Reproduction harness (vitest, mock provider, no network): a Provider wrapping MockProvider('ok') that overrides the named field, run via test/helpers.ts cli(home, ['run','--seat','9001','--job',J,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], {provider}) after readySeat(home,'9001',CAP).

CAP='5'.

The receipt override is {state:'reserved', settled_spend:0}.

Expected: cap_charge 0.18 (the padded quote; spend is unresolved).

Actual: exit 0, result cap_charge 0, quote_padded 0.18, spentToday === 0.

Fix: treat settled_spend as known only when the receipt state is 'settled' or 'released'.

Reproduction harness (vitest, mock provider, no network): a Provider wrapping MockProvider('ok') that overrides the named field, run via test/helpers.ts cli(home, ['run','--seat','9001','--job',J,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], {provider}) after readySeat(home,'9001',CAP).

CAP='5'.

The receipt override is {request_id:'mock-9001-0000000000000000', state:'settled', settled_spend:0}.

Expected: the receipt is treated as unknown for this call, so cap_charge stays 0.18 and match is 'mismatch'.

Actual: the result request_id is mock-9001- but receipt.request_id is mock-9001-0000000000000000; cap_charge 0, receipt.match {match:'matches'}, spentToday 0.

Fix: when r.request_id !== requestId, treat the receipt as absent or unknown (settled null) and flag a mismatch.

Reproduction harness (vitest, mock provider, no network): a Provider wrapping MockProvider('ok') that overrides the named field, run via test/helpers.ts cli(home, ['run','--seat','9001','--job',J,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], {provider}) after readySeat(home,'9001',CAP).

CAP='5'.

The overrides are usage: undefined and receipt {state:'settled', settled_spend:0.1}.

Expected: exit 0, ledger final row state settled with cap_charge 0.1 (cost_reported null).

Actual: exit 1, stderr "imd-flop: Cannot read properties of undefined (reading 'cost_flop')", and the ledger holds only [sent, 0.18, spend null].

Fix: use res.usage?.cost_flop.

Reproduction harness (vitest, mock provider, no network): a Provider wrapping MockProvider('ok') that overrides the named field, run via test/helpers.ts cli(home, ['run','--seat','9001','--job',J,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], {provider}) after readySeat(home,'9001',CAP).

CAP='5'.

The text override is 'key: ' + 'ab'.repeat(64). scanForSecrets({text:'ab'.repeat(64)}) returns [], while scanForSecrets({text:'ab'.repeat(32)}) returns 1 finding.

Expected: text withheld (printed text null, withheld 'secret scan blocked...').

Actual: exit 0, stdout contains the full 128-hex value, and so does the response file.

Fix: flag any hex run of 64 or more characters (e.g. /(?:0x)?[0-9a-fA-F]{64,}/).

Observed on efd47f3: mock receipt patched to { request_id: 'someone-elses-request', correlation_id: 'imd-job-other', state: 'settled', settled_spend: 0 } for a run with --job foreign: exit 0, printed receipt.match.match 'mismatch', last ledger line cap_charge 0 (expected 0.18 = quote_padded), spend 0.

import { join } from 'node:path'; import { expect, it } from 'vitest'; import { MockProvider, type Provider, type CompleteReq } from '../src/providers.js'; import { cliP, readLines, readySeat, tmpHome } from './helpers.js';

class P implements Provider { readonly name = 'mock' as const; calls = 0; inner = new MockProvider('ok');

estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

complete(r: CompleteReq) { this.calls++; return this.inner.complete(r); }

async readReceipt(id: string) { const rr = await this.inner.readReceipt(id); return { ...rr, receipt: { ...rr.receipt!, request_id: 'someone-elses-request', correlation_id: 'imd-job-other', state: 'settled' as const, settled_spend: 0 } }; } }

it('foreign receipt is not a settlement', async () => {

const h = tmpHome(); await readySeat(h, '42', '5');

const r = await cliP(h, ['run','--seat','42','--job','foreign','--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], new P());

expect(r.json().receipt.match.match).toBe('mismatch'); // passes

const last = readLines(join(h, 'ledger.jsonl')).at(-1);

expect(last.cap_charge).toBe(last.quote_padded); // FAILS: 0 vs 0.18

});

Observed on efd47f3: daily cap 0.2, one normal run (0.18 charged), then one appended JSON line copied from the last entry with request_id 'mock-42-ffffffffffffffff' and the cap_charge key removed. spentToday returns NaN; four further runs all exit 0 (expected 3, REFUSED_CAP, since 0.18 of 0.2 was already reserved); status --json shows today_utc.mock null with cap {daily:0.2, perCall:0.2}. Variant: set cap_charge to null on the last line → spentToday 0 and the next run exits 0.

import { writeFileSync } from 'node:fs'; import { join } from 'node:path'; import { expect, it } from 'vitest'; import { spentToday } from '../src/ledger.js'; import { cli, readLines, readySeat, tmpHome } from './helpers.js';

const RUN = (j: string) => ['run','--seat','42','--job',j,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'];

it('ledger total is validated', async () => {

const h = tmpHome(); await readySeat(h, '42', '0.2'); expect((await cli(h, RUN('ok-1'))).code).toBe(0);

const path = join(h, 'ledger.jsonl'); const rows = readLines(path); const last = rows.at(-1);

writeFileSync(path, rows.map((e) => JSON.stringify(e)).join('\n') + '\n' + JSON.stringify({ ...last, request_id: 'mock-42-ffffffffffffffff', cap_charge: undefined }) + '\n');

expect(Number.isFinite(spentToday(h, '42', 'mock'))).toBe(true); // FAILS: NaN

expect((await cli(h, RUN('after'))).code).toBe(3); // FAILS: 0

});

Observed on efd47f3 with a mock whose complete() returns usage { ...normal, api_key: 'not-a-real-key' } and benign text: exit code 5, stderr imd-flop: secret scan blocked writing response: usage.api_key: secret-named field "api_key", empty stdout, responses/ and receipts/ directories absent, ledger contains only {state:'sent', cap_charge:0.18, spend:null}, and status --json shows the attempt under pending_receipts with ledger_state 'sent'. Expected exit 0 with text withheld and a receipt plus final ledger line written.

import { existsSync } from 'node:fs'; import { join } from 'node:path'; import { expect, it } from 'vitest'; import { MockProvider, type Provider, type CompleteReq, type CompleteRes } from '../src/providers.js'; import { cliP, readLines, readySeat, tmpHome } from './helpers.js';

class P implements Provider { readonly name = 'mock' as const; calls = 0; inner = new MockProvider('ok');

estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

async complete(r: CompleteReq): Promise { this.calls++; const res = await this.inner.complete(r); return { ...res, text: 'benign output', usage: { ...res.usage, api_key: 'not-a-real-key' } as CompleteRes['usage'] }; }

readReceipt(id: string) { return this.inner.readReceipt(id); } }

it('fallback write survives a non-text scan hit', async () => {

const h = tmpHome(); await readySeat(h, '42', '5');

const r = await cliP(h, ['run','--seat','42','--job','usage-field','--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], new P());

expect(r.code).toBe(0); // FAILS: 5

expect(existsSync(join(h, 'receipts'))).toBe(true); // FAILS

expect(readLines(join(h, 'ledger.jsonl')).at(-1).state).not.toBe('sent'); // FAILS

});

Observed on efd47f3 with a mock whose complete() takes 30 ms and honours the abort signal: --timeout-ms 3000000000, --timeout-ms abc and --timeout-ms 0 each exit 6 (TIMEOUT_UNKNOWN) with stderr no answer within 3000000000 ms. Spend is UNKNOWN ... and a ledger line {state:'timeout_unknown', cap_charge:0.18}; --timeout-ms 1000 exits 0. Three aborted attempts leave 0.54 FLOP charged to the day for no delivered output.

import { expect, it } from 'vitest'; import { MockProvider, type Provider, type CompleteReq } from '../src/providers.js'; import { cliP, readySeat, tmpHome } from './helpers.js';

class Slow implements Provider { readonly name = 'mock' as const; calls = 0; inner = new MockProvider('ok');

estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

async complete(r: CompleteReq) { this.calls++; await new Promise((res, rej) => { const t = setTimeout(res, 30); r.signal.addEventListener('abort', () => { clearTimeout(t); rej(r.signal.reason); }, { once: true }); }); return this.inner.complete(r); }

readReceipt(id: string) { return this.inner.readReceipt(id); } }

it('timeout flag is validated', async () => {

const h = tmpHome(); await readySeat(h, '42', '5');

const base = ['run','--seat','42','--job','t','--prompt','Say hi','--max-tokens','8','--provider','mock'];

expect((await cliP(h, [...base, '--timeout-ms', '3000000000'], new Slow())).code).toBe(2); // FAILS: 6

expect((await cliP(h, [...base, '--timeout-ms', 'abc'], new Slow())).code).toBe(2); // FAILS: 6

});

Input: a ready seat 42 with cap set 0.2, and one ledger row for a sent attempt whose cap_charge is null (produced by the NaN quote in the previous finding, or by this exact line appended to $IMD_FLOP_HOME/ledger.jsonl):

{"ts":"2026-11-10T00:00:00.000Z","day":"","request_id":"mock-42-0000000000000001","seat":"42","did":null,"job":"j","provider":"mock","network":"devnet","payer":"holder","model":"qwen/qwen2.5-0.5b-instruct","max_tokens":8,"prompt_sha256":"00","quote_raw":0.5,"quote_padded":null,"per_call_cap":0.2,"daily_cap":0.2,"job_budget":null,"spent_before":0,"state":"sent","reason":null,"spend":null,"cost_reported":null,"cap_charge":null,"http":null,"mock":true}

Expected: status --json today_utc.mock reflects an unresolved attempt (not 0) and the next run (mock pads to 0.18) is refused against the 0.2 daily cap, or the command refuses to proceed on an unreadable row.

Actual (observed with the NaN-quote rows, cap 0.1): today_utc = {flop:0, mock:0}, cap show prints "Today: flop 0, mock 0", and the next run is sent with spent_before 0. With the field removed entirely the sum is NaN, today_utc.mock prints null, and every later run passes the daily-cap comparison.

Test body:

import { expect, it } from "vitest";

import { appendFileSync } from "node:fs";

import { join } from "node:path";

import { spentToday, utcDay } from "../../src/ledger.js";

import { cli, readySeat, tmpHome } from "../helpers.js";

it("null cap_charge counts as 0 and the cap is not enforced", async () => {

  const h = tmpHome(); await readySeat(h, "42", "0.2");

  const row = { ts: new Date().toISOString(), day: utcDay(), request_id: "mock-42-0000000000000001", seat: "42", did: null, job: "j", provider: "mock", network: "devnet", payer: "holder", model: "m", max_tokens: 8, prompt_sha256: "00", quote_raw: 0.5, quote_padded: null, per_call_cap: 0.2, daily_cap: 0.2, job_budget: null, spent_before: 0, state: "sent", reason: null, spend: null, cost_reported: null, cap_charge: null, http: null, mock: true };

  appendFileSync(join(h, "ledger.jsonl"), JSON.stringify(row) + "\n");

  expect(spentToday(h, "42", "mock")).toBe(0); // reservation of an unresolved attempt counted as nothing

  const r = await cli(h, ["run", "--seat", "42", "--job", "j2", "--prompt", "Say hi", "--max-tokens", "8", "--json"]);

  expect(r.code).toBe(0); // a second 0.18 attempt is sent under a 0.2 daily cap

});

Reproduce in-process with vitest (temp copy of imd-flop, npm ci && npx vitest run test/scratch/x.test.ts), using the IO.provider test hook from test/helpers.ts (cliP) exactly as test/ledger-reservation.test.ts does:

Input: ready seat 42, cap set 5; a Provider whose complete() returns MockProvider("ok")'s result with usage set to undefined (equivalently a gateway 200 body without "usage"); estimate()/readReceipt() delegate to MockProvider.

Expected: exit 0, cost_reported null, cap_charge 0.18 (reservation kept), a second ledger line with state "estimated", run --json printing the stored text.

Actual (observed): exit code 1, stderr "imd-flop: Cannot read properties of undefined (reading 'cost_flop')", stdout empty; ledger.jsonl holds only [["sent", 0.18, null]] for the request; responses/ and receipts/ each hold the file; status --json lists the attempt in recent_receipts with the ledger still at sent.

Test body:

import { expect, it } from "vitest";

import { join } from "node:path";

import type { CompleteReq, Provider } from "../../src/providers.js";

import { MockProvider } from "../../src/providers.js";

import { cliP, readLines, readySeat, tmpHome } from "../helpers.js";

class P implements Provider { readonly name = "mock" as const; calls = 0; inner = new MockProvider("ok");

  estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

  async complete(r: CompleteReq) { this.calls++; const res = await this.inner.complete(r); (res as unknown as { usage: unknown }).usage = undefined; return res; }

  readReceipt(id: string) { return this.inner.readReceipt(id); } }

it("missing usage crashes after the paid call", async () => {

  const h = tmpHome(); await readySeat(h, "42", "5"); const p = new P();

  const r = await cliP(h, ["run", "--seat", "42", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"], p);

  expect(p.calls).toBe(1);

  expect(r.code).toBe(1); expect(r.err).toMatch(/reading 'cost_flop'/);

  expect(readLines(join(h, "ledger.jsonl")).map((x) => x.state)).toEqual(["sent"]); // no post-call line

});

Reproduce in-process with vitest (temp copy of imd-flop, npm ci && npx vitest run test/scratch/x.test.ts), using the IO.provider test hook from test/helpers.ts (cliP) exactly as test/ledger-reservation.test.ts does:

Input: ready seat 42, cap set 5; a Provider whose complete() returns MockProvider("ok")'s text with usage { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2, cost_flop: 0.01, token: "abcdefgh12345678" } (any extra gateway field with a secret-shaped name or value); estimate()/readReceipt() delegate to MockProvider.

Expected: exit 0; response file written with text (or text null and a withheld reason), receipt file written, ledger second line state "estimated" with cap_charge 0.18 and cost_reported 0.01.

Actual (observed): exit 5, stderr "imd-flop: secret scan blocked writing response: usage.token: secret-named field "token"", stdout empty; responses/ and receipts/ do not exist; ledger.jsonl holds only [["sent", 0.18, null]]; provider.calls = 1 (the paid call happened).

Test body:

import { expect, it } from "vitest";

import { existsSync } from "node:fs";

import { join } from "node:path";

import type { CompleteReq, Provider } from "../../src/providers.js";

import { MockProvider } from "../../src/providers.js";

import { cliP, readLines, readySeat, tmpHome } from "../helpers.js";

class P implements Provider { readonly name = "mock" as const; calls = 0; inner = new MockProvider("ok");

  estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

  async complete(r: CompleteReq) { this.calls++; const res = await this.inner.complete(r); return { ...res, usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2, cost_flop: 0.01, token: "abcdefgh12345678" } as typeof res.usage }; }

  readReceipt(id: string) { return this.inner.readReceipt(id); } }

it("scan hit in usage aborts the run after payment", async () => {

  const h = tmpHome(); await readySeat(h, "42", "5"); const p = new P();

  const r = await cliP(h, ["run", "--seat", "42", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"], p);

  expect(p.calls).toBe(1);

  expect(r.code).toBe(5); expect(r.err).toMatch(/usage.token/);

  expect(existsSync(join(h, "responses"))).toBe(false); expect(existsSync(join(h, "receipts"))).toBe(false);

  expect(readLines(join(h, "ledger.jsonl")).map((x) => x.state)).toEqual(["sent"]);

});

Reproduce in-process with vitest (temp copy of imd-flop, npm ci && npx vitest run test/scratch/x.test.ts), using the IO.provider test hook from test/helpers.ts (cliP) exactly as test/ledger-reservation.test.ts does:

Input: ready seat 42, cap set 5; a Provider whose readReceipt() returns MockProvider("ok")'s receipt with settled_spend: 0, state: "settled" and error: "rejected tx " + "ab".repeat(32) (variant: settled_spend_raw: "cd".repeat(32)); estimate()/complete() delegate to MockProvider.

Expected: exit 0, receipt file written (or the offending field blanked), ledger second line {state:"settled", spend:0, cap_charge:0}, today_utc.mock 0.

Actual (observed): exit 5, stderr "imd-flop: secret scan blocked writing receipt: error: 64-hex (key-shaped) value" (variant: "... settled_raw: 64-hex ..."); ledger.jsonl holds only [["sent", 0.18, null]]; receipts/ absent, responses/ has the file; status --json today_utc = {flop:0, mock:0.18} although the gateway settled 0.

Test body:

import { expect, it } from "vitest";

import { existsSync } from "node:fs";

import { join } from "node:path";

import type { CompleteReq, Provider } from "../../src/providers.js";

import { MockProvider } from "../../src/providers.js";

import { cli, cliP, readLines, readySeat, tmpHome } from "../helpers.js";

class P implements Provider { readonly name = "mock" as const; calls = 0; inner = new MockProvider("ok");

  estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }

  async complete(r: CompleteReq) { this.calls++; return this.inner.complete(r); }

  async readReceipt(id: string) { const rr = await this.inner.readReceipt(id); return { ...rr, error: "rejected tx " + "ab".repeat(32), receipt: { ...rr.receipt!, settled_spend: 0, state: "settled" as const } }; } }

it("receipt string aborts before the settled-0 ledger line", async () => {

  const h = tmpHome(); await readySeat(h, "42", "5"); const p = new P();

  const r = await cliP(h, ["run", "--seat", "42", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"], p);

  expect(r.code).toBe(5); expect(r.err).toMatch(/writing receipt: error: 64-hex/);

  expect(existsSync(join(h, "receipts"))).toBe(false);

  expect(readLines(join(h, "ledger.jsonl")).map((x) => [x.state, x.spend, x.cap_charge])).toEqual([["sent", null, 0.18]]);

  expect((await cli(h, ["status", "--seat", "42", "--json"])).json().today_utc.mock).toBe(0.18); // gateway said settled 0

});

Input: ready seat 42 with cap set 5; run --seat 42 --job j --prompt hi --provider mock --mock-scenario timeout --timeout-ms 3000000000 (also --timeout-ms abc). The mock 'timeout' scenario never answers, so a correct 3000000000 ms timeout would leave the process waiting.

Expected: exit 2 "--timeout-ms must be a positive number" (or, if accepted, the call waits the stated time).

Actual (observed): Node prints "TimeoutOverflowWarning: 3000000000 does not fit into a 32-bit signed integer. Timeout duration was set to 1."; the run returns in 9 ms with exit 6 and stderr "no answer within 3000000000 ms. Spend is UNKNOWN ..."; with abc: "no answer within NaN ms"; ledger.jsonl gains [sent 0.222] then [timeout_unknown 0.222, reason "TimeoutError: no answer; spend unknown, not retried"], and status charges 0.222 against the day for each such run.

Test body:

import { expect, it } from "vitest";

import { MockProvider } from "../../src/providers.js";

import { cliP, readySeat, tmpHome } from "../helpers.js";

it("over-limit timeout aborts at once", async () => {

  const h = tmpHome(); await readySeat(h, "42", "5"); const t0 = Date.now();

  const r = await cliP(h, ["run", "--seat", "42", "--job", "j", "--prompt", "hi", "--provider", "mock", "--timeout-ms", "3000000000"], new MockProvider("timeout"));

  expect(r.code).toBe(6); expect(Date.now() - t0).toBeLessThan(2000);

  const r2 = await cliP(h, ["run", "--seat", "42", "--job", "j", "--prompt", "hi", "--provider", "mock", "--timeout-ms", "abc"], new MockProvider("timeout"));

  expect(r2.code).toBe(6); expect(r2.err).toMatch(/within NaN ms/);

});

Reproduce in-process with vitest in a temp copy of imd-flop using the IO.provider hook (cliP from test/helpers.ts).

Input: ready seat 42, cap set 0.1; a Provider whose estimate() resolves { estimated_cost_flop: 1e-8, estimated_input_tokens: 1, estimated_output_tokens: 1 }, whose complete() delegates to MockProvider("ok") but deletes usage.cost_flop, and whose readReceipt() delegates to MockProvider (state estimated, settled null).

Expected: padQuote returns null (or a positive padded value) and the run is refused locally with exit 7; or, if sent, the ledger keeps a positive reservation while spend is unknown.

Actual (observed): padQuote(...) = { raw: 1e-8, padded: 0 }; the run exits 0 with provider.calls 1 and req.maxCostFlop = 0; ledger.jsonl rows [state, quote_raw, quote_padded, cap_charge, cost_reported] = [["sent",1e-8,0,0,null],["estimated",1e-8,0,0,null]]: an unresolved attempt booked at 0.

Test body:

import { expect, it } from "vitest";

import { join } from "node:path";

import type { CompleteReq, Provider } from "../../src/providers.js";

import { MockProvider } from "../../src/providers.js";

import { padQuote } from "../../src/run.js";

import { cliP, readLines, readySeat, tmpHome } from "../helpers.js";

class P implements Provider { readonly name = "mock" as const; calls = 0; seen: unknown[] = []; inner = new MockProvider("ok");

  async estimate() { return { estimated_cost_flop: 1e-8, estimated_input_tokens: 1, estimated_output_tokens: 1 }; }

  async complete(r: CompleteReq) { this.calls++; this.seen.push(r.maxCostFlop); const res = await this.inner.complete(r); delete res.usage.cost_flop; return res; }

  readReceipt(id: string) { return this.inner.readReceipt(id); } }

it("tiny positive quote books a zero reservation", async () => {

  expect(padQuote({ estimated_cost_flop: 1e-8, estimated_input_tokens: 1, estimated_output_tokens: 1 })).toEqual({ raw: 1e-8, padded: 0 });

  const h = tmpHome(); await readySeat(h, "42", "0.1"); const p = new P();

  const r = await cliP(h, ["run", "--seat", "42", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"], p);

  expect(r.code).toBe(0); expect(p.calls).toBe(1); expect(p.seen[0]).toBe(0);

  expect(readLines(join(h, "ledger.jsonl")).map((x) => x.cap_charge)).toEqual([0, 0]);

});

Mock provider whose readReceipt(requestId) returns the normal mock receipt patched with {request_id:'gen_someone_else', state:'settled', settled_spend:0}. Setup: init --seat 9001; link --token 9001 --agent 7; cap set 5. Run run --seat 9001 --job foreign --prompt 'Say hi' --max-tokens 8 --provider mock --json.

Expected: receipt rejected as not belonging to this attempt; ledger latest line keeps spend null and cap_charge 0.18; match reports a mismatch.

Actual (verified): exit 0; printed receipt.request_id='gen_someone_else' while request_id='mock-9001-…'; cap_charge 0; receipt.match={match:'matches',fields:[]}; receipts/mock-9001-….json contains request_id 'gen_someone_else'; receipt mock-9001-… --json prints request_id 'gen_someone_else' and match 'matches'.

Mock provider whose complete() returns the normal mock result with usage set to undefined. Setup: init/link/cap set 5 for seat 9001. Run run --seat 9001 --job no-usage --prompt 'Say hi' --max-tokens 8 --provider mock --json.

Expected: exit 0, JSON result with cost_reported null and cap_charge 0.18 (unknown usage keeps the reservation), final ledger line written.

Actual (verified): exit 1, stderr imd-flop: Cannot read properties of undefined (reading 'cost_flop'), stdout empty, ledger lines for the attempt = ['sent'] only, receipts/.json and responses/.json both exist. Variant: text = [{type:'text',text:'hi'}] -> exit 1, imd-flop: string expected.

Mock provider whose readReceipt() returns state 'settled' with settled_spend read from a mutable variable, first 0.05 then 0.15. Setup: init/link/cap set 5 for seat 9001. Run run --seat 9001 --job refresh --prompt 'Say hi' --max-tokens 8 --provider mock --json (cap_charge 0.05), set the variable to 0.15, then receipt <request_id> --refresh --json and status --seat 9001 --json.

Expected: refreshed receipt settled 0.15 and ledger_spend/cap_charge raised to 0.15; today_utc.mock 0.15.

Actual (verified): refresh prints settled 0.15 with ledger_spend 0.05; latest ledger line cap_charge 0.05; status today_utc.mock 0.05.

Setup: init/link/cap set 5 for seat 9001. Run run --seat 9001 --job t --prompt 'Say hi' --max-tokens 8 --provider mock --mock-scenario timeout --timeout-ms abc --json (and again with --timeout-ms 0).

Expected: exit 2 usage error '--timeout-ms must be a positive integer', no ledger line.

Actual (verified): exit 6, stderr imd-flop: no answer within NaN ms. Spend is UNKNOWN (recorded as null). Not retried. (and 'within 0 ms'), provider.complete called once, latest ledger line {state:'timeout_unknown', cap_charge:0.18}, Node emits TimeoutNaNWarning.

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does. Provider P wraps MockProvider('ok') and overrides only the named field. Seat prepared with readySeat(home,'9001',CAP). Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider). CAP='5'. Case 1: P.readReceipt() returns the mock receipt patched with { request_id: 'mock-9001-0000000000000000', state: 'settled', settled_spend: 0 }; run job 'foreign'. Expected: receipt rejected as not ours, cap_charge 0.18, match 'mismatch'. Actual (observed): exit 0; printed request_id mock-9001- but receipt.request_id mock-9001-0000000000000000; cap_charge 0; receipt.match {match:'matches', fields:[]}; latest ledger line cap_charge 0, spend 0; spentToday 0; receipts/mock-9001-.json contains request_id 'mock-9001-0000000000000000'; receipt mock-9001-<random> --json prints request_id 'mock-9001-0000000000000000' with match 'matches'. Case 2: receipt { request_id: 'someone-else', correlation_id: 'imd-job-other', state: 'settled', settled_spend: 0 }. Actual: match {match:'mismatch', fields:['job(correlation_id)']} yet the ledger line still has cap_charge 0 (expected 0.18). Test body:

class P implements Provider { readonly name = 'mock' as const; calls = 0; inner = new MockProvider('ok'); estimate(b) { return this.inner.estimate(b); } complete(r) { this.calls++; return this.inner.complete(r); } async readReceipt(id: string) { const rr = await this.inner.readReceipt(id); return { ...rr, receipt: { ...rr.receipt!, request_id: 'mock-9001-0000000000000000', state: 'settled' as const, settled_spend: 0 } }; } }

it('foreign receipt is not a settlement', async () => { const h = tmpHome(); await readySeat(h, '9001', '5'); const r = await cliP(h, ['run','--seat','9001','--job','foreign','--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], new P()); expect(r.json().receipt.match.match).toBe('mismatch'); /* FAILS: matches / const last = readLines(join(h,'ledger.jsonl')).at(-1); expect(last.cap_charge).toBe(last.quote_padded); / FAILS: 0 vs 0.18 */ });

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does. Seat prepared with readySeat(home,'9001',CAP). Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider). CAP='0.2'. One normal run (job ok-1, charged 0.18, exit 0). Then append to ledger.jsonl a copy of the last row with request_id 'mock-9001-ffffffffffffffff' and the cap_charge key removed. Expected: spentToday is finite and the next run is refused with exit 3 (0.18 of 0.2 already reserved). Actual (observed): spentToday(home,'9001','mock') is NaN; the next run (job 'after') exits 0 and is sent; status --json shows today_utc {flop:0, mock:null}. Variant: on a fresh seat append a row with state 'sent', quote_padded 0.18, cap_charge null. Actual: spentToday 0 and the next 0.18 run exits 0 under a 0.2 daily cap. Test body:

import { appendFileSync } from 'node:fs'; import { join } from 'node:path'; import { expect, it } from 'vitest'; import { spentToday } from '../../src/ledger.js'; import { cli, readLines, readySeat, tmpHome } from '../helpers.js';

const RUN = (j: string) => ['run','--seat','9001','--job',j,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'];

it('ledger total is validated', async () => { const h = tmpHome(); await readySeat(h, '9001', '0.2'); expect((await cli(h, RUN('ok-1'))).code).toBe(0); const path = join(h, 'ledger.jsonl'); const last = readLines(path).at(-1); appendFileSync(path, JSON.stringify({ ...last, request_id: 'mock-9001-ffffffffffffffff', cap_charge: undefined }) + '\n'); expect(Number.isFinite(spentToday(h, '9001', 'mock'))).toBe(true); /* FAILS: NaN / expect((await cli(h, RUN('after'))).code).toBe(3); / FAILS: 0 */ });

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

Unit: scanForSecrets({ text: 'ab'.repeat(64) }) returns [] and scanForSecrets({ text: 'x' + 'ab'.repeat(32) + 'c' }) returns [], while scanForSecrets({ text: 'ab'.repeat(32) }) returns [{path:'text', reason:'64-hex (key-shaped) value'}].

CLI: CAP='5'; P.complete() returns text 'key: ' + 'ab'.repeat(64); run job hex128 with --json.

Expected: printed text null, withheld 'secret scan blocked writing response: text: ...', response file text null.

Actual (observed): exit 0, stdout contains the full 128-hex value, printed withheld is undefined, and responses/.json contains the value.

Test: it('128-hex is withheld', async () => { const h = tmpHome(); await readySeat(h,'9001','5'); const key = 'ab'.repeat(64); const r = await cliP(h, RUN('hex128'), new P(/* complete() sets text 'key: '+key /)); expect(r.out.includes(key)).toBe(false); / FAILS: true / expect(readFileSync(r.json().response_file,'utf8').includes(key)).toBe(false); / FAILS: true */ });

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='5'; P.complete() returns the mock result with usage set to undefined; P.readReceipt() returns { state: 'settled', settled_spend: 0.1 }.

Expected: exit 0, final ledger line state 'settled', spend 0.1, cap_charge 0.1, cost_reported null, JSON printed.

Actual (observed): exit 1, stderr 'imd-flop: Cannot read properties of undefined (reading 'cost_flop')', stdout empty, ledger rows for the attempt = [['sent', 0.18, null]] only, responses/ and receipts/ both contain the file.

Variant: text = [{type:'text', text:'hi'}] -> exit 1, stderr 'imd-flop: string expected'.

Test: it('missing usage keeps the run alive', async () => { const h = tmpHome(); await readySeat(h,'9001','5'); const r = await cliP(h, RUN('nousage'), p); expect(r.code).toBe(0); /* FAILS: 1 / expect(readLines(join(h,'ledger.jsonl')).at(-1).state).not.toBe('sent'); / FAILS */ });

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='5'; P.complete() returns text 'benign output' and usage { prompt_tokens:1, completion_tokens:1, total_tokens:2, cost_flop:0.01, token:'abcdefgh12345678' }.

Expected: exit 0, response and receipt files written, final ledger line state 'estimated' with cap_charge 0.18.

Actual (observed): exit 5, stderr 'imd-flop: secret scan blocked writing response: usage.token: secret-named field "token"', stdout empty, provider.calls 1, responses/ and receipts/ absent, ledger rows [['sent', 0.18]], status --json lists the attempt under pending_receipts with ledger_state 'sent' and today_utc.mock 0.18.

Test: it('fallback write survives a non-text scan hit', async () => { const h = tmpHome(); await readySeat(h,'9001','5'); const r = await cliP(h, RUN('usage-token'), p); expect(r.code).toBe(0); /* FAILS: 5 / expect(existsSync(join(h,'receipts'))).toBe(true); / FAILS */ });

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='5'; P.readReceipt() returns the mock receipt with settled_spend 0, state 'settled' and the ReceiptRead error field 'rejected tx ' + 'ab'.repeat(32).

Expected: exit 0, ledger second line {state:'settled', spend:0, cap_charge:0}, today_utc.mock 0.

Actual (observed): exit 5, stderr 'imd-flop: secret scan blocked writing receipt: error: 64-hex (key-shaped) value'; ledger rows [['sent', null, 0.18]]; receipts/ absent, responses/ present; status --json today_utc {flop:0, mock:0.18}.

Variant with settled_spend_raw: 'cd'.repeat(32): exit 5, 'secret scan blocked writing receipt: settled_raw: 64-hex (key-shaped) value'.

Test: it('receipt string does not block the settled-0 line', async () => { const h = tmpHome(); await readySeat(h,'9001','5'); const r = await cliP(h, RUN('rcpt'), p); expect(r.code).toBe(0); /* FAILS: 5 / expect(readLines(join(h,'ledger.jsonl')).at(-1).cap_charge).toBe(0); / FAILS: 0.18 */ });

Unit: padQuote({ estimated_cost_flop: 4e-7, estimated_input_tokens: 10, estimated_output_tokens: 1000 }) returns { raw: 4e-7, padded: 0 }; padQuote({ estimated_cost_flop: 0.0000014, estimated_input_tokens: 10, estimated_output_tokens: 100000 }) returns padded 0.000001 < raw; padQuote({ estimated_cost_flop: 1e-8, estimated_input_tokens: 1, estimated_output_tokens: 1 }) returns { raw: 1e-8, padded: 0 }.

Expected padded >= raw > 0 or null.

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='0.1'; P.estimate() returns { estimated_cost_flop: 1e-8, estimated_input_tokens: 1, estimated_output_tokens: 1 }, P.complete() returns usage without cost_flop, receipt is the mock's (state estimated, settled null).

Actual (observed): exit 0, provider.calls 1, req.maxCostFlop 0, ledger rows [state, quote_raw, quote_padded, cap_charge, cost_reported] = [['sent',1e-8,0,0,null],['estimated',1e-8,0,0,null]].

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and overrides only the named field.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='5'; P.complete() waits 30 ms honouring the abort signal, then delegates to the mock.

Run with --timeout-ms abc, --timeout-ms 0 and --timeout-ms 3000000000.

Expected: exit 2 usage error (or, for 3000000000, the call waits and succeeds).

Actual (observed): each returns in under 10 ms with exit 6, stderr 'imd-flop: no answer within NaN ms.

Spend is UNKNOWN ...' / 'within 0 ms' / 'within 3000000000 ms', provider.calls 1, latest ledger line {state:'timeout_unknown', cap_charge:0.18}, Node prints TimeoutNaNWarning / TimeoutOverflowWarning; --timeout-ms 1000 exits 0.

Three aborted attempts leave 0.54 FLOP charged to the day.

Test: expect((await cliP(h, [...RUN('t'), '--timeout-ms', 'abc'], new Slow())).code).toBe(2); /* FAILS: 6 */

Harness: vitest in a copy of imd-flop (npm ci; npx vitest run test/scratch/x.test.ts), no network, using the IO.provider hook via test/helpers.ts cliP() exactly as test/ledger-reservation.test.ts does.

Provider P wraps MockProvider('ok') and returns state 'settled' with settled_spend read from a mutable variable.

Seat prepared with readySeat(home,'9001',CAP).

Run: cliP(home, ['run','--seat','9001','--job',JOB,'--prompt','Say hi','--max-tokens','8','--provider','mock','--json'], provider).

CAP='5'.

Variable 0.05: run job 'refresh' with --json -> cap_charge 0.05.

Set the variable to 0.15, then cli(home, ['receipt', <request_id>, '--refresh', '--json'], { provider }) and cli(home, ['status','--seat','9001','--json']).

Expected: refreshed receipt settled 0.15 with ledger_spend/cap_charge raised to 0.15 and today_utc.mock 0.15.

Actual (observed): refresh prints settled 0.15 with ledger_spend 0.05; latest ledger line cap_charge 0.05; status today_utc {flop:0, mock:0.05}.