viztor · Nov 13, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -507,6 +507,7 @@ jobs:
               # version in the user agent the probes carry (identity.ts), the
               # anthropic-version every Messages probe sends
               # (request-shape.ts), and the probes' own inputs, CI arming
+              # and the environment reader that arms a key (e2e-env.ts)
               # included. Left out, and covered by the offline suite and the
               # nightly `full` run: the generated catalog (catalog-data.ts)
               # and the live model choice (models-catalog.ts), which the
@@ -517,7 +518,7 @@ jobs:
               # it. grep reads a here-string, not a pipe: under
               # pipefail, `grep -q` exiting on an early match could kill the
               # writer with SIGPIPE on a long path list and read as a miss.
-              if grep -Eq '^(src/host/|src/utils/protocols\.ts$|src/utils/plane-model\.ts$|src/identity\.ts$|src/utils/request-shape\.ts$|test/e2e/keyed-probes\.e2e\.ts$|test/support/keyed-probes\.ts$|test/support/keyless-matrix\.ts$|\.github/workflows/ci\.yml$)' <<<"$changed"; then
+              if grep -Eq '^(src/host/|src/utils/protocols\.ts$|src/utils/plane-model\.ts$|src/identity\.ts$|src/utils/request-shape\.ts$|test/e2e/keyed-probes\.e2e\.ts$|test/support/keyed-probes\.ts$|test/support/keyless-matrix\.ts$|test/support/e2e-env\.ts$|\.github/workflows/ci\.yml$)' <<<"$changed"; then
                 tier=probes
               else
                 tier=none
@@ -652,8 +653,13 @@ jobs:
           # generated catalog) is covered on each pull request by the
           # in-process characterization of the same rows, on both channels,
           # and here by the nightly run.
+          # The binary e2e's own inputs are in scope too: the file, the rows it
+          # asserts (support/host.ts), the versions it installs
+          # (support/host-versions.ts, which also selects its channel) and the
+          # reader its gate, prefix and cell come through (support/e2e-env.ts).
+          # test/keyed-probes.test.ts compiles this pattern and checks it.
           # A here-string, not a pipe: see the e2e job's tier step.
-          if grep -Eq '^(src/host/|src/lifecycle\.ts$|src/identity\.ts$|src/cordis-context\.ts$|src/models-discovery\.ts$|src/fetch-patch\.ts$|src/stream-hook\.ts$|cordis\.patch\.yml$|test/e2e/host/|test/e2e/host-binary\.e2e\.ts$|test/support/host\.ts$|test/support/host-versions\.ts$|scripts/host-drift\.ts$|\.github/workflows/ci\.yml$|vitest\.e2e\.config\.ts$|vite\.config\.ts$)' <<<"$changed"; then
+          if grep -Eq '^(src/host/|src/lifecycle\.ts$|src/identity\.ts$|src/cordis-context\.ts$|src/models-discovery\.ts$|src/fetch-patch\.ts$|src/stream-hook\.ts$|cordis\.patch\.yml$|test/e2e/host/|test/e2e/host-binary\.e2e\.ts$|test/support/host\.ts$|test/support/host-versions\.ts$|test/support/e2e-env\.ts$|scripts/host-drift\.ts$|\.github/workflows/ci\.yml$|vitest\.e2e\.config\.ts$|vite\.config\.ts$)' <<<"$changed"; then
             echo "run=true" >> "$GITHUB_OUTPUT"
           else
             echo "run=false" >> "$GITHUB_OUTPUT"

diff --git a/AGENTS.md b/AGENTS.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
diff --git a/docs/credentials.md b/docs/credentials.md
@@ -13,7 +13,7 @@ The plugin's default is the deployment's own credential: whatever `apiKeyEnv` th
     a named apiKeyEnv  →  the credentials service (the launch environment only when no service is mounted)
     no reference       →  pi's own lookup (a Sign-in record under llm-pi-ai/<plane>, then OPENCODE_API_KEY)  →  the installation's store (opt-in)
 
-**pi's own lookup reads `OPENCODE_API_KEY` on both planes** (pi 1.1.0's `providers/opencode.js` and `providers/opencode-go.js` both name that one variable). So a Go entry that names no reference authenticates every Go turn with the Zen key, and a Go key stored in DSH Credentials reaches a Go turn only as the entry's `apiKeyEnv: OPENCODE_GO_API_KEY`. Before P-R1 the Go plane's Responses, Messages and Google turns defaulted to `OPENCODE_GO_API_KEY`; that default went with the hidden routes, and the README's "Changed in 1.x" names it. The meter inherits the consequence: the fetch interceptor files the bearer of a Go-plane request as a Go key, and the meter's `auto` order puts that captured key ahead of the configured `OPENCODE_GO_API_KEY`, so after the first Go turn of a no-reference Go entry the meter sends the Zen key to the Go usage endpoint, which refuses it. `test/host-planes.test.ts` pins both turn cases on the Go plane, and the meter's switch from the Go key to the captured Zen key.
+**pi's own lookup reads `OPENCODE_API_KEY` on both planes** (pi 1.1.0's `providers/opencode.js` and `providers/opencode-go.js` both name that one variable). So a Go entry that names no reference authenticates every Go turn with the Zen key, and a Go key stored in DSH Credentials reaches a Go turn only as the entry's `apiKeyEnv: OPENCODE_GO_API_KEY`. Before P-R1 the Go plane's Responses, Messages and Google turns defaulted to `OPENCODE_GO_API_KEY`; that default went with the hidden routes, and the README's "Changed in 1.x" names it. The meter inherits the consequence: the fetch interceptor files the bearer of a Go-plane request as a Go key, and the meter's `auto` order puts that captured key ahead of the configured `OPENCODE_GO_API_KEY`, so after the first Go turn of a no-reference Go entry the meter sends the Zen key to the Go usage endpoint, which refuses it. `test/host-planes-credentials.test.ts` pins both turn cases on the Go plane, and the meter's switch from the Go key to the captured Zen key.
 
 A named reference that resolves nothing is `MISSING_CREDENTIAL`, and no request is sent; a credentials service that fails propagates its own error rather than reading as a missing key. A captured or literal key never answers for the adapter. The installation's store is read only when the deployment sets `readOpencodeStore`, only for a plane that names no reference, and only when pi's own lookup would find nothing: the resolver's answer is handed to pi as the request's explicit key, which pi lets win over its own lookup, so a store key returned any earlier would outrank a Sign-in record or an exported `OPENCODE_API_KEY`.
 

diff --git a/docs/engineering-notes.md b/docs/engineering-notes.md
@@ -228,7 +228,7 @@ Worth keeping separate because the conclusions differ: the first is fixed by not
 
 ## Every count in the documentation, checked against the data
 
-Two were missed while chasing the catalog's changes — Go's total and its no-SDK row — so the sweep was finished properly: every number stated in any document, compared against `catalog-data.ts`, and every live count in the docs agreed with the shim of that day. The counts are deliberately not restated here, because the shim has been regenerated since and a number in this paragraph is one no test reads: the current ones are the dated tables in [`redirect-planes.md`](./redirect-planes.md) §1 and §2, which `test/catalog.test.ts` reads back against the shipped shim.
+Two were missed while chasing the catalog's changes — Go's total and its no-SDK row — so the sweep was finished properly: every number stated in any document, compared against `catalog-data.ts`, and every live count in the docs agreed with the shim of that day. The counts are deliberately not restated here, because the shim has been regenerated since and a number in this paragraph is one no test reads: the current ones are the dated tables in [`redirect-planes.md`](./redirect-planes.md) §1 and §2, which `test/catalog-docs.test.ts` reads back against the shipped shim.
 
 Two numbers that look stale are not, and they are worth naming so the next sweep does not "fix" them: `0 of 31` appears once, inside this file, as a quotation of the mistake; and `16 of 17` is a recorded test result from the round that narrowed the header test, not a count of anything current.
 
@@ -318,13 +318,13 @@ So the class has one member left standing rather than a pattern, which is the po
 
 ## Why one document's counts never drifted, and the others' did
 
-`protocol-routing-and-merge.md` states five counts — 28, 30, 18, 8 and 1 of 85 — and every one is correct, which is not luck. The document says why in its own words: _"a count written into prose does not regenerate with the data it counts"_, and it names the test that holds them. `catalog.test.ts` asserts the table against the shipped catalog, so a count that drifts fails the suite rather than sitting in a file.
+`protocol-routing-and-merge.md` states five counts — 28, 30, 18, 8 and 1 of 85 — and every one is correct, which is not luck. The document says why in its own words: _"a count written into prose does not regenerate with the data it counts"_, and it names the test that holds them. `catalog-docs.test.ts` asserts the table against the shipped catalog, so a count that drifts fails the suite rather than sitting in a file.
 
 That is the difference between the counts that were wrong this session and this one. The ones that drifted — Go 31, the Zen total in the plane table, the duplicated 12 and 13, the Chinese README's Google line — were all prose that nothing checked. The fix in each case was to correct it; the fix that would have prevented all of them is the one this document already applies, and it is worth copying rather than rediscovering: put the number where a test can reach it.
 
 ## The prose totals are still unguarded, and the attempt to guard them is recorded
 
-`catalog.test.ts` already parses and asserts the tables in three documents — the README's routing table, `protocol-routing-and-merge.md`'s "N of M" pairs, and `redirect-planes.md`'s per-SDK matrix. Every count this repository has had to correct lived outside them, in a sentence: the README's total, the Chinese README's copy of it, and the plane table's "85 served / 120 listed". The mechanism that would have caught all three exists and is not pointed at them.
+`catalog-docs.test.ts` already parses and asserts the tables in three documents — the README's routing table, `protocol-routing-and-merge.md`'s "N of M" pairs, and `redirect-planes.md`'s per-SDK matrix. Every count this repository has had to correct lived outside them, in a sentence: the README's total, the Chinese README's copy of it, and the plane table's "85 served / 120 listed". The mechanism that would have caught all three exists and is not pointed at them.
 
 An attempt to add that case was made and reverted. The regex had to allow for the number being emphasised (`**85** active`), the escaping survived one round of edits and not the second, and the file ended up with no tests running at all. Reverted rather than left half-working, which is this session's rule and the reason the tree is green.