Deploy ecc2a52

The cost cap can finally see the GPU

Source: https://github.com/WINTER4000/turingDNA/commit/ecc2a52ff08d074502a69e19f73ef4227ca6ea61

dee/core/compute_budget.py

@@ -0,0 +1,158 @@
+"""What a run spends on rented GPUs — and, until now, what the cap could not see.
+
+THE HOLE
+--------
+`AGENT_MAX_COST_USD` stops a run that talks to the language model too much. It
+has never seen a single second of GPU time. A run that calls the DNA scorer
+forty times bought forty A10G jobs and reported spending only the tokens it
+took to ask for them, because the only thing `run.cost_usd` ever accumulated
+was `_llm.call`'s return value.
+
+That is the wrong shape of failure for a budget. A cap that silently excludes
+the expensive half is worse than no cap, because it reads as protection.
+
+WHY THERE IS NO PRICE IN THIS FILE
+----------------------------------
+Rates change, and this repo already decided (modal/evo2_scoring.py, modal/
+sieve.py) that a hardcoded per-second figure is a number that goes stale
+without anyone noticing and then gets quoted as fact. So the rate comes from
+the environment or not at all:
+
+    MODAL_USD_PER_GPU_SECOND          applies to every tier
+    MODAL_USD_PER_GPU_SECOND_T4       per-tier override
+    MODAL_USD_PER_GPU_SECOND_A10G
+
+With nothing configured, this module still counts GPU SECONDS — which are
+measured, not looked up — and says plainly that the dollar cap covers model
+time only. That is the honest failure: report the quantity you actually have,
+and name the one you don't. Reporting $0.00 of compute would be a claim, and
+a false one.
+
+SECONDS ARE AN UPPER BOUND, ON PURPOSE
+--------------------------------------
+What is measured is wall time around the whole submit-and-poll cycle, which
+includes queueing and container cold start — time the GPU may not have been
+billed for. For a budget that is the correct direction to be wrong in: it
+spends the cap early rather than late. Anywhere the number is shown it is
+labelled an estimate, because it is one.
+"""
+
+from __future__ import annotations
+
+import os
+import threading
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+__all__ = ["Charge", "GPU_TIER_BY_PIPELINE", "rate_for", "record", "drain",
+           "summarise", "reset"]
+
+# Which GPU each Modal pipeline runs on. MIRRORED from modal/ rather than
+# imported: dee/ and modal/ are deployed separately and neither imports the
+# other's package at runtime (the same reason dna_scoring.TIER_CONTEXT
+# duplicates MODEL_PRESETS). Sources: modal/sieve.py `gpu="T4"`,
+# modal/evo2_scoring.py `gpu="A10G"`, modal/ensemble.py `gpu="A10G"`.
+#
+# A pipeline missing from this table is still METERED — its seconds are
+# counted under an "unknown" tier — because dropping the measurement would
+# reintroduce exactly the blindness this module exists to fix.
+GPU_TIER_BY_PIPELINE = {"protein": "T4", "dna": "A10G"}
+UNKNOWN_TIER = "unknown"
+
+_ENV_ANY = "MODAL_USD_PER_GPU_SECOND"
+_ENV_TIER = "MODAL_USD_PER_GPU_SECOND_{tier}"
+
+# Thread-local, not a ContextVar: the orchestrator drives each run on its own
+# thread and executes that run's tool calls in it, so per-thread is exactly
+# the scope wanted. A process-global would bill one run for another's GPU.
+_local = threading.local()
+
+
+@dataclass
+class Charge:
+    label: str                 # what bought it — the pipeline or tool name
+    tier: str                  # GPU tier, or "unknown"
+    seconds: float             # wall time, an UPPER BOUND (see module docstring)
+    usd: Optional[float]       # None when no rate is configured for this tier
+
+
+def rate_for(tier: str) -> Optional[float]:
+    """USD per GPU-second for a tier, from the environment only.
+
+    Returns None when unset — which the caller must treat as "unknown", never
+    as zero. Those are different claims and only one of them is true.
+    """
+    for key in (_ENV_TIER.format(tier=str(tier or "").upper().replace("-", "_")),
+                _ENV_ANY):
+        raw = os.environ.get(key)
+        if raw is None or str(raw).strip() == "":
+            continue
+        try:
+            v = float(raw)
+        except (TypeError, ValueError):
+            continue
+        # A negative or non-finite rate would credit the run for spending.
+        if v >= 0 and v == v and v not in (float("inf"), float("-inf")):
+            return v
+    return None
+
+
+def record(label: str, seconds: float, *, pipeline: str = "",
+           tier: str = "") -> Optional[Charge]:
+    """Meter one GPU call against the current thread's run."""
+    try:
+        s = float(seconds)
+    except (TypeError, ValueError):
+        return None
+    if not (s > 0) or s != s or s in (float("inf"), float("-inf")):
+        return None
+    t = tier or GPU_TIER_BY_PIPELINE.get(pipeline, UNKNOWN_TIER)
+    rate = rate_for(t)
+    charge = Charge(label=str(label or pipeline or "gpu")[:64], tier=t,
+                    seconds=round(s, 3),
+                    usd=(None if rate is None else round(rate * s, 6)))
+    if not hasattr(_local, "charges"):
+        _local.charges = []
+    _local.charges.append(charge)
+    return charge
+
+
+def drain() -> List[Charge]:
+    """Take everything metered on this thread since the last drain."""
+    out = getattr(_local, "charges", [])
+    _local.charges = []
+    return out
+
+
+def reset() -> None:
+    """Discard anything metered on this thread. For tests and for the start of
+    a run, so a charge can never leak across a thread's reuse."""
+    _local.charges = []
+
+
+def summarise(charges: List[Charge]) -> Dict[str, Any]:
+    """Roll charges up, and be explicit about the part that has no price."""
+    charges = charges or []
+    seconds = round(sum(c.seconds for c in charges), 3)
+    priced = [c for c in charges if c.usd is not None]
+    unpriced = [c for c in charges if c.usd is None]
+    usd = round(sum(c.usd or 0.0 for c in priced), 6)
+    tiers = sorted({c.tier for c in unpriced})
+    return {
+        "calls": len(charges),
+        "gpu_seconds": seconds,
+        "usd": usd,
+        # False whenever ANY charge could not be priced. A partially priced
+        # total is the failure this module exists to avoid: it looks complete.
+        "fully_priced": not unpriced,
+        "unpriced_calls": len(unpriced),
+        "unpriced_tiers": tiers,
+        "note": (
+            "" if not charges else
+            (f"{seconds:g}s of GPU time, estimated from wall clock "
+             f"(includes queue and cold start, so it reads high)."
+             + ("" if not unpriced else
+                f" No rate configured for {', '.join(tiers) or 'these tiers'}, "
+                f"so the dollar cap covers model time only — set "
+                f"{_ENV_ANY} to include compute."))),
+    }

dee/core/modal_client.py

@@ -41,6 +41,8 @@ import os
 import time
 from typing import Any, Dict, Optional, Tuple
 
+from dee.core import compute_budget as _budget
+
 logger = logging.getLogger("dee.modal_client")
 
 SUBMIT_URL_ENV = "MODAL_SUBMIT_URL"
@@ -242,9 +244,23 @@ def run(payload: Dict[str, Any], *, pipeline: str = "protein",
         total_timeout = DNA_TIMEOUT if pipeline == "dna" else DEFAULT_TIMEOUT
 
     job_id = submit(payload, pipeline=pipeline)
-    deadline = time.monotonic() + total_timeout
+    started = time.monotonic()
+    deadline = started + total_timeout
     last_state = None
 
+    def _meter() -> None:
+        """Bill the run for the GPU it just rented.
+
+        Metered on EVERY exit — done, error and timeout alike. A failed job
+        still occupied a container, and a budget that only counts successes
+        can be walked past by a caller whose calls keep failing.
+        """
+        try:
+            _budget.record(pipeline or "gpu", time.monotonic() - started,
+                           pipeline=pipeline)
+        except Exception:  # noqa: BLE001 — accounting must never fail the work
+            logger.debug("gpu metering failed; continuing", exc_info=True)
+
     while True:
         state = status(job_id, pipeline=pipeline)
         # The orchestrator calls this field "stage" (orchestrate_logic.
@@ -276,11 +292,14 @@ def run(payload: Dict[str, Any], *, pipeline: str = "protein",
                     logger.debug("on_progress raised; continuing", exc_info=True)
 
         if phase == "done":
+            _meter()
             return state
         if phase == "error":
+            _meter()
             raise ModalError(str(state.get("error") or "GPU run failed")[:400])
 
         if time.monotonic() >= deadline:
+            _meter()
             # Say what was actually seen. "Timed out" alone leaves the caller
             # unable to tell a slow run from a stuck one.
             raise ModalError(

dee/core/orchestrator.py

@@ -53,6 +53,7 @@ import uuid
 from dataclasses import dataclass, field
 from typing import Any, Dict, List, Optional, Tuple
 
+from dee.core import compute_budget as _budget
 from dee.core import llm as _llm
 from dee.core import provenance as _prov
 from dee.core import agent_tools as _tools
@@ -578,6 +579,17 @@ class Run:
     seq: int = 0
     steps: int = 0
     cost_usd: float = 0.0
+    # GPU time the run bought, metered by dee.core.compute_budget. Kept apart
+    # from cost_usd because they are known to different precisions: cost_usd
+    # is what the provider billed, compute_usd is an ESTIMATE from wall clock
+    # and may be 0.0 simply because no rate is configured. Summing them into
+    # one field would erase which half is measured and which is inferred.
+    gpu_seconds: float = 0.0
+    compute_usd: float = 0.0
+    compute_calls: int = 0
+    # False once ANY GPU call could not be priced. The cap still counts what
+    # it can; this is how the run says the total is a floor, not a total.
+    compute_fully_priced: bool = True
     context_tokens: int = 0
     # Prompt-cache accounting, summed over every step of the run. Kept
     # separate from context_tokens (which is last-step-wins, because it drives
@@ -760,7 +772,15 @@ def _persist(run: Run) -> None:
             "cost_usd": run.cost_usd,
             "events": [_slim_for_storage(e) for e in run.events],
             "history": list(run.history),
-            "meta": {"workspace": dict(run.workspace)},
+            # Compute rides in `meta` rather than its own column: it needs
+            # no migration, and a resumed run that forgot the GPU it already
+            # bought would hand its successor a fresh allowance for spend
+            # that already happened.
+            "meta": {"workspace": dict(run.workspace),
+                     "compute": {"gpu_seconds": run.gpu_seconds,
+                                 "usd": run.compute_usd,
+                                 "calls": run.compute_calls,
+                                 "fully_priced": run.compute_fully_priced}},
         }
         owner = run.owner
 
@@ -800,7 +820,17 @@ def rehydrate(run_id: str, user_id: str) -> Optional[Run]:
     run.title = row.get("title") or ""
     run.steps = int(row.get("steps") or 0)
     run.cost_usd = float(row.get("cost_usd") or 0.0)
-    run.workspace = dict((row.get("meta") or {}).get("workspace") or {})
+    _meta = row.get("meta") or {}
+    run.workspace = dict(_meta.get("workspace") or {})
+    _compute = _meta.get("compute") or {}
+    run.gpu_seconds = float(_compute.get("gpu_seconds") or 0.0)
+    run.compute_usd = float(_compute.get("usd") or 0.0)
+    run.compute_calls = int(_compute.get("calls") or 0)
+    # Absent on runs saved before compute was metered. True is the right
+    # default there: those runs have no unpriced charges because they have no
+    # recorded charges at all, and defaulting to False would make every old
+    # run claim a caveat it never earned.
+    run.compute_fully_priced = bool(_compute.get("fully_priced", True))
     # seq must continue past the highest persisted event or the client's
     # `after=` cursor would skip everything it has already seen on the next
     # turn — restored events keep their original numbering.
@@ -850,6 +880,15 @@ def public_state(run: Run) -> Dict[str, Any]:
             "seq": run.seq,
             "steps": run.steps,
             "cost_usd": round(run.cost_usd, 6),
+            # The GPU half, published separately and never folded into
+            # cost_usd: one is what the provider billed, the other an
+            # estimate from wall clock that may read 0.00 only because no
+            # rate is configured. `compute_priced` is how a client knows
+            # which of those two 0.00s it is looking at.
+            "compute_usd": round(run.compute_usd, 6),
+            "gpu_seconds": round(run.gpu_seconds, 1),
+            "compute_calls": run.compute_calls,
+            "compute_priced": run.compute_fully_priced,
             # Published so a client can SHOW the allowance instead of the user
             # meeting it for the first time as a wall (reviewer, 2026-07-30:
             # "not clear what happened here / was this a user limit?").
@@ -1103,6 +1142,10 @@ def _drive(run: Run, config: _llm.OpenRouterConfig) -> None:
     a terminal event (done/error/ask) so the client's poll always converges
     instead of spinning on a run that quietly died.
     """
+    # Clear anything the GPU meter is holding on this thread before the first
+    # tool call. Threads can be reused, and an inherited charge would bill
+    # this run for another's compute.
+    _budget.reset()
     try:
         while True:
             # ── Out of steps? Buy more, if this is still work. ────────────
@@ -1460,6 +1503,10 @@ def _run_one_tool(run: Run, name: str, call_id: str, args: Dict[str, Any],
                                  # duration by execute_tool so no tool inherits
                                  # the model of whatever ran before it.
                                  model=getattr(run, "model", "small"))
+    # Bill the run for any GPU that tool just rented, BEFORE the next model
+    # call: a tool that spends the rest of the allowance must stop the run at
+    # the tool, not one LLM round-trip later.
+    _meter_compute(run)
     model_result = _strip_ui(result)
     # Bind BEFORE the event is emitted, so the very next system prompt — the
     # one the model plans with — already knows what this run is about.
@@ -1537,11 +1584,50 @@ def _clean_plan(raw: Any) -> List[Dict[str, str]]:
 # everything the run had already done. All three are fixed below.
 
 def _cost_fraction(run: Run, config: _llm.OpenRouterConfig) -> float:
-    """How much of this run's allowance is gone, 0-1. Zero when uncapped."""
+    """How much of this run's allowance is gone, 0-1. Zero when uncapped.
+
+    Counts GPU time as well as model time. Until this line did, a run could
+    rent forty A10G jobs and report spending only the tokens it took to ask
+    for them — a cap that silently excluded the expensive half, which is
+    worse than no cap because it reads as protection.
+
+    When no per-second rate is configured, compute_usd is 0.0 and the cap
+    covers model time alone. That is a real limitation, and it is stated
+    wherever the number is shown rather than papered over with a guess.
+    """
     limit = float(getattr(config, "max_cost_usd", 0.0) or 0.0)
     if limit <= 0:
         return 0.0
-    return run.cost_usd / limit
+    return (run.cost_usd + run.compute_usd) / limit
+
+
+def _spend_line(run: Run) -> str:
+    """How to describe the allowance, given what is actually known about it."""
+    if not run.compute_calls:
+        return "of model time per run"
+    if run.compute_fully_priced:
+        return "of model and GPU time per run"
+    # The honest middle case: GPU time happened, and we can say how much of it
+    # in seconds, but not what it cost.
+    return (f"of model time per run — plus {run.gpu_seconds:.0f}s of GPU time "
+            f"this run bought, which has no configured rate and so is not "
+            f"counted against the cap")
+
+
+def _meter_compute(run: Run) -> None:
+    """Fold whatever GPU the last tool call rented into this run's spend."""
+    try:
+        summary = _budget.summarise(_budget.drain())
+    except Exception:  # noqa: BLE001 — accounting must never fail the work
+        logger.debug("compute metering failed; continuing", exc_info=True)
+        return
+    if not summary.get("calls"):
+        return
+    run.compute_calls += int(summary["calls"])
+    run.gpu_seconds = round(run.gpu_seconds + float(summary["gpu_seconds"]), 3)
+    run.compute_usd = round(run.compute_usd + float(summary["usd"]), 6)
+    if not summary.get("fully_priced"):
+        run.compute_fully_priced = False
 
 
 def _warn_on_spend(run: Run, config: _llm.OpenRouterConfig) -> None:
@@ -1552,12 +1638,15 @@ def _warn_on_spend(run: Run, config: _llm.OpenRouterConfig) -> None:
     limit = float(config.max_cost_usd)
     _emit(run, "budget", {
         "spent_usd": round(run.cost_usd, 4),
+        "compute_usd": round(run.compute_usd, 4),
+        "gpu_seconds": round(run.gpu_seconds, 1),
+        "compute_fully_priced": run.compute_fully_priced,
         "limit_usd": round(limit, 4),
         "fraction": round(_cost_fraction(run, config), 3),
     })
     _emit(run, "text", {"text": (
         f"Heads up — I've used about {round(_cost_fraction(run, config) * 100)}% "
-        f"of this run's compute allowance (${limit:.2f} of model time per run; "
+        f"of this run's compute allowance (${limit:.2f} {_spend_line(run)}; "
         f"it's a cap on the run, not a limit on your account). I'll pause and "
         f"check in with you before it runs out.")})
 
@@ -1567,8 +1656,8 @@ def _budget_spent(run: Run, config: _llm.OpenRouterConfig) -> None:
     limit = float(config.max_cost_usd)
     run.budget_spent = True
     _hand_over(run, reason="budget_spent", why=(
-        f"That's this run's full compute allowance spent (${limit:.2f} of "
-        f"model time per run — it's a cap on the run, not a limit on your "
+        f"That's this run's full compute allowance spent (${limit:.2f} "
+        f"{_spend_line(run)} — it's a cap on the run, not a limit on your "
         f"account, and nothing you did is lost)."))
 
 

dee/static/cockpit.js

@@ -1795,6 +1795,13 @@
                     applyEvent(ev);
                 });
                 if (typeof d.cost_usd === "number") state.cost = d.cost_usd;
+                // GPU time this run rented. Held separately from state.cost
+                // for the same reason the server publishes it separately: one
+                // is what the provider billed, the other an estimate from
+                // wall clock that reads 0.00 when no rate is configured.
+                if (typeof d.gpu_seconds === "number") state.gpuSeconds = d.gpu_seconds;
+                if (typeof d.compute_usd === "number") state.computeUsd = d.compute_usd;
+                if (typeof d.compute_priced === "boolean") state.computePriced = d.compute_priced;
                 if (typeof d.context_tokens_used === "number") state.ctxUsed = d.context_tokens_used;
                 // null (not 0) until the first billed step — see
                 // orchestrator.public_state. Guard on null explicitly so "no
@@ -2309,6 +2316,7 @@
         _planNode = null;   // a new run gets a fresh checklist, not the old one
         state.digest = {}; state.transcript = [];
         state.cost = 0; state.ctxUsed = 0; state.ctxLimit = 0;
+        state.gpuSeconds = 0; state.computeUsd = 0; state.computePriced = true;
         _noted = false; _phase = 0; _seq = "";
         // The trace is per-run. Carrying the previous run's steps into a new
         // one would be the same mistake the plan node used to make — a stale
@@ -2519,6 +2527,15 @@
             }).length + " tool calls",
         ];
         if (state.cost) lines.push("**Model cost:** $" + state.cost.toFixed(4));
+        // In a methods record the GPU line matters more than the model line:
+        // it is the compute that produced the numbers, and its price is an
+        // estimate. Say which is which rather than printing one total.
+        if (state.gpuSeconds) {
+            lines.push("**GPU time:** " + state.gpuSeconds.toFixed(1) + "s" +
+                (state.computePriced && state.computeUsd
+                    ? " (~$" + state.computeUsd.toFixed(4) + ", estimated from wall clock)"
+                    : " (no rate configured — seconds only)"));
+        }
         lines.push("", "---", "", "## Transcript", "");
 
         state.transcript.forEach(function (ev) {
@@ -2625,6 +2642,11 @@
         // real figure at the precision it actually has.
         if (state.cost) bits.push("$" + (state.cost < 0.01
             ? state.cost.toFixed(4) : state.cost.toFixed(2)) + " model cost");
+        // GPU seconds, never folded into the dollar figure beside them. A
+        // combined total would hide that one half is billed and the other
+        // estimated — and, when no rate is set, that the dollars exclude the
+        // expensive half entirely.
+        if (state.gpuSeconds) bits.push(Math.round(state.gpuSeconds) + "s GPU");
         // Cache hit rate. ~14.5k tokens of tool specs + system prompt are
         // resent on every step and ~99% of that is byte-identical, so this
         // number is what says whether that repetition is billed at full price

dee/static/index.html

@@ -112,7 +112,7 @@
     <!-- ?v= query bumps invalidate browser + iframe asset caches when app.css /
          app.js change. Bump these numbers whenever you ship a frontend update —
          without them, users keep getting the stale file for up to a week. -->
-    <link rel="stylesheet" href="/static/app.css?v=20260819-uplift1" />
+    <link rel="stylesheet" href="/static/app.css?v=20260819-budget1" />
     <!-- The work catalog + the draggable rail. Kept out of app.css so two new
          self-contained surfaces stay reviewable; every colour is an app.css
          token, so both themes work with nothing added. -->
@@ -2995,9 +2995,9 @@
     <!-- Cloning reference data must load before app.js so the Designer
          can read VECTORS / ENZYMES / CLONING_METHODS / TAGS / LINKERS. -->
     <script src="/static/cloning_db.js?v=20260530-ui-polish" defer></script>
-    <script src="/static/context.js?v=20260819-uplift1" defer></script>
-    <script src="/static/lineage.js?v=20260819-uplift1" defer></script>
-    <script src="/static/app.js?v=20260819-uplift1" defer></script>
+    <script src="/static/context.js?v=20260819-budget1" defer></script>
+    <script src="/static/lineage.js?v=20260819-budget1" defer></script>
+    <script src="/static/app.js?v=20260819-budget1" defer></script>
     <!-- The decision trace, BEFORE cockpit.js: applyEvent calls TDTrace.push
          on the very first event, and both are `defer`, so document order is
          load order. Loading it after would drop the opening events of a
@@ -3006,7 +3006,7 @@
     <!-- THE COCKPIT — the persistent orchestrator rail. Loads after app.js so
          TDBench/TDStructure exist when a tool result asks the workspace to
          render something. This is the only conversation surface in the app. -->
-    <script src="/static/cockpit.js?v=20260811-buildC" defer></script>
+    <script src="/static/cockpit.js?v=20260819-budget1" defer></script>
     <!-- structcard before catalog: the catalog calls TDStructCard.observe as
          soon as it paints. Both are defer, so document order is load order. -->
     <script src="/static/structcard.js?v=20260811-buildC" defer></script>

tests/test_compute_budget.py

@@ -0,0 +1,204 @@
+"""GPU time the agent buys, and the cap that could not see it.
+
+`AGENT_MAX_COST_USD` stopped a run that talked to the model too much and
+never saw a second of GPU. A run could rent forty A10G jobs and report
+spending only the tokens it took to ask for them. A cap that silently
+excludes the expensive half is worse than no cap: it reads as protection.
+
+These tests are as much about what the module REFUSES to claim — a price it
+was never told, a $0.00 that means "unknown" — as about the arithmetic.
+"""
+import os
+
+import pytest
+
+from dee.core import compute_budget as cb
+
+
+@pytest.fixture(autouse=True)
+def _clean(monkeypatch):
+    for k in list(os.environ):
+        if k.startswith("MODAL_USD_PER_GPU_SECOND"):
+            monkeypatch.delenv(k, raising=False)
+    cb.reset()
+    yield
+    cb.reset()
+
+
+# --------------------------------------------------------------------------- #
+# The price this module refuses to invent
+# --------------------------------------------------------------------------- #
+def test_with_no_rate_configured_there_is_no_price_only_seconds():
+    """Rates change. A hardcoded per-second figure goes stale without anyone
+    noticing and is then quoted as fact — the repo already decided this in
+    modal/sieve.py and modal/evo2_scoring.py."""
+    assert cb.rate_for("A10G") is None
+    c = cb.record("dna", 12.0, pipeline="dna")
+    assert c.seconds == 12.0 and c.usd is None
+
+
+def test_an_unpriced_total_is_never_reported_as_fully_priced():
+    """$0.00 of compute and 'we do not know what compute cost' are opposite
+    claims that render identically as a number."""
+    cb.record("dna", 12.0, pipeline="dna")
+    s = cb.summarise(cb.drain())
+    assert s["usd"] == 0.0 and s["fully_priced"] is False
+    assert "no configured rate" in s["note"].lower() or "No rate configured" in s["note"]
+
+
+def test_one_unpriced_call_poisons_the_whole_total(monkeypatch):
+    """A partially priced total is the worst outcome: it looks complete."""
+    monkeypatch.setenv("MODAL_USD_PER_GPU_SECOND_T4", "0.0002")
+    cb.record("protein", 10.0, pipeline="protein")   # priced
+    cb.record("dna", 10.0, pipeline="dna")           # A10G, no rate
+    s = cb.summarise(cb.drain())
+    assert s["usd"] == pytest.approx(0.002)
+    assert s["fully_priced"] is False and s["unpriced_tiers"] == ["A10G"]
+
+
+def test_a_per_tier_rate_beats_the_blanket_one(monkeypatch):
+    monkeypatch.setenv("MODAL_USD_PER_GPU_SECOND", "1.0")
+    monkeypatch.setenv("MODAL_USD_PER_GPU_SECOND_T4", "0.5")
+    assert cb.rate_for("T4") == 0.5
+    assert cb.rate_for("A10G") == 1.0
+
+
+@pytest.mark.parametrize("bad", ["", "   ", "abc", "-0.5", "nan", "inf"])
+def test_an_unusable_rate_is_treated_as_no_rate_not_as_zero(monkeypatch, bad):
+    """A negative rate would credit the run for spending; a garbage one would
+    silently zero the compute half of the cap."""
+    monkeypatch.setenv("MODAL_USD_PER_GPU_SECOND", bad)
+    assert cb.rate_for("A10G") is None
+
+
+# --------------------------------------------------------------------------- #
+# Metering
+# --------------------------------------------------------------------------- #
+def test_an_unknown_pipeline_is_still_metered():
+    """Dropping the measurement would reintroduce exactly the blindness this
+    module exists to fix."""
+    c = cb.record("mystery", 5.0, pipeline="quantum")
+    assert c.tier == cb.UNKNOWN_TIER and c.seconds == 5.0
+
+
+@pytest.mark.parametrize("bad", [0, -1, None, "x", float("nan"), float("inf")])
+def test_a_nonsense_duration_is_not_recorded(bad):
+    assert cb.record("dna", bad, pipeline="dna") is None
+    assert cb.summarise(cb.drain())["calls"] == 0
+
+
+def test_draining_empties_the_meter_so_a_charge_is_never_billed_twice():
+    cb.record("dna", 3.0, pipeline="dna")
+    assert len(cb.drain()) == 1
+    assert cb.drain() == []
+
+
+def test_the_meter_is_per_thread_so_one_run_never_bills_another():
+    import threading
+    seen = {}
+
+    def other():
+        cb.record("dna", 99.0, pipeline="dna")
+        seen["other"] = cb.summarise(cb.drain())["gpu_seconds"]
+
+    cb.record("dna", 1.0, pipeline="dna")
+    t = threading.Thread(target=other)
+    t.start(); t.join()
+    assert seen["other"] == 99.0
+    assert cb.summarise(cb.drain())["gpu_seconds"] == 1.0
+
+
+def test_nothing_metered_produces_an_empty_note_not_a_reassurance():
+    s = cb.summarise([])
+    assert s["calls"] == 0 and s["note"] == "" and s["fully_priced"] is True
+
+
+def test_the_note_calls_the_seconds_an_estimate():
+    """Wall time includes queue and cold start, so it reads high. That is the
+    right direction for a budget to be wrong in, and it has to be said."""
+    cb.record("dna", 8.0, pipeline="dna")
+    assert "estimated" in cb.summarise(cb.drain())["note"]
+
+
+# --------------------------------------------------------------------------- #
+# The cap actually seeing it
+# --------------------------------------------------------------------------- #
+from dee.core import llm as _llm
+from dee.core import orchestrator as orch
+
+
+def _run_and_config(limit=1.0):
+    run = orch.Run(run_id="r1", owner="u1", anonymous=False)
+    config = _llm.OpenRouterConfig(api_key="k", model="m", max_steps=8,
+                                   max_cost_usd=limit)
+    return run, config
+
+
+def test_gpu_spend_counts_against_the_cap():
+    run, config = _run_and_config(limit=1.0)
+    run.cost_usd = 0.4
+    run.compute_usd = 0.4
+    assert orch._cost_fraction(run, config) == pytest.approx(0.8)
+
+
+def test_a_run_that_only_spent_gpu_can_still_hit_the_cap():
+    """The exact hole: model time near zero, compute enormous."""
+    run, config = _run_and_config(limit=1.0)
+    run.cost_usd = 0.01
+    run.compute_usd = 1.2
+    assert orch._cost_fraction(run, config) >= 1.0
+
+
+def test_an_uncapped_run_is_still_uncapped():
+    run, config = _run_and_config(limit=0.0)
+    run.compute_usd = 99.0
+    assert orch._cost_fraction(run, config) == 0.0
+
+
+def test_metering_folds_the_meter_into_the_run():
+    run, _ = _run_and_config()
+    cb.record("dna", 6.0, pipeline="dna")
+    orch._meter_compute(run)
+    assert run.compute_calls == 1 and run.gpu_seconds == 6.0
+    assert run.compute_fully_priced is False   # no rate configured
+
+
+def test_the_spend_line_says_what_the_cap_actually_covers():
+    run, _ = _run_and_config()
+    assert orch._spend_line(run) == "of model time per run"
+
+    run.compute_calls, run.gpu_seconds = 1, 30.0
+    run.compute_fully_priced = False
+    line = orch._spend_line(run)
+    assert "not counted against the cap" in line and "30s" in line
+
+    run.compute_fully_priced = True
+    assert orch._spend_line(run) == "of model and GPU time per run"
+
+
+def test_a_resumed_run_does_not_forget_the_gpu_it_already_bought():
+    """Otherwise every resume hands the successor a fresh allowance for spend
+    that already happened."""
+    run, _ = _run_and_config()
+    cb.record("dna", 20.0, pipeline="dna")
+    orch._meter_compute(run)
+    restored = orch.Run(run_id="r1", owner="u1", anonymous=False)
+    meta = {"workspace": {}, "compute": {"gpu_seconds": run.gpu_seconds,
+                                         "usd": run.compute_usd,
+                                         "calls": run.compute_calls,
+                                         "fully_priced": run.compute_fully_priced}}
+    _compute = meta["compute"]
+    restored.gpu_seconds = float(_compute["gpu_seconds"])
+    restored.compute_usd = float(_compute["usd"])
+    restored.compute_calls = int(_compute["calls"])
+    restored.compute_fully_priced = bool(_compute["fully_priced"])
+    assert restored.gpu_seconds == 20.0 and restored.compute_calls == 1
+
+
+def test_an_old_run_with_no_compute_block_claims_no_caveat():
+    """Runs saved before compute was metered have no unpriced charges because
+    they have no recorded charges — defaulting to False would make every one
+    of them wear a warning it never earned."""
+    meta = {"workspace": {}}
+    compute = meta.get("compute") or {}
+    assert bool(compute.get("fully_priced", True)) is True