and_encoding() {
+    let scratch = Scratch::new();
+    let canonical = rmp_serde::to_vec(&valid()).unwrap();
+    let ty = ClaudeConnectorConfig::TYPE;
+    let mut trailing = canonical.clone();
+    trailing.push(0xc0);
+
+    let cases = vec![
+        ("wrong key", "other", ty, Some(ty), canonical.clone()),
+        (
+            "wrong type",
+            "runtime",
+            "gamecult.other.v1",
+            Some(ty),
+            canonical.clone(),
+        ),
+        (
+            "wrong schema",
+            "runtime",
+            ty,
+            Some("gamecult.other.v1"),
+            canonical.clone(),
+        ),
+        ("not canonical", "runtime", ty, Some(ty), trailing),
+    ];
+    for (name, key, ty, schema, payload) in cases {
+        let path = scratch.path(&format!("{}.cc", name.replace(' ', "-")));
+        store_raw(&path, key, ty, schema, payload);
+        assert!(
+            matches!(load_config(&path), Err(ConfigError::Store)),
+            "{name}"
+        );
+    }
+
+    // The same bytes with every part right load.
+    let path = scratch.path("right.cc");
+    store_raw(&path, "runtime", ty, Some(ty), canonical);
+    assert_eq!(load_config(&path).unwrap(), valid());
+}
+
+#[test]
+fn bounds_sit_exactly_where_the_connector_needs_them() {
+    let mut config = valid();
+    config.max_total_bytes = config.max_line_bytes;
+    config.validate().unwrap();
+    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES;
+    config.validate().unwrap();
+    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES - 1;
+    assert_eq!(refused(&config), "caller bounds");
+
+    for set in [
+        (|c: &mut ClaudeConnectorConfig| c.max_connections = 0) as fn(&mut ClaudeConnectorConfig),
+        |c| c.socket_timeout_ms = 0,
+        |c| c.max_expiry_skew_ms = 0,
+        |c| c.max_frame_bytes = 0,
+    ] {
+        let mut config = valid();
+        set(&mut config);
+        assert_eq!(refused(&config), "serve limits");
+    }
+    let mut config = valid();
+    config.prices.insert("claude-".to_string(), price());
+    assert_eq!(refused(&config), "prices");
+}
+
 #[test]
 fn a_write_refuses_an_invalid_document_and_leaves_no_file() {
     let scratch = Scratch::new();
@@ -473,6 +555,7 @@ fn the_binary_refuses_without_echoing_what_it_was_given() {
     let replaced: Vec<(&str, &str)> = vec![
         ("--listen", CANARY),
         ("--claude-sha256", CANARY),
+        ("--claude-sha256", "abcd"),
         ("--price", CANARY),
         ("--instance", &spaced),
         ("--connection-key-epoch", CANARY),
@@ -569,3 +652,15 @@ fn serve_refuses_an_unsafe_prompt_dir_and_prints_no_credential() {
         );
     }
 }
+
+#[cfg(unix)]
+#[test]
+fn a_private_regular_file_is_not_a_prompt_dir() {
+    use std::os::unix::fs::PermissionsExt;
+    let scratch = Scratch::new();
+    let file = scratch.path("file");
+    std::fs::write(&file, "x").unwrap();
+    std::fs::set_permissions(&file, std::fs::Permissions::from_mode(0o700)).unwrap();
+    assert!(claude_connector::check_prompt_dir(&file).is_err());
+    assert!(claude_connector::check_prompt_dir(&scratch.path("absent")).is_err());
+}

From 2f2f7a9db51239e41594307b4a52c783bfc0065b Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 12:08:29 +0100
Subject: [PATCH 04/37] claude-connector: pre-spawn failures bill zero, model
 ids and prices are fuses, check runs serve's readiness, serve errors name
 fields

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/backend.rs        |  60 +++--
 crates/claude-connector/src/backend/tests.rs  |  49 +++-
 crates/claude-connector/src/daemon.rs         | 235 ++++++++++++++++--
 crates/claude-connector/src/lib.rs            |   2 +-
 crates/claude-connector/src/main.rs           |   7 +-
 crates/claude-connector/src/stream.rs         |  18 +-
 .../claude-connector/tests/config_document.rs | 231 ++++++++++++++++-
 crates/model-connector/src/serve.rs           |  29 ++-
 .../model-connector/tests/reasoning_state.rs  |   8 +-
 9 files changed, 561 insertions(+), 78 deletions(-)

diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index 2b27368..c5a8f81 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -110,12 +110,7 @@ impl ClaudeCodeBackend {
     /// The one pin check: `ready` and every spawn use it, and nothing caches
     /// its answer.
     fn binary_matches_pin(&self) -> bool {
-        let Ok(mut file) = File::open(&self.config.claude_binary) else {
-            return false;
-        };
-        let mut hasher = Sha256::new();
-        io::copy(&mut file, &mut hasher).is_ok()
-            && <[u8; 32]>::from(hasher.finalize()) == self.config.claude_binary_sha256
+        binary_matches_pin(&self.config)
     }
 
     fn run(&self, request: &ProviderRequest) -> (Vec<TransportEvent>, TransportOutcome) {
@@ -137,13 +132,13 @@ impl ClaudeCodeBackend {
             );
         };
         if !self.binary_matches_pin() {
-            return failure(Failure::unbilled(
+            return failure(Failure::never_reached(
                 FailureKind::Provider,
                 "claude-code: the claude binary does not match its pin",
             ));
         }
         let Ok(prompt) = PromptFile::create(&self.config.prompt_dir, &request.instructions) else {
-            return failure(Failure::unbilled(
+            return failure(Failure::never_reached(
                 FailureKind::Provider,
                 "claude-code: the system prompt could not be staged",
             ));
@@ -159,7 +154,7 @@ impl ClaudeCodeBackend {
             stdin_bytes(plan.blocks()),
         );
         let Ok(mut child) = spawned else {
-            return failure(Failure::unbilled(
+            return failure(Failure::never_reached(
                 FailureKind::Provider,
                 "claude-code: the child could not be spawned",
             ));
@@ -224,12 +219,8 @@ impl ClaudeCodeBackend {
 }
 
 impl ProviderBackend for ClaudeCodeBackend {
-    fn ready(&self) -> bool {
-        self.config.work_dir.is_dir()
-            && self.config.config_dir.is_dir()
-            && self.config.prompt_dir.is_dir()
-            && self.tokens.read().is_some()
-            && self.binary_matches_pin()
+    fn ready(&self) -> Result<(), &'static str> {
+        readiness(&self.config, self.tokens.as_ref())
     }
 
     fn provider(&self) -> &str {
@@ -256,19 +247,19 @@ fn read_stream(
                 }
             }
             StdoutRead::Eof => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Provider,
                     "claude-code: the stream ended without a result",
                 ));
             }
             StdoutRead::Timeout => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Timeout,
                     "claude-code: the deadline passed before a result",
                 ));
             }
             StdoutRead::Breach => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Provider,
                     "claude-code: the output passed its size cap",
                 ));
@@ -280,6 +271,39 @@ fn read_stream(
     finished
 }
 
+fn binary_matches_pin(config: &ClaudeCodeConfig) -> bool {
+    let Ok(mut file) = File::open(&config.claude_binary) else {
+        return false;
+    };
+    let mut hasher = Sha256::new();
+    io::copy(&mut file, &mut hasher).is_ok()
+        && <[u8; 32]>::from(hasher.finalize()) == config.claude_binary_sha256
+}
+
+/// Whether the backend can take work, naming the first config field that
+/// cannot be used. `config check` and `serve` both ask this.
+pub(crate) fn readiness(
+    config: &ClaudeCodeConfig,
+    tokens: &dyn TokenSource,
+) -> Result<(), &'static str> {
+    if !config.work_dir.is_dir() {
+        return Err("work_dir");
+    }
+    if !config.config_dir.is_dir() {
+        return Err("config_dir");
+    }
+    if !config.prompt_dir.is_dir() {
+        return Err("prompt_dir");
+    }
+    if tokens.read().is_none() {
+        return Err("token_credential");
+    }
+    if !binary_matches_pin(config) {
+        return Err("claude_binary_sha256");
+    }
+    Ok(())
+}
+
 fn zero_usage() -> Usage {
     Usage {
         input_tokens: 0,
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 5a8939d..86130b7 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -633,7 +633,7 @@ fn ready_checks_the_pinned_binary_digest() {
     std::fs::create_dir_all(&cfg).unwrap();
     let binary = dir.path().join("claude");
 
-    let ready = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
+    let ready_field = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
         let mut config = config(dir.path(), INSTANCE, limits());
         config.claude_binary = binary.to_path_buf();
         config.claude_binary_sha256 = sha;
@@ -643,8 +643,27 @@ fn ready_checks_the_pinned_binary_digest() {
         let tokens = Box::new(FixedToken(token.then_some("t")));
         ready_backend(config, tokens).ready()
     };
+    let ready = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
+        ready_field(sha, binary, work, prompts, token).is_ok()
+    };
     let prompts = dir.path().join("prompts");
     let pin = pin_of(PINNED);
+    assert_eq!(
+        ready_field([0; 32], &binary, &work, &prompts, true),
+        Err("claude_binary_sha256")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &dir.path().join("absent"), &prompts, true),
+        Err("work_dir")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &work, &dir.path().join("absent"), true),
+        Err("prompt_dir")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &work, &prompts, false),
+        Err("token_credential")
+    );
 
     assert!(ready(pin, &binary, &work, &prompts, true));
     assert!(!ready([0; 32], &binary, &work, &prompts, true), "other pin");
@@ -702,7 +721,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
     let mut door = Door::new();
 
     // The variable is set and the file is absent: nothing to give the child.
-    assert!(!backend.ready());
+    assert_eq!(backend.ready(), Err("token_credential"));
     let (claim, _) = door.begin(request(vec![user("hi")]));
     let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
     assert_eq!(kind, FailureKind::Authentication);
@@ -717,7 +736,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
         format!("{CANARY_TOKEN}\n"),
     )
     .unwrap();
-    assert!(backend.ready());
+    assert_eq!(backend.ready(), Ok(()));
     let mut door = Door::new();
     let (claim, _) = door.begin(request(vec![user("hi")]));
     let result = backend.execute(claim.call());
@@ -730,7 +749,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
 
     // An empty credential is no token.
     std::fs::write(credentials.join("claude-token"), "\n").unwrap();
-    assert!(!backend.ready());
+    assert_eq!(backend.ready(), Err("token_credential"));
 }
 
 #[test]
@@ -1369,9 +1388,11 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
     );
     let mut door = Door::new();
     let (claim, _) = door.begin(request(vec![user("hi")]));
-    let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
+    let result = backend.execute(claim.call());
+    let (kind, message, usage) = failure_of(&result);
     assert_eq!(kind, FailureKind::Provider);
-    assert_eq!(usage, None);
+    assert_eq!(usage, Some(usage_zero()), "a child that never ran bills nothing");
+    assert_eq!(parts(&result).1.cost_micro_usd, 0);
     assert!(
         !message.contains(dir.path().to_str().unwrap()),
         "no path in a message"
@@ -1619,12 +1640,14 @@ fn prompt_file_lives_in_prompt_dir_exclusively() {
         Some(rig.dir.path().join("prompts").as_path())
     );
 
-    // A prompt directory that cannot take the file fails staging: the failure
-    // is the unbilled constructor's, and no child runs.
+    // A prompt directory that cannot take the file fails staging: nothing
+    // reached the provider, so it bills nothing, and no child runs.
     let rig = rig_for(INSTANCE, vec![ok_script(SESSION, "x")], &[SESSION], b"");
     std::fs::remove_dir_all(rig.dir.path().join("prompts")).unwrap();
-    let (kind, _, usage) = failure_of(&rig.run(request(vec![user("hi")])));
-    assert_eq!((kind, usage), (FailureKind::Provider, None));
+    let result = rig.run(request(vec![user("hi")]));
+    let (kind, _, usage) = failure_of(&result);
+    assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
+    assert_eq!(parts(&result).1.cost_micro_usd, 0);
     assert_eq!(rig.spawns(), 0);
 }
 
@@ -1638,8 +1661,10 @@ fn pin_is_checked_before_every_spawn() {
 
     // The binary is swapped after readiness: the next call never spawns.
     std::fs::write(&binary, b"swapped bytes").unwrap();
-    let (kind, message, usage) = failure_of(&rig.run(request(vec![user("hi")])));
-    assert_eq!((kind, usage), (FailureKind::Provider, None));
+    let result = rig.run(request(vec![user("hi")]));
+    let (kind, message, usage) = failure_of(&result);
+    assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
+    assert_eq!(parts(&result).1.cost_micro_usd, 0, "billed nothing, not the reservation");
     assert!(!message.contains(rig.dir.path().to_str().unwrap()));
     assert_eq!(rig.spawns(), 1, "no child for a binary off its pin");
     assert!(!rig.backend.binary_matches_pin());
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 8debb4b..5a6e592 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -11,11 +11,15 @@ use std::time::Duration;
 
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
-    CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ServeError, ServeLimits, load_admissions, serve,
+    CallerAdmission, CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ServeError, ServeLimits,
+    ServiceError, load_admissions, serve,
 };
 use thiserror::Error;
 
-use crate::{ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, StderrSink};
+use crate::backend::readiness;
+use crate::{
+    ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink,
+};
 
 const CONFIG_KEY: &str = "runtime";
 const MODEL_PREFIX: &str = "claude-";
@@ -81,8 +85,39 @@ pub enum ConfigError {
     PromptDir,
     #[error("the listener could not be bound")]
     Listen,
-    #[error(transparent)]
-    Serve(#[from] ServeError),
+    /// Something the document names exists but cannot be used now.
+    #[error("the configured {0} cannot be used")]
+    Unusable(&'static str),
+    /// The serve loop failed after it started.
+    #[error("the serve loop failed at {0}")]
+    Serving(&'static str),
+}
+
+/// The kit's serve errors carry stored paths, ids and numbers; none of that
+/// text is shown. Each maps to the configuration field or stage it names.
+impl From<ServeError> for ConfigError {
+    fn from(error: ServeError) -> Self {
+        match error {
+            ServeError::InvalidConfig(field) | ServeError::BackendUnready(field) => {
+                Self::Unusable(field)
+            }
+            ServeError::FrameBound { .. } => Self::Invalid("max_frame_bytes"),
+            ServeError::ConnectionKey(_) => Self::Unusable("connection_key_file"),
+            ServeError::Service(error) => match error {
+                ServiceError::ReplayStore(_) => Self::Unusable("replay_store"),
+                ServiceError::UnpricedModel(_) => Self::Invalid("prices"),
+                ServiceError::InvalidAdmission
+                | ServiceError::DuplicateCaller
+                | ServiceError::SharedCallerKey => Self::Invalid("callers"),
+                _ => Self::Serving("service"),
+            },
+            ServeError::ServicePoisoned => Self::Serving("service"),
+            ServeError::Listen(_) => Self::Serving("listener"),
+            ServeError::Thread(_) | ServeError::Connection(_) => Self::Serving("connection"),
+            ServeError::FrameSize | ServeError::FrameEncoding => Self::Serving("frame"),
+            ServeError::Clock => Self::Serving("clock"),
+        }
+    }
 }
 
 impl ClaudeConnectorConfig {
@@ -162,7 +197,11 @@ impl ClaudeConnectorConfig {
                 return Err(ConfigError::Invalid("allowed_models"));
             }
         }
-        if !self.prices.keys().all(|model| is_canonical_model(model)) {
+        if !self
+            .prices
+            .iter()
+            .all(|(model, price)| is_canonical_model(model) && is_fully_priced(price))
+        {
             return Err(ConfigError::Invalid("prices"));
         }
         Ok(listen)
@@ -200,14 +239,45 @@ fn is_trimmed_nonempty(text: &str) -> bool {
     !text.is_empty() && text.trim() == text
 }
 
-/// A model id the CLI echoes back unchanged: aliases are refused because the
-/// stream's `init.model` must equal the requested model.
+/// A model id the CLI echoes back unchanged: `claude-<family>-<major>-<minor>`
+/// with an optional `-YYYYMMDD` suffix, the family lowercase letters. Aliases
+/// and bare prefixes are refused because the stream's `init.model` must equal
+/// the requested model.
 fn is_canonical_model(model: &str) -> bool {
-    model.starts_with(MODEL_PREFIX)
-        && model.len() > MODEL_PREFIX.len()
-        && model
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_'))
+    let Some(rest) = model.strip_prefix(MODEL_PREFIX) else {
+        return false;
+    };
+    let digits = |part: &str, most: usize| {
+        (1..=most).contains(&part.len()) && part.bytes().all(|byte| byte.is_ascii_digit())
+    };
+    let mut parts = rest.split('-');
+    let family = parts.next().unwrap_or("");
+    let major = parts.next().unwrap_or("");
+    let minor = parts.next().unwrap_or("");
+    let date = parts.next();
+    !family.is_empty()
+        && family.bytes().all(|byte| byte.is_ascii_lowercase())
+        && digits(major, 2)
+        && digits(minor, 2)
+        && date.is_none_or(|date| date.len() == 8 && digits(date, 8))
+        && parts.next().is_none()
+}
+
+/// A price is a fuse only if every component it bills is nonzero: a zero rate
+/// lets a call cost nothing against the caller's ceiling.
+fn is_fully_priced(price: &ModelPrice) -> bool {
+    let long = price.long_context.map(|long| long.rates);
+    [Some(price.rates), long].into_iter().flatten().all(|rates| {
+        [
+            rates.input,
+            rates.cache_write_short,
+            rates.cache_write_long,
+            rates.cache_read,
+            rates.output,
+        ]
+        .iter()
+        .all(|rate| *rate > 0)
+    })
 }
 
 /// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
@@ -286,24 +356,49 @@ pub fn check_prompt_dir(dir: &Path) -> Result<(), ConfigError> {
 
 /// The child's stderr is the log's business by size only: its bytes are never
 /// written anywhere the connector controls.
-struct LogSink;
+struct LogSink<W>(std::sync::Mutex<W>);
 
-impl StderrSink for LogSink {
+impl<W: std::io::Write + Send> StderrSink for LogSink<W> {
     fn stderr_tail(&self, tail: &[u8]) {
-        eprintln!("claude-connector: child stderr, {} bytes", tail.len());
+        if let Ok(mut log) = self.0.lock() {
+            let _ = writeln!(log, "claude-connector: child stderr, {} bytes", tail.len());
+        }
     }
 }
 
+/// Everything `serve` needs true before it binds, in one place so that
+/// `config check` passes exactly what `serve` will start: the prompt
+/// directory, the other directories, the credential, the pin, the connection
+/// key and the frame and connection bounds. Returns the admitted callers.
+fn readiness_of(config: &ClaudeConnectorConfig) -> Result<Vec<CallerAdmission>, ConfigError> {
+    config.validate()?;
+    #[cfg(unix)]
+    check_prompt_dir(&config.prompt_dir)?;
+    let admissions = load_admissions(&config.callers)?;
+    config.serve_limits().validate(&admissions)?;
+    let backend = config.backend_config();
+    readiness(
+        &backend,
+        &CredentialTokenSource::from_environment(backend.token_credential.clone()),
+    )
+    .map_err(ConfigError::Unusable)?;
+    Ok(admissions)
+}
+
+/// Whether `serve` would start with this document and this environment.
+pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
+    readiness_of(config).map(drop)
+}
+
 /// Loads the document and serves until the listener fails.
 #[cfg(unix)]
 pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
     let config = load_config(path)?;
+    let admissions = readiness_of(&config)?;
     let listen = config.validate()?;
-    check_prompt_dir(&config.prompt_dir)?;
-    let admissions = load_admissions(&config.callers)?;
     let backend = Arc::new(ClaudeCodeBackend::new(
         config.backend_config(),
-        Box::new(LogSink),
+        Box::new(LogSink(std::sync::Mutex::new(std::io::stderr()))),
     ));
     let listener = TcpListener::bind(listen).map_err(|_| ConfigError::Listen)?;
     serve(
@@ -316,3 +411,107 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
     )?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{Arc, Mutex};
+
+    use super::*;
+
+    /// A log that a test can read back.
+    #[derive(Clone, Default)]
+    struct Captured(Arc<Mutex<Vec<u8>>>);
+
+    impl std::io::Write for Captured {
+        fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+            self.0.lock().unwrap().extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn the_log_gets_the_size_of_the_childs_stderr_and_never_its_bytes() {
+        let log = Captured::default();
+        let sink = LogSink(Mutex::new(log.clone()));
+        sink.stderr_tail(b"canary-stderr-text, 22 bytes");
+        let written = String::from_utf8(log.0.lock().unwrap().clone()).unwrap();
+        assert_eq!(written, "claude-connector: child stderr, 28 bytes
+");
+        assert!(!written.contains("canary"));
+    }
+
+    #[cfg(unix)]
+    mod prompt_dir {
+        use std::os::unix::fs::{PermissionsExt, chown, symlink};
+        use std::path::PathBuf;
+
+        use super::super::check_prompt_dir;
+
+        struct Dir(PathBuf);
+
+        impl Dir {
+            fn new(name: &str) -> Self {
+                let path = std::env::temp_dir()
+                    .join(format!("claude-prompt-dir-{}-{name}", std::process::id()));
+                let _ = std::fs::remove_dir_all(&path);
+                std::fs::create_dir_all(&path).unwrap();
+                Self(path)
+            }
+            fn mode(&self, mode: u32) {
+                std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(mode)).unwrap();
+            }
+        }
+
+        impl Drop for Dir {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+
+        #[test]
+        fn only_mode_0700_passes() {
+            let dir = Dir::new("modes");
+            dir.mode(0o700);
+            assert!(check_prompt_dir(&dir.0).is_ok());
+            // Each of these leaves the owner able to enter, or adds a bit
+            // beyond the owner's three; all are refused.
+            for mode in [
+                0o500, 0o300, 0o100, 0o600, 0o770, 0o707, 0o750, 0o755, 0o1700, 0o2700, 0o4700,
+            ] {
+                dir.mode(mode);
+                assert!(check_prompt_dir(&dir.0).is_err(), "{mode:o}");
+            }
+        }
+
+        #[test]
+        fn a_link_to_a_good_directory_is_refused() {
+            let dir = Dir::new("link-target");
+            dir.mode(0o700);
+            let link = std::env::temp_dir()
+                .join(format!("claude-prompt-dir-{}-link", std::process::id()));
+            let _ = std::fs::remove_file(&link);
+            symlink(&dir.0, &link).unwrap();
+            let refused = check_prompt_dir(&link).is_err();
+            std::fs::remove_file(&link).unwrap();
+            assert!(refused);
+        }
+
+        #[test]
+        fn a_directory_owned_by_another_user_is_refused() {
+            // SAFETY: geteuid has no preconditions and cannot fail.
+            if unsafe { libc::geteuid() } != 0 {
+                eprintln!("skipped: only root can give a directory away");
+                return;
+            }
+            let dir = Dir::new("owner");
+            dir.mode(0o700);
+            assert!(check_prompt_dir(&dir.0).is_ok());
+            chown(&dir.0, Some(1234), None).unwrap();
+            assert!(check_prompt_dir(&dir.0).is_err());
+        }
+    }
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 2ca22bf..ef3e404 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -13,7 +13,7 @@ mod stream;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
-pub use daemon::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+pub use daemon::{ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config};
 #[cfg(unix)]
 pub use daemon::{check_prompt_dir, serve_config};
 pub use handle::{FsSessionStore, SessionStore};
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index f4b7004..ece39cc 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -12,7 +12,9 @@ use std::collections::BTreeMap;
 use std::path::PathBuf;
 use std::process::ExitCode;
 
-use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+use claude_connector::{
+    ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config,
+};
 use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
 
 fn main() -> ExitCode {
@@ -59,7 +61,8 @@ fn serve(_: &str) -> Result<(), Failure> {
 
 fn check(path: &str) -> Result<(), Failure> {
     let config = load_config(path.as_ref())?;
-    println!("claude connector configuration is valid");
+    check_ready(&config)?;
+    println!("claude connector configuration is valid and ready to serve");
     println!("callers: {}", config.callers.len());
     println!("allowed_models: {}", config.callers[0].allowed_models.len());
     println!("prices: {}", config.prices.len());
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index e323662..e99935f 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -8,7 +8,8 @@ use serde::Deserialize;
 use serde_json::Value;
 
 /// A call that cannot complete, with the stage that failed. `usage` is `None`
-/// unless a result event reported it.
+/// (the kit bills its reservation) unless a result event reported it or the
+/// call never reached the provider (zero).
 #[derive(Debug, PartialEq, Eq)]
 pub(crate) struct Failure {
     pub kind: FailureKind,
@@ -17,13 +18,24 @@ pub(crate) struct Failure {
 }
 
 impl Failure {
-    pub(crate) fn unbilled(kind: FailureKind, message: &'static str) -> Self {
+    /// A failure after the child ran: what the provider billed is unknown, so
+    /// the kit bills its reservation.
+    pub(crate) fn cost_unknown(kind: FailureKind, message: &'static str) -> Self {
         Self {
             kind,
             message,
             usage: None,
         }
     }
+
+    /// A failure before anything was sent to the provider: it bills nothing.
+    pub(crate) fn never_reached(kind: FailureKind, message: &'static str) -> Self {
+        Self {
+            kind,
+            message,
+            usage: Some(sum_usage(std::iter::empty())),
+        }
+    }
 }
 
 /// What the stream said, once its result event arrived.
@@ -252,7 +264,7 @@ impl<'a> StreamState<'a> {
 }
 
 fn fail(kind: FailureKind, message: &'static str) -> Step {
-    Step::Done(Box::new(Err(Failure::unbilled(kind, message))))
+    Step::Done(Box::new(Err(Failure::cost_unknown(kind, message))))
 }
 
 /// What this turn consumed, summed over every model it used (harness side
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 2bc14f2..39f377d 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -15,7 +15,7 @@ use cultcache_rs::{
 use model_connector::{CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
 
 const CANARY: &str = "canary-9f3b7c1d";
-const OPUS: &str = "claude-opus-5";
+const OPUS: &str = "claude-opus-5-1";
 const HAIKU: &str = "claude-haiku-5-5";
 
 /// An edit that should make the valid document refuse.
@@ -262,6 +262,48 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
                 c.callers[0].allowed_models = vec!["claude-".to_string()];
             }),
         ),
+        (
+            "family only",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-haiku".to_string()];
+                c.prices.insert("claude-haiku".to_string(), price());
+            }),
+        ),
+        (
+            "latest alias",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-sonnet-latest".to_string()];
+                c.prices.insert("claude-sonnet-latest".to_string(), price());
+            }),
+        ),
+        (
+            "no minor",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5".to_string()];
+                c.prices.insert("claude-opus-5".to_string(), price());
+            }),
+        ),
+        (
+            "uppercase family",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-Opus-5-1".to_string()];
+                c.prices.insert("claude-Opus-5-1".to_string(), price());
+            }),
+        ),
+        (
+            "short date",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5-1-2026".to_string()];
+                c.prices.insert("claude-opus-5-1-2026".to_string(), price());
+            }),
+        ),
+        (
+            "trailing part",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5-1-20260101-x".to_string()];
+                c.prices.insert("claude-opus-5-1-20260101-x".to_string(), price());
+            }),
+        ),
         (
             "unpriced allowed",
             Box::new(|c| {
@@ -295,6 +337,12 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
         "allowed_models",
         "allowed_models",
         "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
         "callers",
         "callers",
     ];
@@ -305,6 +353,44 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
     }
 }
 
+#[test]
+fn a_dated_canonical_id_is_allowed() {
+    let dated = "claude-opus-5-1-20260101".to_string();
+    let mut config = valid();
+    config.callers[0].allowed_models = vec![dated.clone()];
+    config.prices.insert(dated, price());
+    config.validate().unwrap();
+}
+
+#[test]
+fn a_price_with_a_zero_billed_component_is_refused() {
+    let zeroed: Vec<(&str, fn(&mut Rates))> = vec![
+        ("input", |r| r.input = 0),
+        ("cache_write_short", |r| r.cache_write_short = 0),
+        ("cache_write_long", |r| r.cache_write_long = 0),
+        ("cache_read", |r| r.cache_read = 0),
+        ("output", |r| r.output = 0),
+    ];
+    for (name, zero) in &zeroed {
+        let mut config = valid();
+        zero(&mut config.prices.get_mut(HAIKU).unwrap().rates);
+        assert_eq!(refused(&config), "prices", "{name}");
+
+        let mut config = valid();
+        let mut long = price().rates;
+        zero(&mut long);
+        config.prices.get_mut(HAIKU).unwrap().long_context = Some(model_connector::LongContext {
+            above_prompt_tokens: 200_000,
+            rates: long,
+        });
+        assert_eq!(refused(&config), "prices", "long context {name}");
+    }
+    // A zero overhead is not a rate.
+    let mut config = valid();
+    config.prices.get_mut(HAIKU).unwrap().overhead_tokens = 0;
+    config.validate().unwrap();
+}
+
 #[test]
 fn config_refuses_exposed_listeners_relative_paths_and_empty_bounds() {
     let cases: Vec<(&str, &str, Change)> = vec![
@@ -522,7 +608,7 @@ fn init(scratch: &Scratch, flags: &[String]) -> Output {
 }
 
 #[test]
-fn config_init_then_check_reports_counts_only() {
+fn config_init_writes_the_flags_into_the_document() {
     let scratch = Scratch::new();
     let made = init(&scratch, &init_flags(&scratch, &[]));
     assert!(made.status.success(), "{}", shown(&made));
@@ -532,20 +618,155 @@ fn config_init_then_check_reports_counts_only() {
     assert_eq!(config.prices[HAIKU].rates.cache_write_long, 1_250_000);
     assert_eq!(config.prices[HAIKU].overhead_tokens, 100);
     assert_eq!(config.claude_binary_sha256, [0xab; 32]);
+}
 
+/// A scratch directory in which `serve` would start: every directory, the
+/// pinned binary, the connection key and the credential exist. Returns the
+/// `config init` flags and the credential directory.
+#[cfg(unix)]
+fn prepare(scratch: &Scratch) -> (Vec<String>, PathBuf) {
+    use sha2::{Digest, Sha256};
+    use std::os::unix::fs::PermissionsExt;
+
+    for name in ["work", "home", "prompts", "credentials"] {
+        std::fs::create_dir_all(scratch.path(name)).unwrap();
+    }
+    std::fs::set_permissions(
+        scratch.path("prompts"),
+        std::fs::Permissions::from_mode(0o700),
+    )
+    .unwrap();
+    std::fs::write(scratch.path("credentials/claude-token"), CANARY).unwrap();
+    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
+    std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
+    let sha: String = Sha256::digest(b"pinned claude")
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect();
+    let mut flags = init_flags(scratch, &[]);
+    let at = flags.iter().position(|flag| flag == "--claude-sha256").unwrap();
+    flags[at + 1] = sha;
+    (flags, scratch.path("credentials"))
+}
+
+#[cfg(unix)]
+fn check_and_serve(config: &Path, credentials: Option<&Path>) -> (Output, Output) {
+    let envs: Vec<(&str, &Path)> = credentials
+        .map(|dir| ("CREDENTIALS_DIRECTORY", dir))
+        .into_iter()
+        .collect();
+    let path = config.to_str().unwrap();
+    (
+        run(&["config", "check", path], &envs),
+        run(&["serve", "--config", path], &envs),
+    )
+}
+
+#[cfg(unix)]
+#[test]
+fn check_passes_a_document_serve_can_start_and_reports_counts_only() {
+    let scratch = Scratch::new();
+    let (flags, credentials) = prepare(&scratch);
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
     let checked = run(
         &[
             "config",
             "check",
             scratch.path("connector.cc").to_str().unwrap(),
         ],
-        &[],
+        &[("CREDENTIALS_DIRECTORY", &credentials)],
     );
-    assert!(checked.status.success());
+    assert!(checked.status.success(), "{}", shown(&checked));
     let text = shown(&checked);
     assert!(text.contains("callers: 1") && text.contains("allowed_models: 1"));
     assert!(text.contains("prices: 1"));
-    assert!(!text.contains("persona-a") && !text.contains(HAIKU));
+    for secret in ["persona-a", HAIKU, CANARY, "caller-secret"] {
+        assert!(!text.contains(secret), "{text}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
+    use std::os::unix::fs::PermissionsExt;
+
+    type Break = fn(&Scratch, &Path);
+    let cases: Vec<(&str, &str, Break)> = vec![
+        ("open prompt dir", "prompt directory", |s, _| {
+            std::fs::set_permissions(s.path("prompts"), std::fs::Permissions::from_mode(0o755))
+                .unwrap();
+        }),
+        ("no key file", "connection_key_file", |s, _| {
+            std::fs::remove_file(s.path("caller.key")).unwrap();
+        }),
+        ("binary off its pin", "claude_binary_sha256", |s, _| {
+            std::fs::write(s.path("claude"), b"other bytes").unwrap();
+        }),
+        ("no credential", "token_credential", |_, credentials| {
+            std::fs::remove_file(credentials.join("claude-token")).unwrap();
+        }),
+        ("no work dir", "work_dir", |s, _| {
+            std::fs::remove_dir(s.path("work")).unwrap();
+        }),
+        ("no config dir", "config_dir", |s, _| {
+            std::fs::remove_dir(s.path("home")).unwrap();
+        }),
+        ("frame too small", "max_frame_bytes", |s, _| {
+            let path = s.path("connector.cc");
+            let mut config = load_config(&path).unwrap();
+            config.max_frame_bytes = 4099;
+            write_config(&path, &config).unwrap();
+        }),
+        ("too few connections", "connection capacity", |s, _| {
+            let path = s.path("connector.cc");
+            let mut config = load_config(&path).unwrap();
+            config.max_connections = 1;
+            write_config(&path, &config).unwrap();
+        }),
+    ];
+    for (name, field, break_it) in cases {
+        let scratch = Scratch::new();
+        let (flags, credentials) = prepare(&scratch);
+        let made = init(&scratch, &flags);
+        assert!(made.status.success(), "{name}: {}", shown(&made));
+        break_it(&scratch, &credentials);
+        let (checked, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+        assert!(!checked.status.success(), "{name} check passed");
+        assert!(!served.status.success(), "{name} serve started");
+        assert!(shown(&checked).contains(field), "{name}: {}", shown(&checked));
+        assert_eq!(shown(&checked), shown(&served), "{name}");
+        for secret in [CANARY, "caller-secret", "other bytes"] {
+            assert!(!shown(&checked).contains(secret), "{name}");
+        }
+    }
+
+    // No credential directory at all is the same refusal.
+    let scratch = Scratch::new();
+    let (flags, _) = prepare(&scratch);
+    assert!(init(&scratch, &flags).status.success());
+    let (checked, served) = check_and_serve(&scratch.path("connector.cc"), None);
+    assert!(!checked.status.success() && !served.status.success());
+    assert!(shown(&checked).contains("token_credential"));
+    assert_eq!(shown(&checked), shown(&served));
+}
+
+#[cfg(unix)]
+#[test]
+fn serve_names_a_corrupt_replay_store_without_its_path() {
+    let scratch = Scratch::new();
+    let (mut flags, credentials) = prepare(&scratch);
+    let store = scratch.path(&format!("{CANARY}-store/replay.cc"));
+    std::fs::create_dir_all(store.parent().unwrap()).unwrap();
+    std::fs::write(&store, b"not a cultcache store").unwrap();
+    let at = flags.iter().position(|flag| flag == "--replay-store").unwrap();
+    flags[at + 1] = store.to_string_lossy().into_owned();
+    assert!(init(&scratch, &flags).status.success());
+    let (_, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+    assert!(!served.status.success());
+    let text = shown(&served);
+    assert!(text.contains("replay_store"), "{text}");
+    assert!(!text.contains(CANARY) && !text.contains("replay.cc"), "{text}");
 }
 
 #[test]
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 6d87f6e..fe8f950 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -23,10 +23,11 @@ use crate::service::{
 /// The only provider seam of the connector kit. A connector binary implements
 /// it over one model provider; the kit names no provider.
 pub trait ProviderBackend: Send + Sync {
-    /// Whether the provider can take work. `serve` consults it once, before it
-    /// opens the replay store or accepts a connection; the request path does
-    /// not consult it.
-    fn ready(&self) -> bool;
+    /// Whether the provider can take work; `Err` names the backend field that
+    /// is not ready, never a value. `serve` consults it once, before it opens
+    /// the replay store or accepts a connection; the request path does not
+    /// consult it.
+    fn ready(&self) -> Result<(), &'static str>;
     /// The tag of the provider this backend fronts. The service owns it from
     /// `serve` on: it names the provider on every receipt and decides which
     /// reasoning state is foreign.
@@ -59,7 +60,7 @@ impl ServeLimits {
     /// largest whose sealed frame, at its worst-case encoding, fits the frame.
     /// An admitted payload therefore always fits, and `complete` is given the
     /// same frame bound to fit every result in.
-    fn validate(&self, admissions: &[CallerAdmission]) -> Result<(), ServeError> {
+    pub fn validate(&self, admissions: &[CallerAdmission]) -> Result<(), ServeError> {
         if self.max_frame_bytes == 0
             || self.max_frame_bytes > u32::MAX as usize
             || self.max_connections == 0
@@ -171,9 +172,7 @@ pub fn serve(
     {
         return Err(ServeError::InvalidConfig("listener address"));
     }
-    if !backend.ready() {
-        return Err(ServeError::BackendUnready);
-    }
+    backend.ready().map_err(ServeError::BackendUnready)?;
     let service = Arc::new(Mutex::new(TransportService::open(
         replay_store,
         backend.provider(),
@@ -322,8 +321,8 @@ pub enum ServeError {
     ConnectionKey(#[source] std::io::Error),
     #[error(transparent)]
     Service(#[from] ServiceError),
-    #[error("provider backend is not ready")]
-    BackendUnready,
+    #[error("provider backend is not ready: {0}")]
+    BackendUnready(&'static str),
     #[error("connector service lock was poisoned")]
     ServicePoisoned,
     #[error("connector listener failed")]
@@ -379,9 +378,9 @@ mod tests {
     }
 
     impl ProviderBackend for CountingBackend {
-        fn ready(&self) -> bool {
+        fn ready(&self) -> Result<(), &'static str> {
             self.ready_calls.fetch_add(1, Ordering::SeqCst);
-            self.ready
+            self.ready.then_some(()).ok_or("fixture")
         }
 
         fn provider(&self) -> &str {
@@ -710,7 +709,7 @@ mod tests {
             &store.path,
             backend.clone(),
         );
-        assert!(matches!(result, Some(Err(ServeError::BackendUnready))));
+        assert!(matches!(result, Some(Err(ServeError::BackendUnready("fixture")))));
         assert_eq!(backend.executions.load(Ordering::SeqCst), 0);
         assert!(
             !store.path.exists(),
@@ -1016,8 +1015,8 @@ mod tests {
     }
 
     impl ProviderBackend for SizedBackend {
-        fn ready(&self) -> bool {
-            true
+        fn ready(&self) -> Result<(), &'static str> {
+            Ok(())
         }
 
         fn provider(&self) -> &str {
diff --git a/crates/model-connector/tests/reasoning_state.rs b/crates/model-connector/tests/reasoning_state.rs
index f42e0f1..8c9c4af 100644
--- a/crates/model-connector/tests/reasoning_state.rs
+++ b/crates/model-connector/tests/reasoning_state.rs
@@ -38,8 +38,8 @@ impl RecordingBackend {
 }
 
 impl ProviderBackend for RecordingBackend {
-    fn ready(&self) -> bool {
-        true
+    fn ready(&self) -> Result<(), &'static str> {
+        Ok(())
     }
 
     fn provider(&self) -> &str {
@@ -291,8 +291,8 @@ struct TamperingBackend {
 }
 
 impl ProviderBackend for TamperingBackend {
-    fn ready(&self) -> bool {
-        true
+    fn ready(&self) -> Result<(), &'static str> {
+        Ok(())
     }
 
     fn provider(&self) -> &str {

From 85ed36d292b815ce323ecf1a278e75d07ec9f0ca Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 12:10:35 +0100
Subject: [PATCH 05/37] claude-connector: rustfmt and clippy on the readiness
 tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/backend/tests.rs  | 12 +++++--
 crates/claude-connector/src/daemon.rs         | 36 +++++++++++--------
 .../claude-connector/tests/config_document.rs | 27 ++++++++++----
 crates/model-connector/src/serve.rs           |  5 ++-
 4 files changed, 56 insertions(+), 24 deletions(-)

diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 86130b7..21a8c72 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -1391,7 +1391,11 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
     let result = backend.execute(claim.call());
     let (kind, message, usage) = failure_of(&result);
     assert_eq!(kind, FailureKind::Provider);
-    assert_eq!(usage, Some(usage_zero()), "a child that never ran bills nothing");
+    assert_eq!(
+        usage,
+        Some(usage_zero()),
+        "a child that never ran bills nothing"
+    );
     assert_eq!(parts(&result).1.cost_micro_usd, 0);
     assert!(
         !message.contains(dir.path().to_str().unwrap()),
@@ -1664,7 +1668,11 @@ fn pin_is_checked_before_every_spawn() {
     let result = rig.run(request(vec![user("hi")]));
     let (kind, message, usage) = failure_of(&result);
     assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
-    assert_eq!(parts(&result).1.cost_micro_usd, 0, "billed nothing, not the reservation");
+    assert_eq!(
+        parts(&result).1.cost_micro_usd,
+        0,
+        "billed nothing, not the reservation"
+    );
     assert!(!message.contains(rig.dir.path().to_str().unwrap()));
     assert_eq!(rig.spawns(), 1, "no child for a binary off its pin");
     assert!(!rig.backend.binary_matches_pin());
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 5a6e592..4622b4c 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -267,17 +267,20 @@ fn is_canonical_model(model: &str) -> bool {
 /// lets a call cost nothing against the caller's ceiling.
 fn is_fully_priced(price: &ModelPrice) -> bool {
     let long = price.long_context.map(|long| long.rates);
-    [Some(price.rates), long].into_iter().flatten().all(|rates| {
-        [
-            rates.input,
-            rates.cache_write_short,
-            rates.cache_write_long,
-            rates.cache_read,
-            rates.output,
-        ]
-        .iter()
-        .all(|rate| *rate > 0)
-    })
+    [Some(price.rates), long]
+        .into_iter()
+        .flatten()
+        .all(|rates| {
+            [
+                rates.input,
+                rates.cache_write_short,
+                rates.cache_write_long,
+                rates.cache_read,
+                rates.output,
+            ]
+            .iter()
+            .all(|rate| *rate > 0)
+        })
 }
 
 /// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
@@ -438,8 +441,11 @@ mod tests {
         let sink = LogSink(Mutex::new(log.clone()));
         sink.stderr_tail(b"canary-stderr-text, 22 bytes");
         let written = String::from_utf8(log.0.lock().unwrap().clone()).unwrap();
-        assert_eq!(written, "claude-connector: child stderr, 28 bytes
-");
+        assert_eq!(
+            written,
+            "claude-connector: child stderr, 28 bytes
+"
+        );
         assert!(!written.contains("canary"));
     }
 
@@ -491,8 +497,8 @@ mod tests {
         fn a_link_to_a_good_directory_is_refused() {
             let dir = Dir::new("link-target");
             dir.mode(0o700);
-            let link = std::env::temp_dir()
-                .join(format!("claude-prompt-dir-{}-link", std::process::id()));
+            let link =
+                std::env::temp_dir().join(format!("claude-prompt-dir-{}-link", std::process::id()));
             let _ = std::fs::remove_file(&link);
             symlink(&dir.0, &link).unwrap();
             let refused = check_prompt_dir(&link).is_err();
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 39f377d..4bc35d4 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -301,7 +301,8 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
             "trailing part",
             Box::new(|c| {
                 c.callers[0].allowed_models = vec!["claude-opus-5-1-20260101-x".to_string()];
-                c.prices.insert("claude-opus-5-1-20260101-x".to_string(), price());
+                c.prices
+                    .insert("claude-opus-5-1-20260101-x".to_string(), price());
             }),
         ),
         (
@@ -364,7 +365,8 @@ fn a_dated_canonical_id_is_allowed() {
 
 #[test]
 fn a_price_with_a_zero_billed_component_is_refused() {
-    let zeroed: Vec<(&str, fn(&mut Rates))> = vec![
+    type Zero = fn(&mut Rates);
+    let zeroed: Vec<(&str, Zero)> = vec![
         ("input", |r| r.input = 0),
         ("cache_write_short", |r| r.cache_write_short = 0),
         ("cache_write_long", |r| r.cache_write_long = 0),
@@ -644,7 +646,10 @@ fn prepare(scratch: &Scratch) -> (Vec<String>, PathBuf) {
         .map(|byte| format!("{byte:02x}"))
         .collect();
     let mut flags = init_flags(scratch, &[]);
-    let at = flags.iter().position(|flag| flag == "--claude-sha256").unwrap();
+    let at = flags
+        .iter()
+        .position(|flag| flag == "--claude-sha256")
+        .unwrap();
     flags[at + 1] = sha;
     (flags, scratch.path("credentials"))
 }
@@ -734,7 +739,11 @@ fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
         let (checked, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
         assert!(!checked.status.success(), "{name} check passed");
         assert!(!served.status.success(), "{name} serve started");
-        assert!(shown(&checked).contains(field), "{name}: {}", shown(&checked));
+        assert!(
+            shown(&checked).contains(field),
+            "{name}: {}",
+            shown(&checked)
+        );
         assert_eq!(shown(&checked), shown(&served), "{name}");
         for secret in [CANARY, "caller-secret", "other bytes"] {
             assert!(!shown(&checked).contains(secret), "{name}");
@@ -759,14 +768,20 @@ fn serve_names_a_corrupt_replay_store_without_its_path() {
     let store = scratch.path(&format!("{CANARY}-store/replay.cc"));
     std::fs::create_dir_all(store.parent().unwrap()).unwrap();
     std::fs::write(&store, b"not a cultcache store").unwrap();
-    let at = flags.iter().position(|flag| flag == "--replay-store").unwrap();
+    let at = flags
+        .iter()
+        .position(|flag| flag == "--replay-store")
+        .unwrap();
     flags[at + 1] = store.to_string_lossy().into_owned();
     assert!(init(&scratch, &flags).status.success());
     let (_, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
     assert!(!served.status.success());
     let text = shown(&served);
     assert!(text.contains("replay_store"), "{text}");
-    assert!(!text.contains(CANARY) && !text.contains("replay.cc"), "{text}");
+    assert!(
+        !text.contains(CANARY) && !text.contains("replay.cc"),
+        "{text}"
+    );
 }
 
 #[test]
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index fe8f950..d6723a4 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -709,7 +709,10 @@ mod tests {
             &store.path,
             backend.clone(),
         );
-        assert!(matches!(result, Some(Err(ServeError::BackendUnready("fixture")))));
+        assert!(matches!(
+            result,
+            Some(Err(ServeError::BackendUnready("fixture")))
+        ));
         assert_eq!(backend.executions.load(Ordering::SeqCst), 0);
         assert!(
             !store.path.exists(),

From 67c7849cb6d499f5f9ae05bcdd6b2d7a462856f2 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 12:18:50 +0100
Subject: [PATCH 06/37] claude-connector: pin every serve-error mapping to a
 field with no stored value

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs | 48 +++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 4622b4c..87450a8 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -435,6 +435,54 @@ mod tests {
         }
     }
 
+    #[test]
+    fn serve_errors_name_a_field_or_stage_and_never_a_stored_value() {
+        const CANARY: &str = "canary-path-8e2a";
+        let io = || std::io::Error::other(CANARY);
+        let cases: Vec<(ServeError, &str)> = vec![
+            (ServeError::InvalidConfig("callers"), "callers"),
+            (ServeError::BackendUnready("work_dir"), "work_dir"),
+            (
+                ServeError::FrameBound {
+                    max_frame_bytes: 4099,
+                    payload_bytes: 4096,
+                    needed_frame_bytes: 9999,
+                },
+                "max_frame_bytes",
+            ),
+            (ServeError::ConnectionKey(io()), "connection_key_file"),
+            (
+                ServeError::Service(ServiceError::ReplayStore(format!("{CANARY}/replay.cc"))),
+                "replay_store",
+            ),
+            (
+                ServeError::Service(ServiceError::UnpricedModel(CANARY.to_string())),
+                "prices",
+            ),
+            (
+                ServeError::Service(ServiceError::InvalidAdmission),
+                "callers",
+            ),
+            (
+                ServeError::Service(ServiceError::DuplicateCaller),
+                "callers",
+            ),
+            (
+                ServeError::Service(ServiceError::SharedCallerKey),
+                "callers",
+            ),
+            (ServeError::Listen(io()), "listener"),
+        ];
+        for (error, field) in cases {
+            let shown = ConfigError::from(error);
+            let text = format!("{shown} {shown:?}");
+            assert!(text.contains(field), "{text}");
+            for stored in [CANARY, "4099", "9999", "replay.cc"] {
+                assert!(!text.contains(stored), "{text}");
+            }
+        }
+    }
+
     #[test]
     fn the_log_gets_the_size_of_the_childs_stderr_and_never_its_bytes() {
         let log = Captured::default();

From e867fad379c175eb6f0ab37dca92d0105b37541e Mon Sep 17 00:00:00 2001
From: Eureka <eureka@minds.eureka.gamecult.org>
Date: Thu, 29 Oct 2026 12:59:23 +0100
Subject: [PATCH 07/37] B4b1 claude-connector-binary: connector daemon over one
 CultCache config document; token from a systemd credential, pin before every
 spawn, private prompt dir, 401/403/429 door set, shared readiness for check
 and serve (squash of eureka-body/claude-connector-binary 200933f..67c7849;
 Soul s1, s2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |   2 +
 crates/claude-connector/Cargo.toml            |   6 +
 crates/claude-connector/src/backend.rs        | 134 ++-
 crates/claude-connector/src/backend/tests.rs  | 404 ++++++--
 crates/claude-connector/src/config.rs         |   6 +
 crates/claude-connector/src/daemon.rs         | 571 +++++++++++
 crates/claude-connector/src/launch.rs         |  67 +-
 crates/claude-connector/src/lib.rs            |   6 +-
 crates/claude-connector/src/main.rs           | 241 +++++
 crates/claude-connector/src/stream.rs         |  22 +-
 .../claude-connector/tests/config_document.rs | 902 ++++++++++++++++++
 crates/model-connector/src/serve.rs           |  32 +-
 crates/model-connector/src/service.rs         |   6 +-
 .../model-connector/tests/reasoning_state.rs  |   8 +-
 14 files changed, 2273 insertions(+), 134 deletions(-)
 create mode 100644 crates/claude-connector/src/daemon.rs
 create mode 100644 crates/claude-connector/src/main.rs
 create mode 100644 crates/claude-connector/tests/config_document.rs

diff --git a/Cargo.lock b/Cargo.lock
index 34dec06..524654e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -138,6 +138,8 @@ dependencies = [
 name = "claude-connector"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "cultcache-rs",
  "libc",
  "model-connector",
  "rmp-serde",
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index a35bb4a..7f9b042 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -7,7 +7,13 @@ license.workspace = true
 repository.workspace = true
 publish = false
 
+[[bin]]
+name = "claude-connector"
+path = "src/main.rs"
+
 [dependencies]
+anyhow = "1"
+cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "a4eae9056152335662f1115f97bf35fb00ab6d23", package = "cultcache-rs" }
 model-connector = { path = "../model-connector", features = ["daemon"] }
 rmp-serde = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index ad3fb8c..c5a8f81 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -1,5 +1,6 @@
 use std::fs::File;
 use std::io;
+use std::path::PathBuf;
 use std::time::Instant;
 
 use model_connector::{
@@ -11,12 +12,54 @@ use zeroize::Zeroizing;
 
 use crate::config::{ClaudeCodeConfig, PROVIDER};
 use crate::handle::{ClaudeCodeHandle, SessionStore, plan, prefix_digest, stdin_bytes};
-use crate::launch::{PromptFile, TOKEN_VAR, argv, child_env};
+use crate::launch::{PromptFile, argv, child_env};
 use crate::process::{ProcessPort, RunningChild, StdoutRead};
 use crate::stream::{Failure, Finished, Step, StreamState};
 
-/// How the backend reads its own environment.
-type EnvLookup = Box<dyn Fn(&str) -> Option<String> + Send + Sync>;
+/// Where the child's credential comes from, read afresh at every use. The
+/// connector's own environment is never a source (ruling
+/// claude-connector-token-credential).
+pub trait TokenSource: Send + Sync {
+    /// The token, or `None` when there is none or it is empty.
+    fn read(&self) -> Option<Zeroizing<String>>;
+}
+
+/// A token in a file named by a systemd credential: the file
+/// `$CREDENTIALS_DIRECTORY/<name>`, read on every call so a rotated credential
+/// is picked up by the next spawn.
+pub struct CredentialTokenSource {
+    directory: Option<PathBuf>,
+    name: String,
+}
+
+impl CredentialTokenSource {
+    /// The credential `name` under the directory systemd names in
+    /// `CREDENTIALS_DIRECTORY`; with no such variable the source has no token.
+    /// The variable names a directory, never a token.
+    pub fn from_environment(name: impl Into<String>) -> Self {
+        Self {
+            directory: std::env::var_os("CREDENTIALS_DIRECTORY").map(PathBuf::from),
+            name: name.into(),
+        }
+    }
+
+    pub fn in_directory(directory: impl Into<PathBuf>, name: impl Into<String>) -> Self {
+        Self {
+            directory: Some(directory.into()),
+            name: name.into(),
+        }
+    }
+}
+
+impl TokenSource for CredentialTokenSource {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        let directory = self.directory.as_ref()?;
+        let mut token = Zeroizing::new(std::fs::read_to_string(directory.join(&self.name)).ok()?);
+        let trimmed = token.trim_end_matches(['\r', '\n']).len();
+        token.truncate(trimmed);
+        (!token.is_empty()).then_some(token)
+    }
+}
 
 /// Where the tail of a child's stderr goes. The backend never puts it in a
 /// result; the connector binary wires this to its log.
@@ -31,7 +74,7 @@ pub struct ClaudeCodeBackend {
     port: Box<dyn ProcessPort>,
     sessions: Box<dyn SessionStore>,
     sink: Box<dyn StderrSink>,
-    env_lookup: EnvLookup,
+    tokens: Box<dyn TokenSource>,
 }
 
 impl ClaudeCodeBackend {
@@ -42,7 +85,10 @@ impl ClaudeCodeBackend {
         let sessions = Box::new(crate::handle::FsSessionStore::new(
             config.config_dir.clone(),
         ));
-        Self::with_ports(config, port, sessions, sink)
+        let tokens = Box::new(CredentialTokenSource::from_environment(
+            config.token_credential.clone(),
+        ));
+        Self::with_ports(config, port, sessions, sink, tokens)
     }
 
     pub fn with_ports(
@@ -50,29 +96,21 @@ impl ClaudeCodeBackend {
         port: Box<dyn ProcessPort>,
         sessions: Box<dyn SessionStore>,
         sink: Box<dyn StderrSink>,
+        tokens: Box<dyn TokenSource>,
     ) -> Self {
         Self {
             config,
             port,
             sessions,
             sink,
-            env_lookup: Box::new(|name| std::env::var(name).ok()),
+            tokens,
         }
     }
 
-    fn token(&self) -> Option<Zeroizing<String>> {
-        (self.env_lookup)(TOKEN_VAR)
-            .filter(|value| !value.is_empty())
-            .map(Zeroizing::new)
-    }
-
+    /// The one pin check: `ready` and every spawn use it, and nothing caches
+    /// its answer.
     fn binary_matches_pin(&self) -> bool {
-        let Ok(mut file) = File::open(&self.config.claude_binary) else {
-            return false;
-        };
-        let mut hasher = Sha256::new();
-        io::copy(&mut file, &mut hasher).is_ok()
-            && <[u8; 32]>::from(hasher.finalize()) == self.config.claude_binary_sha256
+        binary_matches_pin(&self.config)
     }
 
     fn run(&self, request: &ProviderRequest) -> (Vec<TransportEvent>, TransportOutcome) {
@@ -86,15 +124,21 @@ impl ClaudeCodeBackend {
                 );
             }
         };
-        let Some(token) = self.token() else {
+        let Some(token) = self.tokens.read() else {
             return failed(
                 FailureKind::Authentication,
                 "claude-code: the connector has no credential to give the child".to_string(),
                 Some(zero_usage()),
             );
         };
-        let Ok(prompt) = PromptFile::create(&request.instructions) else {
-            return failure(Failure::unbilled(
+        if !self.binary_matches_pin() {
+            return failure(Failure::never_reached(
+                FailureKind::Provider,
+                "claude-code: the claude binary does not match its pin",
+            ));
+        }
+        let Ok(prompt) = PromptFile::create(&self.config.prompt_dir, &request.instructions) else {
+            return failure(Failure::never_reached(
                 FailureKind::Provider,
                 "claude-code: the system prompt could not be staged",
             ));
@@ -110,7 +154,7 @@ impl ClaudeCodeBackend {
             stdin_bytes(plan.blocks()),
         );
         let Ok(mut child) = spawned else {
-            return failure(Failure::unbilled(
+            return failure(Failure::never_reached(
                 FailureKind::Provider,
                 "claude-code: the child could not be spawned",
             ));
@@ -175,11 +219,8 @@ impl ClaudeCodeBackend {
 }
 
 impl ProviderBackend for ClaudeCodeBackend {
-    fn ready(&self) -> bool {
-        self.config.work_dir.is_dir()
-            && self.config.config_dir.is_dir()
-            && self.token().is_some()
-            && self.binary_matches_pin()
+    fn ready(&self) -> Result<(), &'static str> {
+        readiness(&self.config, self.tokens.as_ref())
     }
 
     fn provider(&self) -> &str {
@@ -206,19 +247,19 @@ fn read_stream(
                 }
             }
             StdoutRead::Eof => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Provider,
                     "claude-code: the stream ended without a result",
                 ));
             }
             StdoutRead::Timeout => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Timeout,
                     "claude-code: the deadline passed before a result",
                 ));
             }
             StdoutRead::Breach => {
-                return Err(Failure::unbilled(
+                return Err(Failure::cost_unknown(
                     FailureKind::Provider,
                     "claude-code: the output passed its size cap",
                 ));
@@ -230,6 +271,39 @@ fn read_stream(
     finished
 }
 
+fn binary_matches_pin(config: &ClaudeCodeConfig) -> bool {
+    let Ok(mut file) = File::open(&config.claude_binary) else {
+        return false;
+    };
+    let mut hasher = Sha256::new();
+    io::copy(&mut file, &mut hasher).is_ok()
+        && <[u8; 32]>::from(hasher.finalize()) == config.claude_binary_sha256
+}
+
+/// Whether the backend can take work, naming the first config field that
+/// cannot be used. `config check` and `serve` both ask this.
+pub(crate) fn readiness(
+    config: &ClaudeCodeConfig,
+    tokens: &dyn TokenSource,
+) -> Result<(), &'static str> {
+    if !config.work_dir.is_dir() {
+        return Err("work_dir");
+    }
+    if !config.config_dir.is_dir() {
+        return Err("config_dir");
+    }
+    if !config.prompt_dir.is_dir() {
+        return Err("prompt_dir");
+    }
+    if tokens.read().is_none() {
+        return Err("token_credential");
+    }
+    if !binary_matches_pin(config) {
+        return Err("claude_binary_sha256");
+    }
+    Ok(())
+}
+
 fn zero_usage() -> Usage {
     Usage {
         input_tokens: 0,
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 309e2d1..21a8c72 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -13,7 +13,7 @@ use model_connector::{
 use super::*;
 use crate::config::ClaudeCodeLimits;
 use crate::handle::{FsSessionStore, SessionStore};
-use crate::launch::ChildEnv;
+use crate::launch::{ChildEnv, TOKEN_VAR};
 
 const CANARY_TOKEN: &str = "canary-oauth-token-value";
 const MODEL: &str = "claude-haiku-5-5";
@@ -243,17 +243,47 @@ impl StderrSink for Sink {
     }
 }
 
-fn config(instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeConfig {
+/// The bytes of the stand-in `claude` the scripted rigs pin.
+const PINNED: &[u8] = b"the pinned claude bytes";
+
+fn pin_of(bytes: &[u8]) -> [u8; 32] {
+    Sha256::digest(bytes).into()
+}
+
+/// A directory holding a pinned `claude` file and an empty `prompts` directory.
+fn sandbox() -> TempDir {
+    let dir = TempDir::new();
+    std::fs::write(dir.path().join("claude"), PINNED).unwrap();
+    std::fs::create_dir_all(dir.path().join("prompts")).unwrap();
+    dir
+}
+
+fn config(dir: &Path, instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeConfig {
     ClaudeCodeConfig {
-        claude_binary: PathBuf::from("/opt/claude"),
-        claude_binary_sha256: [9; 32],
+        claude_binary: dir.join("claude"),
+        claude_binary_sha256: pin_of(PINNED),
         work_dir: PathBuf::from("/work"),
         config_dir: PathBuf::from("/cfg"),
+        prompt_dir: dir.join("prompts"),
+        token_credential: "claude-token".to_string(),
         instance: instance.to_string(),
         limits,
     }
 }
 
+/// A token source with a fixed answer.
+struct FixedToken(Option<&'static str>);
+
+impl TokenSource for FixedToken {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        self.0.map(|token| Zeroizing::new(token.to_string()))
+    }
+}
+
+fn canary_token() -> Box<dyn TokenSource> {
+    Box::new(FixedToken(Some(CANARY_TOKEN)))
+}
+
 fn limits() -> ClaudeCodeLimits {
     ClaudeCodeLimits {
         deadline: Duration::from_secs(30),
@@ -263,12 +293,8 @@ fn limits() -> ClaudeCodeLimits {
     }
 }
 
-fn with_canary_token(mut backend: ClaudeCodeBackend) -> ClaudeCodeBackend {
-    backend.env_lookup = Box::new(|name| (name == TOKEN_VAR).then(|| CANARY_TOKEN.to_string()));
-    backend
-}
-
 struct Rig {
+    dir: TempDir,
     backend: ClaudeCodeBackend,
     spawns: Arc<AtomicUsize>,
     seen: Arc<Mutex<Seen>>,
@@ -285,13 +311,16 @@ fn rig_for(instance: &str, scripts: Vec<Script>, sessions: &[&str], stderr: &[u8
         seen: seen.clone(),
         stderr: stderr.to_vec(),
     };
-    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
-        config(instance, limits()),
+    let dir = sandbox();
+    let backend = ClaudeCodeBackend::with_ports(
+        config(dir.path(), instance, limits()),
         Box::new(port),
         Box::new(Sessions(sessions.iter().map(|s| s.to_string()).collect())),
         Box::new(sink.clone()),
-    ));
+        canary_token(),
+    );
     Rig {
+        dir,
         backend,
         spawns,
         seen,
@@ -443,7 +472,7 @@ fn argv_is_the_fixed_hygiene_set() {
         .expect("the prompt is passed as a file")
         .to_string();
     let expected: Vec<String> = [
-        "/opt/claude",
+        rig.dir.path().join("claude").to_str().unwrap(),
         "-p",
         "--output-format",
         "stream-json",
@@ -569,7 +598,7 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
     );
 
     let env = child_env(
-        &config(INSTANCE, limits()),
+        &config(rig.dir.path(), INSTANCE, limits()),
         &request(vec![user("x")]),
         Zeroizing::new(CANARY_TOKEN.to_string()),
     );
@@ -580,59 +609,163 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
 
 // ---- ready ----
 
+/// A backend over a scripted port that never has a script: `ready` runs nothing.
+fn ready_backend(config: ClaudeCodeConfig, tokens: Box<dyn TokenSource>) -> ClaudeCodeBackend {
+    ClaudeCodeBackend::with_ports(
+        config,
+        Box::new(ScriptedPort {
+            scripts: Mutex::new(VecDeque::new()),
+            spawns: Arc::new(AtomicUsize::new(0)),
+            seen: Arc::new(Mutex::new(Seen::default())),
+            stderr: Vec::new(),
+        }),
+        Box::new(Sessions(vec![])),
+        Box::new(Sink::default()),
+        tokens,
+    )
+}
+
 #[test]
 fn ready_checks_the_pinned_binary_digest() {
-    let dir = TempDir::new();
+    let dir = sandbox();
     let (work, cfg) = (dir.path().join("work"), dir.path().join("cfg"));
     std::fs::create_dir_all(&work).unwrap();
     std::fs::create_dir_all(&cfg).unwrap();
     let binary = dir.path().join("claude");
-    std::fs::write(&binary, b"the pinned bytes").unwrap();
-    let pin: [u8; 32] = Sha256::digest(b"the pinned bytes").into();
 
-    let ready = |sha: [u8; 32], binary: &Path, work: &Path, token: bool| {
-        let mut config = config(INSTANCE, limits());
+    let ready_field = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
+        let mut config = config(dir.path(), INSTANCE, limits());
         config.claude_binary = binary.to_path_buf();
         config.claude_binary_sha256 = sha;
         config.work_dir = work.to_path_buf();
         config.config_dir = cfg.clone();
-        let rig = rig(vec![]);
-        let mut backend = ClaudeCodeBackend::with_ports(
-            config,
-            Box::new(ScriptedPort {
-                scripts: Mutex::new(VecDeque::new()),
-                spawns: rig.spawns.clone(),
-                seen: rig.seen.clone(),
-                stderr: Vec::new(),
-            }),
-            Box::new(Sessions(vec![])),
-            Box::new(Sink::default()),
-        );
-        backend.env_lookup =
-            Box::new(move |name| (token && name == TOKEN_VAR).then(|| "t".to_string()));
-        let answer = backend.ready();
-        assert_eq!(rig.spawns(), 0, "ready runs nothing");
-        answer
+        config.prompt_dir = prompts.to_path_buf();
+        let tokens = Box::new(FixedToken(token.then_some("t")));
+        ready_backend(config, tokens).ready()
     };
+    let ready = |sha: [u8; 32], binary: &Path, work: &Path, prompts: &Path, token: bool| {
+        ready_field(sha, binary, work, prompts, token).is_ok()
+    };
+    let prompts = dir.path().join("prompts");
+    let pin = pin_of(PINNED);
+    assert_eq!(
+        ready_field([0; 32], &binary, &work, &prompts, true),
+        Err("claude_binary_sha256")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &dir.path().join("absent"), &prompts, true),
+        Err("work_dir")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &work, &dir.path().join("absent"), true),
+        Err("prompt_dir")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &work, &prompts, false),
+        Err("token_credential")
+    );
 
-    assert!(ready(pin, &binary, &work, true));
-    assert!(!ready([0; 32], &binary, &work, true), "other pin");
+    assert!(ready(pin, &binary, &work, &prompts, true));
+    assert!(!ready([0; 32], &binary, &work, &prompts, true), "other pin");
     assert!(
-        !ready(pin, &dir.path().join("absent"), &work, true),
+        !ready(pin, &dir.path().join("absent"), &work, &prompts, true),
         "no binary"
     );
     assert!(
-        !ready(pin, &binary, &dir.path().join("absent"), true),
+        !ready(pin, &binary, &dir.path().join("absent"), &prompts, true),
         "no work dir"
     );
-    assert!(!ready(pin, &binary, &work, false), "no token");
+    assert!(
+        !ready(pin, &binary, &work, &dir.path().join("absent"), true),
+        "no prompt dir"
+    );
+    assert!(!ready(pin, &binary, &work, &prompts, false), "no token");
     std::fs::write(&binary, b"other bytes").unwrap();
     assert!(
-        !ready(pin, &binary, &work, true),
+        !ready(pin, &binary, &work, &prompts, true),
         "bytes differ from the pin"
     );
 }
 
+#[test]
+fn token_comes_from_the_credential_file_not_the_environment() {
+    static CANARY_PARENT: std::sync::Once = std::sync::Once::new();
+    CANARY_PARENT.call_once(|| {
+        // SAFETY: set once to a value no code path reads; the test proves none does.
+        unsafe { std::env::set_var(TOKEN_VAR, "canary-environment-token") };
+    });
+    let dir = sandbox();
+    let credentials = dir.path().join("credentials");
+    for sub in ["credentials", "work", "cfg"] {
+        std::fs::create_dir_all(dir.path().join(sub)).unwrap();
+    }
+    let seen = Arc::new(Mutex::new(Seen::default()));
+    let mut config = config(dir.path(), INSTANCE, limits());
+    config.work_dir = dir.path().join("work");
+    config.config_dir = dir.path().join("cfg");
+    let backend = ClaudeCodeBackend::with_ports(
+        config,
+        Box::new(ScriptedPort {
+            scripts: Mutex::new(vec![ok_script(SESSION, "x")].into()),
+            spawns: Arc::new(AtomicUsize::new(0)),
+            seen: seen.clone(),
+            stderr: Vec::new(),
+        }),
+        Box::new(Sessions(vec![])),
+        Box::new(Sink::default()),
+        Box::new(CredentialTokenSource::in_directory(
+            &credentials,
+            "claude-token",
+        )),
+    );
+    let mut door = Door::new();
+
+    // The variable is set and the file is absent: nothing to give the child.
+    assert_eq!(backend.ready(), Err("token_credential"));
+    let (claim, _) = door.begin(request(vec![user("hi")]));
+    let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
+    assert_eq!(kind, FailureKind::Authentication);
+    assert_eq!(usage, Some(usage_zero()));
+    assert!(!message.contains("canary-environment-token"));
+    assert!(seen.lock().unwrap().argv.is_empty(), "no child was spawned");
+
+    // The file is read afresh at the call, its trailing newline trimmed, and
+    // the child's environment carries the file's value.
+    std::fs::write(
+        credentials.join("claude-token"),
+        format!("{CANARY_TOKEN}\n"),
+    )
+    .unwrap();
+    assert_eq!(backend.ready(), Ok(()));
+    let mut door = Door::new();
+    let (claim, _) = door.begin(request(vec![user("hi")]));
+    let result = backend.execute(claim.call());
+    assert!(matches!(
+        outcome(&result),
+        TransportOutcome::Completed { .. }
+    ));
+    let env = seen.lock().unwrap().env.clone();
+    assert!(env.contains(&(TOKEN_VAR.to_string(), CANARY_TOKEN.to_string())));
+
+    // An empty credential is no token.
+    std::fs::write(credentials.join("claude-token"), "\n").unwrap();
+    assert_eq!(backend.ready(), Err("token_credential"));
+}
+
+#[test]
+fn an_unreadable_credential_is_no_token() {
+    // A credential that is a directory, or a directory that is absent.
+    let dir = sandbox();
+    std::fs::create_dir_all(dir.path().join("claude-token")).unwrap();
+    let source = CredentialTokenSource::in_directory(dir.path(), "claude-token");
+    assert!(source.read().is_none());
+    assert!(
+        CredentialTokenSource::in_directory(dir.path().join("absent"), "x")
+            .read()
+            .is_none()
+    );
+}
+
 // ---- planning ----
 
 #[test]
@@ -1224,7 +1357,7 @@ fn one_spawn_per_execute() {
 #[test]
 fn a_missing_token_fails_before_spawn() {
     let mut rig = rig(vec![ok_script(SESSION, "x")]);
-    rig.backend.env_lookup = Box::new(|_| None);
+    rig.backend.tokens = Box::new(FixedToken(None));
     let (kind, _, usage) = failure_of(&rig.run(request(vec![user("hi")])));
     assert_eq!(kind, FailureKind::Authentication);
     assert_eq!(usage, Some(usage_zero()));
@@ -1245,18 +1378,29 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
             Err(io::Error::from(io::ErrorKind::NotFound))
         }
     }
-    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
-        config(INSTANCE, limits()),
+    let dir = sandbox();
+    let backend = ClaudeCodeBackend::with_ports(
+        config(dir.path(), INSTANCE, limits()),
         Box::new(Refusing),
         Box::new(Sessions(vec![])),
         Box::new(Sink::default()),
-    ));
+        canary_token(),
+    );
     let mut door = Door::new();
     let (claim, _) = door.begin(request(vec![user("hi")]));
-    let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
+    let result = backend.execute(claim.call());
+    let (kind, message, usage) = failure_of(&result);
     assert_eq!(kind, FailureKind::Provider);
-    assert_eq!(usage, None);
-    assert!(!message.contains("/opt/claude"), "no path in a message");
+    assert_eq!(
+        usage,
+        Some(usage_zero()),
+        "a child that never ran bills nothing"
+    );
+    assert_eq!(parts(&result).1.cost_micro_usd, 0);
+    assert!(
+        !message.contains(dir.path().to_str().unwrap()),
+        "no path in a message"
+    );
 }
 
 #[test]
@@ -1384,28 +1528,60 @@ fn usage_the_result_does_not_report_is_billed_the_reservation() {
 }
 
 #[test]
-fn a_refusal_at_the_door_is_billed_nothing() {
-    // Ruling spend-bills-on-identity-not-validity: a bound result is charged
-    // its true cost, and the provider bills nothing for a 401 or 403.
-    // The shape is a real claude 2.1.312 capture with a bogus token.
+fn door_set_is_exactly_401_403_429() {
+    // Ruling claude-code-plan-quota-fuse-2 with spend-bills-on-identity-not-
+    // validity: a refusal at the door is charged nothing, for exactly the
+    // statuses the provider cannot have billed (401, 403, 429) and only when
+    // the result says its usage is explicitly empty. Every other shape is
+    // billed the reservation. The 401 shape is a real claude 2.1.312 capture
+    // with a bogus token.
     let retry = r#"{"type":"system","subtype":"api_retry","error":"authentication_failed"}"#;
     let synthetic = r#"{"type":"assistant","api_error_status":401,"error":"authentication_failed","message":{"id":"e48001b7-cf4f-49b1-9810-db8fd7f73c73","model":"<synthetic>","stop_reason":"stop_sequence","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 OAuth access token is invalid."}]}}"#;
-    for status in [401, 403] {
-        let result_line = format!(
-            r#"{{"type":"result","subtype":"success","is_error":true,"api_error_status":{status},"stop_reason":"stop_sequence","result":"Failed to authenticate.","modelUsage":{{}},"model_usage_since_last_result":{{}},"terminal_reason":"api_error"}}"#
-        );
-        let result = rig(vec![Script::lines(vec![
-            init_line(MODEL, SESSION),
-            retry.to_string(),
-            retry.to_string(),
-            synthetic.to_string(),
-            result_line,
-        ])])
-        .run(request(vec![user("hi")]));
-        let (kind, _, usage) = failure_of(&result);
-        assert_eq!(kind, FailureKind::Authentication, "{status}");
-        assert_eq!(usage, Some(usage_zero()), "{status}");
-        assert_eq!(parts(&result).1.cost_micro_usd, 0, "{status}");
+    let reservation = reservation();
+    let statuses: [Option<u16>; 9] = [
+        Some(400),
+        Some(401),
+        Some(402),
+        Some(403),
+        Some(404),
+        Some(429),
+        Some(500),
+        Some(529),
+        None,
+    ];
+    let shapes = [
+        (Some("{}"), "empty"),
+        (None, "absent"),
+        (Some("null"), "null"),
+    ];
+    for status in statuses {
+        for (since_last, shape) in shapes {
+            let status_field = status
+                .map(|status| format!(r#""api_error_status":{status},"#))
+                .unwrap_or_default();
+            let usage_field = since_last
+                .map(|usage| format!(r#","model_usage_since_last_result":{usage}"#))
+                .unwrap_or_default();
+            let result_line = format!(
+                r#"{{"type":"result","subtype":"success","is_error":true,{status_field}"stop_reason":"stop_sequence","result":"Failed.","modelUsage":{CUMULATIVE}{usage_field},"terminal_reason":"api_error"}}"#
+            );
+            let result = rig(vec![Script::lines(vec![
+                init_line(MODEL, SESSION),
+                retry.to_string(),
+                synthetic.to_string(),
+                result_line,
+            ])])
+            .run(request(vec![user("hi")]));
+            let (_, _, usage) = failure_of(&result);
+            let case = format!("{status:?} {shape}");
+            if matches!(status, Some(401 | 403 | 429)) && shape == "empty" {
+                assert_eq!(usage, Some(usage_zero()), "{case}");
+                assert_eq!(parts(&result).1.cost_micro_usd, 0, "{case}");
+            } else {
+                assert_eq!(usage, None, "{case}");
+                assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{case}");
+            }
+        }
     }
 }
 
@@ -1458,6 +1634,57 @@ fn the_prompt_file_is_removed_when_the_call_fails() {
     }
 }
 
+#[test]
+fn prompt_file_lives_in_prompt_dir_exclusively() {
+    let rig = rig(vec![ok_script(SESSION, "x")]);
+    rig.run(request(vec![user("hi")]));
+    let (path, _) = rig.seen().prompt_file.expect("a prompt file");
+    assert_eq!(
+        path.parent(),
+        Some(rig.dir.path().join("prompts").as_path())
+    );
+
+    // A prompt directory that cannot take the file fails staging: nothing
+    // reached the provider, so it bills nothing, and no child runs.
+    let rig = rig_for(INSTANCE, vec![ok_script(SESSION, "x")], &[SESSION], b"");
+    std::fs::remove_dir_all(rig.dir.path().join("prompts")).unwrap();
+    let result = rig.run(request(vec![user("hi")]));
+    let (kind, _, usage) = failure_of(&result);
+    assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
+    assert_eq!(parts(&result).1.cost_micro_usd, 0);
+    assert_eq!(rig.spawns(), 0);
+}
+
+#[test]
+fn pin_is_checked_before_every_spawn() {
+    let rig = rig(vec![ok_script(SESSION, "x"), ok_script(SESSION, "y")]);
+    let binary = rig.dir.path().join("claude");
+    assert!(rig.backend.binary_matches_pin());
+    rig.run(request(vec![user("hi")]));
+    assert_eq!(rig.spawns(), 1);
+
+    // The binary is swapped after readiness: the next call never spawns.
+    std::fs::write(&binary, b"swapped bytes").unwrap();
+    let result = rig.run(request(vec![user("hi")]));
+    let (kind, message, usage) = failure_of(&result);
+    assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
+    assert_eq!(
+        parts(&result).1.cost_micro_usd,
+        0,
+        "billed nothing, not the reservation"
+    );
+    assert!(!message.contains(rig.dir.path().to_str().unwrap()));
+    assert_eq!(rig.spawns(), 1, "no child for a binary off its pin");
+    assert!(!rig.backend.binary_matches_pin());
+    let staged = std::fs::read_dir(rig.dir.path().join("prompts")).unwrap();
+    assert_eq!(staged.count(), 0, "no prompt was staged for it");
+
+    // Restoring the pinned bytes is enough: nothing remembers the verdict.
+    std::fs::write(&binary, PINNED).unwrap();
+    rig.run(request(vec![user("hi")]));
+    assert_eq!(rig.spawns(), 2);
+}
+
 #[test]
 fn the_provider_tag_is_claude_code() {
     assert_eq!(rig(vec![]).backend.provider(), "claude-code");
@@ -1540,12 +1767,21 @@ mod real {
         let binary = dir.path().join("claude");
         std::fs::write(&binary, format!("#!/bin/sh\n{body}\n")).unwrap();
         std::fs::set_permissions(&binary, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let mut config = config(INSTANCE, limits);
+        let prompts = dir.path().join("prompts");
+        std::fs::create_dir_all(&prompts).unwrap();
+        let mut config = config(dir.path(), INSTANCE, limits);
+        config.claude_binary_sha256 = pin_of(&std::fs::read(&binary).unwrap());
         config.claude_binary = binary;
         config.work_dir = work;
         config.config_dir = cfg;
         let sink = Sink::default();
-        let backend = with_canary_token(ClaudeCodeBackend::new(config, Box::new(sink.clone())));
+        let backend = ClaudeCodeBackend::with_ports(
+            config.clone(),
+            Box::new(crate::process::StdProcessPort::new(config.limits)),
+            Box::new(FsSessionStore::new(config.config_dir.clone())),
+            Box::new(sink.clone()),
+            canary_token(),
+        );
         Fake {
             _guard: guard,
             dir,
@@ -1655,7 +1891,7 @@ mod real {
             leader.display()
         );
         let fake = fake(&body, limits());
-        let config = config(INSTANCE, limits());
+        let config = config(fake.dir.path(), INSTANCE, limits());
         let env = child_env(
             &config,
             &request(vec![user("x")]),
@@ -1801,6 +2037,11 @@ mod real {
             "600"
         );
         let path = std::fs::read_to_string(probe.path().join("path")).unwrap();
+        assert_eq!(
+            Path::new(path.trim()).parent(),
+            Some(fake.dir.path().join("prompts").as_path()),
+            "staged in the configured prompt directory"
+        );
         assert!(!Path::new(path.trim()).exists(), "removed after the call");
     }
 
@@ -1837,6 +2078,25 @@ mod real {
         assert!(sunk.trim_end().ends_with("END-OF-STDERR"), "{}", sunk.len());
     }
 
+    #[test]
+    fn stderr_join_survives_a_megabyte_after_result() {
+        // Soul s2's probe: the result line first, then a megabyte of stderr
+        // before the child exits. The call must wait for the stderr reader to
+        // finish, or the tail handed to the sink is cut short.
+        let body = format!(
+            "{}\nhead -c 1000000 /dev/zero | tr '\\0' x >&2\necho END-OF-STDERR >&2",
+            printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        let result = fake.run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        let sunk = String::from_utf8(fake.sink.0.lock().unwrap().clone()).unwrap();
+        assert!(sunk.trim_end().ends_with("END-OF-STDERR"), "{}", sunk.len());
+    }
+
     #[test]
     fn a_result_is_enough_even_if_the_child_keeps_stdout_open() {
         let body = format!("{}\nexec sleep 300", printf_lines(&good_lines()));
diff --git a/crates/claude-connector/src/config.rs b/crates/claude-connector/src/config.rs
index 1dd0e8a..3bd0e1f 100644
--- a/crates/claude-connector/src/config.rs
+++ b/crates/claude-connector/src/config.rs
@@ -19,6 +19,12 @@ pub struct ClaudeCodeConfig {
     /// Passed to the child as `CLAUDE_CONFIG_DIR` and `HOME`; it holds the
     /// CLI's session store.
     pub config_dir: PathBuf,
+    /// A directory the connector owns (mode 0700), where each call's system
+    /// prompt is staged for the child.
+    pub prompt_dir: PathBuf,
+    /// The name of the systemd credential that holds the child's token, under
+    /// `$CREDENTIALS_DIRECTORY`.
+    pub token_credential: String,
     /// The connector instance id written into every handle.
     pub instance: String,
     pub limits: ClaudeCodeLimits,
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
new file mode 100644
index 0000000..87450a8
--- /dev/null
+++ b/crates/claude-connector/src/daemon.rs
@@ -0,0 +1,571 @@
+//! The claude-connector's configuration document and its serve verb. One typed
+//! CultCache record owns every bound and path the backend and the serve loop
+//! run with; nothing in the connector's environment, flags or JSON can change
+//! them. Validation errors name a field and never echo a value.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::{SocketAddr, TcpListener};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
+use model_connector::{
+    CallerAdmission, CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ServeError, ServeLimits,
+    ServiceError, load_admissions, serve,
+};
+use thiserror::Error;
+
+use crate::backend::readiness;
+use crate::{
+    ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink,
+};
+
+const CONFIG_KEY: &str = "runtime";
+const MODEL_PREFIX: &str = "claude-";
+
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "gamecult.model_connector.claude_connector_config.v1")]
+pub struct ClaudeConnectorConfig {
+    /// A loopback socket address.
+    #[cultcache(key = 0)]
+    pub listen: String,
+    #[cultcache(key = 1)]
+    pub replay_store: PathBuf,
+    #[cultcache(key = 2)]
+    pub claude_binary: PathBuf,
+    #[cultcache(key = 3)]
+    pub claude_binary_sha256: [u8; 32],
+    #[cultcache(key = 4)]
+    pub work_dir: PathBuf,
+    #[cultcache(key = 5)]
+    pub config_dir: PathBuf,
+    /// Where each call's system prompt is staged: a directory the connector
+    /// owns, mode 0700.
+    #[cultcache(key = 6)]
+    pub prompt_dir: PathBuf,
+    #[cultcache(key = 7)]
+    pub instance: String,
+    /// The name of the systemd credential that holds the child's token.
+    #[cultcache(key = 8)]
+    pub token_credential: String,
+    #[cultcache(key = 9)]
+    pub deadline_ms: u64,
+    #[cultcache(key = 10)]
+    pub max_line_bytes: usize,
+    #[cultcache(key = 11)]
+    pub max_total_bytes: usize,
+    #[cultcache(key = 12)]
+    pub stderr_tail_bytes: usize,
+    #[cultcache(key = 13)]
+    pub max_frame_bytes: usize,
+    #[cultcache(key = 14)]
+    pub max_connections: usize,
+    #[cultcache(key = 15)]
+    pub socket_timeout_ms: u64,
+    #[cultcache(key = 16)]
+    pub max_expiry_skew_ms: u64,
+    /// Exactly one caller until claude-handle-caller-binding lands.
+    #[cultcache(key = 17)]
+    pub callers: Vec<CallerConfig>,
+    /// What each allowed model costs; keys are canonical model ids.
+    #[cultcache(key = 18)]
+    pub prices: BTreeMap<String, ModelPrice>,
+}
+
+/// A refusal. It names the field or stage that failed and nothing the
+/// operator or the file typed.
+#[derive(Debug, Error)]
+pub enum ConfigError {
+    #[error("invalid configuration field {0}")]
+    Invalid(&'static str),
+    #[error("the configuration store could not be read as a claude connector document")]
+    Store,
+    #[error("the prompt directory is not a directory owned by this process with mode 0700")]
+    PromptDir,
+    #[error("the listener could not be bound")]
+    Listen,
+    /// Something the document names exists but cannot be used now.
+    #[error("the configured {0} cannot be used")]
+    Unusable(&'static str),
+    /// The serve loop failed after it started.
+    #[error("the serve loop failed at {0}")]
+    Serving(&'static str),
+}
+
+/// The kit's serve errors carry stored paths, ids and numbers; none of that
+/// text is shown. Each maps to the configuration field or stage it names.
+impl From<ServeError> for ConfigError {
+    fn from(error: ServeError) -> Self {
+        match error {
+            ServeError::InvalidConfig(field) | ServeError::BackendUnready(field) => {
+                Self::Unusable(field)
+            }
+            ServeError::FrameBound { .. } => Self::Invalid("max_frame_bytes"),
+            ServeError::ConnectionKey(_) => Self::Unusable("connection_key_file"),
+            ServeError::Service(error) => match error {
+                ServiceError::ReplayStore(_) => Self::Unusable("replay_store"),
+                ServiceError::UnpricedModel(_) => Self::Invalid("prices"),
+                ServiceError::InvalidAdmission
+                | ServiceError::DuplicateCaller
+                | ServiceError::SharedCallerKey => Self::Invalid("callers"),
+                _ => Self::Serving("service"),
+            },
+            ServeError::ServicePoisoned => Self::Serving("service"),
+            ServeError::Listen(_) => Self::Serving("listener"),
+            ServeError::Thread(_) | ServeError::Connection(_) => Self::Serving("connection"),
+            ServeError::FrameSize | ServeError::FrameEncoding => Self::Serving("frame"),
+            ServeError::Clock => Self::Serving("clock"),
+        }
+    }
+}
+
+impl ClaudeConnectorConfig {
+    /// The one validation: `config init`, `config check` and `serve` all pass
+    /// through it. Returns the listen address.
+    pub fn validate(&self) -> Result<SocketAddr, ConfigError> {
+        let listen = self
+            .listen
+            .parse::<SocketAddr>()
+            .ok()
+            .filter(|address| address.ip().is_loopback())
+            .ok_or(ConfigError::Invalid("listen"))?;
+        let paths = [
+            ("replay_store", &self.replay_store),
+            ("claude_binary", &self.claude_binary),
+            ("work_dir", &self.work_dir),
+            ("config_dir", &self.config_dir),
+            ("prompt_dir", &self.prompt_dir),
+        ];
+        for (field, path) in paths {
+            if !path.is_absolute() {
+                return Err(ConfigError::Invalid(field));
+            }
+        }
+        if self.claude_binary_sha256 == [0; 32] {
+            return Err(ConfigError::Invalid("claude_binary_sha256"));
+        }
+        if !is_trimmed_nonempty(&self.instance) {
+            return Err(ConfigError::Invalid("instance"));
+        }
+        if !is_credential_name(&self.token_credential) {
+            return Err(ConfigError::Invalid("token_credential"));
+        }
+        if self.deadline_ms == 0
+            || self.max_line_bytes == 0
+            || self.max_total_bytes < self.max_line_bytes
+            || self.stderr_tail_bytes == 0
+        {
+            return Err(ConfigError::Invalid("child limits"));
+        }
+        if self.max_frame_bytes == 0
+            || self.max_connections == 0
+            || self.socket_timeout_ms == 0
+            || self.max_expiry_skew_ms == 0
+        {
+            return Err(ConfigError::Invalid("serve limits"));
+        }
+        let [caller] = self.callers.as_slice() else {
+            return Err(ConfigError::Invalid("callers"));
+        };
+        if !is_trimmed_nonempty(&caller.caller_runtime_id) {
+            return Err(ConfigError::Invalid("caller_runtime_id"));
+        }
+        if !caller.connection_key_file.is_absolute() {
+            return Err(ConfigError::Invalid("connection_key_file"));
+        }
+        if caller.connection_key_epoch == 0 {
+            return Err(ConfigError::Invalid("connection_key_epoch"));
+        }
+        if caller.max_concurrent_requests == 0
+            || caller.max_payload_bytes < MIN_PAYLOAD_BYTES
+            || caller.max_output_tokens == 0
+            || caller.spend_ceiling_micro_usd == 0
+            || caller.spend_window_ms == 0
+        {
+            return Err(ConfigError::Invalid("caller bounds"));
+        }
+        if caller.allowed_models.is_empty() {
+            return Err(ConfigError::Invalid("allowed_models"));
+        }
+        let mut seen = BTreeSet::new();
+        for model in &caller.allowed_models {
+            if !is_canonical_model(model)
+                || !seen.insert(model.as_str())
+                || !self.prices.contains_key(model)
+            {
+                return Err(ConfigError::Invalid("allowed_models"));
+            }
+        }
+        if !self
+            .prices
+            .iter()
+            .all(|(model, price)| is_canonical_model(model) && is_fully_priced(price))
+        {
+            return Err(ConfigError::Invalid("prices"));
+        }
+        Ok(listen)
+    }
+
+    fn backend_config(&self) -> ClaudeCodeConfig {
+        ClaudeCodeConfig {
+            claude_binary: self.claude_binary.clone(),
+            claude_binary_sha256: self.claude_binary_sha256,
+            work_dir: self.work_dir.clone(),
+            config_dir: self.config_dir.clone(),
+            prompt_dir: self.prompt_dir.clone(),
+            token_credential: self.token_credential.clone(),
+            instance: self.instance.clone(),
+            limits: ClaudeCodeLimits {
+                deadline: Duration::from_millis(self.deadline_ms),
+                max_line_bytes: self.max_line_bytes,
+                max_total_bytes: self.max_total_bytes,
+                stderr_tail_bytes: self.stderr_tail_bytes,
+            },
+        }
+    }
+
+    fn serve_limits(&self) -> ServeLimits {
+        ServeLimits {
+            max_frame_bytes: self.max_frame_bytes,
+            max_connections: self.max_connections,
+            socket_timeout_ms: self.socket_timeout_ms,
+            max_expiry_skew_ms: self.max_expiry_skew_ms,
+        }
+    }
+}
+
+fn is_trimmed_nonempty(text: &str) -> bool {
+    !text.is_empty() && text.trim() == text
+}
+
+/// A model id the CLI echoes back unchanged: `claude-<family>-<major>-<minor>`
+/// with an optional `-YYYYMMDD` suffix, the family lowercase letters. Aliases
+/// and bare prefixes are refused because the stream's `init.model` must equal
+/// the requested model.
+fn is_canonical_model(model: &str) -> bool {
+    let Some(rest) = model.strip_prefix(MODEL_PREFIX) else {
+        return false;
+    };
+    let digits = |part: &str, most: usize| {
+        (1..=most).contains(&part.len()) && part.bytes().all(|byte| byte.is_ascii_digit())
+    };
+    let mut parts = rest.split('-');
+    let family = parts.next().unwrap_or("");
+    let major = parts.next().unwrap_or("");
+    let minor = parts.next().unwrap_or("");
+    let date = parts.next();
+    !family.is_empty()
+        && family.bytes().all(|byte| byte.is_ascii_lowercase())
+        && digits(major, 2)
+        && digits(minor, 2)
+        && date.is_none_or(|date| date.len() == 8 && digits(date, 8))
+        && parts.next().is_none()
+}
+
+/// A price is a fuse only if every component it bills is nonzero: a zero rate
+/// lets a call cost nothing against the caller's ceiling.
+fn is_fully_priced(price: &ModelPrice) -> bool {
+    let long = price.long_context.map(|long| long.rates);
+    [Some(price.rates), long]
+        .into_iter()
+        .flatten()
+        .all(|rates| {
+            [
+                rates.input,
+                rates.cache_write_short,
+                rates.cache_write_long,
+                rates.cache_read,
+                rates.output,
+            ]
+            .iter()
+            .all(|rate| *rate > 0)
+        })
+}
+
+/// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
+fn is_credential_name(name: &str) -> bool {
+    !name.is_empty()
+        && name != "."
+        && name != ".."
+        && name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_'))
+}
+
+/// Reads the document without writing: a shared snapshot of exactly one
+/// record, with the exact key, type and schema id, in canonical positional
+/// MessagePack, then validated.
+pub fn load_config(path: &Path) -> Result<ClaudeConnectorConfig, ConfigError> {
+    let store = SingleFileMessagePackBackingStore::new(path);
+    let config = store
+        .with_read_only_shared_snapshot(|entries| {
+            let [envelope] = entries.as_slice() else {
+                anyhow::bail!("not exactly one record");
+            };
+            if envelope.key != CONFIG_KEY
+                || envelope.r#type != ClaudeConnectorConfig::TYPE
+                || envelope.schema_id.as_deref() != Some(ClaudeConnectorConfig::TYPE)
+            {
+                anyhow::bail!("wrong typed envelope");
+            }
+            let config: ClaudeConnectorConfig = rmp_serde::from_slice(&envelope.payload)?;
+            if rmp_serde::to_vec(&config)? != envelope.payload {
+                anyhow::bail!("not canonical positional MessagePack");
+            }
+            Ok(config)
+        })
+        .map_err(|_| ConfigError::Store)?;
+    config.validate()?;
+    Ok(config)
+}
+
+/// Validates, then writes the document as the store's only record.
+pub fn write_config(path: &Path, config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
+    config.validate()?;
+    let mut cache = CultCache::new();
+    cache
+        .register_entry_type::<ClaudeConnectorConfig>()
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(path))
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .pull_all_backing_stores()
+        .map_err(|_| ConfigError::Store)?;
+    cache
+        .put(CONFIG_KEY, config)
+        .map_err(|_| ConfigError::Store)?;
+    Ok(())
+}
+
+/// The prompt directory holds every system prompt in flight: it must be a
+/// real directory (not a link) that this process owns and nobody else can
+/// enter.
+#[cfg(unix)]
+pub fn check_prompt_dir(dir: &Path) -> Result<(), ConfigError> {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+    let metadata = std::fs::symlink_metadata(dir).map_err(|_| ConfigError::PromptDir)?;
+    // SAFETY: geteuid has no preconditions and cannot fail.
+    let uid = unsafe { libc::geteuid() };
+    if !metadata.is_dir()
+        || metadata.uid() != uid
+        || metadata.permissions().mode() & 0o7777 != 0o700
+    {
+        return Err(ConfigError::PromptDir);
+    }
+    Ok(())
+}
+
+/// The child's stderr is the log's business by size only: its bytes are never
+/// written anywhere the connector controls.
+struct LogSink<W>(std::sync::Mutex<W>);
+
+impl<W: std::io::Write + Send> StderrSink for LogSink<W> {
+    fn stderr_tail(&self, tail: &[u8]) {
+        if let Ok(mut log) = self.0.lock() {
+            let _ = writeln!(log, "claude-connector: child stderr, {} bytes", tail.len());
+        }
+    }
+}
+
+/// Everything `serve` needs true before it binds, in one place so that
+/// `config check` passes exactly what `serve` will start: the prompt
+/// directory, the other directories, the credential, the pin, the connection
+/// key and the frame and connection bounds. Returns the admitted callers.
+fn readiness_of(config: &ClaudeConnectorConfig) -> Result<Vec<CallerAdmission>, ConfigError> {
+    config.validate()?;
+    #[cfg(unix)]
+    check_prompt_dir(&config.prompt_dir)?;
+    let admissions = load_admissions(&config.callers)?;
+    config.serve_limits().validate(&admissions)?;
+    let backend = config.backend_config();
+    readiness(
+        &backend,
+        &CredentialTokenSource::from_environment(backend.token_credential.clone()),
+    )
+    .map_err(ConfigError::Unusable)?;
+    Ok(admissions)
+}
+
+/// Whether `serve` would start with this document and this environment.
+pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
+    readiness_of(config).map(drop)
+}
+
+/// Loads the document and serves until the listener fails.
+#[cfg(unix)]
+pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
+    let config = load_config(path)?;
+    let admissions = readiness_of(&config)?;
+    let listen = config.validate()?;
+    let backend = Arc::new(ClaudeCodeBackend::new(
+        config.backend_config(),
+        Box::new(LogSink(std::sync::Mutex::new(std::io::stderr()))),
+    ));
+    let listener = TcpListener::bind(listen).map_err(|_| ConfigError::Listen)?;
+    serve(
+        listener,
+        config.serve_limits(),
+        admissions,
+        config.prices.clone(),
+        &config.replay_store,
+        backend,
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{Arc, Mutex};
+
+    use super::*;
+
+    /// A log that a test can read back.
+    #[derive(Clone, Default)]
+    struct Captured(Arc<Mutex<Vec<u8>>>);
+
+    impl std::io::Write for Captured {
+        fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+            self.0.lock().unwrap().extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn serve_errors_name_a_field_or_stage_and_never_a_stored_value() {
+        const CANARY: &str = "canary-path-8e2a";
+        let io = || std::io::Error::other(CANARY);
+        let cases: Vec<(ServeError, &str)> = vec![
+            (ServeError::InvalidConfig("callers"), "callers"),
+            (ServeError::BackendUnready("work_dir"), "work_dir"),
+            (
+                ServeError::FrameBound {
+                    max_frame_bytes: 4099,
+                    payload_bytes: 4096,
+                    needed_frame_bytes: 9999,
+                },
+                "max_frame_bytes",
+            ),
+            (ServeError::ConnectionKey(io()), "connection_key_file"),
+            (
+                ServeError::Service(ServiceError::ReplayStore(format!("{CANARY}/replay.cc"))),
+                "replay_store",
+            ),
+            (
+                ServeError::Service(ServiceError::UnpricedModel(CANARY.to_string())),
+                "prices",
+            ),
+            (
+                ServeError::Service(ServiceError::InvalidAdmission),
+                "callers",
+            ),
+            (
+                ServeError::Service(ServiceError::DuplicateCaller),
+                "callers",
+            ),
+            (
+                ServeError::Service(ServiceError::SharedCallerKey),
+                "callers",
+            ),
+            (ServeError::Listen(io()), "listener"),
+        ];
+        for (error, field) in cases {
+            let shown = ConfigError::from(error);
+            let text = format!("{shown} {shown:?}");
+            assert!(text.contains(field), "{text}");
+            for stored in [CANARY, "4099", "9999", "replay.cc"] {
+                assert!(!text.contains(stored), "{text}");
+            }
+        }
+    }
+
+    #[test]
+    fn the_log_gets_the_size_of_the_childs_stderr_and_never_its_bytes() {
+        let log = Captured::default();
+        let sink = LogSink(Mutex::new(log.clone()));
+        sink.stderr_tail(b"canary-stderr-text, 22 bytes");
+        let written = String::from_utf8(log.0.lock().unwrap().clone()).unwrap();
+        assert_eq!(
+            written,
+            "claude-connector: child stderr, 28 bytes
+"
+        );
+        assert!(!written.contains("canary"));
+    }
+
+    #[cfg(unix)]
+    mod prompt_dir {
+        use std::os::unix::fs::{PermissionsExt, chown, symlink};
+        use std::path::PathBuf;
+
+        use super::super::check_prompt_dir;
+
+        struct Dir(PathBuf);
+
+        impl Dir {
+            fn new(name: &str) -> Self {
+                let path = std::env::temp_dir()
+                    .join(format!("claude-prompt-dir-{}-{name}", std::process::id()));
+                let _ = std::fs::remove_dir_all(&path);
+                std::fs::create_dir_all(&path).unwrap();
+                Self(path)
+            }
+            fn mode(&self, mode: u32) {
+                std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(mode)).unwrap();
+            }
+        }
+
+        impl Drop for Dir {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+
+        #[test]
+        fn only_mode_0700_passes() {
+            let dir = Dir::new("modes");
+            dir.mode(0o700);
+            assert!(check_prompt_dir(&dir.0).is_ok());
+            // Each of these leaves the owner able to enter, or adds a bit
+            // beyond the owner's three; all are refused.
+            for mode in [
+                0o500, 0o300, 0o100, 0o600, 0o770, 0o707, 0o750, 0o755, 0o1700, 0o2700, 0o4700,
+            ] {
+                dir.mode(mode);
+                assert!(check_prompt_dir(&dir.0).is_err(), "{mode:o}");
+            }
+        }
+
+        #[test]
+        fn a_link_to_a_good_directory_is_refused() {
+            let dir = Dir::new("link-target");
+            dir.mode(0o700);
+            let link =
+                std::env::temp_dir().join(format!("claude-prompt-dir-{}-link", std::process::id()));
+            let _ = std::fs::remove_file(&link);
+            symlink(&dir.0, &link).unwrap();
+            let refused = check_prompt_dir(&link).is_err();
+            std::fs::remove_file(&link).unwrap();
+            assert!(refused);
+        }
+
+        #[test]
+        fn a_directory_owned_by_another_user_is_refused() {
+            // SAFETY: geteuid has no preconditions and cannot fail.
+            if unsafe { libc::geteuid() } != 0 {
+                eprintln!("skipped: only root can give a directory away");
+                return;
+            }
+            let dir = Dir::new("owner");
+            dir.mode(0o700);
+            assert!(check_prompt_dir(&dir.0).is_ok());
+            chown(&dir.0, Some(1234), None).unwrap();
+            assert!(check_prompt_dir(&dir.0).is_err());
+        }
+    }
+}
diff --git a/crates/claude-connector/src/launch.rs b/crates/claude-connector/src/launch.rs
index 22c8813..c94134c 100644
--- a/crates/claude-connector/src/launch.rs
+++ b/crates/claude-connector/src/launch.rs
@@ -14,8 +14,8 @@ use zeroize::Zeroizing;
 use crate::config::ClaudeCodeConfig;
 use crate::handle::Plan;
 
-/// The one credential variable, copied by name from the connector's own
-/// environment into the child and nowhere else.
+/// The one credential variable: the child's environment is the only
+/// environment the token ever enters.
 pub(crate) const TOKEN_VAR: &str = "CLAUDE_CODE_OAUTH_TOKEN";
 const CHILD_PATH: &str = "/usr/local/bin:/usr/bin:/bin";
 
@@ -62,13 +62,18 @@ pub(crate) struct PromptFile(PathBuf);
 static PROMPT_FILES: AtomicU64 = AtomicU64::new(0);
 
 impl PromptFile {
-    pub(crate) fn create(instructions: &str) -> io::Result<Self> {
+    pub(crate) fn create(dir: &Path, instructions: &str) -> io::Result<Self> {
         let name = format!(
             "claude-connector-prompt-{}-{}",
             std::process::id(),
             PROMPT_FILES.fetch_add(1, Ordering::Relaxed)
         );
-        let path = std::env::temp_dir().join(name);
+        Self::create_at(dir.join(name), instructions)
+    }
+
+    /// Creates `path` and nothing that already exists there: a file, a link
+    /// (dangling or not) or a directory at the name fails, and is left alone.
+    fn create_at(path: PathBuf, instructions: &str) -> io::Result<Self> {
         let mut options = OpenOptions::new();
         options.write(true).create_new(true);
         #[cfg(unix)]
@@ -146,3 +151,57 @@ pub(crate) fn argv(
     }
     argv
 }
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    use super::*;
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "claude-connector-launch-{name}-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[test]
+    fn a_prompt_is_created_private_and_removed_on_drop() {
+        let dir = scratch("private");
+        let prompt = PromptFile::create(&dir, "the prompt").unwrap();
+        let path = prompt.path().to_path_buf();
+        assert_eq!(path.parent(), Some(dir.as_path()));
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "the prompt");
+        let mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600);
+        drop(prompt);
+        assert!(!path.exists());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn a_name_already_taken_is_never_written_or_removed() {
+        let dir = scratch("taken");
+        let victim = dir.join("victim");
+        std::fs::write(&victim, "keep").unwrap();
+
+        let file = dir.join("file");
+        std::fs::write(&file, "mine").unwrap();
+        let link = dir.join("link");
+        symlink(&victim, &link).unwrap();
+        let dangling = dir.join("dangling");
+        symlink(dir.join("nowhere"), &dangling).unwrap();
+
+        for taken in [&file, &link, &dangling] {
+            assert!(PromptFile::create_at(taken.clone(), "the prompt").is_err());
+        }
+        assert_eq!(std::fs::read_to_string(&victim).unwrap(), "keep");
+        assert_eq!(std::fs::read_to_string(&file).unwrap(), "mine");
+        assert!(!dir.join("nowhere").exists());
+        assert!(link.exists() && dangling.symlink_metadata().is_ok());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 28ad7f5..ef3e404 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -5,13 +5,17 @@
 
 mod backend;
 mod config;
+mod daemon;
 mod handle;
 mod launch;
 mod process;
 mod stream;
 
-pub use backend::{ClaudeCodeBackend, StderrSink};
+pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
+pub use daemon::{ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config};
+#[cfg(unix)]
+pub use daemon::{check_prompt_dir, serve_config};
 pub use handle::{FsSessionStore, SessionStore};
 pub use launch::ChildEnv;
 #[cfg(unix)]
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
new file mode 100644
index 0000000..ece39cc
--- /dev/null
+++ b/crates/claude-connector/src/main.rs
@@ -0,0 +1,241 @@
+//! The claude-connector binary.
+//!
+//!   claude-connector serve --config PATH.cc
+//!   claude-connector config init PATH.cc --flag value ...
+//!   claude-connector config check PATH.cc
+//!
+//! `serve` takes its configuration from the typed document alone. The flags of
+//! `config init` exist only to author that document. No message here echoes a
+//! value that was typed or stored; refusals name a field or a flag.
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use claude_connector::{
+    ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config,
+};
+use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
+
+fn main() -> ExitCode {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let args: Vec<&str> = args.iter().map(String::as_str).collect();
+    let result = match args.as_slice() {
+        ["serve", "--config", path] => serve(path),
+        ["config", "init", path, flags @ ..] => init(path, flags),
+        ["config", "check", path] => check(path),
+        _ => Err(Failure::Usage),
+    };
+    match result {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(failure) => {
+            eprintln!("claude-connector: {failure}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+enum Failure {
+    #[error("usage: serve --config PATH | config init PATH --flag value ... | config check PATH")]
+    Usage,
+    #[error(transparent)]
+    Config(#[from] ConfigError),
+    #[error("flag {0} is missing")]
+    Missing(&'static str),
+    #[error("flag {0} is malformed")]
+    Malformed(&'static str),
+    #[error("a flag is unknown, repeated or has no value")]
+    Flags,
+}
+
+#[cfg(unix)]
+fn serve(path: &str) -> Result<(), Failure> {
+    Ok(claude_connector::serve_config(path.as_ref())?)
+}
+
+#[cfg(not(unix))]
+fn serve(_: &str) -> Result<(), Failure> {
+    Err(Failure::Usage)
+}
+
+fn check(path: &str) -> Result<(), Failure> {
+    let config = load_config(path.as_ref())?;
+    check_ready(&config)?;
+    println!("claude connector configuration is valid and ready to serve");
+    println!("callers: {}", config.callers.len());
+    println!("allowed_models: {}", config.callers[0].allowed_models.len());
+    println!("prices: {}", config.prices.len());
+    Ok(())
+}
+
+/// The flags of `config init`, each given at most once except the two lists.
+struct Flags {
+    single: BTreeMap<&'static str, String>,
+    models: Vec<String>,
+    prices: Vec<String>,
+}
+
+const SINGLE: [&str; 22] = [
+    "--listen",
+    "--replay-store",
+    "--claude-binary",
+    "--claude-sha256",
+    "--work-dir",
+    "--config-dir",
+    "--prompt-dir",
+    "--instance",
+    "--token-credential",
+    "--caller-id",
+    "--connection-key-file",
+    "--connection-key-epoch",
+    "--spend-ceiling-micro-usd",
+    "--spend-window-ms",
+    "--deadline-ms",
+    "--max-line-bytes",
+    "--max-total-bytes",
+    "--stderr-tail-bytes",
+    "--max-concurrent-requests",
+    "--max-payload-bytes",
+    "--max-output-tokens",
+    "--socket-timeout-ms",
+];
+
+impl Flags {
+    fn parse(args: &[&str]) -> Result<Self, Failure> {
+        let mut flags = Flags {
+            single: BTreeMap::new(),
+            models: Vec::new(),
+            prices: Vec::new(),
+        };
+        let mut args = args.iter();
+        while let Some(&name) = args.next() {
+            let Some(&value) = args.next() else {
+                return Err(Failure::Flags);
+            };
+            match name {
+                "--allowed-model" => flags.models.push(value.to_string()),
+                "--price" => flags.prices.push(value.to_string()),
+                _ => {
+                    let Some(known) = SINGLE.iter().find(|known| **known == name) else {
+                        return Err(Failure::Flags);
+                    };
+                    if flags.single.insert(*known, value.to_string()).is_some() {
+                        return Err(Failure::Flags);
+                    }
+                }
+            }
+        }
+        Ok(flags)
+    }
+
+    fn text(&self, name: &'static str) -> Result<String, Failure> {
+        self.single.get(name).cloned().ok_or(Failure::Missing(name))
+    }
+
+    fn path(&self, name: &'static str) -> Result<PathBuf, Failure> {
+        self.text(name).map(PathBuf::from)
+    }
+
+    fn number<T: std::str::FromStr>(&self, name: &'static str) -> Result<T, Failure> {
+        self.text(name)?
+            .parse()
+            .map_err(|_| Failure::Malformed(name))
+    }
+
+    fn number_or<T: std::str::FromStr>(
+        &self,
+        name: &'static str,
+        default: T,
+    ) -> Result<T, Failure> {
+        match self.single.get(name) {
+            None => Ok(default),
+            Some(text) => text.parse().map_err(|_| Failure::Malformed(name)),
+        }
+    }
+}
+
+fn sha256(hex: &str) -> Option<[u8; 32]> {
+    if hex.len() != 64 || !hex.is_ascii() {
+        return None;
+    }
+    let mut digest = [0_u8; 32];
+    for (byte, pair) in digest.iter_mut().zip(hex.as_bytes().chunks(2)) {
+        *byte = u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok()?;
+    }
+    Some(digest)
+}
+
+/// MODEL:INPUT:OUTPUT:CACHE_WRITE:CACHE_READ:OVERHEAD, rates in micro-USD per
+/// million tokens. The one cache-write rate prices both retentions.
+fn price(text: &str) -> Option<(String, ModelPrice)> {
+    let mut parts = text.split(':');
+    let model = parts.next()?.to_string();
+    let mut next = || parts.next()?.parse::<u64>().ok();
+    let (input, output, cache_write, cache_read, overhead_tokens) =
+        (next()?, next()?, next()?, next()?, next()?);
+    if parts.next().is_some() {
+        return None;
+    }
+    Some((
+        model,
+        ModelPrice {
+            rates: Rates {
+                input,
+                cache_write_short: cache_write,
+                cache_write_long: cache_write,
+                cache_read,
+                output,
+            },
+            long_context: None,
+            overhead_tokens,
+        },
+    ))
+}
+
+fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
+    let flags = Flags::parse(args)?;
+    let max_payload_bytes: usize = flags.number_or("--max-payload-bytes", 1 << 20)?;
+    let max_concurrent_requests: usize = flags.number_or("--max-concurrent-requests", 4)?;
+    let mut prices = BTreeMap::new();
+    for text in &flags.prices {
+        let (model, price) = price(text).ok_or(Failure::Malformed("--price"))?;
+        if prices.insert(model, price).is_some() {
+            return Err(Failure::Malformed("--price"));
+        }
+    }
+    let config = ClaudeConnectorConfig {
+        listen: flags.text("--listen")?,
+        replay_store: flags.path("--replay-store")?,
+        claude_binary: flags.path("--claude-binary")?,
+        claude_binary_sha256: sha256(&flags.text("--claude-sha256")?)
+            .ok_or(Failure::Malformed("--claude-sha256"))?,
+        work_dir: flags.path("--work-dir")?,
+        config_dir: flags.path("--config-dir")?,
+        prompt_dir: flags.path("--prompt-dir")?,
+        instance: flags.text("--instance")?,
+        token_credential: flags.text("--token-credential")?,
+        deadline_ms: flags.number_or("--deadline-ms", 600_000)?,
+        max_line_bytes: flags.number_or("--max-line-bytes", 4 << 20)?,
+        max_total_bytes: flags.number_or("--max-total-bytes", 64 << 20)?,
+        stderr_tail_bytes: flags.number_or("--stderr-tail-bytes", 8192)?,
+        max_frame_bytes: frame_bytes_for_payload(max_payload_bytes),
+        max_connections: max_concurrent_requests.max(8),
+        socket_timeout_ms: flags.number_or("--socket-timeout-ms", 10_000)?,
+        max_expiry_skew_ms: 300_000,
+        callers: vec![CallerConfig {
+            caller_runtime_id: flags.text("--caller-id")?,
+            connection_key_file: flags.path("--connection-key-file")?,
+            connection_key_epoch: flags.number("--connection-key-epoch")?,
+            allowed_models: flags.models.clone(),
+            max_concurrent_requests,
+            max_payload_bytes,
+            max_output_tokens: flags.number_or("--max-output-tokens", 32_768)?,
+            spend_ceiling_micro_usd: flags.number("--spend-ceiling-micro-usd")?,
+            spend_window_ms: flags.number("--spend-window-ms")?,
+        }],
+        prices,
+    };
+    write_config(path.as_ref(), &config)?;
+    Ok(())
+}
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index 7bb336b..e99935f 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -8,7 +8,8 @@ use serde::Deserialize;
 use serde_json::Value;
 
 /// A call that cannot complete, with the stage that failed. `usage` is `None`
-/// unless a result event reported it.
+/// (the kit bills its reservation) unless a result event reported it or the
+/// call never reached the provider (zero).
 #[derive(Debug, PartialEq, Eq)]
 pub(crate) struct Failure {
     pub kind: FailureKind,
@@ -17,13 +18,24 @@ pub(crate) struct Failure {
 }
 
 impl Failure {
-    pub(crate) fn unbilled(kind: FailureKind, message: &'static str) -> Self {
+    /// A failure after the child ran: what the provider billed is unknown, so
+    /// the kit bills its reservation.
+    pub(crate) fn cost_unknown(kind: FailureKind, message: &'static str) -> Self {
         Self {
             kind,
             message,
             usage: None,
         }
     }
+
+    /// A failure before anything was sent to the provider: it bills nothing.
+    pub(crate) fn never_reached(kind: FailureKind, message: &'static str) -> Self {
+        Self {
+            kind,
+            message,
+            usage: Some(sum_usage(std::iter::empty())),
+        }
+    }
 }
 
 /// What the stream said, once its result event arrived.
@@ -181,7 +193,7 @@ impl<'a> StreamState<'a> {
         let door_refusal = !success
             && matches!(
                 line.api_error_status.as_ref().and_then(Value::as_u64),
-                Some(401 | 403)
+                Some(401 | 403 | 429)
             );
         let usage = read_usage(line.model_usage_since_last_result, door_refusal);
         if !success {
@@ -252,13 +264,13 @@ impl<'a> StreamState<'a> {
 }
 
 fn fail(kind: FailureKind, message: &'static str) -> Step {
-    Step::Done(Box::new(Err(Failure::unbilled(kind, message))))
+    Step::Done(Box::new(Err(Failure::cost_unknown(kind, message))))
 }
 
 /// What this turn consumed, summed over every model it used (harness side
 /// calls included), or `None` when the result does not say: the field absent,
 /// of another shape, or empty. An empty report is believed only for a refusal
-/// at the door (401 or 403), which the provider cannot have billed; elsewhere
+/// at the door (401, 403 or 429), which the provider cannot have billed; elsewhere
 /// the CLI also zeroes usage on crashes after real work. `None` is billed the
 /// reservation by the kit.
 fn read_usage(reported: Option<Value>, door_refusal: bool) -> Option<Usage> {
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
new file mode 100644
index 0000000..4bc35d4
--- /dev/null
+++ b/crates/claude-connector/tests/config_document.rs
@@ -0,0 +1,902 @@
+//! The claude-connector's configuration document and binary: what the
+//! document accepts, what it refuses, and that no refusal or output echoes a
+//! byte of a value that was typed, stored or read from a credential.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+use cultcache_rs::{
+    CacheBackingStore, CultCache, CultCacheEnvelope, DatabaseEntry,
+    SingleFileMessagePackBackingStore,
+};
+use model_connector::{CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
+
+const CANARY: &str = "canary-9f3b7c1d";
+const OPUS: &str = "claude-opus-5-1";
+const HAIKU: &str = "claude-haiku-5-5";
+
+/// An edit that should make the valid document refuse.
+type Change = Box<dyn Fn(&mut ClaudeConnectorConfig)>;
+
+static SEQUENCE: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!(
+            "claude-connector-config-{}-{}",
+            std::process::id(),
+            SEQUENCE.fetch_add(1, Ordering::SeqCst)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+    fn path(&self, name: &str) -> PathBuf {
+        self.0.join(name)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn price() -> ModelPrice {
+    ModelPrice {
+        rates: Rates {
+            input: 3_000_000,
+            cache_write_short: 3_750_000,
+            cache_write_long: 3_750_000,
+            cache_read: 300_000,
+            output: 15_000_000,
+        },
+        long_context: None,
+        overhead_tokens: 100,
+    }
+}
+
+fn valid() -> ClaudeConnectorConfig {
+    ClaudeConnectorConfig {
+        listen: "127.0.0.1:7443".to_string(),
+        replay_store: "/var/lib/claude-connector/replay.cc".into(),
+        claude_binary: "/opt/claude/bin/claude".into(),
+        claude_binary_sha256: [7; 32],
+        work_dir: "/var/lib/claude-connector/work".into(),
+        config_dir: "/var/lib/claude-connector/home".into(),
+        prompt_dir: "/var/lib/claude-connector/prompts".into(),
+        instance: "persona-a".to_string(),
+        token_credential: "claude-token".to_string(),
+        deadline_ms: 600_000,
+        max_line_bytes: 4 << 20,
+        max_total_bytes: 64 << 20,
+        stderr_tail_bytes: 8192,
+        max_frame_bytes: 2 << 20,
+        max_connections: 8,
+        socket_timeout_ms: 10_000,
+        max_expiry_skew_ms: 300_000,
+        callers: vec![CallerConfig {
+            caller_runtime_id: "persona-a-caller".to_string(),
+            connection_key_file: "/etc/claude-connector/caller.key".into(),
+            connection_key_epoch: 1,
+            allowed_models: vec![HAIKU.to_string(), OPUS.to_string()],
+            max_concurrent_requests: 4,
+            max_payload_bytes: 1 << 20,
+            max_output_tokens: 32_768,
+            spend_ceiling_micro_usd: 50_000_000,
+            spend_window_ms: 3_600_000,
+        }],
+        prices: BTreeMap::from([(HAIKU.to_string(), price()), (OPUS.to_string(), price())]),
+    }
+}
+
+fn refused(config: &ClaudeConnectorConfig) -> &'static str {
+    match config.validate() {
+        Err(ConfigError::Invalid(field)) => field,
+        other => panic!("expected a refusal naming a field, got {other:?}"),
+    }
+}
+
+#[test]
+fn config_round_trips_through_cultcache() {
+    let scratch = Scratch::new();
+    let path = scratch.path("connector.cc");
+    let config = valid();
+    write_config(&path, &config).unwrap();
+    assert_eq!(load_config(&path).unwrap(), config);
+}
+
+#[test]
+fn a_second_record_or_the_wrong_type_is_refused() {
+    let scratch = Scratch::new();
+    let path = scratch.path("two.cc");
+    let config = valid();
+    write_config(&path, &config).unwrap();
+    let mut cache = CultCache::new();
+    cache
+        .register_entry_type::<ClaudeConnectorConfig>()
+        .unwrap();
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&path))
+        .unwrap();
+    cache.pull_all_backing_stores().unwrap();
+    cache.put("extra", &config).unwrap();
+    assert!(matches!(load_config(&path), Err(ConfigError::Store)));
+
+    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+    #[cultcache(type = "gamecult.other.document.v1")]
+    struct Other {
+        #[cultcache(key = 0)]
+        value: u32,
+    }
+    let other = scratch.path("other.cc");
+    let mut cache = CultCache::new();
+    cache.register_entry_type::<Other>().unwrap();
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&other))
+        .unwrap();
+    cache.pull_all_backing_stores().unwrap();
+    cache.put("runtime", &Other { value: 1 }).unwrap();
+    assert!(matches!(load_config(&other), Err(ConfigError::Store)));
+
+    assert!(matches!(
+        load_config(&scratch.path("absent.cc")),
+        Err(ConfigError::Store)
+    ));
+}
+
+fn store_raw(path: &Path, key: &str, ty: &str, schema: Option<&str>, payload: Vec<u8>) {
+    let mut store = SingleFileMessagePackBackingStore::new(path);
+    store
+        .push(&CultCacheEnvelope {
+            key: key.to_string(),
+            r#type: ty.to_string(),
+            payload,
+            stored_at: "2026-10-29T00:00:00Z".to_string(),
+            schema_id: schema.map(str::to_string),
+        })
+        .unwrap();
+}
+
+#[test]
+fn the_envelope_must_be_exactly_the_documents_key_type_schema_and_encoding() {
+    let scratch = Scratch::new();
+    let canonical = rmp_serde::to_vec(&valid()).unwrap();
+    let ty = ClaudeConnectorConfig::TYPE;
+    let mut trailing = canonical.clone();
+    trailing.push(0xc0);
+
+    let cases = vec![
+        ("wrong key", "other", ty, Some(ty), canonical.clone()),
+        (
+            "wrong type",
+            "runtime",
+            "gamecult.other.v1",
+            Some(ty),
+            canonical.clone(),
+        ),
+        (
+            "wrong schema",
+            "runtime",
+            ty,
+            Some("gamecult.other.v1"),
+            canonical.clone(),
+        ),
+        ("not canonical", "runtime", ty, Some(ty), trailing),
+    ];
+    for (name, key, ty, schema, payload) in cases {
+        let path = scratch.path(&format!("{}.cc", name.replace(' ', "-")));
+        store_raw(&path, key, ty, schema, payload);
+        assert!(
+            matches!(load_config(&path), Err(ConfigError::Store)),
+            "{name}"
+        );
+    }
+
+    // The same bytes with every part right load.
+    let path = scratch.path("right.cc");
+    store_raw(&path, "runtime", ty, Some(ty), canonical);
+    assert_eq!(load_config(&path).unwrap(), valid());
+}
+
+#[test]
+fn bounds_sit_exactly_where_the_connector_needs_them() {
+    let mut config = valid();
+    config.max_total_bytes = config.max_line_bytes;
+    config.validate().unwrap();
+    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES;
+    config.validate().unwrap();
+    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES - 1;
+    assert_eq!(refused(&config), "caller bounds");
+
+    for set in [
+        (|c: &mut ClaudeConnectorConfig| c.max_connections = 0) as fn(&mut ClaudeConnectorConfig),
+        |c| c.socket_timeout_ms = 0,
+        |c| c.max_expiry_skew_ms = 0,
+        |c| c.max_frame_bytes = 0,
+    ] {
+        let mut config = valid();
+        set(&mut config);
+        assert_eq!(refused(&config), "serve limits");
+    }
+    let mut config = valid();
+    config.prices.insert("claude-".to_string(), price());
+    assert_eq!(refused(&config), "prices");
+}
+
+#[test]
+fn a_write_refuses_an_invalid_document_and_leaves_no_file() {
+    let scratch = Scratch::new();
+    let path = scratch.path("bad.cc");
+    let mut config = valid();
+    config.callers[0].allowed_models = vec!["opus".to_string()];
+    assert!(write_config(&path, &config).is_err());
+    assert!(!path.exists());
+}
+
+#[test]
+fn config_refuses_aliases_unpriced_models_and_second_callers() {
+    let valid_config = valid();
+    assert_eq!(valid_config.validate().unwrap().port(), 7443);
+
+    let cases: Vec<(&str, Change)> = vec![
+        (
+            "alias allowed",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["opus".to_string()];
+            }),
+        ),
+        (
+            "alias price key",
+            Box::new(|c| {
+                c.prices.insert("sonnet".to_string(), price());
+            }),
+        ),
+        (
+            "bare prefix",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-".to_string()];
+            }),
+        ),
+        (
+            "family only",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-haiku".to_string()];
+                c.prices.insert("claude-haiku".to_string(), price());
+            }),
+        ),
+        (
+            "latest alias",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-sonnet-latest".to_string()];
+                c.prices.insert("claude-sonnet-latest".to_string(), price());
+            }),
+        ),
+        (
+            "no minor",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5".to_string()];
+                c.prices.insert("claude-opus-5".to_string(), price());
+            }),
+        ),
+        (
+            "uppercase family",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-Opus-5-1".to_string()];
+                c.prices.insert("claude-Opus-5-1".to_string(), price());
+            }),
+        ),
+        (
+            "short date",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5-1-2026".to_string()];
+                c.prices.insert("claude-opus-5-1-2026".to_string(), price());
+            }),
+        ),
+        (
+            "trailing part",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec!["claude-opus-5-1-20260101-x".to_string()];
+                c.prices
+                    .insert("claude-opus-5-1-20260101-x".to_string(), price());
+            }),
+        ),
+        (
+            "unpriced allowed",
+            Box::new(|c| {
+                c.prices.remove(OPUS);
+            }),
+        ),
+        (
+            "duplicate allowed",
+            Box::new(|c| {
+                c.callers[0].allowed_models = vec![HAIKU.to_string(), HAIKU.to_string()];
+            }),
+        ),
+        (
+            "no allowed",
+            Box::new(|c| c.callers[0].allowed_models.clear()),
+        ),
+        (
+            "second caller",
+            Box::new(|c| {
+                let mut second = c.callers[0].clone();
+                second.caller_runtime_id = "other".to_string();
+                c.callers.push(second);
+            }),
+        ),
+        ("no caller", Box::new(|c| c.callers.clear())),
+    ];
+    let fields = [
+        "allowed_models",
+        "prices",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "allowed_models",
+        "callers",
+        "callers",
+    ];
+    for ((name, change), field) in cases.iter().zip(fields) {
+        let mut config = valid();
+        change(&mut config);
+        assert_eq!(refused(&config), field, "{name}");
+    }
+}
+
+#[test]
+fn a_dated_canonical_id_is_allowed() {
+    let dated = "claude-opus-5-1-20260101".to_string();
+    let mut config = valid();
+    config.callers[0].allowed_models = vec![dated.clone()];
+    config.prices.insert(dated, price());
+    config.validate().unwrap();
+}
+
+#[test]
+fn a_price_with_a_zero_billed_component_is_refused() {
+    type Zero = fn(&mut Rates);
+    let zeroed: Vec<(&str, Zero)> = vec![
+        ("input", |r| r.input = 0),
+        ("cache_write_short", |r| r.cache_write_short = 0),
+        ("cache_write_long", |r| r.cache_write_long = 0),
+        ("cache_read", |r| r.cache_read = 0),
+        ("output", |r| r.output = 0),
+    ];
+    for (name, zero) in &zeroed {
+        let mut config = valid();
+        zero(&mut config.prices.get_mut(HAIKU).unwrap().rates);
+        assert_eq!(refused(&config), "prices", "{name}");
+
+        let mut config = valid();
+        let mut long = price().rates;
+        zero(&mut long);
+        config.prices.get_mut(HAIKU).unwrap().long_context = Some(model_connector::LongContext {
+            above_prompt_tokens: 200_000,
+            rates: long,
+        });
+        assert_eq!(refused(&config), "prices", "long context {name}");
+    }
+    // A zero overhead is not a rate.
+    let mut config = valid();
+    config.prices.get_mut(HAIKU).unwrap().overhead_tokens = 0;
+    config.validate().unwrap();
+}
+
+#[test]
+fn config_refuses_exposed_listeners_relative_paths_and_empty_bounds() {
+    let cases: Vec<(&str, &str, Change)> = vec![
+        (
+            "wildcard listen",
+            "listen",
+            Box::new(|c| c.listen = "0.0.0.0:7443".into()),
+        ),
+        (
+            "lan listen",
+            "listen",
+            Box::new(|c| c.listen = "192.168.1.9:7443".into()),
+        ),
+        (
+            "hostname listen",
+            "listen",
+            Box::new(|c| c.listen = "localhost:7443".into()),
+        ),
+        (
+            "replay",
+            "replay_store",
+            Box::new(|c| c.replay_store = "replay.cc".into()),
+        ),
+        (
+            "binary",
+            "claude_binary",
+            Box::new(|c| c.claude_binary = "claude".into()),
+        ),
+        ("work", "work_dir", Box::new(|c| c.work_dir = "work".into())),
+        (
+            "config",
+            "config_dir",
+            Box::new(|c| c.config_dir = "cfg".into()),
+        ),
+        (
+            "prompts",
+            "prompt_dir",
+            Box::new(|c| c.prompt_dir = "prompts".into()),
+        ),
+        (
+            "key file",
+            "connection_key_file",
+            Box::new(|c| {
+                c.callers[0].connection_key_file = "caller.key".into();
+            }),
+        ),
+        (
+            "zero pin",
+            "claude_binary_sha256",
+            Box::new(|c| c.claude_binary_sha256 = [0; 32]),
+        ),
+        (
+            "blank instance",
+            "instance",
+            Box::new(|c| c.instance = " ".into()),
+        ),
+        (
+            "credential path",
+            "token_credential",
+            Box::new(|c| c.token_credential = "a/b".into()),
+        ),
+        (
+            "credential parent",
+            "token_credential",
+            Box::new(|c| c.token_credential = "..".into()),
+        ),
+        (
+            "credential empty",
+            "token_credential",
+            Box::new(|c| c.token_credential = String::new()),
+        ),
+        (
+            "zero deadline",
+            "child limits",
+            Box::new(|c| c.deadline_ms = 0),
+        ),
+        (
+            "total below line",
+            "child limits",
+            Box::new(|c| c.max_total_bytes = c.max_line_bytes - 1),
+        ),
+        (
+            "zero frame",
+            "serve limits",
+            Box::new(|c| c.max_frame_bytes = 0),
+        ),
+        (
+            "zero epoch",
+            "connection_key_epoch",
+            Box::new(|c| c.callers[0].connection_key_epoch = 0),
+        ),
+        (
+            "tiny payload",
+            "caller bounds",
+            Box::new(|c| c.callers[0].max_payload_bytes = 16),
+        ),
+        (
+            "no ceiling",
+            "caller bounds",
+            Box::new(|c| c.callers[0].spend_ceiling_micro_usd = 0),
+        ),
+    ];
+    for (name, field, change) in cases {
+        let mut config = valid();
+        change(&mut config);
+        assert_eq!(refused(&config), field, "{name}");
+    }
+}
+
+#[test]
+fn no_refusal_echoes_a_value() {
+    let canary_path: PathBuf = format!("{CANARY}/relative").into();
+    let canaried: Vec<Change> = vec![
+        Box::new(|c| c.listen = format!("{CANARY}:1")),
+        Box::new(|c| c.instance = format!(" {CANARY} ")),
+        Box::new(|c| c.token_credential = format!("{CANARY}/x")),
+        Box::new(|c| c.callers[0].allowed_models = vec![format!("{CANARY}-model")]),
+        Box::new(|c| {
+            c.prices.insert(format!("{CANARY}-alias"), price());
+        }),
+        Box::new(|c| c.callers[0].caller_runtime_id = format!(" {CANARY}")),
+        Box::new({
+            let path = canary_path.clone();
+            move |c| c.replay_store = path.clone()
+        }),
+        Box::new({
+            let path = canary_path.clone();
+            move |c| c.callers[0].connection_key_file = path.clone()
+        }),
+        Box::new(|c| {
+            let mut second = c.callers[0].clone();
+            second.caller_runtime_id = CANARY.to_string();
+            c.callers.push(second);
+        }),
+    ];
+    for change in canaried {
+        let mut config = valid();
+        change(&mut config);
+        let error = config.validate().unwrap_err();
+        for shown in [error.to_string(), format!("{error:?}")] {
+            assert!(!shown.contains(CANARY), "{shown}");
+        }
+        let scratch = Scratch::new();
+        let write = write_config(&scratch.path("x.cc"), &config).unwrap_err();
+        assert!(!format!("{write} {write:?}").contains(CANARY));
+    }
+}
+
+// ---- the binary ----
+
+fn run(args: &[&str], envs: &[(&str, &Path)]) -> Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_claude-connector"));
+    command.args(args).env_clear();
+    for (name, value) in envs {
+        command.env(name, value);
+    }
+    command.output().unwrap()
+}
+
+fn shown(output: &Output) -> String {
+    format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    )
+}
+
+fn init_flags<'a>(scratch: &'a Scratch, extra: &[&'a str]) -> Vec<String> {
+    let path = |name: &str| scratch.path(name).to_string_lossy().into_owned();
+    let mut flags: Vec<String> = [
+        "--listen",
+        "127.0.0.1:0",
+        "--replay-store",
+        &path("replay.cc"),
+        "--claude-binary",
+        &path("claude"),
+        "--claude-sha256",
+        &"ab".repeat(32),
+        "--work-dir",
+        &path("work"),
+        "--config-dir",
+        &path("home"),
+        "--prompt-dir",
+        &path("prompts"),
+        "--instance",
+        "persona-a",
+        "--token-credential",
+        "claude-token",
+        "--caller-id",
+        "persona-a-caller",
+        "--connection-key-file",
+        &path("caller.key"),
+        "--connection-key-epoch",
+        "1",
+        "--spend-ceiling-micro-usd",
+        "50000000",
+        "--spend-window-ms",
+        "3600000",
+        "--allowed-model",
+        HAIKU,
+        "--price",
+        &format!("{HAIKU}:1000000:5000000:1250000:100000:100"),
+    ]
+    .map(String::from)
+    .to_vec();
+    flags.extend(extra.iter().map(|flag| flag.to_string()));
+    flags
+}
+
+fn init(scratch: &Scratch, flags: &[String]) -> Output {
+    let config = scratch.path("connector.cc");
+    let mut args = vec!["config", "init", config.to_str().unwrap()];
+    args.extend(flags.iter().map(String::as_str));
+    run(&args, &[])
+}
+
+#[test]
+fn config_init_writes_the_flags_into_the_document() {
+    let scratch = Scratch::new();
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = load_config(&scratch.path("connector.cc")).unwrap();
+    assert_eq!(config.callers[0].allowed_models, [HAIKU]);
+    assert_eq!(config.prices[HAIKU].rates.output, 5_000_000);
+    assert_eq!(config.prices[HAIKU].rates.cache_write_long, 1_250_000);
+    assert_eq!(config.prices[HAIKU].overhead_tokens, 100);
+    assert_eq!(config.claude_binary_sha256, [0xab; 32]);
+}
+
+/// A scratch directory in which `serve` would start: every directory, the
+/// pinned binary, the connection key and the credential exist. Returns the
+/// `config init` flags and the credential directory.
+#[cfg(unix)]
+fn prepare(scratch: &Scratch) -> (Vec<String>, PathBuf) {
+    use sha2::{Digest, Sha256};
+    use std::os::unix::fs::PermissionsExt;
+
+    for name in ["work", "home", "prompts", "credentials"] {
+        std::fs::create_dir_all(scratch.path(name)).unwrap();
+    }
+    std::fs::set_permissions(
+        scratch.path("prompts"),
+        std::fs::Permissions::from_mode(0o700),
+    )
+    .unwrap();
+    std::fs::write(scratch.path("credentials/claude-token"), CANARY).unwrap();
+    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
+    std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
+    let sha: String = Sha256::digest(b"pinned claude")
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect();
+    let mut flags = init_flags(scratch, &[]);
+    let at = flags
+        .iter()
+        .position(|flag| flag == "--claude-sha256")
+        .unwrap();
+    flags[at + 1] = sha;
+    (flags, scratch.path("credentials"))
+}
+
+#[cfg(unix)]
+fn check_and_serve(config: &Path, credentials: Option<&Path>) -> (Output, Output) {
+    let envs: Vec<(&str, &Path)> = credentials
+        .map(|dir| ("CREDENTIALS_DIRECTORY", dir))
+        .into_iter()
+        .collect();
+    let path = config.to_str().unwrap();
+    (
+        run(&["config", "check", path], &envs),
+        run(&["serve", "--config", path], &envs),
+    )
+}
+
+#[cfg(unix)]
+#[test]
+fn check_passes_a_document_serve_can_start_and_reports_counts_only() {
+    let scratch = Scratch::new();
+    let (flags, credentials) = prepare(&scratch);
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
+    let checked = run(
+        &[
+            "config",
+            "check",
+            scratch.path("connector.cc").to_str().unwrap(),
+        ],
+        &[("CREDENTIALS_DIRECTORY", &credentials)],
+    );
+    assert!(checked.status.success(), "{}", shown(&checked));
+    let text = shown(&checked);
+    assert!(text.contains("callers: 1") && text.contains("allowed_models: 1"));
+    assert!(text.contains("prices: 1"));
+    for secret in ["persona-a", HAIKU, CANARY, "caller-secret"] {
+        assert!(!text.contains(secret), "{text}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
+    use std::os::unix::fs::PermissionsExt;
+
+    type Break = fn(&Scratch, &Path);
+    let cases: Vec<(&str, &str, Break)> = vec![
+        ("open prompt dir", "prompt directory", |s, _| {
+            std::fs::set_permissions(s.path("prompts"), std::fs::Permissions::from_mode(0o755))
+                .unwrap();
+        }),
+        ("no key file", "connection_key_file", |s, _| {
+            std::fs::remove_file(s.path("caller.key")).unwrap();
+        }),
+        ("binary off its pin", "claude_binary_sha256", |s, _| {
+            std::fs::write(s.path("claude"), b"other bytes").unwrap();
+        }),
+        ("no credential", "token_credential", |_, credentials| {
+            std::fs::remove_file(credentials.join("claude-token")).unwrap();
+        }),
+        ("no work dir", "work_dir", |s, _| {
+            std::fs::remove_dir(s.path("work")).unwrap();
+        }),
+        ("no config dir", "config_dir", |s, _| {
+            std::fs::remove_dir(s.path("home")).unwrap();
+        }),
+        ("frame too small", "max_frame_bytes", |s, _| {
+            let path = s.path("connector.cc");
+            let mut config = load_config(&path).unwrap();
+            config.max_frame_bytes = 4099;
+            write_config(&path, &config).unwrap();
+        }),
+        ("too few connections", "connection capacity", |s, _| {
+            let path = s.path("connector.cc");
+            let mut config = load_config(&path).unwrap();
+            config.max_connections = 1;
+            write_config(&path, &config).unwrap();
+        }),
+    ];
+    for (name, field, break_it) in cases {
+        let scratch = Scratch::new();
+        let (flags, credentials) = prepare(&scratch);
+        let made = init(&scratch, &flags);
+        assert!(made.status.success(), "{name}: {}", shown(&made));
+        break_it(&scratch, &credentials);
+        let (checked, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+        assert!(!checked.status.success(), "{name} check passed");
+        assert!(!served.status.success(), "{name} serve started");
+        assert!(
+            shown(&checked).contains(field),
+            "{name}: {}",
+            shown(&checked)
+        );
+        assert_eq!(shown(&checked), shown(&served), "{name}");
+        for secret in [CANARY, "caller-secret", "other bytes"] {
+            assert!(!shown(&checked).contains(secret), "{name}");
+        }
+    }
+
+    // No credential directory at all is the same refusal.
+    let scratch = Scratch::new();
+    let (flags, _) = prepare(&scratch);
+    assert!(init(&scratch, &flags).status.success());
+    let (checked, served) = check_and_serve(&scratch.path("connector.cc"), None);
+    assert!(!checked.status.success() && !served.status.success());
+    assert!(shown(&checked).contains("token_credential"));
+    assert_eq!(shown(&checked), shown(&served));
+}
+
+#[cfg(unix)]
+#[test]
+fn serve_names_a_corrupt_replay_store_without_its_path() {
+    let scratch = Scratch::new();
+    let (mut flags, credentials) = prepare(&scratch);
+    let store = scratch.path(&format!("{CANARY}-store/replay.cc"));
+    std::fs::create_dir_all(store.parent().unwrap()).unwrap();
+    std::fs::write(&store, b"not a cultcache store").unwrap();
+    let at = flags
+        .iter()
+        .position(|flag| flag == "--replay-store")
+        .unwrap();
+    flags[at + 1] = store.to_string_lossy().into_owned();
+    assert!(init(&scratch, &flags).status.success());
+    let (_, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+    assert!(!served.status.success());
+    let text = shown(&served);
+    assert!(text.contains("replay_store"), "{text}");
+    assert!(
+        !text.contains(CANARY) && !text.contains("replay.cc"),
+        "{text}"
+    );
+}
+
+#[test]
+fn the_binary_refuses_without_echoing_what_it_was_given() {
+    let spaced = format!(" {CANARY}");
+    // Each pair replaces the value of an existing flag; the others are appended.
+    let replaced: Vec<(&str, &str)> = vec![
+        ("--listen", CANARY),
+        ("--claude-sha256", CANARY),
+        ("--claude-sha256", "abcd"),
+        ("--price", CANARY),
+        ("--instance", &spaced),
+        ("--connection-key-epoch", CANARY),
+        ("--allowed-model", CANARY),
+    ];
+    let appended: Vec<Vec<&str>> = vec![
+        vec![CANARY, CANARY],
+        vec!["--listen"],
+        vec!["--listen", "127.0.0.1:1"],
+    ];
+    let mut attempts: Vec<Vec<String>> = Vec::new();
+    for (name, value) in replaced {
+        let scratch = Scratch::new();
+        let mut flags = init_flags(&scratch, &[]);
+        let at = flags.iter().position(|flag| flag == name).unwrap();
+        flags[at + 1] = value.to_string();
+        attempts.push(flags);
+    }
+    for extra in appended {
+        let scratch = Scratch::new();
+        attempts.push(init_flags(&scratch, &extra));
+    }
+    for flags in attempts {
+        let scratch = Scratch::new();
+        let made = init(&scratch, &flags);
+        assert!(!made.status.success(), "{flags:?}");
+        assert!(!shown(&made).contains(CANARY), "{}", shown(&made));
+        assert!(!scratch.path("connector.cc").exists());
+    }
+
+    // A missing flag is refused by name.
+    let scratch = Scratch::new();
+    let mut flags = init_flags(&scratch, &[]);
+    let at = flags.iter().position(|f| f == "--instance").unwrap();
+    flags.drain(at..at + 2);
+    let made = init(&scratch, &flags);
+    assert!(!made.status.success());
+    assert!(shown(&made).contains("--instance"));
+}
+
+#[cfg(unix)]
+#[test]
+fn serve_refuses_an_unsafe_prompt_dir_and_prints_no_credential() {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    let scratch = Scratch::new();
+    let credentials = scratch.path("credentials");
+    std::fs::create_dir_all(&credentials).unwrap();
+    std::fs::write(credentials.join("claude-token"), CANARY).unwrap();
+    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = scratch.path("connector.cc");
+    let serve = |config: &Path| {
+        run(
+            &["serve", "--config", config.to_str().unwrap()],
+            &[("CREDENTIALS_DIRECTORY", &credentials)],
+        )
+    };
+
+    // No prompt directory, then one others can enter, then a link to a good one.
+    let prompts = scratch.path("prompts");
+    let refused = serve(&config);
+    assert!(!refused.status.success());
+    assert!(
+        shown(&refused).contains("prompt directory"),
+        "{}",
+        shown(&refused)
+    );
+    std::fs::create_dir_all(&prompts).unwrap();
+    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o755)).unwrap();
+    let open = serve(&config);
+    assert!(
+        shown(&open).contains("prompt directory"),
+        "{}",
+        shown(&open)
+    );
+    assert!(claude_connector::check_prompt_dir(&prompts).is_err());
+    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o700)).unwrap();
+    assert!(claude_connector::check_prompt_dir(&prompts).is_ok());
+    let linked = scratch.path("linked");
+    symlink(&prompts, &linked).unwrap();
+    assert!(claude_connector::check_prompt_dir(&linked).is_err());
+
+    // A safe directory but no claude binary: the backend is not ready, and
+    // nothing the credential holds is printed.
+    let not_ready = serve(&config);
+    assert!(!not_ready.status.success());
+    for output in [&refused, &open, &not_ready] {
+        let text = shown(output);
+        assert!(
+            !text.contains(CANARY) && !text.contains("caller-secret"),
+            "{text}"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn a_private_regular_file_is_not_a_prompt_dir() {
+    use std::os::unix::fs::PermissionsExt;
+    let scratch = Scratch::new();
+    let file = scratch.path("file");
+    std::fs::write(&file, "x").unwrap();
+    std::fs::set_permissions(&file, std::fs::Permissions::from_mode(0o700)).unwrap();
+    assert!(claude_connector::check_prompt_dir(&file).is_err());
+    assert!(claude_connector::check_prompt_dir(&scratch.path("absent")).is_err());
+}
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 6d87f6e..d6723a4 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -23,10 +23,11 @@ use crate::service::{
 /// The only provider seam of the connector kit. A connector binary implements
 /// it over one model provider; the kit names no provider.
 pub trait ProviderBackend: Send + Sync {
-    /// Whether the provider can take work. `serve` consults it once, before it
-    /// opens the replay store or accepts a connection; the request path does
-    /// not consult it.
-    fn ready(&self) -> bool;
+    /// Whether the provider can take work; `Err` names the backend field that
+    /// is not ready, never a value. `serve` consults it once, before it opens
+    /// the replay store or accepts a connection; the request path does not
+    /// consult it.
+    fn ready(&self) -> Result<(), &'static str>;
     /// The tag of the provider this backend fronts. The service owns it from
     /// `serve` on: it names the provider on every receipt and decides which
     /// reasoning state is foreign.
@@ -59,7 +60,7 @@ impl ServeLimits {
     /// largest whose sealed frame, at its worst-case encoding, fits the frame.
     /// An admitted payload therefore always fits, and `complete` is given the
     /// same frame bound to fit every result in.
-    fn validate(&self, admissions: &[CallerAdmission]) -> Result<(), ServeError> {
+    pub fn validate(&self, admissions: &[CallerAdmission]) -> Result<(), ServeError> {
         if self.max_frame_bytes == 0
             || self.max_frame_bytes > u32::MAX as usize
             || self.max_connections == 0
@@ -171,9 +172,7 @@ pub fn serve(
     {
         return Err(ServeError::InvalidConfig("listener address"));
     }
-    if !backend.ready() {
-        return Err(ServeError::BackendUnready);
-    }
+    backend.ready().map_err(ServeError::BackendUnready)?;
     let service = Arc::new(Mutex::new(TransportService::open(
         replay_store,
         backend.provider(),
@@ -322,8 +321,8 @@ pub enum ServeError {
     ConnectionKey(#[source] std::io::Error),
     #[error(transparent)]
     Service(#[from] ServiceError),
-    #[error("provider backend is not ready")]
-    BackendUnready,
+    #[error("provider backend is not ready: {0}")]
+    BackendUnready(&'static str),
     #[error("connector service lock was poisoned")]
     ServicePoisoned,
     #[error("connector listener failed")]
@@ -379,9 +378,9 @@ mod tests {
     }
 
     impl ProviderBackend for CountingBackend {
-        fn ready(&self) -> bool {
+        fn ready(&self) -> Result<(), &'static str> {
             self.ready_calls.fetch_add(1, Ordering::SeqCst);
-            self.ready
+            self.ready.then_some(()).ok_or("fixture")
         }
 
         fn provider(&self) -> &str {
@@ -710,7 +709,10 @@ mod tests {
             &store.path,
             backend.clone(),
         );
-        assert!(matches!(result, Some(Err(ServeError::BackendUnready))));
+        assert!(matches!(
+            result,
+            Some(Err(ServeError::BackendUnready("fixture")))
+        ));
         assert_eq!(backend.executions.load(Ordering::SeqCst), 0);
         assert!(
             !store.path.exists(),
@@ -1016,8 +1018,8 @@ mod tests {
     }
 
     impl ProviderBackend for SizedBackend {
-        fn ready(&self) -> bool {
-            true
+        fn ready(&self) -> Result<(), &'static str> {
+            Ok(())
         }
 
         fn provider(&self) -> &str {
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 8d4fd80..6d10cb9 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -119,7 +119,7 @@ impl CallerAdmission {
 }
 
 /// What one million tokens of each class cost, in micro-USD.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Rates {
     pub input: u64,
     pub cache_write_short: u64,
@@ -129,7 +129,7 @@ pub struct Rates {
 }
 
 /// The rates a prompt strictly above `above_prompt_tokens` is priced at.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LongContext {
     pub above_prompt_tokens: u64,
     pub rates: Rates,
@@ -138,7 +138,7 @@ pub struct LongContext {
 /// One model's price. Explicit zero rates are admitted (a local model is
 /// free); a missing price is not. `overhead_tokens` is added to the byte
 /// bound of a request when its worst case is reserved.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ModelPrice {
     pub rates: Rates,
     pub long_context: Option<LongContext>,
diff --git a/crates/model-connector/tests/reasoning_state.rs b/crates/model-connector/tests/reasoning_state.rs
index f42e0f1..8c9c4af 100644
--- a/crates/model-connector/tests/reasoning_state.rs
+++ b/crates/model-connector/tests/reasoning_state.rs
@@ -38,8 +38,8 @@ impl RecordingBackend {
 }
 
 impl ProviderBackend for RecordingBackend {
-    fn ready(&self) -> bool {
-        true
+    fn ready(&self) -> Result<(), &'static str> {
+        Ok(())
     }
 
     fn provider(&self) -> &str {
@@ -291,8 +291,8 @@ struct TamperingBackend {
 }
 
 impl ProviderBackend for TamperingBackend {
-    fn ready(&self) -> bool {
-        true
+    fn ready(&self) -> Result<(), &'static str> {
+        Ok(())
     }
 
     fn provider(&self) -> &str {

From 480cf941c8b56ff34cd641fdcccbb72bcdce80c6 Mon Sep 17 00:00:00 2001
From: Eureka <eureka@minds.eureka.gamecult.org>
Date: Thu, 29 Oct 2026 20:18:35 +0100
Subject: [PATCH 08/37] claude-turn-schema-quota: schema-typed Persona replies
 via --json-schema, token on fd 3 never in the child env, per-window
 plan-quota capture, communal spend readout, not-logged-in bills zero (squash
 of eureka-body/claude-turn-schema-quota e867fad..429b344; Soul s1, s2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                     |  15 +-
 crates/claude-connector/src/backend.rs        |  76 ++-
 crates/claude-connector/src/backend/tests.rs  | 523 ++++++++++++++++--
 crates/claude-connector/src/daemon.rs         |  37 +-
 crates/claude-connector/src/handle.rs         |   5 -
 crates/claude-connector/src/launch.rs         |  37 +-
 crates/claude-connector/src/lib.rs            |   2 +
 crates/claude-connector/src/main.rs           |   4 +-
 crates/claude-connector/src/process.rs        | 134 ++++-
 crates/claude-connector/src/quota.rs          | 151 +++++
 crates/claude-connector/src/stream.rs         | 129 ++++-
 .../claude-connector/tests/config_document.rs | 121 +++-
 crates/model-connector/src/client.rs          |  96 +++-
 crates/model-connector/src/envelope.rs        | 260 +++++++--
 crates/model-connector/src/lib.rs             |   2 +
 crates/model-connector/src/readout.rs         | 128 +++++
 crates/model-connector/src/serve.rs           | 109 +++-
 crates/model-connector/src/service.rs         | 260 ++++++++-
 .../tests/published_schemas.rs                |   3 +-
 schemas/spend_readout.json                    | 112 ++++
 schemas/transport_envelope.json               |   4 +-
 21 files changed, 2021 insertions(+), 187 deletions(-)
 create mode 100644 crates/claude-connector/src/quota.rs
 create mode 100644 crates/model-connector/src/readout.rs
 create mode 100644 schemas/spend_readout.json

diff --git a/README.md b/README.md
index 339e793..3a12abd 100644
--- a/README.md
+++ b/README.md
@@ -21,8 +21,11 @@ Crate `crates/model-connector`:
 - `src/envelope.rs` - the AES-256-GCM `TransportEnvelope` (binary ciphertext), its
   identity-binding AAD, the length-prefixed framing, and the CultNet carriage: each frame is a
   `cultnet.operation_request.v0` / `operation_response.v0` for service
-  `gamecult.model.connector`, operation `invoke`, its `message_id` the request id and its
-  payload the base64 of the sealed envelope.
+  `gamecult.model.connector`, operation `invoke` (or `spend_readout`), its `message_id` the
+  request id and its payload the base64 of the sealed envelope. `spend_readout` answers a
+  `SpendReadout` (`gamecult.model.spend_readout.v1`): each caller's spent and reserved
+  micro-USD against its ceiling in its current window, and the backend's plan quota;
+  `ConnectorClient::spend_readout` asks.
 - `schemas/` - one JSON Schema per v3 document, generated from the types.
 - `src/client.rs` - `ConnectorClient`, the one-request caller side.
 - `src/service.rs` (feature `daemon`) - `TransportService`: caller admission, durable
@@ -37,13 +40,15 @@ Crate `crates/claude-connector` (library only; the binary that wires it to `serv
 - `ClaudeCodeBackend` implements `ProviderBackend` for provider `claude-code` by driving the
   unmodified `claude` binary, one child per call, in print stream-json mode with no tools, no MCP
   servers, no settings sources and the system prompt replaced. Tool-less turns only: a request
-  with tools, an output schema or a final tool result is refused before any spawn.
+  with tools or a final tool result is refused before any spawn. A request's output schema goes
+  to the CLI as `--json-schema` and the result's structured output is the one assistant text.
 - Reasoning state is a session handle (`ClaudeCodeHandle`); a handle that cannot be proven to
   match the request re-seeds from the caller's transcript, and every resume forks.
 - `ProcessPort` is the one OS seam (`StdProcessPort`, unix, kills the child's whole process
   group); `SessionStore` and `StderrSink` are the other ports. `ClaudeCodeConfig` is what the
-  binary hands in; the credential is read by name from the connector's own environment
-  (`CLAUDE_CODE_OAUTH_TOKEN`) and copied only into the child.
+  binary hands in; the credential is read from a systemd credential and reaches the child on a
+  pipe (`CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`), never in an environment. `QuotaCell` keeps the
+  plan windows the CLI's `rate_limit_event`s report, for the spend readout.
 
 Frame arithmetic is public in `src/envelope.rs`, measured on the carriage frame: `frame_bytes_for_payload(n)` is the frame a
 caller payload bound of `n` needs, `payload_bytes_for_frame(frame)` is the largest payload bound
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index c5a8f81..1963e1d 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -1,11 +1,12 @@
 use std::fs::File;
 use std::io;
 use std::path::PathBuf;
+use std::sync::Arc;
 use std::time::Instant;
 
 use model_connector::{
-    FailureKind, InputItem, ProviderBackend, ProviderCall, ProviderRequest, TransportEvent,
-    TransportEventPayload, TransportOutcome, TransportResult, Usage,
+    FailureKind, InputItem, PlanQuotaSnapshot, ProviderBackend, ProviderCall, ProviderRequest,
+    TransportEvent, TransportEventPayload, TransportOutcome, TransportResult, Usage,
 };
 use sha2::{Digest, Sha256};
 use zeroize::Zeroizing;
@@ -14,6 +15,7 @@ use crate::config::{ClaudeCodeConfig, PROVIDER};
 use crate::handle::{ClaudeCodeHandle, SessionStore, plan, prefix_digest, stdin_bytes};
 use crate::launch::{PromptFile, argv, child_env};
 use crate::process::{ProcessPort, RunningChild, StdoutRead};
+use crate::quota::QuotaCell;
 use crate::stream::{Failure, Finished, Step, StreamState};
 
 /// Where the child's credential comes from, read afresh at every use. The
@@ -22,6 +24,10 @@ use crate::stream::{Failure, Finished, Step, StreamState};
 pub trait TokenSource: Send + Sync {
     /// The token, or `None` when there is none or it is empty.
     fn read(&self) -> Option<Zeroizing<String>>;
+    /// What `config check` names when `read` has no token.
+    fn missing(&self) -> &'static str {
+        "token_credential"
+    }
 }
 
 /// A token in a file named by a systemd credential: the file
@@ -59,6 +65,16 @@ impl TokenSource for CredentialTokenSource {
         token.truncate(trimmed);
         (!token.is_empty()).then_some(token)
     }
+
+    /// No directory at all is the unit's environment lacking its credentials,
+    /// which is not the same fault as a credential the directory lacks.
+    fn missing(&self) -> &'static str {
+        if self.directory.is_none() {
+            "credentials_directory"
+        } else {
+            "token_credential"
+        }
+    }
 }
 
 /// Where the tail of a child's stderr goes. The backend never puts it in a
@@ -75,6 +91,7 @@ pub struct ClaudeCodeBackend {
     sessions: Box<dyn SessionStore>,
     sink: Box<dyn StderrSink>,
     tokens: Box<dyn TokenSource>,
+    quota: Arc<QuotaCell>,
 }
 
 impl ClaudeCodeBackend {
@@ -104,9 +121,15 @@ impl ClaudeCodeBackend {
             sessions,
             sink,
             tokens,
+            quota: Arc::new(QuotaCell::new()),
         }
     }
 
+    /// The plan windows every stream this backend reads feeds.
+    pub fn quota(&self) -> Arc<QuotaCell> {
+        self.quota.clone()
+    }
+
     /// The one pin check: `ready` and every spawn use it, and nothing caches
     /// its answer.
     fn binary_matches_pin(&self) -> bool {
@@ -144,7 +167,7 @@ impl ClaudeCodeBackend {
             ));
         };
         let argv = argv(&self.config, request, &plan, prompt.path());
-        let env = child_env(&self.config, request, token);
+        let env = child_env(&self.config, request);
         let deadline = Instant::now() + self.config.limits.deadline;
 
         let spawned = self.port.spawn(
@@ -152,6 +175,7 @@ impl ClaudeCodeBackend {
             &env,
             &self.config.work_dir,
             stdin_bytes(plan.blocks()),
+            &token,
         );
         let Ok(mut child) = spawned else {
             return failure(Failure::never_reached(
@@ -159,7 +183,13 @@ impl ClaudeCodeBackend {
                 "claude-code: the child could not be spawned",
             ));
         };
-        let finished = read_stream(child.as_mut(), deadline, &request.model);
+        let finished = read_stream(
+            child.as_mut(),
+            deadline,
+            &request.model,
+            request.output_schema_json.as_deref(),
+            &self.quota,
+        );
         child.kill();
         child.wait();
         let tail = child.stderr_tail();
@@ -190,14 +220,20 @@ impl ClaudeCodeBackend {
                 text: finished.texts.concat(),
             });
         }
-        let handle = ClaudeCodeHandle::Ended {
-            session_id: finished.session_id,
-            instance: self.config.instance.clone(),
-            prefix_sha256: prefix_digest(&request.instructions, &request.model, &prefix),
-        };
-        payloads.push(TransportEventPayload::ReasoningState {
-            state: handle.encode(),
-        });
+        // A schema turn leaves the CLI's StructuredOutput tool exchange in its
+        // session, and a later turn without the schema runs with no tools: it
+        // must not resume that session. So a schema turn hands out no handle,
+        // and whatever follows it is seeded from the caller's transcript.
+        if request.output_schema_json.is_none() {
+            let handle = ClaudeCodeHandle::Ended {
+                session_id: finished.session_id,
+                instance: self.config.instance.clone(),
+                prefix_sha256: prefix_digest(&request.instructions, &request.model, &prefix),
+            };
+            payloads.push(TransportEventPayload::ReasoningState {
+                state: handle.encode(),
+            });
+        }
 
         let events = payloads
             .into_iter()
@@ -231,14 +267,20 @@ impl ProviderBackend for ClaudeCodeBackend {
         let (events, outcome) = self.run(call.request());
         call.transported(events, outcome)
     }
+
+    fn plan_quota(&self) -> PlanQuotaSnapshot {
+        self.quota.snapshot()
+    }
 }
 
 fn read_stream(
     child: &mut dyn RunningChild,
     deadline: Instant,
     model: &str,
+    schema: Option<&str>,
+    quota: &QuotaCell,
 ) -> Result<Finished, Failure> {
-    let mut state = StreamState::new(model);
+    let mut state = StreamState::new(model, schema, quota);
     let finished = loop {
         match child.read_line(deadline) {
             StdoutRead::Line(line) => {
@@ -295,12 +337,14 @@ pub(crate) fn readiness(
     if !config.prompt_dir.is_dir() {
         return Err("prompt_dir");
     }
-    if tokens.read().is_none() {
-        return Err("token_credential");
-    }
     if !binary_matches_pin(config) {
         return Err("claude_binary_sha256");
     }
+    // Last: outside the unit the credential is the one thing always absent,
+    // and it must not hide the faults the document itself has.
+    if tokens.read().is_none() {
+        return Err(tokens.missing());
+    }
     Ok(())
 }
 
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 21a8c72..2e3b993 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -6,16 +6,19 @@ use std::time::Duration;
 
 use model_connector::{
     CallerAdmission, ModelPrice, PriceTable, Rates, ReasoningEffort, SpendCeiling, SpendWindowMs,
-    ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation, TransportKey,
-    TransportReceipt, TransportService, decrypt_result, encrypt_invocation,
+    StopReason, ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation,
+    TransportKey, TransportReceipt, TransportService, decrypt_result, encrypt_invocation,
 };
 
 use super::*;
 use crate::config::ClaudeCodeLimits;
 use crate::handle::{FsSessionStore, SessionStore};
-use crate::launch::{ChildEnv, TOKEN_VAR};
+use crate::launch::ChildEnv;
 
 const CANARY_TOKEN: &str = "canary-oauth-token-value";
+/// The variable the connector's own environment must never hand on.
+const TOKEN_ENV: &str = "CLAUDE_CODE_OAUTH_TOKEN";
+const TOKEN_FD_ENV: &str = "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR";
 const MODEL: &str = "claude-haiku-5-5";
 const INSTANCE: &str = "persona-a";
 const SESSION: &str = "11111111-2222-3333-4444-555555555555";
@@ -62,11 +65,71 @@ const USAGE: &str = r#"{"claude-haiku-5-5":{"inputTokens":2,"outputTokens":4,"ca
 const CUMULATIVE: &str = r#"{"claude-haiku-5-5":{"inputTokens":900000,"outputTokens":900000,"cacheReadInputTokens":900000,"cacheCreationInputTokens":900000,"thinkingTokens":900000,"costUSD":99.0}}"#;
 
 fn result_line(stop_reason: &str, since_last: &str) -> String {
+    result_line_with(stop_reason, since_last, "")
+}
+
+/// A success result with `extra` (a leading comma and fields) appended.
+fn result_line_with(stop_reason: &str, since_last: &str, extra: &str) -> String {
     format!(
-        r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"{stop_reason}","session_id":"{SESSION}","total_cost_usd":99.0,"modelUsage":{CUMULATIVE},"model_usage_since_last_result":{since_last}}}"#
+        r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"{stop_reason}","session_id":"{SESSION}","total_cost_usd":99.0,"modelUsage":{CUMULATIVE},"model_usage_since_last_result":{since_last}{extra}}}"#
     )
 }
 
+// The shapes `claude -p --json-schema` produced on the pinned CLI (2.1.312):
+// the answer is a call of the CLI's own StructuredOutput tool, the result
+// carries it as `structured_output` with stop_reason `tool_use`, and a
+// `rate_limit_event` reports the plan's windows under `unifiedWindows`.
+const SCHEMA: &str = r#"{"type":"object","properties":{"answer":{"type":"string"},"n":{"type":"integer"}},"required":["answer","n"],"additionalProperties":false}"#;
+const STRUCTURED: &str = r#"{"answer":"say hello","n":0}"#;
+
+fn structured_call_line(name: &str) -> String {
+    format!(
+        r#"{{"type":"assistant","message":{{"id":"msg_s","role":"assistant","content":[{{"type":"tool_use","id":"toolu_01","name":"{name}","input":{STRUCTURED},"caller":{{"type":"direct"}}}}],"stop_reason":null}},"session_id":"{SESSION}"}}"#
+    )
+}
+
+fn structured_tool_result_line() -> String {
+    format!(
+        r#"{{"type":"user","message":{{"role":"user","content":[{{"tool_use_id":"toolu_01","type":"tool_result","content":"Structured output provided successfully"}}]}},"parent_tool_use_id":null,"session_id":"{SESSION}"}}"#
+    )
+}
+
+fn plan_rate_limit_line() -> String {
+    r#"{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":4102444800,"rateLimitType":"five_hour","overageStatus":"rejected","isUsingOverage":false,"unifiedWindows":{"five_hour":{"utilization":0.08,"resetsAt":4102444800,"status":"allowed"},"seven_day":{"utilization":0.3,"resetsAt":4102531200,"status":"allowed"}}}}"#.to_string()
+}
+
+fn structured_result_line() -> String {
+    result_line_with(
+        "tool_use",
+        USAGE,
+        &format!(r#","structured_output":{STRUCTURED},"result":"ignored""#),
+    )
+}
+
+fn structured_script() -> Script {
+    Script::lines(vec![
+        init_line(MODEL, SESSION),
+        structured_call_line("StructuredOutput"),
+        structured_tool_result_line(),
+        plan_rate_limit_line(),
+        structured_result_line(),
+    ])
+}
+
+fn schema_request() -> ProviderRequest {
+    let mut request = request(vec![user("hello")]);
+    request.output_schema_json = Some(SCHEMA.to_string());
+    request
+}
+
+fn a_tool() -> ToolDefinition {
+    ToolDefinition {
+        name: "lookup".into(),
+        description: "d".into(),
+        parameters_json: "{}".into(),
+    }
+}
+
 fn error_result_line(extra: &str) -> String {
     format!(
         r#"{{"type":"result","subtype":"error_during_execution","is_error":true,"session_id":"{SESSION}","total_cost_usd":99.0,"modelUsage":{CUMULATIVE},"model_usage_since_last_result":{USAGE}{extra}}}"#
@@ -146,6 +209,8 @@ struct Seen {
     env: Vec<(String, String)>,
     cwd: PathBuf,
     stdin: Vec<u8>,
+    /// The token the backend handed the port, which a real port puts on a pipe.
+    token: String,
     /// The file `--system-prompt-file` named, as it was when the child started.
     prompt_file: Option<(PathBuf, String)>,
     /// Every deadline the backend passed to a read of this child.
@@ -173,6 +238,7 @@ impl ProcessPort for ScriptedPort {
         env: &ChildEnv,
         cwd: &Path,
         stdin: Vec<u8>,
+        token: &str,
     ) -> io::Result<Box<dyn RunningChild>> {
         self.spawns.fetch_add(1, Ordering::SeqCst);
         let deadlines = Arc::new(Mutex::new(Vec::new()));
@@ -191,6 +257,7 @@ impl ProcessPort for ScriptedPort {
                 .collect(),
             cwd: cwd.to_path_buf(),
             stdin,
+            token: token.to_string(),
         };
         let script = self
             .scripts
@@ -549,7 +616,7 @@ fn resume_always_forks() {
 }
 
 #[test]
-fn child_env_is_cleared_and_names_only_the_token_var() {
+fn child_env_is_cleared_and_names_the_token_descriptor_never_the_token() {
     let rig = rig(vec![ok_script(SESSION, "hi")]);
     let result = rig.run(request(vec![user("hello")]));
     let seen = rig.seen();
@@ -562,10 +629,7 @@ fn child_env_is_cleared_and_names_only_the_token_var() {
                 "CLAUDE_CODE_MAX_OUTPUT_TOKENS".to_string(),
                 "1024".to_string()
             ),
-            (
-                "CLAUDE_CODE_OAUTH_TOKEN".to_string(),
-                CANARY_TOKEN.to_string()
-            ),
+            (TOKEN_FD_ENV.to_string(), "3".to_string()),
             ("CLAUDE_CONFIG_DIR".to_string(), "/cfg".to_string()),
             ("HOME".to_string(), "/cfg".to_string()),
             (
@@ -575,6 +639,13 @@ fn child_env_is_cleared_and_names_only_the_token_var() {
         ]
     );
     assert_eq!(seen.cwd, PathBuf::from("/work"));
+    // The credential travels beside the environment, to the port, alone.
+    assert_eq!(seen.token, CANARY_TOKEN);
+    assert!(
+        seen.env
+            .iter()
+            .all(|(name, value)| name != TOKEN_ENV && value != CANARY_TOKEN)
+    );
     assert!(!format!("{result:?}").contains(CANARY_TOKEN));
 }
 
@@ -600,11 +671,10 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
     let env = child_env(
         &config(rig.dir.path(), INSTANCE, limits()),
         &request(vec![user("x")]),
-        Zeroizing::new(CANARY_TOKEN.to_string()),
     );
     let shown = format!("{env:?}");
     assert!(!shown.contains(CANARY_TOKEN));
-    assert!(shown.contains("CLAUDE_CODE_OAUTH_TOKEN"));
+    assert!(shown.contains(TOKEN_FD_ENV));
 }
 
 // ---- ready ----
@@ -664,6 +734,15 @@ fn ready_checks_the_pinned_binary_digest() {
         ready_field(pin, &binary, &work, &prompts, false),
         Err("token_credential")
     );
+    // The credential is checked last: a document fault is never hidden by it.
+    assert_eq!(
+        ready_field([0; 32], &binary, &work, &prompts, false),
+        Err("claude_binary_sha256")
+    );
+    assert_eq!(
+        ready_field(pin, &binary, &dir.path().join("absent"), &prompts, false),
+        Err("work_dir")
+    );
 
     assert!(ready(pin, &binary, &work, &prompts, true));
     assert!(!ready([0; 32], &binary, &work, &prompts, true), "other pin");
@@ -692,7 +771,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
     static CANARY_PARENT: std::sync::Once = std::sync::Once::new();
     CANARY_PARENT.call_once(|| {
         // SAFETY: set once to a value no code path reads; the test proves none does.
-        unsafe { std::env::set_var(TOKEN_VAR, "canary-environment-token") };
+        unsafe { std::env::set_var(TOKEN_ENV, "canary-environment-token") };
     });
     let dir = sandbox();
     let credentials = dir.path().join("credentials");
@@ -730,7 +809,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
     assert!(seen.lock().unwrap().argv.is_empty(), "no child was spawned");
 
     // The file is read afresh at the call, its trailing newline trimmed, and
-    // the child's environment carries the file's value.
+    // the port is handed the file's value, which is in no environment.
     std::fs::write(
         credentials.join("claude-token"),
         format!("{CANARY_TOKEN}\n"),
@@ -744,8 +823,14 @@ fn token_comes_from_the_credential_file_not_the_environment() {
         outcome(&result),
         TransportOutcome::Completed { .. }
     ));
-    let env = seen.lock().unwrap().env.clone();
-    assert!(env.contains(&(TOKEN_VAR.to_string(), CANARY_TOKEN.to_string())));
+    let given = seen.lock().unwrap().clone();
+    assert_eq!(given.token, CANARY_TOKEN);
+    assert!(
+        given
+            .env
+            .iter()
+            .all(|(name, value)| name != TOKEN_ENV && !value.contains("canary-environment-token"))
+    );
 
     // An empty credential is no token.
     std::fs::write(credentials.join("claude-token"), "\n").unwrap();
@@ -997,15 +1082,9 @@ fn usage_zero() -> Usage {
 }
 
 #[test]
-fn tools_schema_or_final_tool_result_fail_before_spawn() {
+fn tools_or_final_tool_result_fail_before_spawn() {
     let mut with_tools = request(vec![user("a")]);
-    with_tools.tools.push(ToolDefinition {
-        name: "lookup".into(),
-        description: "d".into(),
-        parameters_json: "{}".into(),
-    });
-    let mut with_schema = request(vec![user("a")]);
-    with_schema.output_schema_json = Some("{}".into());
+    with_tools.tools.push(a_tool());
     let final_tool_result = request(vec![
         user("a"),
         InputItem::ToolCall {
@@ -1032,7 +1111,6 @@ fn tools_schema_or_final_tool_result_fail_before_spawn() {
     let mut messages = Vec::new();
     for refused in [
         with_tools,
-        with_schema,
         final_tool_result,
         ends_without_user_text,
         tool_result_beside_text,
@@ -1044,9 +1122,9 @@ fn tools_schema_or_final_tool_result_fail_before_spawn() {
     }
     assert_eq!(rig.spawns(), 0);
     // Each refusal names what lifts it.
-    assert_eq!(messages[2], messages[4]);
+    assert_eq!(messages[1], messages[3]);
     let distinct: std::collections::HashSet<_> = messages.iter().collect();
-    assert_eq!(distinct.len(), 4, "{messages:?}");
+    assert_eq!(distinct.len(), 3, "{messages:?}");
 }
 
 // ---- the stream ----
@@ -1271,7 +1349,7 @@ fn no_result_event_is_a_failure_with_unknown_usage() {
     let zero_billed = {
         let (_, _, usage) = failure_of(&rig(vec![]).run({
             let mut bad = request(vec![user("a")]);
-            bad.output_schema_json = Some("{}".into());
+            bad.tools.push(a_tool());
             bad
         }));
         usage
@@ -1293,7 +1371,7 @@ fn no_result_event_is_a_failure_with_unknown_usage() {
     assert_eq!(
         parts(&rig(vec![]).run({
             let mut bad = request(vec![user("a")]);
-            bad.output_schema_json = Some("{}".into());
+            bad.tools.push(a_tool());
             bad
         }))
         .1
@@ -1374,6 +1452,7 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
             _: &ChildEnv,
             _: &Path,
             _: Vec<u8>,
+            _: &str,
         ) -> io::Result<Box<dyn RunningChild>> {
             Err(io::Error::from(io::ErrorKind::NotFound))
         }
@@ -1742,6 +1821,199 @@ impl Drop for TempDir {
     }
 }
 
+// ---- structured output and the plan quota ----
+
+#[test]
+fn schema_request_lowers_to_json_schema() {
+    let rig = rig(vec![structured_script(), ok_script(SESSION, "hi")]);
+    rig.run(schema_request());
+    let argv = rig.seen().argv;
+    assert_eq!(arg_after(&argv, "--json-schema"), Some(SCHEMA));
+    assert_eq!(argv.iter().filter(|a| *a == "--json-schema").count(), 1);
+    // The tool-less hygiene stays with it.
+    assert_eq!(arg_after(&argv, "--tools"), Some(""));
+    assert!(argv.iter().any(|a| a == "--strict-mcp-config"));
+    assert!(!argv.iter().any(|a| a == "--mcp-config"));
+
+    rig.run(request(vec![user("hello")]));
+    assert!(!rig.seen().argv.iter().any(|a| a == "--json-schema"));
+}
+
+#[test]
+fn structured_output_becomes_assistant_text() {
+    let rig = rig(vec![structured_script()]);
+    let result = rig.run(schema_request());
+    let TransportOutcome::Completed {
+        stop_reason, usage, ..
+    } = outcome(&result)
+    else {
+        panic!("expected completion, got {:?}", outcome(&result));
+    };
+    assert_eq!(*stop_reason, StopReason::EndTurn);
+    assert_eq!(*usage, usage_cost_fixture());
+    let (events, _) = parts(&result);
+    let texts: Vec<&str> = events
+        .iter()
+        .filter_map(|event| match &event.payload {
+            TransportEventPayload::TextDelta { text } => Some(text.as_str()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(texts, [STRUCTURED]);
+    let items = result.transcript_items();
+    assert_eq!(items[0], assistant(STRUCTURED));
+    // The answer is JSON the caller decodes with serde: it is the object.
+    let decoded: serde_json::Value = serde_json::from_str(STRUCTURED).unwrap();
+    assert_eq!(decoded["answer"], "say hello");
+}
+
+fn usage_cost_fixture() -> Usage {
+    usage(2, 7, 1043, 4, Some(3))
+}
+
+#[test]
+fn a_schema_turn_without_structured_output_is_a_provider_failure_billed_as_reported() {
+    for line in [
+        result_line("tool_use", USAGE),
+        result_line_with("end_turn", USAGE, r#","structured_output":null"#),
+    ] {
+        let rig = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            text_line("msg_1", "prose, not the schema"),
+            line,
+        ])]);
+        let result = rig.run(schema_request());
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Provider);
+        assert_eq!(usage, Some(usage_cost_fixture()), "the turn was billed");
+        assert!(result.transcript_items().is_empty());
+    }
+}
+
+#[test]
+fn only_the_structured_output_tool_is_allowed_and_only_when_a_schema_was_sent() {
+    // Without a schema the same call is a tool in a tool-less turn.
+    let first = rig(vec![structured_script()]);
+    let (kind, message, _) = failure_of(&first.run(request(vec![user("hello")])));
+    assert_eq!(kind, FailureKind::Provider);
+    assert!(message.contains("tool"), "{message}");
+
+    // With a schema, any other tool is still refused.
+    let second = rig(vec![Script::lines(vec![
+        init_line(MODEL, SESSION),
+        structured_call_line("Bash"),
+        structured_result_line(),
+    ])]);
+    let (kind, message, _) = failure_of(&second.run(schema_request()));
+    assert_eq!(kind, FailureKind::Provider);
+    assert!(message.contains("tool"), "{message}");
+
+    // `tool_use` is a stop reason only for a schema turn.
+    let third = rig(vec![Script::lines(vec![
+        init_line(MODEL, SESSION),
+        text_line("msg_1", "hi"),
+        result_line("tool_use", USAGE),
+    ])]);
+    let (kind, message, _) = failure_of(&third.run(request(vec![user("hello")])));
+    assert_eq!(kind, FailureKind::Provider);
+    assert!(message.contains("stop reason"), "{message}");
+}
+
+fn quota_of(rig: &Rig) -> model_connector::PlanQuotaSnapshot {
+    rig.backend.plan_quota()
+}
+
+/// The windows with their observation stamps zeroed, for comparing readings.
+fn readings(rig: &Rig) -> Vec<model_connector::PlanQuota> {
+    let mut windows = quota_of(rig).windows;
+    for window in &mut windows {
+        window.observed_at_unix_ms = 0;
+    }
+    windows
+}
+
+fn window(name: &str, permille: u32, resets_at_unix_ms: u64) -> model_connector::PlanQuota {
+    model_connector::PlanQuota {
+        window: name.to_string(),
+        utilization_permille: Some(permille),
+        resets_at_unix_ms,
+        status: "allowed".to_string(),
+        observed_at_unix_ms: 0,
+    }
+}
+
+#[test]
+fn rate_limit_event_updates_quota_cell() {
+    let rig = rig(vec![structured_script()]);
+    assert!(quota_of(&rig).windows.is_empty());
+    let before = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_millis() as u64;
+    rig.run(schema_request());
+    let snapshot = quota_of(&rig);
+    assert_eq!(
+        readings(&rig),
+        vec![
+            window("five_hour", 80, 4_102_444_800_000),
+            window("seven_day", 300, 4_102_531_200_000),
+        ]
+    );
+    let after = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_millis() as u64;
+    for each in &snapshot.windows {
+        assert!((before..=after).contains(&each.observed_at_unix_ms));
+    }
+    // The cell is the one the backend hands out.
+    assert_eq!(rig.backend.quota().snapshot(), snapshot);
+}
+
+#[test]
+fn a_rejected_turn_still_reports_its_windows_and_a_bad_window_costs_only_itself() {
+    let event = r#"{"type":"rate_limit_event","rate_limit_info":{"status":"rejected","unifiedWindows":{"five_hour":{"utilization":0.9996,"resetsAt":4102444800,"status":"rejected"},"seven_day":{"resetsAt":4102531200,"status":"allowed"},"idle":{"utilization":0,"resetsAt":4102444800,"status":"allowed"},"odd":{"utilization":"high","resetsAt":1,"status":"allowed"},"negative":{"utilization":-0.5,"resetsAt":1,"status":"allowed"}}}}"#;
+    let rig = rig(vec![Script::lines(vec![
+        init_line(MODEL, SESSION),
+        event.to_string(),
+        error_result_line(r#","api_error_status":429"#),
+    ])]);
+    let (kind, _, _) = failure_of(&rig.run(request(vec![user("hello")])));
+    assert_eq!(kind, FailureKind::RateLimited);
+    let mut rejected = window("five_hour", 1000, 4_102_444_800_000);
+    rejected.status = "rejected".to_string();
+    // Unknown is never zero: a window missing a field or of another type is
+    // skipped, not read as empty.
+    // A window at exactly zero use is a reading, and is kept.
+    assert_eq!(
+        readings(&rig),
+        vec![rejected, window("idle", 0, 4_102_444_800_000)]
+    );
+}
+
+#[test]
+fn a_later_event_replaces_only_the_windows_it_names() {
+    let only_five = r#"{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","unifiedWindows":{"five_hour":{"utilization":0.5,"resetsAt":4102448400,"status":"allowed"}}}}"#;
+    let rig = rig(vec![
+        structured_script(),
+        Script::lines(vec![
+            init_line(MODEL, SESSION),
+            only_five.to_string(),
+            text_line("msg_1", "hi"),
+            result_line("end_turn", USAGE),
+        ]),
+    ]);
+    rig.run(schema_request());
+    rig.run(request(vec![user("again")]));
+    assert_eq!(
+        readings(&rig),
+        vec![
+            window("five_hour", 500, 4_102_448_400_000),
+            window("seven_day", 300, 4_102_531_200_000),
+        ]
+    );
+}
+
 #[cfg(unix)]
 mod real {
     use super::*;
@@ -1892,11 +2164,7 @@ mod real {
         );
         let fake = fake(&body, limits());
         let config = config(fake.dir.path(), INSTANCE, limits());
-        let env = child_env(
-            &config,
-            &request(vec![user("x")]),
-            Zeroizing::new("t".to_string()),
-        );
+        let env = child_env(&config, &request(vec![user("x")]));
         let argv = vec![
             fake.dir
                 .path()
@@ -1906,7 +2174,7 @@ mod real {
         ];
         let port = crate::process::StdProcessPort::new(limits());
         let child = port
-            .spawn(&argv, &env, fake.dir.path(), Vec::new())
+            .spawn(&argv, &env, fake.dir.path(), Vec::new(), "t")
             .unwrap();
         let (leader_pid, grandchild_pid) = (pid_in(&leader), pid_in(&grandchild));
         drop(child);
@@ -1966,13 +2234,14 @@ mod real {
             names,
             [
                 "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
-                "CLAUDE_CODE_OAUTH_TOKEN",
+                TOKEN_FD_ENV,
                 "CLAUDE_CONFIG_DIR",
                 "HOME",
                 "PATH"
             ]
         );
-        assert!(env.contains(&format!("CLAUDE_CODE_OAUTH_TOKEN={CANARY_TOKEN}")));
+        assert!(env.contains(&format!("{TOKEN_FD_ENV}=3")));
+        assert!(!env.contains(CANARY_TOKEN));
         let cwd = std::fs::read_to_string(probe.path().join("pwd")).unwrap();
         assert_eq!(cwd.trim(), fake.dir.path().join("work").to_str().unwrap());
         let stdin = std::fs::read_to_string(probe.path().join("stdin")).unwrap();
@@ -1980,6 +2249,59 @@ mod real {
         assert!(stdin.contains("\"text\":\"hello\""));
     }
 
+    #[test]
+    fn token_never_in_child_env_and_the_pipe_yields_it_once() {
+        let probe = TempDir::new();
+        // Read the descriptor the variable names, twice, and list what the
+        // child holds open.
+        let body = format!(
+            "fd=\"${TOKEN_FD_ENV}\"\neval \"cat <&$fd\" > '{d}/first'\neval \"cat <&$fd\" > '{d}/second'\nenv > '{d}/env'\nls /proc/$$/fd > '{d}/fds'\n{lines}",
+            d = probe.path().display(),
+            lines = printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        let result = fake.run(request(vec![user("hello")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        let read = |name: &str| std::fs::read_to_string(probe.path().join(name)).unwrap();
+        assert_eq!(read("first"), CANARY_TOKEN, "the pipe holds the token");
+        assert_eq!(read("second"), "", "and nothing the second time");
+        let env = read("env");
+        assert!(!env.contains(CANARY_TOKEN) && !env.contains(&format!("{TOKEN_ENV}=")));
+        assert!(env.contains(&format!("{TOKEN_FD_ENV}=3")));
+        // 0 1 2, the pipe at 3, and the shell's own working descriptors:
+        // no descriptor of the connector's other pipes survives into the child.
+        let held: Vec<u32> = read("fds")
+            .lines()
+            .filter_map(|l| l.trim().parse().ok())
+            .collect();
+        assert!(held.contains(&3));
+    }
+
+    #[test]
+    fn a_token_too_large_for_a_pipe_is_refused_at_its_bound_not_hung() {
+        let fake = fake("exit 0", limits());
+        let config = config(fake.dir.path(), INSTANCE, limits());
+        let env = child_env(&config, &request(vec![user("x")]));
+        let port = crate::process::StdProcessPort::new(limits());
+        let argv = vec![
+            fake.dir
+                .path()
+                .join("claude")
+                .to_string_lossy()
+                .into_owned(),
+        ];
+        let spawn = |token: &str| port.spawn(&argv, &env, fake.dir.path(), Vec::new(), token);
+        let at_bound = spawn(&"t".repeat(4096)).expect("4096 bytes fit the bound");
+        drop(at_bound);
+        assert_eq!(
+            spawn(&"t".repeat(4097)).err().map(|e| e.kind()),
+            Some(io::ErrorKind::InvalidInput)
+        );
+    }
+
     #[test]
     fn the_output_caps_hold_at_their_exact_sizes() {
         let lines = good_lines();
@@ -2109,3 +2431,132 @@ mod real {
         ));
     }
 }
+
+// ---- a call that never reached the provider ----
+
+/// The shape claude 2.1.312 gave with no usable credential: an error result
+/// with no status, no API time and no usage rows. `extra` replaces the
+/// per-turn usage field.
+fn not_logged_in_line(status: &str, api_ms: u64, extra: &str) -> String {
+    format!(
+        r#"{{"type":"result","subtype":"success","is_error":true,{status}"duration_ms":118,"duration_api_ms":{api_ms},"stop_reason":"stop_sequence","result":"Not logged in","total_cost_usd":0,"modelUsage":{{}}{extra}}}"#
+    )
+}
+
+#[test]
+fn a_result_that_made_no_api_call_bills_nothing() {
+    let reservation = reservation();
+    let empty = r#","model_usage_since_last_result":{}"#;
+    let cases = [
+        // (status field, api ms, usage field, billed nothing)
+        (r#""api_error_status":null,"#, 0, empty, true),
+        ("", 0, empty, true),
+        ("", 0, "", true),
+        // An API call was made, or the status names a server fault, or the
+        // CLI reported rows: the reservation stands.
+        ("", 2300, empty, false),
+        (r#""api_error_status":500,"#, 0, empty, false),
+        (
+            r#""api_error_status":null,"#,
+            0,
+            r#","model_usage_since_last_result":"?""#,
+            false,
+        ),
+    ];
+    for (status, api_ms, extra, free) in cases {
+        let line = not_logged_in_line(status, api_ms, extra);
+        let result = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            line.clone(),
+        ])])
+        .run(request(vec![user("hi")]));
+        let (_, _, usage) = failure_of(&result);
+        if free {
+            assert_eq!(usage, Some(usage_zero()), "{line}");
+            assert_eq!(parts(&result).1.cost_micro_usd, 0, "{line}");
+        } else {
+            assert_eq!(usage, None, "{line}");
+            assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
+        }
+    }
+}
+
+#[test]
+fn a_no_call_result_that_reports_rows_is_billed_those_rows() {
+    let line = not_logged_in_line(
+        "",
+        0,
+        &format!(r#","model_usage_since_last_result":{USAGE}"#),
+    );
+    let result = rig(vec![Script::lines(vec![init_line(MODEL, SESSION), line])])
+        .run(request(vec![user("hi")]));
+    let (_, _, billed) = failure_of(&result);
+    assert_eq!(billed, Some(usage(2, 7, 1043, 4, Some(3))));
+}
+
+// ---- the structured output is an object ----
+
+#[test]
+fn a_structured_output_that_is_not_an_object_fails_as_provider_with_usage() {
+    for output in ["\"text\"", "[1]", "42", "true", "null"] {
+        let result = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            structured_call_line("StructuredOutput"),
+            result_line_with(
+                "tool_use",
+                USAGE,
+                &format!(r#","structured_output":{output}"#),
+            ),
+        ])])
+        .run(schema_request());
+        let (kind, message, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Provider, "{output}");
+        assert!(message.contains("structured output"), "{message}");
+        assert!(usage.is_some(), "{output}: the turn ran and is billed");
+    }
+}
+
+#[test]
+fn an_object_answer_to_a_schema_whose_top_type_is_not_object_fails() {
+    for (schema, accepted) in [
+        (r#"{"type":"array"}"#, false),
+        (r#"{"type":"string"}"#, false),
+        (r#"{"type":["object","null"]}"#, false),
+        (r#"{"type":"object"}"#, true),
+        (r#"{"properties":{}}"#, true),
+    ] {
+        let mut asked = request(vec![user("hello")]);
+        asked.output_schema_json = Some(schema.to_string());
+        let result = rig(vec![structured_script()]).run(asked);
+        assert_eq!(
+            matches!(outcome(&result), TransportOutcome::Completed { .. }),
+            accepted,
+            "{schema}"
+        );
+    }
+}
+
+// ---- a schema turn does not hand out a session to resume ----
+
+#[test]
+fn a_turn_after_a_schema_turn_is_seeded_not_resumed() {
+    let rig = rig(vec![structured_script(), ok_script(SESSION, "next")]);
+    let first = rig.run(schema_request());
+    assert!(
+        !parts(&first)
+            .0
+            .iter()
+            .any(|e| matches!(e.payload, TransportEventPayload::ReasoningState { .. })),
+        "a schema turn leaves no handle"
+    );
+    rig.run(request(vec![
+        user("hello"),
+        InputItem::AssistantText {
+            text: STRUCTURED.to_string(),
+        },
+        user("and now plainly"),
+    ]));
+    let argv = rig.seen().argv;
+    assert!(!argv.iter().any(|a| a == "--resume"), "{argv:?}");
+    assert!(!argv.iter().any(|a| a == "--json-schema"));
+}
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 87450a8..674975d 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -68,7 +68,8 @@ pub struct ClaudeConnectorConfig {
     /// Exactly one caller until claude-handle-caller-binding lands.
     #[cultcache(key = 17)]
     pub callers: Vec<CallerConfig>,
-    /// What each allowed model costs; keys are canonical model ids.
+    /// What each allowed model costs. The keys are the known list of models:
+    /// ids exactly as the CLI reports them in its init event.
     #[cultcache(key = 18)]
     pub prices: BTreeMap<String, ModelPrice>,
 }
@@ -190,7 +191,7 @@ impl ClaudeConnectorConfig {
         }
         let mut seen = BTreeSet::new();
         for model in &caller.allowed_models {
-            if !is_canonical_model(model)
+            if !has_model_id_form(model)
                 || !seen.insert(model.as_str())
                 || !self.prices.contains_key(model)
             {
@@ -200,7 +201,7 @@ impl ClaudeConnectorConfig {
         if !self
             .prices
             .iter()
-            .all(|(model, price)| is_canonical_model(model) && is_fully_priced(price))
+            .all(|(model, price)| has_model_id_form(model) && is_fully_priced(price))
         {
             return Err(ConfigError::Invalid("prices"));
         }
@@ -239,28 +240,36 @@ fn is_trimmed_nonempty(text: &str) -> bool {
     !text.is_empty() && text.trim() == text
 }
 
-/// A model id the CLI echoes back unchanged: `claude-<family>-<major>-<minor>`
-/// with an optional `-YYYYMMDD` suffix, the family lowercase letters. Aliases
-/// and bare prefixes are refused because the stream's `init.model` must equal
-/// the requested model.
-fn is_canonical_model(model: &str) -> bool {
+/// The loose shape of a model id, only to catch typos:
+/// `claude-<family>-<major>`, then an optional `-<minor>` and an optional
+/// `-YYYYMMDD`, the family lowercase letters. No shape can tell an alias from
+/// a canonical id, so the known list is the price table's keys (ruling
+/// claude-model-ids-from-price-table); an alias that slips in fails its first
+/// call, when the stream's `init.model` differs from the request.
+fn has_model_id_form(model: &str) -> bool {
     let Some(rest) = model.strip_prefix(MODEL_PREFIX) else {
         return false;
     };
     let digits = |part: &str, most: usize| {
         (1..=most).contains(&part.len()) && part.bytes().all(|byte| byte.is_ascii_digit())
     };
+    let date = |part: &str| part.len() == 8 && digits(part, 8);
     let mut parts = rest.split('-');
     let family = parts.next().unwrap_or("");
-    let major = parts.next().unwrap_or("");
-    let minor = parts.next().unwrap_or("");
-    let date = parts.next();
+    let tail: Vec<&str> = parts.collect();
+    let Some((major, after)) = tail.split_first() else {
+        return false;
+    };
+    let after_ok = match after {
+        [] => true,
+        [one] => digits(one, 2) || date(one),
+        [minor, last] => digits(minor, 2) && date(last),
+        _ => false,
+    };
     !family.is_empty()
         && family.bytes().all(|byte| byte.is_ascii_lowercase())
         && digits(major, 2)
-        && digits(minor, 2)
-        && date.is_none_or(|date| date.len() == 8 && digits(date, 8))
-        && parts.next().is_none()
+        && after_ok
 }
 
 /// A price is a fuse only if every component it bills is nonzero: a zero rate
diff --git a/crates/claude-connector/src/handle.rs b/crates/claude-connector/src/handle.rs
index c20fda0..222b74b 100644
--- a/crates/claude-connector/src/handle.rs
+++ b/crates/claude-connector/src/handle.rs
@@ -89,8 +89,6 @@ impl SessionStore for FsSessionStore {
 pub(crate) enum PlanError {
     #[error("claude-code: tools are not supported by this backend yet")]
     Tools,
-    #[error("claude-code: structured output is not supported by this backend yet")]
-    OutputSchema,
     #[error("claude-code: tool results are not supported by this backend yet")]
     ToolResult,
     #[error("claude-code: the request ends without user text")]
@@ -128,9 +126,6 @@ pub(crate) fn plan(
     if !request.tools.is_empty() {
         return Err(PlanError::Tools);
     }
-    if request.output_schema_json.is_some() {
-        return Err(PlanError::OutputSchema);
-    }
     let input = &request.input;
     let run_start = input
         .iter()
diff --git a/crates/claude-connector/src/launch.rs b/crates/claude-connector/src/launch.rs
index c94134c..b233c09 100644
--- a/crates/claude-connector/src/launch.rs
+++ b/crates/claude-connector/src/launch.rs
@@ -9,19 +9,22 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use model_connector::{ProviderRequest, ReasoningEffort};
-use zeroize::Zeroizing;
 
 use crate::config::ClaudeCodeConfig;
 use crate::handle::Plan;
 
-/// The one credential variable: the child's environment is the only
-/// environment the token ever enters.
-pub(crate) const TOKEN_VAR: &str = "CLAUDE_CODE_OAUTH_TOKEN";
+/// The variable that tells the CLI which file descriptor holds its credential.
+/// The token itself never enters the environment: the process port writes it
+/// into a pipe and hands the child the read end at [`TOKEN_FD`].
+pub(crate) const TOKEN_FD_VAR: &str = "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR";
+/// The descriptor number the child finds the token pipe at: the first one
+/// after stdin, stdout and stderr.
+pub(crate) const TOKEN_FD: i32 = 3;
 const CHILD_PATH: &str = "/usr/local/bin:/usr/bin:/bin";
 
 /// The environment of the child: exactly these names and nothing inherited.
-/// Values are never formatted; `Debug` lists names only.
-pub struct ChildEnv(Vec<(&'static str, Zeroizing<String>)>);
+/// `Debug` lists names only.
+pub struct ChildEnv(Vec<(&'static str, String)>);
 
 impl ChildEnv {
     pub fn iter(&self) -> impl Iterator<Item = (&str, &str)> {
@@ -37,21 +40,17 @@ impl fmt::Debug for ChildEnv {
     }
 }
 
-pub(crate) fn child_env(
-    config: &ClaudeCodeConfig,
-    request: &ProviderRequest,
-    token: Zeroizing<String>,
-) -> ChildEnv {
+pub(crate) fn child_env(config: &ClaudeCodeConfig, request: &ProviderRequest) -> ChildEnv {
     let config_dir = config.config_dir.to_string_lossy().into_owned();
     ChildEnv(vec![
-        ("PATH", Zeroizing::new(CHILD_PATH.to_string())),
-        ("HOME", Zeroizing::new(config_dir.clone())),
-        ("CLAUDE_CONFIG_DIR", Zeroizing::new(config_dir)),
+        ("PATH", CHILD_PATH.to_string()),
+        ("HOME", config_dir.clone()),
+        ("CLAUDE_CONFIG_DIR", config_dir),
         (
             "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
-            Zeroizing::new(request.max_output_tokens.to_string()),
+            request.max_output_tokens.to_string(),
         ),
-        (TOKEN_VAR, token),
+        (TOKEN_FD_VAR, TOKEN_FD.to_string()),
     ])
 }
 
@@ -108,7 +107,8 @@ fn effort(effort: ReasoningEffort) -> &'static str {
 /// rather than an argument because one argument is capped near 128 KiB
 /// (E2BIG) and instructions are not, the child has
 /// no tools, no MCP servers, no settings, no slash commands and nobody to ask
-/// for permission, and a resume always forks.
+/// for permission, and a resume always forks. A request's output schema goes
+/// to the CLI as `--json-schema`; without one the flag is absent.
 pub(crate) fn argv(
     config: &ClaudeCodeConfig,
     request: &ProviderRequest,
@@ -142,6 +142,9 @@ pub(crate) fn argv(
     if let Some(level) = request.reasoning_effort {
         argv.extend(["--effort".to_string(), effort(level).to_string()]);
     }
+    if let Some(schema) = &request.output_schema_json {
+        argv.extend(["--json-schema".to_string(), schema.clone()]);
+    }
     if let Plan::Resume { session_id, .. } = plan {
         argv.extend([
             "--resume".to_string(),
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index ef3e404..327a078 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -9,6 +9,7 @@ mod daemon;
 mod handle;
 mod launch;
 mod process;
+mod quota;
 mod stream;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
@@ -21,3 +22,4 @@ pub use launch::ChildEnv;
 #[cfg(unix)]
 pub use process::StdProcessPort;
 pub use process::{ProcessPort, RunningChild, StdoutRead};
+pub use quota::QuotaCell;
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index ece39cc..c58e7f5 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -37,7 +37,9 @@ fn main() -> ExitCode {
 
 #[derive(Debug, thiserror::Error)]
 enum Failure {
-    #[error("usage: serve --config PATH | config init PATH --flag value ... | config check PATH")]
+    #[error(
+        "usage: serve --config PATH | config init PATH --flag value ... | config check PATH (check reads the credential from the environment it runs in: run it in the unit's environment)"
+    )]
     Usage,
     #[error(transparent)]
     Config(#[from] ConfigError),
diff --git a/crates/claude-connector/src/process.rs b/crates/claude-connector/src/process.rs
index 450f388..2421e0e 100644
--- a/crates/claude-connector/src/process.rs
+++ b/crates/claude-connector/src/process.rs
@@ -20,7 +20,9 @@ pub enum StdoutRead {
 }
 
 /// Starts a `claude` child. `argv[0]` is the program; the environment is
-/// exactly `env`; `stdin` is written and closed.
+/// exactly `env`; `stdin` is written and closed. `token` is the child's
+/// credential: it reaches the child on a pipe at `launch::TOKEN_FD`, once, and
+/// is in no environment.
 pub trait ProcessPort: Send + Sync {
     fn spawn(
         &self,
@@ -28,6 +30,7 @@ pub trait ProcessPort: Send + Sync {
         env: &ChildEnv,
         cwd: &Path,
         stdin: Vec<u8>,
+        token: &str,
     ) -> io::Result<Box<dyn RunningChild>>;
 }
 
@@ -47,6 +50,7 @@ pub use unix::StdProcessPort;
 #[cfg(unix)]
 mod unix {
     use std::io::{self, BufRead, BufReader, Read, Write};
+    use std::os::fd::{AsRawFd, RawFd};
     use std::os::unix::process::CommandExt;
     use std::path::Path;
     use std::process::{Child, Command, Stdio};
@@ -57,7 +61,40 @@ mod unix {
 
     use super::{ProcessPort, RunningChild, StdoutRead};
     use crate::config::ClaudeCodeLimits;
-    use crate::launch::ChildEnv;
+    use crate::launch::{ChildEnv, TOKEN_FD};
+
+    /// A pipe holds a token without blocking the writer; a token is a few
+    /// hundred bytes, so anything near the pipe's capacity is not one.
+    const MAX_TOKEN_BYTES: usize = 4096;
+
+    fn cvt(result: libc::c_int) -> io::Result<libc::c_int> {
+        if result < 0 {
+            Err(io::Error::last_os_error())
+        } else {
+            Ok(result)
+        }
+    }
+
+    /// Makes `source` also descriptor `target`, open across exec. Runs between
+    /// fork and exec in the child, so it calls nothing but `dup2` and `fcntl`.
+    fn place_fd(source: RawFd, target: RawFd) -> io::Result<()> {
+        // SAFETY: dup2 and fcntl take integers only and are async-signal-safe.
+        unsafe {
+            if source == target {
+                // dup2 onto itself changes nothing, so the close-on-exec flag
+                // the pipe was created with must be cleared by hand.
+                let flags = cvt(libc::fcntl(target, libc::F_GETFD))?;
+                cvt(libc::fcntl(
+                    target,
+                    libc::F_SETFD,
+                    flags & !libc::FD_CLOEXEC,
+                ))?;
+            } else {
+                cvt(libc::dup2(source, target))?;
+            }
+        }
+        Ok(())
+    }
 
     /// Spawns each child in its own process group, so that killing the call
     /// kills what the child started too.
@@ -78,7 +115,11 @@ mod unix {
             env: &ChildEnv,
             cwd: &Path,
             stdin: Vec<u8>,
+            token: &str,
         ) -> io::Result<Box<dyn RunningChild>> {
+            if token.len() > MAX_TOKEN_BYTES {
+                return Err(io::Error::from(io::ErrorKind::InvalidInput));
+            }
             let (program, args) = argv
                 .split_first()
                 .ok_or_else(|| io::Error::from(io::ErrorKind::InvalidInput))?;
@@ -92,7 +133,17 @@ mod unix {
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped())
                 .process_group(0);
+            // The write end closes here, so the child sees the token and then
+            // the end of the pipe. Both ends are close-on-exec; only the copy
+            // `place_fd` makes reaches the child.
+            let (reader, mut writer) = std::io::pipe()?;
+            writer.write_all(token.as_bytes())?;
+            drop(writer);
+            let source = reader.as_raw_fd();
+            // SAFETY: the closure calls only async-signal-safe functions.
+            unsafe { command.pre_exec(move || place_fd(source, TOKEN_FD)) };
             let mut child = command.spawn()?;
+            drop(reader);
             let (stdin_pipe, stdout, stderr) =
                 (child.stdin.take(), child.stdout.take(), child.stderr.take());
 
@@ -229,4 +280,83 @@ mod unix {
             self.wait();
         }
     }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+
+        fn cloexec(fd: RawFd) -> bool {
+            // SAFETY: fcntl on an integer descriptor.
+            let flags = unsafe { libc::fcntl(fd, libc::F_GETFD) };
+            assert!(flags >= 0, "descriptor {fd} is not open");
+            flags & libc::FD_CLOEXEC != 0
+        }
+
+        /// A descriptor at or above 300 on the same pipe, so a test never
+        /// touches a low number another thread may be using.
+        fn high_dup(source: RawFd, close_on_exec: bool) -> RawFd {
+            let command = if close_on_exec {
+                libc::F_DUPFD_CLOEXEC
+            } else {
+                libc::F_DUPFD
+            };
+            // SAFETY: fcntl on an integer descriptor.
+            let fd = unsafe { libc::fcntl(source, command, 300) };
+            assert!(fd >= 300);
+            fd
+        }
+
+        /// The three tests below name descriptor numbers by value, and a number
+        /// one releases is the lowest free one for the next `high_dup`. They
+        /// hold this for their whole body, so none sees a number another
+        /// freed or places over one another owns.
+        static FDS: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+        fn fds() -> std::sync::MutexGuard<'static, ()> {
+            FDS.lock().unwrap_or_else(|e| e.into_inner())
+        }
+
+        fn close(fd: RawFd) {
+            // SAFETY: closing a descriptor the test owns.
+            unsafe { libc::close(fd) };
+        }
+
+        #[test]
+        fn placing_a_descriptor_on_itself_clears_close_on_exec() {
+            let _held = fds();
+            let (reader, _writer) = std::io::pipe().unwrap();
+            let fd = high_dup(reader.as_raw_fd(), true);
+            assert!(cloexec(fd));
+            place_fd(fd, fd).unwrap();
+            assert!(!cloexec(fd), "it must survive exec");
+            // One that already survives is left alone, not refused.
+            place_fd(fd, fd).unwrap();
+            assert!(!cloexec(fd));
+            close(fd);
+        }
+
+        #[test]
+        fn placing_a_descriptor_elsewhere_copies_it_open_across_exec() {
+            let _held = fds();
+            let (reader, _writer) = std::io::pipe().unwrap();
+            let source = high_dup(reader.as_raw_fd(), true);
+            let target = high_dup(reader.as_raw_fd(), true);
+            assert!(cloexec(target));
+            place_fd(source, target).unwrap();
+            assert!(!cloexec(target), "the copy survives exec");
+            assert!(cloexec(source), "the source does not");
+            close(source);
+            close(target);
+        }
+
+        #[test]
+        fn a_descriptor_that_is_not_open_is_refused_either_way() {
+            let _held = fds();
+            let (reader, _writer) = std::io::pipe().unwrap();
+            let closed = high_dup(reader.as_raw_fd(), true);
+            close(closed);
+            assert!(place_fd(closed, closed).is_err());
+            assert!(place_fd(closed, closed + 1).is_err());
+        }
+    }
 }
diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
new file mode 100644
index 0000000..76f0ce4
--- /dev/null
+++ b/crates/claude-connector/src/quota.rs
@@ -0,0 +1,151 @@
+//! The plan's own usage windows, as the CLI reports them. The subscription
+//! decides how much a plan may burn; the CLI's `rate_limit_event` is the only
+//! place that number appears, so the latest observation of each window is kept
+//! here and read out beside the connector's own spend ledger.
+
+use std::collections::BTreeMap;
+use std::sync::Mutex;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use model_connector::{PlanQuota, PlanQuotaSnapshot};
+
+/// The latest observation of each plan window, shared by the backend that
+/// feeds it and whatever reads it out. Each window carries the time of its
+/// own observation: an event that names one window says nothing about the
+/// others.
+#[derive(Default)]
+pub struct QuotaCell(Mutex<BTreeMap<String, PlanQuota>>);
+
+impl QuotaCell {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Records the windows one event reported, stamping each with now. Each
+    /// replaces that window's earlier observation, and windows the event did
+    /// not mention stay as they were, stamp included.
+    pub fn observe(&self, windows: impl IntoIterator<Item = PlanQuota>) {
+        self.observe_at(unix_ms(), windows);
+    }
+
+    fn observe_at(&self, now: u64, windows: impl IntoIterator<Item = PlanQuota>) {
+        let mut held = self.0.lock().unwrap_or_else(|e| e.into_inner());
+        for mut quota in windows {
+            quota.observed_at_unix_ms = now;
+            held.insert(quota.window.clone(), quota);
+        }
+    }
+
+    pub fn snapshot(&self) -> PlanQuotaSnapshot {
+        self.snapshot_at(unix_ms())
+    }
+
+    /// The windows as of `now`. One whose reset time has passed is reported
+    /// `expired` with no utilization: the reading described a window that no
+    /// longer exists.
+    fn snapshot_at(&self, now: u64) -> PlanQuotaSnapshot {
+        let held = self.0.lock().unwrap_or_else(|e| e.into_inner());
+        PlanQuotaSnapshot {
+            windows: held
+                .values()
+                .cloned()
+                .map(|mut quota| {
+                    if now >= quota.resets_at_unix_ms {
+                        quota.utilization_permille = None;
+                        quota.status = EXPIRED.to_string();
+                    }
+                    quota
+                })
+                .collect(),
+        }
+    }
+}
+
+/// The status of a window whose reset has passed since it was observed.
+const EXPIRED: &str = "expired";
+
+fn unix_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |elapsed| {
+            u64::try_from(elapsed.as_millis()).unwrap_or(u64::MAX)
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const RESET: u64 = 1_793_307_000_000;
+
+    fn quota(window: &str, permille: u32, observed_at: u64) -> PlanQuota {
+        PlanQuota {
+            window: window.to_string(),
+            utilization_permille: Some(permille),
+            resets_at_unix_ms: RESET,
+            status: "allowed".to_string(),
+            observed_at_unix_ms: observed_at,
+        }
+    }
+
+    #[test]
+    fn an_empty_cell_has_observed_nothing() {
+        assert!(QuotaCell::new().snapshot().windows.is_empty());
+    }
+
+    #[test]
+    fn each_window_keeps_its_own_latest_observation_and_its_own_time() {
+        let cell = QuotaCell::new();
+        cell.observe_at(100, [quota("five_hour", 80, 0), quota("seven_day", 300, 0)]);
+        cell.observe_at(200, [quota("five_hour", 120, 0)]);
+        assert_eq!(
+            cell.snapshot_at(250).windows,
+            vec![quota("five_hour", 120, 200), quota("seven_day", 300, 100)],
+            "the window the later event did not name keeps its older stamp"
+        );
+    }
+
+    #[test]
+    fn an_event_with_no_windows_changes_nothing() {
+        let cell = QuotaCell::new();
+        cell.observe_at(100, [quota("five_hour", 80, 0)]);
+        cell.observe_at(900, Vec::new());
+        assert_eq!(
+            cell.snapshot_at(950).windows,
+            vec![quota("five_hour", 80, 100)]
+        );
+    }
+
+    #[test]
+    fn a_window_past_its_reset_is_expired_not_old_utilization() {
+        let cell = QuotaCell::new();
+        cell.observe_at(100, [quota("five_hour", 80, 0)]);
+        let live = cell.snapshot_at(RESET - 1).windows;
+        assert_eq!(live, vec![quota("five_hour", 80, 100)]);
+        let expired = cell.snapshot_at(RESET).windows;
+        assert_eq!(expired.len(), 1);
+        assert_eq!(expired[0].status, "expired");
+        assert_eq!(expired[0].utilization_permille, None);
+        assert_eq!(
+            expired[0].observed_at_unix_ms, 100,
+            "its age stays readable"
+        );
+        assert_eq!(expired[0].resets_at_unix_ms, RESET);
+    }
+
+    #[test]
+    fn the_live_clock_stamps_and_expires() {
+        let cell = QuotaCell::new();
+        let before = unix_ms();
+        let mut past = quota("old", 10, 0);
+        past.resets_at_unix_ms = 1;
+        cell.observe([past, quota("five_hour", 80, 0)]);
+        let after = unix_ms();
+        let windows = cell.snapshot().windows;
+        let stamp = windows[0].observed_at_unix_ms;
+        assert!((before..=after).contains(&stamp));
+        assert_eq!(windows[0].window, "five_hour");
+        assert_eq!(windows[0].utilization_permille, Some(80));
+        assert_eq!(windows[1].status, "expired");
+    }
+}
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index e99935f..f712892 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -3,10 +3,16 @@
 
 use std::collections::BTreeMap;
 
-use model_connector::{FailureKind, StopReason, Usage};
+use model_connector::{FailureKind, PlanQuota, StopReason, Usage};
 use serde::Deserialize;
 use serde_json::Value;
 
+use crate::quota::QuotaCell;
+
+/// The tool the CLI gives the model to deliver an answer that must match a
+/// `--json-schema`. Its call is the structured output, not a tool exchange.
+const STRUCTURED_OUTPUT_TOOL: &str = "StructuredOutput";
+
 /// A call that cannot complete, with the stage that failed. `usage` is `None`
 /// (the kit bills its reservation) unless a result event reported it or the
 /// call never reached the provider (zero).
@@ -63,12 +69,18 @@ struct Line {
     session_id: Option<String>,
     model: Option<String>,
     message: Option<Message>,
-    rate_limit_info: Option<RateLimitInfo>,
+    /// Read by hand: the shape moves with the CLI, and a field that changes
+    /// type must cost the quota reading, never the call.
+    rate_limit_info: Option<Value>,
     is_error: Option<bool>,
     stop_reason: Option<String>,
     api_error_status: Option<Value>,
+    /// Milliseconds spent in API calls; zero means no call was made.
+    duration_api_ms: Option<u64>,
     result: Option<Value>,
     errors: Option<Value>,
+    /// The answer to a `--json-schema` request, an object.
+    structured_output: Option<Value>,
     /// What this turn alone consumed. `modelUsage` is deliberately not read:
     /// on a resumed session it carries every earlier turn too.
     model_usage_since_last_result: Option<Value>,
@@ -85,11 +97,7 @@ struct Block {
     #[serde(rename = "type")]
     kind: String,
     text: Option<String>,
-}
-
-#[derive(Deserialize)]
-struct RateLimitInfo {
-    status: Option<String>,
+    name: Option<String>,
 }
 
 /// One model's entry. The four counts are required: an entry that lacks one
@@ -107,6 +115,13 @@ struct ModelUsage {
 /// One call's stream, line by line.
 pub(crate) struct StreamState<'a> {
     model: &'a str,
+    /// Whether the request carried an output schema, so the answer is the
+    /// result's structured output.
+    structured: bool,
+    /// Whether that schema's top type admits an object (absent counts): the
+    /// structured output must be an object, never a bare scalar or array.
+    schema_top_is_object: bool,
+    quota: &'a QuotaCell,
     session_id: Option<String>,
     texts: Vec<String>,
     message_id: Option<String>,
@@ -114,9 +129,16 @@ pub(crate) struct StreamState<'a> {
 }
 
 impl<'a> StreamState<'a> {
-    pub(crate) fn new(model: &'a str) -> Self {
+    /// `schema` is the request's output schema text, when it carried one.
+    pub(crate) fn new(model: &'a str, schema: Option<&str>, quota: &'a QuotaCell) -> Self {
+        let top = schema
+            .and_then(|text| serde_json::from_str::<Value>(text).ok())
+            .and_then(|schema| schema.get("type").cloned());
         Self {
             model,
+            structured: schema.is_some(),
+            schema_top_is_object: top.is_none_or(|top| top.as_str() == Some("object")),
+            quota,
             session_id: None,
             texts: Vec::new(),
             message_id: None,
@@ -151,10 +173,11 @@ impl<'a> StreamState<'a> {
             },
             "assistant" => self.assistant(line.message),
             "rate_limit_event" => {
-                self.plan_rejected |= line
-                    .rate_limit_info
-                    .and_then(|info| info.status)
-                    .is_some_and(|status| status == "rejected");
+                if let Some(info) = &line.rate_limit_info {
+                    self.plan_rejected |=
+                        info.get("status").and_then(Value::as_str) == Some("rejected");
+                    self.quota.observe(plan_windows(info));
+                }
                 Step::More
             }
             "result" => Step::Done(Box::new(self.result(line))),
@@ -176,6 +199,9 @@ impl<'a> StreamState<'a> {
                         self.texts.push(text);
                     }
                 }
+                "tool_use"
+                    if self.structured && block.name.as_deref() == Some(STRUCTURED_OUTPUT_TOOL) => {
+                }
                 "tool_use" => {
                     return fail(
                         FailureKind::Provider,
@@ -195,7 +221,16 @@ impl<'a> StreamState<'a> {
                 line.api_error_status.as_ref().and_then(Value::as_u64),
                 Some(401 | 403 | 429)
             );
-        let usage = read_usage(line.model_usage_since_last_result, door_refusal);
+        // The CLI found no credential and never called the API: an error with
+        // no status and no API time at all.
+        let no_call = !success
+            && line.duration_api_ms == Some(0)
+            && line.api_error_status.as_ref().is_none_or(Value::is_null);
+        let usage = read_usage(
+            line.model_usage_since_last_result,
+            door_refusal || no_call,
+            no_call,
+        );
         if !success {
             return Err(Failure {
                 kind: self.error_kind(&line.api_error_status, &line.result, &line.errors),
@@ -210,8 +245,26 @@ impl<'a> StreamState<'a> {
                 usage: None,
             });
         };
+        let mut texts = std::mem::take(&mut self.texts);
+        if self.structured {
+            // The answer is the structured output alone; any prose around the
+            // tool call is not part of it.
+            let Some(output) = line
+                .structured_output
+                .filter(|value| value.is_object() && self.schema_top_is_object)
+            else {
+                return Err(Failure {
+                    kind: FailureKind::Provider,
+                    message: "claude-code: a schema was sent and the result carried no structured output object",
+                    usage: Some(usage),
+                });
+            };
+            texts = vec![output.to_string()];
+        }
         let stop_reason = match line.stop_reason.as_deref() {
             Some("end_turn") => StopReason::EndTurn,
+            // The structured-output tool call is how such a turn ends.
+            Some("tool_use") if self.structured => StopReason::EndTurn,
             Some("max_tokens") => StopReason::MaxOutputTokens,
             Some("stop_sequence") => StopReason::StopSequence,
             Some("refusal") => StopReason::Refusal,
@@ -233,7 +286,7 @@ impl<'a> StreamState<'a> {
         };
         Ok(Finished {
             session_id,
-            texts: std::mem::take(&mut self.texts),
+            texts,
             message_id: self.message_id.take(),
             stop_reason,
             usage,
@@ -263,20 +316,54 @@ impl<'a> StreamState<'a> {
     }
 }
 
+/// The plan windows one `rate_limit_event` reports under
+/// `rate_limit_info.unifiedWindows`: utilization as a fraction of the window,
+/// reset as unix seconds. A window missing any of its three fields is skipped;
+/// an unknown reading is never zero.
+fn plan_windows(info: &Value) -> Vec<PlanQuota> {
+    let Some(windows) = info.get("unifiedWindows").and_then(Value::as_object) else {
+        return Vec::new();
+    };
+    windows
+        .iter()
+        .filter_map(|(window, reading)| {
+            let utilization = reading.get("utilization")?.as_f64()?;
+            let resets_at = reading.get("resetsAt")?.as_u64()?;
+            let status = reading.get("status")?.as_str()?;
+            if !utilization.is_finite() || utilization < 0.0 {
+                return None;
+            }
+            Some(PlanQuota {
+                window: window.clone(),
+                // `as` saturates a float at the integer's bounds.
+                utilization_permille: Some((utilization * 1000.0).round() as u32),
+                resets_at_unix_ms: resets_at.saturating_mul(1000),
+                status: status.to_string(),
+                // Stamped by the cell that keeps it.
+                observed_at_unix_ms: 0,
+            })
+        })
+        .collect()
+}
+
 fn fail(kind: FailureKind, message: &'static str) -> Step {
     Step::Done(Box::new(Err(Failure::cost_unknown(kind, message))))
 }
 
 /// What this turn consumed, summed over every model it used (harness side
 /// calls included), or `None` when the result does not say: the field absent,
-/// of another shape, or empty. An empty report is believed only for a refusal
-/// at the door (401, 403 or 429), which the provider cannot have billed; elsewhere
-/// the CLI also zeroes usage on crashes after real work. `None` is billed the
-/// reservation by the kit.
-fn read_usage(reported: Option<Value>, door_refusal: bool) -> Option<Usage> {
-    let models: BTreeMap<String, ModelUsage> = serde_json::from_value(reported?).ok()?;
+/// of another shape, or empty. An empty report is believed only where the
+/// provider cannot have billed (`empty_is_zero`: a refusal at the door, 401,
+/// 403 or 429, or a call never made); elsewhere the CLI also zeroes usage on
+/// crashes after real work. A call never made (`absent_is_zero`) may also
+/// omit the field. `None` is billed the reservation by the kit.
+fn read_usage(reported: Option<Value>, empty_is_zero: bool, absent_is_zero: bool) -> Option<Usage> {
+    let Some(reported) = reported else {
+        return absent_is_zero.then(|| sum_usage(std::iter::empty()));
+    };
+    let models: BTreeMap<String, ModelUsage> = serde_json::from_value(reported).ok()?;
     if models.is_empty() {
-        return door_refusal.then(|| sum_usage(std::iter::empty()));
+        return empty_is_zero.then(|| sum_usage(std::iter::empty()));
     }
     Some(sum_usage(models.into_values()))
 }
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 4bc35d4..141f471 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -6,6 +6,7 @@ use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::Duration;
 
 use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
 use cultcache_rs::{
@@ -276,13 +277,6 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
                 c.prices.insert("claude-sonnet-latest".to_string(), price());
             }),
         ),
-        (
-            "no minor",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-opus-5".to_string()];
-                c.prices.insert("claude-opus-5".to_string(), price());
-            }),
-        ),
         (
             "uppercase family",
             Box::new(|c| {
@@ -343,7 +337,6 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
         "allowed_models",
         "allowed_models",
         "allowed_models",
-        "allowed_models",
         "callers",
         "callers",
     ];
@@ -355,12 +348,23 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
 }
 
 #[test]
-fn a_dated_canonical_id_is_allowed() {
-    let dated = "claude-opus-5-1-20260101".to_string();
-    let mut config = valid();
-    config.callers[0].allowed_models = vec![dated.clone()];
-    config.prices.insert(dated, price());
-    config.validate().unwrap();
+fn a_priced_id_of_any_loose_form_is_allowed_and_the_price_table_decides() {
+    // Real ids come with a minor, without one, and with a date either way.
+    for id in [
+        "claude-opus-5-1-20260101",
+        "claude-opus-5",
+        "claude-opus-5-20260101",
+        "claude-sonnet-4-5",
+    ] {
+        let mut config = valid();
+        config.callers[0].allowed_models = vec![id.to_string()];
+        config.prices.insert(id.to_string(), price());
+        config.validate().unwrap_or_else(|e| panic!("{id}: {e}"));
+
+        // The same id with no price is not on the known list.
+        config.prices.remove(id);
+        assert_eq!(refused(&config), "allowed_models", "{id}");
+    }
 }
 
 #[test]
@@ -543,13 +547,64 @@ fn no_refusal_echoes_a_value() {
 
 // ---- the binary ----
 
+/// How long any connector verb may take in these tests. `check` and `init`
+/// return at once and `serve` is meant to refuse; a `serve` that starts
+/// instead would run forever, so it fails a named test here, not the suite.
+const VERB_DEADLINE: Duration = Duration::from_secs(20);
+
 fn run(args: &[&str], envs: &[(&str, &Path)]) -> Output {
     let mut command = Command::new(env!("CARGO_BIN_EXE_claude-connector"));
     command.args(args).env_clear();
     for (name, value) in envs {
         command.env(name, value);
     }
-    command.output().unwrap()
+    run_within(command, VERB_DEADLINE).unwrap_or_else(|| {
+        panic!(
+            "`{}` was still running after {VERB_DEADLINE:?}: it started",
+            args.join(" ")
+        )
+    })
+}
+
+/// The command's output, or `None` when it outlived `deadline` and was killed.
+fn run_within(mut command: Command, deadline: Duration) -> Option<Output> {
+    use std::process::Stdio;
+    use std::time::Instant;
+
+    let mut child = command
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let started = Instant::now();
+    while child.try_wait().unwrap().is_none() {
+        if started.elapsed() > deadline {
+            child.kill().unwrap();
+            child.wait().unwrap();
+            return None;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    Some(child.wait_with_output().unwrap())
+}
+
+#[cfg(unix)]
+#[test]
+fn a_process_past_its_deadline_is_killed_and_reported_as_none() {
+    let mut forever = Command::new("sleep");
+    forever.arg("60");
+    let started = std::time::Instant::now();
+    assert!(run_within(forever, Duration::from_millis(200)).is_none());
+    assert!(started.elapsed() < Duration::from_secs(10));
+    let mut quick = Command::new("true");
+    quick.env_clear();
+    assert!(
+        run_within(quick, Duration::from_secs(10))
+            .unwrap()
+            .status
+            .success()
+    );
 }
 
 fn shown(output: &Output) -> String {
@@ -756,8 +811,42 @@ fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
     assert!(init(&scratch, &flags).status.success());
     let (checked, served) = check_and_serve(&scratch.path("connector.cc"), None);
     assert!(!checked.status.success() && !served.status.success());
-    assert!(shown(&checked).contains("token_credential"));
+    assert!(shown(&checked).contains("credentials_directory"));
+    assert!(!shown(&checked).contains("token_credential"));
     assert_eq!(shown(&checked), shown(&served));
+
+    // A credential directory without the credential is the other fault, and
+    // the token is checked last: a broken pin is named first.
+    let scratch = Scratch::new();
+    let (flags, credentials) = prepare(&scratch);
+    assert!(init(&scratch, &flags).status.success());
+    std::fs::remove_file(credentials.join("claude-token")).unwrap();
+    std::fs::write(scratch.path("claude"), b"other bytes").unwrap();
+    let (checked, _) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+    assert!(
+        shown(&checked).contains("claude_binary_sha256"),
+        "{}",
+        shown(&checked)
+    );
+    std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
+    let (checked, _) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
+    assert!(
+        shown(&checked).contains("token_credential"),
+        "{}",
+        shown(&checked)
+    );
+    assert!(!shown(&checked).contains("credentials_directory"));
+}
+
+#[test]
+fn usage_says_check_runs_in_the_units_environment() {
+    let output = run(&["nonsense"], &[]);
+    assert!(!output.status.success());
+    assert!(
+        shown(&output).contains("unit's environment"),
+        "{}",
+        shown(&output)
+    );
 }
 
 #[cfg(unix)]
diff --git a/crates/model-connector/src/client.rs b/crates/model-connector/src/client.rs
index 1421a5b..47b6c94 100644
--- a/crates/model-connector/src/client.rs
+++ b/crates/model-connector/src/client.rs
@@ -4,11 +4,16 @@ use std::time::Duration;
 use thiserror::Error;
 use zeroize::Zeroizing;
 
+use rand_core::{OsRng, RngCore};
+
 use crate::contract::{TransportInvocation, TransportKey, TransportResult};
 use crate::envelope::{
-    MAX_IDENTITY_BYTES, ServiceError, TransportFrameError, decode_result_frame, decrypt_result,
-    encode_invocation_frame, encrypt_invocation, read_transport_frame, write_transport_frame,
+    MAX_IDENTITY_BYTES, ServiceError, TransportFrameError, decode_result_frame,
+    decode_spend_readout_response_frame, decrypt_result, decrypt_spend_readout,
+    encode_invocation_frame, encode_spend_readout_request_frame, encrypt_invocation,
+    encrypt_spend_readout_request, read_transport_frame, write_transport_frame,
 };
+use crate::readout::SpendReadout;
 
 #[derive(Clone)]
 pub struct ConnectorClient {
@@ -52,6 +57,34 @@ impl ConnectorClient {
             return Err(ConnectorClientError::RequestIdTooLong);
         }
         let request = encode_invocation_frame(&encrypt_invocation(invocation, &self.security)?)?;
+        let response = self.exchange(&request)?;
+        let envelope = decode_result_frame(&response)?;
+        decrypt_result(&envelope, &self.security, invocation).map_err(Into::into)
+    }
+
+    /// Reads the connector's spend ledger and plan quota as `caller_runtime_id`,
+    /// which must be a caller whose connection key this client holds.
+    pub fn spend_readout(
+        &self,
+        caller_runtime_id: &str,
+    ) -> Result<SpendReadout, ConnectorClientError> {
+        let mut nonce = [0_u8; 16];
+        OsRng.fill_bytes(&mut nonce);
+        let request_id = format!(
+            "spend-readout-{}",
+            nonce.iter().map(|b| format!("{b:02x}")).collect::<String>()
+        );
+        let sealed = encrypt_spend_readout_request(caller_runtime_id, &request_id, &self.security)?;
+        let response = self.exchange(&encode_spend_readout_request_frame(&sealed)?)?;
+        let envelope = decode_spend_readout_response_frame(&response)?;
+        if envelope.caller_runtime_id != caller_runtime_id || envelope.request_id != request_id {
+            return Err(ServiceError::OuterIdentity.into());
+        }
+        decrypt_spend_readout(&envelope, &self.security).map_err(Into::into)
+    }
+
+    /// Sends one frame on a fresh connection and reads the one answer.
+    fn exchange(&self, request: &[u8]) -> Result<Vec<u8>, ConnectorClientError> {
         let connect_timeout = self
             .response_timeout
             .unwrap_or(Duration::from_secs(10))
@@ -62,12 +95,9 @@ impl ConnectorClient {
             .set_read_timeout(self.response_timeout)
             .and_then(|()| stream.set_write_timeout(self.response_timeout))
             .map_err(ConnectorClientError::Connection)?;
-        write_transport_frame(&mut stream, &request, self.max_frame_bytes)
+        write_transport_frame(&mut stream, request, self.max_frame_bytes)
             .map_err(client_frame_error)?;
-        let response =
-            read_transport_frame(&mut stream, self.max_frame_bytes).map_err(client_frame_error)?;
-        let envelope = decode_result_frame(&response)?;
-        decrypt_result(&envelope, &self.security, invocation).map_err(Into::into)
+        read_transport_frame(&mut stream, self.max_frame_bytes).map_err(client_frame_error)
     }
 }
 
@@ -226,4 +256,56 @@ mod fixture_tests {
             "the client must not even connect"
         );
     }
+
+    #[cfg(feature = "daemon")]
+    #[test]
+    fn a_readout_is_accepted_only_for_the_identity_that_asked() {
+        use crate::readout::PlanQuotaSnapshot;
+        // (caller the answer is sealed for, request id override, accepted)
+        let cases = [
+            ("caller-1", None, true),
+            ("caller-2", None, false),
+            ("caller-1", Some("some-other-request"), false),
+        ];
+        for (answer_caller, answer_request, accepted) in cases {
+            let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+            let endpoint = listener.local_addr().unwrap();
+            let key = security("readout-client-key");
+            let server = std::thread::spawn(move || {
+                let (mut stream, _) = listener.accept().unwrap();
+                let request = read_transport_frame(&mut stream, 64 * 1024).unwrap();
+                let RequestFrame::SpendReadout(asked) = decode_request_frame(&request).unwrap()
+                else {
+                    panic!("the client sent something other than a readout request");
+                };
+                let request_id = answer_request.unwrap_or(&asked.request_id);
+                let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
+                let sealed =
+                    encrypt_spend_readout(answer_caller, request_id, &readout, &key).unwrap();
+                write_transport_frame(
+                    &mut stream,
+                    &encode_spend_readout_response_frame(&sealed).unwrap(),
+                    64 * 1024,
+                )
+                .unwrap();
+            });
+            let client = ConnectorClient::new(
+                endpoint,
+                "readout-client-key",
+                64 * 1024,
+                Some(Duration::from_secs(1)),
+            )
+            .unwrap();
+            let answer = client.spend_readout("caller-1");
+            if accepted {
+                assert_eq!(answer.unwrap().at_unix_ms, 1);
+            } else {
+                assert!(matches!(
+                    answer,
+                    Err(ConnectorClientError::Transport(ServiceError::OuterIdentity))
+                ));
+            }
+            server.join().unwrap();
+        }
+    }
 }
diff --git a/crates/model-connector/src/envelope.rs b/crates/model-connector/src/envelope.rs
index 40cfd09..70d8ed2 100644
--- a/crates/model-connector/src/envelope.rs
+++ b/crates/model-connector/src/envelope.rs
@@ -17,11 +17,14 @@ use crate::contract::{
     ContractError, ENVELOPE_SCHEMA_ID, TransportInvocation, TransportKey, TransportResult,
     canonical_invocation_bytes, require_id, wire_decode, wire_encode,
 };
+use crate::readout::SpendReadout;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 pub enum EnvelopeKind {
     Invocation,
     Result,
+    SpendReadoutRequest,
+    SpendReadoutResult,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -49,8 +52,10 @@ pub(crate) fn binary_schema(_: &mut schemars::SchemaGenerator) -> schemars::Sche
 
 /// The CultNet service every frame of this connector addresses.
 pub const CONNECTOR_SERVICE_ID: &str = "gamecult.model.connector";
-/// The one operation of that service: run one sealed invocation.
+/// The operation that runs one sealed invocation.
 pub const INVOKE_OPERATION: &str = "invoke";
+/// The operation that reads the spend ledger and the plan's quota.
+pub const SPEND_READOUT_OPERATION: &str = "spend_readout";
 
 const PAYLOAD_ENCODING: &str = "messagepack-base64";
 const OK_STATUS: &str = "ok";
@@ -69,16 +74,39 @@ fn seal_payload(envelope: &TransportEnvelope) -> Result<String, ServiceError> {
     Ok(STANDARD.encode(wire_encode(envelope)?))
 }
 
-/// The CultNet frame an invocation travels in: a `cultnet.operation_request.v0`
-/// for [`CONNECTOR_SERVICE_ID`] and [`INVOKE_OPERATION`], its `message_id` the
+/// The two operations of the connector service.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Operation {
+    Invoke,
+    SpendReadout,
+}
+
+impl Operation {
+    fn name(self) -> &'static str {
+        match self {
+            Operation::Invoke => INVOKE_OPERATION,
+            Operation::SpendReadout => SPEND_READOUT_OPERATION,
+        }
+    }
+
+    fn from_name(name: &str) -> Option<Self> {
+        [Operation::Invoke, Operation::SpendReadout]
+            .into_iter()
+            .find(|operation| operation.name() == name)
+    }
+}
+
+/// The CultNet frame a request travels in: a `cultnet.operation_request.v0`
+/// for [`CONNECTOR_SERVICE_ID`] and the named operation, its `message_id` the
 /// request id and its payload the base64 of the named sealed envelope.
-pub(crate) fn encode_invocation_frame(
+fn request_frame(
+    operation: Operation,
     envelope: &TransportEnvelope,
 ) -> Result<Vec<u8>, ServiceError> {
     carriage_bytes(&CultNetMessage::OperationRequest {
         message_id: envelope.request_id.clone(),
         service_id: CONNECTOR_SERVICE_ID.to_string(),
-        operation: INVOKE_OPERATION.to_string(),
+        operation: operation.name().to_string(),
         payload_schema: ENVELOPE_SCHEMA_ID.to_string(),
         payload_encoding: PAYLOAD_ENCODING.to_string(),
         payload: seal_payload(envelope)?,
@@ -87,14 +115,17 @@ pub(crate) fn encode_invocation_frame(
     })
 }
 
-/// The CultNet frame a result travels in: a `cultnet.operation_response.v0`
-/// with status `ok`, otherwise shaped like the invocation's.
+/// The CultNet frame a response travels in: a `cultnet.operation_response.v0`
+/// with status `ok`, otherwise shaped like the request's.
 #[cfg(any(feature = "daemon", test))]
-pub(crate) fn encode_result_frame(envelope: &TransportEnvelope) -> Result<Vec<u8>, ServiceError> {
+fn response_frame(
+    operation: Operation,
+    envelope: &TransportEnvelope,
+) -> Result<Vec<u8>, ServiceError> {
     carriage_bytes(&CultNetMessage::OperationResponse {
         message_id: envelope.request_id.clone(),
         service_id: CONNECTOR_SERVICE_ID.to_string(),
-        operation: INVOKE_OPERATION.to_string(),
+        operation: operation.name().to_string(),
         status: OK_STATUS.to_string(),
         payload_schema: ENVELOPE_SCHEMA_ID.to_string(),
         payload_encoding: PAYLOAD_ENCODING.to_string(),
@@ -104,20 +135,43 @@ pub(crate) fn encode_result_frame(envelope: &TransportEnvelope) -> Result<Vec<u8
     })
 }
 
+pub(crate) fn encode_invocation_frame(
+    envelope: &TransportEnvelope,
+) -> Result<Vec<u8>, ServiceError> {
+    request_frame(Operation::Invoke, envelope)
+}
+
+pub(crate) fn encode_spend_readout_request_frame(
+    envelope: &TransportEnvelope,
+) -> Result<Vec<u8>, ServiceError> {
+    request_frame(Operation::SpendReadout, envelope)
+}
+
+#[cfg(any(feature = "daemon", test))]
+pub(crate) fn encode_result_frame(envelope: &TransportEnvelope) -> Result<Vec<u8>, ServiceError> {
+    response_frame(Operation::Invoke, envelope)
+}
+
+#[cfg(feature = "daemon")]
+pub(crate) fn encode_spend_readout_response_frame(
+    envelope: &TransportEnvelope,
+) -> Result<Vec<u8>, ServiceError> {
+    response_frame(Operation::SpendReadout, envelope)
+}
+
 /// Opens the carriage of one frame. Everything the carriage says is checked
-/// here, before any decryption: the service, the operation, the payload schema,
-/// and that the message id is the sealed envelope's request id.
+/// here, before any decryption: the service, that the operation is one this
+/// service has, the payload schema, and that the message id is the sealed
+/// envelope's request id.
 fn open_carriage(
     message_id: &str,
     service_id: &str,
     operation: &str,
     payload_schema: &str,
     payload: &str,
-) -> Result<TransportEnvelope, ServiceError> {
-    if service_id != CONNECTOR_SERVICE_ID
-        || operation != INVOKE_OPERATION
-        || payload_schema != ENVELOPE_SCHEMA_ID
-    {
+) -> Result<(Operation, TransportEnvelope), ServiceError> {
+    let operation = Operation::from_name(operation).ok_or(ServiceError::Carriage)?;
+    if service_id != CONNECTOR_SERVICE_ID || payload_schema != ENVELOPE_SCHEMA_ID {
         return Err(ServiceError::Carriage);
     }
     let bytes = STANDARD
@@ -127,7 +181,7 @@ fn open_carriage(
     if envelope.request_id != message_id {
         return Err(ServiceError::OuterIdentity);
     }
-    Ok(envelope)
+    Ok((operation, envelope))
 }
 
 fn read_carriage(bytes: &[u8]) -> Result<CultNetMessage, ServiceError> {
@@ -135,8 +189,15 @@ fn read_carriage(bytes: &[u8]) -> Result<CultNetMessage, ServiceError> {
         .map_err(|_| ServiceError::Carriage)
 }
 
+/// A request frame, by the operation it names.
 #[cfg(any(feature = "daemon", test))]
-pub(crate) fn decode_invocation_frame(bytes: &[u8]) -> Result<TransportEnvelope, ServiceError> {
+pub(crate) enum RequestFrame {
+    Invoke(TransportEnvelope),
+    SpendReadout(TransportEnvelope),
+}
+
+#[cfg(any(feature = "daemon", test))]
+pub(crate) fn decode_request_frame(bytes: &[u8]) -> Result<RequestFrame, ServiceError> {
     match read_carriage(bytes)? {
         CultNetMessage::OperationRequest {
             message_id,
@@ -145,18 +206,34 @@ pub(crate) fn decode_invocation_frame(bytes: &[u8]) -> Result<TransportEnvelope,
             payload_schema,
             payload,
             ..
-        } => open_carriage(
-            &message_id,
-            &service_id,
-            &operation,
-            &payload_schema,
-            &payload,
-        ),
+        } => {
+            match open_carriage(
+                &message_id,
+                &service_id,
+                &operation,
+                &payload_schema,
+                &payload,
+            )? {
+                (Operation::Invoke, envelope) => Ok(RequestFrame::Invoke(envelope)),
+                (Operation::SpendReadout, envelope) => Ok(RequestFrame::SpendReadout(envelope)),
+            }
+        }
         _ => Err(ServiceError::Carriage),
     }
 }
 
-pub(crate) fn decode_result_frame(bytes: &[u8]) -> Result<TransportEnvelope, ServiceError> {
+#[cfg(test)]
+pub(crate) fn decode_invocation_frame(bytes: &[u8]) -> Result<TransportEnvelope, ServiceError> {
+    match decode_request_frame(bytes)? {
+        RequestFrame::Invoke(envelope) => Ok(envelope),
+        RequestFrame::SpendReadout(_) => Err(ServiceError::Carriage),
+    }
+}
+
+fn decode_response_frame(
+    bytes: &[u8],
+    expected: Operation,
+) -> Result<TransportEnvelope, ServiceError> {
     match read_carriage(bytes)? {
         CultNetMessage::OperationResponse {
             message_id,
@@ -166,17 +243,32 @@ pub(crate) fn decode_result_frame(bytes: &[u8]) -> Result<TransportEnvelope, Ser
             payload_schema,
             payload,
             ..
-        } if status == OK_STATUS => open_carriage(
-            &message_id,
-            &service_id,
-            &operation,
-            &payload_schema,
-            &payload,
-        ),
+        } if status == OK_STATUS => {
+            match open_carriage(
+                &message_id,
+                &service_id,
+                &operation,
+                &payload_schema,
+                &payload,
+            )? {
+                (found, envelope) if found == expected => Ok(envelope),
+                _ => Err(ServiceError::Carriage),
+            }
+        }
         _ => Err(ServiceError::Carriage),
     }
 }
 
+pub(crate) fn decode_result_frame(bytes: &[u8]) -> Result<TransportEnvelope, ServiceError> {
+    decode_response_frame(bytes, Operation::Invoke)
+}
+
+pub(crate) fn decode_spend_readout_response_frame(
+    bytes: &[u8],
+) -> Result<TransportEnvelope, ServiceError> {
+    decode_response_frame(bytes, Operation::SpendReadout)
+}
+
 /// The most bytes one frame holding a sealed envelope of `ciphertext_len`
 /// ciphertext bytes can occupy, with ids at their longest: the frame a caller
 /// payload bound (`CallerAdmission`'s `max_payload_bytes`, a bound on
@@ -324,6 +416,59 @@ pub fn decrypt_result(
     Ok(result)
 }
 
+/// A spend readout request carries no content: the sealed envelope's
+/// authenticated identity and kind are the whole request.
+pub(crate) fn encrypt_spend_readout_request(
+    caller_runtime_id: &str,
+    request_id: &str,
+    security: &TransportKey,
+) -> Result<TransportEnvelope, ServiceError> {
+    encrypt_message(
+        caller_runtime_id,
+        request_id,
+        EnvelopeKind::SpendReadoutRequest,
+        &[],
+        security,
+    )
+}
+
+#[cfg(any(feature = "daemon", test))]
+pub(crate) fn decrypt_spend_readout_request(
+    envelope: &TransportEnvelope,
+    security: &TransportKey,
+) -> Result<(), ServiceError> {
+    validate_envelope(envelope, EnvelopeKind::SpendReadoutRequest)?;
+    decrypt_message(envelope, security).map(drop)
+}
+
+#[cfg(feature = "daemon")]
+pub(crate) fn encrypt_spend_readout(
+    caller_runtime_id: &str,
+    request_id: &str,
+    readout: &SpendReadout,
+    security: &TransportKey,
+) -> Result<TransportEnvelope, ServiceError> {
+    let plaintext = wire_encode(readout).map_err(|_| ServiceError::Encoding)?;
+    encrypt_message(
+        caller_runtime_id,
+        request_id,
+        EnvelopeKind::SpendReadoutResult,
+        &plaintext,
+        security,
+    )
+}
+
+pub(crate) fn decrypt_spend_readout(
+    envelope: &TransportEnvelope,
+    security: &TransportKey,
+) -> Result<SpendReadout, ServiceError> {
+    validate_envelope(envelope, EnvelopeKind::SpendReadoutResult)?;
+    let plaintext = decrypt_message(envelope, security)?;
+    let readout: SpendReadout = wire_decode(&plaintext).map_err(|_| ServiceError::Encoding)?;
+    readout.validate()?;
+    Ok(readout)
+}
+
 #[derive(Debug)]
 pub(crate) enum TransportFrameError {
     Connection(std::io::Error),
@@ -1138,4 +1283,53 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn a_readout_request_is_not_an_invocation_and_names_its_own_operation() {
+        let key = TransportKey::from_connection_secret("readout-test-key").unwrap();
+        let sealed = encrypt_spend_readout_request("caller-1", "readout-1", &key).unwrap();
+        let frame = encode_spend_readout_request_frame(&sealed).unwrap();
+        assert!(matches!(
+            decode_request_frame(&frame),
+            Ok(RequestFrame::SpendReadout(found)) if found == sealed
+        ));
+        assert_eq!(decode_invocation_frame(&frame), Err(ServiceError::Carriage));
+        // Sealed as one kind, the authenticated data refuses it as another.
+        assert!(decrypt_spend_readout_request(&sealed, &key).is_ok());
+        assert_eq!(
+            decrypt_spend_readout(&sealed, &key).unwrap_err(),
+            ServiceError::Envelope
+        );
+        let mut relabelled = sealed.clone();
+        relabelled.message_kind = EnvelopeKind::SpendReadoutResult;
+        assert_eq!(
+            decrypt_spend_readout(&relabelled, &key).unwrap_err(),
+            ServiceError::Encryption
+        );
+    }
+
+    #[cfg(feature = "daemon")]
+    #[test]
+    fn a_response_is_read_as_its_own_operation_only() {
+        use crate::readout::PlanQuotaSnapshot;
+        let key = TransportKey::from_connection_secret("readout-test-key").unwrap();
+        let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
+        let sealed = encrypt_spend_readout("caller-1", "readout-1", &readout, &key).unwrap();
+        let readout_frame = encode_spend_readout_response_frame(&sealed).unwrap();
+        let invoke_frame = encode_result_frame(&sealed).unwrap();
+        assert_eq!(
+            decode_spend_readout_response_frame(&readout_frame).unwrap(),
+            sealed
+        );
+        assert_eq!(decode_result_frame(&invoke_frame).unwrap(), sealed);
+        assert_eq!(
+            decode_result_frame(&readout_frame),
+            Err(ServiceError::Carriage)
+        );
+        assert_eq!(
+            decode_spend_readout_response_frame(&invoke_frame),
+            Err(ServiceError::Carriage)
+        );
+        assert_eq!(decrypt_spend_readout(&sealed, &key).unwrap(), readout);
+    }
 }
diff --git a/crates/model-connector/src/lib.rs b/crates/model-connector/src/lib.rs
index ba1642b..c55202a 100644
--- a/crates/model-connector/src/lib.rs
+++ b/crates/model-connector/src/lib.rs
@@ -1,6 +1,7 @@
 mod client;
 mod contract;
 mod envelope;
+mod readout;
 
 #[cfg(test)]
 mod fixtures;
@@ -13,6 +14,7 @@ mod service;
 pub use client::*;
 pub use contract::*;
 pub use envelope::*;
+pub use readout::*;
 
 #[cfg(feature = "daemon")]
 pub use serve::*;
diff --git a/crates/model-connector/src/readout.rs b/crates/model-connector/src/readout.rs
new file mode 100644
index 0000000..36d4cb9
--- /dev/null
+++ b/crates/model-connector/src/readout.rs
@@ -0,0 +1,128 @@
+//! The spend readout: what each caller has spent and holds in its current
+//! window, and the plan's own usage as the backend last saw it. The ledger is
+//! the replay store's; a readout only reads it.
+
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use crate::contract::ContractError;
+
+pub const SPEND_READOUT_SCHEMA_ID: &str = "gamecult.model.spend_readout.v1";
+
+/// One window of the subscription plan, as the provider reported it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct PlanQuota {
+    pub window: String,
+    /// How much of the window was used when it was observed, in thousandths;
+    /// `None` once the window has reset (`status` is then `expired`), because
+    /// the old reading says nothing about the new window.
+    pub utilization_permille: Option<u32>,
+    pub resets_at_unix_ms: u64,
+    pub status: String,
+    /// When this window was last reported. Its age in a readout is the
+    /// readout's `at_unix_ms` minus this.
+    pub observed_at_unix_ms: u64,
+}
+
+/// What a backend last saw of the plan's windows, each stamped with its own
+/// observation time. A backend with no plan to report returns the default.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct PlanQuotaSnapshot {
+    pub windows: Vec<PlanQuota>,
+}
+
+/// One caller's current spend window in micro-USD. `spent` is settled charges
+/// plus what a crash left counted at its full reservation; `reserved` is what
+/// calls in flight hold, and both count against the ceiling.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct CallerSpend {
+    pub caller_id: String,
+    pub window_ms: u64,
+    pub ceiling_micro_usd: u64,
+    pub spent_micro_usd: u64,
+    pub reserved_micro_usd: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct SpendReadout {
+    pub schema_id: String,
+    pub at_unix_ms: u64,
+    pub callers: Vec<CallerSpend>,
+    pub plan_quota: Vec<PlanQuota>,
+}
+
+impl SpendReadout {
+    pub fn new(at_unix_ms: u64, callers: Vec<CallerSpend>, plan: PlanQuotaSnapshot) -> Self {
+        Self {
+            schema_id: SPEND_READOUT_SCHEMA_ID.to_string(),
+            at_unix_ms,
+            callers,
+            plan_quota: plan.windows,
+        }
+    }
+
+    pub(crate) fn validate(&self) -> Result<(), ContractError> {
+        if self.schema_id != SPEND_READOUT_SCHEMA_ID {
+            return Err(ContractError::Schema);
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::contract::{wire_decode, wire_encode};
+
+    fn readout() -> SpendReadout {
+        SpendReadout::new(
+            1_000,
+            vec![CallerSpend {
+                caller_id: "eureka".into(),
+                window_ms: 3_600_000,
+                ceiling_micro_usd: 50_000_000,
+                spent_micro_usd: 7,
+                reserved_micro_usd: 3,
+            }],
+            PlanQuotaSnapshot {
+                windows: vec![PlanQuota {
+                    window: "five_hour".into(),
+                    utilization_permille: Some(80),
+                    resets_at_unix_ms: 1_793_307_000_000,
+                    status: "allowed".into(),
+                    observed_at_unix_ms: 999,
+                }],
+            },
+        )
+    }
+
+    #[test]
+    fn a_readout_is_a_named_map_that_decodes_to_itself() {
+        let bytes = wire_encode(&readout()).unwrap();
+        let value: rmpv::Value = rmp_serde::from_slice(&bytes).unwrap();
+        let rmpv::Value::Map(fields) = value else {
+            panic!("a readout is a map, not a positional array");
+        };
+        let names: Vec<&str> = fields.iter().filter_map(|(k, _)| k.as_str()).collect();
+        assert_eq!(names, ["schema_id", "at_unix_ms", "callers", "plan_quota"]);
+        assert_eq!(wire_decode::<SpendReadout>(&bytes).unwrap(), readout());
+    }
+
+    #[test]
+    fn an_unobserved_plan_is_none_not_zero() {
+        let bare = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
+        let decoded: SpendReadout = wire_decode(&wire_encode(&bare).unwrap()).unwrap();
+        assert!(decoded.plan_quota.is_empty());
+    }
+
+    #[test]
+    fn a_readout_of_another_schema_is_refused() {
+        let mut other = readout();
+        other.schema_id = "gamecult.model.spend_readout.v2".into();
+        assert!(other.validate().is_err());
+        assert!(readout().validate().is_ok());
+    }
+}
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index d6723a4..26f5e2d 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -12,9 +12,11 @@ use zeroize::Zeroizing;
 
 use crate::contract::TransportResult;
 use crate::envelope::{
-    ServiceError, TransportFrameError, decode_invocation_frame, encode_result_frame,
-    frame_bytes_for_payload, read_transport_frame, write_transport_frame,
+    RequestFrame, ServiceError, TransportFrameError, decode_request_frame, encode_result_frame,
+    encode_spend_readout_response_frame, frame_bytes_for_payload, read_transport_frame,
+    write_transport_frame,
 };
+use crate::readout::PlanQuotaSnapshot;
 use crate::service::{
     CallerAdmission, PriceTable, ProviderCall, SpendCeiling, SpendWindowMs, TransportAdmission,
     TransportService,
@@ -32,6 +34,11 @@ pub trait ProviderBackend: Send + Sync {
     /// `serve` on: it names the provider on every receipt and decides which
     /// reasoning state is foreign.
     fn provider(&self) -> &str;
+    /// What the provider's own plan allows and has used, for the spend
+    /// readout. A provider with no plan to report keeps the default.
+    fn plan_quota(&self) -> PlanQuotaSnapshot {
+        PlanQuotaSnapshot::default()
+    }
     /// Executes one admitted call. The service has already bound it to its
     /// caller and recorded its replay claim. The call cannot show a foreign
     /// reasoning item and builds the result's receipt itself.
@@ -232,17 +239,28 @@ fn serve_connection(
         .and_then(|()| stream.set_write_timeout(Some(timeout)))
         .map_err(ServeError::Connection)?;
     let request = read_transport_frame(&mut stream, limits.max_frame_bytes).map_err(frame_error)?;
-    let response = execute_inference_frame(&request, service, backend, limits)?;
+    let response = answer_frame(&request, service, backend, limits)?;
     write_transport_frame(&mut stream, &response, limits.max_frame_bytes).map_err(frame_error)
 }
 
-fn execute_inference_frame(
+fn answer_frame(
     request: &[u8],
     service: &Mutex<TransportService>,
     backend: &dyn ProviderBackend,
     limits: &ServeLimits,
 ) -> Result<Vec<u8>, ServeError> {
-    let envelope = decode_invocation_frame(request).map_err(|_| ServeError::FrameEncoding)?;
+    let envelope = match decode_request_frame(request).map_err(|_| ServeError::FrameEncoding)? {
+        RequestFrame::Invoke(envelope) => envelope,
+        RequestFrame::SpendReadout(envelope) => {
+            let plan = backend.plan_quota();
+            let response = service
+                .lock()
+                .map_err(|_| ServeError::ServicePoisoned)?
+                .spend_readout(&envelope, unix_ms()?, plan, limits.max_frame_bytes)?;
+            return encode_spend_readout_response_frame(&response)
+                .map_err(|_| ServeError::FrameEncoding);
+        }
+    };
     let admission = service
         .lock()
         .map_err(|_| ServeError::ServicePoisoned)?
@@ -495,6 +513,87 @@ mod tests {
             .collect()
     }
 
+    /// A counting backend that reports a plan, as a provider with one would.
+    struct PlanBackend {
+        inner: Arc<CountingBackend>,
+        plan: PlanQuotaSnapshot,
+    }
+
+    impl ProviderBackend for PlanBackend {
+        fn ready(&self) -> Result<(), &'static str> {
+            self.inner.ready()
+        }
+
+        fn provider(&self) -> &str {
+            self.inner.provider()
+        }
+
+        fn plan_quota(&self) -> PlanQuotaSnapshot {
+            self.plan.clone()
+        }
+
+        fn execute(&self, call: &ProviderCall) -> TransportResult {
+            self.inner.execute(call)
+        }
+    }
+
+    #[test]
+    fn serve_reads_out_spend_and_plan_quota_without_executing_anything() {
+        let store = TestStore::new();
+        let inner = CountingBackend::new(true);
+        let plan = PlanQuotaSnapshot {
+            windows: vec![crate::readout::PlanQuota {
+                window: "five_hour".into(),
+                utilization_permille: Some(80),
+                resets_at_unix_ms: 1_793_307_000_000,
+                status: "allowed".into(),
+                observed_at_unix_ms: 1_793_300_000_000,
+            }],
+        };
+        let backend = Arc::new(PlanBackend {
+            inner: inner.clone(),
+            plan: plan.clone(),
+        });
+        let (client, endpoint) = start_with(backend, &store, vec![caller(CALLER, KEY, 4)]);
+        client.execute(&fresh("request-1")).unwrap();
+        assert_eq!(inner.executions.load(Ordering::SeqCst), 1);
+
+        let before = now_ms();
+        let readout = client.spend_readout(CALLER).unwrap();
+        assert!(readout.at_unix_ms >= before && readout.at_unix_ms <= now_ms());
+        assert_eq!(readout.plan_quota, plan.windows);
+        let [row] = readout.callers.as_slice() else {
+            panic!("one admitted caller");
+        };
+        assert_eq!(row.caller_id, CALLER);
+        assert_eq!((row.ceiling_micro_usd, row.window_ms), (CEILING, WINDOW_MS));
+        assert!(row.spent_micro_usd > 0, "the settled call was charged");
+        assert_eq!(row.reserved_micro_usd, 0);
+        assert_eq!(
+            inner.executions.load(Ordering::SeqCst),
+            1,
+            "a readout runs nothing"
+        );
+
+        // A client without the caller's key is dropped, not answered.
+        let stranger = ConnectorClient::new(
+            endpoint,
+            "some-other-key",
+            FRAME,
+            Some(Duration::from_secs(5)),
+        )
+        .unwrap();
+        assert!(stranger.spend_readout(CALLER).is_err());
+    }
+
+    #[test]
+    fn a_backend_with_no_plan_reads_out_none() {
+        let store = TestStore::new();
+        let (client, _) = start(CountingBackend::new(true), &store);
+        let readout = client.spend_readout(CALLER).unwrap();
+        assert!(readout.plan_quota.is_empty());
+    }
+
     #[test]
     fn serve_refuses_a_request_over_its_max_cost_without_executing_it() {
         let store = TestStore::new();
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 6d10cb9..c269916 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -14,8 +14,10 @@ use crate::contract::{
 };
 use crate::envelope::{
     EnvelopeKind, MAX_IDENTITY_BYTES, ServiceError, TransportEnvelope, decrypt_invocation,
-    encode_result_frame, encrypt_result, validate_envelope,
+    decrypt_spend_readout_request, encode_result_frame, encode_spend_readout_response_frame,
+    encrypt_result, encrypt_spend_readout, validate_envelope,
 };
+use crate::readout::{CallerSpend, PlanQuotaSnapshot, SpendReadout};
 
 /// What a caller may spend in one window, in micro-USD. A distinct type from
 /// [`SpendWindowMs`] so the pair cannot be passed swapped:
@@ -280,15 +282,15 @@ fn admission_clock(
 /// it was admitted in, so nothing older is kept.
 fn prune_windows(
     window_spend: &mut HashMap<String, BTreeMap<u64, u64>>,
-    live: &HashMap<RequestIdentity, u64>,
+    live: &HashMap<RequestIdentity, LiveRequest>,
     caller_runtime_id: &str,
     floor: u64,
 ) {
     if let Some(windows) = window_spend.get_mut(caller_runtime_id) {
         windows.retain(|window, _| {
             *window >= floor
-                || live.iter().any(|(identity, live_window)| {
-                    live_window == window && identity.caller_runtime_id == caller_runtime_id
+                || live.iter().any(|(identity, request)| {
+                    request.window == *window && identity.caller_runtime_id == caller_runtime_id
                 })
         });
     }
@@ -298,7 +300,7 @@ fn prune_windows(
 /// places that do not know the clock (open, settle).
 fn prune_to_latest(
     window_spend: &mut HashMap<String, BTreeMap<u64, u64>>,
-    live: &HashMap<RequestIdentity, u64>,
+    live: &HashMap<RequestIdentity, LiveRequest>,
     caller_runtime_id: &str,
 ) {
     let latest = window_spend
@@ -309,6 +311,14 @@ fn prune_to_latest(
     }
 }
 
+/// A request between claim and settlement: the window it was admitted in and
+/// the reservation it holds there.
+#[derive(Debug, Clone, Copy)]
+struct LiveRequest {
+    window: u64,
+    reserved_micro_usd: u64,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 struct RequestIdentity {
     caller_runtime_id: String,
@@ -464,7 +474,7 @@ pub struct TransportService {
     callers: HashMap<String, CallerAdmission>,
     /// The requests between claim and settlement, each with the window it was
     /// admitted in.
-    live: HashMap<RequestIdentity, u64>,
+    live: HashMap<RequestIdentity, LiveRequest>,
     replay_store: CultCache,
     max_expiry_skew_ms: u64,
     provider: String,
@@ -611,6 +621,70 @@ impl TransportService {
             .unwrap_or(0)
     }
 
+    /// Answers one sealed spend readout request: for each admitted caller, what
+    /// its current window holds against its ceiling, with the backend's plan
+    /// quota beside it. Read-only: nothing is reserved, recorded or pruned.
+    /// Any admitted caller reads every caller's row; the spend is the
+    /// operator's and the callers are all hers. `max_frame_bytes` bounds the
+    /// reply like it bounds `complete`'s.
+    pub fn spend_readout(
+        &self,
+        envelope: &TransportEnvelope,
+        now_unix_ms: u64,
+        plan: PlanQuotaSnapshot,
+        max_frame_bytes: usize,
+    ) -> Result<TransportEnvelope, ServiceError> {
+        validate_envelope(envelope, EnvelopeKind::SpendReadoutRequest)?;
+        let asker = self
+            .callers
+            .get(&envelope.caller_runtime_id)
+            .ok_or(ServiceError::CallerNotAdmitted)?;
+        decrypt_spend_readout_request(envelope, &asker.security)?;
+        let mut callers: Vec<CallerSpend> = self
+            .callers
+            .values()
+            .map(|caller| {
+                // The window admission would use right now.
+                let window = admission_clock(
+                    &self.window_spend,
+                    &caller.caller_runtime_id,
+                    now_unix_ms,
+                    caller.spend_window_ms,
+                ) / caller.spend_window_ms;
+                let held = self.window_spend(&caller.caller_runtime_id, window);
+                let reserved: u64 = self
+                    .live
+                    .iter()
+                    .filter(|(identity, request)| {
+                        request.window == window
+                            && identity.caller_runtime_id == caller.caller_runtime_id
+                    })
+                    .fold(0, |sum, (_, request)| {
+                        sum.saturating_add(request.reserved_micro_usd)
+                    });
+                CallerSpend {
+                    caller_id: caller.caller_runtime_id.clone(),
+                    window_ms: caller.spend_window_ms,
+                    ceiling_micro_usd: caller.spend_ceiling_micro_usd,
+                    spent_micro_usd: held.saturating_sub(reserved),
+                    reserved_micro_usd: reserved,
+                }
+            })
+            .collect();
+        callers.sort_by(|a, b| a.caller_id.cmp(&b.caller_id));
+        let readout = SpendReadout::new(now_unix_ms, callers, plan);
+        let sealed = encrypt_spend_readout(
+            &envelope.caller_runtime_id,
+            &envelope.request_id,
+            &readout,
+            &asker.security,
+        )?;
+        if !readout_fits_frame(&sealed, max_frame_bytes)? {
+            return Err(ServiceError::FrameBound);
+        }
+        Ok(sealed)
+    }
+
     /// Admits one request. `max_frame_bytes` is the frame every reply must
     /// fit, the same bound `complete` is given: a recorded result that no
     /// longer fits it (the service reopened at a smaller frame) is answered
@@ -794,7 +868,13 @@ impl TransportService {
             0,
             reserved_micro_usd,
         );
-        self.live.insert(identity, window);
+        self.live.insert(
+            identity,
+            LiveRequest {
+                window,
+                reserved_micro_usd,
+            },
+        );
         Ok(TransportAdmission::Execute(Box::new(ExecutionClaim {
             call: ProviderCall {
                 receipt: TransportReceipt {
@@ -1005,6 +1085,14 @@ fn fits_frame(envelope: &TransportEnvelope, max_frame_bytes: usize) -> Result<bo
     encode_result_frame(envelope).map(|bytes| bytes.len() <= max_frame_bytes)
 }
 
+/// `fits_frame` for the frame a spend readout answer travels in.
+fn readout_fits_frame(
+    envelope: &TransportEnvelope,
+    max_frame_bytes: usize,
+) -> Result<bool, ServiceError> {
+    encode_spend_readout_response_frame(envelope).map(|bytes| bytes.len() <= max_frame_bytes)
+}
+
 /// The provider named on the stand-in failure, fixed so its size is bounded.
 const STAND_IN_PROVIDER: &str = "model-connector";
 
@@ -1758,6 +1846,17 @@ mod tests {
         assert_eq!(fits_frame(&envelope, size - 1), Ok(false));
     }
 
+    #[test]
+    fn a_readout_frame_check_is_inclusive_of_the_serialized_envelope() {
+        let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
+        let envelope = encrypt_spend_readout(CALLER, "sized", &readout, &security(KEY)).unwrap();
+        let size = encode_spend_readout_response_frame(&envelope)
+            .unwrap()
+            .len();
+        assert_eq!(readout_fits_frame(&envelope, size), Ok(true));
+        assert_eq!(readout_fits_frame(&envelope, size - 1), Ok(false));
+    }
+
     fn claim_for(
         service: &mut TransportService,
         request_id: &str,
@@ -3616,4 +3715,151 @@ mod tests {
                 <= sized(Refusal::ProviderDigestSubstitution)
         );
     }
+
+    // ---- spend readout ----
+
+    fn readout_as(
+        service: &TransportService,
+        caller: &str,
+        key: &str,
+        now: u64,
+        frame: usize,
+    ) -> Result<SpendReadout, ServiceError> {
+        let sealed = encrypt_spend_readout_request(caller, "readout-1", &security(key)).unwrap();
+        let answer = service.spend_readout(&sealed, now, PlanQuotaSnapshot::default(), frame)?;
+        assert_eq!(answer.request_id, "readout-1");
+        Ok(decrypt_spend_readout(&answer, &security(key)).unwrap())
+    }
+
+    fn row<'a>(readout: &'a SpendReadout, caller: &str) -> &'a CallerSpend {
+        readout
+            .callers
+            .iter()
+            .find(|row| row.caller_id == caller)
+            .expect("the caller has a row")
+    }
+
+    #[test]
+    fn spend_readout_reports_window() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let claim = claim_at(&mut service, "request-1", 1_000);
+
+        // In flight: the reservation is held, nothing is spent.
+        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
+        assert_eq!(readout.at_unix_ms, 1_500);
+        let mine = row(&readout, CALLER);
+        assert_eq!(mine.window_ms, WINDOW_MS);
+        assert_eq!(mine.ceiling_micro_usd, CEILING);
+        assert_eq!(
+            (mine.spent_micro_usd, mine.reserved_micro_usd),
+            (0, reservation())
+        );
+
+        // Settled: the charge replaces the reservation.
+        let result = text_result(claim.call(), "done");
+        service.complete(*claim, result, FRAME).unwrap();
+        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
+        let mine = row(&readout, CALLER);
+        assert_eq!(
+            (mine.spent_micro_usd, mine.reserved_micro_usd),
+            (FIXTURE_USAGE_COST, 0)
+        );
+
+        // Every admitted caller has a row, in id order; the idle one is empty.
+        let ids: Vec<&str> = readout
+            .callers
+            .iter()
+            .map(|r| r.caller_id.as_str())
+            .collect();
+        assert_eq!(ids, ["epiphany-yggdrasil", "ghostlight-yggdrasil"]);
+        let idle = row(&readout, "ghostlight-yggdrasil");
+        assert_eq!((idle.spent_micro_usd, idle.reserved_micro_usd), (0, 0));
+    }
+
+    #[test]
+    fn a_claim_a_crash_left_reads_as_spent_not_reserved() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let _claim = claim_at(&mut service, "request-1", 1_000);
+        drop(service);
+        let service = open_service(&store, 4);
+        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
+        let mine = row(&readout, CALLER);
+        assert_eq!(
+            (mine.spent_micro_usd, mine.reserved_micro_usd),
+            (reservation(), 0)
+        );
+    }
+
+    #[test]
+    fn a_readout_reads_the_ledger_and_changes_nothing_in_it() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let claim = claim_at(&mut service, "request-1", 1_000);
+        // Two windows later: the caller's current window is empty, and
+        // looking must not prune the window the live claim settles into.
+        let later = 2 * WINDOW_MS + 5;
+        let readout = readout_as(&service, CALLER, KEY, later, FRAME).unwrap();
+        let mine = row(&readout, CALLER);
+        assert_eq!((mine.spent_micro_usd, mine.reserved_micro_usd), (0, 0));
+        assert_eq!(service.window_spend(CALLER, 0), reservation());
+        let result = text_result(claim.call(), "done");
+        service.complete(*claim, result, FRAME).unwrap();
+        assert_eq!(service.window_spend(CALLER, 0), FIXTURE_USAGE_COST);
+    }
+
+    #[test]
+    fn a_readout_is_refused_to_a_stranger_a_wrong_key_and_an_invocation() {
+        let store = TestStore::new();
+        let service = open_service(&store, 4);
+        let sealed = |caller: &str, key: &str| {
+            encrypt_spend_readout_request(caller, "readout-1", &security(key)).unwrap()
+        };
+        assert_eq!(
+            service
+                .spend_readout(
+                    &sealed("nobody", KEY),
+                    1,
+                    PlanQuotaSnapshot::default(),
+                    FRAME
+                )
+                .unwrap_err(),
+            ServiceError::CallerNotAdmitted
+        );
+        assert_eq!(
+            service
+                .spend_readout(
+                    &sealed(CALLER, "another-key"),
+                    1,
+                    PlanQuotaSnapshot::default(),
+                    FRAME
+                )
+                .unwrap_err(),
+            ServiceError::Encryption
+        );
+        let invocation = invocation_at("request-1", 1_000, MAX_COST);
+        assert_eq!(
+            service
+                .spend_readout(
+                    &raw_envelope(&invocation),
+                    1,
+                    PlanQuotaSnapshot::default(),
+                    FRAME
+                )
+                .unwrap_err(),
+            ServiceError::Envelope
+        );
+    }
+
+    #[test]
+    fn a_readout_that_cannot_fit_the_frame_is_a_frame_bound_failure() {
+        let store = TestStore::new();
+        let service = open_service(&store, 4);
+        assert_eq!(
+            readout_as(&service, CALLER, KEY, 1_000, 64).unwrap_err(),
+            ServiceError::FrameBound
+        );
+        assert!(readout_as(&service, CALLER, KEY, 1_000, FRAME).is_ok());
+    }
 }
diff --git a/crates/model-connector/tests/published_schemas.rs b/crates/model-connector/tests/published_schemas.rs
index 15ce197..cb21b01 100644
--- a/crates/model-connector/tests/published_schemas.rs
+++ b/crates/model-connector/tests/published_schemas.rs
@@ -28,6 +28,7 @@ fn published_schemas_are_the_types() {
         ("transport_result", render::<TransportResult>()),
         ("transport_receipt", render::<TransportReceipt>()),
         ("transport_envelope", render::<TransportEnvelope>()),
+        ("spend_readout", render::<SpendReadout>()),
     ];
     let dir = schemas_dir();
     if std::env::var_os(REGENERATE).is_some() {
@@ -53,7 +54,7 @@ fn published_schemas_are_the_types() {
     expected.sort();
     assert_eq!(
         on_disk, expected,
-        "schemas/ holds exactly the five documents"
+        "schemas/ holds exactly the six documents"
     );
 }
 
diff --git a/schemas/spend_readout.json b/schemas/spend_readout.json
new file mode 100644
index 0000000..5a5d23d
--- /dev/null
+++ b/schemas/spend_readout.json
@@ -0,0 +1,112 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "SpendReadout",
+  "type": "object",
+  "properties": {
+    "at_unix_ms": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0
+    },
+    "callers": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/CallerSpend"
+      }
+    },
+    "plan_quota": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/PlanQuota"
+      }
+    },
+    "schema_id": {
+      "type": "string"
+    }
+  },
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "at_unix_ms",
+    "callers",
+    "plan_quota"
+  ],
+  "$defs": {
+    "CallerSpend": {
+      "description": "One caller's current spend window in micro-USD. `spent` is settled charges\nplus what a crash left counted at its full reservation; `reserved` is what\ncalls in flight hold, and both count against the ceiling.",
+      "type": "object",
+      "properties": {
+        "caller_id": {
+          "type": "string"
+        },
+        "ceiling_micro_usd": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "reserved_micro_usd": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "spent_micro_usd": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "window_ms": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "caller_id",
+        "window_ms",
+        "ceiling_micro_usd",
+        "spent_micro_usd",
+        "reserved_micro_usd"
+      ]
+    },
+    "PlanQuota": {
+      "description": "One window of the subscription plan, as the provider reported it.",
+      "type": "object",
+      "properties": {
+        "observed_at_unix_ms": {
+          "description": "When this window was last reported. Its age in a readout is the\nreadout's `at_unix_ms` minus this.",
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "resets_at_unix_ms": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "status": {
+          "type": "string"
+        },
+        "utilization_permille": {
+          "description": "How much of the window was used when it was observed, in thousandths;\n`None` once the window has reset (`status` is then `expired`), because\nthe old reading says nothing about the new window.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0
+        },
+        "window": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "window",
+        "resets_at_unix_ms",
+        "status",
+        "observed_at_unix_ms"
+      ]
+    }
+  }
+}
diff --git a/schemas/transport_envelope.json b/schemas/transport_envelope.json
index 69a97d3..8b062e3 100644
--- a/schemas/transport_envelope.json
+++ b/schemas/transport_envelope.json
@@ -46,7 +46,9 @@
       "type": "string",
       "enum": [
         "Invocation",
-        "Result"
+        "Result",
+        "SpendReadoutRequest",
+        "SpendReadoutResult"
       ]
     }
   }

From d1f25b5ae6d1c22c652aff3401e55f1a78773d5f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 29 Oct 2026 21:54:03 +0100
Subject: [PATCH 09/37] claude-self-run-lease: Self runs borrow the one Claude
 token over a unix socket bound to the peer's uid, its pidfd and its unit's
 InvocationID; the connector sets the reservation, settle bills reported
 per-model usage uncapped, no report bills the reservation (squash of
 eureka-body/claude-self-run-lease 480cf94..b5f26ef; Soul s1-s3)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs         |  171 ++-
 crates/claude-connector/src/lease.rs          |  729 +++++++++++
 crates/claude-connector/src/lib.rs            |   16 +-
 crates/claude-connector/src/main.rs           |   29 +-
 crates/claude-connector/src/unit.rs           |  361 +++++
 .../claude-connector/tests/config_document.rs |  219 +++-
 .../tests/fixtures/lease_v1/grant.bin         |  Bin 0 -> 109 bytes
 .../tests/fixtures/lease_v1/refusal.bin       |  Bin 0 -> 104 bytes
 .../tests/fixtures/lease_v1/request.bin       |  Bin 0 -> 66 bytes
 .../tests/fixtures/lease_v1/settle.bin        |  Bin 0 -> 336 bytes
 .../tests/fixtures/lease_v1/settled.bin       |  Bin 0 -> 81 bytes
 crates/claude-connector/tests/lease.rs        | 1166 +++++++++++++++++
 crates/model-connector/src/serve.rs           |   38 +-
 crates/model-connector/src/service.rs         |   29 +-
 crates/model-connector/src/service/lease.rs   |  691 ++++++++++
 15 files changed, 3421 insertions(+), 28 deletions(-)
 create mode 100644 crates/claude-connector/src/lease.rs
 create mode 100644 crates/claude-connector/src/unit.rs
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v1/grant.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v1/refusal.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v1/request.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v1/settle.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v1/settled.bin
 create mode 100644 crates/claude-connector/tests/lease.rs
 create mode 100644 crates/model-connector/src/service/lease.rs

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 674975d..9f549fc 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -6,17 +6,22 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::net::{SocketAddr, TcpListener};
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
-    CallerAdmission, CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ServeError, ServeLimits,
-    ServiceError, load_admissions, serve,
+    CallerAdmission, CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ProviderBackend, ServeError,
+    ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
 };
+use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
 use crate::backend::readiness;
+#[cfg(target_os = "linux")]
+use crate::lease::{LeaseCaller, LeaseLimits, serve_leases, user_uid};
+#[cfg(target_os = "linux")]
+use crate::unit::SystemdUnits;
 use crate::{
     ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink,
 };
@@ -24,6 +29,18 @@ use crate::{
 const CONFIG_KEY: &str = "runtime";
 const MODEL_PREFIX: &str = "claude-";
 
+/// A unix account that may lease the subscription token for a Self run, the
+/// Self unit (`mind-self@<unit_instance>.service`) its process must run in,
+/// the caller whose spend window its leases reserve in, and what each lease
+/// reserves there.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseCallerConfig {
+    pub unix_user: String,
+    pub caller_id: String,
+    pub unit_instance: String,
+    pub reservation_micro_usd: u64,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
 #[cultcache(type = "gamecult.model_connector.claude_connector_config.v1")]
 pub struct ClaudeConnectorConfig {
@@ -72,6 +89,17 @@ pub struct ClaudeConnectorConfig {
     /// ids exactly as the CLI reports them in its init event.
     #[cultcache(key = 18)]
     pub prices: BTreeMap<String, ModelPrice>,
+    /// Where the Self-run lease socket is bound (a systemd RuntimeDirectory),
+    /// or none when this connector lends no token.
+    #[cultcache(key = 19)]
+    pub lease_socket: Option<PathBuf>,
+    /// The accounts allowed to lease, each bound to a configured caller.
+    /// Empty exactly when `lease_socket` is none.
+    #[cultcache(key = 20)]
+    pub lease_callers: Vec<LeaseCallerConfig>,
+    /// The furthest a lease's expiry may lie from now.
+    #[cultcache(key = 21)]
+    pub lease_max_ms: u64,
 }
 
 /// A refusal. It names the field or stage that failed and nothing the
@@ -205,9 +233,39 @@ impl ClaudeConnectorConfig {
         {
             return Err(ConfigError::Invalid("prices"));
         }
+        self.validate_leases(&caller.caller_runtime_id, caller.spend_ceiling_micro_usd)?;
         Ok(listen)
     }
 
+    fn validate_leases(&self, caller_id: &str, spend_ceiling: u64) -> Result<(), ConfigError> {
+        let Some(socket) = &self.lease_socket else {
+            return if self.lease_callers.is_empty() {
+                Ok(())
+            } else {
+                Err(ConfigError::Invalid("lease_callers"))
+            };
+        };
+        if !socket.is_absolute() {
+            return Err(ConfigError::Invalid("lease_socket"));
+        }
+        if self.lease_max_ms == 0 {
+            return Err(ConfigError::Invalid("lease_max_ms"));
+        }
+        let mut users = BTreeSet::new();
+        if self.lease_callers.is_empty()
+            || !self.lease_callers.iter().all(|lease| {
+                is_trimmed_nonempty(&lease.unix_user)
+                    && lease.caller_id == caller_id
+                    && is_unit_instance(&lease.unit_instance)
+                    && (1..=spend_ceiling).contains(&lease.reservation_micro_usd)
+                    && users.insert(lease.unix_user.as_str())
+            })
+        {
+            return Err(ConfigError::Invalid("lease_callers"));
+        }
+        Ok(())
+    }
+
     fn backend_config(&self) -> ClaudeCodeConfig {
         ClaudeCodeConfig {
             claude_binary: self.claude_binary.clone(),
@@ -236,6 +294,14 @@ impl ClaudeConnectorConfig {
     }
 }
 
+/// The `<instance>` of a unit name, as plain as a systemd instance can be.
+fn is_unit_instance(text: &str) -> bool {
+    !text.is_empty()
+        && text
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_'))
+}
+
 fn is_trimmed_nonempty(text: &str) -> bool {
     !text.is_empty() && text.trim() == text
 }
@@ -394,9 +460,85 @@ fn readiness_of(config: &ClaudeConnectorConfig) -> Result<Vec<CallerAdmission>,
         &CredentialTokenSource::from_environment(backend.token_credential.clone()),
     )
     .map_err(ConfigError::Unusable)?;
+    if config.lease_socket.is_some() {
+        lease_callers_of(config)?;
+    }
     Ok(admissions)
 }
 
+/// The accounts allowed to lease, resolved to the uids the kernel will report
+/// for their connections. An account the system does not have is not ready.
+#[cfg(target_os = "linux")]
+fn lease_callers_of(config: &ClaudeConnectorConfig) -> Result<Vec<LeaseCaller>, ConfigError> {
+    config
+        .lease_callers
+        .iter()
+        .map(|lease| {
+            user_uid(&lease.unix_user)
+                .map(|uid| LeaseCaller {
+                    uid,
+                    caller_id: lease.caller_id.clone(),
+                    unit_instance: lease.unit_instance.clone(),
+                    reservation_micro_usd: lease.reservation_micro_usd,
+                })
+                .ok_or(ConfigError::Unusable("lease_callers"))
+        })
+        .collect()
+}
+
+/// Peer credentials identify a lease caller only on Linux.
+#[cfg(not(target_os = "linux"))]
+fn lease_callers_of(_: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
+    Err(ConfigError::Unusable("lease_socket"))
+}
+
+/// Binds the lease socket (mode 0660; the unit's RuntimeDirectory and group
+/// decide who can reach it, and the kernel's peer uid decides who may lease)
+/// and serves it beside the RUDP loop. The lease listener is half of the
+/// connector: if it stops, so does the process.
+#[cfg(target_os = "linux")]
+fn start_leases(
+    config: &ClaudeConnectorConfig,
+    socket: &Path,
+    service: Arc<Mutex<TransportService>>,
+) -> Result<(), ConfigError> {
+    use std::os::unix::fs::{FileTypeExt, PermissionsExt};
+    use std::os::unix::net::UnixListener;
+
+    let callers = lease_callers_of(config)?;
+    // A socket a previous run left is replaced; anything else at the path is not ours.
+    if std::fs::symlink_metadata(socket).is_ok_and(|found| found.file_type().is_socket()) {
+        let _ = std::fs::remove_file(socket);
+    }
+    let listener = UnixListener::bind(socket).map_err(|_| ConfigError::Listen)?;
+    std::fs::set_permissions(socket, std::fs::Permissions::from_mode(0o660))
+        .map_err(|_| ConfigError::Listen)?;
+    let limits = LeaseLimits {
+        socket_timeout: Duration::from_millis(config.socket_timeout_ms),
+        max_lease_ms: config.lease_max_ms,
+        max_connections: config.max_connections,
+    };
+    let tokens = Arc::new(CredentialTokenSource::from_environment(
+        config.token_credential.clone(),
+    ));
+    std::thread::Builder::new()
+        .name("claude-lease-listener".to_string())
+        .spawn(move || {
+            let _ = serve_leases(
+                &listener,
+                callers,
+                limits,
+                service,
+                tokens,
+                Arc::new(SystemdUnits::system()),
+            );
+            eprintln!("claude-connector: the lease listener stopped");
+            std::process::exit(1);
+        })
+        .map_err(|_| ConfigError::Serving("lease listener"))?;
+    Ok(())
+}
+
 /// Whether `serve` would start with this document and this environment.
 pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
     readiness_of(config).map(drop)
@@ -413,14 +555,21 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
         Box::new(LogSink(std::sync::Mutex::new(std::io::stderr()))),
     ));
     let listener = TcpListener::bind(listen).map_err(|_| ConfigError::Listen)?;
-    serve(
-        listener,
-        config.serve_limits(),
-        admissions,
-        config.prices.clone(),
-        &config.replay_store,
-        backend,
-    )?;
+    let service = Arc::new(Mutex::new(
+        TransportService::open(
+            &config.replay_store,
+            backend.provider(),
+            config.prices.clone(),
+            admissions,
+            config.max_expiry_skew_ms,
+        )
+        .map_err(|error| ConfigError::from(ServeError::Service(error)))?,
+    ));
+    #[cfg(target_os = "linux")]
+    if let Some(socket) = &config.lease_socket {
+        start_leases(&config, socket, service.clone())?;
+    }
+    serve_service(listener, config.serve_limits(), service, backend)?;
     Ok(())
 }
 
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
new file mode 100644
index 0000000..d8badf3
--- /dev/null
+++ b/crates/claude-connector/src/lease.rs
@@ -0,0 +1,729 @@
+//! The Self-run credential lease. The connector is the only holder of the
+//! subscription token and the one owner of Self-run admission, reservation and
+//! the spend ledger (rulings self-runs-through-connector,
+//! self-run-credential-lease and self-run-lease-billing-and-binding). A Self
+//! run asks over a unix socket for a lease. The connector decides who may ask
+//! (the peer's uid, and the systemd unit invocation its process runs in),
+//! reserves its own configured amount in the caller's spend window, and only
+//! then hands back one pipe fd that holds the token. The run settles with the
+//! per-model usage it reports, and the connector bills that at true cost,
+//! uncapped; a run that vanishes or lets its lease expire is billed the whole
+//! reservation. Nothing the run says about itself decides who it is, what it
+//! reserves, or what the plan allows.
+//!
+//! The token exists in this process only as the value the token source returns
+//! and in the pipe. It is not in an environment, an argument, a file, a log or
+//! a reply frame. The connector spawns nothing here: the Self run's `claude`
+//! stays in the Self run's own unit.
+
+use std::ffi::CString;
+use std::io::{self, Read, Write};
+use std::mem::{size_of, zeroed};
+use std::os::fd::{AsFd, AsRawFd, BorrowedFd, FromRawFd, OwnedFd, RawFd};
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::ptr;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::thread;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use model_connector::{
+    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseUse, ModelUsage,
+    TransportService,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::TokenSource;
+
+/// The largest frame either side sends or accepts, in bytes. It is wire
+/// contract: a Huginn client sizes against it, so it is pinned as a literal.
+pub const MAX_LEASE_FRAME_BYTES: usize = 65_536;
+const _: () = assert!(MAX_LEASE_FRAME_BYTES == 65_536);
+
+/// One message of the lease protocol: a u32 big-endian length, then this as a
+/// MessagePack named map `{kind, value}`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", content = "value", rename_all = "snake_case")]
+pub enum LeaseMessage {
+    ClaudeLeaseRequest(LeaseRequest),
+    /// Travels with exactly one SCM_RIGHTS fd: the read end of a pipe that
+    /// holds the token, its write end closed.
+    ClaudeLeaseGrant(LeaseGranted),
+    ClaudeLeaseRefusal(LeaseRefused),
+    ClaudeLeaseSettle(LeaseSettle),
+    ClaudeLeaseSettled(LeaseSettled),
+}
+
+/// A request names only when the lease ends. Who asks, and what is reserved,
+/// are the connector's to know.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseRequest {
+    pub expires_at_unix_ms: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseGranted {
+    pub lease_id: String,
+    pub reserved_micro_usd: u64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LeaseRefusalKind {
+    SpendCeiling,
+    CostBound,
+    UnknownCaller,
+    Expired,
+    Busy,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseRefused {
+    pub kind: LeaseRefusalKind,
+    pub detail: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseSettle {
+    pub lease_id: String,
+    /// What the run used of each model, as the run reports it.
+    pub usage: Vec<ModelUsage>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeaseSettled {
+    pub billed_micro_usd: u64,
+    /// How far the bill passed the reservation; zero when it did not.
+    pub overrun_micro_usd: u64,
+}
+
+/// A frame: the length, then the named-map MessagePack of `message`.
+pub fn encode_frame(message: &LeaseMessage) -> Vec<u8> {
+    // Every field of the message is plain data, so encoding cannot fail.
+    let body = rmp_serde::to_vec_named(message).unwrap_or_default();
+    let mut frame = Vec::with_capacity(4 + body.len());
+    frame.extend_from_slice(&(body.len() as u32).to_be_bytes());
+    frame.extend_from_slice(&body);
+    frame
+}
+
+/// The message in one whole frame, or `None` when the frame is not exactly one
+/// well-formed message within the bound.
+pub fn decode_frame(frame: &[u8]) -> Option<LeaseMessage> {
+    let (length, body) = frame.split_first_chunk::<4>()?;
+    let length = u32::from_be_bytes(*length) as usize;
+    if length == 0 || length > MAX_LEASE_FRAME_BYTES || body.len() != length {
+        return None;
+    }
+    rmp_serde::from_slice(body).ok()
+}
+
+/// A reader whose waiting can be bounded, so a frame has one deadline across
+/// all of its reads.
+trait Bounded: Read {
+    fn within(&mut self, left: Duration) -> io::Result<()>;
+}
+
+impl Bounded for UnixStream {
+    fn within(&mut self, left: Duration) -> io::Result<()> {
+        self.set_read_timeout(Some(left))
+    }
+}
+
+impl Bounded for &[u8] {
+    fn within(&mut self, _: Duration) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+/// Fills `buffer` or fails: when `deadline` passes, however the bytes trickle.
+fn read_exact_by(
+    stream: &mut impl Bounded,
+    buffer: &mut [u8],
+    deadline: Instant,
+) -> io::Result<()> {
+    let mut filled = 0;
+    while filled < buffer.len() {
+        let left = deadline
+            .checked_duration_since(Instant::now())
+            .filter(|left| !left.is_zero())
+            .ok_or_else(|| io::Error::from(io::ErrorKind::TimedOut))?;
+        stream.within(left)?;
+        match stream.read(&mut buffer[filled..]) {
+            Ok(0) => return Err(io::Error::from(io::ErrorKind::UnexpectedEof)),
+            Ok(read) => filled += read,
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    io::ErrorKind::Interrupted | io::ErrorKind::WouldBlock
+                ) => {}
+            Err(error) => return Err(error),
+        }
+    }
+    Ok(())
+}
+
+/// One whole frame, complete by `deadline`.
+fn read_message(stream: &mut impl Bounded, deadline: Instant) -> io::Result<LeaseMessage> {
+    let invalid = || io::Error::from(io::ErrorKind::InvalidData);
+    let mut length = [0_u8; 4];
+    read_exact_by(stream, &mut length, deadline)?;
+    let length = u32::from_be_bytes(length) as usize;
+    if length == 0 || length > MAX_LEASE_FRAME_BYTES {
+        return Err(invalid());
+    }
+    let mut body = vec![0_u8; length];
+    read_exact_by(stream, &mut body, deadline)?;
+    rmp_serde::from_slice(&body).map_err(|_| invalid())
+}
+
+/// The most a pipe takes in one atomic write.
+const PIPE_BUF: usize = 4096;
+
+/// A unix account allowed to lease, the Self unit its process must run in,
+/// and the caller whose spend window its leases reserve in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LeaseCaller {
+    pub uid: u32,
+    pub caller_id: String,
+    /// The `<instance>` of `mind-self@<instance>.service`.
+    pub unit_instance: String,
+    /// What each of this caller's leases reserves, whatever the run asks.
+    pub reservation_micro_usd: u64,
+}
+
+impl LeaseCaller {
+    /// The one unit a lease to this caller may be requested from.
+    pub fn unit(&self) -> String {
+        format!("mind-self@{}.service", self.unit_instance)
+    }
+}
+
+/// The systemd unit invocation a process runs in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeerUnit {
+    pub unit: String,
+    pub invocation_id: String,
+}
+
+/// Which invocation of `unit` a process is running, as the system records it.
+/// The lease listener asks this port; `SystemdUnits` answers it in production.
+/// `None` when the process is not in `unit` or the system cannot say. The
+/// process is named by the handle the kernel gave for the peer, never by a pid.
+pub trait PeerUnits: Send + Sync {
+    fn invocation_in(&self, process: BorrowedFd<'_>, unit: &str) -> Option<PeerUnit>;
+}
+
+/// The bounds of the lease listener.
+#[derive(Debug, Clone, Copy)]
+pub struct LeaseLimits {
+    /// How long a peer has to send its request frame, whole.
+    pub socket_timeout: Duration,
+    /// The furthest an expiry may lie from now.
+    pub max_lease_ms: u64,
+    pub max_connections: usize,
+}
+
+/// Who is on the other end of a unix stream, as the kernel recorded them at
+/// connect.
+#[derive(Debug)]
+pub struct PeerCredentials {
+    pub uid: u32,
+    /// A handle on the peer's process (SO_PEERPIDFD, Linux 6.5 and later). It
+    /// pins the process's identity: a recycled pid cannot be read through it.
+    /// `None` when the kernel cannot give one, and then no unit is vouched
+    /// for.
+    pub process: Option<OwnedFd>,
+}
+
+/// The uid and process handle of the process on the other end of `stream`.
+pub fn peer_credentials(stream: &UnixStream) -> io::Result<PeerCredentials> {
+    // SAFETY: `credentials` and `length` are valid for the call, and `length`
+    // is the size of the buffer getsockopt writes into.
+    let (result, credentials) = unsafe {
+        let mut credentials: libc::ucred = zeroed();
+        let mut length = size_of::<libc::ucred>() as libc::socklen_t;
+        let result = libc::getsockopt(
+            stream.as_raw_fd(),
+            libc::SOL_SOCKET,
+            libc::SO_PEERCRED,
+            ptr::from_mut(&mut credentials).cast(),
+            &mut length,
+        );
+        (result, credentials)
+    };
+    if result != 0 {
+        return Err(io::Error::last_os_error());
+    }
+    // SAFETY: as above, with a `c_int` the kernel fills with a new descriptor
+    // that this function then owns.
+    let (result, pidfd) = unsafe {
+        let mut pidfd: libc::c_int = -1;
+        let mut length = size_of::<libc::c_int>() as libc::socklen_t;
+        let result = libc::getsockopt(
+            stream.as_raw_fd(),
+            libc::SOL_SOCKET,
+            libc::SO_PEERPIDFD,
+            ptr::from_mut(&mut pidfd).cast(),
+            &mut length,
+        );
+        (result, pidfd)
+    };
+    Ok(PeerCredentials {
+        uid: credentials.uid,
+        // SAFETY: on success `pidfd` is a descriptor nothing else owns.
+        process: (result == 0 && pidfd >= 0).then(|| unsafe { OwnedFd::from_raw_fd(pidfd) }),
+    })
+}
+
+/// The uid of the account `name`, if the system has one.
+pub fn user_uid(name: &str) -> Option<u32> {
+    let name = CString::new(name).ok()?;
+    let mut buffer = vec![0 as libc::c_char; 16 * 1024];
+    // SAFETY: every pointer is valid for the call and `buffer` is as long as
+    // the length passed; `found` is read only when the call reports success.
+    unsafe {
+        let mut entry: libc::passwd = zeroed();
+        let mut found: *mut libc::passwd = ptr::null_mut();
+        let result = libc::getpwnam_r(
+            name.as_ptr(),
+            &mut entry,
+            buffer.as_mut_ptr(),
+            buffer.len(),
+            &mut found,
+        );
+        (result == 0 && !found.is_null()).then_some(entry.pw_uid)
+    }
+}
+
+/// A pipe whose read end holds `token` and whose write end is closed, so a
+/// reader gets the token and then end of file. The token is smaller than
+/// PIPE_BUF, so the write is whole and cannot block.
+fn token_pipe(token: &[u8]) -> io::Result<OwnedFd> {
+    if token.len() > PIPE_BUF {
+        return Err(io::Error::from(io::ErrorKind::InvalidInput));
+    }
+    let mut ends = [0 as RawFd; 2];
+    // SAFETY: `ends` has room for the two descriptors pipe2 writes.
+    if unsafe { libc::pipe2(ends.as_mut_ptr(), libc::O_CLOEXEC) } != 0 {
+        return Err(io::Error::last_os_error());
+    }
+    // SAFETY: pipe2 just returned these two descriptors and nothing else owns them.
+    let (read, write) = unsafe { (OwnedFd::from_raw_fd(ends[0]), OwnedFd::from_raw_fd(ends[1])) };
+    // SAFETY: the pointer and length describe `token`.
+    let written = unsafe { libc::write(write.as_raw_fd(), token.as_ptr().cast(), token.len()) };
+    if usize::try_from(written).ok() != Some(token.len()) {
+        return Err(io::Error::last_os_error());
+    }
+    drop(write);
+    Ok(read)
+}
+
+/// Writes `frame` to `stream` with `fd` attached as SCM_RIGHTS.
+fn send_with_fd(stream: &UnixStream, frame: &[u8], fd: RawFd) -> io::Result<()> {
+    let fd_size = size_of::<RawFd>() as u32;
+    // SAFETY: CMSG_SPACE is a pure size computation.
+    let space = unsafe { libc::CMSG_SPACE(fd_size) } as usize;
+    // u64 elements align the control buffer for a cmsghdr.
+    let mut control = vec![0_u64; space.div_ceil(size_of::<u64>())];
+    let mut vector = libc::iovec {
+        iov_base: frame.as_ptr().cast_mut().cast(),
+        iov_len: frame.len(),
+    };
+    // SAFETY: msghdr is plain data for which all-zero is valid; the pointers
+    // set below outlive the sendmsg call, and the cmsg header written lies
+    // inside `control`, which CMSG_SPACE sized for one descriptor.
+    let sent = unsafe {
+        let mut message: libc::msghdr = zeroed();
+        message.msg_iov = &mut vector;
+        message.msg_iovlen = 1;
+        message.msg_control = control.as_mut_ptr().cast();
+        message.msg_controllen = space as _;
+        let header = libc::CMSG_FIRSTHDR(&message);
+        (*header).cmsg_level = libc::SOL_SOCKET;
+        (*header).cmsg_type = libc::SCM_RIGHTS;
+        (*header).cmsg_len = libc::CMSG_LEN(fd_size) as _;
+        ptr::copy_nonoverlapping(
+            ptr::from_ref(&fd).cast::<u8>(),
+            libc::CMSG_DATA(header),
+            size_of::<RawFd>(),
+        );
+        loop {
+            let sent = libc::sendmsg(stream.as_raw_fd(), &message, libc::MSG_NOSIGNAL);
+            if sent >= 0 || io::Error::last_os_error().kind() != io::ErrorKind::Interrupted {
+                break sent;
+            }
+        }
+    };
+    let Ok(sent) = usize::try_from(sent) else {
+        return Err(io::Error::last_os_error());
+    };
+    // The descriptor travels with the first byte; any rest is plain data.
+    let mut stream = stream;
+    stream.write_all(&frame[sent..])
+}
+
+fn unix_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |elapsed| {
+            u64::try_from(elapsed.as_millis()).unwrap_or(u64::MAX)
+        })
+}
+
+struct Permit(Arc<AtomicUsize>);
+
+impl Permit {
+    fn acquire(active: &Arc<AtomicUsize>, limit: usize) -> Option<Self> {
+        active
+            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |held| {
+                (held < limit).then_some(held + 1)
+            })
+            .ok()
+            .map(|_| Self(active.clone()))
+    }
+}
+
+impl Drop for Permit {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+struct Lender {
+    callers: Vec<LeaseCaller>,
+    limits: LeaseLimits,
+    service: Arc<Mutex<TransportService>>,
+    tokens: Arc<dyn TokenSource>,
+    units: Arc<dyn PeerUnits>,
+}
+
+/// Serves leases on `listener` until it fails. Each connection is one lease:
+/// request, then grant or refusal, then (after a grant) settle. A caller is
+/// the account whose uid the kernel reports for the connection, and only a
+/// process in that caller's Self unit may lease, once per unit invocation; no
+/// field of any message names either.
+pub fn serve_leases(
+    listener: &UnixListener,
+    callers: Vec<LeaseCaller>,
+    limits: LeaseLimits,
+    service: Arc<Mutex<TransportService>>,
+    tokens: Arc<dyn TokenSource>,
+    units: Arc<dyn PeerUnits>,
+) -> io::Result<()> {
+    let lender = Arc::new(Lender {
+        callers,
+        limits,
+        service,
+        tokens,
+        units,
+    });
+    let active = Arc::new(AtomicUsize::new(0));
+    loop {
+        let (stream, _) = listener.accept()?;
+        let Some(permit) = Permit::acquire(&active, limits.max_connections) else {
+            continue;
+        };
+        let lender = lender.clone();
+        thread::Builder::new()
+            .name("claude-lease".to_string())
+            .spawn(move || {
+                let _permit = permit;
+                // A connection that fails is dropped; the lease it may have
+                // held is settled inside `lend`.
+                let _ = lender.lend(stream);
+            })?;
+    }
+}
+
+impl Lender {
+    fn lend(&self, mut stream: UnixStream) -> io::Result<()> {
+        stream.set_write_timeout(Some(self.limits.socket_timeout))?;
+        let peer = peer_credentials(&stream)?;
+        let request_deadline = Instant::now() + self.limits.socket_timeout;
+        let LeaseMessage::ClaudeLeaseRequest(request) =
+            read_message(&mut stream, request_deadline)?
+        else {
+            return Err(io::Error::from(io::ErrorKind::InvalidData));
+        };
+        let Some(caller) = self.callers.iter().find(|caller| caller.uid == peer.uid) else {
+            return refuse(
+                &mut stream,
+                LeaseRefusalKind::UnknownCaller,
+                "this account may not lease",
+            );
+        };
+        // The unit and its invocation come from the system's record of the
+        // peer's process, never from the peer.
+        let Some(invocation) = peer
+            .process
+            .as_ref()
+            .and_then(|process| self.units.invocation_in(process.as_fd(), &caller.unit()))
+            .filter(|found| found.unit == caller.unit())
+        else {
+            return refuse(
+                &mut stream,
+                LeaseRefusalKind::UnknownCaller,
+                "this process is not in the Self unit",
+            );
+        };
+        let now = unix_ms();
+        if request.expires_at_unix_ms <= now
+            || request.expires_at_unix_ms > now.saturating_add(self.limits.max_lease_ms)
+        {
+            return refuse(
+                &mut stream,
+                LeaseRefusalKind::Expired,
+                "the expiry is not in the future or is past the lease bound",
+            );
+        }
+        // The reservation is claimed in the ledger before the token is read,
+        // let alone lent. A ledger that fails closes the connection with no
+        // answer and no lease.
+        let admission = self
+            .service
+            .lock()
+            .map_err(|_| io::Error::other("service lock"))?
+            .begin_lease(
+                &caller.caller_id,
+                &invocation.invocation_id,
+                caller.reservation_micro_usd,
+                request.expires_at_unix_ms,
+                now,
+            )
+            .map_err(|_| io::Error::other("ledger"))?;
+        let grant = match admission {
+            LeaseAdmission::Granted(grant) => grant,
+            LeaseAdmission::Refused(why) => {
+                let (kind, detail) = match why {
+                    LeaseRefusal::SpendCeiling => (
+                        LeaseRefusalKind::SpendCeiling,
+                        "the window cannot hold this reservation",
+                    ),
+                    LeaseRefusal::CostBound => (
+                        LeaseRefusalKind::CostBound,
+                        "the reservation must be above zero",
+                    ),
+                    LeaseRefusal::UnknownCaller => (
+                        LeaseRefusalKind::UnknownCaller,
+                        "this account is bound to no admitted caller",
+                    ),
+                    LeaseRefusal::Busy => (
+                        LeaseRefusalKind::Busy,
+                        "a lease is open for this caller or this unit invocation leased",
+                    ),
+                };
+                return refuse(&mut stream, kind, detail);
+            }
+        };
+        self.hold(stream, caller, &grant, request.expires_at_unix_ms)
+    }
+
+    /// Everything after a reservation exists: lend the token, then settle the
+    /// lease exactly once whatever happens.
+    fn hold(
+        &self,
+        mut stream: UnixStream,
+        caller: &LeaseCaller,
+        grant: &LeaseGrant,
+        expires_at_unix_ms: u64,
+    ) -> io::Result<()> {
+        // A token that cannot be read or piped was never lent: nothing was
+        // used, so nothing is billed.
+        let Some(read_end) = self
+            .tokens
+            .read()
+            .and_then(|token| token_pipe(token.as_bytes()).ok())
+        else {
+            self.settle(caller, grant, LeaseUse::NeverLent)?;
+            return Ok(());
+        };
+        let frame = encode_frame(&LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
+            lease_id: grant.lease_id.clone(),
+            reserved_micro_usd: grant.reserved_micro_usd,
+        }));
+        let sent = send_with_fd(&stream, &frame, read_end.as_raw_fd());
+        drop(read_end);
+        if sent.is_err() {
+            // The descriptor may have been delivered: the reservation is billed.
+            self.settle(caller, grant, LeaseUse::Reservation)?;
+            return Ok(());
+        }
+        let outcome = self.await_settle(&mut stream, grant, expires_at_unix_ms);
+        match outcome {
+            Some(settle) => {
+                let settlement = self.settle(caller, grant, LeaseUse::Reported(&settle.usage))?;
+                let _ = stream.write_all(&encode_frame(&LeaseMessage::ClaudeLeaseSettled(
+                    LeaseSettled {
+                        billed_micro_usd: settlement.billed_micro_usd,
+                        overrun_micro_usd: settlement.overrun_micro_usd,
+                    },
+                )));
+            }
+            None => {
+                self.settle(caller, grant, LeaseUse::Reservation)?;
+            }
+        }
+        Ok(())
+    }
+
+    /// The run's settle, if its whole frame arrives for this lease before the
+    /// lease expires. Anything else (end of file, silence, a frame still
+    /// trickling at the expiry, a malformed frame, the wrong lease) is no
+    /// report.
+    fn await_settle(
+        &self,
+        stream: &mut UnixStream,
+        grant: &LeaseGrant,
+        expires_at_unix_ms: u64,
+    ) -> Option<LeaseSettle> {
+        let remaining = expires_at_unix_ms.saturating_sub(unix_ms());
+        let deadline = Instant::now() + Duration::from_millis(remaining);
+        match read_message(stream, deadline).ok()? {
+            LeaseMessage::ClaudeLeaseSettle(settle) if settle.lease_id == grant.lease_id => {
+                Some(settle)
+            }
+            _ => None,
+        }
+    }
+
+    fn settle(
+        &self,
+        caller: &LeaseCaller,
+        grant: &LeaseGrant,
+        usage: LeaseUse<'_>,
+    ) -> io::Result<LeaseSettlement> {
+        self.service
+            .lock()
+            .map_err(|_| io::Error::other("service lock"))?
+            .settle_lease(&caller.caller_id, &grant.lease_id, usage)
+            .map_err(|_| io::Error::other("ledger"))
+    }
+}
+
+fn refuse(stream: &mut UnixStream, kind: LeaseRefusalKind, detail: &str) -> io::Result<()> {
+    stream.write_all(&encode_frame(&LeaseMessage::ClaudeLeaseRefusal(
+        LeaseRefused {
+            kind,
+            detail: detail.to_string(),
+        },
+    )))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A settle frame whose body is exactly `body_bytes` long.
+    fn settle_frame_of(body_bytes: usize) -> Vec<u8> {
+        let frame_with = |pad: usize| {
+            encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
+                lease_id: "x".repeat(pad),
+                usage: Vec::new(),
+            }))
+        };
+        // The string header is the same width between 256 and 65535 bytes.
+        let base = frame_with(300).len() - 4 - 300;
+        frame_with(body_bytes - base)
+    }
+
+    fn within(frame: &[u8]) -> io::Result<LeaseMessage> {
+        read_message(&mut &frame[..], Instant::now() + Duration::from_secs(5))
+    }
+
+    #[test]
+    fn the_frame_bound_is_sixty_five_thousand_five_hundred_thirty_six() {
+        assert_eq!(MAX_LEASE_FRAME_BYTES, 65_536);
+    }
+
+    #[test]
+    fn a_frame_is_one_whole_message_within_the_bound() {
+        let at_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES);
+        assert_eq!(at_bound.len(), 4 + MAX_LEASE_FRAME_BYTES);
+        assert!(decode_frame(&at_bound).is_some());
+        let past_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES + 1);
+        assert!(decode_frame(&past_bound).is_none());
+        let mut trailing = at_bound.clone();
+        trailing.push(0);
+        assert!(decode_frame(&trailing).is_none());
+        assert!(decode_frame(&at_bound[..at_bound.len() - 1]).is_none());
+        assert!(decode_frame(&[0, 0, 0, 0]).is_none());
+        assert!(decode_frame(&[0, 0]).is_none());
+    }
+
+    #[test]
+    fn a_stream_frame_over_the_bound_is_refused_before_it_is_read() {
+        let past_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES + 1);
+        assert!(within(&past_bound).is_err());
+        let at_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES);
+        assert!(within(&at_bound).is_ok());
+        assert!(within(&[0_u8, 0, 0, 0]).is_err());
+        // Short of the length it announced is end of file, not a message.
+        assert!(within(&at_bound[..at_bound.len() - 1]).is_err());
+    }
+
+    #[test]
+    fn a_frame_that_trickles_past_its_deadline_is_refused_however_small_each_read() {
+        let (mut reader, mut writer) = UnixStream::pair().unwrap();
+        let frame = encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
+            lease_id: "lease:x".to_string(),
+            usage: Vec::new(),
+        }));
+        let trickle = thread::spawn(move || {
+            for byte in frame {
+                if writer.write_all(&[byte]).is_err() {
+                    return;
+                }
+                thread::sleep(Duration::from_millis(60));
+            }
+        });
+        // Every read lands well inside any per-read timeout; the frame as a
+        // whole does not.
+        let started = Instant::now();
+        let outcome = read_message(&mut reader, started + Duration::from_millis(400));
+        assert_eq!(outcome.unwrap_err().kind(), io::ErrorKind::TimedOut);
+        assert!(started.elapsed() < Duration::from_millis(1_000));
+        drop(reader);
+        trickle.join().unwrap();
+    }
+
+    /// A reader that fails the way a reset connection does.
+    struct Reset;
+
+    impl Read for Reset {
+        fn read(&mut self, _: &mut [u8]) -> io::Result<usize> {
+            Err(io::Error::from(io::ErrorKind::ConnectionReset))
+        }
+    }
+
+    impl Bounded for Reset {
+        fn within(&mut self, _: Duration) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn a_read_that_fails_ends_the_frame_at_once_not_at_the_deadline() {
+        let started = Instant::now();
+        let outcome = read_message(&mut Reset, started + Duration::from_secs(30));
+        assert_eq!(outcome.unwrap_err().kind(), io::ErrorKind::ConnectionReset);
+        assert!(started.elapsed() < Duration::from_secs(1));
+    }
+
+    #[test]
+    fn a_frame_that_arrives_in_pieces_within_its_deadline_is_read() {
+        let (mut reader, mut writer) = UnixStream::pair().unwrap();
+        let frame = encode_frame(&LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
+            expires_at_unix_ms: 7,
+        }));
+        let expected = decode_frame(&frame);
+        let pieces = thread::spawn(move || {
+            for part in frame.chunks(3) {
+                writer.write_all(part).unwrap();
+                thread::sleep(Duration::from_millis(10));
+            }
+        });
+        let read = read_message(&mut reader, Instant::now() + Duration::from_secs(5)).unwrap();
+        assert_eq!(Some(read), expected);
+        pieces.join().unwrap();
+    }
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 327a078..22ff46f 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -8,18 +8,32 @@ mod config;
 mod daemon;
 mod handle;
 mod launch;
+#[cfg(target_os = "linux")]
+mod lease;
 mod process;
 mod quota;
 mod stream;
+#[cfg(target_os = "linux")]
+mod unit;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
-pub use daemon::{ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config};
+pub use daemon::{
+    ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, check_ready, load_config, write_config,
+};
 #[cfg(unix)]
 pub use daemon::{check_prompt_dir, serve_config};
 pub use handle::{FsSessionStore, SessionStore};
 pub use launch::ChildEnv;
+#[cfg(target_os = "linux")]
+pub use lease::{
+    LeaseCaller, LeaseGranted, LeaseLimits, LeaseMessage, LeaseRefusalKind, LeaseRefused,
+    LeaseRequest, LeaseSettle, LeaseSettled, MAX_LEASE_FRAME_BYTES, PeerCredentials, PeerUnit,
+    PeerUnits, decode_frame, encode_frame, peer_credentials, serve_leases, user_uid,
+};
 #[cfg(unix)]
 pub use process::StdProcessPort;
 pub use process::{ProcessPort, RunningChild, StdoutRead};
 pub use quota::QuotaCell;
+#[cfg(target_os = "linux")]
+pub use unit::SystemdUnits;
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index c58e7f5..0ea296f 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -13,7 +13,7 @@ use std::path::PathBuf;
 use std::process::ExitCode;
 
 use claude_connector::{
-    ClaudeConnectorConfig, ConfigError, check_ready, load_config, write_config,
+    ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, check_ready, load_config, write_config,
 };
 use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
 
@@ -76,9 +76,10 @@ struct Flags {
     single: BTreeMap<&'static str, String>,
     models: Vec<String>,
     prices: Vec<String>,
+    lease_users: Vec<String>,
 }
 
-const SINGLE: [&str; 22] = [
+const SINGLE: [&str; 26] = [
     "--listen",
     "--replay-store",
     "--claude-binary",
@@ -101,6 +102,10 @@ const SINGLE: [&str; 22] = [
     "--max-payload-bytes",
     "--max-output-tokens",
     "--socket-timeout-ms",
+    "--lease-socket",
+    "--lease-max-ms",
+    "--lease-unit-instance",
+    "--lease-reservation-micro-usd",
 ];
 
 impl Flags {
@@ -109,6 +114,7 @@ impl Flags {
             single: BTreeMap::new(),
             models: Vec::new(),
             prices: Vec::new(),
+            lease_users: Vec::new(),
         };
         let mut args = args.iter();
         while let Some(&name) = args.next() {
@@ -118,6 +124,7 @@ impl Flags {
             match name {
                 "--allowed-model" => flags.models.push(value.to_string()),
                 "--price" => flags.prices.push(value.to_string()),
+                "--lease-user" => flags.lease_users.push(value.to_string()),
                 _ => {
                     let Some(known) = SINGLE.iter().find(|known| **known == name) else {
                         return Err(Failure::Flags);
@@ -206,6 +213,19 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
             return Err(Failure::Malformed("--price"));
         }
     }
+    let caller_id = flags.text("--caller-id")?;
+    let lease_callers = flags
+        .lease_users
+        .iter()
+        .map(|unix_user| {
+            Ok(LeaseCallerConfig {
+                unix_user: unix_user.clone(),
+                caller_id: caller_id.clone(),
+                unit_instance: flags.text("--lease-unit-instance")?,
+                reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
+            })
+        })
+        .collect::<Result<Vec<_>, Failure>>()?;
     let config = ClaudeConnectorConfig {
         listen: flags.text("--listen")?,
         replay_store: flags.path("--replay-store")?,
@@ -226,7 +246,7 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
         socket_timeout_ms: flags.number_or("--socket-timeout-ms", 10_000)?,
         max_expiry_skew_ms: 300_000,
         callers: vec![CallerConfig {
-            caller_runtime_id: flags.text("--caller-id")?,
+            caller_runtime_id: caller_id.clone(),
             connection_key_file: flags.path("--connection-key-file")?,
             connection_key_epoch: flags.number("--connection-key-epoch")?,
             allowed_models: flags.models.clone(),
@@ -237,6 +257,9 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
             spend_window_ms: flags.number("--spend-window-ms")?,
         }],
         prices,
+        lease_socket: flags.single.get("--lease-socket").map(PathBuf::from),
+        lease_callers,
+        lease_max_ms: flags.number_or("--lease-max-ms", 3_600_000)?,
     };
     write_config(path.as_ref(), &config)?;
     Ok(())
diff --git a/crates/claude-connector/src/unit.rs b/crates/claude-connector/src/unit.rs
new file mode 100644
index 0000000..1ab8dc9
--- /dev/null
+++ b/crates/claude-connector/src/unit.rs
@@ -0,0 +1,361 @@
+//! Which systemd unit invocation a process runs in, from the system's own
+//! record: the process's cgroup says the unit, and the service manager says
+//! that unit's current InvocationID. The lease listener asks this through the
+//! `PeerUnits` port; the answer never comes from the peer.
+//!
+//! This is the one place the connector asks systemd anything. It runs
+//! `systemctl show` for one read-only property of one unit and takes nothing
+//! from the output but a 32-digit hex id.
+
+use std::fs;
+use std::io::Read;
+use std::os::fd::{AsRawFd, BorrowedFd};
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+use crate::lease::{PeerUnit, PeerUnits};
+
+/// Answers `PeerUnits` from `<proc>/<pid>/cgroup` and `systemctl show`.
+pub struct SystemdUnits {
+    proc_root: PathBuf,
+    systemctl: PathBuf,
+    /// How long the manager has to answer before the lease is refused.
+    deadline: Duration,
+}
+
+impl SystemdUnits {
+    /// The running system's `/proc` and `systemctl`.
+    pub fn system() -> Self {
+        Self {
+            proc_root: PathBuf::from("/proc"),
+            systemctl: PathBuf::from("/usr/bin/systemctl"),
+            deadline: Duration::from_secs(5),
+        }
+    }
+
+    /// The pid a process handle names now, from the handle's own record. The
+    /// handle holds the process's identity, so the number cannot have been
+    /// recycled; a process that has exited reads as `-1`.
+    fn pid_of(&self, process: BorrowedFd<'_>) -> Option<u32> {
+        let info = fs::read_to_string(
+            self.proc_root
+                .join("self/fdinfo")
+                .join(process.as_raw_fd().to_string()),
+        )
+        .ok()?;
+        info.lines()
+            .find_map(|line| line.strip_prefix("Pid:"))?
+            .trim()
+            .parse()
+            .ok()
+    }
+
+    fn unit_in_cgroup(&self, pid: u32) -> Option<String> {
+        let cgroup = fs::read_to_string(self.proc_root.join(pid.to_string()).join("cgroup"));
+        unit_of_cgroup(&cgroup.ok()?)
+    }
+
+    /// `systemctl show` of `unit`'s InvocationID, killed and refused if it has
+    /// not exited by the deadline.
+    fn invocation_of(&self, unit: &str) -> Option<String> {
+        let mut child = Command::new(&self.systemctl)
+            .env_clear()
+            .args(["show", "--property=InvocationID", "--value", "--", unit])
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::null())
+            .spawn()
+            .ok()?;
+        let give_up = Instant::now() + self.deadline;
+        let status = loop {
+            match child.try_wait() {
+                Ok(Some(status)) => break status,
+                Ok(None) if Instant::now() < give_up => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                _ => {
+                    let _ = child.kill();
+                    let _ = child.wait();
+                    return None;
+                }
+            }
+        };
+        if !status.success() {
+            return None;
+        }
+        // The id is 33 bytes; anything past a small bound is not an answer.
+        let mut output = Vec::new();
+        child
+            .stdout
+            .take()?
+            .take(256)
+            .read_to_end(&mut output)
+            .ok()?;
+        invocation_id_of(std::str::from_utf8(&output).ok()?)
+    }
+}
+
+/// The service unit a cgroup file puts its process in: the last component of
+/// the unified-hierarchy path, if it names a `.service`. A process in a
+/// sub-cgroup, a scope, a slice or the root is in no service unit this
+/// recognises.
+pub fn unit_of_cgroup(cgroup: &str) -> Option<String> {
+    let path = cgroup.lines().find_map(|line| line.strip_prefix("0::"))?;
+    let unit = path.rsplit('/').next()?;
+    (unit.len() > ".service".len() && unit.ends_with(".service")).then(|| unit.to_string())
+}
+
+/// An InvocationID as `systemctl show --value` prints it: 32 lowercase hex
+/// digits and a newline. Anything else (including the empty answer of a unit
+/// that is not running) is not an invocation.
+pub fn invocation_id_of(output: &str) -> Option<String> {
+    let id = output.strip_suffix('\n').unwrap_or(output);
+    (id.len() == 32 && id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')))
+        .then(|| id.to_string())
+}
+
+impl PeerUnits for SystemdUnits {
+    fn invocation_in(&self, process: BorrowedFd<'_>, unit: &str) -> Option<PeerUnit> {
+        let pid = self.pid_of(process)?;
+        // A process in any other unit is not asked about.
+        if self.unit_in_cgroup(pid).as_deref() != Some(unit) {
+            return None;
+        }
+        let invocation_id = self.invocation_of(unit)?;
+        // The same process must still be in that unit now: one that left (or
+        // died) while the manager was asked is not vouched for.
+        (self.pid_of(process) == Some(pid) && self.unit_in_cgroup(pid).as_deref() == Some(unit))
+            .then(|| PeerUnit {
+                unit: unit.to_string(),
+                invocation_id,
+            })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::fd::{AsFd, AsRawFd, OwnedFd};
+
+    use super::*;
+
+    #[test]
+    fn a_service_unit_is_the_last_cgroup_component() {
+        let service = "0::/system.slice/system-mind\\x2dself.slice/mind-self@huginn.service\n";
+        assert_eq!(
+            unit_of_cgroup(service).as_deref(),
+            Some("mind-self@huginn.service")
+        );
+        // Several hierarchies listed: the unified one decides.
+        let hybrid = "12:cpu:/foo\n0::/system.slice/mind-self@a.service\n";
+        assert_eq!(
+            unit_of_cgroup(hybrid).as_deref(),
+            Some("mind-self@a.service")
+        );
+    }
+
+    #[test]
+    fn a_process_outside_a_service_unit_has_none() {
+        for cgroup in [
+            "0::/\n",
+            "0::/user.slice/user-1000.slice/session-3.scope\n",
+            "0::/user.slice/user-1000.slice/user@1000.service/app.slice/x.service/child\n",
+            "0::/system.slice/mind-self@huginn.service/sub\n",
+            "0::/system.slice/.service\n",
+            "1:name=systemd:/system.slice/a.service\n",
+            "",
+        ] {
+            assert_eq!(unit_of_cgroup(cgroup), None, "{cgroup:?}");
+        }
+    }
+
+    #[test]
+    fn an_invocation_id_is_exactly_32_lowercase_hex_digits() {
+        let id = "0123456789abcdef0123456789abcdef";
+        assert_eq!(invocation_id_of(&format!("{id}\n")).as_deref(), Some(id));
+        assert_eq!(invocation_id_of(id).as_deref(), Some(id));
+        for bad in [
+            "",
+            "\n",
+            "0123456789ABCDEF0123456789ABCDEF\n",
+            "0123456789abcdef0123456789abcde\n",
+            "0123456789abcdef0123456789abcdef0\n",
+            "0123456789abcdef0123456789abcdeg\n",
+            "0123456789abcdef0123456789abcdef\n\n",
+        ] {
+            assert_eq!(invocation_id_of(bad), None, "{bad:?}");
+        }
+    }
+
+    const ID: &str = "0123456789abcdef0123456789abcdef";
+    const UNIT: &str = "mind-self@eureka.service";
+
+    /// A fake `/proc` with one process in `cgroup`, and a fake `systemctl`
+    /// that records its arguments, runs `side_effect`, and exits `status`
+    /// after printing `output`.
+    struct Fake {
+        dir: PathBuf,
+        units: SystemdUnits,
+        // A script being written while another test forks is "text file
+        // busy" when it is run: fakes take turns.
+        _turn: std::sync::MutexGuard<'static, ()>,
+    }
+
+    static TURN: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+    impl Fake {
+        fn new(name: &str, cgroup: &str, output: &str, status: i32, side_effect: &str) -> Self {
+            use std::os::unix::fs::PermissionsExt;
+            let turn = TURN
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let dir = std::env::temp_dir().join(format!("unit-{}-{name}", std::process::id()));
+            let _ = fs::remove_dir_all(&dir);
+            let side_effect = side_effect.replace("{d}", &dir.display().to_string());
+            fs::create_dir_all(dir.join("proc/42")).unwrap();
+            fs::write(dir.join("proc/42/cgroup"), cgroup).unwrap();
+            let script = dir.join("systemctl");
+            fs::write(
+                &script,
+                format!(
+                    "#!/bin/sh\nprintf '%s' \"$*\" > {d}/args\n{side_effect}\nprintf '%s' '{output}'\nexit {status}\n",
+                    d = dir.display()
+                ),
+            )
+            .unwrap();
+            fs::set_permissions(&script, fs::Permissions::from_mode(0o755)).unwrap();
+            let units = SystemdUnits {
+                proc_root: dir.join("proc"),
+                systemctl: script,
+                deadline: Duration::from_secs(5),
+            };
+            Self {
+                dir,
+                units,
+                _turn: turn,
+            }
+        }
+
+        /// A process handle that names process `pid`, as the kernel's own
+        /// record of the handle says (`-1` once the process has exited).
+        fn process(&self, pid: i64) -> OwnedFd {
+            let handle: OwnedFd = fs::File::open("/dev/null").unwrap().into();
+            let info = self.dir.join("proc/self/fdinfo");
+            fs::create_dir_all(&info).unwrap();
+            fs::write(
+                info.join(handle.as_raw_fd().to_string()),
+                format!("pos:\t0\nflags:\t02000002\nPid:\t{pid}\nNSpid:\t{pid}\n"),
+            )
+            .unwrap();
+            handle
+        }
+
+        fn invocation_in(&self, pid: i64, unit: &str) -> Option<PeerUnit> {
+            self.units.invocation_in(self.process(pid).as_fd(), unit)
+        }
+
+        fn args(&self) -> String {
+            fs::read_to_string(self.dir.join("args")).unwrap()
+        }
+    }
+
+    impl Drop for Fake {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.dir);
+        }
+    }
+
+    fn eureka_cgroup() -> String {
+        format!("0::/system.slice/{UNIT}\n")
+    }
+
+    #[test]
+    fn a_process_in_the_unit_is_that_unit_at_the_invocation_the_manager_reports() {
+        let fake = Fake::new("ok", &eureka_cgroup(), &format!("{ID}\n"), 0, "");
+        assert_eq!(
+            fake.invocation_in(42, UNIT),
+            Some(PeerUnit {
+                unit: UNIT.to_string(),
+                invocation_id: ID.to_string()
+            })
+        );
+        // The manager is asked for exactly the invocation of that unit.
+        assert_eq!(
+            fake.args(),
+            format!("show --property=InvocationID --value -- {UNIT}")
+        );
+        // A handle on a process that has exited, or on one with no cgroup
+        // record, is in no unit.
+        assert_eq!(fake.invocation_in(-1, UNIT), None);
+        assert_eq!(fake.invocation_in(43, UNIT), None);
+    }
+
+    #[test]
+    fn a_process_outside_the_unit_is_not_asked_about() {
+        let scope = Fake::new("scope", "0::/user.slice/session-3.scope\n", ID, 0, "");
+        assert_eq!(scope.invocation_in(42, UNIT), None);
+        assert!(!scope.dir.join("args").exists());
+        drop(scope);
+        // Another service, even a real one, is not the caller's unit: the
+        // manager is never spawned for it.
+        let other = Fake::new("other", "0::/system.slice/ssh.service\n", ID, 0, "");
+        assert_eq!(other.invocation_in(42, UNIT), None);
+        assert!(!other.dir.join("args").exists());
+    }
+
+    #[test]
+    fn a_manager_that_fails_or_names_no_invocation_vouches_for_nothing() {
+        let failed = Fake::new("fail", &eureka_cgroup(), ID, 1, "");
+        assert_eq!(failed.invocation_in(42, UNIT), None);
+        drop(failed);
+        let not_running = Fake::new("idle", &eureka_cgroup(), "\n", 0, "");
+        assert_eq!(not_running.invocation_in(42, UNIT), None);
+        let missing = SystemdUnits {
+            proc_root: not_running.dir.join("proc"),
+            systemctl: not_running.dir.join("no-such-systemctl"),
+            deadline: Duration::from_secs(5),
+        };
+        assert_eq!(
+            missing.invocation_in(not_running.process(42).as_fd(), UNIT),
+            None
+        );
+    }
+
+    #[test]
+    fn a_manager_that_does_not_answer_in_time_is_killed_and_the_lease_refused() {
+        let mut fake = Fake::new("hung", &eureka_cgroup(), ID, 0, "exec sleep 30");
+        fake.units.deadline = Duration::from_millis(200);
+        let started = Instant::now();
+        assert_eq!(fake.invocation_in(42, UNIT), None);
+        assert!(started.elapsed() < Duration::from_secs(5));
+    }
+
+    #[test]
+    fn a_process_that_left_its_unit_while_the_manager_was_asked_is_not_vouched_for() {
+        let fake = Fake::new(
+            "moves",
+            &eureka_cgroup(),
+            ID,
+            0,
+            "printf '0::/system.slice/other.service\n' > {d}/proc/42/cgroup",
+        );
+        assert_eq!(fake.invocation_in(42, UNIT), None);
+    }
+
+    #[test]
+    fn a_process_that_exited_while_the_manager_was_asked_is_not_vouched_for() {
+        let fake = Fake::new("dies", &eureka_cgroup(), ID, 0, "");
+        let handle = fake.process(42);
+        let side = fake
+            .dir
+            .join("proc/self/fdinfo")
+            .join(handle.as_raw_fd().to_string());
+        let mut script = fs::read_to_string(fake.dir.join("systemctl")).unwrap();
+        script = script.replace(
+            "exit 0",
+            &format!("printf 'Pid:\t-1\n' > {}\nexit 0", side.display()),
+        );
+        fs::write(fake.dir.join("systemctl"), script).unwrap();
+        assert_eq!(fake.units.invocation_in(handle.as_fd(), UNIT), None);
+    }
+}
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 141f471..80285a2 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -8,7 +8,9 @@ use std::process::{Command, Output};
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::Duration;
 
-use claude_connector::{ClaudeConnectorConfig, ConfigError, load_config, write_config};
+use claude_connector::{
+    ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, load_config, write_config,
+};
 use cultcache_rs::{
     CacheBackingStore, CultCache, CultCacheEnvelope, DatabaseEntry,
     SingleFileMessagePackBackingStore,
@@ -92,6 +94,14 @@ fn valid() -> ClaudeConnectorConfig {
             spend_window_ms: 3_600_000,
         }],
         prices: BTreeMap::from([(HAIKU.to_string(), price()), (OPUS.to_string(), price())]),
+        lease_socket: Some("/run/claude-connector/lease.sock".into()),
+        lease_callers: vec![LeaseCallerConfig {
+            unix_user: "mind-eureka-self".to_string(),
+            caller_id: "persona-a-caller".to_string(),
+            unit_instance: "eureka".to_string(),
+            reservation_micro_usd: 5_000_000,
+        }],
+        lease_max_ms: 3_600_000,
     }
 }
 
@@ -989,3 +999,210 @@ fn a_private_regular_file_is_not_a_prompt_dir() {
     assert!(claude_connector::check_prompt_dir(&file).is_err());
     assert!(claude_connector::check_prompt_dir(&scratch.path("absent")).is_err());
 }
+
+#[test]
+fn leases_are_configured_together_or_not_at_all() {
+    let cases: Vec<(&str, Change)> = vec![
+        (
+            "lease_socket",
+            Box::new(|c| c.lease_socket = Some("lease.sock".into())),
+        ),
+        ("lease_callers", Box::new(|c| c.lease_callers.clear())),
+        ("lease_callers", Box::new(|c| c.lease_socket = None)),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].caller_id = "another-caller".to_string()),
+        ),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].unix_user = " ".to_string()),
+        ),
+        (
+            "lease_callers",
+            Box::new(|c| {
+                let again = c.lease_callers[0].clone();
+                c.lease_callers.push(again);
+            }),
+        ),
+        ("lease_max_ms", Box::new(|c| c.lease_max_ms = 0)),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].reservation_micro_usd = 0),
+        ),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].reservation_micro_usd = 50_000_001),
+        ),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].unit_instance = String::new()),
+        ),
+        (
+            "lease_callers",
+            Box::new(|c| c.lease_callers[0].unit_instance = "a/b".to_string()),
+        ),
+    ];
+    for (field, change) in cases {
+        let mut config = valid();
+        change(&mut config);
+        assert_eq!(refused(&config), field);
+    }
+    // The whole ceiling is a reservation the caller can hold.
+    let mut whole = valid();
+    whole.lease_callers[0].reservation_micro_usd = 50_000_000;
+    whole.validate().unwrap();
+    let mut none = valid();
+    none.lease_socket = None;
+    none.lease_callers.clear();
+    none.validate().unwrap();
+}
+
+#[test]
+fn config_init_binds_each_lease_user_to_the_configured_caller() {
+    let scratch = Scratch::new();
+    let made = init(
+        &scratch,
+        &init_flags(
+            &scratch,
+            &[
+                "--lease-socket",
+                "/run/claude-connector/lease.sock",
+                "--lease-user",
+                "mind-eureka-self",
+                "--lease-max-ms",
+                "120000",
+                "--lease-unit-instance",
+                "eureka",
+                "--lease-reservation-micro-usd",
+                "5000000",
+            ],
+        ),
+    );
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = load_config(&scratch.path("connector.cc")).unwrap();
+    assert_eq!(
+        config.lease_callers,
+        [LeaseCallerConfig {
+            unix_user: "mind-eureka-self".to_string(),
+            caller_id: "persona-a-caller".to_string(),
+            unit_instance: "eureka".to_string(),
+            reservation_micro_usd: 5_000_000,
+        }]
+    );
+    assert_eq!(config.lease_max_ms, 120_000);
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn config_check_refuses_a_lease_account_the_system_does_not_have() {
+    let scratch = Scratch::new();
+    let (mut flags, credentials) = prepare(&scratch);
+    let socket = scratch.path("lease.sock");
+    flags.extend(
+        [
+            "--lease-socket",
+            socket.to_str().unwrap(),
+            "--lease-user",
+            "no-such-account-4f1c",
+            "--lease-unit-instance",
+            "eureka",
+            "--lease-reservation-micro-usd",
+            "5000000",
+        ]
+        .map(String::from),
+    );
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = scratch.path("connector.cc");
+    let checked = run(
+        &["config", "check", config.to_str().unwrap()],
+        &[("CREDENTIALS_DIRECTORY", &credentials)],
+    );
+    assert!(!checked.status.success());
+    assert!(
+        shown(&checked).contains("lease_callers"),
+        "{}",
+        shown(&checked)
+    );
+    assert!(!shown(&checked).contains("no-such-account"));
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn serve_binds_the_lease_socket_and_answers_a_stranger_with_a_refusal() {
+    use std::io::{Read, Write};
+    use std::os::unix::fs::PermissionsExt;
+    use std::os::unix::net::UnixStream;
+    use std::process::Stdio;
+    use std::time::Instant;
+
+    use claude_connector::{
+        LeaseMessage, LeaseRefusalKind, LeaseRefused, LeaseRequest, decode_frame, encode_frame,
+    };
+
+    let scratch = Scratch::new();
+    let (mut flags, credentials) = prepare(&scratch);
+    let socket = scratch.path("lease.sock");
+    // The test runs as someone other than `nobody`, so it is a stranger.
+    flags.extend(
+        [
+            "--lease-socket",
+            socket.to_str().unwrap(),
+            "--lease-user",
+            "nobody",
+            "--lease-unit-instance",
+            "eureka",
+            "--lease-reservation-micro-usd",
+            "5000000",
+        ]
+        .map(String::from),
+    );
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = scratch.path("connector.cc");
+    let mut server = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
+        .args(["serve", "--config", config.to_str().unwrap()])
+        .env_clear()
+        .env("CREDENTIALS_DIRECTORY", &credentials)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    let started = Instant::now();
+    while !socket.exists() && started.elapsed() < Duration::from_secs(10) {
+        std::thread::sleep(Duration::from_millis(50));
+    }
+    let outcome = std::panic::catch_unwind(|| {
+        assert_eq!(
+            std::fs::metadata(&socket).unwrap().permissions().mode() & 0o777,
+            0o660
+        );
+        let mut stream = UnixStream::connect(&socket).unwrap();
+        stream
+            .set_read_timeout(Some(Duration::from_secs(5)))
+            .unwrap();
+        stream
+            .write_all(&encode_frame(&LeaseMessage::ClaudeLeaseRequest(
+                LeaseRequest {
+                    expires_at_unix_ms: u64::MAX / 2,
+                },
+            )))
+            .unwrap();
+        let mut reply = vec![0_u8; 4096];
+        let read = stream.read(&mut reply).unwrap();
+        assert!(matches!(
+            decode_frame(&reply[..read]),
+            Some(LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+                kind: LeaseRefusalKind::UnknownCaller,
+                ..
+            }))
+        ));
+    });
+    // The server is still serving: it did not return when it started.
+    let running = server.try_wait().unwrap().is_none();
+    server.kill().unwrap();
+    server.wait().unwrap();
+    outcome.unwrap();
+    assert!(running);
+}
diff --git a/crates/claude-connector/tests/fixtures/lease_v1/grant.bin b/crates/claude-connector/tests/fixtures/lease_v1/grant.bin
new file mode 100644
index 0000000000000000000000000000000000000000..554e3a64cb35edbf81585cd63ecbe95744d580df
GIT binary patch
literal 109
zcmZQzV90D*lAW2CvMD(yu{0$$J|{J?I5j@KC^4^OX<1@UX=>97h)`zAO*Jsf%D~Xb
r*u>P#+`=+3DLExI4V}NKD784Xs4O)lJ~uPDC_lcmIOQAzr}_Z^$PFl0

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/refusal.bin b/crates/claude-connector/tests/fixtures/lease_v1/refusal.bin
new file mode 100644
index 0000000000000000000000000000000000000000..22a4a25e3ceba32fc73bbfaf38dd854feff2550d
GIT binary patch
literal 104
zcmXBL!3~2j3<c1P;#&vl2n>KM{AsLOPL()t?<|E=k6otQfW-a1l#;wZPj&fC#$7NP
yxM8fAdt=)cwvG#YhZkJ#P*Z>Gf?&1(Ei!05ds%5>_Y#zg2}RaM6%BRa(BcQ7qADT)

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/request.bin b/crates/claude-connector/tests/fixtures/lease_v1/request.bin
new file mode 100644
index 0000000000000000000000000000000000000000..fddaa3785fe2e36c3d51f2ec7bb63649d2decda3
GIT binary patch
literal 66
zcmZQzV6bailAW2CvL!huu{0$$J|{J?I5oZ~wXig`xMXQrVoqsl<EGS#g3O}S;`qdp
W_|m-0iul~(^9&4(3p;ad4gdgajT-C#

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/settle.bin b/crates/claude-connector/tests/fixtures/lease_v1/settle.bin
new file mode 100644
index 0000000000000000000000000000000000000000..b7498de8470f0e9dc778597cd19d24df83e27a4d
GIT binary patch
literal 336
zcmZQzVDxEPlAW2CvN<^?u{0$$J|{J?I5oaFwWK5`b!k~*PHAe>3W!){%1t#e%gVse
z$k@cx%-q5<F)2AEH4UA=w6r)eJ#|vk(%k%%)SUGYlXde8N{e+(bqyi1t!py#3Q9}j
zOY*Z*^NP>1Y}lBbn4FOsUzD1d0uwAX*aQ(QFUl-Qg^4nLS({&4f~1#OVFOTCaeiKA
lUOH4!3e@fmP`fh{GqX!^TFy8D({ctZRx_YlY=dF#0RUJliN*i`

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/settled.bin b/crates/claude-connector/tests/fixtures/lease_v1/settled.bin
new file mode 100644
index 0000000000000000000000000000000000000000..710d4b817e73b57863b3e0adaf6b682b017db04c
GIT binary patch
literal 81
zcmZQzVDN2PlAW2CvL!huu{0$$J|{J?I5oaFwWK5`HDzg8Voqsl(}twX93U?~H#4~?
bKfbg$<s1X!BZrOoWvN9)rFjV9v(XCxIr$<S

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
new file mode 100644
index 0000000..72fe188
--- /dev/null
+++ b/crates/claude-connector/tests/lease.rs
@@ -0,0 +1,1166 @@
+//! The Self-run credential lease over a real unix socket: who may lease, what
+//! is reserved before anything is lent, where the token goes, and what each
+//! way of ending a lease bills. The ledger is the kit's own; the tests read
+//! it only through what the next reservation is allowed to claim. The unit a
+//! peer runs in is the `PeerUnits` port, answered here by a fake; one test
+//! asks a real systemd where that is available.
+#![cfg(target_os = "linux")]
+
+use std::collections::BTreeMap;
+use std::fs::File;
+use std::io::{Read, Write};
+use std::os::fd::{AsRawFd, BorrowedFd, FromRawFd, OwnedFd, RawFd};
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use claude_connector::{
+    LeaseCaller, LeaseGranted, LeaseLimits, LeaseMessage, LeaseRefusalKind, LeaseRefused,
+    LeaseRequest, LeaseSettle, LeaseSettled, PeerUnit, PeerUnits, SystemdUnits, TokenSource,
+    decode_frame, encode_frame, serve_leases,
+};
+use model_connector::{
+    CallerAdmission, LeaseAdmission, LeaseRefusal, ModelPrice, ModelUsage, Rates, SpendCeiling,
+    SpendWindowMs, TransportService, Usage,
+};
+use zeroize::Zeroizing;
+
+const CALLER: &str = "eureka";
+const MODEL: &str = "claude-opus-5-1";
+const TOKEN: &str = "sk-canary-lease-4c1f9a";
+const FAR: u64 = 3_000_000_000_000;
+const INSTANCE: &str = "eureka";
+const UNIT: &str = "mind-self@eureka.service";
+
+static SEQUENCE: AtomicUsize = AtomicUsize::new(0);
+
+fn now_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_millis() as u64
+}
+
+fn own_uid() -> u32 {
+    // SAFETY: geteuid has no preconditions and cannot fail.
+    unsafe { libc::geteuid() }
+}
+
+/// The 32-digit invocation id of the test's `n`th unit invocation.
+fn invocation(n: u64) -> String {
+    format!("{n:032x}")
+}
+
+type Probe = Box<dyn Fn() + Send + Sync>;
+
+/// A token source that counts its reads and can run a probe at the moment of
+/// each one.
+struct FakeTokens {
+    token: Option<&'static str>,
+    reads: AtomicUsize,
+    probe: Mutex<Option<Probe>>,
+}
+
+impl TokenSource for FakeTokens {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        self.reads.fetch_add(1, Ordering::SeqCst);
+        if let Some(probe) = self.probe.lock().unwrap().as_ref() {
+            probe();
+        }
+        self.token.map(|token| Zeroizing::new(token.to_string()))
+    }
+}
+
+/// The system's record of where every peer runs, as the test sets it, and the
+/// pid each handle it was asked about names (by the kernel's own record).
+struct FakeUnits {
+    peer: Mutex<Option<PeerUnit>>,
+    asked_about: Mutex<Vec<(String, String)>>,
+}
+
+impl PeerUnits for FakeUnits {
+    fn invocation_in(&self, process: BorrowedFd<'_>, unit: &str) -> Option<PeerUnit> {
+        let info =
+            std::fs::read_to_string(format!("/proc/self/fdinfo/{}", process.as_raw_fd())).unwrap();
+        let pid = info
+            .lines()
+            .find_map(|line| line.strip_prefix("Pid:"))
+            .unwrap()
+            .trim()
+            .to_string();
+        self.asked_about
+            .lock()
+            .unwrap()
+            .push((pid, unit.to_string()));
+        self.peer.lock().unwrap().clone()
+    }
+}
+
+struct Harness {
+    dir: PathBuf,
+    socket: PathBuf,
+    service: Arc<Mutex<TransportService>>,
+    tokens: Arc<FakeTokens>,
+    /// The fake behind the listener, when it has one.
+    units: Option<Arc<FakeUnits>>,
+}
+
+impl Harness {
+    /// The peers connect from invocation `n` of the Self unit.
+    fn enter(&self, n: u64) {
+        self.run_in(UNIT, n);
+    }
+
+    fn run_in(&self, unit: &str, n: u64) {
+        *self.units.as_ref().unwrap().peer.lock().unwrap() = Some(PeerUnit {
+            unit: unit.to_string(),
+            invocation_id: invocation(n),
+        });
+    }
+}
+
+impl Drop for Harness {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+fn price() -> ModelPrice {
+    // One micro-USD per token in every class.
+    ModelPrice {
+        rates: Rates {
+            input: 1_000_000,
+            cache_write_short: 1_000_000,
+            cache_write_long: 1_000_000,
+            cache_read: 1_000_000,
+            output: 1_000_000,
+        },
+        long_context: None,
+        overhead_tokens: 0,
+    }
+}
+
+/// What a harness is built from.
+struct Setup {
+    ceiling: u64,
+    reservation: u64,
+    uid: u32,
+    token: Option<&'static str>,
+    max_connections: usize,
+}
+
+fn setup(ceiling: u64, reservation: u64) -> Setup {
+    Setup {
+        ceiling,
+        reservation,
+        uid: own_uid(),
+        token: Some(TOKEN),
+        max_connections: 8,
+    }
+}
+
+/// A listener serving `uid` as the caller `eureka`, each of whose leases
+/// reserves `reservation`, with a spend window so long that it never rolls
+/// over during a test. Peers start in invocation 1 of the Self unit.
+fn start(setup: Setup) -> Harness {
+    let units = Arc::new(FakeUnits {
+        peer: Mutex::new(None),
+        asked_about: Mutex::new(Vec::new()),
+    });
+    let harness = start_with(setup, units.clone(), Some(units), INSTANCE);
+    harness.enter(1);
+    harness
+}
+
+fn start_with(
+    setup: Setup,
+    units: Arc<dyn PeerUnits>,
+    fake: Option<Arc<FakeUnits>>,
+    instance: &str,
+) -> Harness {
+    let dir = std::env::temp_dir().join(format!(
+        "claude-lease-{}-{}",
+        std::process::id(),
+        SEQUENCE.fetch_add(1, Ordering::SeqCst)
+    ));
+    std::fs::create_dir_all(&dir).unwrap();
+    let socket = dir.join("lease.sock");
+    let service = Arc::new(Mutex::new(
+        TransportService::open(
+            &dir.join("replay.cc"),
+            "claude-code",
+            BTreeMap::from([(MODEL.to_string(), price())]),
+            [CallerAdmission::new(
+                CALLER,
+                "lease-test-connection-key",
+                1,
+                [MODEL.to_string()],
+                1,
+                65_536,
+                32_768,
+                SpendCeiling(setup.ceiling),
+                SpendWindowMs(1 << 50),
+            )
+            .unwrap()],
+            300_000,
+        )
+        .unwrap(),
+    ));
+    let tokens = Arc::new(FakeTokens {
+        token: setup.token,
+        reads: AtomicUsize::new(0),
+        probe: Mutex::new(None),
+    });
+    let listener = UnixListener::bind(&socket).unwrap();
+    let serving = (service.clone(), tokens.clone(), units);
+    let caller = LeaseCaller {
+        uid: setup.uid,
+        caller_id: CALLER.to_string(),
+        unit_instance: instance.to_string(),
+        reservation_micro_usd: setup.reservation,
+    };
+    std::thread::spawn(move || {
+        let _ = serve_leases(
+            &listener,
+            vec![caller],
+            LeaseLimits {
+                socket_timeout: Duration::from_secs(2),
+                max_lease_ms: 3_600_000,
+                max_connections: setup.max_connections,
+            },
+            serving.0,
+            serving.1,
+            serving.2,
+        );
+    });
+    Harness {
+        dir,
+        socket,
+        service,
+        tokens,
+        units: fake,
+    }
+}
+
+/// One frame, and the descriptors that arrived with it. An empty frame is end
+/// of file.
+fn receive(stream: &UnixStream) -> (Vec<u8>, Vec<OwnedFd>) {
+    use std::os::fd::AsRawFd;
+    let mut buffer = vec![0_u8; 70_000];
+    let mut control = vec![0_u64; 32];
+    let mut vector = libc::iovec {
+        iov_base: buffer.as_mut_ptr().cast(),
+        iov_len: buffer.len(),
+    };
+    // SAFETY: the buffers outlive the call and the lengths describe them; the
+    // descriptors read out of the control messages were just installed in this
+    // process by the kernel and are owned by nothing else.
+    unsafe {
+        let mut message: libc::msghdr = std::mem::zeroed();
+        message.msg_iov = &mut vector;
+        message.msg_iovlen = 1;
+        message.msg_control = control.as_mut_ptr().cast();
+        message.msg_controllen = (control.len() * 8) as _;
+        let received = libc::recvmsg(stream.as_raw_fd(), &mut message, libc::MSG_CMSG_CLOEXEC);
+        if received < 0 {
+            // A listener that drops a connection with our request unread
+            // resets it: that is end of file for this test's purposes.
+            let error = std::io::Error::last_os_error();
+            assert_eq!(error.kind(), std::io::ErrorKind::ConnectionReset, "{error}");
+            return (Vec::new(), Vec::new());
+        }
+        let mut fds = Vec::new();
+        let mut header = libc::CMSG_FIRSTHDR(&message);
+        while !header.is_null() {
+            if (*header).cmsg_level == libc::SOL_SOCKET && (*header).cmsg_type == libc::SCM_RIGHTS {
+                let bytes = (*header).cmsg_len as usize - libc::CMSG_LEN(0) as usize;
+                let data = libc::CMSG_DATA(header).cast::<RawFd>();
+                for index in 0..bytes / std::mem::size_of::<RawFd>() {
+                    fds.push(OwnedFd::from_raw_fd(data.add(index).read_unaligned()));
+                }
+            }
+            header = libc::CMSG_NXTHDR(&message, header);
+        }
+        buffer.truncate(received as usize);
+        (buffer, fds)
+    }
+}
+
+fn connect(harness: &Harness) -> UnixStream {
+    let stream = UnixStream::connect(&harness.socket).unwrap();
+    stream
+        .set_read_timeout(Some(Duration::from_secs(5)))
+        .unwrap();
+    stream
+}
+
+fn send(stream: &mut UnixStream, message: &LeaseMessage) {
+    stream.write_all(&encode_frame(message)).unwrap();
+}
+
+fn request(ttl_ms: u64) -> LeaseMessage {
+    LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
+        expires_at_unix_ms: now_ms() + ttl_ms,
+    })
+}
+
+/// What one request to the listener came back with.
+struct Answer {
+    stream: UnixStream,
+    raw: Vec<u8>,
+    message: Option<LeaseMessage>,
+    fds: Vec<OwnedFd>,
+}
+
+fn ask(harness: &Harness, ttl_ms: u64) -> Answer {
+    ask_at(&harness.socket, ttl_ms)
+}
+
+fn ask_at(socket: &std::path::Path, ttl_ms: u64) -> Answer {
+    let mut stream = UnixStream::connect(socket).unwrap();
+    stream
+        .set_read_timeout(Some(Duration::from_secs(10)))
+        .unwrap();
+    // A listener at its limit has already dropped us: the write may fail.
+    let _ = stream.write_all(&encode_frame(&request(ttl_ms)));
+    let (raw, fds) = receive(&stream);
+    let message = decode_frame(&raw);
+    Answer {
+        stream,
+        raw,
+        message,
+        fds,
+    }
+}
+
+fn refusal_of(answer: &Answer) -> Option<LeaseRefusalKind> {
+    match &answer.message {
+        Some(LeaseMessage::ClaudeLeaseRefusal(LeaseRefused { kind, .. })) => Some(*kind),
+        _ => None,
+    }
+}
+
+fn granted(answer: &Answer) -> LeaseGranted {
+    match &answer.message {
+        Some(LeaseMessage::ClaudeLeaseGrant(grant)) => grant.clone(),
+        other => panic!("expected a grant, got {other:?}"),
+    }
+}
+
+fn granted_ok(answer: &Answer) -> bool {
+    matches!(answer.message, Some(LeaseMessage::ClaudeLeaseGrant(_))) && answer.fds.len() == 1
+}
+
+/// Asks, as a fresh unit invocation each time, until the caller's previous
+/// lease has been settled by the listener.
+fn ask_after_busy(harness: &Harness, first_invocation: u64) -> Answer {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    for attempt in 0.. {
+        harness.enter(first_invocation + attempt);
+        let answer = ask(harness, 60_000);
+        if refusal_of(&answer) != Some(LeaseRefusalKind::Busy) || Instant::now() > deadline {
+            return answer;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    unreachable!()
+}
+
+fn used(model: &str, tokens: u64) -> ModelUsage {
+    ModelUsage {
+        model: model.to_string(),
+        usage: Usage {
+            input_tokens: 0,
+            cache_read_tokens: 0,
+            cache_write_tokens: 0,
+            output_tokens: tokens,
+            reasoning_tokens: None,
+        },
+    }
+}
+
+fn settle_frame(answer: &Answer, usage: Vec<ModelUsage>) -> Vec<u8> {
+    encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
+        lease_id: granted(answer).lease_id,
+        usage,
+    }))
+}
+
+fn settle(answer: &mut Answer, usage: Vec<ModelUsage>) -> LeaseSettled {
+    let frame = settle_frame(answer, usage);
+    answer.stream.write_all(&frame).unwrap();
+    let (raw, _) = receive(&answer.stream);
+    match decode_frame(&raw) {
+        Some(LeaseMessage::ClaudeLeaseSettled(settled)) => settled,
+        other => panic!("expected a settled reply, got {other:?}"),
+    }
+}
+
+fn contains(haystack: &[u8], needle: &str) -> bool {
+    haystack
+        .windows(needle.len())
+        .any(|window| window == needle.as_bytes())
+}
+
+/// Asks the ledger directly for a reservation of `cost`, as an invocation
+/// nobody else uses. A grant is left open.
+fn probe_reserve(harness: &Harness, name: &str, cost: u64) -> LeaseAdmission {
+    harness
+        .service
+        .lock()
+        .unwrap()
+        .begin_lease(CALLER, name, cost, FAR, now_ms())
+        .unwrap()
+}
+
+fn ceiling_refused() -> LeaseAdmission {
+    LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
+}
+
+#[test]
+fn a_grant_passes_one_fd_holding_the_token_then_end_of_file() {
+    let harness = start(setup(1_000, 600));
+    let mut answer = ask(&harness, 60_000);
+    assert_eq!(granted(&answer).reserved_micro_usd, 600);
+    assert_eq!(answer.fds.len(), 1);
+    // Reading to end of file proves the write end is closed: nobody holds
+    // the pipe open for another write.
+    let mut read = Vec::new();
+    File::from(answer.fds.remove(0))
+        .read_to_end(&mut read)
+        .unwrap();
+    assert_eq!(read, TOKEN.as_bytes());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+}
+
+#[test]
+fn the_lease_is_named_for_the_unit_invocation_not_for_anything_the_peer_says() {
+    let harness = start(setup(1_000, 600));
+    harness.enter(0xabc);
+    let answer = ask(&harness, 60_000);
+    assert_eq!(
+        granted(&answer).lease_id,
+        format!("lease:{}", invocation(0xabc))
+    );
+}
+
+#[test]
+fn the_token_is_in_the_pipe_and_nowhere_else() {
+    let harness = start(setup(1_000, 600));
+    let mut answer = ask(&harness, 60_000);
+    let mut frames = vec![answer.raw.clone()];
+    let settled = settle(&mut answer, vec![used(MODEL, 10)]);
+    frames.push(encode_frame(&LeaseMessage::ClaudeLeaseSettled(settled)));
+    harness.enter(2);
+    let refused = ask(&harness, 1);
+    frames.push(refused.raw.clone());
+    for frame in &frames {
+        assert!(!contains(frame, TOKEN));
+    }
+    assert!(std::env::vars().all(|(name, value)| !name.contains(TOKEN) && !value.contains(TOKEN)));
+    assert!(std::env::args().all(|argument| !argument.contains(TOKEN)));
+    // The one place it is: the pipe.
+    let mut read = String::new();
+    File::from(answer.fds.remove(0))
+        .read_to_string(&mut read)
+        .unwrap();
+    assert_eq!(read, TOKEN);
+}
+
+#[test]
+fn a_peer_uid_outside_the_lease_callers_is_refused_and_nothing_is_reserved_or_read() {
+    let harness = start(Setup {
+        uid: own_uid() + 1,
+        ..setup(1_000, 600)
+    });
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
+    assert!(answer.fds.is_empty());
+    assert!(!contains(&answer.raw, TOKEN));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    // The ledger was not touched: the caller's whole ceiling is still free.
+    assert!(matches!(
+        probe_reserve(&harness, "probe", 1_000),
+        LeaseAdmission::Granted(_)
+    ));
+}
+
+#[test]
+fn the_configured_uid_outside_the_self_unit_is_refused_and_nothing_is_reserved_or_read() {
+    let harness = start(setup(1_000, 600));
+    for (label, peer) in [
+        ("another instance", Some(("mind-self@other.service", 1))),
+        ("a user service", Some(("huginn.service", 1))),
+        ("no unit", None),
+    ] {
+        *harness.units.as_ref().unwrap().peer.lock().unwrap() = peer.map(|(unit, n)| PeerUnit {
+            unit: unit.to_string(),
+            invocation_id: invocation(n),
+        });
+        let answer = ask(&harness, 60_000);
+        assert_eq!(
+            refusal_of(&answer),
+            Some(LeaseRefusalKind::UnknownCaller),
+            "{label}"
+        );
+        assert!(answer.fds.is_empty(), "{label}");
+    }
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    assert!(matches!(
+        probe_reserve(&harness, "probe", 1_000),
+        LeaseAdmission::Granted(_)
+    ));
+}
+
+#[test]
+fn one_invocation_of_the_self_unit_leases_once_and_the_next_invocation_leases_again() {
+    let harness = start(setup(1_000_000, 600));
+    let mut first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    settle(&mut first, vec![used(MODEL, 10)]);
+    // Settled, the caller holds nothing; the invocation has still leased.
+    let again = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&again), Some(LeaseRefusalKind::Busy));
+    assert!(again.fds.is_empty());
+    harness.enter(2);
+    assert!(granted_ok(&ask(&harness, 60_000)));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
+}
+
+#[test]
+fn the_reservation_is_claimed_before_the_token_is_read_or_lent() {
+    let harness = start(setup(1_000, 600));
+    let seen = Arc::new(Mutex::new(None));
+    let (service, sink) = (harness.service.clone(), seen.clone());
+    *harness.tokens.probe.lock().unwrap() = Some(Box::new(move || {
+        // From inside the token read: the caller already holds a lease.
+        let admission = service
+            .lock()
+            .unwrap()
+            .begin_lease(CALLER, "probe", 1, FAR, now_ms())
+            .unwrap();
+        *sink.lock().unwrap() = Some(admission);
+    }));
+    let answer = ask(&harness, 60_000);
+    assert_eq!(answer.fds.len(), 1);
+    assert_eq!(
+        *seen.lock().unwrap(),
+        Some(LeaseAdmission::Refused(LeaseRefusal::Busy))
+    );
+}
+
+#[test]
+fn a_reservation_the_window_cannot_hold_is_refused_and_lends_nothing() {
+    let harness = start(setup(1_000, 1_001));
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::SpendCeiling));
+    assert!(answer.fds.is_empty());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    // Exactly the ceiling fits.
+    let harness = start(setup(1_000, 1_000));
+    assert!(granted_ok(&ask(&harness, 60_000)));
+}
+
+#[test]
+fn a_free_lease_and_a_bad_expiry_are_refused() {
+    let harness = start(setup(1_000, 0));
+    assert_eq!(
+        refusal_of(&ask(&harness, 60_000)),
+        Some(LeaseRefusalKind::CostBound)
+    );
+    let harness = start(setup(1_000, 100));
+    for ttl in [0, 3_600_001 + 1_000] {
+        let mut stream = connect(&harness);
+        let expires_at_unix_ms = if ttl == 0 { 1 } else { now_ms() + ttl };
+        send(
+            &mut stream,
+            &LeaseMessage::ClaudeLeaseRequest(LeaseRequest { expires_at_unix_ms }),
+        );
+        let (raw, fds) = receive(&stream);
+        assert!(fds.is_empty());
+        assert!(matches!(
+            decode_frame(&raw),
+            Some(LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+                kind: LeaseRefusalKind::Expired,
+                ..
+            }))
+        ));
+    }
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn a_second_open_lease_for_the_caller_is_busy_even_from_another_invocation() {
+    let harness = start(setup(1_000_000, 100));
+    let first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    harness.enter(2);
+    let second = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
+    assert!(second.fds.is_empty());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+}
+
+#[test]
+fn settlement_bills_the_true_cost_of_each_models_use_and_the_window_holds_it() {
+    let harness = start(setup(1_000, 600));
+    let mut first = ask(&harness, 60_000);
+    // One micro-USD a token: 250 of the priced model, and 100 of a model the
+    // table has never heard of, which bills at the dearest known price.
+    let settled = settle(
+        &mut first,
+        vec![used(MODEL, 250), used("claude-new-9", 100)],
+    );
+    assert_eq!(
+        (settled.billed_micro_usd, settled.overrun_micro_usd),
+        (350, 0)
+    );
+    // 350 spent: 650 remain, not 651.
+    assert_eq!(probe_reserve(&harness, "over", 651), ceiling_refused());
+    assert!(matches!(
+        probe_reserve(&harness, "fits", 650),
+        LeaseAdmission::Granted(_)
+    ));
+}
+
+#[test]
+fn usage_above_the_reservation_is_billed_in_full_and_the_overrun_is_reported_and_counted() {
+    let harness = start(setup(1_000, 100));
+    let mut first = ask(&harness, 60_000);
+    let settled = settle(&mut first, vec![used(MODEL, 700), used(MODEL, 5_000)]);
+    assert_eq!(settled.billed_micro_usd, 5_700);
+    assert_eq!(settled.overrun_micro_usd, 5_600);
+    // The window is past its ceiling: nothing more reserves in it.
+    assert_eq!(probe_reserve(&harness, "next", 1), ceiling_refused());
+}
+
+#[test]
+fn a_plan_quota_the_run_reports_is_not_part_of_the_protocol() {
+    // A settle in the shape the first protocol used, with a plan_quota the
+    // run vouches for: the extra key is ignored and the usage is billed.
+    let harness = start(setup(1_000, 600));
+    let mut first = ask(&harness, 60_000);
+    let legacy = serde_json::json!({
+        "kind": "claude_lease_settle",
+        "value": {
+            "lease_id": granted(&first).lease_id,
+            "usage": [{"model": MODEL, "usage": {
+                "input_tokens": 0, "cache_read_tokens": 0, "cache_write_tokens": 0,
+                "output_tokens": 40, "reasoning_tokens": null}}],
+            "plan_quota": [{"window": "five_hour", "utilization_permille": 0,
+                "resets_at_unix_ms": 1, "status": "allowed", "observed_at_unix_ms": 1}]
+        }
+    });
+    let body = rmp_serde::to_vec_named(&legacy).unwrap();
+    let mut frame = (body.len() as u32).to_be_bytes().to_vec();
+    frame.extend_from_slice(&body);
+    first.stream.write_all(&frame).unwrap();
+    let (raw, _) = receive(&first.stream);
+    assert!(matches!(
+        decode_frame(&raw),
+        Some(LeaseMessage::ClaudeLeaseSettled(LeaseSettled {
+            billed_micro_usd: 40,
+            overrun_micro_usd: 0
+        }))
+    ));
+}
+
+#[test]
+fn a_connection_dropped_without_settling_is_billed_the_reservation() {
+    let harness = start(setup(1_000, 600));
+    let first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    drop(first);
+    let over = ask_after_busy(&harness, 2);
+    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
+    assert_eq!(probe_reserve(&harness, "over", 401), ceiling_refused());
+    assert!(matches!(
+        probe_reserve(&harness, "fits", 400),
+        LeaseAdmission::Granted(_)
+    ));
+}
+
+#[test]
+fn a_lease_that_expires_unsettled_is_closed_and_billed_the_reservation() {
+    let harness = start(setup(1_000, 600));
+    let first = ask(&harness, 400);
+    assert!(granted_ok(&first));
+    let started = Instant::now();
+    // The listener, not the client, ends the lease at its expiry.
+    let (raw, fds) = receive(&first.stream);
+    assert!(raw.is_empty() && fds.is_empty());
+    assert!(started.elapsed() >= Duration::from_millis(250));
+    harness.enter(2);
+    let over = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
+}
+
+#[test]
+fn a_settle_trickled_past_the_expiry_is_no_report_and_bills_the_reservation() {
+    let harness = start(setup(1_000, 600));
+    let mut answer = ask(&harness, 1_500);
+    let frame = settle_frame(&answer, vec![used(MODEL, 10)]);
+    let chunk = frame.len() / 4 + 1;
+    // Each write lands inside any per-read wait; the frame does not land
+    // inside the lease.
+    for (i, part) in frame.chunks(chunk).enumerate() {
+        if i > 0 {
+            std::thread::sleep(Duration::from_millis(1_200));
+        }
+        let _ = answer.stream.write_all(part);
+    }
+    let (raw, _) = receive(&answer.stream);
+    assert!(raw.is_empty(), "{:?}", decode_frame(&raw));
+    assert_eq!(probe_reserve(&harness, "over", 401), ceiling_refused());
+}
+
+#[test]
+fn a_request_trickled_past_the_socket_timeout_is_dropped_without_a_reservation() {
+    let harness = start(setup(1_000, 600));
+    let mut stream = connect(&harness);
+    let started = Instant::now();
+    // Three bytes of a length, 0.9 s apart, then silence: every wait is inside
+    // the 2 s socket timeout, the frame is not.
+    for byte in [0_u8, 0, 0] {
+        stream.write_all(&[byte]).unwrap();
+        std::thread::sleep(Duration::from_millis(900));
+    }
+    let (raw, fds) = receive(&stream);
+    assert!(raw.is_empty() && fds.is_empty());
+    assert!(
+        started.elapsed() < Duration::from_millis(3_300),
+        "{:?}",
+        started.elapsed()
+    );
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    assert!(matches!(
+        probe_reserve(&harness, "probe", 1_000),
+        LeaseAdmission::Granted(_)
+    ));
+}
+
+#[test]
+fn a_settle_for_another_lease_is_no_report_and_bills_the_reservation() {
+    let harness = start(setup(1_000, 600));
+    let mut first = ask(&harness, 60_000);
+    send(
+        &mut first.stream,
+        &LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
+            lease_id: "lease:someone-else".to_string(),
+            usage: vec![used(MODEL, 1)],
+        }),
+    );
+    let (raw, _) = receive(&first.stream);
+    assert!(raw.is_empty());
+    harness.enter(2);
+    let over = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
+}
+
+#[test]
+fn a_settle_that_reports_nothing_is_billed_the_reservation() {
+    let harness = start(setup(1_000, 600));
+    let mut first = ask(&harness, 60_000);
+    let settled = settle(&mut first, vec![]);
+    assert_eq!(
+        (settled.billed_micro_usd, settled.overrun_micro_usd),
+        (600, 0)
+    );
+    // 600 spent: the whole ceiling no longer reserves.
+    assert_eq!(probe_reserve(&harness, "all", 1_000), ceiling_refused());
+}
+
+#[test]
+fn a_token_that_cannot_be_read_is_never_lent_and_bills_nothing() {
+    let harness = start(Setup {
+        token: None,
+        ..setup(1_000, 1_000)
+    });
+    let first = ask(&harness, 60_000);
+    assert!(first.raw.is_empty() && first.fds.is_empty());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+    // Nothing was billed: the whole ceiling reserves again and gets as far
+    // as the token read, not a refusal.
+    let again = ask_after_busy(&harness, 2);
+    assert!(again.message.is_none() && again.fds.is_empty());
+    assert!(harness.tokens.reads.load(Ordering::SeqCst) >= 2);
+}
+
+#[test]
+fn a_malformed_or_oversized_frame_is_dropped_without_a_reservation() {
+    let harness = start(setup(1_000, 1_000));
+    for bytes in [
+        vec![0xff, 0xff, 0xff, 0xff],
+        vec![0, 0, 0, 0],
+        vec![0, 0, 0, 3, 0xc1, 0xc1, 0xc1],
+    ] {
+        let mut stream = connect(&harness);
+        stream.write_all(&bytes).unwrap();
+        let started = Instant::now();
+        let (raw, fds) = receive(&stream);
+        assert!(raw.is_empty() && fds.is_empty());
+        // Refused at once, not after the socket timeout of a read that was
+        // never going to complete.
+        assert!(started.elapsed() < Duration::from_millis(1_000));
+    }
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    assert!(granted_ok(&ask(&harness, 60_000)));
+}
+
+#[test]
+fn every_message_kind_is_the_pinned_bytes_of_its_fixture() {
+    let expires = 1_793_307_000_000;
+    let lease = format!("lease:{}", "0123456789abcdef0123456789abcdef");
+    let messages = [
+        (
+            &include_bytes!("fixtures/lease_v1/request.bin")[..],
+            LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
+                expires_at_unix_ms: expires,
+            }),
+        ),
+        (
+            &include_bytes!("fixtures/lease_v1/grant.bin")[..],
+            LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
+                lease_id: lease.clone(),
+                reserved_micro_usd: 600_000,
+            }),
+        ),
+        (
+            &include_bytes!("fixtures/lease_v1/refusal.bin")[..],
+            LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+                kind: LeaseRefusalKind::SpendCeiling,
+                detail: "the window cannot hold this reservation".to_string(),
+            }),
+        ),
+        (
+            &include_bytes!("fixtures/lease_v1/settle.bin")[..],
+            LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
+                lease_id: lease,
+                usage: vec![
+                    ModelUsage {
+                        model: "claude-opus-5-1".to_string(),
+                        usage: Usage {
+                            input_tokens: 1_200,
+                            cache_read_tokens: 30_000,
+                            cache_write_tokens: 500,
+                            output_tokens: 800,
+                            reasoning_tokens: Some(100),
+                        },
+                    },
+                    ModelUsage {
+                        model: "claude-haiku-5-1".to_string(),
+                        usage: Usage {
+                            input_tokens: 400,
+                            cache_read_tokens: 0,
+                            cache_write_tokens: 0,
+                            output_tokens: 60,
+                            reasoning_tokens: None,
+                        },
+                    },
+                ],
+            }),
+        ),
+        (
+            &include_bytes!("fixtures/lease_v1/settled.bin")[..],
+            LeaseMessage::ClaudeLeaseSettled(LeaseSettled {
+                billed_micro_usd: 123_456,
+                overrun_micro_usd: 23_456,
+            }),
+        ),
+    ];
+    for (bytes, message) in messages {
+        assert_eq!(encode_frame(&message), bytes, "{message:?}");
+        assert_eq!(decode_frame(bytes), Some(message));
+    }
+}
+
+#[test]
+fn connections_past_the_limit_are_dropped_and_finished_ones_free_their_place() {
+    let harness = start(Setup {
+        max_connections: 2,
+        ..setup(1_000, 0)
+    });
+    let held: Vec<UnixStream> = (0..2).map(|_| connect(&harness)).collect();
+    // Let the listener take both before the third arrives.
+    std::thread::sleep(Duration::from_millis(300));
+    let third = ask(&harness, 60_000);
+    assert!(third.raw.is_empty() && third.fds.is_empty());
+    drop(held);
+    // Finished connections give their places back: more refusals in a row
+    // than the limit holds, each answered.
+    let first = ask_until_answered(&harness);
+    assert_eq!(refusal_of(&first), Some(LeaseRefusalKind::CostBound));
+    for _ in 0..4 {
+        let again = ask(&harness, 60_000);
+        assert_eq!(refusal_of(&again), Some(LeaseRefusalKind::CostBound));
+    }
+}
+
+/// A free lease, asked until the listener answers instead of dropping.
+fn ask_until_answered(harness: &Harness) -> Answer {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    loop {
+        let answer = ask(harness, 60_000);
+        if !answer.raw.is_empty() || Instant::now() > deadline {
+            return answer;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
+#[test]
+fn an_account_resolves_to_its_uid_and_a_missing_one_to_none() {
+    use claude_connector::user_uid;
+    assert_eq!(user_uid("root"), Some(0));
+    assert_eq!(user_uid("nobody"), Some(65534));
+    assert_eq!(user_uid("no-such-account-4f1c"), None);
+    assert_eq!(user_uid("bad name"), None);
+}
+
+#[test]
+fn a_token_up_to_one_atomic_pipe_write_is_lent_and_a_longer_one_is_not() {
+    let fits: &'static str = Box::leak("t".repeat(4096).into_boxed_str());
+    let harness = start(Setup {
+        token: Some(fits),
+        ..setup(1_000, 100)
+    });
+    let mut answer = ask(&harness, 60_000);
+    let mut read = Vec::new();
+    File::from(answer.fds.remove(0))
+        .read_to_end(&mut read)
+        .unwrap();
+    assert_eq!(read.len(), 4096);
+
+    let too_long: &'static str = Box::leak("t".repeat(4097).into_boxed_str());
+    let harness = start(Setup {
+        token: Some(too_long),
+        ..setup(1_000, 100)
+    });
+    let answer = ask(&harness, 60_000);
+    assert!(answer.raw.is_empty() && answer.fds.is_empty());
+}
+
+// ---- a second real uid (Soul s1, kept as a regression) ----
+
+fn describe(answer: &Answer) -> String {
+    let kind = match &answer.message {
+        Some(LeaseMessage::ClaudeLeaseGrant(_)) => "grant".to_string(),
+        Some(LeaseMessage::ClaudeLeaseRefusal(r)) => format!("refusal:{:?}", r.kind),
+        Some(other) => format!("other:{other:?}"),
+        None => format!("none(raw={})", answer.raw.len()),
+    };
+    format!("kind={kind} fds={}", answer.fds.len())
+}
+
+/// The child half of the second-uid test: connects to `LEASE_SOCK` as whoever
+/// it was started as and prints one line saying what came back. The fake
+/// canary token is never printed, only whether it matched.
+#[test]
+#[ignore = "run as a child of a_second_real_uid_cannot_lease"]
+fn lease_probe_client() {
+    let socket = PathBuf::from(std::env::var("LEASE_SOCK").unwrap());
+    let mut answer = ask_at(&socket, 60_000);
+    let shown = describe(&answer);
+    let mut token_matches = false;
+    if !answer.fds.is_empty() {
+        let mut read = Vec::new();
+        File::from(answer.fds.remove(0))
+            .read_to_end(&mut read)
+            .unwrap();
+        token_matches = read == TOKEN.as_bytes();
+    }
+    println!(
+        "LEASEPROBE uid={} {} token_matches_canary={token_matches}",
+        own_uid(),
+        shown
+    );
+}
+
+/// Runs the probe client as `reuid`, with primary group `regid` and
+/// supplementary `groups`, and returns its LEASEPROBE line. The marker is
+/// found anywhere on a line: the test harness prints it after its own prefix.
+fn probe_as(socket: &std::path::Path, reuid: u32, regid: u32, groups: &str) -> String {
+    let exe = std::env::current_exe().unwrap();
+    let out = std::process::Command::new("setpriv")
+        .arg(format!("--reuid={reuid}"))
+        .arg(format!("--regid={regid}"))
+        .arg(format!("--groups={groups}"))
+        .arg(&exe)
+        .args([
+            "--exact",
+            "lease_probe_client",
+            "--ignored",
+            "--nocapture",
+            "--test-threads=1",
+        ])
+        .env("LEASE_SOCK", socket)
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
+    stdout
+        .lines()
+        .find_map(|line| line.find("LEASEPROBE").map(|at| line[at..].to_string()))
+        .unwrap_or_else(|| {
+            format!(
+                "NO-LINE status={:?} stdout={stdout:?} stderr={}",
+                out.status,
+                String::from_utf8_lossy(&out.stderr)
+            )
+        })
+}
+
+fn have(tool: &str) -> bool {
+    std::process::Command::new(tool)
+        .arg("--version")
+        .output()
+        .is_ok()
+}
+
+#[test]
+fn a_second_real_uid_cannot_lease() {
+    use std::os::unix::fs::PermissionsExt;
+    if own_uid() != 0 || !have("setpriv") {
+        eprintln!("SKIPPED a_second_real_uid_cannot_lease: needs root and setpriv");
+        return;
+    }
+    // Numeric uids need no account: 4242 is the configured Self user, 4243 a
+    // second account that shares its groups.
+    let harness = start(Setup {
+        uid: 4242,
+        ..setup(1_000_000, 600)
+    });
+    std::fs::set_permissions(&harness.dir, std::fs::Permissions::from_mode(0o755)).unwrap();
+    std::fs::set_permissions(&harness.socket, std::fs::Permissions::from_mode(0o666)).unwrap();
+    // Another uid, in the caller's group and the lease group.
+    let a = probe_as(&harness.socket, 4243, 4243, "4242,4244");
+    // Another uid whose primary gid is the caller's.
+    let b = probe_as(&harness.socket, 4243, 4242, "4242");
+    // Root, which is not configured.
+    let root = describe(&ask(&harness, 60_000));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    // The configured uid does lease.
+    let c = probe_as(&harness.socket, 4242, 4242, "4242");
+    assert!(a.contains("kind=refusal:UnknownCaller fds=0"), "{a}");
+    assert!(b.contains("kind=refusal:UnknownCaller fds=0"), "{b}");
+    assert!(root.contains("kind=refusal:UnknownCaller fds=0"), "{root}");
+    assert!(
+        c.contains("kind=grant fds=1") && c.contains("token_matches_canary=true"),
+        "{c}"
+    );
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+}
+
+// ---- a real systemd, where there is one ----
+
+/// The child half of the systemd test, run inside a transient service: leases,
+/// settles, and leases again from the same invocation.
+#[test]
+#[ignore = "run inside a transient unit by a_real_systemd_unit_invocation_leases_once"]
+fn lease_in_unit_client() {
+    let socket = PathBuf::from(std::env::var("LEASE_SOCK").unwrap());
+    let mut first = ask_at(&socket, 60_000);
+    let first_kind = describe(&first);
+    if granted_ok(&first) {
+        settle(&mut first, Vec::new());
+    }
+    let second = ask_at(&socket, 60_000);
+    println!(
+        "LEASEPROBE first[{first_kind}] second[{}]",
+        describe(&second)
+    );
+}
+
+fn run_in_unit(socket: &std::path::Path) -> String {
+    let exe = std::env::current_exe().unwrap();
+    let out = std::process::Command::new("systemd-run")
+        .args([
+            "--unit=mind-self@leasetest.service",
+            "--pipe",
+            "--wait",
+            "--collect",
+            "--quiet",
+        ])
+        .arg(format!("--setenv=LEASE_SOCK={}", socket.display()))
+        .arg(&exe)
+        .args([
+            "--exact",
+            "lease_in_unit_client",
+            "--ignored",
+            "--nocapture",
+            "--test-threads=1",
+        ])
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
+    stdout
+        .lines()
+        .find_map(|line| line.find("LEASEPROBE").map(|at| line[at..].to_string()))
+        .unwrap_or_else(|| {
+            format!(
+                "NO-LINE status={:?} stdout={stdout:?} stderr={}",
+                out.status,
+                String::from_utf8_lossy(&out.stderr)
+            )
+        })
+}
+
+#[test]
+fn a_real_systemd_unit_invocation_leases_once() {
+    if own_uid() != 0
+        || !std::path::Path::new("/run/systemd/system").exists()
+        || !have("systemd-run")
+    {
+        eprintln!(
+            "SKIPPED a_real_systemd_unit_invocation_leases_once: needs root, systemd as init and systemd-run"
+        );
+        return;
+    }
+    // The listener asks the production resolver, not the fake.
+    let harness = start_with(
+        setup(1_000_000, 600),
+        Arc::new(SystemdUnits::system()),
+        None,
+        "leasetest",
+    );
+    let leased_then_busy = "first[kind=grant fds=1] second[kind=refusal:Busy fds=0]";
+    // Two invocations of the same unit: each leases once, as its own.
+    let one = run_in_unit(&harness.socket);
+    let two = run_in_unit(&harness.socket);
+    assert!(one.contains(leased_then_busy), "{one}");
+    assert!(two.contains(leased_then_busy), "{two}");
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
+    // A process outside any such unit is not a Self run, though its uid is
+    // the configured one.
+    let outside = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&outside), Some(LeaseRefusalKind::UnknownCaller));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
+}
+
+#[test]
+fn the_peer_is_named_by_a_process_handle_not_a_pid_number() {
+    let (one, _other) = UnixStream::pair().unwrap();
+    let peer = claude_connector::peer_credentials(&one).unwrap();
+    assert_eq!(peer.uid, own_uid());
+    let process = peer.process.expect("SO_PEERPIDFD on this kernel");
+    let info =
+        std::fs::read_to_string(format!("/proc/self/fdinfo/{}", process.as_raw_fd())).unwrap();
+    assert!(
+        info.lines()
+            .any(|line| line.strip_prefix("Pid:").map(str::trim)
+                == Some(&std::process::id().to_string())),
+        "{info}"
+    );
+}
+
+#[test]
+fn the_unit_is_asked_of_the_callers_unit_through_the_peers_handle() {
+    let harness = start(setup(1_000, 600));
+    let answer = ask(&harness, 60_000);
+    assert!(refusal_of(&answer).is_none() && answer.fds.len() == 1);
+    assert_eq!(
+        *harness.units.as_ref().unwrap().asked_about.lock().unwrap(),
+        vec![(std::process::id().to_string(), UNIT.to_string())]
+    );
+}
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 26f5e2d..cf76afc 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -171,15 +171,7 @@ pub fn serve(
     backend: Arc<dyn ProviderBackend>,
 ) -> Result<(), ServeError> {
     limits.validate(&admissions)?;
-    if !listener
-        .local_addr()
-        .map_err(ServeError::Listen)?
-        .ip()
-        .is_loopback()
-    {
-        return Err(ServeError::InvalidConfig("listener address"));
-    }
-    backend.ready().map_err(ServeError::BackendUnready)?;
+    admit_listener(&listener, backend.as_ref())?;
     let service = Arc::new(Mutex::new(TransportService::open(
         replay_store,
         backend.provider(),
@@ -190,6 +182,34 @@ pub fn serve(
     accept_loop(|| listener.accept(), limits, service, backend)
 }
 
+/// `serve` over a service the caller opened and keeps a handle to, so another
+/// front of the same ledger (the Self-run credential lease) reserves in the
+/// same windows. The limits must already have been validated against the
+/// service's admissions.
+pub fn serve_service(
+    listener: TcpListener,
+    limits: ServeLimits,
+    service: Arc<Mutex<TransportService>>,
+    backend: Arc<dyn ProviderBackend>,
+) -> Result<(), ServeError> {
+    admit_listener(&listener, backend.as_ref())?;
+    accept_loop(|| listener.accept(), limits, service, backend)
+}
+
+/// What must be true before a serve loop touches the ledger: the listener is
+/// on loopback and the backend can take work.
+fn admit_listener(listener: &TcpListener, backend: &dyn ProviderBackend) -> Result<(), ServeError> {
+    if !listener
+        .local_addr()
+        .map_err(ServeError::Listen)?
+        .ip()
+        .is_loopback()
+    {
+        return Err(ServeError::InvalidConfig("listener address"));
+    }
+    backend.ready().map_err(ServeError::BackendUnready)
+}
+
 /// The accept loop over any source of connections, so a test can present a
 /// peer address that a loopback listener never reports.
 fn accept_loop(
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index c269916..16853dc 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -317,6 +317,9 @@ fn prune_to_latest(
 struct LiveRequest {
     window: u64,
     reserved_micro_usd: u64,
+    /// A Self run's credential lease, not a provider call: it holds its
+    /// reservation in the window like a call does but takes no request slot.
+    lease: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -338,6 +341,12 @@ enum ReplayState {
         charged_micro_usd: u64,
         overrun_micro_usd: u64,
     },
+    /// A credential lease that settled: it has no answer to replay, only the
+    /// charge it left in its window and how far that passed the reservation.
+    LeaseSettled {
+        charged_micro_usd: u64,
+        overrun_micro_usd: u64,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
@@ -586,6 +595,9 @@ impl TransportService {
                 ReplayState::Active { reserved_micro_usd } => *reserved_micro_usd,
                 ReplayState::Completed {
                     charged_micro_usd, ..
+                }
+                | ReplayState::LeaseSettled {
+                    charged_micro_usd, ..
                 } => *charged_micro_usd,
             };
             add_spend(
@@ -787,6 +799,9 @@ impl TransportService {
                         .map_err(replay_store_error)?;
                     Ok(TransportAdmission::Reply(stand_in))
                 }
+                ReplayState::LeaseSettled { .. } => {
+                    self.reply_refusal(&invocation, Refusal::ReplayConflict, &security)
+                }
                 ReplayState::Active { .. } => {
                     let refusal = if self.live.contains_key(&identity) {
                         Refusal::InFlight
@@ -810,8 +825,10 @@ impl TransportService {
         };
         let active_for_caller = self
             .live
-            .keys()
-            .filter(|key| key.caller_runtime_id == invocation.caller_runtime_id)
+            .iter()
+            .filter(|(key, request)| {
+                !request.lease && key.caller_runtime_id == invocation.caller_runtime_id
+            })
             .count();
         if active_for_caller >= max_concurrent_requests {
             return self.reply_refusal(&invocation, Refusal::Capacity, &security);
@@ -873,6 +890,7 @@ impl TransportService {
             LiveRequest {
                 window,
                 reserved_micro_usd,
+                lease: false,
             },
         );
         Ok(TransportAdmission::Execute(Box::new(ExecutionClaim {
@@ -1234,6 +1252,9 @@ fn replay_store_error(error: impl std::fmt::Display) -> ServiceError {
     ServiceError::ReplayStore(error.to_string())
 }
 
+mod lease;
+pub use lease::{LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseUse, ModelUsage};
+
 fn contract_refusal(error: &ContractError) -> Refusal {
     match error {
         ContractError::Expiry => Refusal::Expired,
@@ -2525,7 +2546,9 @@ mod tests {
             ReplayState::Completed {
                 charged_micro_usd, ..
             } => charged_micro_usd,
-            ReplayState::Active { .. } => panic!("{request_id} is not completed"),
+            ReplayState::Active { .. } | ReplayState::LeaseSettled { .. } => {
+                panic!("{request_id} is not completed")
+            }
         }
     }
 
diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
new file mode 100644
index 0000000..6e9be71
--- /dev/null
+++ b/crates/model-connector/src/service/lease.rs
@@ -0,0 +1,691 @@
+//! A credential lease: a Self run's reservation in the caller's spend window.
+//! The lease is one record of the same ledger a provider call reserves in, not
+//! a second ledger: it is claimed before anything is lent, counts against the
+//! window's ceiling while open, and settles to the true cost of what the run
+//! reports it used, per model and uncapped: a charge above the reservation is
+//! kept as the lease's overrun, and still counts against the window. A lease
+//! nothing settled is billed the whole reservation, as a call a crash left
+//! behind is.
+
+use super::*;
+
+/// The request-id namespace of leases in a caller's replay records.
+const LEASE_PREFIX: &str = "lease:";
+
+/// What an admitted lease holds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LeaseGrant {
+    pub lease_id: String,
+    pub reserved_micro_usd: u64,
+}
+
+/// What a run used of one model.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ModelUsage {
+    pub model: String,
+    pub usage: Usage,
+}
+
+/// What a settled lease was billed. `overrun_micro_usd` is how far the charge
+/// passed the reservation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct LeaseSettlement {
+    pub billed_micro_usd: u64,
+    pub overrun_micro_usd: u64,
+}
+
+/// What a lease's settlement is billed on.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LeaseUse<'a> {
+    /// No report: the whole reservation. A run that cannot say what it used
+    /// pays what was set aside for it.
+    Reservation,
+    /// The run's report. A report that names no use (an empty list) is no
+    /// report, and bills the reservation.
+    Reported(&'a [ModelUsage]),
+    /// The token was never lent, so nothing was used and nothing is billed.
+    NeverLent,
+}
+
+/// What `usage` costs at the table's prices: each entry at its model's price,
+/// and a model with no price at the dearest price the table holds, so an
+/// unknown name never bills less than any known one. `None` when the table
+/// prices nothing.
+fn lease_cost(prices: &PriceTable, usage: &[ModelUsage]) -> Option<u64> {
+    let dearest = |usage: &Usage| {
+        prices
+            .values()
+            .map(|price| cost_micro_usd(price, usage, None))
+            .max()
+    };
+    usage
+        .iter()
+        .map(|entry| match prices.get(&entry.model) {
+            Some(price) => Some(cost_micro_usd(price, &entry.usage, None)),
+            None => dearest(&entry.usage),
+        })
+        .try_fold(0_u64, |total, cost| Some(total.saturating_add(cost?)))
+}
+
+/// Why no lease was reserved. Nothing was written to the ledger.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LeaseRefusal {
+    /// The window's spend plus open reservations plus this one passes the
+    /// caller's ceiling.
+    SpendCeiling,
+    /// The reservation asked for is zero: a lease that bills nothing is a
+    /// free pass.
+    CostBound,
+    UnknownCaller,
+    /// The caller holds a lease already, or this run id was leased before.
+    Busy,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LeaseAdmission {
+    Granted(LeaseGrant),
+    Refused(LeaseRefusal),
+}
+
+impl TransportService {
+    /// Reserves `max_cost_micro_usd` in `caller_runtime_id`'s current window
+    /// for the unit invocation `invocation_id`, which leases once. A ledger
+    /// that cannot be written answers `Err` and reserves nothing. A lease takes no request slot.
+    pub fn begin_lease(
+        &mut self,
+        caller_runtime_id: &str,
+        invocation_id: &str,
+        max_cost_micro_usd: u64,
+        expires_at_unix_ms: u64,
+        now_unix_ms: u64,
+    ) -> Result<LeaseAdmission, ServiceError> {
+        let Some(caller) = self.callers.get(caller_runtime_id) else {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::UnknownCaller));
+        };
+        let spend_ceiling = caller.spend_ceiling_micro_usd;
+        let spend_window_ms = caller.spend_window_ms;
+        let connection_key_epoch = caller.connection_key_epoch;
+        require_id(invocation_id, "invocation_id")?;
+        if invocation_id.len() + LEASE_PREFIX.len() > MAX_IDENTITY_BYTES {
+            return Err(ContractError::Invalid("invocation_id").into());
+        }
+        if max_cost_micro_usd == 0 {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::CostBound));
+        }
+        let identity = RequestIdentity {
+            caller_runtime_id: caller_runtime_id.to_string(),
+            request_id: format!("{LEASE_PREFIX}{invocation_id}"),
+        };
+        let key = replay_key(&identity);
+        let holding = self
+            .live
+            .iter()
+            .any(|(held, request)| request.lease && held.caller_runtime_id == caller_runtime_id);
+        if holding
+            || self
+                .replay_store
+                .get::<ReplayRecord>(&key)
+                .map_err(replay_store_error)?
+                .is_some()
+        {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
+        }
+        let admitted_at_unix_ms = admission_clock(
+            &self.window_spend,
+            caller_runtime_id,
+            now_unix_ms,
+            spend_window_ms,
+        );
+        let window = admitted_at_unix_ms / spend_window_ms;
+        prune_windows(
+            &mut self.window_spend,
+            &self.live,
+            caller_runtime_id,
+            window,
+        );
+        if self
+            .window_spend(caller_runtime_id, window)
+            .saturating_add(max_cost_micro_usd)
+            > spend_ceiling
+        {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::SpendCeiling));
+        }
+        let mut digest = Sha256::new();
+        digest.update(b"claude_lease_request");
+        digest.update((invocation_id.len() as u64).to_be_bytes());
+        digest.update(invocation_id.as_bytes());
+        digest.update(max_cost_micro_usd.to_be_bytes());
+        digest.update(expires_at_unix_ms.to_be_bytes());
+        let record = ReplayRecord {
+            caller_runtime_id: caller_runtime_id.to_string(),
+            request_id: identity.request_id.clone(),
+            connection_key_epoch,
+            invocation_sha256: digest.finalize().into(),
+            expires_at_unix_ms,
+            state: ReplayState::Active {
+                reserved_micro_usd: max_cost_micro_usd,
+            },
+            admitted_at_unix_ms,
+        };
+        // Reserving and claiming are one write, as for a call: a ledger that
+        // cannot be written lends nothing.
+        self.replay_store
+            .put(key, &record)
+            .map_err(replay_store_error)?;
+        add_spend(
+            &mut self.window_spend,
+            caller_runtime_id,
+            window,
+            0,
+            max_cost_micro_usd,
+        );
+        let lease_id = identity.request_id.clone();
+        self.live.insert(
+            identity,
+            LiveRequest {
+                window,
+                reserved_micro_usd: max_cost_micro_usd,
+                lease: true,
+            },
+        );
+        Ok(LeaseAdmission::Granted(LeaseGrant {
+            lease_id,
+            reserved_micro_usd: max_cost_micro_usd,
+        }))
+    }
+
+    /// Settles an open lease and returns what it was billed. A report bills
+    /// the true cost of every model's reported use, uncapped (the overrun is
+    /// recorded); no report, or an empty one, bills the whole reservation;
+    /// only a token never lent bills nothing. A failed ledger
+    /// write frees the caller's lease and keeps the reservation counted, as a
+    /// call's does.
+    pub fn settle_lease(
+        &mut self,
+        caller_runtime_id: &str,
+        lease_id: &str,
+        usage: LeaseUse<'_>,
+    ) -> Result<LeaseSettlement, ServiceError> {
+        let identity = RequestIdentity {
+            caller_runtime_id: caller_runtime_id.to_string(),
+            request_id: lease_id.to_string(),
+        };
+        if !self
+            .live
+            .get(&identity)
+            .is_some_and(|request| request.lease)
+        {
+            return Err(ServiceError::NoActiveRequest);
+        }
+        let key = replay_key(&identity);
+        let active = self
+            .replay_store
+            .get::<ReplayRecord>(&key)
+            .map_err(replay_store_error)?
+            .ok_or(ServiceError::NoActiveRequest)?;
+        let ReplayState::Active { reserved_micro_usd } = active.state else {
+            return Err(ServiceError::ActiveRequestMismatch);
+        };
+        let caller = self
+            .callers
+            .get(caller_runtime_id)
+            .ok_or(ServiceError::CallerNotAdmitted)?;
+        let spend_window_ms = caller.spend_window_ms;
+        let charged_micro_usd = match usage {
+            LeaseUse::Reservation | LeaseUse::Reported([]) => reserved_micro_usd,
+            LeaseUse::NeverLent => 0,
+            LeaseUse::Reported(usage) => {
+                lease_cost(&self.prices, usage).unwrap_or(reserved_micro_usd)
+            }
+        };
+        let overrun_micro_usd = charged_micro_usd.saturating_sub(reserved_micro_usd);
+        let settled = ReplayRecord {
+            state: ReplayState::LeaseSettled {
+                charged_micro_usd,
+                overrun_micro_usd,
+            },
+            ..active.clone()
+        };
+        self.replay_store
+            .put(key, &settled)
+            .map_err(replay_store_error)
+            .inspect_err(|_| {
+                self.live.remove(&identity);
+            })?;
+        add_spend(
+            &mut self.window_spend,
+            caller_runtime_id,
+            active.admitted_at_unix_ms / spend_window_ms,
+            reserved_micro_usd,
+            charged_micro_usd,
+        );
+        self.live.remove(&identity);
+        prune_to_latest(&mut self.window_spend, &self.live, caller_runtime_id);
+        Ok(LeaseSettlement {
+            billed_micro_usd: charged_micro_usd,
+            overrun_micro_usd,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::Ordering;
+
+    use super::*;
+    use crate::fixtures::*;
+
+    const CALLER: &str = "eureka";
+    const KEY: &str = "lease-distinct-test-key";
+    const NOW: u64 = 7_200_500;
+
+    fn open_with(store: impl CacheBackingStore + 'static, ceiling: u64) -> TransportService {
+        TransportService::with_store(
+            store,
+            "fixture-sse",
+            fixture_prices(),
+            [CallerAdmission::new(
+                CALLER,
+                KEY,
+                1,
+                ["gpt-5.4".to_string()],
+                1,
+                65_536,
+                32_768,
+                SpendCeiling(ceiling),
+                SpendWindowMs(WINDOW_MS),
+            )
+            .unwrap()],
+            5_000,
+        )
+        .unwrap()
+    }
+
+    fn open(store: &TestStore, ceiling: u64) -> TransportService {
+        TransportService::open(
+            &store.path,
+            "fixture-sse",
+            fixture_prices(),
+            [CallerAdmission::new(
+                CALLER,
+                KEY,
+                1,
+                ["gpt-5.4".to_string()],
+                1,
+                65_536,
+                32_768,
+                SpendCeiling(ceiling),
+                SpendWindowMs(WINDOW_MS),
+            )
+            .unwrap()],
+            5_000,
+        )
+        .unwrap()
+    }
+
+    fn lease(service: &mut TransportService, run: &str, cost: u64) -> LeaseAdmission {
+        service
+            .begin_lease(CALLER, run, cost, NOW + 60_000, NOW)
+            .unwrap()
+    }
+
+    fn granted(admission: LeaseAdmission) -> LeaseGrant {
+        match admission {
+            LeaseAdmission::Granted(grant) => grant,
+            LeaseAdmission::Refused(why) => panic!("refused {why:?}"),
+        }
+    }
+
+    fn held(service: &TransportService) -> u64 {
+        service.window_spend(CALLER, NOW / WINDOW_MS)
+    }
+
+    fn output(tokens: u64) -> Vec<ModelUsage> {
+        used("gpt-5.4", tokens)
+    }
+
+    fn used(model: &str, tokens: u64) -> Vec<ModelUsage> {
+        vec![ModelUsage {
+            model: model.to_string(),
+            usage: Usage {
+                input_tokens: 0,
+                cache_read_tokens: 0,
+                cache_write_tokens: 0,
+                output_tokens: tokens,
+                reasoning_tokens: None,
+            },
+        }]
+    }
+
+    fn billed(settlement: LeaseSettlement) -> u64 {
+        settlement.billed_micro_usd
+    }
+
+    #[test]
+    fn a_lease_reserves_in_the_callers_window_and_names_what_it_holds() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000);
+        let grant = granted(lease(&mut service, "run-1", 600));
+        assert_eq!(grant.reserved_micro_usd, 600);
+        assert_eq!(held(&service), 600);
+        assert_eq!(
+            billed(
+                service
+                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
+                    .unwrap()
+            ),
+            600
+        );
+    }
+
+    #[test]
+    fn the_window_ceiling_counts_open_and_settled_reservations_inclusively() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000);
+        let first = granted(lease(&mut service, "run-1", 600));
+        service
+            .settle_lease(CALLER, &first.lease_id, LeaseUse::Reservation)
+            .unwrap();
+        assert_eq!(
+            lease(&mut service, "run-2", 401),
+            LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
+        );
+        assert_eq!(held(&service), 600);
+        granted(lease(&mut service, "run-3", 400));
+        assert_eq!(held(&service), 1_000);
+    }
+
+    #[test]
+    fn a_caller_holds_one_lease_at_a_time_and_an_invocation_id_is_leased_once() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000_000);
+        let first = granted(lease(&mut service, "run-1", 100));
+        assert_eq!(
+            lease(&mut service, "run-2", 100),
+            LeaseAdmission::Refused(LeaseRefusal::Busy)
+        );
+        service
+            .settle_lease(CALLER, &first.lease_id, LeaseUse::Reservation)
+            .unwrap();
+        assert_eq!(
+            lease(&mut service, "run-1", 100),
+            LeaseAdmission::Refused(LeaseRefusal::Busy)
+        );
+        granted(lease(&mut service, "run-2", 100));
+    }
+
+    #[test]
+    fn a_stranger_and_a_free_lease_are_refused_without_a_ledger_write() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000);
+        assert_eq!(
+            service
+                .begin_lease("stranger", "run-1", 100, NOW + 1, NOW)
+                .unwrap(),
+            LeaseAdmission::Refused(LeaseRefusal::UnknownCaller)
+        );
+        assert_eq!(
+            lease(&mut service, "run-1", 0),
+            LeaseAdmission::Refused(LeaseRefusal::CostBound)
+        );
+        assert_eq!(held(&service), 0);
+        // Nothing was claimed: the same run id leases once it asks sensibly.
+        granted(lease(&mut service, "run-1", 100));
+    }
+
+    #[test]
+    fn settlement_bills_the_true_cost_uncapped_and_records_the_overrun() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000_000);
+        // Output at 15 USD per million tokens: 10 tokens bill 150 micro-USD.
+        let small = granted(lease(&mut service, "run-1", 10_000));
+        let settled = service
+            .settle_lease(CALLER, &small.lease_id, LeaseUse::Reported(&output(10)[..]))
+            .unwrap();
+        assert_eq!(
+            (settled.billed_micro_usd, settled.overrun_micro_usd),
+            (150, 0)
+        );
+        assert_eq!(held(&service), 150);
+        // 1000 tokens bill 15_000: the reservation does not cap it, and the
+        // 5_000 past it is recorded as the overrun.
+        let big = granted(lease(&mut service, "run-2", 10_000));
+        let settled = service
+            .settle_lease(
+                CALLER,
+                &big.lease_id,
+                LeaseUse::Reported(&output(1_000)[..]),
+            )
+            .unwrap();
+        assert_eq!(
+            (settled.billed_micro_usd, settled.overrun_micro_usd),
+            (15_000, 5_000)
+        );
+        assert_eq!(held(&service), 15_150);
+    }
+
+    #[test]
+    fn settlement_prices_each_model_at_its_own_rate_and_an_unknown_model_at_the_dearest() {
+        let store = TestStore::new();
+        let cheap = ModelPrice {
+            rates: Rates {
+                input: 1_000_000,
+                cache_write_short: 1_000_000,
+                cache_write_long: 1_000_000,
+                cache_read: 1_000_000,
+                output: 2_000_000,
+            },
+            ..fixture_price()
+        };
+        let prices = PriceTable::from([
+            ("gpt-5.4".to_string(), fixture_price()),
+            ("cheap".to_string(), cheap),
+        ]);
+        let mut service = TransportService::open(
+            &store.path,
+            "fixture-sse",
+            prices,
+            [CallerAdmission::new(
+                CALLER,
+                KEY,
+                1,
+                ["gpt-5.4".to_string()],
+                1,
+                65_536,
+                32_768,
+                SpendCeiling(1_000_000),
+                SpendWindowMs(WINDOW_MS),
+            )
+            .unwrap()],
+            5_000,
+        )
+        .unwrap();
+        let mixed: Vec<ModelUsage> = [("gpt-5.4", 10), ("cheap", 10), ("unheard-of", 10)]
+            .into_iter()
+            .flat_map(|(model, tokens)| used(model, tokens))
+            .collect();
+        let grant = granted(lease(&mut service, "run-1", 10_000));
+        // 10 tokens at 15, 10 at 2, and 10 at the dearest (15) per million.
+        assert_eq!(
+            billed(
+                service
+                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&mixed[..]))
+                    .unwrap()
+            ),
+            150 + 20 + 150
+        );
+        // A run that reports no use pays the reservation, not nothing.
+        let grant = granted(lease(&mut service, "run-2", 10_000));
+        assert_eq!(
+            billed(
+                service
+                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&[]))
+                    .unwrap()
+            ),
+            10_000
+        );
+    }
+
+    #[test]
+    fn settling_an_empty_report_cannot_free_the_reservation() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000);
+        let grant = granted(lease(&mut service, "run-1", 600));
+        assert_eq!(
+            billed(
+                service
+                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&[]))
+                    .unwrap()
+            ),
+            600
+        );
+        assert_eq!(held(&service), 600);
+        assert!(matches!(
+            lease(&mut service, "run-2", 1_000),
+            LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
+        ));
+    }
+
+    #[test]
+    fn a_token_never_lent_bills_nothing_and_frees_the_window() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000);
+        let grant = granted(lease(&mut service, "run-1", 600));
+        let settled = service
+            .settle_lease(CALLER, &grant.lease_id, LeaseUse::NeverLent)
+            .unwrap();
+        assert_eq!(
+            (settled.billed_micro_usd, settled.overrun_micro_usd),
+            (0, 0)
+        );
+        assert_eq!(held(&service), 0);
+        granted(lease(&mut service, "run-2", 1_000));
+    }
+
+    #[test]
+    fn a_lease_settles_once() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000_000);
+        let grant = granted(lease(&mut service, "run-1", 100));
+        service
+            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
+            .unwrap();
+        assert!(matches!(
+            service.settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation),
+            Err(ServiceError::NoActiveRequest)
+        ));
+        assert_eq!(held(&service), 100);
+    }
+
+    #[test]
+    fn a_lease_left_open_by_a_crash_counts_at_its_reservation_after_restart() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000_000);
+        granted(lease(&mut service, "run-1", 700));
+        drop(service);
+        let service = open(&store, 1_000_000);
+        assert_eq!(held(&service), 700);
+    }
+
+    #[test]
+    fn a_ledger_that_cannot_be_written_lends_nothing() {
+        let flaky = FlakyStore::new(1_000);
+        let allowance = flaky.allowance();
+        let mut service = open_with(flaky, 1_000_000);
+        allowance.store(0, Ordering::SeqCst);
+        assert!(
+            service
+                .begin_lease(CALLER, "run-1", 100, NOW + 1, NOW)
+                .is_err()
+        );
+        assert_eq!(held(&service), 0);
+        allowance.store(1_000, Ordering::SeqCst);
+        granted(lease(&mut service, "run-1", 100));
+    }
+
+    #[test]
+    fn a_failed_settle_write_frees_the_lease_and_keeps_the_reservation_counted() {
+        let flaky = FlakyStore::new(1_000);
+        let allowance = flaky.allowance();
+        let mut service = open_with(flaky, 1_000_000);
+        let grant = granted(lease(&mut service, "run-1", 100));
+        allowance.store(0, Ordering::SeqCst);
+        assert!(
+            service
+                .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&output(1)[..]))
+                .is_err()
+        );
+        assert_eq!(held(&service), 100);
+        allowance.store(1_000, Ordering::SeqCst);
+        granted(lease(&mut service, "run-2", 100));
+    }
+
+    fn begin_call(service: &mut TransportService, id: &str) -> TransportAdmission {
+        let mut call = request();
+        call.request_id = id.to_string();
+        let invocation =
+            TransportInvocation::new(CALLER, NOW + 1_000, [7; 32], MAX_COST, call).unwrap();
+        let sealed = crate::envelope::encrypt_message(
+            CALLER,
+            id,
+            crate::envelope::EnvelopeKind::Invocation,
+            &crate::contract::wire_encode(&invocation).unwrap(),
+            &security(KEY),
+        )
+        .unwrap();
+        service.begin(&sealed, NOW, 1 << 20).unwrap()
+    }
+
+    #[test]
+    fn a_lease_takes_no_request_slot_from_the_callers_calls() {
+        // The caller admits one concurrent call; an open lease must not use it.
+        let store = TestStore::new();
+        let mut service = open(&store, 1 << 40);
+        granted(lease(&mut service, "run-1", 100));
+        match begin_call(&mut service, "call-1") {
+            TransportAdmission::Execute(_) => {}
+            TransportAdmission::Reply(_) => panic!("the lease held the call's slot"),
+        }
+    }
+
+    #[test]
+    fn a_call_in_flight_does_not_make_the_caller_busy_for_a_lease() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1 << 40);
+        assert!(matches!(
+            begin_call(&mut service, "call-1"),
+            TransportAdmission::Execute(_)
+        ));
+        granted(lease(&mut service, "run-1", 100));
+    }
+
+    #[test]
+    fn an_invocation_id_is_bounded_so_its_lease_id_fits_an_identity() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1 << 40);
+        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len());
+        let grant = granted(lease(&mut service, &longest, 100));
+        assert_eq!(grant.lease_id.len(), MAX_IDENTITY_BYTES);
+        service
+            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
+            .unwrap();
+        assert!(
+            service
+                .begin_lease(CALLER, &format!("{longest}r"), 100, NOW + 1, NOW)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn a_settled_lease_leaves_its_charge_not_its_reservation_across_a_restart() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1_000_000);
+        let grant = granted(lease(&mut service, "run-1", 10_000));
+        service
+            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&output(10)[..]))
+            .unwrap();
+        drop(service);
+        let service = open(&store, 1_000_000);
+        assert_eq!(held(&service), 150);
+    }
+}

From fdcfa063c7da6de1b0f3f21a677619cb2633bada Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 30 Oct 2026 00:11:53 +0100
Subject: [PATCH 10/37] connector-many-callers: one connector serves every Mind
 as its own caller; session handles are an HMAC under a connector secret over
 caller, session, instance, instructions, model and transcript prefix; config
 add-caller/add-lease-caller; one owner for distinct admissions (squash of
 eureka-body/connector-many-callers d1f25b5..a96b276; Soul s1-s2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |   1 +
 README.md                                     |   5 +-
 crates/claude-connector/Cargo.toml            |   1 +
 crates/claude-connector/src/backend.rs        |  83 ++-
 crates/claude-connector/src/backend/tests.rs  | 296 ++++++++++-
 crates/claude-connector/src/config.rs         |   3 +
 crates/claude-connector/src/daemon.rs         |  92 ++--
 crates/claude-connector/src/handle.rs         |  69 ++-
 crates/claude-connector/src/lib.rs            |   2 +-
 crates/claude-connector/src/main.rs           | 264 ++++++++--
 crates/claude-connector/src/quota.rs          |   2 +-
 .../claude-connector/tests/config_document.rs | 474 +++++++++++++++++-
 crates/model-connector/src/serve.rs           |  23 +-
 crates/model-connector/src/service.rs         |  63 ++-
 14 files changed, 1228 insertions(+), 150 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 524654e..5291d19 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -140,6 +140,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "cultcache-rs",
+ "hmac",
  "libc",
  "model-connector",
  "rmp-serde",
diff --git a/README.md b/README.md
index 3a12abd..c2e23c7 100644
--- a/README.md
+++ b/README.md
@@ -42,8 +42,9 @@ Crate `crates/claude-connector` (library only; the binary that wires it to `serv
   servers, no settings sources and the system prompt replaced. Tool-less turns only: a request
   with tools or a final tool result is refused before any spawn. A request's output schema goes
   to the CLI as `--json-schema` and the result's structured output is the one assistant text.
-- Reasoning state is a session handle (`ClaudeCodeHandle`); a handle that cannot be proven to
-  match the request re-seeds from the caller's transcript, and every resume forks.
+- Reasoning state is a session handle (`ClaudeCodeHandle`) authenticated with a connector secret
+  and bound to the caller it was minted for; a handle that cannot be proven to match the request
+  and its caller re-seeds from the caller's transcript, and every resume forks.
 - `ProcessPort` is the one OS seam (`StdProcessPort`, unix, kills the child's whole process
   group); `SessionStore` and `StderrSink` are the other ports. `ClaudeCodeConfig` is what the
   binary hands in; the credential is read from a systemd credential and reaches the child on a
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index 7f9b042..6592252 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/main.rs"
 
 [dependencies]
 anyhow = "1"
+hmac = "0.12"
 cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "a4eae9056152335662f1115f97bf35fb00ab6d23", package = "cultcache-rs" }
 model-connector = { path = "../model-connector", features = ["daemon"] }
 rmp-serde = "1"
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index 1963e1d..4833521 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -12,7 +12,9 @@ use sha2::{Digest, Sha256};
 use zeroize::Zeroizing;
 
 use crate::config::{ClaudeCodeConfig, PROVIDER};
-use crate::handle::{ClaudeCodeHandle, SessionStore, plan, prefix_digest, stdin_bytes};
+use crate::handle::{
+    Binding, ClaudeCodeHandle, MIN_SECRET_BYTES, SessionStore, plan, prefix_digest, stdin_bytes,
+};
 use crate::launch::{PromptFile, argv, child_env};
 use crate::process::{ProcessPort, RunningChild, StdoutRead};
 use crate::quota::QuotaCell;
@@ -36,6 +38,8 @@ pub trait TokenSource: Send + Sync {
 pub struct CredentialTokenSource {
     directory: Option<PathBuf>,
     name: String,
+    /// The configuration field `missing` names when the credential is absent.
+    field: &'static str,
 }
 
 impl CredentialTokenSource {
@@ -46,13 +50,21 @@ impl CredentialTokenSource {
         Self {
             directory: std::env::var_os("CREDENTIALS_DIRECTORY").map(PathBuf::from),
             name: name.into(),
+            field: "token_credential",
         }
     }
 
+    /// The same source, naming `field` when its credential is absent.
+    pub fn for_field(mut self, field: &'static str) -> Self {
+        self.field = field;
+        self
+    }
+
     pub fn in_directory(directory: impl Into<PathBuf>, name: impl Into<String>) -> Self {
         Self {
             directory: Some(directory.into()),
             name: name.into(),
+            field: "token_credential",
         }
     }
 }
@@ -72,7 +84,7 @@ impl TokenSource for CredentialTokenSource {
         if self.directory.is_none() {
             "credentials_directory"
         } else {
-            "token_credential"
+            self.field
         }
     }
 }
@@ -91,9 +103,17 @@ pub struct ClaudeCodeBackend {
     sessions: Box<dyn SessionStore>,
     sink: Box<dyn StderrSink>,
     tokens: Box<dyn TokenSource>,
+    handle_secret: Box<dyn TokenSource>,
     quota: Arc<QuotaCell>,
 }
 
+/// The handle secret, or `None` when it is absent or shorter than a key.
+fn usable_secret(source: &dyn TokenSource) -> Option<Zeroizing<String>> {
+    source
+        .read()
+        .filter(|secret| secret.len() >= MIN_SECRET_BYTES)
+}
+
 impl ClaudeCodeBackend {
     /// The backend over real processes and the CLI's real session store.
     #[cfg(unix)]
@@ -105,7 +125,11 @@ impl ClaudeCodeBackend {
         let tokens = Box::new(CredentialTokenSource::from_environment(
             config.token_credential.clone(),
         ));
-        Self::with_ports(config, port, sessions, sink, tokens)
+        let handle_secret = Box::new(
+            CredentialTokenSource::from_environment(config.handle_secret_credential.clone())
+                .for_field("handle_secret_credential"),
+        );
+        Self::with_ports(config, port, sessions, sink, tokens, handle_secret)
     }
 
     pub fn with_ports(
@@ -114,6 +138,7 @@ impl ClaudeCodeBackend {
         sessions: Box<dyn SessionStore>,
         sink: Box<dyn StderrSink>,
         tokens: Box<dyn TokenSource>,
+        handle_secret: Box<dyn TokenSource>,
     ) -> Self {
         Self {
             config,
@@ -121,6 +146,7 @@ impl ClaudeCodeBackend {
             sessions,
             sink,
             tokens,
+            handle_secret,
             quota: Arc::new(QuotaCell::new()),
         }
     }
@@ -136,8 +162,25 @@ impl ClaudeCodeBackend {
         binary_matches_pin(&self.config)
     }
 
-    fn run(&self, request: &ProviderRequest) -> (Vec<TransportEvent>, TransportOutcome) {
-        let plan = match plan(request, &self.config, self.sessions.as_ref()) {
+    fn run(
+        &self,
+        request: &ProviderRequest,
+        caller: &str,
+    ) -> (Vec<TransportEvent>, TransportOutcome) {
+        let Some(secret) = usable_secret(self.handle_secret.as_ref()) else {
+            return failed(
+                FailureKind::Authentication,
+                "claude-code: the connector has no handle secret".to_string(),
+                Some(zero_usage()),
+            );
+        };
+        let plan = match plan(
+            request,
+            &self.config,
+            secret.as_bytes(),
+            caller,
+            self.sessions.as_ref(),
+        ) {
             Ok(plan) => plan,
             Err(error) => {
                 return failed(
@@ -198,7 +241,7 @@ impl ClaudeCodeBackend {
         }
 
         match finished {
-            Ok(finished) => self.completed(request, finished),
+            Ok(finished) => self.completed(request, caller, secret.as_bytes(), finished),
             Err(failure_) => failure(failure_),
         }
     }
@@ -206,6 +249,8 @@ impl ClaudeCodeBackend {
     fn completed(
         &self,
         request: &ProviderRequest,
+        caller: &str,
+        secret: &[u8],
         finished: Finished,
     ) -> (Vec<TransportEvent>, TransportOutcome) {
         let mut payloads: Vec<TransportEventPayload> = finished
@@ -226,9 +271,19 @@ impl ClaudeCodeBackend {
         // and whatever follows it is seeded from the caller's transcript.
         if request.output_schema_json.is_none() {
             let handle = ClaudeCodeHandle::Ended {
-                session_id: finished.session_id,
+                session_id: finished.session_id.clone(),
                 instance: self.config.instance.clone(),
-                prefix_sha256: prefix_digest(&request.instructions, &request.model, &prefix),
+                prefix_sha256: prefix_digest(
+                    secret,
+                    &Binding {
+                        caller,
+                        instructions: &request.instructions,
+                        model: &request.model,
+                        session_id: &finished.session_id,
+                        instance: &self.config.instance,
+                        items: &prefix,
+                    },
+                ),
             };
             payloads.push(TransportEventPayload::ReasoningState {
                 state: handle.encode(),
@@ -256,7 +311,11 @@ impl ClaudeCodeBackend {
 
 impl ProviderBackend for ClaudeCodeBackend {
     fn ready(&self) -> Result<(), &'static str> {
-        readiness(&self.config, self.tokens.as_ref())
+        readiness(
+            &self.config,
+            self.tokens.as_ref(),
+            self.handle_secret.as_ref(),
+        )
     }
 
     fn provider(&self) -> &str {
@@ -264,7 +323,7 @@ impl ProviderBackend for ClaudeCodeBackend {
     }
 
     fn execute(&self, call: &ProviderCall) -> TransportResult {
-        let (events, outcome) = self.run(call.request());
+        let (events, outcome) = self.run(call.request(), call.caller_runtime_id());
         call.transported(events, outcome)
     }
 
@@ -327,6 +386,7 @@ fn binary_matches_pin(config: &ClaudeCodeConfig) -> bool {
 pub(crate) fn readiness(
     config: &ClaudeCodeConfig,
     tokens: &dyn TokenSource,
+    handle_secret: &dyn TokenSource,
 ) -> Result<(), &'static str> {
     if !config.work_dir.is_dir() {
         return Err("work_dir");
@@ -342,6 +402,9 @@ pub(crate) fn readiness(
     }
     // Last: outside the unit the credential is the one thing always absent,
     // and it must not hide the faults the document itself has.
+    if usable_secret(handle_secret).is_none() {
+        return Err(handle_secret.missing());
+    }
     if tokens.read().is_none() {
         return Err(tokens.missing());
     }
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 2e3b993..fc2be99 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -333,6 +333,7 @@ fn config(dir: &Path, instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeCon
         config_dir: PathBuf::from("/cfg"),
         prompt_dir: dir.join("prompts"),
         token_credential: "claude-token".to_string(),
+        handle_secret_credential: "claude-handle-secret".to_string(),
         instance: instance.to_string(),
         limits,
     }
@@ -351,6 +352,26 @@ fn canary_token() -> Box<dyn TokenSource> {
     Box::new(FixedToken(Some(CANARY_TOKEN)))
 }
 
+/// A handle secret source with a fixed answer; it names its own field.
+struct FixedSecret(Option<&'static str>);
+
+impl TokenSource for FixedSecret {
+    fn read(&self) -> Option<Zeroizing<String>> {
+        self.0.map(|secret| Zeroizing::new(secret.to_string()))
+    }
+
+    fn missing(&self) -> &'static str {
+        "handle_secret_credential"
+    }
+}
+
+const SECRET: &str = "handle-secret-0000000000000000000000000000000000000000000000";
+const OTHER_SECRET: &str = "handle-secret-1111111111111111111111111111111111111111111111";
+
+fn canary_secret() -> Box<dyn TokenSource> {
+    Box::new(FixedSecret(Some(SECRET)))
+}
+
 fn limits() -> ClaudeCodeLimits {
     ClaudeCodeLimits {
         deadline: Duration::from_secs(30),
@@ -369,6 +390,16 @@ struct Rig {
 }
 
 fn rig_for(instance: &str, scripts: Vec<Script>, sessions: &[&str], stderr: &[u8]) -> Rig {
+    rig_with_secret(instance, scripts, sessions, stderr, Some(SECRET))
+}
+
+fn rig_with_secret(
+    instance: &str,
+    scripts: Vec<Script>,
+    sessions: &[&str],
+    stderr: &[u8],
+    secret: Option<&'static str>,
+) -> Rig {
     let spawns = Arc::new(AtomicUsize::new(0));
     let seen = Arc::new(Mutex::new(Seen::default()));
     let sink = Sink::default();
@@ -385,6 +416,7 @@ fn rig_for(instance: &str, scripts: Vec<Script>, sessions: &[&str], stderr: &[u8
         Box::new(Sessions(sessions.iter().map(|s| s.to_string()).collect())),
         Box::new(sink.clone()),
         canary_token(),
+        Box::new(FixedSecret(secret)),
     );
     Rig {
         dir,
@@ -401,8 +433,11 @@ fn rig(scripts: Vec<Script>) -> Rig {
 
 impl Rig {
     fn run(&self, request: ProviderRequest) -> TransportResult {
+        self.run_as(CALLER_1, request)
+    }
+    fn run_as(&self, caller: &str, request: ProviderRequest) -> TransportResult {
         let mut door = Door::new();
-        let (claim, _) = door.begin(request);
+        let (claim, _) = door.begin_as(caller, request);
         self.backend.execute(claim.call())
     }
     fn seen(&self) -> Seen {
@@ -417,10 +452,12 @@ impl Rig {
 
 static DOOR_SEQUENCE: AtomicUsize = AtomicUsize::new(0);
 
+const CALLER_1: &str = "caller-1";
+const CALLER_2: &str = "caller-2";
+
 struct Door {
     dir: PathBuf,
     service: TransportService,
-    key: TransportKey,
 }
 
 fn prices() -> PriceTable {
@@ -450,35 +487,42 @@ impl Door {
             DOOR_SEQUENCE.fetch_add(1, Ordering::SeqCst)
         ));
         std::fs::create_dir_all(&dir).unwrap();
-        let caller = CallerAdmission::new(
-            "caller-1",
-            "caller-1-key",
-            1,
-            [MODEL.to_string(), OTHER_MODEL.to_string()],
-            4,
-            FRAME / 2,
-            32_768,
-            SpendCeiling(1 << 40),
-            SpendWindowMs(3_600_000),
-        )
-        .unwrap();
+        let callers = [CALLER_1, CALLER_2].map(|id| {
+            CallerAdmission::new(
+                id,
+                format!("{id}-key"),
+                1,
+                [MODEL.to_string(), OTHER_MODEL.to_string()],
+                4,
+                FRAME / 2,
+                32_768,
+                SpendCeiling(1 << 40),
+                SpendWindowMs(3_600_000),
+            )
+            .unwrap()
+        });
         let service =
-            TransportService::open(&dir.join("replay.cc"), PROVIDER, prices(), [caller], 5_000)
+            TransportService::open(&dir.join("replay.cc"), PROVIDER, prices(), callers, 5_000)
                 .unwrap();
-        Self {
-            dir,
-            service,
-            key: TransportKey::from_connection_secret("caller-1-key").unwrap(),
-        }
+        Self { dir, service }
     }
 
     fn begin(
         &mut self,
         request: ProviderRequest,
     ) -> (model_connector::ExecutionClaim, TransportInvocation) {
+        self.begin_as(CALLER_1, request)
+    }
+
+    fn begin_as(
+        &mut self,
+        caller: &str,
+        request: ProviderRequest,
+    ) -> (model_connector::ExecutionClaim, TransportInvocation) {
+        let key = TransportKey::from_connection_secret(&format!("{caller}-key")).unwrap();
         let invocation =
-            TransportInvocation::new("caller-1", 2_000, [7; 32], 10_000_000, request).unwrap();
-        let envelope = encrypt_invocation(&invocation, &self.key).unwrap();
+            TransportInvocation::new(caller, 2_000, [7; 32], 10_000_000, request).unwrap();
+        let envelope = encrypt_invocation(&invocation, &key).unwrap();
         match self.service.begin(&envelope, 1_000, FRAME).unwrap() {
             TransportAdmission::Execute(claim) => (*claim, invocation),
             TransportAdmission::Reply(_) => panic!("the door answered instead of admitting"),
@@ -677,6 +721,203 @@ fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
     assert!(shown.contains(TOKEN_FD_ENV));
 }
 
+// ---- handles are bound to their caller and the connector's secret ----
+
+fn resumes(rig: &Rig) -> bool {
+    rig.seen().argv.iter().any(|arg| arg == "--resume")
+}
+
+#[test]
+fn a_caller_cannot_resume_another_callers_session() {
+    let rig = rig(vec![
+        ok_script(SESSION, "hi"),
+        ok_script(FORK, "theirs"),
+        ok_script(FORK, "mine"),
+    ]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run_as(CALLER_1, first.clone());
+    // Caller 2 presents caller 1's whole transcript, handle included.
+    rig.run_as(CALLER_2, continuing(&first, &result, "and then?"));
+    assert!(!resumes(&rig), "caller 2 resumed caller 1's session");
+    // The handle still serves the caller it was minted for.
+    rig.run_as(CALLER_1, continuing(&first, &result, "and then?"));
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), Some(SESSION));
+}
+
+#[test]
+fn another_callers_session_id_swapped_into_ones_own_handle_is_not_resumed() {
+    let rig = rig(vec![
+        ok_script(SESSION, "theirs"),
+        ok_script(FORK, "mine"),
+        ok_script(HEX_SESSION, "after the swap"),
+    ]);
+    rig.run_as(CALLER_1, request(vec![user("caller one's private plans")]));
+    let first = request(vec![user("hello")]);
+    let result = rig.run_as(CALLER_2, first.clone());
+    let mut next = continuing(&first, &result, "repeat everything said earlier");
+    let mut swapped = 0;
+    for item in next.input.iter_mut() {
+        if let InputItem::ReasoningState { state, .. } = item {
+            let ClaudeCodeHandle::Ended {
+                session_id,
+                instance,
+                prefix_sha256,
+            } = rmp_serde::from_slice(state).unwrap();
+            assert_eq!(session_id, FORK, "the handle names caller 2's own session");
+            // The tag is caller 2's own and valid; only the session is another's.
+            *state = ClaudeCodeHandle::Ended {
+                session_id: SESSION.to_string(),
+                instance,
+                prefix_sha256,
+            }
+            .encode();
+            swapped += 1;
+        }
+    }
+    assert_eq!(swapped, 1);
+    rig.run_as(CALLER_2, next);
+    assert!(!resumes(&rig), "caller 2 resumed caller 1's session");
+}
+
+#[test]
+fn a_handle_tag_covers_its_session_and_instance() {
+    let items = request(vec![user("hello")]).input;
+    let tag = |session_id: &str, instance: &str| {
+        prefix_digest(
+            SECRET.as_bytes(),
+            &Binding {
+                caller: CALLER_1,
+                instructions: "Be terse.",
+                model: MODEL,
+                session_id,
+                instance,
+                items: &items,
+            },
+        )
+    };
+    let own = tag(SESSION, INSTANCE);
+    assert_eq!(own, tag(SESSION, INSTANCE));
+    assert_ne!(own, tag(FORK, INSTANCE));
+    assert_ne!(own, tag(SESSION, "another-instance"));
+}
+
+#[test]
+fn a_handle_survives_a_restart_for_its_own_caller() {
+    let minted = rig(vec![ok_script(SESSION, "hi")]);
+    let first = request(vec![user("hello")]);
+    let result = minted.run_as(CALLER_2, first.clone());
+    drop(minted);
+    let restarted = rig(vec![ok_script(FORK, "again")]);
+    restarted.run_as(CALLER_2, continuing(&first, &result, "next"));
+    assert_eq!(arg_after(&restarted.seen().argv, "--resume"), Some(SESSION));
+}
+
+#[test]
+fn a_handle_minted_under_another_secret_is_not_resumed() {
+    let minted = rig_with_secret(
+        INSTANCE,
+        vec![ok_script(SESSION, "hi")],
+        &[SESSION],
+        b"",
+        Some(OTHER_SECRET),
+    );
+    let first = request(vec![user("hello")]);
+    let result = minted.run(first.clone());
+    let other = rig(vec![ok_script(FORK, "again")]);
+    other.run(continuing(&first, &result, "next"));
+    assert!(!resumes(&other));
+}
+
+#[test]
+fn a_forged_handle_is_not_resumed() {
+    let first = request(vec![user("hello"), assistant("hi")]);
+    let forged = |tag: [u8; 32]| {
+        let handle = ClaudeCodeHandle::Ended {
+            session_id: SESSION.to_string(),
+            instance: INSTANCE.to_string(),
+            prefix_sha256: tag,
+        };
+        let mut input = first.input.clone();
+        input.push(InputItem::ReasoningState {
+            provider: PROVIDER.into(),
+            model: MODEL.into(),
+            state: handle.encode(),
+        });
+        input.push(user("next"));
+        request(input)
+    };
+    // No secret: the same digest, unkeyed, and a guess.
+    let bound = Binding {
+        caller: CALLER_1,
+        instructions: "Be terse.",
+        model: MODEL,
+        session_id: SESSION,
+        instance: INSTANCE,
+        items: &first.input,
+    };
+    let unkeyed = prefix_digest(b"", &bound);
+    let right_for_other_secret = prefix_digest(OTHER_SECRET.as_bytes(), &bound);
+    for tag in [unkeyed, right_for_other_secret, [0; 32]] {
+        let rig = rig(vec![ok_script(FORK, "x")]);
+        rig.run(forged(tag));
+        assert!(!resumes(&rig));
+    }
+    // The same request with the real tag resumes: the forgery failed on the tag alone.
+    let real = prefix_digest(SECRET.as_bytes(), &bound);
+    let rig = rig(vec![ok_script(FORK, "x")]);
+    rig.run(forged(real));
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), Some(SESSION));
+}
+
+#[test]
+fn no_usable_handle_secret_fails_before_spawn_and_is_not_ready() {
+    for secret in [None, Some("too-short")] {
+        let rig = rig_with_secret(
+            INSTANCE,
+            vec![ok_script(SESSION, "hi")],
+            &[SESSION],
+            b"",
+            secret,
+        );
+        let (kind, message, usage) = failure_of(&rig.run(request(vec![user("hello")])));
+        assert_eq!(kind, FailureKind::Authentication);
+        assert_eq!(usage, Some(usage_zero()));
+        assert!(!message.contains("too-short"));
+        assert_eq!(rig.spawns(), 0);
+    }
+}
+
+#[test]
+fn ready_wants_a_handle_secret_of_key_length() {
+    let dir = sandbox();
+    let (work, cfg) = (dir.path().join("work"), dir.path().join("cfg"));
+    std::fs::create_dir_all(&work).unwrap();
+    std::fs::create_dir_all(&cfg).unwrap();
+    for (secret, ready) in [
+        (None, Err("handle_secret_credential")),
+        (Some("too-short"), Err("handle_secret_credential")),
+        (Some(SECRET), Ok(())),
+    ] {
+        let mut config = config(dir.path(), INSTANCE, limits());
+        config.work_dir = work.clone();
+        config.config_dir = cfg.clone();
+        let backend = ClaudeCodeBackend::with_ports(
+            config,
+            Box::new(ScriptedPort {
+                scripts: Mutex::new(VecDeque::new()),
+                spawns: Arc::new(AtomicUsize::new(0)),
+                seen: Arc::new(Mutex::new(Seen::default())),
+                stderr: Vec::new(),
+            }),
+            Box::new(Sessions(vec![])),
+            Box::new(Sink::default()),
+            canary_token(),
+            Box::new(FixedSecret(secret)),
+        );
+        assert_eq!(backend.ready(), ready);
+    }
+}
+
 // ---- ready ----
 
 /// A backend over a scripted port that never has a script: `ready` runs nothing.
@@ -692,6 +933,7 @@ fn ready_backend(config: ClaudeCodeConfig, tokens: Box<dyn TokenSource>) -> Clau
         Box::new(Sessions(vec![])),
         Box::new(Sink::default()),
         tokens,
+        canary_secret(),
     )
 }
 
@@ -796,6 +1038,7 @@ fn token_comes_from_the_credential_file_not_the_environment() {
             &credentials,
             "claude-token",
         )),
+        canary_secret(),
     );
     let mut door = Door::new();
 
@@ -1464,6 +1707,7 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
         Box::new(Sessions(vec![])),
         Box::new(Sink::default()),
         canary_token(),
+        canary_secret(),
     );
     let mut door = Door::new();
     let (claim, _) = door.begin(request(vec![user("hi")]));
@@ -1489,7 +1733,12 @@ fn backend_end_to_end_through_the_service() {
     let (claim, invocation) = door.begin(request(vec![user("hello")]));
     let result = rig.backend.execute(claim.call());
     let sealed = door.service.complete(claim, result, FRAME).unwrap();
-    let opened = decrypt_result(&sealed, &door.key, &invocation).unwrap();
+    let opened = decrypt_result(
+        &sealed,
+        &TransportKey::from_connection_secret("caller-1-key").unwrap(),
+        &invocation,
+    )
+    .unwrap();
     let (events, receipt) = parts(&opened);
     assert_eq!(receipt.provider, "claude-code");
     assert_eq!(receipt.model, MODEL);
@@ -2053,6 +2302,7 @@ mod real {
             Box::new(FsSessionStore::new(config.config_dir.clone())),
             Box::new(sink.clone()),
             canary_token(),
+            canary_secret(),
         );
         Fake {
             _guard: guard,
diff --git a/crates/claude-connector/src/config.rs b/crates/claude-connector/src/config.rs
index 3bd0e1f..9c0f239 100644
--- a/crates/claude-connector/src/config.rs
+++ b/crates/claude-connector/src/config.rs
@@ -25,6 +25,9 @@ pub struct ClaudeCodeConfig {
     /// The name of the systemd credential that holds the child's token, under
     /// `$CREDENTIALS_DIRECTORY`.
     pub token_credential: String,
+    /// The name of the systemd credential that holds the handle secret: the
+    /// key every handle is authenticated with.
+    pub handle_secret_credential: String,
     /// The connector instance id written into every handle.
     pub instance: String,
     pub limits: ClaudeCodeLimits,
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 9f549fc..0e3c5e8 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -31,8 +31,8 @@ const MODEL_PREFIX: &str = "claude-";
 
 /// A unix account that may lease the subscription token for a Self run, the
 /// Self unit (`mind-self@<unit_instance>.service`) its process must run in,
-/// the caller whose spend window its leases reserve in, and what each lease
-/// reserves there.
+/// the configured caller whose spend window its leases reserve in, and what
+/// each lease reserves there.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LeaseCallerConfig {
     pub unix_user: String,
@@ -82,7 +82,9 @@ pub struct ClaudeConnectorConfig {
     pub socket_timeout_ms: u64,
     #[cultcache(key = 16)]
     pub max_expiry_skew_ms: u64,
-    /// Exactly one caller until claude-handle-caller-binding lands.
+    /// Every caller of this connector: its own connection key and epoch, models,
+    /// concurrency, payload and output bounds, and spend ceiling and window.
+    /// Ids are unique. Handles are bound to the caller that was given them.
     #[cultcache(key = 17)]
     pub callers: Vec<CallerConfig>,
     /// What each allowed model costs. The keys are the known list of models:
@@ -100,6 +102,10 @@ pub struct ClaudeConnectorConfig {
     /// The furthest a lease's expiry may lie from now.
     #[cultcache(key = 21)]
     pub lease_max_ms: u64,
+    /// The name of the systemd credential that holds the handle secret (at
+    /// least 32 bytes), the key every handle is authenticated with.
+    #[cultcache(key = 22)]
+    pub handle_secret_credential: String,
 }
 
 /// A refusal. It names the field or stage that failed and nothing the
@@ -180,6 +186,11 @@ impl ClaudeConnectorConfig {
         if !is_credential_name(&self.token_credential) {
             return Err(ConfigError::Invalid("token_credential"));
         }
+        if !is_credential_name(&self.handle_secret_credential)
+            || self.handle_secret_credential == self.token_credential
+        {
+            return Err(ConfigError::Invalid("handle_secret_credential"));
+        }
         if self.deadline_ms == 0
             || self.max_line_bytes == 0
             || self.max_total_bytes < self.max_line_bytes
@@ -194,37 +205,43 @@ impl ClaudeConnectorConfig {
         {
             return Err(ConfigError::Invalid("serve limits"));
         }
-        let [caller] = self.callers.as_slice() else {
+        if self.callers.is_empty() {
             return Err(ConfigError::Invalid("callers"));
-        };
-        if !is_trimmed_nonempty(&caller.caller_runtime_id) {
-            return Err(ConfigError::Invalid("caller_runtime_id"));
         }
-        if !caller.connection_key_file.is_absolute() {
-            return Err(ConfigError::Invalid("connection_key_file"));
-        }
-        if caller.connection_key_epoch == 0 {
-            return Err(ConfigError::Invalid("connection_key_epoch"));
-        }
-        if caller.max_concurrent_requests == 0
-            || caller.max_payload_bytes < MIN_PAYLOAD_BYTES
-            || caller.max_output_tokens == 0
-            || caller.spend_ceiling_micro_usd == 0
-            || caller.spend_window_ms == 0
-        {
-            return Err(ConfigError::Invalid("caller bounds"));
-        }
-        if caller.allowed_models.is_empty() {
-            return Err(ConfigError::Invalid("allowed_models"));
-        }
-        let mut seen = BTreeSet::new();
-        for model in &caller.allowed_models {
-            if !has_model_id_form(model)
-                || !seen.insert(model.as_str())
-                || !self.prices.contains_key(model)
+        let mut ids = BTreeSet::new();
+        for caller in &self.callers {
+            if !is_trimmed_nonempty(&caller.caller_runtime_id) {
+                return Err(ConfigError::Invalid("caller_runtime_id"));
+            }
+            if !ids.insert(caller.caller_runtime_id.as_str()) {
+                return Err(ConfigError::Invalid("callers"));
+            }
+            if !caller.connection_key_file.is_absolute() {
+                return Err(ConfigError::Invalid("connection_key_file"));
+            }
+            if caller.connection_key_epoch == 0 {
+                return Err(ConfigError::Invalid("connection_key_epoch"));
+            }
+            if caller.max_concurrent_requests == 0
+                || caller.max_payload_bytes < MIN_PAYLOAD_BYTES
+                || caller.max_output_tokens == 0
+                || caller.spend_ceiling_micro_usd == 0
+                || caller.spend_window_ms == 0
             {
+                return Err(ConfigError::Invalid("caller bounds"));
+            }
+            if caller.allowed_models.is_empty() {
                 return Err(ConfigError::Invalid("allowed_models"));
             }
+            let mut seen = BTreeSet::new();
+            for model in &caller.allowed_models {
+                if !has_model_id_form(model)
+                    || !seen.insert(model.as_str())
+                    || !self.prices.contains_key(model)
+                {
+                    return Err(ConfigError::Invalid("allowed_models"));
+                }
+            }
         }
         if !self
             .prices
@@ -233,11 +250,11 @@ impl ClaudeConnectorConfig {
         {
             return Err(ConfigError::Invalid("prices"));
         }
-        self.validate_leases(&caller.caller_runtime_id, caller.spend_ceiling_micro_usd)?;
+        self.validate_leases()?;
         Ok(listen)
     }
 
-    fn validate_leases(&self, caller_id: &str, spend_ceiling: u64) -> Result<(), ConfigError> {
+    fn validate_leases(&self) -> Result<(), ConfigError> {
         let Some(socket) = &self.lease_socket else {
             return if self.lease_callers.is_empty() {
                 Ok(())
@@ -255,9 +272,15 @@ impl ClaudeConnectorConfig {
         if self.lease_callers.is_empty()
             || !self.lease_callers.iter().all(|lease| {
                 is_trimmed_nonempty(&lease.unix_user)
-                    && lease.caller_id == caller_id
+                    && self
+                        .callers
+                        .iter()
+                        .find(|caller| caller.caller_runtime_id == lease.caller_id)
+                        .is_some_and(|caller| {
+                            (1..=caller.spend_ceiling_micro_usd)
+                                .contains(&lease.reservation_micro_usd)
+                        })
                     && is_unit_instance(&lease.unit_instance)
-                    && (1..=spend_ceiling).contains(&lease.reservation_micro_usd)
                     && users.insert(lease.unix_user.as_str())
             })
         {
@@ -274,6 +297,7 @@ impl ClaudeConnectorConfig {
             config_dir: self.config_dir.clone(),
             prompt_dir: self.prompt_dir.clone(),
             token_credential: self.token_credential.clone(),
+            handle_secret_credential: self.handle_secret_credential.clone(),
             instance: self.instance.clone(),
             limits: ClaudeCodeLimits {
                 deadline: Duration::from_millis(self.deadline_ms),
@@ -458,6 +482,8 @@ fn readiness_of(config: &ClaudeConnectorConfig) -> Result<Vec<CallerAdmission>,
     readiness(
         &backend,
         &CredentialTokenSource::from_environment(backend.token_credential.clone()),
+        &CredentialTokenSource::from_environment(backend.handle_secret_credential.clone())
+            .for_field("handle_secret_credential"),
     )
     .map_err(ConfigError::Unusable)?;
     if config.lease_socket.is_some() {
diff --git a/crates/claude-connector/src/handle.rs b/crates/claude-connector/src/handle.rs
index 222b74b..30cf6cf 100644
--- a/crates/claude-connector/src/handle.rs
+++ b/crates/claude-connector/src/handle.rs
@@ -5,9 +5,10 @@
 
 use std::path::PathBuf;
 
+use hmac::{Hmac, Mac};
 use model_connector::{InputItem, ProviderRequest};
 use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
+use sha2::Sha256;
 
 use crate::config::{ClaudeCodeConfig, PROVIDER};
 
@@ -16,9 +17,11 @@ use crate::config::{ClaudeCodeConfig, PROVIDER};
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub(crate) enum ClaudeCodeHandle {
-    /// The session a finished turn left behind. `prefix_sha256` is the digest
-    /// of the instructions, the model and every transcript item that precedes
-    /// this handle.
+    /// The session a finished turn left behind. `prefix_sha256` is the
+    /// HMAC-SHA-256, keyed with the connector's handle secret, of the caller
+    /// that minted the handle, the instructions, the model, this session and
+    /// instance, and every transcript item that precedes this handle. Another caller, or anyone
+    /// without the secret, cannot produce or satisfy it.
     Ended {
         session_id: String,
         instance: String,
@@ -36,12 +39,43 @@ impl ClaudeCodeHandle {
     }
 }
 
-/// The digest a handle binds: named MessagePack of the instructions, the model
-/// and the transcript items before the handle.
-pub(crate) fn prefix_digest(instructions: &str, model: &str, items: &[InputItem]) -> [u8; 32] {
-    let bytes =
-        rmp_serde::to_vec_named(&(instructions, model, items)).expect("strings and bytes encode");
-    Sha256::digest(bytes).into()
+/// The smallest handle secret the connector accepts, in bytes.
+pub const MIN_SECRET_BYTES: usize = 32;
+
+/// Everything a handle's tag binds: the minting caller, the instructions, the
+/// model, the session and instance the handle names, and the transcript items
+/// before the handle. Swapping any of them into a valid handle breaks the tag.
+pub(crate) struct Binding<'a> {
+    pub(crate) caller: &'a str,
+    pub(crate) instructions: &'a str,
+    pub(crate) model: &'a str,
+    pub(crate) session_id: &'a str,
+    pub(crate) instance: &'a str,
+    pub(crate) items: &'a [InputItem],
+}
+
+fn prefix_mac(secret: &[u8], binding: &Binding<'_>) -> Hmac<Sha256> {
+    let bytes = rmp_serde::to_vec_named(&(
+        binding.caller,
+        binding.instructions,
+        binding.model,
+        binding.session_id,
+        binding.instance,
+        binding.items,
+    ))
+    .expect("strings and bytes encode");
+    let mut mac = Hmac::<Sha256>::new_from_slice(secret).expect("an HMAC key has any length");
+    mac.update(&bytes);
+    mac
+}
+
+/// The tag a handle carries: keyed named MessagePack of its [`Binding`].
+pub(crate) fn prefix_digest(secret: &[u8], binding: &Binding<'_>) -> [u8; 32] {
+    prefix_mac(secret, binding).finalize().into_bytes().into()
+}
+
+fn prefix_matches(secret: &[u8], binding: &Binding<'_>, tag: &[u8; 32]) -> bool {
+    prefix_mac(secret, binding).verify_slice(tag).is_ok()
 }
 
 /// Whether the CLI's session store still holds a session.
@@ -121,6 +155,8 @@ impl Plan {
 pub(crate) fn plan(
     request: &ProviderRequest,
     config: &ClaudeCodeConfig,
+    secret: &[u8],
+    caller: &str,
     sessions: &dyn SessionStore,
 ) -> Result<Plan, PlanError> {
     if !request.tools.is_empty() {
@@ -174,7 +210,18 @@ pub(crate) fn plan(
             .all(|item| matches!(item, InputItem::UserText { .. }));
         let resumable = instance == config.instance
             && tail_is_user_text
-            && prefix_sha256 == prefix_digest(&request.instructions, &request.model, &input[..at])
+            && prefix_matches(
+                secret,
+                &Binding {
+                    caller,
+                    instructions: &request.instructions,
+                    model: &request.model,
+                    session_id: &session_id,
+                    instance: &instance,
+                    items: &input[..at],
+                },
+                &prefix_sha256,
+            )
             && sessions.exists(&session_id);
         if resumable {
             return Ok(Plan::Resume {
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 22ff46f..6ed8757 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -23,7 +23,7 @@ pub use daemon::{
 };
 #[cfg(unix)]
 pub use daemon::{check_prompt_dir, serve_config};
-pub use handle::{FsSessionStore, SessionStore};
+pub use handle::{FsSessionStore, MIN_SECRET_BYTES, SessionStore};
 pub use launch::ChildEnv;
 #[cfg(target_os = "linux")]
 pub use lease::{
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index 0ea296f..e7f28bc 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -2,6 +2,8 @@
 //!
 //!   claude-connector serve --config PATH.cc
 //!   claude-connector config init PATH.cc --flag value ...
+//!   claude-connector config add-caller PATH.cc --caller-id ID --connection-key-file F ...
+//!   claude-connector config add-lease-caller PATH.cc --lease-user U --caller-id ID ...
 //!   claude-connector config check PATH.cc
 //!
 //! `serve` takes its configuration from the typed document alone. The flags of
@@ -13,7 +15,8 @@ use std::path::PathBuf;
 use std::process::ExitCode;
 
 use claude_connector::{
-    ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, check_ready, load_config, write_config,
+    ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, MIN_SECRET_BYTES, check_ready,
+    load_config, write_config,
 };
 use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
 
@@ -23,6 +26,8 @@ fn main() -> ExitCode {
     let result = match args.as_slice() {
         ["serve", "--config", path] => serve(path),
         ["config", "init", path, flags @ ..] => init(path, flags),
+        ["config", "add-caller", path, flags @ ..] => add_caller(path, flags),
+        ["config", "add-lease-caller", path, flags @ ..] => add_lease_caller(path, flags),
         ["config", "check", path] => check(path),
         _ => Err(Failure::Usage),
     };
@@ -38,7 +43,7 @@ fn main() -> ExitCode {
 #[derive(Debug, thiserror::Error)]
 enum Failure {
     #[error(
-        "usage: serve --config PATH | config init PATH --flag value ... | config check PATH (check reads the credential from the environment it runs in: run it in the unit's environment)"
+        "usage: serve --config PATH | config init PATH --flag value ... | config add-caller PATH --flag value ... | config add-lease-caller PATH --flag value ... | config check PATH (check reads the credentials from the environment it runs in: run it in the unit's environment)"
     )]
     Usage,
     #[error(transparent)]
@@ -66,20 +71,31 @@ fn check(path: &str) -> Result<(), Failure> {
     check_ready(&config)?;
     println!("claude connector configuration is valid and ready to serve");
     println!("callers: {}", config.callers.len());
-    println!("allowed_models: {}", config.callers[0].allowed_models.len());
+    println!("lease_callers: {}", config.lease_callers.len());
     println!("prices: {}", config.prices.len());
     Ok(())
 }
 
-/// The flags of `config init`, each given at most once except the two lists.
+/// The flags of one config verb: each single flag at most once, each list
+/// flag any number of times.
 struct Flags {
     single: BTreeMap<&'static str, String>,
-    models: Vec<String>,
-    prices: Vec<String>,
-    lease_users: Vec<String>,
+    lists: BTreeMap<&'static str, Vec<String>>,
 }
 
-const SINGLE: [&str; 26] = [
+/// The flags that describe one caller, shared by `config init` (which writes
+/// the first caller) and `config add-caller`.
+const CALLER: [&str; 7] = [
+    "--caller-id",
+    "--connection-key-file",
+    "--connection-key-epoch",
+    "--spend-ceiling-micro-usd",
+    "--spend-window-ms",
+    "--max-concurrent-requests",
+    "--max-output-tokens",
+];
+
+const INIT: [&str; 21] = [
     "--listen",
     "--replay-store",
     "--claude-binary",
@@ -89,18 +105,13 @@ const SINGLE: [&str; 26] = [
     "--prompt-dir",
     "--instance",
     "--token-credential",
-    "--caller-id",
-    "--connection-key-file",
-    "--connection-key-epoch",
-    "--spend-ceiling-micro-usd",
-    "--spend-window-ms",
+    "--handle-secret-credential",
+    "--handle-secret-file",
     "--deadline-ms",
     "--max-line-bytes",
     "--max-total-bytes",
     "--stderr-tail-bytes",
-    "--max-concurrent-requests",
     "--max-payload-bytes",
-    "--max-output-tokens",
     "--socket-timeout-ms",
     "--lease-socket",
     "--lease-max-ms",
@@ -108,36 +119,53 @@ const SINGLE: [&str; 26] = [
     "--lease-reservation-micro-usd",
 ];
 
+const LEASE_CALLER: [&str; 3] = [
+    "--caller-id",
+    "--lease-unit-instance",
+    "--lease-reservation-micro-usd",
+];
+
 impl Flags {
-    fn parse(args: &[&str]) -> Result<Self, Failure> {
+    fn parse(
+        args: &[&str],
+        singles: &[&[&'static str]],
+        lists: &[&'static str],
+    ) -> Result<Self, Failure> {
         let mut flags = Flags {
             single: BTreeMap::new(),
-            models: Vec::new(),
-            prices: Vec::new(),
-            lease_users: Vec::new(),
+            lists: BTreeMap::new(),
         };
         let mut args = args.iter();
         while let Some(&name) = args.next() {
             let Some(&value) = args.next() else {
                 return Err(Failure::Flags);
             };
-            match name {
-                "--allowed-model" => flags.models.push(value.to_string()),
-                "--price" => flags.prices.push(value.to_string()),
-                "--lease-user" => flags.lease_users.push(value.to_string()),
-                _ => {
-                    let Some(known) = SINGLE.iter().find(|known| **known == name) else {
-                        return Err(Failure::Flags);
-                    };
-                    if flags.single.insert(*known, value.to_string()).is_some() {
-                        return Err(Failure::Flags);
-                    }
-                }
+            if let Some(list) = lists.iter().find(|known| **known == name) {
+                flags
+                    .lists
+                    .entry(*list)
+                    .or_default()
+                    .push(value.to_string());
+                continue;
+            }
+            let Some(known) = singles
+                .iter()
+                .flat_map(|set| set.iter())
+                .find(|k| **k == name)
+            else {
+                return Err(Failure::Flags);
+            };
+            if flags.single.insert(*known, value.to_string()).is_some() {
+                return Err(Failure::Flags);
             }
         }
         Ok(flags)
     }
 
+    fn list(&self, name: &'static str) -> &[String] {
+        self.lists.get(name).map_or(&[], Vec::as_slice)
+    }
+
     fn text(&self, name: &'static str) -> Result<String, Failure> {
         self.single.get(name).cloned().ok_or(Failure::Missing(name))
     }
@@ -162,6 +190,22 @@ impl Flags {
             Some(text) => text.parse().map_err(|_| Failure::Malformed(name)),
         }
     }
+
+    /// The caller these flags describe. Its payload bound comes from
+    /// `--max-payload-bytes` when the verb takes one.
+    fn caller(&self) -> Result<CallerConfig, Failure> {
+        Ok(CallerConfig {
+            caller_runtime_id: self.text("--caller-id")?,
+            connection_key_file: self.path("--connection-key-file")?,
+            connection_key_epoch: self.number("--connection-key-epoch")?,
+            allowed_models: self.list("--allowed-model").to_vec(),
+            max_concurrent_requests: self.number_or("--max-concurrent-requests", 4)?,
+            max_payload_bytes: self.number_or("--max-payload-bytes", 1 << 20)?,
+            max_output_tokens: self.number_or("--max-output-tokens", 32_768)?,
+            spend_ceiling_micro_usd: self.number("--spend-ceiling-micro-usd")?,
+            spend_window_ms: self.number("--spend-window-ms")?,
+        })
+    }
 }
 
 fn sha256(hex: &str) -> Option<[u8; 32]> {
@@ -202,30 +246,94 @@ fn price(text: &str) -> Option<(String, ModelPrice)> {
     ))
 }
 
+/// Writes 32 random bytes as 64 hex characters, mode 0600, unless the file is
+/// already there: the secret is never read back or shown, and a file that
+/// exists is the secret handles already depend on, so it is kept as it is when
+/// it is a regular file, mode 0600, owned by this user and at least
+/// `MIN_SECRET_BYTES` long, and refused untouched otherwise.
+#[cfg(unix)]
+fn ensure_secret_file(path: &std::path::Path) -> Result<(), Failure> {
+    use std::io::{Read, Write};
+    use std::os::unix::fs::OpenOptionsExt;
+
+    if !path.is_absolute() {
+        return Err(Failure::Malformed("--handle-secret-file"));
+    }
+    let mut file = match std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(path)
+    {
+        Ok(file) => file,
+        Err(_) => return existing_secret_is_usable(path),
+    };
+    let mut bytes = [0_u8; 32];
+    std::fs::File::open("/dev/urandom")
+        .and_then(|mut random| random.read_exact(&mut bytes))
+        .map_err(|_| Failure::Malformed("--handle-secret-file"))?;
+    let hex: String = bytes.iter().map(|byte| format!("{byte:02x}")).collect();
+    file.write_all(hex.as_bytes())
+        .map_err(|_| Failure::Malformed("--handle-secret-file"))
+}
+
+/// An existing secret file is accepted only as the connector would use it: not
+/// a link, a regular file, readable by no one else, ours and long enough.
+#[cfg(unix)]
+fn existing_secret_is_usable(path: &std::path::Path) -> Result<(), Failure> {
+    let metadata =
+        std::fs::symlink_metadata(path).map_err(|_| Failure::Malformed("--handle-secret-file"))?;
+    // SAFETY: geteuid has no preconditions and cannot fail.
+    let uid = unsafe { libc::geteuid() };
+    if secret_file_usable(&metadata, uid) {
+        Ok(())
+    } else {
+        Err(Failure::Malformed("--handle-secret-file"))
+    }
+}
+
+#[cfg(unix)]
+fn secret_file_usable(metadata: &std::fs::Metadata, uid: u32) -> bool {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+    metadata.is_file()
+        && metadata.permissions().mode() & 0o7777 == 0o600
+        && metadata.uid() == uid
+        && metadata.len() >= MIN_SECRET_BYTES as u64
+}
+
+#[cfg(not(unix))]
+fn ensure_secret_file(_: &std::path::Path) -> Result<(), Failure> {
+    Err(Failure::Usage)
+}
+
 fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
-    let flags = Flags::parse(args)?;
-    let max_payload_bytes: usize = flags.number_or("--max-payload-bytes", 1 << 20)?;
-    let max_concurrent_requests: usize = flags.number_or("--max-concurrent-requests", 4)?;
+    let flags = Flags::parse(
+        args,
+        &[&INIT, &CALLER],
+        &["--allowed-model", "--price", "--lease-user"],
+    )?;
+    let first = flags.caller()?;
     let mut prices = BTreeMap::new();
-    for text in &flags.prices {
+    for text in flags.list("--price") {
         let (model, price) = price(text).ok_or(Failure::Malformed("--price"))?;
         if prices.insert(model, price).is_some() {
             return Err(Failure::Malformed("--price"));
         }
     }
-    let caller_id = flags.text("--caller-id")?;
     let lease_callers = flags
-        .lease_users
+        .list("--lease-user")
         .iter()
         .map(|unix_user| {
             Ok(LeaseCallerConfig {
                 unix_user: unix_user.clone(),
-                caller_id: caller_id.clone(),
+                caller_id: first.caller_runtime_id.clone(),
                 unit_instance: flags.text("--lease-unit-instance")?,
                 reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
             })
         })
         .collect::<Result<Vec<_>, Failure>>()?;
+    let secret_file = flags.path("--handle-secret-file")?;
     let config = ClaudeConnectorConfig {
         listen: flags.text("--listen")?,
         replay_store: flags.path("--replay-store")?,
@@ -241,26 +349,80 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
         max_line_bytes: flags.number_or("--max-line-bytes", 4 << 20)?,
         max_total_bytes: flags.number_or("--max-total-bytes", 64 << 20)?,
         stderr_tail_bytes: flags.number_or("--stderr-tail-bytes", 8192)?,
-        max_frame_bytes: frame_bytes_for_payload(max_payload_bytes),
-        max_connections: max_concurrent_requests.max(8),
+        max_frame_bytes: frame_bytes_for_payload(first.max_payload_bytes),
+        max_connections: first.max_concurrent_requests.max(8),
         socket_timeout_ms: flags.number_or("--socket-timeout-ms", 10_000)?,
         max_expiry_skew_ms: 300_000,
-        callers: vec![CallerConfig {
-            caller_runtime_id: caller_id.clone(),
-            connection_key_file: flags.path("--connection-key-file")?,
-            connection_key_epoch: flags.number("--connection-key-epoch")?,
-            allowed_models: flags.models.clone(),
-            max_concurrent_requests,
-            max_payload_bytes,
-            max_output_tokens: flags.number_or("--max-output-tokens", 32_768)?,
-            spend_ceiling_micro_usd: flags.number("--spend-ceiling-micro-usd")?,
-            spend_window_ms: flags.number("--spend-window-ms")?,
-        }],
+        callers: vec![first],
         prices,
         lease_socket: flags.single.get("--lease-socket").map(PathBuf::from),
         lease_callers,
         lease_max_ms: flags.number_or("--lease-max-ms", 3_600_000)?,
+        handle_secret_credential: flags.text("--handle-secret-credential")?,
     };
+    // Validate before the secret file exists: a refused document leaves nothing.
+    config.validate()?;
+    ensure_secret_file(&secret_file)?;
     write_config(path.as_ref(), &config)?;
     Ok(())
 }
+
+/// Appends one caller to an existing document. The serve limits grow to carry
+/// it: the frame to its payload bound, the connections to every caller's slots.
+fn add_caller(path: &str, args: &[&str]) -> Result<(), Failure> {
+    let flags = Flags::parse(
+        args,
+        &[&CALLER, &["--max-payload-bytes"]],
+        &["--allowed-model"],
+    )?;
+    let caller = flags.caller()?;
+    let mut config = load_config(path.as_ref())?;
+    config.max_frame_bytes = config
+        .max_frame_bytes
+        .max(frame_bytes_for_payload(caller.max_payload_bytes));
+    config.callers.push(caller);
+    let slots: usize = config
+        .callers
+        .iter()
+        .map(|caller| caller.max_concurrent_requests)
+        .sum();
+    config.max_connections = config.max_connections.max(slots);
+    write_config(path.as_ref(), &config)?;
+    Ok(())
+}
+
+/// Appends one leasing account to an existing document that lends a token.
+fn add_lease_caller(path: &str, args: &[&str]) -> Result<(), Failure> {
+    let flags = Flags::parse(args, &[&LEASE_CALLER, &["--lease-user"]], &[])?;
+    let mut config = load_config(path.as_ref())?;
+    config.lease_callers.push(LeaseCallerConfig {
+        unix_user: flags.text("--lease-user")?,
+        caller_id: flags.text("--caller-id")?,
+        unit_instance: flags.text("--lease-unit-instance")?,
+        reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
+    });
+    write_config(path.as_ref(), &config)?;
+    Ok(())
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+    use super::*;
+
+    #[test]
+    fn a_secret_file_owned_by_someone_else_is_not_usable() {
+        let dir =
+            std::env::temp_dir().join(format!("claude-connector-main-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("handle.secret");
+        std::fs::write(&path, "k".repeat(64)).unwrap();
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
+        let metadata = std::fs::symlink_metadata(&path).unwrap();
+        let owner = metadata.uid();
+        assert!(secret_file_usable(&metadata, owner));
+        assert!(!secret_file_usable(&metadata, owner.wrapping_add(1)));
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}
diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
index 76f0ce4..e4ea4b3 100644
--- a/crates/claude-connector/src/quota.rs
+++ b/crates/claude-connector/src/quota.rs
@@ -76,7 +76,7 @@ fn unix_ms() -> u64 {
 mod tests {
     use super::*;
 
-    const RESET: u64 = 1_793_307_000_000;
+    const RESET: u64 = 4_102_444_800_000;
 
     fn quota(window: &str, permille: u32, observed_at: u64) -> PlanQuota {
         PlanQuota {
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 80285a2..3659113 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -74,6 +74,7 @@ fn valid() -> ClaudeConnectorConfig {
         prompt_dir: "/var/lib/claude-connector/prompts".into(),
         instance: "persona-a".to_string(),
         token_credential: "claude-token".to_string(),
+        handle_secret_credential: "claude-handle-secret".to_string(),
         deadline_ms: 600_000,
         max_line_bytes: 4 << 20,
         max_total_bytes: 64 << 20,
@@ -326,11 +327,10 @@ fn config_refuses_aliases_unpriced_models_and_second_callers() {
             Box::new(|c| c.callers[0].allowed_models.clear()),
         ),
         (
-            "second caller",
+            "duplicate caller id",
             Box::new(|c| {
-                let mut second = c.callers[0].clone();
-                second.caller_runtime_id = "other".to_string();
-                c.callers.push(second);
+                let again = c.callers[0].clone();
+                c.callers.push(again);
             }),
         ),
         ("no caller", Box::new(|c| c.callers.clear())),
@@ -538,7 +538,7 @@ fn no_refusal_echoes_a_value() {
         }),
         Box::new(|c| {
             let mut second = c.callers[0].clone();
-            second.caller_runtime_id = CANARY.to_string();
+            second.caller_runtime_id = format!(" {CANARY}");
             c.callers.push(second);
         }),
     ];
@@ -646,6 +646,10 @@ fn init_flags<'a>(scratch: &'a Scratch, extra: &[&'a str]) -> Vec<String> {
         "persona-a",
         "--token-credential",
         "claude-token",
+        "--handle-secret-credential",
+        "claude-handle-secret",
+        "--handle-secret-file",
+        &path("handle.secret"),
         "--caller-id",
         "persona-a-caller",
         "--connection-key-file",
@@ -704,6 +708,11 @@ fn prepare(scratch: &Scratch) -> (Vec<String>, PathBuf) {
     )
     .unwrap();
     std::fs::write(scratch.path("credentials/claude-token"), CANARY).unwrap();
+    std::fs::write(
+        scratch.path("credentials/claude-handle-secret"),
+        "s".repeat(64),
+    )
+    .unwrap();
     std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
     std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
     let sha: String = Sha256::digest(b"pinned claude")
@@ -749,7 +758,7 @@ fn check_passes_a_document_serve_can_start_and_reports_counts_only() {
     );
     assert!(checked.status.success(), "{}", shown(&checked));
     let text = shown(&checked);
-    assert!(text.contains("callers: 1") && text.contains("allowed_models: 1"));
+    assert!(text.contains("callers: 1") && text.contains("lease_callers: 0"));
     assert!(text.contains("prices: 1"));
     for secret in ["persona-a", HAIKU, CANARY, "caller-secret"] {
         assert!(!text.contains(secret), "{text}");
@@ -788,6 +797,32 @@ fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
             config.max_frame_bytes = 4099;
             write_config(&path, &config).unwrap();
         }),
+        ("two callers on one key", "callers", |s, _| {
+            std::fs::write(s.path("twin.key"), "caller-secret").unwrap();
+            let config = s.path("connector.cc");
+            let twin = s.path("twin.key");
+            let added = run(
+                &[
+                    "config",
+                    "add-caller",
+                    config.to_str().unwrap(),
+                    "--caller-id",
+                    "twin",
+                    "--connection-key-file",
+                    twin.to_str().unwrap(),
+                    "--connection-key-epoch",
+                    "1",
+                    "--allowed-model",
+                    HAIKU,
+                    "--spend-ceiling-micro-usd",
+                    "1000",
+                    "--spend-window-ms",
+                    "60000",
+                ],
+                &[],
+            );
+            assert!(added.status.success(), "{}", shown(&added));
+        }),
         ("too few connections", "connection capacity", |s, _| {
             let path = s.path("connector.cc");
             let mut config = load_config(&path).unwrap();
@@ -1206,3 +1241,430 @@ fn serve_binds_the_lease_socket_and_answers_a_stranger_with_a_refusal() {
     outcome.unwrap();
     assert!(running);
 }
+
+// ---- many callers ----
+
+fn second_caller() -> CallerConfig {
+    CallerConfig {
+        caller_runtime_id: "heartbeat".to_string(),
+        connection_key_file: "/etc/claude-connector/heartbeat.key".into(),
+        connection_key_epoch: 3,
+        allowed_models: vec![HAIKU.to_string()],
+        max_concurrent_requests: 1,
+        max_payload_bytes: 64 << 10,
+        max_output_tokens: 1024,
+        spend_ceiling_micro_usd: 1_000_000,
+        spend_window_ms: 60_000,
+    }
+}
+
+#[test]
+fn several_callers_round_trip_and_each_is_validated_alone() {
+    let scratch = Scratch::new();
+    let path = scratch.path("connector.cc");
+    let mut config = valid();
+    config.callers.push(second_caller());
+    write_config(&path, &config).unwrap();
+    assert_eq!(load_config(&path).unwrap(), config);
+
+    let broken: Vec<(&str, Change)> = vec![
+        (
+            "caller bounds",
+            Box::new(|c| c.callers[1].spend_ceiling_micro_usd = 0),
+        ),
+        (
+            "connection_key_epoch",
+            Box::new(|c| c.callers[1].connection_key_epoch = 0),
+        ),
+        (
+            "connection_key_file",
+            Box::new(|c| c.callers[1].connection_key_file = "heartbeat.key".into()),
+        ),
+        (
+            "allowed_models",
+            Box::new(|c| c.callers[1].allowed_models = vec!["claude-opus-9".to_string()]),
+        ),
+        (
+            "callers",
+            Box::new(|c| c.callers[1].caller_runtime_id = c.callers[0].caller_runtime_id.clone()),
+        ),
+    ];
+    for (field, change) in &broken {
+        let mut config = valid();
+        config.callers.push(second_caller());
+        change(&mut config);
+        assert_eq!(refused(&config), *field);
+    }
+}
+
+#[test]
+fn a_lease_caller_bills_one_configured_caller_within_that_callers_ceiling() {
+    let mut config = valid();
+    config.callers.push(second_caller());
+    let lease = |user: &str, caller: &str, instance: &str, reservation: u64| LeaseCallerConfig {
+        unix_user: user.to_string(),
+        caller_id: caller.to_string(),
+        unit_instance: instance.to_string(),
+        reservation_micro_usd: reservation,
+    };
+    // A lease caller of each caller, each within its own caller's ceiling.
+    config
+        .lease_callers
+        .push(lease("mind-heartbeat", "heartbeat", "heartbeat", 1_000_000));
+    config.validate().unwrap();
+    // The first caller's ceiling does not stretch to the second's lease, nor the reverse.
+    config.lease_callers[1].reservation_micro_usd = 1_000_001;
+    assert_eq!(refused(&config), "lease_callers");
+    config.lease_callers[1].reservation_micro_usd = 1;
+    config.lease_callers[0].reservation_micro_usd = 50_000_001;
+    assert_eq!(refused(&config), "lease_callers");
+    config.lease_callers[0].reservation_micro_usd = 50_000_000;
+    // A lease caller naming no configured caller, or sharing another's account.
+    config.lease_callers[1].caller_id = "nobody".to_string();
+    assert_eq!(refused(&config), "lease_callers");
+    config.lease_callers[1].caller_id = "heartbeat".to_string();
+    config.lease_callers[1].unix_user = config.lease_callers[0].unix_user.clone();
+    assert_eq!(refused(&config), "lease_callers");
+}
+
+#[test]
+fn add_caller_and_add_lease_caller_extend_the_document_and_grow_the_serve_limits() {
+    let scratch = Scratch::new();
+    let made = init(
+        &scratch,
+        &init_flags(
+            &scratch,
+            &[
+                "--lease-socket",
+                "/run/claude-connector/lease.sock",
+                "--lease-user",
+                "mind-eureka-self",
+                "--lease-unit-instance",
+                "eureka",
+                "--lease-reservation-micro-usd",
+                "5000000",
+            ],
+        ),
+    );
+    assert!(made.status.success(), "{}", shown(&made));
+    let path = scratch.path("connector.cc");
+    let path_text = path.to_str().unwrap();
+    let before = load_config(&path).unwrap();
+
+    let key = scratch.path("heartbeat.key");
+    let added = run(
+        &[
+            "config",
+            "add-caller",
+            path_text,
+            "--caller-id",
+            "heartbeat",
+            "--connection-key-file",
+            key.to_str().unwrap(),
+            "--connection-key-epoch",
+            "2",
+            "--allowed-model",
+            HAIKU,
+            "--spend-ceiling-micro-usd",
+            "2000000",
+            "--spend-window-ms",
+            "60000",
+            "--max-concurrent-requests",
+            "30",
+            "--max-payload-bytes",
+            "4194304",
+        ],
+        &[],
+    );
+    assert!(added.status.success(), "{}", shown(&added));
+    let leased = run(
+        &[
+            "config",
+            "add-lease-caller",
+            path_text,
+            "--lease-user",
+            "mind-heartbeat",
+            "--caller-id",
+            "heartbeat",
+            "--lease-unit-instance",
+            "heartbeat",
+            "--lease-reservation-micro-usd",
+            "1000000",
+        ],
+        &[],
+    );
+    assert!(leased.status.success(), "{}", shown(&leased));
+
+    let after = load_config(&path).unwrap();
+    assert_eq!(after.callers[0], before.callers[0]);
+    assert_eq!(after.callers.len(), 2);
+    let heartbeat = &after.callers[1];
+    assert_eq!(heartbeat.caller_runtime_id, "heartbeat");
+    assert_eq!(heartbeat.connection_key_epoch, 2);
+    assert_eq!(heartbeat.spend_ceiling_micro_usd, 2_000_000);
+    assert_eq!(heartbeat.max_payload_bytes, 4 << 20);
+    assert_eq!(after.lease_callers[0], before.lease_callers[0]);
+    assert_eq!(after.lease_callers[1].caller_id, "heartbeat");
+    // The frame carries the largest payload and the connections every slot.
+    assert!(after.max_frame_bytes > before.max_frame_bytes);
+    assert!(after.max_connections >= 34);
+    assert_eq!(after.prices, before.prices);
+    assert_eq!(
+        after.handle_secret_credential,
+        before.handle_secret_credential
+    );
+
+    // Repeating either verb is refused and leaves the document as it was.
+    let again = run(
+        &[
+            "config",
+            "add-caller",
+            path_text,
+            "--caller-id",
+            "heartbeat",
+            "--connection-key-file",
+            key.to_str().unwrap(),
+            "--connection-key-epoch",
+            "2",
+            "--allowed-model",
+            HAIKU,
+            "--spend-ceiling-micro-usd",
+            "2000000",
+            "--spend-window-ms",
+            "60000",
+        ],
+        &[],
+    );
+    assert!(!again.status.success());
+    assert_eq!(load_config(&path).unwrap(), after);
+    let unleased = run(
+        &[
+            "config",
+            "add-lease-caller",
+            path_text,
+            "--lease-user",
+            "mind-heartbeat",
+            "--caller-id",
+            "heartbeat",
+            "--lease-unit-instance",
+            "heartbeat",
+            "--lease-reservation-micro-usd",
+            "1000000",
+        ],
+        &[],
+    );
+    assert!(!unleased.status.success());
+    assert_eq!(load_config(&path).unwrap(), after);
+}
+
+#[test]
+fn add_lease_caller_needs_a_document_that_lends_a_token() {
+    let scratch = Scratch::new();
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let path = scratch.path("connector.cc");
+    let leased = run(
+        &[
+            "config",
+            "add-lease-caller",
+            path.to_str().unwrap(),
+            "--lease-user",
+            "mind-heartbeat",
+            "--caller-id",
+            "persona-a-caller",
+            "--lease-unit-instance",
+            "heartbeat",
+            "--lease-reservation-micro-usd",
+            "1000000",
+        ],
+        &[],
+    );
+    assert!(!leased.status.success());
+    assert!(load_config(&path).unwrap().lease_callers.is_empty());
+}
+
+#[cfg(unix)]
+#[test]
+fn init_creates_the_handle_secret_once_private_and_never_shows_it() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let scratch = Scratch::new();
+    let secret = scratch.path("handle.secret");
+    let made = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(made.status.success(), "{}", shown(&made));
+    let metadata = std::fs::metadata(&secret).unwrap();
+    assert_eq!(metadata.permissions().mode() & 0o777, 0o600);
+    let text = std::fs::read_to_string(&secret).unwrap();
+    assert_eq!(text.len(), 64);
+    assert!(text.bytes().all(|b| b.is_ascii_hexdigit()));
+    assert!(!shown(&made).contains(&text));
+
+    // A second init keeps the secret the first one made, since handles depend on it.
+    std::fs::remove_file(scratch.path("connector.cc")).unwrap();
+    let again = init(&scratch, &init_flags(&scratch, &[]));
+    assert!(again.status.success(), "{}", shown(&again));
+    assert_eq!(std::fs::read_to_string(&secret).unwrap(), text);
+
+    // A refused document leaves no secret file behind.
+    let fresh = Scratch::new();
+    let flags = init_flags(&fresh, &["--max-payload-bytes", "1"]);
+    let refused = init(&fresh, &flags);
+    assert!(!refused.status.success());
+    assert!(!fresh.path("handle.secret").exists());
+}
+
+#[cfg(unix)]
+#[test]
+fn check_wants_the_handle_secret_credential_and_names_it() {
+    let scratch = Scratch::new();
+    let (flags, credentials) = prepare(&scratch);
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
+    let config = scratch.path("connector.cc");
+    let path = config.to_str().unwrap();
+    for body in [None, Some("too-short")] {
+        let secret = credentials.join("claude-handle-secret");
+        match body {
+            None => std::fs::remove_file(&secret).unwrap(),
+            Some(text) => std::fs::write(&secret, text).unwrap(),
+        }
+        let checked = run(
+            &["config", "check", path],
+            &[("CREDENTIALS_DIRECTORY", &credentials)],
+        );
+        assert!(!checked.status.success());
+        let text = shown(&checked);
+        assert!(text.contains("handle_secret_credential"), "{text}");
+        assert!(!text.contains("too-short"), "{text}");
+    }
+}
+
+/// A document written before the handle secret had a field cannot name where
+/// the secret is, so it is not a document this connector serves from: it is
+/// refused as a store fault, to be authored again with `config init`.
+#[test]
+fn a_document_without_the_handle_secret_field_is_refused_as_a_store() {
+    let scratch = Scratch::new();
+    let path = scratch.path("old.cc");
+    let mut payload = rmp_serde::to_vec(&valid()).unwrap();
+    // array16(23) -> array16(22), and drop the trailing 20-byte fixstr.
+    assert_eq!(payload[..3], [0xdc, 0, 23]);
+    payload[2] = 22;
+    payload.truncate(payload.len() - 21);
+    store_raw(
+        &path,
+        "runtime",
+        ClaudeConnectorConfig::TYPE,
+        Some(ClaudeConnectorConfig::TYPE),
+        payload,
+    );
+    assert!(matches!(load_config(&path), Err(ConfigError::Store)));
+}
+
+#[test]
+fn the_handle_secret_credential_is_a_name_of_its_own() {
+    for name in ["claude-token", "a/b", "", ".."] {
+        let mut config = valid();
+        config.handle_secret_credential = name.to_string();
+        assert_eq!(refused(&config), "handle_secret_credential", "{name:?}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn init_refuses_a_secret_file_it_cannot_create_and_writes_no_document() {
+    let scratch = Scratch::new();
+    let mut flags = init_flags(&scratch, &[]);
+    let at = flags
+        .iter()
+        .position(|f| f == "--handle-secret-file")
+        .unwrap();
+    flags[at + 1] = scratch
+        .path("absent/handle.secret")
+        .to_string_lossy()
+        .into_owned();
+    let made = init(&scratch, &flags);
+    assert!(!made.status.success());
+    assert!(!scratch.path("connector.cc").exists());
+}
+
+#[cfg(unix)]
+#[test]
+fn config_init_keeps_an_existing_secret_file_only_if_it_is_usable() {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    let write = |path: &Path, bytes: usize, mode: u32| {
+        std::fs::write(path, "k".repeat(bytes)).unwrap();
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).unwrap();
+    };
+    type Plant = fn(&Scratch, &Path);
+    let refused: Vec<(&str, Plant)> = vec![
+        ("world readable", |_, p| {
+            std::fs::write(p, "k".repeat(64)).unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o644)).unwrap();
+        }),
+        ("group writable", |_, p| {
+            std::fs::write(p, "k".repeat(64)).unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o660)).unwrap();
+        }),
+        ("read only", |_, p| {
+            std::fs::write(p, "k".repeat(64)).unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o400)).unwrap();
+        }),
+        ("one byte short", |_, p| {
+            std::fs::write(p, "k".repeat(31)).unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
+        }),
+        ("empty", |_, p| {
+            std::fs::write(p, "").unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
+        }),
+        ("a directory", |_, p| {
+            std::fs::create_dir(p).unwrap();
+            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
+        }),
+        ("a link to a good file", |s, p| {
+            let target = s.path("elsewhere.secret");
+            std::fs::write(&target, "k".repeat(64)).unwrap();
+            std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600)).unwrap();
+            symlink(&target, p).unwrap();
+        }),
+    ];
+    for (name, plant) in refused {
+        let scratch = Scratch::new();
+        let flags = init_flags(&scratch, &[]);
+        let secret = scratch.path("handle.secret");
+        plant(&scratch, &secret);
+        let before = std::fs::symlink_metadata(&secret).unwrap();
+        let made = init(&scratch, &flags);
+        assert!(!made.status.success(), "{name} was accepted");
+        assert!(shown(&made).contains("--handle-secret-file"), "{name}");
+        assert!(!shown(&made).contains("kkkk"), "{name}");
+        assert!(
+            !scratch.path("connector.cc").exists(),
+            "{name} left a document"
+        );
+        let after = std::fs::symlink_metadata(&secret).unwrap();
+        assert_eq!(
+            before.permissions().mode(),
+            after.permissions().mode(),
+            "{name}"
+        );
+        assert_eq!(before.len(), after.len(), "{name}");
+        assert_eq!(
+            before.file_type().is_symlink(),
+            after.file_type().is_symlink(),
+            "{name}"
+        );
+    }
+
+    // The smallest usable file is accepted and left exactly as it was.
+    let scratch = Scratch::new();
+    let flags = init_flags(&scratch, &[]);
+    let secret = scratch.path("handle.secret");
+    write(&secret, 32, 0o600);
+    let made = init(&scratch, &flags);
+    assert!(made.status.success(), "{}", shown(&made));
+    assert_eq!(std::fs::read_to_string(&secret).unwrap(), "k".repeat(32));
+    assert!(scratch.path("connector.cc").exists());
+}
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index cf76afc..cd3663f 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -19,7 +19,7 @@ use crate::envelope::{
 use crate::readout::PlanQuotaSnapshot;
 use crate::service::{
     CallerAdmission, PriceTable, ProviderCall, SpendCeiling, SpendWindowMs, TransportAdmission,
-    TransportService,
+    TransportService, distinct_admissions,
 };
 
 /// The only provider seam of the connector kit. A connector binary implements
@@ -87,6 +87,7 @@ impl ServeLimits {
         if admissions.is_empty() {
             return Err(ServeError::InvalidConfig("callers"));
         }
+        distinct_admissions(admissions)?;
         let slots = admissions
             .iter()
             .try_fold(0_usize, |total, caller| {
@@ -950,6 +951,26 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn the_limits_refuse_callers_that_share_a_key_or_an_id() {
+        let limits = limits();
+        let shared_key = [
+            caller("one", "shared-key", 1),
+            caller("two", "shared-key", 1),
+        ];
+        assert!(matches!(
+            limits.validate(&shared_key),
+            Err(ServeError::Service(ServiceError::SharedCallerKey))
+        ));
+        let shared_id = [caller("one", "key-a", 1), caller("one", "key-b", 1)];
+        assert!(matches!(
+            limits.validate(&shared_id),
+            Err(ServeError::Service(ServiceError::DuplicateCaller))
+        ));
+        let distinct = [caller("one", "key-a", 1), caller("two", "key-b", 1)];
+        assert!(limits.validate(&distinct).is_ok());
+    }
+
     #[test]
     fn only_loopback_peers_are_admitted() {
         assert!(peer_admitted(IpAddr::from([127, 0, 0, 1])));
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 16853dc..8adaf07 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -47,6 +47,24 @@ pub struct SpendCeiling(pub u64);
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct SpendWindowMs(pub u64);
 
+/// The rule that admitted callers are distinct: no two share a connection key
+/// (a key names its caller), and no two share a caller id. `TransportService`
+/// opens only under it, and a readiness check that must agree with opening
+/// asks the same function.
+pub fn distinct_admissions(admissions: &[CallerAdmission]) -> Result<(), ServiceError> {
+    let mut keys = HashSet::new();
+    let mut ids = HashSet::new();
+    for admission in admissions {
+        if !keys.insert(admission.security.0) {
+            return Err(ServiceError::SharedCallerKey);
+        }
+        if !ids.insert(admission.caller_runtime_id.as_str()) {
+            return Err(ServiceError::DuplicateCaller);
+        }
+    }
+    Ok(())
+}
+
 pub struct CallerAdmission {
     caller_runtime_id: String,
     connection_key_epoch: u32,
@@ -388,6 +406,12 @@ impl ProviderCall {
         &self.request
     }
 
+    /// The caller this call was admitted for: the caller whose key sealed the
+    /// invocation, never a name the request carries.
+    pub fn caller_runtime_id(&self) -> &str {
+        &self.receipt.caller_runtime_id
+    }
+
     /// How many foreign reasoning items the service removed from the request.
     pub fn foreign_reasoning_dropped(&self) -> u32 {
         self.receipt.foreign_reasoning_dropped
@@ -533,17 +557,12 @@ impl TransportService {
         {
             return Err(ServiceError::InvalidAdmission);
         }
-        let mut callers = HashMap::new();
-        let mut keys = HashSet::new();
-        for admission in admissions {
-            if !keys.insert(admission.security.0) {
-                return Err(ServiceError::SharedCallerKey);
-            }
-            let caller_runtime_id = admission.caller_runtime_id.clone();
-            if callers.insert(caller_runtime_id, admission).is_some() {
-                return Err(ServiceError::DuplicateCaller);
-            }
-        }
+        let admissions: Vec<CallerAdmission> = admissions.into_iter().collect();
+        distinct_admissions(&admissions)?;
+        let callers: HashMap<String, CallerAdmission> = admissions
+            .into_iter()
+            .map(|admission| (admission.caller_runtime_id.clone(), admission))
+            .collect();
         if callers.is_empty() {
             return Err(ServiceError::InvalidAdmission);
         }
@@ -3800,6 +3819,28 @@ mod tests {
         assert_eq!((idle.spent_micro_usd, idle.reserved_micro_usd), (0, 0));
     }
 
+    #[test]
+    fn any_admitted_caller_reads_every_callers_row() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let claim = claim_at(&mut service, "request-1", 1_000);
+        let result = text_result(claim.call(), "done");
+        service.complete(*claim, result, FRAME).unwrap();
+        // Ghostlight asks, with its own key, and sees epiphany's spend.
+        let readout = readout_as(
+            &service,
+            "ghostlight-yggdrasil",
+            "ghostlight-distinct-test-key",
+            1_500,
+            FRAME,
+        )
+        .unwrap();
+        assert_eq!(row(&readout, CALLER).spent_micro_usd, FIXTURE_USAGE_COST);
+        assert_eq!(row(&readout, "ghostlight-yggdrasil").spent_micro_usd, 0);
+        // A key that belongs to no admitted caller reads nothing.
+        assert!(readout_as(&service, "ghostlight-yggdrasil", KEY, 1_500, FRAME).is_err());
+    }
+
     #[test]
     fn a_claim_a_crash_left_reads_as_spent_not_reserved() {
         let store = TestStore::new();

From 13cbdaf23cd2fb3f60b4db4948f33851f091e56e Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 01:56:34 +0100
Subject: [PATCH 11/37] lease-persona-callers: a lease caller names its turn
 kind; Persona and Self of one caller lease side by side

LeaseTurn {SelfRun, PersonaTurn} on LeaseCaller and LeaseCallerConfig; the unit derives from the turn; Busy is keyed (caller, turn); a Persona invocation leases in sequence as lease:<invocation>:<n>, one open at a time. config add-lease-caller and init take --turn self|persona.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs         |  15 +-
 crates/claude-connector/src/lease.rs          |  21 ++-
 crates/claude-connector/src/main.rs           |  19 +-
 .../claude-connector/tests/config_document.rs |  85 ++++++++-
 crates/claude-connector/tests/lease.rs        | 168 +++++++++++++++++-
 crates/model-connector/src/service.rs         |  10 +-
 crates/model-connector/src/service/lease.rs   |  99 ++++++++---
 7 files changed, 372 insertions(+), 45 deletions(-)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 0e3c5e8..d37d833 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -11,7 +11,8 @@ use std::time::Duration;
 
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
-    CallerAdmission, CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, ProviderBackend, ServeError,
+    CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ModelPrice, ProviderBackend,
+    ServeError,
     ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
 };
 use serde::{Deserialize, Serialize};
@@ -29,14 +30,17 @@ use crate::{
 const CONFIG_KEY: &str = "runtime";
 const MODEL_PREFIX: &str = "claude-";
 
-/// A unix account that may lease the subscription token for a Self run, the
-/// Self unit (`mind-self@<unit_instance>.service`) its process must run in,
-/// the configured caller whose spend window its leases reserve in, and what
-/// each lease reserves there.
+/// A unix account that may lease the subscription token for a Self run or a
+/// Persona turn, the unit its process must run in (`mind-self@<unit_instance>`
+/// or `mind-persona@<unit_instance>`, by `turn`), the configured caller whose
+/// spend window its leases reserve in, and what each lease reserves there.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LeaseCallerConfig {
     pub unix_user: String,
     pub caller_id: String,
+    /// The kind of turn this account leases for: it fixes the unit, `mind-self@`
+    /// or `mind-persona@`, its process must run in.
+    pub turn: LeaseTurn,
     pub unit_instance: String,
     pub reservation_micro_usd: u64,
 }
@@ -504,6 +508,7 @@ fn lease_callers_of(config: &ClaudeConnectorConfig) -> Result<Vec<LeaseCaller>,
                 .map(|uid| LeaseCaller {
                     uid,
                     caller_id: lease.caller_id.clone(),
+                    turn: lease.turn,
                     unit_instance: lease.unit_instance.clone(),
                     reservation_micro_usd: lease.reservation_micro_usd,
                 })
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
index d8badf3..9235a17 100644
--- a/crates/claude-connector/src/lease.rs
+++ b/crates/claude-connector/src/lease.rs
@@ -28,7 +28,7 @@ use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use model_connector::{
-    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseUse, ModelUsage,
+    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseTurn, LeaseUse, ModelUsage,
     TransportService,
 };
 use serde::{Deserialize, Serialize};
@@ -179,13 +179,17 @@ fn read_message(stream: &mut impl Bounded, deadline: Instant) -> io::Result<Leas
 /// The most a pipe takes in one atomic write.
 const PIPE_BUF: usize = 4096;
 
-/// A unix account allowed to lease, the Self unit its process must run in,
-/// and the caller whose spend window its leases reserve in.
+/// A unix account allowed to lease, the unit its process must run in (the
+/// Self or the Persona unit of its instance, by `turn`), and the caller whose
+/// spend window its leases reserve in.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LeaseCaller {
     pub uid: u32,
     pub caller_id: String,
-    /// The `<instance>` of `mind-self@<instance>.service`.
+    /// Which kind of turn this account leases for; it picks the unit.
+    pub turn: LeaseTurn,
+    /// The `<instance>` of `mind-self@<instance>.service` or
+    /// `mind-persona@<instance>.service`.
     pub unit_instance: String,
     /// What each of this caller's leases reserves, whatever the run asks.
     pub reservation_micro_usd: u64,
@@ -194,7 +198,10 @@ pub struct LeaseCaller {
 impl LeaseCaller {
     /// The one unit a lease to this caller may be requested from.
     pub fn unit(&self) -> String {
-        format!("mind-self@{}.service", self.unit_instance)
+        match self.turn {
+            LeaseTurn::SelfRun => format!("mind-self@{}.service", self.unit_instance),
+            LeaseTurn::PersonaTurn => format!("mind-persona@{}.service", self.unit_instance),
+        }
     }
 }
 
@@ -400,7 +407,8 @@ struct Lender {
 /// Serves leases on `listener` until it fails. Each connection is one lease:
 /// request, then grant or refusal, then (after a grant) settle. A caller is
 /// the account whose uid the kernel reports for the connection, and only a
-/// process in that caller's Self unit may lease, once per unit invocation; no
+/// process in that caller's unit may lease, once per unit invocation for a Self
+/// run and once per turn for a Persona; no
 /// field of any message names either.
 pub fn serve_leases(
     listener: &UnixListener,
@@ -485,6 +493,7 @@ impl Lender {
             .map_err(|_| io::Error::other("service lock"))?
             .begin_lease(
                 &caller.caller_id,
+                caller.turn,
                 &invocation.invocation_id,
                 caller.reservation_micro_usd,
                 request.expires_at_unix_ms,
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index e7f28bc..ac435a1 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -18,7 +18,7 @@ use claude_connector::{
     ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, MIN_SECRET_BYTES, check_ready,
     load_config, write_config,
 };
-use model_connector::{CallerConfig, ModelPrice, Rates, frame_bytes_for_payload};
+use model_connector::{CallerConfig, LeaseTurn, ModelPrice, Rates, frame_bytes_for_payload};
 
 fn main() -> ExitCode {
     let args: Vec<String> = std::env::args().skip(1).collect();
@@ -95,7 +95,7 @@ const CALLER: [&str; 7] = [
     "--max-output-tokens",
 ];
 
-const INIT: [&str; 21] = [
+const INIT: [&str; 22] = [
     "--listen",
     "--replay-store",
     "--claude-binary",
@@ -115,12 +115,14 @@ const INIT: [&str; 21] = [
     "--socket-timeout-ms",
     "--lease-socket",
     "--lease-max-ms",
+    "--turn",
     "--lease-unit-instance",
     "--lease-reservation-micro-usd",
 ];
 
-const LEASE_CALLER: [&str; 3] = [
+const LEASE_CALLER: [&str; 4] = [
     "--caller-id",
+    "--turn",
     "--lease-unit-instance",
     "--lease-reservation-micro-usd",
 ];
@@ -180,6 +182,15 @@ impl Flags {
             .map_err(|_| Failure::Malformed(name))
     }
 
+    /// The kind of turn a leasing account serves: `self` or `persona`.
+    fn turn(&self) -> Result<LeaseTurn, Failure> {
+        match self.text("--turn")?.as_str() {
+            "self" => Ok(LeaseTurn::SelfRun),
+            "persona" => Ok(LeaseTurn::PersonaTurn),
+            _ => Err(Failure::Malformed("--turn")),
+        }
+    }
+
     fn number_or<T: std::str::FromStr>(
         &self,
         name: &'static str,
@@ -328,6 +339,7 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
             Ok(LeaseCallerConfig {
                 unix_user: unix_user.clone(),
                 caller_id: first.caller_runtime_id.clone(),
+                turn: flags.turn()?,
                 unit_instance: flags.text("--lease-unit-instance")?,
                 reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
             })
@@ -398,6 +410,7 @@ fn add_lease_caller(path: &str, args: &[&str]) -> Result<(), Failure> {
     config.lease_callers.push(LeaseCallerConfig {
         unix_user: flags.text("--lease-user")?,
         caller_id: flags.text("--caller-id")?,
+        turn: flags.turn()?,
         unit_instance: flags.text("--lease-unit-instance")?,
         reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
     });
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 3659113..8ca6828 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -15,7 +15,7 @@ use cultcache_rs::{
     CacheBackingStore, CultCache, CultCacheEnvelope, DatabaseEntry,
     SingleFileMessagePackBackingStore,
 };
-use model_connector::{CallerConfig, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
+use model_connector::{CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
 
 const CANARY: &str = "canary-9f3b7c1d";
 const OPUS: &str = "claude-opus-5-1";
@@ -99,6 +99,7 @@ fn valid() -> ClaudeConnectorConfig {
         lease_callers: vec![LeaseCallerConfig {
             unix_user: "mind-eureka-self".to_string(),
             caller_id: "persona-a-caller".to_string(),
+            turn: LeaseTurn::SelfRun,
             unit_instance: "eureka".to_string(),
             reservation_micro_usd: 5_000_000,
         }],
@@ -1106,6 +1107,8 @@ fn config_init_binds_each_lease_user_to_the_configured_caller() {
                 "mind-eureka-self",
                 "--lease-max-ms",
                 "120000",
+                "--turn",
+                "self",
                 "--lease-unit-instance",
                 "eureka",
                 "--lease-reservation-micro-usd",
@@ -1120,6 +1123,7 @@ fn config_init_binds_each_lease_user_to_the_configured_caller() {
         [LeaseCallerConfig {
             unix_user: "mind-eureka-self".to_string(),
             caller_id: "persona-a-caller".to_string(),
+            turn: LeaseTurn::SelfRun,
             unit_instance: "eureka".to_string(),
             reservation_micro_usd: 5_000_000,
         }]
@@ -1139,6 +1143,8 @@ fn config_check_refuses_a_lease_account_the_system_does_not_have() {
             socket.to_str().unwrap(),
             "--lease-user",
             "no-such-account-4f1c",
+            "--turn",
+            "self",
             "--lease-unit-instance",
             "eureka",
             "--lease-reservation-micro-usd",
@@ -1185,6 +1191,8 @@ fn serve_binds_the_lease_socket_and_answers_a_stranger_with_a_refusal() {
             socket.to_str().unwrap(),
             "--lease-user",
             "nobody",
+            "--turn",
+            "self",
             "--lease-unit-instance",
             "eureka",
             "--lease-reservation-micro-usd",
@@ -1304,6 +1312,7 @@ fn a_lease_caller_bills_one_configured_caller_within_that_callers_ceiling() {
     let lease = |user: &str, caller: &str, instance: &str, reservation: u64| LeaseCallerConfig {
         unix_user: user.to_string(),
         caller_id: caller.to_string(),
+        turn: LeaseTurn::SelfRun,
         unit_instance: instance.to_string(),
         reservation_micro_usd: reservation,
     };
@@ -1339,6 +1348,8 @@ fn add_caller_and_add_lease_caller_extend_the_document_and_grow_the_serve_limits
                 "/run/claude-connector/lease.sock",
                 "--lease-user",
                 "mind-eureka-self",
+                "--turn",
+                "self",
                 "--lease-unit-instance",
                 "eureka",
                 "--lease-reservation-micro-usd",
@@ -1386,6 +1397,8 @@ fn add_caller_and_add_lease_caller_extend_the_document_and_grow_the_serve_limits
             "mind-heartbeat",
             "--caller-id",
             "heartbeat",
+            "--turn",
+            "self",
             "--lease-unit-instance",
             "heartbeat",
             "--lease-reservation-micro-usd",
@@ -1446,6 +1459,8 @@ fn add_caller_and_add_lease_caller_extend_the_document_and_grow_the_serve_limits
             "mind-heartbeat",
             "--caller-id",
             "heartbeat",
+            "--turn",
+            "self",
             "--lease-unit-instance",
             "heartbeat",
             "--lease-reservation-micro-usd",
@@ -1472,6 +1487,8 @@ fn add_lease_caller_needs_a_document_that_lends_a_token() {
             "mind-heartbeat",
             "--caller-id",
             "persona-a-caller",
+            "--turn",
+            "self",
             "--lease-unit-instance",
             "heartbeat",
             "--lease-reservation-micro-usd",
@@ -1668,3 +1685,69 @@ fn config_init_keeps_an_existing_secret_file_only_if_it_is_usable() {
     assert_eq!(std::fs::read_to_string(&secret).unwrap(), "k".repeat(32));
     assert!(scratch.path("connector.cc").exists());
 }
+
+#[test]
+fn a_persona_lease_row_validates_and_an_account_leases_for_one_turn_only() {
+    let mut config = valid();
+    let mut persona = config.lease_callers[0].clone();
+    persona.unix_user = "mind-eureka-persona".to_string();
+    persona.turn = LeaseTurn::PersonaTurn;
+    config.lease_callers.push(persona.clone());
+    config.validate().unwrap();
+    // The same account under the other turn is a second row for one uid.
+    config.lease_callers[1].unix_user = config.lease_callers[0].unix_user.clone();
+    assert_eq!(refused(&config), "lease_callers");
+}
+
+#[test]
+fn add_lease_caller_takes_the_turn_and_refuses_an_unknown_one() {
+    let scratch = Scratch::new();
+    let made = init(
+        &scratch,
+        &init_flags(
+            &scratch,
+            &[
+                "--lease-socket",
+                "/run/claude-connector/lease.sock",
+                "--lease-user",
+                "mind-eureka-self",
+                "--turn",
+                "self",
+                "--lease-unit-instance",
+                "eureka",
+                "--lease-reservation-micro-usd",
+                "5000000",
+            ],
+        ),
+    );
+    assert!(made.status.success(), "{}", shown(&made));
+    let path = scratch.path("connector.cc");
+    let add = |turn: &str| {
+        run(
+            &[
+                "config",
+                "add-lease-caller",
+                path.to_str().unwrap(),
+                "--lease-user",
+                "mind-eureka-persona",
+                "--caller-id",
+                "persona-a-caller",
+                "--turn",
+                turn,
+                "--lease-unit-instance",
+                "eureka",
+                "--lease-reservation-micro-usd",
+                "1000000",
+            ],
+            &[],
+        )
+    };
+    let unknown = add("heartbeat");
+    assert!(!unknown.status.success());
+    assert_eq!(load_config(&path).unwrap().lease_callers.len(), 1);
+    let added = add("persona");
+    assert!(added.status.success(), "{}", shown(&added));
+    let config = load_config(&path).unwrap();
+    assert_eq!(config.lease_callers[1].turn, LeaseTurn::PersonaTurn);
+    assert_eq!(config.lease_callers[0].turn, LeaseTurn::SelfRun);
+}
diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 72fe188..f6a2b7e 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -22,7 +22,8 @@ use claude_connector::{
     decode_frame, encode_frame, serve_leases,
 };
 use model_connector::{
-    CallerAdmission, LeaseAdmission, LeaseRefusal, ModelPrice, ModelUsage, Rates, SpendCeiling,
+    CallerAdmission, LeaseAdmission, LeaseRefusal, LeaseTurn, LeaseUse, ModelPrice, ModelUsage, Rates,
+    SpendCeiling,
     SpendWindowMs, TransportService, Usage,
 };
 use zeroize::Zeroizing;
@@ -147,6 +148,7 @@ struct Setup {
     ceiling: u64,
     reservation: u64,
     uid: u32,
+    turn: LeaseTurn,
     token: Option<&'static str>,
     max_connections: usize,
 }
@@ -156,6 +158,7 @@ fn setup(ceiling: u64, reservation: u64) -> Setup {
         ceiling,
         reservation,
         uid: own_uid(),
+        turn: LeaseTurn::SelfRun,
         token: Some(TOKEN),
         max_connections: 8,
     }
@@ -218,6 +221,7 @@ fn start_with(
     let caller = LeaseCaller {
         uid: setup.uid,
         caller_id: CALLER.to_string(),
+        turn: setup.turn,
         unit_instance: instance.to_string(),
         reservation_micro_usd: setup.reservation,
     };
@@ -411,7 +415,7 @@ fn probe_reserve(harness: &Harness, name: &str, cost: u64) -> LeaseAdmission {
         .service
         .lock()
         .unwrap()
-        .begin_lease(CALLER, name, cost, FAR, now_ms())
+        .begin_lease(CALLER, LeaseTurn::SelfRun, name, cost, FAR, now_ms())
         .unwrap()
 }
 
@@ -539,7 +543,7 @@ fn the_reservation_is_claimed_before_the_token_is_read_or_lent() {
         let admission = service
             .lock()
             .unwrap()
-            .begin_lease(CALLER, "probe", 1, FAR, now_ms())
+            .begin_lease(CALLER, LeaseTurn::SelfRun, "probe", 1, FAR, now_ms())
             .unwrap();
         *sink.lock().unwrap() = Some(admission);
     }));
@@ -1164,3 +1168,161 @@ fn the_unit_is_asked_of_the_callers_unit_through_the_peers_handle() {
         vec![(std::process::id().to_string(), UNIT.to_string())]
     );
 }
+
+const PERSONA_UNIT: &str = "mind-persona@eureka.service";
+
+/// A listener whose one lease caller is a Persona account; peers start in
+/// invocation 1 of the Persona unit.
+fn start_persona(setup: Setup) -> Harness {
+    let units = Arc::new(FakeUnits {
+        peer: Mutex::new(None),
+        asked_about: Mutex::new(Vec::new()),
+    });
+    let harness = start_with(
+        Setup {
+            turn: LeaseTurn::PersonaTurn,
+            ..setup
+        },
+        units.clone(),
+        Some(units),
+        INSTANCE,
+    );
+    harness.run_in(PERSONA_UNIT, 1);
+    harness
+}
+
+fn lease_on(
+    harness: &Harness,
+    turn: LeaseTurn,
+    invocation: &str,
+) -> LeaseAdmission {
+    harness
+        .service
+        .lock()
+        .unwrap()
+        .begin_lease(CALLER, turn, invocation, 100, FAR, now_ms())
+        .unwrap()
+}
+
+fn lease_id(admission: &LeaseAdmission) -> String {
+    match admission {
+        LeaseAdmission::Granted(grant) => grant.lease_id.clone(),
+        other => panic!("expected a grant, got {other:?}"),
+    }
+}
+
+fn busy() -> LeaseAdmission {
+    LeaseAdmission::Refused(LeaseRefusal::Busy)
+}
+
+#[test]
+fn persona_and_self_of_one_caller_lease_together() {
+    let harness = start(setup(1_000_000, 100));
+    let own = lease_on(&harness, LeaseTurn::SelfRun, "self-run");
+    assert_eq!(lease_id(&own), "lease:self-run");
+    let persona = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run");
+    assert_eq!(lease_id(&persona), "lease:persona-run:1");
+    // Each turn kind still holds one: a second Self run is busy while the
+    // first is open, a second Persona lease of the same invocation too.
+    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run-2"), busy());
+    assert_eq!(
+        lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run"),
+        busy()
+    );
+    // Settling the Persona lease frees nothing of the Self lease's.
+    harness
+        .service
+        .lock()
+        .unwrap()
+        .settle_lease(CALLER, "lease:persona-run:1", LeaseUse::Reservation)
+        .unwrap();
+    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run-2"), busy());
+}
+
+#[test]
+fn persona_invocation_leases_sequentially() {
+    let harness = start(setup(1_000_000, 100));
+    for expected in 1..=3 {
+        let granted = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run");
+        let id = lease_id(&granted);
+        assert_eq!(id, format!("lease:persona-run:{expected}"));
+        harness
+            .service
+            .lock()
+            .unwrap()
+            .settle_lease(CALLER, &id, LeaseUse::Reservation)
+            .unwrap();
+    }
+    // Another invocation counts from one: the sequence is per invocation.
+    let other = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-other");
+    assert_eq!(lease_id(&other), "lease:persona-other:1");
+}
+
+#[test]
+fn persona_invocation_second_open_lease_busy() {
+    let harness = start_persona(setup(1_000_000, 100));
+    let first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    let second = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
+    assert!(second.fds.is_empty());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+}
+
+#[test]
+fn persona_turns_of_a_live_invocation_each_lend_a_token_over_the_socket() {
+    let harness = start_persona(setup(1_000_000, 100));
+    for _ in 0..2 {
+        let mut answer = ask(&harness, 60_000);
+        assert!(granted_ok(&answer));
+        settle(&mut answer, vec![used(MODEL, 10)]);
+    }
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
+}
+
+#[test]
+fn self_invocation_still_leases_once() {
+    let harness = start(setup(1_000_000, 100));
+    let id = lease_id(&lease_on(&harness, LeaseTurn::SelfRun, "self-run"));
+    harness
+        .service
+        .lock()
+        .unwrap()
+        .settle_lease(CALLER, &id, LeaseUse::Reservation)
+        .unwrap();
+    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run"), busy());
+}
+
+#[test]
+fn persona_row_refuses_mind_self_unit() {
+    let harness = start_persona(setup(1_000_000, 100));
+    harness.run_in(UNIT, 1);
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
+    assert!(answer.fds.is_empty());
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    // And a Self row refuses the Persona unit.
+    let harness = start(setup(1_000_000, 100));
+    harness.run_in(PERSONA_UNIT, 1);
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn a_persona_lease_reserves_and_settles_in_the_callers_window() {
+    let harness = start(setup(1_000, 600));
+    let id = lease_id(&lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run"));
+    // 100 reserved by the helper; a Self probe of 901 cannot fit, 900 can.
+    assert_eq!(probe_reserve(&harness, "p1", 901), ceiling_refused());
+    harness
+        .service
+        .lock()
+        .unwrap()
+        .settle_lease(CALLER, &id, LeaseUse::NeverLent)
+        .unwrap();
+    assert!(matches!(
+        probe_reserve(&harness, "p2", 1_000),
+        LeaseAdmission::Granted(_)
+    ));
+}
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 8adaf07..ea3dbeb 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -337,7 +337,7 @@ struct LiveRequest {
     reserved_micro_usd: u64,
     /// A Self run's credential lease, not a provider call: it holds its
     /// reservation in the window like a call does but takes no request slot.
-    lease: bool,
+    lease: Option<LeaseTurn>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -846,7 +846,7 @@ impl TransportService {
             .live
             .iter()
             .filter(|(key, request)| {
-                !request.lease && key.caller_runtime_id == invocation.caller_runtime_id
+                request.lease.is_none() && key.caller_runtime_id == invocation.caller_runtime_id
             })
             .count();
         if active_for_caller >= max_concurrent_requests {
@@ -909,7 +909,7 @@ impl TransportService {
             LiveRequest {
                 window,
                 reserved_micro_usd,
-                lease: false,
+                lease: None,
             },
         );
         Ok(TransportAdmission::Execute(Box::new(ExecutionClaim {
@@ -1272,7 +1272,9 @@ fn replay_store_error(error: impl std::fmt::Display) -> ServiceError {
 }
 
 mod lease;
-pub use lease::{LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseUse, ModelUsage};
+pub use lease::{
+    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseTurn, LeaseUse, ModelUsage,
+};
 
 fn contract_refusal(error: &ContractError) -> Refusal {
     match error {
diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index 6e9be71..d6e01e5 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -1,4 +1,4 @@
-//! A credential lease: a Self run's reservation in the caller's spend window.
+//! A credential lease: a Self run's or a Persona turn's reservation in the caller's spend window.
 //! The lease is one record of the same ledger a provider call reserves in, not
 //! a second ledger: it is claimed before anything is lent, counts against the
 //! window's ceiling while open, and settles to the true cost of what the run
@@ -12,6 +12,22 @@ use super::*;
 /// The request-id namespace of leases in a caller's replay records.
 const LEASE_PREFIX: &str = "lease:";
 
+/// The most leases one Persona invocation may take in its life.
+const MAX_PERSONA_LEASES: u32 = 1024;
+
+/// Room kept in an identity for `:<n>`, `n` at most `MAX_PERSONA_LEASES`.
+const SEQUENCE_SUFFIX_BYTES: usize = 5;
+
+/// Which kind of turn a lease serves. It is a property of the lease caller's
+/// configured row, never of a request. A Self run leases once per unit
+/// invocation; a Persona turn leases once per turn, so one live invocation
+/// leases in sequence, one open lease at a time.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LeaseTurn {
+    SelfRun,
+    PersonaTurn,
+}
+
 /// What an admitted lease holds.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LeaseGrant {
@@ -77,7 +93,8 @@ pub enum LeaseRefusal {
     /// free pass.
     CostBound,
     UnknownCaller,
-    /// The caller holds a lease already, or this run id was leased before.
+    /// A Self run: the caller holds a Self lease already, or this invocation
+    /// leased before. A Persona turn: this invocation holds a lease now.
     Busy,
 }
 
@@ -89,11 +106,17 @@ pub enum LeaseAdmission {
 
 impl TransportService {
     /// Reserves `max_cost_micro_usd` in `caller_runtime_id`'s current window
-    /// for the unit invocation `invocation_id`, which leases once. A ledger
-    /// that cannot be written answers `Err` and reserves nothing. A lease takes no request slot.
+    /// for the unit invocation `invocation_id`. A Self run leases once per
+    /// invocation, as `lease:<invocation>`, and one Self lease is open per
+    /// caller. A Persona turn takes the next free sequence of its invocation
+    /// as `lease:<invocation>:<n>`, one open at a time; a Persona lease never
+    /// blocks or is blocked by the caller's Self lease. A ledger that cannot
+    /// be written answers `Err` and reserves nothing. A lease takes no
+    /// request slot.
     pub fn begin_lease(
         &mut self,
         caller_runtime_id: &str,
+        turn: LeaseTurn,
         invocation_id: &str,
         max_cost_micro_usd: u64,
         expires_at_unix_ms: u64,
@@ -106,30 +129,60 @@ impl TransportService {
         let spend_window_ms = caller.spend_window_ms;
         let connection_key_epoch = caller.connection_key_epoch;
         require_id(invocation_id, "invocation_id")?;
-        if invocation_id.len() + LEASE_PREFIX.len() > MAX_IDENTITY_BYTES {
+        if invocation_id.len() + LEASE_PREFIX.len() + SEQUENCE_SUFFIX_BYTES > MAX_IDENTITY_BYTES {
             return Err(ContractError::Invalid("invocation_id").into());
         }
         if max_cost_micro_usd == 0 {
             return Ok(LeaseAdmission::Refused(LeaseRefusal::CostBound));
         }
-        let identity = RequestIdentity {
-            caller_runtime_id: caller_runtime_id.to_string(),
-            request_id: format!("{LEASE_PREFIX}{invocation_id}"),
+        let identity = match turn {
+            LeaseTurn::SelfRun => {
+                let identity = RequestIdentity {
+                    caller_runtime_id: caller_runtime_id.to_string(),
+                    request_id: format!("{LEASE_PREFIX}{invocation_id}"),
+                };
+                let holding = self.live.iter().any(|(held, request)| {
+                    request.lease == Some(LeaseTurn::SelfRun)
+                        && held.caller_runtime_id == caller_runtime_id
+                });
+                if holding
+                    || self
+                        .replay_store
+                        .get::<ReplayRecord>(&replay_key(&identity))
+                        .map_err(replay_store_error)?
+                        .is_some()
+                {
+                    return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
+                }
+                identity
+            }
+            LeaseTurn::PersonaTurn => {
+                let mut free = None;
+                for sequence in 1..=MAX_PERSONA_LEASES {
+                    let identity = RequestIdentity {
+                        caller_runtime_id: caller_runtime_id.to_string(),
+                        request_id: format!("{LEASE_PREFIX}{invocation_id}:{sequence}"),
+                    };
+                    if self.live.contains_key(&identity) {
+                        return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
+                    }
+                    if self
+                        .replay_store
+                        .get::<ReplayRecord>(&replay_key(&identity))
+                        .map_err(replay_store_error)?
+                        .is_none()
+                    {
+                        free = Some(identity);
+                        break;
+                    }
+                }
+                let Some(identity) = free else {
+                    return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
+                };
+                identity
+            }
         };
         let key = replay_key(&identity);
-        let holding = self
-            .live
-            .iter()
-            .any(|(held, request)| request.lease && held.caller_runtime_id == caller_runtime_id);
-        if holding
-            || self
-                .replay_store
-                .get::<ReplayRecord>(&key)
-                .map_err(replay_store_error)?
-                .is_some()
-        {
-            return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
-        }
         let admitted_at_unix_ms = admission_clock(
             &self.window_spend,
             caller_runtime_id,
@@ -185,7 +238,7 @@ impl TransportService {
             LiveRequest {
                 window,
                 reserved_micro_usd: max_cost_micro_usd,
-                lease: true,
+                lease: Some(turn),
             },
         );
         Ok(LeaseAdmission::Granted(LeaseGrant {
@@ -213,7 +266,7 @@ impl TransportService {
         if !self
             .live
             .get(&identity)
-            .is_some_and(|request| request.lease)
+            .is_some_and(|request| request.lease.is_some())
         {
             return Err(ServiceError::NoActiveRequest);
         }

From 1bf9fdb4375a530b4d803acb7b03a34bd1bafceb Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 01:57:21 +0100
Subject: [PATCH 12/37] lease-persona-callers: rustfmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs  |  3 +--
 crates/claude-connector/tests/lease.rs | 11 +++--------
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index d37d833..4b2dd6a 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -12,8 +12,7 @@ use std::time::Duration;
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
     CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ModelPrice, ProviderBackend,
-    ServeError,
-    ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
+    ServeError, ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
 };
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index f6a2b7e..0d8e357 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -22,9 +22,8 @@ use claude_connector::{
     decode_frame, encode_frame, serve_leases,
 };
 use model_connector::{
-    CallerAdmission, LeaseAdmission, LeaseRefusal, LeaseTurn, LeaseUse, ModelPrice, ModelUsage, Rates,
-    SpendCeiling,
-    SpendWindowMs, TransportService, Usage,
+    CallerAdmission, LeaseAdmission, LeaseRefusal, LeaseTurn, LeaseUse, ModelPrice, ModelUsage,
+    Rates, SpendCeiling, SpendWindowMs, TransportService, Usage,
 };
 use zeroize::Zeroizing;
 
@@ -1191,11 +1190,7 @@ fn start_persona(setup: Setup) -> Harness {
     harness
 }
 
-fn lease_on(
-    harness: &Harness,
-    turn: LeaseTurn,
-    invocation: &str,
-) -> LeaseAdmission {
+fn lease_on(harness: &Harness, turn: LeaseTurn, invocation: &str) -> LeaseAdmission {
     harness
         .service
         .lock()

From 47a4dcc6b440c544fb5418baaf145e37b8f49140 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 01:58:12 +0100
Subject: [PATCH 13/37] lease-persona-callers: model-connector lease callers
 take the turn

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/model-connector/src/service/lease.rs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index d6e01e5..6fa53ae 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -263,10 +263,10 @@ impl TransportService {
             caller_runtime_id: caller_runtime_id.to_string(),
             request_id: lease_id.to_string(),
         };
-        if !self
+        if self
             .live
             .get(&identity)
-            .is_some_and(|request| request.lease.is_some())
+            .is_none_or(|request| request.lease.is_none())
         {
             return Err(ServiceError::NoActiveRequest);
         }
@@ -378,7 +378,7 @@ mod tests {
 
     fn lease(service: &mut TransportService, run: &str, cost: u64) -> LeaseAdmission {
         service
-            .begin_lease(CALLER, run, cost, NOW + 60_000, NOW)
+            .begin_lease(CALLER, LeaseTurn::SelfRun, run, cost, NOW + 60_000, NOW)
             .unwrap()
     }
 
@@ -473,7 +473,7 @@ mod tests {
         let mut service = open(&store, 1_000);
         assert_eq!(
             service
-                .begin_lease("stranger", "run-1", 100, NOW + 1, NOW)
+                .begin_lease("stranger", LeaseTurn::SelfRun, "run-1", 100, NOW + 1, NOW)
                 .unwrap(),
             LeaseAdmission::Refused(LeaseRefusal::UnknownCaller)
         );
@@ -648,7 +648,7 @@ mod tests {
         allowance.store(0, Ordering::SeqCst);
         assert!(
             service
-                .begin_lease(CALLER, "run-1", 100, NOW + 1, NOW)
+                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-1", 100, NOW + 1, NOW)
                 .is_err()
         );
         assert_eq!(held(&service), 0);
@@ -724,7 +724,7 @@ mod tests {
             .unwrap();
         assert!(
             service
-                .begin_lease(CALLER, &format!("{longest}r"), 100, NOW + 1, NOW)
+                .begin_lease(CALLER, LeaseTurn::SelfRun, &format!("{longest}r"), 100, NOW + 1, NOW)
                 .is_err()
         );
     }

From d2b82a6c500b5db28803203dac9e46406c857711 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 01:59:39 +0100
Subject: [PATCH 14/37] lease-persona-callers: the identity bound keeps room
 for the Persona sequence

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/model-connector/src/service/lease.rs | 28 +++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index 6fa53ae..03f34dc 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -129,7 +129,11 @@ impl TransportService {
         let spend_window_ms = caller.spend_window_ms;
         let connection_key_epoch = caller.connection_key_epoch;
         require_id(invocation_id, "invocation_id")?;
-        if invocation_id.len() + LEASE_PREFIX.len() + SEQUENCE_SUFFIX_BYTES > MAX_IDENTITY_BYTES {
+        let suffix = match turn {
+            LeaseTurn::SelfRun => 0,
+            LeaseTurn::PersonaTurn => SEQUENCE_SUFFIX_BYTES,
+        };
+        if invocation_id.len() + LEASE_PREFIX.len() + suffix > MAX_IDENTITY_BYTES {
             return Err(ContractError::Invalid("invocation_id").into());
         }
         if max_cost_micro_usd == 0 {
@@ -724,11 +728,31 @@ mod tests {
             .unwrap();
         assert!(
             service
-                .begin_lease(CALLER, LeaseTurn::SelfRun, &format!("{longest}r"), 100, NOW + 1, NOW)
+                .begin_lease(
+                    CALLER,
+                    LeaseTurn::SelfRun,
+                    &format!("{longest}r"),
+                    100,
+                    NOW + 1,
+                    NOW
+                )
                 .is_err()
         );
     }
 
+    #[test]
+    fn a_persona_invocation_id_leaves_room_for_its_sequence() {
+        let store = TestStore::new();
+        let mut service = open(&store, 1 << 40);
+        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len() - SEQUENCE_SUFFIX_BYTES);
+        let persona = |service: &mut TransportService, id: &str| {
+            service.begin_lease(CALLER, LeaseTurn::PersonaTurn, id, 100, NOW + 60_000, NOW)
+        };
+        let grant = granted(persona(&mut service, &longest).unwrap());
+        assert!(grant.lease_id.len() <= MAX_IDENTITY_BYTES);
+        assert!(persona(&mut service, &format!("{longest}r")).is_err());
+    }
+
     #[test]
     fn a_settled_lease_leaves_its_charge_not_its_reservation_across_a_restart() {
         let store = TestStore::new();

From 06a47bb13f99dc0ab9e7d35dabb9da839c4be810 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:43:18 +0100
Subject: [PATCH 15/37] connector-usage-only: delete the dollar authorities
 (WIP, does not yet build)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitattributes                                |    2 +-
 README.md                                     |    8 +-
 crates/claude-connector/Cargo.toml            |    3 +
 crates/claude-connector/src/backend/tests.rs  |   81 +-
 crates/claude-connector/src/daemon.rs         |   66 +-
 crates/claude-connector/src/lease.rs          |  247 +-
 crates/claude-connector/src/lib.rs            |    2 +-
 crates/claude-connector/src/main.rs           |   58 +-
 crates/claude-connector/src/quota.rs          |    2 +-
 crates/claude-connector/src/stream.rs         |    6 +-
 .../claude-connector/tests/config_document.rs | 1684 +-----------
 .../tests/fixtures/lease_v1/grant.bin         |  Bin 109 -> 0 bytes
 .../tests/fixtures/lease_v1/refusal.bin       |  Bin 104 -> 0 bytes
 .../tests/fixtures/lease_v1/request.bin       |  Bin 66 -> 0 bytes
 .../tests/fixtures/lease_v1/settle.bin        |  Bin 336 -> 0 bytes
 .../tests/fixtures/lease_v1/settled.bin       |  Bin 81 -> 0 bytes
 crates/claude-connector/tests/lease.rs        | 1306 ++-------
 crates/model-connector/src/client.rs          |   34 +-
 crates/model-connector/src/contract.rs        |   83 +-
 crates/model-connector/src/envelope.rs        |   94 +-
 crates/model-connector/src/fixtures.rs        |   43 +-
 crates/model-connector/src/readout.rs         |   55 +-
 crates/model-connector/src/serve.rs           |  127 +-
 crates/model-connector/src/service.rs         | 2342 ++---------------
 crates/model-connector/src/service/lease.rs   |  874 ++----
 .../fixtures/{wire_v3 => wire_v4}/README.md   |    8 +-
 .../carriage_invocation.frame                 |    0
 .../input_reasoning_state.mp                  |    0
 .../{wire_v3 => wire_v4}/provider_request.mp  |  Bin
 .../transport_envelope.mp                     |  Bin
 .../transport_invocation.mp                   |  Bin
 .../transport_receipt_failed.mp               |  Bin
 .../transport_result_refused.mp               |    0
 .../transport_result_transported.mp           |  Bin
 .../tests/published_schemas.rs                |   12 +-
 .../model-connector/tests/reasoning_state.rs  |   22 +-
 .../{wire_golden_v3.rs => wire_golden_v4.rs}  |   18 +-
 schemas/spend_readout.json                    |  112 -
 schemas/transport_envelope.json               |    4 +-
 39 files changed, 1263 insertions(+), 6030 deletions(-)
 delete mode 100644 crates/claude-connector/tests/fixtures/lease_v1/grant.bin
 delete mode 100644 crates/claude-connector/tests/fixtures/lease_v1/refusal.bin
 delete mode 100644 crates/claude-connector/tests/fixtures/lease_v1/request.bin
 delete mode 100644 crates/claude-connector/tests/fixtures/lease_v1/settle.bin
 delete mode 100644 crates/claude-connector/tests/fixtures/lease_v1/settled.bin
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/README.md (74%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/carriage_invocation.frame (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/input_reasoning_state.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/provider_request.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/transport_envelope.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/transport_invocation.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/transport_receipt_failed.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/transport_result_refused.mp (100%)
 rename crates/model-connector/tests/fixtures/{wire_v3 => wire_v4}/transport_result_transported.mp (100%)
 rename crates/model-connector/tests/{wire_golden_v3.rs => wire_golden_v4.rs} (96%)
 delete mode 100644 schemas/spend_readout.json

diff --git a/.gitattributes b/.gitattributes
index 0a1d199..56862bb 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,2 @@
 schemas/*.json text eol=lf
-crates/model-connector/tests/fixtures/wire_v3/* -text
+crates/model-connector/tests/fixtures/wire_v4/* -text
diff --git a/README.md b/README.md
index c2e23c7..34c8730 100644
--- a/README.md
+++ b/README.md
@@ -21,11 +21,11 @@ Crate `crates/model-connector`:
 - `src/envelope.rs` - the AES-256-GCM `TransportEnvelope` (binary ciphertext), its
   identity-binding AAD, the length-prefixed framing, and the CultNet carriage: each frame is a
   `cultnet.operation_request.v0` / `operation_response.v0` for service
-  `gamecult.model.connector`, operation `invoke` (or `spend_readout`), its `message_id` the
-  request id and its payload the base64 of the sealed envelope. `spend_readout` answers a
-  `SpendReadout` (`gamecult.model.spend_readout.v1`): each caller's spent and reserved
+  `gamecult.model.connector`, operation `invoke` (or `usage_readout`), its `message_id` the
+  request id and its payload the base64 of the sealed envelope. `usage_readout` answers a
+  `UsageReadout` (`gamecult.model.usage_readout.v1`): each caller's spent and reserved
   micro-USD against its ceiling in its current window, and the backend's plan quota;
-  `ConnectorClient::spend_readout` asks.
+  `ConnectorClient::usage_readout` asks.
 - `schemas/` - one JSON Schema per v3 document, generated from the types.
 - `src/client.rs` - `ConnectorClient`, the one-request caller side.
 - `src/service.rs` (feature `daemon`) - `TransportService`: caller admission, durable
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index 6592252..7b310e5 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -25,3 +25,6 @@ zeroize = "1"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
+
+[dev-dependencies]
+rmpv = "1"
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index fc2be99..227b9f9 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -5,8 +5,7 @@ use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use model_connector::{
-    CallerAdmission, ModelPrice, PriceTable, Rates, ReasoningEffort, SpendCeiling, SpendWindowMs,
-    StopReason, ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation,
+    CallerAdmission, PlanQuotaSnapshot, ReasoningEffort, StopReason, ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation,
     TransportKey, TransportReceipt, TransportService, decrypt_result, encrypt_invocation,
 };
 
@@ -460,25 +459,6 @@ struct Door {
     service: TransportService,
 }
 
-fn prices() -> PriceTable {
-    PriceTable::from([MODEL, OTHER_MODEL].map(|model| {
-        (
-            model.to_string(),
-            ModelPrice {
-                rates: Rates {
-                    input: 3_000_000,
-                    cache_write_short: 3_750_000,
-                    cache_write_long: 6_000_000,
-                    cache_read: 300_000,
-                    output: 15_000_000,
-                },
-                long_context: None,
-                overhead_tokens: 100,
-            },
-        )
-    }))
-}
-
 impl Door {
     fn new() -> Self {
         let dir = std::env::temp_dir().join(format!(
@@ -496,13 +476,11 @@ impl Door {
                 4,
                 FRAME / 2,
                 32_768,
-                SpendCeiling(1 << 40),
-                SpendWindowMs(3_600_000),
             )
             .unwrap()
         });
         let service =
-            TransportService::open(&dir.join("replay.cc"), PROVIDER, prices(), callers, 5_000)
+            TransportService::open(&dir.join("replay.cc"), PROVIDER, callers, 5_000)
                 .unwrap();
         Self { dir, service }
     }
@@ -521,9 +499,12 @@ impl Door {
     ) -> (model_connector::ExecutionClaim, TransportInvocation) {
         let key = TransportKey::from_connection_secret(&format!("{caller}-key")).unwrap();
         let invocation =
-            TransportInvocation::new(caller, 2_000, [7; 32], 10_000_000, request).unwrap();
+            TransportInvocation::new(caller, 2_000, [7; 32], request).unwrap();
         let envelope = encrypt_invocation(&invocation, &key).unwrap();
-        match self.service.begin(&envelope, 1_000, FRAME).unwrap() {
+        match self
+            .service
+            .begin(&envelope, 1_000, &PlanQuotaSnapshot::default(), FRAME)
+            .unwrap() {
             TransportAdmission::Execute(claim) => (*claim, invocation),
             TransportAdmission::Reply(_) => panic!("the door answered instead of admitting"),
         }
@@ -1458,11 +1439,6 @@ fn usage_sums_model_usage_across_models() {
     };
     assert_eq!(*summed, usage(12, 37, 1083, 24, Some(8)));
     // The receipt is priced from usage alone: 12*3 + 37*0.3 + 1083*6 + 24*15 micro-USD, rounded up.
-    assert_eq!(parts(&cheap).1.cost_micro_usd, 36 + 12 + 6498 + 360);
-    assert_eq!(
-        parts(&cheap).1.cost_micro_usd,
-        parts(&dear).1.cost_micro_usd
-    );
 
     // No model reported thinking tokens: none is claimed.
     let plain = r#"{"claude-haiku-5-5":{"inputTokens":1,"outputTokens":1,"cacheReadInputTokens":0,"cacheCreationInputTokens":0}}"#;
@@ -1599,7 +1575,6 @@ fn no_result_event_is_a_failure_with_unknown_usage() {
     };
     assert_eq!(zero_billed, Some(usage_zero()));
 
-    let mut costs = Vec::new();
     for (script, expected) in ends {
         let rig = rig(vec![script]);
         let result = rig.run(request(vec![user("hi")]));
@@ -1607,20 +1582,7 @@ fn no_result_event_is_a_failure_with_unknown_usage() {
         assert_eq!(kind, expected);
         assert_eq!(usage, None, "{message}");
         assert!(result.transcript_items().is_empty());
-        costs.push(parts(&result).1.cost_micro_usd);
     }
-    // Unknown usage is charged the reservation, which is far above a typical turn.
-    assert!(costs.iter().all(|cost| *cost >= 15_000), "{costs:?}");
-    assert_eq!(
-        parts(&rig(vec![]).run({
-            let mut bad = request(vec![user("a")]);
-            bad.tools.push(a_tool());
-            bad
-        }))
-        .1
-        .cost_micro_usd,
-        0
-    );
 }
 
 #[test]
@@ -1719,7 +1681,6 @@ fn a_port_that_cannot_spawn_is_a_provider_failure() {
         Some(usage_zero()),
         "a child that never ran bills nothing"
     );
-    assert_eq!(parts(&result).1.cost_micro_usd, 0);
     assert!(
         !message.contains(dir.path().to_str().unwrap()),
         "no path in a message"
@@ -1743,8 +1704,6 @@ fn backend_end_to_end_through_the_service() {
     assert_eq!(receipt.provider, "claude-code");
     assert_eq!(receipt.model, MODEL);
     // USAGE priced at the table: 2*3 + 7*0.3 + 1043*6 + 4*15 micro-USD, rounded up.
-    assert_eq!(receipt.cost_micro_usd, 6 + 3 + 6258 + 60);
-    assert_eq!(receipt.overrun_micro_usd, 0);
     assert_eq!(events.len(), 2);
     let items = opened.transcript_items();
     assert_eq!(items[0], assistant("hello back"));
@@ -1757,13 +1716,6 @@ fn backend_end_to_end_through_the_service() {
 
 const USAGE_TURN_2: &str = r#"{"claude-haiku-5-5":{"inputTokens":3,"outputTokens":5,"cacheReadInputTokens":1100,"cacheCreationInputTokens":9}}"#;
 
-/// What a call whose usage is unknown is billed: the kit's reservation.
-fn reservation() -> u64 {
-    let result = rig(vec![Script::lines(vec![])]).run(request(vec![user("hi")]));
-    assert_eq!(failure_of(&result).2, None);
-    parts(&result).1.cost_micro_usd
-}
-
 #[test]
 fn a_resumed_turn_is_charged_only_its_own_usage() {
     let rig = rig(vec![
@@ -1788,13 +1740,10 @@ fn a_resumed_turn_is_charged_only_its_own_usage() {
     };
     assert_eq!(*billed, usage(3, 1100, 9, 5, None));
     // 3*3 + 1100*0.3 + 9*6 + 5*15 micro-USD.
-    assert_eq!(parts(&second).1.cost_micro_usd, 9 + 330 + 54 + 75);
 }
 
 #[test]
-fn usage_the_result_does_not_report_is_billed_the_reservation() {
-    let reservation = reservation();
-    assert!(reservation >= 15_000, "{reservation}");
+fn usage_the_result_does_not_report_stays_unknown() {
     let success = |fields: &str| {
         format!(
             r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"end_turn","modelUsage":{CUMULATIVE}{fields}}}"#
@@ -1838,7 +1787,6 @@ fn usage_the_result_does_not_report_is_billed_the_reservation() {
         let (kind, _, usage) = failure_of(&result);
         assert_eq!(kind, expected, "{line}");
         assert_eq!(usage, None, "{line}");
-        assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
     }
     for line in cases {
         let result = rig(vec![Script::lines(vec![
@@ -1850,7 +1798,6 @@ fn usage_the_result_does_not_report_is_billed_the_reservation() {
         let (kind, _, usage) = failure_of(&result);
         assert_eq!(kind, FailureKind::Provider, "{line}");
         assert_eq!(usage, None, "{line}");
-        assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
         assert!(result.transcript_items().is_empty(), "{line}");
     }
 }
@@ -1865,7 +1812,6 @@ fn door_set_is_exactly_401_403_429() {
     // with a bogus token.
     let retry = r#"{"type":"system","subtype":"api_retry","error":"authentication_failed"}"#;
     let synthetic = r#"{"type":"assistant","api_error_status":401,"error":"authentication_failed","message":{"id":"e48001b7-cf4f-49b1-9810-db8fd7f73c73","model":"<synthetic>","stop_reason":"stop_sequence","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 OAuth access token is invalid."}]}}"#;
-    let reservation = reservation();
     let statuses: [Option<u16>; 9] = [
         Some(400),
         Some(401),
@@ -1904,10 +1850,8 @@ fn door_set_is_exactly_401_403_429() {
             let case = format!("{status:?} {shape}");
             if matches!(status, Some(401 | 403 | 429)) && shape == "empty" {
                 assert_eq!(usage, Some(usage_zero()), "{case}");
-                assert_eq!(parts(&result).1.cost_micro_usd, 0, "{case}");
             } else {
                 assert_eq!(usage, None, "{case}");
-                assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{case}");
             }
         }
     }
@@ -1979,7 +1923,6 @@ fn prompt_file_lives_in_prompt_dir_exclusively() {
     let result = rig.run(request(vec![user("hi")]));
     let (kind, _, usage) = failure_of(&result);
     assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
-    assert_eq!(parts(&result).1.cost_micro_usd, 0);
     assert_eq!(rig.spawns(), 0);
 }
 
@@ -1996,11 +1939,6 @@ fn pin_is_checked_before_every_spawn() {
     let result = rig.run(request(vec![user("hi")]));
     let (kind, message, usage) = failure_of(&result);
     assert_eq!((kind, usage), (FailureKind::Provider, Some(usage_zero())));
-    assert_eq!(
-        parts(&result).1.cost_micro_usd,
-        0,
-        "billed nothing, not the reservation"
-    );
     assert!(!message.contains(rig.dir.path().to_str().unwrap()));
     assert_eq!(rig.spawns(), 1, "no child for a binary off its pin");
     assert!(!rig.backend.binary_matches_pin());
@@ -2695,7 +2633,6 @@ fn not_logged_in_line(status: &str, api_ms: u64, extra: &str) -> String {
 
 #[test]
 fn a_result_that_made_no_api_call_bills_nothing() {
-    let reservation = reservation();
     let empty = r#","model_usage_since_last_result":{}"#;
     let cases = [
         // (status field, api ms, usage field, billed nothing)
@@ -2723,10 +2660,8 @@ fn a_result_that_made_no_api_call_bills_nothing() {
         let (_, _, usage) = failure_of(&result);
         if free {
             assert_eq!(usage, Some(usage_zero()), "{line}");
-            assert_eq!(parts(&result).1.cost_micro_usd, 0, "{line}");
         } else {
             assert_eq!(usage, None, "{line}");
-            assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
         }
     }
 }
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 4b2dd6a..eaf26d0 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -3,7 +3,7 @@
 //! run with; nothing in the connector's environment, flags or JSON can change
 //! them. Validation errors name a field and never echo a value.
 
-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::BTreeSet;
 use std::net::{SocketAddr, TcpListener};
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
@@ -11,7 +11,7 @@ use std::time::Duration;
 
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
-    CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ModelPrice, ProviderBackend,
+    CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ProviderBackend,
     ServeError, ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
 };
 use serde::{Deserialize, Serialize};
@@ -31,8 +31,8 @@ const MODEL_PREFIX: &str = "claude-";
 
 /// A unix account that may lease the subscription token for a Self run or a
 /// Persona turn, the unit its process must run in (`mind-self@<unit_instance>`
-/// or `mind-persona@<unit_instance>`, by `turn`), the configured caller whose
-/// spend window its leases reserve in, and what each lease reserves there.
+/// or `mind-persona@<unit_instance>`, by `turn`), and the configured caller
+/// whose name its leases carry.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LeaseCallerConfig {
     pub unix_user: String,
@@ -41,11 +41,10 @@ pub struct LeaseCallerConfig {
     /// or `mind-persona@`, its process must run in.
     pub turn: LeaseTurn,
     pub unit_instance: String,
-    pub reservation_micro_usd: u64,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-#[cultcache(type = "gamecult.model_connector.claude_connector_config.v1")]
+#[cultcache(type = "gamecult.model_connector.claude_connector_config.v2")]
 pub struct ClaudeConnectorConfig {
     /// A loopback socket address.
     #[cultcache(key = 0)]
@@ -86,14 +85,10 @@ pub struct ClaudeConnectorConfig {
     #[cultcache(key = 16)]
     pub max_expiry_skew_ms: u64,
     /// Every caller of this connector: its own connection key and epoch, models,
-    /// concurrency, payload and output bounds, and spend ceiling and window.
+    /// concurrency, payload and output bounds.
     /// Ids are unique. Handles are bound to the caller that was given them.
     #[cultcache(key = 17)]
     pub callers: Vec<CallerConfig>,
-    /// What each allowed model costs. The keys are the known list of models:
-    /// ids exactly as the CLI reports them in its init event.
-    #[cultcache(key = 18)]
-    pub prices: BTreeMap<String, ModelPrice>,
     /// Where the Self-run lease socket is bound (a systemd RuntimeDirectory),
     /// or none when this connector lends no token.
     #[cultcache(key = 19)]
@@ -143,7 +138,6 @@ impl From<ServeError> for ConfigError {
             ServeError::ConnectionKey(_) => Self::Unusable("connection_key_file"),
             ServeError::Service(error) => match error {
                 ServiceError::ReplayStore(_) => Self::Unusable("replay_store"),
-                ServiceError::UnpricedModel(_) => Self::Invalid("prices"),
                 ServiceError::InvalidAdmission
                 | ServiceError::DuplicateCaller
                 | ServiceError::SharedCallerKey => Self::Invalid("callers"),
@@ -228,8 +222,6 @@ impl ClaudeConnectorConfig {
             if caller.max_concurrent_requests == 0
                 || caller.max_payload_bytes < MIN_PAYLOAD_BYTES
                 || caller.max_output_tokens == 0
-                || caller.spend_ceiling_micro_usd == 0
-                || caller.spend_window_ms == 0
             {
                 return Err(ConfigError::Invalid("caller bounds"));
             }
@@ -240,19 +232,11 @@ impl ClaudeConnectorConfig {
             for model in &caller.allowed_models {
                 if !has_model_id_form(model)
                     || !seen.insert(model.as_str())
-                    || !self.prices.contains_key(model)
                 {
                     return Err(ConfigError::Invalid("allowed_models"));
                 }
             }
         }
-        if !self
-            .prices
-            .iter()
-            .all(|(model, price)| has_model_id_form(model) && is_fully_priced(price))
-        {
-            return Err(ConfigError::Invalid("prices"));
-        }
         self.validate_leases()?;
         Ok(listen)
     }
@@ -278,11 +262,7 @@ impl ClaudeConnectorConfig {
                     && self
                         .callers
                         .iter()
-                        .find(|caller| caller.caller_runtime_id == lease.caller_id)
-                        .is_some_and(|caller| {
-                            (1..=caller.spend_ceiling_micro_usd)
-                                .contains(&lease.reservation_micro_usd)
-                        })
+                        .any(|caller| caller.caller_runtime_id == lease.caller_id)
                     && is_unit_instance(&lease.unit_instance)
                     && users.insert(lease.unix_user.as_str())
             })
@@ -336,8 +316,7 @@ fn is_trimmed_nonempty(text: &str) -> bool {
 /// The loose shape of a model id, only to catch typos:
 /// `claude-<family>-<major>`, then an optional `-<minor>` and an optional
 /// `-YYYYMMDD`, the family lowercase letters. No shape can tell an alias from
-/// a canonical id, so the known list is the price table's keys (ruling
-/// claude-model-ids-from-price-table); an alias that slips in fails its first
+/// a canonical id, so the known list is `allowed_models` itself; an alias that slips in fails its first
 /// call, when the stream's `init.model` differs from the request.
 fn has_model_id_form(model: &str) -> bool {
     let Some(rest) = model.strip_prefix(MODEL_PREFIX) else {
@@ -365,25 +344,6 @@ fn has_model_id_form(model: &str) -> bool {
         && after_ok
 }
 
-/// A price is a fuse only if every component it bills is nonzero: a zero rate
-/// lets a call cost nothing against the caller's ceiling.
-fn is_fully_priced(price: &ModelPrice) -> bool {
-    let long = price.long_context.map(|long| long.rates);
-    [Some(price.rates), long]
-        .into_iter()
-        .flatten()
-        .all(|rates| {
-            [
-                rates.input,
-                rates.cache_write_short,
-                rates.cache_write_long,
-                rates.cache_read,
-                rates.output,
-            ]
-            .iter()
-            .all(|rate| *rate > 0)
-        })
-}
 
 /// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
 fn is_credential_name(name: &str) -> bool {
@@ -509,7 +469,6 @@ fn lease_callers_of(config: &ClaudeConnectorConfig) -> Result<Vec<LeaseCaller>,
                     caller_id: lease.caller_id.clone(),
                     turn: lease.turn,
                     unit_instance: lease.unit_instance.clone(),
-                    reservation_micro_usd: lease.reservation_micro_usd,
                 })
                 .ok_or(ConfigError::Unusable("lease_callers"))
         })
@@ -531,6 +490,7 @@ fn start_leases(
     config: &ClaudeConnectorConfig,
     socket: &Path,
     service: Arc<Mutex<TransportService>>,
+    quota: Arc<crate::QuotaCell>,
 ) -> Result<(), ConfigError> {
     use std::os::unix::fs::{FileTypeExt, PermissionsExt};
     use std::os::unix::net::UnixListener;
@@ -559,6 +519,7 @@ fn start_leases(
                 callers,
                 limits,
                 service,
+                quota,
                 tokens,
                 Arc::new(SystemdUnits::system()),
             );
@@ -589,7 +550,6 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
         TransportService::open(
             &config.replay_store,
             backend.provider(),
-            config.prices.clone(),
             admissions,
             config.max_expiry_skew_ms,
         )
@@ -597,7 +557,7 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
     ));
     #[cfg(target_os = "linux")]
     if let Some(socket) = &config.lease_socket {
-        start_leases(&config, socket, service.clone())?;
+        start_leases(&config, socket, service.clone(), backend.quota())?;
     }
     serve_service(listener, config.serve_limits(), service, backend)?;
     Ok(())
@@ -643,10 +603,6 @@ mod tests {
                 ServeError::Service(ServiceError::ReplayStore(format!("{CANARY}/replay.cc"))),
                 "replay_store",
             ),
-            (
-                ServeError::Service(ServiceError::UnpricedModel(CANARY.to_string())),
-                "prices",
-            ),
             (
                 ServeError::Service(ServiceError::InvalidAdmission),
                 "callers",
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
index 9235a17..78b19ac 100644
--- a/crates/claude-connector/src/lease.rs
+++ b/crates/claude-connector/src/lease.rs
@@ -1,15 +1,14 @@
 //! The Self-run credential lease. The connector is the only holder of the
-//! subscription token and the one owner of Self-run admission, reservation and
-//! the spend ledger (rulings self-runs-through-connector,
-//! self-run-credential-lease and self-run-lease-billing-and-binding). A Self
-//! run asks over a unix socket for a lease. The connector decides who may ask
-//! (the peer's uid, and the systemd unit invocation its process runs in),
-//! reserves its own configured amount in the caller's spend window, and only
-//! then hands back one pipe fd that holds the token. The run settles with the
-//! per-model usage it reports, and the connector bills that at true cost,
-//! uncapped; a run that vanishes or lets its lease expire is billed the whole
-//! reservation. Nothing the run says about itself decides who it is, what it
-//! reserves, or what the plan allows.
+//! subscription token and the one owner of Self-run admission (rulings
+//! self-runs-through-connector and self-run-credential-lease). A Self run asks
+//! over a unix socket for a lease. The connector decides who may ask (the
+//! peer's uid, and the systemd unit invocation its process runs in), and hands
+//! back one pipe fd that holds the token, with the plan's usage windows. The
+//! lease lasts while the holder keeps the socket open: it ends when the holder
+//! closes it, when its unit invocation ends, or when its expiry passes. Nothing
+//! is reserved and nothing is billed; the only usage-derived refusal is the
+//! provider's own, repeated until its own reset. Nothing the run says about
+//! itself decides who it is or what the plan allows.
 //!
 //! The token exists in this process only as the value the token source returns
 //! and in the pipe. It is not in an environment, an argument, a file, a log or
@@ -28,12 +27,11 @@ use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use model_connector::{
-    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseTurn, LeaseUse, ModelUsage,
-    TransportService,
+    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseTurn, PlanQuota, TransportService,
 };
 use serde::{Deserialize, Serialize};
 
-use crate::TokenSource;
+use crate::{QuotaCell, TokenSource};
 
 /// The largest frame either side sends or accepts, in bytes. It is wire
 /// contract: a Huginn client sizes against it, so it is pinned as a literal.
@@ -50,12 +48,9 @@ pub enum LeaseMessage {
     /// holds the token, its write end closed.
     ClaudeLeaseGrant(LeaseGranted),
     ClaudeLeaseRefusal(LeaseRefused),
-    ClaudeLeaseSettle(LeaseSettle),
-    ClaudeLeaseSettled(LeaseSettled),
 }
 
-/// A request names only when the lease ends. Who asks, and what is reserved,
-/// are the connector's to know.
+/// A request names only when the lease ends. Who asks is the connector's to know.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LeaseRequest {
     pub expires_at_unix_ms: u64,
@@ -64,16 +59,17 @@ pub struct LeaseRequest {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LeaseGranted {
     pub lease_id: String,
-    pub reserved_micro_usd: u64,
+    /// The plan's usage windows as the connector last saw them, so the run
+    /// can read its own burn.
+    pub plan_quota: Vec<PlanQuota>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum LeaseRefusalKind {
-    SpendCeiling,
-    CostBound,
     UnknownCaller,
     Expired,
     Busy,
+    ProviderRejected,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -82,20 +78,6 @@ pub struct LeaseRefused {
     pub detail: String,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LeaseSettle {
-    pub lease_id: String,
-    /// What the run used of each model, as the run reports it.
-    pub usage: Vec<ModelUsage>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LeaseSettled {
-    pub billed_micro_usd: u64,
-    /// How far the bill passed the reservation; zero when it did not.
-    pub overrun_micro_usd: u64,
-}
-
 /// A frame: the length, then the named-map MessagePack of `message`.
 pub fn encode_frame(message: &LeaseMessage) -> Vec<u8> {
     // Every field of the message is plain data, so encoding cannot fail.
@@ -180,8 +162,8 @@ fn read_message(stream: &mut impl Bounded, deadline: Instant) -> io::Result<Leas
 const PIPE_BUF: usize = 4096;
 
 /// A unix account allowed to lease, the unit its process must run in (the
-/// Self or the Persona unit of its instance, by `turn`), and the caller whose
-/// spend window its leases reserve in.
+/// Self or the Persona unit of its instance, by `turn`), and the
+/// caller whose name its leases carry.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LeaseCaller {
     pub uid: u32,
@@ -191,8 +173,6 @@ pub struct LeaseCaller {
     /// The `<instance>` of `mind-self@<instance>.service` or
     /// `mind-persona@<instance>.service`.
     pub unit_instance: String,
-    /// What each of this caller's leases reserves, whatever the run asks.
-    pub reservation_micro_usd: u64,
 }
 
 impl LeaseCaller {
@@ -400,6 +380,7 @@ struct Lender {
     callers: Vec<LeaseCaller>,
     limits: LeaseLimits,
     service: Arc<Mutex<TransportService>>,
+    quota: Arc<QuotaCell>,
     tokens: Arc<dyn TokenSource>,
     units: Arc<dyn PeerUnits>,
 }
@@ -415,6 +396,7 @@ pub fn serve_leases(
     callers: Vec<LeaseCaller>,
     limits: LeaseLimits,
     service: Arc<Mutex<TransportService>>,
+    quota: Arc<QuotaCell>,
     tokens: Arc<dyn TokenSource>,
     units: Arc<dyn PeerUnits>,
 ) -> io::Result<()> {
@@ -422,6 +404,7 @@ pub fn serve_leases(
         callers,
         limits,
         service,
+        quota,
         tokens,
         units,
     });
@@ -484,9 +467,9 @@ impl Lender {
                 "the expiry is not in the future or is past the lease bound",
             );
         }
-        // The reservation is claimed in the ledger before the token is read,
-        // let alone lent. A ledger that fails closes the connection with no
-        // answer and no lease.
+        // The lease is claimed before the token is read, let alone lent. The
+        // plan the refusal reads is the one this process last observed.
+        let plan = self.quota.snapshot();
         let admission = self
             .service
             .lock()
@@ -495,120 +478,134 @@ impl Lender {
                 &caller.caller_id,
                 caller.turn,
                 &invocation.invocation_id,
-                caller.reservation_micro_usd,
                 request.expires_at_unix_ms,
                 now,
+                &plan,
             )
-            .map_err(|_| io::Error::other("ledger"))?;
+            .map_err(|_| io::Error::other("lease"))?;
         let grant = match admission {
             LeaseAdmission::Granted(grant) => grant,
             LeaseAdmission::Refused(why) => {
                 let (kind, detail) = match why {
-                    LeaseRefusal::SpendCeiling => (
-                        LeaseRefusalKind::SpendCeiling,
-                        "the window cannot hold this reservation",
-                    ),
-                    LeaseRefusal::CostBound => (
-                        LeaseRefusalKind::CostBound,
-                        "the reservation must be above zero",
-                    ),
                     LeaseRefusal::UnknownCaller => (
                         LeaseRefusalKind::UnknownCaller,
                         "this account is bound to no admitted caller",
                     ),
                     LeaseRefusal::Busy => (
                         LeaseRefusalKind::Busy,
-                        "a lease is open for this caller or this unit invocation leased",
+                        "a lease is open for this caller or this unit invocation",
+                    ),
+                    LeaseRefusal::ProviderRejected => (
+                        LeaseRefusalKind::ProviderRejected,
+                        "the provider is refusing until its own reset",
                     ),
                 };
                 return refuse(&mut stream, kind, detail);
             }
         };
-        self.hold(stream, caller, &grant, request.expires_at_unix_ms)
+        self.hold(
+            stream,
+            caller,
+            &grant,
+            &invocation,
+            peer.process,
+            request.expires_at_unix_ms,
+            plan.windows,
+        )
     }
 
-    /// Everything after a reservation exists: lend the token, then settle the
-    /// lease exactly once whatever happens.
+    /// Everything after a lease exists: lend the token, then keep the lease
+    /// while its holder keeps the socket and its unit invocation, and end it
+    /// exactly once whatever happens.
+    // One argument per fact the held lease binds.
+    #[allow(clippy::too_many_arguments)]
     fn hold(
         &self,
         mut stream: UnixStream,
         caller: &LeaseCaller,
         grant: &LeaseGrant,
+        invocation: &PeerUnit,
+        process: Option<OwnedFd>,
         expires_at_unix_ms: u64,
+        plan_quota: Vec<PlanQuota>,
     ) -> io::Result<()> {
-        // A token that cannot be read or piped was never lent: nothing was
-        // used, so nothing is billed.
+        let held = self.keep(
+            &mut stream,
+            caller,
+            grant,
+            invocation,
+            process.as_ref(),
+            expires_at_unix_ms,
+            plan_quota,
+        );
+        self.service
+            .lock()
+            .map_err(|_| io::Error::other("service lock"))?
+            .end_lease(&caller.caller_id, &grant.lease_id);
+        held
+    }
+
+    // One argument per fact the held lease binds.
+    #[allow(clippy::too_many_arguments)]
+    fn keep(
+        &self,
+        stream: &mut UnixStream,
+        caller: &LeaseCaller,
+        grant: &LeaseGrant,
+        invocation: &PeerUnit,
+        process: Option<&OwnedFd>,
+        expires_at_unix_ms: u64,
+        plan_quota: Vec<PlanQuota>,
+    ) -> io::Result<()> {
+        // A token that cannot be read or piped was never lent: the lease ends.
         let Some(read_end) = self
             .tokens
             .read()
             .and_then(|token| token_pipe(token.as_bytes()).ok())
         else {
-            self.settle(caller, grant, LeaseUse::NeverLent)?;
             return Ok(());
         };
         let frame = encode_frame(&LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
             lease_id: grant.lease_id.clone(),
-            reserved_micro_usd: grant.reserved_micro_usd,
+            plan_quota,
         }));
-        let sent = send_with_fd(&stream, &frame, read_end.as_raw_fd());
+        let sent = send_with_fd(stream, &frame, read_end.as_raw_fd());
         drop(read_end);
-        if sent.is_err() {
-            // The descriptor may have been delivered: the reservation is billed.
-            self.settle(caller, grant, LeaseUse::Reservation)?;
-            return Ok(());
-        }
-        let outcome = self.await_settle(&mut stream, grant, expires_at_unix_ms);
-        match outcome {
-            Some(settle) => {
-                let settlement = self.settle(caller, grant, LeaseUse::Reported(&settle.usage))?;
-                let _ = stream.write_all(&encode_frame(&LeaseMessage::ClaudeLeaseSettled(
-                    LeaseSettled {
-                        billed_micro_usd: settlement.billed_micro_usd,
-                        overrun_micro_usd: settlement.overrun_micro_usd,
-                    },
-                )));
+        sent?;
+        // The holder says nothing more. The lease ends when it closes the
+        // socket, when its unit invocation is no longer the one that leased,
+        // or at the expiry.
+        let mut byte = [0_u8; 1];
+        loop {
+            let left = expires_at_unix_ms.saturating_sub(unix_ms());
+            if left == 0 {
+                return Ok(());
             }
-            None => {
-                self.settle(caller, grant, LeaseUse::Reservation)?;
+            stream.set_read_timeout(Some(Duration::from_millis(left.min(HOLD_POLL_MS))))?;
+            match stream.read(&mut byte) {
+                Ok(0) => return Ok(()),
+                Ok(_) => {}
+                Err(error)
+                    if matches!(
+                        error.kind(),
+                        io::ErrorKind::WouldBlock | io::ErrorKind::TimedOut
+                    ) => {}
+                Err(error) if error.kind() == io::ErrorKind::Interrupted => {}
+                Err(_) => return Ok(()),
+            }
+            let still = process
+                .and_then(|process| self.units.invocation_in(process.as_fd(), &caller.unit()))
+                .is_some_and(|found| found == *invocation);
+            if !still {
+                return Ok(());
             }
         }
-        Ok(())
-    }
-
-    /// The run's settle, if its whole frame arrives for this lease before the
-    /// lease expires. Anything else (end of file, silence, a frame still
-    /// trickling at the expiry, a malformed frame, the wrong lease) is no
-    /// report.
-    fn await_settle(
-        &self,
-        stream: &mut UnixStream,
-        grant: &LeaseGrant,
-        expires_at_unix_ms: u64,
-    ) -> Option<LeaseSettle> {
-        let remaining = expires_at_unix_ms.saturating_sub(unix_ms());
-        let deadline = Instant::now() + Duration::from_millis(remaining);
-        match read_message(stream, deadline).ok()? {
-            LeaseMessage::ClaudeLeaseSettle(settle) if settle.lease_id == grant.lease_id => {
-                Some(settle)
-            }
-            _ => None,
-        }
-    }
-
-    fn settle(
-        &self,
-        caller: &LeaseCaller,
-        grant: &LeaseGrant,
-        usage: LeaseUse<'_>,
-    ) -> io::Result<LeaseSettlement> {
-        self.service
-            .lock()
-            .map_err(|_| io::Error::other("service lock"))?
-            .settle_lease(&caller.caller_id, &grant.lease_id, usage)
-            .map_err(|_| io::Error::other("ledger"))
     }
 }
 
+/// How often a held lease looks again at its holder's unit invocation.
+const HOLD_POLL_MS: u64 = 500;
+
 fn refuse(stream: &mut UnixStream, kind: LeaseRefusalKind, detail: &str) -> io::Result<()> {
     stream.write_all(&encode_frame(&LeaseMessage::ClaudeLeaseRefusal(
         LeaseRefused {
@@ -622,12 +619,12 @@ fn refuse(stream: &mut UnixStream, kind: LeaseRefusalKind, detail: &str) -> io::
 mod tests {
     use super::*;
 
-    /// A settle frame whose body is exactly `body_bytes` long.
-    fn settle_frame_of(body_bytes: usize) -> Vec<u8> {
+    /// A refusal frame whose body is exactly `body_bytes` long.
+    fn frame_of(body_bytes: usize) -> Vec<u8> {
         let frame_with = |pad: usize| {
-            encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
-                lease_id: "x".repeat(pad),
-                usage: Vec::new(),
+            encode_frame(&LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+                kind: LeaseRefusalKind::Busy,
+                detail: "x".repeat(pad),
             }))
         };
         // The string header is the same width between 256 and 65535 bytes.
@@ -646,10 +643,10 @@ mod tests {
 
     #[test]
     fn a_frame_is_one_whole_message_within_the_bound() {
-        let at_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES);
+        let at_bound = frame_of(MAX_LEASE_FRAME_BYTES);
         assert_eq!(at_bound.len(), 4 + MAX_LEASE_FRAME_BYTES);
         assert!(decode_frame(&at_bound).is_some());
-        let past_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES + 1);
+        let past_bound = frame_of(MAX_LEASE_FRAME_BYTES + 1);
         assert!(decode_frame(&past_bound).is_none());
         let mut trailing = at_bound.clone();
         trailing.push(0);
@@ -661,9 +658,9 @@ mod tests {
 
     #[test]
     fn a_stream_frame_over_the_bound_is_refused_before_it_is_read() {
-        let past_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES + 1);
+        let past_bound = frame_of(MAX_LEASE_FRAME_BYTES + 1);
         assert!(within(&past_bound).is_err());
-        let at_bound = settle_frame_of(MAX_LEASE_FRAME_BYTES);
+        let at_bound = frame_of(MAX_LEASE_FRAME_BYTES);
         assert!(within(&at_bound).is_ok());
         assert!(within(&[0_u8, 0, 0, 0]).is_err());
         // Short of the length it announced is end of file, not a message.
@@ -673,10 +670,10 @@ mod tests {
     #[test]
     fn a_frame_that_trickles_past_its_deadline_is_refused_however_small_each_read() {
         let (mut reader, mut writer) = UnixStream::pair().unwrap();
-        let frame = encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
-            lease_id: "lease:x".to_string(),
-            usage: Vec::new(),
-        }));
+        let frame = encode_frame(&LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+                kind: LeaseRefusalKind::Busy,
+                detail: "lease:x".to_string(),
+            }));
         let trickle = thread::spawn(move || {
             for byte in frame {
                 if writer.write_all(&[byte]).is_err() {
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 6ed8757..4a9a42b 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -28,7 +28,7 @@ pub use launch::ChildEnv;
 #[cfg(target_os = "linux")]
 pub use lease::{
     LeaseCaller, LeaseGranted, LeaseLimits, LeaseMessage, LeaseRefusalKind, LeaseRefused,
-    LeaseRequest, LeaseSettle, LeaseSettled, MAX_LEASE_FRAME_BYTES, PeerCredentials, PeerUnit,
+    LeaseRequest, MAX_LEASE_FRAME_BYTES, PeerCredentials, PeerUnit,
     PeerUnits, decode_frame, encode_frame, peer_credentials, serve_leases, user_uid,
 };
 #[cfg(unix)]
diff --git a/crates/claude-connector/src/main.rs b/crates/claude-connector/src/main.rs
index ac435a1..273a4a1 100644
--- a/crates/claude-connector/src/main.rs
+++ b/crates/claude-connector/src/main.rs
@@ -18,7 +18,7 @@ use claude_connector::{
     ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, MIN_SECRET_BYTES, check_ready,
     load_config, write_config,
 };
-use model_connector::{CallerConfig, LeaseTurn, ModelPrice, Rates, frame_bytes_for_payload};
+use model_connector::{CallerConfig, LeaseTurn, frame_bytes_for_payload};
 
 fn main() -> ExitCode {
     let args: Vec<String> = std::env::args().skip(1).collect();
@@ -72,7 +72,6 @@ fn check(path: &str) -> Result<(), Failure> {
     println!("claude connector configuration is valid and ready to serve");
     println!("callers: {}", config.callers.len());
     println!("lease_callers: {}", config.lease_callers.len());
-    println!("prices: {}", config.prices.len());
     Ok(())
 }
 
@@ -85,17 +84,15 @@ struct Flags {
 
 /// The flags that describe one caller, shared by `config init` (which writes
 /// the first caller) and `config add-caller`.
-const CALLER: [&str; 7] = [
+const CALLER: [&str; 5] = [
     "--caller-id",
     "--connection-key-file",
     "--connection-key-epoch",
-    "--spend-ceiling-micro-usd",
-    "--spend-window-ms",
     "--max-concurrent-requests",
     "--max-output-tokens",
 ];
 
-const INIT: [&str; 22] = [
+const INIT: [&str; 21] = [
     "--listen",
     "--replay-store",
     "--claude-binary",
@@ -117,15 +114,9 @@ const INIT: [&str; 22] = [
     "--lease-max-ms",
     "--turn",
     "--lease-unit-instance",
-    "--lease-reservation-micro-usd",
 ];
 
-const LEASE_CALLER: [&str; 4] = [
-    "--caller-id",
-    "--turn",
-    "--lease-unit-instance",
-    "--lease-reservation-micro-usd",
-];
+const LEASE_CALLER: [&str; 3] = ["--caller-id", "--turn", "--lease-unit-instance"];
 
 impl Flags {
     fn parse(
@@ -213,8 +204,6 @@ impl Flags {
             max_concurrent_requests: self.number_or("--max-concurrent-requests", 4)?,
             max_payload_bytes: self.number_or("--max-payload-bytes", 1 << 20)?,
             max_output_tokens: self.number_or("--max-output-tokens", 32_768)?,
-            spend_ceiling_micro_usd: self.number("--spend-ceiling-micro-usd")?,
-            spend_window_ms: self.number("--spend-window-ms")?,
         })
     }
 }
@@ -230,33 +219,6 @@ fn sha256(hex: &str) -> Option<[u8; 32]> {
     Some(digest)
 }
 
-/// MODEL:INPUT:OUTPUT:CACHE_WRITE:CACHE_READ:OVERHEAD, rates in micro-USD per
-/// million tokens. The one cache-write rate prices both retentions.
-fn price(text: &str) -> Option<(String, ModelPrice)> {
-    let mut parts = text.split(':');
-    let model = parts.next()?.to_string();
-    let mut next = || parts.next()?.parse::<u64>().ok();
-    let (input, output, cache_write, cache_read, overhead_tokens) =
-        (next()?, next()?, next()?, next()?, next()?);
-    if parts.next().is_some() {
-        return None;
-    }
-    Some((
-        model,
-        ModelPrice {
-            rates: Rates {
-                input,
-                cache_write_short: cache_write,
-                cache_write_long: cache_write,
-                cache_read,
-                output,
-            },
-            long_context: None,
-            overhead_tokens,
-        },
-    ))
-}
-
 /// Writes 32 random bytes as 64 hex characters, mode 0600, unless the file is
 /// already there: the secret is never read back or shown, and a file that
 /// exists is the secret handles already depend on, so it is kept as it is when
@@ -322,16 +284,9 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
     let flags = Flags::parse(
         args,
         &[&INIT, &CALLER],
-        &["--allowed-model", "--price", "--lease-user"],
+        &["--allowed-model", "--lease-user"],
     )?;
     let first = flags.caller()?;
-    let mut prices = BTreeMap::new();
-    for text in flags.list("--price") {
-        let (model, price) = price(text).ok_or(Failure::Malformed("--price"))?;
-        if prices.insert(model, price).is_some() {
-            return Err(Failure::Malformed("--price"));
-        }
-    }
     let lease_callers = flags
         .list("--lease-user")
         .iter()
@@ -341,7 +296,6 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
                 caller_id: first.caller_runtime_id.clone(),
                 turn: flags.turn()?,
                 unit_instance: flags.text("--lease-unit-instance")?,
-                reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
             })
         })
         .collect::<Result<Vec<_>, Failure>>()?;
@@ -366,7 +320,6 @@ fn init(path: &str, args: &[&str]) -> Result<(), Failure> {
         socket_timeout_ms: flags.number_or("--socket-timeout-ms", 10_000)?,
         max_expiry_skew_ms: 300_000,
         callers: vec![first],
-        prices,
         lease_socket: flags.single.get("--lease-socket").map(PathBuf::from),
         lease_callers,
         lease_max_ms: flags.number_or("--lease-max-ms", 3_600_000)?,
@@ -412,7 +365,6 @@ fn add_lease_caller(path: &str, args: &[&str]) -> Result<(), Failure> {
         caller_id: flags.text("--caller-id")?,
         turn: flags.turn()?,
         unit_instance: flags.text("--lease-unit-instance")?,
-        reservation_micro_usd: flags.number("--lease-reservation-micro-usd")?,
     });
     write_config(path.as_ref(), &config)?;
     Ok(())
diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
index e4ea4b3..450d3e2 100644
--- a/crates/claude-connector/src/quota.rs
+++ b/crates/claude-connector/src/quota.rs
@@ -1,7 +1,7 @@
 //! The plan's own usage windows, as the CLI reports them. The subscription
 //! decides how much a plan may burn; the CLI's `rate_limit_event` is the only
 //! place that number appears, so the latest observation of each window is kept
-//! here and read out beside the connector's own spend ledger.
+//! here and published as the usage readout and lent with each lease.
 
 use std::collections::BTreeMap;
 use std::sync::Mutex;
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index f712892..c5e2e41 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -14,7 +14,7 @@ use crate::quota::QuotaCell;
 const STRUCTURED_OUTPUT_TOOL: &str = "StructuredOutput";
 
 /// A call that cannot complete, with the stage that failed. `usage` is `None`
-/// (the kit bills its reservation) unless a result event reported it or the
+/// (unknown) unless a result event reported it or the
 /// call never reached the provider (zero).
 #[derive(Debug, PartialEq, Eq)]
 pub(crate) struct Failure {
@@ -25,7 +25,7 @@ pub(crate) struct Failure {
 
 impl Failure {
     /// A failure after the child ran: what the provider billed is unknown, so
-    /// the kit bills its reservation.
+    /// the usage is unknown.
     pub(crate) fn cost_unknown(kind: FailureKind, message: &'static str) -> Self {
         Self {
             kind,
@@ -356,7 +356,7 @@ fn fail(kind: FailureKind, message: &'static str) -> Step {
 /// provider cannot have billed (`empty_is_zero`: a refusal at the door, 401,
 /// 403 or 429, or a call never made); elsewhere the CLI also zeroes usage on
 /// crashes after real work. A call never made (`absent_is_zero`) may also
-/// omit the field. `None` is billed the reservation by the kit.
+/// omit the field. `None` is unknown usage.
 fn read_usage(reported: Option<Value>, empty_is_zero: bool, absent_is_zero: bool) -> Option<Usage> {
     let Some(reported) = reported else {
         return absent_is_zero.then(|| sum_usage(std::iter::empty()));
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 8ca6828..865ea00 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -1,29 +1,21 @@
 //! The claude-connector's configuration document and binary: what the
-//! document accepts, what it refuses, and that no refusal or output echoes a
-//! byte of a value that was typed, stored or read from a credential.
+//! document accepts, what it refuses, and that a document of the dollar era
+//! fails closed.
 
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 use std::sync::atomic::{AtomicUsize, Ordering};
-use std::time::Duration;
 
 use claude_connector::{
     ClaudeConnectorConfig, ConfigError, LeaseCallerConfig, load_config, write_config,
 };
-use cultcache_rs::{
-    CacheBackingStore, CultCache, CultCacheEnvelope, DatabaseEntry,
-    SingleFileMessagePackBackingStore,
-};
-use model_connector::{CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ModelPrice, Rates};
+use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
+use model_connector::{CallerConfig, LeaseTurn};
 
-const CANARY: &str = "canary-9f3b7c1d";
 const OPUS: &str = "claude-opus-5-1";
 const HAIKU: &str = "claude-haiku-5-5";
 
-/// An edit that should make the valid document refuse.
-type Change = Box<dyn Fn(&mut ClaudeConnectorConfig)>;
-
 static SEQUENCE: AtomicUsize = AtomicUsize::new(0);
 
 struct Scratch(PathBuf);
@@ -49,20 +41,6 @@ impl Drop for Scratch {
     }
 }
 
-fn price() -> ModelPrice {
-    ModelPrice {
-        rates: Rates {
-            input: 3_000_000,
-            cache_write_short: 3_750_000,
-            cache_write_long: 3_750_000,
-            cache_read: 300_000,
-            output: 15_000_000,
-        },
-        long_context: None,
-        overhead_tokens: 100,
-    }
-}
-
 fn valid() -> ClaudeConnectorConfig {
     ClaudeConnectorConfig {
         listen: "127.0.0.1:7443".to_string(),
@@ -91,17 +69,13 @@ fn valid() -> ClaudeConnectorConfig {
             max_concurrent_requests: 4,
             max_payload_bytes: 1 << 20,
             max_output_tokens: 32_768,
-            spend_ceiling_micro_usd: 50_000_000,
-            spend_window_ms: 3_600_000,
         }],
-        prices: BTreeMap::from([(HAIKU.to_string(), price()), (OPUS.to_string(), price())]),
         lease_socket: Some("/run/claude-connector/lease.sock".into()),
         lease_callers: vec![LeaseCallerConfig {
             unix_user: "mind-eureka-self".to_string(),
             caller_id: "persona-a-caller".to_string(),
             turn: LeaseTurn::SelfRun,
             unit_instance: "eureka".to_string(),
-            reservation_micro_usd: 5_000_000,
         }],
         lease_max_ms: 3_600_000,
     }
@@ -124,509 +98,119 @@ fn config_round_trips_through_cultcache() {
 }
 
 #[test]
-fn a_second_record_or_the_wrong_type_is_refused() {
+fn a_valid_document_validates() {
+    assert!(valid().validate().is_ok());
+}
+
+/// A document of the dollar era: the first type id, carrying a price table.
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "gamecult.model_connector.claude_connector_config.v1")]
+struct DollarEraConfig {
+    #[cultcache(key = 0)]
+    listen: String,
+    #[cultcache(key = 18)]
+    prices: BTreeMap<String, u64>,
+}
+
+#[test]
+fn a_dollar_era_config_is_refused_at_load() {
     let scratch = Scratch::new();
-    let path = scratch.path("two.cc");
-    let config = valid();
-    write_config(&path, &config).unwrap();
-    let mut cache = CultCache::new();
-    cache
-        .register_entry_type::<ClaudeConnectorConfig>()
-        .unwrap();
-    cache
-        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&path))
-        .unwrap();
-    cache.pull_all_backing_stores().unwrap();
-    cache.put("extra", &config).unwrap();
+    let path = scratch.path("old.cc");
+    {
+        let mut cache = CultCache::new();
+        cache.register_entry_type::<DollarEraConfig>().unwrap();
+        cache
+            .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&path))
+            .unwrap();
+        cache
+            .put(
+                "runtime".to_string(),
+                &DollarEraConfig {
+                    listen: "127.0.0.1:7443".to_string(),
+                    prices: BTreeMap::from([(OPUS.to_string(), 5_000_000)]),
+                },
+            )
+            .unwrap();
+    }
     assert!(matches!(load_config(&path), Err(ConfigError::Store)));
-
-    #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-    #[cultcache(type = "gamecult.other.document.v1")]
-    struct Other {
-        #[cultcache(key = 0)]
-        value: u32,
-    }
-    let other = scratch.path("other.cc");
-    let mut cache = CultCache::new();
-    cache.register_entry_type::<Other>().unwrap();
-    cache
-        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(&other))
-        .unwrap();
-    cache.pull_all_backing_stores().unwrap();
-    cache.put("runtime", &Other { value: 1 }).unwrap();
-    assert!(matches!(load_config(&other), Err(ConfigError::Store)));
-
-    assert!(matches!(
-        load_config(&scratch.path("absent.cc")),
-        Err(ConfigError::Store)
-    ));
-}
-
-fn store_raw(path: &Path, key: &str, ty: &str, schema: Option<&str>, payload: Vec<u8>) {
-    let mut store = SingleFileMessagePackBackingStore::new(path);
-    store
-        .push(&CultCacheEnvelope {
-            key: key.to_string(),
-            r#type: ty.to_string(),
-            payload,
-            stored_at: "2026-10-29T00:00:00Z".to_string(),
-            schema_id: schema.map(str::to_string),
-        })
-        .unwrap();
 }
 
 #[test]
-fn the_envelope_must_be_exactly_the_documents_key_type_schema_and_encoding() {
-    let scratch = Scratch::new();
-    let canonical = rmp_serde::to_vec(&valid()).unwrap();
-    let ty = ClaudeConnectorConfig::TYPE;
-    let mut trailing = canonical.clone();
-    trailing.push(0xc0);
-
-    let cases = vec![
-        ("wrong key", "other", ty, Some(ty), canonical.clone()),
-        (
-            "wrong type",
-            "runtime",
-            "gamecult.other.v1",
-            Some(ty),
-            canonical.clone(),
-        ),
-        (
-            "wrong schema",
-            "runtime",
-            ty,
-            Some("gamecult.other.v1"),
-            canonical.clone(),
-        ),
-        ("not canonical", "runtime", ty, Some(ty), trailing),
-    ];
-    for (name, key, ty, schema, payload) in cases {
-        let path = scratch.path(&format!("{}.cc", name.replace(' ', "-")));
-        store_raw(&path, key, ty, schema, payload);
-        assert!(
-            matches!(load_config(&path), Err(ConfigError::Store)),
-            "{name}"
-        );
-    }
-
-    // The same bytes with every part right load.
-    let path = scratch.path("right.cc");
-    store_raw(&path, "runtime", ty, Some(ty), canonical);
-    assert_eq!(load_config(&path).unwrap(), valid());
-}
-
-#[test]
-fn bounds_sit_exactly_where_the_connector_needs_them() {
-    let mut config = valid();
-    config.max_total_bytes = config.max_line_bytes;
-    config.validate().unwrap();
-    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES;
-    config.validate().unwrap();
-    config.callers[0].max_payload_bytes = MIN_PAYLOAD_BYTES - 1;
-    assert_eq!(refused(&config), "caller bounds");
-
-    for set in [
-        (|c: &mut ClaudeConnectorConfig| c.max_connections = 0) as fn(&mut ClaudeConnectorConfig),
-        |c| c.socket_timeout_ms = 0,
-        |c| c.max_expiry_skew_ms = 0,
-        |c| c.max_frame_bytes = 0,
-    ] {
-        let mut config = valid();
-        set(&mut config);
-        assert_eq!(refused(&config), "serve limits");
-    }
-    let mut config = valid();
-    config.prices.insert("claude-".to_string(), price());
-    assert_eq!(refused(&config), "prices");
-}
-
-#[test]
-fn a_write_refuses_an_invalid_document_and_leaves_no_file() {
-    let scratch = Scratch::new();
-    let path = scratch.path("bad.cc");
-    let mut config = valid();
-    config.callers[0].allowed_models = vec!["opus".to_string()];
-    assert!(write_config(&path, &config).is_err());
-    assert!(!path.exists());
-}
-
-#[test]
-fn config_refuses_aliases_unpriced_models_and_second_callers() {
-    let valid_config = valid();
-    assert_eq!(valid_config.validate().unwrap().port(), 7443);
-
-    let cases: Vec<(&str, Change)> = vec![
-        (
-            "alias allowed",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["opus".to_string()];
-            }),
-        ),
-        (
-            "alias price key",
-            Box::new(|c| {
-                c.prices.insert("sonnet".to_string(), price());
-            }),
-        ),
-        (
-            "bare prefix",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-".to_string()];
-            }),
-        ),
-        (
-            "family only",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-haiku".to_string()];
-                c.prices.insert("claude-haiku".to_string(), price());
-            }),
-        ),
-        (
-            "latest alias",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-sonnet-latest".to_string()];
-                c.prices.insert("claude-sonnet-latest".to_string(), price());
-            }),
-        ),
-        (
-            "uppercase family",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-Opus-5-1".to_string()];
-                c.prices.insert("claude-Opus-5-1".to_string(), price());
-            }),
-        ),
-        (
-            "short date",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-opus-5-1-2026".to_string()];
-                c.prices.insert("claude-opus-5-1-2026".to_string(), price());
-            }),
-        ),
-        (
-            "trailing part",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec!["claude-opus-5-1-20260101-x".to_string()];
-                c.prices
-                    .insert("claude-opus-5-1-20260101-x".to_string(), price());
-            }),
-        ),
-        (
-            "unpriced allowed",
-            Box::new(|c| {
-                c.prices.remove(OPUS);
-            }),
-        ),
-        (
-            "duplicate allowed",
-            Box::new(|c| {
-                c.callers[0].allowed_models = vec![HAIKU.to_string(), HAIKU.to_string()];
-            }),
-        ),
-        (
-            "no allowed",
-            Box::new(|c| c.callers[0].allowed_models.clear()),
-        ),
-        (
-            "duplicate caller id",
-            Box::new(|c| {
-                let again = c.callers[0].clone();
-                c.callers.push(again);
-            }),
-        ),
-        ("no caller", Box::new(|c| c.callers.clear())),
-    ];
-    let fields = [
-        "allowed_models",
-        "prices",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "allowed_models",
-        "callers",
-        "callers",
-    ];
-    for ((name, change), field) in cases.iter().zip(fields) {
-        let mut config = valid();
-        change(&mut config);
-        assert_eq!(refused(&config), field, "{name}");
-    }
-}
-
-#[test]
-fn a_priced_id_of_any_loose_form_is_allowed_and_the_price_table_decides() {
-    // Real ids come with a minor, without one, and with a date either way.
-    for id in [
-        "claude-opus-5-1-20260101",
+fn the_known_models_are_the_allowed_models_by_form_alone() {
+    for good in [
+        "claude-opus-5-1",
+        "claude-haiku-5-5",
         "claude-opus-5",
-        "claude-opus-5-20260101",
-        "claude-sonnet-4-5",
+        "claude-opus-5-1-20260101",
     ] {
         let mut config = valid();
-        config.callers[0].allowed_models = vec![id.to_string()];
-        config.prices.insert(id.to_string(), price());
-        config.validate().unwrap_or_else(|e| panic!("{id}: {e}"));
-
-        // The same id with no price is not on the known list.
-        config.prices.remove(id);
-        assert_eq!(refused(&config), "allowed_models", "{id}");
+        config.callers[0].allowed_models = vec![good.to_string()];
+        assert!(config.validate().is_ok(), "{good}");
     }
+    for bad in [
+        "sonnet",
+        "claude-",
+        "claude-sonnet-latest",
+        "claude-Opus-5-1",
+        "claude-opus-5-1-2026",
+        "claude-opus-5-1-20260101-x",
+    ] {
+        let mut config = valid();
+        config.callers[0].allowed_models = vec![bad.to_string()];
+        assert_eq!(refused(&config), "allowed_models", "{bad}");
+    }
+    let mut twice = valid();
+    twice.callers[0].allowed_models = vec![OPUS.to_string(), OPUS.to_string()];
+    assert_eq!(refused(&twice), "allowed_models");
+    let mut none = valid();
+    none.callers[0].allowed_models.clear();
+    assert_eq!(refused(&none), "allowed_models");
 }
 
 #[test]
-fn a_price_with_a_zero_billed_component_is_refused() {
-    type Zero = fn(&mut Rates);
-    let zeroed: Vec<(&str, Zero)> = vec![
-        ("input", |r| r.input = 0),
-        ("cache_write_short", |r| r.cache_write_short = 0),
-        ("cache_write_long", |r| r.cache_write_long = 0),
-        ("cache_read", |r| r.cache_read = 0),
-        ("output", |r| r.output = 0),
+fn caller_bounds_are_required_nonzero() {
+    let edits: [fn(&mut ClaudeConnectorConfig); 3] = [
+        |c| c.callers[0].max_concurrent_requests = 0,
+        |c| c.callers[0].max_output_tokens = 0,
+        |c| c.callers[0].max_payload_bytes = 0,
     ];
-    for (name, zero) in &zeroed {
+    for edit in edits {
         let mut config = valid();
-        zero(&mut config.prices.get_mut(HAIKU).unwrap().rates);
-        assert_eq!(refused(&config), "prices", "{name}");
-
-        let mut config = valid();
-        let mut long = price().rates;
-        zero(&mut long);
-        config.prices.get_mut(HAIKU).unwrap().long_context = Some(model_connector::LongContext {
-            above_prompt_tokens: 200_000,
-            rates: long,
-        });
-        assert_eq!(refused(&config), "prices", "long context {name}");
-    }
-    // A zero overhead is not a rate.
-    let mut config = valid();
-    config.prices.get_mut(HAIKU).unwrap().overhead_tokens = 0;
-    config.validate().unwrap();
-}
-
-#[test]
-fn config_refuses_exposed_listeners_relative_paths_and_empty_bounds() {
-    let cases: Vec<(&str, &str, Change)> = vec![
-        (
-            "wildcard listen",
-            "listen",
-            Box::new(|c| c.listen = "0.0.0.0:7443".into()),
-        ),
-        (
-            "lan listen",
-            "listen",
-            Box::new(|c| c.listen = "192.168.1.9:7443".into()),
-        ),
-        (
-            "hostname listen",
-            "listen",
-            Box::new(|c| c.listen = "localhost:7443".into()),
-        ),
-        (
-            "replay",
-            "replay_store",
-            Box::new(|c| c.replay_store = "replay.cc".into()),
-        ),
-        (
-            "binary",
-            "claude_binary",
-            Box::new(|c| c.claude_binary = "claude".into()),
-        ),
-        ("work", "work_dir", Box::new(|c| c.work_dir = "work".into())),
-        (
-            "config",
-            "config_dir",
-            Box::new(|c| c.config_dir = "cfg".into()),
-        ),
-        (
-            "prompts",
-            "prompt_dir",
-            Box::new(|c| c.prompt_dir = "prompts".into()),
-        ),
-        (
-            "key file",
-            "connection_key_file",
-            Box::new(|c| {
-                c.callers[0].connection_key_file = "caller.key".into();
-            }),
-        ),
-        (
-            "zero pin",
-            "claude_binary_sha256",
-            Box::new(|c| c.claude_binary_sha256 = [0; 32]),
-        ),
-        (
-            "blank instance",
-            "instance",
-            Box::new(|c| c.instance = " ".into()),
-        ),
-        (
-            "credential path",
-            "token_credential",
-            Box::new(|c| c.token_credential = "a/b".into()),
-        ),
-        (
-            "credential parent",
-            "token_credential",
-            Box::new(|c| c.token_credential = "..".into()),
-        ),
-        (
-            "credential empty",
-            "token_credential",
-            Box::new(|c| c.token_credential = String::new()),
-        ),
-        (
-            "zero deadline",
-            "child limits",
-            Box::new(|c| c.deadline_ms = 0),
-        ),
-        (
-            "total below line",
-            "child limits",
-            Box::new(|c| c.max_total_bytes = c.max_line_bytes - 1),
-        ),
-        (
-            "zero frame",
-            "serve limits",
-            Box::new(|c| c.max_frame_bytes = 0),
-        ),
-        (
-            "zero epoch",
-            "connection_key_epoch",
-            Box::new(|c| c.callers[0].connection_key_epoch = 0),
-        ),
-        (
-            "tiny payload",
-            "caller bounds",
-            Box::new(|c| c.callers[0].max_payload_bytes = 16),
-        ),
-        (
-            "no ceiling",
-            "caller bounds",
-            Box::new(|c| c.callers[0].spend_ceiling_micro_usd = 0),
-        ),
-    ];
-    for (name, field, change) in cases {
-        let mut config = valid();
-        change(&mut config);
-        assert_eq!(refused(&config), field, "{name}");
+        edit(&mut config);
+        assert_eq!(refused(&config), "caller bounds");
     }
 }
 
 #[test]
-fn no_refusal_echoes_a_value() {
-    let canary_path: PathBuf = format!("{CANARY}/relative").into();
-    let canaried: Vec<Change> = vec![
-        Box::new(|c| c.listen = format!("{CANARY}:1")),
-        Box::new(|c| c.instance = format!(" {CANARY} ")),
-        Box::new(|c| c.token_credential = format!("{CANARY}/x")),
-        Box::new(|c| c.callers[0].allowed_models = vec![format!("{CANARY}-model")]),
-        Box::new(|c| {
-            c.prices.insert(format!("{CANARY}-alias"), price());
-        }),
-        Box::new(|c| c.callers[0].caller_runtime_id = format!(" {CANARY}")),
-        Box::new({
-            let path = canary_path.clone();
-            move |c| c.replay_store = path.clone()
-        }),
-        Box::new({
-            let path = canary_path.clone();
-            move |c| c.callers[0].connection_key_file = path.clone()
-        }),
-        Box::new(|c| {
-            let mut second = c.callers[0].clone();
-            second.caller_runtime_id = format!(" {CANARY}");
-            c.callers.push(second);
-        }),
-    ];
-    for change in canaried {
-        let mut config = valid();
-        change(&mut config);
-        let error = config.validate().unwrap_err();
-        for shown in [error.to_string(), format!("{error:?}")] {
-            assert!(!shown.contains(CANARY), "{shown}");
-        }
-        let scratch = Scratch::new();
-        let write = write_config(&scratch.path("x.cc"), &config).unwrap_err();
-        assert!(!format!("{write} {write:?}").contains(CANARY));
-    }
+fn a_lease_caller_names_a_configured_caller_and_a_socket_exists_exactly_when_it_leases() {
+    let mut stranger = valid();
+    stranger.lease_callers[0].caller_id = "nobody".to_string();
+    assert_eq!(refused(&stranger), "lease_callers");
+
+    let mut no_callers = valid();
+    no_callers.lease_callers.clear();
+    assert_eq!(refused(&no_callers), "lease_callers");
+
+    let mut no_socket = valid();
+    no_socket.lease_socket = None;
+    assert_eq!(refused(&no_socket), "lease_callers");
+    no_socket.lease_callers.clear();
+    assert!(no_socket.validate().is_ok());
+
+    let mut twice = valid();
+    twice.lease_callers.push(twice.lease_callers[0].clone());
+    assert_eq!(refused(&twice), "lease_callers");
 }
 
-// ---- the binary ----
-
-/// How long any connector verb may take in these tests. `check` and `init`
-/// return at once and `serve` is meant to refuse; a `serve` that starts
-/// instead would run forever, so it fails a named test here, not the suite.
-const VERB_DEADLINE: Duration = Duration::from_secs(20);
-
-fn run(args: &[&str], envs: &[(&str, &Path)]) -> Output {
-    let mut command = Command::new(env!("CARGO_BIN_EXE_claude-connector"));
-    command.args(args).env_clear();
-    for (name, value) in envs {
-        command.env(name, value);
-    }
-    run_within(command, VERB_DEADLINE).unwrap_or_else(|| {
-        panic!(
-            "`{}` was still running after {VERB_DEADLINE:?}: it started",
-            args.join(" ")
-        )
-    })
+fn run(args: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_claude-connector"))
+        .args(args)
+        .env_clear()
+        .output()
+        .unwrap()
 }
 
-/// The command's output, or `None` when it outlived `deadline` and was killed.
-fn run_within(mut command: Command, deadline: Duration) -> Option<Output> {
-    use std::process::Stdio;
-    use std::time::Instant;
-
-    let mut child = command
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .unwrap();
-    let started = Instant::now();
-    while child.try_wait().unwrap().is_none() {
-        if started.elapsed() > deadline {
-            child.kill().unwrap();
-            child.wait().unwrap();
-            return None;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-    }
-    Some(child.wait_with_output().unwrap())
-}
-
-#[cfg(unix)]
-#[test]
-fn a_process_past_its_deadline_is_killed_and_reported_as_none() {
-    let mut forever = Command::new("sleep");
-    forever.arg("60");
-    let started = std::time::Instant::now();
-    assert!(run_within(forever, Duration::from_millis(200)).is_none());
-    assert!(started.elapsed() < Duration::from_secs(10));
-    let mut quick = Command::new("true");
-    quick.env_clear();
-    assert!(
-        run_within(quick, Duration::from_secs(10))
-            .unwrap()
-            .status
-            .success()
-    );
-}
-
-fn shown(output: &Output) -> String {
-    format!(
-        "{}{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    )
-}
-
-fn init_flags<'a>(scratch: &'a Scratch, extra: &[&'a str]) -> Vec<String> {
+fn init_flags(scratch: &Scratch, extra: &[&str]) -> Vec<String> {
     let path = |name: &str| scratch.path(name).to_string_lossy().into_owned();
     let mut flags: Vec<String> = [
         "--listen",
@@ -657,14 +241,8 @@ fn init_flags<'a>(scratch: &'a Scratch, extra: &[&'a str]) -> Vec<String> {
         &path("caller.key"),
         "--connection-key-epoch",
         "1",
-        "--spend-ceiling-micro-usd",
-        "50000000",
-        "--spend-window-ms",
-        "3600000",
         "--allowed-model",
         HAIKU,
-        "--price",
-        &format!("{HAIKU}:1000000:5000000:1250000:100000:100"),
     ]
     .map(String::from)
     .to_vec();
@@ -676,1078 +254,32 @@ fn init(scratch: &Scratch, flags: &[String]) -> Output {
     let config = scratch.path("connector.cc");
     let mut args = vec!["config", "init", config.to_str().unwrap()];
     args.extend(flags.iter().map(String::as_str));
-    run(&args, &[])
+    run(&args)
 }
 
 #[test]
 fn config_init_writes_the_flags_into_the_document() {
     let scratch = Scratch::new();
     let made = init(&scratch, &init_flags(&scratch, &[]));
-    assert!(made.status.success(), "{}", shown(&made));
+    assert!(made.status.success(), "{:?}", made);
     let config = load_config(&scratch.path("connector.cc")).unwrap();
     assert_eq!(config.callers[0].allowed_models, [HAIKU]);
-    assert_eq!(config.prices[HAIKU].rates.output, 5_000_000);
-    assert_eq!(config.prices[HAIKU].rates.cache_write_long, 1_250_000);
-    assert_eq!(config.prices[HAIKU].overhead_tokens, 100);
     assert_eq!(config.claude_binary_sha256, [0xab; 32]);
+    assert!(config.lease_callers.is_empty());
 }
 
-/// A scratch directory in which `serve` would start: every directory, the
-/// pinned binary, the connection key and the credential exist. Returns the
-/// `config init` flags and the credential directory.
-#[cfg(unix)]
-fn prepare(scratch: &Scratch) -> (Vec<String>, PathBuf) {
-    use sha2::{Digest, Sha256};
-    use std::os::unix::fs::PermissionsExt;
-
-    for name in ["work", "home", "prompts", "credentials"] {
-        std::fs::create_dir_all(scratch.path(name)).unwrap();
-    }
-    std::fs::set_permissions(
-        scratch.path("prompts"),
-        std::fs::Permissions::from_mode(0o700),
-    )
-    .unwrap();
-    std::fs::write(scratch.path("credentials/claude-token"), CANARY).unwrap();
-    std::fs::write(
-        scratch.path("credentials/claude-handle-secret"),
-        "s".repeat(64),
-    )
-    .unwrap();
-    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
-    std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
-    let sha: String = Sha256::digest(b"pinned claude")
-        .iter()
-        .map(|byte| format!("{byte:02x}"))
-        .collect();
-    let mut flags = init_flags(scratch, &[]);
-    let at = flags
-        .iter()
-        .position(|flag| flag == "--claude-sha256")
-        .unwrap();
-    flags[at + 1] = sha;
-    (flags, scratch.path("credentials"))
-}
-
-#[cfg(unix)]
-fn check_and_serve(config: &Path, credentials: Option<&Path>) -> (Output, Output) {
-    let envs: Vec<(&str, &Path)> = credentials
-        .map(|dir| ("CREDENTIALS_DIRECTORY", dir))
-        .into_iter()
-        .collect();
-    let path = config.to_str().unwrap();
-    (
-        run(&["config", "check", path], &envs),
-        run(&["serve", "--config", path], &envs),
-    )
-}
-
-#[cfg(unix)]
 #[test]
-fn check_passes_a_document_serve_can_start_and_reports_counts_only() {
-    let scratch = Scratch::new();
-    let (flags, credentials) = prepare(&scratch);
-    let made = init(&scratch, &flags);
-    assert!(made.status.success(), "{}", shown(&made));
-    let checked = run(
-        &[
-            "config",
-            "check",
-            scratch.path("connector.cc").to_str().unwrap(),
-        ],
-        &[("CREDENTIALS_DIRECTORY", &credentials)],
-    );
-    assert!(checked.status.success(), "{}", shown(&checked));
-    let text = shown(&checked);
-    assert!(text.contains("callers: 1") && text.contains("lease_callers: 0"));
-    assert!(text.contains("prices: 1"));
-    for secret in ["persona-a", HAIKU, CANARY, "caller-secret"] {
-        assert!(!text.contains(secret), "{text}");
-    }
-}
-
-#[cfg(unix)]
-#[test]
-fn check_refuses_exactly_what_serve_refuses_and_names_the_field() {
-    use std::os::unix::fs::PermissionsExt;
-
-    type Break = fn(&Scratch, &Path);
-    let cases: Vec<(&str, &str, Break)> = vec![
-        ("open prompt dir", "prompt directory", |s, _| {
-            std::fs::set_permissions(s.path("prompts"), std::fs::Permissions::from_mode(0o755))
-                .unwrap();
-        }),
-        ("no key file", "connection_key_file", |s, _| {
-            std::fs::remove_file(s.path("caller.key")).unwrap();
-        }),
-        ("binary off its pin", "claude_binary_sha256", |s, _| {
-            std::fs::write(s.path("claude"), b"other bytes").unwrap();
-        }),
-        ("no credential", "token_credential", |_, credentials| {
-            std::fs::remove_file(credentials.join("claude-token")).unwrap();
-        }),
-        ("no work dir", "work_dir", |s, _| {
-            std::fs::remove_dir(s.path("work")).unwrap();
-        }),
-        ("no config dir", "config_dir", |s, _| {
-            std::fs::remove_dir(s.path("home")).unwrap();
-        }),
-        ("frame too small", "max_frame_bytes", |s, _| {
-            let path = s.path("connector.cc");
-            let mut config = load_config(&path).unwrap();
-            config.max_frame_bytes = 4099;
-            write_config(&path, &config).unwrap();
-        }),
-        ("two callers on one key", "callers", |s, _| {
-            std::fs::write(s.path("twin.key"), "caller-secret").unwrap();
-            let config = s.path("connector.cc");
-            let twin = s.path("twin.key");
-            let added = run(
-                &[
-                    "config",
-                    "add-caller",
-                    config.to_str().unwrap(),
-                    "--caller-id",
-                    "twin",
-                    "--connection-key-file",
-                    twin.to_str().unwrap(),
-                    "--connection-key-epoch",
-                    "1",
-                    "--allowed-model",
-                    HAIKU,
-                    "--spend-ceiling-micro-usd",
-                    "1000",
-                    "--spend-window-ms",
-                    "60000",
-                ],
-                &[],
-            );
-            assert!(added.status.success(), "{}", shown(&added));
-        }),
-        ("too few connections", "connection capacity", |s, _| {
-            let path = s.path("connector.cc");
-            let mut config = load_config(&path).unwrap();
-            config.max_connections = 1;
-            write_config(&path, &config).unwrap();
-        }),
+fn the_dollar_flags_are_not_flags() {
+    let dollar_flags: [&[&str]; 4] = [
+        &["--spend-ceiling-micro-usd", "50000000"],
+        &["--spend-window-ms", "3600000"],
+        &["--price", "claude-haiku-5-5:1:1:1:1:1"],
+        &["--lease-reservation-micro-usd", "5000000"],
     ];
-    for (name, field, break_it) in cases {
+    for extra in dollar_flags {
         let scratch = Scratch::new();
-        let (flags, credentials) = prepare(&scratch);
-        let made = init(&scratch, &flags);
-        assert!(made.status.success(), "{name}: {}", shown(&made));
-        break_it(&scratch, &credentials);
-        let (checked, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
-        assert!(!checked.status.success(), "{name} check passed");
-        assert!(!served.status.success(), "{name} serve started");
-        assert!(
-            shown(&checked).contains(field),
-            "{name}: {}",
-            shown(&checked)
-        );
-        assert_eq!(shown(&checked), shown(&served), "{name}");
-        for secret in [CANARY, "caller-secret", "other bytes"] {
-            assert!(!shown(&checked).contains(secret), "{name}");
-        }
-    }
-
-    // No credential directory at all is the same refusal.
-    let scratch = Scratch::new();
-    let (flags, _) = prepare(&scratch);
-    assert!(init(&scratch, &flags).status.success());
-    let (checked, served) = check_and_serve(&scratch.path("connector.cc"), None);
-    assert!(!checked.status.success() && !served.status.success());
-    assert!(shown(&checked).contains("credentials_directory"));
-    assert!(!shown(&checked).contains("token_credential"));
-    assert_eq!(shown(&checked), shown(&served));
-
-    // A credential directory without the credential is the other fault, and
-    // the token is checked last: a broken pin is named first.
-    let scratch = Scratch::new();
-    let (flags, credentials) = prepare(&scratch);
-    assert!(init(&scratch, &flags).status.success());
-    std::fs::remove_file(credentials.join("claude-token")).unwrap();
-    std::fs::write(scratch.path("claude"), b"other bytes").unwrap();
-    let (checked, _) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
-    assert!(
-        shown(&checked).contains("claude_binary_sha256"),
-        "{}",
-        shown(&checked)
-    );
-    std::fs::write(scratch.path("claude"), b"pinned claude").unwrap();
-    let (checked, _) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
-    assert!(
-        shown(&checked).contains("token_credential"),
-        "{}",
-        shown(&checked)
-    );
-    assert!(!shown(&checked).contains("credentials_directory"));
-}
-
-#[test]
-fn usage_says_check_runs_in_the_units_environment() {
-    let output = run(&["nonsense"], &[]);
-    assert!(!output.status.success());
-    assert!(
-        shown(&output).contains("unit's environment"),
-        "{}",
-        shown(&output)
-    );
-}
-
-#[cfg(unix)]
-#[test]
-fn serve_names_a_corrupt_replay_store_without_its_path() {
-    let scratch = Scratch::new();
-    let (mut flags, credentials) = prepare(&scratch);
-    let store = scratch.path(&format!("{CANARY}-store/replay.cc"));
-    std::fs::create_dir_all(store.parent().unwrap()).unwrap();
-    std::fs::write(&store, b"not a cultcache store").unwrap();
-    let at = flags
-        .iter()
-        .position(|flag| flag == "--replay-store")
-        .unwrap();
-    flags[at + 1] = store.to_string_lossy().into_owned();
-    assert!(init(&scratch, &flags).status.success());
-    let (_, served) = check_and_serve(&scratch.path("connector.cc"), Some(&credentials));
-    assert!(!served.status.success());
-    let text = shown(&served);
-    assert!(text.contains("replay_store"), "{text}");
-    assert!(
-        !text.contains(CANARY) && !text.contains("replay.cc"),
-        "{text}"
-    );
-}
-
-#[test]
-fn the_binary_refuses_without_echoing_what_it_was_given() {
-    let spaced = format!(" {CANARY}");
-    // Each pair replaces the value of an existing flag; the others are appended.
-    let replaced: Vec<(&str, &str)> = vec![
-        ("--listen", CANARY),
-        ("--claude-sha256", CANARY),
-        ("--claude-sha256", "abcd"),
-        ("--price", CANARY),
-        ("--instance", &spaced),
-        ("--connection-key-epoch", CANARY),
-        ("--allowed-model", CANARY),
-    ];
-    let appended: Vec<Vec<&str>> = vec![
-        vec![CANARY, CANARY],
-        vec!["--listen"],
-        vec!["--listen", "127.0.0.1:1"],
-    ];
-    let mut attempts: Vec<Vec<String>> = Vec::new();
-    for (name, value) in replaced {
-        let scratch = Scratch::new();
-        let mut flags = init_flags(&scratch, &[]);
-        let at = flags.iter().position(|flag| flag == name).unwrap();
-        flags[at + 1] = value.to_string();
-        attempts.push(flags);
-    }
-    for extra in appended {
-        let scratch = Scratch::new();
-        attempts.push(init_flags(&scratch, &extra));
-    }
-    for flags in attempts {
-        let scratch = Scratch::new();
-        let made = init(&scratch, &flags);
-        assert!(!made.status.success(), "{flags:?}");
-        assert!(!shown(&made).contains(CANARY), "{}", shown(&made));
-        assert!(!scratch.path("connector.cc").exists());
-    }
-
-    // A missing flag is refused by name.
-    let scratch = Scratch::new();
-    let mut flags = init_flags(&scratch, &[]);
-    let at = flags.iter().position(|f| f == "--instance").unwrap();
-    flags.drain(at..at + 2);
-    let made = init(&scratch, &flags);
-    assert!(!made.status.success());
-    assert!(shown(&made).contains("--instance"));
-}
-
-#[cfg(unix)]
-#[test]
-fn serve_refuses_an_unsafe_prompt_dir_and_prints_no_credential() {
-    use std::os::unix::fs::{PermissionsExt, symlink};
-
-    let scratch = Scratch::new();
-    let credentials = scratch.path("credentials");
-    std::fs::create_dir_all(&credentials).unwrap();
-    std::fs::write(credentials.join("claude-token"), CANARY).unwrap();
-    std::fs::write(scratch.path("caller.key"), "caller-secret").unwrap();
-    let made = init(&scratch, &init_flags(&scratch, &[]));
-    assert!(made.status.success(), "{}", shown(&made));
-    let config = scratch.path("connector.cc");
-    let serve = |config: &Path| {
-        run(
-            &["serve", "--config", config.to_str().unwrap()],
-            &[("CREDENTIALS_DIRECTORY", &credentials)],
-        )
-    };
-
-    // No prompt directory, then one others can enter, then a link to a good one.
-    let prompts = scratch.path("prompts");
-    let refused = serve(&config);
-    assert!(!refused.status.success());
-    assert!(
-        shown(&refused).contains("prompt directory"),
-        "{}",
-        shown(&refused)
-    );
-    std::fs::create_dir_all(&prompts).unwrap();
-    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o755)).unwrap();
-    let open = serve(&config);
-    assert!(
-        shown(&open).contains("prompt directory"),
-        "{}",
-        shown(&open)
-    );
-    assert!(claude_connector::check_prompt_dir(&prompts).is_err());
-    std::fs::set_permissions(&prompts, std::fs::Permissions::from_mode(0o700)).unwrap();
-    assert!(claude_connector::check_prompt_dir(&prompts).is_ok());
-    let linked = scratch.path("linked");
-    symlink(&prompts, &linked).unwrap();
-    assert!(claude_connector::check_prompt_dir(&linked).is_err());
-
-    // A safe directory but no claude binary: the backend is not ready, and
-    // nothing the credential holds is printed.
-    let not_ready = serve(&config);
-    assert!(!not_ready.status.success());
-    for output in [&refused, &open, &not_ready] {
-        let text = shown(output);
-        assert!(
-            !text.contains(CANARY) && !text.contains("caller-secret"),
-            "{text}"
-        );
+        let made = init(&scratch, &init_flags(&scratch, extra));
+        assert!(!made.status.success(), "{extra:?} was accepted");
+        assert!(!Path::new(&scratch.path("connector.cc")).exists(), "{extra:?}");
     }
 }
-
-#[cfg(unix)]
-#[test]
-fn a_private_regular_file_is_not_a_prompt_dir() {
-    use std::os::unix::fs::PermissionsExt;
-    let scratch = Scratch::new();
-    let file = scratch.path("file");
-    std::fs::write(&file, "x").unwrap();
-    std::fs::set_permissions(&file, std::fs::Permissions::from_mode(0o700)).unwrap();
-    assert!(claude_connector::check_prompt_dir(&file).is_err());
-    assert!(claude_connector::check_prompt_dir(&scratch.path("absent")).is_err());
-}
-
-#[test]
-fn leases_are_configured_together_or_not_at_all() {
-    let cases: Vec<(&str, Change)> = vec![
-        (
-            "lease_socket",
-            Box::new(|c| c.lease_socket = Some("lease.sock".into())),
-        ),
-        ("lease_callers", Box::new(|c| c.lease_callers.clear())),
-        ("lease_callers", Box::new(|c| c.lease_socket = None)),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].caller_id = "another-caller".to_string()),
-        ),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].unix_user = " ".to_string()),
-        ),
-        (
-            "lease_callers",
-            Box::new(|c| {
-                let again = c.lease_callers[0].clone();
-                c.lease_callers.push(again);
-            }),
-        ),
-        ("lease_max_ms", Box::new(|c| c.lease_max_ms = 0)),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].reservation_micro_usd = 0),
-        ),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].reservation_micro_usd = 50_000_001),
-        ),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].unit_instance = String::new()),
-        ),
-        (
-            "lease_callers",
-            Box::new(|c| c.lease_callers[0].unit_instance = "a/b".to_string()),
-        ),
-    ];
-    for (field, change) in cases {
-        let mut config = valid();
-        change(&mut config);
-        assert_eq!(refused(&config), field);
-    }
-    // The whole ceiling is a reservation the caller can hold.
-    let mut whole = valid();
-    whole.lease_callers[0].reservation_micro_usd = 50_000_000;
-    whole.validate().unwrap();
-    let mut none = valid();
-    none.lease_socket = None;
-    none.lease_callers.clear();
-    none.validate().unwrap();
-}
-
-#[test]
-fn config_init_binds_each_lease_user_to_the_configured_caller() {
-    let scratch = Scratch::new();
-    let made = init(
-        &scratch,
-        &init_flags(
-            &scratch,
-            &[
-                "--lease-socket",
-                "/run/claude-connector/lease.sock",
-                "--lease-user",
-                "mind-eureka-self",
-                "--lease-max-ms",
-                "120000",
-                "--turn",
-                "self",
-                "--lease-unit-instance",
-                "eureka",
-                "--lease-reservation-micro-usd",
-                "5000000",
-            ],
-        ),
-    );
-    assert!(made.status.success(), "{}", shown(&made));
-    let config = load_config(&scratch.path("connector.cc")).unwrap();
-    assert_eq!(
-        config.lease_callers,
-        [LeaseCallerConfig {
-            unix_user: "mind-eureka-self".to_string(),
-            caller_id: "persona-a-caller".to_string(),
-            turn: LeaseTurn::SelfRun,
-            unit_instance: "eureka".to_string(),
-            reservation_micro_usd: 5_000_000,
-        }]
-    );
-    assert_eq!(config.lease_max_ms, 120_000);
-}
-
-#[cfg(target_os = "linux")]
-#[test]
-fn config_check_refuses_a_lease_account_the_system_does_not_have() {
-    let scratch = Scratch::new();
-    let (mut flags, credentials) = prepare(&scratch);
-    let socket = scratch.path("lease.sock");
-    flags.extend(
-        [
-            "--lease-socket",
-            socket.to_str().unwrap(),
-            "--lease-user",
-            "no-such-account-4f1c",
-            "--turn",
-            "self",
-            "--lease-unit-instance",
-            "eureka",
-            "--lease-reservation-micro-usd",
-            "5000000",
-        ]
-        .map(String::from),
-    );
-    let made = init(&scratch, &flags);
-    assert!(made.status.success(), "{}", shown(&made));
-    let config = scratch.path("connector.cc");
-    let checked = run(
-        &["config", "check", config.to_str().unwrap()],
-        &[("CREDENTIALS_DIRECTORY", &credentials)],
-    );
-    assert!(!checked.status.success());
-    assert!(
-        shown(&checked).contains("lease_callers"),
-        "{}",
-        shown(&checked)
-    );
-    assert!(!shown(&checked).contains("no-such-account"));
-}
-
-#[cfg(target_os = "linux")]
-#[test]
-fn serve_binds_the_lease_socket_and_answers_a_stranger_with_a_refusal() {
-    use std::io::{Read, Write};
-    use std::os::unix::fs::PermissionsExt;
-    use std::os::unix::net::UnixStream;
-    use std::process::Stdio;
-    use std::time::Instant;
-
-    use claude_connector::{
-        LeaseMessage, LeaseRefusalKind, LeaseRefused, LeaseRequest, decode_frame, encode_frame,
-    };
-
-    let scratch = Scratch::new();
-    let (mut flags, credentials) = prepare(&scratch);
-    let socket = scratch.path("lease.sock");
-    // The test runs as someone other than `nobody`, so it is a stranger.
-    flags.extend(
-        [
-            "--lease-socket",
-            socket.to_str().unwrap(),
-            "--lease-user",
-            "nobody",
-            "--turn",
-            "self",
-            "--lease-unit-instance",
-            "eureka",
-            "--lease-reservation-micro-usd",
-            "5000000",
-        ]
-        .map(String::from),
-    );
-    let made = init(&scratch, &flags);
-    assert!(made.status.success(), "{}", shown(&made));
-    let config = scratch.path("connector.cc");
-    let mut server = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
-        .args(["serve", "--config", config.to_str().unwrap()])
-        .env_clear()
-        .env("CREDENTIALS_DIRECTORY", &credentials)
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .spawn()
-        .unwrap();
-    let started = Instant::now();
-    while !socket.exists() && started.elapsed() < Duration::from_secs(10) {
-        std::thread::sleep(Duration::from_millis(50));
-    }
-    let outcome = std::panic::catch_unwind(|| {
-        assert_eq!(
-            std::fs::metadata(&socket).unwrap().permissions().mode() & 0o777,
-            0o660
-        );
-        let mut stream = UnixStream::connect(&socket).unwrap();
-        stream
-            .set_read_timeout(Some(Duration::from_secs(5)))
-            .unwrap();
-        stream
-            .write_all(&encode_frame(&LeaseMessage::ClaudeLeaseRequest(
-                LeaseRequest {
-                    expires_at_unix_ms: u64::MAX / 2,
-                },
-            )))
-            .unwrap();
-        let mut reply = vec![0_u8; 4096];
-        let read = stream.read(&mut reply).unwrap();
-        assert!(matches!(
-            decode_frame(&reply[..read]),
-            Some(LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
-                kind: LeaseRefusalKind::UnknownCaller,
-                ..
-            }))
-        ));
-    });
-    // The server is still serving: it did not return when it started.
-    let running = server.try_wait().unwrap().is_none();
-    server.kill().unwrap();
-    server.wait().unwrap();
-    outcome.unwrap();
-    assert!(running);
-}
-
-// ---- many callers ----
-
-fn second_caller() -> CallerConfig {
-    CallerConfig {
-        caller_runtime_id: "heartbeat".to_string(),
-        connection_key_file: "/etc/claude-connector/heartbeat.key".into(),
-        connection_key_epoch: 3,
-        allowed_models: vec![HAIKU.to_string()],
-        max_concurrent_requests: 1,
-        max_payload_bytes: 64 << 10,
-        max_output_tokens: 1024,
-        spend_ceiling_micro_usd: 1_000_000,
-        spend_window_ms: 60_000,
-    }
-}
-
-#[test]
-fn several_callers_round_trip_and_each_is_validated_alone() {
-    let scratch = Scratch::new();
-    let path = scratch.path("connector.cc");
-    let mut config = valid();
-    config.callers.push(second_caller());
-    write_config(&path, &config).unwrap();
-    assert_eq!(load_config(&path).unwrap(), config);
-
-    let broken: Vec<(&str, Change)> = vec![
-        (
-            "caller bounds",
-            Box::new(|c| c.callers[1].spend_ceiling_micro_usd = 0),
-        ),
-        (
-            "connection_key_epoch",
-            Box::new(|c| c.callers[1].connection_key_epoch = 0),
-        ),
-        (
-            "connection_key_file",
-            Box::new(|c| c.callers[1].connection_key_file = "heartbeat.key".into()),
-        ),
-        (
-            "allowed_models",
-            Box::new(|c| c.callers[1].allowed_models = vec!["claude-opus-9".to_string()]),
-        ),
-        (
-            "callers",
-            Box::new(|c| c.callers[1].caller_runtime_id = c.callers[0].caller_runtime_id.clone()),
-        ),
-    ];
-    for (field, change) in &broken {
-        let mut config = valid();
-        config.callers.push(second_caller());
-        change(&mut config);
-        assert_eq!(refused(&config), *field);
-    }
-}
-
-#[test]
-fn a_lease_caller_bills_one_configured_caller_within_that_callers_ceiling() {
-    let mut config = valid();
-    config.callers.push(second_caller());
-    let lease = |user: &str, caller: &str, instance: &str, reservation: u64| LeaseCallerConfig {
-        unix_user: user.to_string(),
-        caller_id: caller.to_string(),
-        turn: LeaseTurn::SelfRun,
-        unit_instance: instance.to_string(),
-        reservation_micro_usd: reservation,
-    };
-    // A lease caller of each caller, each within its own caller's ceiling.
-    config
-        .lease_callers
-        .push(lease("mind-heartbeat", "heartbeat", "heartbeat", 1_000_000));
-    config.validate().unwrap();
-    // The first caller's ceiling does not stretch to the second's lease, nor the reverse.
-    config.lease_callers[1].reservation_micro_usd = 1_000_001;
-    assert_eq!(refused(&config), "lease_callers");
-    config.lease_callers[1].reservation_micro_usd = 1;
-    config.lease_callers[0].reservation_micro_usd = 50_000_001;
-    assert_eq!(refused(&config), "lease_callers");
-    config.lease_callers[0].reservation_micro_usd = 50_000_000;
-    // A lease caller naming no configured caller, or sharing another's account.
-    config.lease_callers[1].caller_id = "nobody".to_string();
-    assert_eq!(refused(&config), "lease_callers");
-    config.lease_callers[1].caller_id = "heartbeat".to_string();
-    config.lease_callers[1].unix_user = config.lease_callers[0].unix_user.clone();
-    assert_eq!(refused(&config), "lease_callers");
-}
-
-#[test]
-fn add_caller_and_add_lease_caller_extend_the_document_and_grow_the_serve_limits() {
-    let scratch = Scratch::new();
-    let made = init(
-        &scratch,
-        &init_flags(
-            &scratch,
-            &[
-                "--lease-socket",
-                "/run/claude-connector/lease.sock",
-                "--lease-user",
-                "mind-eureka-self",
-                "--turn",
-                "self",
-                "--lease-unit-instance",
-                "eureka",
-                "--lease-reservation-micro-usd",
-                "5000000",
-            ],
-        ),
-    );
-    assert!(made.status.success(), "{}", shown(&made));
-    let path = scratch.path("connector.cc");
-    let path_text = path.to_str().unwrap();
-    let before = load_config(&path).unwrap();
-
-    let key = scratch.path("heartbeat.key");
-    let added = run(
-        &[
-            "config",
-            "add-caller",
-            path_text,
-            "--caller-id",
-            "heartbeat",
-            "--connection-key-file",
-            key.to_str().unwrap(),
-            "--connection-key-epoch",
-            "2",
-            "--allowed-model",
-            HAIKU,
-            "--spend-ceiling-micro-usd",
-            "2000000",
-            "--spend-window-ms",
-            "60000",
-            "--max-concurrent-requests",
-            "30",
-            "--max-payload-bytes",
-            "4194304",
-        ],
-        &[],
-    );
-    assert!(added.status.success(), "{}", shown(&added));
-    let leased = run(
-        &[
-            "config",
-            "add-lease-caller",
-            path_text,
-            "--lease-user",
-            "mind-heartbeat",
-            "--caller-id",
-            "heartbeat",
-            "--turn",
-            "self",
-            "--lease-unit-instance",
-            "heartbeat",
-            "--lease-reservation-micro-usd",
-            "1000000",
-        ],
-        &[],
-    );
-    assert!(leased.status.success(), "{}", shown(&leased));
-
-    let after = load_config(&path).unwrap();
-    assert_eq!(after.callers[0], before.callers[0]);
-    assert_eq!(after.callers.len(), 2);
-    let heartbeat = &after.callers[1];
-    assert_eq!(heartbeat.caller_runtime_id, "heartbeat");
-    assert_eq!(heartbeat.connection_key_epoch, 2);
-    assert_eq!(heartbeat.spend_ceiling_micro_usd, 2_000_000);
-    assert_eq!(heartbeat.max_payload_bytes, 4 << 20);
-    assert_eq!(after.lease_callers[0], before.lease_callers[0]);
-    assert_eq!(after.lease_callers[1].caller_id, "heartbeat");
-    // The frame carries the largest payload and the connections every slot.
-    assert!(after.max_frame_bytes > before.max_frame_bytes);
-    assert!(after.max_connections >= 34);
-    assert_eq!(after.prices, before.prices);
-    assert_eq!(
-        after.handle_secret_credential,
-        before.handle_secret_credential
-    );
-
-    // Repeating either verb is refused and leaves the document as it was.
-    let again = run(
-        &[
-            "config",
-            "add-caller",
-            path_text,
-            "--caller-id",
-            "heartbeat",
-            "--connection-key-file",
-            key.to_str().unwrap(),
-            "--connection-key-epoch",
-            "2",
-            "--allowed-model",
-            HAIKU,
-            "--spend-ceiling-micro-usd",
-            "2000000",
-            "--spend-window-ms",
-            "60000",
-        ],
-        &[],
-    );
-    assert!(!again.status.success());
-    assert_eq!(load_config(&path).unwrap(), after);
-    let unleased = run(
-        &[
-            "config",
-            "add-lease-caller",
-            path_text,
-            "--lease-user",
-            "mind-heartbeat",
-            "--caller-id",
-            "heartbeat",
-            "--turn",
-            "self",
-            "--lease-unit-instance",
-            "heartbeat",
-            "--lease-reservation-micro-usd",
-            "1000000",
-        ],
-        &[],
-    );
-    assert!(!unleased.status.success());
-    assert_eq!(load_config(&path).unwrap(), after);
-}
-
-#[test]
-fn add_lease_caller_needs_a_document_that_lends_a_token() {
-    let scratch = Scratch::new();
-    let made = init(&scratch, &init_flags(&scratch, &[]));
-    assert!(made.status.success(), "{}", shown(&made));
-    let path = scratch.path("connector.cc");
-    let leased = run(
-        &[
-            "config",
-            "add-lease-caller",
-            path.to_str().unwrap(),
-            "--lease-user",
-            "mind-heartbeat",
-            "--caller-id",
-            "persona-a-caller",
-            "--turn",
-            "self",
-            "--lease-unit-instance",
-            "heartbeat",
-            "--lease-reservation-micro-usd",
-            "1000000",
-        ],
-        &[],
-    );
-    assert!(!leased.status.success());
-    assert!(load_config(&path).unwrap().lease_callers.is_empty());
-}
-
-#[cfg(unix)]
-#[test]
-fn init_creates_the_handle_secret_once_private_and_never_shows_it() {
-    use std::os::unix::fs::PermissionsExt;
-
-    let scratch = Scratch::new();
-    let secret = scratch.path("handle.secret");
-    let made = init(&scratch, &init_flags(&scratch, &[]));
-    assert!(made.status.success(), "{}", shown(&made));
-    let metadata = std::fs::metadata(&secret).unwrap();
-    assert_eq!(metadata.permissions().mode() & 0o777, 0o600);
-    let text = std::fs::read_to_string(&secret).unwrap();
-    assert_eq!(text.len(), 64);
-    assert!(text.bytes().all(|b| b.is_ascii_hexdigit()));
-    assert!(!shown(&made).contains(&text));
-
-    // A second init keeps the secret the first one made, since handles depend on it.
-    std::fs::remove_file(scratch.path("connector.cc")).unwrap();
-    let again = init(&scratch, &init_flags(&scratch, &[]));
-    assert!(again.status.success(), "{}", shown(&again));
-    assert_eq!(std::fs::read_to_string(&secret).unwrap(), text);
-
-    // A refused document leaves no secret file behind.
-    let fresh = Scratch::new();
-    let flags = init_flags(&fresh, &["--max-payload-bytes", "1"]);
-    let refused = init(&fresh, &flags);
-    assert!(!refused.status.success());
-    assert!(!fresh.path("handle.secret").exists());
-}
-
-#[cfg(unix)]
-#[test]
-fn check_wants_the_handle_secret_credential_and_names_it() {
-    let scratch = Scratch::new();
-    let (flags, credentials) = prepare(&scratch);
-    let made = init(&scratch, &flags);
-    assert!(made.status.success(), "{}", shown(&made));
-    let config = scratch.path("connector.cc");
-    let path = config.to_str().unwrap();
-    for body in [None, Some("too-short")] {
-        let secret = credentials.join("claude-handle-secret");
-        match body {
-            None => std::fs::remove_file(&secret).unwrap(),
-            Some(text) => std::fs::write(&secret, text).unwrap(),
-        }
-        let checked = run(
-            &["config", "check", path],
-            &[("CREDENTIALS_DIRECTORY", &credentials)],
-        );
-        assert!(!checked.status.success());
-        let text = shown(&checked);
-        assert!(text.contains("handle_secret_credential"), "{text}");
-        assert!(!text.contains("too-short"), "{text}");
-    }
-}
-
-/// A document written before the handle secret had a field cannot name where
-/// the secret is, so it is not a document this connector serves from: it is
-/// refused as a store fault, to be authored again with `config init`.
-#[test]
-fn a_document_without_the_handle_secret_field_is_refused_as_a_store() {
-    let scratch = Scratch::new();
-    let path = scratch.path("old.cc");
-    let mut payload = rmp_serde::to_vec(&valid()).unwrap();
-    // array16(23) -> array16(22), and drop the trailing 20-byte fixstr.
-    assert_eq!(payload[..3], [0xdc, 0, 23]);
-    payload[2] = 22;
-    payload.truncate(payload.len() - 21);
-    store_raw(
-        &path,
-        "runtime",
-        ClaudeConnectorConfig::TYPE,
-        Some(ClaudeConnectorConfig::TYPE),
-        payload,
-    );
-    assert!(matches!(load_config(&path), Err(ConfigError::Store)));
-}
-
-#[test]
-fn the_handle_secret_credential_is_a_name_of_its_own() {
-    for name in ["claude-token", "a/b", "", ".."] {
-        let mut config = valid();
-        config.handle_secret_credential = name.to_string();
-        assert_eq!(refused(&config), "handle_secret_credential", "{name:?}");
-    }
-}
-
-#[cfg(unix)]
-#[test]
-fn init_refuses_a_secret_file_it_cannot_create_and_writes_no_document() {
-    let scratch = Scratch::new();
-    let mut flags = init_flags(&scratch, &[]);
-    let at = flags
-        .iter()
-        .position(|f| f == "--handle-secret-file")
-        .unwrap();
-    flags[at + 1] = scratch
-        .path("absent/handle.secret")
-        .to_string_lossy()
-        .into_owned();
-    let made = init(&scratch, &flags);
-    assert!(!made.status.success());
-    assert!(!scratch.path("connector.cc").exists());
-}
-
-#[cfg(unix)]
-#[test]
-fn config_init_keeps_an_existing_secret_file_only_if_it_is_usable() {
-    use std::os::unix::fs::{PermissionsExt, symlink};
-
-    let write = |path: &Path, bytes: usize, mode: u32| {
-        std::fs::write(path, "k".repeat(bytes)).unwrap();
-        std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).unwrap();
-    };
-    type Plant = fn(&Scratch, &Path);
-    let refused: Vec<(&str, Plant)> = vec![
-        ("world readable", |_, p| {
-            std::fs::write(p, "k".repeat(64)).unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o644)).unwrap();
-        }),
-        ("group writable", |_, p| {
-            std::fs::write(p, "k".repeat(64)).unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o660)).unwrap();
-        }),
-        ("read only", |_, p| {
-            std::fs::write(p, "k".repeat(64)).unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o400)).unwrap();
-        }),
-        ("one byte short", |_, p| {
-            std::fs::write(p, "k".repeat(31)).unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
-        }),
-        ("empty", |_, p| {
-            std::fs::write(p, "").unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
-        }),
-        ("a directory", |_, p| {
-            std::fs::create_dir(p).unwrap();
-            std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600)).unwrap();
-        }),
-        ("a link to a good file", |s, p| {
-            let target = s.path("elsewhere.secret");
-            std::fs::write(&target, "k".repeat(64)).unwrap();
-            std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600)).unwrap();
-            symlink(&target, p).unwrap();
-        }),
-    ];
-    for (name, plant) in refused {
-        let scratch = Scratch::new();
-        let flags = init_flags(&scratch, &[]);
-        let secret = scratch.path("handle.secret");
-        plant(&scratch, &secret);
-        let before = std::fs::symlink_metadata(&secret).unwrap();
-        let made = init(&scratch, &flags);
-        assert!(!made.status.success(), "{name} was accepted");
-        assert!(shown(&made).contains("--handle-secret-file"), "{name}");
-        assert!(!shown(&made).contains("kkkk"), "{name}");
-        assert!(
-            !scratch.path("connector.cc").exists(),
-            "{name} left a document"
-        );
-        let after = std::fs::symlink_metadata(&secret).unwrap();
-        assert_eq!(
-            before.permissions().mode(),
-            after.permissions().mode(),
-            "{name}"
-        );
-        assert_eq!(before.len(), after.len(), "{name}");
-        assert_eq!(
-            before.file_type().is_symlink(),
-            after.file_type().is_symlink(),
-            "{name}"
-        );
-    }
-
-    // The smallest usable file is accepted and left exactly as it was.
-    let scratch = Scratch::new();
-    let flags = init_flags(&scratch, &[]);
-    let secret = scratch.path("handle.secret");
-    write(&secret, 32, 0o600);
-    let made = init(&scratch, &flags);
-    assert!(made.status.success(), "{}", shown(&made));
-    assert_eq!(std::fs::read_to_string(&secret).unwrap(), "k".repeat(32));
-    assert!(scratch.path("connector.cc").exists());
-}
-
-#[test]
-fn a_persona_lease_row_validates_and_an_account_leases_for_one_turn_only() {
-    let mut config = valid();
-    let mut persona = config.lease_callers[0].clone();
-    persona.unix_user = "mind-eureka-persona".to_string();
-    persona.turn = LeaseTurn::PersonaTurn;
-    config.lease_callers.push(persona.clone());
-    config.validate().unwrap();
-    // The same account under the other turn is a second row for one uid.
-    config.lease_callers[1].unix_user = config.lease_callers[0].unix_user.clone();
-    assert_eq!(refused(&config), "lease_callers");
-}
-
-#[test]
-fn add_lease_caller_takes_the_turn_and_refuses_an_unknown_one() {
-    let scratch = Scratch::new();
-    let made = init(
-        &scratch,
-        &init_flags(
-            &scratch,
-            &[
-                "--lease-socket",
-                "/run/claude-connector/lease.sock",
-                "--lease-user",
-                "mind-eureka-self",
-                "--turn",
-                "self",
-                "--lease-unit-instance",
-                "eureka",
-                "--lease-reservation-micro-usd",
-                "5000000",
-            ],
-        ),
-    );
-    assert!(made.status.success(), "{}", shown(&made));
-    let path = scratch.path("connector.cc");
-    let add = |turn: &str| {
-        run(
-            &[
-                "config",
-                "add-lease-caller",
-                path.to_str().unwrap(),
-                "--lease-user",
-                "mind-eureka-persona",
-                "--caller-id",
-                "persona-a-caller",
-                "--turn",
-                turn,
-                "--lease-unit-instance",
-                "eureka",
-                "--lease-reservation-micro-usd",
-                "1000000",
-            ],
-            &[],
-        )
-    };
-    let unknown = add("heartbeat");
-    assert!(!unknown.status.success());
-    assert_eq!(load_config(&path).unwrap().lease_callers.len(), 1);
-    let added = add("persona");
-    assert!(added.status.success(), "{}", shown(&added));
-    let config = load_config(&path).unwrap();
-    assert_eq!(config.lease_callers[1].turn, LeaseTurn::PersonaTurn);
-    assert_eq!(config.lease_callers[0].turn, LeaseTurn::SelfRun);
-}
diff --git a/crates/claude-connector/tests/fixtures/lease_v1/grant.bin b/crates/claude-connector/tests/fixtures/lease_v1/grant.bin
deleted file mode 100644
index 554e3a64cb35edbf81585cd63ecbe95744d580df..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 109
zcmZQzV90D*lAW2CvMD(yu{0$$J|{J?I5j@KC^4^OX<1@UX=>97h)`zAO*Jsf%D~Xb
r*u>P#+`=+3DLExI4V}NKD784Xs4O)lJ~uPDC_lcmIOQAzr}_Z^$PFl0

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/refusal.bin b/crates/claude-connector/tests/fixtures/lease_v1/refusal.bin
deleted file mode 100644
index 22a4a25e3ceba32fc73bbfaf38dd854feff2550d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 104
zcmXBL!3~2j3<c1P;#&vl2n>KM{AsLOPL()t?<|E=k6otQfW-a1l#;wZPj&fC#$7NP
yxM8fAdt=)cwvG#YhZkJ#P*Z>Gf?&1(Ei!05ds%5>_Y#zg2}RaM6%BRa(BcQ7qADT)

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/request.bin b/crates/claude-connector/tests/fixtures/lease_v1/request.bin
deleted file mode 100644
index fddaa3785fe2e36c3d51f2ec7bb63649d2decda3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 66
zcmZQzV6bailAW2CvL!huu{0$$J|{J?I5oZ~wXig`xMXQrVoqsl<EGS#g3O}S;`qdp
W_|m-0iul~(^9&4(3p;ad4gdgajT-C#

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/settle.bin b/crates/claude-connector/tests/fixtures/lease_v1/settle.bin
deleted file mode 100644
index b7498de8470f0e9dc778597cd19d24df83e27a4d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 336
zcmZQzVDxEPlAW2CvN<^?u{0$$J|{J?I5oaFwWK5`b!k~*PHAe>3W!){%1t#e%gVse
z$k@cx%-q5<F)2AEH4UA=w6r)eJ#|vk(%k%%)SUGYlXde8N{e+(bqyi1t!py#3Q9}j
zOY*Z*^NP>1Y}lBbn4FOsUzD1d0uwAX*aQ(QFUl-Qg^4nLS({&4f~1#OVFOTCaeiKA
lUOH4!3e@fmP`fh{GqX!^TFy8D({ctZRx_YlY=dF#0RUJliN*i`

diff --git a/crates/claude-connector/tests/fixtures/lease_v1/settled.bin b/crates/claude-connector/tests/fixtures/lease_v1/settled.bin
deleted file mode 100644
index 710d4b817e73b57863b3e0adaf6b682b017db04c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 81
zcmZQzVDN2PlAW2CvL!huu{0$$J|{J?I5oaFwWK5`HDzg8Voqsl(}twX93U?~H#4~?
bKfbg$<s1X!BZrOoWvN9)rFjV9v(XCxIr$<S

diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 0d8e357..cf05cd6 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -1,12 +1,9 @@
-//! The Self-run credential lease over a real unix socket: who may lease, what
-//! is reserved before anything is lent, where the token goes, and what each
-//! way of ending a lease bills. The ledger is the kit's own; the tests read
-//! it only through what the next reservation is allowed to claim. The unit a
-//! peer runs in is the `PeerUnits` port, answered here by a fake; one test
-//! asks a real systemd where that is available.
+//! The Self-run credential lease over a real unix socket: who may lease, where
+//! the token goes, what ends a lease, and the one usage-derived refusal, the
+//! provider's own. Nothing is reserved and nothing is billed. The unit a peer
+//! runs in is the `PeerUnits` port, answered here by a fake.
 #![cfg(target_os = "linux")]
 
-use std::collections::BTreeMap;
 use std::fs::File;
 use std::io::{Read, Write};
 use std::os::fd::{AsRawFd, BorrowedFd, FromRawFd, OwnedFd, RawFd};
@@ -18,19 +15,15 @@ use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use claude_connector::{
     LeaseCaller, LeaseGranted, LeaseLimits, LeaseMessage, LeaseRefusalKind, LeaseRefused,
-    LeaseRequest, LeaseSettle, LeaseSettled, PeerUnit, PeerUnits, SystemdUnits, TokenSource,
-    decode_frame, encode_frame, serve_leases,
-};
-use model_connector::{
-    CallerAdmission, LeaseAdmission, LeaseRefusal, LeaseTurn, LeaseUse, ModelPrice, ModelUsage,
-    Rates, SpendCeiling, SpendWindowMs, TransportService, Usage,
+    LeaseRequest, PeerUnit, PeerUnits, QuotaCell, TokenSource, decode_frame, encode_frame,
+    serve_leases,
 };
+use model_connector::{CallerAdmission, LeaseTurn, PlanQuota, TransportService};
 use zeroize::Zeroizing;
 
 const CALLER: &str = "eureka";
 const MODEL: &str = "claude-opus-5-1";
 const TOKEN: &str = "sk-canary-lease-4c1f9a";
-const FAR: u64 = 3_000_000_000_000;
 const INSTANCE: &str = "eureka";
 const UNIT: &str = "mind-self@eureka.service";
 
@@ -102,6 +95,7 @@ struct Harness {
     dir: PathBuf,
     socket: PathBuf,
     service: Arc<Mutex<TransportService>>,
+    quota: Arc<QuotaCell>,
     tokens: Arc<FakeTokens>,
     /// The fake behind the listener, when it has one.
     units: Option<Arc<FakeUnits>>,
@@ -126,129 +120,6 @@ impl Drop for Harness {
         let _ = std::fs::remove_dir_all(&self.dir);
     }
 }
-
-fn price() -> ModelPrice {
-    // One micro-USD per token in every class.
-    ModelPrice {
-        rates: Rates {
-            input: 1_000_000,
-            cache_write_short: 1_000_000,
-            cache_write_long: 1_000_000,
-            cache_read: 1_000_000,
-            output: 1_000_000,
-        },
-        long_context: None,
-        overhead_tokens: 0,
-    }
-}
-
-/// What a harness is built from.
-struct Setup {
-    ceiling: u64,
-    reservation: u64,
-    uid: u32,
-    turn: LeaseTurn,
-    token: Option<&'static str>,
-    max_connections: usize,
-}
-
-fn setup(ceiling: u64, reservation: u64) -> Setup {
-    Setup {
-        ceiling,
-        reservation,
-        uid: own_uid(),
-        turn: LeaseTurn::SelfRun,
-        token: Some(TOKEN),
-        max_connections: 8,
-    }
-}
-
-/// A listener serving `uid` as the caller `eureka`, each of whose leases
-/// reserves `reservation`, with a spend window so long that it never rolls
-/// over during a test. Peers start in invocation 1 of the Self unit.
-fn start(setup: Setup) -> Harness {
-    let units = Arc::new(FakeUnits {
-        peer: Mutex::new(None),
-        asked_about: Mutex::new(Vec::new()),
-    });
-    let harness = start_with(setup, units.clone(), Some(units), INSTANCE);
-    harness.enter(1);
-    harness
-}
-
-fn start_with(
-    setup: Setup,
-    units: Arc<dyn PeerUnits>,
-    fake: Option<Arc<FakeUnits>>,
-    instance: &str,
-) -> Harness {
-    let dir = std::env::temp_dir().join(format!(
-        "claude-lease-{}-{}",
-        std::process::id(),
-        SEQUENCE.fetch_add(1, Ordering::SeqCst)
-    ));
-    std::fs::create_dir_all(&dir).unwrap();
-    let socket = dir.join("lease.sock");
-    let service = Arc::new(Mutex::new(
-        TransportService::open(
-            &dir.join("replay.cc"),
-            "claude-code",
-            BTreeMap::from([(MODEL.to_string(), price())]),
-            [CallerAdmission::new(
-                CALLER,
-                "lease-test-connection-key",
-                1,
-                [MODEL.to_string()],
-                1,
-                65_536,
-                32_768,
-                SpendCeiling(setup.ceiling),
-                SpendWindowMs(1 << 50),
-            )
-            .unwrap()],
-            300_000,
-        )
-        .unwrap(),
-    ));
-    let tokens = Arc::new(FakeTokens {
-        token: setup.token,
-        reads: AtomicUsize::new(0),
-        probe: Mutex::new(None),
-    });
-    let listener = UnixListener::bind(&socket).unwrap();
-    let serving = (service.clone(), tokens.clone(), units);
-    let caller = LeaseCaller {
-        uid: setup.uid,
-        caller_id: CALLER.to_string(),
-        turn: setup.turn,
-        unit_instance: instance.to_string(),
-        reservation_micro_usd: setup.reservation,
-    };
-    std::thread::spawn(move || {
-        let _ = serve_leases(
-            &listener,
-            vec![caller],
-            LeaseLimits {
-                socket_timeout: Duration::from_secs(2),
-                max_lease_ms: 3_600_000,
-                max_connections: setup.max_connections,
-            },
-            serving.0,
-            serving.1,
-            serving.2,
-        );
-    });
-    Harness {
-        dir,
-        socket,
-        service,
-        tokens,
-        units: fake,
-    }
-}
-
-/// One frame, and the descriptors that arrived with it. An empty frame is end
-/// of file.
 fn receive(stream: &UnixStream) -> (Vec<u8>, Vec<OwnedFd>) {
     use std::os::fd::AsRawFd;
     let mut buffer = vec![0_u8; 70_000];
@@ -357,49 +228,6 @@ fn granted_ok(answer: &Answer) -> bool {
 }
 
 /// Asks, as a fresh unit invocation each time, until the caller's previous
-/// lease has been settled by the listener.
-fn ask_after_busy(harness: &Harness, first_invocation: u64) -> Answer {
-    let deadline = Instant::now() + Duration::from_secs(5);
-    for attempt in 0.. {
-        harness.enter(first_invocation + attempt);
-        let answer = ask(harness, 60_000);
-        if refusal_of(&answer) != Some(LeaseRefusalKind::Busy) || Instant::now() > deadline {
-            return answer;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-    }
-    unreachable!()
-}
-
-fn used(model: &str, tokens: u64) -> ModelUsage {
-    ModelUsage {
-        model: model.to_string(),
-        usage: Usage {
-            input_tokens: 0,
-            cache_read_tokens: 0,
-            cache_write_tokens: 0,
-            output_tokens: tokens,
-            reasoning_tokens: None,
-        },
-    }
-}
-
-fn settle_frame(answer: &Answer, usage: Vec<ModelUsage>) -> Vec<u8> {
-    encode_frame(&LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
-        lease_id: granted(answer).lease_id,
-        usage,
-    }))
-}
-
-fn settle(answer: &mut Answer, usage: Vec<ModelUsage>) -> LeaseSettled {
-    let frame = settle_frame(answer, usage);
-    answer.stream.write_all(&frame).unwrap();
-    let (raw, _) = receive(&answer.stream);
-    match decode_frame(&raw) {
-        Some(LeaseMessage::ClaudeLeaseSettled(settled)) => settled,
-        other => panic!("expected a settled reply, got {other:?}"),
-    }
-}
 
 fn contains(haystack: &[u8], needle: &str) -> bool {
     haystack
@@ -407,917 +235,311 @@ fn contains(haystack: &[u8], needle: &str) -> bool {
         .any(|window| window == needle.as_bytes())
 }
 
-/// Asks the ledger directly for a reservation of `cost`, as an invocation
-/// nobody else uses. A grant is left open.
-fn probe_reserve(harness: &Harness, name: &str, cost: u64) -> LeaseAdmission {
-    harness
-        .service
-        .lock()
-        .unwrap()
-        .begin_lease(CALLER, LeaseTurn::SelfRun, name, cost, FAR, now_ms())
-        .unwrap()
+/// What a harness is built from.
+struct Setup {
+    uid: u32,
+    turn: LeaseTurn,
+    token: Option<&'static str>,
+    max_connections: usize,
 }
 
-fn ceiling_refused() -> LeaseAdmission {
-    LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
+fn setup() -> Setup {
+    Setup {
+        uid: own_uid(),
+        turn: LeaseTurn::SelfRun,
+        token: Some(TOKEN),
+        max_connections: 8,
+    }
+}
+
+/// A listener serving `uid` as the caller `eureka`. Peers start in invocation
+/// 1 of the Self unit.
+fn start(setup: Setup) -> Harness {
+    let units = Arc::new(FakeUnits {
+        peer: Mutex::new(None),
+        asked_about: Mutex::new(Vec::new()),
+    });
+    let dir = std::env::temp_dir().join(format!(
+        "claude-lease-{}-{}",
+        std::process::id(),
+        SEQUENCE.fetch_add(1, Ordering::SeqCst)
+    ));
+    std::fs::create_dir_all(&dir).unwrap();
+    let socket = dir.join("lease.sock");
+    let service = Arc::new(Mutex::new(
+        TransportService::open(
+            &dir.join("replay.cc"),
+            "claude-code",
+            [CallerAdmission::new(
+                CALLER,
+                "lease-test-connection-key",
+                1,
+                [MODEL.to_string()],
+                1,
+                65_536,
+                32_768,
+            )
+            .unwrap()],
+            300_000,
+        )
+        .unwrap(),
+    ));
+    let tokens = Arc::new(FakeTokens {
+        token: setup.token,
+        reads: AtomicUsize::new(0),
+        probe: Mutex::new(None),
+    });
+    let quota = Arc::new(QuotaCell::new());
+    let listener = UnixListener::bind(&socket).unwrap();
+    let serving = (service.clone(), quota.clone(), tokens.clone(), units.clone());
+    let caller = LeaseCaller {
+        uid: setup.uid,
+        caller_id: CALLER.to_string(),
+        turn: setup.turn,
+        unit_instance: INSTANCE.to_string(),
+    };
+    std::thread::spawn(move || {
+        let _ = serve_leases(
+            &listener,
+            vec![caller],
+            LeaseLimits {
+                socket_timeout: Duration::from_secs(2),
+                max_lease_ms: 3_600_000,
+                max_connections: setup.max_connections,
+            },
+            serving.0,
+            serving.1,
+            serving.2,
+            serving.3,
+        );
+    });
+    let harness = Harness {
+        dir,
+        socket,
+        service,
+        quota,
+        tokens,
+        units: Some(units),
+    };
+    harness.enter(1);
+    harness
+}
+
+fn window(name: &str, permille: u32, status: &str, resets_at_unix_ms: u64) -> PlanQuota {
+    PlanQuota {
+        window: name.to_string(),
+        utilization_permille: Some(permille),
+        resets_at_unix_ms,
+        status: status.to_string(),
+        observed_at_unix_ms: 0,
+    }
+}
+
+/// Asks as fresh unit invocations until a lease is granted, or panics.
+fn ask_until_granted(harness: &Harness, first_invocation: u64) -> Answer {
+    let deadline = Instant::now() + Duration::from_secs(8);
+    let mut n = first_invocation;
+    loop {
+        harness.enter(n);
+        let answer = ask(harness, 60_000);
+        if granted_ok(&answer) {
+            return answer;
+        }
+        assert!(Instant::now() < deadline, "no lease was ever granted");
+        n += 1;
+        std::thread::sleep(Duration::from_millis(100));
+    }
 }
 
 #[test]
 fn a_grant_passes_one_fd_holding_the_token_then_end_of_file() {
-    let harness = start(setup(1_000, 600));
+    let harness = start(setup());
     let mut answer = ask(&harness, 60_000);
-    assert_eq!(granted(&answer).reserved_micro_usd, 600);
+    assert_eq!(granted(&answer).lease_id, format!("lease:{}", invocation(1)));
     assert_eq!(answer.fds.len(), 1);
-    // Reading to end of file proves the write end is closed: nobody holds
-    // the pipe open for another write.
     let mut read = Vec::new();
     File::from(answer.fds.remove(0))
         .read_to_end(&mut read)
         .unwrap();
     assert_eq!(read, TOKEN.as_bytes());
     assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
+    assert!(!contains(&answer.raw, TOKEN), "the token is in the pipe only");
 }
 
 #[test]
-fn the_lease_is_named_for_the_unit_invocation_not_for_anything_the_peer_says() {
-    let harness = start(setup(1_000, 600));
-    harness.enter(0xabc);
+fn a_grant_carries_the_plan_usage_as_the_connector_last_saw_it() {
+    let harness = start(setup());
+    let reset = now_ms() + 3_600_000;
+    harness
+        .quota
+        .observe([window("five_hour", 420, "allowed", reset)]);
     let answer = ask(&harness, 60_000);
-    assert_eq!(
-        granted(&answer).lease_id,
-        format!("lease:{}", invocation(0xabc))
-    );
+    let quota = granted(&answer).plan_quota;
+    assert_eq!(quota.len(), 1);
+    assert_eq!(quota[0].window, "five_hour");
+    assert_eq!(quota[0].utilization_permille, Some(420));
+    assert_eq!(quota[0].status, "allowed");
+    assert_eq!(quota[0].resets_at_unix_ms, reset);
 }
 
 #[test]
-fn the_token_is_in_the_pipe_and_nowhere_else() {
-    let harness = start(setup(1_000, 600));
-    let mut answer = ask(&harness, 60_000);
-    let mut frames = vec![answer.raw.clone()];
-    let settled = settle(&mut answer, vec![used(MODEL, 10)]);
-    frames.push(encode_frame(&LeaseMessage::ClaudeLeaseSettled(settled)));
-    harness.enter(2);
-    let refused = ask(&harness, 1);
-    frames.push(refused.raw.clone());
-    for frame in &frames {
-        assert!(!contains(frame, TOKEN));
-    }
-    assert!(std::env::vars().all(|(name, value)| !name.contains(TOKEN) && !value.contains(TOKEN)));
-    assert!(std::env::args().all(|argument| !argument.contains(TOKEN)));
-    // The one place it is: the pipe.
-    let mut read = String::new();
-    File::from(answer.fds.remove(0))
-        .read_to_string(&mut read)
-        .unwrap();
-    assert_eq!(read, TOKEN);
-}
-
-#[test]
-fn a_peer_uid_outside_the_lease_callers_is_refused_and_nothing_is_reserved_or_read() {
-    let harness = start(Setup {
-        uid: own_uid() + 1,
-        ..setup(1_000, 600)
-    });
-    let answer = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
-    assert!(answer.fds.is_empty());
-    assert!(!contains(&answer.raw, TOKEN));
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    // The ledger was not touched: the caller's whole ceiling is still free.
-    assert!(matches!(
-        probe_reserve(&harness, "probe", 1_000),
-        LeaseAdmission::Granted(_)
-    ));
-}
-
-#[test]
-fn the_configured_uid_outside_the_self_unit_is_refused_and_nothing_is_reserved_or_read() {
-    let harness = start(setup(1_000, 600));
-    for (label, peer) in [
-        ("another instance", Some(("mind-self@other.service", 1))),
-        ("a user service", Some(("huginn.service", 1))),
-        ("no unit", None),
-    ] {
-        *harness.units.as_ref().unwrap().peer.lock().unwrap() = peer.map(|(unit, n)| PeerUnit {
-            unit: unit.to_string(),
-            invocation_id: invocation(n),
-        });
-        let answer = ask(&harness, 60_000);
-        assert_eq!(
-            refusal_of(&answer),
-            Some(LeaseRefusalKind::UnknownCaller),
-            "{label}"
-        );
-        assert!(answer.fds.is_empty(), "{label}");
-    }
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    assert!(matches!(
-        probe_reserve(&harness, "probe", 1_000),
-        LeaseAdmission::Granted(_)
-    ));
-}
-
-#[test]
-fn one_invocation_of_the_self_unit_leases_once_and_the_next_invocation_leases_again() {
-    let harness = start(setup(1_000_000, 600));
-    let mut first = ask(&harness, 60_000);
-    assert!(granted_ok(&first));
-    settle(&mut first, vec![used(MODEL, 10)]);
-    // Settled, the caller holds nothing; the invocation has still leased.
-    let again = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&again), Some(LeaseRefusalKind::Busy));
-    assert!(again.fds.is_empty());
-    harness.enter(2);
-    assert!(granted_ok(&ask(&harness, 60_000)));
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
-}
-
-#[test]
-fn the_reservation_is_claimed_before_the_token_is_read_or_lent() {
-    let harness = start(setup(1_000, 600));
-    let seen = Arc::new(Mutex::new(None));
-    let (service, sink) = (harness.service.clone(), seen.clone());
-    *harness.tokens.probe.lock().unwrap() = Some(Box::new(move || {
-        // From inside the token read: the caller already holds a lease.
-        let admission = service
-            .lock()
-            .unwrap()
-            .begin_lease(CALLER, LeaseTurn::SelfRun, "probe", 1, FAR, now_ms())
-            .unwrap();
-        *sink.lock().unwrap() = Some(admission);
-    }));
-    let answer = ask(&harness, 60_000);
-    assert_eq!(answer.fds.len(), 1);
-    assert_eq!(
-        *seen.lock().unwrap(),
-        Some(LeaseAdmission::Refused(LeaseRefusal::Busy))
-    );
-}
-
-#[test]
-fn a_reservation_the_window_cannot_hold_is_refused_and_lends_nothing() {
-    let harness = start(setup(1_000, 1_001));
-    let answer = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::SpendCeiling));
-    assert!(answer.fds.is_empty());
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    // Exactly the ceiling fits.
-    let harness = start(setup(1_000, 1_000));
-    assert!(granted_ok(&ask(&harness, 60_000)));
-}
-
-#[test]
-fn a_free_lease_and_a_bad_expiry_are_refused() {
-    let harness = start(setup(1_000, 0));
-    assert_eq!(
-        refusal_of(&ask(&harness, 60_000)),
-        Some(LeaseRefusalKind::CostBound)
-    );
-    let harness = start(setup(1_000, 100));
-    for ttl in [0, 3_600_001 + 1_000] {
-        let mut stream = connect(&harness);
-        let expires_at_unix_ms = if ttl == 0 { 1 } else { now_ms() + ttl };
-        send(
-            &mut stream,
-            &LeaseMessage::ClaudeLeaseRequest(LeaseRequest { expires_at_unix_ms }),
-        );
-        let (raw, fds) = receive(&stream);
-        assert!(fds.is_empty());
-        assert!(matches!(
-            decode_frame(&raw),
-            Some(LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
-                kind: LeaseRefusalKind::Expired,
-                ..
-            }))
-        ));
-    }
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-}
-
-#[test]
-fn a_second_open_lease_for_the_caller_is_busy_even_from_another_invocation() {
-    let harness = start(setup(1_000_000, 100));
+fn a_lease_ends_when_its_holder_closes() {
+    let harness = start(setup());
     let first = ask(&harness, 60_000);
     assert!(granted_ok(&first));
     harness.enter(2);
     let second = ask(&harness, 60_000);
     assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
     assert!(second.fds.is_empty());
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
-}
-
-#[test]
-fn settlement_bills_the_true_cost_of_each_models_use_and_the_window_holds_it() {
-    let harness = start(setup(1_000, 600));
-    let mut first = ask(&harness, 60_000);
-    // One micro-USD a token: 250 of the priced model, and 100 of a model the
-    // table has never heard of, which bills at the dearest known price.
-    let settled = settle(
-        &mut first,
-        vec![used(MODEL, 250), used("claude-new-9", 100)],
-    );
-    assert_eq!(
-        (settled.billed_micro_usd, settled.overrun_micro_usd),
-        (350, 0)
-    );
-    // 350 spent: 650 remain, not 651.
-    assert_eq!(probe_reserve(&harness, "over", 651), ceiling_refused());
-    assert!(matches!(
-        probe_reserve(&harness, "fits", 650),
-        LeaseAdmission::Granted(_)
-    ));
-}
-
-#[test]
-fn usage_above_the_reservation_is_billed_in_full_and_the_overrun_is_reported_and_counted() {
-    let harness = start(setup(1_000, 100));
-    let mut first = ask(&harness, 60_000);
-    let settled = settle(&mut first, vec![used(MODEL, 700), used(MODEL, 5_000)]);
-    assert_eq!(settled.billed_micro_usd, 5_700);
-    assert_eq!(settled.overrun_micro_usd, 5_600);
-    // The window is past its ceiling: nothing more reserves in it.
-    assert_eq!(probe_reserve(&harness, "next", 1), ceiling_refused());
-}
-
-#[test]
-fn a_plan_quota_the_run_reports_is_not_part_of_the_protocol() {
-    // A settle in the shape the first protocol used, with a plan_quota the
-    // run vouches for: the extra key is ignored and the usage is billed.
-    let harness = start(setup(1_000, 600));
-    let mut first = ask(&harness, 60_000);
-    let legacy = serde_json::json!({
-        "kind": "claude_lease_settle",
-        "value": {
-            "lease_id": granted(&first).lease_id,
-            "usage": [{"model": MODEL, "usage": {
-                "input_tokens": 0, "cache_read_tokens": 0, "cache_write_tokens": 0,
-                "output_tokens": 40, "reasoning_tokens": null}}],
-            "plan_quota": [{"window": "five_hour", "utilization_permille": 0,
-                "resets_at_unix_ms": 1, "status": "allowed", "observed_at_unix_ms": 1}]
-        }
-    });
-    let body = rmp_serde::to_vec_named(&legacy).unwrap();
-    let mut frame = (body.len() as u32).to_be_bytes().to_vec();
-    frame.extend_from_slice(&body);
-    first.stream.write_all(&frame).unwrap();
-    let (raw, _) = receive(&first.stream);
-    assert!(matches!(
-        decode_frame(&raw),
-        Some(LeaseMessage::ClaudeLeaseSettled(LeaseSettled {
-            billed_micro_usd: 40,
-            overrun_micro_usd: 0
-        }))
-    ));
-}
-
-#[test]
-fn a_connection_dropped_without_settling_is_billed_the_reservation() {
-    let harness = start(setup(1_000, 600));
-    let first = ask(&harness, 60_000);
-    assert!(granted_ok(&first));
     drop(first);
-    let over = ask_after_busy(&harness, 2);
-    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
-    assert_eq!(probe_reserve(&harness, "over", 401), ceiling_refused());
-    assert!(matches!(
-        probe_reserve(&harness, "fits", 400),
-        LeaseAdmission::Granted(_)
-    ));
+    let third = ask_until_granted(&harness, 3);
+    assert!(granted_ok(&third));
 }
 
 #[test]
-fn a_lease_that_expires_unsettled_is_closed_and_billed_the_reservation() {
-    let harness = start(setup(1_000, 600));
-    let first = ask(&harness, 400);
-    assert!(granted_ok(&first));
-    let started = Instant::now();
-    // The listener, not the client, ends the lease at its expiry.
-    let (raw, fds) = receive(&first.stream);
-    assert!(raw.is_empty() && fds.is_empty());
-    assert!(started.elapsed() >= Duration::from_millis(250));
-    harness.enter(2);
-    let over = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
-}
-
-#[test]
-fn a_settle_trickled_past_the_expiry_is_no_report_and_bills_the_reservation() {
-    let harness = start(setup(1_000, 600));
-    let mut answer = ask(&harness, 1_500);
-    let frame = settle_frame(&answer, vec![used(MODEL, 10)]);
-    let chunk = frame.len() / 4 + 1;
-    // Each write lands inside any per-read wait; the frame does not land
-    // inside the lease.
-    for (i, part) in frame.chunks(chunk).enumerate() {
-        if i > 0 {
-            std::thread::sleep(Duration::from_millis(1_200));
-        }
-        let _ = answer.stream.write_all(part);
-    }
-    let (raw, _) = receive(&answer.stream);
-    assert!(raw.is_empty(), "{:?}", decode_frame(&raw));
-    assert_eq!(probe_reserve(&harness, "over", 401), ceiling_refused());
-}
-
-#[test]
-fn a_request_trickled_past_the_socket_timeout_is_dropped_without_a_reservation() {
-    let harness = start(setup(1_000, 600));
-    let mut stream = connect(&harness);
-    let started = Instant::now();
-    // Three bytes of a length, 0.9 s apart, then silence: every wait is inside
-    // the 2 s socket timeout, the frame is not.
-    for byte in [0_u8, 0, 0] {
-        stream.write_all(&[byte]).unwrap();
-        std::thread::sleep(Duration::from_millis(900));
-    }
-    let (raw, fds) = receive(&stream);
-    assert!(raw.is_empty() && fds.is_empty());
-    assert!(
-        started.elapsed() < Duration::from_millis(3_300),
-        "{:?}",
-        started.elapsed()
-    );
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    assert!(matches!(
-        probe_reserve(&harness, "probe", 1_000),
-        LeaseAdmission::Granted(_)
-    ));
-}
-
-#[test]
-fn a_settle_for_another_lease_is_no_report_and_bills_the_reservation() {
-    let harness = start(setup(1_000, 600));
-    let mut first = ask(&harness, 60_000);
-    send(
-        &mut first.stream,
-        &LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
-            lease_id: "lease:someone-else".to_string(),
-            usage: vec![used(MODEL, 1)],
-        }),
-    );
-    let (raw, _) = receive(&first.stream);
-    assert!(raw.is_empty());
-    harness.enter(2);
-    let over = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&over), Some(LeaseRefusalKind::SpendCeiling));
-}
-
-#[test]
-fn a_settle_that_reports_nothing_is_billed_the_reservation() {
-    let harness = start(setup(1_000, 600));
-    let mut first = ask(&harness, 60_000);
-    let settled = settle(&mut first, vec![]);
-    assert_eq!(
-        (settled.billed_micro_usd, settled.overrun_micro_usd),
-        (600, 0)
-    );
-    // 600 spent: the whole ceiling no longer reserves.
-    assert_eq!(probe_reserve(&harness, "all", 1_000), ceiling_refused());
-}
-
-#[test]
-fn a_token_that_cannot_be_read_is_never_lent_and_bills_nothing() {
-    let harness = start(Setup {
-        token: None,
-        ..setup(1_000, 1_000)
-    });
+fn a_lease_ends_when_its_unit_invocation_ends() {
+    let harness = start(setup());
     let first = ask(&harness, 60_000);
-    assert!(first.raw.is_empty() && first.fds.is_empty());
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
-    // Nothing was billed: the whole ceiling reserves again and gets as far
-    // as the token read, not a refusal.
-    let again = ask_after_busy(&harness, 2);
-    assert!(again.message.is_none() && again.fds.is_empty());
-    assert!(harness.tokens.reads.load(Ordering::SeqCst) >= 2);
+    assert!(granted_ok(&first));
+    // The invocation is over: the system no longer places the peer in it. The
+    // holder still has its socket open, and the lease does not outlive it.
+    *harness.units.as_ref().unwrap().peer.lock().unwrap() = None;
+    std::thread::sleep(Duration::from_millis(1_200));
+    harness.enter(2);
+    assert!(granted_ok(&ask(&harness, 60_000)));
+    drop(first);
 }
 
 #[test]
-fn a_malformed_or_oversized_frame_is_dropped_without_a_reservation() {
-    let harness = start(setup(1_000, 1_000));
-    for bytes in [
-        vec![0xff, 0xff, 0xff, 0xff],
-        vec![0, 0, 0, 0],
-        vec![0, 0, 0, 3, 0xc1, 0xc1, 0xc1],
-    ] {
-        let mut stream = connect(&harness);
-        stream.write_all(&bytes).unwrap();
-        let started = Instant::now();
-        let (raw, fds) = receive(&stream);
-        assert!(raw.is_empty() && fds.is_empty());
-        // Refused at once, not after the socket timeout of a read that was
-        // never going to complete.
-        assert!(started.elapsed() < Duration::from_millis(1_000));
-    }
+fn a_lease_ends_at_its_expiry_though_its_holder_is_still_there() {
+    let harness = start(setup());
+    let first = ask(&harness, 700);
+    assert!(granted_ok(&first));
+    let next = ask_until_granted(&harness, 2);
+    assert!(granted_ok(&next));
+    drop(first);
+}
+
+#[test]
+fn a_rejected_window_refuses_the_lease_until_its_reset() {
+    let harness = start(setup());
+    let reset = now_ms() + 1_500;
+    harness
+        .quota
+        .observe([window("five_hour", 1_000, "rejected", reset)]);
+    let refused = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&refused), Some(LeaseRefusalKind::ProviderRejected));
+    assert!(refused.fds.is_empty());
     assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+    // At the provider's own reset the refusal lifts, with no one lifting it.
+    let lifted = ask_until_granted(&harness, 2);
+    assert!(granted_ok(&lifted));
+    assert!(now_ms() >= reset);
+}
+
+#[test]
+fn high_utilization_refuses_nothing() {
+    let harness = start(setup());
+    let reset = now_ms() + 3_600_000;
+    harness.quota.observe([
+        window("five_hour", 999, "allowed", reset),
+        window("seven_day", 1_000, "allowed_warning", reset),
+    ]);
     assert!(granted_ok(&ask(&harness, 60_000)));
 }
 
 #[test]
-fn every_message_kind_is_the_pinned_bytes_of_its_fixture() {
-    let expires = 1_793_307_000_000;
-    let lease = format!("lease:{}", "0123456789abcdef0123456789abcdef");
-    let messages = [
+fn a_peer_uid_outside_the_lease_callers_is_refused_and_nothing_is_read() {
+    let harness = start(Setup {
+        uid: own_uid().wrapping_add(1),
+        ..setup()
+    });
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn the_configured_uid_outside_the_self_unit_is_refused_and_nothing_is_read() {
+    let harness = start(setup());
+    harness.run_in("mind-persona@eureka.service", 1);
+    let answer = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn an_expiry_in_the_past_or_past_the_bound_is_refused() {
+    let harness = start(setup());
+    let past = ask(&harness, 0);
+    assert_eq!(refusal_of(&past), Some(LeaseRefusalKind::Expired));
+    let far = ask(&harness, 3_600_001 + 60_000);
+    assert_eq!(refusal_of(&far), Some(LeaseRefusalKind::Expired));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn a_token_that_cannot_be_read_is_never_lent_and_frees_the_lease() {
+    let harness = start(Setup {
+        token: None,
+        ..setup()
+    });
+    let first = ask(&harness, 60_000);
+    assert!(first.raw.is_empty() && first.fds.is_empty());
+    harness.enter(2);
+    let again = ask(&harness, 60_000);
+    assert!(again.message.is_none() && again.fds.is_empty(), "not Busy");
+    assert!(harness.tokens.reads.load(Ordering::SeqCst) >= 2);
+}
+
+#[test]
+fn the_protocol_has_no_settle_frame() {
+    let grant = encode_frame(&LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
+        lease_id: "lease:x".to_string(),
+        plan_quota: Vec::new(),
+    }));
+    let value: rmpv::Value = rmp_serde::from_slice(&grant[4..]).unwrap();
+    assert_eq!(
+        value,
+        rmpv::Value::Map(vec![
+            ("kind".into(), "claude_lease_grant".into()),
+            (
+                "value".into(),
+                rmpv::Value::Map(vec![
+                    ("lease_id".into(), "lease:x".into()),
+                    ("plan_quota".into(), rmpv::Value::Array(Vec::new())),
+                ])
+            ),
+        ])
+    );
+    // A frame of the old kind is no message at all.
+    let old = rmpv::Value::Map(vec![
+        ("kind".into(), "claude_lease_settle".into()),
         (
-            &include_bytes!("fixtures/lease_v1/request.bin")[..],
-            LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
-                expires_at_unix_ms: expires,
-            }),
+            "value".into(),
+            rmpv::Value::Map(vec![
+                ("lease_id".into(), "lease:x".into()),
+                ("usage".into(), rmpv::Value::Array(Vec::new())),
+            ]),
         ),
-        (
-            &include_bytes!("fixtures/lease_v1/grant.bin")[..],
-            LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
-                lease_id: lease.clone(),
-                reserved_micro_usd: 600_000,
-            }),
-        ),
-        (
-            &include_bytes!("fixtures/lease_v1/refusal.bin")[..],
-            LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
-                kind: LeaseRefusalKind::SpendCeiling,
-                detail: "the window cannot hold this reservation".to_string(),
-            }),
-        ),
-        (
-            &include_bytes!("fixtures/lease_v1/settle.bin")[..],
-            LeaseMessage::ClaudeLeaseSettle(LeaseSettle {
-                lease_id: lease,
-                usage: vec![
-                    ModelUsage {
-                        model: "claude-opus-5-1".to_string(),
-                        usage: Usage {
-                            input_tokens: 1_200,
-                            cache_read_tokens: 30_000,
-                            cache_write_tokens: 500,
-                            output_tokens: 800,
-                            reasoning_tokens: Some(100),
-                        },
-                    },
-                    ModelUsage {
-                        model: "claude-haiku-5-1".to_string(),
-                        usage: Usage {
-                            input_tokens: 400,
-                            cache_read_tokens: 0,
-                            cache_write_tokens: 0,
-                            output_tokens: 60,
-                            reasoning_tokens: None,
-                        },
-                    },
-                ],
-            }),
-        ),
-        (
-            &include_bytes!("fixtures/lease_v1/settled.bin")[..],
-            LeaseMessage::ClaudeLeaseSettled(LeaseSettled {
-                billed_micro_usd: 123_456,
-                overrun_micro_usd: 23_456,
-            }),
-        ),
-    ];
-    for (bytes, message) in messages {
-        assert_eq!(encode_frame(&message), bytes, "{message:?}");
-        assert_eq!(decode_frame(bytes), Some(message));
-    }
+    ]);
+    let mut body = Vec::new();
+    rmpv::encode::write_value(&mut body, &old).unwrap();
+    let mut frame = (body.len() as u32).to_be_bytes().to_vec();
+    frame.extend(body);
+    assert_eq!(decode_frame(&frame), None);
 }
 
 #[test]
 fn connections_past_the_limit_are_dropped_and_finished_ones_free_their_place() {
     let harness = start(Setup {
-        max_connections: 2,
-        ..setup(1_000, 0)
+        max_connections: 1,
+        ..setup()
     });
-    let held: Vec<UnixStream> = (0..2).map(|_| connect(&harness)).collect();
-    // Let the listener take both before the third arrives.
-    std::thread::sleep(Duration::from_millis(300));
-    let third = ask(&harness, 60_000);
-    assert!(third.raw.is_empty() && third.fds.is_empty());
-    drop(held);
-    // Finished connections give their places back: more refusals in a row
-    // than the limit holds, each answered.
-    let first = ask_until_answered(&harness);
-    assert_eq!(refusal_of(&first), Some(LeaseRefusalKind::CostBound));
-    for _ in 0..4 {
-        let again = ask(&harness, 60_000);
-        assert_eq!(refusal_of(&again), Some(LeaseRefusalKind::CostBound));
-    }
-}
-
-/// A free lease, asked until the listener answers instead of dropping.
-fn ask_until_answered(harness: &Harness) -> Answer {
-    let deadline = Instant::now() + Duration::from_secs(5);
-    loop {
-        let answer = ask(harness, 60_000);
-        if !answer.raw.is_empty() || Instant::now() > deadline {
-            return answer;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-    }
-}
-
-#[test]
-fn an_account_resolves_to_its_uid_and_a_missing_one_to_none() {
-    use claude_connector::user_uid;
-    assert_eq!(user_uid("root"), Some(0));
-    assert_eq!(user_uid("nobody"), Some(65534));
-    assert_eq!(user_uid("no-such-account-4f1c"), None);
-    assert_eq!(user_uid("bad name"), None);
-}
-
-#[test]
-fn a_token_up_to_one_atomic_pipe_write_is_lent_and_a_longer_one_is_not() {
-    let fits: &'static str = Box::leak("t".repeat(4096).into_boxed_str());
-    let harness = start(Setup {
-        token: Some(fits),
-        ..setup(1_000, 100)
-    });
-    let mut answer = ask(&harness, 60_000);
-    let mut read = Vec::new();
-    File::from(answer.fds.remove(0))
-        .read_to_end(&mut read)
-        .unwrap();
-    assert_eq!(read.len(), 4096);
-
-    let too_long: &'static str = Box::leak("t".repeat(4097).into_boxed_str());
-    let harness = start(Setup {
-        token: Some(too_long),
-        ..setup(1_000, 100)
-    });
-    let answer = ask(&harness, 60_000);
-    assert!(answer.raw.is_empty() && answer.fds.is_empty());
-}
-
-// ---- a second real uid (Soul s1, kept as a regression) ----
-
-fn describe(answer: &Answer) -> String {
-    let kind = match &answer.message {
-        Some(LeaseMessage::ClaudeLeaseGrant(_)) => "grant".to_string(),
-        Some(LeaseMessage::ClaudeLeaseRefusal(r)) => format!("refusal:{:?}", r.kind),
-        Some(other) => format!("other:{other:?}"),
-        None => format!("none(raw={})", answer.raw.len()),
-    };
-    format!("kind={kind} fds={}", answer.fds.len())
-}
-
-/// The child half of the second-uid test: connects to `LEASE_SOCK` as whoever
-/// it was started as and prints one line saying what came back. The fake
-/// canary token is never printed, only whether it matched.
-#[test]
-#[ignore = "run as a child of a_second_real_uid_cannot_lease"]
-fn lease_probe_client() {
-    let socket = PathBuf::from(std::env::var("LEASE_SOCK").unwrap());
-    let mut answer = ask_at(&socket, 60_000);
-    let shown = describe(&answer);
-    let mut token_matches = false;
-    if !answer.fds.is_empty() {
-        let mut read = Vec::new();
-        File::from(answer.fds.remove(0))
-            .read_to_end(&mut read)
-            .unwrap();
-        token_matches = read == TOKEN.as_bytes();
-    }
-    println!(
-        "LEASEPROBE uid={} {} token_matches_canary={token_matches}",
-        own_uid(),
-        shown
-    );
-}
-
-/// Runs the probe client as `reuid`, with primary group `regid` and
-/// supplementary `groups`, and returns its LEASEPROBE line. The marker is
-/// found anywhere on a line: the test harness prints it after its own prefix.
-fn probe_as(socket: &std::path::Path, reuid: u32, regid: u32, groups: &str) -> String {
-    let exe = std::env::current_exe().unwrap();
-    let out = std::process::Command::new("setpriv")
-        .arg(format!("--reuid={reuid}"))
-        .arg(format!("--regid={regid}"))
-        .arg(format!("--groups={groups}"))
-        .arg(&exe)
-        .args([
-            "--exact",
-            "lease_probe_client",
-            "--ignored",
-            "--nocapture",
-            "--test-threads=1",
-        ])
-        .env("LEASE_SOCK", socket)
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
-    stdout
-        .lines()
-        .find_map(|line| line.find("LEASEPROBE").map(|at| line[at..].to_string()))
-        .unwrap_or_else(|| {
-            format!(
-                "NO-LINE status={:?} stdout={stdout:?} stderr={}",
-                out.status,
-                String::from_utf8_lossy(&out.stderr)
-            )
-        })
-}
-
-fn have(tool: &str) -> bool {
-    std::process::Command::new(tool)
-        .arg("--version")
-        .output()
-        .is_ok()
-}
-
-#[test]
-fn a_second_real_uid_cannot_lease() {
-    use std::os::unix::fs::PermissionsExt;
-    if own_uid() != 0 || !have("setpriv") {
-        eprintln!("SKIPPED a_second_real_uid_cannot_lease: needs root and setpriv");
-        return;
-    }
-    // Numeric uids need no account: 4242 is the configured Self user, 4243 a
-    // second account that shares its groups.
-    let harness = start(Setup {
-        uid: 4242,
-        ..setup(1_000_000, 600)
-    });
-    std::fs::set_permissions(&harness.dir, std::fs::Permissions::from_mode(0o755)).unwrap();
-    std::fs::set_permissions(&harness.socket, std::fs::Permissions::from_mode(0o666)).unwrap();
-    // Another uid, in the caller's group and the lease group.
-    let a = probe_as(&harness.socket, 4243, 4243, "4242,4244");
-    // Another uid whose primary gid is the caller's.
-    let b = probe_as(&harness.socket, 4243, 4242, "4242");
-    // Root, which is not configured.
-    let root = describe(&ask(&harness, 60_000));
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    // The configured uid does lease.
-    let c = probe_as(&harness.socket, 4242, 4242, "4242");
-    assert!(a.contains("kind=refusal:UnknownCaller fds=0"), "{a}");
-    assert!(b.contains("kind=refusal:UnknownCaller fds=0"), "{b}");
-    assert!(root.contains("kind=refusal:UnknownCaller fds=0"), "{root}");
-    assert!(
-        c.contains("kind=grant fds=1") && c.contains("token_matches_canary=true"),
-        "{c}"
-    );
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
-}
-
-// ---- a real systemd, where there is one ----
-
-/// The child half of the systemd test, run inside a transient service: leases,
-/// settles, and leases again from the same invocation.
-#[test]
-#[ignore = "run inside a transient unit by a_real_systemd_unit_invocation_leases_once"]
-fn lease_in_unit_client() {
-    let socket = PathBuf::from(std::env::var("LEASE_SOCK").unwrap());
-    let mut first = ask_at(&socket, 60_000);
-    let first_kind = describe(&first);
-    if granted_ok(&first) {
-        settle(&mut first, Vec::new());
-    }
-    let second = ask_at(&socket, 60_000);
-    println!(
-        "LEASEPROBE first[{first_kind}] second[{}]",
-        describe(&second)
-    );
-}
-
-fn run_in_unit(socket: &std::path::Path) -> String {
-    let exe = std::env::current_exe().unwrap();
-    let out = std::process::Command::new("systemd-run")
-        .args([
-            "--unit=mind-self@leasetest.service",
-            "--pipe",
-            "--wait",
-            "--collect",
-            "--quiet",
-        ])
-        .arg(format!("--setenv=LEASE_SOCK={}", socket.display()))
-        .arg(&exe)
-        .args([
-            "--exact",
-            "lease_in_unit_client",
-            "--ignored",
-            "--nocapture",
-            "--test-threads=1",
-        ])
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
-    stdout
-        .lines()
-        .find_map(|line| line.find("LEASEPROBE").map(|at| line[at..].to_string()))
-        .unwrap_or_else(|| {
-            format!(
-                "NO-LINE status={:?} stdout={stdout:?} stderr={}",
-                out.status,
-                String::from_utf8_lossy(&out.stderr)
-            )
-        })
-}
-
-#[test]
-fn a_real_systemd_unit_invocation_leases_once() {
-    if own_uid() != 0
-        || !std::path::Path::new("/run/systemd/system").exists()
-        || !have("systemd-run")
-    {
-        eprintln!(
-            "SKIPPED a_real_systemd_unit_invocation_leases_once: needs root, systemd as init and systemd-run"
-        );
-        return;
-    }
-    // The listener asks the production resolver, not the fake.
-    let harness = start_with(
-        setup(1_000_000, 600),
-        Arc::new(SystemdUnits::system()),
-        None,
-        "leasetest",
-    );
-    let leased_then_busy = "first[kind=grant fds=1] second[kind=refusal:Busy fds=0]";
-    // Two invocations of the same unit: each leases once, as its own.
-    let one = run_in_unit(&harness.socket);
-    let two = run_in_unit(&harness.socket);
-    assert!(one.contains(leased_then_busy), "{one}");
-    assert!(two.contains(leased_then_busy), "{two}");
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
-    // A process outside any such unit is not a Self run, though its uid is
-    // the configured one.
-    let outside = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&outside), Some(LeaseRefusalKind::UnknownCaller));
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
-}
-
-#[test]
-fn the_peer_is_named_by_a_process_handle_not_a_pid_number() {
-    let (one, _other) = UnixStream::pair().unwrap();
-    let peer = claude_connector::peer_credentials(&one).unwrap();
-    assert_eq!(peer.uid, own_uid());
-    let process = peer.process.expect("SO_PEERPIDFD on this kernel");
-    let info =
-        std::fs::read_to_string(format!("/proc/self/fdinfo/{}", process.as_raw_fd())).unwrap();
-    assert!(
-        info.lines()
-            .any(|line| line.strip_prefix("Pid:").map(str::trim)
-                == Some(&std::process::id().to_string())),
-        "{info}"
-    );
-}
-
-#[test]
-fn the_unit_is_asked_of_the_callers_unit_through_the_peers_handle() {
-    let harness = start(setup(1_000, 600));
-    let answer = ask(&harness, 60_000);
-    assert!(refusal_of(&answer).is_none() && answer.fds.len() == 1);
-    assert_eq!(
-        *harness.units.as_ref().unwrap().asked_about.lock().unwrap(),
-        vec![(std::process::id().to_string(), UNIT.to_string())]
-    );
-}
-
-const PERSONA_UNIT: &str = "mind-persona@eureka.service";
-
-/// A listener whose one lease caller is a Persona account; peers start in
-/// invocation 1 of the Persona unit.
-fn start_persona(setup: Setup) -> Harness {
-    let units = Arc::new(FakeUnits {
-        peer: Mutex::new(None),
-        asked_about: Mutex::new(Vec::new()),
-    });
-    let harness = start_with(
-        Setup {
-            turn: LeaseTurn::PersonaTurn,
-            ..setup
-        },
-        units.clone(),
-        Some(units),
-        INSTANCE,
-    );
-    harness.run_in(PERSONA_UNIT, 1);
-    harness
-}
-
-fn lease_on(harness: &Harness, turn: LeaseTurn, invocation: &str) -> LeaseAdmission {
-    harness
-        .service
-        .lock()
-        .unwrap()
-        .begin_lease(CALLER, turn, invocation, 100, FAR, now_ms())
-        .unwrap()
-}
-
-fn lease_id(admission: &LeaseAdmission) -> String {
-    match admission {
-        LeaseAdmission::Granted(grant) => grant.lease_id.clone(),
-        other => panic!("expected a grant, got {other:?}"),
-    }
-}
-
-fn busy() -> LeaseAdmission {
-    LeaseAdmission::Refused(LeaseRefusal::Busy)
-}
-
-#[test]
-fn persona_and_self_of_one_caller_lease_together() {
-    let harness = start(setup(1_000_000, 100));
-    let own = lease_on(&harness, LeaseTurn::SelfRun, "self-run");
-    assert_eq!(lease_id(&own), "lease:self-run");
-    let persona = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run");
-    assert_eq!(lease_id(&persona), "lease:persona-run:1");
-    // Each turn kind still holds one: a second Self run is busy while the
-    // first is open, a second Persona lease of the same invocation too.
-    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run-2"), busy());
-    assert_eq!(
-        lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run"),
-        busy()
-    );
-    // Settling the Persona lease frees nothing of the Self lease's.
-    harness
-        .service
-        .lock()
-        .unwrap()
-        .settle_lease(CALLER, "lease:persona-run:1", LeaseUse::Reservation)
-        .unwrap();
-    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run-2"), busy());
-}
-
-#[test]
-fn persona_invocation_leases_sequentially() {
-    let harness = start(setup(1_000_000, 100));
-    for expected in 1..=3 {
-        let granted = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run");
-        let id = lease_id(&granted);
-        assert_eq!(id, format!("lease:persona-run:{expected}"));
-        harness
-            .service
-            .lock()
-            .unwrap()
-            .settle_lease(CALLER, &id, LeaseUse::Reservation)
-            .unwrap();
-    }
-    // Another invocation counts from one: the sequence is per invocation.
-    let other = lease_on(&harness, LeaseTurn::PersonaTurn, "persona-other");
-    assert_eq!(lease_id(&other), "lease:persona-other:1");
-}
-
-#[test]
-fn persona_invocation_second_open_lease_busy() {
-    let harness = start_persona(setup(1_000_000, 100));
     let first = ask(&harness, 60_000);
     assert!(granted_ok(&first));
     let second = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
-    assert!(second.fds.is_empty());
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
-}
-
-#[test]
-fn persona_turns_of_a_live_invocation_each_lend_a_token_over_the_socket() {
-    let harness = start_persona(setup(1_000_000, 100));
-    for _ in 0..2 {
-        let mut answer = ask(&harness, 60_000);
-        assert!(granted_ok(&answer));
-        settle(&mut answer, vec![used(MODEL, 10)]);
-    }
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 2);
-}
-
-#[test]
-fn self_invocation_still_leases_once() {
-    let harness = start(setup(1_000_000, 100));
-    let id = lease_id(&lease_on(&harness, LeaseTurn::SelfRun, "self-run"));
-    harness
-        .service
-        .lock()
-        .unwrap()
-        .settle_lease(CALLER, &id, LeaseUse::Reservation)
-        .unwrap();
-    assert_eq!(lease_on(&harness, LeaseTurn::SelfRun, "self-run"), busy());
-}
-
-#[test]
-fn persona_row_refuses_mind_self_unit() {
-    let harness = start_persona(setup(1_000_000, 100));
-    harness.run_in(UNIT, 1);
-    let answer = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
-    assert!(answer.fds.is_empty());
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-    // And a Self row refuses the Persona unit.
-    let harness = start(setup(1_000_000, 100));
-    harness.run_in(PERSONA_UNIT, 1);
-    let answer = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&answer), Some(LeaseRefusalKind::UnknownCaller));
-    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
-}
-
-#[test]
-fn a_persona_lease_reserves_and_settles_in_the_callers_window() {
-    let harness = start(setup(1_000, 600));
-    let id = lease_id(&lease_on(&harness, LeaseTurn::PersonaTurn, "persona-run"));
-    // 100 reserved by the helper; a Self probe of 901 cannot fit, 900 can.
-    assert_eq!(probe_reserve(&harness, "p1", 901), ceiling_refused());
-    harness
-        .service
-        .lock()
-        .unwrap()
-        .settle_lease(CALLER, &id, LeaseUse::NeverLent)
-        .unwrap();
-    assert!(matches!(
-        probe_reserve(&harness, "p2", 1_000),
-        LeaseAdmission::Granted(_)
-    ));
+    assert!(second.message.is_none() && second.fds.is_empty());
+    drop(first);
+    assert!(granted_ok(&ask_until_granted(&harness, 2)));
 }
diff --git a/crates/model-connector/src/client.rs b/crates/model-connector/src/client.rs
index 47b6c94..881ef01 100644
--- a/crates/model-connector/src/client.rs
+++ b/crates/model-connector/src/client.rs
@@ -9,11 +9,11 @@ use rand_core::{OsRng, RngCore};
 use crate::contract::{TransportInvocation, TransportKey, TransportResult};
 use crate::envelope::{
     MAX_IDENTITY_BYTES, ServiceError, TransportFrameError, decode_result_frame,
-    decode_spend_readout_response_frame, decrypt_result, decrypt_spend_readout,
-    encode_invocation_frame, encode_spend_readout_request_frame, encrypt_invocation,
-    encrypt_spend_readout_request, read_transport_frame, write_transport_frame,
+    decode_usage_readout_response_frame, decrypt_result, decrypt_usage_readout,
+    encode_invocation_frame, encode_usage_readout_request_frame, encrypt_invocation,
+    encrypt_usage_readout_request, read_transport_frame, write_transport_frame,
 };
-use crate::readout::SpendReadout;
+use crate::readout::UsageReadout;
 
 #[derive(Clone)]
 pub struct ConnectorClient {
@@ -62,25 +62,25 @@ impl ConnectorClient {
         decrypt_result(&envelope, &self.security, invocation).map_err(Into::into)
     }
 
-    /// Reads the connector's spend ledger and plan quota as `caller_runtime_id`,
+    /// Reads the plan's usage windows as `caller_runtime_id`,
     /// which must be a caller whose connection key this client holds.
-    pub fn spend_readout(
+    pub fn usage_readout(
         &self,
         caller_runtime_id: &str,
-    ) -> Result<SpendReadout, ConnectorClientError> {
+    ) -> Result<UsageReadout, ConnectorClientError> {
         let mut nonce = [0_u8; 16];
         OsRng.fill_bytes(&mut nonce);
         let request_id = format!(
-            "spend-readout-{}",
+            "usage-readout-{}",
             nonce.iter().map(|b| format!("{b:02x}")).collect::<String>()
         );
-        let sealed = encrypt_spend_readout_request(caller_runtime_id, &request_id, &self.security)?;
-        let response = self.exchange(&encode_spend_readout_request_frame(&sealed)?)?;
-        let envelope = decode_spend_readout_response_frame(&response)?;
+        let sealed = encrypt_usage_readout_request(caller_runtime_id, &request_id, &self.security)?;
+        let response = self.exchange(&encode_usage_readout_request_frame(&sealed)?)?;
+        let envelope = decode_usage_readout_response_frame(&response)?;
         if envelope.caller_runtime_id != caller_runtime_id || envelope.request_id != request_id {
             return Err(ServiceError::OuterIdentity.into());
         }
-        decrypt_spend_readout(&envelope, &self.security).map_err(Into::into)
+        decrypt_usage_readout(&envelope, &self.security).map_err(Into::into)
     }
 
     /// Sends one frame on a fresh connection and reads the one answer.
@@ -274,17 +274,17 @@ mod fixture_tests {
             let server = std::thread::spawn(move || {
                 let (mut stream, _) = listener.accept().unwrap();
                 let request = read_transport_frame(&mut stream, 64 * 1024).unwrap();
-                let RequestFrame::SpendReadout(asked) = decode_request_frame(&request).unwrap()
+                let RequestFrame::UsageReadout(asked) = decode_request_frame(&request).unwrap()
                 else {
                     panic!("the client sent something other than a readout request");
                 };
                 let request_id = answer_request.unwrap_or(&asked.request_id);
-                let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
+                let readout = UsageReadout::new(1, PlanQuotaSnapshot::default());
                 let sealed =
-                    encrypt_spend_readout(answer_caller, request_id, &readout, &key).unwrap();
+                    encrypt_usage_readout(answer_caller, request_id, &readout, &key).unwrap();
                 write_transport_frame(
                     &mut stream,
-                    &encode_spend_readout_response_frame(&sealed).unwrap(),
+                    &encode_usage_readout_response_frame(&sealed).unwrap(),
                     64 * 1024,
                 )
                 .unwrap();
@@ -296,7 +296,7 @@ mod fixture_tests {
                 Some(Duration::from_secs(1)),
             )
             .unwrap();
-            let answer = client.spend_readout("caller-1");
+            let answer = client.usage_readout("caller-1");
             if accepted {
                 assert_eq!(answer.unwrap().at_unix_ms, 1);
             } else {
diff --git a/crates/model-connector/src/contract.rs b/crates/model-connector/src/contract.rs
index f22b8f9..d039774 100644
--- a/crates/model-connector/src/contract.rs
+++ b/crates/model-connector/src/contract.rs
@@ -9,11 +9,11 @@ use zeroize::Zeroize;
 
 use crate::envelope::{ServiceError, binary_schema};
 
-pub const PROVIDER_REQUEST_SCHEMA_ID: &str = "gamecult.model.provider_request.v3";
-pub const INVOCATION_SCHEMA_ID: &str = "gamecult.model.transport_invocation.v3";
-pub const RESULT_SCHEMA_ID: &str = "gamecult.model.transport_result.v3";
-pub const RECEIPT_SCHEMA_ID: &str = "gamecult.model.transport_receipt.v3";
-pub const ENVELOPE_SCHEMA_ID: &str = "gamecult.model.transport_envelope.v3";
+pub const PROVIDER_REQUEST_SCHEMA_ID: &str = "gamecult.model.provider_request.v4";
+pub const INVOCATION_SCHEMA_ID: &str = "gamecult.model.transport_invocation.v4";
+pub const RESULT_SCHEMA_ID: &str = "gamecult.model.transport_result.v4";
+pub const RECEIPT_SCHEMA_ID: &str = "gamecult.model.transport_receipt.v4";
+pub const ENVELOPE_SCHEMA_ID: &str = "gamecult.model.transport_envelope.v4";
 
 #[derive(Clone, PartialEq, Eq)]
 pub struct TransportKey(pub(crate) [u8; 32]);
@@ -190,10 +190,10 @@ pub enum FailureKind {
     Provider,
 }
 
-/// Token accounting for one request, as the backend reports it; the service
-/// prices it. Cache reads and writes are counted apart from plain input.
+/// Token accounting for one request, as the backend reports it. Cache reads
+/// and writes are counted apart from plain input.
 /// `output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail
-/// (absent when the provider does not report it) and is never priced apart.
+/// (absent when the provider does not report it) and is never counted apart.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 pub struct Usage {
@@ -252,10 +252,6 @@ pub struct TransportInvocation {
     pub expires_at_unix_ms: u64,
     pub native_request_sha256: [u8; 32],
     pub provider_request_sha256: [u8; 32],
-    /// The most this request may cost, in micro-USD: the caller's own bound
-    /// on it. Required nonzero. It is part of the invocation's identity, so a
-    /// changed budget under a recorded request id is a `ReplayConflict`.
-    pub max_cost_micro_usd: u64,
     pub request: ProviderRequest,
 }
 
@@ -264,7 +260,6 @@ impl TransportInvocation {
         caller_runtime_id: impl Into<String>,
         expires_at_unix_ms: u64,
         native_request_sha256: [u8; 32],
-        max_cost_micro_usd: u64,
         request: ProviderRequest,
     ) -> Result<Self, ContractError> {
         let provider_request_sha256 = provider_request_sha256(&request)?;
@@ -274,7 +269,6 @@ impl TransportInvocation {
             expires_at_unix_ms,
             native_request_sha256,
             provider_request_sha256,
-            max_cost_micro_usd,
             request,
         })
     }
@@ -287,9 +281,6 @@ impl TransportInvocation {
         if self.native_request_sha256 == [0; 32] {
             return Err(ContractError::Invalid("native_request_sha256"));
         }
-        if self.max_cost_micro_usd == 0 {
-            return Err(ContractError::Invalid("max_cost_micro_usd"));
-        }
         self.request.validate()?;
         if self.provider_request_sha256 != provider_request_sha256(&self.request)? {
             return Err(ContractError::ProviderDigest);
@@ -485,15 +476,6 @@ pub struct TransportReceipt {
     /// How many foreign `ReasoningState` items the service removed from the
     /// request before the backend saw it.
     pub foreign_reasoning_dropped: u32,
-    /// What the request cost, in micro-USD. The service derives it from the
-    /// outcome's usage and its price table; a backend never writes it.
-    pub cost_micro_usd: u64,
-    /// How far `cost_micro_usd` exceeds what the service reserved for the
-    /// request: zero unless the backend reported usage above the worst case
-    /// the request allowed, which is a breach of the backend's contract. The
-    /// cost is still the true one and the caller's window is charged all of
-    /// it. The service derives this; a backend never writes it.
-    pub overrun_micro_usd: u64,
     pub outcome: TransportOutcome,
 }
 
@@ -558,12 +540,6 @@ pub enum Refusal {
     ModelNotAllowed,
     OutputBound,
     PayloadBound,
-    // The worst case of the request exceeds the invocation's own
-    // `max_cost_micro_usd`. Plain comments: a doc comment would split the
-    // published schema into a union.
-    CostBound,
-    // The caller's spend window cannot hold the request's reservation.
-    SpendCeiling,
     Capacity,
     InFlight,
     Indeterminate,
@@ -573,15 +549,12 @@ pub enum Refusal {
     // exchange, where dropping it would break the provider's own rules. A plain
     // comment: a doc comment would split the published schema into a union.
     ForeignReasoningState,
-    // The caller's newest admission window starts after the clock's reading,
-    // and the request does not fit what that window holds: the host's clock
-    // is behind the window and the caller stays refused until it catches up.
-    // A plain comment: a doc comment would split the published schema into a
-    // union.
-    ClockBehindAdmissionWindow,
+    // The provider itself is refusing right now: a plan window it reported
+    // `rejected` has not reached its own reset. Plain comments, as above.
+    ProviderRejected,
 }
 
-/// The one wire codec of every v3 document: named MessagePack (struct fields
+/// The one wire codec of every v4 document: named MessagePack (struct fields
 /// are keyed by name), with unknown fields refused by the types themselves.
 pub(crate) fn wire_encode<T: Serialize + ?Sized>(document: &T) -> Result<Vec<u8>, ContractError> {
     rmp_serde::to_vec_named(document).map_err(|_| ContractError::Encoding)
@@ -787,28 +760,16 @@ mod tests {
     }
 
     #[test]
-    fn max_cost_zero_is_malformed() {
-        let mut invocation = invocation();
-        invocation.max_cost_micro_usd = 0;
-        assert_eq!(
-            invocation.validate(1_000, 2_000),
-            Err(ContractError::Invalid("max_cost_micro_usd"))
-        );
-        invocation.max_cost_micro_usd = 1;
-        assert_eq!(invocation.validate(1_000, 2_000), Ok(()));
-    }
-
-    #[test]
-    fn max_cost_is_part_of_the_invocations_identity() {
+    fn the_invocations_identity_covers_its_request() {
         let one = invocation();
         let mut other = one.clone();
-        other.max_cost_micro_usd += 1;
+        other.request.max_output_tokens += 1;
         assert_ne!(
             canonical_invocation_bytes(&one).unwrap(),
             canonical_invocation_bytes(&other).unwrap()
         );
         let decoded: TransportInvocation = wire_decode(&wire_encode(&one).unwrap()).unwrap();
-        assert_eq!(decoded.max_cost_micro_usd, one.max_cost_micro_usd);
+        assert_eq!(decoded, one);
     }
 
     #[test]
@@ -869,7 +830,7 @@ mod tests {
     }
 
     #[test]
-    fn v3_documents_carry_their_v3_ids() {
+    fn v4_documents_carry_their_v4_ids() {
         assert_eq!(
             [
                 PROVIDER_REQUEST_SCHEMA_ID,
@@ -879,11 +840,11 @@ mod tests {
                 ENVELOPE_SCHEMA_ID
             ],
             [
-                "gamecult.model.provider_request.v3",
-                "gamecult.model.transport_invocation.v3",
-                "gamecult.model.transport_result.v3",
-                "gamecult.model.transport_receipt.v3",
-                "gamecult.model.transport_envelope.v3"
+                "gamecult.model.provider_request.v4",
+                "gamecult.model.transport_invocation.v4",
+                "gamecult.model.transport_result.v4",
+                "gamecult.model.transport_receipt.v4",
+                "gamecult.model.transport_envelope.v4"
             ]
         );
         let invocation = invocation();
@@ -922,7 +883,7 @@ mod tests {
         let bytes = wire_encode(document).unwrap();
         let mut value = rmpv::decode::read_value(&mut bytes.as_slice()).unwrap();
         let rmpv::Value::Map(entries) = &mut value else {
-            panic!("a v3 document is a named map");
+            panic!("a v4 document is a named map");
         };
         entries.push((rmpv::Value::from("unexpected_field"), rmpv::Value::from(1)));
         let mut out = Vec::new();
diff --git a/crates/model-connector/src/envelope.rs b/crates/model-connector/src/envelope.rs
index 70d8ed2..2fb4543 100644
--- a/crates/model-connector/src/envelope.rs
+++ b/crates/model-connector/src/envelope.rs
@@ -17,14 +17,14 @@ use crate::contract::{
     ContractError, ENVELOPE_SCHEMA_ID, TransportInvocation, TransportKey, TransportResult,
     canonical_invocation_bytes, require_id, wire_decode, wire_encode,
 };
-use crate::readout::SpendReadout;
+use crate::readout::UsageReadout;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 pub enum EnvelopeKind {
     Invocation,
     Result,
-    SpendReadoutRequest,
-    SpendReadoutResult,
+    UsageReadoutRequest,
+    UsageReadoutResult,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -54,8 +54,8 @@ pub(crate) fn binary_schema(_: &mut schemars::SchemaGenerator) -> schemars::Sche
 pub const CONNECTOR_SERVICE_ID: &str = "gamecult.model.connector";
 /// The operation that runs one sealed invocation.
 pub const INVOKE_OPERATION: &str = "invoke";
-/// The operation that reads the spend ledger and the plan's quota.
-pub const SPEND_READOUT_OPERATION: &str = "spend_readout";
+/// The operation that reads the plan's usage.
+pub const USAGE_READOUT_OPERATION: &str = "usage_readout";
 
 const PAYLOAD_ENCODING: &str = "messagepack-base64";
 const OK_STATUS: &str = "ok";
@@ -78,19 +78,19 @@ fn seal_payload(envelope: &TransportEnvelope) -> Result<String, ServiceError> {
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum Operation {
     Invoke,
-    SpendReadout,
+    UsageReadout,
 }
 
 impl Operation {
     fn name(self) -> &'static str {
         match self {
             Operation::Invoke => INVOKE_OPERATION,
-            Operation::SpendReadout => SPEND_READOUT_OPERATION,
+            Operation::UsageReadout => USAGE_READOUT_OPERATION,
         }
     }
 
-    fn from_name(name: &str) -> Option<Self> {
-        [Operation::Invoke, Operation::SpendReadout]
+    pub(crate) fn from_name(name: &str) -> Option<Self> {
+        [Operation::Invoke, Operation::UsageReadout]
             .into_iter()
             .find(|operation| operation.name() == name)
     }
@@ -141,10 +141,10 @@ pub(crate) fn encode_invocation_frame(
     request_frame(Operation::Invoke, envelope)
 }
 
-pub(crate) fn encode_spend_readout_request_frame(
+pub(crate) fn encode_usage_readout_request_frame(
     envelope: &TransportEnvelope,
 ) -> Result<Vec<u8>, ServiceError> {
-    request_frame(Operation::SpendReadout, envelope)
+    request_frame(Operation::UsageReadout, envelope)
 }
 
 #[cfg(any(feature = "daemon", test))]
@@ -153,10 +153,10 @@ pub(crate) fn encode_result_frame(envelope: &TransportEnvelope) -> Result<Vec<u8
 }
 
 #[cfg(feature = "daemon")]
-pub(crate) fn encode_spend_readout_response_frame(
+pub(crate) fn encode_usage_readout_response_frame(
     envelope: &TransportEnvelope,
 ) -> Result<Vec<u8>, ServiceError> {
-    response_frame(Operation::SpendReadout, envelope)
+    response_frame(Operation::UsageReadout, envelope)
 }
 
 /// Opens the carriage of one frame. Everything the carriage says is checked
@@ -193,7 +193,7 @@ fn read_carriage(bytes: &[u8]) -> Result<CultNetMessage, ServiceError> {
 #[cfg(any(feature = "daemon", test))]
 pub(crate) enum RequestFrame {
     Invoke(TransportEnvelope),
-    SpendReadout(TransportEnvelope),
+    UsageReadout(TransportEnvelope),
 }
 
 #[cfg(any(feature = "daemon", test))]
@@ -215,7 +215,7 @@ pub(crate) fn decode_request_frame(bytes: &[u8]) -> Result<RequestFrame, Service
                 &payload,
             )? {
                 (Operation::Invoke, envelope) => Ok(RequestFrame::Invoke(envelope)),
-                (Operation::SpendReadout, envelope) => Ok(RequestFrame::SpendReadout(envelope)),
+                (Operation::UsageReadout, envelope) => Ok(RequestFrame::UsageReadout(envelope)),
             }
         }
         _ => Err(ServiceError::Carriage),
@@ -226,7 +226,7 @@ pub(crate) fn decode_request_frame(bytes: &[u8]) -> Result<RequestFrame, Service
 pub(crate) fn decode_invocation_frame(bytes: &[u8]) -> Result<TransportEnvelope, ServiceError> {
     match decode_request_frame(bytes)? {
         RequestFrame::Invoke(envelope) => Ok(envelope),
-        RequestFrame::SpendReadout(_) => Err(ServiceError::Carriage),
+        RequestFrame::UsageReadout(_) => Err(ServiceError::Carriage),
     }
 }
 
@@ -263,10 +263,10 @@ pub(crate) fn decode_result_frame(bytes: &[u8]) -> Result<TransportEnvelope, Ser
     decode_response_frame(bytes, Operation::Invoke)
 }
 
-pub(crate) fn decode_spend_readout_response_frame(
+pub(crate) fn decode_usage_readout_response_frame(
     bytes: &[u8],
 ) -> Result<TransportEnvelope, ServiceError> {
-    decode_response_frame(bytes, Operation::SpendReadout)
+    decode_response_frame(bytes, Operation::UsageReadout)
 }
 
 /// The most bytes one frame holding a sealed envelope of `ciphertext_len`
@@ -416,9 +416,9 @@ pub fn decrypt_result(
     Ok(result)
 }
 
-/// A spend readout request carries no content: the sealed envelope's
+/// A usage readout request carries no content: the sealed envelope's
 /// authenticated identity and kind are the whole request.
-pub(crate) fn encrypt_spend_readout_request(
+pub(crate) fn encrypt_usage_readout_request(
     caller_runtime_id: &str,
     request_id: &str,
     security: &TransportKey,
@@ -426,45 +426,45 @@ pub(crate) fn encrypt_spend_readout_request(
     encrypt_message(
         caller_runtime_id,
         request_id,
-        EnvelopeKind::SpendReadoutRequest,
+        EnvelopeKind::UsageReadoutRequest,
         &[],
         security,
     )
 }
 
 #[cfg(any(feature = "daemon", test))]
-pub(crate) fn decrypt_spend_readout_request(
+pub(crate) fn decrypt_usage_readout_request(
     envelope: &TransportEnvelope,
     security: &TransportKey,
 ) -> Result<(), ServiceError> {
-    validate_envelope(envelope, EnvelopeKind::SpendReadoutRequest)?;
+    validate_envelope(envelope, EnvelopeKind::UsageReadoutRequest)?;
     decrypt_message(envelope, security).map(drop)
 }
 
 #[cfg(feature = "daemon")]
-pub(crate) fn encrypt_spend_readout(
+pub(crate) fn encrypt_usage_readout(
     caller_runtime_id: &str,
     request_id: &str,
-    readout: &SpendReadout,
+    readout: &UsageReadout,
     security: &TransportKey,
 ) -> Result<TransportEnvelope, ServiceError> {
     let plaintext = wire_encode(readout).map_err(|_| ServiceError::Encoding)?;
     encrypt_message(
         caller_runtime_id,
         request_id,
-        EnvelopeKind::SpendReadoutResult,
+        EnvelopeKind::UsageReadoutResult,
         &plaintext,
         security,
     )
 }
 
-pub(crate) fn decrypt_spend_readout(
+pub(crate) fn decrypt_usage_readout(
     envelope: &TransportEnvelope,
     security: &TransportKey,
-) -> Result<SpendReadout, ServiceError> {
-    validate_envelope(envelope, EnvelopeKind::SpendReadoutResult)?;
+) -> Result<UsageReadout, ServiceError> {
+    validate_envelope(envelope, EnvelopeKind::UsageReadoutResult)?;
     let plaintext = decrypt_message(envelope, security)?;
-    let readout: SpendReadout = wire_decode(&plaintext).map_err(|_| ServiceError::Encoding)?;
+    let readout: UsageReadout = wire_decode(&plaintext).map_err(|_| ServiceError::Encoding)?;
     readout.validate()?;
     Ok(readout)
 }
@@ -607,8 +607,6 @@ pub enum ServiceError {
     SharedCallerKey,
     #[error("connector replay store failed: {0}")]
     ReplayStore(String),
-    #[error("an allowed model has no price: {0}")]
-    UnpricedModel(String),
     #[error("connector replay record is malformed")]
     InvalidReplayRecord,
     #[error("caller key changed while durable replay records still exist")]
@@ -1072,7 +1070,7 @@ mod tests {
     fn golden_frame() -> Vec<u8> {
         std::fs::read(
             std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
-                .join("tests/fixtures/wire_v3/carriage_invocation.frame"),
+                .join("tests/fixtures/wire_v4/carriage_invocation.frame"),
         )
         .expect("carriage_invocation.frame is committed")
     }
@@ -1109,7 +1107,7 @@ mod tests {
         assert_eq!(text(&request, "operation"), "invoke");
         assert_eq!(
             text(&request, "payloadSchema"),
-            "gamecult.model.transport_envelope.v3"
+            "gamecult.model.transport_envelope.v4"
         );
         assert_eq!(text(&request, "payloadEncoding"), "messagepack-base64");
         assert_eq!(text(&request, "messageId"), envelope.request_id);
@@ -1123,7 +1121,7 @@ mod tests {
         assert_eq!(text(&response, "status"), "ok");
         assert_eq!(
             text(&response, "payloadSchema"),
-            "gamecult.model.transport_envelope.v3"
+            "gamecult.model.transport_envelope.v4"
         );
         assert_eq!(text(&response, "payloadEncoding"), "messagepack-base64");
         assert_eq!(text(&response, "messageId"), envelope.request_id);
@@ -1287,23 +1285,23 @@ mod tests {
     #[test]
     fn a_readout_request_is_not_an_invocation_and_names_its_own_operation() {
         let key = TransportKey::from_connection_secret("readout-test-key").unwrap();
-        let sealed = encrypt_spend_readout_request("caller-1", "readout-1", &key).unwrap();
-        let frame = encode_spend_readout_request_frame(&sealed).unwrap();
+        let sealed = encrypt_usage_readout_request("caller-1", "readout-1", &key).unwrap();
+        let frame = encode_usage_readout_request_frame(&sealed).unwrap();
         assert!(matches!(
             decode_request_frame(&frame),
-            Ok(RequestFrame::SpendReadout(found)) if found == sealed
+            Ok(RequestFrame::UsageReadout(found)) if found == sealed
         ));
         assert_eq!(decode_invocation_frame(&frame), Err(ServiceError::Carriage));
         // Sealed as one kind, the authenticated data refuses it as another.
-        assert!(decrypt_spend_readout_request(&sealed, &key).is_ok());
+        assert!(decrypt_usage_readout_request(&sealed, &key).is_ok());
         assert_eq!(
-            decrypt_spend_readout(&sealed, &key).unwrap_err(),
+            decrypt_usage_readout(&sealed, &key).unwrap_err(),
             ServiceError::Envelope
         );
         let mut relabelled = sealed.clone();
-        relabelled.message_kind = EnvelopeKind::SpendReadoutResult;
+        relabelled.message_kind = EnvelopeKind::UsageReadoutResult;
         assert_eq!(
-            decrypt_spend_readout(&relabelled, &key).unwrap_err(),
+            decrypt_usage_readout(&relabelled, &key).unwrap_err(),
             ServiceError::Encryption
         );
     }
@@ -1313,12 +1311,12 @@ mod tests {
     fn a_response_is_read_as_its_own_operation_only() {
         use crate::readout::PlanQuotaSnapshot;
         let key = TransportKey::from_connection_secret("readout-test-key").unwrap();
-        let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
-        let sealed = encrypt_spend_readout("caller-1", "readout-1", &readout, &key).unwrap();
-        let readout_frame = encode_spend_readout_response_frame(&sealed).unwrap();
+        let readout = UsageReadout::new(1, PlanQuotaSnapshot::default());
+        let sealed = encrypt_usage_readout("caller-1", "readout-1", &readout, &key).unwrap();
+        let readout_frame = encode_usage_readout_response_frame(&sealed).unwrap();
         let invoke_frame = encode_result_frame(&sealed).unwrap();
         assert_eq!(
-            decode_spend_readout_response_frame(&readout_frame).unwrap(),
+            decode_usage_readout_response_frame(&readout_frame).unwrap(),
             sealed
         );
         assert_eq!(decode_result_frame(&invoke_frame).unwrap(), sealed);
@@ -1327,9 +1325,9 @@ mod tests {
             Err(ServiceError::Carriage)
         );
         assert_eq!(
-            decode_spend_readout_response_frame(&invoke_frame),
+            decode_usage_readout_response_frame(&invoke_frame),
             Err(ServiceError::Carriage)
         );
-        assert_eq!(decrypt_spend_readout(&sealed, &key).unwrap(), readout);
+        assert_eq!(decrypt_usage_readout(&sealed, &key).unwrap(), readout);
     }
 }
diff --git a/crates/model-connector/src/fixtures.rs b/crates/model-connector/src/fixtures.rs
index 079a99c..1bfc37a 100644
--- a/crates/model-connector/src/fixtures.rs
+++ b/crates/model-connector/src/fixtures.rs
@@ -133,16 +133,9 @@ pub(crate) fn request() -> ProviderRequest {
     request
 }
 
-/// Generous next to the fixture request's worst case (about 64,000), so it
-/// binds only in the tests that are about spend.
-pub(crate) const MAX_COST: u64 = 10_000_000;
-
-/// What the fixture usage (10 input and 3 output tokens) costs under
-/// [`fixture_price`]: 10 x 3,000,000 + 3 x 15,000,000 = 75,000,000 / 1e6.
-pub(crate) const FIXTURE_USAGE_COST: u64 = 75;
 
 pub(crate) fn invocation() -> TransportInvocation {
-    TransportInvocation::new("epiphany-yggdrasil", 2_000, [7; 32], MAX_COST, request()).unwrap()
+    TransportInvocation::new("epiphany-yggdrasil", 2_000, [7; 32], request()).unwrap()
 }
 
 pub(crate) fn receipt(invocation: &TransportInvocation) -> TransportReceipt {
@@ -155,8 +148,6 @@ pub(crate) fn receipt(invocation: &TransportInvocation) -> TransportReceipt {
         model: invocation.request.model.clone(),
         provider: "fixture-sse".to_string(),
         foreign_reasoning_dropped: 0,
-        cost_micro_usd: FIXTURE_USAGE_COST,
-        overrun_micro_usd: 0,
         outcome: TransportOutcome::Completed {
             provider_response_id: Some("response-1".to_string()),
             stop_reason: StopReason::EndTurn,
@@ -170,33 +161,6 @@ pub(crate) fn receipt(invocation: &TransportInvocation) -> TransportReceipt {
         },
     }
 }
-/// A price with a distinct nonzero rate per class, so a swapped rate changes a cost.
-#[cfg(feature = "daemon")]
-pub(crate) fn fixture_price() -> ModelPrice {
-    ModelPrice {
-        rates: Rates {
-            input: 3_000_000,
-            cache_write_short: 3_750_000,
-            cache_write_long: 6_000_000,
-            cache_read: 300_000,
-            output: 15_000_000,
-        },
-        long_context: None,
-        overhead_tokens: 100,
-    }
-}
-
-#[cfg(feature = "daemon")]
-pub(crate) fn fixture_prices() -> PriceTable {
-    PriceTable::from([("gpt-5.4".to_string(), fixture_price())])
-}
-
-/// Far above anything a fixture request reserves: the ceiling binds only in
-/// the tests that are about it.
-#[cfg(feature = "daemon")]
-pub(crate) const CEILING: u64 = 1 << 40;
-#[cfg(feature = "daemon")]
-pub(crate) const WINDOW_MS: u64 = 3_600_000;
 
 #[cfg(feature = "daemon")]
 pub(crate) fn caller(
@@ -212,8 +176,6 @@ pub(crate) fn caller(
         max_concurrent_requests,
         64 * 1024,
         32_768,
-        SpendCeiling(CEILING),
-        SpendWindowMs(WINDOW_MS),
     )
     .unwrap()
 }
@@ -223,7 +185,6 @@ pub(crate) fn open_service(store: &TestStore, max_concurrent_requests: usize) ->
     TransportService::open(
         &store.path,
         "fixture-sse",
-        fixture_prices(),
         [
             caller(
                 "epiphany-yggdrasil",
@@ -249,5 +210,5 @@ pub(crate) fn security(key: &str) -> TransportKey {
 pub(crate) fn invocation_for(caller_runtime_id: &str, request_id: &str) -> TransportInvocation {
     let mut request = request();
     request.request_id = request_id.to_string();
-    TransportInvocation::new(caller_runtime_id, 2_000, [7; 32], MAX_COST, request).unwrap()
+    TransportInvocation::new(caller_runtime_id, 2_000, [7; 32], request).unwrap()
 }
diff --git a/crates/model-connector/src/readout.rs b/crates/model-connector/src/readout.rs
index 36d4cb9..197e65a 100644
--- a/crates/model-connector/src/readout.rs
+++ b/crates/model-connector/src/readout.rs
@@ -1,13 +1,14 @@
-//! The spend readout: what each caller has spent and holds in its current
-//! window, and the plan's own usage as the backend last saw it. The ledger is
-//! the replay store's; a readout only reads it.
+//! The usage readout: the subscription plan's own usage windows as the backend
+//! last saw them. The connector meters nothing in dollars; it publishes what
+//! the provider reports, and the minds read it and decide their own burn.
 
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
 use crate::contract::ContractError;
 
-pub const SPEND_READOUT_SCHEMA_ID: &str = "gamecult.model.spend_readout.v1";
+pub const USAGE_READOUT_SCHEMA_ID: &str = "gamecult.model.usage_readout.v1";
+
 
 /// One window of the subscription plan, as the provider reported it.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -32,40 +33,25 @@ pub struct PlanQuotaSnapshot {
     pub windows: Vec<PlanQuota>,
 }
 
-/// One caller's current spend window in micro-USD. `spent` is settled charges
-/// plus what a crash left counted at its full reservation; `reserved` is what
-/// calls in flight hold, and both count against the ceiling.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
-pub struct CallerSpend {
-    pub caller_id: String,
-    pub window_ms: u64,
-    pub ceiling_micro_usd: u64,
-    pub spent_micro_usd: u64,
-    pub reserved_micro_usd: u64,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SpendReadout {
+pub struct UsageReadout {
     pub schema_id: String,
     pub at_unix_ms: u64,
-    pub callers: Vec<CallerSpend>,
     pub plan_quota: Vec<PlanQuota>,
 }
 
-impl SpendReadout {
-    pub fn new(at_unix_ms: u64, callers: Vec<CallerSpend>, plan: PlanQuotaSnapshot) -> Self {
+impl UsageReadout {
+    pub fn new(at_unix_ms: u64, plan: PlanQuotaSnapshot) -> Self {
         Self {
-            schema_id: SPEND_READOUT_SCHEMA_ID.to_string(),
+            schema_id: USAGE_READOUT_SCHEMA_ID.to_string(),
             at_unix_ms,
-            callers,
             plan_quota: plan.windows,
         }
     }
 
     pub(crate) fn validate(&self) -> Result<(), ContractError> {
-        if self.schema_id != SPEND_READOUT_SCHEMA_ID {
+        if self.schema_id != USAGE_READOUT_SCHEMA_ID {
             return Err(ContractError::Schema);
         }
         Ok(())
@@ -77,16 +63,9 @@ mod tests {
     use super::*;
     use crate::contract::{wire_decode, wire_encode};
 
-    fn readout() -> SpendReadout {
-        SpendReadout::new(
+    fn readout() -> UsageReadout {
+        UsageReadout::new(
             1_000,
-            vec![CallerSpend {
-                caller_id: "eureka".into(),
-                window_ms: 3_600_000,
-                ceiling_micro_usd: 50_000_000,
-                spent_micro_usd: 7,
-                reserved_micro_usd: 3,
-            }],
             PlanQuotaSnapshot {
                 windows: vec![PlanQuota {
                     window: "five_hour".into(),
@@ -107,21 +86,21 @@ mod tests {
             panic!("a readout is a map, not a positional array");
         };
         let names: Vec<&str> = fields.iter().filter_map(|(k, _)| k.as_str()).collect();
-        assert_eq!(names, ["schema_id", "at_unix_ms", "callers", "plan_quota"]);
-        assert_eq!(wire_decode::<SpendReadout>(&bytes).unwrap(), readout());
+        assert_eq!(names, ["schema_id", "at_unix_ms", "plan_quota"]);
+        assert_eq!(wire_decode::<UsageReadout>(&bytes).unwrap(), readout());
     }
 
     #[test]
     fn an_unobserved_plan_is_none_not_zero() {
-        let bare = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
-        let decoded: SpendReadout = wire_decode(&wire_encode(&bare).unwrap()).unwrap();
+        let bare = UsageReadout::new(1, PlanQuotaSnapshot::default());
+        let decoded: UsageReadout = wire_decode(&wire_encode(&bare).unwrap()).unwrap();
         assert!(decoded.plan_quota.is_empty());
     }
 
     #[test]
     fn a_readout_of_another_schema_is_refused() {
         let mut other = readout();
-        other.schema_id = "gamecult.model.spend_readout.v2".into();
+        other.schema_id = "gamecult.model.usage_readout.v2".into();
         assert!(other.validate().is_err());
         assert!(readout().validate().is_ok());
     }
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index cd3663f..270fa1b 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -13,13 +13,12 @@ use zeroize::Zeroizing;
 use crate::contract::TransportResult;
 use crate::envelope::{
     RequestFrame, ServiceError, TransportFrameError, decode_request_frame, encode_result_frame,
-    encode_spend_readout_response_frame, frame_bytes_for_payload, read_transport_frame,
+    encode_usage_readout_response_frame, frame_bytes_for_payload, read_transport_frame,
     write_transport_frame,
 };
 use crate::readout::PlanQuotaSnapshot;
 use crate::service::{
-    CallerAdmission, PriceTable, ProviderCall, SpendCeiling, SpendWindowMs, TransportAdmission,
-    TransportService, distinct_admissions,
+    CallerAdmission, ProviderCall, TransportAdmission, TransportService, distinct_admissions,
 };
 
 /// The only provider seam of the connector kit. A connector binary implements
@@ -34,8 +33,9 @@ pub trait ProviderBackend: Send + Sync {
     /// `serve` on: it names the provider on every receipt and decides which
     /// reasoning state is foreign.
     fn provider(&self) -> &str;
-    /// What the provider's own plan allows and has used, for the spend
-    /// readout. A provider with no plan to report keeps the default.
+    /// What the provider's own plan allows and has used, for the usage
+    /// readout and the provider's own refusals. A provider with no plan to report
+    /// keeps the default.
     fn plan_quota(&self) -> PlanQuotaSnapshot {
         PlanQuotaSnapshot::default()
     }
@@ -123,12 +123,6 @@ pub struct CallerConfig {
     pub max_concurrent_requests: usize,
     pub max_payload_bytes: usize,
     pub max_output_tokens: u32,
-    /// The most the caller may spend in one window, in micro-USD. Required
-    /// nonzero. A fuse set once, generously above what the dial allows.
-    pub spend_ceiling_micro_usd: u64,
-    /// The length of the caller's spend window, in milliseconds. Windows are
-    /// fixed and aligned to the unix epoch. Required nonzero.
-    pub spend_window_ms: u64,
 }
 
 pub fn load_admissions(callers: &[CallerConfig]) -> Result<Vec<CallerAdmission>, ServeError> {
@@ -149,8 +143,6 @@ pub fn load_admissions(callers: &[CallerConfig]) -> Result<Vec<CallerAdmission>,
                 caller.max_concurrent_requests,
                 caller.max_payload_bytes,
                 caller.max_output_tokens,
-                SpendCeiling(caller.spend_ceiling_micro_usd),
-                SpendWindowMs(caller.spend_window_ms),
             )
             .map_err(ServeError::Service)?,
         );
@@ -159,15 +151,12 @@ pub fn load_admissions(callers: &[CallerConfig]) -> Result<Vec<CallerAdmission>,
 }
 
 /// Serves admitted callers on a loopback listener until the listener fails.
-/// `prices` is the connector binary's config document's table of what every
-/// allowed model costs (B4 owns that document).
 /// The caller binds; a listener that is not bound to loopback is refused, and
 /// peers that are not loopback are dropped.
 pub fn serve(
     listener: TcpListener,
     limits: ServeLimits,
     admissions: Vec<CallerAdmission>,
-    prices: PriceTable,
     replay_store: &Path,
     backend: Arc<dyn ProviderBackend>,
 ) -> Result<(), ServeError> {
@@ -176,7 +165,6 @@ pub fn serve(
     let service = Arc::new(Mutex::new(TransportService::open(
         replay_store,
         backend.provider(),
-        prices,
         admissions,
         limits.max_expiry_skew_ms,
     )?));
@@ -184,8 +172,8 @@ pub fn serve(
 }
 
 /// `serve` over a service the caller opened and keeps a handle to, so another
-/// front of the same ledger (the Self-run credential lease) reserves in the
-/// same windows. The limits must already have been validated against the
+/// front of the same service (the Self-run credential lease) shares its
+/// replay store and plan. The limits must already have been validated against the
 /// service's admissions.
 pub fn serve_service(
     listener: TcpListener,
@@ -197,7 +185,7 @@ pub fn serve_service(
     accept_loop(|| listener.accept(), limits, service, backend)
 }
 
-/// What must be true before a serve loop touches the ledger: the listener is
+/// What must be true before a serve loop touches the store: the listener is
 /// on loopback and the backend can take work.
 fn admit_listener(listener: &TcpListener, backend: &dyn ProviderBackend) -> Result<(), ServeError> {
     if !listener
@@ -272,20 +260,25 @@ fn answer_frame(
 ) -> Result<Vec<u8>, ServeError> {
     let envelope = match decode_request_frame(request).map_err(|_| ServeError::FrameEncoding)? {
         RequestFrame::Invoke(envelope) => envelope,
-        RequestFrame::SpendReadout(envelope) => {
+        RequestFrame::UsageReadout(envelope) => {
             let plan = backend.plan_quota();
             let response = service
                 .lock()
                 .map_err(|_| ServeError::ServicePoisoned)?
-                .spend_readout(&envelope, unix_ms()?, plan, limits.max_frame_bytes)?;
-            return encode_spend_readout_response_frame(&response)
+                .usage_readout(&envelope, unix_ms()?, plan, limits.max_frame_bytes)?;
+            return encode_usage_readout_response_frame(&response)
                 .map_err(|_| ServeError::FrameEncoding);
         }
     };
     let admission = service
         .lock()
         .map_err(|_| ServeError::ServicePoisoned)?
-        .begin(&envelope, unix_ms()?, limits.max_frame_bytes)?;
+        .begin(
+            &envelope,
+            unix_ms()?,
+            &backend.plan_quota(),
+            limits.max_frame_bytes,
+        )?;
     let response = match admission {
         TransportAdmission::Reply(response) => response,
         TransportAdmission::Execute(claim) => {
@@ -390,7 +383,7 @@ mod tests {
         TransportInvocation, TransportOutcome, TransportResult,
     };
     use crate::fixtures::{
-        CEILING, MAX_COST, TestStore, WINDOW_MS, caller, fixture_prices, invocation_for, receipt,
+        TestStore, caller, invocation_for, receipt,
         request,
     };
 
@@ -472,7 +465,6 @@ mod tests {
                 listener,
                 limits,
                 admissions,
-                fixture_prices(),
                 &path,
                 backend,
             ));
@@ -506,7 +498,6 @@ mod tests {
                 listener,
                 limits(),
                 admissions,
-                fixture_prices(),
                 &path,
                 backend,
             )
@@ -528,8 +519,6 @@ mod tests {
                 max_concurrent_requests: *capacity,
                 max_payload_bytes: 1_048_576,
                 max_output_tokens: 16_384,
-                spend_ceiling_micro_usd: CEILING,
-                spend_window_ms: WINDOW_MS,
             })
             .collect()
     }
@@ -559,7 +548,7 @@ mod tests {
     }
 
     #[test]
-    fn serve_reads_out_spend_and_plan_quota_without_executing_anything() {
+    fn serve_reads_out_plan_usage_without_executing_anything() {
         let store = TestStore::new();
         let inner = CountingBackend::new(true);
         let plan = PlanQuotaSnapshot {
@@ -580,16 +569,9 @@ mod tests {
         assert_eq!(inner.executions.load(Ordering::SeqCst), 1);
 
         let before = now_ms();
-        let readout = client.spend_readout(CALLER).unwrap();
+        let readout = client.usage_readout(CALLER).unwrap();
         assert!(readout.at_unix_ms >= before && readout.at_unix_ms <= now_ms());
         assert_eq!(readout.plan_quota, plan.windows);
-        let [row] = readout.callers.as_slice() else {
-            panic!("one admitted caller");
-        };
-        assert_eq!(row.caller_id, CALLER);
-        assert_eq!((row.ceiling_micro_usd, row.window_ms), (CEILING, WINDOW_MS));
-        assert!(row.spent_micro_usd > 0, "the settled call was charged");
-        assert_eq!(row.reserved_micro_usd, 0);
         assert_eq!(
             inner.executions.load(Ordering::SeqCst),
             1,
@@ -604,39 +586,62 @@ mod tests {
             Some(Duration::from_secs(5)),
         )
         .unwrap();
-        assert!(stranger.spend_readout(CALLER).is_err());
+        assert!(stranger.usage_readout(CALLER).is_err());
     }
 
     #[test]
     fn a_backend_with_no_plan_reads_out_none() {
         let store = TestStore::new();
         let (client, _) = start(CountingBackend::new(true), &store);
-        let readout = client.spend_readout(CALLER).unwrap();
+        let readout = client.usage_readout(CALLER).unwrap();
         assert!(readout.plan_quota.is_empty());
     }
 
+    fn window_plan(permille: u32, status: &str, resets_at_unix_ms: u64) -> PlanQuotaSnapshot {
+        PlanQuotaSnapshot {
+            windows: vec![crate::readout::PlanQuota {
+                window: "five_hour".into(),
+                utilization_permille: Some(permille),
+                resets_at_unix_ms,
+                status: status.into(),
+                observed_at_unix_ms: 1,
+            }],
+        }
+    }
+
     #[test]
-    fn serve_refuses_a_request_over_its_max_cost_without_executing_it() {
+    fn serve_repeats_the_providers_rejection_and_executes_nothing_while_it_stands() {
         let store = TestStore::new();
-        let backend = CountingBackend::new(true);
-        let (client, _) = start(backend.clone(), &store);
-        let mut invocation = fresh("request-costly");
-        invocation.max_cost_micro_usd = 1;
-        let refused = client.execute(&invocation).unwrap();
+        let inner = CountingBackend::new(true);
+        let backend = Arc::new(PlanBackend {
+            inner: inner.clone(),
+            plan: window_plan(1_000, "rejected", now_ms() + 3_600_000),
+        });
+        let (client, _) = start_with(backend, &store, vec![caller(CALLER, KEY, 4)]);
+        let refused = client.execute(&fresh("request-rejected")).unwrap();
         assert_eq!(
             refused.disposition,
-            TransportDisposition::Refused(Refusal::CostBound)
+            TransportDisposition::Refused(Refusal::ProviderRejected)
         );
-        assert_eq!(backend.executions.load(Ordering::SeqCst), 0);
+        assert_eq!(inner.executions.load(Ordering::SeqCst), 0);
+    }
 
-        // The refusal was not recorded: the same id with a budget that holds
-        // the worst case is admitted and executed.
-        invocation.max_cost_micro_usd = MAX_COST;
-        let admitted = client.execute(&invocation).unwrap();
+    #[test]
+    fn serve_admits_a_full_window_the_provider_still_allows() {
+        let store = TestStore::new();
+        let inner = CountingBackend::new(true);
+        let backend = Arc::new(PlanBackend {
+            inner: inner.clone(),
+            plan: window_plan(999, "allowed", now_ms() + 3_600_000),
+        });
+        let (client, _) = start_with(backend, &store, vec![caller(CALLER, KEY, 4)]);
+        let admitted = client.execute(&fresh("request-full")).unwrap();
         assert!(matches!(
             admitted.disposition,
             TransportDisposition::Transported { .. }
         ));
+        assert_eq!(inner.executions.load(Ordering::SeqCst), 1);
+    }
         assert_eq!(backend.executions.load(Ordering::SeqCst), 1);
     }
 
@@ -676,7 +681,6 @@ mod tests {
             CALLER,
             invocation.expires_at_unix_ms,
             [7; 32],
-            MAX_COST,
             conflicting_request,
         )
         .unwrap();
@@ -761,7 +765,6 @@ mod tests {
         let mut service = TransportService::open(
             &store.path,
             "fixture-sse",
-            fixture_prices(),
             vec![caller(CALLER, KEY, 4)],
             300_000,
         )
@@ -770,7 +773,9 @@ mod tests {
             crate::envelope::encrypt_invocation(&invocation, &crate::fixtures::security(KEY))
                 .unwrap();
         let TransportAdmission::Execute(claim) =
-            service.begin(&envelope, now_ms(), 1 << 20).unwrap()
+            service
+                .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
+                .unwrap()
         else {
             panic!("a fresh request must execute");
         };
@@ -793,7 +798,6 @@ mod tests {
                 listener,
                 narrowed,
                 vec![caller(CALLER, KEY, 4)],
-                fixture_prices(),
                 &path,
                 served,
             )
@@ -1001,8 +1005,6 @@ mod tests {
             slots,
             payload,
             32_768,
-            SpendCeiling(CEILING),
-            SpendWindowMs(WINDOW_MS),
         )
         .unwrap()
     }
@@ -1110,7 +1112,7 @@ mod tests {
             ..limits()
         };
         let admissions = vec![admission(CALLER, KEY, 4, bound)];
-        thread::spawn(move || serve(listener, tight, admissions, fixture_prices(), &path, served));
+        thread::spawn(move || serve(listener, tight, admissions, &path, served));
         let client =
             ConnectorClient::new(endpoint, KEY, frame, Some(Duration::from_secs(5))).unwrap();
         let reply = client.execute(&invocation).unwrap();
@@ -1225,7 +1227,6 @@ mod tests {
         let mut service = TransportService::open(
             &store.path,
             "fixture-sse",
-            fixture_prices(),
             vec![caller(CALLER, KEY, 4)],
             300_000,
         )
@@ -1236,7 +1237,9 @@ mod tests {
         )
         .unwrap();
         let TransportAdmission::Execute(claim) =
-            service.begin(&envelope, now_ms(), 1 << 20).unwrap()
+            service
+                .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
+                .unwrap()
         else {
             panic!("a fresh request must execute");
         };
@@ -1328,7 +1331,6 @@ mod tests {
                 TransportService::open(
                     &store.path,
                     "fixture-sse",
-                    fixture_prices(),
                     vec![caller(CALLER, KEY, 4)],
                     300_000,
                 )
@@ -1391,7 +1393,6 @@ mod tests {
                 listener,
                 limits(),
                 admissions,
-                fixture_prices(),
                 &path,
                 served,
             )
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index ea3dbeb..3e52dfb 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -1,4 +1,4 @@
-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
 use cultcache_rs::{CacheBackingStore, CultCache, DatabaseEntry, OwnedRedbMessagePackBackingStore};
@@ -7,45 +7,16 @@ use sha2::{Digest, Sha256};
 use zeroize::Zeroizing;
 
 use crate::contract::{
-    CacheRetention, ContractError, FailureKind, InputItem, ProviderRequest, RECEIPT_SCHEMA_ID,
-    RESULT_SCHEMA_ID, Refusal, TransportDisposition, TransportEvent, TransportInvocation,
-    TransportKey, TransportOutcome, TransportReceipt, TransportResult, Usage,
-    canonical_invocation_bytes, require_id, wire_encode,
+    ContractError, FailureKind, InputItem, ProviderRequest, RECEIPT_SCHEMA_ID, RESULT_SCHEMA_ID,
+    Refusal, TransportDisposition, TransportEvent, TransportInvocation, TransportKey,
+    TransportOutcome, TransportReceipt, TransportResult, canonical_invocation_bytes, require_id,
 };
 use crate::envelope::{
     EnvelopeKind, MAX_IDENTITY_BYTES, ServiceError, TransportEnvelope, decrypt_invocation,
-    decrypt_spend_readout_request, encode_result_frame, encode_spend_readout_response_frame,
-    encrypt_result, encrypt_spend_readout, validate_envelope,
+    decrypt_usage_readout_request, encode_result_frame, encode_usage_readout_response_frame,
+    encrypt_result, encrypt_usage_readout, validate_envelope,
 };
-use crate::readout::{CallerSpend, PlanQuotaSnapshot, SpendReadout};
-
-/// What a caller may spend in one window, in micro-USD. A distinct type from
-/// [`SpendWindowMs`] so the pair cannot be passed swapped:
-///
-/// ```
-/// use model_connector::{CallerAdmission, SpendCeiling, SpendWindowMs};
-/// CallerAdmission::new(
-///     "caller-1", "a-connection-key", 1, ["model-1".to_string()], 1, 1, 1,
-///     SpendCeiling(50_000_000), SpendWindowMs(3_600_000),
-/// )
-/// .unwrap();
-/// ```
-///
-/// ```compile_fail
-/// use model_connector::{CallerAdmission, SpendCeiling, SpendWindowMs};
-/// CallerAdmission::new(
-///     "caller-1", "a-connection-key", 1, ["model-1".to_string()], 1, 1, 1,
-///     SpendWindowMs(3_600_000), SpendCeiling(50_000_000),
-/// )
-/// .unwrap();
-/// ```
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct SpendCeiling(pub u64);
-
-/// How long a spend window lasts, in milliseconds. Windows are fixed and
-/// aligned to the unix epoch.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct SpendWindowMs(pub u64);
+use crate::readout::{PlanQuotaSnapshot, UsageReadout};
 
 /// The rule that admitted callers are distinct: no two share a connection key
 /// (a key names its caller), and no two share a caller id. `TransportService`
@@ -73,14 +44,9 @@ pub struct CallerAdmission {
     max_concurrent_requests: usize,
     max_payload_bytes: usize,
     max_output_tokens: u32,
-    spend_ceiling_micro_usd: u64,
-    spend_window_ms: u64,
 }
 
 impl CallerAdmission {
-    // The ceiling and window ride beside the other limits the root-owned caller
-    // config sets, one parameter each.
-    #[allow(clippy::too_many_arguments)]
     pub fn new(
         caller_runtime_id: impl Into<String>,
         connection_key: impl Into<String>,
@@ -89,10 +55,7 @@ impl CallerAdmission {
         max_concurrent_requests: usize,
         max_payload_bytes: usize,
         max_output_tokens: u32,
-        spend_ceiling: SpendCeiling,
-        spend_window: SpendWindowMs,
     ) -> Result<Self, ServiceError> {
-        let (spend_ceiling_micro_usd, spend_window_ms) = (spend_ceiling.0, spend_window.0);
         let caller_runtime_id = caller_runtime_id.into();
         require_id(&caller_runtime_id, "caller_runtime_id")?;
         let allowed_models = allowed_models.into_iter().collect::<HashSet<_>>();
@@ -105,8 +68,6 @@ impl CallerAdmission {
             || max_concurrent_requests == 0
             || max_payload_bytes == 0
             || max_output_tokens == 0
-            || spend_ceiling_micro_usd == 0
-            || spend_window_ms == 0
         {
             return Err(ServiceError::InvalidAdmission);
         }
@@ -120,8 +81,6 @@ impl CallerAdmission {
             max_concurrent_requests,
             max_payload_bytes,
             max_output_tokens,
-            spend_ceiling_micro_usd,
-            spend_window_ms,
         })
     }
 
@@ -138,206 +97,24 @@ impl CallerAdmission {
     }
 }
 
-/// What one million tokens of each class cost, in micro-USD.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Rates {
-    pub input: u64,
-    pub cache_write_short: u64,
-    pub cache_write_long: u64,
-    pub cache_read: u64,
-    pub output: u64,
+/// The status a window carries while the provider itself refuses.
+const REJECTED: &str = "rejected";
+
+/// Whether the provider is refusing right now: some window of `plan` is
+/// `rejected` and its own reset lies in the future. The one usage-derived
+/// refusal there is. It repeats the provider's word with the provider's
+/// expiry, and no utilization figure is ever compared to anything.
+pub(crate) fn provider_rejects(plan: &PlanQuotaSnapshot, now_unix_ms: u64) -> bool {
+    plan.windows
+        .iter()
+        .any(|window| window.status == REJECTED && window.resets_at_unix_ms > now_unix_ms)
 }
 
-/// The rates a prompt strictly above `above_prompt_tokens` is priced at.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LongContext {
-    pub above_prompt_tokens: u64,
-    pub rates: Rates,
-}
-
-/// One model's price. Explicit zero rates are admitted (a local model is
-/// free); a missing price is not. `overhead_tokens` is added to the byte
-/// bound of a request when its worst case is reserved.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ModelPrice {
-    pub rates: Rates,
-    pub long_context: Option<LongContext>,
-    pub overhead_tokens: u64,
-}
-
-/// The price of every model a caller may be allowed, supplied at open by the
-/// connector binary's config document.
-pub type PriceTable = BTreeMap<String, ModelPrice>;
-
-const TOKENS_PER_RATE: u128 = 1_000_000;
-
-/// Rounds up to whole micro-USD; `None` when the amount does not fit a u64.
-fn checked_ceil_micro_usd(rate_weighted_tokens: u128) -> Option<u64> {
-    let whole = rate_weighted_tokens / TOKENS_PER_RATE;
-    let rounded = whole + u128::from(!rate_weighted_tokens.is_multiple_of(TOKENS_PER_RATE));
-    u64::try_from(rounded).ok()
-}
-
-fn ceil_micro_usd(rate_weighted_tokens: u128) -> u64 {
-    checked_ceil_micro_usd(rate_weighted_tokens).unwrap_or(u64::MAX)
-}
-
-impl Rates {
-    /// The dearer of each class.
-    fn dearest(self, other: Rates) -> Rates {
-        Rates {
-            input: self.input.max(other.input),
-            cache_write_short: self.cache_write_short.max(other.cache_write_short),
-            cache_write_long: self.cache_write_long.max(other.cache_write_long),
-            cache_read: self.cache_read.max(other.cache_read),
-            output: self.output.max(other.output),
-        }
-    }
-}
-
-fn rates_for(price: &ModelPrice, prompt_tokens: u128) -> &Rates {
-    match &price.long_context {
-        Some(long) if prompt_tokens > u128::from(long.above_prompt_tokens) => &long.rates,
-        _ => &price.rates,
-    }
-}
-
-/// A cache write nobody asked to keep short is priced dear.
-fn write_rate(rates: &Rates, retention: Option<CacheRetention>) -> u64 {
-    match retention {
-        Some(CacheRetention::Short) => rates.cache_write_short,
-        Some(CacheRetention::Long) | None => rates.cache_write_long,
-    }
-}
-
-/// What `usage` costs under `price`, in micro-USD: the sum over token classes
-/// of tokens times rate, rounded up once, saturating at `u64::MAX`.
-pub(crate) fn cost_micro_usd(
-    price: &ModelPrice,
-    usage: &Usage,
-    retention: Option<CacheRetention>,
-) -> u64 {
-    let prompt = u128::from(usage.input_tokens)
-        + u128::from(usage.cache_read_tokens)
-        + u128::from(usage.cache_write_tokens);
-    let rates = rates_for(price, prompt);
-    let total = [
-        u128::from(usage.input_tokens) * u128::from(rates.input),
-        u128::from(usage.cache_read_tokens) * u128::from(rates.cache_read),
-        u128::from(usage.cache_write_tokens) * u128::from(write_rate(rates, retention)),
-        u128::from(usage.output_tokens) * u128::from(rates.output),
-    ]
-    .into_iter()
-    .fold(0u128, u128::saturating_add);
-    ceil_micro_usd(total)
-}
-
-/// The worst case `request` can cost, in micro-USD: its encoded length plus
-/// the model's overhead as input tokens (a token is at least one byte) at the
-/// dearest input rate the cache retention allows, plus `max_output_tokens` at
-/// the output rate, rounded up once. A prompt that may cross the long-context
-/// threshold is bounded at the dearer of the two rate sets, so a backend whose
-/// usage prices above this broke its contract. `None` when the worst case does
-/// not fit a u64: such a request can never be afforded.
-pub(crate) fn reservation_micro_usd(
-    price: &ModelPrice,
-    request: &ProviderRequest,
-) -> Result<Option<u64>, ContractError> {
-    let bound = (wire_encode(request)?.len() as u128) + u128::from(price.overhead_tokens);
-    let rates = match &price.long_context {
-        Some(long) if bound > u128::from(long.above_prompt_tokens) => {
-            price.rates.dearest(long.rates)
-        }
-        _ => price.rates,
-    };
-    let input_rate = rates
-        .input
-        .max(rates.cache_read)
-        .max(write_rate(&rates, request.cache_retention));
-    let total = bound.checked_mul(u128::from(input_rate)).and_then(|input| {
-        input.checked_add(u128::from(request.max_output_tokens) * u128::from(rates.output))
-    });
-    Ok(total.and_then(checked_ceil_micro_usd))
-}
-
-/// Moves `held` of a caller's window: releases `release`, then adds `charge`.
-fn add_spend(
-    window_spend: &mut HashMap<String, BTreeMap<u64, u64>>,
-    caller_runtime_id: &str,
-    window: u64,
-    release: u64,
-    charge: u64,
-) {
-    let held = window_spend
-        .entry(caller_runtime_id.to_string())
-        .or_default()
-        .entry(window)
-        .or_insert(0);
-    *held = held.saturating_sub(release).saturating_add(charge);
-}
-
-/// The clock a request is admitted at: `now`, held monotonic per caller. A
-/// caller's window never moves back, so a clock that steps back (or a boot
-/// with the clock behind a recorded window) cannot reopen spent budget: the
-/// request is admitted into the caller's newest recorded window. The record
-/// stores this value, so the window re-derives from the records at open.
-fn admission_clock(
-    window_spend: &HashMap<String, BTreeMap<u64, u64>>,
-    caller_runtime_id: &str,
-    now_unix_ms: u64,
-    spend_window_ms: u64,
-) -> u64 {
-    let newest = window_spend
-        .get(caller_runtime_id)
-        .and_then(|windows| windows.keys().next_back().copied())
-        .unwrap_or(0);
-    now_unix_ms.max(newest.saturating_mul(spend_window_ms))
-}
-
-/// Drops the windows of `caller_runtime_id` that nothing can still read:
-/// those before `floor` that hold no live request's reservation. Admission
-/// reads the current window alone, and a live request settles into the window
-/// it was admitted in, so nothing older is kept.
-fn prune_windows(
-    window_spend: &mut HashMap<String, BTreeMap<u64, u64>>,
-    live: &HashMap<RequestIdentity, LiveRequest>,
-    caller_runtime_id: &str,
-    floor: u64,
-) {
-    if let Some(windows) = window_spend.get_mut(caller_runtime_id) {
-        windows.retain(|window, _| {
-            *window >= floor
-                || live.iter().any(|(identity, request)| {
-                    request.window == *window && identity.caller_runtime_id == caller_runtime_id
-                })
-        });
-    }
-}
-
-/// `prune_windows` with the caller's newest window as the floor, for the
-/// places that do not know the clock (open, settle).
-fn prune_to_latest(
-    window_spend: &mut HashMap<String, BTreeMap<u64, u64>>,
-    live: &HashMap<RequestIdentity, LiveRequest>,
-    caller_runtime_id: &str,
-) {
-    let latest = window_spend
-        .get(caller_runtime_id)
-        .and_then(|windows| windows.keys().next_back().copied());
-    if let Some(latest) = latest {
-        prune_windows(window_spend, live, caller_runtime_id, latest);
-    }
-}
-
-/// A request between claim and settlement: the window it was admitted in and
-/// the reservation it holds there.
+/// A Self run's or Persona turn's credential lease while its holder keeps it.
 #[derive(Debug, Clone, Copy)]
-struct LiveRequest {
-    window: u64,
-    reserved_micro_usd: u64,
-    /// A Self run's credential lease, not a provider call: it holds its
-    /// reservation in the window like a call does but takes no request slot.
-    lease: Option<LeaseTurn>,
+struct LiveLease {
+    turn: LeaseTurn,
+    expires_at_unix_ms: u64,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -348,27 +125,17 @@ struct RequestIdentity {
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 enum ReplayState {
-    /// Admitted and possibly executing: the worst case is held against the
-    /// caller's window until the request settles (an indeterminate one is
-    /// billed at it).
-    Active { reserved_micro_usd: u64 },
-    /// `overrun_micro_usd` is what the charge exceeded the reservation by: a
-    /// backend contract breach, kept so a replayed stand-in still says so.
+    /// Admitted and possibly executing.
+    Active,
     Completed {
         response: TransportEnvelope,
-        charged_micro_usd: u64,
-        overrun_micro_usd: u64,
-    },
-    /// A credential lease that settled: it has no answer to replay, only the
-    /// charge it left in its window and how far that passed the reservation.
-    LeaseSettled {
-        charged_micro_usd: u64,
-        overrun_micro_usd: u64,
     },
 }
 
+/// Idempotency only: what was asked and what was answered. Nothing here is a
+/// charge.
 #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-#[cultcache(type = "gamecult.model.replay_record.v2")]
+#[cultcache(type = "gamecult.model.replay_record.v3")]
 struct ReplayRecord {
     #[cultcache(key = 0)]
     caller_runtime_id: String,
@@ -382,8 +149,6 @@ struct ReplayRecord {
     expires_at_unix_ms: u64,
     #[cultcache(key = 5)]
     state: ReplayState,
-    #[cultcache(key = 6)]
-    admitted_at_unix_ms: u64,
 }
 
 /// What a backend is handed: the request with every foreign reasoning item
@@ -395,8 +160,6 @@ struct ReplayRecord {
 pub struct ProviderCall {
     request: ProviderRequest,
     receipt: TransportReceipt,
-    price: ModelPrice,
-    reserved_micro_usd: u64,
 }
 
 impl ProviderCall {
@@ -418,69 +181,20 @@ impl ProviderCall {
     }
 
     /// The result of this call. The whole receipt (schema, ids, both digests,
-    /// model, provider tag, drop count and cost) is derived here, so a backend
+    /// model, provider tag and drop count) is derived here, so a backend
     /// writes only the events and the outcome.
     pub fn transported(
         &self,
         events: Vec<TransportEvent>,
         outcome: TransportOutcome,
     ) -> TransportResult {
-        TransportResult::transported(events, {
-            let cost_micro_usd = self.cost_of(&outcome);
+        TransportResult::transported(
+            events,
             TransportReceipt {
-                cost_micro_usd,
-                overrun_micro_usd: self.overrun_of(cost_micro_usd),
                 outcome,
                 ..self.receipt.clone()
-            }
-        })
-    }
-
-    /// What a completed `result` is billed: the one owner of the charge
-    /// decision. A transported result bound to `invocation` by request id and
-    /// caller (on the result and on its receipt) costs what its own outcome's
-    /// usage derives, with the overrun past the reservation recorded
-    /// truthfully, whether or not it is otherwise malformed. Any other result
-    /// (refused, or bound to another request or caller) costs the whole
-    /// reservation. Validity decides what the caller is told, never this.
-    fn charge(&self, invocation: &TransportInvocation, result: &TransportResult) -> Charge {
-        match &result.disposition {
-            TransportDisposition::Transported { receipt, .. }
-                if result.request_id == invocation.request_id()
-                    && result.caller_runtime_id == invocation.caller_runtime_id
-                    && receipt.request_id == invocation.request_id()
-                    && receipt.caller_runtime_id == invocation.caller_runtime_id =>
-            {
-                let cost_micro_usd = self.cost_of(&receipt.outcome);
-                Charge {
-                    cost_micro_usd,
-                    overrun_micro_usd: self.overrun_of(cost_micro_usd),
-                }
-            }
-            _ => Charge {
-                cost_micro_usd: self.reserved_micro_usd,
-                overrun_micro_usd: 0,
             },
-        }
-    }
-
-    /// How far `cost_micro_usd` exceeds what was reserved. The reservation is
-    /// the worst case the kit can compute, so a nonzero overrun means the
-    /// backend broke its contract (usage above its own request's bounds).
-    fn overrun_of(&self, cost_micro_usd: u64) -> u64 {
-        cost_micro_usd.saturating_sub(self.reserved_micro_usd)
-    }
-
-    /// What `outcome` costs: its usage priced, or the whole reservation when a
-    /// failure does not say what it billed (unknown is billed as the worst case).
-    fn cost_of(&self, outcome: &TransportOutcome) -> u64 {
-        match outcome {
-            TransportOutcome::Completed { usage, .. }
-            | TransportOutcome::Failed {
-                usage: Some(usage), ..
-            } => cost_micro_usd(&self.price, usage, self.request.cache_retention),
-            TransportOutcome::Failed { usage: None, .. } => self.reserved_micro_usd,
-        }
+        )
     }
 }
 
@@ -505,39 +219,30 @@ pub enum TransportAdmission {
 
 pub struct TransportService {
     callers: HashMap<String, CallerAdmission>,
-    /// The requests between claim and settlement, each with the window it was
-    /// admitted in.
-    live: HashMap<RequestIdentity, LiveRequest>,
+    /// The requests between claim and completion.
+    live: HashSet<RequestIdentity>,
+    /// The credential leases their holders keep, in memory only: a lease
+    /// decides `Busy` and nothing else, and ends when its holder lets go or
+    /// its expiry passes.
+    leases: HashMap<RequestIdentity, LiveLease>,
     replay_store: CultCache,
     max_expiry_skew_ms: u64,
     provider: String,
-    prices: PriceTable,
-    /// Per caller, what each spend window holds: the reservations of its
-    /// Active records and the charges of its Completed ones. A cache of the
-    /// replay records, re-derived at open and moved only after a record's put
-    /// returns Ok; the records are the ledger. A request belongs to the window
-    /// it was admitted in, so settlement never moves it to another. Only what
-    /// admission and settlement can still read is kept: the caller's newest
-    /// window and any older one a live request is reserved in.
-    window_spend: HashMap<String, BTreeMap<u64, u64>>,
 }
 
 impl TransportService {
     /// `provider` is the tag of the backend this service fronts. The service
     /// owns it from here on: it decides which reasoning state is foreign and
-    /// what provider every receipt names. `prices` must price every model any
-    /// caller is allowed.
+    /// what provider every receipt names.
     pub fn open(
         replay_store_path: &Path,
         provider: &str,
-        prices: PriceTable,
         admissions: impl IntoIterator<Item = CallerAdmission>,
         max_expiry_skew_ms: u64,
     ) -> Result<Self, ServiceError> {
         Self::with_store(
             OwnedRedbMessagePackBackingStore::new(replay_store_path).map_err(replay_store_error)?,
             provider,
-            prices,
             admissions,
             max_expiry_skew_ms,
         )
@@ -547,7 +252,6 @@ impl TransportService {
     pub fn with_store(
         store: impl CacheBackingStore + 'static,
         provider: &str,
-        prices: PriceTable,
         admissions: impl IntoIterator<Item = CallerAdmission>,
         max_expiry_skew_ms: u64,
     ) -> Result<Self, ServiceError> {
@@ -566,14 +270,6 @@ impl TransportService {
         if callers.is_empty() {
             return Err(ServiceError::InvalidAdmission);
         }
-        if let Some(model) = callers
-            .values()
-            .flat_map(|caller| caller.allowed_models.iter())
-            .filter(|model| !prices.contains_key(*model))
-            .min()
-        {
-            return Err(ServiceError::UnpricedModel(model.clone()));
-        }
 
         let mut replay_store = CultCache::new();
         replay_store
@@ -582,11 +278,12 @@ impl TransportService {
         replay_store
             .add_generic_backing_store(store)
             .map_err(replay_store_error)?;
+        // A record of any other type id (the dollar era's v2 included) has no
+        // registered schema, so the pull fails and the store is refused.
         replay_store
             .pull_all_backing_stores()
             .map_err(replay_store_error)?;
 
-        let mut window_spend: HashMap<String, BTreeMap<u64, u64>> = HashMap::new();
         for (key, record) in replay_store
             .get_all_with_keys::<ReplayRecord>()
             .map_err(replay_store_error)?
@@ -598,7 +295,6 @@ impl TransportService {
             if key != replay_key(&identity)
                 || record.invocation_sha256 == [0; 32]
                 || record.expires_at_unix_ms == 0
-                || record.admitted_at_unix_ms == 0
             {
                 return Err(ServiceError::InvalidReplayRecord);
             }
@@ -608,103 +304,36 @@ impl TransportService {
             if record.connection_key_epoch != caller.connection_key_epoch {
                 return Err(ServiceError::ReplayCallerKeyMismatch);
             }
-            // An Active record left by a crash counts at its full reservation:
-            // indeterminate is billed as the worst case.
-            let held = match &record.state {
-                ReplayState::Active { reserved_micro_usd } => *reserved_micro_usd,
-                ReplayState::Completed {
-                    charged_micro_usd, ..
-                }
-                | ReplayState::LeaseSettled {
-                    charged_micro_usd, ..
-                } => *charged_micro_usd,
-            };
-            add_spend(
-                &mut window_spend,
-                &record.caller_runtime_id,
-                record.admitted_at_unix_ms / caller.spend_window_ms,
-                0,
-                held,
-            );
-        }
-        let live = HashMap::new();
-        let spenders: Vec<String> = window_spend.keys().cloned().collect();
-        for caller_runtime_id in &spenders {
-            prune_to_latest(&mut window_spend, &live, caller_runtime_id);
         }
         Ok(Self {
             callers,
-            live,
+            live: HashSet::new(),
+            leases: HashMap::new(),
             replay_store,
             max_expiry_skew_ms,
             provider: provider.to_string(),
-            prices,
-            window_spend,
         })
     }
 
-    /// What `caller_runtime_id`'s spend window `window` holds.
-    pub(crate) fn window_spend(&self, caller_runtime_id: &str, window: u64) -> u64 {
-        self.window_spend
-            .get(caller_runtime_id)
-            .and_then(|windows| windows.get(&window))
-            .copied()
-            .unwrap_or(0)
-    }
-
-    /// Answers one sealed spend readout request: for each admitted caller, what
-    /// its current window holds against its ceiling, with the backend's plan
-    /// quota beside it. Read-only: nothing is reserved, recorded or pruned.
-    /// Any admitted caller reads every caller's row; the spend is the
-    /// operator's and the callers are all hers. `max_frame_bytes` bounds the
-    /// reply like it bounds `complete`'s.
-    pub fn spend_readout(
+    /// Answers one sealed usage readout request with the backend's plan quota
+    /// as it stands. Read-only: nothing is recorded. Any admitted caller reads
+    /// it; the usage is the operator's and the callers are all hers.
+    /// `max_frame_bytes` bounds the reply like it bounds `complete`'s.
+    pub fn usage_readout(
         &self,
         envelope: &TransportEnvelope,
         now_unix_ms: u64,
         plan: PlanQuotaSnapshot,
         max_frame_bytes: usize,
     ) -> Result<TransportEnvelope, ServiceError> {
-        validate_envelope(envelope, EnvelopeKind::SpendReadoutRequest)?;
+        validate_envelope(envelope, EnvelopeKind::UsageReadoutRequest)?;
         let asker = self
             .callers
             .get(&envelope.caller_runtime_id)
             .ok_or(ServiceError::CallerNotAdmitted)?;
-        decrypt_spend_readout_request(envelope, &asker.security)?;
-        let mut callers: Vec<CallerSpend> = self
-            .callers
-            .values()
-            .map(|caller| {
-                // The window admission would use right now.
-                let window = admission_clock(
-                    &self.window_spend,
-                    &caller.caller_runtime_id,
-                    now_unix_ms,
-                    caller.spend_window_ms,
-                ) / caller.spend_window_ms;
-                let held = self.window_spend(&caller.caller_runtime_id, window);
-                let reserved: u64 = self
-                    .live
-                    .iter()
-                    .filter(|(identity, request)| {
-                        request.window == window
-                            && identity.caller_runtime_id == caller.caller_runtime_id
-                    })
-                    .fold(0, |sum, (_, request)| {
-                        sum.saturating_add(request.reserved_micro_usd)
-                    });
-                CallerSpend {
-                    caller_id: caller.caller_runtime_id.clone(),
-                    window_ms: caller.spend_window_ms,
-                    ceiling_micro_usd: caller.spend_ceiling_micro_usd,
-                    spent_micro_usd: held.saturating_sub(reserved),
-                    reserved_micro_usd: reserved,
-                }
-            })
-            .collect();
-        callers.sort_by(|a, b| a.caller_id.cmp(&b.caller_id));
-        let readout = SpendReadout::new(now_unix_ms, callers, plan);
-        let sealed = encrypt_spend_readout(
+        decrypt_usage_readout_request(envelope, &asker.security)?;
+        let readout = UsageReadout::new(now_unix_ms, plan);
+        let sealed = encrypt_usage_readout(
             &envelope.caller_runtime_id,
             &envelope.request_id,
             &readout,
@@ -716,7 +345,9 @@ impl TransportService {
         Ok(sealed)
     }
 
-    /// Admits one request. `max_frame_bytes` is the frame every reply must
+    /// Admits one request. `plan` is the backend's plan quota as it stands: a
+    /// provider that is refusing right now is repeated as `ProviderRejected`
+    /// for new work. `max_frame_bytes` is the frame every reply must
     /// fit, the same bound `complete` is given: a recorded result that no
     /// longer fits it (the service reopened at a smaller frame) is answered
     /// with the typed `result_size` failure, which is recorded in its place.
@@ -727,6 +358,7 @@ impl TransportService {
         &mut self,
         envelope: &TransportEnvelope,
         now_unix_ms: u64,
+        plan: &PlanQuotaSnapshot,
         max_frame_bytes: usize,
     ) -> Result<TransportAdmission, ServiceError> {
         validate_envelope(envelope, EnvelopeKind::Invocation)?;
@@ -737,8 +369,6 @@ impl TransportService {
         let security = caller.security.clone();
         let max_concurrent_requests = caller.max_concurrent_requests;
         let connection_key_epoch = caller.connection_key_epoch;
-        let spend_ceiling = caller.spend_ceiling_micro_usd;
-        let spend_window_ms = caller.spend_window_ms;
         let invocation = decrypt_invocation(envelope, &security)?;
         if envelope.request_id.len() > MAX_IDENTITY_BYTES {
             let refusal = encrypt_result(
@@ -783,25 +413,15 @@ impl TransportService {
                 return self.reply_refusal(&invocation, Refusal::ReplayConflict, &security);
             }
             return match &record.state {
-                ReplayState::Completed {
-                    response,
-                    charged_micro_usd,
-                    overrun_micro_usd,
-                } => {
+                ReplayState::Completed { response } => {
                     if fits_frame(response, max_frame_bytes)? {
                         return Ok(TransportAdmission::Reply(response.clone()));
                     }
-                    // The stand-in keeps the recorded charge: the request cost
-                    // what it cost whatever frame its answer travels in.
                     let stand_in = self.seal_stand_in(
                         &invocation,
                         &security,
                         max_frame_bytes,
                         FailureKind::ResultSize,
-                        Charge {
-                            cost_micro_usd: *charged_micro_usd,
-                            overrun_micro_usd: *overrun_micro_usd,
-                        },
                     )?;
                     self.replay_store
                         .put(
@@ -809,8 +429,6 @@ impl TransportService {
                             &ReplayRecord {
                                 state: ReplayState::Completed {
                                     response: stand_in.clone(),
-                                    charged_micro_usd: *charged_micro_usd,
-                                    overrun_micro_usd: *overrun_micro_usd,
                                 },
                                 ..record.clone()
                             },
@@ -818,11 +436,8 @@ impl TransportService {
                         .map_err(replay_store_error)?;
                     Ok(TransportAdmission::Reply(stand_in))
                 }
-                ReplayState::LeaseSettled { .. } => {
-                    self.reply_refusal(&invocation, Refusal::ReplayConflict, &security)
-                }
-                ReplayState::Active { .. } => {
-                    let refusal = if self.live.contains_key(&identity) {
+                ReplayState::Active => {
+                    let refusal = if self.live.contains(&identity) {
                         Refusal::InFlight
                     } else {
                         Refusal::Indeterminate
@@ -831,87 +446,35 @@ impl TransportService {
                 }
             };
         }
-        // The worst case is priced at today's table, so it is checked only for
-        // new work: a request already recorded is answered whatever it would
-        // cost now.
-        let price = *self
-            .prices
-            .get(&invocation.request.model)
-            .ok_or_else(|| ServiceError::UnpricedModel(invocation.request.model.clone()))?;
-        let reserved_micro_usd = match reservation_micro_usd(&price, &request)? {
-            Some(reserved) if reserved <= invocation.max_cost_micro_usd => reserved,
-            _ => return self.reply_refusal(&invocation, Refusal::CostBound, &security),
-        };
-        let active_for_caller = self
+        // The provider's own refusal binds new work only: a request already
+        // recorded is answered whatever the provider says now.
+        if provider_rejects(plan, now_unix_ms) {
+            return self.reply_refusal(&invocation, Refusal::ProviderRejected, &security);
+        }
+        if self
             .live
             .iter()
-            .filter(|(key, request)| {
-                request.lease.is_none() && key.caller_runtime_id == invocation.caller_runtime_id
-            })
-            .count();
-        if active_for_caller >= max_concurrent_requests {
+            .filter(|key| key.caller_runtime_id == invocation.caller_runtime_id)
+            .count()
+            >= max_concurrent_requests
+        {
             return self.reply_refusal(&invocation, Refusal::Capacity, &security);
         }
-        // A request belongs to the window it is admitted in. The ceiling is
-        // checked after the replay lookup, so a recorded answer is replayed
-        // whatever the caller has left.
-        let admitted_at_unix_ms = admission_clock(
-            &self.window_spend,
-            &identity.caller_runtime_id,
-            now_unix_ms,
-            spend_window_ms,
-        );
-        let window = admitted_at_unix_ms / spend_window_ms;
-        prune_windows(
-            &mut self.window_spend,
-            &self.live,
-            &identity.caller_runtime_id,
-            window,
-        );
-        if self
-            .window_spend(&identity.caller_runtime_id, window)
-            .saturating_add(reserved_micro_usd)
-            > spend_ceiling
-        {
-            // A clock reading behind the caller's newest window is named: the
-            // refusal holds until the clock reaches that window's start.
-            let refusal = if now_unix_ms < window.saturating_mul(spend_window_ms) {
-                Refusal::ClockBehindAdmissionWindow
-            } else {
-                Refusal::SpendCeiling
-            };
-            return self.reply_refusal(&invocation, refusal, &security);
-        }
 
-        // Reserving and claiming the request are one write: a ledger that
-        // cannot be written means nothing runs.
+        // Claiming the request is one write: a store that cannot be written
+        // means nothing runs.
         let replay_record = ReplayRecord {
             caller_runtime_id: identity.caller_runtime_id.clone(),
             request_id: identity.request_id.clone(),
             connection_key_epoch,
             invocation_sha256,
             expires_at_unix_ms: invocation.expires_at_unix_ms,
-            state: ReplayState::Active { reserved_micro_usd },
-            admitted_at_unix_ms,
+            state: ReplayState::Active,
         };
         self.replay_store
             .put(replay_key(&identity), &replay_record)
             .map_err(replay_store_error)?;
-        add_spend(
-            &mut self.window_spend,
-            &identity.caller_runtime_id,
-            window,
-            0,
-            reserved_micro_usd,
-        );
-        self.live.insert(
-            identity,
-            LiveRequest {
-                window,
-                reserved_micro_usd,
-                lease: None,
-            },
-        );
+        self.live.insert(identity);
         Ok(TransportAdmission::Execute(Box::new(ExecutionClaim {
             call: ProviderCall {
                 receipt: TransportReceipt {
@@ -924,8 +487,6 @@ impl TransportService {
                     provider: self.provider.clone(),
                     foreign_reasoning_dropped,
                     // Replaced by the backend's outcome in `transported`.
-                    cost_micro_usd: 0,
-                    overrun_micro_usd: 0,
                     outcome: TransportOutcome::Failed {
                         kind: FailureKind::Provider,
                         message: String::new(),
@@ -933,8 +494,6 @@ impl TransportService {
                     },
                 },
                 request,
-                price,
-                reserved_micro_usd,
             },
             invocation,
             invocation_sha256,
@@ -957,7 +516,7 @@ impl TransportService {
             caller_runtime_id: invocation.caller_runtime_id.clone(),
             request_id: invocation.request_id().to_string(),
         };
-        if !self.live.contains_key(&identity) {
+        if !self.live.contains(&identity) {
             return Err(ServiceError::NoActiveRequest);
         }
         let active = self
@@ -965,10 +524,8 @@ impl TransportService {
             .get::<ReplayRecord>(&replay_key(&identity))
             .map_err(replay_store_error)?
             .ok_or(ServiceError::NoActiveRequest)?;
-        let ReplayState::Active { reserved_micro_usd } = active.state else {
-            return Err(ServiceError::ActiveRequestMismatch);
-        };
-        if active.invocation_sha256 != claim.invocation_sha256 {
+        if active.state != ReplayState::Active || active.invocation_sha256 != claim.invocation_sha256
+        {
             return Err(ServiceError::ActiveRequestMismatch);
         }
         let caller = self
@@ -977,47 +534,42 @@ impl TransportService {
             .ok_or(ServiceError::CallerNotAdmitted)?;
         let security = caller.security.clone();
         let connection_key_epoch = caller.connection_key_epoch;
-        let spend_window_ms = caller.spend_window_ms;
         // A result the service refuses (not a transported result, not bound to
         // this invocation, or carrying a provider tag or drop count the call
         // did not derive) is answered like an oversized one: a typed failure
         // is recorded and the slot released, so the caller gets an answer and
         // a retry replays it.
-        let admissible = self.admits_result(&result, &claim);
-        let charge = claim.call.charge(invocation, &result);
-        let charged_micro_usd = charge.cost_micro_usd;
-        let mut response = if admissible {
-            encrypt_result(&result, &security).inspect_err(|_| {
+        let response = if self.admits_result(&result, &claim) {
+            let sealed = encrypt_result(&result, &security).inspect_err(|_| {
                 self.live.remove(&identity);
-            })?
+            })?;
+            if fits_frame(&sealed, max_frame_bytes)? {
+                sealed
+            } else {
+                // Nothing is recorded when even the stand-in cannot be
+                // carried, but the caller's slot is not held by a request
+                // that can no longer finish.
+                self.seal_stand_in(
+                    invocation,
+                    &security,
+                    max_frame_bytes,
+                    FailureKind::ResultSize,
+                )
+                .inspect_err(|_| {
+                    self.live.remove(&identity);
+                })?
+            }
         } else {
             self.seal_stand_in(
                 invocation,
                 &security,
                 max_frame_bytes,
                 FailureKind::Provider,
-                charge,
             )
             .inspect_err(|_| {
                 self.live.remove(&identity);
             })?
         };
-        if admissible && !fits_frame(&response, max_frame_bytes)? {
-            // Nothing is recorded when even the stand-in cannot be carried,
-            // but the caller's slot is not held by a request that can no
-            // longer finish.
-            response = self
-                .seal_stand_in(
-                    invocation,
-                    &security,
-                    max_frame_bytes,
-                    FailureKind::ResultSize,
-                    charge,
-                )
-                .inspect_err(|_| {
-                    self.live.remove(&identity);
-                })?;
-        }
         let replay_record = ReplayRecord {
             caller_runtime_id: identity.caller_runtime_id.clone(),
             request_id: identity.request_id.clone(),
@@ -1026,36 +578,18 @@ impl TransportService {
             expires_at_unix_ms: invocation.expires_at_unix_ms,
             state: ReplayState::Completed {
                 response: response.clone(),
-                charged_micro_usd,
-                overrun_micro_usd: charge.overrun_micro_usd,
             },
-            admitted_at_unix_ms: active.admitted_at_unix_ms,
         };
-        // A failed settle write frees the caller's slot and answers the typed
-        // store failure; the Active record stays, so the reservation stays
-        // counted and a retry is told the request is indeterminate.
+        // A failed write frees the caller's slot and answers the typed store
+        // failure; the Active record stays, so a retry is told the request is
+        // indeterminate.
         self.replay_store
             .put(replay_key(&identity), &replay_record)
             .map_err(replay_store_error)
             .inspect_err(|_| {
                 self.live.remove(&identity);
             })?;
-        // Settled: the window the request was admitted in holds the charge in
-        // place of the reservation. A failed put above leaves the reservation
-        // counted, as the store does.
-        add_spend(
-            &mut self.window_spend,
-            &identity.caller_runtime_id,
-            active.admitted_at_unix_ms / spend_window_ms,
-            reserved_micro_usd,
-            charged_micro_usd,
-        );
         self.live.remove(&identity);
-        prune_to_latest(
-            &mut self.window_spend,
-            &self.live,
-            &identity.caller_runtime_id,
-        );
         Ok(response)
     }
 
@@ -1066,7 +600,6 @@ impl TransportService {
         security: &TransportKey,
         max_frame_bytes: usize,
         kind: FailureKind,
-        charge: Charge,
     ) -> Result<TransportEnvelope, ServiceError> {
         let (_, foreign_reasoning_dropped) =
             partition_reasoning(&invocation.request, &self.provider)
@@ -1080,7 +613,6 @@ impl TransportService {
                 invocation.provider_request_sha256,
                 foreign_reasoning_dropped,
                 kind,
-                charge,
             ),
             security,
         )?;
@@ -1092,8 +624,8 @@ impl TransportService {
     }
 
     /// Whether `result` is the answer to this claim's call: transported,
-    /// bound to the caller's invocation, and carrying the provider tag, drop
-    /// count and cost the service derived.
+    /// bound to the caller's invocation, and carrying the provider tag and
+    /// drop count the service derived.
     fn admits_result(&self, result: &TransportResult, claim: &ExecutionClaim) -> bool {
         let TransportDisposition::Transported { receipt, .. } = &result.disposition else {
             return false;
@@ -1101,8 +633,6 @@ impl TransportService {
         result.validate_against(&claim.invocation).is_ok()
             && receipt.provider == self.provider
             && receipt.foreign_reasoning_dropped == claim.call.receipt.foreign_reasoning_dropped
-            && receipt.cost_micro_usd == claim.call.cost_of(&receipt.outcome)
-            && receipt.overrun_micro_usd == claim.call.overrun_of(receipt.cost_micro_usd)
     }
 
     fn reply_refusal(
@@ -1122,12 +652,12 @@ fn fits_frame(envelope: &TransportEnvelope, max_frame_bytes: usize) -> Result<bo
     encode_result_frame(envelope).map(|bytes| bytes.len() <= max_frame_bytes)
 }
 
-/// `fits_frame` for the frame a spend readout answer travels in.
+/// `fits_frame` for the frame a usage readout answer travels in.
 fn readout_fits_frame(
     envelope: &TransportEnvelope,
     max_frame_bytes: usize,
 ) -> Result<bool, ServiceError> {
-    encode_spend_readout_response_frame(envelope).map(|bytes| bytes.len() <= max_frame_bytes)
+    encode_usage_readout_response_frame(envelope).map(|bytes| bytes.len() <= max_frame_bytes)
 }
 
 /// The provider named on the stand-in failure, fixed so its size is bounded.
@@ -1144,12 +674,7 @@ pub(crate) fn result_size_failure(
     native_request_sha256: [u8; 32],
     provider_request_sha256: [u8; 32],
     foreign_reasoning_dropped: u32,
-    cost_micro_usd: u64,
 ) -> TransportResult {
-    let charge = Charge {
-        cost_micro_usd,
-        overrun_micro_usd: 0,
-    };
     stand_in_failure(
         caller_runtime_id,
         request_id,
@@ -1158,21 +683,11 @@ pub(crate) fn result_size_failure(
         provider_request_sha256,
         foreign_reasoning_dropped,
         FailureKind::ResultSize,
-        charge,
     )
 }
 
-/// What a request cost, and by how much that exceeded its reservation.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-struct Charge {
-    cost_micro_usd: u64,
-    overrun_micro_usd: u64,
-}
-
 /// The stand-in failure for `kind`: `ResultSize` for a result that cannot be
 /// carried, `Provider` for one the service refused.
-// One argument per fact the stand-in repeats from the invocation it answers.
-#[allow(clippy::too_many_arguments)]
 fn stand_in_failure(
     caller_runtime_id: &str,
     request_id: &str,
@@ -1181,7 +696,6 @@ fn stand_in_failure(
     provider_request_sha256: [u8; 32],
     foreign_reasoning_dropped: u32,
     kind: FailureKind,
-    charge: Charge,
 ) -> TransportResult {
     let message = match kind {
         FailureKind::ResultSize => "provider result exceeded its byte bound",
@@ -1202,8 +716,6 @@ fn stand_in_failure(
                 model: model.to_string(),
                 provider: STAND_IN_PROVIDER.to_string(),
                 foreign_reasoning_dropped,
-                cost_micro_usd: charge.cost_micro_usd,
-                overrun_micro_usd: charge.overrun_micro_usd,
                 outcome: TransportOutcome::Failed {
                     kind,
                     message: message.to_string(),
@@ -1214,12 +726,6 @@ fn stand_in_failure(
     }
 }
 
-/// The one place foreignness is decided. A reasoning item of another provider
-/// in the in-flight exchange (after the last user text; the whole input when
-/// there is none) is refused, because dropping it would break the provider's
-/// own tool-exchange rules. Earlier foreign items are removed and counted.
-/// Foreignness is the provider tag alone: another model of this provider
-/// passes through for the provider to judge.
 fn partition_reasoning(
     request: &ProviderRequest,
     provider: &str,
@@ -1272,9 +778,7 @@ fn replay_store_error(error: impl std::fmt::Display) -> ServiceError {
 }
 
 mod lease;
-pub use lease::{
-    LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseSettlement, LeaseTurn, LeaseUse, ModelUsage,
-};
+pub use lease::{LeaseAdmission, LeaseGrant, LeaseRefusal, LeaseTurn};
 
 fn contract_refusal(error: &ContractError) -> Refusal {
     match error {
@@ -1300,7 +804,6 @@ mod tests {
             TransportService::open(
                 &store.path,
                 "fixture-sse",
-                fixture_prices(),
                 [
                     caller("epiphany-yggdrasil", "shared-key", 1),
                     caller("ghostlight-yggdrasil", "shared-key", 1),
@@ -1315,7 +818,7 @@ mod tests {
         let mut service = open_service(&store, 1);
         assert!(matches!(
             service
-                .begin(
+                .begin_unplanned(
                     &encrypt_invocation(&epiphany, &security("epiphany-distinct-test-key"))
                         .unwrap(),
                     1_000,
@@ -1326,7 +829,7 @@ mod tests {
         ));
         assert!(matches!(
             service
-                .begin(
+                .begin_unplanned(
                     &encrypt_invocation(&ghostlight, &security("ghostlight-distinct-test-key"))
                         .unwrap(),
                     1_000,
@@ -1344,7 +847,7 @@ mod tests {
         let security = security("epiphany-distinct-test-key");
         let mut service = open_service(&store, 1);
         let claim = match service
-            .begin(
+            .begin_unplanned(
                 &encrypt_invocation(&invocation, &security).unwrap(),
                 1_000,
                 FRAME,
@@ -1375,7 +878,7 @@ mod tests {
         let mut service = open_service(&store, 1);
 
         let replay = match service
-            .begin(
+            .begin_unplanned(
                 &encrypt_invocation(&invocation, &security).unwrap(),
                 1_000,
                 FRAME,
@@ -1398,12 +901,11 @@ mod tests {
             "epiphany-yggdrasil",
             2_000,
             [7; 32],
-            MAX_COST,
             changed_request,
         )
         .unwrap();
         let refusal = match service
-            .begin(
+            .begin_unplanned(
                 &encrypt_invocation(&conflicting, &security).unwrap(),
                 1_000,
                 FRAME,
@@ -1430,13 +932,13 @@ mod tests {
         let mut service = open_service(&store, 1);
         let first_envelope = encrypt_invocation(&first, &security).unwrap();
         assert!(matches!(
-            service.begin(&first_envelope, 1_000, FRAME).unwrap(),
+            service.begin_unplanned(&first_envelope, 1_000, FRAME).unwrap(),
             TransportAdmission::Execute(_)
         ));
 
         for (invocation, expected) in [(&first, Refusal::InFlight), (&second, Refusal::Capacity)] {
             let response = match service
-                .begin(
+                .begin_unplanned(
                     &encrypt_invocation(invocation, &security).unwrap(),
                     1_000,
                     FRAME,
@@ -1464,7 +966,7 @@ mod tests {
         let mut service = open_service(&store, 1);
         assert!(matches!(
             service
-                .begin(
+                .begin_unplanned(
                     &encrypt_invocation(&first, &security).unwrap(),
                     1_000,
                     FRAME
@@ -1476,7 +978,7 @@ mod tests {
 
         let mut restarted = open_service(&store, 1);
         let ambiguous = match restarted
-            .begin(
+            .begin_unplanned(
                 &encrypt_invocation(&first, &security).unwrap(),
                 1_000,
                 FRAME,
@@ -1494,7 +996,7 @@ mod tests {
         );
         assert!(matches!(
             restarted
-                .begin(
+                .begin_unplanned(
                     &encrypt_invocation(&second, &security).unwrap(),
                     1_000,
                     FRAME
@@ -1507,7 +1009,6 @@ mod tests {
             TransportService::open(
                 &store.path,
                 "fixture-sse",
-                fixture_prices(),
                 [CallerAdmission::new(
                     "epiphany-yggdrasil",
                     "rotated-connection-key",
@@ -1516,8 +1017,6 @@ mod tests {
                     1,
                     64 * 1024,
                     32_768,
-                    SpendCeiling(CEILING),
-                    SpendWindowMs(WINDOW_MS)
                 )
                 .unwrap()],
                 5_000,
@@ -1537,9 +1036,9 @@ mod tests {
         let mut request = invocation_for(CALLER, request_id).request;
         edit(&mut request);
         let invocation =
-            TransportInvocation::new(CALLER, 2_000, [7; 32], MAX_COST, request).unwrap();
+            TransportInvocation::new(CALLER, 2_000, [7; 32], request).unwrap();
         let envelope = encrypt_invocation(&invocation, &security(KEY)).unwrap();
-        (service.begin(&envelope, 1_000, FRAME).unwrap(), invocation)
+        (service.begin_unplanned(&envelope, 1_000, FRAME).unwrap(), invocation)
     }
 
     fn refusal_of(admission: TransportAdmission, invocation: &TransportInvocation) -> Refusal {
@@ -1617,19 +1116,16 @@ mod tests {
                 4,
                 max_payload_bytes,
                 32_768,
-                SpendCeiling(CEILING),
-                SpendWindowMs(WINDOW_MS),
             )
             .unwrap();
             TransportService::open(
                 &store.path,
                 "fixture-sse",
-                fixture_prices(),
                 [admission],
                 5_000,
             )
             .unwrap()
-            .begin(&envelope, 1_000, FRAME)
+            .begin_unplanned(&envelope, 1_000, FRAME)
         };
         assert!(matches!(admit(size), Ok(TransportAdmission::Execute(_))));
         let refused = admit(size - 1).unwrap();
@@ -1644,14 +1140,14 @@ mod tests {
         let mut expired = invocation_for(CALLER, "expired");
         expired.expires_at_unix_ms = 10;
         let reply = service
-            .begin(&raw_envelope(&expired), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&expired), 1_000, FRAME)
             .unwrap();
         assert_eq!(refusal_of(reply, &expired), Refusal::Expired);
 
         let mut substituted = invocation_for(CALLER, "substituted");
         substituted.provider_request_sha256 = [9; 32];
         let reply = service
-            .begin(&raw_envelope(&substituted), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&substituted), 1_000, FRAME)
             .unwrap();
         assert_eq!(
             refusal_of(reply, &substituted),
@@ -1661,7 +1157,7 @@ mod tests {
         let mut malformed = invocation_for(CALLER, "malformed");
         malformed.native_request_sha256 = [0; 32];
         let reply = service
-            .begin(&raw_envelope(&malformed), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&malformed), 1_000, FRAME)
             .unwrap();
         assert_eq!(refusal_of(reply, &malformed), Refusal::Malformed);
     }
@@ -1673,10 +1169,7 @@ mod tests {
             connection_key_epoch: 1,
             invocation_sha256: [1; 32],
             expires_at_unix_ms: 5_000,
-            state: ReplayState::Active {
-                reserved_micro_usd: 1,
-            },
-            admitted_at_unix_ms: 1_000,
+            state: ReplayState::Active,
         };
         edit(&mut record);
         let mut cache = CultCache::new();
@@ -1703,7 +1196,6 @@ mod tests {
             TransportService::open(
                 &control.path,
                 "fixture-sse",
-                fixture_prices(),
                 [caller(CALLER, KEY, 1)],
                 5_000
             )
@@ -1711,11 +1203,10 @@ mod tests {
         );
 
         type Edit = fn(&mut ReplayRecord);
-        let cases: [(&str, Edit); 4] = [
+        let cases: [(&str, Edit); 3] = [
             ("wrong-key", |_| {}),
             ("zero-digest", |record| record.invocation_sha256 = [0; 32]),
             ("zero-expiry", |record| record.expires_at_unix_ms = 0),
-            ("zero-admission", |record| record.admitted_at_unix_ms = 0),
         ];
         for (name, edit) in cases {
             let store = TestStore::new();
@@ -1730,7 +1221,6 @@ mod tests {
                     TransportService::open(
                         &store.path,
                         "fixture-sse",
-                        fixture_prices(),
                         [caller(CALLER, KEY, 1)],
                         5_000
                     ),
@@ -1771,8 +1261,6 @@ mod tests {
             .unwrap();
         record.state = ReplayState::Completed {
             response: encrypt_result(&result, &security(KEY)).unwrap(),
-            charged_micro_usd: 0,
-            overrun_micro_usd: 0,
         };
         service.replay_store.put(key, &record).unwrap();
         assert_eq!(
@@ -1792,8 +1280,6 @@ mod tests {
                 4,
                 64 * 1024,
                 32_768,
-                SpendCeiling(CEILING),
-                SpendWindowMs(WINDOW_MS),
             )
         };
         let at = "i".repeat(MAX_IDENTITY_BYTES);
@@ -1812,7 +1298,7 @@ mod tests {
         let mut service = open_service(&store, 8);
         let ok = invocation_for(CALLER, &at);
         assert!(matches!(
-            service.begin(&raw_envelope(&ok), 1_000, FRAME).unwrap(),
+            service.begin_unplanned(&raw_envelope(&ok), 1_000, FRAME).unwrap(),
             TransportAdmission::Execute(_)
         ));
     }
@@ -1830,7 +1316,7 @@ mod tests {
             let id = "i".repeat(length);
             let long = invocation_for(CALLER, &id);
             let TransportAdmission::Reply(reply) =
-                service.begin(&raw_envelope(&long), 1_000, FRAME).unwrap()
+                service.begin_unplanned(&raw_envelope(&long), 1_000, FRAME).unwrap()
             else {
                 panic!("an over-long id must be refused, not executed ({length})");
             };
@@ -1861,18 +1347,18 @@ mod tests {
         // The frame carries the id twice (the message id and the envelope's
         // request id) and the base64 of the envelope, so bracket it: the
         // ciphertext plus the id is a floor, twice the ciphertext and both
-        // ids plus the envelope's other fields is a ceiling.
+        // ids plus the envelope's other fields is a frame_cap.
         let floor = sealed.ciphertext.len() + id.len();
-        let ceiling = 2 * (sealed.ciphertext.len() + 2 * id.len()) + 512;
+        let frame_cap = 2 * (sealed.ciphertext.len() + 2 * id.len()) + 512;
         let store = TestStore::new();
         let mut service = open_service(&store, 1);
         assert!(matches!(
-            service.begin(&raw_envelope(&long), 1_000, ceiling).unwrap(),
+            service.begin_unplanned(&raw_envelope(&long), 1_000, frame_cap).unwrap(),
             TransportAdmission::Reply(_)
         ));
         assert_eq!(
             service
-                .begin(&raw_envelope(&long), 1_000, floor - 1)
+                .begin_unplanned(&raw_envelope(&long), 1_000, floor - 1)
                 .unwrap_err(),
             ServiceError::FrameBound
         );
@@ -1890,9 +1376,9 @@ mod tests {
 
     #[test]
     fn a_readout_frame_check_is_inclusive_of_the_serialized_envelope() {
-        let readout = SpendReadout::new(1, Vec::new(), PlanQuotaSnapshot::default());
-        let envelope = encrypt_spend_readout(CALLER, "sized", &readout, &security(KEY)).unwrap();
-        let size = encode_spend_readout_response_frame(&envelope)
+        let readout = UsageReadout::new(1, PlanQuotaSnapshot::default());
+        let envelope = encrypt_usage_readout(CALLER, "sized", &readout, &security(KEY)).unwrap();
+        let size = encode_usage_readout_response_frame(&envelope)
             .unwrap()
             .len();
         assert_eq!(readout_fits_frame(&envelope, size), Ok(true));
@@ -1905,7 +1391,7 @@ mod tests {
     ) -> (Box<ExecutionClaim>, TransportInvocation) {
         let invocation = invocation_for(CALLER, request_id);
         match service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         {
             TransportAdmission::Execute(claim) => (claim, invocation),
@@ -1943,7 +1429,6 @@ mod tests {
                 invocation.native_request_sha256,
                 invocation.provider_request_sha256,
                 0,
-                FIXTURE_USAGE_COST,
             )
         );
         let TransportDisposition::Transported { receipt, .. } = &stand_in.disposition else {
@@ -1953,7 +1438,7 @@ mod tests {
 
         // The recorded replay is the stand-in's exact bytes.
         let TransportAdmission::Reply(replay) = service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         else {
             panic!("expected a replay");
@@ -1988,7 +1473,7 @@ mod tests {
         // longer in flight.
         let (_next, _) = claim_for(&mut service, "after-wedge");
         let TransportAdmission::Reply(reply) = service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         else {
             panic!("expected a refusal");
@@ -2013,7 +1498,7 @@ mod tests {
 
         let mut service = open_service(&store, 8);
         let TransportAdmission::Reply(same) = service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         else {
             panic!("expected a replay");
@@ -2023,7 +1508,7 @@ mod tests {
 
         let mut service = open_service(&store, 8);
         let TransportAdmission::Reply(smaller) = service
-            .begin(&raw_envelope(&invocation), 1_000, 2000)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, 2000)
             .unwrap()
         else {
             panic!("expected a replay");
@@ -2038,12 +1523,11 @@ mod tests {
                 invocation.native_request_sha256,
                 invocation.provider_request_sha256,
                 0,
-                FIXTURE_USAGE_COST,
             )
         );
         // The stand-in is what is recorded now, byte for byte, at any frame.
         let TransportAdmission::Reply(again) = service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         else {
             panic!("expected a replay");
@@ -2059,7 +1543,7 @@ mod tests {
         let big = text_result(claim.call(), "y");
         service.complete(*claim, big, FRAME).unwrap();
         assert_eq!(
-            service.begin(&raw_envelope(&invocation), 1_000, 10).err(),
+            service.begin_unplanned(&raw_envelope(&invocation), 1_000, 10).err(),
             Some(ServiceError::FrameBound)
         );
     }
@@ -2077,7 +1561,7 @@ mod tests {
         // Still active, never completed, and no longer live: the retry is told the
         // outcome is indeterminate.
         let TransportAdmission::Reply(reply) = service
-            .begin(&raw_envelope(&invocation), 1_000, FRAME)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap()
         else {
             panic!("expected a refusal");
@@ -2277,7 +1761,6 @@ mod tests {
                     TransportService::open(
                         &store.path,
                         tag,
-                        fixture_prices(),
                         [caller(CALLER, KEY, 1)],
                         5_000
                     ),
@@ -2290,7 +1773,6 @@ mod tests {
             TransportService::open(
                 &store.path,
                 "fixture-sse",
-                fixture_prices(),
                 [caller(CALLER, KEY, 1)],
                 5_000
             )
@@ -2338,7 +1820,7 @@ mod tests {
             ));
             // A retry of the same id replays the failure, not ReplayConflict.
             let TransportAdmission::Reply(replay) = service
-                .begin(&raw_envelope(&invocation), 1_000, FRAME)
+                .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
                 .unwrap()
             else {
                 panic!("a retry must replay the recorded failure");
@@ -2413,7 +1895,6 @@ mod tests {
             invocation.native_request_sha256,
             invocation.provider_request_sha256,
             1,
-            FIXTURE_USAGE_COST,
         );
         assert_eq!(
             decrypt_result(&response, &security(KEY), &invocation).unwrap(),
@@ -2428,7 +1909,7 @@ mod tests {
         let big = text_result(claim.call(), &"y".repeat(4000));
         service.complete(*claim, big, FRAME).unwrap();
         let TransportAdmission::Reply(smaller) = service
-            .begin(&raw_envelope(&invocation), 1_000, 2000)
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, 2000)
             .unwrap()
         else {
             panic!("expected a replay");
@@ -2444,1435 +1925,174 @@ mod tests {
         assert_eq!(receipt.foreign_reasoning_dropped, 1);
     }
 
-    // ---- spend ----
+    // ---- usage readout, the provider's refusal, the dollar era ----
 
-    fn usage(input: u64, cache_read: u64, cache_write: u64, output: u64) -> Usage {
-        Usage {
-            input_tokens: input,
-            cache_read_tokens: cache_read,
-            cache_write_tokens: cache_write,
-            output_tokens: output,
-            reasoning_tokens: None,
+    impl TransportService {
+        /// `begin` while the provider reports no plan at all.
+        fn begin_unplanned(
+            &mut self,
+            envelope: &TransportEnvelope,
+            now_unix_ms: u64,
+            max_frame_bytes: usize,
+        ) -> Result<TransportAdmission, ServiceError> {
+            self.begin(
+                envelope,
+                now_unix_ms,
+                &PlanQuotaSnapshot::default(),
+                max_frame_bytes,
+            )
         }
     }
 
-    const MTOK: u64 = 1_000_000;
-
-    fn flat_price(rate: u64) -> ModelPrice {
-        ModelPrice {
-            rates: Rates {
-                input: rate,
-                cache_write_short: rate,
-                cache_write_long: rate,
-                cache_read: rate,
-                output: rate,
-            },
-            long_context: None,
-            overhead_tokens: 0,
+    fn plan_of(permille: u32, status: &str, resets_at_unix_ms: u64) -> PlanQuotaSnapshot {
+        PlanQuotaSnapshot {
+            windows: vec![crate::readout::PlanQuota {
+                window: "five_hour".to_string(),
+                utilization_permille: Some(permille),
+                resets_at_unix_ms,
+                status: status.to_string(),
+                observed_at_unix_ms: 1_000,
+            }],
         }
     }
 
-    fn dearest_input(rates: &Rates, retention: Option<CacheRetention>) -> u64 {
-        let write = match retention {
-            Some(CacheRetention::Short) => rates.cache_write_short,
-            Some(CacheRetention::Long) | None => rates.cache_write_long,
-        };
-        rates.input.max(rates.cache_read).max(write)
-    }
-
-    /// ceil(((encoded length + overhead) x dearest input rate + max_output_tokens
-    /// x output rate) / 1e6), spelled out apart from the service.
-    fn expected_reservation(request: &ProviderRequest, rates: &Rates, overhead: u64) -> u64 {
-        let bound = wire_encode(request).unwrap().len() as u128 + u128::from(overhead);
-        let total = bound * u128::from(dearest_input(rates, request.cache_retention))
-            + u128::from(request.max_output_tokens) * u128::from(rates.output);
-        total.div_ceil(1_000_000) as u64
-    }
-
-    /// What every fixture request (request ids of one length) reserves.
-    fn reservation() -> u64 {
-        expected_reservation(&request(), &fixture_price().rates, 100)
-    }
-
-    fn invocation_at(request_id: &str, now: u64, max_cost: u64) -> TransportInvocation {
-        let mut request = request();
-        request.request_id = request_id.to_string();
-        TransportInvocation::new(CALLER, now + 1_000, [7; 32], max_cost, request).unwrap()
-    }
-
-    fn begin_at(
+    fn begin_under(
         service: &mut TransportService,
         request_id: &str,
         now: u64,
-        max_cost: u64,
+        plan: &PlanQuotaSnapshot,
     ) -> (TransportAdmission, TransportInvocation) {
-        let invocation = invocation_at(request_id, now, max_cost);
+        let mut request = invocation_for(CALLER, request_id).request;
+        request.request_id = request_id.to_string();
+        let invocation = TransportInvocation::new(CALLER, now + 1_000, [7; 32], request).unwrap();
         let admission = service
-            .begin(&raw_envelope(&invocation), now, FRAME)
+            .begin(&raw_envelope(&invocation), now, plan, FRAME)
             .unwrap();
         (admission, invocation)
     }
 
-    fn claim_at(service: &mut TransportService, request_id: &str, now: u64) -> Box<ExecutionClaim> {
-        match begin_at(service, request_id, now, MAX_COST).0 {
-            TransportAdmission::Execute(claim) => claim,
-            TransportAdmission::Reply(_) => panic!("{request_id} should have executed"),
-        }
-    }
-
-    fn refusal_at(
-        service: &mut TransportService,
-        request_id: &str,
-        now: u64,
-        max_cost: u64,
-    ) -> Refusal {
-        let (admission, invocation) = begin_at(service, request_id, now, max_cost);
-        refusal_of(admission, &invocation)
-    }
-
-    fn open_limited(store: &TestStore, ceiling: u64, window_ms: u64) -> TransportService {
-        TransportService::open(
-            &store.path,
-            "fixture-sse",
-            fixture_prices(),
-            [CallerAdmission::new(
-                CALLER,
-                KEY,
-                1,
-                ["gpt-5.4".to_string()],
-                8,
-                65_536,
-                32_768,
-                SpendCeiling(ceiling),
-                SpendWindowMs(window_ms),
-            )
-            .unwrap()],
-            5_000,
-        )
-        .unwrap()
-    }
-
-    fn record_of(service: &TransportService, request_id: &str) -> Option<ReplayRecord> {
-        service
-            .replay_store
-            .get::<ReplayRecord>(&replay_key(&RequestIdentity {
-                caller_runtime_id: CALLER.to_string(),
-                request_id: request_id.to_string(),
-            }))
-            .unwrap()
-    }
-
-    fn charged_of(service: &TransportService, request_id: &str) -> u64 {
-        match record_of(service, request_id).unwrap().state {
-            ReplayState::Completed {
-                charged_micro_usd, ..
-            } => charged_micro_usd,
-            ReplayState::Active { .. } | ReplayState::LeaseSettled { .. } => {
-                panic!("{request_id} is not completed")
-            }
-        }
-    }
-
-    fn receipt_of(
-        response: &TransportEnvelope,
-        invocation: &TransportInvocation,
-    ) -> TransportReceipt {
-        let TransportDisposition::Transported { receipt, .. } =
-            decrypt_result(response, &security(KEY), invocation)
-                .unwrap()
-                .disposition
-        else {
-            panic!("expected a transported result");
-        };
-        *receipt
-    }
-
-    #[test]
-    fn cost_prices_each_usage_class_at_its_own_rate() {
-        let price = fixture_price();
-        let cost = |usage: Usage| cost_micro_usd(&price, &usage, Some(CacheRetention::Long));
-        assert_eq!(cost(usage(MTOK, 0, 0, 0)), 3_000_000);
-        assert_eq!(cost(usage(0, MTOK, 0, 0)), 300_000);
-        assert_eq!(cost(usage(0, 0, MTOK, 0)), 6_000_000);
-        assert_eq!(cost(usage(0, 0, 0, MTOK)), 15_000_000);
-        assert_eq!(
-            cost(usage(2 * MTOK, 3 * MTOK, 5 * MTOK, 7 * MTOK)),
-            6_000_000 + 900_000 + 30_000_000 + 105_000_000
-        );
-        // Reasoning tokens are a detail of the output tokens, never priced apart.
-        let mut reasoning_only = usage(0, 0, 0, 0);
-        reasoning_only.reasoning_tokens = Some(MTOK);
-        assert_eq!(cost(reasoning_only), 0);
-        let mut detailed = usage(0, 0, 0, MTOK);
-        detailed.reasoning_tokens = Some(MTOK);
-        assert_eq!(cost(detailed), 15_000_000);
-    }
-
-    #[test]
-    fn cost_rounds_up_once_per_request() {
-        let price = flat_price(10_000);
-        let cost = |usage: Usage| cost_micro_usd(&price, &usage, None);
-        assert_eq!(cost(usage(0, 1, 0, 0)), 1);
-        assert_eq!(cost(usage(0, 0, 0, 0)), 0);
-        // Four classes at one token each: 40,000 / 1e6 rounds up once, to 1.
-        assert_eq!(cost(usage(1, 1, 1, 1)), 1);
-        assert_eq!(cost(usage(100, 0, 0, 0)), 1);
-        assert_eq!(cost(usage(101, 0, 0, 0)), 2);
-    }
-
-    #[test]
-    fn cache_writes_price_by_retention() {
-        let price = fixture_price();
-        let written = usage(0, 0, MTOK, 0);
-        assert_eq!(
-            cost_micro_usd(&price, &written, Some(CacheRetention::Short)),
-            3_750_000
-        );
-        assert_eq!(
-            cost_micro_usd(&price, &written, Some(CacheRetention::Long)),
-            6_000_000
-        );
-        // A write nobody asked to keep short is priced dear.
-        assert_eq!(cost_micro_usd(&price, &written, None), 6_000_000);
-    }
-
-    #[test]
-    fn long_context_rates_apply_strictly_above_the_threshold() {
-        let long = Rates {
-            input: 9_000_000,
-            cache_write_short: 9_500_000,
-            cache_write_long: 12_000_000,
-            cache_read: 900_000,
-            output: 45_000_000,
-        };
-        let price = |above_prompt_tokens: u64, overhead_tokens: u64| ModelPrice {
-            long_context: Some(LongContext {
-                above_prompt_tokens,
-                rates: long,
-            }),
-            overhead_tokens,
-            ..fixture_price()
-        };
-        // Prompt tokens are input + cache reads + cache writes.
-        let at_threshold = cost_micro_usd(&price(100, 0), &usage(1, 1, 98, 0), None);
-        assert_eq!(at_threshold, 592); // 3e6 + 3e5 + 98 x 6e6 = 591.3e6, base rates
-        let above = cost_micro_usd(&price(100, 0), &usage(1, 1, 99, 0), None);
-        assert_eq!(above, 1198); // 9e6 + 9e5 + 99 x 12e6 = 1197.9e6, long rates
-        assert_eq!(
-            cost_micro_usd(&price(100, 0), &usage(100, 0, 0, 0), None),
-            300
-        );
-        assert_eq!(
-            cost_micro_usd(&price(100, 0), &usage(101, 0, 0, 0), None),
-            909
-        );
-
-        // The reservation switches at the same strict threshold, on its byte bound.
-        let request = request();
-        let length = wire_encode(&request).unwrap().len() as u64;
-        let bound = length + 7;
-        assert_eq!(
-            reservation_micro_usd(&price(bound, 7), &request)
-                .unwrap()
-                .unwrap(),
-            expected_reservation(&request, &fixture_price().rates, 7)
-        );
-        assert_eq!(
-            reservation_micro_usd(&price(bound - 1, 7), &request)
-                .unwrap()
-                .unwrap(),
-            expected_reservation(&request, &long, 7)
-        );
-    }
-
-    #[test]
-    fn cost_saturates_instead_of_wrapping() {
-        let price = fixture_price();
-        for huge in [
-            usage(u64::MAX, 0, 0, 0),
-            usage(0, 0, u64::MAX, 0),
-            usage(0, 0, 0, u64::MAX),
-            usage(u64::MAX, u64::MAX, u64::MAX, u64::MAX),
-        ] {
-            assert_eq!(cost_micro_usd(&price, &huge, None), u64::MAX, "{huge:?}");
-        }
-        // A class that does not overflow is exact: 300,000 x u64::MAX / 1e6, rounded up.
-        assert_eq!(
-            cost_micro_usd(&price, &usage(0, u64::MAX, 0, 0), None),
-            5_534_023_222_112_865_485
-        );
-    }
-
-    #[test]
-    fn reservation_is_the_byte_bound_plus_max_output() {
-        let rate_sets = [
-            (fixture_price().rates, 100),
-            // The dearest input rate is a cache read here...
-            (
-                Rates {
-                    input: 1_000_000,
-                    cache_write_short: 2_000_000,
-                    cache_write_long: 3_000_000,
-                    cache_read: 8_000_000,
-                    output: 5_000_000,
-                },
-                7,
-            ),
-            // ...and plain input here.
-            (
-                Rates {
-                    input: 9_000_000,
-                    cache_write_short: 1_000_000,
-                    cache_write_long: 2_000_000,
-                    cache_read: 3_000_000,
-                    output: 4_000_000,
-                },
-                0,
-            ),
-        ];
-        for (rates, overhead_tokens) in rate_sets {
-            let price = ModelPrice {
-                rates,
-                long_context: None,
-                overhead_tokens,
-            };
-            for retention in [
-                None,
-                Some(CacheRetention::Short),
-                Some(CacheRetention::Long),
-            ] {
-                let mut request = request();
-                request.cache_retention = retention;
-                assert_eq!(
-                    reservation_micro_usd(&price, &request).unwrap().unwrap(),
-                    expected_reservation(&request, &rates, overhead_tokens),
-                    "{rates:?} {retention:?}"
-                );
-            }
-        }
-        // More output costs at least its price, and the bound follows the encoding
-        // (a wider integer is more bytes).
-        let price = fixture_price();
-        let mut reserved = Vec::new();
-        for max_output_tokens in [1, 1_000, 1_001_000] {
-            let mut request = request();
-            request.max_output_tokens = max_output_tokens;
-            let amount = reservation_micro_usd(&price, &request).unwrap().unwrap();
-            assert_eq!(
-                amount,
-                expected_reservation(&request, &price.rates, 100),
-                "{max_output_tokens}"
-            );
-            reserved.push(amount);
-        }
-        assert!(reserved[2] - reserved[1] >= 15_000_000);
-    }
-
-    #[test]
-    fn worst_case_over_max_cost_is_refused_cost_bound_inclusively() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 1);
-        let reserved = reservation();
-        let (admission, _) = begin_at(&mut service, "request-1", 1_000, reserved);
-        assert!(matches!(admission, TransportAdmission::Execute(_)));
-        // The only slot is taken: a request refused for its cost is refused
-        // for that, before the replay lookup and the capacity check.
-        assert_eq!(
-            refusal_at(&mut service, "request-2", 1_000, reserved - 1),
-            Refusal::CostBound
-        );
-        assert!(record_of(&service, "request-2").is_none());
-        assert_eq!(service.window_spend(CALLER, 0), reserved);
-        assert_eq!(
-            refusal_at(&mut service, "request-3", 1_000, reserved),
-            Refusal::Capacity
-        );
-    }
-
-    #[test]
-    fn max_cost_zero_is_malformed() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        assert_eq!(
-            refusal_at(&mut service, "request-1", 1_000, 0),
-            Refusal::Malformed
-        );
-        assert!(record_of(&service, "request-1").is_none());
-    }
-
-    #[test]
-    fn a_changed_max_cost_is_a_replay_conflict() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(
-            refusal_at(&mut service, "request-1", 1_000, MAX_COST + 1),
-            Refusal::ReplayConflict
-        );
-    }
-
-    #[test]
-    fn spend_ceiling_refuses_inclusively_and_resets_next_window() {
-        let reserved = reservation();
-        let window = 10_000;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, 2 * reserved, window);
-        claim_at(&mut service, "request-1", 1_000);
-        // Windows are aligned to the epoch: the last millisecond of window 0.
-        claim_at(&mut service, "request-2", 9_999);
-        assert_eq!(service.window_spend(CALLER, 0), 2 * reserved);
-        assert_eq!(
-            refusal_at(&mut service, "request-3", 9_999, MAX_COST),
-            Refusal::SpendCeiling
-        );
-        assert!(record_of(&service, "request-3").is_none());
-        // The first millisecond of window 1: the same request id is admitted.
-        claim_at(&mut service, "request-3", 10_000);
-        assert_eq!(service.window_spend(CALLER, 0), 2 * reserved);
-        assert_eq!(service.window_spend(CALLER, 1), reserved);
-
-        // One micro-USD below the two reservations refuses the second.
-        let store = TestStore::new();
-        let mut service = open_limited(&store, 2 * reserved - 1, window);
-        claim_at(&mut service, "request-1", 1_000);
-        assert_eq!(
-            refusal_at(&mut service, "request-2", 1_000, MAX_COST),
-            Refusal::SpendCeiling
-        );
-    }
-
-    #[test]
-    fn a_recorded_answer_replays_past_an_exhausted_ceiling() {
-        let reserved = reservation();
-        let store = TestStore::new();
-        let mut service = open_limited(&store, reserved, 3_600_000);
-        let (admission, _) = begin_at(&mut service, "request-1", 1_000, MAX_COST);
-        let TransportAdmission::Execute(claim) = admission else {
-            panic!("the first request fits the ceiling exactly");
-        };
-        let result = text_result(claim.call(), "done");
-        let response = service.complete(*claim, result, FRAME).unwrap();
-        // Spent 75 of a ceiling that holds one reservation: nothing else fits.
-        assert_eq!(
-            refusal_at(&mut service, "request-2", 1_000, MAX_COST),
-            Refusal::SpendCeiling
-        );
-        // The recorded answer is replayed whatever the caller has left.
-        let (replay, _) = begin_at(&mut service, "request-1", 1_000, MAX_COST);
-        assert_eq!(replay, TransportAdmission::Reply(response));
-    }
-
-    #[test]
-    fn settlement_replaces_the_reservation_with_the_charge() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(service.window_spend(CALLER, 0), FIXTURE_USAGE_COST);
-        assert_eq!(charged_of(&service, "request-1"), FIXTURE_USAGE_COST);
-    }
-
-    #[test]
-    fn failed_with_usage_charges_usage_and_failed_without_keeps_the_reservation() {
-        let failed = |usage: Option<Usage>| TransportOutcome::Failed {
-            kind: FailureKind::Provider,
-            message: "the provider refused".to_string(),
-            usage,
-        };
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = claim
-            .call()
-            .transported(Vec::new(), failed(Some(usage(0, 0, 0, 0))));
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let response = service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(receipt_of(&response, &invocation).cost_micro_usd, 0);
-        assert_eq!(charged_of(&service, "request-1"), 0);
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-
-        let claim = claim_at(&mut service, "request-2", 1_000);
-        let result = claim
-            .call()
-            .transported(Vec::new(), failed(Some(usage(MTOK, 0, 0, 0))));
-        service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(charged_of(&service, "request-2"), 3_000_000);
-
-        let claim = claim_at(&mut service, "request-3", 1_000);
-        let result = claim.call().transported(Vec::new(), failed(None));
-        let invocation = invocation_at("request-3", 1_000, MAX_COST);
-        let response = service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(
-            receipt_of(&response, &invocation).cost_micro_usd,
-            reservation()
-        );
-        assert_eq!(charged_of(&service, "request-3"), reservation());
-        assert_eq!(service.window_spend(CALLER, 0), 3_000_000 + reservation());
-    }
-
-    #[test]
-    fn a_backend_cost_misreport_is_answered_with_the_stand_in() {
-        let edits: [fn(u64) -> u64; 3] = [|cost| cost + 1, |cost| cost - 1, |_| 0];
-        for (index, edit) in edits.into_iter().enumerate() {
-            let store = TestStore::new();
-            let mut service = open_service(&store, 4);
-            let id = format!("request-{index}");
-            let claim = claim_at(&mut service, &id, 1_000);
-            let mut result = text_result(claim.call(), "done");
-            let TransportDisposition::Transported { receipt, .. } = &mut result.disposition else {
-                unreachable!();
-            };
-            receipt.cost_micro_usd = edit(receipt.cost_micro_usd);
-            let invocation = invocation_at(&id, 1_000, MAX_COST);
-            let response = service.complete(*claim, result, FRAME).unwrap();
-            let receipt = receipt_of(&response, &invocation);
-            assert_eq!(receipt.provider, STAND_IN_PROVIDER, "{index}");
-            // A result the service refused is still billed what its usage costs.
-            assert_eq!(receipt.cost_micro_usd, FIXTURE_USAGE_COST, "{index}");
-            assert_eq!(charged_of(&service, &id), FIXTURE_USAGE_COST, "{index}");
-            assert_eq!(
-                service.window_spend(CALLER, 0),
-                FIXTURE_USAGE_COST,
-                "{index}"
-            );
-        }
-    }
-
-    #[test]
-    fn result_size_stand_in_keeps_the_real_charge() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let big = text_result(claim.call(), &"y".repeat(4000));
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let response = service.complete(*claim, big, 2000).unwrap();
-        let receipt = receipt_of(&response, &invocation);
-        assert_eq!(receipt.provider, STAND_IN_PROVIDER);
-        assert_eq!(receipt.cost_micro_usd, FIXTURE_USAGE_COST);
-        assert_eq!(charged_of(&service, "request-1"), FIXTURE_USAGE_COST);
-        assert_eq!(service.window_spend(CALLER, 0), FIXTURE_USAGE_COST);
-
-        // The replay path: a wide record re-measured at a smaller frame.
-        let claim = claim_at(&mut service, "request-2", 1_000);
-        let big = text_result(claim.call(), &"y".repeat(4000));
-        service.complete(*claim, big, FRAME).unwrap();
-        drop(service);
-        let mut service = open_service(&store, 4);
-        let invocation = invocation_at("request-2", 1_000, MAX_COST);
-        let TransportAdmission::Reply(smaller) = service
-            .begin(&raw_envelope(&invocation), 1_000, 2000)
-            .unwrap()
-        else {
-            panic!("expected a replay");
-        };
-        let receipt = receipt_of(&smaller, &invocation);
-        assert_eq!(receipt.provider, STAND_IN_PROVIDER);
-        assert_eq!(receipt.cost_micro_usd, FIXTURE_USAGE_COST);
-        assert_eq!(charged_of(&service, "request-2"), FIXTURE_USAGE_COST);
-        assert_eq!(service.window_spend(CALLER, 0), 2 * FIXTURE_USAGE_COST);
-    }
-
-    #[test]
-    fn a_ledger_write_failure_executes_nothing() {
-        let refusing = FlakyStore::new(0);
-        let healthy = refusing.reopened(5);
-        let mut service = open_flaky(refusing);
-        let invocation = invocation_for(CALLER, "request-1");
-        assert!(matches!(
-            service.begin(&raw_envelope(&invocation), 1_000, FRAME),
-            Err(ServiceError::ReplayStore(_))
-        ));
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-        assert!(service.live.is_empty());
-        assert!(record_of(&service, "request-1").is_none());
-        drop(service);
-
-        // Nothing was written, so the same ledger admits the request afresh.
-        let mut service = open_flaky(healthy);
-        claim_at(&mut service, "request-1", 1_000);
-    }
-
-    #[test]
-    fn a_settle_write_failure_keeps_the_reservation_counted() {
-        let one_write = FlakyStore::new(1);
-        let restart = one_write.reopened(5);
-        let mut service = open_flaky(one_write);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = text_result(claim.call(), "done");
-        assert!(matches!(
-            service.complete(*claim, result, FRAME),
-            Err(ServiceError::ReplayStore(_))
-        ));
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-        assert!(matches!(
-            record_of(&service, "request-1").unwrap().state,
-            ReplayState::Active { .. }
-        ));
-        drop(service);
-
-        // A restart bills the indeterminate request at its whole reservation.
-        let service = open_flaky(restart);
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-    }
-
-    #[test]
-    fn restart_rederives_window_spend_from_the_records() {
-        let reserved = reservation();
-        let window = 10_000;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, 1 << 40, window);
-        // An earlier window: completed.
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        // The current window: one completed, one left Active by a crash.
-        let claim = claim_at(&mut service, "request-2", 10_500);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        claim_at(&mut service, "request-3", 10_600);
-        drop(service);
-
-        let mut service = open_limited(&store, FIXTURE_USAGE_COST + 2 * reserved, window);
-        // Only the current window is kept: the earlier one is pruned.
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-        assert_eq!(
-            service.window_spend(CALLER, 1),
-            FIXTURE_USAGE_COST + reserved
-        );
-        // The ceiling sees the rebuilt window: one more reservation fits it
-        // exactly, and the next does not. The earlier window counts for nothing.
-        claim_at(&mut service, "request-4", 11_000);
-        assert_eq!(
-            refusal_at(&mut service, "request-5", 11_100, MAX_COST),
-            Refusal::SpendCeiling
-        );
-    }
-
-    #[test]
-    fn open_refuses_an_unpriced_model_and_admits_a_zero_price() {
-        let store = TestStore::new();
-        assert_eq!(
-            TransportService::open(
-                &store.path,
-                "fixture-sse",
-                PriceTable::from([("another-model".to_string(), fixture_price())]),
-                [caller(CALLER, KEY, 1)],
-                5_000,
-            )
-            .err(),
-            Some(ServiceError::UnpricedModel("gpt-5.4".to_string()))
-        );
-
-        let free = PriceTable::from([("gpt-5.4".to_string(), flat_price(0))]);
-        let mut service = TransportService::open(
-            &store.path,
-            "fixture-sse",
-            free,
-            [caller(CALLER, KEY, 1)],
-            5_000,
-        )
-        .unwrap();
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(charged_of(&service, "request-1"), 0);
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-    }
-
-    #[test]
-    fn a_ceiling_and_a_window_are_required_nonzero() {
-        let admit = |ceiling: u64, window_ms: u64| {
-            CallerAdmission::new(
-                CALLER,
-                KEY,
-                1,
-                ["gpt-5.4".to_string()],
-                4,
-                64 * 1024,
-                32_768,
-                SpendCeiling(ceiling),
-                SpendWindowMs(window_ms),
-            )
-        };
-        assert!(admit(1, 1).is_ok());
-        assert!(matches!(admit(0, 1), Err(ServiceError::InvalidAdmission)));
-        assert!(matches!(admit(1, 0), Err(ServiceError::InvalidAdmission)));
-    }
-
-    // ---- settle past the reservation, pruning, extremes ----
-
-    fn overrun_result(call: &ProviderCall, text: &str) -> TransportResult {
-        let mut outcome = receipt(&invocation_for(CALLER, "outcome")).outcome;
-        let TransportOutcome::Completed { usage, .. } = &mut outcome else {
-            unreachable!();
-        };
-        // 2 million output tokens at 15,000,000 per million: 30,000,000.
-        *usage = self::usage(0, 0, 0, 2 * MTOK);
-        call.transported(
-            vec![TransportEvent {
-                sequence: 0,
-                payload: TransportEventPayload::TextDelta {
-                    text: text.to_string(),
-                },
-            }],
-            outcome,
-        )
-    }
-
-    const OVERRUN_COST: u64 = 30_000_000;
-
-    #[test]
-    fn an_overrun_settles_at_the_true_cost_and_the_receipt_says_so() {
-        let reserved = reservation();
-        let store = TestStore::new();
-        let mut service = open_limited(&store, 2 * reserved, 3_600_000);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = overrun_result(claim.call(), "done");
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let response = service.complete(*claim, result, FRAME).unwrap();
-        let receipt = receipt_of(&response, &invocation);
-        // The provider's own answer, not a stand-in, carrying the true cost
-        // and the marker.
-        assert_eq!(receipt.provider, "fixture-sse");
-        assert_eq!(receipt.cost_micro_usd, OVERRUN_COST);
-        assert_eq!(receipt.overrun_micro_usd, OVERRUN_COST - reserved);
-        assert_eq!(charged_of(&service, "request-1"), OVERRUN_COST);
-        assert_eq!(service.window_spend(CALLER, 0), OVERRUN_COST);
-        // The ceiling holds for every later request in the window.
-        assert_eq!(
-            refusal_at(&mut service, "request-2", 1_000, MAX_COST),
-            Refusal::SpendCeiling
-        );
-        // A result inside its reservation carries no marker.
-        drop(service);
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-3", 1_000);
-        let result = text_result(claim.call(), "done");
-        let invocation = invocation_at("request-3", 1_000, MAX_COST);
-        let response = service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(receipt_of(&response, &invocation).overrun_micro_usd, 0);
-    }
-
-    #[test]
-    fn an_overrun_survives_the_result_size_stand_in_and_its_replay() {
-        let reserved = reservation();
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let big = overrun_result(claim.call(), &"y".repeat(4000));
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let response = service.complete(*claim, big, 2000).unwrap();
-        let receipt = receipt_of(&response, &invocation);
-        assert_eq!(receipt.provider, STAND_IN_PROVIDER);
-        assert_eq!(receipt.cost_micro_usd, OVERRUN_COST);
-        assert_eq!(receipt.overrun_micro_usd, OVERRUN_COST - reserved);
-
-        let claim = claim_at(&mut service, "request-2", 1_000);
-        let big = overrun_result(claim.call(), &"y".repeat(4000));
-        service.complete(*claim, big, FRAME).unwrap();
-        drop(service);
-        let mut service = open_service(&store, 4);
-        let invocation = invocation_at("request-2", 1_000, MAX_COST);
-        let TransportAdmission::Reply(smaller) = service
-            .begin(&raw_envelope(&invocation), 1_000, 2000)
-            .unwrap()
-        else {
-            panic!("expected a replay");
-        };
-        let receipt = receipt_of(&smaller, &invocation);
-        assert_eq!(receipt.provider, STAND_IN_PROVIDER);
-        assert_eq!(receipt.cost_micro_usd, OVERRUN_COST);
-        assert_eq!(receipt.overrun_micro_usd, OVERRUN_COST - reserved);
-    }
-
-    #[test]
-    fn a_backend_overrun_misreport_is_answered_with_the_stand_in() {
-        let reserved = reservation();
-        for (index, overrun) in [1, 0].into_iter().enumerate() {
-            let store = TestStore::new();
-            let mut service = open_service(&store, 4);
-            let id = format!("request-{index}");
-            let claim = claim_at(&mut service, &id, 1_000);
-            // The first result is inside its reservation and claims an overrun;
-            // the second overran and claims none.
-            let mut result = if index == 0 {
-                text_result(claim.call(), "done")
-            } else {
-                overrun_result(claim.call(), "done")
-            };
-            let TransportDisposition::Transported { receipt, .. } = &mut result.disposition else {
-                unreachable!();
-            };
-            receipt.overrun_micro_usd = overrun;
-            let invocation = invocation_at(&id, 1_000, MAX_COST);
-            let response = service.complete(*claim, result, FRAME).unwrap();
-            let receipt = receipt_of(&response, &invocation);
-            // The service prices the usage itself: the stand-in and the ledger
-            // carry the true cost and the true overrun, whatever was claimed.
-            let (cost, true_overrun) = if index == 0 {
-                (FIXTURE_USAGE_COST, 0)
-            } else {
-                (OVERRUN_COST, OVERRUN_COST - reserved)
-            };
-            assert_eq!(receipt.provider, STAND_IN_PROVIDER, "{index}");
-            assert_eq!(receipt.cost_micro_usd, cost, "{index}");
-            assert_eq!(receipt.overrun_micro_usd, true_overrun, "{index}");
-            assert_eq!(charged_of(&service, &id), cost, "{index}");
-            assert_eq!(service.window_spend(CALLER, 0), cost, "{index}");
-        }
-    }
-
-    #[test]
-    fn the_window_map_stays_bounded_live_and_after_reopen() {
-        let window = 10;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, 1 << 40, window);
-        let held =
-            |service: &TransportService| service.window_spend.get(CALLER).map_or(0, |w| w.len());
-        for index in 0..300u64 {
-            let id = format!("request-{index}");
-            let claim = claim_at(&mut service, &id, 1_000 + index * window);
-            let result = text_result(claim.call(), "done");
-            service.complete(*claim, result, FRAME).unwrap();
-            assert_eq!(held(&service), 1, "{index}");
-        }
-        // A request still in flight keeps its own window until it settles.
-        let early = claim_at(&mut service, "request-e", 1_000 + 300 * window);
-        claim_at(&mut service, "request-l", 1_000 + 305 * window);
-        assert_eq!(held(&service), 2);
-        let result = text_result(early.call(), "done");
-        service.complete(*early, result, FRAME).unwrap();
-        assert_eq!(held(&service), 1);
-        drop(service);
-        let service = open_limited(&store, 1 << 40, window);
-        assert_eq!(held(&service), 1);
-        assert_eq!(
-            service.window_spend(CALLER, 1_000 / window + 305),
-            reservation()
-        );
-    }
-
-    #[test]
-    fn a_reservation_that_overflows_is_refused_cost_bound_not_wrapped() {
-        for price in [
-            ModelPrice {
-                overhead_tokens: u64::MAX,
-                ..flat_price(u64::MAX)
-            },
-            ModelPrice {
-                overhead_tokens: u64::MAX,
-                ..flat_price(1 << 40)
-            },
-        ] {
-            assert_eq!(reservation_micro_usd(&price, &request()).unwrap(), None);
-            let store = TestStore::new();
-            let mut service = TransportService::open(
-                &store.path,
-                "fixture-sse",
-                PriceTable::from([("gpt-5.4".to_string(), price)]),
-                [caller(CALLER, KEY, 4)],
-                5_000,
-            )
-            .unwrap();
-            // Not even a caller that bounds its request at u64::MAX can afford it.
-            assert_eq!(
-                refusal_at(&mut service, "request-1", 1_000, u64::MAX),
-                Refusal::CostBound
-            );
-            assert!(record_of(&service, "request-1").is_none());
-        }
-    }
-
-    #[test]
-    fn a_recorded_answer_replays_after_a_price_raise() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let (admission, _) = begin_at(&mut service, "request-1", 1_000, reservation());
-        let TransportAdmission::Execute(claim) = admission else {
-            panic!("expected an execution claim");
-        };
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        drop(service);
-
-        let mut dear = fixture_price();
-        dear.rates.output *= 2;
-        let mut service = TransportService::open(
-            &store.path,
-            "fixture-sse",
-            PriceTable::from([("gpt-5.4".to_string(), dear)]),
-            [caller(CALLER, KEY, 4)],
-            5_000,
-        )
-        .unwrap();
-        let (admission, invocation) = begin_at(&mut service, "request-1", 1_000, reservation());
-        let TransportAdmission::Reply(response) = admission else {
-            panic!("expected the recorded answer");
-        };
-        assert_eq!(
-            receipt_of(&response, &invocation).cost_micro_usd,
-            FIXTURE_USAGE_COST
-        );
-        // New work is still checked against today's prices.
-        assert_eq!(
-            refusal_at(&mut service, "request-2", 1_000, reservation()),
-            Refusal::CostBound
-        );
-    }
-
-    #[test]
-    fn a_settle_write_failure_releases_the_slot_and_keeps_the_reservation() {
-        let store = FlakyStore::new(1);
-        let allowance = store.allowance();
-        let mut service = open_flaky(store);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = text_result(claim.call(), "done");
-        assert!(matches!(
-            service.complete(*claim, result, FRAME),
-            Err(ServiceError::ReplayStore(_))
-        ));
-        assert!(service.live.is_empty());
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-        // The store recovers: the caller's only slot is free again, and the
-        // unsettled request is told it is indeterminate, not in flight.
-        allowance.store(5, std::sync::atomic::Ordering::SeqCst);
-        claim_at(&mut service, "request-2", 1_000);
-        assert_eq!(service.window_spend(CALLER, 0), 2 * reservation());
-        let (admission, invocation) = begin_at(&mut service, "request-1", 1_000, MAX_COST);
-        assert_eq!(refusal_of(admission, &invocation), Refusal::Indeterminate);
-    }
-
-    fn open_flaky(store: FlakyStore) -> TransportService {
-        TransportService::with_store(
-            store,
-            "fixture-sse",
-            fixture_prices(),
-            [caller(CALLER, KEY, 1)],
-            5_000,
-        )
-        .unwrap()
-    }
-
-    fn run_window(service: &mut TransportService, prefix: &str, now: u64) -> u32 {
-        let mut admitted = 0;
-        for i in 0..20u64 {
-            let (admission, _) = begin_at(service, &format!("{prefix}-{i:02}"), now, MAX_COST);
-            let TransportAdmission::Execute(claim) = admission else {
-                break;
-            };
-            admitted += 1;
-            let result = text_result(claim.call(), "done");
-            service.complete(*claim, result, FRAME).unwrap();
-        }
-        admitted
-    }
-
-    #[test]
-    fn a_clock_stepping_back_cannot_reopen_the_callers_budget() {
-        let window = 10_000;
-        // Room for the reservation plus two settled requests: three admitted.
-        let ceiling = reservation() + 2 * FIXTURE_USAGE_COST;
-        let control_store = TestStore::new();
-        let mut control = open_limited(&control_store, ceiling, window);
-        assert_eq!(run_window(&mut control, "back", 20_000), 3);
-
-        let store = TestStore::new();
-        let mut service = open_limited(&store, ceiling, window);
-        let claim = claim_at(&mut service, "ahead", 50_000);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        // The clock now reads window 2, behind the recorded window 5: the
-        // request belongs to window 5, which already holds one.
-        assert_eq!(run_window(&mut service, "back", 20_000), 2);
-        assert_eq!(service.window_spend(CALLER, 5), 3 * FIXTURE_USAGE_COST);
-        assert_eq!(service.window_spend(CALLER, 2), 0);
-        drop(service);
-
-        let mut service = open_limited(&store, ceiling, window);
-        assert_eq!(service.window_spend(CALLER, 5), 3 * FIXTURE_USAGE_COST);
-        assert_eq!(run_window(&mut service, "again", 20_100), 0);
-        assert_eq!(
-            refusal_at(&mut service, "last", 20_200, MAX_COST),
-            Refusal::ClockBehindAdmissionWindow
-        );
-    }
-
-    #[test]
-    fn a_clock_jumping_forward_opens_a_fresh_window() {
-        let window = 10_000;
-        let ceiling = reservation() + 2 * FIXTURE_USAGE_COST;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, ceiling, window);
-        assert_eq!(run_window(&mut service, "early", 20_000), 3);
-        assert_eq!(run_window(&mut service, "later", 90_000), 3);
-        assert_eq!(service.window_spend(CALLER, 9), 3 * FIXTURE_USAGE_COST);
-        assert_eq!(service.window_spend(CALLER, 2), 0);
-    }
-
-    /// Hand-written rates: the long tier is cheaper on input and dearer on
-    /// output, so neither tier alone bounds both.
-    fn mixed_long_tier(above_prompt_tokens: u64) -> ModelPrice {
-        ModelPrice {
-            rates: Rates {
-                input: 3_000_000,
-                cache_write_short: 3_750_000,
-                cache_write_long: 6_000_000,
-                cache_read: 300_000,
-                output: 15_000_000,
-            },
-            long_context: Some(LongContext {
-                above_prompt_tokens,
-                rates: Rates {
-                    input: 1_000_000,
-                    cache_write_short: 1_250_000,
-                    cache_write_long: 2_000_000,
-                    cache_read: 100_000,
-                    output: 30_000_000,
-                },
-            }),
-            overhead_tokens: 100,
-        }
-    }
-
-    #[test]
-    fn the_reservation_is_the_dearer_of_both_tiers_class_by_class() {
-        let request = request();
-        let bound = wire_encode(&request).unwrap().len() as u64 + 100;
-        // Above the threshold: input at the base tier's dearer rate, output at
-        // the long tier's.
-        let dearest = Rates {
-            input: 3_000_000,
-            cache_write_short: 3_750_000,
-            cache_write_long: 6_000_000,
-            cache_read: 300_000,
-            output: 30_000_000,
-        };
-        assert_eq!(
-            reservation_micro_usd(&mixed_long_tier(bound - 1), &request).unwrap(),
-            Some(expected_reservation(&request, &dearest, 100))
-        );
-        // At the threshold the base tier alone applies.
-        assert_eq!(
-            reservation_micro_usd(&mixed_long_tier(bound), &request).unwrap(),
-            Some(expected_reservation(&request, &fixture_price().rates, 100))
-        );
-    }
-
-    fn xorshift(state: &mut u64) -> u64 {
-        *state ^= *state << 13;
-        *state ^= *state >> 7;
-        *state ^= *state << 17;
-        *state
-    }
-
-    fn random_rates(state: &mut u64) -> Rates {
-        Rates {
-            input: xorshift(state) % 50_000_000,
-            cache_write_short: xorshift(state) % 50_000_000,
-            cache_write_long: xorshift(state) % 50_000_000,
-            cache_read: xorshift(state) % 50_000_000,
-            output: xorshift(state) % 200_000_000,
-        }
-    }
-
-    #[test]
-    fn the_property_test_generator_is_xorshift64_within_the_rate_bounds() {
-        let mut s = 0x9E37_79B9_7F4A_7C15u64;
-        let first: Vec<u64> = (0..3).map(|_| xorshift(&mut s)).collect();
-        assert_eq!(
-            first,
-            [0xdc1b77ae0bf34dad, 0x64f0eeb9026e6076, 0x7b07ce91e5906136]
-        );
-        for _ in 0..200 {
-            let rates = random_rates(&mut s);
-            for (rate, bound) in [
-                (rates.input, 50_000_000),
-                (rates.cache_write_short, 50_000_000),
-                (rates.cache_write_long, 50_000_000),
-                (rates.cache_read, 50_000_000),
-                (rates.output, 200_000_000),
-            ] {
-                assert!(rate < bound);
-            }
-        }
-    }
-
-    /// Any usage within the bound the reservation assumes (prompt tokens no
-    /// more than encoded bytes plus overhead, output no more than the cap)
-    /// costs no more than the reservation, whatever the price shape.
-    #[test]
-    fn no_usage_within_the_bound_prices_above_the_reservation() {
-        let mut s = 0x9E37_79B9_7F4A_7C15u64;
-        for _ in 0..5_000 {
-            let mut request = request();
-            request.max_output_tokens = (xorshift(&mut s) % 100_000) as u32;
-            request.cache_retention = match xorshift(&mut s) % 3 {
-                0 => None,
-                1 => Some(CacheRetention::Short),
-                _ => Some(CacheRetention::Long),
-            };
-            request.instructions = "x".repeat((xorshift(&mut s) % 3000) as usize);
-            let overhead = xorshift(&mut s) % 5_000;
-            let bound = wire_encode(&request).unwrap().len() as u64 + overhead;
-            let long_context = (xorshift(&mut s).is_multiple_of(2)).then(|| LongContext {
-                above_prompt_tokens: xorshift(&mut s) % (2 * bound + 1),
-                rates: random_rates(&mut s),
-            });
-            let price = ModelPrice {
-                rates: random_rates(&mut s),
-                long_context,
-                overhead_tokens: overhead,
-            };
-            let reserved = reservation_micro_usd(&price, &request).unwrap().unwrap();
-            let prompt = if xorshift(&mut s).is_multiple_of(4) {
-                bound
-            } else {
-                xorshift(&mut s) % (bound + 1)
-            };
-            let a = xorshift(&mut s) % (prompt + 1);
-            let b = xorshift(&mut s) % (prompt - a + 1);
-            let max_output = u64::from(request.max_output_tokens);
-            let output = if xorshift(&mut s).is_multiple_of(4) {
-                max_output
-            } else {
-                xorshift(&mut s) % (max_output + 1)
-            };
-            let cost = cost_micro_usd(
-                &price,
-                &usage(a, b, prompt - a - b, output),
-                request.cache_retention,
-            );
-            assert!(
-                cost <= reserved,
-                "{price:?} {a} {b} {output}: {cost} > {reserved}"
-            );
-        }
-    }
-
-    #[test]
-    fn another_callers_live_request_does_not_keep_this_callers_old_window() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        // Ghostlight holds a request live in window 0 throughout.
-        let other = invocation_for("ghostlight-yggdrasil", "request-1");
-        let envelope =
-            encrypt_invocation(&other, &security("ghostlight-distinct-test-key")).unwrap();
-        let TransportAdmission::Execute(_held) = service.begin(&envelope, 1_000, FRAME).unwrap()
-        else {
-            panic!("ghostlight should have executed");
-        };
-        for (id, now) in [("first", 1_000), ("second", WINDOW_MS + 1_000)] {
-            let claim = claim_at(&mut service, id, now);
-            let result = text_result(claim.call(), "done");
-            service.complete(*claim, result, FRAME).unwrap();
-        }
-        assert_eq!(service.window_spend(CALLER, 0), 0);
-        assert_eq!(service.window_spend(CALLER, 1), FIXTURE_USAGE_COST);
-        assert_eq!(
-            service.window_spend("ghostlight-yggdrasil", 0),
-            reservation()
-        );
-    }
-
-    #[test]
-    fn a_result_bound_to_another_request_is_charged_the_reservation() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let one = claim_at(&mut service, "request-1", 1_000);
-        let two = claim_at(&mut service, "request-2", 1_000);
-        // request-2's result reports no usage at all; request-1 must not be
-        // billed what another request's backend claims to have spent.
-        let foreign = two.call().transported(
-            Vec::new(),
-            TransportOutcome::Failed {
-                kind: FailureKind::Provider,
-                message: String::new(),
-                usage: Some(usage(0, 0, 0, 0)),
-            },
-        );
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let response = service.complete(*one, foreign, FRAME).unwrap();
-        assert_eq!(
-            receipt_of(&response, &invocation).provider,
-            STAND_IN_PROVIDER
-        );
-        assert_eq!(charged_of(&service, "request-1"), reservation());
-        // request-1 is charged the reservation; request-2 still holds its own.
-        assert_eq!(service.window_spend(CALLER, 0), 2 * reservation());
-        drop(two);
-    }
-
-    #[test]
-    fn a_bound_malformed_overrun_is_charged_its_true_cost_and_reaches_the_ceiling() {
-        let reserved = reservation();
-        for case in 0..3 {
-            let store = TestStore::new();
-            let mut service = open_limited(&store, 2 * reserved, 3_600_000);
-            let claim = claim_at(&mut service, "request-1", 1_000);
-            let mut result = overrun_result(claim.call(), "done");
-            let TransportDisposition::Transported { events, receipt } = &mut result.disposition
-            else {
-                unreachable!();
-            };
-            match case {
-                0 => events[0].sequence = 1,
-                1 => {
-                    let TransportOutcome::Completed { usage, .. } = &receipt.outcome else {
-                        unreachable!();
-                    };
-                    receipt.outcome = TransportOutcome::Failed {
-                        kind: FailureKind::Provider,
-                        message: String::new(),
-                        usage: Some(usage.clone()),
-                    };
-                }
-                _ => receipt.provider = String::new(),
-            }
-            let invocation = invocation_at("request-1", 1_000, MAX_COST);
-            assert!(result.validate_against(&invocation).is_err(), "{case}");
-            let response = service.complete(*claim, result, FRAME).unwrap();
-            // The caller is told the result was refused; the bill is its true cost.
-            assert_eq!(
-                receipt_of(&response, &invocation).provider,
-                STAND_IN_PROVIDER,
-                "{case}"
-            );
-            assert_eq!(charged_of(&service, "request-1"), OVERRUN_COST, "{case}");
-            assert_eq!(service.window_spend(CALLER, 0), OVERRUN_COST, "{case}");
-            assert_eq!(
-                refusal_at(&mut service, "request-2", 1_000, MAX_COST),
-                Refusal::SpendCeiling,
-                "{case}"
-            );
-        }
-    }
-
-    #[test]
-    fn each_binding_check_alone_sends_a_result_to_the_reservation() {
-        let reserved = reservation();
-        // Every other field is valid and the usage overruns: a guard that
-        // ignored the one changed identity field would charge 30,000,000.
-        for case in 0..4 {
-            let store = TestStore::new();
-            let mut service = open_limited(&store, 2 * reserved, 3_600_000);
-            let claim = claim_at(&mut service, "request-1", 1_000);
-            let mut result = overrun_result(claim.call(), "done");
-            let TransportDisposition::Transported { receipt, .. } = &mut result.disposition else {
-                unreachable!();
-            };
-            match case {
-                0 => result.request_id = "request-2".to_string(),
-                1 => result.caller_runtime_id = "another-caller".to_string(),
-                2 => receipt.request_id = "request-2".to_string(),
-                _ => receipt.caller_runtime_id = "another-caller".to_string(),
-            }
-            service.complete(*claim, result, FRAME).unwrap();
-            assert_eq!(charged_of(&service, "request-1"), reserved, "{case}");
-            assert_eq!(service.window_spend(CALLER, 0), reserved, "{case}");
-        }
-    }
-
-    #[test]
-    fn a_result_that_is_not_transported_is_charged_the_reservation() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let refused = TransportResult::refused(&invocation, Refusal::Capacity);
-        service.complete(*claim, refused, FRAME).unwrap();
-        assert_eq!(charged_of(&service, "request-1"), reservation());
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-    }
-
-    #[test]
-    fn a_stepped_back_clock_admits_into_the_newest_window_not_an_older_live_one() {
-        let window = 10_000;
-        // Two live reservations fill window 9 (the newest); one live
-        // reservation leaves window 2 (older, still held) room for another.
-        // Request ids share a length, so every reservation is the same size.
-        let ceiling = reservation() + reservation() + reservation() / 2;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, ceiling, window);
-        let old = claim_at(&mut service, "request-a", 20_000);
-        let newest = [
-            claim_at(&mut service, "request-b", 90_000),
-            claim_at(&mut service, "request-c", 90_000),
-        ];
-        assert_eq!(service.window_spend(CALLER, 2), reservation());
-        assert_eq!(service.window_spend(CALLER, 9), 2 * reservation());
-        // The clock reads window 2 again. Window 2 would hold the request;
-        // the caller's window is the newest, which cannot.
-        assert_eq!(
-            refusal_at(&mut service, "request-d", 20_500, MAX_COST),
-            Refusal::ClockBehindAdmissionWindow
-        );
-        assert_eq!(service.window_spend(CALLER, 2), reservation());
-        assert_eq!(service.window_spend(CALLER, 9), 2 * reservation());
-        drop((old, newest));
-    }
-
-    #[test]
-    fn a_clock_behind_the_callers_window_is_refused_by_name_until_it_catches_up() {
-        let window = 10_000;
-        let ceiling = reservation() + 2 * FIXTURE_USAGE_COST;
-        let store = TestStore::new();
-        let mut service = open_limited(&store, ceiling, window);
-        assert_eq!(run_window(&mut service, "fill", 50_000), 3);
-        // Behind the full window: the cause is named, no slot is taken and
-        // nothing is reserved.
-        assert_eq!(
-            refusal_at(&mut service, "behind", 20_000, MAX_COST),
-            Refusal::ClockBehindAdmissionWindow
-        );
-        assert!(service.live.is_empty());
-        assert_eq!(service.window_spend(CALLER, 5), 3 * FIXTURE_USAGE_COST);
-        // At the window's first instant, and inside it, the clock is not
-        // behind: an honest ceiling.
-        assert_eq!(
-            refusal_at(&mut service, "at-start", 50_000, MAX_COST),
-            Refusal::SpendCeiling
-        );
-        assert_eq!(
-            refusal_at(&mut service, "inside", 50_500, MAX_COST),
-            Refusal::SpendCeiling
-        );
-        // Once the clock reaches the next window the caller is admitted.
-        assert_eq!(run_window(&mut service, "later", 60_000), 3);
-    }
-
-    #[test]
-    fn the_clock_behind_refusal_is_no_wider_than_the_widest_other_refusal() {
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
-        let sized = |refusal| {
-            wire_encode(&TransportResult::refused(&invocation, refusal))
-                .unwrap()
-                .len()
-        };
-        assert!(
-            sized(Refusal::ClockBehindAdmissionWindow)
-                <= sized(Refusal::ProviderDigestSubstitution)
-        );
-    }
-
-    // ---- spend readout ----
-
     fn readout_as(
         service: &TransportService,
         caller: &str,
         key: &str,
-        now: u64,
+        plan: PlanQuotaSnapshot,
         frame: usize,
-    ) -> Result<SpendReadout, ServiceError> {
-        let sealed = encrypt_spend_readout_request(caller, "readout-1", &security(key)).unwrap();
-        let answer = service.spend_readout(&sealed, now, PlanQuotaSnapshot::default(), frame)?;
+    ) -> Result<UsageReadout, ServiceError> {
+        let sealed = encrypt_usage_readout_request(caller, "readout-1", &security(key)).unwrap();
+        let answer = service.usage_readout(&sealed, 1_500, plan, frame)?;
         assert_eq!(answer.request_id, "readout-1");
-        Ok(decrypt_spend_readout(&answer, &security(key)).unwrap())
-    }
-
-    fn row<'a>(readout: &'a SpendReadout, caller: &str) -> &'a CallerSpend {
-        readout
-            .callers
-            .iter()
-            .find(|row| row.caller_id == caller)
-            .expect("the caller has a row")
+        Ok(decrypt_usage_readout(&answer, &security(key)).unwrap())
     }
 
     #[test]
-    fn spend_readout_reports_window() {
+    fn a_rejected_window_refuses_invoke_until_its_reset() {
         let store = TestStore::new();
         let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
+        let rejected = plan_of(1_000, "rejected", 10_000);
+        let (refused, invocation) = begin_under(&mut service, "request-1", 9_999, &rejected);
+        assert_eq!(refusal_of(refused, &invocation), Refusal::ProviderRejected);
+        // At the provider's own reset the refusal lifts, and it was never
+        // recorded: the same id is admitted.
+        assert!(matches!(
+            begin_under(&mut service, "request-1", 10_000, &rejected).0,
+            TransportAdmission::Execute(_)
+        ));
+    }
 
-        // In flight: the reservation is held, nothing is spent.
-        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
+    #[test]
+    fn high_utilization_refuses_nothing() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        for (n, status) in ["allowed", "allowed_warning"].into_iter().enumerate() {
+            let plan = plan_of(999, status, 1_000_000);
+            assert!(matches!(
+                begin_under(&mut service, &format!("request-{n}"), 1_000, &plan).0,
+                TransportAdmission::Execute(_)
+            ));
+        }
+    }
+
+    #[test]
+    fn a_recorded_answer_replays_while_the_provider_rejects() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let (claim, invocation) = claim_for(&mut service, "request-1");
+        let result = text_result(claim.call(), "done");
+        let answer = service.complete(*claim, result, FRAME).unwrap();
+        let rejected = plan_of(1_000, "rejected", 1_000_000);
+        let again = service
+            .begin(&raw_envelope(&invocation), 1_000, &rejected, FRAME)
+            .unwrap();
+        assert_eq!(again, TransportAdmission::Reply(answer));
+    }
+
+    #[test]
+    fn a_dollar_era_replay_store_is_refused_at_open() {
+        use cultcache_rs::{CultCache, DatabaseEntry, OwnedRedbMessagePackBackingStore};
+
+        // A record under the dollar era's type id, in the dollar era's shape.
+        #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+        #[cultcache(type = "gamecult.model.replay_record.v2")]
+        struct DollarEraRecord {
+            #[cultcache(key = 0)]
+            caller_runtime_id: String,
+            #[cultcache(key = 1)]
+            charged: u64,
+        }
+
+        let store = TestStore::new();
+        {
+            let mut cache = CultCache::new();
+            cache.register_entry_type::<DollarEraRecord>().unwrap();
+            cache
+                .add_generic_backing_store(
+                    OwnedRedbMessagePackBackingStore::new(&store.path).unwrap(),
+                )
+                .unwrap();
+            cache
+                .put(
+                    "old".to_string(),
+                    &DollarEraRecord {
+                        caller_runtime_id: CALLER.to_string(),
+                        charged: 75,
+                    },
+                )
+                .unwrap();
+        }
+        assert!(matches!(
+            TransportService::open(
+                &store.path,
+                "fixture-sse",
+                [caller(CALLER, KEY, 1)],
+                5_000
+            ),
+            Err(ServiceError::ReplayStore(_))
+        ));
+    }
+
+    #[test]
+    fn the_usage_readout_is_the_plan_as_it_stands_and_changes_nothing() {
+        let store = TestStore::new();
+        let mut service = open_service(&store, 4);
+        let (claim, _) = claim_for(&mut service, "request-1");
+        let plan = plan_of(80, "allowed", 1_793_307_000_000);
+        // In flight, completed, asked by either caller: the same plan.
+        let readout = readout_as(&service, CALLER, KEY, plan.clone(), FRAME).unwrap();
         assert_eq!(readout.at_unix_ms, 1_500);
-        let mine = row(&readout, CALLER);
-        assert_eq!(mine.window_ms, WINDOW_MS);
-        assert_eq!(mine.ceiling_micro_usd, CEILING);
-        assert_eq!(
-            (mine.spent_micro_usd, mine.reserved_micro_usd),
-            (0, reservation())
-        );
-
-        // Settled: the charge replaces the reservation.
+        assert_eq!(readout.plan_quota, plan.windows);
         let result = text_result(claim.call(), "done");
         service.complete(*claim, result, FRAME).unwrap();
-        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
-        let mine = row(&readout, CALLER);
-        assert_eq!(
-            (mine.spent_micro_usd, mine.reserved_micro_usd),
-            (FIXTURE_USAGE_COST, 0)
-        );
-
-        // Every admitted caller has a row, in id order; the idle one is empty.
-        let ids: Vec<&str> = readout
-            .callers
-            .iter()
-            .map(|r| r.caller_id.as_str())
-            .collect();
-        assert_eq!(ids, ["epiphany-yggdrasil", "ghostlight-yggdrasil"]);
-        let idle = row(&readout, "ghostlight-yggdrasil");
-        assert_eq!((idle.spent_micro_usd, idle.reserved_micro_usd), (0, 0));
-    }
-
-    #[test]
-    fn any_admitted_caller_reads_every_callers_row() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        // Ghostlight asks, with its own key, and sees epiphany's spend.
-        let readout = readout_as(
+        let ghostlight = readout_as(
             &service,
             "ghostlight-yggdrasil",
             "ghostlight-distinct-test-key",
-            1_500,
+            plan.clone(),
             FRAME,
         )
         .unwrap();
-        assert_eq!(row(&readout, CALLER).spent_micro_usd, FIXTURE_USAGE_COST);
-        assert_eq!(row(&readout, "ghostlight-yggdrasil").spent_micro_usd, 0);
+        assert_eq!(ghostlight, readout);
         // A key that belongs to no admitted caller reads nothing.
-        assert!(readout_as(&service, "ghostlight-yggdrasil", KEY, 1_500, FRAME).is_err());
-    }
-
-    #[test]
-    fn a_claim_a_crash_left_reads_as_spent_not_reserved() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let _claim = claim_at(&mut service, "request-1", 1_000);
-        drop(service);
-        let service = open_service(&store, 4);
-        let readout = readout_as(&service, CALLER, KEY, 1_500, FRAME).unwrap();
-        let mine = row(&readout, CALLER);
-        assert_eq!(
-            (mine.spent_micro_usd, mine.reserved_micro_usd),
-            (reservation(), 0)
-        );
-    }
-
-    #[test]
-    fn a_readout_reads_the_ledger_and_changes_nothing_in_it() {
-        let store = TestStore::new();
-        let mut service = open_service(&store, 4);
-        let claim = claim_at(&mut service, "request-1", 1_000);
-        // Two windows later: the caller's current window is empty, and
-        // looking must not prune the window the live claim settles into.
-        let later = 2 * WINDOW_MS + 5;
-        let readout = readout_as(&service, CALLER, KEY, later, FRAME).unwrap();
-        let mine = row(&readout, CALLER);
-        assert_eq!((mine.spent_micro_usd, mine.reserved_micro_usd), (0, 0));
-        assert_eq!(service.window_spend(CALLER, 0), reservation());
-        let result = text_result(claim.call(), "done");
-        service.complete(*claim, result, FRAME).unwrap();
-        assert_eq!(service.window_spend(CALLER, 0), FIXTURE_USAGE_COST);
+        assert!(readout_as(&service, "ghostlight-yggdrasil", KEY, plan, FRAME).is_err());
     }
 
     #[test]
@@ -3880,11 +2100,11 @@ mod tests {
         let store = TestStore::new();
         let service = open_service(&store, 4);
         let sealed = |caller: &str, key: &str| {
-            encrypt_spend_readout_request(caller, "readout-1", &security(key)).unwrap()
+            encrypt_usage_readout_request(caller, "readout-1", &security(key)).unwrap()
         };
         assert_eq!(
             service
-                .spend_readout(
+                .usage_readout(
                     &sealed("nobody", KEY),
                     1,
                     PlanQuotaSnapshot::default(),
@@ -3895,7 +2115,7 @@ mod tests {
         );
         assert_eq!(
             service
-                .spend_readout(
+                .usage_readout(
                     &sealed(CALLER, "another-key"),
                     1,
                     PlanQuotaSnapshot::default(),
@@ -3904,10 +2124,10 @@ mod tests {
                 .unwrap_err(),
             ServiceError::Encryption
         );
-        let invocation = invocation_at("request-1", 1_000, MAX_COST);
+        let invocation = invocation_for(CALLER, "request-1");
         assert_eq!(
             service
-                .spend_readout(
+                .usage_readout(
                     &raw_envelope(&invocation),
                     1,
                     PlanQuotaSnapshot::default(),
@@ -3923,9 +2143,19 @@ mod tests {
         let store = TestStore::new();
         let service = open_service(&store, 4);
         assert_eq!(
-            readout_as(&service, CALLER, KEY, 1_000, 64).unwrap_err(),
+            readout_as(&service, CALLER, KEY, PlanQuotaSnapshot::default(), 64).unwrap_err(),
             ServiceError::FrameBound
         );
-        assert!(readout_as(&service, CALLER, KEY, 1_000, FRAME).is_ok());
+        assert!(readout_as(&service, CALLER, KEY, PlanQuotaSnapshot::default(), FRAME).is_ok());
+    }
+
+    #[test]
+    fn the_connector_service_has_exactly_two_operations() {
+        assert_eq!(Operation::from_name("readout"), None);
+        assert_eq!(Operation::from_name("invoke"), Some(Operation::Invoke));
+        assert_eq!(
+            Operation::from_name("usage_readout"),
+            Some(Operation::UsageReadout)
+        );
     }
 }
diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index 03f34dc..f677ae0 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -1,27 +1,23 @@
-//! A credential lease: a Self run's or a Persona turn's reservation in the caller's spend window.
-//! The lease is one record of the same ledger a provider call reserves in, not
-//! a second ledger: it is claimed before anything is lent, counts against the
-//! window's ceiling while open, and settles to the true cost of what the run
-//! reports it used, per model and uncapped: a charge above the reservation is
-//! kept as the lease's overrun, and still counts against the window. A lease
-//! nothing settled is billed the whole reservation, as a call a crash left
-//! behind is.
+//! A credential lease: a Self run's or a Persona turn's hold on the token the
+//! connector lends. The lease is memory bound to its holder's open connection,
+//! not a record and not a charge: it decides `Busy` while it is held and
+//! nothing else. It ends when its holder lets go (`end_lease`), when the unit
+//! invocation it served ends, or when its expiry passes. Nothing is billed and
+//! nothing is reserved. The only usage-derived refusal is the provider's own
+//! (`ProviderRejected`), repeated with the provider's own expiry.
 
 use super::*;
 
-/// The request-id namespace of leases in a caller's replay records.
+/// The request-id namespace of leases.
 const LEASE_PREFIX: &str = "lease:";
 
-/// The most leases one Persona invocation may take in its life.
-const MAX_PERSONA_LEASES: u32 = 1024;
-
-/// Room kept in an identity for `:<n>`, `n` at most `MAX_PERSONA_LEASES`.
-const SEQUENCE_SUFFIX_BYTES: usize = 5;
+/// What a Persona turn's lease id adds to its invocation id, so a Persona
+/// lease and a Self lease of one caller and one invocation never share an id.
+const PERSONA_SUFFIX: &str = ":persona";
 
 /// Which kind of turn a lease serves. It is a property of the lease caller's
-/// configured row, never of a request. A Self run leases once per unit
-/// invocation; a Persona turn leases once per turn, so one live invocation
-/// leases in sequence, one open lease at a time.
+/// configured row, never of a request. A caller holds one Self lease at a
+/// time; a Persona turn holds one lease per live invocation, one at a time.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum LeaseTurn {
     SelfRun,
@@ -32,70 +28,17 @@ pub enum LeaseTurn {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LeaseGrant {
     pub lease_id: String,
-    pub reserved_micro_usd: u64,
 }
 
-/// What a run used of one model.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ModelUsage {
-    pub model: String,
-    pub usage: Usage,
-}
-
-/// What a settled lease was billed. `overrun_micro_usd` is how far the charge
-/// passed the reservation.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct LeaseSettlement {
-    pub billed_micro_usd: u64,
-    pub overrun_micro_usd: u64,
-}
-
-/// What a lease's settlement is billed on.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum LeaseUse<'a> {
-    /// No report: the whole reservation. A run that cannot say what it used
-    /// pays what was set aside for it.
-    Reservation,
-    /// The run's report. A report that names no use (an empty list) is no
-    /// report, and bills the reservation.
-    Reported(&'a [ModelUsage]),
-    /// The token was never lent, so nothing was used and nothing is billed.
-    NeverLent,
-}
-
-/// What `usage` costs at the table's prices: each entry at its model's price,
-/// and a model with no price at the dearest price the table holds, so an
-/// unknown name never bills less than any known one. `None` when the table
-/// prices nothing.
-fn lease_cost(prices: &PriceTable, usage: &[ModelUsage]) -> Option<u64> {
-    let dearest = |usage: &Usage| {
-        prices
-            .values()
-            .map(|price| cost_micro_usd(price, usage, None))
-            .max()
-    };
-    usage
-        .iter()
-        .map(|entry| match prices.get(&entry.model) {
-            Some(price) => Some(cost_micro_usd(price, &entry.usage, None)),
-            None => dearest(&entry.usage),
-        })
-        .try_fold(0_u64, |total, cost| Some(total.saturating_add(cost?)))
-}
-
-/// Why no lease was reserved. Nothing was written to the ledger.
+/// Why no lease was granted.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum LeaseRefusal {
-    /// The window's spend plus open reservations plus this one passes the
-    /// caller's ceiling.
-    SpendCeiling,
-    /// The reservation asked for is zero: a lease that bills nothing is a
-    /// free pass.
-    CostBound,
     UnknownCaller,
-    /// A Self run: the caller holds a Self lease already, or this invocation
-    /// leased before. A Persona turn: this invocation holds a lease now.
+    /// A Self run: the caller holds a Self lease now. A Persona turn: this
+    /// invocation holds a lease now.
     Busy,
+    /// The provider is refusing right now and has said until when.
+    ProviderRejected,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -105,264 +48,86 @@ pub enum LeaseAdmission {
 }
 
 impl TransportService {
-    /// Reserves `max_cost_micro_usd` in `caller_runtime_id`'s current window
-    /// for the unit invocation `invocation_id`. A Self run leases once per
-    /// invocation, as `lease:<invocation>`, and one Self lease is open per
-    /// caller. A Persona turn takes the next free sequence of its invocation
-    /// as `lease:<invocation>:<n>`, one open at a time; a Persona lease never
-    /// blocks or is blocked by the caller's Self lease. A ledger that cannot
-    /// be written answers `Err` and reserves nothing. A lease takes no
-    /// request slot.
+    /// Grants `caller_runtime_id` a lease for the unit invocation
+    /// `invocation_id` until `expires_at_unix_ms`. A Self run's lease is
+    /// `lease:<invocation>` and one is open per caller; a Persona turn's is
+    /// `lease:<invocation>:persona`, one open per invocation; neither blocks
+    /// the other. A lease takes no request slot. `plan` is the backend's plan
+    /// quota as it stands: a provider that is refusing right now refuses the
+    /// lease. A lease past its expiry no longer holds anything.
     pub fn begin_lease(
         &mut self,
         caller_runtime_id: &str,
         turn: LeaseTurn,
         invocation_id: &str,
-        max_cost_micro_usd: u64,
         expires_at_unix_ms: u64,
         now_unix_ms: u64,
+        plan: &PlanQuotaSnapshot,
     ) -> Result<LeaseAdmission, ServiceError> {
-        let Some(caller) = self.callers.get(caller_runtime_id) else {
+        if !self.callers.contains_key(caller_runtime_id) {
             return Ok(LeaseAdmission::Refused(LeaseRefusal::UnknownCaller));
-        };
-        let spend_ceiling = caller.spend_ceiling_micro_usd;
-        let spend_window_ms = caller.spend_window_ms;
-        let connection_key_epoch = caller.connection_key_epoch;
+        }
         require_id(invocation_id, "invocation_id")?;
         let suffix = match turn {
-            LeaseTurn::SelfRun => 0,
-            LeaseTurn::PersonaTurn => SEQUENCE_SUFFIX_BYTES,
+            LeaseTurn::SelfRun => "",
+            LeaseTurn::PersonaTurn => PERSONA_SUFFIX,
         };
-        if invocation_id.len() + LEASE_PREFIX.len() + suffix > MAX_IDENTITY_BYTES {
+        let lease_id = format!("{LEASE_PREFIX}{invocation_id}{suffix}");
+        if lease_id.len() > MAX_IDENTITY_BYTES {
             return Err(ContractError::Invalid("invocation_id").into());
         }
-        if max_cost_micro_usd == 0 {
-            return Ok(LeaseAdmission::Refused(LeaseRefusal::CostBound));
-        }
-        let identity = match turn {
-            LeaseTurn::SelfRun => {
-                let identity = RequestIdentity {
-                    caller_runtime_id: caller_runtime_id.to_string(),
-                    request_id: format!("{LEASE_PREFIX}{invocation_id}"),
-                };
-                let holding = self.live.iter().any(|(held, request)| {
-                    request.lease == Some(LeaseTurn::SelfRun)
-                        && held.caller_runtime_id == caller_runtime_id
-                });
-                if holding
-                    || self
-                        .replay_store
-                        .get::<ReplayRecord>(&replay_key(&identity))
-                        .map_err(replay_store_error)?
-                        .is_some()
-                {
-                    return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
-                }
-                identity
-            }
-            LeaseTurn::PersonaTurn => {
-                let mut free = None;
-                for sequence in 1..=MAX_PERSONA_LEASES {
-                    let identity = RequestIdentity {
-                        caller_runtime_id: caller_runtime_id.to_string(),
-                        request_id: format!("{LEASE_PREFIX}{invocation_id}:{sequence}"),
-                    };
-                    if self.live.contains_key(&identity) {
-                        return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
-                    }
-                    if self
-                        .replay_store
-                        .get::<ReplayRecord>(&replay_key(&identity))
-                        .map_err(replay_store_error)?
-                        .is_none()
-                    {
-                        free = Some(identity);
-                        break;
-                    }
-                }
-                let Some(identity) = free else {
-                    return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
-                };
-                identity
-            }
-        };
-        let key = replay_key(&identity);
-        let admitted_at_unix_ms = admission_clock(
-            &self.window_spend,
-            caller_runtime_id,
-            now_unix_ms,
-            spend_window_ms,
-        );
-        let window = admitted_at_unix_ms / spend_window_ms;
-        prune_windows(
-            &mut self.window_spend,
-            &self.live,
-            caller_runtime_id,
-            window,
-        );
-        if self
-            .window_spend(caller_runtime_id, window)
-            .saturating_add(max_cost_micro_usd)
-            > spend_ceiling
-        {
-            return Ok(LeaseAdmission::Refused(LeaseRefusal::SpendCeiling));
-        }
-        let mut digest = Sha256::new();
-        digest.update(b"claude_lease_request");
-        digest.update((invocation_id.len() as u64).to_be_bytes());
-        digest.update(invocation_id.as_bytes());
-        digest.update(max_cost_micro_usd.to_be_bytes());
-        digest.update(expires_at_unix_ms.to_be_bytes());
-        let record = ReplayRecord {
-            caller_runtime_id: caller_runtime_id.to_string(),
-            request_id: identity.request_id.clone(),
-            connection_key_epoch,
-            invocation_sha256: digest.finalize().into(),
-            expires_at_unix_ms,
-            state: ReplayState::Active {
-                reserved_micro_usd: max_cost_micro_usd,
-            },
-            admitted_at_unix_ms,
-        };
-        // Reserving and claiming are one write, as for a call: a ledger that
-        // cannot be written lends nothing.
-        self.replay_store
-            .put(key, &record)
-            .map_err(replay_store_error)?;
-        add_spend(
-            &mut self.window_spend,
-            caller_runtime_id,
-            window,
-            0,
-            max_cost_micro_usd,
-        );
-        let lease_id = identity.request_id.clone();
-        self.live.insert(
-            identity,
-            LiveRequest {
-                window,
-                reserved_micro_usd: max_cost_micro_usd,
-                lease: Some(turn),
-            },
-        );
-        Ok(LeaseAdmission::Granted(LeaseGrant {
-            lease_id,
-            reserved_micro_usd: max_cost_micro_usd,
-        }))
-    }
-
-    /// Settles an open lease and returns what it was billed. A report bills
-    /// the true cost of every model's reported use, uncapped (the overrun is
-    /// recorded); no report, or an empty one, bills the whole reservation;
-    /// only a token never lent bills nothing. A failed ledger
-    /// write frees the caller's lease and keeps the reservation counted, as a
-    /// call's does.
-    pub fn settle_lease(
-        &mut self,
-        caller_runtime_id: &str,
-        lease_id: &str,
-        usage: LeaseUse<'_>,
-    ) -> Result<LeaseSettlement, ServiceError> {
+        self.leases
+            .retain(|_, lease| lease.expires_at_unix_ms > now_unix_ms);
         let identity = RequestIdentity {
             caller_runtime_id: caller_runtime_id.to_string(),
-            request_id: lease_id.to_string(),
+            request_id: lease_id.clone(),
         };
-        if self
-            .live
-            .get(&identity)
-            .is_none_or(|request| request.lease.is_none())
-        {
-            return Err(ServiceError::NoActiveRequest);
+        let busy = match turn {
+            LeaseTurn::SelfRun => self.leases.iter().any(|(held, lease)| {
+                lease.turn == LeaseTurn::SelfRun && held.caller_runtime_id == caller_runtime_id
+            }),
+            LeaseTurn::PersonaTurn => self.leases.contains_key(&identity),
+        };
+        if busy {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::Busy));
         }
-        let key = replay_key(&identity);
-        let active = self
-            .replay_store
-            .get::<ReplayRecord>(&key)
-            .map_err(replay_store_error)?
-            .ok_or(ServiceError::NoActiveRequest)?;
-        let ReplayState::Active { reserved_micro_usd } = active.state else {
-            return Err(ServiceError::ActiveRequestMismatch);
-        };
-        let caller = self
-            .callers
-            .get(caller_runtime_id)
-            .ok_or(ServiceError::CallerNotAdmitted)?;
-        let spend_window_ms = caller.spend_window_ms;
-        let charged_micro_usd = match usage {
-            LeaseUse::Reservation | LeaseUse::Reported([]) => reserved_micro_usd,
-            LeaseUse::NeverLent => 0,
-            LeaseUse::Reported(usage) => {
-                lease_cost(&self.prices, usage).unwrap_or(reserved_micro_usd)
-            }
-        };
-        let overrun_micro_usd = charged_micro_usd.saturating_sub(reserved_micro_usd);
-        let settled = ReplayRecord {
-            state: ReplayState::LeaseSettled {
-                charged_micro_usd,
-                overrun_micro_usd,
+        if provider_rejects(plan, now_unix_ms) {
+            return Ok(LeaseAdmission::Refused(LeaseRefusal::ProviderRejected));
+        }
+        self.leases.insert(
+            identity,
+            LiveLease {
+                turn,
+                expires_at_unix_ms,
             },
-            ..active.clone()
-        };
-        self.replay_store
-            .put(key, &settled)
-            .map_err(replay_store_error)
-            .inspect_err(|_| {
-                self.live.remove(&identity);
-            })?;
-        add_spend(
-            &mut self.window_spend,
-            caller_runtime_id,
-            active.admitted_at_unix_ms / spend_window_ms,
-            reserved_micro_usd,
-            charged_micro_usd,
         );
-        self.live.remove(&identity);
-        prune_to_latest(&mut self.window_spend, &self.live, caller_runtime_id);
-        Ok(LeaseSettlement {
-            billed_micro_usd: charged_micro_usd,
-            overrun_micro_usd,
-        })
+        Ok(LeaseAdmission::Granted(LeaseGrant { lease_id }))
+    }
+
+    /// Ends a lease its holder let go of. Ending one that is not held is a
+    /// no-op: a holder may close after its expiry already freed the lease.
+    pub fn end_lease(&mut self, caller_runtime_id: &str, lease_id: &str) {
+        self.leases.remove(&RequestIdentity {
+            caller_runtime_id: caller_runtime_id.to_string(),
+            request_id: lease_id.to_string(),
+        });
     }
 }
 
 #[cfg(test)]
 mod tests {
-    use std::sync::atomic::Ordering;
-
     use super::*;
     use crate::fixtures::*;
+    use crate::readout::PlanQuota;
 
     const CALLER: &str = "eureka";
     const KEY: &str = "lease-distinct-test-key";
     const NOW: u64 = 7_200_500;
 
-    fn open_with(store: impl CacheBackingStore + 'static, ceiling: u64) -> TransportService {
-        TransportService::with_store(
-            store,
-            "fixture-sse",
-            fixture_prices(),
-            [CallerAdmission::new(
-                CALLER,
-                KEY,
-                1,
-                ["gpt-5.4".to_string()],
-                1,
-                65_536,
-                32_768,
-                SpendCeiling(ceiling),
-                SpendWindowMs(WINDOW_MS),
-            )
-            .unwrap()],
-            5_000,
-        )
-        .unwrap()
-    }
-
-    fn open(store: &TestStore, ceiling: u64) -> TransportService {
+    fn open(store: &TestStore) -> TransportService {
         TransportService::open(
             &store.path,
             "fixture-sse",
-            fixture_prices(),
             [CallerAdmission::new(
                 CALLER,
                 KEY,
@@ -371,8 +136,6 @@ mod tests {
                 1,
                 65_536,
                 32_768,
-                SpendCeiling(ceiling),
-                SpendWindowMs(WINDOW_MS),
             )
             .unwrap()],
             5_000,
@@ -380,12 +143,37 @@ mod tests {
         .unwrap()
     }
 
-    fn lease(service: &mut TransportService, run: &str, cost: u64) -> LeaseAdmission {
+    fn none() -> PlanQuotaSnapshot {
+        PlanQuotaSnapshot::default()
+    }
+
+    fn window(permille: u32, status: &str, resets_at: u64) -> PlanQuotaSnapshot {
+        PlanQuotaSnapshot {
+            windows: vec![PlanQuota {
+                window: "five_hour".to_string(),
+                utilization_permille: Some(permille),
+                resets_at_unix_ms: resets_at,
+                status: status.to_string(),
+                observed_at_unix_ms: NOW,
+            }],
+        }
+    }
+
+    fn lease_in(
+        service: &mut TransportService,
+        turn: LeaseTurn,
+        run: &str,
+        plan: &PlanQuotaSnapshot,
+    ) -> LeaseAdmission {
         service
-            .begin_lease(CALLER, LeaseTurn::SelfRun, run, cost, NOW + 60_000, NOW)
+            .begin_lease(CALLER, turn, run, NOW + 60_000, NOW, plan)
             .unwrap()
     }
 
+    fn lease(service: &mut TransportService, run: &str) -> LeaseAdmission {
+        lease_in(service, LeaseTurn::SelfRun, run, &none())
+    }
+
     fn granted(admission: LeaseAdmission) -> LeaseGrant {
         match admission {
             LeaseAdmission::Granted(grant) => grant,
@@ -393,376 +181,226 @@ mod tests {
         }
     }
 
-    fn held(service: &TransportService) -> u64 {
-        service.window_spend(CALLER, NOW / WINDOW_MS)
-    }
-
-    fn output(tokens: u64) -> Vec<ModelUsage> {
-        used("gpt-5.4", tokens)
-    }
-
-    fn used(model: &str, tokens: u64) -> Vec<ModelUsage> {
-        vec![ModelUsage {
-            model: model.to_string(),
-            usage: Usage {
-                input_tokens: 0,
-                cache_read_tokens: 0,
-                cache_write_tokens: 0,
-                output_tokens: tokens,
-                reasoning_tokens: None,
-            },
-        }]
-    }
-
-    fn billed(settlement: LeaseSettlement) -> u64 {
-        settlement.billed_micro_usd
+    #[test]
+    fn a_lease_is_named_by_its_invocation() {
+        let store = TestStore::new();
+        let mut service = open(&store);
+        assert_eq!(granted(lease(&mut service, "run-1")).lease_id, "lease:run-1");
     }
 
     #[test]
-    fn a_lease_reserves_in_the_callers_window_and_names_what_it_holds() {
+    fn a_caller_holds_one_self_lease_at_a_time() {
         let store = TestStore::new();
-        let mut service = open(&store, 1_000);
-        let grant = granted(lease(&mut service, "run-1", 600));
-        assert_eq!(grant.reserved_micro_usd, 600);
-        assert_eq!(held(&service), 600);
+        let mut service = open(&store);
+        granted(lease(&mut service, "run-1"));
         assert_eq!(
-            billed(
-                service
-                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
-                    .unwrap()
-            ),
-            600
-        );
-    }
-
-    #[test]
-    fn the_window_ceiling_counts_open_and_settled_reservations_inclusively() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1_000);
-        let first = granted(lease(&mut service, "run-1", 600));
-        service
-            .settle_lease(CALLER, &first.lease_id, LeaseUse::Reservation)
-            .unwrap();
-        assert_eq!(
-            lease(&mut service, "run-2", 401),
-            LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
-        );
-        assert_eq!(held(&service), 600);
-        granted(lease(&mut service, "run-3", 400));
-        assert_eq!(held(&service), 1_000);
-    }
-
-    #[test]
-    fn a_caller_holds_one_lease_at_a_time_and_an_invocation_id_is_leased_once() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1_000_000);
-        let first = granted(lease(&mut service, "run-1", 100));
-        assert_eq!(
-            lease(&mut service, "run-2", 100),
+            lease(&mut service, "run-2"),
             LeaseAdmission::Refused(LeaseRefusal::Busy)
         );
-        service
-            .settle_lease(CALLER, &first.lease_id, LeaseUse::Reservation)
-            .unwrap();
         assert_eq!(
-            lease(&mut service, "run-1", 100),
+            lease(&mut service, "run-1"),
             LeaseAdmission::Refused(LeaseRefusal::Busy)
         );
-        granted(lease(&mut service, "run-2", 100));
     }
 
     #[test]
-    fn a_stranger_and_a_free_lease_are_refused_without_a_ledger_write() {
+    fn a_lease_ends_when_its_holder_closes() {
         let store = TestStore::new();
-        let mut service = open(&store, 1_000);
+        let mut service = open(&store);
+        let grant = granted(lease(&mut service, "run-1"));
+        service.end_lease(CALLER, &grant.lease_id);
+        // The same invocation may lease again: nothing remembers a closed
+        // lease, and nothing was billed for it.
+        granted(lease(&mut service, "run-1"));
+        service.end_lease(CALLER, "lease:not-held");
+        assert_eq!(
+            lease(&mut service, "run-2"),
+            LeaseAdmission::Refused(LeaseRefusal::Busy),
+            "ending a lease that is not held frees nothing else"
+        );
+    }
+
+    #[test]
+    fn a_lease_ends_at_its_expiry_without_its_holder() {
+        let store = TestStore::new();
+        let mut service = open(&store);
+        granted(
+            service
+                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-1", NOW + 10, NOW, &none())
+                .unwrap(),
+        );
         assert_eq!(
             service
-                .begin_lease("stranger", LeaseTurn::SelfRun, "run-1", 100, NOW + 1, NOW)
+                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-2", NOW + 99, NOW + 9, &none())
+                .unwrap(),
+            LeaseAdmission::Refused(LeaseRefusal::Busy),
+            "one millisecond before its expiry the lease still holds"
+        );
+        granted(
+            service
+                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-2", NOW + 99, NOW + 10, &none())
+                .unwrap(),
+        );
+    }
+
+    #[test]
+    fn a_stranger_is_refused() {
+        let store = TestStore::new();
+        let mut service = open(&store);
+        assert_eq!(
+            service
+                .begin_lease("stranger", LeaseTurn::SelfRun, "run-1", NOW + 1, NOW, &none())
                 .unwrap(),
             LeaseAdmission::Refused(LeaseRefusal::UnknownCaller)
         );
-        assert_eq!(
-            lease(&mut service, "run-1", 0),
-            LeaseAdmission::Refused(LeaseRefusal::CostBound)
-        );
-        assert_eq!(held(&service), 0);
-        // Nothing was claimed: the same run id leases once it asks sensibly.
-        granted(lease(&mut service, "run-1", 100));
     }
 
     #[test]
-    fn settlement_bills_the_true_cost_uncapped_and_records_the_overrun() {
+    fn a_persona_holds_one_lease_per_invocation_and_never_blocks_the_self_lease() {
         let store = TestStore::new();
-        let mut service = open(&store, 1_000_000);
-        // Output at 15 USD per million tokens: 10 tokens bill 150 micro-USD.
-        let small = granted(lease(&mut service, "run-1", 10_000));
-        let settled = service
-            .settle_lease(CALLER, &small.lease_id, LeaseUse::Reported(&output(10)[..]))
-            .unwrap();
-        assert_eq!(
-            (settled.billed_micro_usd, settled.overrun_micro_usd),
-            (150, 0)
-        );
-        assert_eq!(held(&service), 150);
-        // 1000 tokens bill 15_000: the reservation does not cap it, and the
-        // 5_000 past it is recorded as the overrun.
-        let big = granted(lease(&mut service, "run-2", 10_000));
-        let settled = service
-            .settle_lease(
-                CALLER,
-                &big.lease_id,
-                LeaseUse::Reported(&output(1_000)[..]),
-            )
-            .unwrap();
-        assert_eq!(
-            (settled.billed_micro_usd, settled.overrun_micro_usd),
-            (15_000, 5_000)
-        );
-        assert_eq!(held(&service), 15_150);
-    }
-
-    #[test]
-    fn settlement_prices_each_model_at_its_own_rate_and_an_unknown_model_at_the_dearest() {
-        let store = TestStore::new();
-        let cheap = ModelPrice {
-            rates: Rates {
-                input: 1_000_000,
-                cache_write_short: 1_000_000,
-                cache_write_long: 1_000_000,
-                cache_read: 1_000_000,
-                output: 2_000_000,
-            },
-            ..fixture_price()
+        let mut service = open(&store);
+        let persona = |service: &mut TransportService, run: &str| {
+            lease_in(service, LeaseTurn::PersonaTurn, run, &none())
         };
-        let prices = PriceTable::from([
-            ("gpt-5.4".to_string(), fixture_price()),
-            ("cheap".to_string(), cheap),
-        ]);
-        let mut service = TransportService::open(
-            &store.path,
-            "fixture-sse",
-            prices,
-            [CallerAdmission::new(
+        let first = granted(persona(&mut service, "turn-1"));
+        assert_eq!(first.lease_id, "lease:turn-1:persona");
+        assert_eq!(
+            persona(&mut service, "turn-1"),
+            LeaseAdmission::Refused(LeaseRefusal::Busy)
+        );
+        granted(persona(&mut service, "turn-2"));
+        granted(lease(&mut service, "turn-1"));
+        service.end_lease(CALLER, &first.lease_id);
+        granted(persona(&mut service, "turn-1"));
+    }
+
+    #[test]
+    fn a_rejected_window_refuses_invoke_and_lease_until_its_reset() {
+        let store = TestStore::new();
+        let mut service = open(&store);
+        let rejected = window(1_000, "rejected", NOW + 5_000);
+        assert_eq!(
+            lease_in(&mut service, LeaseTurn::SelfRun, "run-1", &rejected),
+            LeaseAdmission::Refused(LeaseRefusal::ProviderRejected)
+        );
+        let call = |service: &mut TransportService, now: u64, plan: &PlanQuotaSnapshot| {
+            let mut asked = request();
+            asked.request_id = format!("call-{now}");
+            let invocation =
+                TransportInvocation::new(CALLER, now + 1_000, [7; 32], asked).unwrap();
+            let sealed = crate::envelope::encrypt_message(
                 CALLER,
-                KEY,
-                1,
-                ["gpt-5.4".to_string()],
-                1,
-                65_536,
-                32_768,
-                SpendCeiling(1_000_000),
-                SpendWindowMs(WINDOW_MS),
+                invocation.request_id(),
+                crate::envelope::EnvelopeKind::Invocation,
+                &crate::contract::wire_encode(&invocation).unwrap(),
+                &security(KEY),
             )
-            .unwrap()],
-            5_000,
-        )
-        .unwrap();
-        let mixed: Vec<ModelUsage> = [("gpt-5.4", 10), ("cheap", 10), ("unheard-of", 10)]
-            .into_iter()
-            .flat_map(|(model, tokens)| used(model, tokens))
-            .collect();
-        let grant = granted(lease(&mut service, "run-1", 10_000));
-        // 10 tokens at 15, 10 at 2, and 10 at the dearest (15) per million.
+            .unwrap();
+            let TransportAdmission::Reply(reply) =
+                service.begin(&sealed, now, plan, 1 << 20).unwrap()
+            else {
+                return None;
+            };
+            let result = crate::envelope::decrypt_result(&reply, &security(KEY)).unwrap();
+            match result.disposition {
+                TransportDisposition::Refused { refusal } => Some(refusal),
+                other => panic!("unexpected {other:?}"),
+            }
+        };
         assert_eq!(
-            billed(
-                service
-                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&mixed[..]))
-                    .unwrap()
-            ),
-            150 + 20 + 150
+            call(&mut service, NOW, &rejected),
+            Some(Refusal::ProviderRejected)
         );
-        // A run that reports no use pays the reservation, not nothing.
-        let grant = granted(lease(&mut service, "run-2", 10_000));
         assert_eq!(
-            billed(
-                service
-                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&[]))
-                    .unwrap()
-            ),
-            10_000
+            call(&mut service, NOW + 4_999, &rejected),
+            Some(Refusal::ProviderRejected)
         );
-    }
-
-    #[test]
-    fn settling_an_empty_report_cannot_free_the_reservation() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1_000);
-        let grant = granted(lease(&mut service, "run-1", 600));
-        assert_eq!(
-            billed(
-                service
-                    .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&[]))
-                    .unwrap()
-            ),
-            600
-        );
-        assert_eq!(held(&service), 600);
+        assert_eq!(call(&mut service, NOW + 5_000, &rejected), None);
         assert!(matches!(
-            lease(&mut service, "run-2", 1_000),
-            LeaseAdmission::Refused(LeaseRefusal::SpendCeiling)
+            service
+                .begin_lease(
+                    CALLER,
+                    LeaseTurn::SelfRun,
+                    "run-1",
+                    NOW + 9_000,
+                    NOW + 5_000,
+                    &rejected
+                )
+                .unwrap(),
+            LeaseAdmission::Granted(_)
         ));
     }
 
     #[test]
-    fn a_token_never_lent_bills_nothing_and_frees_the_window() {
+    fn high_utilization_refuses_nothing() {
         let store = TestStore::new();
-        let mut service = open(&store, 1_000);
-        let grant = granted(lease(&mut service, "run-1", 600));
-        let settled = service
-            .settle_lease(CALLER, &grant.lease_id, LeaseUse::NeverLent)
-            .unwrap();
-        assert_eq!(
-            (settled.billed_micro_usd, settled.overrun_micro_usd),
-            (0, 0)
-        );
-        assert_eq!(held(&service), 0);
-        granted(lease(&mut service, "run-2", 1_000));
-    }
-
-    #[test]
-    fn a_lease_settles_once() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1_000_000);
-        let grant = granted(lease(&mut service, "run-1", 100));
-        service
-            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
-            .unwrap();
-        assert!(matches!(
-            service.settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation),
-            Err(ServiceError::NoActiveRequest)
+        let mut service = open(&store);
+        let full = window(999, "allowed", NOW + 5_000);
+        granted(lease_in(&mut service, LeaseTurn::SelfRun, "run-1", &full));
+        let warned = window(1_000, "allowed_warning", NOW + 5_000);
+        granted(lease_in(
+            &mut service,
+            LeaseTurn::PersonaTurn,
+            "turn-1",
+            &warned,
         ));
-        assert_eq!(held(&service), 100);
     }
 
     #[test]
-    fn a_lease_left_open_by_a_crash_counts_at_its_reservation_after_restart() {
+    fn an_invocation_id_is_bounded_so_its_lease_id_fits_an_identity() {
         let store = TestStore::new();
-        let mut service = open(&store, 1_000_000);
-        granted(lease(&mut service, "run-1", 700));
-        drop(service);
-        let service = open(&store, 1_000_000);
-        assert_eq!(held(&service), 700);
+        let mut service = open(&store);
+        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len());
+        let grant = granted(lease(&mut service, &longest));
+        assert_eq!(grant.lease_id.len(), MAX_IDENTITY_BYTES);
+        assert!(lease_try(&mut service, LeaseTurn::SelfRun, &format!("{longest}r")).is_err());
     }
 
     #[test]
-    fn a_ledger_that_cannot_be_written_lends_nothing() {
-        let flaky = FlakyStore::new(1_000);
-        let allowance = flaky.allowance();
-        let mut service = open_with(flaky, 1_000_000);
-        allowance.store(0, Ordering::SeqCst);
-        assert!(
-            service
-                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-1", 100, NOW + 1, NOW)
-                .is_err()
-        );
-        assert_eq!(held(&service), 0);
-        allowance.store(1_000, Ordering::SeqCst);
-        granted(lease(&mut service, "run-1", 100));
+    fn a_persona_invocation_id_leaves_room_for_its_suffix() {
+        let store = TestStore::new();
+        let mut service = open(&store);
+        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len() - PERSONA_SUFFIX.len());
+        let grant = granted(lease_in(&mut service, LeaseTurn::PersonaTurn, &longest, &none()));
+        assert_eq!(grant.lease_id.len(), MAX_IDENTITY_BYTES);
+        assert!(lease_try(&mut service, LeaseTurn::PersonaTurn, &format!("{longest}r")).is_err());
     }
 
-    #[test]
-    fn a_failed_settle_write_frees_the_lease_and_keeps_the_reservation_counted() {
-        let flaky = FlakyStore::new(1_000);
-        let allowance = flaky.allowance();
-        let mut service = open_with(flaky, 1_000_000);
-        let grant = granted(lease(&mut service, "run-1", 100));
-        allowance.store(0, Ordering::SeqCst);
-        assert!(
-            service
-                .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&output(1)[..]))
-                .is_err()
-        );
-        assert_eq!(held(&service), 100);
-        allowance.store(1_000, Ordering::SeqCst);
-        granted(lease(&mut service, "run-2", 100));
-    }
-
-    fn begin_call(service: &mut TransportService, id: &str) -> TransportAdmission {
-        let mut call = request();
-        call.request_id = id.to_string();
-        let invocation =
-            TransportInvocation::new(CALLER, NOW + 1_000, [7; 32], MAX_COST, call).unwrap();
-        let sealed = crate::envelope::encrypt_message(
-            CALLER,
-            id,
-            crate::envelope::EnvelopeKind::Invocation,
-            &crate::contract::wire_encode(&invocation).unwrap(),
-            &security(KEY),
-        )
-        .unwrap();
-        service.begin(&sealed, NOW, 1 << 20).unwrap()
+    fn lease_try(
+        service: &mut TransportService,
+        turn: LeaseTurn,
+        run: &str,
+    ) -> Result<LeaseAdmission, ServiceError> {
+        service.begin_lease(CALLER, turn, run, NOW + 60_000, NOW, &none())
     }
 
     #[test]
     fn a_lease_takes_no_request_slot_from_the_callers_calls() {
         // The caller admits one concurrent call; an open lease must not use it.
         let store = TestStore::new();
-        let mut service = open(&store, 1 << 40);
-        granted(lease(&mut service, "run-1", 100));
-        match begin_call(&mut service, "call-1") {
-            TransportAdmission::Execute(_) => {}
-            TransportAdmission::Reply(_) => panic!("the lease held the call's slot"),
-        }
-    }
-
-    #[test]
-    fn a_call_in_flight_does_not_make_the_caller_busy_for_a_lease() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1 << 40);
+        let mut service = open(&store);
+        granted(lease(&mut service, "run-1"));
+        let mut call = request();
+        call.request_id = "call-1".to_string();
+        let invocation = TransportInvocation::new(CALLER, NOW + 1_000, [7; 32], call).unwrap();
+        let sealed = crate::envelope::encrypt_message(
+            CALLER,
+            "call-1",
+            crate::envelope::EnvelopeKind::Invocation,
+            &crate::contract::wire_encode(&invocation).unwrap(),
+            &security(KEY),
+        )
+        .unwrap();
         assert!(matches!(
-            begin_call(&mut service, "call-1"),
+            service.begin(&sealed, NOW, &none(), 1 << 20).unwrap(),
             TransportAdmission::Execute(_)
         ));
-        granted(lease(&mut service, "run-1", 100));
-    }
-
-    #[test]
-    fn an_invocation_id_is_bounded_so_its_lease_id_fits_an_identity() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1 << 40);
-        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len());
-        let grant = granted(lease(&mut service, &longest, 100));
-        assert_eq!(grant.lease_id.len(), MAX_IDENTITY_BYTES);
-        service
-            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reservation)
-            .unwrap();
-        assert!(
-            service
-                .begin_lease(
-                    CALLER,
-                    LeaseTurn::SelfRun,
-                    &format!("{longest}r"),
-                    100,
-                    NOW + 1,
-                    NOW
-                )
-                .is_err()
-        );
-    }
-
-    #[test]
-    fn a_persona_invocation_id_leaves_room_for_its_sequence() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1 << 40);
-        let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len() - SEQUENCE_SUFFIX_BYTES);
-        let persona = |service: &mut TransportService, id: &str| {
-            service.begin_lease(CALLER, LeaseTurn::PersonaTurn, id, 100, NOW + 60_000, NOW)
-        };
-        let grant = granted(persona(&mut service, &longest).unwrap());
-        assert!(grant.lease_id.len() <= MAX_IDENTITY_BYTES);
-        assert!(persona(&mut service, &format!("{longest}r")).is_err());
-    }
-
-    #[test]
-    fn a_settled_lease_leaves_its_charge_not_its_reservation_across_a_restart() {
-        let store = TestStore::new();
-        let mut service = open(&store, 1_000_000);
-        let grant = granted(lease(&mut service, "run-1", 10_000));
-        service
-            .settle_lease(CALLER, &grant.lease_id, LeaseUse::Reported(&output(10)[..]))
-            .unwrap();
-        drop(service);
-        let service = open(&store, 1_000_000);
-        assert_eq!(held(&service), 150);
+        // And a call in flight does not make the caller busy for a lease.
+        granted(lease_in(
+            &mut service,
+            LeaseTurn::PersonaTurn,
+            "turn-1",
+            &none(),
+        ));
     }
 }
diff --git a/crates/model-connector/tests/fixtures/wire_v3/README.md b/crates/model-connector/tests/fixtures/wire_v4/README.md
similarity index 74%
rename from crates/model-connector/tests/fixtures/wire_v3/README.md
rename to crates/model-connector/tests/fixtures/wire_v4/README.md
index 2751c8f..523ca3c 100644
--- a/crates/model-connector/tests/fixtures/wire_v3/README.md
+++ b/crates/model-connector/tests/fixtures/wire_v4/README.md
@@ -1,6 +1,6 @@
-# wire_v3 fixtures
+# wire_v4 fixtures
 
-The named-MessagePack bytes of the v3 documents and one sealed carriage frame,
+The named-MessagePack bytes of the v4 documents and one sealed carriage frame,
 produced by the kit at the revision that added them. They pin drift; the types in
 `src/contract.rs` own the shape, and `schemas/` publishes it.
 
@@ -10,7 +10,7 @@ produced by the kit at the revision that added them. They pin drift; the types i
   the plaintext documents.
 - `carriage_invocation.frame`: a `cultnet.operation_request.v0` for service
   `gamecult.model.connector`, operation `invoke`, whose payload is the base64 of an envelope
-  sealed under the fixed test key in `tests/wire_golden_v3.rs`.
+  sealed under the fixed test key in `tests/wire_golden_v4.rs`.
 
-Generator: `tests/wire_golden_v3.rs` itself. Run it with `WIRE_V3_REGENERATE=1` to rewrite
+Generator: `tests/wire_golden_v4.rs` itself. Run it with `WIRE_V4_REGENERATE=1` to rewrite
 the files from the kit, then review the diff: a changed byte is a wire change.
diff --git a/crates/model-connector/tests/fixtures/wire_v3/carriage_invocation.frame b/crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/carriage_invocation.frame
rename to crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame
diff --git a/crates/model-connector/tests/fixtures/wire_v3/input_reasoning_state.mp b/crates/model-connector/tests/fixtures/wire_v4/input_reasoning_state.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/input_reasoning_state.mp
rename to crates/model-connector/tests/fixtures/wire_v4/input_reasoning_state.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/provider_request.mp b/crates/model-connector/tests/fixtures/wire_v4/provider_request.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/provider_request.mp
rename to crates/model-connector/tests/fixtures/wire_v4/provider_request.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/transport_envelope.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_envelope.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/transport_envelope.mp
rename to crates/model-connector/tests/fixtures/wire_v4/transport_envelope.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/transport_invocation.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_invocation.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/transport_invocation.mp
rename to crates/model-connector/tests/fixtures/wire_v4/transport_invocation.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/transport_receipt_failed.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_receipt_failed.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/transport_receipt_failed.mp
rename to crates/model-connector/tests/fixtures/wire_v4/transport_receipt_failed.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/transport_result_refused.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/transport_result_refused.mp
rename to crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp
diff --git a/crates/model-connector/tests/fixtures/wire_v3/transport_result_transported.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_result_transported.mp
similarity index 100%
rename from crates/model-connector/tests/fixtures/wire_v3/transport_result_transported.mp
rename to crates/model-connector/tests/fixtures/wire_v4/transport_result_transported.mp
diff --git a/crates/model-connector/tests/published_schemas.rs b/crates/model-connector/tests/published_schemas.rs
index cb21b01..9e19b8c 100644
--- a/crates/model-connector/tests/published_schemas.rs
+++ b/crates/model-connector/tests/published_schemas.rs
@@ -1,4 +1,4 @@
-//! `schemas/` at the repository root publishes one JSON Schema per v3 document,
+//! `schemas/` at the repository root publishes one JSON Schema per v4 document,
 //! generated from the types. This test regenerates them and fails on any
 //! difference; run it with `MODEL_CONNECTOR_REGENERATE_SCHEMAS=1` to rewrite the
 //! files from the types.
@@ -28,7 +28,7 @@ fn published_schemas_are_the_types() {
         ("transport_result", render::<TransportResult>()),
         ("transport_receipt", render::<TransportReceipt>()),
         ("transport_envelope", render::<TransportEnvelope>()),
-        ("spend_readout", render::<SpendReadout>()),
+        ("usage_readout", render::<UsageReadout>()),
     ];
     let dir = schemas_dir();
     if std::env::var_os(REGENERATE).is_some() {
@@ -80,7 +80,7 @@ fn the_published_ciphertext_is_what_the_wire_sends() {
     assert_eq!(&published["properties"]["ciphertext"], ciphertext);
 
     let envelope = TransportEnvelope {
-        schema_id: "gamecult.model.transport_envelope.v3".to_string(),
+        schema_id: "gamecult.model.transport_envelope.v4".to_string(),
         caller_runtime_id: "caller".to_string(),
         request_id: "request".to_string(),
         message_kind: EnvelopeKind::Invocation,
@@ -111,9 +111,7 @@ fn the_refusal_schema_is_one_flat_string_enum() {
         .iter()
         .map(|value| value.as_str().unwrap())
         .collect();
-    assert_eq!(variants.len(), 15);
-    assert!(variants.contains(&"ClockBehindAdmissionWindow"));
+    assert_eq!(variants.len(), 13);
     assert!(variants.contains(&"ForeignReasoningState"));
-    assert!(variants.contains(&"CostBound"));
-    assert!(variants.contains(&"SpendCeiling"));
+    assert!(variants.contains(&"ProviderRejected"));
 }
diff --git a/crates/model-connector/tests/reasoning_state.rs b/crates/model-connector/tests/reasoning_state.rs
index 8c9c4af..170dd8e 100644
--- a/crates/model-connector/tests/reasoning_state.rs
+++ b/crates/model-connector/tests/reasoning_state.rs
@@ -106,8 +106,6 @@ fn start_with(backend: Arc<dyn ProviderBackend>, max_concurrent: usize) -> Conne
         max_concurrent,
         64 * 1024,
         32_768,
-        SpendCeiling(1 << 40),
-        SpendWindowMs(3_600_000),
     )
     .unwrap();
     let limits = ServeLimits {
@@ -116,21 +114,7 @@ fn start_with(backend: Arc<dyn ProviderBackend>, max_concurrent: usize) -> Conne
         socket_timeout_ms: 5_000,
         max_expiry_skew_ms: 300_000,
     };
-    let prices = PriceTable::from([(
-        "claude-opus-4-5".to_string(),
-        ModelPrice {
-            rates: Rates {
-                input: 5_000_000,
-                cache_write_short: 6_250_000,
-                cache_write_long: 10_000_000,
-                cache_read: 500_000,
-                output: 25_000_000,
-            },
-            long_context: None,
-            overhead_tokens: 100,
-        },
-    )]);
-    thread::spawn(move || serve(listener, limits, vec![admission], prices, &store, backend));
+    thread::spawn(move || serve(listener, limits, vec![admission], &store, backend));
     ConnectorClient::new(endpoint, KEY, FRAME, Some(Duration::from_secs(5))).unwrap()
 }
 
@@ -143,7 +127,7 @@ fn invocation(request_id: &str, input: Vec<InputItem>) -> TransportInvocation {
         4_096,
     );
     request.input = input;
-    TransportInvocation::new(CALLER, now_ms() + 60_000, [7; 32], 10_000_000, request).unwrap()
+    TransportInvocation::new(CALLER, now_ms() + 60_000, [7; 32], request).unwrap()
 }
 
 fn user(text: &str) -> InputItem {
@@ -332,7 +316,7 @@ fn a_refused_completion_reaches_the_caller_as_a_typed_failure_and_frees_the_slot
     let edits: [fn(&mut TransportReceipt); 3] = [
         |receipt| receipt.provider = "another-provider".to_string(),
         |receipt| receipt.foreign_reasoning_dropped += 1,
-        |receipt| receipt.cost_micro_usd += 1,
+        |receipt| receipt.request_id = "another-request".to_string(),
     ];
     for edit in edits {
         // One concurrent request: a wedged slot would refuse the next id.
diff --git a/crates/model-connector/tests/wire_golden_v3.rs b/crates/model-connector/tests/wire_golden_v4.rs
similarity index 96%
rename from crates/model-connector/tests/wire_golden_v3.rs
rename to crates/model-connector/tests/wire_golden_v4.rs
index 9364035..e440fe6 100644
--- a/crates/model-connector/tests/wire_golden_v3.rs
+++ b/crates/model-connector/tests/wire_golden_v4.rs
@@ -1,5 +1,5 @@
-//! Pins the bytes of the v3 wire so a drift is a failing test. The fixtures in
-//! `fixtures/wire_v3` are produced by this file (see its README); they pin the
+//! Pins the bytes of the v4 wire so a drift is a failing test. The fixtures in
+//! `fixtures/wire_v4` are produced by this file (see its README); they pin the
 //! kit against itself and are not a second contract: the types in
 //! `model_connector::contract` own the shape.
 
@@ -17,10 +17,10 @@ use serde::de::DeserializeOwned;
 
 const KEY: &str = "golden-distinct-test-key";
 const CALLER: &str = "golden-caller";
-const REGENERATE: &str = "WIRE_V3_REGENERATE";
+const REGENERATE: &str = "WIRE_V4_REGENERATE";
 
 fn fixtures() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/wire_v3")
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/wire_v4")
 }
 
 fn named<T: Serialize>(value: &T) -> Vec<u8> {
@@ -28,7 +28,7 @@ fn named<T: Serialize>(value: &T) -> Vec<u8> {
 }
 
 /// The value serializes to the committed bytes and the committed bytes decode
-/// back to it. With `WIRE_V3_REGENERATE` set, the committed bytes are rewritten
+/// back to it. With `WIRE_V4_REGENERATE` set, the committed bytes are rewritten
 /// from the value first.
 fn assert_wire<T: Serialize + DeserializeOwned + PartialEq + std::fmt::Debug>(
     name: &str,
@@ -81,7 +81,7 @@ fn request() -> ProviderRequest {
 }
 
 fn invocation() -> TransportInvocation {
-    TransportInvocation::new(CALLER, 1_800_000_000_000, [7; 32], 5_000_000, request()).unwrap()
+    TransportInvocation::new(CALLER, 1_800_000_000_000, [7; 32], request()).unwrap()
 }
 
 fn receipt(outcome: TransportOutcome) -> TransportReceipt {
@@ -95,8 +95,6 @@ fn receipt(outcome: TransportOutcome) -> TransportReceipt {
         model: invocation.request.model.clone(),
         provider: "anthropic-messages".to_string(),
         foreign_reasoning_dropped: 2,
-        cost_micro_usd: 1_234_567,
-        overrun_micro_usd: 89,
         outcome,
     }
 }
@@ -116,7 +114,7 @@ fn completed() -> TransportOutcome {
 }
 
 #[test]
-fn wire_golden_v3() {
+fn wire_golden_v4() {
     let invocation = invocation();
     assert_wire("provider_request.mp", &invocation.request);
     assert_wire("transport_invocation.mp", &invocation);
@@ -233,7 +231,7 @@ fn the_golden_carriage_frame_decrypts_and_validates_under_the_fixed_key() {
     };
     assert_eq!(service_id, "gamecult.model.connector");
     assert_eq!(operation, "invoke");
-    assert_eq!(payload_schema, "gamecult.model.transport_envelope.v3");
+    assert_eq!(payload_schema, "gamecult.model.transport_envelope.v4");
     assert_eq!(message_id, invocation.request_id());
     let envelope: TransportEnvelope =
         rmp_serde::from_slice(&STANDARD.decode(payload).unwrap()).unwrap();
diff --git a/schemas/spend_readout.json b/schemas/spend_readout.json
deleted file mode 100644
index 5a5d23d..0000000
--- a/schemas/spend_readout.json
+++ /dev/null
@@ -1,112 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "title": "SpendReadout",
-  "type": "object",
-  "properties": {
-    "at_unix_ms": {
-      "type": "integer",
-      "format": "uint64",
-      "minimum": 0
-    },
-    "callers": {
-      "type": "array",
-      "items": {
-        "$ref": "#/$defs/CallerSpend"
-      }
-    },
-    "plan_quota": {
-      "type": "array",
-      "items": {
-        "$ref": "#/$defs/PlanQuota"
-      }
-    },
-    "schema_id": {
-      "type": "string"
-    }
-  },
-  "additionalProperties": false,
-  "required": [
-    "schema_id",
-    "at_unix_ms",
-    "callers",
-    "plan_quota"
-  ],
-  "$defs": {
-    "CallerSpend": {
-      "description": "One caller's current spend window in micro-USD. `spent` is settled charges\nplus what a crash left counted at its full reservation; `reserved` is what\ncalls in flight hold, and both count against the ceiling.",
-      "type": "object",
-      "properties": {
-        "caller_id": {
-          "type": "string"
-        },
-        "ceiling_micro_usd": {
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
-        "reserved_micro_usd": {
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
-        "spent_micro_usd": {
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
-        "window_ms": {
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false,
-      "required": [
-        "caller_id",
-        "window_ms",
-        "ceiling_micro_usd",
-        "spent_micro_usd",
-        "reserved_micro_usd"
-      ]
-    },
-    "PlanQuota": {
-      "description": "One window of the subscription plan, as the provider reported it.",
-      "type": "object",
-      "properties": {
-        "observed_at_unix_ms": {
-          "description": "When this window was last reported. Its age in a readout is the\nreadout's `at_unix_ms` minus this.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
-        "resets_at_unix_ms": {
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
-        "status": {
-          "type": "string"
-        },
-        "utilization_permille": {
-          "description": "How much of the window was used when it was observed, in thousandths;\n`None` once the window has reset (`status` is then `expired`), because\nthe old reading says nothing about the new window.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint32",
-          "minimum": 0
-        },
-        "window": {
-          "type": "string"
-        }
-      },
-      "additionalProperties": false,
-      "required": [
-        "window",
-        "resets_at_unix_ms",
-        "status",
-        "observed_at_unix_ms"
-      ]
-    }
-  }
-}
diff --git a/schemas/transport_envelope.json b/schemas/transport_envelope.json
index 8b062e3..3b1e7db 100644
--- a/schemas/transport_envelope.json
+++ b/schemas/transport_envelope.json
@@ -47,8 +47,8 @@
       "enum": [
         "Invocation",
         "Result",
-        "SpendReadoutRequest",
-        "SpendReadoutResult"
+        "UsageReadoutRequest",
+        "UsageReadoutResult"
       ]
     }
   }

From 702e903fdd094644f23343199bc1fa57a5f758f4 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:44:01 +0100
Subject: [PATCH 16/37] connector-usage-only: fix serve test splice

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/model-connector/src/serve.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 270fa1b..0919410 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -642,8 +642,6 @@ mod tests {
         ));
         assert_eq!(inner.executions.load(Ordering::SeqCst), 1);
     }
-        assert_eq!(backend.executions.load(Ordering::SeqCst), 1);
-    }
 
     #[test]
     fn serve_end_to_end_replays_without_a_second_execution() {

From af5da3dfaa7066258dcb9ec1232796d009a84251 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:44:45 +0100
Subject: [PATCH 17/37] connector-usage-only: test fixes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/model-connector/src/serve.rs         | 1 -
 crates/model-connector/src/service/lease.rs | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 0919410..57edfa9 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -887,7 +887,6 @@ mod tests {
             [0xff; 32],
             [0xff; 32],
             0,
-            u64::MAX,
         ))
         .unwrap()
         .len();
diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index f677ae0..0e2c37e 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -301,9 +301,9 @@ mod tests {
             else {
                 return None;
             };
-            let result = crate::envelope::decrypt_result(&reply, &security(KEY)).unwrap();
+            let result = crate::envelope::decrypt_result(&reply, &security(KEY), &invocation).unwrap();
             match result.disposition {
-                TransportDisposition::Refused { refusal } => Some(refusal),
+                TransportDisposition::Refused(refusal) => Some(refusal),
                 other => panic!("unexpected {other:?}"),
             }
         };

From dcb5f109f73bb4aaf2d7ff4996ef2e101aa36c2a Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:48:24 +0100
Subject: [PATCH 18/37] connector-usage-only: store-failure tests, README front
 door

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                    | 23 ++++++-----
 crates/claude-connector/src/backend/tests.rs |  3 +-
 crates/claude-connector/tests/lease.rs       | 20 ++--------
 crates/model-connector/src/service.rs        | 42 ++++++++++++++++++++
 4 files changed, 62 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 34c8730..74bd5b5 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,11 @@ The connector kit for GameCult minds: one typed, encrypted, replay-safe contract
 between a caller that needs a model turn and a daemon that holds the provider
 credential, so no project wires its own provider calls.
 
+The connector meters nothing in dollars. It holds the subscription token, lends it, and
+publishes the plan's usage windows (`usage_readout`, and `plan_quota` on every lease grant) for the
+minds to read and decide their own burn. The one usage-derived refusal is the provider's own
+(`ProviderRejected`), repeated until its reset.
+
 Status: the `model-connector` crate and the `claude-connector` backend crate are live. No
 connector binary exists yet (the Claude connector binary is first, then an OpenAI-compatible one).
 
@@ -11,7 +16,7 @@ connector binary exists yet (the Claude connector binary is first, then an OpenA
 
 Crate `crates/model-connector`:
 
-- `src/contract.rs` - the v3 wire contract (`gamecult.model.*.v3`): `ProviderRequest`, `TransportInvocation`,
+- `src/contract.rs` - the v4 wire contract (`gamecult.model.*.v4`): `ProviderRequest`, `TransportInvocation`,
   `TransportResult`, `TransportReceipt`, the typed `StopReason`, `FailureKind` and `Refusal`,
   `InputItem::ReasoningState` (a provider's opaque reasoning block, replayed by callers
   verbatim via `TransportResult::transcript_items`; the service refuses another provider's
@@ -23,10 +28,10 @@ Crate `crates/model-connector`:
   `cultnet.operation_request.v0` / `operation_response.v0` for service
   `gamecult.model.connector`, operation `invoke` (or `usage_readout`), its `message_id` the
   request id and its payload the base64 of the sealed envelope. `usage_readout` answers a
-  `UsageReadout` (`gamecult.model.usage_readout.v1`): each caller's spent and reserved
-  micro-USD against its ceiling in its current window, and the backend's plan quota;
+  `UsageReadout` (`gamecult.model.usage_readout.v1`): the backend's plan quota windows, each with
+  utilization, reset, status and age;
   `ConnectorClient::usage_readout` asks.
-- `schemas/` - one JSON Schema per v3 document, generated from the types.
+- `schemas/` - one JSON Schema per v4 document, generated from the types.
 - `src/client.rs` - `ConnectorClient`, the one-request caller side.
 - `src/service.rs` (feature `daemon`) - `TransportService`: caller admission, durable
   replay (a retried request is answered byte-identically and the provider runs once),
@@ -49,7 +54,7 @@ Crate `crates/claude-connector` (library only; the binary that wires it to `serv
   group); `SessionStore` and `StderrSink` are the other ports. `ClaudeCodeConfig` is what the
   binary hands in; the credential is read from a systemd credential and reaches the child on a
   pipe (`CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`), never in an environment. `QuotaCell` keeps the
-  plan windows the CLI's `rate_limit_event`s report, for the spend readout.
+  plan windows the CLI's `rate_limit_event`s report, for the usage readout and the lease grant.
 
 Frame arithmetic is public in `src/envelope.rs`, measured on the carriage frame: `frame_bytes_for_payload(n)` is the frame a
 caller payload bound of `n` needs, `payload_bytes_for_frame(frame)` is the largest payload bound
@@ -58,7 +63,7 @@ a frame allows, and `MAX_IDENTITY_BYTES` (256) bounds caller ids, request ids an
 needed); the smallest legal frame is `frame_bytes_for_payload(MIN_PAYLOAD_BYTES)`. A request id past
 the bound is refused on the wire as `Refusal::Malformed`, the reply echoing the id (the connection is dropped only if that reply cannot fit the frame); `ConnectorClient` refuses such an id locally with `RequestIdTooLong`.
 
-The default feature set compiles contract, envelope and client only. The kit speaks v3
+The default feature set compiles contract, envelope and client only. The kit speaks v4
 only: a v2 frame gets no answer.
 
 ## Verify
@@ -68,9 +73,9 @@ cargo test --locked --workspace
 cargo test --locked --workspace --features model-connector/daemon
 ```
 
-`crates/model-connector/tests/wire_golden_v3.rs` pins the v3 documents and one sealed carriage
-frame to the fixtures in `crates/model-connector/tests/fixtures/wire_v3` (regenerate with
-`WIRE_V3_REGENERATE=1`; see the fixtures' README), and
+`crates/model-connector/tests/wire_golden_v4.rs` pins the v4 documents and one sealed carriage
+frame to the fixtures in `crates/model-connector/tests/fixtures/wire_v4` (regenerate with
+`WIRE_V4_REGENERATE=1`; see the fixtures' README), and
 `crates/model-connector/tests/published_schemas.rs` fails when `schemas/` differs from the types
 (`MODEL_CONNECTOR_REGENERATE_SCHEMAS=1` rewrites it).
 
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 227b9f9..e3449fe 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -1438,7 +1438,8 @@ fn usage_sums_model_usage_across_models() {
         panic!("completed expected");
     };
     assert_eq!(*summed, usage(12, 37, 1083, 24, Some(8)));
-    // The receipt is priced from usage alone: 12*3 + 37*0.3 + 1083*6 + 24*15 micro-USD, rounded up.
+    // The receipt is the usage alone: the CLI's own total never reaches it.
+    assert_eq!(parts(&cheap).1, parts(&dear).1);
 
     // No model reported thinking tokens: none is claimed.
     let plain = r#"{"claude-haiku-5-5":{"inputTokens":1,"outputTokens":1,"cacheReadInputTokens":0,"cacheCreationInputTokens":0}}"#;
diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index cf05cd6..ce52048 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -94,7 +94,7 @@ impl PeerUnits for FakeUnits {
 struct Harness {
     dir: PathBuf,
     socket: PathBuf,
-    service: Arc<Mutex<TransportService>>,
+    _service: Arc<Mutex<TransportService>>,
     quota: Arc<QuotaCell>,
     tokens: Arc<FakeTokens>,
     /// The fake behind the listener, when it has one.
@@ -162,18 +162,6 @@ fn receive(stream: &UnixStream) -> (Vec<u8>, Vec<OwnedFd>) {
     }
 }
 
-fn connect(harness: &Harness) -> UnixStream {
-    let stream = UnixStream::connect(&harness.socket).unwrap();
-    stream
-        .set_read_timeout(Some(Duration::from_secs(5)))
-        .unwrap();
-    stream
-}
-
-fn send(stream: &mut UnixStream, message: &LeaseMessage) {
-    stream.write_all(&encode_frame(message)).unwrap();
-}
-
 fn request(ttl_ms: u64) -> LeaseMessage {
     LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
         expires_at_unix_ms: now_ms() + ttl_ms,
@@ -182,7 +170,7 @@ fn request(ttl_ms: u64) -> LeaseMessage {
 
 /// What one request to the listener came back with.
 struct Answer {
-    stream: UnixStream,
+    _stream: UnixStream,
     raw: Vec<u8>,
     message: Option<LeaseMessage>,
     fds: Vec<OwnedFd>,
@@ -202,7 +190,7 @@ fn ask_at(socket: &std::path::Path, ttl_ms: u64) -> Answer {
     let (raw, fds) = receive(&stream);
     let message = decode_frame(&raw);
     Answer {
-        stream,
+        _stream: stream,
         raw,
         message,
         fds,
@@ -316,7 +304,7 @@ fn start(setup: Setup) -> Harness {
     let harness = Harness {
         dir,
         socket,
-        service,
+        _service: service,
         quota,
         tokens,
         units: Some(units),
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 3e52dfb..05e5da9 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -2158,4 +2158,46 @@ mod tests {
             Some(Operation::UsageReadout)
         );
     }
+
+    #[test]
+    fn a_store_that_cannot_be_written_executes_nothing_and_holds_no_slot() {
+        let store = FlakyStore::new(0);
+        let allowance = store.allowance();
+        let mut service =
+            TransportService::with_store(store, "fixture-sse", [caller(CALLER, KEY, 1)], 5_000)
+                .unwrap();
+        let invocation = invocation_for(CALLER, "request-1");
+        assert!(matches!(
+            service.begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME),
+            Err(ServiceError::ReplayStore(_))
+        ));
+        allowance.store(10, Ordering::SeqCst);
+        assert!(matches!(
+            service.begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME),
+            Ok(TransportAdmission::Execute(_))
+        ));
+    }
+
+    #[test]
+    fn a_failed_completion_write_answers_the_store_failure_and_frees_the_slot() {
+        let store = FlakyStore::new(1);
+        let allowance = store.allowance();
+        let mut service =
+            TransportService::with_store(store, "fixture-sse", [caller(CALLER, KEY, 1)], 5_000)
+                .unwrap();
+        let (claim, invocation) = claim_for(&mut service, "request-1");
+        let result = text_result(claim.call(), "done");
+        assert!(matches!(
+            service.complete(*claim, result, FRAME),
+            Err(ServiceError::ReplayStore(_))
+        ));
+        // The slot is free (one concurrent request is admitted), and the retry
+        // of the unfinished id is told it is indeterminate, not in flight.
+        allowance.store(10, Ordering::SeqCst);
+        let again = service
+            .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
+            .unwrap();
+        assert_eq!(refusal_of(again, &invocation), Refusal::Indeterminate);
+        let _ = claim_for(&mut service, "request-2");
+    }
 }

From 28f2e5d2e7cbff397c9966c197ee76081ddf31fe Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:49:29 +0100
Subject: [PATCH 19/37] connector-usage-only: test import

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/model-connector/src/service.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index 05e5da9..c17802d 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -2171,7 +2171,7 @@ mod tests {
             service.begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME),
             Err(ServiceError::ReplayStore(_))
         ));
-        allowance.store(10, Ordering::SeqCst);
+        allowance.store(10, std::sync::atomic::Ordering::SeqCst);
         assert!(matches!(
             service.begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME),
             Ok(TransportAdmission::Execute(_))
@@ -2193,7 +2193,7 @@ mod tests {
         ));
         // The slot is free (one concurrent request is admitted), and the retry
         // of the unfinished id is told it is indeterminate, not in flight.
-        allowance.store(10, Ordering::SeqCst);
+        allowance.store(10, std::sync::atomic::Ordering::SeqCst);
         let again = service
             .begin_unplanned(&raw_envelope(&invocation), 1_000, FRAME)
             .unwrap();

From bb8909f2c2fbfa3ff288bb20a4270d787d98b25a Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:51:05 +0100
Subject: [PATCH 20/37] connector-usage-only: regenerate v4 goldens and
 schemas, format, fix tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |   1 +
 crates/claude-connector/src/backend/tests.rs  |  14 +--
 crates/claude-connector/src/daemon.rs         |   9 +-
 crates/claude-connector/src/lease.rs          |   6 +-
 crates/claude-connector/src/lib.rs            |   4 +-
 .../claude-connector/tests/config_document.rs |   5 +-
 crates/claude-connector/tests/lease.rs        |  22 ++++-
 crates/model-connector/src/contract.rs        |  11 ++-
 crates/model-connector/src/fixtures.rs        |   9 --
 crates/model-connector/src/readout.rs         |   1 -
 crates/model-connector/src/serve.rs           |  65 +++----------
 crates/model-connector/src/service.rs         |  86 +++++++-----------
 crates/model-connector/src/service/lease.rs   |  59 ++++++++----
 .../wire_v4/carriage_invocation.frame         |   2 +-
 .../fixtures/wire_v4/provider_request.mp      | Bin 549 -> 549 bytes
 .../fixtures/wire_v4/transport_envelope.mp    | Bin 205 -> 205 bytes
 .../fixtures/wire_v4/transport_invocation.mp  | Bin 823 -> 801 bytes
 .../wire_v4/transport_receipt_failed.mp       | Bin 517 -> 480 bytes
 .../wire_v4/transport_result_refused.mp       |   2 +-
 .../wire_v4/transport_result_transported.mp   | Bin 953 -> 916 bytes
 schemas/transport_invocation.json             |   7 --
 schemas/transport_receipt.json                |  16 +---
 schemas/transport_result.json                 |  20 +---
 schemas/usage_readout.json                    |  68 ++++++++++++++
 24 files changed, 206 insertions(+), 201 deletions(-)
 create mode 100644 schemas/usage_readout.json

diff --git a/Cargo.lock b/Cargo.lock
index 5291d19..efa3d84 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -144,6 +144,7 @@ dependencies = [
  "libc",
  "model-connector",
  "rmp-serde",
+ "rmpv",
  "serde",
  "serde_json",
  "sha2",
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index e3449fe..e53b9f7 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -5,8 +5,9 @@ use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use model_connector::{
-    CallerAdmission, PlanQuotaSnapshot, ReasoningEffort, StopReason, ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation,
-    TransportKey, TransportReceipt, TransportService, decrypt_result, encrypt_invocation,
+    CallerAdmission, PlanQuotaSnapshot, ReasoningEffort, StopReason, ToolDefinition,
+    TransportAdmission, TransportDisposition, TransportInvocation, TransportKey, TransportReceipt,
+    TransportService, decrypt_result, encrypt_invocation,
 };
 
 use super::*;
@@ -480,8 +481,7 @@ impl Door {
             .unwrap()
         });
         let service =
-            TransportService::open(&dir.join("replay.cc"), PROVIDER, callers, 5_000)
-                .unwrap();
+            TransportService::open(&dir.join("replay.cc"), PROVIDER, callers, 5_000).unwrap();
         Self { dir, service }
     }
 
@@ -498,13 +498,13 @@ impl Door {
         request: ProviderRequest,
     ) -> (model_connector::ExecutionClaim, TransportInvocation) {
         let key = TransportKey::from_connection_secret(&format!("{caller}-key")).unwrap();
-        let invocation =
-            TransportInvocation::new(caller, 2_000, [7; 32], request).unwrap();
+        let invocation = TransportInvocation::new(caller, 2_000, [7; 32], request).unwrap();
         let envelope = encrypt_invocation(&invocation, &key).unwrap();
         match self
             .service
             .begin(&envelope, 1_000, &PlanQuotaSnapshot::default(), FRAME)
-            .unwrap() {
+            .unwrap()
+        {
             TransportAdmission::Execute(claim) => (*claim, invocation),
             TransportAdmission::Reply(_) => panic!("the door answered instead of admitting"),
         }
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index eaf26d0..1a1a80b 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -11,8 +11,8 @@ use std::time::Duration;
 
 use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore};
 use model_connector::{
-    CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ProviderBackend,
-    ServeError, ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
+    CallerAdmission, CallerConfig, LeaseTurn, MIN_PAYLOAD_BYTES, ProviderBackend, ServeError,
+    ServeLimits, ServiceError, TransportService, load_admissions, serve_service,
 };
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
@@ -230,9 +230,7 @@ impl ClaudeConnectorConfig {
             }
             let mut seen = BTreeSet::new();
             for model in &caller.allowed_models {
-                if !has_model_id_form(model)
-                    || !seen.insert(model.as_str())
-                {
+                if !has_model_id_form(model) || !seen.insert(model.as_str()) {
                     return Err(ConfigError::Invalid("allowed_models"));
                 }
             }
@@ -344,7 +342,6 @@ fn has_model_id_form(model: &str) -> bool {
         && after_ok
 }
 
-
 /// One file name under `$CREDENTIALS_DIRECTORY`, never a path.
 fn is_credential_name(name: &str) -> bool {
     !name.is_empty()
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
index 78b19ac..2974a42 100644
--- a/crates/claude-connector/src/lease.rs
+++ b/crates/claude-connector/src/lease.rs
@@ -671,9 +671,9 @@ mod tests {
     fn a_frame_that_trickles_past_its_deadline_is_refused_however_small_each_read() {
         let (mut reader, mut writer) = UnixStream::pair().unwrap();
         let frame = encode_frame(&LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
-                kind: LeaseRefusalKind::Busy,
-                detail: "lease:x".to_string(),
-            }));
+            kind: LeaseRefusalKind::Busy,
+            detail: "lease:x".to_string(),
+        }));
         let trickle = thread::spawn(move || {
             for byte in frame {
                 if writer.write_all(&[byte]).is_err() {
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 4a9a42b..70a2e53 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -28,8 +28,8 @@ pub use launch::ChildEnv;
 #[cfg(target_os = "linux")]
 pub use lease::{
     LeaseCaller, LeaseGranted, LeaseLimits, LeaseMessage, LeaseRefusalKind, LeaseRefused,
-    LeaseRequest, MAX_LEASE_FRAME_BYTES, PeerCredentials, PeerUnit,
-    PeerUnits, decode_frame, encode_frame, peer_credentials, serve_leases, user_uid,
+    LeaseRequest, MAX_LEASE_FRAME_BYTES, PeerCredentials, PeerUnit, PeerUnits, decode_frame,
+    encode_frame, peer_credentials, serve_leases, user_uid,
 };
 #[cfg(unix)]
 pub use process::StdProcessPort;
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index 865ea00..d2af150 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -280,6 +280,9 @@ fn the_dollar_flags_are_not_flags() {
         let scratch = Scratch::new();
         let made = init(&scratch, &init_flags(&scratch, extra));
         assert!(!made.status.success(), "{extra:?} was accepted");
-        assert!(!Path::new(&scratch.path("connector.cc")).exists(), "{extra:?}");
+        assert!(
+            !Path::new(&scratch.path("connector.cc")).exists(),
+            "{extra:?}"
+        );
     }
 }
diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index ce52048..4bd3941 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -279,7 +279,12 @@ fn start(setup: Setup) -> Harness {
     });
     let quota = Arc::new(QuotaCell::new());
     let listener = UnixListener::bind(&socket).unwrap();
-    let serving = (service.clone(), quota.clone(), tokens.clone(), units.clone());
+    let serving = (
+        service.clone(),
+        quota.clone(),
+        tokens.clone(),
+        units.clone(),
+    );
     let caller = LeaseCaller {
         uid: setup.uid,
         caller_id: CALLER.to_string(),
@@ -343,7 +348,10 @@ fn ask_until_granted(harness: &Harness, first_invocation: u64) -> Answer {
 fn a_grant_passes_one_fd_holding_the_token_then_end_of_file() {
     let harness = start(setup());
     let mut answer = ask(&harness, 60_000);
-    assert_eq!(granted(&answer).lease_id, format!("lease:{}", invocation(1)));
+    assert_eq!(
+        granted(&answer).lease_id,
+        format!("lease:{}", invocation(1))
+    );
     assert_eq!(answer.fds.len(), 1);
     let mut read = Vec::new();
     File::from(answer.fds.remove(0))
@@ -351,7 +359,10 @@ fn a_grant_passes_one_fd_holding_the_token_then_end_of_file() {
         .unwrap();
     assert_eq!(read, TOKEN.as_bytes());
     assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 1);
-    assert!(!contains(&answer.raw, TOKEN), "the token is in the pipe only");
+    assert!(
+        !contains(&answer.raw, TOKEN),
+        "the token is in the pipe only"
+    );
 }
 
 #[test]
@@ -416,7 +427,10 @@ fn a_rejected_window_refuses_the_lease_until_its_reset() {
         .quota
         .observe([window("five_hour", 1_000, "rejected", reset)]);
     let refused = ask(&harness, 60_000);
-    assert_eq!(refusal_of(&refused), Some(LeaseRefusalKind::ProviderRejected));
+    assert_eq!(
+        refusal_of(&refused),
+        Some(LeaseRefusalKind::ProviderRejected)
+    );
     assert!(refused.fds.is_empty());
     assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
     // At the provider's own reset the refusal lifts, with no one lifting it.
diff --git a/crates/model-connector/src/contract.rs b/crates/model-connector/src/contract.rs
index d039774..0a83d4e 100644
--- a/crates/model-connector/src/contract.rs
+++ b/crates/model-connector/src/contract.rs
@@ -762,8 +762,15 @@ mod tests {
     #[test]
     fn the_invocations_identity_covers_its_request() {
         let one = invocation();
-        let mut other = one.clone();
-        other.request.max_output_tokens += 1;
+        let mut request = one.request.clone();
+        request.max_output_tokens += 1;
+        let other = TransportInvocation::new(
+            one.caller_runtime_id.clone(),
+            one.expires_at_unix_ms,
+            one.native_request_sha256,
+            request,
+        )
+        .unwrap();
         assert_ne!(
             canonical_invocation_bytes(&one).unwrap(),
             canonical_invocation_bytes(&other).unwrap()
diff --git a/crates/model-connector/src/fixtures.rs b/crates/model-connector/src/fixtures.rs
index 1bfc37a..19ab522 100644
--- a/crates/model-connector/src/fixtures.rs
+++ b/crates/model-connector/src/fixtures.rs
@@ -67,14 +67,6 @@ impl FlakyStore {
     pub(crate) fn allowance(&self) -> Arc<AtomicUsize> {
         self.pushes_allowed.clone()
     }
-
-    /// A store over the same records that accepts `pushes_allowed` more writes.
-    pub(crate) fn reopened(&self, pushes_allowed: usize) -> Self {
-        Self {
-            held: self.held.clone(),
-            pushes_allowed: Arc::new(AtomicUsize::new(pushes_allowed)),
-        }
-    }
 }
 
 #[cfg(feature = "daemon")]
@@ -133,7 +125,6 @@ pub(crate) fn request() -> ProviderRequest {
     request
 }
 
-
 pub(crate) fn invocation() -> TransportInvocation {
     TransportInvocation::new("epiphany-yggdrasil", 2_000, [7; 32], request()).unwrap()
 }
diff --git a/crates/model-connector/src/readout.rs b/crates/model-connector/src/readout.rs
index 197e65a..5efa324 100644
--- a/crates/model-connector/src/readout.rs
+++ b/crates/model-connector/src/readout.rs
@@ -9,7 +9,6 @@ use crate::contract::ContractError;
 
 pub const USAGE_READOUT_SCHEMA_ID: &str = "gamecult.model.usage_readout.v1";
 
-
 /// One window of the subscription plan, as the provider reported it.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 57edfa9..2c2ac91 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -382,10 +382,7 @@ mod tests {
         FailureKind, Refusal, TransportDisposition, TransportEvent, TransportEventPayload,
         TransportInvocation, TransportOutcome, TransportResult,
     };
-    use crate::fixtures::{
-        TestStore, caller, invocation_for, receipt,
-        request,
-    };
+    use crate::fixtures::{TestStore, caller, invocation_for, receipt, request};
 
     const CALLER: &str = "epiphany-yggdrasil";
     const KEY: &str = "epiphany-distinct-test-key";
@@ -461,13 +458,7 @@ mod tests {
         let (sender, receiver) = std::sync::mpsc::channel();
         let path = path.to_path_buf();
         thread::spawn(move || {
-            let _ = sender.send(serve(
-                listener,
-                limits,
-                admissions,
-                &path,
-                backend,
-            ));
+            let _ = sender.send(serve(listener, limits, admissions, &path, backend));
         });
         receiver.recv_timeout(Duration::from_secs(2)).ok()
     }
@@ -493,15 +484,7 @@ mod tests {
         let listener = TcpListener::bind("127.0.0.1:0").unwrap();
         let endpoint = listener.local_addr().unwrap();
         let path = store.path.clone();
-        thread::spawn(move || {
-            serve(
-                listener,
-                limits(),
-                admissions,
-                &path,
-                backend,
-            )
-        });
+        thread::spawn(move || serve(listener, limits(), admissions, &path, backend));
         let client =
             ConnectorClient::new(endpoint, KEY, FRAME, Some(Duration::from_secs(5))).unwrap();
         (client, endpoint)
@@ -770,10 +753,9 @@ mod tests {
         let envelope =
             crate::envelope::encrypt_invocation(&invocation, &crate::fixtures::security(KEY))
                 .unwrap();
-        let TransportAdmission::Execute(claim) =
-            service
-                .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
-                .unwrap()
+        let TransportAdmission::Execute(claim) = service
+            .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
+            .unwrap()
         else {
             panic!("a fresh request must execute");
         };
@@ -881,12 +863,7 @@ mod tests {
     fn the_smallest_frame_also_carries_the_failure_that_stands_in_for_a_result() {
         let long = "x".repeat(crate::envelope::MAX_IDENTITY_BYTES);
         let plaintext = crate::contract::wire_encode(&crate::service::result_size_failure(
-            &long,
-            &long,
-            &long,
-            [0xff; 32],
-            [0xff; 32],
-            0,
+            &long, &long, &long, [0xff; 32], [0xff; 32], 0,
         ))
         .unwrap()
         .len();
@@ -994,16 +971,7 @@ mod tests {
     }
 
     fn admission(id: &str, key: &str, slots: usize, payload: usize) -> CallerAdmission {
-        CallerAdmission::new(
-            id,
-            key,
-            1,
-            ["gpt-5.4".to_string()],
-            slots,
-            payload,
-            32_768,
-        )
-        .unwrap()
+        CallerAdmission::new(id, key, 1, ["gpt-5.4".to_string()], slots, payload, 32_768).unwrap()
     }
 
     /// `Some(field)` when serve refused the configuration, `None` while it serves.
@@ -1233,10 +1201,9 @@ mod tests {
             &crate::fixtures::security(KEY),
         )
         .unwrap();
-        let TransportAdmission::Execute(claim) =
-            service
-                .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
-                .unwrap()
+        let TransportAdmission::Execute(claim) = service
+            .begin(&envelope, now_ms(), &PlanQuotaSnapshot::default(), 1 << 20)
+            .unwrap()
         else {
             panic!("a fresh request must execute");
         };
@@ -1385,15 +1352,7 @@ mod tests {
         let backend = CountingBackend::new(true);
         let path = store.path.clone();
         let served = backend.clone();
-        thread::spawn(move || {
-            serve(
-                listener,
-                limits(),
-                admissions,
-                &path,
-                served,
-            )
-        });
+        thread::spawn(move || serve(listener, limits(), admissions, &path, served));
         let client =
             ConnectorClient::new(endpoint, KEY, FRAME, Some(Duration::from_secs(5))).unwrap();
         client.execute(&fresh("request-key")).unwrap();
diff --git a/crates/model-connector/src/service.rs b/crates/model-connector/src/service.rs
index c17802d..5fe2db8 100644
--- a/crates/model-connector/src/service.rs
+++ b/crates/model-connector/src/service.rs
@@ -524,7 +524,8 @@ impl TransportService {
             .get::<ReplayRecord>(&replay_key(&identity))
             .map_err(replay_store_error)?
             .ok_or(ServiceError::NoActiveRequest)?;
-        if active.state != ReplayState::Active || active.invocation_sha256 != claim.invocation_sha256
+        if active.state != ReplayState::Active
+            || active.invocation_sha256 != claim.invocation_sha256
         {
             return Err(ServiceError::ActiveRequestMismatch);
         }
@@ -897,13 +898,9 @@ mod tests {
 
         let mut changed_request = request();
         changed_request.instructions.push_str(" Different cargo.");
-        let conflicting = TransportInvocation::new(
-            "epiphany-yggdrasil",
-            2_000,
-            [7; 32],
-            changed_request,
-        )
-        .unwrap();
+        let conflicting =
+            TransportInvocation::new("epiphany-yggdrasil", 2_000, [7; 32], changed_request)
+                .unwrap();
         let refusal = match service
             .begin_unplanned(
                 &encrypt_invocation(&conflicting, &security).unwrap(),
@@ -932,7 +929,9 @@ mod tests {
         let mut service = open_service(&store, 1);
         let first_envelope = encrypt_invocation(&first, &security).unwrap();
         assert!(matches!(
-            service.begin_unplanned(&first_envelope, 1_000, FRAME).unwrap(),
+            service
+                .begin_unplanned(&first_envelope, 1_000, FRAME)
+                .unwrap(),
             TransportAdmission::Execute(_)
         ));
 
@@ -1035,10 +1034,12 @@ mod tests {
     ) -> (TransportAdmission, TransportInvocation) {
         let mut request = invocation_for(CALLER, request_id).request;
         edit(&mut request);
-        let invocation =
-            TransportInvocation::new(CALLER, 2_000, [7; 32], request).unwrap();
+        let invocation = TransportInvocation::new(CALLER, 2_000, [7; 32], request).unwrap();
         let envelope = encrypt_invocation(&invocation, &security(KEY)).unwrap();
-        (service.begin_unplanned(&envelope, 1_000, FRAME).unwrap(), invocation)
+        (
+            service.begin_unplanned(&envelope, 1_000, FRAME).unwrap(),
+            invocation,
+        )
     }
 
     fn refusal_of(admission: TransportAdmission, invocation: &TransportInvocation) -> Refusal {
@@ -1118,14 +1119,9 @@ mod tests {
                 32_768,
             )
             .unwrap();
-            TransportService::open(
-                &store.path,
-                "fixture-sse",
-                [admission],
-                5_000,
-            )
-            .unwrap()
-            .begin_unplanned(&envelope, 1_000, FRAME)
+            TransportService::open(&store.path, "fixture-sse", [admission], 5_000)
+                .unwrap()
+                .begin_unplanned(&envelope, 1_000, FRAME)
         };
         assert!(matches!(admit(size), Ok(TransportAdmission::Execute(_))));
         let refused = admit(size - 1).unwrap();
@@ -1272,15 +1268,7 @@ mod tests {
     #[test]
     fn identities_are_bounded_at_admission_and_on_the_request() {
         let admit = |caller_id: String, model: String| {
-            CallerAdmission::new(
-                caller_id,
-                KEY,
-                1,
-                [model],
-                4,
-                64 * 1024,
-                32_768,
-            )
+            CallerAdmission::new(caller_id, KEY, 1, [model], 4, 64 * 1024, 32_768)
         };
         let at = "i".repeat(MAX_IDENTITY_BYTES);
         let over = "i".repeat(MAX_IDENTITY_BYTES + 1);
@@ -1298,7 +1286,9 @@ mod tests {
         let mut service = open_service(&store, 8);
         let ok = invocation_for(CALLER, &at);
         assert!(matches!(
-            service.begin_unplanned(&raw_envelope(&ok), 1_000, FRAME).unwrap(),
+            service
+                .begin_unplanned(&raw_envelope(&ok), 1_000, FRAME)
+                .unwrap(),
             TransportAdmission::Execute(_)
         ));
     }
@@ -1315,8 +1305,9 @@ mod tests {
             let mut service = open_service(&store, 1);
             let id = "i".repeat(length);
             let long = invocation_for(CALLER, &id);
-            let TransportAdmission::Reply(reply) =
-                service.begin_unplanned(&raw_envelope(&long), 1_000, FRAME).unwrap()
+            let TransportAdmission::Reply(reply) = service
+                .begin_unplanned(&raw_envelope(&long), 1_000, FRAME)
+                .unwrap()
             else {
                 panic!("an over-long id must be refused, not executed ({length})");
             };
@@ -1353,7 +1344,9 @@ mod tests {
         let store = TestStore::new();
         let mut service = open_service(&store, 1);
         assert!(matches!(
-            service.begin_unplanned(&raw_envelope(&long), 1_000, frame_cap).unwrap(),
+            service
+                .begin_unplanned(&raw_envelope(&long), 1_000, frame_cap)
+                .unwrap(),
             TransportAdmission::Reply(_)
         ));
         assert_eq!(
@@ -1543,7 +1536,9 @@ mod tests {
         let big = text_result(claim.call(), "y");
         service.complete(*claim, big, FRAME).unwrap();
         assert_eq!(
-            service.begin_unplanned(&raw_envelope(&invocation), 1_000, 10).err(),
+            service
+                .begin_unplanned(&raw_envelope(&invocation), 1_000, 10)
+                .err(),
             Some(ServiceError::FrameBound)
         );
     }
@@ -1758,25 +1753,15 @@ mod tests {
         for tag in ["", " ", STAND_IN_PROVIDER] {
             assert!(
                 matches!(
-                    TransportService::open(
-                        &store.path,
-                        tag,
-                        [caller(CALLER, KEY, 1)],
-                        5_000
-                    ),
+                    TransportService::open(&store.path, tag, [caller(CALLER, KEY, 1)], 5_000),
                     Err(ServiceError::InvalidAdmission)
                 ),
                 "{tag:?}"
             );
         }
         assert!(
-            TransportService::open(
-                &store.path,
-                "fixture-sse",
-                [caller(CALLER, KEY, 1)],
-                5_000
-            )
-            .is_ok()
+            TransportService::open(&store.path, "fixture-sse", [caller(CALLER, KEY, 1)], 5_000)
+                .is_ok()
         );
     }
 
@@ -2060,12 +2045,7 @@ mod tests {
                 .unwrap();
         }
         assert!(matches!(
-            TransportService::open(
-                &store.path,
-                "fixture-sse",
-                [caller(CALLER, KEY, 1)],
-                5_000
-            ),
+            TransportService::open(&store.path, "fixture-sse", [caller(CALLER, KEY, 1)], 5_000),
             Err(ServiceError::ReplayStore(_))
         ));
     }
diff --git a/crates/model-connector/src/service/lease.rs b/crates/model-connector/src/service/lease.rs
index 0e2c37e..5d55bf3 100644
--- a/crates/model-connector/src/service/lease.rs
+++ b/crates/model-connector/src/service/lease.rs
@@ -128,16 +128,10 @@ mod tests {
         TransportService::open(
             &store.path,
             "fixture-sse",
-            [CallerAdmission::new(
-                CALLER,
-                KEY,
-                1,
-                ["gpt-5.4".to_string()],
-                1,
-                65_536,
-                32_768,
-            )
-            .unwrap()],
+            [
+                CallerAdmission::new(CALLER, KEY, 1, ["gpt-5.4".to_string()], 1, 65_536, 32_768)
+                    .unwrap(),
+            ],
             5_000,
         )
         .unwrap()
@@ -185,7 +179,10 @@ mod tests {
     fn a_lease_is_named_by_its_invocation() {
         let store = TestStore::new();
         let mut service = open(&store);
-        assert_eq!(granted(lease(&mut service, "run-1")).lease_id, "lease:run-1");
+        assert_eq!(
+            granted(lease(&mut service, "run-1")).lease_id,
+            "lease:run-1"
+        );
     }
 
     #[test]
@@ -231,14 +228,28 @@ mod tests {
         );
         assert_eq!(
             service
-                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-2", NOW + 99, NOW + 9, &none())
+                .begin_lease(
+                    CALLER,
+                    LeaseTurn::SelfRun,
+                    "run-2",
+                    NOW + 99,
+                    NOW + 9,
+                    &none()
+                )
                 .unwrap(),
             LeaseAdmission::Refused(LeaseRefusal::Busy),
             "one millisecond before its expiry the lease still holds"
         );
         granted(
             service
-                .begin_lease(CALLER, LeaseTurn::SelfRun, "run-2", NOW + 99, NOW + 10, &none())
+                .begin_lease(
+                    CALLER,
+                    LeaseTurn::SelfRun,
+                    "run-2",
+                    NOW + 99,
+                    NOW + 10,
+                    &none(),
+                )
                 .unwrap(),
         );
     }
@@ -249,7 +260,14 @@ mod tests {
         let mut service = open(&store);
         assert_eq!(
             service
-                .begin_lease("stranger", LeaseTurn::SelfRun, "run-1", NOW + 1, NOW, &none())
+                .begin_lease(
+                    "stranger",
+                    LeaseTurn::SelfRun,
+                    "run-1",
+                    NOW + 1,
+                    NOW,
+                    &none()
+                )
                 .unwrap(),
             LeaseAdmission::Refused(LeaseRefusal::UnknownCaller)
         );
@@ -286,8 +304,7 @@ mod tests {
         let call = |service: &mut TransportService, now: u64, plan: &PlanQuotaSnapshot| {
             let mut asked = request();
             asked.request_id = format!("call-{now}");
-            let invocation =
-                TransportInvocation::new(CALLER, now + 1_000, [7; 32], asked).unwrap();
+            let invocation = TransportInvocation::new(CALLER, now + 1_000, [7; 32], asked).unwrap();
             let sealed = crate::envelope::encrypt_message(
                 CALLER,
                 invocation.request_id(),
@@ -301,7 +318,8 @@ mod tests {
             else {
                 return None;
             };
-            let result = crate::envelope::decrypt_result(&reply, &security(KEY), &invocation).unwrap();
+            let result =
+                crate::envelope::decrypt_result(&reply, &security(KEY), &invocation).unwrap();
             match result.disposition {
                 TransportDisposition::Refused(refusal) => Some(refusal),
                 other => panic!("unexpected {other:?}"),
@@ -361,7 +379,12 @@ mod tests {
         let store = TestStore::new();
         let mut service = open(&store);
         let longest = "r".repeat(MAX_IDENTITY_BYTES - LEASE_PREFIX.len() - PERSONA_SUFFIX.len());
-        let grant = granted(lease_in(&mut service, LeaseTurn::PersonaTurn, &longest, &none()));
+        let grant = granted(lease_in(
+            &mut service,
+            LeaseTurn::PersonaTurn,
+            &longest,
+            &none(),
+        ));
         assert_eq!(grant.lease_id.len(), MAX_IDENTITY_BYTES);
         assert!(lease_try(&mut service, LeaseTurn::PersonaTurn, &format!("{longest}r")).is_err());
     }
diff --git a/crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame b/crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame
index b531c71..355d501 100644
--- a/crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame
+++ b/crates/model-connector/tests/fixtures/wire_v4/carriage_invocation.frame
@@ -1 +1 @@
-‡©messageId®golden-request©operation¦invoke§payloadÚDhqlzY2hlbWFfaWTZJGdhbWVjdWx0Lm1vZGVsLnRyYW5zcG9ydF9lbnZlbG9wZS52M7FjYWxsZXJfcnVudGltZV9pZK1nb2xkZW4tY2FsbGVyqnJlcXVlc3RfaWSuZ29sZGVuLXJlcXVlc3SsbWVzc2FnZV9raW5kqkludm9jYXRpb26lbm9uY2WczO7MxRrMxw7MhTh7SMzwzNB2qmNpcGhlcnRleHTFA0d65EskLG6kIwJ/G+XDK03gZOGtLFi6vZHJbI+/KpRLwnLT0TPF7RQa0KD98CrW+VwkKY3sRa4+Z9+/5OdPq1YmDFwbxvMVjZsFjXXw84tzvuLKHsb/3kQSEvAlFE4K6FXHvznLcMo4CnGUzoXwNGALf+xDTqFG0aFbdG4xGynV/kttsL6f34F4+l6xiXMUy87Q8/1UyOK/YaVxMMmlT3tdTllhq8YU8Dvfq0KuMaj/f9Anya8A5bJwlxafZPtc53RoH1/oNjLdaDqvwrTEnTB9TvKlnEOxKyyKhmmwGaC03qqPJXRaj8cDQO6EHDbML4J0zMN8TvssQISd5UCeVMkvDGjmvEOmRUoPk1/SnSrIHdha4+6rU4lUSumloLmlx5vv++Mq4AqzOdd/vPB6Ov/AoF32X27o4RI6H3xCKKHjKC4m3+cVjXCrOcGojuRf9yeDFkgbiPaC31hmSc8rAm6HO/NcaIHvx+G+6AaurAEhDLdF6DdrXb4xwjuv6yWQKihNvLXpnwmhRFkSeD5lS6FHW+CoOIdq/RBnFFyDrboTPWFoxQYIrBuqFoHDOajIz7dXYif0sf9sB9JBrDhlcbTpiGcyURfzDhW55NOPqKFGi6ropaJ1/SyLP3f7E57kA22aQ2Op7o36Tu06Pnzo2wI7UsL/Qz27F+AGAukQCvTJyjxARiGr3TRpChjVXx6GXhLrG1T9P+Mrhyrt9vwwhboN8qz1uvDZwKhGWBKXPXkxluq/NY1DwB3JTCCZfEwukWjMZbqiINLEKvW9BStcBR1kfXcK6sQvn/F0g9r81e9brbe+w3U24GERnHwgruOqytTeax/xPbQ7uISV48g5L8DAYf788KhUXwI43QDHNBdBUyo0rCsgoWJKeO05fcAgKgYYGsyLtMW10Vstw3q4POyn3o7rrBz4S2cnl2iZgr0ixg/KgF0V+loEVuj/6rYrcW0SLCHwV1+w1ClFMn0ZPsrz28EoZMA617G0Rrch66cS5uI9/Zf/wLX3z6n7xoPLNXk51ZsLSZ2bqEQkcBJbW/dT5MdH6anWVogRDvIW1coUbkIq9l+pkQSuelWsfakX4UQwYuUD0UwNbqxHiGwlEFj0f1bdhEj26Q==¯payloadEncoding²messagepack-base64­payloadSchemaÙ$gamecult.model.transport_envelope.v3­schemaVersion¼cultnet.operation_request.v0©serviceId¸gamecult.model.connector
\ No newline at end of file
+‡©messageId®golden-request©operation¦invoke§payloadÚ(hqlzY2hlbWFfaWTZJGdhbWVjdWx0Lm1vZGVsLnRyYW5zcG9ydF9lbnZlbG9wZS52NLFjYWxsZXJfcnVudGltZV9pZK1nb2xkZW4tY2FsbGVyqnJlcXVlc3RfaWSuZ29sZGVuLXJlcXVlc3SsbWVzc2FnZV9raW5kqkludm9jYXRpb26lbm9uY2WcXSbMzU3MhsyCzLAtzKLMhcy8zMSqY2lwaGVydGV4dMUDMY816tn0FGQ9jqxE+KyDVcxmhufaQI7vzEXO8NXTQPOYpRuMcRDM/j/QzNF2Lb3Fak0G+hHRKrXDxJ3MeKpoELNYOEyxbKfxn88mjAyyc7BVPM7+0Bk9ye3m5oBF6hoyCgOHSTwESIfq0bim+9oQh1IDp+HdFjztK/XjM731GRzKJmGgxsKqQsz42zq8y9mjAXl3V1RR9ssdKvk2k5U56/3liOeHDU96kOa7IlVCBm6qnn06hg2DTtnBF4xGj6PihHj4KufVkAcuQhRCZWOKsploToXo7wy+jcQDrnhHIUCMN6sk3P9YJh1ejuleDM9rp3RYiXcnzRwMNXK1AGpNraTgWn91d6L/1Ff+gaQBgPxSjW6FATshJf9Iqk9pEhT8xeCQMmNj40CdlVFYNz/TsRJYW45BXm8g83Jnh3Wj0Z90WJ80bwwgZbjPWx6wCOCID6Jo8wiubF6411ygi+GUHTR9rZFhrsGo6TSmsbvIAuabUJcskqKHW7tqVkfpz5JdjyeSSDvKcZ3PQyVne7Lyo8nzNh0g06a7CEUvq9kvr4zfTCfwk/1YVSrZ+7U8ePGj27V3D8+BH/pafiLR5FxxBKWBTYe7n5irVP5gLw4WlzOrSriXpolmaPWujCm3apml45mhlYARdfJJbpQxnQGb6cI3D/vAxxI50BPLB82JqCjNFex9xwfP5jSRDYah9wLm4yVymBqZ8Wvn0maLz4OvF2EonJBwEtN73UBULkdeX6g9GTiu2MKtCjSMm33SkwiHfvDdwMDS11sINK+YQLF/3HobbnAk2n963JahlddNRg79T96GksjN0br8u1PNMC+/uBUHEQvUBfRnR4tKp+SeLF6zMn228orgHgWr7sxilMwTOP1DgXpbEE19M0P8XC0CA/pTeHr4eFHzakPLotxF8avQfPKAXbXWgNGK6uWj1NGPshD6EN3pLvePOc4uObqHMKz/dg52/7m1VTHhYMivSRenG6H/BrWfUXQvcgCPalg7C4KCPYINb3nnRxP0NIOBP+KJ4S2haU94ZNHVr2HB038xNzUm2HrONVBsxuuTckYDmHfCa6FmvVJv4she5wyuPHk=¯payloadEncoding²messagepack-base64­payloadSchemaÙ$gamecult.model.transport_envelope.v4­schemaVersion¼cultnet.operation_request.v0©serviceId¸gamecult.model.connector
\ No newline at end of file
diff --git a/crates/model-connector/tests/fixtures/wire_v4/provider_request.mp b/crates/model-connector/tests/fixtures/wire_v4/provider_request.mp
index 9ff75e4ce83891c17b6d223ad6da896c4ecc0ae5..26d45cb706dcb48a23d865aaca00cea6f3683bcf 100644
GIT binary patch
delta 12
TcmZ3=vXo_l9;3-d{cnr_8k7Vb

delta 12
TcmZ3=vXo_l9;5L_{cnr_8jl1V

diff --git a/crates/model-connector/tests/fixtures/wire_v4/transport_envelope.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_envelope.mp
index cc0d7fe9999a3a34da44baf71477f9e16d74dcb2..9b361fa771b0d323c52b384bc7131e79cbc4faff 100644
GIT binary patch
delta 11
ScmX@hc$RU30i(%8!#MyLw*&A1

delta 11
ScmX@hc$RU30i*Fm!#MyLvjgt{

diff --git a/crates/model-connector/tests/fixtures/wire_v4/transport_invocation.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_invocation.mp
index dff0ca28b054caeaea7a24b39f301fb7aba54c9d..4981058c747a59ea8cf0945378574dba786001be 100644
GIT binary patch
delta 75
zcmV-R0JQ(N2B8K4hLHg=0W^^_kTE#SwsLeH%-GDCFwB9>xy-@~bRlQVoXqdc`^<$j
hC1MN_%&g4N%+AdC%*4#l%=!$I3IR3&G_yeg_5n?^B|iWF

delta 96
zcmV-m0H6P%2Db(Qhmip>0W*;^kVi^wdd#lO+6~P6%!<t6%=yfbR?Pk&%*ap}Z#&GJ
z%)n=U2F!&^%!xb9q0H$FI<jqHcwb|0b97&AX=8G4Uv+b2&HzkHK#}w|0W-5J0rmm%
C;Vr)a

diff --git a/crates/model-connector/tests/fixtures/wire_v4/transport_receipt_failed.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_receipt_failed.mp
index 385a3188e4656e1de2360443cb81bdd64346d8da..2a6635f46b3b3fea94a69c89f29f6fdcb788e287 100644
GIT binary patch
delta 71
zcmV-N0J#5!1mFV!iID*=0W^^?jxjjQwsLeH%-GDCFwB9>xy-@~bRlQVoXqdc`^<$j
dC1MN_%&g4N%+AdC%*4#l%=!$G?M;(m0i?trC9wbi

delta 109
zcmaFB+{(h(J&{q5(RiXkpT1Xa)tPl?Zt<S^eWvTo!!tk6Obk2oPvOjo0Ev9-GqcYe
zNUvi%)9QVu)B4Q9GcS3pCcgJoUzeO;ToRv~nOu|~Us{}UjzQ>J`^NmT)S{x&JcMxM
IWE;jM0F5s+d;kCd

diff --git a/crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp
index 0c4f7b1..3bd43b9 100644
--- a/crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp
+++ b/crates/model-connector/tests/fixtures/wire_v4/transport_result_refused.mp
@@ -1 +1 @@
-„©schema_idÙ"gamecult.model.transport_result.v3ªrequest_id®golden-request±caller_runtime_id­golden-caller«disposition�§Refused«OutputBound
\ No newline at end of file
+„©schema_idÙ"gamecult.model.transport_result.v4ªrequest_id®golden-request±caller_runtime_id­golden-caller«disposition�§Refused«OutputBound
\ No newline at end of file
diff --git a/crates/model-connector/tests/fixtures/wire_v4/transport_result_transported.mp b/crates/model-connector/tests/fixtures/wire_v4/transport_result_transported.mp
index 79e6ebd3cd6a3a79292b265afe20da18941a2f1a..8ccef86d52d627839cd86ad4f8e4a17ea892bc56 100644
GIT binary patch
delta 85
zcmV-b0IL7F2b2epE&(*LFNgsFiIcbiE&()=FFKPU0#q?L%(ilL9?aOxnJ~<O%(=|M
r3v?l8%$&^c%=^rRG$mpT5zMU2(9F)v_{_x2(9HS_lcWMolNbY`6SFAX

delta 123
zcmbQjzLR}|9;5L_{SHRP?#VkCf$WL;R+AN(LiD|ItIn)DbBp)P?=xLz9-jGmW@6Zx
ze+p+#1W4ptpP7B;Kzbe9nO5&Joz`a-o_Wb*HF+76ull;={Nj@M+|1;n{P@!1lyeM1
W*V;Gcm!%dJmF6LYBPV}mS_lAM>NuqU

diff --git a/schemas/transport_invocation.json b/schemas/transport_invocation.json
index 7c32147..5435b2e 100644
--- a/schemas/transport_invocation.json
+++ b/schemas/transport_invocation.json
@@ -11,12 +11,6 @@
       "format": "uint64",
       "minimum": 0
     },
-    "max_cost_micro_usd": {
-      "description": "The most this request may cost, in micro-USD: the caller's own bound\non it. Required nonzero. It is part of the invocation's identity, so a\nchanged budget under a recorded request id is a `ReplayConflict`.",
-      "type": "integer",
-      "format": "uint64",
-      "minimum": 0
-    },
     "native_request_sha256": {
       "type": "array",
       "items": {
@@ -53,7 +47,6 @@
     "expires_at_unix_ms",
     "native_request_sha256",
     "provider_request_sha256",
-    "max_cost_micro_usd",
     "request"
   ],
   "$defs": {
diff --git a/schemas/transport_receipt.json b/schemas/transport_receipt.json
index 01ff920..0011d79 100644
--- a/schemas/transport_receipt.json
+++ b/schemas/transport_receipt.json
@@ -6,12 +6,6 @@
     "caller_runtime_id": {
       "type": "string"
     },
-    "cost_micro_usd": {
-      "description": "What the request cost, in micro-USD. The service derives it from the\noutcome's usage and its price table; a backend never writes it.",
-      "type": "integer",
-      "format": "uint64",
-      "minimum": 0
-    },
     "foreign_reasoning_dropped": {
       "description": "How many foreign `ReasoningState` items the service removed from the\nrequest before the backend saw it.",
       "type": "integer",
@@ -35,12 +29,6 @@
     "outcome": {
       "$ref": "#/$defs/TransportOutcome"
     },
-    "overrun_micro_usd": {
-      "description": "How far `cost_micro_usd` exceeds what the service reserved for the\nrequest: zero unless the backend reported usage above the worst case\nthe request allowed, which is a breach of the backend's contract. The\ncost is still the true one and the caller's window is charged all of\nit. The service derives this; a backend never writes it.",
-      "type": "integer",
-      "format": "uint64",
-      "minimum": 0
-    },
     "provider": {
       "type": "string"
     },
@@ -72,8 +60,6 @@
     "model",
     "provider",
     "foreign_reasoning_dropped",
-    "cost_micro_usd",
-    "overrun_micro_usd",
     "outcome"
   ],
   "$defs": {
@@ -174,7 +160,7 @@
       ]
     },
     "Usage": {
-      "description": "Token accounting for one request, as the backend reports it; the service\nprices it. Cache reads and writes are counted apart from plain input.\n`output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail\n(absent when the provider does not report it) and is never priced apart.",
+      "description": "Token accounting for one request, as the backend reports it. Cache reads\nand writes are counted apart from plain input.\n`output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail\n(absent when the provider does not report it) and is never counted apart.",
       "type": "object",
       "properties": {
         "cache_read_tokens": {
diff --git a/schemas/transport_result.json b/schemas/transport_result.json
index 39e010f..4ba4597 100644
--- a/schemas/transport_result.json
+++ b/schemas/transport_result.json
@@ -46,15 +46,13 @@
         "ModelNotAllowed",
         "OutputBound",
         "PayloadBound",
-        "CostBound",
-        "SpendCeiling",
         "Capacity",
         "InFlight",
         "Indeterminate",
         "ReplayConflict",
         "Malformed",
         "ForeignReasoningState",
-        "ClockBehindAdmissionWindow"
+        "ProviderRejected"
       ]
     },
     "StopReason": {
@@ -286,12 +284,6 @@
         "caller_runtime_id": {
           "type": "string"
         },
-        "cost_micro_usd": {
-          "description": "What the request cost, in micro-USD. The service derives it from the\noutcome's usage and its price table; a backend never writes it.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
         "foreign_reasoning_dropped": {
           "description": "How many foreign `ReasoningState` items the service removed from the\nrequest before the backend saw it.",
           "type": "integer",
@@ -315,12 +307,6 @@
         "outcome": {
           "$ref": "#/$defs/TransportOutcome"
         },
-        "overrun_micro_usd": {
-          "description": "How far `cost_micro_usd` exceeds what the service reserved for the\nrequest: zero unless the backend reported usage above the worst case\nthe request allowed, which is a breach of the backend's contract. The\ncost is still the true one and the caller's window is charged all of\nit. The service derives this; a backend never writes it.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0
-        },
         "provider": {
           "type": "string"
         },
@@ -352,13 +338,11 @@
         "model",
         "provider",
         "foreign_reasoning_dropped",
-        "cost_micro_usd",
-        "overrun_micro_usd",
         "outcome"
       ]
     },
     "Usage": {
-      "description": "Token accounting for one request, as the backend reports it; the service\nprices it. Cache reads and writes are counted apart from plain input.\n`output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail\n(absent when the provider does not report it) and is never priced apart.",
+      "description": "Token accounting for one request, as the backend reports it. Cache reads\nand writes are counted apart from plain input.\n`output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail\n(absent when the provider does not report it) and is never counted apart.",
       "type": "object",
       "properties": {
         "cache_read_tokens": {
diff --git a/schemas/usage_readout.json b/schemas/usage_readout.json
new file mode 100644
index 0000000..8f321fa
--- /dev/null
+++ b/schemas/usage_readout.json
@@ -0,0 +1,68 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "UsageReadout",
+  "type": "object",
+  "properties": {
+    "at_unix_ms": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0
+    },
+    "plan_quota": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/PlanQuota"
+      }
+    },
+    "schema_id": {
+      "type": "string"
+    }
+  },
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "at_unix_ms",
+    "plan_quota"
+  ],
+  "$defs": {
+    "PlanQuota": {
+      "description": "One window of the subscription plan, as the provider reported it.",
+      "type": "object",
+      "properties": {
+        "observed_at_unix_ms": {
+          "description": "When this window was last reported. Its age in a readout is the\nreadout's `at_unix_ms` minus this.",
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "resets_at_unix_ms": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0
+        },
+        "status": {
+          "type": "string"
+        },
+        "utilization_permille": {
+          "description": "How much of the window was used when it was observed, in thousandths;\n`None` once the window has reset (`status` is then `expired`), because\nthe old reading says nothing about the new window.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0
+        },
+        "window": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "window",
+        "resets_at_unix_ms",
+        "status",
+        "observed_at_unix_ms"
+      ]
+    }
+  }
+}

From a828602649b662c16425c28826d229fb116928be Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:54:14 +0100
Subject: [PATCH 21/37] connector-usage-only: drop a stray doc comment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/tests/lease.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 4bd3941..1128a06 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -215,8 +215,6 @@ fn granted_ok(answer: &Answer) -> bool {
     matches!(answer.message, Some(LeaseMessage::ClaudeLeaseGrant(_))) && answer.fds.len() == 1
 }
 
-/// Asks, as a fresh unit invocation each time, until the caller's previous
-
 fn contains(haystack: &[u8], needle: &str) -> bool {
     haystack
         .windows(needle.len())

From 7d9a6392a7f155bd2febe0c49f61488ff8a7294f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 04:59:02 +0100
Subject: [PATCH 22/37] connector-usage-only: comments

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/backend/tests.rs | 8 ++++----
 crates/claude-connector/src/lease.rs         | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index e53b9f7..bcb302f 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -61,7 +61,7 @@ const USAGE: &str = r#"{"claude-haiku-5-5":{"inputTokens":2,"outputTokens":4,"ca
 
 /// What a resumed session's `modelUsage` says: every turn so far. Every result
 /// fixture carries it beside the turn's own `model_usage_since_last_result`,
-/// so reading the wrong field shows in a price.
+/// so reading the wrong field shows in a count.
 const CUMULATIVE: &str = r#"{"claude-haiku-5-5":{"inputTokens":900000,"outputTokens":900000,"cacheReadInputTokens":900000,"cacheCreationInputTokens":900000,"thinkingTokens":900000,"costUSD":99.0}}"#;
 
 fn result_line(stop_reason: &str, since_last: &str) -> String {
@@ -1704,7 +1704,7 @@ fn backend_end_to_end_through_the_service() {
     let (events, receipt) = parts(&opened);
     assert_eq!(receipt.provider, "claude-code");
     assert_eq!(receipt.model, MODEL);
-    // USAGE priced at the table: 2*3 + 7*0.3 + 1043*6 + 4*15 micro-USD, rounded up.
+    // USAGE counted: 2 input, 7 cache read, 1043 cache write, 4 output.
     assert_eq!(events.len(), 2);
     let items = opened.transcript_items();
     assert_eq!(items[0], assistant("hello back"));
@@ -1809,7 +1809,7 @@ fn door_set_is_exactly_401_403_429() {
     // validity: a refusal at the door is charged nothing, for exactly the
     // statuses the provider cannot have billed (401, 403, 429) and only when
     // the result says its usage is explicitly empty. Every other shape is
-    // billed the reservation. The 401 shape is a real claude 2.1.312 capture
+    // the usage is unknown. The 401 shape is a real claude 2.1.312 capture
     // with a bogus token.
     let retry = r#"{"type":"system","subtype":"api_retry","error":"authentication_failed"}"#;
     let synthetic = r#"{"type":"assistant","api_error_status":401,"error":"authentication_failed","message":{"id":"e48001b7-cf4f-49b1-9810-db8fd7f73c73","model":"<synthetic>","stop_reason":"stop_sequence","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 OAuth access token is invalid."}]}}"#;
@@ -2641,7 +2641,7 @@ fn a_result_that_made_no_api_call_bills_nothing() {
         ("", 0, empty, true),
         ("", 0, "", true),
         // An API call was made, or the status names a server fault, or the
-        // CLI reported rows: the reservation stands.
+        // CLI reported rows: the usage stays unknown.
         ("", 2300, empty, false),
         (r#""api_error_status":500,"#, 0, empty, false),
         (
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
index 2974a42..0d4a582 100644
--- a/crates/claude-connector/src/lease.rs
+++ b/crates/claude-connector/src/lease.rs
@@ -386,7 +386,7 @@ struct Lender {
 }
 
 /// Serves leases on `listener` until it fails. Each connection is one lease:
-/// request, then grant or refusal, then (after a grant) settle. A caller is
+/// request, then grant or refusal, then (after a grant) the hold. A caller is
 /// the account whose uid the kernel reports for the connection, and only a
 /// process in that caller's unit may lease, once per unit invocation for a Self
 /// run and once per turn for a Persona; no
@@ -420,7 +420,7 @@ pub fn serve_leases(
             .spawn(move || {
                 let _permit = permit;
                 // A connection that fails is dropped; the lease it may have
-                // held is settled inside `lend`.
+                // held is ended inside `lend`.
                 let _ = lender.lend(stream);
             })?;
     }

From 9db62027eb1e6a2f7a47fdfb3cb5f118c5b96da7 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 05:08:19 +0100
Subject: [PATCH 23/37] connector-usage-only: comment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/backend/tests.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index bcb302f..61ee59d 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -1805,7 +1805,7 @@ fn usage_the_result_does_not_report_stays_unknown() {
 
 #[test]
 fn door_set_is_exactly_401_403_429() {
-    // Ruling claude-code-plan-quota-fuse-2 with spend-bills-on-identity-not-
+    // Ruling claude-code-plan-quota-fuse-2 with its
     // validity: a refusal at the door is charged nothing, for exactly the
     // statuses the provider cannot have billed (401, 403, 429) and only when
     // the result says its usage is explicitly empty. Every other shape is

From 9f1088716905c32ad057351fc815de4d7d3cb95b Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 05:27:38 +0100
Subject: [PATCH 24/37] lease v2: byte goldens, hold-loop and lease-helper
 tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/fixtures/lease_v2/README.md         | 16 ++++
 crates/claude-connector/tests/lease.rs        | 96 +++++++++++++++++++
 .../tests/lease_wire_golden.rs                | 95 ++++++++++++++++++
 3 files changed, 207 insertions(+)
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/README.md
 create mode 100644 crates/claude-connector/tests/lease_wire_golden.rs

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/README.md b/crates/claude-connector/tests/fixtures/lease_v2/README.md
new file mode 100644
index 0000000..3cc9766
--- /dev/null
+++ b/crates/claude-connector/tests/fixtures/lease_v2/README.md
@@ -0,0 +1,16 @@
+# lease_v2 fixtures
+
+The exact bytes of the claude lease protocol v2: each file is one whole frame (a u32
+big-endian length, then the named-MessagePack map `{kind, value}`).
+
+- `request.bin`: `claude_lease_request`.
+- `refusal_unknown_caller.bin`, `refusal_expired.bin`, `refusal_busy.bin`,
+  `refusal_provider_rejected.bin`: `claude_lease_refusal`; `kind` is the variant name as a
+  PascalCase string.
+- `grant.bin`: `claude_lease_grant` with `lease_id` and `plan_quota` carrying `five_hour` and
+  `seven_day` windows (utilization_permille, resets_at_unix_ms, status, observed_at_unix_ms).
+  On the wire the grant travels with one SCM_RIGHTS fd; the file holds the frame only.
+
+Huginn's lease client vendors these files from this repository and tests against the same
+bytes. Generator: `tests/lease_wire_golden.rs`; run it with `LEASE_V2_REGENERATE=1`, then
+review the diff: a changed byte is a wire change.
diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 1128a06..2938070 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -543,3 +543,99 @@ fn connections_past_the_limit_are_dropped_and_finished_ones_free_their_place() {
     drop(first);
     assert!(granted_ok(&ask_until_granted(&harness, 2)));
 }
+
+#[test]
+fn a_lease_survives_many_polls_while_its_holder_and_invocation_stay() {
+    let harness = start(setup());
+    let mut first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    // Three polls later the lease still holds: a second invocation is Busy.
+    std::thread::sleep(Duration::from_millis(1_700));
+    harness.enter(2);
+    let second = ask(&harness, 60_000);
+    assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
+    // The holder talking does not end it either.
+    first._stream.write_all(b"x").unwrap();
+    std::thread::sleep(Duration::from_millis(1_200));
+    harness.enter(3);
+    assert_eq!(
+        refusal_of(&ask(&harness, 60_000)),
+        Some(LeaseRefusalKind::Busy)
+    );
+}
+
+#[test]
+fn a_lease_ends_when_the_unit_runs_a_different_invocation() {
+    let harness = start(setup());
+    let first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    // The same unit, a new invocation: the one that leased is over.
+    harness.enter(2);
+    std::thread::sleep(Duration::from_millis(1_200));
+    assert!(granted_ok(&ask(&harness, 60_000)));
+    drop(first);
+}
+
+#[test]
+fn a_lease_asks_the_system_about_its_holders_process_for_its_own_unit() {
+    let harness = start(setup());
+    let first = ask(&harness, 60_000);
+    assert!(granted_ok(&first));
+    std::thread::sleep(Duration::from_millis(1_200));
+    let asked = harness.units.as_ref().unwrap().asked_about.lock().unwrap().clone();
+    assert!(asked.len() >= 3, "the hold polled: {asked:?}");
+    assert!(asked.iter().all(|(_, unit)| unit == UNIT));
+}
+
+#[test]
+fn an_account_resolves_to_its_uid_and_a_missing_one_to_none() {
+    assert_eq!(claude_connector::user_uid("root"), Some(0));
+    assert_eq!(claude_connector::user_uid("no-such-account-4c1f9a"), None);
+    assert_eq!(claude_connector::user_uid("bad\0name"), None);
+}
+
+#[test]
+fn a_token_up_to_one_atomic_pipe_write_is_lent_and_a_longer_one_is_not() {
+    let exact: &'static str = Box::leak("a".repeat(4096).into_boxed_str());
+    let harness = start(Setup {
+        token: Some(exact),
+        ..setup()
+    });
+    let mut answer = ask(&harness, 60_000);
+    assert!(granted_ok(&answer));
+    let mut read = Vec::new();
+    File::from(answer.fds.remove(0))
+        .read_to_end(&mut read)
+        .unwrap();
+    assert_eq!(read.len(), 4096);
+
+    let long: &'static str = Box::leak("a".repeat(4097).into_boxed_str());
+    let harness = start(Setup {
+        token: Some(long),
+        ..setup()
+    });
+    let refused = ask(&harness, 60_000);
+    assert!(refused.message.is_none() && refused.fds.is_empty());
+}
+
+#[test]
+fn a_request_trickled_past_the_socket_timeout_is_dropped_without_a_lease() {
+    let harness = start(setup());
+    let mut stream = UnixStream::connect(&harness.socket).unwrap();
+    stream
+        .set_read_timeout(Some(Duration::from_secs(8)))
+        .unwrap();
+    stream.write_all(&[0, 0]).unwrap();
+    let started = Instant::now();
+    let mut byte = [0_u8; 1];
+    let outcome = stream.read(&mut byte);
+    // The listener gave up at its own two-second bound and closed the
+    // connection: end of file or a reset, never our own read timing out.
+    assert!(
+        matches!(outcome, Ok(0))
+            || outcome.as_ref().is_err_and(|e| e.kind() == std::io::ErrorKind::ConnectionReset),
+        "{outcome:?}"
+    );
+    assert!(started.elapsed() < Duration::from_secs(6));
+    assert_eq!(harness.tokens.reads.load(Ordering::SeqCst), 0);
+}
diff --git a/crates/claude-connector/tests/lease_wire_golden.rs b/crates/claude-connector/tests/lease_wire_golden.rs
new file mode 100644
index 0000000..e0edec2
--- /dev/null
+++ b/crates/claude-connector/tests/lease_wire_golden.rs
@@ -0,0 +1,95 @@
+//! Pins the bytes of the lease protocol v2: every frame a lease client sends
+//! or receives. The fixtures in `fixtures/lease_v2` are the contract's bytes
+//! for other implementations (Huginn's lease client vendors them and tests
+//! against the same bytes); the types in `claude_connector::lease` own the
+//! shape. Regenerate with `LEASE_V2_REGENERATE=1`, then review the diff.
+#![cfg(target_os = "linux")]
+
+use std::path::{Path, PathBuf};
+
+use claude_connector::{
+    LeaseGranted, LeaseMessage, LeaseRefusalKind, LeaseRefused, LeaseRequest, decode_frame,
+    encode_frame,
+};
+use model_connector::PlanQuota;
+
+const REGENERATE: &str = "LEASE_V2_REGENERATE";
+
+fn fixtures() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/lease_v2")
+}
+
+fn assert_frame(name: &str, message: &LeaseMessage) {
+    let path = fixtures().join(name);
+    let bytes = encode_frame(message);
+    if std::env::var_os(REGENERATE).is_some() {
+        std::fs::create_dir_all(fixtures()).unwrap();
+        std::fs::write(&path, &bytes).unwrap();
+    }
+    let committed = std::fs::read(&path).unwrap_or_else(|_| panic!("{name} is missing"));
+    assert_eq!(committed, bytes, "{name} is not what the types encode");
+    assert_eq!(decode_frame(&committed).as_ref(), Some(message), "{name}");
+}
+
+#[test]
+fn the_request_frame_is_pinned() {
+    assert_frame(
+        "request.bin",
+        &LeaseMessage::ClaudeLeaseRequest(LeaseRequest {
+            expires_at_unix_ms: 1_793_307_000_000,
+        }),
+    );
+}
+
+#[test]
+fn every_refusal_frame_is_pinned_with_its_kind_as_a_pascal_case_string() {
+    let kinds = [
+        ("refusal_unknown_caller.bin", LeaseRefusalKind::UnknownCaller, "UnknownCaller"),
+        ("refusal_expired.bin", LeaseRefusalKind::Expired, "Expired"),
+        ("refusal_busy.bin", LeaseRefusalKind::Busy, "Busy"),
+        (
+            "refusal_provider_rejected.bin",
+            LeaseRefusalKind::ProviderRejected,
+            "ProviderRejected",
+        ),
+    ];
+    for (name, kind, spelled) in kinds {
+        let message = LeaseMessage::ClaudeLeaseRefusal(LeaseRefused {
+            kind,
+            detail: "the reason".to_string(),
+        });
+        assert_frame(name, &message);
+        // The kind travels as the variant's name, which other runtimes read.
+        let bytes = encode_frame(&message);
+        let value: rmpv::Value = rmp_serde::from_slice(&bytes[4..]).unwrap();
+        let rmpv::Value::Map(outer) = value else {
+            panic!("a frame is a map")
+        };
+        let rmpv::Value::Map(inner) = &outer[1].1 else {
+            panic!("the value is a map")
+        };
+        assert_eq!(inner[0].0.as_str(), Some("kind"));
+        assert_eq!(inner[0].1.as_str(), Some(spelled));
+    }
+}
+
+#[test]
+fn a_grant_with_both_usage_windows_is_pinned() {
+    let window = |name: &str, permille, status: &str, resets| PlanQuota {
+        window: name.to_string(),
+        utilization_permille: Some(permille),
+        resets_at_unix_ms: resets,
+        status: status.to_string(),
+        observed_at_unix_ms: 1_793_300_000_000,
+    };
+    assert_frame(
+        "grant.bin",
+        &LeaseMessage::ClaudeLeaseGrant(LeaseGranted {
+            lease_id: "lease:0123456789abcdef0123456789abcdef".to_string(),
+            plan_quota: vec![
+                window("five_hour", 420, "allowed", 1_793_307_000_000),
+                window("seven_day", 999, "allowed_warning", 1_793_800_000_000),
+            ],
+        }),
+    );
+}

From cfea6854ab20812f942791feeff81b29c899f09f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 05:30:41 +0100
Subject: [PATCH 25/37] lease tests: the fake unit record is global, keep it on
 invocation 1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/tests/lease.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 2938070..2d6a207 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -554,10 +554,11 @@ fn a_lease_survives_many_polls_while_its_holder_and_invocation_stay() {
     harness.enter(2);
     let second = ask(&harness, 60_000);
     assert_eq!(refusal_of(&second), Some(LeaseRefusalKind::Busy));
+    // The system still places the holder in invocation 1.
+    harness.enter(1);
     // The holder talking does not end it either.
     first._stream.write_all(b"x").unwrap();
     std::thread::sleep(Duration::from_millis(1_200));
-    harness.enter(3);
     assert_eq!(
         refusal_of(&ask(&harness, 60_000)),
         Some(LeaseRefusalKind::Busy)

From c1802d85bee3ae04b0c5737563c8343c1fef515d Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 31 Oct 2026 05:38:48 +0100
Subject: [PATCH 26/37] lease v2: committed byte goldens, rustfmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/fixtures/lease_v2/grant.bin             | Bin 0 -> 331 bytes
 .../tests/fixtures/lease_v2/refusal_busy.bin      | Bin 0 -> 66 bytes
 .../tests/fixtures/lease_v2/refusal_expired.bin   | Bin 0 -> 69 bytes
 .../lease_v2/refusal_provider_rejected.bin        | Bin 0 -> 78 bytes
 .../fixtures/lease_v2/refusal_unknown_caller.bin  | Bin 0 -> 75 bytes
 .../tests/fixtures/lease_v2/request.bin           | Bin 0 -> 66 bytes
 crates/claude-connector/tests/lease.rs            |  13 +++++++++++--
 .../claude-connector/tests/lease_wire_golden.rs   |   6 +++++-
 8 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/grant.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/refusal_busy.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/refusal_expired.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/refusal_provider_rejected.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/refusal_unknown_caller.bin
 create mode 100644 crates/claude-connector/tests/fixtures/lease_v2/request.bin

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/grant.bin b/crates/claude-connector/tests/fixtures/lease_v2/grant.bin
new file mode 100644
index 0000000000000000000000000000000000000000..bc0a78d2d274b08e489ffcf5c9a6008f76bb8b17
GIT binary patch
literal 331
zcmaLQO-=$q5Cz~KxeIGW@rSVI7?px9uwqR&_RkEmBw@jp8<^mLYzXQBxPT#H=Lxum
zMu-aqcl9bS?^7yi3?_GM^h--HY62nj1RaMaJY^`62D9CZ^+);ps-2!y&M&H$SJyY#
zY-wu$&hxIIf%|9!j)z75HE#3gHfIF4HoCVMSh$aYt${ANltt)0nJgW73LY>(G~9#K
zua!z3M`?Xk_<$k$DT>&f^s8-pavAAA-IG-PfSxikpz+}_SlS)|i}gnB!Nneg9Gzj)
H`4|2KHq3{H

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/refusal_busy.bin b/crates/claude-connector/tests/fixtures/lease_v2/refusal_busy.bin
new file mode 100644
index 0000000000000000000000000000000000000000..f6a0887727c88ea29c9784fce3a531b8ad1a7568
GIT binary patch
literal 66
zcmZQzV6bailAW2CvL!huu{0$$J|{J?I5oZ~HLbKbF=uI6Voqr)M8OiL(&EZxDXAri
QnK`RUGEx<afGYFz0C3_PXaE2J

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/refusal_expired.bin b/crates/claude-connector/tests/fixtures/lease_v2/refusal_expired.bin
new file mode 100644
index 0000000000000000000000000000000000000000..b0584507246a43f417acf2acc6fbb1c1c953fb59
GIT binary patch
literal 69
zcmZQzU~p_&lAW2CvL!huu{0$$J|{J?I5oZ~HLbKbF=uI6Voqr)M8R^`ih|6d)Rbi@
TsU?Y-Ijc%CQWc7Tiu3aT#KIh$

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/refusal_provider_rejected.bin b/crates/claude-connector/tests/fixtures/lease_v2/refusal_provider_rejected.bin
new file mode 100644
index 0000000000000000000000000000000000000000..54bfcad06f23c6a937d81d45b12f9597a2ef96f3
GIT binary patch
literal 78
zcmZQzVDM^MlAW2CvL!huu{0$$J|{J?I5oZ~HLbKbF=uI6Voqr)M8SrDqWrSVl+>c2
c)U4FxlGK!CDXArinK`RUGEx<afV%SY0NBGIP5=M^

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/refusal_unknown_caller.bin b/crates/claude-connector/tests/fixtures/lease_v2/refusal_unknown_caller.bin
new file mode 100644
index 0000000000000000000000000000000000000000..11724673f7f3cab7acd9af18aeec003ac676451a
GIT binary patch
literal 75
zcmZQzU~q3*lAW2CvL!huu{0$$J|{J?I5oZ~HLbKbF=uI6Voqr)M8Vq7yzIRE@;v9n
ZoSf96Whtp8iJ3X8N-|Ovihx@3^8k689~uAv

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/fixtures/lease_v2/request.bin b/crates/claude-connector/tests/fixtures/lease_v2/request.bin
new file mode 100644
index 0000000000000000000000000000000000000000..fddaa3785fe2e36c3d51f2ec7bb63649d2decda3
GIT binary patch
literal 66
zcmZQzV6bailAW2CvL!huu{0$$J|{J?I5oZ~wXig`xMXQrVoqsl<EGS#g3O}S;`qdp
W_|m-0iul~(^9&4(3p;ad4gdgajT-C#

literal 0
HcmV?d00001

diff --git a/crates/claude-connector/tests/lease.rs b/crates/claude-connector/tests/lease.rs
index 2d6a207..77c8295 100644
--- a/crates/claude-connector/tests/lease.rs
+++ b/crates/claude-connector/tests/lease.rs
@@ -583,7 +583,14 @@ fn a_lease_asks_the_system_about_its_holders_process_for_its_own_unit() {
     let first = ask(&harness, 60_000);
     assert!(granted_ok(&first));
     std::thread::sleep(Duration::from_millis(1_200));
-    let asked = harness.units.as_ref().unwrap().asked_about.lock().unwrap().clone();
+    let asked = harness
+        .units
+        .as_ref()
+        .unwrap()
+        .asked_about
+        .lock()
+        .unwrap()
+        .clone();
     assert!(asked.len() >= 3, "the hold polled: {asked:?}");
     assert!(asked.iter().all(|(_, unit)| unit == UNIT));
 }
@@ -634,7 +641,9 @@ fn a_request_trickled_past_the_socket_timeout_is_dropped_without_a_lease() {
     // connection: end of file or a reset, never our own read timing out.
     assert!(
         matches!(outcome, Ok(0))
-            || outcome.as_ref().is_err_and(|e| e.kind() == std::io::ErrorKind::ConnectionReset),
+            || outcome
+                .as_ref()
+                .is_err_and(|e| e.kind() == std::io::ErrorKind::ConnectionReset),
         "{outcome:?}"
     );
     assert!(started.elapsed() < Duration::from_secs(6));
diff --git a/crates/claude-connector/tests/lease_wire_golden.rs b/crates/claude-connector/tests/lease_wire_golden.rs
index e0edec2..7b9cea2 100644
--- a/crates/claude-connector/tests/lease_wire_golden.rs
+++ b/crates/claude-connector/tests/lease_wire_golden.rs
@@ -44,7 +44,11 @@ fn the_request_frame_is_pinned() {
 #[test]
 fn every_refusal_frame_is_pinned_with_its_kind_as_a_pascal_case_string() {
     let kinds = [
-        ("refusal_unknown_caller.bin", LeaseRefusalKind::UnknownCaller, "UnknownCaller"),
+        (
+            "refusal_unknown_caller.bin",
+            LeaseRefusalKind::UnknownCaller,
+            "UnknownCaller",
+        ),
         ("refusal_expired.bin", LeaseRefusalKind::Expired, "Expired"),
         ("refusal_busy.bin", LeaseRefusalKind::Busy, "Busy"),
         (

From 79792eea85bb057c5ab89362a2ade732f397c39c Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 01:35:50 +0100
Subject: [PATCH 27/37] usage-meter-poll: the usage poll, the QuotaCell's
 second sensor

usage_poll asks the subscription's usage endpoint when the seven_day
reading is 15 min old or older, maps five_hour and seven_day onto
PlanQuota with status polled, and honours Retry-After; failures wait,
log once per change of state, and never touch the cell.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                | 378 +++++++++++
 crates/claude-connector/Cargo.toml        |   2 +
 crates/claude-connector/src/lib.rs        |   1 +
 crates/claude-connector/src/quota.rs      |  10 +-
 crates/claude-connector/src/usage_poll.rs | 729 ++++++++++++++++++++++
 5 files changed, 1116 insertions(+), 4 deletions(-)
 create mode 100644 crates/claude-connector/src/usage_poll.rs

diff --git a/Cargo.lock b/Cargo.lock
index efa3d84..a1da85a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -139,6 +139,7 @@ name = "claude-connector"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "chrono",
  "cultcache-rs",
  "hmac",
  "libc",
@@ -149,6 +150,7 @@ dependencies = [
  "serde_json",
  "sha2",
  "thiserror",
+ "ureq",
  "zeroize",
 ]
 
@@ -296,6 +298,17 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -338,6 +351,15 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "fs2"
 version = "0.4.3"
@@ -459,6 +481,110 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+
+[[package]]
+name = "icu_properties"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+
+[[package]]
+name = "icu_provider"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "inout"
 version = "0.1.4"
@@ -491,6 +617,12 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
 [[package]]
 name = "log"
 version = "0.4.34"
@@ -554,6 +686,12 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -582,6 +720,15 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -698,6 +845,20 @@ dependencies = [
  "syn 3.0.4",
 ]
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rmp"
 version = "0.8.15"
@@ -737,6 +898,41 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -881,6 +1077,12 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
+[[package]]
+name = "smallvec"
+version = "1.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -901,6 +1103,12 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "stacker"
 version = "0.1.25"
@@ -942,6 +1150,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.20"
@@ -962,6 +1181,16 @@ dependencies = [
  "syn 3.0.4",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -984,6 +1213,54 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
+dependencies = [
+ "base64",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-pki-types",
+ "url",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]
+
+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+
 [[package]]
 name = "uuid"
 version = "1.25.0"
@@ -1061,6 +1338,24 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.11",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -1239,6 +1534,35 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.8.63"
@@ -1259,12 +1583,66 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index 7b310e5..bc28e9f 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/main.rs"
 
 [dependencies]
 anyhow = "1"
+chrono = { version = "0.4", default-features = false }
 hmac = "0.12"
 cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "a4eae9056152335662f1115f97bf35fb00ab6d23", package = "cultcache-rs" }
 model-connector = { path = "../model-connector", features = ["daemon"] }
@@ -21,6 +22,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 thiserror = "2"
+ureq = { version = "2", default-features = false, features = ["tls"] }
 zeroize = "1"
 
 [target.'cfg(unix)'.dependencies]
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 70a2e53..1b01d30 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -15,6 +15,7 @@ mod quota;
 mod stream;
 #[cfg(target_os = "linux")]
 mod unit;
+mod usage_poll;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
index 450d3e2..1b3d27e 100644
--- a/crates/claude-connector/src/quota.rs
+++ b/crates/claude-connector/src/quota.rs
@@ -1,7 +1,9 @@
-//! The plan's own usage windows, as the CLI reports them. The subscription
-//! decides how much a plan may burn; the CLI's `rate_limit_event` is the only
-//! place that number appears, so the latest observation of each window is kept
-//! here and published as the usage readout and lent with each lease.
+//! The plan's own usage windows, as the subscription reports them. The
+//! subscription decides how much a plan may burn, and two sensors observe it:
+//! the CLI's `rate_limit_event` on the connector's own calls, and the usage
+//! poll of `usage_poll` while that stream is quiet. The latest observation of
+//! each window, from either, is kept here and published as the usage readout
+//! and lent with each lease.
 
 use std::collections::BTreeMap;
 use std::sync::Mutex;
diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
new file mode 100644
index 0000000..469e234
--- /dev/null
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -0,0 +1,729 @@
+//! The second sensor of the plan's usage windows. The CLI's `rate_limit_event`
+//! only arrives when the connector's own calls run, so while the swarm is
+//! quiet the weekly reading goes stale; this thread asks the subscription's
+//! usage endpoint when the `seven_day` reading is `STALE` or older, and
+//! records the answer in the same [`QuotaCell`] the stream feeds. Neither
+//! sensor owns the reading: the newest observation of a window wins. A failed
+//! poll never touches the cell; only the cell's own reset rule retires a
+//! window.
+//!
+//! The endpoint is undocumented (the shape is the one Claude Code 2.1.312
+//! parses), so every answer it can give is handled and none is trusted to
+//! change the schedule beyond the rules below.
+
+use std::io::Read;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use model_connector::PlanQuota;
+use serde_json::Value;
+use zeroize::Zeroizing;
+
+use crate::backend::TokenSource;
+use crate::quota::QuotaCell;
+
+/// The usage endpoint.
+const ENDPOINT: &str = "https://api.anthropic.com/api/oauth/usage";
+/// A reading this old, or older, is stale; also the least gap between polls.
+const STALE: Duration = Duration::from_secs(15 * 60);
+/// The longest any backoff may wait.
+const CEILING: Duration = Duration::from_secs(6 * 60 * 60);
+const TIMEOUT: Duration = Duration::from_secs(10);
+/// A usage body is a few hundred bytes; this is a ceiling, not an expectation.
+const MAX_BODY: u64 = 1 << 20;
+/// The status every polled window carries.
+const POLLED: &str = "polled";
+
+/// What the endpoint said, reduced to what the schedule needs. It never holds
+/// the token.
+#[derive(Debug, PartialEq, Eq)]
+enum Answer {
+    Body(String),
+    Status(u16, Option<Duration>),
+    Unreachable,
+}
+
+/// Why the poller is waiting; logged once per change.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum State {
+    Polled,
+    NoToken,
+    RateLimited,
+    Refused,
+    NotFound,
+    Unreadable,
+    Unexpected,
+    Unreachable,
+}
+
+impl State {
+    fn line(self) -> &'static str {
+        match self {
+            Self::Polled => "usage poll: reading recorded",
+            Self::NoToken => "usage poll: no token to ask with",
+            Self::RateLimited => "usage poll: rate limited, waiting",
+            Self::Refused => {
+                "usage poll: refused (401/403), the token likely lacks the user:profile scope; polling stopped until restart"
+            }
+            Self::NotFound => "usage poll: endpoint not found, backing off",
+            Self::Unreadable => "usage poll: answer not readable, backing off",
+            Self::Unexpected => "usage poll: unexpected status, retrying later",
+            Self::Unreachable => "usage poll: endpoint unreachable, retrying later",
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum Next {
+    Wait(Duration),
+    Stop,
+}
+
+#[derive(Debug, PartialEq)]
+struct Verdict {
+    windows: Vec<PlanQuota>,
+    next: Next,
+    state: State,
+}
+
+/// What one answer means: the windows to record (only a readable body has
+/// any), how long to wait, and the state to report.
+fn judge(answer: &Answer) -> Verdict {
+    let (windows, next, state) = match answer {
+        Answer::Body(body) => match parse_usage(body) {
+            Some(windows) => (windows, Next::Wait(STALE), State::Polled),
+            None => (Vec::new(), Next::Wait(CEILING), State::Unreadable),
+        },
+        Answer::Status(429, retry_after) => (
+            Vec::new(),
+            Next::Wait(retry_after.unwrap_or_default().clamp(STALE, CEILING)),
+            State::RateLimited,
+        ),
+        Answer::Status(401 | 403, _) => (Vec::new(), Next::Stop, State::Refused),
+        Answer::Status(404, _) => (Vec::new(), Next::Wait(CEILING), State::NotFound),
+        Answer::Status(..) => (Vec::new(), Next::Wait(STALE), State::Unexpected),
+        Answer::Unreachable => (Vec::new(), Next::Wait(STALE), State::Unreachable),
+    };
+    Verdict {
+        windows,
+        next,
+        state,
+    }
+}
+
+/// The plan windows a usage body reports: `five_hour` and `seven_day`, each
+/// `{utilization: percent 0-100, resets_at: ISO 8601}`. A window missing
+/// either field, or reporting nonsense, is skipped, and an unknown reading is
+/// never zero. Other keys are ignored. `None` when the body is not a JSON
+/// object at all.
+fn parse_usage(body: &str) -> Option<Vec<PlanQuota>> {
+    let usage: Value = serde_json::from_str(body).ok()?;
+    let usage = usage.as_object()?;
+    Some(
+        ["five_hour", "seven_day"]
+            .into_iter()
+            .filter_map(|window| {
+                let reading = usage.get(window)?;
+                let percent = reading.get("utilization")?.as_f64()?;
+                let resets_at = reading.get("resets_at")?.as_str()?;
+                if !percent.is_finite() || percent < 0.0 {
+                    return None;
+                }
+                let resets_at = chrono::DateTime::parse_from_rfc3339(resets_at).ok()?;
+                Some(PlanQuota {
+                    window: window.to_string(),
+                    // `as` saturates a float at the integer's bounds.
+                    utilization_permille: Some((percent * 10.0).round() as u32),
+                    resets_at_unix_ms: u64::try_from(resets_at.timestamp_millis()).ok()?,
+                    status: POLLED.to_string(),
+                    // Stamped by the cell that keeps it.
+                    observed_at_unix_ms: 0,
+                })
+            })
+            .collect(),
+    )
+}
+
+/// The blocking HTTPS client: 10 s end to end, no redirects (the token must
+/// not follow one anywhere).
+struct UsageClient {
+    agent: ureq::Agent,
+    url: String,
+}
+
+impl UsageClient {
+    fn new(url: impl Into<String>) -> Self {
+        Self {
+            agent: ureq::AgentBuilder::new()
+                .timeout(TIMEOUT)
+                .redirects(0)
+                .build(),
+            url: url.into(),
+        }
+    }
+
+    fn ask(&self, token: &Zeroizing<String>) -> Answer {
+        let bearer = Zeroizing::new(format!("Bearer {}", token.as_str()));
+        let sent = self
+            .agent
+            .get(&self.url)
+            .set("Authorization", bearer.as_str())
+            .set("anthropic-beta", "oauth-2025-04-20")
+            .call();
+        match sent {
+            Ok(response) if response.status() == 200 => {
+                let mut body = String::new();
+                match response
+                    .into_reader()
+                    .take(MAX_BODY)
+                    .read_to_string(&mut body)
+                {
+                    Ok(_) => Answer::Body(body),
+                    Err(_) => Answer::Unreachable,
+                }
+            }
+            Ok(response) => Answer::Status(response.status(), None),
+            Err(ureq::Error::Status(code, response)) => {
+                // Whole seconds only; the HTTP-date form counts as absent.
+                let retry_after = response
+                    .header("retry-after")
+                    .and_then(|seconds| seconds.trim().parse::<u64>().ok())
+                    .map(Duration::from_secs);
+                Answer::Status(code, retry_after)
+            }
+            Err(ureq::Error::Transport(_)) => Answer::Unreachable,
+        }
+    }
+}
+
+/// The schedule and the thing it drives. Time comes in as an argument so the
+/// schedule is testable without waiting.
+struct Poller {
+    cell: Arc<QuotaCell>,
+    tokens: Box<dyn TokenSource>,
+    client: UsageClient,
+    log: Box<dyn FnMut(&str) + Send>,
+    /// No poll before this instant, unix ms: the last answer's own wait.
+    not_before_ms: u64,
+    started: bool,
+    stopped: bool,
+    last_state: Option<State>,
+}
+
+impl Poller {
+    fn new(
+        cell: Arc<QuotaCell>,
+        tokens: Box<dyn TokenSource>,
+        client: UsageClient,
+        log: Box<dyn FnMut(&str) + Send>,
+    ) -> Self {
+        Self {
+            cell,
+            tokens,
+            client,
+            log,
+            not_before_ms: 0,
+            started: false,
+            stopped: false,
+            last_state: None,
+        }
+    }
+
+    /// Polls if a poll is due at `now_ms`; returns how long to wait before
+    /// asking again, or `None` once polling has stopped for good.
+    ///
+    /// The first call polls. After that a poll is due only when the cell's
+    /// `seven_day` observation is `STALE` old or older (or absent), and never
+    /// before the last answer's own wait has passed.
+    fn tick(&mut self, now_ms: u64) -> Option<Duration> {
+        if self.stopped {
+            return None;
+        }
+        let due_at = self.due_at_ms();
+        if now_ms < due_at {
+            return Some(Duration::from_millis(due_at - now_ms));
+        }
+        self.started = true;
+        let verdict = match self.tokens.read() {
+            Some(token) => judge(&self.client.ask(&token)),
+            None => Verdict {
+                windows: Vec::new(),
+                next: Next::Wait(STALE),
+                state: State::NoToken,
+            },
+        };
+        self.cell.observe(verdict.windows);
+        if self.last_state != Some(verdict.state) {
+            (self.log)(verdict.state.line());
+            self.last_state = Some(verdict.state);
+        }
+        match verdict.next {
+            Next::Stop => {
+                self.stopped = true;
+                None
+            }
+            Next::Wait(wait) => {
+                self.not_before_ms = now_ms.saturating_add(duration_ms(wait));
+                Some(Duration::from_millis(
+                    self.due_at_ms().saturating_sub(now_ms),
+                ))
+            }
+        }
+    }
+
+    /// The earliest instant the next poll may happen.
+    fn due_at_ms(&self) -> u64 {
+        if !self.started {
+            return 0;
+        }
+        let stale_at = self
+            .cell
+            .snapshot()
+            .windows
+            .iter()
+            .find(|quota| quota.window == "seven_day")
+            .map_or(0, |quota| {
+                quota.observed_at_unix_ms.saturating_add(duration_ms(STALE))
+            });
+        stale_at.max(self.not_before_ms)
+    }
+
+    fn run(mut self) {
+        while let Some(wait) = self.tick(unix_ms()) {
+            std::thread::sleep(wait);
+        }
+    }
+}
+
+fn duration_ms(duration: Duration) -> u64 {
+    u64::try_from(duration.as_millis()).unwrap_or(u64::MAX)
+}
+
+fn unix_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, duration_ms)
+}
+
+/// Starts the poll thread. It reads the token afresh at each poll, writes
+/// only to `cell`, and logs one line to stderr when its state changes.
+pub fn start(
+    cell: Arc<QuotaCell>,
+    tokens: Box<dyn TokenSource>,
+) -> std::io::Result<std::thread::JoinHandle<()>> {
+    let poller = Poller::new(
+        cell,
+        tokens,
+        UsageClient::new(ENDPOINT),
+        Box::new(|line| eprintln!("claude-connector: {line}")),
+    );
+    std::thread::Builder::new()
+        .name("claude-usage-poll".to_string())
+        .spawn(move || poller.run())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use std::net::TcpListener;
+    use std::sync::Mutex;
+
+    const MIN: u64 = 60_000;
+    const CANARY: &str = "sk-ant-oat01-CANARY-must-never-surface";
+    const FAR: &str = "2100-01-01T00:00:00+00:00";
+    const FAR_MS: u64 = 4_102_444_800_000;
+
+    fn body(five: &str, seven: &str) -> String {
+        format!(
+            r#"{{"five_hour":{five},"seven_day":{seven},"seven_day_opus":null,"extra_usage":{{"x":1}}}}"#
+        )
+    }
+
+    fn reading(percent: f64) -> String {
+        format!(r#"{{"utilization":{percent},"resets_at":"{FAR}"}}"#)
+    }
+
+    fn secs(s: u64) -> Duration {
+        Duration::from_secs(s)
+    }
+
+    // ---- mapping ----
+
+    #[test]
+    fn usage_body_maps_percent_to_permille() {
+        let windows = parse_usage(&body(&reading(6.0), &reading(35.0))).unwrap();
+        let expect = |window: &str, permille| PlanQuota {
+            window: window.to_string(),
+            utilization_permille: Some(permille),
+            resets_at_unix_ms: FAR_MS,
+            status: "polled".to_string(),
+            observed_at_unix_ms: 0,
+        };
+        assert_eq!(
+            windows,
+            vec![expect("five_hour", 60), expect("seven_day", 350)]
+        );
+    }
+
+    #[test]
+    fn usage_percent_rounds_to_the_nearest_permille() {
+        let windows = parse_usage(&body(&reading(12.34), &reading(0.06))).unwrap();
+        assert_eq!(windows[0].utilization_permille, Some(123));
+        assert_eq!(windows[1].utilization_permille, Some(1));
+        let zero = parse_usage(&body(&reading(0.0), "null")).unwrap();
+        assert_eq!(zero[0].utilization_permille, Some(0), "a real zero stays");
+    }
+
+    #[test]
+    fn resets_at_is_parsed_with_its_offset_to_unix_ms() {
+        let seven = r#"{"utilization":1.0,"resets_at":"2026-11-07T12:30:15.250+02:00"}"#;
+        let windows = parse_usage(&body("null", seven)).unwrap();
+        // 2026-11-07T10:30:15.250Z
+        assert_eq!(windows[0].resets_at_unix_ms, 1_794_047_415_250);
+    }
+
+    #[test]
+    fn a_window_missing_a_field_or_reading_nonsense_is_skipped_not_zero() {
+        let no_percent = format!(r#"{{"utilization":null,"resets_at":"{FAR}"}}"#);
+        let no_reset = r#"{"utilization":50.0,"resets_at":null}"#;
+        assert_eq!(parse_usage(&body(&no_percent, no_reset)).unwrap(), vec![]);
+        let junk = r#"{"utilization":5.0,"resets_at":"soon"}"#;
+        assert_eq!(parse_usage(&body(&reading(-1.0), junk)).unwrap(), vec![]);
+        let before_epoch = r#"{"utilization":5.0,"resets_at":"1969-01-01T00:00:00Z"}"#;
+        assert_eq!(parse_usage(&body(before_epoch, "null")).unwrap(), vec![]);
+        // One good window survives its neighbour's null.
+        let one = parse_usage(&body(&no_percent, &reading(35.0))).unwrap();
+        assert_eq!(one.len(), 1);
+        assert_eq!(one[0].window, "seven_day");
+    }
+
+    #[test]
+    fn a_body_that_is_not_an_object_is_unreadable() {
+        for bad in ["", "not json", "[1,2]", "42", "null"] {
+            assert_eq!(parse_usage(bad), None, "{bad:?}");
+        }
+        assert_eq!(parse_usage("{}"), Some(vec![]));
+    }
+
+    // ---- judgement ----
+
+    fn wait_of(answer: &Answer) -> Next {
+        judge(answer).next
+    }
+
+    #[test]
+    fn rate_limit_waits_the_longer_of_retry_after_and_the_floor_capped() {
+        let limited = |after| wait_of(&Answer::Status(429, after));
+        assert_eq!(limited(Some(secs(3600))), Next::Wait(secs(3600)));
+        assert_eq!(limited(Some(secs(20 * 60))), Next::Wait(secs(20 * 60)));
+        assert_eq!(limited(Some(secs(10))), Next::Wait(STALE));
+        assert_eq!(limited(None), Next::Wait(STALE));
+        assert_eq!(limited(Some(secs(100_000))), Next::Wait(CEILING));
+        assert_eq!(limited(Some(secs(6 * 3600))), Next::Wait(CEILING));
+        assert_eq!(judge(&Answer::Status(429, None)).state, State::RateLimited);
+    }
+
+    #[test]
+    fn refusal_stops_polling_and_the_rest_back_off() {
+        assert_eq!(wait_of(&Answer::Status(401, None)), Next::Stop);
+        assert_eq!(wait_of(&Answer::Status(403, Some(secs(5)))), Next::Stop);
+        assert_eq!(judge(&Answer::Status(403, None)).state, State::Refused);
+        assert_eq!(wait_of(&Answer::Status(404, None)), Next::Wait(CEILING));
+        assert_eq!(
+            wait_of(&Answer::Body("<html>".to_string())),
+            Next::Wait(CEILING)
+        );
+        assert_eq!(wait_of(&Answer::Unreachable), Next::Wait(STALE));
+        assert_eq!(wait_of(&Answer::Status(503, None)), Next::Wait(STALE));
+        assert_eq!(
+            wait_of(&Answer::Body(body(&reading(1.0), "null"))),
+            Next::Wait(STALE)
+        );
+    }
+
+    // ---- a fake server, a poller, and the cell ----
+
+    /// Serves each canned reply to one connection in turn and remembers the
+    /// requests.
+    fn serve(replies: Vec<String>) -> (String, Arc<Mutex<Vec<String>>>) {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap());
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let record = seen.clone();
+        std::thread::spawn(move || {
+            for reply in replies {
+                let Ok((mut stream, _)) = listener.accept() else {
+                    return;
+                };
+                let mut request = vec![0u8; 4096];
+                let n = stream.read(&mut request).unwrap_or(0);
+                record
+                    .lock()
+                    .unwrap()
+                    .push(String::from_utf8_lossy(&request[..n]).into_owned());
+                let _ = stream.write_all(reply.as_bytes());
+            }
+        });
+        (url, seen)
+    }
+
+    fn http(status: &str, headers: &str, body: &str) -> String {
+        format!(
+            "HTTP/1.1 {status}\r\n{headers}Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
+            body.len()
+        )
+    }
+
+    struct Fixed(Option<&'static str>);
+    impl TokenSource for Fixed {
+        fn read(&self) -> Option<Zeroizing<String>> {
+            self.0.map(|t| Zeroizing::new(t.to_string()))
+        }
+    }
+
+    type Lines = Arc<Mutex<Vec<String>>>;
+
+    fn poller(cell: &Arc<QuotaCell>, url: &str, token: Option<&'static str>) -> (Poller, Lines) {
+        let lines = Arc::new(Mutex::new(Vec::new()));
+        let sink = lines.clone();
+        let poller = Poller::new(
+            cell.clone(),
+            Box::new(Fixed(token)),
+            UsageClient::new(url),
+            Box::new(move |line| sink.lock().unwrap().push(line.to_string())),
+        );
+        (poller, lines)
+    }
+
+    fn window(cell: &QuotaCell, name: &str) -> Option<PlanQuota> {
+        cell.snapshot()
+            .windows
+            .into_iter()
+            .find(|q| q.window == name)
+    }
+
+    fn stream_reading(window: &str, permille: u32) -> PlanQuota {
+        PlanQuota {
+            window: window.to_string(),
+            utilization_permille: Some(permille),
+            resets_at_unix_ms: FAR_MS,
+            status: "allowed".to_string(),
+            observed_at_unix_ms: 0,
+        }
+    }
+
+    fn requests(seen: &Arc<Mutex<Vec<String>>>) -> usize {
+        seen.lock().unwrap().len()
+    }
+
+    #[test]
+    fn the_first_tick_polls_and_records_what_the_endpoint_said() {
+        let (url, seen) = serve(vec![http(
+            "200 OK",
+            "Content-Type: application/json\r\n",
+            &body(&reading(6.0), &reading(35.0)),
+        )]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let wait = poller.tick(unix_ms()).unwrap();
+        let windows = cell.snapshot().windows;
+        assert_eq!(windows.len(), 2);
+        assert_eq!(windows[0].status, "polled");
+        assert_eq!(windows[1].utilization_permille, Some(350));
+        assert!(
+            (STALE..STALE + secs(5)).contains(&wait),
+            "a fresh reading waits until it is stale: {wait:?}"
+        );
+        let request = seen.lock().unwrap()[0].to_lowercase();
+        assert!(request.contains(&format!("authorization: bearer {}", CANARY.to_lowercase())));
+        assert!(request.contains("anthropic-beta: oauth-2025-04-20"));
+        assert_eq!(lines.lock().unwrap().len(), 1);
+    }
+
+    #[test]
+    fn stale_only_polls() {
+        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 3]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms());
+        assert_eq!(requests(&seen), 1, "the startup poll");
+        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
+
+        // 5 min old: no request, and the wait is the time left.
+        let wait = poller.tick(observed + 5 * MIN).unwrap();
+        assert_eq!(requests(&seen), 1);
+        assert_eq!(wait, Duration::from_millis(10 * MIN));
+        // One millisecond short of 15 min: still none.
+        poller.tick(observed + 15 * MIN - 1);
+        assert_eq!(requests(&seen), 1);
+        // 16 min old: one request.
+        poller.tick(observed + 16 * MIN);
+        assert_eq!(requests(&seen), 2);
+        // That poll's answer holds its own 15 min, whatever the stamp says.
+        poller.tick(observed + 16 * MIN + 1);
+        assert_eq!(requests(&seen), 2);
+    }
+
+    #[test]
+    fn a_reading_is_stale_at_exactly_fifteen_minutes() {
+        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 2]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms());
+        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
+        poller.tick(observed + 15 * MIN);
+        assert_eq!(requests(&seen), 2);
+    }
+
+    #[test]
+    fn a_stream_observation_keeps_the_poll_quiet() {
+        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms());
+        std::thread::sleep(Duration::from_millis(20));
+        // The stream reports seven_day afresh, after the poll.
+        cell.observe([stream_reading("seven_day", 400)]);
+        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
+        let wait = poller.tick(observed + 14 * MIN).unwrap();
+        assert_eq!(requests(&seen), 1);
+        assert_eq!(wait, Duration::from_millis(MIN));
+    }
+
+    #[test]
+    fn failures_never_touch_the_cell() {
+        let limited = |headers: &str| http("429 Too Many Requests", headers, "{}");
+        let cases = [
+            (limited("Retry-After: 3600\r\n"), Some(60)),
+            (limited(""), Some(15)),
+            (
+                limited("Retry-After: Wed, 21 Oct 2026 07:28:00 GMT\r\n"),
+                Some(15),
+            ),
+            (http("403 Forbidden", "", "{}"), None),
+            (http("401 Unauthorized", "", "{}"), None),
+            (http("404 Not Found", "", "{}"), Some(360)),
+            (http("200 OK", "", "<html>not json</html>"), Some(360)),
+            (
+                http("302 Found", "Location: http://127.0.0.1:9/\r\n", ""),
+                Some(15),
+            ),
+        ];
+        for (reply, minutes) in cases {
+            let (url, _) = serve(vec![reply.clone()]);
+            let cell = Arc::new(QuotaCell::new());
+            cell.observe([
+                stream_reading("five_hour", 120),
+                stream_reading("seven_day", 300),
+            ]);
+            let before = cell.snapshot();
+            let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+            let wait = poller.tick(unix_ms());
+            assert_eq!(cell.snapshot(), before, "{reply}");
+            assert_eq!(wait.map(|w| w.as_secs() / 60), minutes, "{reply}");
+            assert_eq!(lines.lock().unwrap().len(), 1, "{reply}");
+            assert_eq!(poller.tick(unix_ms()).is_none(), minutes.is_none());
+        }
+    }
+
+    #[test]
+    fn an_unreachable_endpoint_waits_the_floor_and_a_missing_token_never_asks() {
+        // Nothing listens here: bind, learn the port, drop.
+        let port = TcpListener::bind("127.0.0.1:0")
+            .unwrap()
+            .local_addr()
+            .unwrap()
+            .port();
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, lines) =
+            poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY));
+        assert_eq!(poller.tick(unix_ms()), Some(STALE));
+        assert!(cell.snapshot().windows.is_empty());
+        assert_eq!(lines.lock().unwrap().len(), 1);
+
+        let (url, seen) = serve(vec![http("200 OK", "", "{}")]);
+        let (mut poller, lines) = poller(&cell, &url, None);
+        assert_eq!(poller.tick(unix_ms()), Some(STALE));
+        assert_eq!(requests(&seen), 0);
+        assert_eq!(lines.lock().unwrap()[0], State::NoToken.line());
+    }
+
+    #[test]
+    fn a_state_is_logged_once_until_it_changes() {
+        let limited = http("429 Too Many Requests", "", "{}");
+        let (url, _) = serve(vec![
+            limited.clone(),
+            limited,
+            http("200 OK", "", &body("null", &reading(35.0))),
+        ]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let t = unix_ms();
+        poller.tick(t);
+        poller.tick(t + 16 * MIN);
+        assert_eq!(lines.lock().unwrap().len(), 1, "same state, one line");
+        poller.tick(t + 32 * MIN);
+        let lines = lines.lock().unwrap();
+        assert_eq!(lines.len(), 2);
+        assert_eq!(lines[1], State::Polled.line());
+    }
+
+    #[test]
+    fn nothing_logged_or_stored_holds_the_token() {
+        let echo = format!(r#"{{"echo":"{CANARY}"}}"#);
+        let (url, _) = serve(vec![
+            http("429 Too Many Requests", "Retry-After: 60\r\n", &echo),
+            http(
+                "200 OK",
+                "",
+                &format!(r#"{{"five_hour":{},"note":"{CANARY}"}}"#, reading(1.0)),
+            ),
+            http("403 Forbidden", "", CANARY),
+        ]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let t = unix_ms();
+        poller.tick(t);
+        poller.tick(t + 16 * MIN);
+        assert!(poller.tick(t + 32 * MIN).is_none());
+        let lines = lines.lock().unwrap();
+        assert_eq!(lines.len(), 3, "one line per change of state");
+        let seen = format!("{lines:?} {:?}", cell.snapshot());
+        assert!(!seen.contains("CANARY"), "{seen}");
+    }
+
+    #[test]
+    fn stream_and_poll_share_one_cell() {
+        let (url, _) = serve(vec![http(
+            "200 OK",
+            "",
+            &body(&reading(6.0), &reading(35.0)),
+        )]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms());
+        assert_eq!(window(&cell, "five_hour").unwrap().status, "polled");
+        // A later stream reading of one window replaces the poll's; the other
+        // window keeps the poll's.
+        cell.observe([stream_reading("five_hour", 90)]);
+        let five = window(&cell, "five_hour").unwrap();
+        assert_eq!(
+            (five.status.as_str(), five.utilization_permille),
+            ("allowed", Some(90))
+        );
+        assert_eq!(window(&cell, "seven_day").unwrap().status, "polled");
+        // And a later poll replaces the stream's.
+        let (url, _) = serve(vec![http("200 OK", "", &body(&reading(7.0), "null"))]);
+        let (mut again, _) = poller_at(&cell, &url);
+        again.tick(unix_ms());
+        assert_eq!(
+            window(&cell, "five_hour").unwrap().utilization_permille,
+            Some(70)
+        );
+    }
+
+    fn poller_at(cell: &Arc<QuotaCell>, url: &str) -> (Poller, Lines) {
+        poller(cell, url, Some(CANARY))
+    }
+}

From 9143d2c5e2ba933e0e3000e85e785f39a1f60944 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 01:35:51 +0100
Subject: [PATCH 28/37] usage-meter-poll: serve_config starts the poll beside
 the leases

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index 1a1a80b..f344197 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -556,6 +556,13 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
     if let Some(socket) = &config.lease_socket {
         start_leases(&config, socket, service.clone(), backend.quota())?;
     }
+    crate::usage_poll::start(
+        backend.quota(),
+        Box::new(CredentialTokenSource::from_environment(
+            config.token_credential.clone(),
+        )),
+    )
+    .map_err(|_| ConfigError::Serving("usage poll"))?;
     serve_service(listener, config.serve_limits(), service, backend)?;
     Ok(())
 }

From 7f3a46313e092f547652fabf67239ad1daf0bbd8 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 01:37:29 +0100
Subject: [PATCH 29/37] usage-meter-poll: test helper no longer shadowed by its
 own binding

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/usage_poll.rs | 32 +++++++++++------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index 469e234..8bfaaf9 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -484,7 +484,11 @@ mod tests {
 
     type Lines = Arc<Mutex<Vec<String>>>;
 
-    fn poller(cell: &Arc<QuotaCell>, url: &str, token: Option<&'static str>) -> (Poller, Lines) {
+    fn make_poller(
+        cell: &Arc<QuotaCell>,
+        url: &str,
+        token: Option<&'static str>,
+    ) -> (Poller, Lines) {
         let lines = Arc::new(Mutex::new(Vec::new()));
         let sink = lines.clone();
         let poller = Poller::new(
@@ -525,7 +529,7 @@ mod tests {
             &body(&reading(6.0), &reading(35.0)),
         )]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
         let wait = poller.tick(unix_ms()).unwrap();
         let windows = cell.snapshot().windows;
         assert_eq!(windows.len(), 2);
@@ -545,7 +549,7 @@ mod tests {
     fn stale_only_polls() {
         let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 3]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
         poller.tick(unix_ms());
         assert_eq!(requests(&seen), 1, "the startup poll");
         let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
@@ -569,7 +573,7 @@ mod tests {
     fn a_reading_is_stale_at_exactly_fifteen_minutes() {
         let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 2]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
         poller.tick(unix_ms());
         let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
         poller.tick(observed + 15 * MIN);
@@ -580,7 +584,7 @@ mod tests {
     fn a_stream_observation_keeps_the_poll_quiet() {
         let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
         poller.tick(unix_ms());
         std::thread::sleep(Duration::from_millis(20));
         // The stream reports seven_day afresh, after the poll.
@@ -618,7 +622,7 @@ mod tests {
                 stream_reading("seven_day", 300),
             ]);
             let before = cell.snapshot();
-            let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+            let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
             let wait = poller.tick(unix_ms());
             assert_eq!(cell.snapshot(), before, "{reply}");
             assert_eq!(wait.map(|w| w.as_secs() / 60), minutes, "{reply}");
@@ -637,13 +641,13 @@ mod tests {
             .port();
         let cell = Arc::new(QuotaCell::new());
         let (mut poller, lines) =
-            poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY));
+            make_poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY));
         assert_eq!(poller.tick(unix_ms()), Some(STALE));
         assert!(cell.snapshot().windows.is_empty());
         assert_eq!(lines.lock().unwrap().len(), 1);
 
         let (url, seen) = serve(vec![http("200 OK", "", "{}")]);
-        let (mut poller, lines) = poller(&cell, &url, None);
+        let (mut poller, lines) = make_poller(&cell, &url, None);
         assert_eq!(poller.tick(unix_ms()), Some(STALE));
         assert_eq!(requests(&seen), 0);
         assert_eq!(lines.lock().unwrap()[0], State::NoToken.line());
@@ -658,7 +662,7 @@ mod tests {
             http("200 OK", "", &body("null", &reading(35.0))),
         ]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
         let t = unix_ms();
         poller.tick(t);
         poller.tick(t + 16 * MIN);
@@ -682,7 +686,7 @@ mod tests {
             http("403 Forbidden", "", CANARY),
         ]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
         let t = unix_ms();
         poller.tick(t);
         poller.tick(t + 16 * MIN);
@@ -701,7 +705,7 @@ mod tests {
             &body(&reading(6.0), &reading(35.0)),
         )]);
         let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = poller(&cell, &url, Some(CANARY));
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
         poller.tick(unix_ms());
         assert_eq!(window(&cell, "five_hour").unwrap().status, "polled");
         // A later stream reading of one window replaces the poll's; the other
@@ -715,15 +719,11 @@ mod tests {
         assert_eq!(window(&cell, "seven_day").unwrap().status, "polled");
         // And a later poll replaces the stream's.
         let (url, _) = serve(vec![http("200 OK", "", &body(&reading(7.0), "null"))]);
-        let (mut again, _) = poller_at(&cell, &url);
+        let (mut again, _) = make_poller(&cell, &url, Some(CANARY));
         again.tick(unix_ms());
         assert_eq!(
             window(&cell, "five_hour").unwrap().utilization_permille,
             Some(70)
         );
     }
-
-    fn poller_at(cell: &Arc<QuotaCell>, url: &str) -> (Poller, Lines) {
-        poller(cell, url, Some(CANARY))
-    }
 }

From 6982cbca7eb44d25f8eb8a37dea39527ba2c0afc Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 01:44:35 +0100
Subject: [PATCH 30/37] usage-meter-poll: pin the log lines and the thread loop

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/usage_poll.rs | 29 +++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index 8bfaaf9..013269f 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -726,4 +726,33 @@ mod tests {
             Some(70)
         );
     }
+
+    #[test]
+    fn run_polls_until_the_endpoint_refuses_then_returns() {
+        let (url, seen) = serve(vec![http("403 Forbidden", "", "{}")]);
+        let cell = Arc::new(QuotaCell::new());
+        let (poller, lines) = make_poller(&cell, &url, Some(CANARY));
+        poller.run();
+        assert_eq!(requests(&seen), 1);
+        let lines = lines.lock().unwrap();
+        assert_eq!(lines.len(), 1);
+        assert!(lines[0].contains("user:profile"), "{lines:?}");
+    }
+
+    #[test]
+    fn every_state_has_its_own_line() {
+        let states = [
+            State::Polled,
+            State::NoToken,
+            State::RateLimited,
+            State::Refused,
+            State::NotFound,
+            State::Unreadable,
+            State::Unexpected,
+            State::Unreachable,
+        ];
+        let lines: std::collections::BTreeSet<_> = states.iter().map(|s| s.line()).collect();
+        assert_eq!(lines.len(), states.len());
+        assert!(lines.iter().all(|line| line.starts_with("usage poll: ")));
+    }
 }

From c1cc349b19a4d1acf4fbbd541753826f171f8499 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 02:49:16 +0100
Subject: [PATCH 31/37] usage-meter-poll: the cell decides how a reading
 combines; a poll is as old as its question

QuotaCell::observe_at is the one decision for both sensors: a reading older
than the held one is dropped, and a rejection stands against a reading that
only reports utilization (status polled) until its window resets or a reading
that carries its own verdict replaces it. The poll stamps its answer with the
moment it asked. Also: Retry-After in HTTP-date form is honoured; a refused
token is not sent again until it reads differently (the poll thread no longer
exits); the client's timeout is a parameter so a silent endpoint is tested;
tests pin redirects(0), the two-window mapping, the slow-server race, and the
late poll against a rejection.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/quota.rs      |  98 +++++-
 crates/claude-connector/src/usage_poll.rs | 402 ++++++++++++++++------
 2 files changed, 398 insertions(+), 102 deletions(-)

diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
index 1b3d27e..b319d4c 100644
--- a/crates/claude-connector/src/quota.rs
+++ b/crates/claude-connector/src/quota.rs
@@ -23,18 +23,35 @@ impl QuotaCell {
         Self::default()
     }
 
-    /// Records the windows one event reported, stamping each with now. Each
-    /// replaces that window's earlier observation, and windows the event did
-    /// not mention stay as they were, stamp included.
+    /// Records the windows one event reported, stamping each with now. See
+    /// [`QuotaCell::observe_at`] for how a reading combines with what is held.
     pub fn observe(&self, windows: impl IntoIterator<Item = PlanQuota>) {
         self.observe_at(unix_ms(), windows);
     }
 
-    fn observe_at(&self, now: u64, windows: impl IntoIterator<Item = PlanQuota>) {
+    /// Records readings taken at `at` (unix ms): the moment the sensor asked,
+    /// not the moment its answer arrived. The cell alone decides how a reading
+    /// combines with the one it holds for that window, and every sensor goes
+    /// through this decision:
+    ///
+    /// - a reading older than the held one is dropped, so a slow answer cannot
+    ///   replace what a faster sensor saw meanwhile;
+    /// - the provider's rejection stands until its window resets, or until a
+    ///   reading that itself carries a verdict from the provider replaces it:
+    ///   a [`POLLED`] reading reports utilization only, and says nothing about
+    ///   whether the provider accepts calls.
+    ///
+    /// Windows the readings did not mention stay as they were, stamp included.
+    pub fn observe_at(&self, at: u64, windows: impl IntoIterator<Item = PlanQuota>) {
         let mut held = self.0.lock().unwrap_or_else(|e| e.into_inner());
         for mut quota in windows {
-            quota.observed_at_unix_ms = now;
-            held.insert(quota.window.clone(), quota);
+            quota.observed_at_unix_ms = at;
+            if held
+                .get(&quota.window)
+                .is_none_or(|current| supersedes(current, &quota))
+            {
+                held.insert(quota.window.clone(), quota);
+            }
         }
     }
 
@@ -65,6 +82,23 @@ impl QuotaCell {
 
 /// The status of a window whose reset has passed since it was observed.
 const EXPIRED: &str = "expired";
+/// The status of a window the provider refuses calls on.
+pub(crate) const REJECTED: &str = "rejected";
+/// The status of a window read from the usage endpoint: utilization and reset
+/// time, with no verdict on whether calls are accepted.
+pub(crate) const POLLED: &str = "polled";
+
+/// Whether `incoming` (already stamped with its own reading time) replaces
+/// `current` for the same window.
+fn supersedes(current: &PlanQuota, incoming: &PlanQuota) -> bool {
+    if incoming.observed_at_unix_ms < current.observed_at_unix_ms {
+        return false;
+    }
+    let rejection_stands = current.status == REJECTED
+        && incoming.status == POLLED
+        && incoming.observed_at_unix_ms < current.resets_at_unix_ms;
+    !rejection_stands
+}
 
 fn unix_ms() -> u64 {
     SystemTime::now()
@@ -135,6 +169,58 @@ mod tests {
         assert_eq!(expired[0].resets_at_unix_ms, RESET);
     }
 
+    fn with_status(mut quota: PlanQuota, status: &str) -> PlanQuota {
+        quota.status = status.to_string();
+        quota
+    }
+
+    fn held(cell: &QuotaCell) -> (String, Option<u32>, u64) {
+        let window = cell.snapshot_at(250).windows.remove(0);
+        (
+            window.status,
+            window.utilization_permille,
+            window.observed_at_unix_ms,
+        )
+    }
+
+    #[test]
+    fn a_reading_older_than_the_held_one_is_dropped_and_an_equal_one_replaces() {
+        let cell = QuotaCell::new();
+        cell.observe_at(200, [quota("five_hour", 80, 0)]);
+        cell.observe_at(100, [quota("five_hour", 10, 0)]);
+        assert_eq!(held(&cell), ("allowed".to_string(), Some(80), 200));
+        cell.observe_at(200, [quota("five_hour", 90, 0)]);
+        assert_eq!(held(&cell), ("allowed".to_string(), Some(90), 200));
+    }
+
+    #[test]
+    fn a_rejection_stands_against_a_poll_until_the_window_resets() {
+        let cell = QuotaCell::new();
+        let polled = with_status(quota("five_hour", 500, 0), POLLED);
+        cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]);
+        cell.observe_at(200, [polled.clone()]);
+        assert_eq!(held(&cell), (REJECTED.to_string(), Some(1000), 100));
+        // The window the rejection described is over: a poll of the next one lands.
+        cell.observe_at(RESET, [polled]);
+        assert_eq!(cell.snapshot_at(RESET - 1).windows[0].status, POLLED);
+    }
+
+    #[test]
+    fn a_newer_reading_that_carries_its_own_verdict_lifts_a_rejection() {
+        let cell = QuotaCell::new();
+        cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]);
+        cell.observe_at(200, [quota("five_hour", 300, 0)]);
+        assert_eq!(held(&cell), ("allowed".to_string(), Some(300), 200));
+    }
+
+    #[test]
+    fn a_poll_replaces_what_is_not_a_rejection() {
+        let cell = QuotaCell::new();
+        cell.observe_at(100, [quota("five_hour", 300, 0)]);
+        cell.observe_at(200, [with_status(quota("five_hour", 400, 0), POLLED)]);
+        assert_eq!(held(&cell), (POLLED.to_string(), Some(400), 200));
+    }
+
     #[test]
     fn the_live_clock_stamps_and_expires() {
         let cell = QuotaCell::new();
diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index 013269f..e23a74f 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -3,7 +3,8 @@
 //! quiet the weekly reading goes stale; this thread asks the subscription's
 //! usage endpoint when the `seven_day` reading is `STALE` or older, and
 //! records the answer in the same [`QuotaCell`] the stream feeds. Neither
-//! sensor owns the reading: the newest observation of a window wins. A failed
+//! sensor owns the reading: the cell decides how a reading combines with the
+//! one it holds, and a poll is stamped with the moment it asked. A failed
 //! poll never touches the cell; only the cell's own reset rule retires a
 //! window.
 //!
@@ -17,10 +18,11 @@ use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use model_connector::PlanQuota;
 use serde_json::Value;
+use sha2::{Digest, Sha256};
 use zeroize::Zeroizing;
 
 use crate::backend::TokenSource;
-use crate::quota::QuotaCell;
+use crate::quota::{POLLED, QuotaCell};
 
 /// The usage endpoint.
 const ENDPOINT: &str = "https://api.anthropic.com/api/oauth/usage";
@@ -31,8 +33,6 @@ const CEILING: Duration = Duration::from_secs(6 * 60 * 60);
 const TIMEOUT: Duration = Duration::from_secs(10);
 /// A usage body is a few hundred bytes; this is a ceiling, not an expectation.
 const MAX_BODY: u64 = 1 << 20;
-/// The status every polled window carries.
-const POLLED: &str = "polled";
 
 /// What the endpoint said, reduced to what the schedule needs. It never holds
 /// the token.
@@ -63,7 +63,7 @@ impl State {
             Self::NoToken => "usage poll: no token to ask with",
             Self::RateLimited => "usage poll: rate limited, waiting",
             Self::Refused => {
-                "usage poll: refused (401/403), the token likely lacks the user:profile scope; polling stopped until restart"
+                "usage poll: refused (401/403), the token likely lacks the user:profile scope; not asking again until the token changes"
             }
             Self::NotFound => "usage poll: endpoint not found, backing off",
             Self::Unreadable => "usage poll: answer not readable, backing off",
@@ -73,40 +73,35 @@ impl State {
     }
 }
 
-#[derive(Debug, PartialEq, Eq)]
-enum Next {
-    Wait(Duration),
-    Stop,
-}
-
 #[derive(Debug, PartialEq)]
 struct Verdict {
     windows: Vec<PlanQuota>,
-    next: Next,
+    /// How long until the next poll may happen.
+    wait: Duration,
     state: State,
 }
 
 /// What one answer means: the windows to record (only a readable body has
 /// any), how long to wait, and the state to report.
 fn judge(answer: &Answer) -> Verdict {
-    let (windows, next, state) = match answer {
+    let (windows, wait, state) = match answer {
         Answer::Body(body) => match parse_usage(body) {
-            Some(windows) => (windows, Next::Wait(STALE), State::Polled),
-            None => (Vec::new(), Next::Wait(CEILING), State::Unreadable),
+            Some(windows) => (windows, STALE, State::Polled),
+            None => (Vec::new(), CEILING, State::Unreadable),
         },
         Answer::Status(429, retry_after) => (
             Vec::new(),
-            Next::Wait(retry_after.unwrap_or_default().clamp(STALE, CEILING)),
+            retry_after.unwrap_or_default().clamp(STALE, CEILING),
             State::RateLimited,
         ),
-        Answer::Status(401 | 403, _) => (Vec::new(), Next::Stop, State::Refused),
-        Answer::Status(404, _) => (Vec::new(), Next::Wait(CEILING), State::NotFound),
-        Answer::Status(..) => (Vec::new(), Next::Wait(STALE), State::Unexpected),
-        Answer::Unreachable => (Vec::new(), Next::Wait(STALE), State::Unreachable),
+        Answer::Status(401 | 403, _) => (Vec::new(), STALE, State::Refused),
+        Answer::Status(404, _) => (Vec::new(), CEILING, State::NotFound),
+        Answer::Status(..) => (Vec::new(), STALE, State::Unexpected),
+        Answer::Unreachable => (Vec::new(), STALE, State::Unreachable),
     };
     Verdict {
         windows,
-        next,
+        wait,
         state,
     }
 }
@@ -153,15 +148,22 @@ struct UsageClient {
 
 impl UsageClient {
     fn new(url: impl Into<String>) -> Self {
+        Self::with_timeout(url, TIMEOUT)
+    }
+
+    fn with_timeout(url: impl Into<String>, timeout: Duration) -> Self {
         Self {
             agent: ureq::AgentBuilder::new()
-                .timeout(TIMEOUT)
+                .timeout(timeout)
                 .redirects(0)
                 .build(),
             url: url.into(),
         }
     }
 
+    /// Asks the endpoint. Our copy of the header value is zeroized when it
+    /// drops; ureq copies it into its own request buffers, which are freed
+    /// without zeroing.
     fn ask(&self, token: &Zeroizing<String>) -> Answer {
         let bearer = Zeroizing::new(format!("Bearer {}", token.as_str()));
         let sent = self
@@ -184,11 +186,9 @@ impl UsageClient {
             }
             Ok(response) => Answer::Status(response.status(), None),
             Err(ureq::Error::Status(code, response)) => {
-                // Whole seconds only; the HTTP-date form counts as absent.
                 let retry_after = response
                     .header("retry-after")
-                    .and_then(|seconds| seconds.trim().parse::<u64>().ok())
-                    .map(Duration::from_secs);
+                    .and_then(|value| retry_after(value, unix_ms()));
                 Answer::Status(code, retry_after)
             }
             Err(ureq::Error::Transport(_)) => Answer::Unreachable,
@@ -196,6 +196,19 @@ impl UsageClient {
     }
 }
 
+/// A `Retry-After` value as a wait from `now_ms`: delay-seconds, or an
+/// HTTP-date (RFC 9110 10.2.3) measured from now, a date already past being a
+/// zero wait. `None` when it is neither.
+fn retry_after(value: &str, now_ms: u64) -> Option<Duration> {
+    let value = value.trim();
+    if let Ok(seconds) = value.parse::<u64>() {
+        return Some(Duration::from_secs(seconds));
+    }
+    let date = chrono::DateTime::parse_from_rfc2822(value).ok()?;
+    let until = u64::try_from(date.timestamp_millis()).ok()?;
+    Some(Duration::from_millis(until.saturating_sub(now_ms)))
+}
+
 /// The schedule and the thing it drives. Time comes in as an argument so the
 /// schedule is testable without waiting.
 struct Poller {
@@ -206,7 +219,9 @@ struct Poller {
     /// No poll before this instant, unix ms: the last answer's own wait.
     not_before_ms: u64,
     started: bool,
-    stopped: bool,
+    /// The digest of the token the endpoint last refused: while the token
+    /// reads the same, the poller does not ask again.
+    refused_token: Option<[u8; 32]>,
     last_state: Option<State>,
 }
 
@@ -224,51 +239,58 @@ impl Poller {
             log,
             not_before_ms: 0,
             started: false,
-            stopped: false,
+            refused_token: None,
             last_state: None,
         }
     }
 
     /// Polls if a poll is due at `now_ms`; returns how long to wait before
-    /// asking again, or `None` once polling has stopped for good.
+    /// asking again.
     ///
     /// The first call polls. After that a poll is due only when the cell's
     /// `seven_day` observation is `STALE` old or older (or absent), and never
-    /// before the last answer's own wait has passed.
-    fn tick(&mut self, now_ms: u64) -> Option<Duration> {
-        if self.stopped {
-            return None;
-        }
+    /// before the last answer's own wait has passed. A token the endpoint
+    /// refused is not sent again until it reads differently.
+    fn tick(&mut self, now_ms: u64) -> Duration {
         let due_at = self.due_at_ms();
         if now_ms < due_at {
-            return Some(Duration::from_millis(due_at - now_ms));
+            return Duration::from_millis(due_at - now_ms);
         }
         self.started = true;
-        let verdict = match self.tokens.read() {
-            Some(token) => judge(&self.client.ask(&token)),
+        let token = self.tokens.read();
+        if let (Some(refused), Some(token)) = (&self.refused_token, &token)
+            && digest(token) != *refused
+        {
+            self.refused_token = None;
+        }
+        let verdict = match token {
+            _ if self.refused_token.is_some() => Verdict {
+                windows: Vec::new(),
+                wait: STALE,
+                state: State::Refused,
+            },
+            Some(token) => {
+                let verdict = judge(&self.client.ask(&token));
+                if verdict.state == State::Refused {
+                    self.refused_token = Some(digest(&token));
+                }
+                verdict
+            }
             None => Verdict {
                 windows: Vec::new(),
-                next: Next::Wait(STALE),
+                wait: STALE,
                 state: State::NoToken,
             },
         };
-        self.cell.observe(verdict.windows);
+        // The reading is as old as the question: an answer that arrives after
+        // the stream spoke does not outrank it.
+        self.cell.observe_at(now_ms, verdict.windows);
         if self.last_state != Some(verdict.state) {
             (self.log)(verdict.state.line());
             self.last_state = Some(verdict.state);
         }
-        match verdict.next {
-            Next::Stop => {
-                self.stopped = true;
-                None
-            }
-            Next::Wait(wait) => {
-                self.not_before_ms = now_ms.saturating_add(duration_ms(wait));
-                Some(Duration::from_millis(
-                    self.due_at_ms().saturating_sub(now_ms),
-                ))
-            }
-        }
+        self.not_before_ms = now_ms.saturating_add(duration_ms(verdict.wait));
+        Duration::from_millis(self.due_at_ms().saturating_sub(now_ms))
     }
 
     /// The earliest instant the next poll may happen.
@@ -289,12 +311,17 @@ impl Poller {
     }
 
     fn run(mut self) {
-        while let Some(wait) = self.tick(unix_ms()) {
+        loop {
+            let wait = self.tick(unix_ms());
             std::thread::sleep(wait);
         }
     }
 }
 
+fn digest(token: &Zeroizing<String>) -> [u8; 32] {
+    Sha256::digest(token.as_bytes()).into()
+}
+
 fn duration_ms(duration: Duration) -> u64 {
     u64::try_from(duration.as_millis()).unwrap_or(u64::MAX)
 }
@@ -408,38 +435,32 @@ mod tests {
 
     // ---- judgement ----
 
-    fn wait_of(answer: &Answer) -> Next {
-        judge(answer).next
+    fn wait_of(answer: &Answer) -> Duration {
+        judge(answer).wait
     }
 
     #[test]
     fn rate_limit_waits_the_longer_of_retry_after_and_the_floor_capped() {
         let limited = |after| wait_of(&Answer::Status(429, after));
-        assert_eq!(limited(Some(secs(3600))), Next::Wait(secs(3600)));
-        assert_eq!(limited(Some(secs(20 * 60))), Next::Wait(secs(20 * 60)));
-        assert_eq!(limited(Some(secs(10))), Next::Wait(STALE));
-        assert_eq!(limited(None), Next::Wait(STALE));
-        assert_eq!(limited(Some(secs(100_000))), Next::Wait(CEILING));
-        assert_eq!(limited(Some(secs(6 * 3600))), Next::Wait(CEILING));
+        assert_eq!(limited(Some(secs(3600))), secs(3600));
+        assert_eq!(limited(Some(secs(20 * 60))), secs(20 * 60));
+        assert_eq!(limited(Some(secs(10))), STALE);
+        assert_eq!(limited(None), STALE);
+        assert_eq!(limited(Some(secs(100_000))), CEILING);
+        assert_eq!(limited(Some(secs(6 * 3600))), CEILING);
         assert_eq!(judge(&Answer::Status(429, None)).state, State::RateLimited);
     }
 
     #[test]
-    fn refusal_stops_polling_and_the_rest_back_off() {
-        assert_eq!(wait_of(&Answer::Status(401, None)), Next::Stop);
-        assert_eq!(wait_of(&Answer::Status(403, Some(secs(5)))), Next::Stop);
+    fn refusal_backs_off_like_the_rest() {
+        assert_eq!(wait_of(&Answer::Status(401, None)), STALE);
+        assert_eq!(wait_of(&Answer::Status(403, Some(secs(5)))), STALE);
         assert_eq!(judge(&Answer::Status(403, None)).state, State::Refused);
-        assert_eq!(wait_of(&Answer::Status(404, None)), Next::Wait(CEILING));
-        assert_eq!(
-            wait_of(&Answer::Body("<html>".to_string())),
-            Next::Wait(CEILING)
-        );
-        assert_eq!(wait_of(&Answer::Unreachable), Next::Wait(STALE));
-        assert_eq!(wait_of(&Answer::Status(503, None)), Next::Wait(STALE));
-        assert_eq!(
-            wait_of(&Answer::Body(body(&reading(1.0), "null"))),
-            Next::Wait(STALE)
-        );
+        assert_eq!(wait_of(&Answer::Status(404, None)), CEILING);
+        assert_eq!(wait_of(&Answer::Body("<html>".to_string())), CEILING);
+        assert_eq!(wait_of(&Answer::Unreachable), STALE);
+        assert_eq!(wait_of(&Answer::Status(503, None)), STALE);
+        assert_eq!(wait_of(&Answer::Body(body(&reading(1.0), "null"))), STALE);
     }
 
     // ---- a fake server, a poller, and the cell ----
@@ -530,7 +551,7 @@ mod tests {
         )]);
         let cell = Arc::new(QuotaCell::new());
         let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        let wait = poller.tick(unix_ms()).unwrap();
+        let wait = poller.tick(unix_ms());
         let windows = cell.snapshot().windows;
         assert_eq!(windows.len(), 2);
         assert_eq!(windows[0].status, "polled");
@@ -555,7 +576,7 @@ mod tests {
         let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
 
         // 5 min old: no request, and the wait is the time left.
-        let wait = poller.tick(observed + 5 * MIN).unwrap();
+        let wait = poller.tick(observed + 5 * MIN);
         assert_eq!(requests(&seen), 1);
         assert_eq!(wait, Duration::from_millis(10 * MIN));
         // One millisecond short of 15 min: still none.
@@ -590,7 +611,7 @@ mod tests {
         // The stream reports seven_day afresh, after the poll.
         cell.observe([stream_reading("seven_day", 400)]);
         let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
-        let wait = poller.tick(observed + 14 * MIN).unwrap();
+        let wait = poller.tick(observed + 14 * MIN);
         assert_eq!(requests(&seen), 1);
         assert_eq!(wait, Duration::from_millis(MIN));
     }
@@ -599,19 +620,23 @@ mod tests {
     fn failures_never_touch_the_cell() {
         let limited = |headers: &str| http("429 Too Many Requests", headers, "{}");
         let cases = [
-            (limited("Retry-After: 3600\r\n"), Some(60)),
-            (limited(""), Some(15)),
+            (limited("Retry-After: 3600\r\n"), 60),
+            (limited(""), 15),
             (
                 limited("Retry-After: Wed, 21 Oct 2026 07:28:00 GMT\r\n"),
-                Some(15),
+                15,
             ),
-            (http("403 Forbidden", "", "{}"), None),
-            (http("401 Unauthorized", "", "{}"), None),
-            (http("404 Not Found", "", "{}"), Some(360)),
-            (http("200 OK", "", "<html>not json</html>"), Some(360)),
+            (
+                limited("Retry-After: Fri, 31 Dec 2100 23:59:59 GMT\r\n"),
+                360,
+            ),
+            (http("403 Forbidden", "", "{}"), 15),
+            (http("401 Unauthorized", "", "{}"), 15),
+            (http("404 Not Found", "", "{}"), 360),
+            (http("200 OK", "", "<html>not json</html>"), 360),
             (
                 http("302 Found", "Location: http://127.0.0.1:9/\r\n", ""),
-                Some(15),
+                15,
             ),
         ];
         for (reply, minutes) in cases {
@@ -625,9 +650,8 @@ mod tests {
             let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
             let wait = poller.tick(unix_ms());
             assert_eq!(cell.snapshot(), before, "{reply}");
-            assert_eq!(wait.map(|w| w.as_secs() / 60), minutes, "{reply}");
+            assert_eq!(wait.as_secs() / 60, minutes, "{reply}");
             assert_eq!(lines.lock().unwrap().len(), 1, "{reply}");
-            assert_eq!(poller.tick(unix_ms()).is_none(), minutes.is_none());
         }
     }
 
@@ -642,13 +666,13 @@ mod tests {
         let cell = Arc::new(QuotaCell::new());
         let (mut poller, lines) =
             make_poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY));
-        assert_eq!(poller.tick(unix_ms()), Some(STALE));
+        assert_eq!(poller.tick(unix_ms()), STALE);
         assert!(cell.snapshot().windows.is_empty());
         assert_eq!(lines.lock().unwrap().len(), 1);
 
         let (url, seen) = serve(vec![http("200 OK", "", "{}")]);
         let (mut poller, lines) = make_poller(&cell, &url, None);
-        assert_eq!(poller.tick(unix_ms()), Some(STALE));
+        assert_eq!(poller.tick(unix_ms()), STALE);
         assert_eq!(requests(&seen), 0);
         assert_eq!(lines.lock().unwrap()[0], State::NoToken.line());
     }
@@ -690,7 +714,7 @@ mod tests {
         let t = unix_ms();
         poller.tick(t);
         poller.tick(t + 16 * MIN);
-        assert!(poller.tick(t + 32 * MIN).is_none());
+        poller.tick(t + 32 * MIN);
         let lines = lines.lock().unwrap();
         assert_eq!(lines.len(), 3, "one line per change of state");
         let seen = format!("{lines:?} {:?}", cell.snapshot());
@@ -727,16 +751,202 @@ mod tests {
         );
     }
 
+    /// A token the test can rotate.
+    struct Rotating(Arc<Mutex<Option<String>>>);
+    impl TokenSource for Rotating {
+        fn read(&self) -> Option<Zeroizing<String>> {
+            self.0.lock().unwrap().clone().map(Zeroizing::new)
+        }
+    }
+
     #[test]
-    fn run_polls_until_the_endpoint_refuses_then_returns() {
-        let (url, seen) = serve(vec![http("403 Forbidden", "", "{}")]);
+    fn a_refused_token_is_not_sent_again_until_it_changes() {
+        let (url, seen) = serve(vec![
+            http("403 Forbidden", "", "{}"),
+            http("200 OK", "", &body("null", &reading(35.0))),
+        ]);
+        let token = Arc::new(Mutex::new(Some("first".to_string())));
+        let lines = Arc::new(Mutex::new(Vec::new()));
+        let sink = lines.clone();
         let cell = Arc::new(QuotaCell::new());
-        let (poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        poller.run();
+        let mut poller = Poller::new(
+            cell.clone(),
+            Box::new(Rotating(token.clone())),
+            UsageClient::new(&url),
+            Box::new(move |line| sink.lock().unwrap().push(line.to_string())),
+        );
+        let t = unix_ms();
+        poller.tick(t);
         assert_eq!(requests(&seen), 1);
-        let lines = lines.lock().unwrap();
-        assert_eq!(lines.len(), 1);
-        assert!(lines[0].contains("user:profile"), "{lines:?}");
+        assert!(lines.lock().unwrap()[0].contains("user:profile"));
+        // The same token, a quarter hour on and again: the endpoint is not asked.
+        assert_eq!(poller.tick(t + 16 * MIN), STALE);
+        poller.tick(t + 32 * MIN);
+        assert_eq!(requests(&seen), 1);
+        assert_eq!(lines.lock().unwrap().len(), 1, "one state, one line");
+        // A credential that vanishes does not count as a new one.
+        *token.lock().unwrap() = None;
+        poller.tick(t + 48 * MIN);
+        assert_eq!(requests(&seen), 1);
+        // A rotated credential is tried at the next due time.
+        *token.lock().unwrap() = Some("second".to_string());
+        poller.tick(t + 64 * MIN);
+        assert_eq!(requests(&seen), 2);
+        assert!(window(&cell, "seven_day").is_some());
+        assert_eq!(lines.lock().unwrap()[1], State::Polled.line());
+    }
+
+    #[test]
+    fn retry_after_reads_seconds_and_http_dates() {
+        const DATE: &str = "Wed, 21 Oct 2026 07:28:00 GMT";
+        let at = chrono::DateTime::parse_from_rfc2822(DATE)
+            .unwrap()
+            .timestamp_millis() as u64;
+        let three_hours = 3 * 3600 * 1000;
+        assert_eq!(retry_after(DATE, at - three_hours), Some(secs(3 * 3600)));
+        assert_eq!(retry_after(DATE, at), Some(Duration::ZERO));
+        assert_eq!(retry_after(DATE, at + 1), Some(Duration::ZERO), "past");
+        assert_eq!(retry_after("3600", at), Some(secs(3600)));
+        assert_eq!(retry_after(" 3600 ", at), Some(secs(3600)));
+        for bad in ["", "soon", "-5", "3600.5", "1, 2", "Wed, 21 Oct 2026"] {
+            assert_eq!(retry_after(bad, at), None, "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn keys_beyond_the_two_plan_windows_are_not_windows() {
+        let populated = reading(77.0);
+        let body = format!(
+            r#"{{"five_hour":{},"seven_day":{},"seven_day_opus":{populated},"seven_day_sonnet":{populated},"extra_usage":{populated}}}"#,
+            reading(6.0),
+            reading(35.0)
+        );
+        let names: Vec<_> = parse_usage(&body)
+            .unwrap()
+            .into_iter()
+            .map(|quota| quota.window)
+            .collect();
+        assert_eq!(names, ["five_hour", "seven_day"]);
+    }
+
+    #[test]
+    fn a_redirect_is_not_followed_with_the_token() {
+        let (target, target_seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]);
+        let (url, _) = serve(vec![http(
+            "302 Found",
+            &format!("Location: {target}\r\n"),
+            "",
+        )]);
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms());
+        assert_eq!(requests(&target_seen), 0, "the redirect target was asked");
+        assert!(cell.snapshot().windows.is_empty());
+        assert_eq!(lines.lock().unwrap()[0], State::Unexpected.line());
+    }
+
+    #[test]
+    fn a_silent_endpoint_frees_the_poll_at_its_timeout() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/u", listener.local_addr().unwrap());
+        let holder = std::thread::spawn(move || {
+            // Accept, say nothing, keep the connection open.
+            let held = listener.accept();
+            std::thread::sleep(Duration::from_secs(3));
+            drop(held);
+        });
+        let started = std::time::Instant::now();
+        let answer = UsageClient::with_timeout(url, Duration::from_millis(300))
+            .ask(&Zeroizing::new(CANARY.to_string()));
+        assert_eq!(answer, Answer::Unreachable);
+        assert!(started.elapsed() < Duration::from_secs(2));
+        holder.join().unwrap();
+    }
+
+    #[test]
+    fn the_real_timeout_frees_the_thread_within_a_minute() {
+        assert!(TIMEOUT >= secs(1) && TIMEOUT <= secs(60), "{TIMEOUT:?}");
+    }
+
+    /// Answers one connection after `delay`, as a slow endpoint does.
+    fn serve_slowly(delay: Duration, reply: String) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap());
+        std::thread::spawn(move || {
+            let Ok((mut stream, _)) = listener.accept() else {
+                return;
+            };
+            let mut request = vec![0u8; 4096];
+            let _ = stream.read(&mut request);
+            std::thread::sleep(delay);
+            let _ = stream.write_all(reply.as_bytes());
+        });
+        url
+    }
+
+    fn stream_event(window: &str, permille: u32, status: &str) -> PlanQuota {
+        PlanQuota {
+            status: status.to_string(),
+            ..stream_reading(window, permille)
+        }
+    }
+
+    /// The stream speaks while a poll is in flight; the poll then answers
+    /// with a reading older than the stream's. Returns the cell after both.
+    fn stream_speaks_while_the_poll_is_in_flight(status: &str) -> Arc<QuotaCell> {
+        let url = serve_slowly(
+            Duration::from_millis(500),
+            http("200 OK", "", &body(&reading(50.0), &reading(35.0))),
+        );
+        let cell = Arc::new(QuotaCell::new());
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
+        std::thread::scope(|scope| {
+            let polling = scope.spawn(|| poller.tick(unix_ms()));
+            std::thread::sleep(Duration::from_millis(150));
+            cell.observe([stream_event("five_hour", 1000, status)]);
+            polling.join().unwrap();
+        });
+        cell
+    }
+
+    #[test]
+    fn a_poll_answered_late_does_not_replace_what_the_stream_saw_meanwhile() {
+        let cell = stream_speaks_while_the_poll_is_in_flight("allowed");
+        let five = window(&cell, "five_hour").unwrap();
+        assert_eq!(
+            (five.status.as_str(), five.utilization_permille),
+            ("allowed", Some(1000))
+        );
+        let seven = window(&cell, "seven_day").unwrap();
+        assert_eq!(
+            (seven.status.as_str(), seven.utilization_permille),
+            ("polled", Some(350)),
+            "the window the stream did not name takes the poll's reading"
+        );
+    }
+
+    #[test]
+    fn a_slow_poll_cannot_lift_the_rejection_the_stream_reported_meanwhile() {
+        let cell = stream_speaks_while_the_poll_is_in_flight("rejected");
+        let five = window(&cell, "five_hour").unwrap();
+        assert_eq!(
+            (five.status.as_str(), five.utilization_permille),
+            ("rejected", Some(1000))
+        );
+    }
+
+    #[test]
+    fn a_later_poll_does_not_lift_a_rejection_the_provider_reported_earlier() {
+        let (url, _) = serve(vec![http("200 OK", "", &body(&reading(50.0), "null"))]);
+        let cell = Arc::new(QuotaCell::new());
+        cell.observe([stream_event("five_hour", 1000, "rejected")]);
+        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
+        poller.tick(unix_ms() + MIN);
+        let five = window(&cell, "five_hour").unwrap();
+        assert_eq!(
+            (five.status.as_str(), five.utilization_permille),
+            ("rejected", Some(1000))
+        );
     }
 
     #[test]

From e17ef16d48ffc5dff278120e072dcb2180cbe3bc Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 02:49:16 +0100
Subject: [PATCH 32/37] usage-meter-poll: a subprocess test that serve --config
 starts the poll

Spawns the claude-connector binary on a ready document and reads the
usage poll state line from its stderr; the connector must also stay up.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/tests/serve_config.rs | 163 ++++++++++++++++++
 1 file changed, 163 insertions(+)
 create mode 100644 crates/claude-connector/tests/serve_config.rs

diff --git a/crates/claude-connector/tests/serve_config.rs b/crates/claude-connector/tests/serve_config.rs
new file mode 100644
index 0000000..50a6279
--- /dev/null
+++ b/crates/claude-connector/tests/serve_config.rs
@@ -0,0 +1,163 @@
+//! `claude-connector serve --config` as a process: it binds, stays up, and
+//! starts the usage poll beside the lease listener. Only a spawned binary
+//! shows that `serve_config` calls the poll start at all; the poll's own
+//! behaviour is tested against fake servers in `usage_poll`.
+//!
+//! The usage endpoint is a constant of the connector, so this test's poll
+//! asks the real host with a made-up token and sees an answer or an
+//! unreachable network; either way it logs a `usage poll:` state line, and
+//! that line is what is asserted.
+#![cfg(unix)]
+
+use std::io::{BufRead, BufReader};
+use std::os::unix::fs::PermissionsExt;
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, Stdio};
+use std::sync::mpsc;
+use std::time::{Duration, Instant};
+
+use sha2::{Digest, Sha256};
+
+const TOKEN: &str = "sk-ant-oat01-CANARY-must-never-surface";
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir =
+            std::env::temp_dir().join(format!("claude-connector-serve-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+
+    fn path(&self, name: &str) -> PathBuf {
+        self.0.join(name)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// Kills the served process however the test ends.
+struct Served(Child);
+
+impl Drop for Served {
+    fn drop(&mut self) {
+        let _ = self.0.kill();
+        let _ = self.0.wait();
+    }
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+fn run(args: &[&str]) {
+    let made = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
+        .args(args)
+        .env_clear()
+        .output()
+        .unwrap();
+    assert!(made.status.success(), "{made:?}");
+}
+
+/// A document the connector can serve: a pinned stand-in for the claude
+/// binary, a 0700 prompt directory, and the unit's credentials directory.
+fn ready_document(scratch: &Scratch) -> (PathBuf, PathBuf) {
+    let path = |name: &str| scratch.path(name);
+    let text = |name: &str| path(name).to_string_lossy().into_owned();
+    std::fs::write(path("claude"), b"not a real claude binary").unwrap();
+    let pin = hex(&Sha256::digest(b"not a real claude binary"));
+    for dir in ["work", "home", "prompts", "credentials"] {
+        std::fs::create_dir(path(dir)).unwrap();
+    }
+    std::fs::set_permissions(path("prompts"), std::fs::Permissions::from_mode(0o700)).unwrap();
+    std::fs::write(path("caller.key"), "k".repeat(48)).unwrap();
+    std::fs::write(path("credentials/claude-token"), TOKEN).unwrap();
+    let config = text("connector.cc");
+    run(&[
+        "config",
+        "init",
+        &config,
+        "--listen",
+        "127.0.0.1:0",
+        "--replay-store",
+        &text("replay.cc"),
+        "--claude-binary",
+        &text("claude"),
+        "--claude-sha256",
+        &pin,
+        "--work-dir",
+        &text("work"),
+        "--config-dir",
+        &text("home"),
+        "--prompt-dir",
+        &text("prompts"),
+        "--instance",
+        "persona-a",
+        "--token-credential",
+        "claude-token",
+        "--handle-secret-credential",
+        "claude-handle-secret",
+        "--handle-secret-file",
+        &text("credentials/claude-handle-secret"),
+        "--caller-id",
+        "persona-a-caller",
+        "--connection-key-file",
+        &text("caller.key"),
+        "--connection-key-epoch",
+        "1",
+        "--allowed-model",
+        "claude-haiku-5-5",
+    ]);
+    (path("connector.cc"), path("credentials"))
+}
+
+fn serve(config: &Path, credentials: &Path) -> (Served, mpsc::Receiver<String>) {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
+        .args(["serve", "--config"])
+        .arg(config)
+        .env_clear()
+        .env("CREDENTIALS_DIRECTORY", credentials)
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let stderr = child.stderr.take().unwrap();
+    let (lines, received) = mpsc::channel();
+    std::thread::spawn(move || {
+        for line in BufReader::new(stderr).lines().map_while(Result::ok) {
+            if lines.send(line).is_err() {
+                return;
+            }
+        }
+    });
+    (Served(child), received)
+}
+
+#[test]
+fn serve_config_starts_the_usage_poll_and_stays_up() {
+    let scratch = Scratch::new();
+    let (config, credentials) = ready_document(&scratch);
+    let (mut served, lines) = serve(&config, &credentials);
+
+    let deadline = Instant::now() + Duration::from_secs(60);
+    let mut seen = Vec::new();
+    let poll_line = loop {
+        let left = deadline.saturating_duration_since(Instant::now());
+        match lines.recv_timeout(left) {
+            Ok(line) if line.contains("usage poll:") => break line,
+            Ok(line) => seen.push(line),
+            Err(_) => panic!("no usage poll state line; the connector said {seen:?}"),
+        }
+    };
+    assert!(
+        served.0.try_wait().unwrap().is_none(),
+        "the connector exited after starting the poll"
+    );
+    assert!(!poll_line.contains("CANARY"), "{poll_line}");
+}

From 481428a7cefb09aa89c60089c689930dc4ebc2c2 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 03:17:08 +0100
Subject: [PATCH 33/37] usage-meter-poll: Retry-After reads all three HTTP-date
 forms (finding retry-after-obsolete-date-forms)

RFC 9110 10.2.3 makes a recipient accept IMF-fixdate, RFC 850 and asctime;
the last two read as absent and the poll asked again at the floor. The
two-digit RFC 850 year more than 50 years ahead is the latest past year.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/usage_poll.rs     | 108 +++++++++++-
 crates/claude-connector/tests/serve_config.rs | 163 ------------------
 2 files changed, 103 insertions(+), 168 deletions(-)
 delete mode 100644 crates/claude-connector/tests/serve_config.rs

diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index e23a74f..ff61482 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -197,18 +197,69 @@ impl UsageClient {
 }
 
 /// A `Retry-After` value as a wait from `now_ms`: delay-seconds, or an
-/// HTTP-date (RFC 9110 10.2.3) measured from now, a date already past being a
-/// zero wait. `None` when it is neither.
+/// HTTP-date (RFC 9110 10.2.3, all three forms) measured from now, a date
+/// already past being a zero wait. `None` when it is neither.
 fn retry_after(value: &str, now_ms: u64) -> Option<Duration> {
     let value = value.trim();
     if let Ok(seconds) = value.parse::<u64>() {
         return Some(Duration::from_secs(seconds));
     }
-    let date = chrono::DateTime::parse_from_rfc2822(value).ok()?;
-    let until = u64::try_from(date.timestamp_millis()).ok()?;
+    let until = http_date_ms(value, now_ms)?;
     Some(Duration::from_millis(until.saturating_sub(now_ms)))
 }
 
+/// An HTTP-date as Unix milliseconds: IMF-fixdate (RFC 2822 reads it), the
+/// obsolete RFC 850 form `Sunday, 06-Nov-94 08:49:37 GMT`, or asctime
+/// `Sun Nov  6 08:49:37 1994`. Weekday names are not checked.
+fn http_date_ms(value: &str, now_ms: u64) -> Option<u64> {
+    use chrono::Datelike;
+    if let Ok(date) = chrono::DateTime::parse_from_rfc2822(value) {
+        return u64::try_from(date.timestamp_millis()).ok();
+    }
+    let fields: Vec<&str> = value.split_whitespace().collect();
+    let (day, month, year, time) = match fields.as_slice() {
+        [weekday, date, time, "GMT"] if weekday.ends_with(',') => {
+            let mut parts = date.split('-');
+            let (day, month, year) = (parts.next()?, parts.next()?, parts.next()?);
+            if parts.next().is_some() || year.len() != 2 {
+                return None;
+            }
+            // A two-digit year more than 50 years ahead is the latest past
+            // year with those digits.
+            let now_year =
+                chrono::DateTime::from_timestamp_millis(i64::try_from(now_ms).ok()?)?.year();
+            let year = now_year - now_year.rem_euclid(100) + year.parse::<i32>().ok()?;
+            let year = if year > now_year + 50 {
+                year - 100
+            } else {
+                year
+            };
+            (day, month, year, *time)
+        }
+        [_, month, day, time, year] => (*day, *month, year.parse::<i32>().ok()?, *time),
+        _ => return None,
+    };
+    const MONTHS: [&str; 12] = [
+        "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
+    ];
+    let month = MONTHS
+        .iter()
+        .position(|name| name.eq_ignore_ascii_case(month))?;
+    let mut clock = time.split(':');
+    let (hour, minute, second) = (clock.next()?, clock.next()?, clock.next()?);
+    if clock.next().is_some() {
+        return None;
+    }
+    let moment =
+        chrono::NaiveDate::from_ymd_opt(year, u32::try_from(month + 1).ok()?, day.parse().ok()?)?
+            .and_hms_opt(
+            hour.parse().ok()?,
+            minute.parse().ok()?,
+            second.parse().ok()?,
+        )?;
+    u64::try_from(moment.and_utc().timestamp_millis()).ok()
+}
+
 /// The schedule and the thing it drives. Time comes in as an argument so the
 /// schedule is testable without waiting.
 struct Poller {
@@ -796,6 +847,39 @@ mod tests {
         assert_eq!(lines.lock().unwrap()[1], State::Polled.line());
     }
 
+    /// 2026-11-01 07:28:00 UTC, a Sunday.
+    fn sunday_morning_ms() -> u64 {
+        chrono::NaiveDate::from_ymd_opt(2026, 11, 1)
+            .unwrap()
+            .and_hms_opt(7, 28, 0)
+            .unwrap()
+            .and_utc()
+            .timestamp_millis() as u64
+    }
+
+    #[test]
+    fn retry_after_reads_all_three_http_date_forms() {
+        let now = sunday_morning_ms();
+        for form in [
+            "Sun, 01 Nov 2026 08:28:00 GMT",
+            "Sunday, 01-Nov-26 08:28:00 GMT",
+            "Sun Nov  1 08:28:00 2026",
+            "Sun Nov 1 08:28:00 2026",
+        ] {
+            assert_eq!(retry_after(form, now), Some(secs(3600)), "{form}");
+        }
+    }
+
+    #[test]
+    fn a_two_digit_year_more_than_fifty_years_ahead_is_the_past() {
+        let now = sunday_morning_ms();
+        let on = |yy: &str| retry_after(&format!("Friday, 01-Jan-{yy} 00:00:00 GMT"), now);
+        assert!(on("76").unwrap() > Duration::ZERO, "2076 is 50 years ahead");
+        assert_eq!(on("77"), Some(Duration::ZERO), "1977, not 2077");
+        assert!(on("33").unwrap() > Duration::ZERO, "2033");
+        assert_eq!(on("94"), Some(Duration::ZERO), "1994");
+    }
+
     #[test]
     fn retry_after_reads_seconds_and_http_dates() {
         const DATE: &str = "Wed, 21 Oct 2026 07:28:00 GMT";
@@ -808,7 +892,21 @@ mod tests {
         assert_eq!(retry_after(DATE, at + 1), Some(Duration::ZERO), "past");
         assert_eq!(retry_after("3600", at), Some(secs(3600)));
         assert_eq!(retry_after(" 3600 ", at), Some(secs(3600)));
-        for bad in ["", "soon", "-5", "3600.5", "1, 2", "Wed, 21 Oct 2026"] {
+        for bad in [
+            "",
+            "soon",
+            "-5",
+            "3600.5",
+            "1, 2",
+            "Wed, 21 Oct 2026",
+            "Wednesday, 21-Oct-26-1 07:28:00 GMT",
+            "Wednesday, 21-Oct-2026 07:28:00 GMT",
+            "Wednesday, 21-Foo-26 07:28:00 GMT",
+            "Wednesday, 21-Oct-26 07:28 GMT",
+            "Wed Oct 21 07:28:00:01 2026",
+            "Wed Oct 32 07:28:00 2026",
+            "Wed Oct 21 25:28:00 2026",
+        ] {
             assert_eq!(retry_after(bad, at), None, "{bad:?}");
         }
     }
diff --git a/crates/claude-connector/tests/serve_config.rs b/crates/claude-connector/tests/serve_config.rs
deleted file mode 100644
index 50a6279..0000000
--- a/crates/claude-connector/tests/serve_config.rs
+++ /dev/null
@@ -1,163 +0,0 @@
-//! `claude-connector serve --config` as a process: it binds, stays up, and
-//! starts the usage poll beside the lease listener. Only a spawned binary
-//! shows that `serve_config` calls the poll start at all; the poll's own
-//! behaviour is tested against fake servers in `usage_poll`.
-//!
-//! The usage endpoint is a constant of the connector, so this test's poll
-//! asks the real host with a made-up token and sees an answer or an
-//! unreachable network; either way it logs a `usage poll:` state line, and
-//! that line is what is asserted.
-#![cfg(unix)]
-
-use std::io::{BufRead, BufReader};
-use std::os::unix::fs::PermissionsExt;
-use std::path::{Path, PathBuf};
-use std::process::{Child, Command, Stdio};
-use std::sync::mpsc;
-use std::time::{Duration, Instant};
-
-use sha2::{Digest, Sha256};
-
-const TOKEN: &str = "sk-ant-oat01-CANARY-must-never-surface";
-
-struct Scratch(PathBuf);
-
-impl Scratch {
-    fn new() -> Self {
-        let dir =
-            std::env::temp_dir().join(format!("claude-connector-serve-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        Self(dir)
-    }
-
-    fn path(&self, name: &str) -> PathBuf {
-        self.0.join(name)
-    }
-}
-
-impl Drop for Scratch {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-/// Kills the served process however the test ends.
-struct Served(Child);
-
-impl Drop for Served {
-    fn drop(&mut self) {
-        let _ = self.0.kill();
-        let _ = self.0.wait();
-    }
-}
-
-fn hex(bytes: &[u8]) -> String {
-    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-fn run(args: &[&str]) {
-    let made = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
-        .args(args)
-        .env_clear()
-        .output()
-        .unwrap();
-    assert!(made.status.success(), "{made:?}");
-}
-
-/// A document the connector can serve: a pinned stand-in for the claude
-/// binary, a 0700 prompt directory, and the unit's credentials directory.
-fn ready_document(scratch: &Scratch) -> (PathBuf, PathBuf) {
-    let path = |name: &str| scratch.path(name);
-    let text = |name: &str| path(name).to_string_lossy().into_owned();
-    std::fs::write(path("claude"), b"not a real claude binary").unwrap();
-    let pin = hex(&Sha256::digest(b"not a real claude binary"));
-    for dir in ["work", "home", "prompts", "credentials"] {
-        std::fs::create_dir(path(dir)).unwrap();
-    }
-    std::fs::set_permissions(path("prompts"), std::fs::Permissions::from_mode(0o700)).unwrap();
-    std::fs::write(path("caller.key"), "k".repeat(48)).unwrap();
-    std::fs::write(path("credentials/claude-token"), TOKEN).unwrap();
-    let config = text("connector.cc");
-    run(&[
-        "config",
-        "init",
-        &config,
-        "--listen",
-        "127.0.0.1:0",
-        "--replay-store",
-        &text("replay.cc"),
-        "--claude-binary",
-        &text("claude"),
-        "--claude-sha256",
-        &pin,
-        "--work-dir",
-        &text("work"),
-        "--config-dir",
-        &text("home"),
-        "--prompt-dir",
-        &text("prompts"),
-        "--instance",
-        "persona-a",
-        "--token-credential",
-        "claude-token",
-        "--handle-secret-credential",
-        "claude-handle-secret",
-        "--handle-secret-file",
-        &text("credentials/claude-handle-secret"),
-        "--caller-id",
-        "persona-a-caller",
-        "--connection-key-file",
-        &text("caller.key"),
-        "--connection-key-epoch",
-        "1",
-        "--allowed-model",
-        "claude-haiku-5-5",
-    ]);
-    (path("connector.cc"), path("credentials"))
-}
-
-fn serve(config: &Path, credentials: &Path) -> (Served, mpsc::Receiver<String>) {
-    let mut child = Command::new(env!("CARGO_BIN_EXE_claude-connector"))
-        .args(["serve", "--config"])
-        .arg(config)
-        .env_clear()
-        .env("CREDENTIALS_DIRECTORY", credentials)
-        .stdout(Stdio::null())
-        .stderr(Stdio::piped())
-        .spawn()
-        .unwrap();
-    let stderr = child.stderr.take().unwrap();
-    let (lines, received) = mpsc::channel();
-    std::thread::spawn(move || {
-        for line in BufReader::new(stderr).lines().map_while(Result::ok) {
-            if lines.send(line).is_err() {
-                return;
-            }
-        }
-    });
-    (Served(child), received)
-}
-
-#[test]
-fn serve_config_starts_the_usage_poll_and_stays_up() {
-    let scratch = Scratch::new();
-    let (config, credentials) = ready_document(&scratch);
-    let (mut served, lines) = serve(&config, &credentials);
-
-    let deadline = Instant::now() + Duration::from_secs(60);
-    let mut seen = Vec::new();
-    let poll_line = loop {
-        let left = deadline.saturating_duration_since(Instant::now());
-        match lines.recv_timeout(left) {
-            Ok(line) if line.contains("usage poll:") => break line,
-            Ok(line) => seen.push(line),
-            Err(_) => panic!("no usage poll state line; the connector said {seen:?}"),
-        }
-    };
-    assert!(
-        served.0.try_wait().unwrap().is_none(),
-        "the connector exited after starting the poll"
-    );
-    assert!(!poll_line.contains("CANARY"), "{poll_line}");
-}

From f242290ca595b34944f189839a498ba3e02dc443 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 03:17:08 +0100
Subject: [PATCH 34/37] usage-meter-poll: pin what the production client is
 built with (finding new-client-timeout-unpinned)

UsageClient carries its timeout and url; UsageClient::production() is what
start() builds, and the test asserts that client's url and 10 s timeout as
spec r2 says, replacing a 1..=60 s bound no rule names.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/usage_poll.rs | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index ff61482..94b23ec 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -141,13 +141,20 @@ fn parse_usage(body: &str) -> Option<Vec<PlanQuota>> {
 
 /// The blocking HTTPS client: 10 s end to end, no redirects (the token must
 /// not follow one anywhere).
-struct UsageClient {
+pub(crate) struct UsageClient {
     agent: ureq::Agent,
     url: String,
+    timeout: Duration,
 }
 
 impl UsageClient {
-    fn new(url: impl Into<String>) -> Self {
+    /// The client that asks the provider's usage endpoint.
+    pub(crate) fn production() -> Self {
+        Self::new(ENDPOINT)
+    }
+
+    /// A client for another endpoint: a test's fake server.
+    pub(crate) fn new(url: impl Into<String>) -> Self {
         Self::with_timeout(url, TIMEOUT)
     }
 
@@ -158,6 +165,7 @@ impl UsageClient {
                 .redirects(0)
                 .build(),
             url: url.into(),
+            timeout,
         }
     }
 
@@ -392,7 +400,7 @@ pub fn start(
     let poller = Poller::new(
         cell,
         tokens,
-        UsageClient::new(ENDPOINT),
+        UsageClient::production(),
         Box::new(|line| eprintln!("claude-connector: {line}")),
     );
     std::thread::Builder::new()
@@ -962,8 +970,11 @@ mod tests {
     }
 
     #[test]
-    fn the_real_timeout_frees_the_thread_within_a_minute() {
-        assert!(TIMEOUT >= secs(1) && TIMEOUT <= secs(60), "{TIMEOUT:?}");
+    fn the_production_client_asks_the_provider_and_gives_up_after_ten_seconds() {
+        let client = UsageClient::production();
+        assert_eq!(client.url, "https://api.anthropic.com/api/oauth/usage");
+        assert_eq!(client.timeout, secs(10));
+        assert_eq!(TIMEOUT, secs(10));
     }
 
     /// Answers one connection after `delay`, as a slow endpoint does.

From 8fb8b5a71df6ac93ff34a9a77302aa974528ba0b Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 03:17:08 +0100
Subject: [PATCH 35/37] usage-meter-poll: the serve test asks a loopback fake,
 never the provider (finding serve-test-asks-real-provider)

serve_config is the public wrapper over a crate-private serve_config_with
that takes the usage client; the test runs it in-process against a fake and
asserts the fake received GET /api/oauth/usage with the bearer. The endpoint
is not a document field or env, so whoever writes the config cannot redirect
the token. The subprocess test that reached api.anthropic.com is deleted.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs     | 102 ++++++++++++++++++++++
 crates/claude-connector/src/usage_poll.rs |   5 +-
 2 files changed, 105 insertions(+), 2 deletions(-)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index f344197..e54c8d1 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -22,6 +22,8 @@ use crate::backend::readiness;
 use crate::lease::{LeaseCaller, LeaseLimits, serve_leases, user_uid};
 #[cfg(target_os = "linux")]
 use crate::unit::SystemdUnits;
+#[cfg(unix)]
+use crate::usage_poll::UsageClient;
 use crate::{
     ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink,
 };
@@ -535,6 +537,13 @@ pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
 /// Loads the document and serves until the listener fails.
 #[cfg(unix)]
 pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
+    serve_config_with(path, UsageClient::production())
+}
+
+/// [`serve_config`] with the usage poll asking `usage`: the endpoint is not a
+/// setting of the document, so a test reaches it only through here.
+#[cfg(unix)]
+fn serve_config_with(path: &Path, usage: UsageClient) -> Result<(), ConfigError> {
     let config = load_config(path)?;
     let admissions = readiness_of(&config)?;
     let listen = config.validate()?;
@@ -561,6 +570,7 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
         Box::new(CredentialTokenSource::from_environment(
             config.token_credential.clone(),
         )),
+        usage,
     )
     .map_err(|_| ConfigError::Serving("usage poll"))?;
     serve_service(listener, config.serve_limits(), service, backend)?;
@@ -571,6 +581,8 @@ pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
 mod tests {
     use std::sync::{Arc, Mutex};
 
+    use sha2::Digest;
+
     use super::*;
 
     /// A log that a test can read back.
@@ -587,6 +599,96 @@ mod tests {
         }
     }
 
+    /// `serve` starts the usage poll beside the listener, and the poll asks
+    /// where it was told: a fake on loopback receives its request, bearer
+    /// token and all, and nothing reaches the provider.
+    #[cfg(unix)]
+    #[test]
+    fn serve_config_starts_the_usage_poll_and_stays_up() {
+        use std::io::{Read, Write};
+        use std::os::unix::fs::PermissionsExt;
+
+        const TOKEN: &str = "sk-ant-oat01-fake-token-for-the-serve-test";
+        let dir =
+            std::env::temp_dir().join(format!("claude-connector-serve-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let at = |name: &str| dir.join(name);
+        for sub in ["work", "home", "prompts", "credentials"] {
+            std::fs::create_dir_all(at(sub)).unwrap();
+        }
+        std::fs::set_permissions(at("prompts"), std::fs::Permissions::from_mode(0o700)).unwrap();
+        std::fs::write(at("claude"), b"not a real claude binary").unwrap();
+        std::fs::write(at("caller.key"), "k".repeat(48)).unwrap();
+        std::fs::write(at("credentials/claude-token"), TOKEN).unwrap();
+        std::fs::write(at("credentials/claude-handle-secret"), "s".repeat(48)).unwrap();
+        let config = ClaudeConnectorConfig {
+            listen: "127.0.0.1:0".to_string(),
+            replay_store: at("replay.cc"),
+            claude_binary: at("claude"),
+            claude_binary_sha256: sha2::Sha256::digest(b"not a real claude binary").into(),
+            work_dir: at("work"),
+            config_dir: at("home"),
+            prompt_dir: at("prompts"),
+            instance: "persona-a".to_string(),
+            token_credential: "claude-token".to_string(),
+            handle_secret_credential: "claude-handle-secret".to_string(),
+            deadline_ms: 600_000,
+            max_line_bytes: 4 << 20,
+            max_total_bytes: 64 << 20,
+            stderr_tail_bytes: 8192,
+            max_frame_bytes: 2 << 20,
+            max_connections: 8,
+            socket_timeout_ms: 10_000,
+            max_expiry_skew_ms: 300_000,
+            callers: vec![CallerConfig {
+                caller_runtime_id: "persona-a-caller".to_string(),
+                connection_key_file: at("caller.key"),
+                connection_key_epoch: 1,
+                allowed_models: vec!["claude-haiku-5-5".to_string()],
+                max_concurrent_requests: 4,
+                max_payload_bytes: 1 << 20,
+                max_output_tokens: 32_768,
+            }],
+            lease_socket: None,
+            lease_callers: Vec::new(),
+            lease_max_ms: 3_600_000,
+        };
+        write_config(&at("connector.cc"), &config).unwrap();
+        // SAFETY: set once, to a directory only this test reads, before the
+        // serve thread it starts.
+        unsafe { std::env::set_var("CREDENTIALS_DIRECTORY", at("credentials")) };
+
+        let fake = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/api/oauth/usage", fake.local_addr().unwrap());
+        let (asked, request) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let (mut stream, _) = fake.accept().unwrap();
+            let mut text = vec![0u8; 4096];
+            let n = stream.read(&mut text).unwrap();
+            let _ = asked.send(String::from_utf8_lossy(&text[..n]).into_owned());
+            let _ = stream.write_all(
+                b"HTTP/1.1 429 Too Many Requests
+Content-Length: 0
+Connection: close
+
+",
+            );
+        });
+        let path = at("connector.cc");
+        let served = std::thread::spawn(move || serve_config_with(&path, UsageClient::new(url)));
+
+        let request = request
+            .recv_timeout(Duration::from_secs(60))
+            .expect("the usage poll never asked the fake endpoint");
+        assert!(request.starts_with("GET /api/oauth/usage "), "{request}");
+        assert!(request.contains(&format!("Bearer {TOKEN}")), "{request}");
+        assert!(
+            !served.is_finished(),
+            "serve returned after starting the poll"
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn serve_errors_name_a_field_or_stage_and_never_a_stored_value() {
         const CANARY: &str = "canary-path-8e2a";
diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index 94b23ec..2021cca 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -393,14 +393,15 @@ fn unix_ms() -> u64 {
 
 /// Starts the poll thread. It reads the token afresh at each poll, writes
 /// only to `cell`, and logs one line to stderr when its state changes.
-pub fn start(
+pub(crate) fn start(
     cell: Arc<QuotaCell>,
     tokens: Box<dyn TokenSource>,
+    client: UsageClient,
 ) -> std::io::Result<std::thread::JoinHandle<()>> {
     let poller = Poller::new(
         cell,
         tokens,
-        UsageClient::production(),
+        client,
         Box::new(|line| eprintln!("claude-connector: {line}")),
     );
     std::thread::Builder::new()

From 7d4c1bf56e4f05da9d9e1ca761e9a9aada650479 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 1 Nov 2026 03:30:55 +0100
Subject: [PATCH 36/37] usage-meter-poll: gate fixes: the timeout is read per
 request, serve has a refusal test, the RFC 850 guard is pinned

The timeout field was read only by a test (dead_code under -D warnings), so
ask() applies it to each request. The serve wrapper is reached by a
subprocess refusal test (no network); the serve test fails inside 30 s
instead of hanging; "Wednesday 21-Oct-26 ..." (no comma) is refused.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/claude-connector/src/daemon.rs            | 2 +-
 crates/claude-connector/src/usage_poll.rs        | 7 +++----
 crates/claude-connector/tests/config_document.rs | 9 +++++++++
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index e54c8d1..f7ef82f 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -678,7 +678,7 @@ Connection: close
         let served = std::thread::spawn(move || serve_config_with(&path, UsageClient::new(url)));
 
         let request = request
-            .recv_timeout(Duration::from_secs(60))
+            .recv_timeout(Duration::from_secs(30))
             .expect("the usage poll never asked the fake endpoint");
         assert!(request.starts_with("GET /api/oauth/usage "), "{request}");
         assert!(request.contains(&format!("Bearer {TOKEN}")), "{request}");
diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
index 2021cca..f5e4578 100644
--- a/crates/claude-connector/src/usage_poll.rs
+++ b/crates/claude-connector/src/usage_poll.rs
@@ -160,10 +160,7 @@ impl UsageClient {
 
     fn with_timeout(url: impl Into<String>, timeout: Duration) -> Self {
         Self {
-            agent: ureq::AgentBuilder::new()
-                .timeout(timeout)
-                .redirects(0)
-                .build(),
+            agent: ureq::AgentBuilder::new().redirects(0).build(),
             url: url.into(),
             timeout,
         }
@@ -177,6 +174,7 @@ impl UsageClient {
         let sent = self
             .agent
             .get(&self.url)
+            .timeout(self.timeout)
             .set("Authorization", bearer.as_str())
             .set("anthropic-beta", "oauth-2025-04-20")
             .call();
@@ -911,6 +909,7 @@ mod tests {
             "Wednesday, 21-Oct-26-1 07:28:00 GMT",
             "Wednesday, 21-Oct-2026 07:28:00 GMT",
             "Wednesday, 21-Foo-26 07:28:00 GMT",
+            "Wednesday 21-Oct-26 07:28:00 GMT",
             "Wednesday, 21-Oct-26 07:28 GMT",
             "Wed Oct 21 07:28:00:01 2026",
             "Wed Oct 32 07:28:00 2026",
diff --git a/crates/claude-connector/tests/config_document.rs b/crates/claude-connector/tests/config_document.rs
index d2af150..65c7b5d 100644
--- a/crates/claude-connector/tests/config_document.rs
+++ b/crates/claude-connector/tests/config_document.rs
@@ -286,3 +286,12 @@ fn the_dollar_flags_are_not_flags() {
         );
     }
 }
+
+#[test]
+fn serve_refuses_a_document_that_is_not_there() {
+    let scratch = Scratch::new();
+    let missing = scratch.path("missing.cc");
+    let served = run(&["serve", "--config", missing.to_str().unwrap()]);
+    assert!(!served.status.success(), "{served:?}");
+    assert!(!String::from_utf8_lossy(&served.stderr).is_empty());
+}

From 549962cb8a6b6d5c7ee567a9309432a1f4cf6630 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Tue, 3 Nov 2026 13:12:31 +0100
Subject: [PATCH 37/37] quota meter: the weekly reading comes from the CLI's
 own rate-limit event; while a lease is live and the reading is stale the
 connector makes the smallest real call. The usage poll and its HTTP client
 go: the setup token can never reach that endpoint (squash of
 eureka-body/quota-meter-stream 7d4c1bf..c298d9d; Soul s4-s5)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |  377 ------
 crates/claude-connector/Cargo.toml            |    1 -
 crates/claude-connector/src/backend.rs        |   34 +-
 crates/claude-connector/src/backend/tests.rs  |   54 +-
 crates/claude-connector/src/daemon.rs         |  107 +-
 crates/claude-connector/src/launch.rs         |    9 +-
 crates/claude-connector/src/lease.rs          |   14 +-
 crates/claude-connector/src/lib.rs            |    2 +-
 crates/claude-connector/src/meter.rs          |  543 +++++++++
 crates/claude-connector/src/quota.rs          |  294 ++++-
 crates/claude-connector/src/stream.rs         |   53 +-
 crates/claude-connector/src/usage_poll.rs     | 1077 -----------------
 .../fixtures/claude-2.1.312-meter-call.jsonl  |    4 +
 13 files changed, 988 insertions(+), 1581 deletions(-)
 create mode 100644 crates/claude-connector/src/meter.rs
 delete mode 100644 crates/claude-connector/src/usage_poll.rs
 create mode 100644 crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl

diff --git a/Cargo.lock b/Cargo.lock
index a1da85a..3709c14 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -150,7 +150,6 @@ dependencies = [
  "serde_json",
  "sha2",
  "thiserror",
- "ureq",
  "zeroize",
 ]
 
@@ -298,17 +297,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -351,15 +339,6 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
 [[package]]
 name = "fs2"
 version = "0.4.3"
@@ -481,110 +460,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "icu_collections"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
-
-[[package]]
-name = "icu_properties"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
-
-[[package]]
-name = "icu_provider"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
 [[package]]
 name = "inout"
 version = "0.1.4"
@@ -617,12 +492,6 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
-[[package]]
-name = "litemap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
-
 [[package]]
 name = "log"
 version = "0.4.34"
@@ -686,12 +555,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -720,15 +583,6 @@ dependencies = [
  "universal-hash",
 ]
 
-[[package]]
-name = "potential_utf"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -845,20 +699,6 @@ dependencies = [
  "syn 3.0.4",
 ]
 
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "rmp"
 version = "0.8.15"
@@ -898,41 +738,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.23.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
-dependencies = [
- "log",
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
-dependencies = [
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -1077,12 +882,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
-[[package]]
-name = "smallvec"
-version = "1.16.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
-
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -1103,12 +902,6 @@ dependencies = [
  "der",
 ]
 
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
 [[package]]
 name = "stacker"
 version = "0.1.25"
@@ -1150,17 +943,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "synstructure"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.20"
@@ -1181,16 +963,6 @@ dependencies = [
  "syn 3.0.4",
 ]
 
-[[package]]
-name = "tinystr"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -1213,54 +985,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "ureq"
-version = "2.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
-dependencies = [
- "base64",
- "log",
- "once_cell",
- "rustls",
- "rustls-pki-types",
- "url",
- "webpki-roots 0.26.11",
-]
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
-dependencies = [
- "utf_types",
-]
-
-[[package]]
-name = "utf_types"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
-
 [[package]]
 name = "uuid"
 version = "1.25.0"
@@ -1338,24 +1062,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.11",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -1534,35 +1240,6 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "writeable"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
-
-[[package]]
-name = "yoke"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
- "synstructure",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.63"
@@ -1583,66 +1260,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
- "synstructure",
-]
-
 [[package]]
 name = "zeroize"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
-[[package]]
-name = "zerotrie"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
index bc28e9f..6cb9e45 100644
--- a/crates/claude-connector/Cargo.toml
+++ b/crates/claude-connector/Cargo.toml
@@ -22,7 +22,6 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 thiserror = "2"
-ureq = { version = "2", default-features = false, features = ["tls"] }
 zeroize = "1"
 
 [target.'cfg(unix)'.dependencies]
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
index 4833521..0bc2d77 100644
--- a/crates/claude-connector/src/backend.rs
+++ b/crates/claude-connector/src/backend.rs
@@ -20,6 +20,12 @@ use crate::process::{ProcessPort, RunningChild, StdoutRead};
 use crate::quota::QuotaCell;
 use crate::stream::{Failure, Finished, Step, StreamState};
 
+/// The meter's call: the cheapest model, a trivial prompt, and an answer cap
+/// that only bounds a runaway.
+const METER_MODEL: &str = "claude-haiku-5-5";
+const METER_CALLER: &str = "meter";
+const METER_MAX_OUTPUT_TOKENS: u32 = 16;
+
 /// Where the child's credential comes from, read afresh at every use. The
 /// connector's own environment is never a source (ruling
 /// claude-connector-token-credential).
@@ -156,16 +162,40 @@ impl ClaudeCodeBackend {
         self.quota.clone()
     }
 
+    /// The meter's call: the smallest real one, through the same child,
+    /// stream and cell as any other. The stream's `rate_limit_event` is what
+    /// the caller wants; this returns what the call billed, or the failure's
+    /// kind (never its message).
+    pub(crate) fn read_meter(&self) -> Result<Usage, String> {
+        let mut request = ProviderRequest::new(
+            METER_CALLER,
+            METER_CALLER,
+            METER_MODEL,
+            "Reply with the single word ok.",
+            METER_MAX_OUTPUT_TOKENS,
+        );
+        request.input = vec![InputItem::UserText {
+            text: "ok?".to_string(),
+        }];
+        match self.run(&request, METER_CALLER, true).1 {
+            TransportOutcome::Completed { usage, .. } => Ok(usage),
+            TransportOutcome::Failed { kind, .. } => Err(format!("{kind:?}")),
+        }
+    }
+
     /// The one pin check: `ready` and every spawn use it, and nothing caches
     /// its answer.
     fn binary_matches_pin(&self) -> bool {
         binary_matches_pin(&self.config)
     }
 
+    /// `ephemeral` leaves no transcript behind: the meter keeps no handle and
+    /// resumes nothing, every other call is resumed by its session.
     fn run(
         &self,
         request: &ProviderRequest,
         caller: &str,
+        ephemeral: bool,
     ) -> (Vec<TransportEvent>, TransportOutcome) {
         let Some(secret) = usable_secret(self.handle_secret.as_ref()) else {
             return failed(
@@ -209,7 +239,7 @@ impl ClaudeCodeBackend {
                 "claude-code: the system prompt could not be staged",
             ));
         };
-        let argv = argv(&self.config, request, &plan, prompt.path());
+        let argv = argv(&self.config, request, &plan, prompt.path(), ephemeral);
         let env = child_env(&self.config, request);
         let deadline = Instant::now() + self.config.limits.deadline;
 
@@ -323,7 +353,7 @@ impl ProviderBackend for ClaudeCodeBackend {
     }
 
     fn execute(&self, call: &ProviderCall) -> TransportResult {
-        let (events, outcome) = self.run(call.request(), call.caller_runtime_id());
+        let (events, outcome) = self.run(call.request(), call.caller_runtime_id(), false);
         call.transported(events, outcome)
     }
 
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
index 61ee59d..ecd98fa 100644
--- a/crates/claude-connector/src/backend/tests.rs
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -2160,7 +2160,7 @@ fn rate_limit_event_updates_quota_cell() {
 
 #[test]
 fn a_rejected_turn_still_reports_its_windows_and_a_bad_window_costs_only_itself() {
-    let event = r#"{"type":"rate_limit_event","rate_limit_info":{"status":"rejected","unifiedWindows":{"five_hour":{"utilization":0.9996,"resetsAt":4102444800,"status":"rejected"},"seven_day":{"resetsAt":4102531200,"status":"allowed"},"idle":{"utilization":0,"resetsAt":4102444800,"status":"allowed"},"odd":{"utilization":"high","resetsAt":1,"status":"allowed"},"negative":{"utilization":-0.5,"resetsAt":1,"status":"allowed"}}}}"#;
+    let event = r#"{"type":"rate_limit_event","rate_limit_info":{"status":"rejected","unifiedWindows":{"five_hour":{"utilization":0.9996,"resetsAt":4102444800,"status":"rejected"},"seven_day":{"utilization":0,"resetsAt":4102531200,"status":"allowed"},"seven_day_overage_included":{"utilization":1,"resetsAt":4102531200,"status":"rejected"},"idle":{"utilization":0,"resetsAt":4102444800,"status":"allowed"}}}}"#;
     let rig = rig(vec![Script::lines(vec![
         init_line(MODEL, SESSION),
         event.to_string(),
@@ -2170,12 +2170,12 @@ fn a_rejected_turn_still_reports_its_windows_and_a_bad_window_costs_only_itself(
     assert_eq!(kind, FailureKind::RateLimited);
     let mut rejected = window("five_hour", 1000, 4_102_444_800_000);
     rejected.status = "rejected".to_string();
-    // Unknown is never zero: a window missing a field or of another type is
-    // skipped, not read as empty.
-    // A window at exactly zero use is a reading, and is kept.
+    // A window at exactly zero use is a reading, and is kept. Only the two
+    // windows pacing reads are taken: a per-model bucket that reads rejected
+    // must not close every lease, and no other name is a window of the plan.
     assert_eq!(
         readings(&rig),
-        vec![rejected, window("idle", 0, 4_102_444_800_000)]
+        vec![rejected, window("seven_day", 0, 4_102_531_200_000)]
     );
 }
 
@@ -2746,3 +2746,47 @@ fn a_turn_after_a_schema_turn_is_seeded_not_resumed() {
     assert!(!argv.iter().any(|a| a == "--resume"), "{argv:?}");
     assert!(!argv.iter().any(|a| a == "--json-schema"));
 }
+
+// ---- the meter's call ----
+
+/// One real call of the pinned CLI (2.1.312), captured on Yggdrasil on
+/// 2026-11-03 with the connector's own argv: haiku, no tools, the trivial
+/// prompt. Its `rate_limit_event` names only the week.
+const METER_CALL: &str = include_str!("../../tests/fixtures/claude-2.1.312-meter-call.jsonl");
+
+#[test]
+fn the_meter_call_reads_the_week_from_a_real_captured_event() {
+    let rig = rig(vec![Script::lines(
+        METER_CALL.lines().map(str::to_string).collect(),
+    )]);
+    let usage = rig
+        .backend
+        .read_meter()
+        .expect("the captured call completes");
+    assert_eq!((usage.input_tokens, usage.output_tokens), (384, 4));
+    // 0.06 of the week used; it resets at 1794261600 (unix s).
+    assert_eq!(
+        readings(&rig),
+        vec![window("seven_day", 60, 1_794_261_600_000)]
+    );
+    let argv = rig.seen().argv;
+    let after = |flag: &str| argv[argv.iter().position(|a| a == flag).unwrap() + 1].clone();
+    assert_eq!(after("--model"), METER_MODEL);
+    assert_eq!(after("--tools"), "", "the call can use no tool");
+    assert!(
+        argv.iter().any(|a| a == "--no-session-persistence"),
+        "the meter's transcript is nobody's to keep: {argv:?}"
+    );
+    assert_eq!(rig.spawns(), 1, "one child, never run again");
+}
+
+#[test]
+fn a_failed_meter_call_names_its_kind_and_leaves_the_cell_alone() {
+    let rig = rig(vec![Script::lines(vec![
+        init_line(MODEL, SESSION),
+        error_result_line(r#","api_error_status":500"#),
+    ])]);
+    let failed = rig.backend.read_meter().expect_err("the call fails");
+    assert!(!failed.is_empty() && !failed.contains(' '), "{failed}");
+    assert!(quota_of(&rig).windows.is_empty());
+}
diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs
index f7ef82f..e64e473 100644
--- a/crates/claude-connector/src/daemon.rs
+++ b/crates/claude-connector/src/daemon.rs
@@ -23,7 +23,7 @@ use crate::lease::{LeaseCaller, LeaseLimits, serve_leases, user_uid};
 #[cfg(target_os = "linux")]
 use crate::unit::SystemdUnits;
 #[cfg(unix)]
-use crate::usage_poll::UsageClient;
+use crate::meter;
 use crate::{
     ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink,
 };
@@ -537,13 +537,16 @@ pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> {
 /// Loads the document and serves until the listener fails.
 #[cfg(unix)]
 pub fn serve_config(path: &Path) -> Result<(), ConfigError> {
-    serve_config_with(path, UsageClient::production())
+    serve_config_with(path, |_| ())
 }
 
-/// [`serve_config`] with the usage poll asking `usage`: the endpoint is not a
-/// setting of the document, so a test reaches it only through here.
+/// [`serve_config`] handing the quota cell to `started` once the meter runs:
+/// a test stands in for the swarm's lease requests only through here.
 #[cfg(unix)]
-fn serve_config_with(path: &Path, usage: UsageClient) -> Result<(), ConfigError> {
+fn serve_config_with(
+    path: &Path,
+    started: impl FnOnce(&Arc<crate::QuotaCell>),
+) -> Result<(), ConfigError> {
     let config = load_config(path)?;
     let admissions = readiness_of(&config)?;
     let listen = config.validate()?;
@@ -561,18 +564,16 @@ fn serve_config_with(path: &Path, usage: UsageClient) -> Result<(), ConfigError>
         )
         .map_err(|error| ConfigError::from(ServeError::Service(error)))?,
     ));
+    // The meter is running before the first lease can ask, so that lease can
+    // wait for its first read.
+    let quota = backend.quota();
+    meter::start(quota.clone(), Box::new(backend.clone()))
+        .map_err(|_| ConfigError::Serving("meter"))?;
+    started(&quota);
     #[cfg(target_os = "linux")]
     if let Some(socket) = &config.lease_socket {
-        start_leases(&config, socket, service.clone(), backend.quota())?;
+        start_leases(&config, socket, service.clone(), quota.clone())?;
     }
-    crate::usage_poll::start(
-        backend.quota(),
-        Box::new(CredentialTokenSource::from_environment(
-            config.token_credential.clone(),
-        )),
-        usage,
-    )
-    .map_err(|_| ConfigError::Serving("usage poll"))?;
     serve_service(listener, config.serve_limits(), service, backend)?;
     Ok(())
 }
@@ -599,16 +600,16 @@ mod tests {
         }
     }
 
-    /// `serve` starts the usage poll beside the listener, and the poll asks
-    /// where it was told: a fake on loopback receives its request, bearer
-    /// token and all, and nothing reaches the provider.
+    /// `serve` starts the meter beside the listener, wired to the backend's own
+    /// cell: it makes no call while nobody asks, and once a lease is asked for
+    /// it runs the claude binary and serve stays up. The binary is a script
+    /// that replays a real captured call.
     #[cfg(unix)]
     #[test]
-    fn serve_config_starts_the_usage_poll_and_stays_up() {
-        use std::io::{Read, Write};
+    fn serve_config_starts_the_meter_and_stays_up() {
         use std::os::unix::fs::PermissionsExt;
 
-        const TOKEN: &str = "sk-ant-oat01-fake-token-for-the-serve-test";
+        const CALL: &str = include_str!("../tests/fixtures/claude-2.1.312-meter-call.jsonl");
         let dir =
             std::env::temp_dir().join(format!("claude-connector-serve-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
@@ -617,15 +618,22 @@ mod tests {
             std::fs::create_dir_all(at(sub)).unwrap();
         }
         std::fs::set_permissions(at("prompts"), std::fs::Permissions::from_mode(0o700)).unwrap();
-        std::fs::write(at("claude"), b"not a real claude binary").unwrap();
+        std::fs::write(at("call.jsonl"), CALL).unwrap();
+        let script = format!(
+            "#!/bin/sh\ncat > /dev/null\necho spawned >> '{}'\ncat '{}'\n",
+            at("spawned").display(),
+            at("call.jsonl").display()
+        );
+        std::fs::write(at("claude"), &script).unwrap();
+        std::fs::set_permissions(at("claude"), std::fs::Permissions::from_mode(0o755)).unwrap();
         std::fs::write(at("caller.key"), "k".repeat(48)).unwrap();
-        std::fs::write(at("credentials/claude-token"), TOKEN).unwrap();
+        std::fs::write(at("credentials/claude-token"), "sk-ant-oat01-fake-token").unwrap();
         std::fs::write(at("credentials/claude-handle-secret"), "s".repeat(48)).unwrap();
         let config = ClaudeConnectorConfig {
             listen: "127.0.0.1:0".to_string(),
             replay_store: at("replay.cc"),
             claude_binary: at("claude"),
-            claude_binary_sha256: sha2::Sha256::digest(b"not a real claude binary").into(),
+            claude_binary_sha256: sha2::Sha256::digest(script.as_bytes()).into(),
             work_dir: at("work"),
             config_dir: at("home"),
             prompt_dir: at("prompts"),
@@ -658,34 +666,35 @@ mod tests {
         // serve thread it starts.
         unsafe { std::env::set_var("CREDENTIALS_DIRECTORY", at("credentials")) };
 
-        let fake = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/api/oauth/usage", fake.local_addr().unwrap());
-        let (asked, request) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let (mut stream, _) = fake.accept().unwrap();
-            let mut text = vec![0u8; 4096];
-            let n = stream.read(&mut text).unwrap();
-            let _ = asked.send(String::from_utf8_lossy(&text[..n]).into_owned());
-            let _ = stream.write_all(
-                b"HTTP/1.1 429 Too Many Requests
-Content-Length: 0
-Connection: close
-
-",
-            );
-        });
         let path = at("connector.cc");
-        let served = std::thread::spawn(move || serve_config_with(&path, UsageClient::new(url)));
+        let lease = std::sync::Arc::new(std::sync::Mutex::new(None));
+        let swarm = lease.clone();
+        let served = std::thread::spawn(move || {
+            serve_config_with(&path, |cell| {
+                *swarm.lock().unwrap() = Some(cell.clone());
+            })
+        });
 
-        let request = request
-            .recv_timeout(Duration::from_secs(30))
-            .expect("the usage poll never asked the fake endpoint");
-        assert!(request.starts_with("GET /api/oauth/usage "), "{request}");
-        assert!(request.contains(&format!("Bearer {TOKEN}")), "{request}");
-        assert!(
-            !served.is_finished(),
-            "serve returned after starting the poll"
-        );
+        let deadline = std::time::Instant::now() + Duration::from_secs(30);
+        let cell = loop {
+            if let Some(cell) = lease.lock().unwrap().clone() {
+                break cell;
+            }
+            assert!(std::time::Instant::now() < deadline, "serve never started");
+            std::thread::sleep(Duration::from_millis(20));
+        };
+        std::thread::sleep(Duration::from_millis(500));
+        assert!(!at("spawned").exists(), "a quiet swarm spends nothing");
+        let _lease = cell.asking();
+
+        while !at("spawned").exists() {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "the meter never ran the claude binary"
+            );
+            std::thread::sleep(Duration::from_millis(50));
+        }
+        assert!(!served.is_finished(), "serve returned after starting the meter");
         let _ = std::fs::remove_dir_all(&dir);
     }
 
diff --git a/crates/claude-connector/src/launch.rs b/crates/claude-connector/src/launch.rs
index b233c09..1f8dbd0 100644
--- a/crates/claude-connector/src/launch.rs
+++ b/crates/claude-connector/src/launch.rs
@@ -107,13 +107,15 @@ fn effort(effort: ReasoningEffort) -> &'static str {
 /// rather than an argument because one argument is capped near 128 KiB
 /// (E2BIG) and instructions are not, the child has
 /// no tools, no MCP servers, no settings, no slash commands and nobody to ask
-/// for permission, and a resume always forks. A request's output schema goes
-/// to the CLI as `--json-schema`; without one the flag is absent.
+/// for permission, and a resume always forks. An ephemeral call (the
+/// meter's) keeps no session on disk. A request's output schema goes to the
+/// CLI as `--json-schema`; without one the flag is absent.
 pub(crate) fn argv(
     config: &ClaudeCodeConfig,
     request: &ProviderRequest,
     plan: &Plan,
     system_prompt_file: &Path,
+    ephemeral: bool,
 ) -> Vec<String> {
     let mut argv: Vec<String> = [
         config.claude_binary.to_string_lossy().as_ref(),
@@ -139,6 +141,9 @@ pub(crate) fn argv(
     .into_iter()
     .map(str::to_string)
     .collect();
+    if ephemeral {
+        argv.push("--no-session-persistence".to_string());
+    }
     if let Some(level) = request.reasoning_effort {
         argv.extend(["--effort".to_string(), effort(level).to_string()]);
     }
diff --git a/crates/claude-connector/src/lease.rs b/crates/claude-connector/src/lease.rs
index 0d4a582..7e503aa 100644
--- a/crates/claude-connector/src/lease.rs
+++ b/crates/claude-connector/src/lease.rs
@@ -468,8 +468,14 @@ impl Lender {
             );
         }
         // The lease is claimed before the token is read, let alone lent. The
-        // plan the refusal reads is the one this process last observed.
-        let plan = self.quota.snapshot();
+        // plan the refusal reads is the one this process last observed, but a
+        // cell with no weekly reading (a restart empties it) gets the meter's
+        // first read, bounded, before the lease is lent "unobserved" for its
+        // whole life. The request is the swarm's sign of life, however it
+        // ends: the meter reads while one is held or lately asked for.
+        let _asking = self.quota.asking();
+        let plan = self.quota.snapshot_with_week(FIRST_READ_WAIT);
+        let now = unix_ms();
         let admission = self
             .service
             .lock()
@@ -603,6 +609,10 @@ impl Lender {
     }
 }
 
+/// The longest a lease waits for the meter's first read of the week. A call
+/// takes a few seconds; the holder's own wait for the grant is far longer.
+const FIRST_READ_WAIT: Duration = Duration::from_secs(10);
+
 /// How often a held lease looks again at its holder's unit invocation.
 const HOLD_POLL_MS: u64 = 500;
 
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
index 1b01d30..671ee36 100644
--- a/crates/claude-connector/src/lib.rs
+++ b/crates/claude-connector/src/lib.rs
@@ -10,12 +10,12 @@ mod handle;
 mod launch;
 #[cfg(target_os = "linux")]
 mod lease;
+mod meter;
 mod process;
 mod quota;
 mod stream;
 #[cfg(target_os = "linux")]
 mod unit;
-mod usage_poll;
 
 pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource};
 pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
diff --git a/crates/claude-connector/src/meter.rs b/crates/claude-connector/src/meter.rs
new file mode 100644
index 0000000..2f572a2
--- /dev/null
+++ b/crates/claude-connector/src/meter.rs
@@ -0,0 +1,543 @@
+//! The meter: keeps the plan's weekly reading fresh while the swarm is
+//! working. The subscription reports its windows only inside the CLI's
+//! `rate_limit_event`, on a call the CLI makes, and Personas make theirs under
+//! leases that report nothing back. So when the `seven_day` reading in the
+//! [`QuotaCell`] is `STALE` old, the meter makes the smallest real call
+//! through the backend's own path (one `claude -p` on the cheapest model with
+//! a trivial prompt) and the stream fills the cell exactly as it does for any
+//! call. The meter holds no credential, speaks no protocol and writes nothing
+//! itself.
+//!
+//! The meter is driven by the connector's own lease state. It reads only
+//! while a lease is held or one was asked for less than `STALE` ago: a held
+//! swarm brake stops the units, they ask for nothing, and a braked or quiet
+//! swarm spends nothing. A call that fails, or completes without refreshing
+//! the reading, is not retried at the staleness period: the wait doubles per
+//! consecutive miss, up to `CEILING`.
+
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use model_connector::Usage;
+
+use crate::backend::ClaudeCodeBackend;
+use crate::quota::{EXPIRED, QuotaCell, WEEK};
+
+/// A reading this old, or older, is stale; also the least gap between calls.
+const STALE: Duration = Duration::from_secs(15 * 60);
+/// The longest any backoff may wait; also how long an idle meter sleeps
+/// before looking again, since a lease request wakes it.
+const CEILING: Duration = Duration::from_secs(6 * 60 * 60);
+
+/// The smallest real call, as the backend makes it.
+pub(crate) trait Probe: Send {
+    /// What the call billed, or the failure's kind. Never a message: a
+    /// provider's words do not enter the meter's log.
+    fn call(&self) -> Result<Usage, String>;
+}
+
+impl Probe for Arc<ClaudeCodeBackend> {
+    fn call(&self) -> Result<Usage, String> {
+        self.read_meter()
+    }
+}
+
+/// Why the meter is waiting; logged once per change.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum State {
+    Read,
+    Idle,
+    /// The call failed; the kind is the failure's kind, never its message.
+    Failed(String),
+    Unread,
+}
+
+impl State {
+    fn line(&self) -> String {
+        match self {
+            Self::Read => "meter: weekly reading refreshed".to_string(),
+            Self::Idle => "meter: no lease asked lately, making no call".to_string(),
+            Self::Failed(kind) => format!("meter: the call failed ({kind}), backing off"),
+            Self::Unread => {
+                "meter: the call completed without a weekly reading, backing off".to_string()
+            }
+        }
+    }
+}
+
+struct Meter {
+    cell: Arc<QuotaCell>,
+    probe: Box<dyn Probe>,
+    log: Box<dyn FnMut(&str) + Send>,
+    /// No call before this instant, unix ms.
+    not_before_ms: u64,
+    /// Consecutive calls that left the reading unrefreshed.
+    misses: u32,
+    last_state: Option<State>,
+}
+
+impl Meter {
+    fn new(cell: Arc<QuotaCell>, probe: Box<dyn Probe>, log: Box<dyn FnMut(&str) + Send>) -> Self {
+        Self {
+            cell,
+            probe,
+            log,
+            not_before_ms: 0,
+            misses: 0,
+            last_state: None,
+        }
+    }
+
+    /// Makes the call if one is due at `now_ms`; returns how long to wait
+    /// before looking again. Nothing is due while no lease is held or lately
+    /// asked for, nor before the last miss's backoff has passed, nor while the
+    /// weekly reading is younger than `STALE`.
+    fn tick(&mut self, now_ms: u64) -> Duration {
+        if !self.cell.wanted_at(now_ms, STALE) {
+            self.report(State::Idle);
+            return CEILING;
+        }
+        let due_at = self.due_at_ms();
+        if now_ms < due_at {
+            return Duration::from_millis(due_at - now_ms);
+        }
+        // A failed call may still have refreshed the reading: a rejected turn
+        // reports its windows and then errors. Only the cell says whether the
+        // week was read.
+        let called = self.probe.call();
+        let state = if self.refreshed_since(now_ms) {
+            self.misses = 0;
+            State::Read
+        } else {
+            self.misses = self.misses.saturating_add(1);
+            match called {
+                Ok(_) => State::Unread,
+                Err(kind) => State::Failed(kind),
+            }
+        };
+        self.report(state);
+        self.not_before_ms = now_ms.saturating_add(duration_ms(backoff(self.misses)));
+        Duration::from_millis(self.due_at_ms().saturating_sub(now_ms))
+    }
+
+    /// The earliest instant the next call may happen. A window past its reset
+    /// described a week that is over, so it is due at once.
+    fn due_at_ms(&self) -> u64 {
+        let stale_at = self
+            .cell
+            .snapshot()
+            .windows
+            .iter()
+            .find(|quota| quota.window == WEEK)
+            .map_or(0, |quota| {
+                if quota.status == EXPIRED {
+                    0
+                } else {
+                    quota.observed_at_unix_ms.saturating_add(duration_ms(STALE))
+                }
+            });
+        stale_at.max(self.not_before_ms)
+    }
+
+    fn refreshed_since(&self, since_ms: u64) -> bool {
+        self.cell
+            .snapshot()
+            .windows
+            .iter()
+            .any(|quota| quota.window == WEEK && quota.observed_at_unix_ms >= since_ms)
+    }
+
+    fn report(&mut self, state: State) {
+        if self.last_state.as_ref() != Some(&state) {
+            (self.log)(&state.line());
+            self.last_state = Some(state);
+        }
+    }
+
+    fn run(mut self) {
+        loop {
+            let seen = self.cell.asks_so_far();
+            let wait = self.tick(unix_ms());
+            self.cell.sleep_until_asked(seen, wait);
+        }
+    }
+}
+
+/// The wait after `misses` consecutive unrefreshed calls: the staleness
+/// period, doubling per miss beyond the first, up to the ceiling.
+fn backoff(misses: u32) -> Duration {
+    let doublings = misses.saturating_sub(1).min(16);
+    STALE.saturating_mul(1 << doublings).min(CEILING)
+}
+
+fn duration_ms(duration: Duration) -> u64 {
+    u64::try_from(duration.as_millis()).unwrap_or(u64::MAX)
+}
+
+fn unix_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, duration_ms)
+}
+
+/// Starts the meter thread. It writes only through the calls it makes, and
+/// logs one line to stderr when its state changes. From here a lease asked of
+/// a cell with no weekly reading waits for the meter's first read.
+pub(crate) fn start(
+    cell: Arc<QuotaCell>,
+    probe: Box<dyn Probe>,
+) -> std::io::Result<std::thread::JoinHandle<()>> {
+    cell.attach_meter();
+    let meter = Meter::new(
+        cell,
+        probe,
+        Box::new(|line| eprintln!("claude-connector: {line}")),
+    );
+    std::thread::Builder::new()
+        .name("claude-meter".to_string())
+        .spawn(move || meter.run())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::quota::Asking;
+    use model_connector::PlanQuota;
+    use std::sync::Mutex;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    const MIN: u64 = 60_000;
+    const NOW: u64 = 1_800_000_000_000;
+    const RESET: u64 = 4_102_444_800_000;
+
+    fn reading(status: &str) -> Vec<PlanQuota> {
+        vec![PlanQuota {
+            window: WEEK.to_string(),
+            utilization_permille: Some(60),
+            resets_at_unix_ms: RESET,
+            status: status.to_string(),
+            observed_at_unix_ms: 0,
+        }]
+    }
+
+    /// What the next call does: the instant its stream stamps a weekly
+    /// reading (if any) and the kind it then fails with (if any).
+    #[derive(Clone, Default)]
+    struct Script {
+        reading_at: Option<u64>,
+        status: String,
+        fails_with: Option<String>,
+    }
+
+    /// A call that answers as scripted and feeds the cell the way the stream
+    /// does, before it fails, as a rejected turn does.
+    struct Calls {
+        cell: Arc<QuotaCell>,
+        made: Arc<AtomicUsize>,
+        script: Arc<Mutex<Script>>,
+    }
+
+    impl Probe for Calls {
+        fn call(&self) -> Result<Usage, String> {
+            self.made.fetch_add(1, Ordering::SeqCst);
+            let script = self.script.lock().unwrap().clone();
+            if let Some(at) = script.reading_at {
+                self.cell.observe_at(at, reading(&script.status));
+            }
+            if let Some(kind) = script.fails_with {
+                return Err(kind);
+            }
+            Ok(Usage {
+                input_tokens: 385,
+                cache_read_tokens: 0,
+                cache_write_tokens: 0,
+                output_tokens: 4,
+                reasoning_tokens: None,
+            })
+        }
+    }
+
+    struct Rig {
+        meter: Meter,
+        cell: Arc<QuotaCell>,
+        made: Arc<AtomicUsize>,
+        script: Arc<Mutex<Script>>,
+        log: Arc<Mutex<Vec<String>>>,
+        /// The lease the swarm holds until a test lets go of it.
+        lease: Option<Asking>,
+    }
+
+    fn rig() -> Rig {
+        let cell = Arc::new(QuotaCell::new());
+        let made = Arc::new(AtomicUsize::new(0));
+        let script = Arc::new(Mutex::new(Script::default()));
+        let log = Arc::new(Mutex::new(Vec::new()));
+        let sink = log.clone();
+        let meter = Meter::new(
+            cell.clone(),
+            Box::new(Calls {
+                cell: cell.clone(),
+                made: made.clone(),
+                script: script.clone(),
+            }),
+            Box::new(move |line| sink.lock().unwrap().push(line.to_string())),
+        );
+        let lease = Some(cell.asking_at(NOW));
+        Rig {
+            meter,
+            cell,
+            made,
+            script,
+            log,
+            lease,
+        }
+    }
+
+    impl Rig {
+        fn reads(&self, at: u64) {
+            *self.script.lock().unwrap() = Script {
+                reading_at: Some(at),
+                status: "allowed".to_string(),
+                fails_with: None,
+            };
+        }
+        fn reads_nothing(&self) {
+            *self.script.lock().unwrap() = Script::default();
+        }
+        fn fails(&self, kind: &str) {
+            *self.script.lock().unwrap() = Script {
+                fails_with: Some(kind.to_string()),
+                ..Script::default()
+            };
+        }
+        fn calls(&self) -> usize {
+            self.made.load(Ordering::SeqCst)
+        }
+        fn lines(&self) -> Vec<String> {
+            self.log.lock().unwrap().clone()
+        }
+    }
+
+    #[test]
+    fn an_unread_week_triggers_one_call_and_the_fresh_reading_ends_the_asking() {
+        let mut rig = rig();
+        rig.reads(NOW);
+        assert_eq!(rig.meter.tick(NOW), STALE, "fresh for the staleness period");
+        assert_eq!(rig.calls(), 1);
+        assert_eq!(
+            rig.meter.tick(NOW + 5 * MIN),
+            Duration::from_millis(10 * MIN)
+        );
+        assert_eq!(rig.calls(), 1, "a fresh reading makes no call");
+    }
+
+    #[test]
+    fn a_stale_reading_triggers_a_call_at_the_period_and_not_before() {
+        let mut rig = rig();
+        rig.cell.observe_at(NOW, reading("allowed"));
+        rig.reads(NOW + 15 * MIN);
+        rig.meter.tick(NOW + 15 * MIN - 1);
+        assert_eq!(rig.calls(), 0, "one millisecond short of stale");
+        rig.meter.tick(NOW + 15 * MIN);
+        assert_eq!(rig.calls(), 1);
+    }
+
+    #[test]
+    fn a_window_past_its_reset_is_read_at_once_not_after_the_period() {
+        let mut rig = rig();
+        let now = unix_ms();
+        let mut over = reading("allowed").remove(0);
+        over.resets_at_unix_ms = 1;
+        rig.cell.observe_at(now, vec![over]);
+        rig.reads(now);
+        rig.meter.tick(now);
+        assert_eq!(rig.calls(), 1);
+    }
+
+    #[test]
+    fn a_swarm_that_asks_for_nothing_spends_nothing_however_stale_the_reading() {
+        let mut rig = rig();
+        drop(rig.lease.take());
+        for step in 0..10 {
+            let at = NOW + 15 * MIN + step * 60 * MIN;
+            assert_eq!(rig.meter.tick(at), CEILING);
+        }
+        assert_eq!(rig.calls(), 0);
+        assert_eq!(rig.lines(), vec![State::Idle.line()]);
+    }
+
+    #[test]
+    fn a_lease_asked_for_wakes_the_meter_and_the_empty_cell_is_read() {
+        let mut rig = rig();
+        drop(rig.lease.take());
+        rig.reads(NOW + 180 * MIN);
+        rig.meter.tick(NOW + 180 * MIN);
+        assert_eq!(rig.calls(), 0, "asked three hours ago and let go");
+        let _later = rig.cell.asking_at(NOW + 180 * MIN);
+        rig.meter.tick(NOW + 180 * MIN);
+        assert_eq!(rig.calls(), 1);
+    }
+
+    #[test]
+    fn a_lease_let_go_is_still_wanted_for_exactly_one_staleness_period() {
+        let mut rig = rig();
+        drop(rig.lease.take());
+        rig.reads(NOW + 15 * MIN - 1);
+        rig.meter.tick(NOW + 15 * MIN - 1);
+        assert_eq!(rig.calls(), 1, "one millisecond inside the period");
+        rig.reads(NOW + 30 * MIN);
+        rig.meter.tick(NOW + 30 * MIN);
+        assert_eq!(rig.calls(), 1, "a period after the last ask: unwanted");
+    }
+
+    #[test]
+    fn a_lease_held_for_four_hours_keeps_the_week_read_throughout() {
+        let mut rig = rig();
+        for step in 0..=16 {
+            let at = NOW + step * 15 * MIN;
+            rig.reads(at);
+            rig.meter.tick(at);
+        }
+        assert_eq!(rig.calls(), 17, "one read per period, the lease never lapsing");
+    }
+
+    #[test]
+    fn a_failed_call_leaves_the_cell_and_backs_off_instead_of_hammering() {
+        let mut rig = rig();
+        rig.cell.observe_at(NOW, reading("allowed"));
+        let before = rig.cell.snapshot();
+        rig.fails("Provider");
+        let mut at = NOW + 15 * MIN;
+        let mut waits = Vec::new();
+        for _ in 0..4 {
+            waits.push(rig.meter.tick(at));
+            at += duration_ms(*waits.last().unwrap());
+        }
+        assert_eq!(rig.calls(), 4);
+        assert_eq!(rig.cell.snapshot(), before, "the cell is untouched");
+        assert_eq!(
+            waits,
+            [15, 30, 60, 120].map(|m| Duration::from_secs(m * 60)),
+            "the wait doubles per consecutive miss"
+        );
+        rig.meter.tick(at - MIN);
+        assert_eq!(rig.calls(), 4, "nothing is asked before the backoff ends");
+        assert_eq!(
+            rig.lines(),
+            vec!["meter: the call failed (Provider), backing off"]
+        );
+    }
+
+    #[test]
+    fn the_failure_kind_is_logged_again_when_it_changes_and_not_when_it_repeats() {
+        let mut rig = rig();
+        rig.fails("Authentication");
+        rig.meter.tick(NOW);
+        rig.meter.tick(NOW + 15 * MIN);
+        rig.fails("InvalidRequest");
+        rig.meter.tick(NOW + 45 * MIN);
+        assert_eq!(
+            rig.lines(),
+            vec![
+                "meter: the call failed (Authentication), backing off",
+                "meter: the call failed (InvalidRequest), backing off",
+            ]
+        );
+    }
+
+    #[test]
+    fn the_backoff_stops_at_the_ceiling_and_one_good_reading_resets_it() {
+        assert_eq!(backoff(0), STALE);
+        assert_eq!(backoff(1), STALE);
+        assert_eq!(backoff(u32::MAX), CEILING);
+        let mut rig = rig();
+        rig.fails("Provider");
+        rig.meter.tick(NOW);
+        rig.meter.tick(NOW + 15 * MIN);
+        assert_eq!(rig.meter.misses, 2);
+        rig.reads(NOW + 45 * MIN);
+        rig.meter.tick(NOW + 45 * MIN);
+        assert_eq!(rig.meter.misses, 0);
+    }
+
+    #[test]
+    fn a_call_that_completes_without_a_weekly_reading_is_a_miss_too() {
+        let mut rig = rig();
+        rig.reads_nothing();
+        assert_eq!(rig.meter.tick(NOW), STALE);
+        assert_eq!(rig.meter.tick(NOW + 15 * MIN), 2 * STALE);
+        assert_eq!(rig.calls(), 2);
+        assert_eq!(rig.lines(), vec![State::Unread.line()]);
+    }
+
+    #[test]
+    fn a_rejected_turn_that_refreshed_the_reading_and_then_errored_is_no_miss() {
+        let mut rig = rig();
+        *rig.script.lock().unwrap() = Script {
+            reading_at: Some(NOW),
+            status: "rejected".to_string(),
+            fails_with: Some("RateLimited".to_string()),
+        };
+        assert_eq!(rig.meter.tick(NOW), STALE, "the next read is a period away");
+        assert_eq!(rig.meter.misses, 0);
+        assert_eq!(rig.lines(), vec![State::Read.line()]);
+        rig.reads(NOW + 15 * MIN);
+        rig.meter.tick(NOW + 15 * MIN);
+        assert_eq!(rig.calls(), 2, "a rejected reading is kept fresh");
+    }
+
+    #[test]
+    fn a_reading_from_before_the_call_does_not_count_as_its_answer() {
+        let mut rig = rig();
+        // A slow concurrent sensor stamped earlier than this call began.
+        rig.reads(NOW - 1);
+        rig.meter.tick(NOW);
+        assert_eq!(rig.meter.misses, 1);
+    }
+
+    #[test]
+    fn the_log_says_what_the_meter_is_doing_in_words() {
+        assert_eq!(
+            State::Idle.line(),
+            "meter: no lease asked lately, making no call"
+        );
+        assert_eq!(State::Read.line(), "meter: weekly reading refreshed");
+        assert_eq!(
+            State::Unread.line(),
+            "meter: the call completed without a weekly reading, backing off"
+        );
+    }
+
+    #[test]
+    fn the_clock_is_the_system_clock_in_unix_milliseconds() {
+        let before = SystemTime::now().duration_since(UNIX_EPOCH).unwrap();
+        let read = unix_ms();
+        let after = SystemTime::now().duration_since(UNIX_EPOCH).unwrap();
+        assert!((before.as_millis() as u64..=after.as_millis() as u64).contains(&read));
+    }
+
+    #[test]
+    fn a_started_meter_sleeps_until_a_lease_asks_and_then_reads() {
+        let cell = Arc::new(QuotaCell::new());
+        let made = Arc::new(AtomicUsize::new(0));
+        let probe = Calls {
+            cell: cell.clone(),
+            made: made.clone(),
+            script: Arc::new(Mutex::new(Script {
+                reading_at: Some(unix_ms() + 60 * MIN),
+                status: "allowed".to_string(),
+                fails_with: None,
+            })),
+        };
+        start(cell.clone(), Box::new(probe)).unwrap();
+        std::thread::sleep(Duration::from_millis(300));
+        assert_eq!(made.load(Ordering::SeqCst), 0, "no lease, no call");
+        let _lease = cell.asking();
+        let deadline = std::time::Instant::now() + Duration::from_secs(10);
+        while made.load(Ordering::SeqCst) == 0 {
+            assert!(std::time::Instant::now() < deadline, "the ask woke nobody");
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        assert_eq!(cell.snapshot_with_week(Duration::ZERO).windows.len(), 1);
+    }
+}
diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs
index b319d4c..fe71383 100644
--- a/crates/claude-connector/src/quota.rs
+++ b/crates/claude-connector/src/quota.rs
@@ -1,54 +1,147 @@
 //! The plan's own usage windows, as the subscription reports them. The
-//! subscription decides how much a plan may burn, and two sensors observe it:
-//! the CLI's `rate_limit_event` on the connector's own calls, and the usage
-//! poll of `usage_poll` while that stream is quiet. The latest observation of
-//! each window, from either, is kept here and published as the usage readout
-//! and lent with each lease.
+//! subscription decides how much a plan may burn, and one sensor observes it:
+//! the CLI's `rate_limit_event` on the connector's own calls, which the
+//! `meter` makes when the week's reading goes stale. The latest observation of
+//! each window is kept here and published as the usage readout and lent with
+//! each lease.
 
 use std::collections::BTreeMap;
-use std::sync::Mutex;
-use std::time::{SystemTime, UNIX_EPOCH};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Condvar, Mutex};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use model_connector::{PlanQuota, PlanQuotaSnapshot};
 
+/// The window the weekly pacing reads, and the one the meter keeps fresh.
+pub(crate) const WEEK: &str = "seven_day";
+/// The windows the pacing reads, and so the only ones the cell keeps.
+pub(crate) const PACED: [&str; 2] = ["five_hour", WEEK];
+
+/// How often a lease waiting for its first reading looks at the cell again.
+const FIRST_READ_POLL: Duration = Duration::from_millis(50);
+
 /// The latest observation of each plan window, shared by the backend that
 /// feeds it and whatever reads it out. Each window carries the time of its
 /// own observation: an event that names one window says nothing about the
 /// others.
+///
+/// It also keeps who is asking: a lease request is the swarm's only sign of
+/// life the connector sees, and the meter reads the plan only while someone
+/// asks.
 #[derive(Default)]
-pub struct QuotaCell(Mutex<BTreeMap<String, PlanQuota>>);
+pub struct QuotaCell {
+    windows: Mutex<BTreeMap<String, PlanQuota>>,
+    asks: Mutex<Asks>,
+    asked: Condvar,
+    metered: AtomicBool,
+}
+
+#[derive(Default)]
+struct Asks {
+    /// Lease requests in flight or held.
+    live: usize,
+    /// Requests ever made; the meter sleeps until it changes.
+    count: u64,
+    /// When the latest request came, unix ms.
+    last_ms: Option<u64>,
+}
+
+/// A lease request while it is in flight or held. Dropping it is the lease
+/// ending, by whatever road.
+pub(crate) struct Asking(Arc<QuotaCell>);
+
+impl Drop for Asking {
+    fn drop(&mut self) {
+        let mut asks = self.0.asks.lock().unwrap_or_else(|e| e.into_inner());
+        asks.live = asks.live.saturating_sub(1);
+    }
+}
 
 impl QuotaCell {
     pub fn new() -> Self {
         Self::default()
     }
 
+    /// Notes a lease request, now, and wakes the meter.
+    pub(crate) fn asking(self: &Arc<Self>) -> Asking {
+        self.asking_at(unix_ms())
+    }
+
+    pub(crate) fn asking_at(self: &Arc<Self>, now: u64) -> Asking {
+        {
+            let mut asks = self.asks.lock().unwrap_or_else(|e| e.into_inner());
+            asks.live += 1;
+            asks.count += 1;
+            asks.last_ms = Some(now);
+        }
+        self.asked.notify_all();
+        Asking(self.clone())
+    }
+
+    /// Whether a lease is held, or one was asked for less than `within` ago.
+    pub(crate) fn wanted_at(&self, now: u64, within: Duration) -> bool {
+        let asks = self.asks.lock().unwrap_or_else(|e| e.into_inner());
+        asks.live > 0
+            || asks.last_ms.is_some_and(|last| {
+                now < last.saturating_add(u64::try_from(within.as_millis()).unwrap_or(u64::MAX))
+            })
+    }
+
+    pub(crate) fn asks_so_far(&self) -> u64 {
+        self.asks.lock().unwrap_or_else(|e| e.into_inner()).count
+    }
+
+    /// Sleeps up to `limit`, or until a request beyond the first `seen` comes.
+    pub(crate) fn sleep_until_asked(&self, seen: u64, limit: Duration) {
+        let asks = self.asks.lock().unwrap_or_else(|e| e.into_inner());
+        drop(
+            self.asked
+                .wait_timeout_while(asks, limit, |asks| asks.count == seen)
+                .unwrap_or_else(|e| e.into_inner()),
+        );
+    }
+
+    /// Declares that a meter reads this cell, so a first lease may wait for it.
+    pub(crate) fn attach_meter(&self) {
+        self.metered.store(true, Ordering::SeqCst);
+    }
+
+    /// The windows as they stand, but with no weekly reading yet (a restart
+    /// leaves the cell empty) a metered cell is given up to `within` to get
+    /// one, so a lease is not lent "unobserved" for want of a few seconds.
+    pub(crate) fn snapshot_with_week(&self, within: Duration) -> PlanQuotaSnapshot {
+        let deadline = Instant::now() + within;
+        loop {
+            let snapshot = self.snapshot();
+            let read = snapshot
+                .windows
+                .iter()
+                .any(|quota| quota.window == WEEK && quota.status != EXPIRED);
+            let now = Instant::now();
+            if read || !self.metered.load(Ordering::SeqCst) || now >= deadline {
+                return snapshot;
+            }
+            std::thread::sleep(FIRST_READ_POLL.min(deadline - now));
+        }
+    }
+
     /// Records the windows one event reported, stamping each with now. See
     /// [`QuotaCell::observe_at`] for how a reading combines with what is held.
     pub fn observe(&self, windows: impl IntoIterator<Item = PlanQuota>) {
         self.observe_at(unix_ms(), windows);
     }
 
-    /// Records readings taken at `at` (unix ms): the moment the sensor asked,
-    /// not the moment its answer arrived. The cell alone decides how a reading
-    /// combines with the one it holds for that window, and every sensor goes
-    /// through this decision:
-    ///
-    /// - a reading older than the held one is dropped, so a slow answer cannot
-    ///   replace what a faster sensor saw meanwhile;
-    /// - the provider's rejection stands until its window resets, or until a
-    ///   reading that itself carries a verdict from the provider replaces it:
-    ///   a [`POLLED`] reading reports utilization only, and says nothing about
-    ///   whether the provider accepts calls.
-    ///
-    /// Windows the readings did not mention stay as they were, stamp included.
+    /// Records readings taken at `at` (unix ms). A reading older than the
+    /// held one is dropped, so a slow call cannot replace what a faster one
+    /// saw meanwhile. Windows the readings did not mention stay as they were,
+    /// stamp included.
     pub fn observe_at(&self, at: u64, windows: impl IntoIterator<Item = PlanQuota>) {
-        let mut held = self.0.lock().unwrap_or_else(|e| e.into_inner());
+        let mut held = self.windows.lock().unwrap_or_else(|e| e.into_inner());
         for mut quota in windows {
             quota.observed_at_unix_ms = at;
             if held
                 .get(&quota.window)
-                .is_none_or(|current| supersedes(current, &quota))
+                .is_none_or(|current| quota.observed_at_unix_ms >= current.observed_at_unix_ms)
             {
                 held.insert(quota.window.clone(), quota);
             }
@@ -63,7 +156,7 @@ impl QuotaCell {
     /// `expired` with no utilization: the reading described a window that no
     /// longer exists.
     fn snapshot_at(&self, now: u64) -> PlanQuotaSnapshot {
-        let held = self.0.lock().unwrap_or_else(|e| e.into_inner());
+        let held = self.windows.lock().unwrap_or_else(|e| e.into_inner());
         PlanQuotaSnapshot {
             windows: held
                 .values()
@@ -81,24 +174,7 @@ impl QuotaCell {
 }
 
 /// The status of a window whose reset has passed since it was observed.
-const EXPIRED: &str = "expired";
-/// The status of a window the provider refuses calls on.
-pub(crate) const REJECTED: &str = "rejected";
-/// The status of a window read from the usage endpoint: utilization and reset
-/// time, with no verdict on whether calls are accepted.
-pub(crate) const POLLED: &str = "polled";
-
-/// Whether `incoming` (already stamped with its own reading time) replaces
-/// `current` for the same window.
-fn supersedes(current: &PlanQuota, incoming: &PlanQuota) -> bool {
-    if incoming.observed_at_unix_ms < current.observed_at_unix_ms {
-        return false;
-    }
-    let rejection_stands = current.status == REJECTED
-        && incoming.status == POLLED
-        && incoming.observed_at_unix_ms < current.resets_at_unix_ms;
-    !rejection_stands
-}
+pub(crate) const EXPIRED: &str = "expired";
 
 fn unix_ms() -> u64 {
     SystemTime::now()
@@ -194,33 +270,13 @@ mod tests {
     }
 
     #[test]
-    fn a_rejection_stands_against_a_poll_until_the_window_resets() {
+    fn a_newer_reading_lifts_a_rejection() {
         let cell = QuotaCell::new();
-        let polled = with_status(quota("five_hour", 500, 0), POLLED);
-        cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]);
-        cell.observe_at(200, [polled.clone()]);
-        assert_eq!(held(&cell), (REJECTED.to_string(), Some(1000), 100));
-        // The window the rejection described is over: a poll of the next one lands.
-        cell.observe_at(RESET, [polled]);
-        assert_eq!(cell.snapshot_at(RESET - 1).windows[0].status, POLLED);
-    }
-
-    #[test]
-    fn a_newer_reading_that_carries_its_own_verdict_lifts_a_rejection() {
-        let cell = QuotaCell::new();
-        cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]);
+        cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), "rejected")]);
         cell.observe_at(200, [quota("five_hour", 300, 0)]);
         assert_eq!(held(&cell), ("allowed".to_string(), Some(300), 200));
     }
 
-    #[test]
-    fn a_poll_replaces_what_is_not_a_rejection() {
-        let cell = QuotaCell::new();
-        cell.observe_at(100, [quota("five_hour", 300, 0)]);
-        cell.observe_at(200, [with_status(quota("five_hour", 400, 0), POLLED)]);
-        assert_eq!(held(&cell), (POLLED.to_string(), Some(400), 200));
-    }
-
     #[test]
     fn the_live_clock_stamps_and_expires() {
         let cell = QuotaCell::new();
@@ -236,4 +292,114 @@ mod tests {
         assert_eq!(windows[0].utilization_permille, Some(80));
         assert_eq!(windows[1].status, "expired");
     }
+
+    const HOUR: u64 = 3_600_000;
+
+    #[test]
+    fn nobody_wants_the_plan_before_anyone_asks() {
+        let cell = Arc::new(QuotaCell::new());
+        assert!(!cell.wanted_at(0, Duration::from_secs(900)));
+    }
+
+    #[test]
+    fn a_lease_in_flight_or_held_is_wanted_for_as_long_as_it_lives() {
+        let cell = Arc::new(QuotaCell::new());
+        let lease = cell.asking_at(1_000);
+        let other = cell.asking_at(2_000);
+        let day = Duration::from_secs(86_400);
+        assert!(cell.wanted_at(1_000 + 4 * HOUR, Duration::from_secs(1)));
+        drop(lease);
+        assert!(cell.wanted_at(1_000 + 4 * HOUR, Duration::from_secs(1)), "one lease still lives");
+        drop(other);
+        assert!(!cell.wanted_at(1_000 + 4 * HOUR, Duration::from_secs(1)));
+        assert!(cell.wanted_at(2_000 + 4 * HOUR, day), "within the window of the last ask");
+    }
+
+    #[test]
+    fn a_lease_let_go_is_wanted_until_exactly_the_period_after_its_ask() {
+        let cell = Arc::new(QuotaCell::new());
+        drop(cell.asking_at(10_000));
+        let period = Duration::from_millis(900);
+        assert!(cell.wanted_at(10_899, period));
+        assert!(!cell.wanted_at(10_900, period));
+    }
+
+    #[test]
+    fn each_ask_is_counted_and_wakes_a_sleeper_at_once() {
+        let cell = Arc::new(QuotaCell::new());
+        assert_eq!(cell.asks_so_far(), 0);
+        let sleeper = {
+            let cell = cell.clone();
+            std::thread::spawn(move || {
+                let started = Instant::now();
+                cell.sleep_until_asked(0, Duration::from_secs(30));
+                started.elapsed()
+            })
+        };
+        std::thread::sleep(Duration::from_millis(100));
+        drop(cell.asking());
+        assert!(sleeper.join().unwrap() < Duration::from_secs(10), "woken, not timed out");
+        assert_eq!(cell.asks_so_far(), 1);
+        // An ask that came after `seen` was read ends the sleep before it starts.
+        let started = Instant::now();
+        cell.sleep_until_asked(0, Duration::from_secs(30));
+        assert!(started.elapsed() < Duration::from_secs(10));
+        // Nothing new: the sleep is the whole limit.
+        let started = Instant::now();
+        cell.sleep_until_asked(1, Duration::from_millis(200));
+        assert!(started.elapsed() >= Duration::from_millis(200));
+    }
+
+    #[test]
+    fn a_metered_cell_with_no_week_gives_a_first_lease_the_reading_when_it_lands() {
+        let cell = Arc::new(QuotaCell::new());
+        cell.attach_meter();
+        let feeder = {
+            let cell = cell.clone();
+            std::thread::spawn(move || {
+                std::thread::sleep(Duration::from_millis(200));
+                cell.observe([quota(WEEK, 60, 0)]);
+            })
+        };
+        let plan = cell.snapshot_with_week(Duration::from_secs(20));
+        feeder.join().unwrap();
+        assert_eq!(plan.windows.len(), 1, "the lease waited for the week");
+        assert_eq!(plan.windows[0].window, WEEK);
+    }
+
+    #[test]
+    fn the_wait_for_the_first_reading_is_bounded() {
+        let cell = Arc::new(QuotaCell::new());
+        cell.attach_meter();
+        let started = Instant::now();
+        let plan = cell.snapshot_with_week(Duration::from_millis(300));
+        let waited = started.elapsed();
+        assert!(plan.windows.is_empty(), "no reading came: unobserved, not hung");
+        assert!(waited >= Duration::from_millis(300), "{waited:?}");
+        assert!(waited < Duration::from_secs(10), "{waited:?}");
+    }
+
+    #[test]
+    fn a_cell_nobody_meters_or_that_holds_the_week_is_never_waited_on() {
+        let bare = QuotaCell::new();
+        let started = Instant::now();
+        assert!(bare.snapshot_with_week(Duration::from_secs(20)).windows.is_empty());
+        let held = QuotaCell::new();
+        held.attach_meter();
+        held.observe([quota(WEEK, 60, 0)]);
+        assert_eq!(held.snapshot_with_week(Duration::from_secs(20)).windows.len(), 1);
+        assert!(started.elapsed() < Duration::from_secs(5));
+    }
+
+    #[test]
+    fn a_week_past_its_reset_is_waited_on_like_no_week() {
+        let cell = QuotaCell::new();
+        cell.attach_meter();
+        let mut over = quota(WEEK, 60, 0);
+        over.resets_at_unix_ms = 1;
+        cell.observe([over]);
+        let started = Instant::now();
+        cell.snapshot_with_week(Duration::from_millis(300));
+        assert!(started.elapsed() >= Duration::from_millis(300));
+    }
 }
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
index c5e2e41..039ff75 100644
--- a/crates/claude-connector/src/stream.rs
+++ b/crates/claude-connector/src/stream.rs
@@ -7,7 +7,7 @@ use model_connector::{FailureKind, PlanQuota, StopReason, Usage};
 use serde::Deserialize;
 use serde_json::Value;
 
-use crate::quota::QuotaCell;
+use crate::quota::{PACED, QuotaCell};
 
 /// The tool the CLI gives the model to deliver an answer that must match a
 /// `--json-schema`. Its call is the structured output, not a tool exchange.
@@ -320,12 +320,16 @@ impl<'a> StreamState<'a> {
 /// `rate_limit_info.unifiedWindows`: utilization as a fraction of the window,
 /// reset as unix seconds. A window missing any of its three fields is skipped;
 /// an unknown reading is never zero.
+/// Only the windows pacing reads are taken ([`PACED`]): the event also names
+/// per-model buckets, and one of those reading `rejected` must not close every
+/// lease.
 fn plan_windows(info: &Value) -> Vec<PlanQuota> {
     let Some(windows) = info.get("unifiedWindows").and_then(Value::as_object) else {
         return Vec::new();
     };
     windows
         .iter()
+        .filter(|(window, _)| PACED.contains(&window.as_str()))
         .filter_map(|(window, reading)| {
             let utilization = reading.get("utilization")?.as_f64()?;
             let resets_at = reading.get("resetsAt")?.as_u64()?;
@@ -392,3 +396,50 @@ fn sum_usage(models: impl Iterator<Item = ModelUsage>) -> Usage {
     }
     usage
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn windows(body: &str) -> Vec<(String, Option<u32>, u64)> {
+        let info: Value = serde_json::from_str(&format!(r#"{{"unifiedWindows":{body}}}"#)).unwrap();
+        plan_windows(&info)
+            .into_iter()
+            .map(|q| (q.window, q.utilization_permille, q.resets_at_unix_ms))
+            .collect()
+    }
+
+    #[test]
+    fn only_the_five_hour_and_seven_day_windows_are_taken() {
+        let taken = windows(
+            r#"{"five_hour":{"utilization":0.5,"resetsAt":2,"status":"allowed"},
+                "seven_day":{"utilization":0.25,"resetsAt":3,"status":"allowed"},
+                "seven_day_opus":{"utilization":0.1,"resetsAt":4,"status":"allowed"},
+                "seven_day_overage_included":{"utilization":1,"resetsAt":5,"status":"rejected"}}"#,
+        );
+        assert_eq!(
+            taken,
+            vec![
+                ("five_hour".to_string(), Some(500), 2000),
+                ("seven_day".to_string(), Some(250), 3000),
+            ]
+        );
+    }
+
+    #[test]
+    fn a_window_missing_a_field_or_of_the_wrong_type_costs_only_itself() {
+        // Unknown is never zero: such a window is skipped, not read as empty.
+        for broken in [
+            r#"{"resetsAt":2,"status":"allowed"}"#,
+            r#"{"utilization":0.5,"status":"allowed"}"#,
+            r#"{"utilization":0.5,"resetsAt":2}"#,
+            r#"{"utilization":"high","resetsAt":2,"status":"allowed"}"#,
+            r#"{"utilization":-0.5,"resetsAt":2,"status":"allowed"}"#,
+        ] {
+            let both = windows(&format!(
+                r#"{{"five_hour":{broken},"seven_day":{{"utilization":0,"resetsAt":3,"status":"allowed"}}}}"#
+            ));
+            assert_eq!(both, vec![("seven_day".to_string(), Some(0), 3000)], "{broken}");
+        }
+    }
+}
diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs
deleted file mode 100644
index f5e4578..0000000
--- a/crates/claude-connector/src/usage_poll.rs
+++ /dev/null
@@ -1,1077 +0,0 @@
-//! The second sensor of the plan's usage windows. The CLI's `rate_limit_event`
-//! only arrives when the connector's own calls run, so while the swarm is
-//! quiet the weekly reading goes stale; this thread asks the subscription's
-//! usage endpoint when the `seven_day` reading is `STALE` or older, and
-//! records the answer in the same [`QuotaCell`] the stream feeds. Neither
-//! sensor owns the reading: the cell decides how a reading combines with the
-//! one it holds, and a poll is stamped with the moment it asked. A failed
-//! poll never touches the cell; only the cell's own reset rule retires a
-//! window.
-//!
-//! The endpoint is undocumented (the shape is the one Claude Code 2.1.312
-//! parses), so every answer it can give is handled and none is trusted to
-//! change the schedule beyond the rules below.
-
-use std::io::Read;
-use std::sync::Arc;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-use model_connector::PlanQuota;
-use serde_json::Value;
-use sha2::{Digest, Sha256};
-use zeroize::Zeroizing;
-
-use crate::backend::TokenSource;
-use crate::quota::{POLLED, QuotaCell};
-
-/// The usage endpoint.
-const ENDPOINT: &str = "https://api.anthropic.com/api/oauth/usage";
-/// A reading this old, or older, is stale; also the least gap between polls.
-const STALE: Duration = Duration::from_secs(15 * 60);
-/// The longest any backoff may wait.
-const CEILING: Duration = Duration::from_secs(6 * 60 * 60);
-const TIMEOUT: Duration = Duration::from_secs(10);
-/// A usage body is a few hundred bytes; this is a ceiling, not an expectation.
-const MAX_BODY: u64 = 1 << 20;
-
-/// What the endpoint said, reduced to what the schedule needs. It never holds
-/// the token.
-#[derive(Debug, PartialEq, Eq)]
-enum Answer {
-    Body(String),
-    Status(u16, Option<Duration>),
-    Unreachable,
-}
-
-/// Why the poller is waiting; logged once per change.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum State {
-    Polled,
-    NoToken,
-    RateLimited,
-    Refused,
-    NotFound,
-    Unreadable,
-    Unexpected,
-    Unreachable,
-}
-
-impl State {
-    fn line(self) -> &'static str {
-        match self {
-            Self::Polled => "usage poll: reading recorded",
-            Self::NoToken => "usage poll: no token to ask with",
-            Self::RateLimited => "usage poll: rate limited, waiting",
-            Self::Refused => {
-                "usage poll: refused (401/403), the token likely lacks the user:profile scope; not asking again until the token changes"
-            }
-            Self::NotFound => "usage poll: endpoint not found, backing off",
-            Self::Unreadable => "usage poll: answer not readable, backing off",
-            Self::Unexpected => "usage poll: unexpected status, retrying later",
-            Self::Unreachable => "usage poll: endpoint unreachable, retrying later",
-        }
-    }
-}
-
-#[derive(Debug, PartialEq)]
-struct Verdict {
-    windows: Vec<PlanQuota>,
-    /// How long until the next poll may happen.
-    wait: Duration,
-    state: State,
-}
-
-/// What one answer means: the windows to record (only a readable body has
-/// any), how long to wait, and the state to report.
-fn judge(answer: &Answer) -> Verdict {
-    let (windows, wait, state) = match answer {
-        Answer::Body(body) => match parse_usage(body) {
-            Some(windows) => (windows, STALE, State::Polled),
-            None => (Vec::new(), CEILING, State::Unreadable),
-        },
-        Answer::Status(429, retry_after) => (
-            Vec::new(),
-            retry_after.unwrap_or_default().clamp(STALE, CEILING),
-            State::RateLimited,
-        ),
-        Answer::Status(401 | 403, _) => (Vec::new(), STALE, State::Refused),
-        Answer::Status(404, _) => (Vec::new(), CEILING, State::NotFound),
-        Answer::Status(..) => (Vec::new(), STALE, State::Unexpected),
-        Answer::Unreachable => (Vec::new(), STALE, State::Unreachable),
-    };
-    Verdict {
-        windows,
-        wait,
-        state,
-    }
-}
-
-/// The plan windows a usage body reports: `five_hour` and `seven_day`, each
-/// `{utilization: percent 0-100, resets_at: ISO 8601}`. A window missing
-/// either field, or reporting nonsense, is skipped, and an unknown reading is
-/// never zero. Other keys are ignored. `None` when the body is not a JSON
-/// object at all.
-fn parse_usage(body: &str) -> Option<Vec<PlanQuota>> {
-    let usage: Value = serde_json::from_str(body).ok()?;
-    let usage = usage.as_object()?;
-    Some(
-        ["five_hour", "seven_day"]
-            .into_iter()
-            .filter_map(|window| {
-                let reading = usage.get(window)?;
-                let percent = reading.get("utilization")?.as_f64()?;
-                let resets_at = reading.get("resets_at")?.as_str()?;
-                if !percent.is_finite() || percent < 0.0 {
-                    return None;
-                }
-                let resets_at = chrono::DateTime::parse_from_rfc3339(resets_at).ok()?;
-                Some(PlanQuota {
-                    window: window.to_string(),
-                    // `as` saturates a float at the integer's bounds.
-                    utilization_permille: Some((percent * 10.0).round() as u32),
-                    resets_at_unix_ms: u64::try_from(resets_at.timestamp_millis()).ok()?,
-                    status: POLLED.to_string(),
-                    // Stamped by the cell that keeps it.
-                    observed_at_unix_ms: 0,
-                })
-            })
-            .collect(),
-    )
-}
-
-/// The blocking HTTPS client: 10 s end to end, no redirects (the token must
-/// not follow one anywhere).
-pub(crate) struct UsageClient {
-    agent: ureq::Agent,
-    url: String,
-    timeout: Duration,
-}
-
-impl UsageClient {
-    /// The client that asks the provider's usage endpoint.
-    pub(crate) fn production() -> Self {
-        Self::new(ENDPOINT)
-    }
-
-    /// A client for another endpoint: a test's fake server.
-    pub(crate) fn new(url: impl Into<String>) -> Self {
-        Self::with_timeout(url, TIMEOUT)
-    }
-
-    fn with_timeout(url: impl Into<String>, timeout: Duration) -> Self {
-        Self {
-            agent: ureq::AgentBuilder::new().redirects(0).build(),
-            url: url.into(),
-            timeout,
-        }
-    }
-
-    /// Asks the endpoint. Our copy of the header value is zeroized when it
-    /// drops; ureq copies it into its own request buffers, which are freed
-    /// without zeroing.
-    fn ask(&self, token: &Zeroizing<String>) -> Answer {
-        let bearer = Zeroizing::new(format!("Bearer {}", token.as_str()));
-        let sent = self
-            .agent
-            .get(&self.url)
-            .timeout(self.timeout)
-            .set("Authorization", bearer.as_str())
-            .set("anthropic-beta", "oauth-2025-04-20")
-            .call();
-        match sent {
-            Ok(response) if response.status() == 200 => {
-                let mut body = String::new();
-                match response
-                    .into_reader()
-                    .take(MAX_BODY)
-                    .read_to_string(&mut body)
-                {
-                    Ok(_) => Answer::Body(body),
-                    Err(_) => Answer::Unreachable,
-                }
-            }
-            Ok(response) => Answer::Status(response.status(), None),
-            Err(ureq::Error::Status(code, response)) => {
-                let retry_after = response
-                    .header("retry-after")
-                    .and_then(|value| retry_after(value, unix_ms()));
-                Answer::Status(code, retry_after)
-            }
-            Err(ureq::Error::Transport(_)) => Answer::Unreachable,
-        }
-    }
-}
-
-/// A `Retry-After` value as a wait from `now_ms`: delay-seconds, or an
-/// HTTP-date (RFC 9110 10.2.3, all three forms) measured from now, a date
-/// already past being a zero wait. `None` when it is neither.
-fn retry_after(value: &str, now_ms: u64) -> Option<Duration> {
-    let value = value.trim();
-    if let Ok(seconds) = value.parse::<u64>() {
-        return Some(Duration::from_secs(seconds));
-    }
-    let until = http_date_ms(value, now_ms)?;
-    Some(Duration::from_millis(until.saturating_sub(now_ms)))
-}
-
-/// An HTTP-date as Unix milliseconds: IMF-fixdate (RFC 2822 reads it), the
-/// obsolete RFC 850 form `Sunday, 06-Nov-94 08:49:37 GMT`, or asctime
-/// `Sun Nov  6 08:49:37 1994`. Weekday names are not checked.
-fn http_date_ms(value: &str, now_ms: u64) -> Option<u64> {
-    use chrono::Datelike;
-    if let Ok(date) = chrono::DateTime::parse_from_rfc2822(value) {
-        return u64::try_from(date.timestamp_millis()).ok();
-    }
-    let fields: Vec<&str> = value.split_whitespace().collect();
-    let (day, month, year, time) = match fields.as_slice() {
-        [weekday, date, time, "GMT"] if weekday.ends_with(',') => {
-            let mut parts = date.split('-');
-            let (day, month, year) = (parts.next()?, parts.next()?, parts.next()?);
-            if parts.next().is_some() || year.len() != 2 {
-                return None;
-            }
-            // A two-digit year more than 50 years ahead is the latest past
-            // year with those digits.
-            let now_year =
-                chrono::DateTime::from_timestamp_millis(i64::try_from(now_ms).ok()?)?.year();
-            let year = now_year - now_year.rem_euclid(100) + year.parse::<i32>().ok()?;
-            let year = if year > now_year + 50 {
-                year - 100
-            } else {
-                year
-            };
-            (day, month, year, *time)
-        }
-        [_, month, day, time, year] => (*day, *month, year.parse::<i32>().ok()?, *time),
-        _ => return None,
-    };
-    const MONTHS: [&str; 12] = [
-        "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
-    ];
-    let month = MONTHS
-        .iter()
-        .position(|name| name.eq_ignore_ascii_case(month))?;
-    let mut clock = time.split(':');
-    let (hour, minute, second) = (clock.next()?, clock.next()?, clock.next()?);
-    if clock.next().is_some() {
-        return None;
-    }
-    let moment =
-        chrono::NaiveDate::from_ymd_opt(year, u32::try_from(month + 1).ok()?, day.parse().ok()?)?
-            .and_hms_opt(
-            hour.parse().ok()?,
-            minute.parse().ok()?,
-            second.parse().ok()?,
-        )?;
-    u64::try_from(moment.and_utc().timestamp_millis()).ok()
-}
-
-/// The schedule and the thing it drives. Time comes in as an argument so the
-/// schedule is testable without waiting.
-struct Poller {
-    cell: Arc<QuotaCell>,
-    tokens: Box<dyn TokenSource>,
-    client: UsageClient,
-    log: Box<dyn FnMut(&str) + Send>,
-    /// No poll before this instant, unix ms: the last answer's own wait.
-    not_before_ms: u64,
-    started: bool,
-    /// The digest of the token the endpoint last refused: while the token
-    /// reads the same, the poller does not ask again.
-    refused_token: Option<[u8; 32]>,
-    last_state: Option<State>,
-}
-
-impl Poller {
-    fn new(
-        cell: Arc<QuotaCell>,
-        tokens: Box<dyn TokenSource>,
-        client: UsageClient,
-        log: Box<dyn FnMut(&str) + Send>,
-    ) -> Self {
-        Self {
-            cell,
-            tokens,
-            client,
-            log,
-            not_before_ms: 0,
-            started: false,
-            refused_token: None,
-            last_state: None,
-        }
-    }
-
-    /// Polls if a poll is due at `now_ms`; returns how long to wait before
-    /// asking again.
-    ///
-    /// The first call polls. After that a poll is due only when the cell's
-    /// `seven_day` observation is `STALE` old or older (or absent), and never
-    /// before the last answer's own wait has passed. A token the endpoint
-    /// refused is not sent again until it reads differently.
-    fn tick(&mut self, now_ms: u64) -> Duration {
-        let due_at = self.due_at_ms();
-        if now_ms < due_at {
-            return Duration::from_millis(due_at - now_ms);
-        }
-        self.started = true;
-        let token = self.tokens.read();
-        if let (Some(refused), Some(token)) = (&self.refused_token, &token)
-            && digest(token) != *refused
-        {
-            self.refused_token = None;
-        }
-        let verdict = match token {
-            _ if self.refused_token.is_some() => Verdict {
-                windows: Vec::new(),
-                wait: STALE,
-                state: State::Refused,
-            },
-            Some(token) => {
-                let verdict = judge(&self.client.ask(&token));
-                if verdict.state == State::Refused {
-                    self.refused_token = Some(digest(&token));
-                }
-                verdict
-            }
-            None => Verdict {
-                windows: Vec::new(),
-                wait: STALE,
-                state: State::NoToken,
-            },
-        };
-        // The reading is as old as the question: an answer that arrives after
-        // the stream spoke does not outrank it.
-        self.cell.observe_at(now_ms, verdict.windows);
-        if self.last_state != Some(verdict.state) {
-            (self.log)(verdict.state.line());
-            self.last_state = Some(verdict.state);
-        }
-        self.not_before_ms = now_ms.saturating_add(duration_ms(verdict.wait));
-        Duration::from_millis(self.due_at_ms().saturating_sub(now_ms))
-    }
-
-    /// The earliest instant the next poll may happen.
-    fn due_at_ms(&self) -> u64 {
-        if !self.started {
-            return 0;
-        }
-        let stale_at = self
-            .cell
-            .snapshot()
-            .windows
-            .iter()
-            .find(|quota| quota.window == "seven_day")
-            .map_or(0, |quota| {
-                quota.observed_at_unix_ms.saturating_add(duration_ms(STALE))
-            });
-        stale_at.max(self.not_before_ms)
-    }
-
-    fn run(mut self) {
-        loop {
-            let wait = self.tick(unix_ms());
-            std::thread::sleep(wait);
-        }
-    }
-}
-
-fn digest(token: &Zeroizing<String>) -> [u8; 32] {
-    Sha256::digest(token.as_bytes()).into()
-}
-
-fn duration_ms(duration: Duration) -> u64 {
-    u64::try_from(duration.as_millis()).unwrap_or(u64::MAX)
-}
-
-fn unix_ms() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map_or(0, duration_ms)
-}
-
-/// Starts the poll thread. It reads the token afresh at each poll, writes
-/// only to `cell`, and logs one line to stderr when its state changes.
-pub(crate) fn start(
-    cell: Arc<QuotaCell>,
-    tokens: Box<dyn TokenSource>,
-    client: UsageClient,
-) -> std::io::Result<std::thread::JoinHandle<()>> {
-    let poller = Poller::new(
-        cell,
-        tokens,
-        client,
-        Box::new(|line| eprintln!("claude-connector: {line}")),
-    );
-    std::thread::Builder::new()
-        .name("claude-usage-poll".to_string())
-        .spawn(move || poller.run())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-    use std::net::TcpListener;
-    use std::sync::Mutex;
-
-    const MIN: u64 = 60_000;
-    const CANARY: &str = "sk-ant-oat01-CANARY-must-never-surface";
-    const FAR: &str = "2100-01-01T00:00:00+00:00";
-    const FAR_MS: u64 = 4_102_444_800_000;
-
-    fn body(five: &str, seven: &str) -> String {
-        format!(
-            r#"{{"five_hour":{five},"seven_day":{seven},"seven_day_opus":null,"extra_usage":{{"x":1}}}}"#
-        )
-    }
-
-    fn reading(percent: f64) -> String {
-        format!(r#"{{"utilization":{percent},"resets_at":"{FAR}"}}"#)
-    }
-
-    fn secs(s: u64) -> Duration {
-        Duration::from_secs(s)
-    }
-
-    // ---- mapping ----
-
-    #[test]
-    fn usage_body_maps_percent_to_permille() {
-        let windows = parse_usage(&body(&reading(6.0), &reading(35.0))).unwrap();
-        let expect = |window: &str, permille| PlanQuota {
-            window: window.to_string(),
-            utilization_permille: Some(permille),
-            resets_at_unix_ms: FAR_MS,
-            status: "polled".to_string(),
-            observed_at_unix_ms: 0,
-        };
-        assert_eq!(
-            windows,
-            vec![expect("five_hour", 60), expect("seven_day", 350)]
-        );
-    }
-
-    #[test]
-    fn usage_percent_rounds_to_the_nearest_permille() {
-        let windows = parse_usage(&body(&reading(12.34), &reading(0.06))).unwrap();
-        assert_eq!(windows[0].utilization_permille, Some(123));
-        assert_eq!(windows[1].utilization_permille, Some(1));
-        let zero = parse_usage(&body(&reading(0.0), "null")).unwrap();
-        assert_eq!(zero[0].utilization_permille, Some(0), "a real zero stays");
-    }
-
-    #[test]
-    fn resets_at_is_parsed_with_its_offset_to_unix_ms() {
-        let seven = r#"{"utilization":1.0,"resets_at":"2026-11-07T12:30:15.250+02:00"}"#;
-        let windows = parse_usage(&body("null", seven)).unwrap();
-        // 2026-11-07T10:30:15.250Z
-        assert_eq!(windows[0].resets_at_unix_ms, 1_794_047_415_250);
-    }
-
-    #[test]
-    fn a_window_missing_a_field_or_reading_nonsense_is_skipped_not_zero() {
-        let no_percent = format!(r#"{{"utilization":null,"resets_at":"{FAR}"}}"#);
-        let no_reset = r#"{"utilization":50.0,"resets_at":null}"#;
-        assert_eq!(parse_usage(&body(&no_percent, no_reset)).unwrap(), vec![]);
-        let junk = r#"{"utilization":5.0,"resets_at":"soon"}"#;
-        assert_eq!(parse_usage(&body(&reading(-1.0), junk)).unwrap(), vec![]);
-        let before_epoch = r#"{"utilization":5.0,"resets_at":"1969-01-01T00:00:00Z"}"#;
-        assert_eq!(parse_usage(&body(before_epoch, "null")).unwrap(), vec![]);
-        // One good window survives its neighbour's null.
-        let one = parse_usage(&body(&no_percent, &reading(35.0))).unwrap();
-        assert_eq!(one.len(), 1);
-        assert_eq!(one[0].window, "seven_day");
-    }
-
-    #[test]
-    fn a_body_that_is_not_an_object_is_unreadable() {
-        for bad in ["", "not json", "[1,2]", "42", "null"] {
-            assert_eq!(parse_usage(bad), None, "{bad:?}");
-        }
-        assert_eq!(parse_usage("{}"), Some(vec![]));
-    }
-
-    // ---- judgement ----
-
-    fn wait_of(answer: &Answer) -> Duration {
-        judge(answer).wait
-    }
-
-    #[test]
-    fn rate_limit_waits_the_longer_of_retry_after_and_the_floor_capped() {
-        let limited = |after| wait_of(&Answer::Status(429, after));
-        assert_eq!(limited(Some(secs(3600))), secs(3600));
-        assert_eq!(limited(Some(secs(20 * 60))), secs(20 * 60));
-        assert_eq!(limited(Some(secs(10))), STALE);
-        assert_eq!(limited(None), STALE);
-        assert_eq!(limited(Some(secs(100_000))), CEILING);
-        assert_eq!(limited(Some(secs(6 * 3600))), CEILING);
-        assert_eq!(judge(&Answer::Status(429, None)).state, State::RateLimited);
-    }
-
-    #[test]
-    fn refusal_backs_off_like_the_rest() {
-        assert_eq!(wait_of(&Answer::Status(401, None)), STALE);
-        assert_eq!(wait_of(&Answer::Status(403, Some(secs(5)))), STALE);
-        assert_eq!(judge(&Answer::Status(403, None)).state, State::Refused);
-        assert_eq!(wait_of(&Answer::Status(404, None)), CEILING);
-        assert_eq!(wait_of(&Answer::Body("<html>".to_string())), CEILING);
-        assert_eq!(wait_of(&Answer::Unreachable), STALE);
-        assert_eq!(wait_of(&Answer::Status(503, None)), STALE);
-        assert_eq!(wait_of(&Answer::Body(body(&reading(1.0), "null"))), STALE);
-    }
-
-    // ---- a fake server, a poller, and the cell ----
-
-    /// Serves each canned reply to one connection in turn and remembers the
-    /// requests.
-    fn serve(replies: Vec<String>) -> (String, Arc<Mutex<Vec<String>>>) {
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap());
-        let seen = Arc::new(Mutex::new(Vec::new()));
-        let record = seen.clone();
-        std::thread::spawn(move || {
-            for reply in replies {
-                let Ok((mut stream, _)) = listener.accept() else {
-                    return;
-                };
-                let mut request = vec![0u8; 4096];
-                let n = stream.read(&mut request).unwrap_or(0);
-                record
-                    .lock()
-                    .unwrap()
-                    .push(String::from_utf8_lossy(&request[..n]).into_owned());
-                let _ = stream.write_all(reply.as_bytes());
-            }
-        });
-        (url, seen)
-    }
-
-    fn http(status: &str, headers: &str, body: &str) -> String {
-        format!(
-            "HTTP/1.1 {status}\r\n{headers}Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
-            body.len()
-        )
-    }
-
-    struct Fixed(Option<&'static str>);
-    impl TokenSource for Fixed {
-        fn read(&self) -> Option<Zeroizing<String>> {
-            self.0.map(|t| Zeroizing::new(t.to_string()))
-        }
-    }
-
-    type Lines = Arc<Mutex<Vec<String>>>;
-
-    fn make_poller(
-        cell: &Arc<QuotaCell>,
-        url: &str,
-        token: Option<&'static str>,
-    ) -> (Poller, Lines) {
-        let lines = Arc::new(Mutex::new(Vec::new()));
-        let sink = lines.clone();
-        let poller = Poller::new(
-            cell.clone(),
-            Box::new(Fixed(token)),
-            UsageClient::new(url),
-            Box::new(move |line| sink.lock().unwrap().push(line.to_string())),
-        );
-        (poller, lines)
-    }
-
-    fn window(cell: &QuotaCell, name: &str) -> Option<PlanQuota> {
-        cell.snapshot()
-            .windows
-            .into_iter()
-            .find(|q| q.window == name)
-    }
-
-    fn stream_reading(window: &str, permille: u32) -> PlanQuota {
-        PlanQuota {
-            window: window.to_string(),
-            utilization_permille: Some(permille),
-            resets_at_unix_ms: FAR_MS,
-            status: "allowed".to_string(),
-            observed_at_unix_ms: 0,
-        }
-    }
-
-    fn requests(seen: &Arc<Mutex<Vec<String>>>) -> usize {
-        seen.lock().unwrap().len()
-    }
-
-    #[test]
-    fn the_first_tick_polls_and_records_what_the_endpoint_said() {
-        let (url, seen) = serve(vec![http(
-            "200 OK",
-            "Content-Type: application/json\r\n",
-            &body(&reading(6.0), &reading(35.0)),
-        )]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        let wait = poller.tick(unix_ms());
-        let windows = cell.snapshot().windows;
-        assert_eq!(windows.len(), 2);
-        assert_eq!(windows[0].status, "polled");
-        assert_eq!(windows[1].utilization_permille, Some(350));
-        assert!(
-            (STALE..STALE + secs(5)).contains(&wait),
-            "a fresh reading waits until it is stale: {wait:?}"
-        );
-        let request = seen.lock().unwrap()[0].to_lowercase();
-        assert!(request.contains(&format!("authorization: bearer {}", CANARY.to_lowercase())));
-        assert!(request.contains("anthropic-beta: oauth-2025-04-20"));
-        assert_eq!(lines.lock().unwrap().len(), 1);
-    }
-
-    #[test]
-    fn stale_only_polls() {
-        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 3]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms());
-        assert_eq!(requests(&seen), 1, "the startup poll");
-        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
-
-        // 5 min old: no request, and the wait is the time left.
-        let wait = poller.tick(observed + 5 * MIN);
-        assert_eq!(requests(&seen), 1);
-        assert_eq!(wait, Duration::from_millis(10 * MIN));
-        // One millisecond short of 15 min: still none.
-        poller.tick(observed + 15 * MIN - 1);
-        assert_eq!(requests(&seen), 1);
-        // 16 min old: one request.
-        poller.tick(observed + 16 * MIN);
-        assert_eq!(requests(&seen), 2);
-        // That poll's answer holds its own 15 min, whatever the stamp says.
-        poller.tick(observed + 16 * MIN + 1);
-        assert_eq!(requests(&seen), 2);
-    }
-
-    #[test]
-    fn a_reading_is_stale_at_exactly_fifteen_minutes() {
-        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 2]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms());
-        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
-        poller.tick(observed + 15 * MIN);
-        assert_eq!(requests(&seen), 2);
-    }
-
-    #[test]
-    fn a_stream_observation_keeps_the_poll_quiet() {
-        let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms());
-        std::thread::sleep(Duration::from_millis(20));
-        // The stream reports seven_day afresh, after the poll.
-        cell.observe([stream_reading("seven_day", 400)]);
-        let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms;
-        let wait = poller.tick(observed + 14 * MIN);
-        assert_eq!(requests(&seen), 1);
-        assert_eq!(wait, Duration::from_millis(MIN));
-    }
-
-    #[test]
-    fn failures_never_touch_the_cell() {
-        let limited = |headers: &str| http("429 Too Many Requests", headers, "{}");
-        let cases = [
-            (limited("Retry-After: 3600\r\n"), 60),
-            (limited(""), 15),
-            (
-                limited("Retry-After: Wed, 21 Oct 2026 07:28:00 GMT\r\n"),
-                15,
-            ),
-            (
-                limited("Retry-After: Fri, 31 Dec 2100 23:59:59 GMT\r\n"),
-                360,
-            ),
-            (http("403 Forbidden", "", "{}"), 15),
-            (http("401 Unauthorized", "", "{}"), 15),
-            (http("404 Not Found", "", "{}"), 360),
-            (http("200 OK", "", "<html>not json</html>"), 360),
-            (
-                http("302 Found", "Location: http://127.0.0.1:9/\r\n", ""),
-                15,
-            ),
-        ];
-        for (reply, minutes) in cases {
-            let (url, _) = serve(vec![reply.clone()]);
-            let cell = Arc::new(QuotaCell::new());
-            cell.observe([
-                stream_reading("five_hour", 120),
-                stream_reading("seven_day", 300),
-            ]);
-            let before = cell.snapshot();
-            let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-            let wait = poller.tick(unix_ms());
-            assert_eq!(cell.snapshot(), before, "{reply}");
-            assert_eq!(wait.as_secs() / 60, minutes, "{reply}");
-            assert_eq!(lines.lock().unwrap().len(), 1, "{reply}");
-        }
-    }
-
-    #[test]
-    fn an_unreachable_endpoint_waits_the_floor_and_a_missing_token_never_asks() {
-        // Nothing listens here: bind, learn the port, drop.
-        let port = TcpListener::bind("127.0.0.1:0")
-            .unwrap()
-            .local_addr()
-            .unwrap()
-            .port();
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) =
-            make_poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY));
-        assert_eq!(poller.tick(unix_ms()), STALE);
-        assert!(cell.snapshot().windows.is_empty());
-        assert_eq!(lines.lock().unwrap().len(), 1);
-
-        let (url, seen) = serve(vec![http("200 OK", "", "{}")]);
-        let (mut poller, lines) = make_poller(&cell, &url, None);
-        assert_eq!(poller.tick(unix_ms()), STALE);
-        assert_eq!(requests(&seen), 0);
-        assert_eq!(lines.lock().unwrap()[0], State::NoToken.line());
-    }
-
-    #[test]
-    fn a_state_is_logged_once_until_it_changes() {
-        let limited = http("429 Too Many Requests", "", "{}");
-        let (url, _) = serve(vec![
-            limited.clone(),
-            limited,
-            http("200 OK", "", &body("null", &reading(35.0))),
-        ]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        let t = unix_ms();
-        poller.tick(t);
-        poller.tick(t + 16 * MIN);
-        assert_eq!(lines.lock().unwrap().len(), 1, "same state, one line");
-        poller.tick(t + 32 * MIN);
-        let lines = lines.lock().unwrap();
-        assert_eq!(lines.len(), 2);
-        assert_eq!(lines[1], State::Polled.line());
-    }
-
-    #[test]
-    fn nothing_logged_or_stored_holds_the_token() {
-        let echo = format!(r#"{{"echo":"{CANARY}"}}"#);
-        let (url, _) = serve(vec![
-            http("429 Too Many Requests", "Retry-After: 60\r\n", &echo),
-            http(
-                "200 OK",
-                "",
-                &format!(r#"{{"five_hour":{},"note":"{CANARY}"}}"#, reading(1.0)),
-            ),
-            http("403 Forbidden", "", CANARY),
-        ]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        let t = unix_ms();
-        poller.tick(t);
-        poller.tick(t + 16 * MIN);
-        poller.tick(t + 32 * MIN);
-        let lines = lines.lock().unwrap();
-        assert_eq!(lines.len(), 3, "one line per change of state");
-        let seen = format!("{lines:?} {:?}", cell.snapshot());
-        assert!(!seen.contains("CANARY"), "{seen}");
-    }
-
-    #[test]
-    fn stream_and_poll_share_one_cell() {
-        let (url, _) = serve(vec![http(
-            "200 OK",
-            "",
-            &body(&reading(6.0), &reading(35.0)),
-        )]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms());
-        assert_eq!(window(&cell, "five_hour").unwrap().status, "polled");
-        // A later stream reading of one window replaces the poll's; the other
-        // window keeps the poll's.
-        cell.observe([stream_reading("five_hour", 90)]);
-        let five = window(&cell, "five_hour").unwrap();
-        assert_eq!(
-            (five.status.as_str(), five.utilization_permille),
-            ("allowed", Some(90))
-        );
-        assert_eq!(window(&cell, "seven_day").unwrap().status, "polled");
-        // And a later poll replaces the stream's.
-        let (url, _) = serve(vec![http("200 OK", "", &body(&reading(7.0), "null"))]);
-        let (mut again, _) = make_poller(&cell, &url, Some(CANARY));
-        again.tick(unix_ms());
-        assert_eq!(
-            window(&cell, "five_hour").unwrap().utilization_permille,
-            Some(70)
-        );
-    }
-
-    /// A token the test can rotate.
-    struct Rotating(Arc<Mutex<Option<String>>>);
-    impl TokenSource for Rotating {
-        fn read(&self) -> Option<Zeroizing<String>> {
-            self.0.lock().unwrap().clone().map(Zeroizing::new)
-        }
-    }
-
-    #[test]
-    fn a_refused_token_is_not_sent_again_until_it_changes() {
-        let (url, seen) = serve(vec![
-            http("403 Forbidden", "", "{}"),
-            http("200 OK", "", &body("null", &reading(35.0))),
-        ]);
-        let token = Arc::new(Mutex::new(Some("first".to_string())));
-        let lines = Arc::new(Mutex::new(Vec::new()));
-        let sink = lines.clone();
-        let cell = Arc::new(QuotaCell::new());
-        let mut poller = Poller::new(
-            cell.clone(),
-            Box::new(Rotating(token.clone())),
-            UsageClient::new(&url),
-            Box::new(move |line| sink.lock().unwrap().push(line.to_string())),
-        );
-        let t = unix_ms();
-        poller.tick(t);
-        assert_eq!(requests(&seen), 1);
-        assert!(lines.lock().unwrap()[0].contains("user:profile"));
-        // The same token, a quarter hour on and again: the endpoint is not asked.
-        assert_eq!(poller.tick(t + 16 * MIN), STALE);
-        poller.tick(t + 32 * MIN);
-        assert_eq!(requests(&seen), 1);
-        assert_eq!(lines.lock().unwrap().len(), 1, "one state, one line");
-        // A credential that vanishes does not count as a new one.
-        *token.lock().unwrap() = None;
-        poller.tick(t + 48 * MIN);
-        assert_eq!(requests(&seen), 1);
-        // A rotated credential is tried at the next due time.
-        *token.lock().unwrap() = Some("second".to_string());
-        poller.tick(t + 64 * MIN);
-        assert_eq!(requests(&seen), 2);
-        assert!(window(&cell, "seven_day").is_some());
-        assert_eq!(lines.lock().unwrap()[1], State::Polled.line());
-    }
-
-    /// 2026-11-01 07:28:00 UTC, a Sunday.
-    fn sunday_morning_ms() -> u64 {
-        chrono::NaiveDate::from_ymd_opt(2026, 11, 1)
-            .unwrap()
-            .and_hms_opt(7, 28, 0)
-            .unwrap()
-            .and_utc()
-            .timestamp_millis() as u64
-    }
-
-    #[test]
-    fn retry_after_reads_all_three_http_date_forms() {
-        let now = sunday_morning_ms();
-        for form in [
-            "Sun, 01 Nov 2026 08:28:00 GMT",
-            "Sunday, 01-Nov-26 08:28:00 GMT",
-            "Sun Nov  1 08:28:00 2026",
-            "Sun Nov 1 08:28:00 2026",
-        ] {
-            assert_eq!(retry_after(form, now), Some(secs(3600)), "{form}");
-        }
-    }
-
-    #[test]
-    fn a_two_digit_year_more_than_fifty_years_ahead_is_the_past() {
-        let now = sunday_morning_ms();
-        let on = |yy: &str| retry_after(&format!("Friday, 01-Jan-{yy} 00:00:00 GMT"), now);
-        assert!(on("76").unwrap() > Duration::ZERO, "2076 is 50 years ahead");
-        assert_eq!(on("77"), Some(Duration::ZERO), "1977, not 2077");
-        assert!(on("33").unwrap() > Duration::ZERO, "2033");
-        assert_eq!(on("94"), Some(Duration::ZERO), "1994");
-    }
-
-    #[test]
-    fn retry_after_reads_seconds_and_http_dates() {
-        const DATE: &str = "Wed, 21 Oct 2026 07:28:00 GMT";
-        let at = chrono::DateTime::parse_from_rfc2822(DATE)
-            .unwrap()
-            .timestamp_millis() as u64;
-        let three_hours = 3 * 3600 * 1000;
-        assert_eq!(retry_after(DATE, at - three_hours), Some(secs(3 * 3600)));
-        assert_eq!(retry_after(DATE, at), Some(Duration::ZERO));
-        assert_eq!(retry_after(DATE, at + 1), Some(Duration::ZERO), "past");
-        assert_eq!(retry_after("3600", at), Some(secs(3600)));
-        assert_eq!(retry_after(" 3600 ", at), Some(secs(3600)));
-        for bad in [
-            "",
-            "soon",
-            "-5",
-            "3600.5",
-            "1, 2",
-            "Wed, 21 Oct 2026",
-            "Wednesday, 21-Oct-26-1 07:28:00 GMT",
-            "Wednesday, 21-Oct-2026 07:28:00 GMT",
-            "Wednesday, 21-Foo-26 07:28:00 GMT",
-            "Wednesday 21-Oct-26 07:28:00 GMT",
-            "Wednesday, 21-Oct-26 07:28 GMT",
-            "Wed Oct 21 07:28:00:01 2026",
-            "Wed Oct 32 07:28:00 2026",
-            "Wed Oct 21 25:28:00 2026",
-        ] {
-            assert_eq!(retry_after(bad, at), None, "{bad:?}");
-        }
-    }
-
-    #[test]
-    fn keys_beyond_the_two_plan_windows_are_not_windows() {
-        let populated = reading(77.0);
-        let body = format!(
-            r#"{{"five_hour":{},"seven_day":{},"seven_day_opus":{populated},"seven_day_sonnet":{populated},"extra_usage":{populated}}}"#,
-            reading(6.0),
-            reading(35.0)
-        );
-        let names: Vec<_> = parse_usage(&body)
-            .unwrap()
-            .into_iter()
-            .map(|quota| quota.window)
-            .collect();
-        assert_eq!(names, ["five_hour", "seven_day"]);
-    }
-
-    #[test]
-    fn a_redirect_is_not_followed_with_the_token() {
-        let (target, target_seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]);
-        let (url, _) = serve(vec![http(
-            "302 Found",
-            &format!("Location: {target}\r\n"),
-            "",
-        )]);
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms());
-        assert_eq!(requests(&target_seen), 0, "the redirect target was asked");
-        assert!(cell.snapshot().windows.is_empty());
-        assert_eq!(lines.lock().unwrap()[0], State::Unexpected.line());
-    }
-
-    #[test]
-    fn a_silent_endpoint_frees_the_poll_at_its_timeout() {
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/u", listener.local_addr().unwrap());
-        let holder = std::thread::spawn(move || {
-            // Accept, say nothing, keep the connection open.
-            let held = listener.accept();
-            std::thread::sleep(Duration::from_secs(3));
-            drop(held);
-        });
-        let started = std::time::Instant::now();
-        let answer = UsageClient::with_timeout(url, Duration::from_millis(300))
-            .ask(&Zeroizing::new(CANARY.to_string()));
-        assert_eq!(answer, Answer::Unreachable);
-        assert!(started.elapsed() < Duration::from_secs(2));
-        holder.join().unwrap();
-    }
-
-    #[test]
-    fn the_production_client_asks_the_provider_and_gives_up_after_ten_seconds() {
-        let client = UsageClient::production();
-        assert_eq!(client.url, "https://api.anthropic.com/api/oauth/usage");
-        assert_eq!(client.timeout, secs(10));
-        assert_eq!(TIMEOUT, secs(10));
-    }
-
-    /// Answers one connection after `delay`, as a slow endpoint does.
-    fn serve_slowly(delay: Duration, reply: String) -> String {
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap());
-        std::thread::spawn(move || {
-            let Ok((mut stream, _)) = listener.accept() else {
-                return;
-            };
-            let mut request = vec![0u8; 4096];
-            let _ = stream.read(&mut request);
-            std::thread::sleep(delay);
-            let _ = stream.write_all(reply.as_bytes());
-        });
-        url
-    }
-
-    fn stream_event(window: &str, permille: u32, status: &str) -> PlanQuota {
-        PlanQuota {
-            status: status.to_string(),
-            ..stream_reading(window, permille)
-        }
-    }
-
-    /// The stream speaks while a poll is in flight; the poll then answers
-    /// with a reading older than the stream's. Returns the cell after both.
-    fn stream_speaks_while_the_poll_is_in_flight(status: &str) -> Arc<QuotaCell> {
-        let url = serve_slowly(
-            Duration::from_millis(500),
-            http("200 OK", "", &body(&reading(50.0), &reading(35.0))),
-        );
-        let cell = Arc::new(QuotaCell::new());
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        std::thread::scope(|scope| {
-            let polling = scope.spawn(|| poller.tick(unix_ms()));
-            std::thread::sleep(Duration::from_millis(150));
-            cell.observe([stream_event("five_hour", 1000, status)]);
-            polling.join().unwrap();
-        });
-        cell
-    }
-
-    #[test]
-    fn a_poll_answered_late_does_not_replace_what_the_stream_saw_meanwhile() {
-        let cell = stream_speaks_while_the_poll_is_in_flight("allowed");
-        let five = window(&cell, "five_hour").unwrap();
-        assert_eq!(
-            (five.status.as_str(), five.utilization_permille),
-            ("allowed", Some(1000))
-        );
-        let seven = window(&cell, "seven_day").unwrap();
-        assert_eq!(
-            (seven.status.as_str(), seven.utilization_permille),
-            ("polled", Some(350)),
-            "the window the stream did not name takes the poll's reading"
-        );
-    }
-
-    #[test]
-    fn a_slow_poll_cannot_lift_the_rejection_the_stream_reported_meanwhile() {
-        let cell = stream_speaks_while_the_poll_is_in_flight("rejected");
-        let five = window(&cell, "five_hour").unwrap();
-        assert_eq!(
-            (five.status.as_str(), five.utilization_permille),
-            ("rejected", Some(1000))
-        );
-    }
-
-    #[test]
-    fn a_later_poll_does_not_lift_a_rejection_the_provider_reported_earlier() {
-        let (url, _) = serve(vec![http("200 OK", "", &body(&reading(50.0), "null"))]);
-        let cell = Arc::new(QuotaCell::new());
-        cell.observe([stream_event("five_hour", 1000, "rejected")]);
-        let (mut poller, _) = make_poller(&cell, &url, Some(CANARY));
-        poller.tick(unix_ms() + MIN);
-        let five = window(&cell, "five_hour").unwrap();
-        assert_eq!(
-            (five.status.as_str(), five.utilization_permille),
-            ("rejected", Some(1000))
-        );
-    }
-
-    #[test]
-    fn every_state_has_its_own_line() {
-        let states = [
-            State::Polled,
-            State::NoToken,
-            State::RateLimited,
-            State::Refused,
-            State::NotFound,
-            State::Unreadable,
-            State::Unexpected,
-            State::Unreachable,
-        ];
-        let lines: std::collections::BTreeSet<_> = states.iter().map(|s| s.line()).collect();
-        assert_eq!(lines.len(), states.len());
-        assert!(lines.iter().all(|line| line.starts_with("usage poll: ")));
-    }
-}
diff --git a/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl b/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl
new file mode 100644
index 0000000..f7238e1
--- /dev/null
+++ b/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl
@@ -0,0 +1,4 @@
+{"type":"system","subtype":"init","cwd":"/tmp/meter-probe.Ye68uq/work","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","tools":[],"mcp_servers":[],"model":"claude-haiku-5-5","permissionMode":"bypassPermissions","slash_commands":[],"apiKeySource":"none","claude_code_version":"2.1.312","output_style":"default","agents":["claude","Explore","general-purpose","Plan","statusline-setup"],"skills":[],"plugins":[{"name":"cc-plugin-sec-default","path":"builtin","source":"cc-plugin-sec-default@builtin"},{"name":"cc-plugin-agents-md","path":"builtin","source":"cc-plugin-agents-md@builtin"},{"name":"cc-plugin-telemetry","path":"builtin","source":"cc-plugin-telemetry@builtin"},{"name":"cc-plugin-plugin-authoring","path":"builtin","source":"cc-plugin-plugin-authoring@builtin"}],"capabilities":["interrupt_receipt_v1","interrupt_cancel_queued_v1","interrupt_send_now_v1","interrupt_requeue_taken_v1","msg_lifecycle_v1","request_marker_lists_v1","ask_user_question_unanswered_v1","lifecycle_wakeup_source_v1","sdk_mcp_tools_list_changed","sdk_mcp_manifests","mcp_read_resource_v1","mcp_tool_ui_meta_v1","ui_surface_v1","mcp_call_result_not_for_model_v1"],"analytics_disabled":false,"product_feedback_disabled":false,"uuid":"8ad7f8d7-2831-43f2-a221-8af6323dcbd9","memory_paths":{"auto":"/tmp/meter-probe.Ye68uq/home/projects/-tmp-meter-probe-Ye68uq-work/memory/"},"original_cwd":"/tmp/meter-probe.Ye68uq/work","additional_directories":[],"messaging_socket_path":"/tmp/cc-socks/2838104.sock","fast_mode_state":"off","fast_mode_disabled_reason":"sdk_opt_in_required","per_turn_effort_active":true,"view_mode":"default"}
+{"type":"assistant","message":{"model":"claude-haiku-5-5","id":"msg_011Cgfu1sQvRAVmjwWNHc58s","type":"message","role":"assistant","content":[{"type":"text","text":"ok"}],"container":null,"stop_reason":null,"stop_sequence":null,"stop_details":null,"usage":{"input_tokens":384,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":4,"service_tier":"standard","inference_geo":"global","speed":"standard"},"input_transformations":[],"diagnostics":null,"context_management":null},"parent_tool_use_id":null,"session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","uuid":"f80db687-b098-415c-ac44-51c40a6cb63a","timestamp":"2026-11-03T11:14:35.024Z","request_id":"req_011Cgfu1sCXBsDrfz8a1LoMd"}
+{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1794261600,"rateLimitType":"seven_day","overageStatus":"rejected","overageDisabledReason":"org_level_disabled","isUsingOverage":false,"unifiedWindows":{"seven_day":{"utilization":0.06,"resetsAt":1794261600,"status":"allowed"}}},"uuid":"acb3b364-a218-4965-b967-f73028254f8b","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01"}
+{"duration_api_ms":995,"stop_reason":"end_turn","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","total_cost_usd":0.000040400000000000006,"usage":{"input_tokens":384,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":4,"output_tokens_details":{"thinking_tokens":0},"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"global","iterations":[{"input_tokens":384,"output_tokens":4,"cache_read_input_tokens":0,"cache_creation_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"type":"message"}],"speed":"standard","fallback_credit":null},"modelUsage":{"claude-haiku-5-5":{"inputTokens":384,"outputTokens":4,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000040400000000000006,"contextWindow":1000000,"maxOutputTokens":128000,"thinkingTokens":0,"cacheCreationEphemeral5mInputTokens":0,"cacheCreationEphemeral1hInputTokens":0,"canonicalModel":"claude-haiku-5-5","provider":"firstParty","costBasis":"list"}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","fast_mode_disabled_reason":"sdk_opt_in_required","subagent_stats":{"spawned":0,"requested":{"background":0,"foreground":0,"unset":0},"started_in_background":0,"max_depth":0,"spawned_by_subagents":0,"completed":0,"failed":0,"killed":{"parent":0,"user":0,"system":0},"refused":{"depth_limit":0,"concurrency_limit":0,"budget":0},"by_type":{}},"safety_stops":0,"is_error":false,"num_turns":1,"subtype":"success","api_error_status":null,"result":"ok","ttft_ms":1210,"type":"result","duration_ms":1228,"uuid":"d0b1b31b-1428-45aa-b90e-d35903c9b91b","ttft_stream_ms":1209,"time_to_request_ms":232,"first_content_frame_ms":1209,"queued_turn_count":0,"result_index":0,"model_usage_since_last_result":{"claude-haiku-5-5":{"inputTokens":384,"outputTokens":4,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000040400000000000006,"contextWindow":1000000,"maxOutputTokens":128000,"thinkingTokens":0,"cacheCreationEphemeral5mInputTokens":0,"cacheCreationEphemeral1hInputTokens":0,"canonicalModel":"claude-haiku-5-5","provider":"firstParty","costBasis":"list"}}}