diff --git a/.github/extensions/ai-attribution/README.md b/.github/extensions/ai-attribution/README.md
index c661011..bed4746 100644
--- a/.github/extensions/ai-attribution/README.md
+++ b/.github/extensions/ai-attribution/README.md
@@ -1,16 +1,15 @@
 # AI attribution canvas
 
 A [GitHub Copilot app](https://docs.github.com/en/copilot/how-tos/github-copilot-app/agent-sessions)
-canvas for Data and Attribution Model. It examines what is
-needed to measure ROI on AI-assisted development across VS Code, Copilot CLI,
-the Copilot app and the cloud agent. Live local measurements show reported
-usage and work-link coverage, not monetary ROI or proven value.
+canvas connecting people, AI usage, work and cost, with facts, estimates and
+missing data clearly separated. It does not treat recorded usage as proof of
+savings or business value.
 
 It renders [the research](../../../docs/research/ai-telemetry-attribution.md) and
 [the model spec](../../../docs/research/attribution-model.json), and adds live,
 read-only coverage from this machine.
 
-![AI attribution canvas outcomes tab with coverage bars and PR-reference splits](../../../docs/media/canvas-outcomes.png)
+![Overview mission and data-source-to-Recipe map, followed by recorded usage](../../../docs/media/canvas-outcomes.png)
 
 The screenshots in this document are generated by `npm run media:canvas` from
 synthetic session and trace stores, with store discovery pointed at an empty
@@ -19,20 +18,26 @@ screenshots uses canned GitHub and Azure Boards answers, not the network.
 
 ## Views
 
-Short summaries first; expand a cell, card or section for the full evidence.
+Overview is the executive entry point: a mission statement and one hybrid map
+of data sources, usage records, Recipe, delivery and the separate bill comparison.
+The question about how much usage can be linked to work sits above the local
+measurements, not above the mission. The map describes supported data flow,
+not which sources are connected on a particular machine.
+
+Labels use plain English; exact API fields and settings appear in setup or
+technical details. Short summaries first; expand a cell, card or section for the full evidence.
 Expanders support the keyboard and retain their state while the panel updates.
 Missing values stay unknown, and source errors remain visible.
 
 | Tab | Shows |
 | --- | --- |
-| Outcomes | ROI-readiness metrics, reported credits with/without a PR reference, and the cost, value and baseline inputs still needed |
+| Overview | Mission and at-a-glance map: sources → usage → Recipe → work/results, with bill comparison alongside; local measurements follow |
 | Recipe | One delivery cycle per repository branch, from work item through AI work and commits to PR, review, merge and work-item closure, with optional GitHub and Azure Boards verification |
-| Surfaces | Concept × surface matrix with native / partial / missing / unverified fields |
-| Intersection | Verified concepts available across all five surfaces, with native vs conditional availability and each source's grain/access caveats |
-| Data model | Entity map and confidence tiers; expand for fields, provenance and accounting rules |
-| Gaps | Impact counts and expandable gaps, verification status and prior art |
-| Live coverage | Source cards, sparklines and attribution bars; expand for token tables and breakdowns |
-| Research | Section index with the complete document and sources on demand |
+| Data sources | What each tool reports; choose all data types or those shared by every source |
+| How it connects | Accounts, usage, work, results and bills, with clear explanations of the strength of each link |
+| Missing data | Gaps, why they matter and what to do |
+| Local usage | Recorded requests and credits by source, with token counts and breakdowns |
+| Research | Short inline findings, limits and the cost-allocation explanation, with supporting source links |
 
 ![AI attribution canvas surfaces tab showing the concept by surface matrix](../../../docs/media/canvas-surfaces.png)
 
@@ -46,10 +51,10 @@ Missing values stay unknown, and source errors remain visible.
 | Source | Default location |
 | --- | --- |
 | Copilot CLI / app session store | `$COPILOT_HOME/session-store.db` (default `~/.copilot/`) |
-| VS Code span store | `globalStorage/github.copilot-chat/agent-traces.db` for Code and Code - Insiders |
-| VS Code Copilot harness span store | `<userData>/agent-host/otel/agent-host-traces.db`, written only while `chat.agentHost.otel.dbSpanExporter.enabled` is on (VS Code 1.141+) |
+| VS Code · Local harness | `globalStorage/github.copilot-chat/agent-traces.db` for Code and Code - Insiders |
+| VS Code · Copilot Agent Host harness | `<userData>/agent-host/otel/agent-host-traces.db`, written only while `chat.agentHost.otel.dbSpanExporter.enabled` is on (VS Code 1.141+) |
 
-The Copilot harness store also holds Claude and Codex Agent Host traces; only
+The Copilot Agent Host harness store also holds Claude and Codex Agent Host traces; only
 Copilot runtime traces (spans stamped with `github.copilot.*`) are counted. Its
 credits are the per-turn `github.copilot.nano_aiu` on chat spans, never added to
 the root invocation total.
@@ -57,7 +62,7 @@ the root invocation total.
 Stores are opened read-only. If the file is locked, a temporary copy is read and
 then deleted. Only aggregates are produced (counts, token and credit sums, and
 model, agent, tool, repository and user names); prompt, response and tool content is
-never read. Nothing leaves the machine unless you press **Verify** on the Recipe
+never read. Nothing leaves the machine unless you press **Check delivery** or **Read billing** on the Recipe
 tab, and the two sources are shown side by side rather than summed.
 
 ### Reading coverage and token values
@@ -78,17 +83,18 @@ The surface matrix describes source capabilities, not everything ingested by
 this canvas. Organisation reports include daily CLI/app tokens and partial
 skill, plugin, custom-agent and MCP aggregates; MCP counts connections, not
 tool calls. Task-completion events are self-reports, not correctness signals.
-The **Data model** tab carries the billing reconciliation contract: preserve
+The **How it connects** tab carries the billing comparison rules: preserve
 query scope, compare matching gross AI-credit consumption, and keep discounts,
-net billed amounts and T3 allocations separate. Billing is not connected here.
-Its **Identity provenance** expander distinguishes native identity/resource
+final billed amounts and estimated work shares separate. Billing is read only
+when you explicitly select **Read billing**.
+Its **Where account details come from** expander distinguishes native identity/resource
 signals, derived actor/device keys, configured organisational attributes and
 external enrichment. Source capability does not mean that this local store
 collected those values.
 
-### Intersection
+### Shared-surface filter
 
-The **Intersection** tab derives concepts available across VS Code, CLI, app,
+The **Data sources** tab's **Shared by all five** filter derives concepts available across VS Code, CLI, app,
 cloud agent and organisation data from the model. Every cell must be native,
 partial or derived; missing and unverified fields are excluded. Native across
 all means directly emitted, not equivalent grain or comparable values.
@@ -116,7 +122,7 @@ VS Code 1.140 can add the signed-in GitHub account to Copilot telemetry as
 resolves each model call's user from its own `user.name`, else from the latest
 agent span at or before the call in the same chat session, conversation, parent
 session or trace. It reports the share of credits attributed to a user
-(**User identity**) and a **By user** breakdown. `process.user.name` and
+(**Linked to an account**) and a **By recorded account** breakdown. `process.user.name` and
 `host.name` are resource attributes, which `agent-traces.db` does not store.
 The CLI / app session store records no user, so its actor coverage is not
 measured. This user name is the join key to organisation data keyed by
@@ -129,13 +135,20 @@ measured. This user name is the join key to organisation data keyed by
 The **Recipe** tab follows one AI-assisted delivery cycle, from picking up a
 work item to closing it. A cycle is one repository branch.
 
+Start with **Setup & permissions**, then read **Lifecycle**, **Developer → work**,
+**Reading the flow**, typical times, **Compare usage with the bill** and cycle timelines.
+The guide explains all seven delivery handoffs and their assumptions, followed
+by a separate billing handoff covering account/day/model matching, estimated
+work costs and unexplained charges. Developer filters
+affect the credit breakdown; lifecycle and timelines retain all work in the window.
+
 | Phase | Steps | Local evidence | Verified evidence |
 | --- | --- | --- | --- |
 | Ingredients | Work item, branch | Branch convention, `session_refs` issue, session and span branch | GitHub issue state and type; Azure Boards type, state and dates |
 | Method | AI work, commits | Sessions, model calls and reported credits per source; recorded commits; VS Code head commits moving | PR commit IDs and dates |
 | Serve | Pull request, review, merge and close | `session_refs` PR | PR by number or head branch, reviews, merge, closing issues and work-item closure |
 
-![Recipe tab with a verified synthetic cycle: recipe strip, KPIs, convention gauge, ingredients and cycle timelines](../../../docs/media/canvas-recipe.png)
+![Recipe overview, developer attribution and cycle timelines using synthetic data](../../../docs/media/canvas-recipe.png)
 
 The **recipe strip** draws a band per step: the solid core counts cycles that
 followed the recipe in order up to that step, the lighter band counts cycles
@@ -143,14 +156,46 @@ that have the step in any order, and the hatched band is unknown until verified.
 Dotted tails show where cycles left the in-order recipe. Each step's evidence bar
 splits **Verified** (GitHub or Azure Boards API), **Recorded** (an agent-recorded
 reference, not ownership), **Convention** (branch name) and **Observed** (local
-telemetry). Below it are serve KPIs (PRs opened, reviewed, merged and closed,
-and median lead times), the branch-convention gauge, ingredients by work-item
-type, and one timeline per cycle. Select a cycle to see its step-by-step card.
+telemetry). Counts appear once in the strip; detailed credits appear once in
+the developer table. Select a cycle to see its step-by-step card. Redundant
+KPI cards, ingredient summaries and the duplicated surface matrix are removed.
+The rightmost **Compare usage and bill** checkpoint is connected with a dashed
+line: it follows delivery visually, but runs independently and is not an eighth
+delivery funnel stage or a per-PR invoice.
 
 Before verification, review, merge and closure are unknown rather than zero:
 
 ![Recipe tab before verification, with unknown steps hatched](../../../docs/media/canvas-recipe-local.png)
 
+### Developer → work
+
+Choose a **developer**, **source** and perspective:
+
+- **Credits used:** the **User recorded**, **Owner estimate** and **User unknown**
+  columns separate captured accounts, ownership-based estimates and unknown users. A measured
+  consumer is never replaced by the assignee or PR author.
+- **Work owned:** all contributors' usage on work associated with that
+  developer, not their personal consumption.
+
+![Developer usage broken down by work and attribution evidence, synthetic data only](../../../docs/media/canvas-recipe-developer.png)
+
+Each work group shows its credit breakdown once, even when it has several
+linked items. No-repository usage and cycles outside the display cap remain
+in the balance. Missing credit reports stay unknown. This is retained local
+history for the selected window, not a complete organization or billing total.
+
+Verify adds GitHub assignment history and the PR author, plus field-limited
+Azure Boards assignment snapshots at first AI activity. Current and historical
+assignees are separate roles. A sole historical owner / PR author can support
+**inference**, never proof of who consumed AI throughout the cycle. Conflicting
+owners remain unattributed; missing or truncated history is shown explicitly.
+
+Azure Boards IDs are organization-qualified. **Link provider identities**
+explicitly maps a Boards account to a GitHub login for this panel only.
+Display names, emails and branch prefixes are never used to match people.
+Links can also be supplied as `identityLinks` when opening the canvas, or set
+through `set_recipe_identity_links`; they are not saved to disk.
+
 ### Branch convention and commit hook
 
 The work item is the first token after the last slash of the branch name:
@@ -165,7 +210,8 @@ The opt-in [`hooks/commit-msg`](hooks/commit-msg) hook adds `Refs: AB#123` or
 `Refs: #123` from the branch name when the message does not already reference
 it, so Azure Boards and GitHub create their own links. It skips merges, detached
 HEADs, empty messages and other branches, never blocks a commit, and needs Node
-on `PATH`. For this repository:
+on `PATH`. Preserve existing hooks: copy/chain this hook if a hooksPath is already
+configured. Otherwise, for this repository:
 
 ```sh
 git config core.hooksPath .github/extensions/ai-attribution/hooks
@@ -176,27 +222,67 @@ Elsewhere, copy `hooks/commit-msg` into the repository's `.git/hooks/`. Set
 
 ### Verification
 
-**Verify with GitHub & Azure Boards** (or the `verify_recipe` action) is the only
-network step, and runs only when asked:
+**Check delivery** (`verify_recipe`) reads delivery metadata only when asked.
+**Read billing** is a separate explicit network action.
 
 - **GitHub.com** through the signed-in `gh` CLI. Each repository gets a GraphQL
   query, with values passed as variables, that finds the PR by recorded number or
   head branch. It reads PR state and dates, review states, commit IDs and dates,
-  closing issues and issue type. A branch name reused by an older PR does not
-  match.
+  closing issues, issue type, author login and assignment events. Assignment
+  history is bounded to 100 events per issue; incomplete history is not used
+  to establish a past assignee. A branch name reused by an older PR does not match.
 - **Azure Boards** through `_apis/wit/workitems` with fields limited to type,
-  state, project and created/activated/resolved/closed dates. State categories
+  state, project, assignee and created/activated/resolved/closed dates. Field-limited
+  `asOf` queries retrieve the assignee at first AI activity, not the current owner
+  retroactively. Historical queries are capped at 60 cycles. State categories
   decide closure across processes. The organization comes from the tab, the
   `azureDevOpsOrg` input or `az devops configure --defaults organization=…`.
   The token comes from `AZURE_DEVOPS_EXT_PAT` or `az account get-access-token`,
   stays in memory and is never logged or returned.
 
-Only repository, branch and PR, issue or work-item numbers are sent. Titles,
-descriptions, commit messages, comments and logins are never requested.
+Only repository, branch and PR, issue or work-item numbers plus first-activity
+timestamps are sent. Account/assignment metadata is read; titles,
+descriptions, commit messages, comments and email fields are never requested.
 Inaccessible repositories, a missing `gh` or `az`, or an unconfigured organization
 show as status chips. Credits stay per source, and reported credits per merged
 PR are consumption, not cost.
 
+### Setup & permissions
+
+The Recipe section is the operational checklist for local stores and identity
+capture, branch conventions, GitHub repository read access, Azure Boards
+Work Items (Read) / project access and the paying account's billing permission.
+It explains missing history, inferred owners, explicit provider identity links,
+network opt-in and how to preserve existing commit hooks.
+
+![Recipe setup and permission checklist with invented accounts only](../../../docs/media/canvas-recipe-setup.png)
+
+### Compare usage with the bill
+
+Choose **organization**, **enterprise** or **personal**, the paying account, a
+GitHub login and one completed **UTC day**. Read billing calls the corresponding
+GitHub `settings/billing/ai_credit/usage` endpoint through `gh`, filtered to that
+user, day and Copilot product. Repository read access alone does not grant billing
+access. Personal reports exclude organization-managed seats.
+
+![Billing comparison and unallocated balance using a synthetic report](../../../docs/media/canvas-recipe-billing.png)
+
+Compare gross credits to captured native-user credits per exact model and local
+source. Gross, discounts and net quantities/amounts remain distinct. Unknown
+consumers, unmatched model names and missing local history are not imputed.
+Currency is not supplied by the endpoint; amounts are displayed as returned.
+
+Billing has no PR/session IDs and accrues independently of merge. Work shares
+are **estimated shares**: net amount times captured native work credits divided by
+billed gross credits for that model. Unlinked work and uncaptured usage leave an
+unallocated remainder. A model with more local credits than billed credits is
+flagged and not allocated. Failed reads clear the previous report; nothing is
+persisted and no token or raw failure body is returned.
+
+Harness names are consistent across the canvas, status text and API source
+labels. Their internal source IDs remain `traces` (Local harness) and `agentHost`
+(Copilot Agent Host harness); database paths and settings are unchanged.
+
 ## Use
 
 The app loads project extensions from `.github/extensions/`. Ask Copilot to open
@@ -212,10 +298,17 @@ open_canvas({ canvasId: "ai-attribution", instanceId: "attribution", input: { vi
 | `refresh_coverage` | `{ windowDays? }` | Recomputes coverage; returns a summary |
 | `get_coverage` | — | Full coverage object |
 | `get_model` | `{ section? }` | Model spec or one section |
-| `get_recipe` | — | Recipe stations, KPIs, convention adherence and latest cycles |
+| `get_recipe` | `{ actorKey?, sourceId?, perspective? }` | Recipe and developer credit breakdown; perspective is `usage` or `ownership`; `actorKey: "__unknown"` selects unmatched usage/ownership |
 | `verify_recipe` | `{ azureDevOpsOrg? }` | Verifies cycles with GitHub and Azure Boards; returns the Recipe summary |
+| `set_recipe_identity_links` | `{ links: [{ boardsKey, githubLogin }] }` | Explicit cross-provider account links for this panel |
+| `reconcile_recipe_billing` | `{ level, account, user, day }` | Explicit one-day AI-credit billing read and per-source reconciliation; no per-PR invoices |
 
-Open input also accepts `sessionStorePath`, `tracesDbPath` and `agentHostTracesDbPath` overrides, and `azureDevOpsOrg`.
+Open input also accepts `sessionStorePath`, `tracesDbPath` and `agentHostTracesDbPath`
+overrides, `azureDevOpsOrg`, and `identityLinks: [{ boardsKey, githubLogin }]`.
+API view IDs remain `outcomes`, `recipe`, `surfaces`, `model`, `gaps`, `coverage`
+and `research`; the display-name changes do not break callers.
+Model schema 2 exposes descriptive `linkMethods`; estimated-cost rows use
+`method: "estimated-share"`. The former research-only code system is removed.
 
 ## Layout
 
@@ -224,17 +317,22 @@ Open input also accepts `sessionStorePath`, `tracesDbPath` and `agentHostTracesD
 | `extension.mjs` | Canvas declaration, actions and per-panel state |
 | `lib/coverage.mjs` | Store discovery and coverage computation |
 | `lib/recipe.mjs` | Recipe cycles, steps, evidence and KPIs (pure) |
+| `lib/actors.mjs` | Provider-qualified identities, role attribution and per-source developer balances (pure) |
+| `lib/billing.mjs` | Explicit GitHub billing reader, scope validation, per-source comparison and estimated work shares |
 | `lib/convention.mjs` | Branch-name work-item convention |
 | `lib/verify.mjs` | On-demand GitHub and Azure Boards verification |
 | `hooks/commit-msg` | Opt-in hook adding the branch's work item to commit messages |
 | `lib/tokenCoverage.cjs`, `lib/tokenCoverage.d.cts` | Shared paired-count and reporting-coverage logic; the declaration supplies the VS Code extension's type contract |
 | `lib/server.mjs` | Loopback HTTP server, JSON API and server-sent events |
 | `lib/model.mjs` | Loads the committed research files |
+| `ui/format.mjs` | Shared display formatting and harness labels used by the canvas, source reports and status text |
 | `ui/` | Static front end (no build step, no dependencies) |
 
 After editing, reload extensions in the app. Tests live in
 [`test/attributionCanvas.test.js`](../../../test/attributionCanvas.test.js) and
-[`test/recipeCanvas.test.js`](../../../test/recipeCanvas.test.js).
+[`test/recipeCanvas.test.js`](../../../test/recipeCanvas.test.js) and
+[`test/recipeActors.test.js`](../../../test/recipeActors.test.js) and
+[`test/recipeBilling.test.js`](../../../test/recipeBilling.test.js).
 
 ## Reuse
 
diff --git a/.github/extensions/ai-attribution/extension.mjs b/.github/extensions/ai-attribution/extension.mjs
index f2a7df7..b808b9c 100644
--- a/.github/extensions/ai-attribution/extension.mjs
+++ b/.github/extensions/ai-attribution/extension.mjs
@@ -10,6 +10,9 @@ import { EXTENSION_DIR, MODEL_SECTIONS, loadModel, loadResearch } from './lib/mo
 import { recipeView } from './lib/recipe.mjs';
 import { startCanvasServer } from './lib/server.mjs';
 import { verifyRecipe } from './lib/verify.mjs';
+import { validateIdentityLinks } from './lib/actors.mjs';
+import { fetchBilling, billingView } from './lib/billing.mjs';
+import { sourceLabels as SOURCE_NAMES } from './ui/format.mjs';
 
 const VIEWS = ['outcomes', 'recipe', 'surfaces', 'intersection', 'model', 'gaps', 'coverage', 'research'];
 const DEFAULT_WINDOW_DAYS = 30;
@@ -62,7 +65,6 @@ function summarize(coverage) {
   };
 }
 
-const SOURCE_NAMES = { sessionStore: 'CLI/app', traces: 'VS Code', agentHost: 'VS Code Copilot harness' };
 
 function statusLine(coverage) {
   const window = coverage.window.days ? `${coverage.window.days}-day window` : 'All history';
@@ -84,7 +86,30 @@ function instanceFor(ctx) {
 }
 
 async function recipeFor(instance) {
-  return recipeView((await coverageFor(instance.options)).recipe, instance.verification);
+  const recipe = (await coverageFor(instance.options)).recipe;
+  return {
+    ...recipeView(recipe, instance.verification, { identityLinks: instance.identityLinks }),
+    billing: billingView(instance.billing, recipe),
+  };
+}
+
+async function readBilling(instance, scope) {
+  if (instance.readingBilling) throw new CanvasError('busy', 'A billing request is already running.');
+  instance.readingBilling = true;
+  instance.billing = null;
+  try {
+    instance.billing = await fetchBilling(scope);
+    instance.server.broadcast('recipe', {});
+    return recipeFor(instance);
+  } finally {
+    instance.readingBilling = false;
+  }
+}
+
+async function setIdentityLinks(instance, links) {
+  instance.identityLinks = validateIdentityLinks(links);
+  instance.server.broadcast('recipe', {});
+  return recipeFor(instance);
 }
 
 /** Explicit network step: asks GitHub and Azure Boards about the cycles already found locally. */
@@ -103,8 +128,26 @@ async function verifyInstance(instance, organization) {
   return recipeFor(instance);
 }
 
-function summarizeRecipe(view) {
+function summarizeRecipe(view, filter = {}) {
+  const developerSources = view.developers.sources
+    .filter((source) => !filter.sourceId || source.id === filter.sourceId)
+    .map((source) => {
+      const owned = filter.perspective === 'ownership';
+      const selected = filter.actorKey === '__unknown' ? source[owned ? 'unowned' : 'unknown'] :
+        filter.actorKey ? source.actors.find((actor) => actor.key === filter.actorKey)?.[owned ? 'ownership' : 'usage'] :
+          owned ? source.ownership : source;
+      return { id: source.id, summary: selected ? {
+        total: selected.total, measured: selected.measured, inferred: selected.inferred, unattributed: selected.unattributed,
+        work: selected.work.map((row) => {
+          const cycle = view.cycles.find((c) => c.key === row.cycleKey);
+          return { ...row, repository: cycle?.repository ?? null, branch: cycle?.branch ?? null,
+            workItems: cycle?.workItems.map((w) => w.reference) ?? [], pullRequest: cycle?.pullRequest?.number ?? null };
+        }),
+      } : null };
+    });
   return {
+    billing: view.billing,
+    developers: { actors: view.developers.actors, identityLinks: view.developers.identityLinks, sources: developerSources, perspective: filter.perspective ?? 'usage' },
     verification: view.verification,
     totals: view.totals,
     stations: view.stations.map(({ id, any, strict, unknown }) => ({ id, any, strict, unknown })),
@@ -114,6 +157,7 @@ function summarizeRecipe(view) {
       repository: c.repository,
       branch: c.branch,
       workItems: c.workItems.map((w) => w.reference),
+      ownership: c.ownership,
       pullRequest: c.pullRequest?.number ?? null,
       reached: c.reached,
       steps: Object.fromEntries(Object.entries(c.steps).map(([id, s]) => [id, s.state])),
@@ -130,6 +174,9 @@ async function openInstance(ctx) {
       options: { windowDays: DEFAULT_WINDOW_DAYS },
       verification: null,
       verifying: null,
+      identityLinks: [],
+      billing: null,
+      readingBilling: false,
     };
     instance.server = await startCanvasServer({
       uiDir: UI_DIR,
@@ -145,6 +192,8 @@ async function openInstance(ctx) {
         },
         recipe: () => recipeFor(instance),
         verify: ({ azureDevOpsOrg } = {}) => verifyInstance(instance, azureDevOpsOrg),
+        identityLinks: (links) => setIdentityLinks(instance, links),
+        billing: (scope) => readBilling(instance, scope),
         getView: () => instance.view,
         setView: (view) => {
           if (VIEWS.includes(view)) instance.view = view;
@@ -163,6 +212,7 @@ async function openInstance(ctx) {
   if (input.tracesDbPath !== undefined) options.tracesDbPath = input.tracesDbPath || undefined;
   if (input.agentHostTracesDbPath !== undefined) options.agentHostTracesDbPath = input.agentHostTracesDbPath || undefined;
   if (input.azureDevOpsOrg !== undefined) options.azureDevOpsOrg = input.azureDevOpsOrg || undefined;
+  if (input.identityLinks !== undefined) instance.identityLinks = validateIdentityLinks(input.identityLinks);
   instance.options = options;
 
   // Every open recomputes, so a reopened panel never shows a stale snapshot;
@@ -200,13 +250,21 @@ await joinSession({
           tracesDbPath: { type: 'string', description: "Override for VS Code's agent-traces.db." },
           agentHostTracesDbPath: {
             type: 'string',
-            description: "Override for VS Code's Copilot-harness agent-host-traces.db.",
+            description: "Override for VS Code's Copilot Agent Host harness agent-host-traces.db.",
           },
           azureDevOpsOrg: {
             type: 'string',
             description:
               'Azure DevOps organization for Recipe verification (name, https://dev.azure.com/<org> or https://<org>.visualstudio.com). Defaults to az devops configure.',
           },
+          identityLinks: {
+            type: 'array', maxItems: 32,
+            description: 'Explicit Azure Boards account-key to GitHub-login links. No display-name matching.',
+            items: {
+              type: 'object', additionalProperties: false, required: ['boardsKey', 'githubLogin'],
+              properties: { boardsKey: { type: 'string' }, githubLogin: { type: 'string' } },
+            },
+          },
         },
       },
       actions: [
@@ -250,11 +308,36 @@ await joinSession({
           inputSchema: { type: 'object', additionalProperties: false, properties: {} },
           handler: async (ctx) => withoutRecipe(await coverageFor(instanceFor(ctx).options)),
         },
+        {
+          name: 'reconcile_recipe_billing',
+          description: 'Explicitly read one completed UTC day of GitHub Copilot AI-credit billing for a user and paying account. Compare native captured consumption per source; work amounts are estimated allocations, never PR invoices.',
+          inputSchema: {
+            type: 'object', additionalProperties: false, required: ['level', 'account', 'user', 'day'],
+            properties: {
+              level: { type: 'string', enum: ['organization', 'enterprise', 'user'] },
+              account: { type: 'string' }, user: { type: 'string' },
+              day: { type: 'string', pattern: '^\\d{4}-\\d{2}-\\d{2}$' },
+            },
+          },
+          handler: async (ctx) => summarizeRecipe(await readBilling(instanceFor(ctx), ctx.input)),
+        },
         {
           name: 'get_recipe',
-          description: 'Return the Recipe summary: cycle stations, KPIs, branch-convention adherence and the latest cycles.',
-          inputSchema: { type: 'object', additionalProperties: false, properties: {} },
-          handler: async (ctx) => summarizeRecipe(await recipeFor(instanceFor(ctx))),
+          description: 'Return Recipe and developer credit attribution. Filter by actorKey/sourceId; usage separates measured from inferred, ownership shows all contributors to owned work.',
+          inputSchema: { type: 'object', additionalProperties: false, properties: {
+            actorKey: { type: 'string' }, sourceId: { type: 'string', enum: ['sessionStore', 'traces', 'agentHost'] },
+            perspective: { type: 'string', enum: ['usage', 'ownership'] },
+          } },
+          handler: async (ctx) => summarizeRecipe(await recipeFor(instanceFor(ctx)), ctx.input ?? {}),
+        },
+        {
+          name: 'set_recipe_identity_links',
+          description: 'Set explicit Azure Boards account-key to GitHub-login links for this panel. Never infer them from names or emails.',
+          inputSchema: { type: 'object', additionalProperties: false, required: ['links'], properties: {
+            links: { type: 'array', maxItems: 32, items: { type: 'object', additionalProperties: false, required: ['boardsKey', 'githubLogin'],
+              properties: { boardsKey: { type: 'string' }, githubLogin: { type: 'string' } } } },
+          } },
+          handler: async (ctx) => summarizeRecipe(await setIdentityLinks(instanceFor(ctx), ctx.input.links)),
         },
         {
           name: 'verify_recipe',
diff --git a/.github/extensions/ai-attribution/lib/actors.mjs b/.github/extensions/ai-attribution/lib/actors.mjs
new file mode 100644
index 0000000..7cf2581
--- /dev/null
+++ b/.github/extensions/ai-attribution/lib/actors.mjs
@@ -0,0 +1,139 @@
+// Provider-qualified identities. Device names, branch prefixes and display names
+// never become account keys; cross-provider links must be supplied explicitly.
+export function githubActor(login, kind = 'User') {
+  if (typeof login !== 'string' || !/^[a-z\d](?:[a-z\d-]{0,37}[a-z\d])?(?:\[bot\])?$/i.test(login)) return null;
+  const bot = kind === 'Bot' || login.endsWith('[bot]');
+  return { key: `github:${login.toLowerCase()}`, label: login, provider: 'github', bot };
+}
+
+export function telemetryActor(value) {
+  if (typeof value !== 'string') return null;
+  const name = value.trim();
+  if (!name || name.length > 128 || /[\u0000-\u001f\u007f]/.test(name)) return null;
+  return githubActor(name) ?? { key: `telemetry:${name}`, label: name, provider: 'telemetry', bot: false };
+}
+
+export function boardsActor(value, organization) {
+  if (!value || typeof value.id !== 'string' || !/^[a-f\d-]{8,64}$/i.test(value.id)) return null;
+  const label = typeof value.displayName === 'string' && value.displayName.length <= 128 && !/[\u0000-\u001f\u007f]/.test(value.displayName)
+    ? value.displayName : value.id;
+  return { key: `boards:${organization.toLowerCase()}:${value.id.toLowerCase()}`, label, provider: 'azure-boards', bot: false };
+}
+
+export function validateIdentityLinks(links) {
+  if (!Array.isArray(links) || links.length > 32) throw new Error('Provide at most 32 identity links.');
+  const seen = new Set();
+  return links.map((link) => {
+    if (!link || typeof link.boardsKey !== 'string' ||
+        !/^boards:https:\/\/(?:dev\.azure\.com\/[a-z\d-]+|[a-z\d-]+\.visualstudio\.com):[a-f\d-]{8,64}$/i.test(link.boardsKey) ||
+        !githubActor(link.githubLogin) || seen.has(link.boardsKey.toLowerCase())) {
+      throw new Error('Each identity link needs a unique Azure Boards account key and a GitHub login.');
+    }
+    const boardsKey = link.boardsKey.toLowerCase();
+    seen.add(boardsKey);
+    return { boardsKey, githubLogin: link.githubLogin };
+  });
+}
+
+function resolve(actor, links) {
+  if (!actor) return null;
+  const link = links.find((l) => l.boardsKey === actor.key);
+  return link ? { ...githubActor(link.githubLogin), linkedFrom: actor.key } : actor;
+}
+
+/** Current assignment is displayed as a role, never backdated to infer usage. */
+export function ownershipFor(workItems, pr, links) {
+  const roles = [];
+  if (pr?.author) roles.push({ role: 'PR author', actor: resolve(pr.author, links), identity: pr.author, at: pr.createdAt });
+  for (const item of workItems) {
+    for (const [field, role, at] of [
+      ['assignees', 'Assigned now', item.assignmentCheckedAt],
+      ['assigneesAtStart', 'Assigned at pickup', item.assignmentAt],
+    ]) {
+      for (const actor of item[field] ?? []) roles.push({ role, actor: resolve(actor, links), identity: actor, at, reference: item.reference });
+    }
+  }
+  const historical = roles.filter((r) => r.role !== 'Assigned now' && !r.actor.bot);
+  const candidates = [...new Map(historical.map((r) => [r.actor.key, r.actor])).values()];
+  return {
+    roles,
+    inferred: candidates.length === 1 ? candidates[0] : null,
+    inference: candidates.length === 1
+      ? [...new Set(historical.map((r) => r.role))].join(' + ')
+      : candidates.length > 1 ? 'Conflicting owners' : 'No historical owner',
+  };
+}
+
+function newTally() {
+  return { calls: 0, creditedCalls: 0, credits: 0 };
+}
+
+function add(tally, usage) {
+  tally.calls += usage.calls;
+  tally.creditedCalls += usage.creditedCalls;
+  tally.credits += usage.credits ?? 0;
+}
+
+function reported(tally) {
+  return { ...tally, credits: tally.creditedCalls ? tally.credits : null };
+}
+
+/** Partitions every source into disjoint measured, inferred and unattributed usage. */
+export function attributeUsage(sources, ownership, links) {
+  return sources.flatMap((source) => {
+    const actors = source.actors ?? [{ actor: null, calls: source.calls, creditedCalls: source.creditedCalls, credits: source.credits }];
+    return actors.map((usage) => ({
+      source: source.id,
+      ...reported(usage),
+      actor: resolve(usage.actor, links) ?? ownership?.inferred ?? null,
+      method: usage.actor ? 'measured' : ownership?.inferred ? 'inferred' : 'unattributed',
+      evidence: usage.actor ? 'user.name' : ownership?.inference ?? 'No user identity',
+    }));
+  });
+}
+
+export function developerReport(cycles, unmatched, identityLinks) {
+  const actors = new Map();
+  const entries = [
+    ...cycles.flatMap((cycle) => cycle.attribution.map((entry) => ({ ...entry, cycleKey: cycle.key }))),
+    ...attributeUsage(unmatched, null, identityLinks).map((entry) => ({ ...entry, cycleKey: null })),
+  ];
+  for (const entry of entries) if (entry.actor) actors.set(entry.actor.key, entry.actor);
+  // Owners without attributed usage remain selectable as work owners, not consumers.
+  for (const cycle of cycles) for (const role of cycle.ownership.roles) actors.set(role.actor.key, role.actor);
+  const summarize = (list, withWork = true) => {
+    const tally = { total: newTally(), measured: newTally(), inferred: newTally(), unattributed: newTally() };
+    const work = new Map();
+    for (const entry of list) {
+      add(tally.total, entry);
+      add(tally[entry.method], entry);
+      const group = work.get(entry.cycleKey) ?? [];
+      group.push(entry);
+      work.set(entry.cycleKey, group);
+    }
+    return {
+      ...Object.fromEntries(Object.entries(tally).map(([key, value]) => [key, reported(value)])),
+      ...(withWork ? { work: [...work.entries()].map(([cycleKey, group]) => ({ cycleKey, ...summarize(group, false) }))
+        .sort((a, b) => (b.total.credits ?? -1) - (a.total.credits ?? -1)) } : {}),
+    };
+  };
+  const sourceIds = [...new Set(entries.map((entry) => entry.source))];
+  const ownedCycles = new Set(cycles.filter((cycle) => cycle.ownership.roles.length).map((cycle) => cycle.key));
+  return {
+    sources: sourceIds.map((id) => {
+      const list = entries.filter((entry) => entry.source === id);
+      return {
+        id, ...summarize(list),
+        unknown: summarize(list.filter((entry) => !entry.actor)),
+        ownership: summarize(list.filter((entry) => ownedCycles.has(entry.cycleKey))),
+        unowned: summarize(list.filter((entry) => !ownedCycles.has(entry.cycleKey))),
+        actors: [...actors.keys()].map((key) => {
+          const owned = new Set(cycles.filter((cycle) => cycle.ownership.roles.some((r) => r.actor.key === key)).map((cycle) => cycle.key));
+          return { key, usage: summarize(list.filter((entry) => entry.actor?.key === key)), ownership: summarize(list.filter((entry) => owned.has(entry.cycleKey))) };
+        }),
+      };
+    }),
+    actors: [...actors.values()].sort((a, b) => a.label.localeCompare(b.label)),
+    identityLinks,
+  };
+}
diff --git a/.github/extensions/ai-attribution/lib/billing.mjs b/.github/extensions/ai-attribution/lib/billing.mjs
new file mode 100644
index 0000000..d5cef5b
--- /dev/null
+++ b/.github/extensions/ai-attribution/lib/billing.mjs
@@ -0,0 +1,155 @@
+// Explicit GitHub billing reads. Usage reconciliation is by native consumer,
+// UTC day and exact model, per source. Work-level cost is an estimated share.
+import { runCommand } from './verify.mjs';
+import { githubActor } from './actors.mjs';
+
+const AMOUNTS = ['grossQuantity', 'grossAmount', 'discountQuantity', 'discountAmount', 'netQuantity', 'netAmount'];
+const SOURCE_IDS = ['sessionStore', 'traces', 'agentHost'];
+
+function utcDay(value) {
+  return typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(value) &&
+    Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+}
+
+export function billingScope(input, now = Date.now()) {
+  const { level, account, user, day } = input ?? {};
+  if (!['organization', 'enterprise', 'user'].includes(level) ||
+      typeof account !== 'string' || !/^[a-z\d][a-z\d-]{0,99}$/i.test(account) ||
+      !githubActor(user) || !utcDay(day)) {
+    throw new Error('Choose a billing level, account, GitHub login and valid UTC day.');
+  }
+  if (day >= new Date(now).toISOString().slice(0, 10)) throw new Error('Choose a completed UTC day, not today or a future date.');
+  if (level === 'user' && account.toLowerCase() !== user.toLowerCase()) throw new Error('Personal billing can only report the selected account itself.');
+  return { level, account: account.toLowerCase(), user: user.toLowerCase(), day, product: 'Copilot' };
+}
+
+function finiteAmount(value) {
+  return typeof value === 'number' && Number.isFinite(value) && value >= 0;
+}
+
+function safeWord(value) {
+  return typeof value === 'string' && value.length > 0 && value.length <= 128 && !/[\u0000-\u001f\u007f]/.test(value);
+}
+
+export function parseBillingReport(body, scope, retrievedAt) {
+  const [year, month, day] = scope.day.split('-').map(Number);
+  if (body?.timePeriod?.year !== year || body.timePeriod.month !== month || body.timePeriod.day !== day ||
+      !Array.isArray(body.usageItems) || body.usageItems.length > 1000) throw new Error('GitHub returned a different billing period or an invalid report.');
+  const accountField = scope.level === 'organization' ? 'organization' : scope.level === 'enterprise' ? 'enterprise' : 'user';
+  for (const [field, expected] of [[accountField, scope.account], ['user', scope.user], ['product', scope.product]]) {
+    if (body[field] !== undefined && (typeof body[field] !== 'string' || body[field].toLowerCase() !== expected.toLowerCase())) {
+      throw new Error('GitHub returned a different billing account, user or product.');
+    }
+  }
+  const items = body.usageItems.map((row) => {
+    if (!safeWord(row.product) || row.product.toLowerCase() !== 'copilot' || !safeWord(row.sku) ||
+        !safeWord(row.model) || !safeWord(row.unitType) ||
+        !/^(ai[\s_-]?)?credits?$/i.test(row.unitType) ||
+        !finiteAmount(row.pricePerUnit) || !AMOUNTS.every((key) => finiteAmount(row[key]))) {
+      throw new Error('Unsupported billing units or missing amounts. No comparison was made.');
+    }
+    return {
+      product: row.product, sku: row.sku, model: row.model, unitType: row.unitType, pricePerUnit: row.pricePerUnit,
+      ...Object.fromEntries(AMOUNTS.map((key) => [key, row[key]])),
+    };
+  });
+  return { status: 'ok', scope, retrievedAt, items };
+}
+
+export async function fetchBilling(input, { run = runCommand, now = Date.now(), env = process.env } = {}) {
+  const scope = billingScope(input, now);
+  const prefix = { organization: 'organizations', enterprise: 'enterprises', user: 'users' }[scope.level];
+  const endpoint = `/${prefix}/${scope.account}/settings/billing/ai_credit/usage`;
+  const [year, month, day] = scope.day.split('-').map(Number);
+  const args = ['api', '--hostname', 'github.com', '--method', 'GET', endpoint,
+    '-H', 'Accept: application/vnd.github+json', '-H', 'X-GitHub-Api-Version: 2026-03-10',
+    '-f', `year=${year}`, '-f', `month=${month}`, '-f', `day=${day}`, '-f', 'product=Copilot'];
+  if (scope.level !== 'user') args.push('-f', `user=${scope.user}`);
+  const retrievedAt = new Date(now).toISOString();
+  try {
+    const response = await run('gh', args, { env, timeout: 30_000 });
+    if (response.missing) return { status: 'error', scope, retrievedAt, reason: 'Install gh and sign in with access to the paying account.' };
+    if (response.code !== 0) {
+      const denied = /401|403|404|auth login|bad credentials/i.test(response.stderr);
+      return { status: 'error', scope, retrievedAt,
+        reason: denied ? 'Billing access denied. Use a supported credential with billing permissions on the paying account.' : 'GitHub billing request failed or timed out. Retry explicitly.' };
+    }
+    let body;
+    try { body = JSON.parse(response.stdout); } catch { throw new Error('GitHub returned invalid billing JSON.'); }
+    return parseBillingReport(body, scope, retrievedAt);
+  } catch (err) {
+    return { status: 'error', scope, retrievedAt,
+      reason: err instanceof Error && /^(GitHub returned|Unsupported billing)/.test(err.message) ? err.message : 'Billing request failed. No billing data was retained.' };
+  }
+}
+
+function sum(rows, field) {
+  return rows.reduce((value, row) => value + row[field], 0);
+}
+
+/** A billing balance is not proof that the selected account paid for local calls. */
+export function reconcileBilling(report, recipe, sourceId) {
+  if (report?.status !== 'ok') return null;
+  if (!SOURCE_IDS.includes(sourceId)) throw new Error('Choose a supported local usage source.');
+  const scope = report.scope;
+  const rows = (recipe.billingUsage ?? []).filter((row) => row.source === sourceId && row.day === scope.day);
+  const userRows = rows.filter((row) => row.actor?.key === `github:${scope.user}`);
+  const modelRows = new Map();
+  for (const item of report.items) {
+    const key = item.model.toLowerCase();
+    const group = modelRows.get(key) ?? { model: item.model, items: [] };
+    group.items.push(item);
+    modelRows.set(key, group);
+  }
+  const allocations = new Map();
+  let matched = 0;
+  let observed = 0;
+  let reportingCalls = 0;
+  let modelDifference = false;
+  const models = [...modelRows.entries()].map(([model, group]) => {
+    const usage = userRows.filter((row) => row.model?.toLowerCase() === model);
+    const credited = usage.filter((row) => row.creditedCalls > 0);
+    const local = sum(credited, 'credits');
+    const gross = sum(group.items, 'grossQuantity');
+    const netAmount = sum(group.items, 'netAmount');
+    observed += local;
+    reportingCalls += sum(usage, 'creditedCalls');
+    matched += Math.min(local, gross);
+    if (local > gross) modelDifference = true;
+    // Never distribute more than the bill. No allocation for model mismatches,
+    // unknown consumers or unlinked work; those amounts remain unallocated.
+    if (gross > 0 && local <= gross) {
+      for (const row of credited.filter((row) => row.cycleKey)) {
+        const allocation = allocations.get(row.cycleKey) ?? { cycleKey: row.cycleKey, grossQuantity: 0, netAmount: 0, method: 'estimated-share' };
+        allocation.grossQuantity += row.credits;
+        allocation.netAmount += netAmount * row.credits / gross;
+        allocations.set(row.cycleKey, allocation);
+      }
+    }
+    return {
+      model: group.model, grossQuantity: gross, observed: credited.length ? local : null,
+      difference: credited.length ? gross - local : null,
+    };
+  });
+  const unseenModels = userRows.filter((row) => !row.model || !modelRows.has(row.model.toLowerCase()));
+  const totals = Object.fromEntries(AMOUNTS.map((field) => [field, sum(report.items, field)]));
+  const work = [...allocations.values()].sort((a, b) => b.grossQuantity - a.grossQuantity);
+  return {
+    sourceId, ...totals, models,
+    observed: reportingCalls ? observed : null,
+    difference: reportingCalls ? totals.grossQuantity - observed : null,
+    unmatchedBilling: Math.max(0, totals.grossQuantity - matched),
+    outsideModelScope: sum(unseenModels, 'credits'),
+    unknownIdentity: sum(rows.filter((row) => !row.actor), 'credits'),
+    localExceedsBilling: modelDifference,
+    work,
+    unallocatedNetAmount: Math.max(0, totals.netAmount - sum(work, 'netAmount')),
+  };
+}
+
+export function billingView(report, recipe) {
+  if (!report) return { status: 'disconnected' };
+  return { ...report,
+    sources: report.status === 'ok' ? SOURCE_IDS.map((id) => reconcileBilling(report, recipe, id)) : [],
+  };
+}
diff --git a/.github/extensions/ai-attribution/lib/coverage.mjs b/.github/extensions/ai-attribution/lib/coverage.mjs
index ce1011b..3ac454b 100644
--- a/.github/extensions/ai-attribution/lib/coverage.mjs
+++ b/.github/extensions/ai-attribution/lib/coverage.mjs
@@ -2,8 +2,8 @@
 //
 // Sources:
 //   - Copilot CLI / GitHub Copilot app session store ($COPILOT_HOME/session-store.db)
-//   - VS Code Copilot Chat span store (globalStorage/github.copilot-chat/agent-traces.db)
-//   - VS Code Agent Host span store for the Copilot harness (<userData>/agent-host/otel/agent-host-traces.db)
+//   - VS Code Local harness span store (globalStorage/github.copilot-chat/agent-traces.db)
+//   - Copilot Agent Host harness span store (<userData>/agent-host/otel/agent-host-traces.db)
 //
 // Only aggregates leave this module: counts, token and credit sums, model,
 // agent and repository names. Prompt, response and tool content are never read.
@@ -15,6 +15,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { TokenTally } from './tokenCoverage.cjs';
 import { CycleCollector, buildRecipe } from './recipe.mjs';
+import { sourceLabels } from '../ui/format.mjs';
 
 export const NANO_AIU_PER_CREDIT = 1_000_000_000;
 const DAY_MS = 86_400_000;
@@ -398,6 +399,7 @@ export function sessionStoreCoverage(db, { sinceDay = null, sinceMs = 0, cycles
       repository: sessionId ? repository : null,
       branch: session?.branch,
       session: sessionId,
+      model: row.model,
       at: t.ms ?? (t.dateOnly ? Date.parse(`${t.day}T00:00:00Z`) : null),
       nano,
       credited: hasCredit,
@@ -743,6 +745,8 @@ export function tracesCoverage(db, { sinceMs = 0, copilotRuntime = false, cycles
       branch: ctx?.branch,
       commit: ctx?.commit,
       session: stageKey,
+      user,
+      model: chat.response_model || chat.request_model,
       at,
       nano,
       credited: hasCredit,
@@ -840,7 +844,7 @@ export function tracesCoverage(db, { sinceMs = 0, copilotRuntime = false, cycles
       hasAttributes ? null : 'span_attributes not found: credits and repository context are unavailable.',
       hasAttributes && actor.calls === 0
         ? copilotRuntime
-          ? 'No user.name on agent spans: Copilot-harness identity needs the managed telemetry.capture.identity setting (VS Code 1.141+).'
+          ? 'No user.name on agent spans: the Copilot Agent Host harness needs the managed telemetry.capture.identity setting (VS Code 1.141+).'
           : 'No user.name on agent spans: turn on github.copilot.chat.otel.captureIdentity (VS Code 1.140+, Local harness) to attribute calls to a GitHub account.'
         : null,
       actor.calls > 0
@@ -917,7 +921,7 @@ export async function computeCoverage(options = {}) {
     ? await readDatabase(agentHostPath, (db) => tracesCoverage(db, { sinceMs, copilotRuntime: true, cycles }))
     : {
         status: 'missing',
-        reason: 'No agent-host-traces.db. VS Code 1.141+ stores Copilot-harness traces locally only while chat.agentHost.otel.dbSpanExporter.enabled is on.',
+        reason: 'No agent-host-traces.db. VS Code 1.141+ stores Copilot Agent Host harness traces locally only while chat.agentHost.otel.dbSpanExporter.enabled is on.',
       };
 
   return {
@@ -926,15 +930,15 @@ export async function computeCoverage(options = {}) {
     sources: [
       {
         id: 'sessionStore',
-        label: 'Copilot CLI / app session store',
+        label: sourceLabels.sessionStore,
         surfaces: ['cli', 'app'],
         path: storePath,
         ...store,
       },
-      { id: 'traces', label: 'VS Code agent-traces.db', surfaces: ['vscode'], path: tracesPath ?? null, ...traces },
+      { id: 'traces', label: sourceLabels.traces, surfaces: ['vscode'], path: tracesPath ?? null, ...traces },
       {
         id: 'agentHost',
-        label: 'VS Code Copilot harness agent-host-traces.db',
+        label: sourceLabels.agentHost,
         surfaces: ['vscode'],
         path: agentHostPath ?? null,
         ...agentHost,
diff --git a/.github/extensions/ai-attribution/lib/model.mjs b/.github/extensions/ai-attribution/lib/model.mjs
index ffd0d0b..d5612f0 100644
--- a/.github/extensions/ai-attribution/lib/model.mjs
+++ b/.github/extensions/ai-attribution/lib/model.mjs
@@ -14,7 +14,7 @@ export const MODEL_SECTIONS = [
   'concepts',
   'entities',
   'relationships',
-  'tiers',
+  'linkMethods',
   'invariants',
   'reconciliation',
   'recipe',
diff --git a/.github/extensions/ai-attribution/lib/recipe.mjs b/.github/extensions/ai-attribution/lib/recipe.mjs
index b36cab9..43a2aa4 100644
--- a/.github/extensions/ai-attribution/lib/recipe.mjs
+++ b/.github/extensions/ai-attribution/lib/recipe.mjs
@@ -9,6 +9,7 @@
 // Credits stay per source and are never summed across sources.
 
 import { branchName, parseBranchWorkItem } from './convention.mjs';
+import { telemetryActor, ownershipFor, attributeUsage, developerReport, validateIdentityLinks } from './actors.mjs';
 
 export const RECIPE_STEPS = ['workItem', 'branch', 'aiWork', 'commits', 'pullRequest', 'review', 'close'];
 const STEP_PHASE = {
@@ -66,6 +67,29 @@ function earliest(map, key, at) {
   if (known === undefined || (Number.isFinite(at) && (!Number.isFinite(known) || at < known))) map.set(key, at);
 }
 
+function usageTally() {
+  return { calls: 0, creditedCalls: 0, nano: 0, actors: new Map() };
+}
+
+function addUsage(tally, actor, nano, credited) {
+  tally.calls += 1;
+  tally.creditedCalls += credited ? 1 : 0;
+  tally.nano += credited ? nano : 0;
+  const key = actor?.key ?? '';
+  const part = tally.actors.get(key) ?? { actor, calls: 0, creditedCalls: 0, nano: 0 };
+  part.calls += 1;
+  part.creditedCalls += credited ? 1 : 0;
+  part.nano += credited ? nano : 0;
+  tally.actors.set(key, part);
+}
+
+function usageView(tally) {
+  return {
+    calls: tally.calls, creditedCalls: tally.creditedCalls, credits: credits(tally.nano),
+    actors: [...tally.actors.values()].map(({ nano, ...actor }) => ({ ...actor, credits: actor.creditedCalls ? credits(nano) : null })),
+  };
+}
+
 // ------------------------------------------------------------- collector ---
 
 /** Accumulates local evidence per (repository, branch) while coverage scans its stores. */
@@ -74,6 +98,7 @@ export class CycleCollector {
     this.cycles = new Map();
     this.unlinked = new Map();
     this.droppedRefs = 0;
+    this.billingUsage = new Map();
   }
 
   #key(repository, branch) {
@@ -102,20 +127,26 @@ export class CycleCollector {
   }
 
   /** One model call. Calls without a repository are tallied as unlinked AI work. */
-  addCall(source, { repository, branch, commit, session, at, nano = 0, credited = false }) {
+  addCall(source, { repository, branch, commit, session, at, user, model, nano = 0, credited = false }) {
+    const actor = telemetryActor(user);
+    const day = Number.isFinite(at) && at > 0 ? iso(at).slice(0, 10) : null;
+    const modelName = typeof model === 'string' && model.length <= 128 && !/[\u0000-\u001f\u007f]/.test(model) ? model.trim() || null : null;
+    const cycleKey = repository ? `${repository}#${branchName(branch) ?? ''}` : null;
+    const key = JSON.stringify([source, actor?.key ?? null, day, modelName, cycleKey]);
+    const billing = this.billingUsage.get(key) ?? { source, actor, day, model: modelName, cycleKey, calls: 0, creditedCalls: 0, nano: 0 };
+    billing.calls += 1;
+    billing.creditedCalls += credited ? 1 : 0;
+    billing.nano += credited ? nano : 0;
+    this.billingUsage.set(key, billing);
     if (!repository) {
-      const u = this.unlinked.get(source) ?? { calls: 0, creditedCalls: 0, nano: 0 };
-      u.calls += 1;
-      u.creditedCalls += credited ? 1 : 0;
-      u.nano += nano;
+      const u = this.unlinked.get(source) ?? usageTally();
+      addUsage(u, actor, nano, credited);
       this.unlinked.set(source, u);
       return;
     }
     const cycle = this.#cycle(repository, branchName(branch));
-    const s = cycle.sources.get(source) ?? { sessions: new Set(), calls: 0, creditedCalls: 0, nano: 0 };
-    s.calls += 1;
-    s.creditedCalls += credited ? 1 : 0;
-    s.nano += nano;
+    const s = cycle.sources.get(source) ?? { ...usageTally(), sessions: new Set() };
+    addUsage(s, actor, nano, credited);
     if (session) s.sessions.add(String(session));
     cycle.sources.set(source, s);
     if (Number.isFinite(at) && at > 0) {
@@ -164,13 +195,13 @@ export function buildRecipe(collector, { generatedAt, window } = {}) {
   return {
     generatedAt,
     window,
+    billingUsage: [...collector.billingUsage.values()].map(({ nano, ...row }) => ({ ...row, credits: credits(nano) })),
     truncated: Math.max(0, all.length - MAX_CYCLES),
     droppedRefs: collector.droppedRefs,
+    omitted: all.slice(MAX_CYCLES).flatMap((cycle) => [...cycle.sources.entries()].map(([id, s]) => ({ id, ...usageView(s) }))),
     unlinked: [...collector.unlinked.entries()].map(([id, u]) => ({
       id,
-      calls: u.calls,
-      creditedCalls: u.creditedCalls,
-      credits: credits(u.nano),
+      ...usageView(u),
     })),
     cycles: all.slice(0, MAX_CYCLES).map((c) => ({
       key: `${c.repository}#${c.branch ?? ''}`,
@@ -183,9 +214,7 @@ export function buildRecipe(collector, { generatedAt, window } = {}) {
       sources: [...c.sources.entries()].map(([id, s]) => ({
         id,
         sessions: s.sessions.size,
-        calls: s.calls,
-        creditedCalls: s.creditedCalls,
-        credits: credits(s.nano),
+        ...usageView(s),
       })),
       hours: [...c.hours.entries()]
         .sort((a, b) => a[0] - b[0])
@@ -284,6 +313,11 @@ function workItemsFor(cycle, checked) {
       state: verified?.state ?? null,
       category: verified?.category ?? null,
       stateReason: verified?.stateReason ?? null,
+      assignees: verified?.assignees ?? [],
+      assigneesAtStart: verified?.assigneesAtStart ?? [],
+      assignmentAt: verified?.assignmentAt ?? null,
+      assignmentCheckedAt: verified?.assignmentCheckedAt ?? null,
+      assignmentStatus: verified?.assignmentStatus ?? null,
       createdAt: verified?.createdAt ?? null,
       activatedAt: verified?.activatedAt ?? null,
       closedAt: verified?.closedAt ?? verified?.resolvedAt ?? null,
@@ -309,35 +343,34 @@ function cycleSteps(cycle, checked, workItems) {
     : step('no', null, null, workItems.length ? `${workItems.map((w) => w.reference).join(', ')} not found` : 'No work item linked');
 
   steps.branch = cycle.branch
-    ? step('yes', 'observed', cycle.first, cycle.convention ? `Follows the convention (${cycle.convention.reference})` : 'Does not follow the convention')
+    ? step('yes', 'observed', cycle.first, cycle.convention ? `Branch names work item ${cycle.convention.reference}` : 'No work-item number in the branch name')
     : step('no', null, null, 'No branch recorded');
 
-  const calls = cycle.sources.reduce((n, s) => n + s.calls, 0);
-  steps.aiWork = step('yes', 'observed', cycle.first, `${calls} model call${calls === 1 ? '' : 's'} across ${cycle.sources.length} source${cycle.sources.length === 1 ? '' : 's'}`);
+  steps.aiWork = step('yes', 'observed', cycle.first, `AI requests recorded in ${cycle.sources.length} source${cycle.sources.length === 1 ? '' : 's'}; totals stay separate`);
 
   const prCommits = pr?.commits?.total ?? 0;
   const headMoves = Math.max(0, cycle.heads.length - 1);
   if (pr && prCommits > 0) steps.commits = step('yes', 'verified', pr.commits.items[0]?.at ?? null, `${prCommits} commit${prCommits === 1 ? '' : 's'} on the PR`);
   else if (cycle.commits.length) steps.commits = step('yes', 'recorded', cycle.commits[0].at, `${cycle.commits.length} recorded commit${cycle.commits.length === 1 ? '' : 's'}`);
-  else if (headMoves) steps.commits = step('yes', 'observed', cycle.heads[1].at, `Head moved ${headMoves} time${headMoves === 1 ? '' : 's'} during AI work`);
+  else if (headMoves) steps.commits = step('yes', 'observed', cycle.heads[1].at, `The branch's recorded commit changed ${headMoves} time${headMoves === 1 ? '' : 's'} during AI work`);
   else if (pr) steps.commits = step('no', 'verified', null, 'The PR has no commits');
-  else steps.commits = step('unknown', null, null, github && !verifiedGithub ? 'Verify to read commits from the PR' : 'No commits recorded locally');
+  else steps.commits = step('unknown', null, null, github && !verifiedGithub ? 'Check delivery to load pull request commits' : 'No commits recorded locally');
 
   const mentioned = checked?.mentioned ?? [];
   if (pr) steps.pullRequest = step('yes', 'verified', pr.createdAt, `#${pr.number} (${pr.isDraft ? 'draft' : pr.state.toLowerCase()})${checked.candidates > 1 ? `, ${checked.candidates} PRs on this branch` : ''}`);
   else if (verifiedGithub) {
-    steps.pullRequest = step('no', mentioned.length ? 'verified' : null, null, mentioned.length ? `Referenced ${mentioned.map((p) => `#${p.number}`).join(', ')} on another branch` : 'No PR for this branch');
+    steps.pullRequest = step('no', mentioned.length ? 'verified' : null, null, mentioned.length ? `Mentioned ${mentioned.map((p) => `#${p.number}`).join(', ')} on another branch` : 'No pull request for this branch');
   } else if (cycle.pullRequests.length) {
     steps.pullRequest = step('yes', 'recorded', cycle.pullRequests[0].at, cycle.pullRequests.map((p) => `#${p.number}`).join(', '));
-  } else steps.pullRequest = step('unknown', null, null, github ? 'Verify to find the PR' : 'Only github.com repositories can be verified');
+  } else steps.pullRequest = step('unknown', null, null, github ? 'Check delivery to find the pull request' : 'Only github.com repositories can be checked online');
 
   if (pr) {
     const reviews = pr.reviews?.items ?? [];
     steps.review = (pr.reviews?.total ?? 0) > 0
       ? step('yes', 'verified', minIso(reviews.map((r) => r.at)), `${pr.reviews.total} review${pr.reviews.total === 1 ? '' : 's'}${pr.reviewDecision ? ` · ${pr.reviewDecision.toLowerCase().replace(/_/g, ' ')}` : ''}`)
       : step('no', 'verified', null, 'No reviews');
-  } else if (steps.pullRequest.state === 'no') steps.review = step('no', null, null, 'No PR');
-  else steps.review = step('unknown', null, null, 'Verify to read reviews');
+  } else if (steps.pullRequest.state === 'no') steps.review = step('no', null, null, 'No pull request');
+  else steps.review = step('unknown', null, null, 'Check delivery to load reviews');
 
   if (pr) {
     const merged = pr.state === 'MERGED';
@@ -348,8 +381,8 @@ function cycleSteps(cycle, checked, workItems) {
     else if (open.length) steps.close = step('no', 'verified', null, `Merged; ${open.map((w) => `${w.reference} ${w.state ?? 'open'}`).join(', ')}`);
     else if (unchecked.length) steps.close = step('unknown', 'verified', pr.mergedAt, `Merged; ${unchecked.map((w) => w.reference).join(', ')} not verified`);
     else steps.close = step('yes', 'verified', maxIso([pr.mergedAt, ...items.map((w) => w.closedAt)]), items.length ? `Merged; ${items.map((w) => w.reference).join(', ')} closed` : 'Merged; no work item to close');
-  } else if (steps.pullRequest.state === 'no') steps.close = step('no', null, null, 'No PR');
-  else steps.close = step('unknown', null, null, 'Verify to read merge and closure');
+  } else if (steps.pullRequest.state === 'no') steps.close = step('no', null, null, 'No pull request');
+  else steps.close = step('unknown', null, null, 'Check delivery to load merge and work-item status');
 
   return steps;
 }
@@ -412,12 +445,15 @@ function sourceCredits(cycles) {
  * The Recipe view model. `verification` is verify.mjs output or null; cycles
  * it did not cover stay unverified, and unknown steps stay unknown, not zero.
  */
-export function recipeView(recipe, verification = null) {
+export function recipeView(recipe, verification = null, { identityLinks = [] } = {}) {
+  const links = validateIdentityLinks(identityLinks);
   const cycles = (recipe?.cycles ?? []).map((cycle) => {
-    const checked = verification?.cycles?.[cycle.key] ?? null;
+    const candidate = verification?.cycles?.[cycle.key] ?? null;
+    const checked = candidate?.activityFirst && candidate.activityFirst !== cycle.first ? null : candidate;
     const workItems = workItemsFor(cycle, checked);
     const steps = cycleSteps(cycle, checked, workItems);
     const pr = checked?.pullRequest ?? null;
+    const ownership = ownershipFor(workItems, pr, links);
     let strict = 0;
     for (const id of RECIPE_STEPS) {
       if (steps[id].state !== 'yes') break;
@@ -436,6 +472,8 @@ export function recipeView(recipe, verification = null) {
       first: cycle.first,
       last: cycle.last,
       sources: cycle.sources,
+      ownership,
+      attribution: attributeUsage(cycle.sources, ownership, links),
       verified: Boolean(checked?.github),
       workItems,
       pullRequest: pr,
@@ -498,6 +536,7 @@ export function recipeView(recipe, verification = null) {
       droppedRefs: recipe?.droppedRefs ?? 0,
       unlinked: recipe?.unlinked ?? [],
     },
+    developers: developerReport(cycles, [...(recipe?.unlinked ?? []), ...(recipe?.omitted ?? [])], links),
     stations,
     adherence: {
       cycles: cycles.length,
diff --git a/.github/extensions/ai-attribution/lib/server.mjs b/.github/extensions/ai-attribution/lib/server.mjs
index 749348d..e9baf99 100644
--- a/.github/extensions/ai-attribution/lib/server.mjs
+++ b/.github/extensions/ai-attribution/lib/server.mjs
@@ -52,6 +52,8 @@ async function readJson(req) {
  *     model(): Promise<unknown>, research(): Promise<string>,
  *     coverage(): Promise<unknown>, refresh(windowDays?: number): Promise<unknown>,
  *     recipe?(): Promise<unknown>, verify?(options: { azureDevOpsOrg?: string }): Promise<unknown>,
+ *     identityLinks?(links: unknown): Promise<unknown>,
+ *     billing?(scope: unknown): Promise<unknown>,
  *     getView(): string, setView(view: string): string, windowDays(): number,
  *   },
  * }} options
@@ -126,6 +128,16 @@ export async function startCanvasServer({ uiDir, api }) {
         send(res, 200, await api.verify({ azureDevOpsOrg: org }));
         return;
       }
+      if (req.method === 'POST' && url.pathname === '/api/recipe/identity-links' && api.identityLinks) {
+        const body = await readJson(req);
+        send(res, 200, await api.identityLinks(body.links));
+        return;
+      }
+      if (req.method === 'POST' && url.pathname === '/api/recipe/billing' && api.billing) {
+        const body = await readJson(req);
+        send(res, 200, await api.billing(body));
+        return;
+      }
       if (req.method === 'POST' && url.pathname === '/api/view') {
         const body = await readJson(req);
         send(res, 200, { view: api.setView(String(body.view ?? '')) });
diff --git a/.github/extensions/ai-attribution/lib/verify.mjs b/.github/extensions/ai-attribution/lib/verify.mjs
index 450dd9d..bf80c72 100644
--- a/.github/extensions/ai-attribution/lib/verify.mjs
+++ b/.github/extensions/ai-attribution/lib/verify.mjs
@@ -3,8 +3,8 @@
 //
 // Only identifiers already recorded locally are sent: repository, branch and
 // PR, issue or work-item numbers. Queries select states, dates, types, review
-// states and commit IDs; titles, descriptions, commit messages, comments and
-// logins are never requested. GitHub calls go through the signed-in `gh` CLI
+// states, commit IDs and actor/assignment metadata. Titles, descriptions,
+// commit messages and comments are never requested. GitHub uses the signed-in CLI
 // (no shell; values are GraphQL variables). Azure Boards uses a token from
 // `az account get-access-token` or AZURE_DEVOPS_EXT_PAT, held only in memory.
 
@@ -14,6 +14,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { branchName } from './convention.mjs';
 import { isGitHubRepository } from './recipe.mjs';
+import { githubActor, boardsActor } from './actors.mjs';
 
 /** Azure DevOps' Entra resource ID, used to request a token from the Azure CLI. */
 export const AZURE_DEVOPS_RESOURCE = '499b84ac-1321-427f-aa17-267ca6975798';
@@ -32,6 +33,7 @@ const WORK_ITEM_FIELDS = [
   'System.WorkItemType',
   'System.State',
   'System.TeamProject',
+  'System.AssignedTo',
   'System.CreatedDate',
   'Microsoft.VSTS.Common.ActivatedDate',
   'Microsoft.VSTS.Common.ResolvedDate',
@@ -71,12 +73,22 @@ function firstLine(value) {
 // ---------------------------------------------------------------- GitHub ---
 
 const ISSUE_TYPE = 'issueType { name }';
+const ASSIGNMENT_FIELDS = `assignees(first: 20) { totalCount nodes { login } }
+  timelineItems(first: 100, itemTypes: [ASSIGNED_EVENT, UNASSIGNED_EVENT]) {
+    pageInfo { hasNextPage }
+    nodes {
+      __typename
+      ... on AssignedEvent { createdAt assignee { __typename ... on User { login } ... on Bot { login } } }
+      ... on UnassignedEvent { createdAt assignee { __typename ... on User { login } ... on Bot { login } } }
+    }
+  }`;
 
 function prFields(issueType) {
   return `number state isDraft createdAt mergedAt closedAt headRefName baseRefName reviewDecision
+    author { login __typename }
     reviews(first: 50) { totalCount nodes { state submittedAt } }
     commits(first: 100) { totalCount nodes { commit { oid committedDate } } }
-    closingIssuesReferences(first: 10) { nodes { number state stateReason createdAt closedAt repository { nameWithOwner } ${issueType ? ISSUE_TYPE : ''} } }`;
+    closingIssuesReferences(first: 10) { nodes { number state stateReason createdAt closedAt repository { nameWithOwner } ${issueType ? ISSUE_TYPE : ''} ${ASSIGNMENT_FIELDS} } }`;
 }
 
 /** One GraphQL document per repository batch. Values are variables, never interpolated. */
@@ -92,7 +104,7 @@ export function githubQuery(lookups, { issueType = true } = {}) {
       return `${l.alias}: pullRequests(headRefName: $${l.alias}, first: 5, orderBy: { field: CREATED_AT, direction: DESC }) { totalCount nodes { ${prFields(issueType)} } }`;
     }
     vars.push(`$${l.alias}: Int!`);
-    return `${l.alias}: issueOrPullRequest(number: $${l.alias}) { __typename ... on Issue { number state stateReason createdAt closedAt ${issueType ? ISSUE_TYPE : ''} } }`;
+    return `${l.alias}: issueOrPullRequest(number: $${l.alias}) { __typename ... on Issue { number state stateReason createdAt closedAt ${issueType ? ISSUE_TYPE : ''} ${ASSIGNMENT_FIELDS} } }`;
   });
   return `query(${vars.join(', ')}) { repository(owner: $owner, name: $name) { ${fields.join(' ')} } }`;
 }
@@ -104,7 +116,7 @@ function githubArgs(repository, lookups, issueType) {
   return args;
 }
 
-function issueFrom(node) {
+function issueFrom(node, pickup, checkedAt) {
   if (!node || node.__typename !== 'Issue') return { found: false };
   return {
     found: true,
@@ -114,6 +126,35 @@ function issueFrom(node) {
     createdAt: date(node.createdAt),
     closedAt: date(node.closedAt),
     type: text(node.issueType?.name, 64),
+    ...githubAssignments(node, pickup, checkedAt),
+  };
+}
+
+export function githubAssignments(node, pickup, checkedAt) {
+  const current = (node.assignees?.nodes ?? []).map((a) => githubActor(a?.login)).filter(Boolean);
+  const events = node.timelineItems?.nodes;
+  const complete = node.timelineItems?.pageInfo?.hasNextPage === false && Array.isArray(events);
+  const at = Date.parse(pickup ?? '');
+  const assignees = new Map();
+  let valid = complete && Number.isFinite(at);
+  for (const event of events ?? []) {
+    const actor = githubActor(event?.assignee?.login, event?.assignee?.__typename);
+    const time = Date.parse(event?.createdAt ?? '');
+    if (!actor || !Number.isFinite(time) || !['AssignedEvent', 'UnassignedEvent'].includes(event.__typename)) {
+      valid = false;
+      continue;
+    }
+    if (time <= at) {
+      if (event.__typename === 'AssignedEvent') assignees.set(actor.key, actor);
+      else assignees.delete(actor.key);
+    }
+  }
+  return {
+    assignees: current,
+    assigneesAtStart: valid ? [...assignees.values()] : [],
+    assignmentAt: valid ? date(pickup) : null,
+    assignmentCheckedAt: date(checkedAt),
+    assignmentStatus: valid ? 'history' : complete ? 'unknown' : 'history unavailable or truncated',
   };
 }
 
@@ -121,6 +162,7 @@ export function prFrom(node) {
   if (!node || !Number.isInteger(node.number)) return null;
   return {
     number: node.number,
+    author: githubActor(node.author?.login, node.author?.__typename),
     state: word(node.state),
     isDraft: node.isDraft === true,
     createdAt: date(node.createdAt),
@@ -155,6 +197,7 @@ export function prFrom(node) {
         closedAt: date(i.closedAt),
         repository: text(i.repository?.nameWithOwner, 140),
         type: text(i.issueType?.name, 64),
+        assignment: { assignees: i.assignees, timelineItems: i.timelineItems },
       })),
   };
 }
@@ -247,10 +290,16 @@ async function verifyGitHub(cycles, { run, env, now }) {
       const recorded = plan.prs.map((l) => prFrom(data[l.alias])).filter(Boolean);
       const matching = new Map([...onBranch, ...recorded.filter((pr) => pr.headRefName === cycle.branch)].map((pr) => [pr.number, pr]));
       const issues = {};
-      for (const { id, lookup } of plan.issues) issues[id] = issueFrom(data[lookup.alias]);
+      const checkedAt = new Date(now).toISOString();
+      for (const { id, lookup } of plan.issues) issues[id] = issueFrom(data[lookup.alias], cycle.first, checkedAt);
+      const chosen = choosePullRequest([...matching.values()], cycle, now);
+      if (chosen) chosen.closingIssues = chosen.closingIssues.map(({ assignment, ...issue }) => ({
+        ...issue, ...githubAssignments(assignment ?? {}, cycle.first, checkedAt),
+      }));
       results[cycle.key] = {
         github: true,
-        pullRequest: choosePullRequest([...matching.values()], cycle, now),
+        activityFirst: cycle.first,
+        pullRequest: chosen,
         candidates: matching.size,
         mentioned: recorded.filter((pr) => pr.headRefName !== cycle.branch).map((pr) => ({ number: pr.number, headRefName: pr.headRefName })),
         issues,
@@ -358,10 +407,15 @@ async function azureGet(fetchImpl, url, authorization) {
     await res.body?.cancel?.();
     throw new Error(`Azure DevOps request failed (HTTP ${res.status})`);
   }
-  return JSON.parse(await readBounded(res));
+  const body = await readBounded(res);
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new Error('Azure DevOps returned invalid JSON.');
+  }
 }
 
-async function verifyBoards(ids, { organization, run, fetch: fetchImpl, env, home, platform }) {
+async function verifyBoards(ids, { organization, run, fetch: fetchImpl, env, home, platform, cycles, now }) {
   const org = normalizeOrganization(organization ?? '') ?? configuredOrganization({ env, home });
   if (!ids.length) return { status: 'skipped', reason: 'No branch follows the AB123 convention.', organization: org, checked: 0, items: {} };
   if (!org) {
@@ -377,6 +431,8 @@ async function verifyBoards(ids, { organization, run, fetch: fetchImpl, env, hom
   if (!auth.header) return { status: 'unavailable', reason: auth.reason, organization: org, checked: 0, items: {} };
 
   const items = {};
+  const snapshots = {};
+  const warnings = [];
   try {
     const wanted = ids.slice(0, MAX_WORK_ITEMS);
     const url = `${org}/_apis/wit/workitems?ids=${wanted.join(',')}&fields=${WORK_ITEM_FIELDS.join(',')}&errorPolicy=omit&api-version=7.1`;
@@ -394,6 +450,8 @@ async function verifyBoards(ids, { organization, run, fetch: fetchImpl, env, hom
         type,
         state: text(f['System.State'], 64),
         category: null,
+        assignees: [boardsActor(f['System.AssignedTo'], org)].filter(Boolean),
+        assignmentCheckedAt: new Date(now).toISOString(),
         createdAt: date(f['System.CreatedDate']),
         activatedAt: date(f['Microsoft.VSTS.Common.ActivatedDate']),
         resolvedAt: date(f['Microsoft.VSTS.Common.ResolvedDate']),
@@ -413,15 +471,52 @@ async function verifyBoards(ids, { organization, run, fetch: fetchImpl, env, hom
         stateCategories.set(key, new Map((states?.value ?? []).map((s) => [s?.name, text(s?.category, 32)])));
       } catch (err) {
         if (err.auth) throw err;
+        warnings.push('Some work-item state categories could not be read.');
       }
     }
     for (const item of Object.values(items)) {
       if (item.found) item.category = stateCategories.get(`${item.project}\u0000${item.type}`)?.get(item.state) ?? null;
     }
+    // fields + asOf avoids the content-bearing revision/history endpoints.
+    // Snapshot at first AI activity: never backdate the current assignee.
+    const times = new Map();
+    for (const cycle of cycles.slice(0, MAX_VERIFY_CYCLES)) {
+      const at = date(cycle.first);
+      const id = cycle.convention.id;
+      if (!at || !items[id]?.found) continue;
+      const group = times.get(at) ?? [];
+      group.push({ key: cycle.key, id });
+      times.set(at, group);
+    }
+    const groups = [...times.entries()];
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(4, groups.length) }, async () => {
+      while (cursor < groups.length) {
+        const [at, group] = groups[cursor++];
+        const snapshotIds = [...new Set(group.map((c) => c.id))];
+        try {
+          const past = await azureGet(fetchImpl,
+            `${org}/_apis/wit/workitems?ids=${snapshotIds.join(',')}&fields=System.Id,System.AssignedTo&asOf=${encodeURIComponent(at)}&errorPolicy=omit&api-version=7.1`,
+            auth.header);
+          if (!Array.isArray(past?.value)) throw new Error('Invalid assignment snapshot.');
+          const rows = new Map(past.value.map((row) => [row.id, row]));
+          for (const { key, id } of group) {
+            const row = rows.get(id);
+            snapshots[key] = {
+              assigneesAtStart: row ? [boardsActor(row.fields?.['System.AssignedTo'], org)].filter(Boolean) : [],
+              assignmentAt: at,
+              assignmentStatus: row ? 'snapshot at pickup' : 'not present at pickup',
+            };
+          }
+        } catch {
+          warnings.push('Some historical assignments could not be read; current assignees are not used as historical owners.');
+        }
+      }
+    }));
   } catch (err) {
     return { status: 'error', reason: err instanceof Error ? err.message : String(err), organization: org, checked: 0, items: {} };
   }
-  return { status: 'ok', reason: null, organization: org, checked: Object.keys(items).length, items };
+  return { status: warnings.length ? 'partial' : 'ok', reason: [...new Set(warnings)].join(' ') || null, organization: org, checked: Object.keys(items).length, items, snapshots };
 }
 
 // ------------------------------------------------------------ entry point ---
@@ -452,14 +547,18 @@ export async function verifyRecipe(recipe, options = {}) {
 
   const boardsCycles = cycles.filter((c) => c.convention?.provider === 'azure-boards').slice(0, MAX_WORK_ITEMS);
   const ids = [...new Set(boardsCycles.map((c) => c.convention.id))];
-  const boards = await verifyBoards(ids, { organization, run, fetch: fetchImpl, env, home, platform });
+  const boards = await verifyBoards(ids, { organization, run, fetch: fetchImpl, env, home, platform, cycles: boardsCycles, now });
 
   const result = {};
   for (const [key, value] of Object.entries(github.cycles)) result[key] = value;
   for (const cycle of boardsCycles) {
     const item = boards.items[cycle.convention.id];
     if (!item) continue;
-    result[cycle.key] = { ...(result[cycle.key] ?? { github: false }), workItems: { [cycle.convention.id]: item } };
+    result[cycle.key] = {
+      ...(result[cycle.key] ?? { github: false }),
+      activityFirst: cycle.first,
+      workItems: { [cycle.convention.id]: { ...item, ...(boards.snapshots?.[cycle.key] ?? { assignmentStatus: 'history unavailable' }) } },
+    };
   }
 
   return {
diff --git a/.github/extensions/ai-attribution/ui/app.js b/.github/extensions/ai-attribution/ui/app.js
index 8cdb12a..87a8825 100644
--- a/.github/extensions/ai-attribution/ui/app.js
+++ b/.github/extensions/ai-attribution/ui/app.js
@@ -1,46 +1,44 @@
 import { h, s, disclosure } from './dom.js';
-import { renderMarkdown } from './markdown.js';
 import { intersectConcepts } from './intersection.mjs';
-import { coverageText, formatTokens } from './format.mjs';
+import { coverageText, formatTokens, entityLabels, sourceLabels as SOURCE_SHORT } from './format.mjs';
 import { renderRecipe } from './recipe.mjs';
 import { initializeTheme } from './theme.mjs';
 
 const VIEWS = [
-  { id: 'outcomes', label: 'Outcomes' },
+  { id: 'outcomes', label: 'Overview' },
   { id: 'recipe', label: 'Recipe' },
-  { id: 'surfaces', label: 'Surfaces' },
-  { id: 'intersection', label: 'Intersection' },
-  { id: 'model', label: 'Data model' },
-  { id: 'gaps', label: 'Gaps' },
-  { id: 'coverage', label: 'Live coverage' },
+  { id: 'surfaces', label: 'Data sources' },
+  { id: 'model', label: 'How it connects' },
+  { id: 'gaps', label: 'Missing data' },
+  { id: 'coverage', label: 'Local usage' },
   { id: 'research', label: 'Research' },
 ];
 const WINDOWS = [
   { days: 7, label: 'Last 7 days' },
   { days: 30, label: 'Last 30 days' },
   { days: 90, label: 'Last 90 days' },
-  { days: 0, label: 'All retained history' },
+  { days: 0, label: 'All available history' },
 ];
-const AVAILABILITY_TEXT = {
-  local: 'Local',
-  'needs-vcs-join': 'Needs delivery data',
-  'needs-org-api': 'Needs billing',
-  'needs-baseline': 'Needs baseline',
-};
-const SOURCE_SHORT = { sessionStore: 'CLI / app', traces: 'VS Code', agentHost: 'VS Code Copilot harness' };
 
 const state = {
   view: 'outcomes',
   model: null,
   coverage: null,
-  research: null,
   group: 'all',
+  sharedOnly: false,
   busy: false,
   recipe: null,
   verifying: false,
   org: '',
   expanded: new Set(),
   showAllCycles: false,
+  developerSource: '',
+  developerActor: '',
+  developerPerspective: 'usage',
+  allDeveloperWork: false,
+  recipeError: null,
+  readingBilling: false,
+  billingForm: {},
 };
 const main = document.getElementById('view');
 
@@ -48,7 +46,10 @@ const main = document.getElementById('view');
 
 async function api(path, init) {
   const res = await fetch(path, init);
-  if (!res.ok) throw new Error(`${path}: ${res.status}`);
+  if (!res.ok) {
+    const body = await res.json();
+    throw new Error(typeof body.error === 'string' ? body.error : `${path}: ${res.status}`);
+  }
   return res.json();
 }
 
@@ -86,24 +87,76 @@ function statTiles(items) {
   ));
 }
 
-function outcomeTable(m) {
-  return h('table', {},
-    h('thead', {}, h('tr', {}, h('th', {}, 'Outcome'), h('th', {}, 'Measure'), h('th', {}, 'Status'))),
-    h('tbody', {}, m.outcomes.map((o) => h('tr', {},
-      h('td', {}, o.name), h('td', {}, o.measure), h('td', {}, badge(o.availability, AVAILABILITY_TEXT[o.availability])),
-    ))),
+// --------------------------------------------------------------- views ---
+
+function overviewMap() {
+  const box = ({ id, x, y, w = 320, h = 60, title, lines, kind = '' }) =>
+    s('g', { class: `overview-node ${kind}`, 'data-overview-node': id },
+      s('rect', { x, y, width: w, height: h, rx: 10 }),
+      s('text', { x: x + 14, y: y + 24, class: 'overview-node-title' }, title),
+      lines.map((line, index) => s('text', { x: x + 14, y: y + 44 + index * 17, class: 'overview-node-detail' }, line)),
+    );
+  const edges = [
+    ['source-sessionStore', 'usage', 'M340 95 H380 V90 H420', false],
+    ['source-traces', 'usage', 'M340 175 H380 V90 H420', false],
+    ['source-agentHost', 'usage', 'M340 255 H380 V90 H420', false],
+    ['usage', 'recipe', 'M570 123 V190', false],
+    ['work-platforms', 'recipe', 'M340 365 H395 V280 H420', true],
+    ['recipe', 'work-summary', 'M720 230 H765 V105 H800', false],
+    ['recipe', 'delivery-summary', 'M720 285 H780 V250 H800', false],
+    ['usage', 'billing-summary', 'M720 105 H740 V400 H780 V460 H800', false],
+    ['billing', 'billing-summary', 'M340 460 H800', true],
+  ];
+  return h('figure', { class: 'card overview-map', 'aria-label': 'Executive summary: data sources, usage records, Recipe and bill comparison' },
+    s('svg', { viewBox: '0 0 1200 525', role: 'img', 'aria-label': 'Local Copilot records feed account and usage records, then Recipe links them to work and delivery. Requested GitHub and Azure Boards checks add work details. GitHub billing is compared separately using recorded accounts, dates and models.' },
+      s('defs', {}, s('marker', { id: 'overview-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 6, markerHeight: 6, orient: 'auto' },
+        s('path', { d: 'M0 0 L10 5 L0 10 Z' }),
+      )),
+      s('text', { x: 20, y: 34, class: 'overview-group' }, 'LOCAL USAGE RECORDS'),
+      s('text', { x: 800, y: 34, class: 'overview-group' }, 'QUESTIONS WE CAN ANSWER'),
+      s('text', { x: 20, y: 320, class: 'overview-group' }, 'CHECKS YOU REQUEST'),
+      edges.map(([from, to, d, requested]) =>
+        s('path', { d, class: `overview-edge${requested ? ' requested' : ''}`, 'marker-end': 'url(#overview-arrow)',
+          'data-overview-from': from, 'data-overview-to': to })),
+      [
+        ['sessionStore', 'Sessions, credits and branches', 65],
+        ['traces', 'Requests and account details', 145],
+        ['agentHost', 'Requests and account details', 225],
+      ].map(([id, detail, y]) => box({ id: `source-${id}`, x: 20, y, title: SOURCE_SHORT[id], lines: [detail] })),
+      box({ id: 'usage', x: 420, y: 58, w: 300, h: 65, title: 'Keep each source separate', lines: ['Account, session, requests and credits'] }),
+      s('g', { class: 'overview-node recipe', 'data-overview-node': 'recipe' },
+        s('rect', { x: 420, y: 190, width: 300, height: 175, rx: 12 }),
+        s('text', { x: 438, y: 221, class: 'overview-node-title' }, 'Recipe'),
+        s('text', { x: 438, y: 253, class: 'overview-step' }, 'Work item → branch'),
+        s('text', { x: 438, y: 282, class: 'overview-step' }, 'AI work → commits'),
+        s('text', { x: 438, y: 311, class: 'overview-step' }, 'Pull request → review → merge & close'),
+        s('text', { x: 438, y: 344, class: 'overview-node-detail' }, 'One cycle per branch'),
+      ),
+      box({ id: 'work-platforms', x: 20, y: 335, h: 65, kind: 'requested', title: 'GitHub + Azure Boards',
+        lines: ['Work owners and delivery records'] }),
+      box({ id: 'billing', x: 20, y: 430, h: 65, kind: 'requested', title: 'GitHub billing',
+        lines: ['Daily credits, discounts and charges'] }),
+      box({ id: 'work-summary', x: 800, y: 65, w: 380, h: 80, kind: 'answer', title: 'Who worked on what?',
+        lines: ['Known accounts, estimates and unknowns'] }),
+      box({ id: 'delivery-summary', x: 800, y: 210, w: 380, h: 80, kind: 'answer', title: 'Was the work delivered?',
+        lines: ['Review, merge and closure'] }),
+      box({ id: 'billing-summary', x: 800, y: 420, w: 380, h: 80, kind: 'answer', title: 'Usage vs bill',
+        lines: ['Same account, UTC day and model', 'Estimated costs, not per-change bills'] }),
+    ),
+    h('figcaption', { class: 'muted small' }, 'Solid: local records. Dashed: checks you request. A source shown here may not be recording data.'),
   );
 }
 
-// --------------------------------------------------------------- views ---
-
 function renderOutcomes() {
   const m = state.model;
   const sources = okSources();
-  const live = m.outcomes.filter((o) => o.liveMetric);
-  const names = { coverage: 'PR references', repo_coverage: 'Repository', credit_coverage: 'Credit reporting', actor_coverage: 'User identity', efficiency: 'Cache read' };
+  const live = m.outcomes.filter((o) => o.liveMetric && !['coverage', 'efficiency'].includes(o.id));
+  const names = { repo_coverage: 'Linked to a repository', credit_coverage: 'Requests with credit counts', actor_coverage: 'Linked to an account' };
   return [
-    h('p', { class: 'lede' }, 'Usage linked to work. Coverage, not financial return.'),
+    h('h2', { class: 'overview-title' }, 'From AI usage to work and cost'),
+    h('p', { class: 'lede overview-mission' }, 'Connect people, AI usage, work and cost—with facts, estimates and missing data clearly separated.'),
+    overviewMap(),
+    h('h2', {}, 'How much recorded AI usage can we link to work?'),
     sources.length
       ? h(
           'div',
@@ -127,19 +180,12 @@ function renderOutcomes() {
                   ),
                 ),
               ),
-              disclosure(`outcome-${o.id}`, 'Definition', h('p', {}, o.measure),
-                o.liveMetric === 'cacheReadRatio'
-                  ? h('ul', {}, sources.map((source) => h('li', {},
-                      `${SOURCE_SHORT[source.id] ?? source.label}: ${coverageText(source.metricCoverage?.cacheReadRatio, source.totals.calls)}`,
-                    )))
-                  : null,
-              ),
             ),
           ),
         )
-      : h('p', { class: 'muted' }, 'No local store could be read. See Live coverage for details.'),
-    h('p', { class: 'muted small' }, 'Sources stay separate. Missing = unknown; a PR reference does not prove delivery.'),
-    h('h2', {}, 'Credits with a PR reference'),
+      : h('p', { class: 'muted' }, 'No local usage file could be read. See Local usage for details.'),
+    h('p', { class: 'muted small' }, 'Sources stay separate. Missing is unknown; a mention is not proof of delivery.'),
+    h('h2', {}, 'Credits linked to a mentioned pull request'),
     sources.length
       ? h(
           'div',
@@ -155,23 +201,16 @@ function renderOutcomes() {
                 ? [
                     ratioBar(s.totals.credits > 0 ? pr.credits / s.totals.credits : null),
                     h('div', { class: 'split-labels small' },
-                      h('span', {}, `${fmtCredits.format(pr.credits)} cr linked`),
-                      h('span', { class: 'muted' }, `${fmtCredits.format(s.totals.credits - pr.credits)} cr unlinked`),
+                      h('span', {}, `${fmtCredits.format(pr.credits)} credits linked`),
+                      h('span', { class: 'muted' }, `${fmtCredits.format(s.totals.credits - pr.credits)} credits not linked`),
                     ),
                   ]
                 : h('p', { class: 'muted' }, 'Not measured'),
-              disclosure(`outcome-funnel-${s.id}`, `Attribution · ${creditWeighted(s) ? 'credits' : 'calls'}`, funnel(s), funnelCounts(s)),
             );
           }),
         )
       : null,
-    h('h2', {}, 'Before ROI'),
-    h('div', { class: 'flow-strip', 'aria-label': 'Inputs still needed for ROI' },
-      ['Verify delivery', 'Reconcile billed cost', 'Measure human effort', 'Compare a baseline'].map((label, i) =>
-        h('div', {}, h('span', { class: 'flow-number' }, i + 1), label),
-      ),
-    ),
-    disclosure('roi-contract', 'Measures & limits', h('p', {}, m.summary), outcomeTable(m)),
+    h('p', { class: 'callout' }, 'Savings still need evidence of business value, people’s time and similar work without AI.'),
   ];
 }
 
@@ -195,11 +234,11 @@ function renderSurfaces(intersection = false) {
             { class: 'concept' },
             disclosure(`concept-${c.id}`, h('strong', {}, c.name),
               h('span', { class: 'mono' }, c.canonical),
-              h('span', { class: 'mono' }, `OTel: ${c.otel}`),
+              h('span', { class: 'mono' }, `OpenTelemetry field: ${c.otel}`),
               c.note ? h('p', { class: 'small muted' }, c.note) : null,
             ),
             intersection
-              ? badge(c.intersectionAvailability, c.intersectionAvailability === 'native' ? 'All native' : 'Conditional')
+              ? badge(c.intersectionAvailability, c.intersectionAvailability === 'native' ? 'Reported by all' : 'Some limits')
               : null,
           ),
           m.surfaces.map((s) => {
@@ -223,19 +262,19 @@ function renderSurfaces(intersection = false) {
       'p',
       { class: 'lede' },
       intersection
-        ? `${available.length} concepts shared across five surfaces. Availability, not equivalent data.`
-        : 'What each surface emits. Expand a cell for fields and conditions.',
+        ? `${available.length} types of data appear in all five tools or reports. The detail can still differ.`
+        : 'What each Copilot tool or report provides. Expand a cell for details.',
     ),
     intersection
       ? statTiles([
-          ['Native everywhere', available.filter((c) => c.intersectionAvailability === 'native').length, 'native'],
-          ['Conditional', available.filter((c) => c.intersectionAvailability !== 'native').length, 'partial'],
-          ['Not shared', m.concepts.length - available.length, 'missing'],
+          ['Reported by all', available.filter((c) => c.intersectionAvailability === 'native').length, 'native'],
+          ['Some limits', available.filter((c) => c.intersectionAvailability !== 'native').length, 'partial'],
+          ['Not in every source', m.concepts.length - available.length, 'missing'],
         ])
       : null,
-    h('p', { class: 'muted small' }, 'Per-call, daily and panel-only data differ. No cross-source join or sum.'),
+    h('p', { class: 'muted small' }, 'Individual requests, daily totals and screen-only values are not interchangeable. Do not add overlapping sources.'),
     intersection && !concepts.length
-      ? h('p', { class: 'muted' }, 'No verified shared concepts in this group.')
+      ? h('p', { class: 'muted' }, 'No checked data is shared by every source in this group.')
       : null,
     h(
       'div',
@@ -248,6 +287,14 @@ function renderSurfaces(intersection = false) {
         ),
       ),
     ),
+    h('div', { class: 'chips', role: 'group', 'aria-label': 'Which data to show' },
+      [[false, 'All data types'], [true, 'Shared by all five']].map(([shared, label]) =>
+        h('button', {
+          'aria-pressed': String(state.sharedOnly === shared), 'data-focus-key': `scope-${shared}`,
+          onclick: () => { state.sharedOnly = shared; render(); },
+        }, label),
+      ),
+    ),
     h(
       'div',
       { class: 'chips', role: 'group', 'aria-label': 'Filter by group' },
@@ -278,7 +325,7 @@ function renderSurfaces(intersection = false) {
           h(
             'tr',
             {},
-            h('th', {}, 'Concept'),
+            h('th', {}, 'Data'),
             m.surfaces.map((s) =>
               h('th', { title: s.collection }, s.name),
             ),
@@ -287,9 +334,9 @@ function renderSurfaces(intersection = false) {
         h('tbody', {}, rows),
       ),
     ),
-    disclosure('matrix-guide', 'How to read this matrix',
+    disclosure('matrix-guide', 'How to read this table',
       h('ul', {}, m.availabilityLevels.map((l) => h('li', {}, h('strong', {}, `${l.label}: `), l.description))),
-      h('p', {}, 'Capabilities are not proof of collection. Native means directly emitted, not identical grain. Missing and unverified fields are excluded from Intersection.'),
+      h('p', {}, 'A tool may support a field without recording it here. “Reported” means the source supplies it, not that every report has the same detail. Shared data excludes fields that are not reported or not checked.'),
       h('ul', {}, m.surfaces.map((surface) => h('li', {}, h('strong', {}, `${surface.name}: `), surface.collection))),
     ),
   ];
@@ -298,38 +345,47 @@ function renderSurfaces(intersection = false) {
 function modelGraph(m) {
   const positions = {
     actor: [30, 28], ai_session: [300, 28], model_call: [570, 28], tool_call: [570, 150],
-    cost_ledger: [30, 150], work_item: [30, 272], attribution: [300, 272], outcome: [840, 272],
+    cost_ledger: [30, 410], work_item: [30, 272], attribution: [300, 272], outcome: [840, 272],
+    billing_reconciliation: [300, 410], work_allocation: [570, 410],
+  };
+  const hints = {
+    actor: 'Who used AI', ai_session: 'One coding session', model_call: 'One AI request', tool_call: 'One tool action',
+    work_item: 'Issue, branch or pull request', attribution: 'Evidence connecting the work', outcome: 'What happened to the change',
+    cost_ledger: 'Usage and actual charges', billing_reconciliation: 'Same account, day and model', work_allocation: 'A share of the bill, not proof',
   };
-  const labels = { actor: 'Actor', ai_session: 'AI session', model_call: 'Model call', tool_call: 'Tool call', cost_ledger: 'Billing', work_item: 'Work item', attribution: 'Attribution', outcome: 'Outcome' };
   const routes = {
     'actor:ai_session': 'M220 57 H300',
     'ai_session:model_call': 'M490 57 H570',
     'ai_session:tool_call': 'M490 70 H530 V179 H570',
     'ai_session:attribution': 'M395 86 V272',
     'work_item:attribution': 'M220 301 H300',
-    'work_item:outcome': 'M125 330 V375 H935 V330',
+    'work_item:outcome': 'M125 330 V365 H935 V330',
     'ai_session:outcome': 'M490 42 H800 V301 H840',
-    'cost_ledger:actor': 'M125 150 V86',
+    'cost_ledger:actor': 'M30 439 H10 V100 H125 V86',
+    'cost_ledger:billing_reconciliation': 'M220 439 H300',
+    'model_call:billing_reconciliation': 'M665 86 V118 H790 V390 H395 V410',
+    'billing_reconciliation:work_allocation': 'M490 439 H570',
+    'work_allocation:work_item': 'M665 468 V525 H255 V301 H220',
   };
   return h('figure', { class: 'card model-graph' },
-    s('svg', { viewBox: '0 0 1060 400', role: 'img', 'aria-label': 'Attribution data model: actors start AI sessions, which contain model and tool calls, link to work items, and produce outcomes. Billing reconciles separately.' },
+    s('svg', { viewBox: '0 0 1060 550', role: 'img', 'aria-label': 'AI usage links to work and results. Separately, compare the bill using the recorded account, day in UTC and model. Costs assigned to work are estimates.' },
       s('defs', {}, s('marker', { id: 'model-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 6, markerHeight: 6, orient: 'auto-start-reverse' },
         s('path', { d: 'M0 0 L10 5 L0 10 Z' }),
       )),
       m.relationships.map((r) => s('path', { d: routes[`${r.from}:${r.to}`], class: 'edge', 'marker-end': 'url(#model-arrow)' },
-        s('title', {}, `${r.from} ${r.label} ${r.to}`),
+        s('title', {}, `${entityLabels[r.from]} ${r.label} ${entityLabels[r.to]}`),
       )),
       m.entities.map((e) => {
         const [x, y] = positions[e.id];
         return s('g', { class: `model-node node-${e.id}`, 'data-entity': e.id },
-          s('title', {}, `${e.name}: ${e.grain}`),
+          s('title', {}, `${entityLabels[e.id]}: ${hints[e.id]}`),
           s('rect', { x, y, width: 190, height: 58, rx: 9 }),
-          s('text', { x: x + 14, y: y + 24, class: 'node-label' }, labels[e.id]),
-          s('text', { x: x + 14, y: y + 43, class: 'node-caption' }, e.id),
+          s('text', { x: x + 14, y: y + 24, class: 'node-label' }, entityLabels[e.id]),
+          s('text', { x: x + 14, y: y + 43, class: 'node-caption' }, hints[e.id]),
         );
       }),
     ),
-    h('figcaption', { class: 'muted small' }, 'Usage → attribution → outcomes. Billing reconciles separately; it is never added to local usage.'),
+    h('figcaption', { class: 'muted small' }, 'Compare bills by account, UTC day and model. Unexplained charges stay separate; no per-pull-request bills.'),
   );
 }
 
@@ -339,51 +395,46 @@ function renderModel() {
     h(
       'p',
       { class: 'lede' },
-      'How usage connects to work and outcomes.',
+      'How AI usage connects to people, work, results and charges.',
     ),
     modelGraph(m),
-    h('h2', {}, 'Attribution confidence'),
+    h('h2', {}, 'How strong is the link?'),
     h(
       'div',
-      { class: 'grid tier-cards' },
-      m.tiers.map((t) => h('div', { class: 'card' },
-        h('h3', {}, badge(`conf-${t.confidence.replace(/[^a-z]/g, '')}`, t.id), ' ', t.name),
-        h('p', { class: 'small muted' }, t.confidence),
-        disclosure(`tier-${t.id}`, 'Evidence', h('p', {}, t.method), h('p', {}, t.example)),
+      { class: 'grid link-methods' },
+      m.linkMethods.map((method) => h('div', { class: 'card' },
+        h('h3', {}, method.name),
+        h('p', { class: 'small muted' }, method.confidence),
+        disclosure(`link-${method.id}`, 'Why', h('p', {}, method.method), h('p', {}, method.example)),
       )),
     ),
-    disclosure('entity-fields', 'Entities & fields',
+    disclosure('entity-fields', 'Records & technical fields',
       h('div', { class: 'grid cards' }, m.entities.map((e) =>
-        h('div', { class: 'card entity' }, h('h3', {}, e.name), h('p', { class: 'muted small' }, e.grain),
+        h('div', { class: 'card entity' }, h('h3', {}, entityLabels[e.id]), h('code', {}, e.name), h('p', { class: 'muted small' }, e.grain),
           h('ul', {}, e.fields.map((f) => h('li', {}, f))),
         ),
       )),
     ),
-    disclosure('model-relationships', 'Relationships',
-      h('ul', { class: 'relations' }, m.relationships.map((r) =>
-        h('li', {}, h('code', {}, r.from), h('span', { class: 'arrow' }, `— ${r.label} →`), h('code', {}, r.to)),
-      )),
-    ),
-    disclosure('actor-provenance', 'Identity provenance',
-      h('p', {}, 'Source capability does not mean the local store collected it. Device identity is not person identity.'),
+    disclosure('actor-provenance', 'Where account details come from',
+      h('p', {}, 'Supported fields may not have been recorded here. A computer or operating-system account is not proof of who used AI.'),
       h('div', { class: 'matrix-wrap' }, h('table', {},
-        h('thead', {}, h('tr', {}, h('th', {}, 'Field'), h('th', {}, 'Origin'), h('th', {}, 'Read path'), h('th', {}, 'Conditions'))),
+        h('thead', {}, h('tr', {}, h('th', {}, 'Field'), h('th', {}, 'How supplied'), h('th', {}, 'Where to find it'), h('th', {}, 'Limits'))),
         h('tbody', {}, m.entities.find((e) => e.id === 'actor').fieldProvenance.map((p) =>
           h('tr', {}, h('td', {}, h('code', {}, p.field)),
-            h('td', {}, badge(p.kind === 'native' || p.kind === 'derived' ? p.kind : 'partial', p.kind)),
+            h('td', {}, badge(p.kind === 'native' || p.kind === 'derived' ? p.kind : 'partial', { native: 'Reported', derived: 'Calculated', configured: 'Set up manually', enriched: 'Added from another system' }[p.kind])),
             h('td', {}, p.readPath), h('td', {}, p.conditions),
           ),
         ),
         ),
       )),
     ),
-    h('p', { class: 'muted small' }, 'Missing stays unknown. Count each call once. Preserve the unattributed remainder.'),
-    disclosure('accounting-rules', 'Accounting rules',
+    h('p', { class: 'muted small' }, 'Missing is unknown, not zero. Count each AI request once. Keep usage we cannot link.'),
+    disclosure('accounting-rules', 'Counting rules',
       h('ol', {}, m.invariants.map((i) => h('li', {}, i))),
     ),
-    disclosure('billing-contract', 'Billing reconciliation',
+    disclosure('billing-contract', 'How we compare usage with the bill',
       h('p', {}, m.reconciliation.source),
-      h('p', {}, h('strong', {}, 'Grain: '), m.reconciliation.grain),
+      h('p', {}, h('strong', {}, 'Compare like for like: '), m.reconciliation.grain),
       h('ul', {}, m.reconciliation.requirements.map((rule) => h('li', {}, rule))),
       h('p', { class: 'muted small' }, m.reconciliation.allocationPolicy),
     ),
@@ -410,40 +461,12 @@ function renderGaps() {
             { class: 'chips' },
             g.surfaces.map((s) => badge('neutral', surfaceName(s))),
           ),
-          h('p', {}, h('strong', {}, 'Consequence: '), g.consequence),
-          h('p', {}, h('strong', {}, 'Mitigation: '), g.mitigation),
-        ),
-      ),
-    ),
-    disclosure('verification-status', `Verification status · ${m.verification.filter((v) => v.status === 'verified').length}/${m.verification.length} verified`,
-      h(
-      'table',
-      {},
-      h('thead', {}, h('tr', {}, h('th', {}, 'Claim'), h('th', {}, 'Status'), h('th', {}, 'Note'))),
-      h(
-        'tbody',
-        {},
-        m.verification.map((v) =>
-          h('tr', {}, h('td', {}, v.claim), h('td', {}, badge(v.status)), h('td', { class: 'muted' }, v.note)),
-        ),
-      ),
-      ),
-    ),
-    disclosure('prior-art', 'Prior art',
-      h(
-      'div',
-      { class: 'grid cards' },
-      m.priorArt.map((p) =>
-        h(
-          'div',
-          { class: 'card' },
-          h('h3', {}, p.name),
-          h('p', {}, h('strong', {}, 'Proved: '), p.proved),
-          h('p', {}, h('strong', {}, 'Learned: '), p.learned),
-          ),
+          h('p', {}, h('strong', {}, 'Why it matters: '), g.consequence),
+          h('p', {}, h('strong', {}, 'What to do: '), g.mitigation),
         ),
       ),
     ),
+    h('p', { class: 'muted small' }, 'Research summarizes the evidence and its limits.'),
   ];
 }
 
@@ -455,7 +478,7 @@ function creditWeighted(source) {
 function funnel(source) {
   const top = source.funnel[0];
   const byCredits = creditWeighted(source);
-  const labels = { observed: 'Observed', session: 'Session', repository: 'Repository', branch: 'Branch / commit', workRef: 'Work reference', pullRequest: 'PR reference' };
+  const labels = { observed: 'Recorded requests', session: 'Linked to a session', repository: 'Linked to a repository', branch: 'Branch / commit', workRef: 'Work mentioned', pullRequest: 'Pull request mentioned' };
   return h(
     'div',
     { class: 'funnel' },
@@ -472,7 +495,7 @@ function funnel(source) {
         ),
         h(
           'span',
-          { class: 'stats', title: f.emitted ? `${fmtCredits.format(f.credits)} credits · ${fmtInt.format(f.calls)} calls · ${fmtInt.format(f.sessions)} sessions` : 'Not emitted by this source' },
+          { class: 'stats', title: f.emitted ? `${fmtCredits.format(f.credits)} credits · ${fmtInt.format(f.calls)} requests · ${fmtInt.format(f.sessions)} sessions` : 'Not reported by this source' },
           f.emitted
             ? pct(ratio)
             : 'Unavailable',
@@ -484,7 +507,7 @@ function funnel(source) {
 
 function funnelCounts(source) {
   return h('div', { class: 'matrix-wrap' }, h('table', {},
-    h('thead', {}, h('tr', {}, ...['Stage', 'Sessions', 'Calls', 'Credits'].map((label) => h('th', {}, label)))),
+    h('thead', {}, h('tr', {}, ...['Step', 'Sessions', 'Requests', 'Credits'].map((label) => h('th', {}, label)))),
     h('tbody', {}, source.funnel.map((stage) => h('tr', {},
       h('td', {}, stage.label),
       ...[stage.sessions, stage.calls, stage.credits].map((value, i) =>
@@ -503,8 +526,8 @@ function breakdownTable(title, rows) {
     h('h3', {}, title),
     h('div', { class: 'breakdown-bars' }, rows.map((r) =>
       h('div', {},
-        h('div', { class: 'metric-label' }, h('span', {}, r.key),
-          h('span', { class: 'muted small' }, `${fmtCredits.format(r.credits)} cr · ${fmtInt.format(r.calls)} calls`),
+        h('div', { class: 'metric-label' }, h('span', {}, r.key === '(none)' ? 'Not recorded' : r.key),
+          h('span', { class: 'muted small' }, `${fmtCredits.format(r.credits)} credits · ${fmtInt.format(r.calls)} requests`),
         ),
         ratioBar(max > 0 ? r.credits / max : 0, `${r.key}: ${fmtCredits.format(r.credits)} credits; scaled to the largest row`),
       ),
@@ -532,7 +555,8 @@ function sourceCard(s) {
   const head = h(
     'div',
     { class: 'head' },
-    h('h2', { title: s.label }, SOURCE_SHORT[s.id] ?? s.label, ' ', badge(s.status)),
+    h('h2', { title: s.label }, SOURCE_SHORT[s.id] ?? s.label, ' ',
+      badge(s.status, { ok: 'Ready', missing: 'Not found', schema: 'Format changed', unavailable: 'Not available', error: 'Read failed' }[s.status] ?? s.status)),
   );
   if (s.status !== 'ok') return h('section', { class: 'card' }, head, h('p', {}, s.reason ?? 'Unavailable.'));
   const t = s.totals;
@@ -550,15 +574,15 @@ function sourceCard(s) {
       'div',
       { class: 'grid kpis' },
       [
-        ['Model calls', fmtInt.format(t.calls)],
+        ['AI requests', fmtInt.format(t.calls)],
         ['Reported credits', fmtCredits.format(t.credits)],
-        ['Credit reporting', pct(s.metrics.creditCoverage)],
+        ['Requests with credit counts', pct(s.metrics.creditCoverage)],
         ['Sessions', fmtInt.format(t.sessions)],
         ['Input / output tokens', `${formatTokens(t.inputTokens)} / ${formatTokens(t.outputTokens)}`],
-        ['Cache-read ratio', pct(s.metrics.cacheReadRatio)],
-        s.metrics.subAgentShare !== null ? ['Sub-agent credit share', pct(s.metrics.subAgentShare)] : null,
+        ['Reused input', pct(s.metrics.cacheReadRatio)],
+        s.metrics.subAgentShare !== null ? ['Credits used by helper agents', pct(s.metrics.subAgentShare)] : null,
         s.metrics.creditsToActorShare !== null && s.metrics.creditsToActorShare !== undefined
-          ? ['Credits with a user', pct(s.metrics.creditsToActorShare)]
+          ? ['Credits linked to an account', pct(s.metrics.creditsToActorShare)]
           : null,
       ]
         .filter(Boolean)
@@ -566,19 +590,23 @@ function sourceCard(s) {
           h('div', { class: 'kpi' }, h('div', { class: 'label' }, label), h('div', { class: 'value' }, value)),
         ),
     ),
-    h('p', { class: 'muted small' }, `${t.creditedCalls}/${t.calls} calls report credits. Cache pairs: ${coverageText(s.metricCoverage?.cacheReadRatio, t.calls)}.`),
+    h('p', { class: 'muted small' }, `${t.creditedCalls}/${t.calls} requests include credit counts. `,
+      s.metricCoverage?.cacheReadRatio?.share === null || !s.metricCoverage?.cacheReadRatio
+        ? 'Input reuse is not measured.'
+        : `Input reuse can be measured for ${coverageText(s.metricCoverage.cacheReadRatio, t.calls)}.`,
+    ),
     sparkline(s.daily),
-    h('h3', {}, `Attribution · ${creditWeighted(s) ? 'credits' : 'calls'}`),
+    h('h3', {}, `Where ${creditWeighted(s) ? 'credits' : 'requests'} can be linked`),
     funnel(s),
-    disclosure(`tokens-${s.id}`, 'Token reporting',
-      h('p', { class: 'muted small' }, 'Reported subtotals only. Missing is unknown, not zero.'),
+    disclosure(`tokens-${s.id}`, 'Token counts',
+      h('p', { class: 'muted small' }, 'Tokens are pieces of text. Totals include only requests that report each count; missing is unknown, not zero.'),
       h('table', {},
-      h('thead', {}, h('tr', {}, h('th', {}, 'Field'), h('th', { class: 'num' }, 'Tokens'), h('th', {}, 'Reporting coverage'))),
+      h('thead', {}, h('tr', {}, h('th', {}, 'Count'), h('th', { class: 'num' }, 'Tokens'), h('th', {}, 'Requests reporting this count'))),
       h('tbody', {}, [
         ['inputTokens', 'Input'],
         ['outputTokens', 'Output'],
-        ['cacheReadTokens', 'Cache read'],
-        ['cacheWriteTokens', 'Cache write'],
+        ['cacheReadTokens', 'Reused input'],
+        ['cacheWriteTokens', 'Input saved for reuse'],
         ['reasoningTokens', 'Reasoning'],
       ].map(([key, label]) => h('tr', {},
         h('td', {}, label),
@@ -592,16 +620,16 @@ function sourceCard(s) {
       'div',
       { class: 'grid two' },
       breakdownTable('By model', b.model),
-      breakdownTable(b.agent ? 'By agent' : 'By initiator', b.agent ?? b.initiator),
-      breakdownTable('By reasoning effort', b.reasoningEffort),
+      breakdownTable(b.agent ? 'By AI agent' : 'Who started the request', b.agent ?? b.initiator),
+      breakdownTable('By reasoning setting', b.reasoningEffort),
       breakdownTable('By repository', b.repository),
-      b.user ? breakdownTable('By user (user.name)', b.user) : null,
-      b.link ? breakdownTable('By repository link method', b.link) : null,
+      b.user ? breakdownTable('By recorded account', b.user) : null,
+      b.link ? breakdownTable('How the repository was linked', b.link) : null,
       s.tools?.length
         ? h(
             'div',
             {},
-            h('h3', {}, 'Tool calls · top 8 by calls'),
+            h('h3', {}, 'Tool actions · eight most used'),
             h(
               'table',
               {},
@@ -612,11 +640,11 @@ function sourceCard(s) {
                   'tr',
                   {},
                   h('th', {}, 'Tool'),
-                  h('th', { class: 'num' }, 'Calls'),
+                  h('th', { class: 'num' }, 'Actions'),
                   h(
                     'th',
-                    { class: 'num', title: 'Failed calls / calls that reported an OK or ERROR status' },
-                    'Failed / with status',
+                    { class: 'num', title: 'Failed actions / actions with a reported success or failure' },
+                    'Failed / known results',
                   ),
                 ),
               ),
@@ -642,7 +670,7 @@ function sourceCard(s) {
         : null,
       ),
     ),
-    disclosure(`source-${s.id}`, 'Source & caveats',
+    disclosure(`source-${s.id}`, 'Source & limits',
       h('p', {}, s.label),
       h('p', { class: 'mono' }, shortPath(s.path)),
       funnelCounts(s),
@@ -658,7 +686,7 @@ function renderCoverage() {
     h(
       'p',
       { class: 'lede' },
-      'Local usage, by source. No prompts or responses; no cross-source totals.',
+      'Usage recorded on this machine, shown separately for each source. No prompts or responses are read.',
     ),
     h(
       'div',
@@ -677,7 +705,7 @@ function renderCoverage() {
     c
       ? h('div', { class: 'grid coverage-sources' }, c.sources.map(sourceCard))
       : h('p', { class: 'muted' }, 'Loading coverage…'),
-    c ? disclosure('coverage-rules', 'Accounting & scope', h('ul', {}, c.caveats.map((x) => h('li', {}, x)))) : null,
+    c ? disclosure('coverage-rules', 'What these numbers include', h('ul', {}, c.caveats.map((x) => h('li', {}, x)))) : null,
   ];
 }
 
@@ -701,6 +729,28 @@ function renderRecipeView() {
     org: state.org,
     expanded: state.expanded,
     showAll: state.showAllCycles,
+    sourceId: state.developerSource,
+    actorKey: state.developerActor,
+    perspective: state.developerPerspective,
+    allWork: state.allDeveloperWork,
+    error: state.recipeError,
+    readingBilling: state.readingBilling,
+    billingForm: state.billingForm,
+    lastCompleteDay: new Date(Date.now() - 86_400_000).toISOString().slice(0, 10),
+    setBilling: (key, value) => { state.billingForm[key] = value; },
+    readBilling: (scope) => readBilling(scope),
+    setDeveloper: (key, value) => {
+      if (key === 'developer-source') state.developerSource = value;
+      if (key === 'developer-actor') state.developerActor = value;
+      if (key === 'developer-perspective') state.developerPerspective = value;
+      render();
+    },
+    toggleWork: () => { state.allDeveloperWork = !state.allDeveloperWork; render(); },
+    linkIdentity: (boardsKey, githubLogin) => saveIdentityLinks([
+      ...state.recipe.developers.identityLinks.filter((link) => link.boardsKey !== boardsKey),
+      { boardsKey, githubLogin },
+    ]),
+    unlinkIdentity: (boardsKey) => saveIdentityLinks(state.recipe.developers.identityLinks.filter((link) => link.boardsKey !== boardsKey)),
     refresh: () => refresh(),
     verify: () => verify(),
     setOrg: (value) => {
@@ -718,28 +768,35 @@ function renderRecipeView() {
 }
 
 function renderResearch() {
-  if (!state.research) return h('p', { class: 'muted' }, 'Loading research…');
-  const document = renderMarkdown(state.research);
-  const index = h('div', { class: 'md research-index' });
-  let section = disclosure('research-about', 'About this research');
-  index.append(section);
-  let number = 0;
-  for (const node of [...document.childNodes]) {
-    if (node.nodeName === 'H3') {
-      section = disclosure(`research-${number++}`, node.textContent);
-      index.append(section);
-    } else {
-      section.append(node);
-    }
-  }
+  const shared = intersectConcepts(state.model);
+  const native = shared.filter((concept) => concept.intersectionAvailability === 'native');
+  const findings = [
+    ['Different sources',
+      'VS Code has a Local harness and a Copilot Agent Host harness. Copilot CLI and the app share an engine. Cloud usage is a preview feature; organization reports contain daily totals.',
+      'Keep source and reporting period. Never sum overlapping usage.'],
+    ['Shared fields are limited',
+      `${shared.length} types of data appear in all five tools or reports; ${native.length} are reported directly by all five.`,
+      'The same type of data can have different detail. It may not contain the IDs needed to link records.'],
+    ['People need evidence',
+      'A captured account identifies who used AI. Work-item assignees and pull request authors tell us who owns or submitted the work.',
+      'Usage assigned from ownership is an estimate. A device, branch prefix or matching name does not prove who used AI.'],
+    ['Work needs verification',
+      'Repository, branch and commit records can link usage to work. Online checks add pull requests, reviews, merges and closure.',
+      'A mention does not prove who owns the work. A merge or review is not proof of quality or value.'],
+    ['Billing is separate',
+      'GitHub reports credits, discounts and final charges by account, day and model, but supplies no PR/session billing IDs.',
+      'Estimated work cost = final charge × recorded account’s work credits / billed credits, per model. Charges we cannot explain stay separate.'],
+  ];
   return [
-    h('p', { class: 'lede' }, 'The evidence behind the model. Read one section at a time.'),
-    h('div', { class: 'flow-strip' },
-      h('div', {}, h('strong', {}, 'Usage'), 'Captured locally'),
-      h('div', {}, h('strong', {}, 'Delivery'), 'Verify ownership'),
-      h('div', {}, h('strong', {}, 'Return'), 'Needs cost & baseline'),
-    ),
-    index,
+    h('p', { class: 'lede' }, 'Research in brief · what we can measure and what we cannot conclude.'),
+    h('div', { class: 'matrix-wrap research-summary' }, h('table', {},
+      h('thead', {}, h('tr', {}, h('th', {}, 'Finding'), h('th', {}, 'Evidence'), h('th', {}, 'Limit'))),
+      h('tbody', {}, findings.map(([finding, evidence, limit]) => h('tr', {},
+        h('th', { scope: 'row' }, finding), h('td', {}, evidence), h('td', {}, limit),
+      ))),
+    )),
+    h('p', { class: 'callout' }, h('strong', {}, 'Before claiming a return on investment: '),
+      'measure people’s time, business value and similar work done without AI. Credits alone show usage, not savings.'),
     disclosure('research-sources', `Sources · ${state.model.sources.length}`,
       h(
       'ul',
@@ -761,8 +818,7 @@ function renderResearch() {
 const RENDERERS = {
   outcomes: renderOutcomes,
   recipe: renderRecipeView,
-  surfaces: () => renderSurfaces(),
-  intersection: () => renderSurfaces(true),
+  surfaces: () => renderSurfaces(state.sharedOnly),
   model: renderModel,
   gaps: renderGaps,
   coverage: renderCoverage,
@@ -824,6 +880,10 @@ function render() {
 }
 
 async function selectView(view, fromUser) {
+  if (view === 'intersection') {
+    state.sharedOnly = true;
+    view = 'surfaces';
+  }
   if (!RENDERERS[view]) return;
   state.view = view;
   render();
@@ -835,10 +895,6 @@ async function selectView(view, fromUser) {
       body: JSON.stringify({ view }),
     }).catch(() => {});
   }
-  if (view === 'research' && !state.research) {
-    state.research = (await api('/api/research')).markdown;
-    render();
-  }
   if (view === 'recipe' && !state.recipe) await loadRecipe();
 }
 
@@ -856,6 +912,7 @@ async function loadRecipe() {
 async function verify() {
   if (state.verifying) return;
   state.verifying = true;
+  state.recipeError = null;
   render();
   try {
     state.recipe = await api('/api/recipe/verify', {
@@ -863,12 +920,44 @@ async function verify() {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(state.org.trim() ? { azureDevOpsOrg: state.org.trim() } : {}),
     });
+  } catch (err) {
+    state.recipeError = `Verification failed: ${err.message}`;
   } finally {
     state.verifying = false;
     render();
   }
 }
 
+async function saveIdentityLinks(links) {
+  state.recipeError = null;
+  try {
+    state.recipe = await api('/api/recipe/identity-links', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ links }),
+    });
+  } catch (err) {
+    state.recipeError = `Identity link failed: ${err.message}`;
+  }
+  render();
+}
+
+async function readBilling(scope) {
+  if (state.readingBilling) return;
+  state.readingBilling = true;
+  state.billingForm = { ...scope };
+  state.recipe = { ...state.recipe, billing: { status: 'loading' } };
+  render();
+  try {
+    state.recipe = await api('/api/recipe/billing', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(scope),
+    });
+  } catch (err) {
+    state.recipe = { ...state.recipe, billing: { status: 'error', reason: `Billing failed: ${err.message}` } };
+  } finally {
+    state.readingBilling = false;
+    render();
+  }
+}
+
 async function loadCoverage() {
   state.coverage = await api('/api/coverage');
   render();
diff --git a/.github/extensions/ai-attribution/ui/format.mjs b/.github/extensions/ai-attribution/ui/format.mjs
index 7e84494..3e3e284 100644
--- a/.github/extensions/ai-attribution/ui/format.mjs
+++ b/.github/extensions/ai-attribution/ui/format.mjs
@@ -6,5 +6,18 @@ export function formatTokens(value) {
 
 export function coverageText(coverage, calls) {
   if (!coverage || coverage.share === null) return 'Not measured';
-  return `${coverage.reportedCalls} / ${calls} calls (${Math.round(coverage.share * 100)}%)`;
+  return `${coverage.reportedCalls} / ${calls} requests (${Math.round(coverage.share * 100)}%)`;
 }
+
+export const usageLabels = { measured: 'User recorded', inferred: 'Owner estimate', unattributed: 'User unknown' };
+export const evidenceLabels = { verified: 'Checked online', recorded: 'Mentioned', convention: 'Branch name', observed: 'Local record' };
+export const sourceLabels = {
+  sessionStore: 'Copilot CLI / app',
+  traces: 'VS Code · Local harness',
+  agentHost: 'VS Code · Copilot Agent Host harness',
+};
+export const entityLabels = {
+  actor: 'Account', ai_session: 'AI session', model_call: 'AI request', tool_call: 'Tool action',
+  work_item: 'Work item', attribution: 'Link to work', outcome: 'Result',
+  cost_ledger: 'GitHub bill', billing_reconciliation: 'Compare with bill', work_allocation: 'Estimated work cost',
+};
diff --git a/.github/extensions/ai-attribution/ui/index.html b/.github/extensions/ai-attribution/ui/index.html
index e1c969a..0b455ef 100644
--- a/.github/extensions/ai-attribution/ui/index.html
+++ b/.github/extensions/ai-attribution/ui/index.html
@@ -10,7 +10,7 @@
     <header class="top">
       <div class="heading">
         <h1 id="title">AI attribution</h1>
-        <p class="question">Usage, work and delivery. Not an ROI score.</p>
+        <p class="question">What AI was used for, what it cost and what is still unknown.</p>
       </div>
       <label class="theme-control">Theme
         <select id="theme" aria-label="Color theme">
diff --git a/.github/extensions/ai-attribution/ui/recipe.mjs b/.github/extensions/ai-attribution/ui/recipe.mjs
index c4699f3..e26050f 100644
--- a/.github/extensions/ai-attribution/ui/recipe.mjs
+++ b/.github/extensions/ai-attribution/ui/recipe.mjs
@@ -2,6 +2,7 @@
 // Rendering only; lib/recipe.mjs decides steps, evidence and counts.
 
 import { h, s, disclosure } from './dom.js';
+import { usageLabels, evidenceLabels, sourceLabels as SOURCE_SHORT } from './format.mjs';
 
 export const STEP_NAMES = {
   workItem: 'Work item',
@@ -12,28 +13,19 @@ export const STEP_NAMES = {
   review: 'Review',
   close: 'Merge & close',
 };
-const STEP_CONCEPT = {
-  workItem: 'issue_task',
-  branch: 'branch_commit',
-  aiWork: 'credits',
-  commits: 'branch_commit',
-  pullRequest: 'pull_request',
-  review: 'acceptance',
-  close: 'delivery',
-};
-const SOURCE_SHORT = { sessionStore: 'CLI / app', traces: 'VS Code', agentHost: 'VS Code harness' };
 const EVIDENCE_ORDER = ['verified', 'recorded', 'convention', 'observed'];
 const STATUS_TEXT = {
   ok: 'connected',
-  partial: 'partly verified',
+  partial: 'partly checked',
   error: 'failed',
   unavailable: 'unavailable',
   'not-configured': 'not configured',
-  skipped: 'nothing to verify',
+  skipped: 'nothing to check',
 };
 const MAX_LANES = 12;
 
 const fmtCredits = new Intl.NumberFormat(undefined, { maximumFractionDigits: 1 });
+const fmtAmount = new Intl.NumberFormat(undefined, { minimumFractionDigits: 2, maximumFractionDigits: 6 });
 const fmtInt = new Intl.NumberFormat(undefined, { maximumFractionDigits: 0 });
 const fmtDay = new Intl.DateTimeFormat(undefined, { month: 'short', day: 'numeric' });
 const fmtStamp = new Intl.DateTimeFormat(undefined, { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
@@ -48,17 +40,102 @@ export function formatHours(hours) {
 const when = (value) => (value ? fmtStamp.format(new Date(value)) : '—');
 const badge = (kind, text) => h('span', { class: `badge ${kind}` }, text ?? kind);
 
-function sourceChips(sources, title = (x) => `${x.calls} calls · ${x.creditedCalls} reporting credits`) {
+function sourceChips(sources, title = (x) => `${x.calls} requests · ${x.creditedCalls} with credit counts`) {
   return h(
     'span',
     { class: 'source-chips' },
     sources.map((x) =>
-      h('span', { class: `src src-${x.id}`, title: title(x) }, `${SOURCE_SHORT[x.id] ?? x.id} ${fmtCredits.format(x.credits)} cr`),
+      h('span', { class: `src src-${x.id}`, title: title(x) }, `${SOURCE_SHORT[x.id] ?? x.id} ${fmtCredits.format(x.credits)} credits`),
+    ),
+  );
+}
+
+const creditValue = (usage) => usage?.credits === null || usage?.credits === undefined ? '—' : fmtCredits.format(usage.credits);
+
+export function developerSelection(view, ui) {
+  const sources = view.developers.sources;
+  const source = sources.find((entry) => entry.id === ui.sourceId) ??
+    sources.find((entry) => entry.measured.calls > 0) ?? sources[0];
+  const person = source?.actors.find((actor) => actor.key === ui.actorKey);
+  const owned = ui.perspective === 'ownership';
+  const summary = ui.actorKey === '__unknown' ? source?.[owned ? 'unowned' : 'unknown'] :
+    ui.actorKey ? person?.[owned ? 'ownership' : 'usage'] : owned ? source?.ownership : source;
+  return { source, summary, actor: view.developers.actors.find((a) => a.key === ui.actorKey) };
+}
+
+function developerPanel(view, ui) {
+  const { source, summary, actor } = developerSelection(view, ui);
+  const select = (label, key, value, choices) => h('select', {
+    'aria-label': label, 'data-focus-key': key, onchange: (event) => ui.setDeveloper(key, event.target.value),
+  }, choices.map(([id, text]) => h('option', { value: id, selected: value === id }, text)));
+  const total = summary?.total;
+  const workRows = summary?.work ?? [];
+  const displayed = ui.allWork ? workRows : workRows.slice(0, 5);
+  return h('section', { class: 'card developer-report' },
+    h('div', { class: 'toolbar' },
+      h('h3', {}, 'Developer → work'),
+      select('Usage source', 'developer-source', source?.id, view.developers.sources.map((entry) => [entry.id, SOURCE_SHORT[entry.id] ?? entry.id])),
+      select('Developer', 'developer-actor', ui.actorKey ?? '', [
+        ['', 'All accounts'], ['__unknown', ui.perspective === 'ownership' ? 'No known owner' : 'Account unknown'],
+        ...view.developers.actors.map((a) => [a.key, `${a.label} · ${{ github: 'GitHub', 'azure-boards': 'Azure Boards', telemetry: 'local record' }[a.provider] ?? a.provider}`]),
+      ]),
+      select('Show usage or owned work', 'developer-perspective', ui.perspective ?? 'usage', [
+        ['usage', 'Credits used'], ['ownership', 'Work owned'],
+      ]),
+    ),
+    h('div', { class: 'actor-balance' },
+      h('strong', { title: total ? `${total.creditedCalls}/${total.calls} requests include credit counts` : 'No usage matches this selection' }, `${creditValue(total)} credits`),
+      ...['measured', 'inferred', 'unattributed'].map((method) =>
+        h('span', { class: method }, `${usageLabels[method]} `, h('strong', {}, creditValue(summary?.[method]))),
+      ),
+    ),
+    h('div', { class: 'actor-credit-bar', role: 'img', 'aria-label': 'Credits from recorded users, estimates based on owners and unknown users' },
+      ...['measured', 'inferred', 'unattributed'].map((method) => h('span', {
+        class: method, style: { width: `${total?.credits > 0 ? ((summary[method].credits ?? 0) / total.credits) * 100 : 0}%` },
+      })),
     ),
+    h('p', { class: 'muted small' }, ui.perspective === 'ownership'
+      ? `Work owned by ${actor?.label ?? 'selected accounts'}; includes other contributors, not just this person’s AI use.`
+      : 'Recorded accounts show who used AI. An owner-based estimate is not proof. This machine may have only part of the history.'),
+    displayed.length ? h('div', { class: 'matrix-wrap' }, h('table', { class: 'actor-work' },
+      h('thead', {}, h('tr', {}, ...['Work / pull request', ...Object.values(usageLabels)].map((label) => h('th', {}, label)))),
+      h('tbody', {}, displayed.map((row) => {
+        const cycle = view.cycles.find((c) => c.key === row.cycleKey);
+        return h('tr', {},
+          h('td', {}, cycle
+            ? h('span', {}, h('strong', {}, cycle.workItems.map((w) => w.reference).join(', ') || 'No work item'),
+                cycle.pullRequest ? ` → PR #${cycle.pullRequest.number}` : '',
+                h('span', { class: 'mono muted' }, `${cycle.repository} · ${cycle.branch ?? 'no branch'}`))
+            : 'No repository, or work outside this list'),
+          ...['measured', 'inferred', 'unattributed'].map((method) => h('td', { class: 'num' }, creditValue(row[method]))),
+        );
+      })),
+    )) : h('p', { class: 'muted' }, 'No usage for this selection.'),
+    workRows.length > 5 ? h('button', { class: 'more', onclick: () => ui.toggleWork(), 'data-focus-key': 'actor-work-more' },
+      ui.allWork ? 'Show less' : `All ${workRows.length} work groups`) : null,
+    total ? h('span', { class: 'muted small' }, `${total.creditedCalls}/${total.calls} requests include credit counts`) : null,
   );
 }
 
-const cycleCredits = (list) => sourceChips(list, (x) => `Reported credits in ${x.cycles} cycle${x.cycles === 1 ? '' : 's'} from ${SOURCE_SHORT[x.id] ?? x.id}`);
+function identityPanel(view, ui) {
+  const identities = [...new Map(view.cycles.flatMap((cycle) => cycle.ownership.roles)
+    .filter((role) => role.identity.provider === 'azure-boards').map((role) => [role.identity.key, role.identity])).values()];
+  if (!identities.length) return null;
+  const choices = h('select', { 'aria-label': 'Azure Boards identity' },
+    identities.map((identity) => h('option', { value: identity.key }, `${identity.label} · ${identity.key}`)));
+  const login = h('input', { 'aria-label': 'GitHub login', placeholder: 'GitHub login', required: true, maxLength: 39 });
+  return disclosure('identity-links', 'Link accounts across tools',
+    h('p', { class: 'small' }, 'Tell us which accounts belong together. The link lasts only in this panel; we never match names or emails automatically.'),
+    h('form', { class: 'toolbar', onsubmit: (event) => {
+      event.preventDefault();
+      ui.linkIdentity(choices.value, login.value);
+    } }, choices, login, h('button', { type: 'submit', disabled: ui.verifying }, 'Link accounts')),
+    h('ul', { class: 'small' }, view.developers.identityLinks.map((link) => h('li', {},
+      `${link.boardsKey} → ${link.githubLogin}`, ' ',
+      h('button', { type: 'button', onclick: () => ui.unlinkIdentity(link.boardsKey) }, 'Remove'),
+    ))),
+  );
+}
 
 // ------------------------------------------------------------------ icons ---
 
@@ -87,6 +164,9 @@ function icon(step) {
       );
     case 'review':
       return g(s('path', { d: 'M-9 0 C-5 -7 5 -7 9 0 C5 7 -5 7 -9 0 Z' }), s('circle', { cx: 0, cy: 0, r: 2.6 }));
+    case 'billing':
+      return g(s('rect', { x: -8, y: -9, width: 16, height: 18, rx: 2 }),
+        s('path', { d: 'M-4 -4 H4 M-4 0 H1 M-4 4 H4' }));
     default:
       return g(s('path', { d: 'M-6 0 L-2 4.5 L6.5 -5' }));
   }
@@ -95,7 +175,7 @@ function icon(step) {
 // ----------------------------------------------------------- recipe strip ---
 
 const STRIP = {
-  width: 1200,
+  width: 1480,
   height: 330,
   center: 158,
   maxHalf: 34,
@@ -128,6 +208,9 @@ function recipeStrip(view, model) {
   const half = (n) => (total ? Math.max(n ? 3 : 1.2, (STRIP.maxHalf * n) / total) : 1.2);
   const steps = model.recipe.steps;
   const stations = view.stations;
+  const billingStatus = view.billing?.status === 'ok' ? 'Report loaded' :
+    view.billing?.status === 'error' ? 'Read failed' :
+      view.billing?.status === 'loading' ? 'Reading…' : 'Not read';
   const start = { x: STRIP.bands[0].x, half: half(total) };
   const end = (n) => ({ x: STRIP.bands[2].x + STRIP.bands[2].w, half: half(n) });
 
@@ -158,7 +241,7 @@ function recipeStrip(view, model) {
           s('title', {}, `${dropped} cycle${dropped === 1 ? '' : 's'} left the in-order recipe at ${STEP_NAMES[st.id]}`),
           s('path', { d: `M ${dx - 26} ${y0} C ${dx - 6} ${y0 + 6} ${dx} ${y0 + 30} ${dx} 282` }),
           s('circle', { cx: dx, cy: 286, r: 3 }),
-          s('text', { x: dx, y: 306, 'text-anchor': 'middle' }, `−${dropped} stopped`),
+          s('text', { x: dx, y: 306, 'text-anchor': 'middle' }, `−${dropped} missing step`),
         ),
       );
     }
@@ -171,7 +254,7 @@ function recipeStrip(view, model) {
     { class: 'recipe-strip card' },
     s(
       'svg',
-      { viewBox: `0 0 ${STRIP.width} ${STRIP.height}`, role: 'img', 'aria-label': 'Recipe: cycles reaching each step from work item to merged pull request' },
+      { viewBox: `0 0 ${STRIP.width} ${STRIP.height}`, role: 'img', 'aria-label': 'Recipe: work item to merge and closure, followed visually by a separate bill comparison, not another delivery step' },
       s('defs', {},
         s('pattern', { id: 'recipe-hatch', width: 7, height: 7, patternUnits: 'userSpaceOnUse', patternTransform: 'rotate(45)' },
           s('rect', { width: 7, height: 7, class: 'hatch-bg' }),
@@ -186,6 +269,19 @@ function recipeStrip(view, model) {
           s('text', { x: band.x + 16, y: 52, class: 'band-detail' }, phase.detail),
         );
       }),
+      s('g', { class: 'band band-billing billing-endpoint', 'data-billing-checkpoint': 'true' },
+        s('title', {}, 'Compare the bill by account, day in UTC and model, independently of merge. GitHub does not bill by pull request or session. This is not another delivery step.'),
+        s('rect', { x: 1202, y: 10, width: 260, height: 310, rx: 14 }),
+        s('text', { x: 1218, y: 34, class: 'band-label' }, 'CHECK THE BILL'),
+        s('text', { x: 1218, y: 52, class: 'band-detail' }, 'Separate from delivery'),
+        s('text', { x: 1332, y: 92, class: 'station-name', 'text-anchor': 'middle' }, 'Compare usage and bill'),
+        s('path', { d: 'M1184 158 H1305 M1297 153 L1305 158 L1297 163', class: 'billing-connector' }),
+        s('circle', { cx: 1332, cy: STRIP.center, r: 25, class: 'station-ring' }),
+        s('g', { transform: `translate(1332 ${STRIP.center})` }, icon('billing')),
+        s('text', { x: 1332, y: 208, class: 'station-count', 'text-anchor': 'middle' }, billingStatus),
+        s('text', { x: 1332, y: 250, class: 'station-any', 'text-anchor': 'middle' }, 'User · UTC day · model'),
+        s('text', { x: 1332, y: 286, class: 'station-any', 'text-anchor': 'middle' }, 'Not a bill for each change'),
+      ),
       s('path', { d: ribbonPath(hatched), class: 'ribbon-pending' }, s('title', {}, 'Cycles that may have this step: unknown until verified')),
       s('path', { d: ribbonPath(reach), class: 'ribbon-any' }, s('title', {}, 'Cycles that have this step, in any order')),
       s('path', { d: ribbonPath(core), class: 'ribbon' }, s('title', {}, 'Cycles that followed the recipe in order up to this step')),
@@ -206,7 +302,7 @@ function recipeStrip(view, model) {
           s('title', {}, [
             `${spec.name}`,
             `${st.any} of ${total} cycles have this step; ${st.strict} followed the recipe in order up to here; ${st.unknown} unknown`,
-            `Evidence: ${EVIDENCE_ORDER.filter((e) => st.evidence[e]).map((e) => `${st.evidence[e]} ${e}`).join(', ') || 'none'}`,
+            `Evidence: ${EVIDENCE_ORDER.filter((e) => st.evidence[e]).map((e) => `${st.evidence[e]} ${evidenceLabels[e]}`).join(', ') || 'none'}`,
             `Local: ${spec.local}`,
             `Verified: ${spec.verified}`,
           ].join('\n')),
@@ -216,111 +312,30 @@ function recipeStrip(view, model) {
           s('text', { x, y: 208, class: 'station-count', 'text-anchor': 'middle' }, `${st.any} / ${total}`),
           s('rect', { x: x - 45, y: 226, width: 90, height: 6, rx: 3, class: 'ev-track' }),
           segments,
-          s('text', { x, y: 250, class: 'station-any', 'text-anchor': 'middle' }, `${st.strict} in order${st.unknown ? ` · ${st.unknown} unknown` : ''}`),
+          s('text', { x, y: 250, class: 'station-any', 'text-anchor': 'middle' }, `${st.strict} no gaps${st.unknown ? ` · ${st.unknown} unknown` : ''}`),
         );
       }),
     ),
     h('figcaption', { class: 'legend' },
-      h('span', {}, h('i', { class: 'swatch ribbon' }), 'In order'),
-      h('span', {}, h('i', { class: 'swatch ribbon-any' }), 'Any order'),
+      h('span', {}, h('i', { class: 'swatch ribbon' }), 'No missing steps'),
+      h('span', {}, h('i', { class: 'swatch ribbon-any' }), 'Step present'),
       h('span', {}, h('i', { class: 'swatch pending' }), 'Unknown'),
       EVIDENCE_ORDER.map((e) => h('span', { title: model.recipe.evidence.find((x) => x.id === e)?.description }, h('i', { class: `swatch ev-${e}` }), model.recipe.evidence.find((x) => x.id === e)?.label ?? e)),
-      h('span', {}, h('i', { class: 'swatch drop' }), 'Stopped here'),
+      h('span', {}, h('i', { class: 'swatch drop' }), 'Missing a step'),
     ),
   );
 }
 
-// ------------------------------------------------------------------- KPIs ---
-
-function kpiCards(view) {
+function medianTimes(view) {
   const k = view.kpis;
-  const verified = Boolean(view.verification);
-  const pending = (value) => (verified ? value : h('span', { class: 'muted' }, '—'));
-  return h('section', { class: 'recipe-results' },
-    h('div', { class: 'grid kpis recipe-kpis' }, [
-      ['PRs opened', fmtInt.format(k.prOpened), 'Verified or recorded references'],
-      ['Reviewed', pending(fmtInt.format(k.reviewed)), 'At least one submitted review'],
-      ['Merged', pending(fmtInt.format(k.merged)), 'PR state MERGED'],
-      ['Merged & closed', pending(fmtInt.format(k.closed)), 'Merged and linked work items closed; no linked item requires only a merge'],
-    ].map(([label, value, note]) =>
-      h('div', { class: 'card kpi', title: note }, h('div', { class: 'label' }, label), h('div', { class: 'value' }, value)),
-    )),
-    h('div', { class: 'timing-row small', 'aria-label': 'Median cycle times' }, [
-      ['Pickup → done', k.medianPickupToDoneHours, 'First AI work or activation to merge and closure'],
-      ['PR → merge', k.medianOpenToMergeHours, 'PR opened to merged'],
-      ['PR → review', k.medianOpenToFirstReviewHours, 'PR opened to first review'],
-    ].map(([label, value, title]) => h('span', { title }, label, ' ', h('strong', {}, pending(formatHours(value))))),
-    h('span', { class: 'muted' }, 'Median times')),
-  );
-}
-
-// ------------------------------------------------------------ adherence ---
-
-function donut(segments, total) {
-  const r = 46;
-  const c = 2 * Math.PI * r;
-  let offset = 0;
-  return s('svg', { viewBox: '0 0 120 120', class: 'donut', role: 'img', 'aria-label': 'Branch convention adherence' },
-    s('circle', { cx: 60, cy: 60, r, class: 'donut-track' }),
-    segments.map((seg) => {
-      const len = total ? (c * seg.value) / total : 0;
-      const el = len > 0
-        ? s('circle', { cx: 60, cy: 60, r, class: `donut-seg ${seg.cls}`, 'stroke-dasharray': `${len} ${c - len}`, 'stroke-dashoffset': -offset, transform: 'rotate(-90 60 60)' }, s('title', {}, `${seg.label}: ${seg.value}`))
-        : null;
-      offset += len;
-      return el;
-    }),
-  );
-}
-
-function adherenceCard(view, model) {
-  const a = view.adherence;
-  const conforming = a.azureBoards + a.github;
-  const share = a.cycles ? Math.round((100 * conforming) / a.cycles) : null;
-  const segments = [
-    { cls: 'seg-ab', label: 'AB123 → Boards', value: a.azureBoards },
-    { cls: 'seg-gh', label: '123 → GitHub issue', value: a.github },
-    { cls: 'seg-non', label: 'Other names', value: a.nonConforming },
-    { cls: 'seg-none', label: 'No branch', value: a.noBranch },
-  ];
-  const credits = (list) => (list.length ? cycleCredits(list) : h('span', { class: 'muted' }, '—'));
-  return h('section', { class: 'card adherence' },
-    h('h3', {}, 'Branch convention'),
-    h('div', { class: 'adherence-body' },
-      h('div', { class: 'donut-wrap' }, donut(segments, a.cycles), h('div', { class: 'donut-center' }, h('strong', {}, share === null ? '—' : `${share}%`), h('span', {}, 'follow it'))),
-      h('ul', { class: 'legend-list' }, segments.map((seg) => h('li', {}, h('i', { class: `swatch ${seg.cls}` }), seg.label, h('strong', {}, ` ${seg.value}`)))),
-    ),
-    h('table', { class: 'compact' },
-      h('tbody', {},
-        h('tr', {}, h('td', {}, 'Convention'), h('td', {}, credits(a.credits.conforming))),
-        h('tr', {}, h('td', {}, 'Other branches'), h('td', {}, credits(a.credits.nonConforming))),
-      ),
-    ),
-    disclosure('recipe-convention', 'Convention & commit hook',
-      h('p', { class: 'small' }, model.recipe.convention.branch),
-      h('p', { class: 'small' }, model.recipe.convention.hook),
-      h('pre', {}, h('code', {}, 'git config core.hooksPath .github/extensions/ai-attribution/hooks')),
-      h('p', { class: 'muted small' }, 'Or copy hooks/commit-msg into another repository\u2019s .git/hooks/. Requires Node on PATH. Set AI_ATTRIBUTION_HOOK=off to skip once.'),
-    ),
-  );
-}
-
-// ------------------------------------------------------------ ingredients ---
-
-function ingredientsCard(view) {
-  const max = Math.max(1, ...view.ingredients.map((i) => i.cycles));
-  return h('section', { class: 'card pantry' },
-    h('h3', {}, 'Ingredients'),
-    view.ingredients.length
-      ? h('div', { class: 'pantry-grid' }, view.ingredients.map((i) =>
-          h('div', { class: `jar jar-${i.provider ?? 'none'}` },
-            h('div', { class: 'jar-head' }, h('strong', {}, i.label), h('span', { class: 'muted small' }, `${i.cycles} cycle${i.cycles === 1 ? '' : 's'}${i.provider ? ` · ${i.closed} served` : ''}`)),
-            h('div', { class: 'jar-bar' }, h('div', { style: { width: `${(100 * i.cycles) / max}%` } })),
-            i.credits.length ? cycleCredits(i.credits) : null,
-          ),
-        ))
-      : h('p', { class: 'muted' }, 'No cycles in this window.'),
-    h('p', { class: 'muted small' }, 'Types appear after verification. Credits stay per source.'),
+  return h('div', { class: 'timing-row small', 'aria-label': 'Median cycle times' }, [
+    ['Pickup → done', k.medianPickupToDoneHours, 'First AI work or activation to merge and closure'],
+    ['Pull request → merge', k.medianOpenToMergeHours, 'Pull request opened to merged'],
+    ['Pull request → review', k.medianOpenToFirstReviewHours, 'Pull request opened to first review'],
+  ].map(([label, value, title]) => h('span', { title }, label, ' ',
+    h('strong', {}, view.verification ? formatHours(value) : h('span', { class: 'muted' }, '—')),
+  )),
+    h('span', { class: 'muted', title: 'Half of measured changes took less time; half took more.' }, 'Typical times (median)'),
   );
 }
 
@@ -380,7 +395,7 @@ function laneTrack(cycle) {
     earlier.length
       ? s('g', { class: 'mk mk-earlier' }, s('title', {}, earlier.map((e) => `${e.label}: ${when(e.at)}`).join('\n')), s('path', { d: `M ${LANE.left + 6} ${LANE.axis - 5} L ${LANE.left} ${LANE.axis} L ${LANE.left + 6} ${LANE.axis + 5}` }))
       : null,
-    cycle.events.filter((e) => Date.parse(e.at) >= start).map((e) => marker(e.kind, xOf(e.at), e.evidence, `${e.label} · ${when(e.at)} · ${e.evidence}`)),
+    cycle.events.filter((e) => Date.parse(e.at) >= start).map((e) => marker(e.kind, xOf(e.at), e.evidence, `${e.label} · ${when(e.at)} · ${evidenceLabels[e.evidence]}`)),
   );
 }
 
@@ -391,7 +406,14 @@ function stepDots(cycle) {
 }
 
 function recipeCard(cycle, model) {
-  return h('ol', { class: 'recipe-card' },
+  return h('div', { class: 'recipe-card' },
+    h('div', { class: 'actor-roles' },
+      ...cycle.ownership.roles.map((role) => h('span', { class: 'chip', title: `${role.identity.key} · ${role.at ?? 'date unknown'}` },
+        `${{ 'PR author': 'Pull request author', 'Assigned at pickup': 'Assigned at first AI use' }[role.role] ?? role.role}: ${role.actor.label}${role.reference ? ` · ${role.reference}` : ''}`)),
+      ...cycle.attribution.map((entry) => h('span', { class: `chip ${entry.method}` },
+        `${entry.actor?.label ?? 'Account unknown'} · ${creditValue(entry)} credits · ${usageLabels[entry.method]} · ${SOURCE_SHORT[entry.source]}`)),
+    ),
+    h('ol', { class: 'recipe-steps' },
     Object.entries(cycle.steps).map(([id, st]) => {
       const spec = model.recipe.steps.find((x) => x.id === id);
       return h('li', { class: `rc-step ${st.state}` },
@@ -400,19 +422,19 @@ function recipeCard(cycle, model) {
           h('div', { class: 'rc-head' }, h('strong', {}, spec?.name ?? STEP_NAMES[id])),
           h('div', { class: 'rc-meta' },
             badge(st.state === 'yes' ? 'native' : st.state === 'no' ? 'missing' : 'unverified', st.state === 'yes' ? 'done' : st.state === 'no' ? 'not done' : 'unknown'),
-            st.evidence ? badge(`ev-${st.evidence}`, st.evidence) : null,
+            st.evidence ? badge(`ev-${st.evidence}`, evidenceLabels[st.evidence]) : null,
             st.at ? h('span', { class: 'muted small' }, when(st.at)) : null,
           ),
           h('div', { class: 'small' }, st.detail),
         ),
       );
-    }),
+    })),
   );
 }
 
 function workItemChip(w) {
   const state = w.found === false ? 'not found' : w.closed ? 'closed' : w.state ? w.state.toLowerCase() : null;
-  return h('span', { class: `chip wi wi-${w.provider}`, title: `${w.provider === 'azure-boards' ? 'Azure Boards' : 'GitHub'} ${w.reference} · ${w.evidence}${w.type ? ` · ${w.type}` : ''}${state ? ` · ${state}` : ''} · via ${w.via.join(', ')}` },
+  return h('span', { class: `chip wi wi-${w.provider}`, title: `${w.provider === 'azure-boards' ? 'Azure Boards' : 'GitHub'} ${w.reference} · ${evidenceLabels[w.evidence]}${w.type ? ` · ${w.type}` : ''}${state ? ` · ${state}` : ''} · via ${w.via.map((e) => evidenceLabels[e]).join(', ')}` },
     w.reference, w.type ? ` ${w.type}` : '', state ? h('span', { class: 'muted' }, ` · ${state}`) : null);
 }
 
@@ -445,6 +467,8 @@ function lanes(view, model, ui) {
               ? h('span', { class: `chip pr pr-${String(cycle.pullRequest.state).toLowerCase()}` }, `PR #${cycle.pullRequest.number} ${cycle.pullRequest.isDraft ? 'draft' : String(cycle.pullRequest.state).toLowerCase()}`)
               : null,
             stepDots(cycle),
+            [...new Set(cycle.attribution.filter((entry) => entry.actor).map((entry) => `${entry.actor.label} · ${usageLabels[entry.method]}`))]
+              .slice(0, 2).map((label) => h('span', { class: 'small muted' }, label)),
           ),
         ),
         laneTrack(cycle),
@@ -465,27 +489,6 @@ function lanes(view, model, ui) {
 
 // ------------------------------------------------------------ surface map ---
 
-function surfaceMatrix(model) {
-  return h('div', { class: 'matrix-wrap' },
-    h('table', { class: 'matrix' },
-      h('thead', {}, h('tr', {}, h('th', {}, 'Step'), model.surfaces.map((x) => h('th', { title: x.collection }, x.name)))),
-      h('tbody', {}, model.recipe.steps.map((step) => {
-        const concept = model.concepts.find((c) => c.id === STEP_CONCEPT[step.id]);
-        return h('tr', {},
-          h('td', { class: 'concept' }, h('strong', {}, step.name), h('span', { class: 'mono' }, concept?.name ?? '')),
-          model.surfaces.map((x) => {
-            const cell = concept?.surfaces[x.id];
-            return h('td', { class: 'cell', title: cell?.note ?? '' },
-              cell ? badge(cell.availability, model.availabilityLevels.find((l) => l.id === cell.availability)?.label) : '—',
-              cell ? h('span', { class: 'mono' }, cell.field) : null,
-            );
-          }),
-        );
-      })),
-    ),
-  );
-}
-
 // -------------------------------------------------------------- toolbar ---
 
 function statusChip(label, status) {
@@ -505,14 +508,14 @@ function toolbar(view, ui) {
     h('input', {
       type: 'text',
       class: 'org',
-      placeholder: 'Azure DevOps org (optional)',
+      placeholder: 'Azure DevOps organization (optional)',
       'aria-label': 'Azure DevOps organization',
       'data-focus-key': 'recipe-org',
       value: ui.org ?? '',
       oninput: (e) => ui.setOrg(e.target.value),
     }),
-    h('button', { class: 'primary', title: 'Verify with GitHub & Azure Boards', 'aria-label': 'Verify with GitHub & Azure Boards', 'data-focus-key': 'recipe-verify', onclick: () => ui.verify(), 'aria-disabled': ui.verifying ? 'true' : undefined },
-      ui.verifying ? 'Verifying…' : v ? 'Verify again' : 'Verify'),
+    h('button', { class: 'primary', title: 'Check delivery with GitHub & Azure Boards', 'aria-label': 'Check delivery with GitHub & Azure Boards', 'data-focus-key': 'recipe-verify', onclick: () => ui.verify(), 'aria-disabled': ui.verifying ? 'true' : undefined },
+      ui.verifying ? 'Checking…' : v ? 'Check again' : 'Check delivery'),
     statusChip('GitHub', v?.github),
     statusChip('Azure Boards', v?.azureBoards),
   );
@@ -520,36 +523,185 @@ function toolbar(view, ui) {
 
 // ------------------------------------------------------------------ view ---
 
+function setupSection(view, ui) {
+  const rows = [
+    ['Local usage',
+      h('span', {}, 'Node 22+ and readable Copilot usage files. Use Connect Copilot Telemetry and choose whether to record the GitHub account.'),
+      h('span', {}, 'VS Code Local: ', h('code', {}, 'github.copilot.chat.otel.captureIdentity'),
+        '. Copilot Agent Host harness: managed ', h('code', {}, 'telemetry.capture.identity'),
+        '. Without a recorded account, usage is estimated from ownership or left unknown; a computer name is not a person.')],
+    ['Work links',
+      h('span', {}, h('code', {}, 'alex/123-feature'), ' → GitHub issue; ', h('code', {}, 'alex/AB123-feature'), ' → Azure Boards.'),
+      h('span', {}, 'Put the work-item number immediately after the last slash. The optional ', h('code', {}, 'hooks/commit-msg'),
+        ' adds a Refs line to commits. Keep existing hooks: copy or run this hook alongside them instead of replacing hooksPath.')],
+    ['GitHub checks',
+      h('span', {}, h('code', {}, 'gh auth login'), '; repository read access, including private repositories and SSO where required.'),
+      'Check delivery reads pull requests, reviews and assignments only. It does not need permission to change them.'],
+    ['Azure Boards',
+      'Set the organization here. Use az login with project access, or AZURE_DEVOPS_EXT_PAT with Work Items (Read).',
+      'We check who was assigned when AI use began. Connect Azure Boards to GitHub if commit mentions should create links automatically.'],
+    ['Billing',
+      'Personal: account holder. Organization: billing/admin access. Enterprise: a billing-authorized role or billing-read GitHub App. Repository read access alone is insufficient.',
+      h('span', {}, 'If an organization pays for the license, use its bill, not the personal account’s bill. Choose a completed UTC day and GitHub username. ',
+        h('a', { href: 'https://docs.github.com/en/rest/billing/usage', target: '_blank', rel: 'noopener noreferrer' }, 'API permissions'))],
+  ];
+  return disclosure('recipe-setup', 'Setup & permissions',
+    h('div', { class: 'matrix-wrap' }, h('table', {},
+      h('thead', {}, h('tr', {}, ...['Step', 'Required', 'Naming rules / assumptions'].map((label) => h('th', {}, label)))),
+      h('tbody', {}, rows.map(([label, required, assumption]) => h('tr', {},
+        h('th', { scope: 'row' }, label), h('td', {}, required), h('td', {}, assumption)))),
+    )),
+    h('p', { class: 'small' }, 'Check delivery and Read billing contact the services only when you ask. We do not read prompts, descriptions or commit text. Access tokens and account links are not saved; screenshots use invented data.'),
+    h('p', { class: 'small' }, 'Only you can link accounts across tools. Billing comparisons use recorded users, not guessed owners. Local usage does not prove which account paid.'),
+    h('p', { class: 'small' }, 'GitHub does not provide a bill for each pull request or session. Work costs are estimates. Usage and charges we cannot explain stay separate.'),
+    identityPanel(view, ui),
+  );
+}
+
+function billingPanel(view, ui) {
+  const report = view.billing;
+  const { source, actor } = developerSelection(view, ui);
+  const result = report?.sources?.find((entry) => entry.sourceId === source?.id);
+  const form = ui.billingForm ?? {};
+  const input = (field, label, value, extra = {}) => h('label', { class: 'billing-field' }, label,
+    h('input', { name: field, 'aria-label': label, 'data-focus-key': `billing-${field}`, value, required: true, ...extra,
+      oninput: (event) => ui.setBilling(field, event.target.value) }));
+  const level = h('label', { class: 'billing-field' }, 'Who pays?',
+    h('select', { name: 'level', 'aria-label': 'Billing level', 'data-focus-key': 'billing-level', onchange: (event) => ui.setBilling('level', event.target.value) },
+      [['organization', 'Organization'], ['enterprise', 'Enterprise'], ['user', 'Personal']].map(([value, label]) =>
+        h('option', { value, selected: (form.level ?? 'organization') === value }, label))),
+  );
+  return h('section', { class: 'card billing-panel' },
+    h('h3', {}, 'Compare usage with the bill'),
+    h('p', { class: 'muted small' }, 'Same account, day in UTC and model. Billing does not wait for merge and is not a bill for each pull request.'),
+    h('form', { class: 'toolbar billing-form', onsubmit: (event) => {
+      event.preventDefault();
+      ui.readBilling(Object.fromEntries(new FormData(event.currentTarget)));
+    } },
+      level,
+      input('account', 'Paying account', form.account ?? '', { maxLength: 100, placeholder: 'organization or account name' }),
+      input('user', 'Person on the bill', form.user ?? (actor?.provider === 'github' ? actor.label : ''), { maxLength: 45, placeholder: 'GitHub username' }),
+      input('day', 'Day (UTC)', form.day ?? ui.lastCompleteDay, { type: 'date', max: ui.lastCompleteDay, title: 'A completed day in UTC, not your local time zone' }),
+      h('button', { type: 'submit', disabled: ui.readingBilling || !report, class: 'primary' }, ui.readingBilling ? 'Reading…' : 'Read billing'),
+    ),
+    !report ? h('p', { role: 'alert' }, 'Reload the extension to enable billing.') : null,
+    report?.status === 'error' ? h('p', { role: 'alert' }, report.reason) : null,
+    report?.status === 'ok' && result ? [
+      h('p', { class: 'small' }, `${report.scope.user} · ${report.scope.day} UTC · ${report.scope.level}/${report.scope.account} · ${SOURCE_SHORT[result.sourceId]}`),
+      h('div', { class: 'grid billing-stats' }, [
+        ['Credits on bill', result.grossQuantity],
+        ['Recorded for this account', result.observed],
+        ['Bill minus recorded', result.difference],
+        ['Charge after discounts', result.netAmount, true],
+      ].map(([label, value, amount]) => h('div', { class: 'kpi' },
+        h('div', { class: 'label' }, label),
+        h('div', { class: 'value' }, value === null ? '—' : (amount ? fmtAmount : fmtCredits).format(value))))),
+      h('p', { class: 'muted small' }, `Before discounts ${fmtAmount.format(result.grossAmount)} · discounts ${fmtCredits.format(result.discountQuantity)} credits / ${fmtAmount.format(result.discountAmount)} · after discounts ${fmtCredits.format(result.netQuantity)} credits. Amounts come from GitHub.`),
+      result.localExceedsBilling ? h('p', { role: 'alert' }, 'We recorded more usage than billed for a model. We do not estimate work costs for that model.') : null,
+      result.outsideModelScope > 0 ? h('p', { class: 'small' }, `${fmtCredits.format(result.outsideModelScope)} recorded credits do not exactly match a model on the bill.`) : null,
+      result.unknownIdentity > 0 ? h('p', { class: 'small' }, `${fmtCredits.format(result.unknownIdentity)} recorded credits have no known user, so they are not assigned to the person on this bill.`) : null,
+      h('p', { class: 'small' }, `Billed credits not matched here: ${fmtCredits.format(result.unmatchedBilling)}. Charge not assigned to work: ${fmtAmount.format(result.unallocatedNetAmount)}.`),
+      disclosure('billing-detail', 'Models & estimated work costs',
+        h('p', {}, 'Model names must match exactly. A difference does not prove a billing error: local history may be incomplete. Estimated work cost = charge after discounts × recorded user’s work credits / credits on the bill, per model.'),
+        h('table', {}, h('thead', {}, h('tr', {}, ...['Model', 'Billed credits', 'Recorded credits', 'Difference'].map((label) => h('th', {}, label)))),
+          h('tbody', {}, result.models.map((row) => h('tr', {}, h('td', {}, row.model),
+            ...[row.grossQuantity, row.observed, row.difference].map((value) => h('td', { class: 'num' }, value === null ? '—' : fmtCredits.format(value))))))),
+        h('table', {}, h('thead', {}, h('tr', {}, h('th', {}, 'Work · estimated cost'), h('th', {}, 'Credits'), h('th', {}, 'Charge after discounts'))),
+          h('tbody', {}, result.work.map((row) => {
+            const cycle = view.cycles.find((entry) => entry.key === row.cycleKey);
+            return h('tr', {}, h('td', {}, cycle ? `${cycle.repository} · ${cycle.branch}` : 'Outside displayed cycles'),
+              h('td', { class: 'num' }, fmtCredits.format(row.grossQuantity)), h('td', { class: 'num' }, fmtAmount.format(row.netAmount)));
+          }))),
+      ),
+    ] : null,
+  );
+}
+
+function handoffEntry(id, [title, handoff, assumption], tag = 'li') {
+  return h(tag, { class: `handoff-card${id === 'billing' ? ' billing-handoff' : ''}`, 'data-handoff': id },
+    h('div', { class: 'handoff-title' },
+      s('svg', { viewBox: '-12 -12 24 24', width: 20, height: 20, 'aria-hidden': 'true' }, icon(id)),
+      h('h3', {}, title),
+    ),
+    h('p', {}, h('strong', {}, 'Handoff: '), handoff),
+    h('p', { class: 'muted' }, h('strong', {}, 'Assumption: '), assumption),
+  );
+}
+
+function readingFlow(model) {
+  const handoffs = {
+    workItem: [
+      'Work item → branch',
+      'The issue number or AB# ID connects planned work to a branch.',
+      'Being assigned the work does not prove who used AI.',
+    ],
+    branch: [
+      'Branch → AI session',
+      'Repository + branch group local sessions into one cycle.',
+      'First activity is not branch creation; reused branches can mix efforts.',
+    ],
+    aiWork: [
+      'Session → credit record',
+      'AI requests supply credit counts and, when enabled, the account that used AI. The developer view links those credits to work.',
+      'A recorded account takes priority. Without one, a single owner can support an estimate, not a measured user.',
+    ],
+    commits: [
+      'AI work → commits',
+      'Local commit references and PR commits link the change.',
+      'A matching commit does not prove AI wrote it or tell us its exact credit use.',
+    ],
+    pullRequest: [
+      'Branch → pull request',
+      'Check delivery finds the pull request and the issues it closes.',
+      'Mentioning a pull request does not prove ownership. Its author may not be the person who used AI.',
+    ],
+    review: [
+      'PR author → review',
+      'Submitted review states and dates show when the change entered review.',
+      'A review does not necessarily mean approval, correct code or time spent by a person.',
+    ],
+    close: [
+      'Merge → work-item closure',
+      'Check delivery checks the merge and whether linked work items are closed.',
+      'With no linked work item, completion means merged only. It does not prove the change was deployed or created business value.',
+    ],
+  };
+  return disclosure('recipe-guide', 'Reading the flow · handoffs & assumptions',
+    h('p', { class: 'small' }, 'Developer filters change the credit breakdown; Lifecycle and Cycles retain all work in the window.'),
+    h('ol', { class: 'recipe-handoffs' }, model.recipe.steps.map((step) => handoffEntry(step.id, handoffs[step.id]))),
+    handoffEntry('billing', [
+      'Separately: recorded usage → bill → estimated work cost',
+      'Read billing gets a user’s credits and charges from the selected paying account for one completed UTC day. Compare with recorded usage for the same GitHub account and exact model, one source at a time.',
+      'Billing does not wait for merge. Work costs are estimated shares of the charge after discounts, not bills for each work item. Unknown users, unmatched models and unexplained charges stay separate. We do not estimate work costs for a model when recorded usage exceeds billed usage.',
+    ], 'section'),
+    h('p', { class: 'small' }, 'Dark band: all steps so far are present, not necessarily recorded in date order. Light band: this step is present but earlier steps may be missing. Stripes: unknown. Dotted lines: a missing step.'),
+  );
+}
+
 export function renderRecipe(view, model, ui) {
   if (!view) return h('p', { class: 'muted' }, 'Loading recipe…');
+  if (!view.developers) return h('p', { role: 'alert' }, 'Reload the AI attribution extension to load developer attribution.');
   const notes = [
-    ...view.totals.unlinked.filter((u) => u.calls).map((u) => `${SOURCE_SHORT[u.id] ?? u.id}: ${fmtInt.format(u.calls)} model calls (${fmtCredits.format(u.credits)} credits) had no repository, so they belong to no cycle.`),
+    ...view.totals.unlinked.filter((u) => u.calls).map((u) => `${SOURCE_SHORT[u.id] ?? u.id}: ${fmtInt.format(u.calls)} calls / ${fmtCredits.format(u.credits)} cr have no repository.`),
     view.totals.droppedRefs ? `${view.totals.droppedRefs} recorded references were not a number or commit ID of the session's own repository and were ignored.` : null,
     view.totals.truncated ? `Only the ${view.totals.cycles} most recent cycles are shown; ${view.totals.truncated} older ones are not.` : null,
     view.verification?.truncated ? `Verification covered the most recent cycles only; ${view.verification.truncated} github.com cycles were not checked.` : null,
   ].filter(Boolean);
   return [
-    h('p', { class: 'lede' }, 'Work item → AI work → reviewed change. One cycle per branch.'),
+    h('h2', { class: 'recipe-headline' }, "What work is behind this developer's AI credits?"),
     toolbar(view, ui),
-    h('p', { class: 'muted small' }, `${view.totals.cycles} cycles · ${view.kpis.verifiedCycles}/${view.totals.github} GitHub cycles verified. Credits are separate, not a bill.`),
-    view.verification
-      ? null
-      : h('div', { class: 'callout' }, h('strong', {}, 'Local evidence only. '), 'Verify with GitHub / Boards to check review, merge and closure.'),
+    ui.error ? h('p', { role: 'alert' }, ui.error) : null,
+    h('p', { class: 'muted small' }, `${view.totals.cycles} branches · ${view.kpis.verifiedCycles}/${view.totals.github} GitHub branches checked. Sources are separate; recorded credits are not a bill.`),
+    view.verification ? null : h('div', { class: 'callout' }, 'Local records only. Check delivery to confirm online results; Read billing checks charges separately.'),
+    setupSection(view, ui),
+    h('h2', {}, 'Lifecycle · all cycles'),
     recipeStrip(view, model),
-    kpiCards(view),
-    h('div', { class: 'grid two recipe-pair' }, adherenceCard(view, model), ingredientsCard(view)),
+    developerPanel(view, ui),
+    readingFlow(model),
+    medianTimes(view),
+    billingPanel(view, ui),
     h('h2', {}, 'Cycles'),
     view.cycles.length ? lanes(view, model, ui) : h('p', { class: 'muted' }, 'No model calls with a repository in this window.'),
-    disclosure('recipe-surfaces', 'Step × surface', surfaceMatrix(model)),
-    disclosure('recipe-guide', 'Reading the flow',
-      h('p', {}, model.recipe.summary),
-      h('p', {}, 'Solid core: steps followed in order. Light band: step recorded in any order. Hatching: not verified. Tails: cycles leaving the in-order path.'),
-      h('p', {}, 'Timeline: hollow markers are local or referenced; filled markers are verified. Bars show credits per source, never summed.'),
-      h('ul', {}, model.recipe.evidence.map((e) => h('li', {}, h('strong', {}, `${e.label}: `), e.description))),
-    ),
-    disclosure('recipe-privacy', 'Network & limits',
-      h('ul', { class: 'small' }, model.recipe.guardrails.map((g) => h('li', {}, g))),
-    ),
     notes.length ? h('ul', { class: 'small muted' }, notes.map((n) => h('li', {}, n))) : null,
   ];
 }
diff --git a/.github/extensions/ai-attribution/ui/style.css b/.github/extensions/ai-attribution/ui/style.css
index 9be882a..73b9d95 100644
--- a/.github/extensions/ai-attribution/ui/style.css
+++ b/.github/extensions/ai-attribution/ui/style.css
@@ -197,6 +197,75 @@ main {
   margin: 0 0 16px;
 }
 
+.recipe-headline {
+  margin: 0 0 16px;
+  font-size: var(--text-title-medium, 20px);
+  line-height: var(--leading-title-medium, 28px);
+}
+.overview-title {
+  margin: 0 0 8px;
+  font-size: var(--text-title-medium, 20px);
+  line-height: var(--leading-title-medium, 28px);
+}
+.overview-mission {
+  max-width: 1000px;
+}
+.overview-map {
+  margin: 0 0 20px;
+  overflow-x: auto;
+}
+.overview-map svg {
+  display: block;
+  width: 100%;
+  min-width: 1000px;
+}
+.overview-group {
+  fill: var(--muted);
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+}
+.overview-edge {
+  stroke: var(--orange);
+  stroke-width: 1.5;
+  fill: none;
+}
+.overview-edge.requested {
+  stroke: var(--blue);
+  stroke-dasharray: 5 4;
+}
+#overview-arrow path {
+  fill: var(--muted);
+}
+.overview-node rect {
+  fill: var(--bg);
+  stroke: var(--border);
+}
+.overview-node.requested rect {
+  stroke: var(--blue);
+  stroke-dasharray: 5 4;
+}
+.overview-node.recipe rect {
+  fill: color-mix(in srgb, var(--orange) 6%, var(--bg));
+  stroke: var(--orange);
+}
+.overview-node.answer rect {
+  fill: var(--surface);
+}
+.overview-node-title {
+  fill: var(--fg);
+  font-size: 15px;
+  font-weight: 600;
+}
+.overview-node-detail {
+  fill: var(--muted);
+  font-size: 12px;
+}
+.overview-step {
+  fill: var(--fg);
+  font-size: 14px;
+}
+
 .grid {
   display: grid;
   gap: 12px;
@@ -611,6 +680,18 @@ th.num {
 .recipe-strip .band-serve rect {
   fill: color-mix(in srgb, var(--green) 6%, transparent);
 }
+.recipe-strip .band-billing > rect {
+  fill: color-mix(in srgb, var(--blue) 6%, transparent);
+}
+.recipe-strip .billing-connector {
+  stroke: var(--blue);
+  stroke-width: 2;
+  stroke-dasharray: 4 4;
+  fill: none;
+}
+.recipe-strip .billing-endpoint .station-ring {
+  stroke: var(--blue);
+}
 .recipe-strip .band-label {
   font-size: 13px;
   font-weight: 700;
@@ -852,6 +933,7 @@ table.compact td {
   display: inline-flex;
   flex-wrap: wrap;
   gap: 4px;
+  max-width: 100%;
 }
 .src {
   font-size: 11px;
@@ -859,7 +941,9 @@ table.compact td {
   padding: 0 7px;
   line-height: 18px;
   border: 1px solid var(--border);
-  white-space: nowrap;
+  white-space: normal;
+  max-width: 100%;
+  overflow-wrap: anywhere;
   font-variant-numeric: tabular-nums;
 }
 .src-sessionStore {
@@ -1107,10 +1191,100 @@ table.compact td {
   margin: 4px 0 2px;
   padding: 8px 0 0;
   border-top: 1px dashed var(--border);
+}
+.recipe-steps {
+  list-style: none;
+  padding: 0;
+  margin: 8px 0;
   display: grid;
   grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
   gap: 8px 16px;
 }
+.actor-roles {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+.actor-roles .chip {
+  max-width: 100%;
+  white-space: normal;
+  overflow-wrap: anywhere;
+}
+.developer-report {
+  margin: 12px 0;
+}
+.developer-report .toolbar h3 {
+  margin: 0 12px 0 0;
+}
+.developer-report select,
+.developer-report input {
+  max-width: 100%;
+  min-width: 0;
+}
+.actor-balance {
+  display: flex;
+  align-items: baseline;
+  gap: 8px 24px;
+  flex-wrap: wrap;
+  font-size: 12px;
+}
+.actor-balance > strong {
+  font-size: 24px;
+}
+.actor-credit-bar {
+  display: flex;
+  height: 10px;
+  background: var(--border);
+  border-radius: 5px;
+  overflow: hidden;
+  margin: 8px 0;
+}
+.actor-credit-bar .measured {
+  background: var(--green);
+}
+.actor-credit-bar .inferred {
+  background: var(--yellow);
+}
+.actor-credit-bar .unattributed {
+  background: var(--muted);
+}
+.actor-work .mono {
+  display: block;
+  overflow-wrap: anywhere;
+}
+.recipe-handoffs {
+  display: grid;
+  gap: 12px;
+  padding-left: 24px;
+}
+.handoff-card {
+  padding: 10px 12px;
+  border-left: 2px solid var(--orange);
+  background: var(--surface);
+}
+.billing-handoff {
+  margin: 12px 0 12px 24px;
+  border-left-color: var(--blue);
+}
+.handoff-title {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.handoff-title h3 {
+  margin: 0;
+}
+.handoff-card p {
+  margin: 6px 0 0;
+}
+.developer-report .more {
+  margin-top: 8px;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 5px;
+  padding: 4px 8px;
+}
 .rc-step {
   display: grid;
   grid-template-columns: 26px 1fr;
@@ -1170,6 +1344,12 @@ table.compact td {
 .disclosure .mono {
   overflow-wrap: anywhere;
 }
+.disclosure .toolbar > *,
+.disclosure select,
+.disclosure input {
+  max-width: 100%;
+  min-width: 0;
+}
 .disclosure pre {
   overflow-x: auto;
 }
@@ -1329,7 +1509,7 @@ table.compact td {
   fill: var(--muted);
   font-size: 11px;
 }
-.tier-cards {
+.link-methods {
   grid-template-columns: repeat(auto-fit, minmax(145px, 1fr));
 }
 .coverage-sources {
@@ -1356,6 +1536,42 @@ table.compact td {
   margin-left: 6px;
   font-variant-numeric: tabular-nums;
 }
+.billing-panel {
+  margin: 16px 0;
+}
+.billing-stats {
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin: 14px 0;
+}
+.billing-form {
+  align-items: end;
+  margin: 12px 0;
+}
+.billing-field {
+  display: grid;
+  gap: 4px;
+  font-size: 12px;
+  color: var(--muted);
+  min-width: 0;
+}
+.billing-field input {
+  font: inherit;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 5px 8px;
+  max-width: 100%;
+  min-width: 0;
+}
+.billing-panel button:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+.node-billing_reconciliation rect,
+.node-work_allocation rect {
+  stroke: var(--blue);
+}
 .recipe-toolbar .status-chip {
   max-width: 100%;
   white-space: normal;
@@ -1379,7 +1595,7 @@ table.compact td {
     overflow-x: auto;
   }
   .recipe-strip > svg {
-    min-width: 850px;
+    min-width: 1180px;
   }
 }
 @media (max-width: 480px) {
@@ -1396,6 +1612,9 @@ table.compact td {
   .recipe-kpis {
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
+  .billing-stats {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
   .lane {
     grid-template-columns: minmax(0, 1fr);
   }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79062cd..aef5b06 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,34 @@
 
 ## Unreleased
 
+- **Overview at a glance:** mission statement and a hybrid source-to-Recipe map,
+  showing people/usage records, delivered work and the separate bill comparison.
+  Local measurements follow the map rather than serving as the page's mission.
+- **Simple work-link labels:** removed research-only codes from the canvas,
+  model, estimated-cost report metadata and documentation. Model schema 2
+  uses descriptive link methods instead.
+- **Harness names:** consistently distinguish the VS Code Local harness from
+  the Copilot Agent Host harness in the canvas, diagnostics, dashboard and docs.
+  Source IDs, settings and database names are unchanged.
+- **Plain-English canvas:** clearer tab names, account/usage labels and billing
+  explanations. Technical field names, commands and API IDs are unchanged.
+  A browser check guards against unexplained jargon in the main views.
+- **Billing and setup in Recipe:** explicit one-day GitHub AI-credit reports,
+  per-source native-user/model comparison and clearly labelled work estimates with
+  unmatched balances. The data model now draws the parallel billing lane.
+  **Setup & permissions** is the single checklist for stores, identity,
+  branch/commit conventions, API access and assumptions.
+- **Essentials-only canvas:** shared concepts move into a Surfaces filter;
+  duplicated KPI, ingredient, relationship and surface panels are removed.
+  Research summarizes findings and limits inline instead of duplicating every
+  tab or requiring a download. Estimated work cost uses a plain-language label.
+- **Recipe developer attribution:** connects captured `user.name` to work,
+  GitHub assignees/PR authors and Azure Boards assignees at first AI activity.
+  Filter by developer and source; measured consumption, inferred ownership
+  proxies and unattributed credits stay separate. Work-ownership mode includes
+  other contributors without calling their usage personal consumption.
+  Cross-provider account links are explicit and panel-scoped.
+
 - **AI attribution canvas: Recipe tab.** One AI-assisted delivery cycle per
   repository branch, from work item to merged pull request: ingredients (GitHub
   issue or Azure Boards work item, branch), method (AI sessions, credits,
@@ -15,7 +43,7 @@
   hook adds the matching `Refs:` trailer. Canvas screenshots now read only
   sandboxed synthetic stores.
 - **Tighter attribution tabs:** shorter summaries, compact coverage bars,
-  an entity diagram and expandable evidence across all eight views.
+  an entity diagram and expandable evidence across the views.
   Recipe keeps its full lifecycle with fewer KPI cards; Research becomes a
   section index. Keyboard controls, narrow layouts and visible-copy budgets
   are checked by the synthetic screenshot harness.
@@ -38,14 +66,14 @@
 
 - Refreshed the attribution research and canvas model to 19 October 2026:
   per-session cloud agent AI credits (Agent Tasks REST, preview), VS Code's
-  Copilot-harness Agent Host telemetry, managed OTel identity capture, the
+  Copilot Agent Host harness Agent Host telemetry, managed OTel identity capture, the
   usage-metrics agent undercount, and OTel GenAI metric and token-breakdown
   changes. Local measurements were re-run, and the research preamble is now a
   last-updated date.
-- README: Copilot-harness sessions get identity only through managed
+- README: Copilot Agent Host harness sessions get identity only through managed
   `telemetry.capture.identity`. The Marketplace listing is live, so the install
   section no longer treats it as pending.
-- Copilot-harness chats (VS Code 1.141+) are now metered. Bear in Mind reads
+- Copilot Agent Host harness chats (VS Code 1.141+) are now metered. Bear in Mind reads
   the Agent Host trace store (`agent-host-traces.db`), using only Copilot runtime
   traces, merged by span ID. Calls only the Agent Host recorded go to their own
   meter ledger, added to the reconciled Local figure and kept out of drift.
@@ -57,7 +85,7 @@
   unless a protobuf or gRPC collector would stop receiving its traces.
   **Restore Defaults** puts it back. Diagnostics show the store's path and
   activity.
-- The AI attribution canvas adds a VS Code Copilot harness source with
+- The AI attribution canvas adds a VS Code Copilot Agent Host harness source with
   per-turn credits.
 
 ## 0.6.5
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5b1d75f..1ebd6bb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -18,7 +18,7 @@ then press `F5` for an Extension Development Host.
 | `src/api.ts`, `src/extension.ts` | Public contract, shared reporting adapter, activation and commands. |
 | `src/tokenMeter.ts` | Persisted ledgers, reconciliation and ice health. |
 | `src/chatWatcher.ts`, `src/otelWatcher.ts` | Transcript/feed I/O, baselines and trace-store queries. |
-| `src/agentHost.ts` | VS Code Agent Host (Copilot harness) store location and the connect decision for its DB mode. |
+| `src/agentHost.ts` | Copilot Agent Host harness store location and the connect decision for its DB mode. |
 | `src/accountUsage.ts`, `src/sqlite.ts` | Authenticated GitHub quota lookup and shared runtime read-only SQLite support. |
 | `src/otelParse.ts`, `src/spanUsage.ts`, `src/otelSummary.ts`, `src/climate.ts` | Pure metric/span parsing, aggregation, session comparison, dashboard snapshots and the habitat's model climate. |
 | `.github/extensions/ai-attribution/lib/tokenCoverage.cjs` / `.d.cts` | Shared token reporting/paired-count logic, bundled into the typed extension and used directly by the build-free canvas. |
@@ -83,7 +83,7 @@ dependencies; reload extensions in the app after editing. Its tests run with
   `process.user.name` or `host.name`, which are a device, not an account. Leave
   unlinked calls as *no user identity* rather than guessing.
   Select optional `agent-traces.db` columns defensively; older stores lack them.
-- `agent-host-traces.db` (VS Code Agent Host, Copilot harness) shares the trace
+- `agent-host-traces.db` (VS Code Copilot Agent Host harness) shares the trace
   store schema but also holds Claude and Codex traces. Read only traces with a
   `github.copilot.*` attribute, merge by span ID with the other sources, and let
   non-GenAI ancestors (the host's session anchor) pass through when classifying
@@ -137,10 +137,24 @@ dependencies; reload extensions in the app after editing. Its tests run with
   source, never summed. Recorded references keep only numbers of the session's
   own repository and commit IDs; summaries and free text are never read.
   Unknown steps stay unknown until verified. Verification runs only on request,
-  sends only recorded identifiers, never selects titles, descriptions, commit
-  messages, comments or logins, passes GitHub values as GraphQL variables and
+  sends work identifiers and first-activity times, never selects titles,
+  descriptions, commit messages, comments or email fields, passes GitHub values as GraphQL variables and
   keeps Azure DevOps tokens in memory. `lib/convention.mjs` and the
   self-contained `hooks/commit-msg` must parse branches identically.
+- Recipe keeps the native consumer (`user.name`), historical/current work-item
+  assignee and PR author as separate roles. Native consumption wins over owner
+  inference; conflicting owners stay unattributed. Never backdate the current
+  assignee. Azure Boards IDs are organization-qualified and link to GitHub only
+  through explicit panel-scoped mappings, never matching names or email.
+  Per-source measured, inferred and unattributed balances must conserve all
+  reported credits, including no-repository usage and cycles outside the display cap.
+- Recipe billing is a separate explicit read of one completed UTC day. Preserve
+  paying account, user and product filters, API units, model/SKU and retrieval
+  time. Compare native consumers only; never promote owner inference to billing.
+  Keep gross, discounts and net distinct. No PR/session IDs exist in billing:
+  work amounts are estimated shares with an unallocated remainder. Skip allocation
+  for a model when captured credits exceed billed credits. Fail on unsupported
+  units; failed reads clear old reports and never return raw CLI errors.
 
 Extend regression tests for accounting changes. The OTel fixture was generated
 using the SDK and Copilot-compatible exporters; preserve those record shapes.
@@ -161,6 +175,10 @@ Run `npm run media` after artwork changes. The HTML screenshot harness mirrors
 webview markup and must stay in sync. `tools/dashboard.html?waiting` previews a
 connected feed without quality signals. See [tools/README.md](tools/README.md).
 Committed screenshots use invented repositories, users and organizations only.
+Use plain English for canvas labels and explanations. Keep exact API keys,
+settings, commands and internal IDs unchanged in setup or technical details.
+Call the VS Code sources **Local harness** and **Copilot Agent Host harness**.
+The shared labels live in `ui/format.mjs`; source IDs and settings do not change.
 `npm run media:canvas` points store discovery at an empty sandbox and fails if a
 source resolves outside its synthetic fixtures; Recipe verification there uses
 canned answers, never the network.
diff --git a/README.md b/README.md
index d527428..7cf7140 100644
--- a/README.md
+++ b/README.md
@@ -136,7 +136,7 @@ The dashboard and Copilot report different units and scopes:
 | --- | --- |
 | Copilot account usage and allowance | GitHub quota API values across sessions and surfaces, with reported plan and reset date. Requires authorized GitHub sign-in; unofficial API, not an invoice. |
 | Copilot **Session Cost** | Compare with transcript credits for the same session. Uses VS Code's `max(sum(turn credits), reported session credits)` formula and includes existing history. |
-| Local tokens | Persisted metric/span usage since the meter start, reconciled by per-dimension maximum, plus Copilot-harness calls only the Agent Host recorded and labeled manual reports. Not a session or billing-period total. |
+| Local tokens | Persisted metric/span usage since the meter start, reconciled by per-dimension maximum, plus Copilot Agent Host harness calls only the Agent Host recorded and labeled manual reports. Not a session or billing-period total. |
 | Trace credits | Reported on unique model-call spans. Coverage is shown; missing credits are unknown. Diagnostics only, never added to transcript credits or the meter. |
 | Gauge with All sessions | Remaining account allowance from GitHub, kept separate from local tokens and credits. Pooled/unlimited plans have no percentage denominator. |
 | Context Window and selected-session gauge | The native window includes prompt and completion tokens against the selected model's full window. The selected-session gauge uses a trace's reported prompt allowance, not that full window. |
@@ -202,18 +202,18 @@ then send a chat request. Allow time for the export to arrive.
 
 | Source | Provides | Exporter impact |
 | --- | --- | --- |
-| Local trace store (`agent-traces.db`, plus `agent-host-traces.db` for the Copilot harness) | Model-call tokens, optional credits, exact timings, reported prompt limits, session repository/branch and user, callers, reasoning effort and tool-span status. | Runs alongside an existing OTLP collector. |
+| Local trace store (`agent-traces.db`, plus `agent-host-traces.db` for the Copilot Agent Host harness) | Model-call tokens, optional credits, exact timings, reported prompt limits, session repository/branch and user, callers, reasoning effort and tool-span status. | Runs alongside an existing OTLP collector. |
 | JSON-lines file feed | Token metrics, quality signals and (in current Copilot) serialized spans with session details. | **Replaces the OTLP exporter.** The command warns first. |
 | Both | All available signals. | Same replacement caveat as the file feed. |
 
-VS Code 1.141+ can run chats in the **Copilot harness**, which is becoming the
+VS Code 1.141+ can run chats in the **Copilot Agent Host harness**, which is becoming the
 default. Its telemetry comes from VS Code's Agent Host, not Copilot Chat, so
 choosing the trace store also turns on the Agent Host's local store
 (`chat.agentHost.otel.dbSpanExporter.enabled`). Connect skips this when the
 Agent Host already exports traces over OTLP protobuf or gRPC, because its store
 would keep them from that collector. The Agent Host reads the setting only when
 it starts: quit and reopen VS Code, or run **Developer: Restart Local Agent
-Host**, which interrupts running Copilot-harness chats.
+Host**, which interrupts running Copilot Agent Host harness chats.
 
 Bear in Mind reads only Copilot runtime traces from that store (spans stamped
 with `github.copilot.*`), not Claude or Codex harness sessions. Calls recorded
@@ -253,7 +253,7 @@ prompt says so. If replacing a collector fails, Connect leaves identity capture
 off. `COPILOT_OTEL_CAPTURE_IDENTITY` outranks the setting, so when it is set
 Connect does not offer the choice. An organisation policy
 (`CopilotOtelCaptureIdentity`) overrides both. The setting covers only the Local
-chat harness; Copilot-harness sessions get identity only through managed
+chat harness; Copilot Agent Host harness sessions get identity only through managed
 `telemetry.capture.identity` (VS Code 1.141+), and only when the bundled runtime
 adds `user.name`. **Iceberg: Telemetry
 Diagnostics** shows whether capture is requested and how many retained calls
diff --git a/SECURITY.md b/SECURITY.md
index 1c7a8a6..54c2f93 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -16,7 +16,7 @@ Bear in Mind meters local files:
 - The configured Copilot OpenTelemetry JSON-lines feed and read-only
   `agent-traces.db`, for metrics, timings and outcome labels.
 - VS Code's read-only Agent Host store `<userData>/agent-host/otel/agent-host-traces.db`
-  (VS Code 1.141+), for the same span metadata from Copilot-harness chats. Only
+  (VS Code 1.141+), for the same span metadata from Copilot Agent Host harness chats. Only
   Copilot runtime traces are used; Claude and Codex harness traces in the same
   store are skipped.
 
@@ -56,6 +56,24 @@ The connection opt-in is saved separately from the GitHub authentication grant.
 The optional `@iceberg` participant sends its chat request through VS Code's
 language-model API, like other chat participants.
 
+The optional AI attribution canvas reads local usage and `user.name` metadata.
+Its Recipe **Verify** button explicitly requests GitHub PR authors, issue
+assignment events and Azure Boards assignment snapshots. Requests send work
+identifiers and first-activity timestamps, never local usage totals or chat
+content. GitHub login names and Azure Boards account IDs/display names are
+retained in memory; email fields, titles, descriptions, commit messages and
+comments are not requested. Azure Boards identity objects may include contact
+metadata in their responses; it is discarded, retaining only ID and display name.
+Azure DevOps credentials stay in memory and are
+never returned or logged. Cross-provider identity links are explicit and
+panel-scoped, not written into the repository or user settings.
+Recipe **Read billing** is a separate explicit network action through `gh`.
+It sends the selected paying-account level/slug, GitHub login, Copilot product
+and completed UTC day to GitHub's AI-credit billing API. It does not send local
+credits, work allocations or transcripts. Only the scoped report's model/SKU,
+units, prices, quantities and amounts are retained in panel memory. Failed
+requests clear the previous report and do not expose raw command output.
+
 Usage ledgers, bounded overlap evidence and file cursors are saved in VS Code's
 local global state. **Connect Copilot Telemetry** also changes the selected Copilot
 settings, records their previous user values, and creates the chosen feed
diff --git a/docs/media/canvas-coverage.png b/docs/media/canvas-coverage.png
index 34a5525..f90d427 100644
Binary files a/docs/media/canvas-coverage.png and b/docs/media/canvas-coverage.png differ
diff --git a/docs/media/canvas-gaps.png b/docs/media/canvas-gaps.png
index 4cfc464..492a2d6 100644
Binary files a/docs/media/canvas-gaps.png and b/docs/media/canvas-gaps.png differ
diff --git a/docs/media/canvas-intersection-dark.png b/docs/media/canvas-intersection-dark.png
index 2e412c2..236f518 100644
Binary files a/docs/media/canvas-intersection-dark.png and b/docs/media/canvas-intersection-dark.png differ
diff --git a/docs/media/canvas-intersection.png b/docs/media/canvas-intersection.png
index 8031687..f7ce2af 100644
Binary files a/docs/media/canvas-intersection.png and b/docs/media/canvas-intersection.png differ
diff --git a/docs/media/canvas-model.png b/docs/media/canvas-model.png
index 55c6aa5..f949ba0 100644
Binary files a/docs/media/canvas-model.png and b/docs/media/canvas-model.png differ
diff --git a/docs/media/canvas-outcomes.png b/docs/media/canvas-outcomes.png
index f8e522e..fe86f55 100644
Binary files a/docs/media/canvas-outcomes.png and b/docs/media/canvas-outcomes.png differ
diff --git a/docs/media/canvas-recipe-billing.png b/docs/media/canvas-recipe-billing.png
new file mode 100644
index 0000000..995669e
Binary files /dev/null and b/docs/media/canvas-recipe-billing.png differ
diff --git a/docs/media/canvas-recipe-developer.png b/docs/media/canvas-recipe-developer.png
new file mode 100644
index 0000000..aa7b883
Binary files /dev/null and b/docs/media/canvas-recipe-developer.png differ
diff --git a/docs/media/canvas-recipe-local.png b/docs/media/canvas-recipe-local.png
index c0a76b7..f946bcd 100644
Binary files a/docs/media/canvas-recipe-local.png and b/docs/media/canvas-recipe-local.png differ
diff --git a/docs/media/canvas-recipe-setup.png b/docs/media/canvas-recipe-setup.png
new file mode 100644
index 0000000..24039c3
Binary files /dev/null and b/docs/media/canvas-recipe-setup.png differ
diff --git a/docs/media/canvas-recipe.png b/docs/media/canvas-recipe.png
index c7a8efa..b77c94f 100644
Binary files a/docs/media/canvas-recipe.png and b/docs/media/canvas-recipe.png differ
diff --git a/docs/media/canvas-research.png b/docs/media/canvas-research.png
index 7b2ef15..8d87846 100644
Binary files a/docs/media/canvas-research.png and b/docs/media/canvas-research.png differ
diff --git a/docs/media/canvas-surfaces.png b/docs/media/canvas-surfaces.png
index 94ae7aa..58f3282 100644
Binary files a/docs/media/canvas-surfaces.png and b/docs/media/canvas-surfaces.png differ
diff --git a/docs/media/dashboard-account.png b/docs/media/dashboard-account.png
index 105792d..1183bf7 100644
Binary files a/docs/media/dashboard-account.png and b/docs/media/dashboard-account.png differ
diff --git a/docs/media/dashboard-context.png b/docs/media/dashboard-context.png
index 01ba11d..3ee6985 100644
Binary files a/docs/media/dashboard-context.png and b/docs/media/dashboard-context.png differ
diff --git a/docs/media/dashboard-credits.png b/docs/media/dashboard-credits.png
index e4956e2..8a6e92f 100644
Binary files a/docs/media/dashboard-credits.png and b/docs/media/dashboard-credits.png differ
diff --git a/docs/media/dashboard-empty.png b/docs/media/dashboard-empty.png
index ea19663..d104c5f 100644
Binary files a/docs/media/dashboard-empty.png and b/docs/media/dashboard-empty.png differ
diff --git a/docs/media/dashboard-high-contrast-light.png b/docs/media/dashboard-high-contrast-light.png
index 01a02fa..589e84e 100644
Binary files a/docs/media/dashboard-high-contrast-light.png and b/docs/media/dashboard-high-contrast-light.png differ
diff --git a/docs/media/dashboard-high-contrast.png b/docs/media/dashboard-high-contrast.png
index eae60ee..6d2e612 100644
Binary files a/docs/media/dashboard-high-contrast.png and b/docs/media/dashboard-high-contrast.png differ
diff --git a/docs/media/dashboard-light.png b/docs/media/dashboard-light.png
index 277a2b5..5570989 100644
Binary files a/docs/media/dashboard-light.png and b/docs/media/dashboard-light.png differ
diff --git a/docs/media/dashboard-sdk.png b/docs/media/dashboard-sdk.png
index 7873769..cf27c6a 100644
Binary files a/docs/media/dashboard-sdk.png and b/docs/media/dashboard-sdk.png differ
diff --git a/docs/media/dashboard-waiting.png b/docs/media/dashboard-waiting.png
index 10f544a..2fb381c 100644
Binary files a/docs/media/dashboard-waiting.png and b/docs/media/dashboard-waiting.png differ
diff --git a/docs/media/dashboard.png b/docs/media/dashboard.png
index b52476c..f34e2dc 100644
Binary files a/docs/media/dashboard.png and b/docs/media/dashboard.png differ
diff --git a/docs/research/ai-telemetry-attribution.md b/docs/research/ai-telemetry-attribution.md
index c694023..be558ec 100644
--- a/docs/research/ai-telemetry-attribution.md
+++ b/docs/research/ai-telemetry-attribution.md
@@ -2,6 +2,11 @@
 
 Last updated on 19/10/2026
 
+Implementation note (22 October 2026): this is the research snapshot. Recipe now
+supports explicit delivery verification, developer attribution and scoped billing
+reconciliation. See the [canvas guide](../../.github/extensions/ai-attribution/README.md)
+for the current connection, permission and allocation contracts.
+
 ## Executive summary
 
 **Decision: proceed with source-aware usage and attribution measurement, not
@@ -27,7 +32,7 @@ availability is not permission to join or compare unlike values.
 harness can emit opt-in `user.name`; SDK/CLI telemetry emits an opaque
 `enduser.pseudo.id` by default. Enterprises can now enable a managed
 **Identity** capture class that adds the Copilot account, operating-system
-account and machine name in Copilot CLI, the app and VS Code's Copilot harness.
+account and machine name in Copilot CLI, the app and VS Code's Copilot Agent Host harness.
 Device resource attributes are not person identities. Canonical actor/device
 keys are derived, and organisation, team and cost-centre assignments must be
 configured or externally enriched with provenance; they must not be guessed
@@ -41,7 +46,7 @@ process, not by publishing an unreviewed tag.
 
 **Two platform changes move the picture.** Cloud agent sessions now report
 their own AI-credit usage alongside their pull request (Agent Tasks REST,
-public preview). In VS Code, the Copilot harness is becoming the default and
+public preview). In VS Code, the Copilot Agent Host harness is becoming the default and
 sends its telemetry through a separate Agent Host pipeline, so readers of the
 Local harness's `agent-traces.db` alone will lose coverage.
 
@@ -77,7 +82,7 @@ complexity, team and quality. Collect:
 | Investment | Billed AI spend, seats/infrastructure, setup, prompting, review and rework time | Local reported credits and tokens only; not a bill or human effort |
 | Delivered value | Verified merged/deployed work, cycle time, quality/reverts, and a declared valuation of time or business outcomes | Some local activity proxies; no verified PR/CI linkage or monetary value |
 | Baseline | Comparable non-AI delivery and quality, with the same value and cost definitions | Not collected |
-| Attribution confidence | Session → work item → verified outcome, with tier and unattributed share | Local repository and sometimes PR references; no outcome join |
+| Strength of the work link | Session → work item → checked result, with the link method and any usage without a link | Local repository and sometimes PR references; no outcome join |
 
 An illustrative return is **(incremental valued benefit − AI investment) /
 AI investment**, with the investment including the full incremental spend
@@ -111,10 +116,10 @@ conditions rather than treating the intersection as a cross-surface inner join.
 | 25 Sep | Usage metrics `repos-1-day` rows gain `pull_request_review_times`: median and p90 minutes per review stage, by author and reviewer type | Review-latency outcome at repository/day; still no session IDs |
 | 6 Oct | GitHub disclosed that agent sessions from SDK-based IDE versions were left out of usage metrics or counted as Copilot CLI; fixed from VS Code 1.139, not backfilled | Agent activity and `agent_edit` lines of code are undercounted, and CLI overcounted, for affected periods; billing unaffected |
 | 6 Oct | OTel GenAI semantic conventions replace `gen_ai.client.operation.duration` with `gen_ai.client.inference.duration` for model calls and rename the chunk-timing metrics | New naming drift: GitHub's CLI reference still lists `gen_ai.client.operation.*` |
-| 7 Oct | VS Code 1.141: the Copilot harness may be the default; managed `telemetry.capture.identity` adds identity to Agent Host telemetry | Copilot-harness sessions use the Agent Host pipeline, not `agent-traces.db` |
+| 7 Oct | VS Code 1.141: the Copilot Agent Host harness may be the default; managed `telemetry.capture.identity` adds identity to Agent Host telemetry | Copilot Agent Host harness sessions use the Agent Host pipeline, not `agent-traces.db` |
 | 13 Oct | GitHub's OTel guide documents six managed capture classes, including Identity | Account-level attribution is available by policy, without capturing content |
 | 13 Oct | Copilot CLI 1.0.97: `/usage` shows billed AI credits for token-billed sessions, including after resume | Better in-product cost view; not an export |
-| 14 Oct | VS Code 1.142: the Copilot harness rolls out progressively as the default; canvases in preview | Local-harness readers lose coverage as the rollout proceeds |
+| 14 Oct | VS Code 1.142: the Copilot Agent Host harness rolls out progressively as the default; canvases in preview | Local harness readers lose coverage as the rollout proceeds |
 | 17 Oct | Semantic conventions recommend cache and reasoning token breakdowns only when non-zero | An absent breakdown may mean zero or not reported |
 | By 19 Oct | Agent Tasks REST sessions return `usage` (`ai_credits` in nano units, or legacy `premium_requests`) and `model`; public preview | Cloud sessions carry their cost and pull request together |
 
@@ -129,7 +134,7 @@ conditions rather than treating the intersection as a cross-surface inner join.
    span tree `invoke_agent → chat → execute_tool` and propagate W3C trace context.
    In VS Code the family now depends on the harness. The Local harness uses the
    extension pipeline (`github.copilot.chat.otel.*`, `agent-traces.db`). The
-   Copilot harness, rolling out as the default since VS Code 1.141–1.142, runs the
+   Copilot Agent Host harness, rolling out as the default since VS Code 1.141–1.142, runs the
    shared runtime in the Agent Host with its own `chat.agentHost.otel.*` settings
    and an opt-in `agent-host-traces.db` that is off by default.
 2. **Per-call consumption is well covered, and credits share one source.** Every
@@ -141,7 +146,7 @@ conditions rather than treating the intersection as a cross-surface inner join.
    VS Code's `copilot_chat.copilot_usage_nano_aiu`
    and the CLI/app's `copilotUsage.totalNanoAiu` both carry the Copilot API's
    `copilot_usage.total_nano_aiu`, so credits are comparable across surfaces.
-   Copilot-harness sessions in VS Code emit shared-runtime spans
+   Copilot Agent Host harness sessions in VS Code emit shared-runtime spans
    (`service.name=github-copilot`), so follow the runtime's root `invoke_agent`
    `github.copilot.nano_aiu` guidance for them. Current GenAI conventions
    recommend cache and reasoning breakdowns only when non-zero; an absent
@@ -165,10 +170,10 @@ conditions rather than treating the intersection as a cross-surface inner join.
    signed-in GitHub account, on agent invocation spans, plus `process.user.name`
    and `host.name` as resource attributes. It is off by default, a managed
    policy takes precedence, and the setting covers only the Local harness. For
-   the Copilot harness, VS Code 1.141 adds identity only through managed
+   the Copilot Agent Host harness, VS Code 1.141 adds identity only through managed
    `telemetry.capture.identity`; `user.name` then appears on runtime spans when
    the bundled runtime supports it. VS Code's monitoring guide still describes
-   identity capture as Local-harness only. `agent-traces.db`
+   identity capture as Local harness only. `agent-traces.db`
    keeps span attributes, so it holds `user.name` but not the resource
    attributes. Without it, VS Code `session.id` identifies a window, not a
    person. CLI and app stores hold no user ID; their OTel agent spans can carry
@@ -200,12 +205,12 @@ conditions rather than treating the intersection as a cross-surface inner join.
 
 | | VS Code (Copilot Chat) | Copilot CLI | GitHub Copilot app | Copilot cloud agent | Organisation plane |
 | --- | --- | --- | --- | --- | --- |
-| **Collection** | Local harness: OTel OTLP or JSON-lines file, local span DB `agent-traces.db`, transcripts (internal). Copilot harness: Agent Host OTel (`chat.agentHost.otel.*`), opt-in `agent-host-traces.db` | Session events in `~/.copilot/session-state/`; SQLite session store; OTel export; cloud session sync | Same runtime and store as CLI | Session logs, Actions run, audit log, Agent Tasks REST (preview), session streaming (preview) | Usage metrics REST/NDJSON, billing usage REST, seats, audit log |
+| **Collection** | Local harness: OTel OTLP or JSON-lines file, local span DB `agent-traces.db`, transcripts (internal). Copilot Agent Host harness: Agent Host OTel (`chat.agentHost.otel.*`), opt-in `agent-host-traces.db` | Session events in `~/.copilot/session-state/`; SQLite session store; OTel export; cloud session sync | Same runtime and store as CLI | Session logs, Actions run, audit log, Agent Tasks REST (preview), session streaming (preview) | Usage metrics REST/NDJSON, billing usage REST, seats, audit log |
 | **Session key** | `copilot_chat.chat_session_id`, `gen_ai.conversation.id`; resource `session.id` (per window) | `sessionId`, sub-agent `agentId`, `turn_index` | `sessionId`, one worktree branch per session | `agent_session_id`; task URL `github.com/{owner}/{repo}/copilot/tasks/{id}` | None (user/day, org/day, repo/day) |
-| **Consumption** | `gen_ai.usage.*` on `chat` spans; `copilot_chat.copilot_usage_nano_aiu`; transcript `copilotCredits`; Copilot harness: runtime `github.copilot.nano_aiu` | Optional `assistant.usage` tokens, `copilotUsage.totalNanoAiu`, `cost` multiplier; OTel `github.copilot.nano_aiu` | Same as CLI | Agent Tasks session `usage`: AI credits in nano units, or legacy premium requests (preview); panel usage | User/day `ai_credits_used` without model split; CLI/app daily token sums; filtered billing gross/discount/net quantities and amounts |
+| **Consumption** | `gen_ai.usage.*` on `chat` spans; `copilot_chat.copilot_usage_nano_aiu`; transcript `copilotCredits`; Copilot Agent Host harness: runtime `github.copilot.nano_aiu` | Optional `assistant.usage` tokens, `copilotUsage.totalNanoAiu`, `cost` multiplier; OTel `github.copilot.nano_aiu` | Same as CLI | Agent Tasks session `usage`: AI credits in nano units, or legacy premium requests (preview); panel usage | User/day `ai_credits_used` without model split; CLI/app daily token sums; filtered billing gross/discount/net quantities and amounts |
 | **Work context** | `github.copilot.git.{repository,branch,commit_sha}`, `github.copilot.github.org` on `invoke_agent` | `session.start.context`: `repository`, `repositoryHost`, `branch`, `headCommit`, `baseCommit`, `gitRoot` | Same, plus the app-managed branch | Repository, branch and pull request are native | Repo/day report (PRs incl. coding agent and code review) |
 | **Outcomes** | Edit acceptance, hunk actions, survival, feedback, PR and cloud-session counters | Code changes, self-reported `session.task_complete.summary`, shutdown status and tool success; not verified correctness | Same as CLI | PR opened/merged, commits co-authored by the initiator | PR throughput, merge time and review-stage times (repo/day); LoC agent vs user (user and organisation reports) |
-| **Actor** | Local harness, opt-in (1.140+): `user.name` on `invoke_agent` spans; resource `process.user.name`, `host.name`. Copilot harness: managed `telemetry.capture.identity` (1.141+) | OTel `enduser.pseudo.id` when available; managed Identity capture class; no identity in local rows | Same runtime | Initiating `user` in audit log | `user_login` |
+| **Actor** | Local harness, opt-in (1.140+): `user.name` on `invoke_agent` spans; resource `process.user.name`, `host.name`. Copilot Agent Host harness: managed `telemetry.capture.identity` (1.141+) | OTel `enduser.pseudo.id` when available; managed Identity capture class; no identity in local rows | Same runtime | Initiating `user` in audit log | `user_login` |
 | **Tools / MCP / skills** | `gen_ai.tool.*`, `github.copilot.tool.parameters.{skill_name,mcp_server_name_hash,mcp_tool_name}` | `toolName`, `mcpServerName`, `mcpToolName`, `skill.invoked`, `subagent.*`, hooks with `traceparent` | Same, plus extensions and canvases | Tool calls in session log | Partial CLI skill/plugin/custom-agent counts and MCP connection attempts; top five, custom names grouped as `other` |
 
 ## 3. Commonalities
@@ -242,11 +247,11 @@ ownership and a verified actor join still need to be supplied.
 | Gap | Where | Consequence | Mitigation |
 | --- | --- | --- | --- |
 | No reliable PR / issue ID locally | VS Code (none), CLI and app (only when referenced) | Consumption stops at branch/commit | Resolve `(repo, branch)` and `(repo, commit)` to PRs through the GitHub API; adopt `vcs.change.id` |
-| Cloud session cost is preview-only | Cloud agent (Agent Tasks REST) | Per-session `usage` exists, but the endpoint is public preview and amounts are consumption, not billed gross/net lines | Ingest as T0 cloud consumption keyed by session and PR artifact; pin the schema; reconcile with billing AI-credit reports |
+| Cloud session cost is preview-only | Cloud agent (Agent Tasks REST) | Per-session `usage` exists, but the endpoint is public preview and amounts are consumption, not billed gross/net lines | Keep cloud usage directly linked to its session and pull request; check the response format; compare with billing AI-credit reports |
 | No session ID in org data | Usage metrics, billing | Per-user consumption has no model/surface split; cannot join to sessions | Use filtered billing AI-credit reports for user/day/model, preserve filters; allocate explicitly |
 | No verified local login join by default | VS Code (opt-in only), CLI, app | CLI/app OTel pseudonyms are not a verified login; local rows have no actor | Verify the VS Code login join; add a governed collector identity/mapping for CLI/app and pseudonymise both |
 | Session ID missing on many VS Code calls | VS Code | Native session coverage is incomplete | Resolve time-appropriate conversation, parent-session or trace context; trace-only calls do not create sessions |
-| Harness split in VS Code | VS Code Copilot harness (Agent Host) | Copilot-harness sessions are not in `agent-traces.db`, and Agent Host DB persistence is off by default | Configure `chat.agentHost.otel.*` or managed telemetry export, apply runtime conventions, and keep the two pipelines separate |
+| Harness split in VS Code | VS Code Copilot Agent Host harness (Agent Host) | Copilot Agent Host harness sessions are not in `agent-traces.db`, and Agent Host DB persistence is off by default | Configure `chat.agentHost.otel.*` or managed telemetry export, apply runtime conventions, and keep the two pipelines separate |
 | Usage metrics undercount | Organisation plane, SDK-based IDE agent sessions | Agent activity and `agent_edit` lines of code undercounted, some counted as CLI; not backfilled | Require fixed IDE versions (VS Code 1.139+); annotate affected periods rather than comparing across the fix |
 | Overlapping sources | VS Code metrics vs spans; transcript vs trace; CLI store vs OTel | Double counting or undercount with mismatched windows | Precedence; conservative max only for aligned scopes/windows; never sum parent and child totals |
 | No CI/CD linkage | All | Build/deploy outcomes unattributed | Join `cicd.pipeline.run.*` by repository and commit |
@@ -259,7 +264,7 @@ ownership and a verified actor join still need to be supplied.
 
 | Project | Proved | Learned |
 | --- | --- | --- |
-| **Bear in Mind** (VS Code extension) | Metering from VS Code OTel file feed, `agent-traces.db`, the Agent Host's `agent-host-traces.db` (Copilot harness, Copilot runtime traces only) and transcripts; cost/speed/quality dashboard, including retained-trace credits by model, repository, user, caller and reasoning effort, and session repository and user labels | Count only `chat` spans; dedupe by span ID; metrics vs spans use max, not sum; transcript and trace credits are never added; credits = nano-AIU / 1e9; token share is not credit share; file-exported spans can be empty `{}` and need the span DB; `user.name`, like repository, must be inherited from `invoke_agent` |
+| **Bear in Mind** (VS Code extension) | Metering from VS Code OTel file feed, `agent-traces.db`, the Agent Host's `agent-host-traces.db` (Copilot Agent Host harness, Copilot runtime traces only) and transcripts; cost/speed/quality dashboard, including retained-trace credits by model, repository, user, caller and reasoning effort, and session repository and user labels | Count only `chat` spans; dedupe by span ID; metrics vs spans use max, not sum; transcript and trace credits are never added; credits = nano-AIU / 1e9; token share is not credit share; file-exported spans can be empty `{}` and need the span DB; `user.name`, like repository, must be inherited from `invoke_agent` |
 | **agentic-sdlc-prototypes-patterns** (Copilot Insights + ELK) | OTLP receiver, CLI session-store ingestion, flattened `copilot-insights/elk/v1` documents with `cost`/`speed`/`quality` groups, pseudonymised `developer_id` | Spans rarely carried credits then, so the CLI store was the reliable cost source; repository must be copied from `invoke_agent` to child `chat` spans; OTel and CLI planes overlap without a dedupe key |
 | **copilot-insights** (hackathon) | Relational schema (`spans`, `metric_points`, `events`, `llm_calls`, `local_sessions`) joining OTel with the CLI store by session | Repo/branch/commit exist in OTel, but no PR join was built |
 | **vscode-insights** (hackathon) | Copilot SDK instrumentation (`assistant.usage`, `subagent.*`, `skill.invoked`, quota snapshots); unified `records` table keyed by trace/span | Keys like `sdk:<sessionId>:call:<apiCallId>` give stable call identity; the account is checked against the signed-in login |
@@ -285,14 +290,14 @@ erDiagram
 | `model_call` | one model API call | `call_key`, `session_key`, agent instance, initiator / interaction class, model, auto/BYOK, reasoning effort, input/output/cache-read/cache-write/reasoning tokens, `credits_nano_aiu` (nullable) + credit source, multiplier, duration, TTFT, finish reason |
 | `tool_call` | one tool call | `tool_call_key`, class (built-in, MCP, skill, sub-agent, hook), tool, MCP server (hash), success, duration |
 | `work_item` | PR, issue, commit, branch, workflow run, task | provider, repo, number / SHA / ref, URL, opened / merged / closed |
-| `attribution` | session ↔ work item | tier, method, confidence, evidence, weight (per session ≤ 1) |
+| `attribution` | session ↔ work item | link method, confidence, evidence, share assigned to work (per session ≤ 1) |
 | `outcome` | measured result | kind (edit accepted, survival, feedback, lines changed, task complete, PR merged, review rounds, CI result, revert, lead time), value, unit, source |
 | `cost_ledger` | billing line with preserved request scope | billing entity/account type, requested UTC day/user/model, product/SKU, unit/rate, gross/discount/net quantities and amounts, retrieval time and coverage — reconciliation only |
 
 ### Actor field provenance
 
-`user.name` is readable on opt-in VS Code Local-harness agent spans, and on
-Copilot-harness runtime spans when managed `telemetry.capture.identity` is on
+`user.name` is readable on opt-in VS Code Local harness agent spans, and on
+Copilot Agent Host harness runtime spans when managed `telemetry.capture.identity` is on
 and the bundled runtime supports it. SDK/CLI emits `enduser.pseudo.id`, an
 opaque analytics ID rather than a GitHub login, unless the managed Identity
 capture class adds the account name.
@@ -307,15 +312,15 @@ if declared in `OTEL_RESOURCE_ATTRIBUTES` or added by a collector, otherwise
 they require external enrichment. `github.copilot.github.org` identifies the
 repository owner, not the developer's employer or billing organisation.
 
-### Attribution tiers
+### How usage is linked to work
 
-| Tier | Method | Example |
+| Link | How we know | Example |
 | --- | --- | --- |
-| T0 native | Work ownership emitted by the surface | Cloud-owned session → PR, with its Agent Tasks `usage`; audit `agent_session_id`. A mentioned PR is only a reference until verified |
-| T1 deterministic | Exact, unambiguous VCS join | Verify head repository, commit and time; disambiguate forks, branch reuse and multiple PR matches |
-| T2 inferred | Time and content overlap | Same repo and actor within PR commit window; modified files ∩ PR diff |
-| T3 allocated | Proportional share | Org day/user/model credits distributed by attributed local share |
-| Unattributed | Kept explicitly | Never dropped, so coverage is always visible |
+| Tool-provided link | The tool reports which work belongs to the session | A cloud session names its own pull request. A pull request merely mentioned locally is not yet a checked link |
+| Exact match | One clear match using repository, commit and time | Check the pull request and rule out reused branches, forks or several possible matches |
+| Likely match | Related work at the same time, but no exact link | The same account worked on some of the same files during the change |
+| Estimated share | Divide an amount in proportion to recorded usage | Estimate a work item's share of the charge from its share of billed credits for the account, day and model |
+| Not linked | No supported connection | Keep the usage visible rather than guessing or dropping it |
 
 ### Accounting invariants
 
@@ -349,7 +354,7 @@ day, model aliases, product and coverage match. Keep gross, discount and net
 quantities/amounts separate. The documented nominal value of one AI credit is
 USD 0.01, not proof of an incremental charge after allowances and discounts.
 Report signed differences, missing local/cloud usage and unallocated balances.
-Any session/work-item allocation from user/day/model totals is T3 estimation,
+Any estimated work cost from user/day/model totals is a proportional share,
 not measured session billing. Agent Tasks session `usage` is cloud consumption
 at session grain, not a billed line; reconcile it in the same way as local
 credits. Include seats, Actions/infrastructure and human
@@ -363,8 +368,8 @@ oversight separately. This canvas does not call billing APIs.
 | Work-context coverage | % reported credits on calls with resolved repository context, including trace-only links; not verified ownership | Local |
 | Credit coverage | % model calls reporting credits | Local |
 | Actor coverage | % reported credits on calls attributed to a `user.name`; a join key, not productivity | Local (VS Code, opt-in) |
-| Cost per delivered change | Credits per merged PR, per work-item type | Cloud: T0 via Agent Tasks (preview); local: needs T1 join |
-| AI-assisted share | % merged PRs with T0/T1 attribution | Needs T1 join + org repo report |
+| Cost per delivered change | Credits per merged PR, per work-item type | Cloud: tool-provided link through Agent Tasks (preview); local: needs an exact match |
+| AI-assisted share | % merged PRs with tool-provided links or exact matches | Needs exact matches and the organization repository report |
 | Usage mix | Paired-count cache-read share with coverage, sub-agent share, model and reasoning-effort mix; not savings | Local |
 | Speed | PR lead time AI-assisted vs baseline; agent latency and TTFT | Local latency; lead time needs PR data |
 | Quality | Acceptance/survival need the telemetry feed this canvas does not read; reviews, CI, reverts and verified task delivery require joins | Feed plus PR/CI data |
@@ -374,14 +379,14 @@ oversight separately. This canvas does not call billing APIs.
 
 ### Recommended next steps
 
-1. **T1 VCS join.** Resolve local `(repository, branch)` and `(repository, head commit)` to pull requests
-   through the GitHub API, and record `attribution` rows with tier and evidence.
+1. **Exact work links.** Resolve local `(repository, branch)` and `(repository, head commit)` to pull requests
+   through the GitHub API, and record how the link was made and the supporting evidence.
 2. **Actor key.** Enable managed Identity capture (`telemetry.capture.identity`) for CLI, the app and the VS Code
-   Copilot harness, plus the Local-harness setting; key calls by account name and pseudonymise them with one salt so
+   Copilot Agent Host harness, plus the Local harness setting; key calls by account name and pseudonymise them with one salt so
    they join to `user_login`.
-3. **Cover the Copilot harness.** As it becomes VS Code's default, export Agent Host telemetry
+3. **Cover the Copilot Agent Host harness.** As it becomes VS Code's default, export Agent Host telemetry
    (`chat.agentHost.otel.*` or managed settings) and stop treating `agent-traces.db` as complete VS Code coverage.
-4. **Cloud cost.** Ingest Agent Tasks session `usage` as T0 cloud consumption keyed by session and pull-request
+4. **Cloud cost.** Keep Agent Tasks session `usage` directly linked to its session and pull-request
    artifact; pin the preview schema and keep billing reconciliation separate.
 5. **Reconcile.** Use scope-filtered billing AI-credit reports, match consumption to gross quantities,
    preserve discounts/net billed amounts and publish the gap.
@@ -404,7 +409,7 @@ Verified against current source and local data:
   session's account label on agent invocation spans, including sub-agents and inline chat, and
   `process.user.name` / `host.name` are resource attributes. It is off by default; a managed policy overrides
   `COPILOT_OTEL_CAPTURE_IDENTITY` and the setting. `agent-traces.db` stores span attributes only. The setting
-  does not cover the Copilot harness: [microsoft/vscode#337413](https://github.com/microsoft/vscode/issues/337413)
+  does not cover the Copilot Agent Host harness: [microsoft/vscode#337413](https://github.com/microsoft/vscode/issues/337413)
   closed on 6 October (1.142 milestone), and VS Code 1.141 governs Agent Host identity through managed
   `telemetry.capture.identity`.
 - The Agent Host has its own OTel pipeline (`OTEL.md` in `microsoft/vscode`): `chat.agentHost.otel.*` settings,
@@ -435,7 +440,7 @@ Still unverified:
 - Whether VS Code `user.name` always equals the usage metrics `user_login` (expected; not tested against an
   organisation export).
 - Whether `copilot_chat.server_request_id` equals the CLI's `serviceRequestId` (candidate dedupe key).
-- Whether VS Code Copilot-harness sessions are also written to the CLI/app session store, and which credit
+- Whether VS Code Copilot Agent Host harness sessions are also written to the CLI/app session store, and which credit
   attribute their exported spans carry (expected root `github.copilot.nano_aiu`; not captured here).
 - Stability of the preview Agent Tasks `usage` schema, and code-review Actions-minute attribution.
 - Limits reset grain/minimum for the installed runtime: the CLI command reference says per response,
@@ -445,7 +450,7 @@ Still unverified:
 
 ## 9. Sources
 
-- VS Code: [Monitor agent usage with OpenTelemetry](https://code.visualstudio.com/docs/agents/guides/monitoring-agents), [Optimize AI credit usage](https://code.visualstudio.com/docs/agents/guides/optimize-usage), [Agent harnesses](https://code.visualstudio.com/docs/agents/run/agent-harnesses), [1.140: Capture user identity in OpenTelemetry](https://code.visualstudio.com/updates/v1_140#_capture-user-identity-in-opentelemetry), [1.141: Attribute Agent Host sessions to users and machines](https://code.visualstudio.com/updates/v1_141#_attribute-agent-host-sessions-to-users-and-machines), [1.142: Copilot harness default and canvases](https://code.visualstudio.com/updates/v1_142)
+- VS Code: [Monitor agent usage with OpenTelemetry](https://code.visualstudio.com/docs/agents/guides/monitoring-agents), [Optimize AI credit usage](https://code.visualstudio.com/docs/agents/guides/optimize-usage), [Agent harnesses](https://code.visualstudio.com/docs/agents/run/agent-harnesses), [1.140: Capture user identity in OpenTelemetry](https://code.visualstudio.com/updates/v1_140#_capture-user-identity-in-opentelemetry), [1.141: Attribute Agent Host sessions to users and machines](https://code.visualstudio.com/updates/v1_141#_attribute-agent-host-sessions-to-users-and-machines), [1.142: Copilot Agent Host harness default and canvases](https://code.visualstudio.com/updates/v1_142)
 - VS Code source: [`genAiAttributes.ts`](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/platform/otel/common/genAiAttributes.ts), [`otelIdentity.ts`](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/platform/otel/common/otelIdentity.ts), [Agent Host `OTEL.md`](https://github.com/microsoft/vscode/blob/main/src/vs/platform/agentHost/OTEL.md)
 - OTel: [GenAI semantic conventions](https://github.com/open-telemetry/semantic-conventions-genai), [inference duration metric (#521)](https://github.com/open-telemetry/semantic-conventions-genai/pull/521), [non-zero token breakdowns (#548)](https://github.com/open-telemetry/semantic-conventions-genai/pull/548), [MCP attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/mcp/), [VCS attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/vcs/), [CICD attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/cicd/)
 - GitHub: [OpenTelemetry for Copilot](https://docs.github.com/en/copilot/concepts/enterprise/opentelemetry), [Session data](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/session-data), [CLI command reference](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference), [Copilot CLI changelog](https://github.com/github/copilot-cli/blob/main/changelog.md), [Copilot app agent sessions](https://docs.github.com/en/copilot/how-tos/github-copilot-app/agent-sessions), [Manage and track agents](https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/manage-and-track-agents), [Agent Tasks REST](https://docs.github.com/en/rest/agent-tasks/agent-tasks), [Agentic audit log events](https://docs.github.com/en/copilot/reference/enterprise-administrators/agentic-audit-log-events), [Copilot usage metrics](https://docs.github.com/en/copilot/reference/copilot-usage-metrics/copilot-usage-metrics), [Billing usage REST](https://docs.github.com/en/rest/billing/usage), [Copilot user management REST](https://docs.github.com/en/rest/copilot/copilot-user-management), [Metrics data](https://docs.github.com/en/copilot/reference/metrics-data)
diff --git a/docs/research/attribution-model.json b/docs/research/attribution-model.json
index 53857d9..c26ffc8 100644
--- a/docs/research/attribution-model.json
+++ b/docs/research/attribution-model.json
@@ -1,7 +1,7 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "title": "Measuring ROI on AI-assisted development",
-  "updated": "2026-10-19",
+  "updated": "2026-10-22",
   "workstream": "Data and Attribution Model",
   "question": "What does AI-assisted development cost, what value does it deliver, and can we credibly attribute the difference?",
   "summary": "ROI requires both the incremental cost of AI-assisted work and its incremental value against a comparable baseline. Local Copilot stores report consumption and some work context, not monetary cost, developer time saved or delivered value. The live measurements below show how much reported usage can be linked to work; they are ROI readiness indicators, not ROI. A deterministic PR join, verified delivery and quality outcomes, billing and human effort data, and a comparable baseline are needed before calculating a return.",
@@ -10,7 +10,7 @@
       "id": "vscode",
       "name": "VS Code",
       "detail": "Copilot Chat agents",
-      "collection": "Local harness: OTel (OTLP or JSON-lines file), local span DB agent-traces.db, chat transcripts (internal). Copilot harness: Agent Host OTel (chat.agentHost.otel.*), opt-in agent-host-traces.db",
+      "collection": "Local harness: OTel (OTLP or JSON-lines file), local span DB agent-traces.db, chat transcripts (internal). Copilot Agent Host harness: Agent Host OTel (chat.agentHost.otel.*), opt-in agent-host-traces.db",
       "sessionKey": "copilot_chat.chat_session_id / gen_ai.conversation.id",
       "liveSource": "traces"
     },
@@ -40,7 +40,7 @@
     },
     {
       "id": "org",
-      "name": "Organisation plane",
+      "name": "Organization reports",
       "detail": "Usage metrics, billing, audit",
       "collection": "Copilot usage metrics REST/NDJSON, billing usage REST, seat management, audit log",
       "sessionKey": null,
@@ -48,18 +48,18 @@
     }
   ],
   "availabilityLevels": [
-    { "id": "native", "label": "Native", "description": "Emitted directly by the surface." },
-    { "id": "partial", "label": "Partial", "description": "Emitted for some calls, at a coarser grain, hashed, or only in the UI." },
-    { "id": "derived", "label": "Derived", "description": "Computable from other native fields on the same surface." },
-    { "id": "missing", "label": "Missing", "description": "Not emitted; needs an external join." },
-    { "id": "unverified", "label": "Unverified", "description": "Not verified against primary sources or local evidence." }
+    { "id": "native", "label": "Reported", "description": "The tool or report supplies this value directly." },
+    { "id": "partial", "label": "Some data", "description": "Available for some requests, as a summary, as a hidden name, or only on screen." },
+    { "id": "derived", "label": "Calculated", "description": "Can be worked out from other values reported by the same source." },
+    { "id": "missing", "label": "Not reported", "description": "Not provided by this source; another system is needed to fill the gap." },
+    { "id": "unverified", "label": "Not checked", "description": "We have not confirmed this against the official source or local records." }
   ],
   "groups": [
-    { "id": "identity", "label": "Identity" },
-    { "id": "consumption", "label": "Consumption" },
-    { "id": "tooling", "label": "Tooling" },
+    { "id": "identity", "label": "Accounts & sessions" },
+    { "id": "consumption", "label": "AI usage" },
+    { "id": "tooling", "label": "Tools" },
     { "id": "work", "label": "Work" },
-    { "id": "outcome", "label": "Outcome" }
+    { "id": "outcome", "label": "Results" }
   ],
   "concepts": [
     {
@@ -78,7 +78,7 @@
     },
     {
       "id": "surface",
-      "name": "Surface / client",
+      "name": "Copilot tool",
       "group": "identity",
       "canonical": "ai_session.surface",
       "otel": "service.name",
@@ -92,12 +92,12 @@
     },
     {
       "id": "actor",
-      "name": "Actor",
+      "name": "Account",
       "group": "identity",
       "canonical": "actor.actor_key",
       "otel": "user.name (span); process.user.name, host.name (resource)",
       "surfaces": {
-        "vscode": { "availability": "partial", "field": "user.name on invoke_agent spans; process.user.name, host.name resource attributes", "note": "Local harness: opt-in since VS Code 1.140 (github.copilot.chat.otel.captureIdentity; managed telemetry.capture.identity / CopilotOtelCaptureIdentity policy wins). Copilot harness (Agent Host): managed telemetry.capture.identity only, since 1.141; user.name appears on runtime spans when the bundled runtime supports it. user.name is the signed-in GitHub account; chat spans inherit it through the session ID. agent-traces.db stores span attributes, not resource attributes." },
+        "vscode": { "availability": "partial", "field": "user.name on invoke_agent spans; process.user.name, host.name resource attributes", "note": "Local harness: opt-in since VS Code 1.140 (github.copilot.chat.otel.captureIdentity; managed telemetry.capture.identity / CopilotOtelCaptureIdentity policy wins). Copilot Agent Host harness (Agent Host): managed telemetry.capture.identity only, since 1.141; user.name appears on runtime spans when the bundled runtime supports it. user.name is the signed-in GitHub account; chat spans inherit it through the session ID. agent-traces.db stores span attributes, not resource attributes." },
         "cli": { "availability": "partial", "field": "enduser.pseudo.id on OTel invoke_agent; no identity in session-store rows", "note": "An analytics pseudonym when available, not a GitHub login. The managed Identity capture class adds the Copilot account name, OS account and machine name; otherwise a governed mapping or collector-supplied account is needed to join user_login." },
         "app": { "availability": "partial", "field": "shared-runtime OTel enduser.pseudo.id; no identity in session-store rows", "note": "Pseudonymous unless the managed Identity capture class is enabled; live actor coverage is unavailable from this store." },
         "cloud": { "availability": "native", "field": "audit user, commit co-author" },
@@ -120,7 +120,7 @@
     },
     {
       "id": "agent",
-      "name": "Agent / sub-agent",
+      "name": "Agent / helper agent",
       "group": "identity",
       "canonical": "model_call.agent_name",
       "otel": "gen_ai.agent.name",
@@ -148,7 +148,7 @@
     },
     {
       "id": "reasoning",
-      "name": "Reasoning effort",
+      "name": "Reasoning setting",
       "group": "consumption",
       "canonical": "model_call.reasoning_effort",
       "otel": "gen_ai.request.reasoning.level",
@@ -182,7 +182,7 @@
       "canonical": "model_call.credits_nano_aiu",
       "otel": "none in semconv",
       "surfaces": {
-        "vscode": { "availability": "native", "field": "copilot_chat.copilot_usage_nano_aiu; transcript copilotCredits", "note": "Same CAPI copilot_usage.total_nano_aiu as the CLI. Older builds omit it; unknown is not zero. Copilot-harness (Agent Host) sessions emit shared-runtime spans instead; follow the CLI root invoke_agent github.copilot.nano_aiu guidance for them." },
+        "vscode": { "availability": "native", "field": "copilot_chat.copilot_usage_nano_aiu; transcript copilotCredits", "note": "Same CAPI copilot_usage.total_nano_aiu as the CLI. Older builds omit it; unknown is not zero. Copilot Agent Host harness (Agent Host) sessions emit shared-runtime spans instead; follow the CLI root invoke_agent github.copilot.nano_aiu guidance for them." },
         "cli": { "availability": "native", "field": "copilotUsage.totalNanoAiu; OTel github.copilot.nano_aiu", "note": "SDK cost / OTel github.copilot.cost is a request multiplier, not credits or currency. CLI OTel guidance uses root invoke_agent nano_aiu totals, never parent plus children." },
         "app": { "availability": "native", "field": "copilotUsage.totalNanoAiu; shared-runtime OTel github.copilot.nano_aiu", "note": "A request multiplier is not monetary cost. The live canvas reads per-call session-store usage, not CLI OTel." },
         "cloud": { "availability": "partial", "field": "Agent Tasks session usage.type / usage.amount (preview)", "note": "Per-session ai_credits in nano units (legacy premium_requests for older sessions). Session grain, not per call; consumption, not a billed gross/net line." },
@@ -191,7 +191,7 @@
     },
     {
       "id": "latency",
-      "name": "Latency",
+      "name": "Response time",
       "group": "consumption",
       "canonical": "model_call.duration_ms, ttft_ms",
       "otel": "gen_ai.client.inference.duration (formerly gen_ai.client.operation.duration)",
@@ -205,7 +205,7 @@
     },
     {
       "id": "request_id",
-      "name": "Model call ID",
+      "name": "AI request ID",
       "group": "consumption",
       "canonical": "model_call.call_key",
       "otel": "gen_ai.response.id",
@@ -220,7 +220,7 @@
     },
     {
       "id": "tool",
-      "name": "Tool call",
+      "name": "Tool action",
       "group": "tooling",
       "canonical": "tool_call.tool",
       "otel": "gen_ai.tool.name",
@@ -332,7 +332,7 @@
     },
     {
       "id": "acceptance",
-      "name": "Acceptance / survival",
+      "name": "Edits accepted or kept",
       "group": "outcome",
       "canonical": "outcome (kind = edit_accepted | survival | feedback)",
       "otel": "none",
@@ -360,7 +360,7 @@
     },
     {
       "id": "delivery",
-      "name": "Delivery (merged, lead time)",
+      "name": "Merged work and time taken",
       "group": "outcome",
       "canonical": "work_item.merged_at, outcome (kind = lead_time)",
       "otel": "vcs.change.state",
@@ -374,7 +374,7 @@
     },
     {
       "id": "ci",
-      "name": "CI / deploy result",
+      "name": "Build / deployment result",
       "group": "outcome",
       "canonical": "outcome (kind = ci_result)",
       "otel": "cicd.pipeline.run.*",
@@ -394,7 +394,7 @@
       "grain": "person",
       "fields": ["identity (native, conditional: user.name or SDK enduser.pseudo.id)", "actor_key (derived salted pseudonym of a verified account)", "device_key (derived, optional; resource inputs are not a person)", "org, team / cost centre (configured or externally enriched)"],
       "fieldProvenance": [
-        { "field": "user.name", "kind": "native", "readPath": "VS Code invoke_agent span; export or span store", "conditions": "Opt-in, policy-controlled Local harness setting, or managed telemetry.capture.identity for Copilot-harness runtime spans when the bundled runtime emits it; verify equivalence with organisation user_login before joining." },
+        { "field": "user.name", "kind": "native", "readPath": "VS Code invoke_agent span; export or span store", "conditions": "Opt-in, policy-controlled Local harness setting, or managed telemetry.capture.identity for Copilot Agent Host harness runtime spans when the bundled runtime emits it; verify equivalence with organisation user_login before joining." },
         { "field": "enduser.pseudo.id", "kind": "native", "readPath": "SDK/CLI invoke_agent OTel span", "conditions": "Opaque analytics identity when available, not a GitHub login. Session-store rows do not contain it. The managed Identity capture class adds the account name separately." },
         { "field": "actor_key", "kind": "derived", "readPath": "Collector normalization or a configured precomputed attribute", "conditions": "Use a governed salted pseudonym of a verified account; Copilot does not automatically generate this canonical field." },
         { "field": "process.user.name, host.name", "kind": "native", "readPath": "Opt-in OTel resource attributes in export", "conditions": "Not stored in agent-traces.db. OS account/machine identity is not person identity and must not replace user.name." },
@@ -431,7 +431,7 @@
       "id": "attribution",
       "name": "attribution",
       "grain": "session ↔ work item",
-      "fields": ["tier (T0–T3)", "method, evidence", "confidence", "weight (≤ 1 per session)"]
+      "fields": ["link method", "evidence", "confidence", "share assigned to work (at most 100%)"]
     },
     {
       "id": "outcome",
@@ -444,6 +444,18 @@
       "name": "cost_ledger",
       "grain": "billing line",
       "fields": ["billing entity and account type", "requested UTC day / user / model filters", "product, SKU, model, unitType, pricePerUnit", "gross / discount / net quantity and amount", "retrieved_at, source, coverage window", "reconciliation only"]
+    },
+    {
+      "id": "billing_reconciliation",
+      "name": "billing_reconciliation",
+      "grain": "paying account × native user × UTC day × model × one local source",
+      "fields": ["explicit billing request scope", "gross billed credits, captured native credits, signed difference", "gross / discount / net amounts kept separate", "unknown identity, unmatched models and incomplete local history", "no cross-source totals or PR billing IDs"]
+    },
+    {
+      "id": "work_allocation",
+      "name": "work_allocation",
+      "grain": "billing reconciliation × repository branch",
+      "fields": ["Estimated share, not measured pull request cost", "weight = captured native work credits / billed gross credits for the model", "estimated net amount", "unallocated remainder", "no allocation when local usage exceeds billed usage"]
     }
   ],
   "relationships": [
@@ -454,41 +466,53 @@
     { "from": "work_item", "to": "attribution", "label": "linked by" },
     { "from": "work_item", "to": "outcome", "label": "produces" },
     { "from": "ai_session", "to": "outcome", "label": "produces" },
-    { "from": "cost_ledger", "to": "actor", "label": "billed to" }
+    { "from": "cost_ledger", "to": "actor", "label": "billed to" },
+    { "from": "cost_ledger", "to": "billing_reconciliation", "label": "provides usage, discounts and charges" },
+    { "from": "model_call", "to": "billing_reconciliation", "label": "same recorded account, UTC day and model" },
+    { "from": "billing_reconciliation", "to": "work_allocation", "label": "supports estimate only" },
+    { "from": "work_allocation", "to": "work_item", "label": "estimated cost, not a bill" }
   ],
-  "tiers": [
-    { "id": "T0", "name": "Native", "method": "Work ownership emitted by the surface", "example": "Cloud-owned session → PR; audit agent_session_id. A mentioned session_refs PR is only a reference until verified.", "confidence": "high" },
-    { "id": "T1", "name": "Deterministic", "method": "Exact, unambiguous join on VCS keys", "example": "Match head repository, commit and time to a verified PR. Branch reuse, forks and multiple PR matches require explicit disambiguation.", "confidence": "high" },
-    { "id": "T2", "name": "Inferred", "method": "Time and content overlap", "example": "Same repo and actor inside the PR commit window; modified files ∩ PR diff", "confidence": "medium" },
-    { "id": "T3", "name": "Allocated", "method": "Proportional share", "example": "Org day/user/model credits distributed by attributed local share", "confidence": "low" },
-    { "id": "U", "name": "Unattributed", "method": "Kept explicitly", "example": "Never dropped, so coverage stays visible", "confidence": "n/a" }
+  "linkMethods": [
+    { "id": "tool-provided-link", "name": "Tool-provided link", "method": "The tool reports which work belongs to the session.", "example": "A cloud session points directly to its pull request. A pull request merely mentioned in local records is still just a mention until checked.", "confidence": "high" },
+    { "id": "exact-match", "name": "Exact match", "method": "One clear match using repository, commit and time.", "example": "Match a commit to a checked pull request. Reused branches, forks or several matching pull requests need a choice, not a guess.", "confidence": "high" },
+    { "id": "likely-match", "name": "Likely match", "method": "Related work at the same time, but no exact link.", "example": "The same account worked in the repository during the change, and edited some of the same files. This suggests a link; it does not prove one.", "confidence": "medium" },
+    { "id": "estimated-share", "name": "Estimated share", "method": "Divide an amount in proportion to recorded usage.", "example": "If a work item accounts for one quarter of the billed credits for the account, day and model, estimate one quarter of the charge after discounts. This is not a measured work-item bill.", "confidence": "low" },
+    { "id": "not-linked", "name": "Not linked", "method": "No supported connection to work.", "example": "Keep the usage visible rather than guessing or dropping it.", "confidence": "n/a" }
   ],
   "invariants": [
-    "Count each model call once, by stable call ID. VS Code uses chat credits; CLI OTel guidance uses root invoke_agent nano_aiu totals. Never add parent and child totals; validate mappings per surface/version.",
-    "Never sum overlapping sources; use precedence, or conservative per-dimension max only for aligned scopes/windows, and record coverage and source.",
-    "Unknown is not zero; report credit coverage alongside credit totals.",
+    "Count each AI request once, using its stable ID. Some tools report totals for a whole agent run; never add a run summary to the requests it includes. Check the correct credit field for each tool and version.",
+    "Do not add overlapping sources. For matching measurements and periods, choose one source or use the larger value, not their sum. Record where the number came from and what was included.",
+    "Unknown is not zero; show how many requests include credit counts alongside the reported credit total.",
     "Credits = nano-AIU / 1,000,000,000, including Agent Tasks usage.amount; sum nano values before dividing. No token-to-currency estimate without an explicit, labelled rate.",
-    "Attribution weights per session sum to at most 1; the remainder stays unattributed.",
-    "Local observations are not a bill. Reconcile matching consumption with gross AI-credit quantities from the billing AI-credit report, preserving scope filters; show discounts and net billed amounts separately.",
-    "No prompt or response content; pseudonymise actors; keep MCP names hashed unless governed.",
-    "Never present credits, cache ratios or PR references as monetary ROI or proof of value; report cost, outcome and baseline coverage separately.",
-    "Token fields are nullable reported subtotals with per-field call coverage. Cache-read share uses only paired, valid input/cache counts; unknown never becomes a measured zero. Emitters may omit zero breakdowns, so absence is unknown, not zero."
+    "Do not assign more than 100% of a session’s usage to work. Keep any usage without a supported link visible.",
+    "Local records are not a bill. Compare recorded usage with the bill for the same account and period, using credits before discounts. Keep discounts and final charges separate.",
+    "Do not read prompts or responses. Protect account IDs before saving or exporting, and keep tool server names hidden unless an approved lookup is available.",
+    "Credits, reused input and pull request mentions do not prove savings or business value. Show costs, results and the comparison with similar work separately.",
+    "Token counts may cover only some requests; show which ones reported each count. Input reuse uses requests with both valid input and reused-input counts. A missing count stays unknown, not zero."
   ],
   "reconciliation": {
-    "source": "Billing AI-credit usage REST: /organizations/{org}/settings/billing/ai_credit/usage or the applicable enterprise/personal endpoint. Not connected by this canvas.",
-    "grain": "Billing entity × UTC day × user × product/SKU × model; preserve the request filters because usageItems do not carry every dimension.",
+    "source": "Explicit Recipe billing read: /organizations/{org}/settings/billing/ai_credit/usage, /enterprises/{enterprise}/settings/billing/ai_credit/usage or /users/{username}/settings/billing/ai_credit/usage. Requires billing access to the paying account.",
+    "grain": "Paying account × day in UTC × GitHub account × product/SKU × model; preserve the request filters because each usageItems row may omit part of this context.",
     "requirements": [
       "Organisation ai_credits_used is user-level consumption, not invoicing and not a model/feature/surface breakdown; reconcile it only at its published grain.",
       "Use the billing entity that pays for the seat. Personal endpoints exclude organisation-managed seats; organisation/enterprise access requires the appropriate administrative permissions.",
-      "Match user identity, UTC date, model aliases, product/SKU, unitType and observed coverage. Compare local credits with gross AI-credit quantity only when those scopes align.",
-      "Keep gross, discount and net quantities/amounts separate. The documented nominal rate is USD 0.01 per AI credit, not proof of an incremental charge after allowances and discounts.",
+      "Compare captured native users for one completed UTC day, Copilot product and exact model names, per local source. Inferred owners are excluded. Local metadata does not prove the selected account paid for those calls.",
+      "Keep gross, discount and net quantities/amounts separate. Preserve API units and pricePerUnit; never turn local credits into currency with a guessed rate.",
       "Store filters and returned scope metadata, retrieval time, coverage and a stable ledger key. Do not add overlapping per-day/user/model queries or duplicate local sources.",
-      "Report signed differences and unmatched usage explicitly. Include seats, Actions/infrastructure and human oversight separately before valuing an investment."
+      "Report signed differences and unmatched usage explicitly. Missing local data is not zero usage. Unsupported units fail visibly; failed reads never retain an old report as current.",
+      "Billing accrues independently of merge. Its reports have no PR, issue, branch or session IDs."
     ],
-    "allocationPolicy": "User/day/model or work-item allocation is T3 estimation, not measured per-session billing. Preserve missing local/cloud usage and unallocated balances; never manufacture per-model usage from ai_credits_used."
+    "allocationPolicy": "Estimated work cost is a proportional share, not measured pull request or session billing: charge after discounts × recorded account’s work credits / credits on the bill, per model. Keep unexplained charges separate and do not estimate a share when recorded credits exceed billed credits."
   },
   "recipe": {
-    "summary": "One AI-assisted delivery cycle as a recipe: ingredients (the work item that starts it), method (the AI-assisted work this canvas measures) and serve (the pull request that closes it). A cycle is one repository branch; local stores supply AI work, branches, commits and recorded references, and an explicit verification step asks GitHub and Azure Boards for review, merge and closure.",
+    "summary": "One cycle per repository branch: work item, AI work and delivery. Developer attribution keeps measured, inferred and unknown usage separate. Billing reconciles in parallel, not as a PR invoice.",
+    "billingLane": {
+      "label": "Billing reconciliation",
+      "runs": "parallel to delivery, not triggered by merge",
+      "join": ["paying account", "native GitHub user", "completed UTC day", "Copilot product", "exact model", "one local source"],
+      "output": ["gross credits", "captured credits", "signed difference", "discounts", "net amount", "estimated work costs", "unmatched / unallocated balance"],
+      "permission": "billing access to the account paying for the seat"
+    },
     "phases": [
       { "id": "ingredients", "label": "Ingredients", "detail": "The work item that starts the cycle" },
       { "id": "method", "label": "Method", "detail": "AI-assisted work measured locally" },
@@ -504,10 +528,10 @@
       { "id": "close", "phase": "serve", "name": "Merge and close the work item", "concepts": ["delivery", "issue_task"], "local": "Not recorded locally", "verified": "PR merged date; GitHub issue closed date or Azure Boards Resolved/Completed state category" }
     ],
     "evidence": [
-      { "id": "verified", "label": "Verified", "tier": "T1", "description": "Confirmed by the GitHub or Azure Boards API during an explicit verification." },
-      { "id": "recorded", "label": "Recorded", "tier": "T0 reference", "description": "A PR, issue or commit the agent referenced (session_refs). A reference, not proof of ownership or delivery." },
-      { "id": "convention", "label": "Convention", "tier": "T2", "description": "Parsed from the branch name convention. Deterministic when the convention is enforced, but not verified." },
-      { "id": "observed", "label": "Observed", "tier": "Local", "description": "Seen in local telemetry: sessions, model calls, credits, branches and head commits." }
+      { "id": "verified", "label": "Checked online", "description": "Confirmed by GitHub or Azure Boards when you ask to check delivery." },
+      { "id": "recorded", "label": "Mentioned", "description": "The agent mentioned a pull request, issue or commit. A mention does not prove ownership or delivery." },
+      { "id": "convention", "label": "Branch name", "description": "The work-item number comes from the branch name. It has not been checked online." },
+      { "id": "observed", "label": "Local record", "description": "Recorded on this machine: sessions, AI requests, credits, branches and commits." }
     ],
     "convention": {
       "branch": "The work item is the first token after the last slash: prefix/AB123-slug is Azure Boards work item 123; prefix/123-slug is GitHub issue 123 in the same repository.",
@@ -521,11 +545,13 @@
       "trailers": { "azure-boards": "Refs: AB#123", "github": "Refs: #123" }
     },
     "guardrails": [
-      "Verification runs only when requested and sends only identifiers already recorded locally: repository, branch and PR, issue or work-item numbers.",
-      "Queries select states, dates, types, review states and commit IDs. Titles, descriptions, commit messages, comments and logins are never requested.",
+      "Verification runs only when requested and sends repository, branch and PR, issue or work-item numbers plus first-activity timestamps for historical assignment snapshots.",
+      "Queries select state, date, type, commit and assignment metadata, including GitHub logins and Azure Boards account IDs/display names. Titles, descriptions, commit messages, comments and email fields are never requested.",
       "GitHub uses the signed-in gh CLI; Azure Boards uses az account get-access-token or AZURE_DEVOPS_EXT_PAT. Tokens stay in memory and are never logged, returned or stored.",
       "Credits stay per source. A cycle that spans the CLI/app store and VS Code shows both values, never a sum.",
-      "Reported credits per merged PR are consumption, not cost or value."
+      "Reported credits per merged PR are consumption, not cost or value.",
+      "Measured user.name consumption, inferred historical-owner/PR-author allocation and unattributed usage remain separate. Current assignment is never backdated and conflicting owners stay unattributed.",
+      "Provider identities are distinct unless explicitly linked. Matching names, email addresses, devices and branch prefixes never establish a person."
     ]
   },
   "outcomes": [
@@ -534,7 +560,7 @@
     { "id": "credit_coverage", "name": "Credit coverage", "measure": "% of model calls that report credits", "availability": "local", "liveMetric": "creditCoverage" },
     { "id": "actor_coverage", "name": "Actor coverage", "measure": "% of reported credits on model calls attributed to a user.name (opt-in identity capture); a join key to per-user organisation data, not a productivity measure", "availability": "local", "liveMetric": "creditsToActorShare" },
     { "id": "cost_per_change", "name": "Cost per delivered change", "measure": "Credits per merged PR, per work-item type", "availability": "needs-vcs-join" },
-    { "id": "ai_share", "name": "AI-assisted share", "measure": "% of merged PRs with T0/T1 attribution", "availability": "needs-vcs-join" },
+    { "id": "ai_share", "name": "AI-assisted share", "measure": "% of merged pull requests linked directly by the tool or by an exact match", "availability": "needs-vcs-join" },
     { "id": "efficiency", "name": "Cache-read share", "measure": "Cache-read / input tokens over calls reporting both valid counts, with paired-call coverage; usage mix, not time or money saved", "availability": "local", "liveMetric": "cacheReadRatio" },
     { "id": "speed", "name": "Speed", "measure": "Local latency/TTFT fields exist but are not rendered here; PR lead time vs a matched baseline needs verified PR data", "availability": "needs-vcs-join" },
     { "id": "quality", "name": "Quality", "measure": "Acceptance/survival require the telemetry feed this canvas does not read; reviews, CI, reverts and verified task delivery require external joins", "availability": "needs-vcs-join" },
@@ -543,22 +569,22 @@
     { "id": "roi", "name": "Incremental return", "measure": "(Valued incremental benefit − AI investment) / AI investment; include incremental spend and oversight, avoid double-counting time savings, and use a comparable baseline", "availability": "needs-baseline" }
   ],
   "gaps": [
-    { "id": "no-pr-locally", "title": "No reliable PR / issue ID locally", "severity": "high", "surfaces": ["vscode", "cli", "app"], "consequence": "Consumption stops at branch/commit: VS Code emits no work-item ID, and CLI/app session_refs capture one only when the agent references it.", "mitigation": "Resolve (repo, branch) and (repo, commit) to PRs through the GitHub API; adopt vcs.change.id." },
-    { "id": "no-cloud-cost", "title": "Cloud session cost is preview-only", "severity": "medium", "surfaces": ["cloud"], "consequence": "Agent Tasks REST returns per-session usage, but the endpoint is public preview and amounts are consumption, not billed gross/net lines.", "mitigation": "Ingest as T0 cloud consumption keyed by session and PR artifact; pin the schema and reconcile with billing AI-credit reports." },
-    { "id": "no-session-in-org", "title": "No session ID in organisation data", "severity": "high", "surfaces": ["org"], "consequence": "Per-user ai_credits_used has no model/surface split and cannot join to sessions.", "mitigation": "Reconcile user/day consumption at its own grain; use filtered billing AI-credit reports for user/day/model and label any allocation T3." },
-    { "id": "no-actor", "title": "No verified local login join by default", "severity": "medium", "surfaces": ["vscode", "cli", "app"], "consequence": "CLI/app rows hold no user and their OTel pseudonym is not a verified login; VS Code user.name is opt-in and its user_login equivalence remains unverified.", "mitigation": "Verify the opt-in VS Code user.name to user_login join; use a governed identity mapping or collector-supplied login for CLI/app, and pseudonymise before storage." },
-    { "id": "session-sparse", "title": "Session ID missing on many VS Code calls", "severity": "medium", "surfaces": ["vscode"], "consequence": "Native session identity is incomplete even when trace-only work context can be resolved.", "mitigation": "Resolve time-appropriate session, conversation, parent-session or trace context; do not fabricate sessions, and retain unmatched calls." },
-    { "id": "harness-split", "title": "Harness split in VS Code", "severity": "high", "surfaces": ["vscode"], "consequence": "The Copilot harness, rolling out as the default since VS Code 1.141–1.142, writes Agent Host telemetry, not agent-traces.db; its local DB mode is off by default.", "mitigation": "Configure chat.agentHost.otel.* or managed telemetry export, apply shared-runtime conventions, and keep both pipelines separate." },
-    { "id": "metrics-undercount", "title": "Usage metrics undercount", "severity": "medium", "surfaces": ["org"], "consequence": "Agent activity and agent_edit lines from SDK-based IDE versions were undercounted, some counted as Copilot CLI; not backfilled.", "mitigation": "Require fixed IDE versions (VS Code 1.139+) and annotate affected periods rather than comparing across the fix." },
-    { "id": "overlap", "title": "Overlapping sources", "severity": "medium", "surfaces": ["vscode", "cli", "app"], "consequence": "Double counting (metrics vs spans, transcript vs trace, CLI store vs OTel), or undercount with mismatched scopes.", "mitigation": "Use precedence or conservative max only for aligned scopes/windows; dedupe call IDs and never sum parent and child usage." },
-    { "id": "no-ci", "title": "No CI/CD linkage", "severity": "medium", "surfaces": ["vscode", "cli", "app", "cloud", "org"], "consequence": "Build and deploy outcomes are unattributed.", "mitigation": "Join cicd.pipeline.run.* by repository and commit." },
-    { "id": "credits-optional", "title": "Credits optional on spans", "severity": "low", "surfaces": ["vscode"], "consequence": "Unknown is not zero.", "mitigation": "Track credit coverage; prefer the session store or transcript." },
-    { "id": "zero-omitted", "title": "Zero breakdowns may be omitted", "severity": "low", "surfaces": ["vscode", "cli", "app"], "consequence": "Under current GenAI conventions an absent cache or reasoning count may be zero or unreported.", "mitigation": "Report per-field coverage; do not impute zero without the emitter's documented convention." },
-    { "id": "mcp-hashed", "title": "MCP server name hashed by default", "severity": "low", "surfaces": ["vscode"], "consequence": "Vendor-level tool cost needs content capture.", "mitigation": "Keep the hash as key; map names in a governed lookup." },
-    { "id": "naming-drift", "title": "Naming drift", "severity": "low", "surfaces": ["vscode", "cli", "app"], "consequence": "github.copilot.git.* vs vcs.*; reasoningEffort vs gen_ai.request.reasoning.level; GitHub's documented gen_ai.client.operation.* vs semantic-convention gen_ai.client.inference.*.", "mitigation": "Normalise to canonical fields at ingest." }
+    { "id": "no-pr-locally", "title": "Usage may not name a work item", "severity": "high", "surfaces": ["vscode", "cli", "app"], "consequence": "Local records can stop at a branch or commit. VS Code supplies no work-item number; CLI/app records include one only when the agent mentions it.", "mitigation": "Use work-item numbers in branch names and check related pull requests online. Keep usage without a link visible." },
+    { "id": "no-cloud-cost", "title": "Cloud usage API is still a preview", "severity": "medium", "surfaces": ["cloud"], "consequence": "GitHub can report credits for a cloud session, but the API may change. These are usage counts, not charges after discounts.", "mitigation": "Keep the session and pull request IDs, check the response format, and compare with the bill separately." },
+    { "id": "no-session-in-org", "title": "Daily reports omit session IDs", "severity": "high", "surfaces": ["org"], "consequence": "Organization user totals do not identify sessions or show usage by model and Copilot tool.", "mitigation": "Compare daily account totals only. Use the billing report for model detail, and label any work-level cost as an estimate." },
+    { "id": "no-actor", "title": "The user account may be missing", "severity": "medium", "surfaces": ["vscode", "cli", "app"], "consequence": "CLI/app session rows hold no account. An anonymous tracking ID is not a GitHub username. VS Code records the account only when enabled.", "mitigation": "Enable account recording with consent. Check account links before comparing reports; never guess from a computer name or email." },
+    { "id": "session-sparse", "title": "Some requests have no session", "severity": "medium", "surfaces": ["vscode"], "consequence": "A request may still have repository context without enough information to identify its session.", "mitigation": "Use the matching context available at the time. Do not invent sessions or drop requests that cannot be linked." },
+    { "id": "harness-split", "title": "VS Code has two harnesses", "severity": "high", "surfaces": ["vscode"], "consequence": "The Local harness uses agent-traces.db. The Copilot Agent Host harness uses agent-host-traces.db, which is off by default.", "mitigation": "Set up recording for the harness you use. Keep the two sources separate and preserve any existing external collector." },
+    { "id": "metrics-undercount", "title": "Older clients under-reported activity", "severity": "medium", "surfaces": ["org"], "consequence": "Some older editor versions counted too little agent work or labelled it as CLI usage. The missing history was not restored.", "mitigation": "Use fixed clients (VS Code 1.139+) and mark affected periods. A lower count does not necessarily mean less work." },
+    { "id": "overlap", "title": "The same usage can appear twice", "severity": "medium", "surfaces": ["vscode", "cli", "app"], "consequence": "Adding overlapping sources can count a request twice. Comparing different time periods can also give misleading totals.", "mitigation": "Match stable request IDs and keep one copy. If the overlap cannot be resolved, show the sources separately." },
+    { "id": "no-ci", "title": "Build and deployment results are not linked", "severity": "medium", "surfaces": ["vscode", "cli", "app", "cloud", "org"], "consequence": "A merged change does not tell us whether it built successfully or reached production.", "mitigation": "Link build and deployment runs using the repository and commit." },
+    { "id": "credits-optional", "title": "Some requests omit credit counts", "severity": "low", "surfaces": ["vscode"], "consequence": "A missing credit count is unknown, not a free request.", "mitigation": "Show how many requests include credit counts, alongside the total credits reported." },
+    { "id": "zero-omitted", "title": "A missing token count may not be zero", "severity": "low", "surfaces": ["vscode", "cli", "app"], "consequence": "Some tools leave out zero cache or reasoning counts; others do not report them at all.", "mitigation": "Show which requests supplied each count. Treat missing values as unknown unless the source explicitly documents otherwise." },
+    { "id": "mcp-hashed", "title": "Tool server names may be hidden", "severity": "low", "surfaces": ["vscode"], "consequence": "A hidden server name can prevent grouping tool usage by supplier.", "mitigation": "Keep the reported ID. Add a readable name only from an approved lookup list." },
+    { "id": "naming-drift", "title": "Different tools use different field names", "severity": "low", "surfaces": ["vscode", "cli", "app"], "consequence": "Several field names may describe the same value.", "mitigation": "Use checked field mappings and keep the source/version. Do not add alternate names as if they were different usage." }
   ],
   "priorArt": [
-    { "name": "bear-in-mind", "proved": "Metering from VS Code OTel file feed, agent-traces.db, the Agent Host's agent-host-traces.db (Copilot harness, Copilot runtime traces only) and transcripts; cost/speed/quality dashboard with retained-trace credits by model, repository, user, caller and reasoning effort, and session repository and user labels.", "learned": "Count only chat spans; dedupe by span ID; metrics vs spans use max not sum; credits = nano-AIU / 1e9; token share is not credit share; user.name, like repository, sits on invoke_agent spans and must be inherited by chat spans." },
+    { "name": "bear-in-mind", "proved": "Metering from VS Code OTel file feed, agent-traces.db, the Agent Host's agent-host-traces.db (Copilot Agent Host harness, Copilot runtime traces only) and transcripts; cost/speed/quality dashboard with retained-trace credits by model, repository, user, caller and reasoning effort, and session repository and user labels.", "learned": "Count only chat spans; dedupe by span ID; metrics vs spans use max not sum; credits = nano-AIU / 1e9; token share is not credit share; user.name, like repository, sits on invoke_agent spans and must be inherited by chat spans." },
     { "name": "agentic-sdlc-prototypes-patterns", "proved": "OTLP receiver, CLI session-store ingestion, ELK documents with cost/speed/quality groups, pseudonymised developer_id.", "learned": "Spans rarely carried credits then; the CLI store was the reliable cost source; repository must be copied from invoke_agent to chat spans." },
     { "name": "copilot-insights (hackathon)", "proved": "Relational schema joining OTel spans, metrics and events with CLI llm_calls by session.", "learned": "Repo/branch/commit exist, but no PR join was built." },
     { "name": "vscode-insights (hackathon)", "proved": "Copilot SDK instrumentation (assistant.usage, subagent.*, skill.invoked, quota snapshots) into one records table.", "learned": "Stable call keys like sdk:<sessionId>:call:<apiCallId>; account checked against the signed-in login." }
@@ -568,11 +594,11 @@
     { "claim": "github.copilot.* attribute namespace (agent.type, git.*, tool.parameters.*)", "status": "verified", "note": "Defined in current source and observed locally on invoke_agent / execute_tool spans. No PR, issue or vcs.* span attribute has been added; no agent span on 14 October 2026 carried git.*." },
     { "claim": "VS Code reasoning effort", "status": "verified", "note": "Carried inside the copilot_chat.request.options JSON blob, not a dedicated attribute." },
     { "claim": "VS Code identity capture: user.name on agent invocation spans; process.user.name and host.name as resource attributes", "status": "verified", "note": "VS Code 1.140 release notes and otelIdentity.ts in microsoft/vscode extensions/copilot: off by default; user.name is the GitHub session account label; a managed policy overrides COPILOT_OTEL_CAPTURE_IDENTITY and the setting; agent-traces.db persists span attributes only. microsoft/vscode#337413 closed on 6 October 2026; VS Code 1.141 governs Agent Host identity through managed telemetry.capture.identity." },
-    { "claim": "VS Code Copilot harness uses a separate Agent Host OTel pipeline", "status": "verified", "note": "Agent Host OTEL.md and VS Code 1.141/1.142 notes: chat.agentHost.otel.* settings, runtime spans with service.name=github-copilot, agent-host-traces.db only in opt-in DB mode. Neither VS Code build on the measured machine had created it." },
+    { "claim": "VS Code Copilot Agent Host harness uses a separate Agent Host OTel pipeline", "status": "verified", "note": "Agent Host OTEL.md and VS Code 1.141/1.142 notes: chat.agentHost.otel.* settings, runtime spans with service.name=github-copilot, agent-host-traces.db only in opt-in DB mode. Neither VS Code build on the measured machine had created it." },
     { "claim": "Managed OTel capture classes, including Identity", "status": "verified", "note": "GitHub's OTel guide (13 October 2026): identity, prompts, responses, tool arguments, tool output and policy detail, independently enabled in CLI, the app and VS Code Agent Host sessions. The VS Code Local harness supports identity and the legacy content setting only." },
     { "claim": "VS Code user.name equals the usage metrics user_login", "status": "unverified", "note": "Both should be the GitHub login; not tested against an organisation export." },
     { "claim": "Copilot CLI OTel span, metric and environment-variable names", "status": "verified", "note": "Primary CLI reference documents COPILOT_OTEL_ENABLED, OTEL_EXPORTER_OTLP_ENDPOINT, COPILOT_OTEL_FILE_EXPORTER_PATH; invoke_agent/chat/execute_tool; gen_ai.* and github.copilot.*. github.copilot.cost is a multiplier; use the documented root-span nano_aiu aggregation, not VS Code's mapping. It still lists gen_ai.client.operation.* metrics, which the semantic conventions renamed to gen_ai.client.inference.* on 6 October 2026." },
-    { "claim": "VS Code Copilot-harness sessions in the CLI/app session store, and their exported credit attribute", "status": "unverified", "note": "Expected to follow the shared runtime (root github.copilot.nano_aiu); not captured on the measured machine." },
+    { "claim": "VS Code Copilot Agent Host harness sessions in the CLI/app session store, and their exported credit attribute", "status": "unverified", "note": "Expected to follow the shared runtime (root github.copilot.nano_aiu); not captured on the measured machine." },
     { "claim": "copilot_chat.server_request_id equals CLI serviceRequestId", "status": "unverified", "note": "Both are service request IDs; equivalence not tested." },
     { "claim": "Cloud agent billing unit", "status": "verified", "note": "Primary usage-based billing docs include cloud agent and define one AI credit as USD 0.01. Premium requests remain for eligible existing annual plans; do not mix billing regimes." },
     { "claim": "--max-ai-credits and /limits exist", "status": "verified", "note": "Both are in the primary CLI command reference. They are soft limits, not a hard spending guarantee." },
@@ -589,7 +615,7 @@
     { "title": "otelIdentity.ts (microsoft/vscode)", "url": "https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/platform/otel/common/otelIdentity.ts", "kind": "source" },
     { "title": "VS Code 1.140: Capture user identity in OpenTelemetry", "url": "https://code.visualstudio.com/updates/v1_140#_capture-user-identity-in-opentelemetry", "kind": "changelog" },
     { "title": "VS Code 1.141: Attribute Agent Host sessions to users and machines", "url": "https://code.visualstudio.com/updates/v1_141#_attribute-agent-host-sessions-to-users-and-machines", "kind": "changelog" },
-    { "title": "VS Code 1.142: Copilot harness default and canvases", "url": "https://code.visualstudio.com/updates/v1_142", "kind": "changelog" },
+    { "title": "VS Code 1.142: Copilot Agent Host harness default and canvases", "url": "https://code.visualstudio.com/updates/v1_142", "kind": "changelog" },
     { "title": "Agent Host OTEL.md (microsoft/vscode)", "url": "https://github.com/microsoft/vscode/blob/main/src/vs/platform/agentHost/OTEL.md", "kind": "source" },
     { "title": "OTel GenAI semantic conventions", "url": "https://github.com/open-telemetry/semantic-conventions-genai", "kind": "spec" },
     { "title": "OTel GenAI: gen_ai.client.inference.duration (#521)", "url": "https://github.com/open-telemetry/semantic-conventions-genai/pull/521", "kind": "spec" },
diff --git a/media/dashboard.js b/media/dashboard.js
index 5c18429..4dceaac 100644
--- a/media/dashboard.js
+++ b/media/dashboard.js
@@ -982,8 +982,8 @@
     const parts = [];
     parts.push(
       feed.agentHostActive
-        ? 'spans: local trace stores, including the Copilot harness / file feed'
-        : feed.sqliteActive ? 'spans: local trace store / file feed' : 'spans: file feed when serialized'
+        ? 'spans: Local harness and Copilot Agent Host harness stores / file feed'
+        : feed.sqliteActive ? 'spans: Local harness store / file feed' : 'spans: file feed when serialized'
     );
     parts.push(feed.jsonlActive ? 'metrics + events: file feed' : 'metrics + events: unavailable');
     parts.push('last record ' + ago(feed.lastRecordAtMs));
diff --git a/src/agentHost.ts b/src/agentHost.ts
index e8510cc..758d495 100644
--- a/src/agentHost.ts
+++ b/src/agentHost.ts
@@ -1,7 +1,7 @@
 import * as path from 'path';
 
 /**
- * VS Code's Copilot harness runs in the Agent Host, a separate process with its
+ * VS Code's Copilot Agent Host harness runs in a separate process with its
  * own OTel pipeline (`chat.agentHost.otel.*`, VS Code 1.141+). Pure helpers so
  * the connect decision and store location can be tested without a VS Code host.
  */
diff --git a/src/extension.ts b/src/extension.ts
index 2c4596f..6aaff58 100644
--- a/src/extension.ts
+++ b/src/extension.ts
@@ -326,7 +326,7 @@ async function connectTelemetry(
 
   const traceStore = {
     label: 'Local trace store',
-    detail: 'Cost and speed, with exact session timings, for Local and Copilot-harness chats. Runs alongside any collector you already use.',
+    detail: 'Cost and speed, with exact session timings, for Local harness and Copilot Agent Host harness chats. Runs alongside any collector you already use.',
     id: 'sqlite' as const
   };
   const fileFeed = {
@@ -524,7 +524,7 @@ async function connectTelemetry(
     }
   }
 
-  // The Copilot harness (VS Code 1.141+) runs in the Agent Host, whose own
+  // The Copilot Agent Host harness (VS Code 1.141+) has its own
   // pipeline never reaches agent-traces.db. Its trace store is additive too,
   // except that protobuf and gRPC traces would stop reaching a collector.
   let harness: 'on' | 'already' | 'collector' | undefined;
@@ -533,7 +533,7 @@ async function connectTelemetry(
     const known = agentHost.inspect(AGENT_HOST_DB_KEY);
     const setting = `${AGENT_HOST_SECTION}.${AGENT_HOST_DB_KEY}`;
     if (known?.defaultValue === undefined) {
-      output.appendLine(`[iceberg] ${setting} is not a setting in this VS Code build; Copilot-harness chats are not recorded.`);
+      output.appendLine(`[iceberg] ${setting} is not a setting in this VS Code build; Copilot Agent Host harness chats are not recorded.`);
     } else if (agentHost.get<boolean>(AGENT_HOST_DB_KEY) === true) {
       harness = 'already';
     } else if (!agentHostDbKeepsExporter({
@@ -585,10 +585,10 @@ async function connectTelemetry(
   // The Agent Host reads its settings only when it starts, and outlives window reloads.
   const harnessNote =
     harness === 'on'
-      ? ' Copilot-harness chats are recorded once the Agent Host restarts: quit and reopen VS Code, or run ' +
-        'Developer: Restart Local Agent Host, which interrupts running Copilot-harness chats.'
+      ? ' Copilot Agent Host harness chats are recorded once the Agent Host restarts: quit and reopen VS Code, or run ' +
+        'Developer: Restart Local Agent Host, which interrupts running Copilot Agent Host harness chats.'
       : harness === 'collector'
-        ? ' Copilot-harness chats are not recorded: their trace store would stop protobuf or gRPC traces reaching your collector.'
+        ? ' Copilot Agent Host harness chats are not recorded: their trace store would stop protobuf or gRPC traces reaching your collector.'
         : '';
   const choice = await vscode.window.showInformationMessage(
     `Copilot telemetry connected${note}. Reload so Copilot Chat picks up the change, then send a chat ` +
@@ -815,7 +815,7 @@ function showDiagnostics(otel: OtelWatcher, meter: TokenMeter, output: vscode.Ou
   output.appendLine(`  file feed           ${feed.jsonlPath ?? '(not configured)'}`);
   output.appendLine(`  trace store         ${feed.sqlitePath ?? '(not found)'}`);
   output.appendLine(
-    `  copilot harness     ${feed.agentHostPath ?? '(no agent-host-traces.db)'}` +
+    `  Copilot Agent Host harness  ${feed.agentHostPath ?? '(no agent-host-traces.db)'}` +
       (feed.agentHostPath && !feed.agentHostActive ? ' · no Copilot runtime spans in the last 7 days' : '')
   );
   // Already redacted by `health()`, which is the single place that touches the
diff --git a/src/otelSummary.ts b/src/otelSummary.ts
index 402cd9d..41a3af6 100644
--- a/src/otelSummary.ts
+++ b/src/otelSummary.ts
@@ -218,7 +218,7 @@ export interface FeedHealth {
   sqlitePath?: string;
   /** A trace store (Local harness or Agent Host) supplied spans. */
   sqliteActive: boolean;
-  /** VS Code Agent Host (Copilot harness) trace store, when it exists. */
+  /** VS Code Agent Host (Copilot Agent Host harness) trace store, when it exists. */
   agentHostPath?: string;
   agentHostActive?: boolean;
   /** Set when an OTLP endpoint is configured that `outfile` would displace. */
diff --git a/src/otelWatcher.ts b/src/otelWatcher.ts
index a3436e6..3de60e8 100644
--- a/src/otelWatcher.ts
+++ b/src/otelWatcher.ts
@@ -65,7 +65,7 @@ export interface OtelUsageDelta {
   input: number;
   output: number;
   requests: number;
-  /** `harness`: Copilot-harness calls seen only in the Agent Host store. */
+  /** `harness`: Copilot Agent Host harness calls seen only in the Agent Host store. */
   source?: 'traces' | 'harness';
   /**
    * Usage already charged to the harness ledger whose call a Local source has
@@ -121,10 +121,10 @@ interface PersistedState {
  *
  * - **The JSONL file feed** carries metrics, log events and current serialized
  *   spans. Legacy SDK v2 exports can contain empty `{}` span records instead.
- * - **`agent-traces.db`** carries completed Local-harness spans and their
+ * - **`agent-traces.db`** carries completed Local harness spans and their
  *   attributes. Read metadata only and merge by span ID so file/SQLite copies
  *   count just once.
- * - **`agent-host-traces.db`** carries Copilot-harness spans from VS Code's
+ * - **`agent-host-traces.db`** carries Copilot Agent Host harness spans from VS Code's
  *   Agent Host (1.141+), when its DB mode is on. Same schema; only Copilot
  *   runtime traces are read, and they merge by span ID with the others.
  *
@@ -868,7 +868,7 @@ export class OtelWatcher implements vscode.Disposable {
     // Copilot gives the environment variable precedence over the user setting.
     const identityCapture = identityCaptureOverride() ??
       this.copilotConfig.get<boolean>('captureIdentity', false) === true;
-    // Only VS Code builds with the Copilot harness register this setting.
+    // Only VS Code builds with the Copilot Agent Host harness register this setting.
     const agentHostAvailable = this.agentHostConfig.inspect?.(AGENT_HOST_DB_KEY)?.defaultValue !== undefined;
 
     const notes = [...this.notes];
@@ -885,8 +885,8 @@ export class OtelWatcher implements vscode.Disposable {
       notes.push(
         agentHostStoreOn
           ? 'The Agent Host trace store is on but has not written yet. It starts after the Agent Host restarts; ' +
-            'Copilot-harness chats are counted from then.'
-          : `No agent-host-traces.db found — Copilot-harness chats are read only when ${AGENT_HOST_SECTION}.${AGENT_HOST_DB_KEY} ` +
+            'Copilot Agent Host harness chats are counted from then.'
+          : `No agent-host-traces.db found — Copilot Agent Host harness chats are read only when ${AGENT_HOST_SECTION}.${AGENT_HOST_DB_KEY} ` +
             'is on. Connect can turn it on.'
       );
     }
diff --git a/src/restore.ts b/src/restore.ts
index 962e807..bfb0a4c 100644
--- a/src/restore.ts
+++ b/src/restore.ts
@@ -15,7 +15,7 @@ export const COPILOT_OTEL_SECTION = 'github.copilot.chat.otel';
 /** Copilot Chat OTel keys the connect command may write, relative to `github.copilot.chat.otel`. */
 export const CONNECT_KEYS = ['enabled', 'dbSpanExporter.enabled', 'dbSpanExporter', 'outfile', 'exporterType', 'captureIdentity'] as const;
 
-/** Backup keys for VS Code Agent Host (Copilot harness) settings carry this prefix. */
+/** Backup keys for VS Code Agent Host (Copilot Agent Host harness) settings carry this prefix. */
 export const AGENT_HOST_BACKUP_PREFIX = 'agentHost:';
 
 /** Agent Host OTel keys the connect command may write, as recorded in the backup. */
diff --git a/src/tokenMeter.ts b/src/tokenMeter.ts
index c91ff9c..f9c2ce6 100644
--- a/src/tokenMeter.ts
+++ b/src/tokenMeter.ts
@@ -44,7 +44,7 @@ interface Ledger {
 interface StoredUsage {
   metrics: Ledger;
   traces: Ledger;
-  /** Copilot-harness (Agent Host) model calls seen in no Local-harness source. */
+  /** Copilot Agent Host harness (Agent Host) model calls seen in no Local harness source. */
   harness: Ledger;
   manual: Ledger;
   credits: number;
@@ -57,8 +57,8 @@ function ledger(value?: Partial<Ledger>): Ledger {
 }
 
 /**
- * Metrics and Local-harness spans describe overlapping calls: never add them or
- * rebase on idle. Copilot-harness calls never reach the Local metric feed, so
+ * Metrics and Local harness spans describe overlapping calls: never add them or
+ * rebase on idle. Copilot Agent Host harness calls never reach the Local metric feed, so
  * their ledger is added to the reconciled Local figure rather than hidden by it.
  */
 export class TokenMeter implements vscode.Disposable {
diff --git a/test/attributionCanvas.test.js b/test/attributionCanvas.test.js
index 43c97be..aff6c2a 100644
--- a/test/attributionCanvas.test.js
+++ b/test/attributionCanvas.test.js
@@ -38,7 +38,8 @@ it('model spec: every concept covers every surface with a known availability', (
   }
 });
 
-it('model spec: outcomes, gaps, tiers and sources are well formed', () => {
+it('model spec: outcomes, gaps, link methods and sources are well formed', () => {
+  assert.equal(model.schemaVersion, 2);
   const surfaces = new Set(model.surfaces.map((s) => s.id));
   const liveMetrics = new Set([
     'creditsToPrShare',
@@ -57,9 +58,11 @@ it('model spec: outcomes, gaps, tiers and sources are well formed', () => {
     for (const s of gap.surfaces) assert.ok(surfaces.has(s), `${gap.id}: ${s}`);
   }
   assert.deepEqual(
-    model.tiers.map((t) => t.id),
-    ['T0', 'T1', 'T2', 'T3', 'U'],
+    model.linkMethods.map((method) => method.id),
+    ['tool-provided-link', 'exact-match', 'likely-match', 'estimated-share', 'not-linked'],
   );
+  assert.equal(model.tiers, undefined);
+  assert.doesNotMatch(JSON.stringify(model), /\bT[0-3]\b|"tier"\s*:/, 'descriptive methods replace the research-only codes everywhere in the model');
   for (const v of model.verification) assert.ok(['verified', 'unverified'].includes(v.status), v.claim);
   for (const source of model.sources) assert.match(source.url, /^https:\/\//, source.title);
   const entities = new Set(model.entities.map((e) => e.id));
@@ -100,7 +103,7 @@ it('model distinguishes organisation aggregates, self-reported completion and bi
   assert.match(model.reconciliation.source, /ai_credit\/usage/);
   assert.match(model.reconciliation.grain, /preserve the request filters/);
   assert.match(model.reconciliation.requirements.join(' '), /gross.*discount.*net/);
-  assert.match(model.reconciliation.allocationPolicy, /T3.*not measured/);
+  assert.match(model.reconciliation.allocationPolicy, /Estimated work cost.*not measured/);
   assert.equal(model.verification.find((v) => v.claim === '--max-ai-credits and /limits exist').status, 'verified');
   assert.equal(model.verification.find((v) => v.claim.includes('limits reset grain')).status, 'unverified');
   const actor = model.entities.find((e) => e.id === 'actor');
@@ -173,11 +176,32 @@ it('token formatting distinguishes unknown and measured zero', async () => {
   assert.equal(formatTokens(null), '—');
   assert.equal(formatTokens(undefined), '—');
   assert.equal(formatTokens(0), '0');
-  assert.equal(coverageText({ reportedCalls: 0, share: 0 }, 3), '0 / 3 calls (0%)');
-  assert.equal(coverageText({ reportedCalls: 1, share: 1 / 3 }, 3), '1 / 3 calls (33%)');
+  assert.equal(coverageText({ reportedCalls: 0, share: 0 }, 3), '0 / 3 requests (0%)');
+  assert.equal(coverageText({ reportedCalls: 1, share: 1 / 3 }, 3), '1 / 3 requests (33%)');
   assert.equal(coverageText(undefined, 3), 'Not measured');
 });
 
+it('harness names are shared by source reports and canvas labels without changing source IDs or database names', async (t) => {
+  const { sourceLabels } = await import(pathToFileURL(path.join(extensionDir, 'ui', 'format.mjs')));
+  assert.deepEqual(sourceLabels, {
+    sessionStore: 'Copilot CLI / app',
+    traces: 'VS Code · Local harness',
+    agentHost: 'VS Code · Copilot Agent Host harness',
+  });
+  const { computeCoverage } = await load('coverage.mjs');
+  const dir = tempDir(t);
+  const paths = {
+    sessionStorePath: path.join(dir, 'session-store.db'),
+    tracesDbPath: path.join(dir, 'agent-traces.db'),
+    agentHostTracesDbPath: path.join(dir, 'agent-host-traces.db'),
+  };
+  const coverage = await computeCoverage({ ...paths, env: {}, home: dir, platform: 'linux' });
+  assert.deepEqual(coverage.sources.map(({ id, label }) => [id, label]), Object.entries(sourceLabels));
+  assert.deepEqual(coverage.sources.map(({ path: file }) => path.basename(file)), [
+    'session-store.db', 'agent-traces.db', 'agent-host-traces.db',
+  ]);
+});
+
 it('normalises repository identifiers and drops credentials', async () => {
   const { normalizeRepository } = await load('coverage.mjs');
   assert.equal(normalizeRepository('obrocki/bear-in-mind'), 'obrocki/bear-in-mind');
@@ -829,7 +853,7 @@ it('canvas does not link a different native chat through a shared conversation o
   assert.equal(result.tokenCoverage.cacheWriteTokens.reportedCalls, 1);
 });
 
-it('Copilot harness: reads only Copilot runtime traces from agent-host-traces.db, with per-turn credits', async (t) => {
+it('Copilot Agent Host harness: reads only Copilot runtime traces from agent-host-traces.db, with per-turn credits', async (t) => {
   const { DatabaseSync } = require('node:sqlite');
   const { computeCoverage, findAgentHostTracesDb, vscodeUserDataDirs } = await load('coverage.mjs');
   const dir = tempDir(t);
diff --git a/test/otelWatcher.test.js b/test/otelWatcher.test.js
index 7aa959e..514f50f 100644
--- a/test/otelWatcher.test.js
+++ b/test/otelWatcher.test.js
@@ -436,7 +436,7 @@ function agentHostStore(file) {
   return { db, span, attr };
 }
 
-it('reads Copilot-harness spans from the Agent Host trace store, excluding other harnesses and duplicates', (t) => {
+it('reads Copilot Agent Host harness spans from the Agent Host trace store, excluding other harnesses and duplicates', (t) => {
   let now = Date.UTC(2026, 9, 19, 12);
   t.mock.method(Date, 'now', () => now);
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bear-agent-host-'));
diff --git a/test/recipeActors.test.js b/test/recipeActors.test.js
new file mode 100644
index 0000000..c4d8eaa
--- /dev/null
+++ b/test/recipeActors.test.js
@@ -0,0 +1,185 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { it } = require('node:test');
+const { pathToFileURL } = require('node:url');
+
+const lib = path.join(__dirname, '..', '.github', 'extensions', 'ai-attribution', 'lib');
+const load = (name) => import(pathToFileURL(path.join(lib, name)).href);
+const DAY = 86_400_000;
+const NOW = Date.UTC(2026, 9, 22, 10);
+const at = (days) => new Date(NOW - days * DAY).toISOString();
+const NANO = 1_000_000_000;
+
+async function fixture() {
+  const { CycleCollector, buildRecipe } = await load('recipe.mjs');
+  const { githubActor } = await load('actors.mjs');
+  const c = new CycleCollector();
+  const call = (branch, user, credits, source = 'traces') => c.addCall(source, {
+    repository: branch ? 'fable/widgets' : null, branch, user,
+    session: `s-${branch}`, nano: credits * NANO, credited: credits !== null, at: Date.parse(at(4)),
+  });
+  call('dev/1-feature', 'alex', 260000);
+  call('dev/1-feature', 'blair', 150000);
+  call('dev/2-feature', null, 100000);
+  call(null, 'alex', 40000);
+  call('spike', null, 50000);
+  call('dev/1-feature', null, 200000, 'sessionStore');
+  call('dev/1-feature', 'casey', null);
+  const recipe = buildRecipe(c, { generatedAt: at(0), window: { days: 7 } });
+  const pr = (number) => ({
+    number, state: 'OPEN', author: githubActor('alex'), createdAt: at(3),
+    commits: { total: 1, items: [{ sha: 'a'.repeat(40), at: at(4) }] },
+    reviews: { total: 0, items: [] }, closingIssues: [],
+  });
+  const verification = { at: at(0), github: { status: 'ok' }, azureBoards: { status: 'skipped' }, cycles: {
+    'fable/widgets#dev/1-feature': { github: true, pullRequest: pr(11), issues: {} },
+    'fable/widgets#dev/2-feature': { github: true, pullRequest: pr(12), issues: {} },
+  } };
+  return { c, recipe, verification };
+}
+
+it('developer report answers the 400k question without combining sources or replacing measured consumers', async () => {
+  const { recipeView } = await load('recipe.mjs');
+  const { recipe, verification } = await fixture();
+  const view = recipeView(recipe, verification);
+  const traces = view.developers.sources.find((s) => s.id === 'traces');
+  assert.equal(traces.total.credits, 600000);
+  assert.equal(traces.measured.credits, 450000);
+  assert.equal(traces.inferred.credits, 100000);
+  assert.equal(traces.unattributed.credits, 50000);
+  assert.equal(traces.measured.credits + traces.inferred.credits + traces.unattributed.credits, traces.total.credits);
+  const alex = traces.actors.find((a) => a.key === 'github:alex');
+  assert.equal(alex.usage.total.credits, 400000);
+  assert.equal(alex.usage.measured.credits, 300000);
+  assert.equal(alex.usage.inferred.credits, 100000);
+  assert.equal(alex.usage.work.reduce((n, w) => n + (w.total.credits ?? 0), 0), 400000);
+  assert.equal(alex.usage.work.find((w) => w.cycleKey === null).measured.credits, 40000, 'known user without work is retained');
+  assert.equal(alex.ownership.total.credits, 510000, 'owned work includes Blair; not personal consumption');
+  assert.equal(traces.actors.find((a) => a.key === 'github:blair').usage.measured.credits, 150000);
+  assert.equal(traces.actors.find((a) => a.key === 'github:casey').usage.total.credits, null, 'missing credit reports are not zero');
+  assert.equal(view.developers.sources.find((s) => s.id === 'sessionStore').total.credits, 200000, 'the second source stays separate');
+});
+
+it('case-insensitive login joins do not use branch names, device identities, emails or matching display names', async () => {
+  const { telemetryActor, githubActor, boardsActor, ownershipFor, validateIdentityLinks } = await load('actors.mjs');
+  assert.equal(telemetryActor('Alex').key, githubActor('alex').key);
+  assert.equal(telemetryActor('\n'), null);
+  const board = boardsActor({ id: 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee', displayName: 'alex', uniqueName: 'private@example.com' }, 'https://dev.azure.com/fable');
+  assert.notEqual(board.key, githubActor('alex').key);
+  assert.doesNotMatch(JSON.stringify(board), /private@example/);
+  assert.equal(ownershipFor([{ assignees: [githubActor('alex')] }], null, []).inferred, null, 'current assignee is never backdated');
+  const items = [{ assigneesAtStart: [board], assignmentAt: at(4) }];
+  assert.equal(ownershipFor(items, { author: githubActor('alex') }, []).inference, 'Conflicting owners');
+  const links = validateIdentityLinks([{ boardsKey: board.key, githubLogin: 'alex' }]);
+  assert.equal(ownershipFor(items, { author: githubActor('alex') }, links).inferred.key, 'github:alex');
+  assert.equal(ownershipFor([], { author: githubActor('helper[bot]', 'Bot') }, []).inferred, null, 'bots are not assumed human consumers');
+  assert.throws(() => validateIdentityLinks([{ boardsKey: 'alex', githubLogin: 'alex' }]));
+  assert.throws(() => validateIdentityLinks([...links, ...links]), /unique/);
+});
+
+it('truncated cycles and no-repository usage retain the full developer balance', async () => {
+  const { CycleCollector, buildRecipe, recipeView } = await load('recipe.mjs');
+  const c = new CycleCollector();
+  for (let i = 0; i < 202; i++) c.addCall('traces', {
+    repository: 'fable/widgets', branch: `dev/${i + 1}-feature`, user: 'alex',
+    at: NOW - i, nano: NANO, credited: true,
+  });
+  const recipe = buildRecipe(c);
+  assert.equal(recipe.truncated, 2);
+  const source = recipeView(recipe).developers.sources[0];
+  assert.equal(source.total.credits, 202);
+  assert.equal(source.work.find((w) => w.cycleKey === null).total.credits, 2);
+});
+
+it('assignment history reconstructs the assignee at pickup, never the current assignee', async () => {
+  const { githubAssignments } = await load('verify.mjs');
+  const node = {
+    assignees: { totalCount: 1, nodes: [{ login: 'blair' }] },
+    timelineItems: { pageInfo: { hasNextPage: false }, nodes: [
+      { __typename: 'AssignedEvent', createdAt: at(8), assignee: { login: 'alex', __typename: 'User' } },
+      { __typename: 'UnassignedEvent', createdAt: at(2), assignee: { login: 'alex', __typename: 'User' } },
+      { __typename: 'AssignedEvent', createdAt: at(2), assignee: { login: 'blair', __typename: 'User' } },
+    ] },
+  };
+  const assignment = githubAssignments(node, at(4), at(0));
+  assert.equal(assignment.assignees[0].key, 'github:blair');
+  assert.equal(assignment.assigneesAtStart[0].key, 'github:alex');
+  node.timelineItems.pageInfo.hasNextPage = true;
+  assert.deepEqual(githubAssignments(node, at(4), at(0)).assigneesAtStart, [], 'partial history cannot establish a past owner');
+});
+
+it('Azure Boards reads field-limited assignment snapshots at first activity and drops email data', async () => {
+  const { verifyRecipe } = await load('verify.mjs');
+  const { recipeView } = await load('recipe.mjs');
+  const { recipe } = await fixture();
+  const cycle = recipe.cycles[0];
+  cycle.convention = { provider: 'azure-boards', id: 123 };
+  const calls = [];
+  const fetch = async (url) => {
+    calls.push(url);
+    const u = new URL(url);
+    if (u.pathname.endsWith('/states')) return new Response(JSON.stringify({ value: [] }));
+    const old = u.searchParams.has('asOf');
+    const assigned = { id: old ? 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' : 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
+      displayName: old ? 'Alex Boards' : 'Blair Boards', uniqueName: 'must-not-retain@example.com', imageUrl: 'private/avatar' };
+    return new Response(JSON.stringify({ value: [{ id: 123, fields: {
+      'System.WorkItemType': 'Task', 'System.State': 'Active', 'System.TeamProject': 'Test', 'System.AssignedTo': assigned,
+    } }] }));
+  };
+  const verification = await verifyRecipe({ ...recipe, cycles: [cycle] }, {
+    fetch, run: async () => ({ missing: true }), organization: 'fable',
+    env: { AZURE_DEVOPS_EXT_PAT: 'test' }, now: NOW,
+  });
+  assert.equal(verification.azureBoards.status, 'ok');
+  const snap = calls.find((url) => url.includes('asOf='));
+  assert.equal(new URL(snap).searchParams.get('asOf'), cycle.first);
+  assert.equal(new URL(snap).searchParams.get('fields'), 'System.Id,System.AssignedTo');
+  assert.doesNotMatch(JSON.stringify(verification), /must-not-retain|private\/avatar/);
+  const view = recipeView({ ...recipe, cycles: [cycle] }, verification);
+  assert.equal(view.cycles[0].ownership.inferred.label, 'Alex Boards');
+  assert.equal(view.cycles[0].ownership.roles.find((r) => r.role === 'Assigned now').actor.label, 'Blair Boards');
+});
+
+it('GitHub actor queries remain content-free and use fixed assignment event kinds', async () => {
+  const { githubQuery } = await load('verify.mjs');
+  const query = githubQuery([{ kind: 'pr', alias: 'p0' }, { kind: 'issue', alias: 'i1' }]);
+  assert.match(query, /author \{ login __typename \}/);
+  assert.match(query, /ASSIGNED_EVENT, UNASSIGNED_EVENT/);
+  assert.doesNotMatch(query, /\b(title|body|message|description|email|comments)\b/);
+});
+
+it('changing the activity window invalidates historical ownership snapshots', async () => {
+  const { recipe, verification } = await fixture();
+  const { recipeView } = await load('recipe.mjs');
+  const key = 'fable/widgets#dev/2-feature';
+  verification.cycles[key].activityFirst = at(5);
+  const view = recipeView(recipe, verification);
+  const cycle = view.cycles.find((c) => c.key === key);
+  assert.equal(cycle.ownership.inferred, null);
+  assert.equal(cycle.attribution[0].method, 'unattributed');
+});
+
+it('Azure Boards snapshot failures are visible and do not backdate current assignment', async () => {
+  const { verifyRecipe } = await load('verify.mjs');
+  const { recipeView } = await load('recipe.mjs');
+  const { recipe } = await fixture();
+  const cycle = recipe.cycles[0];
+  cycle.convention = { provider: 'azure-boards', id: 123 };
+  const fetch = async (url) => {
+    if (url.includes('asOf=')) return new Response('', { status: 403 });
+    return new Response(JSON.stringify({ value: [{ id: 123, fields: {
+      'System.AssignedTo': { id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', displayName: 'Alex' },
+    } }] }));
+  };
+  const verification = await verifyRecipe({ ...recipe, cycles: [cycle] }, {
+    fetch, run: async () => ({ missing: true }), organization: 'fable',
+    env: { AZURE_DEVOPS_EXT_PAT: 'test' }, now: NOW,
+  });
+  assert.equal(verification.azureBoards.status, 'partial');
+  assert.match(verification.azureBoards.reason, /historical assignments/);
+  const view = recipeView({ ...recipe, cycles: [cycle] }, verification);
+  assert.equal(view.cycles[0].ownership.inferred, null);
+  assert.ok(view.cycles[0].ownership.roles.some((r) => r.role === 'Assigned now'));
+});
diff --git a/test/recipeBilling.test.js b/test/recipeBilling.test.js
new file mode 100644
index 0000000..ce04c66
--- /dev/null
+++ b/test/recipeBilling.test.js
@@ -0,0 +1,163 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { it } = require('node:test');
+const { pathToFileURL } = require('node:url');
+const load = (file) => import(pathToFileURL(path.join(__dirname, '..', '.github', 'extensions', 'ai-attribution', 'lib', file)).href);
+const NOW = Date.UTC(2026, 9, 22, 10);
+const DAY = '2026-10-20';
+const SCOPE = { level: 'organization', account: 'fable', user: 'alex', day: DAY };
+const item = (extra = {}) => ({
+  product: 'Copilot', sku: 'Copilot AI credits', model: 'model-a', unitType: 'AI credits', pricePerUnit: 0.01,
+  grossQuantity: 100, grossAmount: 1, discountQuantity: 40, discountAmount: 0.4, netQuantity: 60, netAmount: 0.6,
+  ...extra,
+});
+const body = (items = [item()], extra = {}) => ({
+  timePeriod: { year: 2026, month: 10, day: 20 }, organization: 'fable', user: 'alex', product: 'Copilot', usageItems: items, ...extra,
+});
+
+it('billing validates scope before any network call and only accepts a completed UTC day', async () => {
+  const { billingScope, fetchBilling } = await load('billing.mjs');
+  assert.deepEqual(billingScope(SCOPE, NOW), { ...SCOPE, product: 'Copilot' });
+  for (const input of [
+    { ...SCOPE, account: 'fable/../../else' }, { ...SCOPE, user: 'alex&admin=true' },
+    { ...SCOPE, day: '2026-02-30' }, { ...SCOPE, day: '2026-10-22' }, { ...SCOPE, day: '2026-10-23' },
+    { ...SCOPE, level: 'user' }, { ...SCOPE, level: 'something' },
+  ]) {
+    await assert.rejects(fetchBilling(input, { now: NOW, run: async () => assert.fail('invalid scope must not run gh') }));
+  }
+});
+
+it('billing calls only GitHub, with an explicit paying level, user, product and UTC day', async () => {
+  const { fetchBilling } = await load('billing.mjs');
+  for (const [level, account, prefix] of [['organization', 'fable', 'organizations'], ['enterprise', 'fable', 'enterprises'], ['user', 'alex', 'users']]) {
+    const calls = [];
+    const report = await fetchBilling({ ...SCOPE, level, account }, {
+      now: NOW, env: {},
+      run: async (command, args, options) => {
+        calls.push(args);
+        assert.equal(command, 'gh');
+        assert.equal(options.timeout, 30000);
+        const response = body();
+        delete response.organization;
+        response[level === 'organization' ? 'organization' : level === 'enterprise' ? 'enterprise' : 'user'] = account;
+        return { code: 0, stdout: JSON.stringify(response) };
+      },
+    });
+    assert.equal(report.status, 'ok');
+    assert.equal(calls.length, 1);
+    const args = calls[0];
+    assert.ok(args.includes(`/${prefix}/${account}/settings/billing/ai_credit/usage`));
+    assert.deepEqual(args.slice(0, 5), ['api', '--hostname', 'github.com', '--method', 'GET']);
+    for (const field of ['year=2026', 'month=10', 'day=20', 'product=Copilot']) assert.ok(args.includes(field));
+    assert.equal(args.includes('user=alex'), level !== 'user');
+    assert.equal(report.scope.day, DAY);
+  }
+});
+
+it('billing preserves gross, discounts, net, SKU and requested scope without retaining arbitrary response fields', async () => {
+  const { parseBillingReport, billingScope } = await load('billing.mjs');
+  const scope = billingScope(SCOPE, NOW);
+  const report = parseBillingReport(body([item({ private: 'do-not-retain' })], { arbitrary: 'do-not-retain' }), scope, new Date(NOW).toISOString());
+  assert.equal(report.items[0].grossQuantity, 100);
+  assert.equal(report.items[0].discountQuantity, 40);
+  assert.equal(report.items[0].netQuantity, 60);
+  assert.equal(report.items[0].netAmount, 0.6);
+  assert.doesNotMatch(JSON.stringify(report), /do-not-retain/);
+  const noEchoedFilters = body();
+  delete noEchoedFilters.user;
+  delete noEchoedFilters.product;
+  assert.deepEqual(parseBillingReport(noEchoedFilters, scope, '').scope, scope, 'request filters carry the grain even when response omits them');
+});
+
+it('scope mismatches, missing amounts, unsupported units and malformed reports fail rather than looking like zero usage', async () => {
+  const { parseBillingReport, billingScope } = await load('billing.mjs');
+  const scope = billingScope(SCOPE, NOW);
+  for (const invalid of [
+    body([item({ unitType: 'premium requests' })]), body([item({ grossQuantity: '100' })]),
+    body([item({ netAmount: undefined })]), body([item({ pricePerUnit: -1 })]),
+    body([item({ model: null })]), body([item({ product: 'Other product' })]),
+    body([], { user: 'blair' }), body([], { organization: 'other' }),
+    body([], { timePeriod: { year: 2026, month: 10 } }),
+  ]) assert.throws(() => parseBillingReport(invalid, scope, ''));
+  assert.deepEqual(parseBillingReport(body([]), scope, '').items, [], 'an explicit empty valid report is supported');
+});
+
+it('reconciliation compares native user/day/model only and allocates a bounded estimated work share', async () => {
+  const { CycleCollector, buildRecipe } = await load('recipe.mjs');
+  const { parseBillingReport, billingScope, reconcileBilling } = await load('billing.mjs');
+  const c = new CycleCollector();
+  const add = (credits, extra = {}) => c.addCall('traces', {
+    repository: 'fable/widgets', branch: 'alex/1-change', user: 'alex', model: 'model-a',
+    at: Date.parse(`${DAY}T12:00:00Z`), credited: true, nano: credits * 1e9, ...extra,
+  });
+  add(40);
+  add(10, { repository: null });
+  add(15, { user: null });
+  add(99, { user: 'blair' });
+  add(900, { at: Date.parse('2026-10-19T12:00:00Z') });
+  add(25, { model: 'unmatched-alias' });
+  c.addCall('sessionStore', { user: 'alex', model: 'model-a', at: Date.parse(`${DAY}T12:00:00Z`), credited: true, nano: 300e9 });
+  const recipe = buildRecipe(c);
+  const report = parseBillingReport(body(), billingScope(SCOPE, NOW), '');
+  const result = reconcileBilling(report, recipe, 'traces');
+  assert.equal(result.observed, 50);
+  assert.equal(result.difference, 50);
+  assert.equal(result.unmatchedBilling, 50);
+  assert.equal(result.outsideModelScope, 25);
+  assert.equal(result.unknownIdentity, 15);
+  assert.equal(result.work.length, 1);
+  assert.equal(result.work[0].grossQuantity, 40);
+  assert.equal(result.work[0].netAmount, 0.24);
+  assert.equal(result.work[0].method, 'estimated-share');
+  assert.equal(result.work[0].tier, undefined);
+  assert.equal(result.unallocatedNetAmount, 0.36, 'unlinked work and missing observations keep their unallocated balance');
+  const other = reconcileBilling(report, recipe, 'sessionStore');
+  assert.equal(other.observed, 300);
+  assert.equal(other.localExceedsBilling, true);
+  assert.deepEqual(other.work, []);
+});
+
+it('model-level mismatches cannot cancel out or manufacture work allocations', async () => {
+  const { reconcileBilling, parseBillingReport, billingScope } = await load('billing.mjs');
+  const report = parseBillingReport(body([
+    item({ model: 'model-a', grossQuantity: 10 }), item({ model: 'model-b', grossQuantity: 10 }),
+  ]), billingScope(SCOPE, NOW), '');
+  const usage = (model, credits) => ({
+    source: 'traces', actor: { key: 'github:alex' }, day: DAY, model, credits, calls: 1, creditedCalls: 1, cycleKey: 'work',
+  });
+  const result = reconcileBilling(report, { billingUsage: [usage('MODEL-A', 15), usage('model-b', 5)] }, 'traces');
+  assert.equal(result.difference, 0);
+  assert.equal(result.unmatchedBilling, 5, 'positive and negative per-model gaps do not hide each other');
+  assert.equal(result.localExceedsBilling, true);
+  assert.equal(result.work[0].grossQuantity, 5, 'only the non-exceeding model is allocated');
+});
+
+it('missing identity or credit reports stay unknown, while a reported zero stays zero', async () => {
+  const { reconcileBilling, parseBillingReport, billingScope, billingView } = await load('billing.mjs');
+  const report = parseBillingReport(body(), billingScope(SCOPE, NOW), '');
+  const row = { source: 'traces', day: DAY, model: 'model-a', actor: null, credits: 20, creditedCalls: 1, calls: 1 };
+  assert.equal(reconcileBilling(report, { billingUsage: [row] }, 'traces').observed, null);
+  row.actor = { key: 'github:alex' }; row.credits = 0; row.creditedCalls = 0;
+  assert.equal(reconcileBilling(report, { billingUsage: [row] }, 'traces').observed, null);
+  row.creditedCalls = 1;
+  assert.equal(reconcileBilling(report, { billingUsage: [row] }, 'traces').observed, 0);
+  assert.deepEqual(billingView(null, {}), { status: 'disconnected' });
+  assert.deepEqual(billingView({ status: 'error', reason: 'denied' }, {}).sources, []);
+});
+
+it('billing failures never leak credential or raw response text', async () => {
+  const { fetchBilling } = await load('billing.mjs');
+  for (const response of [
+    { missing: true, stderr: 'secret' },
+    { code: 1, stderr: 'HTTP 403 secret' },
+    { code: 1, stderr: 'HTTP 503 secret' },
+    { code: 0, stdout: '{"secret": invalid json' },
+  ]) {
+    const report = await fetchBilling(SCOPE, { now: NOW, run: async () => response });
+    assert.equal(report.status, 'error');
+    assert.doesNotMatch(JSON.stringify(report), /secret/);
+    assert.equal(report.items, undefined);
+  }
+});
diff --git a/test/recipeCanvas.test.js b/test/recipeCanvas.test.js
index efe71c6..c82ea01 100644
--- a/test/recipeCanvas.test.js
+++ b/test/recipeCanvas.test.js
@@ -185,11 +185,13 @@ function createStores(dir) {
     attr.run(id, 'github.copilot.git.repository', 'https://github.com/octo/web');
     attr.run(id, 'github.copilot.git.branch', 'alex/AB123-checkout');
     attr.run(id, 'github.copilot.git.commit_sha', commit);
+    attr.run(id, 'user.name', id === 'a1' ? 'alex' : 'blair');
   }
   span.run('c1', 't-a1', 'chat', Date.parse(at(8)) + 1000, 'vs-1');
   attr.run('c1', 'copilot_chat.copilot_usage_nano_aiu', String(5 * NANO));
   span.run('c2', 't-a2', 'chat', Date.parse(at(6)) + 1000, 'vs-1');
   attr.run('c2', 'copilot_chat.copilot_usage_nano_aiu', String(1 * NANO));
+  traces.exec("UPDATE spans SET response_model = 'm' WHERE operation_name = 'chat'");
   traces.close();
   return { sessionStorePath, tracesDbPath };
 }
@@ -212,6 +214,9 @@ it('local recipe: one cycle per repository branch, credits per source and never
   assert.deepEqual(web.pullRequests.map((p) => p.number), [128]);
   assert.deepEqual(web.commits.map((c) => c.sha), ['a1b2c3d']);
   assert.deepEqual(web.heads.map((c) => c.sha), ['aaaaaaa', 'bbbbbbb']);
+  assert.deepEqual(web.sources.find((s) => s.id === 'traces').actors.map((a) => [a.actor.key, a.credits]), [
+    ['github:alex', 5], ['github:blair', 1],
+  ], 'Recipe preserves the call-time user context, including account switches');
   assert.deepEqual(web.issues, [], 'other-repository and free-text references are dropped');
   assert.equal(recipe.droppedRefs, 2);
   assert.deepEqual(recipe.unlinked.map((u) => [u.id, u.calls]), [['sessionStore', 1]]);
@@ -251,7 +256,7 @@ it('recipe view without verification: unknown stays unknown, convention is count
   assert.equal(view.kpis.medianOpenToMergeHours, null, 'not measured is not zero');
 });
 
-const FORBIDDEN = /\b(title|body|bodyText|message|messageHeadline|comments|author|login|description)\b/;
+const FORBIDDEN = /\b(title|body|bodyText|message|messageHeadline|comments|description|email)\b/;
 
 function fakeGh(responses, calls) {
   return async (command, args) => {
@@ -259,7 +264,7 @@ function fakeGh(responses, calls) {
     if (command !== 'gh') return { code: 1, missing: true, stdout: '', stderr: '' };
     const query = args[args.indexOf('-f') + 1];
     assert.match(query, /^query=/);
-    assert.doesNotMatch(query, FORBIDDEN, 'never requests content or identities');
+    assert.doesNotMatch(query, FORBIDDEN, 'only account/assignment metadata, never content or email');
     const value = (name) => args.find((a, i) => ['-f', '-F'].includes(args[i - 1]) && a.startsWith(`${name}=`))?.slice(name.length + 1);
     const repo = responses[`${value('owner')}/${value('name')}`];
     if (!repo) return { code: 1, missing: false, stdout: JSON.stringify({ data: { repository: null }, errors: [{ type: 'NOT_FOUND' }] }), stderr: '' };
@@ -431,11 +436,20 @@ it('canvas server: recipe and verify routes, with the same origin check', async
         verified.push(options);
         return { verified: true };
       },
+      identityLinks: async (links) => {
+        const { validateIdentityLinks } = await load('actors.mjs');
+        return { links: validateIdentityLinks(links) };
+      },
+      billing: async (scope) => {
+        const { billingScope } = await load('billing.mjs');
+        return { scope: billingScope(scope, Date.UTC(2026, 9, 22)) };
+      },
       getView: () => 'recipe',
       setView: (v) => v,
       windowDays: () => 30,
     },
   });
+
   t.after(() => server.close());
   const port = Number(new URL(server.url).port);
   assert.equal((await request(port, { pathname: '/recipe.mjs' })).status, 200);
@@ -443,4 +457,70 @@ it('canvas server: recipe and verify routes, with the same origin check', async
   assert.deepEqual(JSON.parse((await request(port, { method: 'POST', pathname: '/api/recipe/verify', body: { azureDevOpsOrg: 'contoso' } })).body), { verified: true });
   assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/verify', origin: 'https://evil.example', body: {} })).status, 403);
   assert.deepEqual(verified, [{ azureDevOpsOrg: 'contoso' }]);
+  const links = [{ boardsKey: 'boards:https://dev.azure.com/contoso:aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', githubLogin: 'alex' }];
+  assert.deepEqual(JSON.parse((await request(port, { method: 'POST', pathname: '/api/recipe/identity-links', body: { links } })).body), { links });
+  assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/identity-links', origin: 'https://evil.example', body: { links } })).status, 403);
+  assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/identity-links', body: { links: 'invalid' } })).status, 500);
+  const scope = { level: 'organization', account: 'contoso', user: 'alex', day: '2026-10-20' };
+  assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/billing', body: scope })).status, 200);
+  assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/billing', origin: 'https://evil.example', body: scope })).status, 403);
+  assert.equal((await request(port, { method: 'POST', pathname: '/api/recipe/billing', body: { ...scope, day: 'invalid' } })).status, 500);
+  assert.equal((await request(port, { pathname: '/research.md' })).status, 404, 'Research is inline, not a download');
+});
+
+it('canvas wiring exposes filtered developer reports and identity links through SDK actions', async (t) => {
+  const dir = tempDir(t);
+  const paths = createStores(dir);
+  const slot = `__recipeCanvas${Date.now()}`;
+  const stub = `data:text/javascript;base64,${Buffer.from(`
+    export const createCanvas = (canvas) => canvas;
+    export const joinSession = async (options) => { globalThis[${JSON.stringify(slot)}] = options.canvases[0]; };
+    export class CanvasError extends Error {}
+  `).toString('base64')}`;
+  const billingStub = `data:text/javascript;base64,${Buffer.from(`
+    import { billingScope, parseBillingReport, billingView } from ${JSON.stringify(pathToFileURL(path.join(extensionDir, 'lib', 'billing.mjs')).href)};
+    export { billingView };
+    export async function fetchBilling(input) {
+      const scope = billingScope(input, Date.UTC(2026, 9, 22));
+      if (scope.account === 'denied') return {status:'error', scope, reason:'Billing access denied.'};
+      const [year,month,day] = scope.day.split('-').map(Number);
+      return parseBillingReport({timePeriod:{year,month,day}, user:scope.user, organization:scope.account,
+        usageItems:[{product:'Copilot',sku:'credits',model:'m',unitType:'AI credits',pricePerUnit:.01,
+          grossQuantity:10,grossAmount:.1,discountQuantity:0,discountAmount:0,netQuantity:10,netAmount:.1}]},
+        scope, new Date(Date.UTC(2026,9,22)).toISOString());
+    }
+  `).toString('base64')}`;
+  const source = fs.readFileSync(path.join(extensionDir, 'extension.mjs'), 'utf8')
+    .replace("from '@github/copilot-sdk/extension'", `from '${stub}'`)
+    .replace("from './lib/billing.mjs'", `from '${billingStub}'`)
+    .replace(/from '(\.\/[^']+)'/g, (_, file) => `from '${pathToFileURL(path.resolve(extensionDir, file)).href}'`);
+  await import(`data:text/javascript;base64,${Buffer.from(source).toString('base64')}`);
+  const canvas = globalThis[slot];
+  delete globalThis[slot];
+  assert.ok(canvas.inputSchema.properties.identityLinks);
+  assert.ok(canvas.actions.some((action) => action.name === 'reconcile_recipe_billing'));
+  const instanceId = 'actors-test';
+  t.after(() => canvas.onClose({ instanceId }));
+  const opened = await canvas.open({ instanceId, input: {
+    view: 'recipe', windowDays: 0, ...paths, agentHostTracesDbPath: path.join(dir, 'absent.db'),
+  } });
+  assert.match(opened.url, /^http:\/\/127\.0\.0\.1:\d+/);
+  const action = (name, input) => canvas.actions.find((a) => a.name === name).handler({ instanceId, input });
+  const report = await action('get_recipe', { sourceId: 'traces', actorKey: 'github:alex' });
+  assert.equal(report.billing.status, 'disconnected', 'opening/reading Recipe does not fetch billing');
+  await assert.rejects(action('reconcile_recipe_billing', { level: 'organization', account: 'bad/path', user: 'alex', day: 'invalid' }));
+  assert.equal((await action('get_recipe', {})).billing.status, 'disconnected', 'a rejected read cannot expose a stale report');
+  assert.equal(report.developers.sources.length, 1);
+  assert.equal(report.developers.sources[0].summary.measured.credits, 5);
+  assert.equal(report.developers.sources[0].summary.work[0].repository, 'octo/web');
+  const billing = await action('reconcile_recipe_billing', { level: 'organization', account: 'contoso', user: 'alex', day: '2026-10-12' });
+  assert.equal(billing.billing.status, 'ok');
+  assert.equal(billing.billing.sources.find((row) => row.sourceId === 'traces').observed, 5);
+  const denied = await action('reconcile_recipe_billing', { level: 'organization', account: 'denied', user: 'alex', day: '2026-10-12' });
+  assert.equal(denied.billing.status, 'error');
+  assert.equal(denied.billing.items, undefined, 'a failed billing request clears the previous report');
+  const link = { boardsKey: 'boards:https://dev.azure.com/contoso:aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', githubLogin: 'alex' };
+  const mapped = await action('set_recipe_identity_links', { links: [link] });
+  assert.deepEqual(mapped.developers.identityLinks, [link]);
+  await assert.rejects(action('set_recipe_identity_links', { links: [{ boardsKey: 'display name', githubLogin: 'alex' }] }));
 });
diff --git a/test/tokenMeter.test.js b/test/tokenMeter.test.js
index c880805..c826a3b 100644
--- a/test/tokenMeter.test.js
+++ b/test/tokenMeter.test.js
@@ -120,7 +120,7 @@ it('reconciles each dimension independently without changing the split', (t) =>
   assert.equal(meter.snapshot().output, 20);
 });
 
-it('adds Copilot-harness calls to the reconciled Local figure and keeps them out of drift', (t) => {
+it('adds Copilot Agent Host harness calls to the reconciled Local figure and keeps them out of drift', (t) => {
   const { meter, store } = fixture(t);
   meter.observe('otel', 1000000, 1000, 0);
   meter.observe('traces', 400000, 400, 1);
diff --git a/tools/README.md b/tools/README.md
index 8b743b3..bc2e52f 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -24,10 +24,18 @@ stores, and can be rebuilt one at a time, for example:
 `npm run media:canvas -- canvas-coverage.png`.
 The canvas harness also verifies live system theme changes, body-injected host
 tokens, explicit Light/Dark overrides and body-text contrast of at least 4.5:1.
-It includes light and dark Intersection views; it never reads live stores.
+Main-view copy is also checked for unexplained codes and specialist terms.
+Overview checks the mission/map/measurements order and the source connections,
+including that the bill feeds a separate comparison rather than the delivery flow.
+It includes light and dark shared-surface filters; it never reads live stores.
 It also checks per-tab visible-word budgets, keyboard expansion and tab
 navigation, disclosure state/focus after rendering, full evidence access and
 390px layouts. Gaps and Research have their own synthetic previews.
+Recipe checks developer/source filters, usage versus ownership and explicit
+provider identity link/remove. Its account identities and API responses are synthetic.
+Billing exercises the real client with an injected synthetic `gh` response:
+explicit submission, native-user/day/model scope, amount precision and estimated
+estimates. The setup preview expands the prerequisites/permissions checklist.
 Dashboard shots include `dashboard-light.png`, both high-contrast variants and
 `dashboard-sdk.png`. They emulate VS Code's body classes/semantic tokens, check
 body-text contrast and verify that SVG paints follow live theme changes without
diff --git a/tools/make-canvas-shots.js b/tools/make-canvas-shots.js
index e7671a9..317874e 100644
--- a/tools/make-canvas-shots.js
+++ b/tools/make-canvas-shots.js
@@ -20,9 +20,9 @@ const SHOTS = [
     file: 'canvas-outcomes.png',
     view: 'outcomes',
     w: 1280,
-    h: 980,
+    h: 1240,
     dsf: 1,
-    ready: "document.querySelector('.outcome-kpis .ratio-bar') && document.body.innerText.includes('Credits with a PR reference')",
+    ready: "document.querySelector('.overview-map svg') && document.querySelector('.outcome-kpis .ratio-bar')",
   },
   {
     file: 'canvas-coverage.png',
@@ -38,7 +38,7 @@ const SHOTS = [
     w: 1280,
     h: 900,
     dsf: 1,
-    ready: "document.body.innerText.includes('What each surface emits') && document.querySelector('table.matrix')",
+    ready: "document.body.innerText.includes('What each Copilot tool or report provides') && document.querySelector('table.matrix')",
   },
   {
     file: 'canvas-intersection.png',
@@ -61,15 +61,15 @@ const SHOTS = [
     file: 'canvas-model.png',
     view: 'model',
     w: 1280,
-    h: 1000,
+    h: 1150,
     dsf: 1,
-    ready: "document.querySelector('.model-graph svg') && document.querySelector('.tier-cards')",
+    ready: "document.querySelector('.model-graph svg') && document.querySelector('.link-methods')",
   },
   {
     file: 'canvas-recipe.png',
     view: 'recipe',
     w: 1440,
-    h: 1750,
+    h: 2150,
     dsf: 1,
     ready: "document.querySelector('.recipe-strip svg') && document.querySelectorAll('.lane').length >= 6 && document.body.innerText.includes('Azure Boards: connected')",
     prepare: "document.querySelector('.lane-meta').click()",
@@ -81,7 +81,35 @@ const SHOTS = [
     w: 1440,
     h: 1180,
     dsf: 1,
-    ready: "document.querySelector('.recipe-strip svg') && document.body.innerText.includes('Local evidence only')",
+    ready: "document.querySelector('.recipe-strip svg') && document.body.innerText.includes('Local records only')",
+  },
+  {
+    file: 'canvas-recipe-developer.png',
+    view: 'recipe',
+    w: 1280,
+    h: 1000,
+    dsf: 1,
+    focus: '.developer-report',
+    ready: "document.querySelector('.developer-report') && document.body.innerText.includes('Azure Boards: connected')",
+    prepare: "(() => { const el = document.querySelector('[aria-label=\"Developer\"]'); el.value = 'github:octocat'; el.dispatchEvent(new Event('change')); })()",
+  },
+  {
+    file: 'canvas-recipe-billing.png',
+    view: 'recipe',
+    billing: true,
+    w: 1440,
+    h: 1900,
+    dsf: 1,
+    ready: "document.querySelector('.billing-panel form') && document.body.innerText.includes('Azure Boards: connected')",
+  },
+  {
+    file: 'canvas-recipe-setup.png',
+    view: 'recipe',
+    w: 1280,
+    h: 1500,
+    dsf: 1,
+    ready: "document.querySelector('[data-detail=\"recipe-setup\"]')",
+    prepare: "document.querySelector('[data-detail=\"recipe-setup\"]').open = true",
   },
   {
     file: 'canvas-gaps.png',
@@ -89,7 +117,7 @@ const SHOTS = [
     w: 1280,
     h: 900,
     dsf: 1,
-    ready: "document.querySelector('[data-detail=\"verification-status\"]')",
+    ready: "document.querySelector('[data-detail^=\"gap-\"]')",
   },
   {
     file: 'canvas-research.png',
@@ -97,7 +125,7 @@ const SHOTS = [
     w: 1280,
     h: 900,
     dsf: 1,
-    ready: "document.querySelector('.research-index .disclosure')",
+    ready: "document.querySelector('.research-summary tbody')",
   },
 ];
 
@@ -415,10 +443,17 @@ function createFixtures(runDir, now) {
 function syntheticForges(now) {
   const at = (daysAgo, hour = 10) => iso(now, daysAgo, hour);
   const sha = (seed) => seed.repeat(40).slice(0, 40);
+  const assignments = (login, days) => ({
+    assignees: { totalCount: 1, nodes: [{ login }] },
+    timelineItems: { pageInfo: { hasNextPage: false }, nodes: [
+      { __typename: 'AssignedEvent', createdAt: at(days, 8), assignee: { login, __typename: 'User' } },
+    ] },
+  });
   const pr = (number, branch, { state, created, merged = null, reviews = [], commits = [], closing = [] }) => ({
     number,
     state,
     isDraft: false,
+    author: { login: number === 90 ? 'river-demo' : 'octocat', __typename: 'User' },
     createdAt: at(created, 15),
     mergedAt: merged === null ? null : at(merged, 11),
     closedAt: merged === null ? null : at(merged, 11),
@@ -427,7 +462,7 @@ function syntheticForges(now) {
     reviewDecision: reviews.at(-1)?.[0] ?? null,
     reviews: { totalCount: reviews.length, nodes: reviews.map(([s, d]) => ({ state: s, submittedAt: at(d, 16) })) },
     commits: { totalCount: commits.length, nodes: commits.map(([seed, d], i) => ({ commit: { oid: sha(seed), committedDate: at(d, 9 + i) } })) },
-    closingIssuesReferences: { nodes: closing },
+    closingIssuesReferences: { nodes: closing.map((item) => ({ ...item, ...assignments('octocat', 30) })) },
   });
   const issue = (number, state, type, created, closed = null) => ({
     __typename: 'Issue',
@@ -437,6 +472,7 @@ function syntheticForges(now) {
     createdAt: at(created, 9),
     closedAt: closed === null ? null : at(closed, 12),
     issueType: { name: type },
+    ...assignments(number === 61 ? 'river-demo' : 'octocat', created),
   });
   const github = {
     'contoso/web-app': {
@@ -500,8 +536,10 @@ function syntheticForges(now) {
   };
 
   const workItems = {
-    1234: { 'System.WorkItemType': 'User Story', 'System.State': 'Closed', 'System.TeamProject': 'Web', 'System.CreatedDate': at(35), 'Microsoft.VSTS.Common.ActivatedDate': at(27, 8), 'Microsoft.VSTS.Common.ClosedDate': at(15, 13) },
-    1250: { 'System.WorkItemType': 'Task', 'System.State': 'Active', 'System.TeamProject': 'Web', 'System.CreatedDate': at(9), 'Microsoft.VSTS.Common.ActivatedDate': at(6, 8) },
+    1234: { 'System.WorkItemType': 'User Story', 'System.State': 'Closed', 'System.TeamProject': 'Web', 'System.CreatedDate': at(35), 'Microsoft.VSTS.Common.ActivatedDate': at(27, 8), 'Microsoft.VSTS.Common.ClosedDate': at(15, 13),
+      'System.AssignedTo': { id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', displayName: 'Mona Example' } },
+    1250: { 'System.WorkItemType': 'Task', 'System.State': 'Active', 'System.TeamProject': 'Web', 'System.CreatedDate': at(9), 'Microsoft.VSTS.Common.ActivatedDate': at(6, 8),
+      'System.AssignedTo': { id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', displayName: 'Mona Example' } },
   };
   const states = [
     { name: 'New', category: 'Proposed' },
@@ -576,21 +614,24 @@ async function waitForRender(ws, sessionId, ready) {
   throw new Error(`canvas did not finish rendering; saw: ${text}`);
 }
 
-const WORD_BUDGETS = { outcomes: 200, recipe: 600, surfaces: 300, intersection: 180, model: 130, gaps: 180, coverage: 280, research: 130 };
+const WORD_BUDGETS = { outcomes: 260, recipe: 600, surfaces: 300, intersection: 200, model: 150, gaps: 140, coverage: 250, research: 300 };
 
 async function verifyCompactView(ws, sessionId, view) {
-  const words = await evaluate(ws, sessionId, "document.getElementById('view').innerText.trim().split(/\\s+/).length");
+  const visibleText = await evaluate(ws, sessionId, "document.getElementById('view').innerText");
+  const words = visibleText.trim().split(/\s+/).length;
+  assert.doesNotMatch(visibleText, /\b(?:T[0-3]|native|deterministic|provenance|unattributed|reconciliation|canonical|grain|ledger|surfaces|initiator|consumer|baseline|new runtime)\b/i,
+    `${view}: default copy uses plain English; technical identifiers belong in details`);
   assert.ok(words <= WORD_BUDGETS[view], `${view}: ${words} visible words exceeds ${WORD_BUDGETS[view]}`);
   console.log(`${view}: ${words}/${WORD_BUDGETS[view]} visible words`);
   const detail = {
-    outcomes: ['roi-contract', 'incremental cost'],
-    recipe: ['recipe-privacy', 'Titles'],
+    outcomes: null,
+    recipe: ['recipe-setup', 'Work Items (Read)'],
     surfaces: ['cell-time-vscode', 'span start_time'],
-    intersection: ['matrix-guide', 'Missing and unverified'],
-    model: ['accounting-rules', 'Count each model call once'],
-    gaps: ['verification-status', 'verified'],
-    coverage: ['tokens-sessionStore', 'Reported subtotals'],
-    research: ['research-0', 'Decision: proceed'],
+    intersection: ['matrix-guide', 'not reported or not checked'],
+    model: ['accounting-rules', 'Count each AI request once'],
+    gaps: ['gap-no-pr-locally', 'What to do'],
+    coverage: ['tokens-sessionStore', 'Tokens are pieces of text'],
+    research: ['research-sources', 'Billing usage'],
   }[view];
   if (detail) {
     const selector = `[data-detail="${detail[0]}"]`;
@@ -614,16 +655,98 @@ async function verifyCompactView(ws, sessionId, view) {
     await evaluate(ws, sessionId, 'new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(r)))');
   }
   if (view === 'model') {
-    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.model-node').length"), 8);
-    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.model-graph .edge').length"), 8);
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.model-node').length"), 10);
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.model-graph .edge').length"), 12);
+    assert.ok(await evaluate(ws, sessionId, "[...document.querySelectorAll('.model-graph .edge')].every(el => el.getAttribute('d'))"), 'all canonical relationships are drawn');
+    assert.equal(await evaluate(ws, sessionId, "document.querySelector('[data-entity=\"work_allocation\"] .node-label').textContent"), 'Estimated work cost');
+    const methods = await evaluate(ws, sessionId, "[...document.querySelectorAll('.link-methods .card')].map(el => ({label: el.querySelector('h3').textContent, text: el.textContent}))");
+    assert.deepEqual(methods.map((method) => method.label), ['Tool-provided link', 'Exact match', 'Likely match', 'Estimated share', 'Not linked']);
+    assert.ok(methods.every((method) => !/\bT[0-3]\b/.test(method.text)), 'no research-only codes remain in expanded method descriptions');
+  }
+  if (view === 'recipe') {
+    assert.equal(await evaluate(ws, sessionId, "document.querySelector('[aria-label=\"Usage source\"] option[value=\"traces\"]').textContent"), 'VS Code · Local harness');
+    assert.equal(await evaluate(ws, sessionId, "document.querySelector('h2.recipe-headline')?.textContent"),
+      "What work is behind this developer's AI credits?");
+    const structure = await evaluate(ws, sessionId, `(() => {
+      const lifecycle = document.querySelector('.recipe-strip');
+      const developer = document.querySelector('.developer-report');
+      const guide = document.querySelector('[data-detail="recipe-guide"]');
+      return {
+        lifecycleFirst: Boolean(lifecycle.compareDocumentPosition(developer) & Node.DOCUMENT_POSITION_FOLLOWING),
+        guideNext: developer.nextElementSibling === guide,
+        timingsNext: guide.nextElementSibling === document.querySelector('.timing-row'),
+        billingSeparate: !guide.querySelector('[data-handoff="billing"]')?.closest('ol'),
+        steps: [...guide.querySelectorAll('[data-handoff]')].map((step) => ({
+          id: step.dataset.handoff,
+          hasHandoff: step.textContent.includes('Handoff:'),
+          hasAssumption: step.textContent.includes('Assumption:'),
+        })),
+      };
+    })()`);
+    assert.ok(structure.lifecycleFirst && structure.guideNext, 'Recipe order: Lifecycle, Developer, Reading the flow');
+    assert.ok(structure.timingsNext, 'Median cycle times follow the handoffs and assumptions guide');
+    assert.deepEqual(structure.steps.map((step) => step.id), ['workItem', 'branch', 'aiWork', 'commits', 'pullRequest', 'review', 'close', 'billing']);
+    assert.ok(structure.billingSeparate, 'the billing guide is separate from the seven delivery handoffs');
+    assert.ok(structure.steps.every((step) => step.hasHandoff && step.hasAssumption), 'every step explains its handoff and assumption');
+    const billingGuide = await evaluate(ws, sessionId, "document.querySelector('[data-handoff=\"billing\"]').textContent");
+    for (const point of ['Read billing', 'completed UTC day', 'exact model', 'one source at a time', 'does not wait for merge', 'charge after discounts', 'Unknown users', 'exceeds billed usage']) {
+      assert.ok(billingGuide.includes(point), `billing handoff explains ${point}`);
+    }
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.recipe-strip [data-step]').length"), 7, 'billing does not add an eighth delivery funnel stage');
+    assert.ok(await evaluate(ws, sessionId, `(() => {
+      const billing = document.querySelector('.recipe-strip [data-billing-checkpoint]');
+      return billing.textContent.includes('Compare usage and bill') &&
+        billing.textContent.includes('Separate from delivery') &&
+        billing.textContent.includes('Not a bill for each change');
+    })()`), 'billing follows delivery visually as a separate checkpoint');
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.recipe-kpis, .adherence, .pantry, [data-detail=\"recipe-surfaces\"]').length"), 0, 'duplicate KPI/ingredient/matrix panels are removed');
   }
   if (view === 'outcomes') {
     assert.ok(await evaluate(ws, sessionId, "document.querySelector('.ratio-bar.unknown[aria-label=\"Not measured\"]') !== null"), 'missing is not a zero bar');
+    const graph = await evaluate(ws, sessionId, `(() => {
+      const map = document.querySelector('.overview-map');
+      return {
+        missionFirst: Boolean(document.querySelector('.overview-mission').compareDocumentPosition(map) & Node.DOCUMENT_POSITION_FOLLOWING),
+        measurementsAfter: Boolean(map.compareDocumentPosition(document.querySelector('.outcome-kpis')) & Node.DOCUMENT_POSITION_FOLLOWING),
+        nodes: [...map.querySelectorAll('[data-overview-node]')].map(el => el.dataset.overviewNode),
+        connections: [...map.querySelectorAll('[data-overview-from]')].map(el => ({
+          from: el.dataset.overviewFrom, to: el.dataset.overviewTo, requested: el.classList.contains('requested'),
+        })),
+        caption: map.querySelector('figcaption').textContent,
+      };
+    })()`);
+    assert.ok(graph.missionFirst && graph.measurementsAfter, 'Overview leads with the mission/map, not the narrower measurement question');
+    assert.deepEqual(graph.nodes, ['source-sessionStore', 'source-traces', 'source-agentHost', 'usage', 'recipe', 'work-platforms', 'billing', 'work-summary', 'delivery-summary', 'billing-summary']);
+    for (const source of ['source-sessionStore', 'source-traces', 'source-agentHost']) {
+      assert.ok(graph.connections.some(edge => edge.from === source && edge.to === 'usage' && !edge.requested));
+    }
+    assert.ok(graph.connections.some(edge => edge.from === 'work-platforms' && edge.to === 'recipe' && edge.requested));
+    assert.ok(graph.connections.some(edge => edge.from === 'billing' && edge.to === 'billing-summary' && edge.requested));
+    assert.ok(!graph.connections.some(edge => edge.from === 'billing' && edge.to === 'recipe'), 'billing stays separate from delivery');
+    assert.match(graph.caption, /may not be recording data/);
   }
   if (view === 'coverage') {
+    assert.ok(visibleText.includes('VS Code · Local harness') && visibleText.includes('VS Code · Copilot Agent Host harness'), 'both harness sources use their explicit names');
     assert.ok(await evaluate(ws, sessionId, "document.querySelector('.not-emitted .bar.unknown') !== null"), 'unavailable stages have a dashed empty bar');
     assert.ok(await evaluate(ws, sessionId, "document.getElementById('view').innerText.includes('No agent-host-traces.db')"), 'source failures stay visible');
   }
+  if (view === 'research') {
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.research-summary tbody tr').length"), 5);
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('#view a[download], #view a[href=\"/research.md\"]').length"), 0);
+    const text = await evaluate(ws, sessionId, "document.getElementById('view').innerText");
+    for (const finding of ['captured account', 'no PR/session billing IDs', 'Estimated work cost', 'stay separate', 'without AI']) {
+      assert.ok(text.includes(finding), `research summary explains ${finding} inline`);
+    }
+  }
+  if (view === 'surfaces' || view === 'intersection') {
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('[aria-label=\"Which data to show\"] button').length"), 2);
+    await evaluate(ws, sessionId, "document.querySelector('[data-focus-key=\"scope-true\"]').click()");
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('table.matrix .concept').length"), 9);
+    await evaluate(ws, sessionId, "document.querySelector('[data-focus-key=\"scope-false\"]').click()");
+    assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('table.matrix .concept').length"), 23);
+    if (view === 'intersection') await evaluate(ws, sessionId, "document.querySelector('[data-focus-key=\"scope-true\"]').click()");
+  }
+  assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('[role=\"tab\"][data-view=\"intersection\"]').length"), 0, 'shared concepts are a Surfaces filter, not a duplicate tab');
 }
 
 async function verifyNarrowView(ws, sessionId, view) {
@@ -638,6 +761,73 @@ async function verifyNarrowView(ws, sessionId, view) {
   await evaluate(ws, sessionId, 'new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(r)))');
 }
 
+async function verifyDeveloperFilters(ws, sessionId) {
+  const select = (label, value) => evaluate(ws, sessionId, `(() => {
+    const el = document.querySelector('[aria-label="${label}"]');
+    el.focus(); el.value = ${JSON.stringify(value)}; el.dispatchEvent(new Event('change'));
+  })()`);
+  const balance = () => evaluate(ws, sessionId, "document.querySelector('.actor-balance > strong').textContent");
+  await select('Usage source', 'traces');
+  await select('Developer', 'github:octocat');
+  assert.equal(await balance(), '19.8 credits', 'measured and inferred usage is selectable by developer');
+  assert.equal(await evaluate(ws, sessionId, 'document.activeElement.dataset.focusKey'), 'developer-actor');
+  await select('Show usage or owned work', 'ownership');
+  assert.equal(await balance(), '13.2 credits', 'ownership excludes work owned by another developer');
+  assert.ok(await evaluate(ws, sessionId, "document.querySelector('.developer-report').innerText.includes('not just this person')"));
+  await select('Show usage or owned work', 'usage');
+  await select('Usage source', 'sessionStore');
+  assert.equal(await balance(), '16.2 credits', 'unlinked provider identities are not guessed');
+  await evaluate(ws, sessionId, `(() => {
+    document.querySelector('[data-detail="recipe-setup"]').open = true;
+    document.querySelector('[data-detail="identity-links"]').open = true;
+    document.querySelector('[aria-label="GitHub login"]').value = 'octocat';
+    document.querySelector('[data-detail="identity-links"] form').requestSubmit();
+  })()`);
+  await waitForRender(ws, sessionId, "document.querySelector('.actor-balance > strong').textContent === '34.1 credits'");
+  assert.equal(await balance(), '34.1 credits', 'an explicit provider link resolves ambiguous owners without adding duplicate usage');
+  await evaluate(ws, sessionId, "document.querySelector('[data-detail=\"identity-links\"] li button').click()");
+  await waitForRender(ws, sessionId, "document.querySelector('.actor-balance > strong').textContent === '16.2 credits'");
+  await select('Developer', '');
+  await select('Usage source', 'traces');
+  await evaluate(ws, sessionId, "document.querySelector('[data-detail=\"identity-links\"]').open = false");
+  await evaluate(ws, sessionId, "document.querySelector('[data-detail=\"recipe-setup\"]').open = false");
+  console.log('Developer filters passed: per-source balances, ownership/consumption separation and explicit identity link/remove.');
+}
+
+async function verifyBillingUI(ws, sessionId, day) {
+  await evaluate(ws, sessionId, `(() => {
+    const user = document.querySelector('[aria-label="Developer"]');
+    user.value = 'github:octocat'; user.dispatchEvent(new Event('change'));
+    const form = document.querySelector('.billing-form');
+    form.querySelector('[name="account"]').value = 'contoso';
+    form.querySelector('[name="user"]').value = 'octocat';
+    form.querySelector('[name="day"]').value = ${JSON.stringify(day)};
+    form.requestSubmit();
+  })()`);
+  await waitForRender(ws, sessionId, "document.querySelector('.billing-stats') && document.body.innerText.includes('Billed credits not matched here:')");
+  const values = await evaluate(ws, sessionId, "[...document.querySelectorAll('.billing-stats .value')].map(el => el.textContent)");
+  assert.deepEqual(values.slice(0, 3), ['10', '5.7', '4.3'], 'billing compares one source/day/native user, not all history');
+  assert.equal(values[3], '0.06', 'amount precision does not round small billed values to zero or a tenth');
+  assert.ok(await evaluate(ws, sessionId, "document.querySelector('[data-billing-checkpoint]').textContent.includes('Report loaded')"), 'the ribbon billing checkpoint reflects the explicit read');
+  const detail = await evaluate(ws, sessionId, "document.querySelector('[data-detail=\"billing-detail\"]').textContent");
+  assert.ok(detail.includes('Estimated work cost') && detail.includes('model'), 'work shares are explicitly estimates');
+  await evaluate(ws, sessionId, `(() => {
+    const form = document.querySelector('.billing-form');
+    form.querySelector('[name="account"]').value = 'denied';
+    form.requestSubmit();
+  })()`);
+  await waitForRender(ws, sessionId, "document.querySelector('.billing-panel [role=\"alert\"]')?.textContent.includes('Billing access denied')");
+  assert.equal(await evaluate(ws, sessionId, "document.querySelectorAll('.billing-stats').length"), 0, 'a failed read removes the previous billing values');
+  assert.ok(await evaluate(ws, sessionId, "document.querySelector('[data-billing-checkpoint]').textContent.includes('Read failed')"), 'the ribbon cannot remain loading/successful after an error');
+  await evaluate(ws, sessionId, `(() => {
+    const form = document.querySelector('.billing-form');
+    form.querySelector('[name="account"]').value = 'contoso';
+    form.requestSubmit();
+  })()`);
+  await waitForRender(ws, sessionId, "document.querySelector('.billing-stats') && document.body.innerText.includes('Billed credits not matched here:')");
+  console.log('Billing UI passed: explicit read, scoped comparison and estimated work shares.');
+}
+
 async function verifyThemes(ws, sessionId) {
   const colors = async () => evaluate(ws, sessionId, `(() => {
     const style = getComputedStyle(document.body);
@@ -691,18 +881,21 @@ async function verifyThemes(ws, sessionId) {
   console.log('Theme checks passed: system changes, body-injected host tokens, explicit overrides and text contrast >= 4.5:1.');
 }
 
-async function startServer(paths, now, display = { verified: true }) {
-  const [{ startCanvasServer }, { computeCoverage, withoutRecipe }, { loadModel, loadResearch }, { recipeView }, { verifyRecipe }] = await Promise.all([
+async function startServer(paths, now, display = { verified: true, billing: false }) {
+  const [{ startCanvasServer }, { computeCoverage, withoutRecipe }, { loadModel, loadResearch }, { recipeView }, { verifyRecipe }, { fetchBilling, billingView }] = await Promise.all([
     import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'server.mjs')).href),
     import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'coverage.mjs')).href),
     import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'model.mjs')).href),
     import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'recipe.mjs')).href),
     import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'verify.mjs')).href),
+    import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'billing.mjs')).href),
   ]);
   let view = 'outcomes';
   let windowDays = 30;
   let cachedCoverage;
   let verification = null;
+  let identityLinks = [];
+  let billing = null;
   const displayCoverage = (coverage) => ({
     ...withoutRecipe(coverage),
     sources: coverage.sources.map((source) => ({
@@ -723,9 +916,13 @@ async function startServer(paths, now, display = { verified: true }) {
     }
     return cachedCoverage;
   };
+  const recipe = async () => ({
+    ...recipeView((await coverage()).recipe, display.verified ? verification : null, { identityLinks }),
+    billing: billingView(display.billing ? billing : null, (await coverage()).recipe),
+  });
   const verify = async () => {
     verification = await verifyRecipe((await coverage()).recipe, { ...syntheticForges(now), now, home: sandbox, platform: 'linux' });
-    return recipeView((await coverage()).recipe, verification);
+    return recipe();
   };
   await verify();
   return startCanvasServer({
@@ -739,7 +936,35 @@ async function startServer(paths, now, display = { verified: true }) {
         cachedCoverage = null;
         return displayCoverage(await coverage());
       },
-      recipe: async () => recipeView((await coverage()).recipe, display.verified ? verification : null),
+      recipe,
+      identityLinks: async (links) => {
+        const { validateIdentityLinks } = await import(pathToFileURL(path.join(EXTENSION_DIR, 'lib', 'actors.mjs')).href);
+        identityLinks = validateIdentityLinks(links);
+        return recipe();
+      },
+      billing: async (scope) => {
+        display.billing = true;
+        billing = await fetchBilling(scope, {
+          now, env: {},
+          run: async (command, args) => {
+            assert.equal(command, 'gh');
+            if (args.includes('/organizations/denied/settings/billing/ai_credit/usage')) return { code: 1, stderr: 'HTTP 403 synthetic-secret-must-not-display' };
+            assert.ok(args.includes('/organizations/contoso/settings/billing/ai_credit/usage'));
+            assert.ok(args.includes('user=octocat'));
+            const [year, month, day] = scope.day.split('-').map(Number);
+            return { code: 0, stdout: JSON.stringify({
+              timePeriod: { year, month, day }, organization: 'contoso', user: 'octocat', product: 'Copilot',
+              usageItems: [
+                { product: 'Copilot', sku: 'AI credits', model: 'gpt-5', unitType: 'AI credits', pricePerUnit: 0.01,
+                  grossQuantity: 8, grossAmount: 0.08, discountQuantity: 4, discountAmount: 0.04, netQuantity: 4, netAmount: 0.04 },
+                { product: 'Copilot', sku: 'AI credits', model: 'gpt-5-mini', unitType: 'AI credits', pricePerUnit: 0.01,
+                  grossQuantity: 2, grossAmount: 0.02, discountQuantity: 0, discountAmount: 0, netQuantity: 2, netAmount: 0.02 },
+              ],
+            }) };
+          },
+        });
+        return recipe();
+      },
       verify,
       getView: () => view,
       setView: (next) => {
@@ -771,7 +996,7 @@ async function setServerView(serverUrl, view) {
   let server;
   try {
     const fixtures = createFixtures(runDir, now);
-    const display = { verified: true };
+    const display = { verified: true, billing: false };
     server = await startServer(fixtures, now, display);
     browser = spawn(
       findBrowser(),
@@ -809,6 +1034,7 @@ async function setServerView(serverUrl, view) {
     let themesVerified = false;
     for (const shot of shots) {
       display.verified = shot.verified !== false;
+      display.billing = false;
       await setServerView(server.url, shot.view);
       await send(
         ws,
@@ -819,6 +1045,8 @@ async function setServerView(serverUrl, view) {
       await send(ws, 'Page.navigate', { url: server.url }, sessionId);
       await waitForRender(ws, sessionId, shot.ready);
       await verifyCompactView(ws, sessionId, shot.view);
+      if (shot.file === 'canvas-recipe.png') await verifyDeveloperFilters(ws, sessionId);
+      if (shot.billing) await verifyBillingUI(ws, sessionId, iso(now, 4).slice(0, 10));
       if (!themesVerified) {
         await verifyThemes(ws, sessionId);
         themesVerified = true;
@@ -833,6 +1061,10 @@ async function setServerView(serverUrl, view) {
       }
       if (shot.prepare) await evaluate(ws, sessionId, shot.prepare);
       await evaluate(ws, sessionId, 'document.activeElement.blur(); window.scrollTo(0, 0)');
+      if (shot.focus) await evaluate(ws, sessionId, `(() => {
+        const el = document.querySelector(${JSON.stringify(shot.focus)});
+        window.scrollTo(0, Math.max(0, el.getBoundingClientRect().top + window.scrollY - document.querySelector('.top').offsetHeight - 16));
+      })()`);
       const { data } = await send(ws, 'Page.captureScreenshot', { format: 'png', fromSurface: true }, sessionId);
       const buf = Buffer.from(data, 'base64');
       const out = path.join(OUT, shot.file);