From 656a48fecdc72d63edabf7b9fbd7a8cc7fb75d99 Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 14:31:27 -0700
Subject: [PATCH 01/10] =?UTF-8?q?fix(evalboard):=201/6=20=E2=80=94=20show?=
 =?UTF-8?q?=20what=20the=20wall=20clock=20does=20not=20account=20for?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two reporting fixes to the same surface: time figures that are each
well-formed but never say what they should reconcile to.

A. The task page's timeline strip gains an `Unaccounted` cell — task wall
clock minus generation minus tool execution — so a harness that stops
reporting one of them is visible on the page instead of reading as fast.
Tinted red at or above a 25% residual. A negative residual (parallel tool
calls, or a tool closing inside a generation window) renders signed and
untinted rather than clamped: an overlap is a signal, not unreported time.
`fmtMs` is now sign-aware so that reads as `-1.2s`, not `-1200ms`.

B. The run list's Duration column now counts only what ran. Mature-skipped
rows are carried-forward passes with no duration, so summing over them
divides real seconds by a task count that never executed — a codex nightly
rendered "1300 tasks · 15h 29m" describing 397 tasks. The two duplicated
duration derivations in runs.ts collapse into one exported
`deriveRunDuration`, which excludes those rows from both the sum and the
`every()` completeness guard, and reports `executedTasks` alongside. Both
run tables now name that count next to the duration when the two differ.

`tasksExecuted` is carried through `RunSummary` / `RunOverview` /
`ScopedRun` / `RunListingRow` rather than recomputed per consumer: the
whole-run count comes from the same helper that produced the duration
(over run.json's task_results), while `overview.tasks` drops rows with no
task_id, so a recount could disagree with the duration's own denominator.

A run with no mature skips renders exactly as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 evalboard/app/page.tsx                        |  52 +++++++--
 .../__tests__/message-timeline.test.tsx       | 102 ++++++++++++++++++
 .../app/runs/[id]/[...task]/_sections.tsx     |  55 +++++++++-
 evalboard/app/runs/[id]/[...task]/page.tsx    |   1 +
 evalboard/lib/__tests__/overview.test.ts      |  36 +++++++
 evalboard/lib/__tests__/runs.test.ts          |  93 ++++++++++++++++
 evalboard/lib/overview.ts                     |  15 +++
 evalboard/lib/runs.ts                         |  81 +++++++++-----
 8 files changed, 399 insertions(+), 36 deletions(-)

diff --git a/evalboard/app/page.tsx b/evalboard/app/page.tsx
index 7a66f245..ee20f570 100644
--- a/evalboard/app/page.tsx
+++ b/evalboard/app/page.tsx
@@ -73,6 +73,40 @@ function fmtCost(c: number | null): string {
     return `$${c.toFixed(2)}`;
 }
 
+// The Duration cell for a run row. `taskDurationSeconds` is compute time over
+// the rows that actually ran, so when the nightly carried some forward as
+// mature passes the cell says how many that was — otherwise "1300 tasks ·
+// 15h 29m" reads as a per-task rate over 1300 tasks when it describes 397.
+function RunDurationCell({
+    seconds,
+    tasksRun,
+    tasksExecuted,
+}: {
+    seconds: number | null;
+    tasksRun: number;
+    tasksExecuted: number;
+}) {
+    const skipped = tasksRun - tasksExecuted;
+    if (skipped <= 0) {
+        return (
+            <td className="py-3 px-4 text-right tabular-nums text-gray-700">
+                {fmtDuration(seconds)}
+            </td>
+        );
+    }
+    return (
+        <td
+            className="py-3 px-4 text-right tabular-nums text-gray-700"
+            title={`compute time over the ${tasksExecuted} task(s) that executed; ${skipped} were carried forward as mature passes`}
+        >
+            {fmtDuration(seconds)}
+            <div className="text-[11px] text-gray-400">
+                {tasksExecuted} run
+            </div>
+        </td>
+    );
+}
+
 // Rail-level q filter: substring match on tag name only. This is narrower
 // than getRunListing's q (which also matches taskId / humanized id) by
 // design — rails are a tag namespace, the table is a task namespace.
@@ -428,9 +462,11 @@ export default async function Page({
                                     <td className="py-3 px-4 text-right tabular-nums text-gray-700">
                                         {fmtCost(r.totalCostUsd)}
                                     </td>
-                                    <td className="py-3 px-4 text-right tabular-nums text-gray-700">
-                                        {fmtDuration(r.taskDurationSeconds)}
-                                    </td>
+                                    <RunDurationCell
+                                        seconds={r.taskDurationSeconds}
+                                        tasksRun={total}
+                                        tasksExecuted={r.tasksExecuted}
+                                    />
                                 </tr>
                             );
                         })}
@@ -572,11 +608,11 @@ export default async function Page({
                                             <td className="py-3 px-4 text-right tabular-nums text-gray-700">
                                                 {fmtCost(r.totalCostUsd)}
                                             </td>
-                                            <td className="py-3 px-4 text-right tabular-nums text-gray-700">
-                                                {fmtDuration(
-                                                    r.taskDurationSeconds,
-                                                )}
-                                            </td>
+                                            <RunDurationCell
+                                                seconds={r.taskDurationSeconds}
+                                                tasksRun={total}
+                                                tasksExecuted={r.tasksExecuted}
+                                            />
                                         </tr>
                                     );
                                 })}
diff --git a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
index cf5ade72..70db7a22 100644
--- a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
+++ b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
@@ -476,3 +476,105 @@ describe("MessageTimelineSection — sub-agent grouping", () => {
         expect(screen.getByText("Message timeline (1)")).toBeInTheDocument();
     });
 });
+
+// The strip must reconcile: generation + tool exec are shown against the wall
+// clock they should add up to, so a harness that stops reporting one of them
+// is visible on the page instead of silently reading as fast.
+describe("MessageTimelineSection — Unaccounted cell", () => {
+    // Each summary cell is <label><value>[<sub-grid>]. Read the value element
+    // itself so a matching string elsewhere in the strip (the Generation
+    // sub-cells also render times and percentages) cannot satisfy an
+    // assertion about this cell.
+    function cell(label: string): HTMLElement {
+        const parent = screen.getByText(label).parentElement as HTMLElement;
+        return parent.children[1] as HTMLElement;
+    }
+
+    function renderStrip(
+        taskDurationSeconds: number | null | undefined,
+        overrides: Partial<MessageEvent> = {},
+    ) {
+        const m = makeMessage({
+            generationMs: 4000,
+            textMs: 4000,
+            toolUses: [
+                {
+                    toolName: "Bash",
+                    toolUseId: "tu_1",
+                    summary: "ls",
+                    argText: "ls",
+                    description: null,
+                    genMs: null,
+                    durationMs: 1000,
+                    isError: false,
+                    resultPreview: null,
+                    outputTokens: null,
+                    resultTokens: null,
+                },
+            ],
+            ...overrides,
+        });
+        return render(
+            <MessageTimelineSection
+                messages={[m]}
+                taskDurationSeconds={taskDurationSeconds}
+            />,
+        );
+    }
+
+    test("renders the residual and its share of the wall clock", () => {
+        // 10s wall clock − 4s generation − 1s tool exec = 5s (50%).
+        renderStrip(10);
+        expect(cell("Unaccounted").textContent).toBe("5.0s (50%)");
+    });
+
+    test("the four pre-existing cells still render their values", () => {
+        renderStrip(10);
+        expect(cell("Messages").textContent).toBe("1");
+        expect(cell("Generation").textContent).toBe("4.0s");
+        expect(cell("Tool exec").textContent).toBe("1.0s");
+        expect(cell("Slow events").textContent).toBe("0 gen · 0 tool");
+    });
+
+    test("a residual at or above 25% is tinted red", () => {
+        // 5s of 10s = 50%.
+        renderStrip(10);
+        expect(cell("Unaccounted").className).toContain("text-red-700");
+    });
+
+    test("a residual below 25% is not tinted", () => {
+        // 5s gen+tool of 5.5s wall clock ≈ 9%.
+        renderStrip(5.5);
+        expect(cell("Unaccounted").textContent).toBe("500ms (9%)");
+        expect(cell("Unaccounted").className).not.toContain("text-red-700");
+    });
+
+    test("no recorded duration renders an em-dash, no NaN and no percentage", () => {
+        const { container } = renderStrip(undefined);
+        expect(cell("Unaccounted").textContent).toBe("—");
+        expect(container.textContent).not.toContain("NaN");
+    });
+
+    test("a zero-second task shows the raw residual with no percentage", () => {
+        const { container } = renderStrip(0);
+        expect(cell("Unaccounted").textContent).toBe("-5.0s");
+        expect(container.textContent).not.toContain("NaN");
+    });
+
+    test("a negative residual renders signed and is NOT tinted red", () => {
+        // Overlap (parallel tools, or a tool closing inside a generation
+        // window) is a signal, not unreported time — so it is neither clamped
+        // nor flagged. The share stays signed too: 5s accounted against a 1s
+        // task is a 4x overlap, and saying so beats hiding it.
+        renderStrip(1);
+        expect(cell("Unaccounted").textContent).toBe("-4.0s (-400%)");
+        expect(cell("Unaccounted").className).not.toContain("text-red-700");
+    });
+
+    test("the cell explains that the residual is not only agent time", () => {
+        renderStrip(10);
+        expect(
+            screen.getByText("Unaccounted").parentElement,
+        ).toHaveAttribute("title", expect.stringContaining("sandbox setup"));
+    });
+});
diff --git a/evalboard/app/runs/[id]/[...task]/_sections.tsx b/evalboard/app/runs/[id]/[...task]/_sections.tsx
index f52ff560..0b00578d 100644
--- a/evalboard/app/runs/[id]/[...task]/_sections.tsx
+++ b/evalboard/app/runs/[id]/[...task]/_sections.tsx
@@ -253,11 +253,17 @@ export function ToolTimelineSection({
     );
 }
 
+// Sign-aware: the Unaccounted residual goes negative when generation and tool
+// execution overlap (parallel tool calls, or Antigravity closing a tool inside
+// a generation window), and "-1.2s" reads as an overlap where "-1200ms" reads
+// as a formatting bug.
 function fmtMs(ms: number | null): string {
     if (ms == null) return "—";
-    if (ms >= 60_000) return `${(ms / 60_000).toFixed(1)}m`;
-    if (ms >= 1_000) return `${(ms / 1_000).toFixed(1)}s`;
-    return `${Math.round(ms)}ms`;
+    const sign = ms < 0 ? "-" : "";
+    const abs = Math.abs(ms);
+    if (abs >= 60_000) return `${sign}${(abs / 60_000).toFixed(1)}m`;
+    if (abs >= 1_000) return `${sign}${(abs / 1_000).toFixed(1)}s`;
+    return `${sign}${Math.round(abs)}ms`;
 }
 
 function fmtTokens(n: number | null): string {
@@ -310,6 +316,7 @@ export function MessageTimelineSection({
     messages,
     subAgentUsageByToolId = {},
     impactByIndex,
+    taskDurationSeconds,
 }: {
     messages: MessageEvent[];
     // Per-Agent-call sub-agent token breakdown (input/output/cache-create/
@@ -320,6 +327,10 @@ export function MessageTimelineSection({
     // by message index. Renders an inline Δ badge on each affected row. Empty
     // (no badges) when levers sit at as-run, or undefined when no simulator.
     impactByIndex?: Map<number, PerMessageImpact>;
+    // The task's recorded wall clock, so the strip can show what generation +
+    // tool execution do NOT account for. Null/absent on a run predating
+    // duration capture — the cell then renders "—" rather than a fake residual.
+    taskDurationSeconds?: number | null;
 }) {
     // Token columns can be shown as counts or as their estimated USD value.
     const [unit, setUnit] = useState<Unit>("tokens");
@@ -369,6 +380,16 @@ export function MessageTimelineSection({
     );
     const thinkingShare = totalGenMs > 0 ? thinkingMs / totalGenMs : 0;
 
+    // Wall clock the agent stream does not explain. Negative means generation
+    // and tool execution overlapped, which is a real signal — never clamped.
+    const taskMs =
+        taskDurationSeconds != null ? taskDurationSeconds * 1000 : null;
+    const unaccountedMs = taskMs != null ? taskMs - totalGenMs - toolExecMs : null;
+    const unaccountedShare =
+        taskMs != null && taskMs > 0 && unaccountedMs != null
+            ? unaccountedMs / taskMs
+            : null;
+
     return (
         <section className="space-y-2">
             <div className="flex items-center justify-between gap-2">
@@ -380,7 +401,7 @@ export function MessageTimelineSection({
             <p className="text-[10px] text-gray-500">
                 MIXED = multiple block types · red = slow (gen ≥10s, tool ≥5s)
             </p>
-            <div className="grid grid-cols-2 md:grid-cols-4 gap-3 text-xs bg-gray-50 border border-gray-200 rounded-lg p-3 tabular-nums">
+            <div className="grid grid-cols-2 md:grid-cols-5 gap-3 text-xs bg-gray-50 border border-gray-200 rounded-lg p-3 tabular-nums">
                 <div>
                     <div className="text-gray-500 uppercase tracking-wide text-[10px]">
                         Messages
@@ -447,6 +468,28 @@ export function MessageTimelineSection({
                         {fmtMs(toolExecMs)}
                     </div>
                 </div>
+                <div
+                    title="task wall clock minus generation and tool execution — includes sandbox setup, grading, simulator calls, and any time the harness did not report"
+                >
+                    <div className="text-gray-500 uppercase tracking-wide text-[10px]">
+                        Unaccounted
+                    </div>
+                    <div
+                        className={
+                            unaccountedShare != null && unaccountedShare >= 0.25
+                                ? "text-red-700 font-medium"
+                                : "text-gray-900 font-medium"
+                        }
+                    >
+                        {fmtMs(unaccountedMs)}
+                        {unaccountedShare != null && (
+                            <span className="text-gray-400">
+                                {" "}
+                                ({Math.round(unaccountedShare * 100)}%)
+                            </span>
+                        )}
+                    </div>
+                </div>
                 <div>
                     <div className="text-gray-500 uppercase tracking-wide text-[10px]">
                         Slow events
@@ -660,11 +703,14 @@ export function CostExplorerSection({
     subAgentUsageByToolId = {},
     tokens,
     recordedCostUsd,
+    taskDurationSeconds,
 }: {
     messages: MessageEvent[];
     subAgentUsageByToolId?: Record<string, SubAgentTotals>;
     tokens: TokenTotals;
     recordedCostUsd: number | null;
+    // Forwarded verbatim to the timeline's Unaccounted cell.
+    taskDurationSeconds?: number | null;
 }) {
     const [scale, setScale] = useState(1);
     const [toolScale, setToolScale] = useState(1);
@@ -702,6 +748,7 @@ export function CostExplorerSection({
                 messages={messages}
                 subAgentUsageByToolId={subAgentUsageByToolId}
                 impactByIndex={impactByIndex}
+                taskDurationSeconds={taskDurationSeconds}
             />
             {model && tokens.total > 0 && (
                 <section className="space-y-2">
diff --git a/evalboard/app/runs/[id]/[...task]/page.tsx b/evalboard/app/runs/[id]/[...task]/page.tsx
index 36e2cb03..12e8b334 100644
--- a/evalboard/app/runs/[id]/[...task]/page.tsx
+++ b/evalboard/app/runs/[id]/[...task]/page.tsx
@@ -364,6 +364,7 @@ export default async function TaskPage({
                     subAgentUsageByToolId={task.subAgentUsageByToolId}
                     tokens={task.tokens}
                     recordedCostUsd={task.totalCostUsd}
+                    taskDurationSeconds={task.durationSeconds}
                 />
             )}
             <ProviderCallTableSection providerCalls={task.providerCalls} />
diff --git a/evalboard/lib/__tests__/overview.test.ts b/evalboard/lib/__tests__/overview.test.ts
index 92774063..3ed4582f 100644
--- a/evalboard/lib/__tests__/overview.test.ts
+++ b/evalboard/lib/__tests__/overview.test.ts
@@ -45,6 +45,7 @@ describe("summarizeListing", () => {
             tasksSucceeded: 0,
             tasksRun: 0,
             tasksGraded: 0,
+            tasksExecuted: 0,
             totalCostUsd: null,
             taskDurationSeconds: null,
             ...overrides,
@@ -1102,6 +1103,41 @@ describe("projectRunRow", () => {
         });
     });
 
+    test("unfiltered, tasksExecuted comes from the overview, not a recount", () => {
+        // The whole-run count must come from the same helper that produced
+        // taskDurationSeconds (which runs over run.json's task_results), not
+        // from a second filter over `tasks` — that list drops rows with no
+        // task_id, so a recount could disagree with the duration's own
+        // denominator.
+        const r = run("r", [task({ taskId: "a" }), task({ taskId: "b" })]);
+        r.overview!.tasksExecuted = 1;
+        expect(projectRunRow(r, null, null)).toMatchObject({
+            tasksRun: 2,
+            tasksExecuted: 1,
+        });
+    });
+
+    test("unfiltered, an overview predating the field counts every task", () => {
+        const row = projectRunRow(
+            run("r", [task({ taskId: "a" }), task({ taskId: "b" })]),
+            null,
+            null,
+        );
+        expect(row).toMatchObject({ tasksRun: 2, tasksExecuted: 2 });
+    });
+
+    test("filtered, tasksExecuted excludes a mature-skipped match", () => {
+        const row = projectRunRow(
+            run("r", [
+                task({ taskId: "a", tags: ["keep"] }),
+                task({ taskId: "b", tags: ["keep"], matureSkipped: true }),
+            ]),
+            "keep",
+            null,
+        );
+        expect(row).toMatchObject({ tasksRun: 2, tasksExecuted: 1 });
+    });
+
     test("drops a run with no task matching the tag", () => {
         const row = projectRunRow(
             run("r", [task({ taskId: "a", tags: ["smoke"] })]),
diff --git a/evalboard/lib/__tests__/runs.test.ts b/evalboard/lib/__tests__/runs.test.ts
index b839efb5..0ac7b635 100644
--- a/evalboard/lib/__tests__/runs.test.ts
+++ b/evalboard/lib/__tests__/runs.test.ts
@@ -14,6 +14,7 @@ import {
     aggregateSubAgentUsage,
     type ArtifactRef,
     clearRunCacheDir,
+    deriveRunDuration,
     extractComponentShas,
     tallyModels,
     extractRunConfig,
@@ -21,6 +22,7 @@ import {
     isExcludedArtifact,
     type MessageEvent,
     parseCriterionResults,
+    type RawTaskResult,
     sortArtifacts,
     toTaskRow,
     visibleTurnsFromRaw,
@@ -95,6 +97,97 @@ describe("toTaskRow", () => {
     });
 });
 
+describe("deriveRunDuration", () => {
+    // Compute time must describe the rows that produced it. A mature-skipped
+    // row is a carried-forward pass that never ran, so it leaves BOTH the sum
+    // and the count.
+    function row(overrides: Partial<RawTaskResult> = {}): RawTaskResult {
+        return { task_id: "t", duration: 0, ...overrides };
+    }
+
+    test("no skips: the plain sum over every row, byte-identical to before", () => {
+        const d = deriveRunDuration(
+            [row({ duration: 10 }), row({ duration: 20 }), row({ duration: 30 })],
+            999,
+        );
+        expect(d.seconds).toBe(60);
+        expect(d.executedTasks).toBe(3);
+    });
+
+    test("mature-skipped rows leave both the sum and the count", () => {
+        const d = deriveRunDuration(
+            [
+                row({ duration: 10 }),
+                row({ duration: 20 }),
+                row({ duration: 30 }),
+                row({ duration: 0, mature_skipped: true }),
+                row({ duration: 0, mature_skipped: true }),
+            ],
+            999,
+        );
+        expect(d.seconds).toBe(60);
+        expect(d.executedTasks).toBe(3);
+    });
+
+    test("an executed row with no duration falls back to the wall clock", () => {
+        const d = deriveRunDuration(
+            [row({ duration: 10 }), row({ duration: undefined })],
+            750,
+        );
+        expect(d.seconds).toBe(750);
+        expect(d.executedTasks).toBe(2);
+    });
+
+    test("a mature-skipped row with no duration does NOT trigger the fallback", () => {
+        // The old whole-run every() guard fell back here, discarding a sum that
+        // was complete over everything that actually ran.
+        const d = deriveRunDuration(
+            [
+                row({ duration: 10 }),
+                row({ duration: 20 }),
+                row({ duration: undefined, mature_skipped: true }),
+            ],
+            750,
+        );
+        expect(d.seconds).toBe(30);
+        expect(d.executedTasks).toBe(2);
+    });
+
+    test("all rows mature-skipped: wall clock, not 0s for a run that did work", () => {
+        const d = deriveRunDuration(
+            [
+                row({ duration: 0, mature_skipped: true }),
+                row({ duration: 0, mature_skipped: true }),
+            ],
+            420,
+        );
+        expect(d.seconds).toBe(420);
+        expect(d.executedTasks).toBe(0);
+    });
+
+    test("no mature_skipped key anywhere reproduces the no-skips case exactly", () => {
+        const rows: RawTaskResult[] = [
+            { task_id: "a", duration: 10 },
+            { task_id: "b", duration: 20 },
+        ];
+        expect(deriveRunDuration(rows, 999)).toEqual({
+            seconds: 30,
+            executedTasks: 2,
+        });
+    });
+
+    test("empty task_results falls back, and to null with no wall clock", () => {
+        expect(deriveRunDuration([], 88)).toEqual({
+            seconds: 88,
+            executedTasks: 0,
+        });
+        expect(deriveRunDuration([], undefined)).toEqual({
+            seconds: null,
+            executedTasks: 0,
+        });
+    });
+});
+
 describe("aggregateSubAgentUsage", () => {
     // Per-sub-agent usage is derived by grouping the parsed messages on
     // `parentToolUseId` (the spawning Agent call's tool_use_id). Main-thread
diff --git a/evalboard/lib/overview.ts b/evalboard/lib/overview.ts
index c28c7704..176a5a60 100644
--- a/evalboard/lib/overview.ts
+++ b/evalboard/lib/overview.ts
@@ -185,6 +185,10 @@ export interface RunListingRow {
     // leaves BOTH sides of every rate, so this — not tasksRun — is the pass-rate
     // denominator. Equals tasksRun on any graded run.
     tasksGraded: number;
+    // Rows that actually ran: tasksRun minus the ones the nightly carried
+    // forward as mature passes. taskDurationSeconds is compute time over
+    // exactly these, so the Duration cell can say what it is describing.
+    tasksExecuted: number;
     totalCostUsd: number | null;
     taskDurationSeconds: number | null;
     // Run-level harness (coder-eval AgentKind) for the Harness column; null on
@@ -1065,6 +1069,12 @@ export interface ScopedRun {
     tasks: RunOverviewTask[];
     totalCostUsd: number | null;
     taskDurationSeconds: number | null;
+    // Rows in `tasks` that actually ran. Carried rather than re-derived by each
+    // consumer because on the whole-run slice it comes from the same helper
+    // that produced taskDurationSeconds (over run.json's task_results), and a
+    // second count over `tasks` — which drops rows with no task_id — could
+    // disagree with the duration's own denominator.
+    tasksExecuted: number;
 }
 
 export function scopeRunTasks(
@@ -1077,6 +1087,8 @@ export function scopeRunTasks(
         tasks: overview.tasks,
         totalCostUsd: overview.totalCostUsd,
         taskDurationSeconds: overview.taskDurationSeconds,
+        // ?? for an overview built before the field existed (test factories).
+        tasksExecuted: overview.tasksExecuted ?? overview.tasks.length,
     };
     if (tag == null && needle == null) return wholeRun;
 
@@ -1117,6 +1129,7 @@ export function scopeRunTasks(
         tasks: matching,
         totalCostUsd: costHasAny ? costSum : null,
         taskDurationSeconds: durAllPresent ? durSum : null,
+        tasksExecuted: matching.filter((t) => !t.matureSkipped).length,
     };
 }
 
@@ -1131,6 +1144,7 @@ function rowFromScoped(
             .length,
         tasksRun: scoped.tasks.length,
         tasksGraded: scoped.tasks.filter((t) => isGraded(t.status)).length,
+        tasksExecuted: scoped.tasksExecuted,
         totalCostUsd: scoped.totalCostUsd,
         taskDurationSeconds: scoped.taskDurationSeconds,
         harness: harness ?? null,
@@ -1245,6 +1259,7 @@ export function buildAdhocRows(
             ).length,
             tasksRun: overview.tasks.length,
             tasksGraded: overview.tasks.filter((t) => isGraded(t.status)).length,
+            tasksExecuted: overview.tasksExecuted ?? overview.tasks.length,
             totalCostUsd: overview.totalCostUsd,
             taskDurationSeconds: overview.taskDurationSeconds,
             // Harness is a main-table-only (internal) column; ad-hoc rows omit it.
diff --git a/evalboard/lib/runs.ts b/evalboard/lib/runs.ts
index 94d7d246..0b39e439 100644
--- a/evalboard/lib/runs.ts
+++ b/evalboard/lib/runs.ts
@@ -57,6 +57,10 @@ export interface RunSummary {
     // (run end - run start) when per-task durations are unavailable.
     taskDurationSeconds: number | null;
     tasksRun: number;
+    // Rows that actually executed: tasksRun minus the ones the nightly carried
+    // forward as mature passes. taskDurationSeconds is the compute time of
+    // exactly these, so a UI showing one must be able to name the other.
+    tasksExecuted: number;
     tasksSucceeded: number;
     tasksFailed: number;
     tasksError: number;
@@ -400,7 +404,9 @@ export function aggregateSubAgentUsage(
 
 // ---------- run.json schema ----------
 
-interface RawTaskResult {
+// Exported so a test can type its fixtures against deriveRunDuration's
+// published signature rather than restating the row shape.
+export interface RawTaskResult {
     task_id?: string;
     // Experiment arm that produced this row (the <variant> sub-dir). Written by
     // reports_experiment.py on every run; absent on runs that predate it, which
@@ -818,6 +824,40 @@ export function toTaskRow(t: RawTaskResult): TaskResultSummary {
     };
 }
 
+export interface RunDurationTotals {
+    // Σ duration over EXECUTED rows, or the wall-clock fallback.
+    seconds: number | null;
+    // Rows that actually ran (mature-skipped excluded).
+    executedTasks: number;
+}
+
+// Compute time for a run, and how many of its rows actually produced it.
+//
+// Mature-skipped rows leave BOTH sides: they are carried-forward passes that
+// never executed, so counting their (absent or zero) duration alongside the
+// rows that did work reports one number and describes another — a codex
+// nightly rendered "1300 tasks · 15h 29m" for 397 tasks that ran. Mirrors
+// overview.ts::timePerPassedTaskForTasks, which already excludes them.
+//
+// The sum is only trusted when EVERY executed row recorded a duration;
+// otherwise the partial sum would understate the run drastically (1/50 rows
+// with a duration would render as that single task's time), so it falls back
+// to the run's wall clock.
+export function deriveRunDuration(
+    taskResults: RawTaskResult[],
+    totalDurationSeconds: number | null | undefined,
+): RunDurationTotals {
+    const executed = taskResults.filter((t) => !t.mature_skipped);
+    const allHaveDuration =
+        executed.length > 0 && executed.every((t) => t.duration != null);
+    return {
+        seconds: allHaveDuration
+            ? executed.reduce((a, t) => a + (t.duration ?? 0), 0)
+            : (totalDurationSeconds ?? null),
+        executedTasks: executed.length,
+    };
+}
+
 export async function readRunSummary(
     id: string,
     source: Source = DEFAULT_SOURCE,
@@ -829,27 +869,18 @@ export async function readRunSummary(
         (a, t) => a + (t.total_cost_usd ?? 0),
         0,
     );
-    // Sum of per-task durations (compute time). Only use the sum when every
-    // task has a duration recorded; otherwise the partial sum would understate
-    // the run drastically (e.g. 1/50 tasks with a duration would render as that
-    // single task's time). Fall back to wall-clock in that case.
-    const taskDurationSum = taskResults.reduce(
-        (a, t) => a + (t.duration ?? 0),
-        0,
+    const duration = deriveRunDuration(
+        taskResults,
+        data.total_duration_seconds,
     );
-    const allHaveDuration =
-        taskResults.length > 0 &&
-        taskResults.every((t) => t.duration != null);
-    const taskDurationSeconds = allHaveDuration
-        ? taskDurationSum
-        : (data.total_duration_seconds ?? null);
     const models = tallyModels(taskResults);
     return {
         id,
         startTime: data.start_time ?? null,
         endTime: data.end_time ?? null,
-        taskDurationSeconds,
+        taskDurationSeconds: duration.seconds,
         tasksRun: data.tasks_run ?? taskResults.length,
+        tasksExecuted: duration.executedTasks,
         tasksSucceeded: data.tasks_succeeded ?? 0,
         tasksFailed: data.tasks_failed ?? 0,
         tasksError: data.tasks_error ?? 0,
@@ -1049,6 +1080,12 @@ export interface RunOverview {
     // front-page table and the chart can be built from a single read.
     totalCostUsd: number | null;
     taskDurationSeconds: number | null;
+    // Rows that actually executed (mature-skipped excluded) — the set
+    // taskDurationSeconds is summed over, so the two always describe the same
+    // rows. Optional only so test factories predating it stay valid; a reader
+    // with no value falls back to the full task count, which is what every
+    // pre-mature_skipped run means anyway.
+    tasksExecuted?: number;
     componentShas: ComponentSha[];
     // Run-level harness (coder-eval AgentKind) from the RunConfig stamp
     // (environment_info.run_config), falling back to the most common per-task
@@ -1168,20 +1205,16 @@ export async function readRunOverview(
         (a, t) => a + (t.total_cost_usd ?? 0),
         0,
     );
-    const taskDurationSum = taskResults.reduce(
-        (a, t) => a + (t.duration ?? 0),
-        0,
+    const duration = deriveRunDuration(
+        taskResults,
+        data.total_duration_seconds,
     );
-    const allHaveDuration =
-        taskResults.length > 0 &&
-        taskResults.every((t) => t.duration != null);
     return {
         id,
         tasks,
         totalCostUsd: taskResults.length ? totalCost : null,
-        taskDurationSeconds: allHaveDuration
-            ? taskDurationSum
-            : (data.total_duration_seconds ?? null),
+        taskDurationSeconds: duration.seconds,
+        tasksExecuted: duration.executedTasks,
         componentShas: extractComponentShas(data.environment_info),
         ...extractRunConfig(data),
         startedAt: data.start_time ?? null,

From e67e66f288a14856e3f549c5b3789b3a45fe5fd7 Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 14:58:05 -0700
Subject: [PATCH 02/10] =?UTF-8?q?fix(telemetry):=202/6=20=E2=80=94=20an=20?=
 =?UTF-8?q?unmeasured=20generation=20window=20says=20so?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`AssistantMessage.generation_duration_ms` was a required `float`, so a
harness with no measurable window had to invent one — and every producer
that did wrote `0.0`, which reads downstream as a real, instant
generation. It is now `float | None` with `default=None`, aligning it with
`UserMessage.generation_duration_ms` in the same module.

Every live "unknown became zero" producer is fixed:

- Codex's rollout rebuild and both sub-agent syntheses record `None` —
  Turn items carry no per-item timestamps and a sub-agent generation
  arrives as a tool result, so no window was ever measurable.
- Claude's sub-agent terminal message, same reason.
- Claude's `_finalize_commands` no longer coerces an orphaned command's
  `duration_ms` to `0.0`. Its `result_status` is already "unknown";
  unknown status and unknown duration are the same fact. The command now
  leaves BOTH sides of `avg_command_time_ms` instead of dragging the
  average toward zero.
- `analysis.py`'s two slowest-command coalescings are gone: the duration
  travels alongside its command as a pair, so it stays a float and an
  untimed command simply is not ranked. `avg_command_time_ms` reports
  `None` when nothing was timed rather than "0ms average".
- The simulator's trailing standalone turn passes a real
  `duration_seconds`. It defaulted to 0.0 with no caller supplying it,
  which halved `avg_turn` in the HTML report for every simulation task.

Two lint rules make the class permanently detectable. CE058: an unknown
timing value may not become a numeric literal — five syntactic forms, one
id, including the `if x is None: x = 0.0` guard where the live Claude
instance was hiding and the `model_copy(update={...})` dict a keyword-only
rule cannot see. CE059: an `AssistantMessage` may not take one clock read
as both bounds; it exempts a call that passes `generation_duration_ms=None`,
because saying "no window was measurable" in the field built to say it is
not a claim the two stamps have to support.

Antigravity's flush keeps its `0.0` under both noqas for one more commit;
the next one replaces it with a real measured window and deletes them.

Golden snapshots move in exactly four places, all `"<scrubbed>" -> null`.
No token bucket moves; `assert_reconciliation` passes unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                                     |   2 +-
 pyproject.toml                                |   2 +
 src/coder_eval/agents/antigravity_agent.py    |   4 +-
 src/coder_eval/agents/claude_code_agent.py    |  11 +-
 src/coder_eval/agents/codex_agent.py          |  11 +-
 src/coder_eval/analysis.py                    |  24 ++-
 src/coder_eval/models/telemetry.py            |  15 +-
 src/coder_eval/orchestrator.py                |   8 +
 .../expected/claude_d_subagent_terminal.json  |   2 +-
 .../expected/claude_f_orphaned_tool.json      |   2 +-
 .../expected/codex_f_collab_fallback.json     |   2 +-
 .../expected/codex_g_items_rebuild.json       |   2 +-
 tests/lint/rules/ce058_no_timing_literal.py   | 204 ++++++++++++++++++
 .../ce059_generation_window_is_two_reads.py   |  79 +++++++
 tests/lint/runner.py                          |   4 +
 tests/test_agent_telemetry.py                 |   9 +-
 tests/test_agent_telemetry_advanced.py        |   4 +-
 tests/test_codex_agent.py                     |  20 +-
 tests/test_custom_lint.py                     | 166 ++++++++++++++
 tests/test_models.py                          |  56 +++++
 tests/test_simulation_integration.py          |  73 +++++++
 tests/test_token_usage.py                     |  12 ++
 22 files changed, 684 insertions(+), 28 deletions(-)
 create mode 100644 tests/lint/rules/ce058_no_timing_literal.py
 create mode 100644 tests/lint/rules/ce059_generation_window_is_two_reads.py

diff --git a/CLAUDE.md b/CLAUDE.md
index 2a0d60c5..75382d4d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -236,7 +236,7 @@ make plugin-reference  # the plugin's bundled criteria reference from the models
 
 Editing `src/coder_eval/pricing.py` means editing `evalboard/lib/pricing.ts` too — it is a hand-copied mirror, and `evalboard/lib/__tests__/pricing-parity.test.ts` fails the build on drift in either direction.
 
-Recent additions, each traceable to a shipped defect: **CE056** (no bare `CODER_EVAL_IN_CONTAINER` literal outside `models/container_paths.py` — the CE053 shape again: a rename-safety constant that shipped beside the literal it replaced, and the straggler was the single WRITER, so a rename would have disarmed four security/correctness gates at once with nothing failing; CE052 cannot catch it because that rule inspects `if` guards and the writer is not one), **CE055** (a criterion `path:` in `tasks/` must be sandbox-relative — an absolute path is joined onto the sandbox root, which DISCARDS the root, so containment refuses it and the criterion can never match whatever the agent does; two in-tree tasks were broken this way and the pair is the argument for a static rule on top of the runtime `CheckerMisuseError`: `byod_smoke_test` IS in a CI bucket and produced only `Results: 7/8 succeeded` plus a gating 0.0 reading "file does not exist" for a file that existed, while `dockerfile_build_example` is in NO bucket, so nothing ran it and no runtime guard was ever reached — the fix is never to relax containment but to say what the criterion means, `run_command: test -f /opt/marker`, a claim about the container IMAGE rather than about the agent's workspace), **CE054** (an `environment_info` key that is READ must be WRITTEN somewhere in `src/` — the bag is `dict[str, Any]`, so nothing connects reader to writer, and the `reference_digest` anti-cheat guard shipped as a read with no writer anywhere: `.get()` returned `None`, the guard took its early return, and CLAUDE.md plus the user guide both described it as protection it never provided), **CE048** (never call a Typer command function in process — its parameter defaults are `OptionInfo` sentinels, not values, and the sentinel is TRUTHY, so `in_place=None` silently selected the wrong branch; the fix is the `run_pipeline` / `run_evaluation` / `run_plan` split, and this rule is the one that also scans `tests/`, since that is the only place the defect occurs), **CE049** (never coalesce a possibly-unmeasured score to a numeric literal — `score or 0.0` publishes "measured and scored zero" while meaning "never measured", which is how an ungraded night reached four unfiltered `avg(Score)` dashboards as a real zero), **CE050** (no untyped `getattr` probe for a discriminated-union field — pyright cannot see the string, so a rename degrades the guard to a permanent no-op; scoped to criterion-shaped receivers because `command`/`tool`/`prompt` are far too common to flag on their own), **CE051** (a sandbox driver may not be rewritten silently — the driver IS the isolation boundary, so a downgrade must be an explicit, stamped, operator-visible decision), **CE053** (no bare run-record or run-LOG filename literal outside `path_utils` — widened to `docker.log` / `grade.docker.log` / `task.log` / `grade.log` after the same shape recurred: `docker.log` was produced in `isolation/` and consumed in `orchestration/` as three unrelated literals, and because the consumer guards its copy with `is_file()`, a rename would have silently discarded the only record of why a grading container failed — `TASK_JSON_FILENAME` shipped with a rename-safety rationale while twelve exact literals stayed unmigrated, including all three `rglob("task.json")` sites the constant's own comment cites as its reason to exist, so it created the second source of truth it argues against), **CE052** (an `os._exit` must sit inside a branch testing `CODER_EVAL_IN_CONTAINER` — it is the right primitive only for reaping the container's own disposable main process, and `run_task_internal_command` armed its heartbeat watchdog, a daemon thread whose whole authority is `os._exit(137)`, unconditionally: a test that invoked the command in-process left the pytest worker holding that thread, which exited the worker 40s later inside an unrelated test file, naming a different test on each run and on each platform with no traceback — and the dead worker's lost coverage data then failed the gate as `65.13 < 80.00`, naming neither the test nor the cause), **CE037** (no unreferenced module-level private helper in `src/` — a helper whose docstring documents a bug the live code still has is worse than none), **CE038** (in an `@asynccontextmanager`, the acquire must sit INSIDE the `try` whose `finally` releases it — `asyncio.shield` protects the inner task, NOT the await, so a cancel on `__aenter__` skips the unwind while the work completes), **CE039** (a criterion checker must not return a gating `score=0.0` from an `except OSError` over a path the *task author* named — that books an eval-config error as an agent failure; raise `CheckerMisuseError` instead, and `# noqa: CE039` the cases that really are the agent's), **CE047** (every onboarding/marketing surface — README, `docs/index.md`, `docs/comparison.md`, `docs/llms.txt`, `mkdocs.yml`'s `site_description`, the Pages stub, and pyproject's `description`/`keywords` — must name every built-in `AgentKind`; OpenCode shipped while four of those seven still listed three harnesses, and nothing failed), **CE057** (a module copied into the recorder directory beside a generated sandbox shim — `models.sandbox.SIDECAR_MODULES`, currently `argv_match.py` — may import stdlib only. The failure is silent: the sidecar runs where `coder_eval` and its dependencies are not installed, so one package import makes every shadowed CLI die with an ImportError the agent reads as "the tool is broken", costing a whole run to diagnose. The rule derives its target set from that exported tuple and a test asserts it matches a file that exists — a lint rule guarding zero files must fail, not pass).
+Recent additions, each traceable to a shipped defect: **CE058** (in `src/coder_eval/`, an unknown timing value may not become a numeric literal — `duration_ms is None` means *never timed* and `0.0` means *timed and instant*, so writing the literal publishes the second while meaning the first. One invariant, one id, four syntactic forms — a zero constructor keyword, `x or 0`, `x if x is not None else 0.0`, and `if x.duration_ms is None: x.duration_ms = 0.0`. Antigravity constructed EVERY message with `generation_duration_ms=0.0`, so the task page's Generation cell read `0ms` and its breakdown rendered `0%` for months with nothing failing; Codex published the SDK's `0.0` as a measured command duration, so `avg_command_time_ms` divided real milliseconds by a command count of which 70 of 211 in one nightly had never been timed. The fourth form is the one no existing rule shape covered and is where a live instance was hiding — `claude_code_agent._finalize_commands` set `0.0` on every command force-closed without a tool result, in the one harness a timing audit had called healthy. BLIND SPOT, stated in the rule's docstring: form 1 keys on the callee's spelling, so renaming the `AssistantMessageTelemetry` import alias silently disarms it there), **CE059** (in `src/coder_eval/agents/`, an `AssistantMessage` may not receive the same `ast.Name` for both `started_at` and `completed_at` — the Antigravity reducer read `datetime.now()` once and passed it as both bounds, so `started_at == completed_at` on 368 of 368 sampled messages. A separate id from CE058 because it is a separate invariant, a zero-length window whatever the duration field says, and one invariant per id is what makes a `# noqa` mean one thing. It does NOT fire when the same call passes `generation_duration_ms=None`: a call that says, in the field built to say it, that no window was measurable is not claiming one — that exemption is what keeps the rule pointed at the misleading case instead of accumulating four permanent suppressions on the rollout-rebuild and sub-agent-synthesis sites), **CE056** (no bare `CODER_EVAL_IN_CONTAINER` literal outside `models/container_paths.py` — the CE053 shape again: a rename-safety constant that shipped beside the literal it replaced, and the straggler was the single WRITER, so a rename would have disarmed four security/correctness gates at once with nothing failing; CE052 cannot catch it because that rule inspects `if` guards and the writer is not one), **CE055** (a criterion `path:` in `tasks/` must be sandbox-relative — an absolute path is joined onto the sandbox root, which DISCARDS the root, so containment refuses it and the criterion can never match whatever the agent does; two in-tree tasks were broken this way and the pair is the argument for a static rule on top of the runtime `CheckerMisuseError`: `byod_smoke_test` IS in a CI bucket and produced only `Results: 7/8 succeeded` plus a gating 0.0 reading "file does not exist" for a file that existed, while `dockerfile_build_example` is in NO bucket, so nothing ran it and no runtime guard was ever reached — the fix is never to relax containment but to say what the criterion means, `run_command: test -f /opt/marker`, a claim about the container IMAGE rather than about the agent's workspace), **CE054** (an `environment_info` key that is READ must be WRITTEN somewhere in `src/` — the bag is `dict[str, Any]`, so nothing connects reader to writer, and the `reference_digest` anti-cheat guard shipped as a read with no writer anywhere: `.get()` returned `None`, the guard took its early return, and CLAUDE.md plus the user guide both described it as protection it never provided), **CE048** (never call a Typer command function in process — its parameter defaults are `OptionInfo` sentinels, not values, and the sentinel is TRUTHY, so `in_place=None` silently selected the wrong branch; the fix is the `run_pipeline` / `run_evaluation` / `run_plan` split, and this rule is the one that also scans `tests/`, since that is the only place the defect occurs), **CE049** (never coalesce a possibly-unmeasured score to a numeric literal — `score or 0.0` publishes "measured and scored zero" while meaning "never measured", which is how an ungraded night reached four unfiltered `avg(Score)` dashboards as a real zero), **CE050** (no untyped `getattr` probe for a discriminated-union field — pyright cannot see the string, so a rename degrades the guard to a permanent no-op; scoped to criterion-shaped receivers because `command`/`tool`/`prompt` are far too common to flag on their own), **CE051** (a sandbox driver may not be rewritten silently — the driver IS the isolation boundary, so a downgrade must be an explicit, stamped, operator-visible decision), **CE053** (no bare run-record or run-LOG filename literal outside `path_utils` — widened to `docker.log` / `grade.docker.log` / `task.log` / `grade.log` after the same shape recurred: `docker.log` was produced in `isolation/` and consumed in `orchestration/` as three unrelated literals, and because the consumer guards its copy with `is_file()`, a rename would have silently discarded the only record of why a grading container failed — `TASK_JSON_FILENAME` shipped with a rename-safety rationale while twelve exact literals stayed unmigrated, including all three `rglob("task.json")` sites the constant's own comment cites as its reason to exist, so it created the second source of truth it argues against), **CE052** (an `os._exit` must sit inside a branch testing `CODER_EVAL_IN_CONTAINER` — it is the right primitive only for reaping the container's own disposable main process, and `run_task_internal_command` armed its heartbeat watchdog, a daemon thread whose whole authority is `os._exit(137)`, unconditionally: a test that invoked the command in-process left the pytest worker holding that thread, which exited the worker 40s later inside an unrelated test file, naming a different test on each run and on each platform with no traceback — and the dead worker's lost coverage data then failed the gate as `65.13 < 80.00`, naming neither the test nor the cause), **CE037** (no unreferenced module-level private helper in `src/` — a helper whose docstring documents a bug the live code still has is worse than none), **CE038** (in an `@asynccontextmanager`, the acquire must sit INSIDE the `try` whose `finally` releases it — `asyncio.shield` protects the inner task, NOT the await, so a cancel on `__aenter__` skips the unwind while the work completes), **CE039** (a criterion checker must not return a gating `score=0.0` from an `except OSError` over a path the *task author* named — that books an eval-config error as an agent failure; raise `CheckerMisuseError` instead, and `# noqa: CE039` the cases that really are the agent's), **CE047** (every onboarding/marketing surface — README, `docs/index.md`, `docs/comparison.md`, `docs/llms.txt`, `mkdocs.yml`'s `site_description`, the Pages stub, and pyproject's `description`/`keywords` — must name every built-in `AgentKind`; OpenCode shipped while four of those seven still listed three harnesses, and nothing failed), **CE057** (a module copied into the recorder directory beside a generated sandbox shim — `models.sandbox.SIDECAR_MODULES`, currently `argv_match.py` — may import stdlib only. The failure is silent: the sidecar runs where `coder_eval` and its dependencies are not installed, so one package import makes every shadowed CLI die with an ImportError the agent reads as "the tool is broken", costing a whole run to diagnose. The rule derives its target set from that exported tuple and a test asserts it matches a file that exists — a lint rule guarding zero files must fail, not pass).
 
 When fixing a bug, ask: *could a custom lint rule have prevented this?* If the root cause is a mechanically detectable pattern (e.g., "always import from `coder_eval.models`", "never call blocking IO in async"), add a rule to `tests/lint/rules/` following the CE001+ pattern and wire it up in `tests/lint/runner.py`. This turns a one-time fix into permanent enforcement. See `tests/test_custom_lint.py` for how rules are tested. (Doc-surface / whole-tree rules that reason over Markdown/YAML or the entire `src/` tree rather than one `.py` AST at a time — CE026–CE031, CE033–CE036 — are not `BaseRule`s in the runner; they are wired as dedicated `@pytest.mark.lint` test classes. CE036 enforces the `live_verdict` determinism + monotonicity contract (`criteria/base.py`) that `EarlyStopWatcher`'s latching, deferred fail-stop, and flip-attribution silently depend on: monotonicity over arbitrary Python is undecidable, so instead of a static check it REPLAYS each live criterion against every prefix of recorded trajectories (`tests/lint/live_verdict_contract.py::CASES`) — on the authored ordering AND under seeded shuffles (`permuted_violations`, which catch order-sensitive bugs the authored walk misses) — and asserts the property directly, plus registry-derived coverage — every `LiveSuccessCriterion` in the union must have cases, and every polarity its instances claim via `live_decidable_polarities()` must actually be reached by one (otherwise a single always-`undecided` fixture would "cover" a type while proving nothing). Adding a live criterion therefore means adding `ContractCase`s in the same change. CE035 resolves every `steps.<id>.outputs.<key>` / `needs.<job>.outputs.<key>` reference in `.github/workflows/**` to a writer that actually produces that key — GitHub expands an unwritten output to the empty string, so a typo degrades a gate silently and actionlint models `steps.*.outputs` as an open string map. CE034 scans `tasks/` and forces an armed, live-*passable* `command_executed` to set `require_success` — a crashed invocation would otherwise latch a live PASS, fire `on_pass: stop`, and let FIRED-ONLY armed gating report SUCCESS without ever consulting the unarmed criteria (negative assertions are fail-only and are exempt). CE033 keeps the plugin's bundled `reference/criteria.md` in parity with the `SuccessCriterion` union that generates it (`make plugin-reference` writes it; the rule re-renders and diffs — never hand-edit the file). CE031 guards against dead config: a behavior-driving field on `SimulationConfig`/`RunLimits`/`Dataset` that no code reads by name. CE026 keeps the GitHub Action's onboarding surfaces honest — `README.md`, `docs/CI_GATE.md`, `docs/tutorials/02-ci-pipeline.md`, and the plugin's `ci` skill, whose emitted workflow users copy into their own repos: a page's *first* Action snippet must show the agent-runtime prerequisite steps (pinned to the `action-dogfood` job that proves them in CI), a zero-install absolute next to such a snippet must name the channel it means, every `github.com/marketplace/actions/<slug>` link plus the shields badge label must match `action.yml`'s `name:`, and every `with:` key on a snippet's action step must be a real `action.yml` input (GitHub ignores unknown inputs, so a rename would silently degrade every copied workflow). Renaming an action input or changing its runtime prerequisites therefore means updating the skill too.)
 
diff --git a/pyproject.toml b/pyproject.toml
index c1834793..b1e08974 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -275,6 +275,8 @@ external = [
     "CE055",
     "CE056",
     "CE057",
+    "CE058",
+    "CE059",
 ]  # custom architectural lint rules (tests/lint/)
 
 [tool.ruff.lint.pylint]
diff --git a/src/coder_eval/agents/antigravity_agent.py b/src/coder_eval/agents/antigravity_agent.py
index ee9901d8..f4db1f55 100644
--- a/src/coder_eval/agents/antigravity_agent.py
+++ b/src/coder_eval/agents/antigravity_agent.py
@@ -1002,9 +1002,9 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
             block.sequence = i
         self.messages.append(
             AssistantMessage(
-                started_at=now,
+                started_at=now,  # noqa: CE059  # one clock read; a real window lands with the next commit
                 completed_at=now,
-                generation_duration_ms=0.0,
+                generation_duration_ms=0.0,  # noqa: CE058  # replaced with a real measured window next commit
                 content_blocks=list(self._blocks),
                 tool_use_ids=[b.tool_use_id for b in self._blocks if b.block_type == "tool_use" and b.tool_use_id],
                 input_tokens=gen.uncached_input_tokens,
diff --git a/src/coder_eval/agents/claude_code_agent.py b/src/coder_eval/agents/claude_code_agent.py
index a7690ed5..7175cb7f 100644
--- a/src/coder_eval/agents/claude_code_agent.py
+++ b/src/coder_eval/agents/claude_code_agent.py
@@ -1373,14 +1373,17 @@ def _finalize_commands(
         for tool_id, cmd_data in pending_commands.items():
             cmd = cmd_data["telemetry"]
             if cmd.result_status is None:
+                # Unknown status and unknown duration are the same fact: nothing
+                # resolved this command, so nothing timed it either. duration_ms
+                # is deliberately LEFT as None here — it used to be coerced to
+                # 0.0, which put an invented measurement on both sides of
+                # avg_command_time_ms and dragged the average toward zero.
                 cmd.result_status = "unknown"
                 unknown_status_count += 1
                 self._log.warning(
                     f"Command {cmd.tool_name}:{tool_id} completed without tool result. "
                     + "Status set to 'unknown'. This may indicate agent interruption or SDK issue."
                 )
-            if cmd.duration_ms is None:
-                cmd.duration_ms = 0.0
             commands.append(cmd)
 
         if unknown_status_count > 0:
@@ -1753,11 +1756,13 @@ def _int(value: Any) -> int:
             except (TypeError, ValueError):
                 return 0
 
+        # This generation arrives as a tool result and is never streamed, so no
+        # window exists to measure — None (unknown), not 0.0 (instant).
         now = datetime.now()
         return AssistantMessageTelemetry(
             started_at=now,
             completed_at=now,
-            generation_duration_ms=0.0,
+            generation_duration_ms=None,
             content_blocks=([ContentBlock(block_type="text", sequence=0, text=result_text)] if result_text else []),
             tool_use_ids=[],
             input_tokens=_int(usage.get("input_tokens")),
diff --git a/src/coder_eval/agents/codex_agent.py b/src/coder_eval/agents/codex_agent.py
index ff96f45c..872ca0bc 100644
--- a/src/coder_eval/agents/codex_agent.py
+++ b/src/coder_eval/agents/codex_agent.py
@@ -1599,8 +1599,9 @@ def _messages_from_items(self, items: Any, turn_id: str) -> list[AssistantMessag
         """Rebuild the assistant transcript from a Turn's ``items`` list (fallback).
 
         Same item→block mapping as the streaming path, but Turn items carry no
-        per-item timestamps, so timing falls back to now()/0.0. Used only when the
-        stream produced no messages.
+        per-item timestamps, so there is no window to measure: the bounds fall back
+        to now() and ``generation_duration_ms`` is None (unknown), never 0.0 (an
+        instant generation). Used only when the stream produced no messages.
         """
         if not items:
             return []
@@ -1619,7 +1620,7 @@ def _flush() -> None:
                 AssistantMessage(
                     started_at=now,
                     completed_at=now,
-                    generation_duration_ms=0.0,
+                    generation_duration_ms=None,
                     content_blocks=open_blocks,
                     tool_use_ids=[b.tool_use_id for b in open_blocks if b.block_type == "tool_use" and b.tool_use_id],
                     model=self._effective_model(),
@@ -2123,7 +2124,7 @@ def _subagent_generation_message(
         return AssistantMessage(
             started_at=now,
             completed_at=now,
-            generation_duration_ms=0.0,
+            generation_duration_ms=None,
             content_blocks=blocks,
             tool_use_ids=[b.tool_use_id for b in blocks if b.block_type == "tool_use" and b.tool_use_id],
             input_tokens=fresh,
@@ -2149,7 +2150,7 @@ def _subagent_text_message(
         return AssistantMessage(
             started_at=now,
             completed_at=now,
-            generation_duration_ms=0.0,
+            generation_duration_ms=None,
             content_blocks=[ContentBlock(block_type="text", sequence=0, text=text)],
             tool_use_ids=[],
             input_tokens=0,
diff --git a/src/coder_eval/analysis.py b/src/coder_eval/analysis.py
index e75a4b86..54cf80ed 100644
--- a/src/coder_eval/analysis.py
+++ b/src/coder_eval/analysis.py
@@ -35,20 +35,28 @@ def calculate_command_statistics(turns: list[TurnRecord]) -> CommandStatistics:
     # Use `is not None` to include valid 0.0ms durations
     total_time = sum(cmd.duration_ms for cmd in all_commands if cmd.duration_ms is not None)
     timed_count = sum(1 for cmd in all_commands if cmd.duration_ms is not None)
-    avg_time = total_time / timed_count if timed_count > 0 else 0
-
-    # Find slowest commands (type-safe using SlowestCommandInfo model)
-    commands_with_timing = [c for c in all_commands if c.duration_ms is not None]
-    slowest = sorted(commands_with_timing, key=lambda x: x.duration_ms or 0, reverse=True)[:5]
-
+    # None, not 0, when NOTHING was timed: `avg_command_time_ms` is
+    # `float | None` precisely so it can say "no measurement" instead of
+    # publishing "measured, and instant". A 0 here rendered "0ms average
+    # command time" for a turn whose only tool call was force-closed and
+    # never timed at all. The `is not None` tests above are deliberately
+    # unchanged — a real 0.0ms duration IS a measurement and still counts.
+    avg_time = total_time / timed_count if timed_count > 0 else None
+
+    # Find slowest commands (type-safe using SlowestCommandInfo model). Only
+    # timed commands are eligible, and the duration travels alongside its
+    # command so it stays a float the whole way — an untimed command has no
+    # place in a "slowest" ranking, and coalescing it to 0.0 would only have
+    # hidden that.
+    timed = [(c.duration_ms, c) for c in all_commands if c.duration_ms is not None]
     slowest_info = [
         SlowestCommandInfo(
             tool=cmd.tool_name,
-            duration_ms=cmd.duration_ms if cmd.duration_ms is not None else 0.0,
+            duration_ms=duration_ms,
             parameters=cmd.parameters,
             tool_id=cmd.tool_id,
         )
-        for cmd in slowest
+        for duration_ms, cmd in sorted(timed, key=lambda pair: pair[0], reverse=True)[:5]
     ]
 
     # Success/failure/unknown rates
diff --git a/src/coder_eval/models/telemetry.py b/src/coder_eval/models/telemetry.py
index 82a79305..15a18430 100644
--- a/src/coder_eval/models/telemetry.py
+++ b/src/coder_eval/models/telemetry.py
@@ -222,8 +222,19 @@ class AssistantMessage(BaseModel):
 
     started_at: datetime = Field(description="Wall-clock start of generation (end of the previous SDK event).")
     completed_at: datetime = Field(description="Wall-clock arrival of the AssistantMessage from the SDK.")
-    generation_duration_ms: float = Field(
-        description="completed_at - started_at in milliseconds (wall-clock between SDK events).",
+    generation_duration_ms: float | None = Field(
+        default=None,
+        description=(
+            "Model-generation time for this emission, in milliseconds. None when the harness "
+            "surfaced the message with no measurable window (a rollout rebuild, or a sub-agent "
+            "generation delivered as a tool result). Equals completed_at - started_at only when "
+            "no tool execution closed inside the window; a harness whose stream interleaves tool "
+            "calls into one generation (Antigravity) subtracts those. The property this field exists "
+            "to make true — once every harness records a real window — is: "
+            "sum(generation_duration_ms) + sum(command duration_ms) ~= turn duration_seconds. "
+            "Per-harness status is in docs/agents/HARNESS_PARITY.md; do not assume it holds "
+            "for a harness that table does not yet claim it for."
+        ),
     )
 
     content_blocks: list[ContentBlock] = Field(
diff --git a/src/coder_eval/orchestrator.py b/src/coder_eval/orchestrator.py
index da273ccc..17f969bd 100644
--- a/src/coder_eval/orchestrator.py
+++ b/src/coder_eval/orchestrator.py
@@ -2964,11 +2964,19 @@ async def _simulation_dialog_loop(self, initial_prompt: str | None, sandbox_dir:
             # append it as a standalone entry so its telemetry is not lost. (If the simulator's opener
             # had stop_requested, we never entered the agent loop, so don't record it.)
             if agent_turn_attempted and pending_user_turn is not None and self.result is not None:
+                # TurnRecord.duration_seconds defaults to 0.0 and no caller passes
+                # it, so this turn used to report 0s for a simulator call that
+                # really took seconds — halving `avg_turn` in the HTML report for
+                # every simulation task. A pinned opener has no simulator call
+                # behind it (generation_duration_ms is None by design), so 0.0
+                # there is the real duration, not a placeholder.
+                sim_ms = pending_user_turn.generation_duration_ms
                 standalone_turn = TurnRecord(
                     iteration=turns_completed,
                     user_input=pending_user_turn.text or "",
                     agent_output="",
                     messages=[pending_user_turn],
+                    duration_seconds=sim_ms / 1000.0 if sim_ms is not None else 0.0,
                 )
                 self.result.iterations.append(standalone_turn)
 
diff --git a/tests/_fixtures/golden_streams/expected/claude_d_subagent_terminal.json b/tests/_fixtures/golden_streams/expected/claude_d_subagent_terminal.json
index 17f88c55..943e0ef7 100644
--- a/tests/_fixtures/golden_streams/expected/claude_d_subagent_terminal.json
+++ b/tests/_fixtures/golden_streams/expected/claude_d_subagent_terminal.json
@@ -72,7 +72,7 @@
           "tool_use_id": null
         }
       ],
-      "generation_duration_ms": "<scrubbed>",
+      "generation_duration_ms": null,
       "input_tokens": 300,
       "message_id": "subagent-toolu_agent_d",
       "model": "mock-model",
diff --git a/tests/_fixtures/golden_streams/expected/claude_f_orphaned_tool.json b/tests/_fixtures/golden_streams/expected/claude_f_orphaned_tool.json
index 58967687..cae8354c 100644
--- a/tests/_fixtures/golden_streams/expected/claude_f_orphaned_tool.json
+++ b/tests/_fixtures/golden_streams/expected/claude_f_orphaned_tool.json
@@ -4,7 +4,7 @@
   "commands": [
     {
       "assistant_turn_index": 0,
-      "duration_ms": "<scrubbed>",
+      "duration_ms": null,
       "error_message": null,
       "execution_completed_at": null,
       "execution_started_at": null,
diff --git a/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json b/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
index 345ab9f6..23988d27 100644
--- a/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
+++ b/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
@@ -103,7 +103,7 @@
           "tool_use_id": null
         }
       ],
-      "generation_duration_ms": "<scrubbed>",
+      "generation_duration_ms": null,
       "input_tokens": 0,
       "message_id": "codex-1-subagent-1",
       "model": "gpt-5.5",
diff --git a/tests/_fixtures/golden_streams/expected/codex_g_items_rebuild.json b/tests/_fixtures/golden_streams/expected/codex_g_items_rebuild.json
index ef3d8c49..aed8db92 100644
--- a/tests/_fixtures/golden_streams/expected/codex_g_items_rebuild.json
+++ b/tests/_fixtures/golden_streams/expected/codex_g_items_rebuild.json
@@ -23,7 +23,7 @@
           "tool_use_id": null
         }
       ],
-      "generation_duration_ms": "<scrubbed>",
+      "generation_duration_ms": null,
       "input_tokens": 0,
       "message_id": "codex-1-msg-0",
       "model": "gpt-5-codex",
diff --git a/tests/lint/rules/ce058_no_timing_literal.py b/tests/lint/rules/ce058_no_timing_literal.py
new file mode 100644
index 00000000..1f10f06a
--- /dev/null
+++ b/tests/lint/rules/ce058_no_timing_literal.py
@@ -0,0 +1,204 @@
+"""CE058: an unknown timing value may not become a numeric literal.
+
+``duration_ms is None`` means *this was never timed*, and it is a different
+fact from ``duration_ms == 0.0``, which means *it was timed and took no
+measurable time*. Writing the literal publishes the second while meaning the
+first, and every consumer downstream — an average, a breakdown percentage, a
+timeline cell — then treats the invention as a measurement. Same reasoning as
+CE049 on the score side.
+
+Two shipped defects motivate it. Antigravity constructed every
+``AssistantMessage`` with ``generation_duration_ms=0.0``, so the task page's
+Generation cell read ``0ms`` and its thinking/tool/text breakdown rendered
+``0%`` for months with nothing failing. And Codex published the SDK item's own
+``duration_ms`` straight through, so ``avg_command_time_ms`` divided real
+milliseconds by a command count of which 70 of 211 in one nightly had never
+been timed at all.
+
+Four syntactic forms, one invariant, one id — these are the four the codebase
+actually produced:
+
+1. a ``0`` / ``0.0`` constructor keyword on one of the telemetry constructors
+   that carry these fields;
+2. ``duration_ms or 0``;
+3. ``x if x is not None else 0.0`` (and the ``is None`` mirror);
+4. ``if x.duration_ms is None: x.duration_ms = 0.0`` — the form no existing
+   rule shape covers, and where the live Claude instance was hiding
+   (``_finalize_commands`` set it on every command force-closed without a
+   tool result, in the one harness a timing audit had called healthy);
+5. ``model_copy(update={"duration_ms": 0.0})`` — a keyword rule is blind to a
+   dict, and the dict is how ``CommandTelemetry.duration_ms`` is actually
+   written on the Antigravity DONE path, so forms 1-4 alone would have left
+   the next author's ``"duration_ms": 0.0`` in that idiom unguarded.
+
+BLIND SPOT worth knowing: form 1 keys on the callee's spelling, so
+``AssistantMessageTelemetry`` (an import alias for ``AssistantMessage`` in
+``claude_code_agent``) is matched by name only. Renaming that alias silently
+disarms form 1 for that module.
+
+``# noqa: CE058`` for a genuinely aggregate-internal use where a missing value
+really is a zero, with a comment saying so.
+"""
+
+import ast
+import re
+
+from tests.lint.rules.base import BaseRule
+
+
+# Trailing-segment match, so `cmd.duration_ms` and `generation_duration_ms`
+# fire while `duration_ms_limit` does not.
+_TIMING_NAME = re.compile(
+    r"^(duration_ms|generation_duration_ms|total_command_time_ms|avg_command_time_ms|[a-z_]*_duration_ms)$"
+)
+
+# The constructors that carry a timing field. Keying on the callee name is what
+# makes the alias hazard above real; it is also the only thing an AST rule can
+# see without type inference.
+_TIMING_CONSTRUCTORS = frozenset(
+    {"AssistantMessage", "AssistantMessageTelemetry", "CommandTelemetry", "SlowestCommandInfo"}
+)
+
+_SRC_ROOT = re.compile(r"(?:^|[/\\])src[/\\]coder_eval[/\\]")
+
+
+def _timing_name(node: ast.expr) -> str | None:
+    """The name of a timing-looking expression, or None."""
+    if isinstance(node, ast.Attribute):
+        name = node.attr
+    elif isinstance(node, ast.Name):
+        name = node.id
+    else:
+        return None
+    return name if _TIMING_NAME.match(name) else None
+
+
+def _numeric_literal(node: ast.expr) -> bool:
+    """Any numeric constant — the fallback in forms 2-4, where ANY invented
+    number for an unmeasured value is the defect, not just zero."""
+    return isinstance(node, ast.Constant) and isinstance(node.value, int | float) and not isinstance(node.value, bool)
+
+
+def _zero_literal(node: ast.expr) -> bool:
+    """Exactly `0` / `0.0`. Form 1 is narrower than the others on purpose: a
+    constructor keyword is also how a legitimately measured value is passed
+    (`generation_duration_ms=1234.0` in a test factory or a replay), so only
+    the placeholder zero every real producer actually wrote is flagged."""
+    return isinstance(node, ast.Constant) and _numeric_literal(node) and node.value == 0
+
+
+def _callee_name(node: ast.Call) -> str | None:
+    func = node.func
+    if isinstance(func, ast.Name):
+        return func.id
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    return None
+
+
+def _none_test(test: ast.expr) -> tuple[ast.expr, bool] | None:
+    """(<operand>, is_none) for an `x is None` / `x is not None` comparison."""
+    if not isinstance(test, ast.Compare) or len(test.ops) != 1 or len(test.comparators) != 1:
+        return None
+    comparator = test.comparators[0]
+    if not (isinstance(comparator, ast.Constant) and comparator.value is None):
+        return None
+    if isinstance(test.ops[0], ast.Is):
+        return test.left, True
+    if isinstance(test.ops[0], ast.IsNot):
+        return test.left, False
+    return None
+
+
+def _same_target(a: ast.expr, b: ast.expr) -> bool:
+    """True when two expressions name the same attribute or local.
+
+    Compares the unparsed source rather than ``ast.dump``: the guard reads the
+    name (``Load``) and the assignment writes it (``Store``), so the dumps
+    differ by ``ctx`` on the very pair the rule exists to match.
+    """
+    return ast.unparse(a) == ast.unparse(b)
+
+
+_MESSAGE = (
+    "an unknown timing value is written as a numeric literal. `None` means it was never "
+    "measured; a literal means it was measured and took that long — and writing the literal "
+    "publishes the second while meaning the first, which is how Antigravity reported 0ms of "
+    "generation on every message of every run and Codex divided avg_command_time_ms by a "
+    "command count a third of which had never been timed. Keep it None, or branch on "
+    "`is None`. Use `# noqa: CE058` where a missing value genuinely IS a zero, with a "
+    "comment saying so."
+)
+
+
+class NoTimingLiteral(BaseRule):
+    id = "CE058"
+
+    def __init__(self, filepath: str) -> None:
+        super().__init__(filepath)
+        self._in_scope = bool(_SRC_ROOT.search(filepath))
+
+    def visit_Call(self, node: ast.Call) -> None:
+        # Form 1: `AssistantMessage(generation_duration_ms=0.0, ...)`
+        if self._in_scope:
+            if _callee_name(node) in _TIMING_CONSTRUCTORS:
+                for kw in node.keywords:
+                    if kw.arg is not None and _TIMING_NAME.match(kw.arg) and _zero_literal(kw.value):
+                        self.violation(node, _MESSAGE)
+            # Form 5. Scoped to an `update=` dict rather than any dict literal:
+            # that is the `model_copy(update={...})` idiom the agents use to
+            # write timing, and scoping it there keeps an unrelated
+            # `{"duration_ms": 0}` fixture from firing.
+            for kw in node.keywords:
+                if kw.arg == "update" and isinstance(kw.value, ast.Dict):
+                    self._check_update_dict(kw.value)
+        self.generic_visit(node)
+
+    def visit_BoolOp(self, node: ast.BoolOp) -> None:
+        # Form 2: `duration_ms or 0`
+        if (
+            self._in_scope
+            and isinstance(node.op, ast.Or)
+            and len(node.values) == 2
+            and _timing_name(node.values[0]) is not None
+            and _numeric_literal(node.values[1])
+        ):
+            self.violation(node, _MESSAGE)
+        self.generic_visit(node)
+
+    def visit_IfExp(self, node: ast.IfExp) -> None:
+        # Form 3: `x if x is not None else 0.0` (and the `is None` mirror).
+        parsed = _none_test(node.test)
+        if self._in_scope and parsed is not None:
+            operand, is_none = parsed
+            unknown_branch = node.body if is_none else node.orelse
+            if _timing_name(operand) is not None and _numeric_literal(unknown_branch):
+                self.violation(node, _MESSAGE)
+        self.generic_visit(node)
+
+    def _check_update_dict(self, node: ast.Dict) -> None:
+        """Form 5: a timing key set to a zero literal inside an ``update=`` dict."""
+        for key, value in zip(node.keys, node.values, strict=True):
+            if (
+                isinstance(key, ast.Constant)
+                and isinstance(key.value, str)
+                and _TIMING_NAME.match(key.value)
+                and _zero_literal(value)
+            ):
+                self.violation(node, _MESSAGE)
+
+    def visit_If(self, node: ast.If) -> None:
+        # Form 4: `if x.duration_ms is None: x.duration_ms = 0.0`
+        parsed = _none_test(node.test)
+        if self._in_scope and parsed is not None:
+            operand, is_none = parsed
+            if is_none and _timing_name(operand) is not None:
+                for stmt in node.body:
+                    if (
+                        isinstance(stmt, ast.Assign)
+                        and len(stmt.targets) == 1
+                        and _numeric_literal(stmt.value)
+                        and _same_target(stmt.targets[0], operand)
+                    ):
+                        self.violation(stmt, _MESSAGE)
+        self.generic_visit(node)
diff --git a/tests/lint/rules/ce059_generation_window_is_two_reads.py b/tests/lint/rules/ce059_generation_window_is_two_reads.py
new file mode 100644
index 00000000..254de2b3
--- /dev/null
+++ b/tests/lint/rules/ce059_generation_window_is_two_reads.py
@@ -0,0 +1,79 @@
+"""CE059: one clock read cannot measure a window.
+
+An ``AssistantMessage`` that receives the SAME name for both ``started_at`` and
+``completed_at`` records a zero-length generation window — whatever
+``generation_duration_ms`` happens to say beside it. The Antigravity reducer
+read ``datetime.now()`` once and passed it as both bounds, so
+``started_at == completed_at`` on 368 of 368 sampled messages and every
+consumer that derives a window from the two stamps saw nothing at all. A window
+needs two reads at two moments.
+
+Separate id from CE058 deliberately: this is a different invariant (a
+zero-length window, regardless of what the duration field says), and one
+invariant per id is what makes a ``# noqa`` mean one thing.
+
+WHAT IT DOES NOT FIRE ON, and why that is the rule rather than a stack of
+suppressions: a call that passes ``generation_duration_ms=None`` in the same
+breath is not claiming a window — it is saying, in the field built to say it,
+that none was measurable. Three sites are legitimately like that (Codex's
+rollout rebuild, and both sub-agent syntheses on Codex and Claude: the
+generation arrives as a tool result and is never streamed), and collapsing
+their bounds to one ``now()`` is then a formatting choice, not a false
+measurement. Exempting them here — rather than through four permanent
+``# noqa`` lines — keeps the rule pointed at the case that actually misleads:
+a duration asserted beside two stamps that cannot support it.
+
+Scoped to ``src/coder_eval/agents/``, the layer that measures. The check is
+skipped unless BOTH bounds are a bare ``ast.Name`` — comparing attribute or
+call expressions (``self.a`` vs ``self.b``) would be guesswork.
+
+BLIND SPOT: two DIFFERENT names that hold the same instant at runtime. Codex
+already produces that shape — ``started = _ms_to_dt(self.open_start_ms)`` and
+``completed = _ms_to_dt(self.open_end_ms if ... is not None else
+self.open_start_ms)`` collapse to one instant whenever ``open_end_ms`` is
+None. No AST rule can see it. The catch for that case is the replay-based
+``assert_timing_captured`` golden invariant, which runs the real reducer and
+asserts a non-zero window actually came out.
+"""
+
+import ast
+import re
+
+from tests.lint.rules.base import BaseRule
+
+
+_AGENTS_ROOT = re.compile(r"(?:^|[/\\])src[/\\]coder_eval[/\\]agents[/\\]")
+
+_MESSAGE_CONSTRUCTORS = frozenset({"AssistantMessage", "AssistantMessageTelemetry"})
+
+
+def _is_none(node: ast.expr | None) -> bool:
+    return isinstance(node, ast.Constant) and node.value is None
+
+
+class GenerationWindowIsTwoReads(BaseRule):
+    id = "CE059"
+
+    def __init__(self, filepath: str) -> None:
+        super().__init__(filepath)
+        self._in_scope = bool(_AGENTS_ROOT.search(filepath))
+
+    def visit_Call(self, node: ast.Call) -> None:
+        if self._in_scope:
+            func = node.func
+            name = func.id if isinstance(func, ast.Name) else func.attr if isinstance(func, ast.Attribute) else None
+            if name in _MESSAGE_CONSTRUCTORS:
+                kwargs = {kw.arg: kw.value for kw in node.keywords if kw.arg is not None}
+                start, end = kwargs.get("started_at"), kwargs.get("completed_at")
+                claims_a_window = not _is_none(kwargs.get("generation_duration_ms"))
+                if claims_a_window and isinstance(start, ast.Name) and isinstance(end, ast.Name) and start.id == end.id:
+                    self.violation(
+                        node,
+                        f"'started_at' and 'completed_at' are both {start.id!r}, so the generation "
+                        "window has zero length while generation_duration_ms claims one beside it. "
+                        "Antigravity shipped this on 368 of 368 sampled messages. Read the clock "
+                        "twice — mark the end of the previous SDK event, and read again when this "
+                        "message arrives — or pass generation_duration_ms=None if no window is "
+                        "measurable.",
+                    )
+        self.generic_visit(node)
diff --git a/tests/lint/runner.py b/tests/lint/runner.py
index fad45a15..8800c424 100644
--- a/tests/lint/runner.py
+++ b/tests/lint/runner.py
@@ -35,6 +35,8 @@
 from tests.lint.rules.ce054_env_info_key_round_trip import EnvInfoKeyRoundTrip
 from tests.lint.rules.ce056_no_container_env_literal import NoContainerEnvLiteral
 from tests.lint.rules.ce057_sidecar_shim_stdlib_only import SidecarShimStdlibOnly
+from tests.lint.rules.ce058_no_timing_literal import NoTimingLiteral
+from tests.lint.rules.ce059_generation_window_is_two_reads import GenerationWindowIsTwoReads
 from tests.lint.rules.no_agent_timing_access import NoAgentTimingAccess
 from tests.lint.rules.no_blocking_io_in_async import NoBlockingIoInAsync
 from tests.lint.rules.no_cli_imports_in_core import NoCliImportsInCore
@@ -93,6 +95,8 @@
     NoContainerEnvLiteral,
     NoRunRecordFilenameLiteral,
     SidecarShimStdlibOnly,
+    NoTimingLiteral,
+    GenerationWindowIsTwoReads,
 ]
 
 # Anti-shadow invariant (mirrors AgentRegistry / register_pricing): every CE rule
diff --git a/tests/test_agent_telemetry.py b/tests/test_agent_telemetry.py
index 7f6fe08b..12c8c171 100644
--- a/tests/test_agent_telemetry.py
+++ b/tests/test_agent_telemetry.py
@@ -194,7 +194,10 @@ async def mock_query(prompt, options):
             assert cmd.tool_name == "Write"
             assert cmd.result_status == "unknown"
             assert cmd.error_message is None
-            assert cmd.duration_ms == 0.0
+            # Force-closed without a tool result, so it was never timed. None
+            # keeps it out of BOTH sides of avg_command_time_ms; a 0.0 here
+            # would drag the average toward zero with an invented measurement.
+            assert cmd.duration_ms is None
 
         finally:
             agent_module.query = original_query
@@ -558,6 +561,10 @@ async def mock_query(prompt, options):
 
             # Verify basic fields
             assert aturn.role == "assistant"
+            # Strong, not `is None or >= 0`: the Claude streaming path always
+            # measures a window, so this is the one assertion in the suite that
+            # a refactor dropping the kwarg (defaulting it to None) would trip.
+            assert aturn.generation_duration_ms is not None
             assert aturn.generation_duration_ms >= 0
             assert aturn.input_tokens == 100
             assert aturn.output_tokens == 50
diff --git a/tests/test_agent_telemetry_advanced.py b/tests/test_agent_telemetry_advanced.py
index 37d562d0..2345485f 100644
--- a/tests/test_agent_telemetry_advanced.py
+++ b/tests/test_agent_telemetry_advanced.py
@@ -80,7 +80,9 @@ async def mock_query(prompt, options):
         cmd = turn_record.commands[0]
         assert cmd.tool_name == "Bash"
         assert cmd.result_status == "unknown"
-        assert cmd.duration_ms == 0.0  # Conservative estimate for unknown status
+        # Unknown status and unknown duration are the same fact: nothing
+        # resolved this command, so nothing timed it either.
+        assert cmd.duration_ms is None
 
     finally:
         agent_module.query = original_query
diff --git a/tests/test_codex_agent.py b/tests/test_codex_agent.py
index 5fefa25d..c12215b4 100644
--- a/tests/test_codex_agent.py
+++ b/tests/test_codex_agent.py
@@ -906,7 +906,7 @@ def _msg(self, *, cache_creation: int, cache_read: int, output: int):
         return AssistantMessage(
             started_at=now,
             completed_at=now,
-            generation_duration_ms=0.0,
+            generation_duration_ms=12.0,
             input_tokens=0,
             output_tokens=output,
             cache_creation_tokens=cache_creation,
@@ -944,6 +944,24 @@ def _reasoning_item(text: str = "", item_id: str = "r1") -> SimpleNamespace:
     return SimpleNamespace(type="reasoning", id=item_id, content=[text] if text else [], summary=[])
 
 
+class TestMessagesFromItemsHasNoWindow:
+    """The rollout-rebuild fallback must not invent a generation window.
+
+    Turn items carry no per-item timestamps, so nothing about the rebuilt
+    messages was ever timed. 0.0 would publish an instant generation; None
+    says the truth, and the evalboard already narrows on it.
+    """
+
+    def test_rebuilt_messages_report_an_unknown_window(self):
+        agent = CodexAgent(parse_agent_config(type=AgentKind.CODEX, model="gpt-5.5"))
+        items = [SimpleNamespace(type="agentMessage", id="m1", text="rebuilt from items")]
+
+        rebuilt = agent._messages_from_items(items, "turn_1")
+
+        assert rebuilt, "expected the fallback to rebuild a message"
+        assert all(m.generation_duration_ms is None for m in rebuilt)
+
+
 class TestFlushMessageReasoningSplit:
     """_flush_message splits a generation's output across a thinking sub-message
     (reasoning tokens) and an action/text sub-message, and resolves text-less
diff --git a/tests/test_custom_lint.py b/tests/test_custom_lint.py
index 6ab18ad1..c2852353 100644
--- a/tests/test_custom_lint.py
+++ b/tests/test_custom_lint.py
@@ -4258,3 +4258,169 @@ def test_allows_a_relative_path(self):
             success_criteria=[FileExistsCriterion(description="c", path="build/out.txt")],
         )
         assert self._absolute_paths(task) == []
+
+
+class TestCE058NoTimingLiteral:
+    """CE058 flags an unknown timing value written as a numeric literal."""
+
+    @staticmethod
+    def _run(src: str, filepath: str = "src/coder_eval/agents/codex_agent.py"):
+        import ast
+
+        from tests.lint.rules.ce058_no_timing_literal import NoTimingLiteral
+
+        return NoTimingLiteral(filepath).check(ast.parse(src))
+
+    # Form 1 — a zero constructor keyword.
+    def test_flags_a_zero_generation_window_keyword(self):
+        assert self._run("m = AssistantMessage(started_at=a, completed_at=b, generation_duration_ms=0.0)")
+
+    def test_flags_a_zero_duration_on_command_telemetry(self):
+        assert self._run("t = CommandTelemetry(tool_name='Bash', duration_ms=0)")
+
+    def test_flags_the_import_alias_spelling_too(self):
+        assert self._run("m = AssistantMessageTelemetry(generation_duration_ms=0.0)")
+
+    def test_allows_none(self):
+        assert not self._run("m = AssistantMessage(generation_duration_ms=None)")
+
+    def test_allows_a_measured_value(self):
+        assert not self._run("m = AssistantMessage(generation_duration_ms=gen_ms)")
+
+    def test_ignores_a_zero_duration_on_an_unrelated_constructor(self):
+        assert not self._run("cfg = RetryPolicy(duration_ms=0.0)")
+
+    def test_ignores_a_non_timing_zero_keyword(self):
+        assert not self._run("m = AssistantMessage(output_tokens=0)")
+
+    def test_form_one_flags_only_a_zero(self):
+        # A constructor keyword is also how a legitimately MEASURED value is
+        # passed, so form 1 flags the placeholder zero every real producer
+        # wrote — not any number. Forms 2-4 stay broad: there, any invented
+        # number standing in for an unmeasured value is the defect.
+        assert not self._run("m = AssistantMessage(generation_duration_ms=1234.0)")
+        assert self._run("x = cmd.duration_ms or 5")
+
+    # Form 2 — the coalesce.
+    def test_flags_duration_or_zero(self):
+        assert self._run("x = sorted(c, key=lambda x: x.duration_ms or 0)")
+
+    def test_ignores_an_unrelated_name_coalesce(self):
+        assert not self._run("x = sample_rate_limit or 0")
+
+    def test_allows_a_non_numeric_fallback(self):
+        assert not self._run('x = cmd.duration_ms or "—"')
+
+    # Form 3 — the conditional expression, both polarities.
+    def test_flags_the_is_not_none_conditional(self):
+        assert self._run("x = cmd.duration_ms if cmd.duration_ms is not None else 0.0")
+
+    def test_flags_the_is_none_conditional(self):
+        assert self._run("x = 0.0 if cmd.duration_ms is None else cmd.duration_ms")
+
+    def test_allows_a_conditional_whose_unknown_branch_is_none(self):
+        assert not self._run("x = cmd.duration_ms if cmd.duration_ms is not None else None")
+
+    # Form 4 — the guard-and-assign. The live Claude instance's shape.
+    def test_flags_the_guard_and_assign(self):
+        src = "if cmd.duration_ms is None:\n    cmd.duration_ms = 0.0\n"
+        assert self._run(src)
+
+    def test_allows_a_guard_that_assigns_a_different_field(self):
+        # A guard on one field that sets another is not this bug.
+        src = "if cmd.duration_ms is None:\n    cmd.result_status = 'unknown'\n"
+        assert not self._run(src)
+
+    def test_allows_a_guard_on_a_different_receiver(self):
+        src = "if a.duration_ms is None:\n    b.duration_ms = 0.0\n"
+        assert not self._run(src)
+
+    def test_allows_a_guard_that_assigns_a_measured_value(self):
+        src = "if cmd.duration_ms is None:\n    cmd.duration_ms = measured\n"
+        assert not self._run(src)
+
+    # Form 5 — the model_copy(update={...}) dict, which a keyword rule cannot
+    # see and which is how CommandTelemetry.duration_ms is actually written on
+    # the Antigravity DONE path.
+    def test_flags_a_zero_timing_key_in_an_update_dict(self):
+        assert self._run('tel = start.model_copy(update={"duration_ms": 0.0})')
+
+    def test_allows_a_measured_value_in_an_update_dict(self):
+        assert not self._run('tel = start.model_copy(update={"duration_ms": tool_ms})')
+
+    def test_ignores_a_non_timing_key_in_an_update_dict(self):
+        assert not self._run('tel = start.model_copy(update={"output_tokens": 0})')
+
+    def test_ignores_a_dict_literal_that_is_not_an_update_kwarg(self):
+        # Scoped to `update=` so an unrelated fixture dict cannot fire.
+        assert not self._run('row = {"duration_ms": 0.0}')
+
+    # Scope + suppression.
+    def test_is_out_of_scope_outside_src(self):
+        assert not self._run(
+            "m = AssistantMessage(generation_duration_ms=0.0)",
+            filepath="tests/test_codex_agent.py",
+        )
+
+    def test_noqa_suppresses(self):
+        from tests.lint.runner import check_file
+
+        path = SRC / "coder_eval/agents/antigravity_agent.py"
+        assert path.is_file(), "the noqa fixture file must exist or this test passes vacuously"
+        assert not [v for v in check_file(path) if v.rule_id == "CE058"]
+
+
+class TestCE059GenerationWindowIsTwoReads:
+    """CE059 flags a generation window built from one clock read."""
+
+    @staticmethod
+    def _run(src: str, filepath: str = "src/coder_eval/agents/antigravity_agent.py"):
+        import ast
+
+        from tests.lint.rules.ce059_generation_window_is_two_reads import GenerationWindowIsTwoReads
+
+        return GenerationWindowIsTwoReads(filepath).check(ast.parse(src))
+
+    def test_flags_the_same_name_for_both_bounds(self):
+        assert self._run("m = AssistantMessage(started_at=now, completed_at=now, generation_duration_ms=0.0)")
+
+    def test_flags_an_omitted_duration_too(self):
+        # An omitted duration is not a disclaimer; the field defaults to None
+        # but the call has not said so, and the bounds still read as a window.
+        assert self._run("m = AssistantMessage(started_at=now, completed_at=now)")
+
+    def test_flags_the_alias_spelling_too(self):
+        assert self._run("m = AssistantMessageTelemetry(started_at=now, completed_at=now, generation_duration_ms=g)")
+
+    def test_allows_collapsed_bounds_when_the_call_says_no_window_exists(self):
+        # Passing None in the field built to say "unmeasurable" is the honest
+        # record, not a claim the two stamps have to support.
+        assert not self._run("m = AssistantMessage(started_at=now, completed_at=now, generation_duration_ms=None)")
+
+    def test_allows_two_different_names(self):
+        assert not self._run("m = AssistantMessage(started_at=started, completed_at=completed)")
+
+    def test_ignores_attribute_expressions(self):
+        # `self.a` vs `self.b` cannot be compared without guessing.
+        assert not self._run("m = AssistantMessage(started_at=self.mark, completed_at=self.mark)")
+
+    def test_ignores_a_call_expression(self):
+        assert not self._run("m = AssistantMessage(started_at=datetime.now(), completed_at=datetime.now())")
+
+    def test_ignores_an_unrelated_constructor(self):
+        assert not self._run("s = Span(started_at=now, completed_at=now)")
+
+    def test_is_out_of_scope_outside_agents(self):
+        assert not self._run(
+            "m = AssistantMessage(started_at=now, completed_at=now)",
+            filepath="src/coder_eval/orchestrator.py",
+        )
+
+    def test_noqa_suppresses(self):
+        from tests.lint.runner import check_file
+
+        # The Antigravity flush carries the only live instance, noqa'd until
+        # Phase 3 replaces it with a real measured window.
+        path = SRC / "coder_eval/agents/antigravity_agent.py"
+        assert path.is_file(), "the noqa fixture file must exist or this test passes vacuously"
+        assert not [v for v in check_file(path) if v.rule_id == "CE059"]
diff --git a/tests/test_models.py b/tests/test_models.py
index 60fa21a2..09784094 100644
--- a/tests/test_models.py
+++ b/tests/test_models.py
@@ -588,3 +588,59 @@ def test_rejects_relative(self):
 
         with pytest.raises(ValidationError, match="must be an absolute path"):
             DockerDriverConfig(working_dir="root")
+
+
+class TestAssistantMessageGenerationWindow:
+    """`generation_duration_ms` must be able to say "never measured".
+
+    The field was a required `float`, so a harness with no measurable window
+    had to invent one — and every producer that did wrote `0.0`, which reads
+    downstream as a real, instant generation (Antigravity's task pages showed
+    0ms of generation and a 0% breakdown for months). It is now `float | None`,
+    aligning it with `UserMessage.generation_duration_ms` in the same module.
+    """
+
+    @staticmethod
+    def _msg(**overrides):
+        from datetime import datetime
+
+        from coder_eval.models import AssistantMessage
+
+        now = datetime.now()
+        return AssistantMessage(started_at=now, completed_at=now, **overrides)
+
+    def test_omitting_it_yields_none_not_zero(self):
+        assert self._msg().generation_duration_ms is None
+
+    def test_a_measured_zero_is_still_legal(self):
+        # Only a PLACEHOLDER zero is the defect. A clamped real measurement
+        # (Antigravity subtracts tool time from its window) can be exactly 0.0.
+        assert self._msg(generation_duration_ms=0.0).generation_duration_ms == 0.0
+
+    def test_round_trip_preserves_none(self):
+        from coder_eval.models import AssistantMessage
+
+        dumped = self._msg().model_dump()
+        assert dumped["generation_duration_ms"] is None
+        assert AssistantMessage.model_validate(dumped).generation_duration_ms is None
+
+    def test_round_trip_preserves_a_value(self):
+        from coder_eval.models import AssistantMessage
+
+        dumped = self._msg(generation_duration_ms=1234.5).model_dump()
+        assert AssistantMessage.model_validate(dumped).generation_duration_ms == 1234.5
+
+    def test_a_historical_record_still_validates(self):
+        # task.json files already on disk carry a number; nothing to migrate.
+        from coder_eval.models import AssistantMessage
+
+        assert (
+            AssistantMessage.model_validate(
+                {
+                    "started_at": "2026-01-01T00:00:00",
+                    "completed_at": "2026-01-01T00:00:01",
+                    "generation_duration_ms": 1000.0,
+                }
+            ).generation_duration_ms
+            == 1000.0
+        )
diff --git a/tests/test_simulation_integration.py b/tests/test_simulation_integration.py
index 98a68207..eeed9962 100644
--- a/tests/test_simulation_integration.py
+++ b/tests/test_simulation_integration.py
@@ -323,3 +323,76 @@ async def test_simulation_pending_user_turn_prepended_to_each_turn(tmp_path, mon
     assert result.simulation.simulator_output_tokens == 14
     # End-of-dialog criteria check ran (success_criteria_results populated).
     assert result.success_criteria_results
+
+
+@pytest.mark.asyncio
+async def test_standalone_turn_records_the_simulator_call_duration(tmp_path, monkeypatch):
+    """The trailing simulator turn must report the time it actually took.
+
+    ``TurnRecord.duration_seconds`` defaults to 0.0 and no caller passed it, so
+    this turn reported 0s for a simulator call that really took seconds — and
+    ``reports_html`` divides by the turn count, halving ``avg_turn`` for every
+    simulation task.
+    """
+    _install_fake_agent(monkeypatch, scenario="success")
+    _install_fake_simulator(monkeypatch, responses=["Looks good. <<<DONE>>>"])
+
+    task = _build_task()
+    orch = Orchestrator(task=task, run_dir=tmp_path / "run" / "sim", variant_id="default")
+    result = await orch.run()
+
+    # The standalone turn is the one holding only the unconsumed simulator
+    # message — the ordinary stop-token exit.
+    standalone = result.iterations[-1]
+    assert [type(m).__name__ for m in standalone.messages] == ["UserMessage"]
+    sim_ms = standalone.messages[0].generation_duration_ms
+    assert sim_ms is not None and sim_ms > 0
+    assert standalone.duration_seconds == pytest.approx(sim_ms / 1000.0)
+    assert standalone.duration_seconds > 0
+
+    # The turn is RECORDED, not COUNTED. Every per-turn tally must describe
+    # only the turns the agent actually took, so derive the expectation from
+    # the trajectory rather than hardcoding it: the standalone turn is the one
+    # entry holding no assistant message.
+    agent_turns = [t for t in result.iterations if t is not standalone]
+    assert len(agent_turns) == len(result.iterations) - 1
+    assert result.iteration_count == len(agent_turns)
+    assert result.simulation is not None
+    assert result.simulation.total_turns == len(agent_turns)
+    # Summed over ALL iterations (orchestrator.py:1192); the standalone turn
+    # holds no assistant message, so it must contribute nothing.
+    assert result.total_assistant_turns == sum(t.assistant_turn_count for t in agent_turns)
+    assert standalone.assistant_turn_count == 0
+
+
+@pytest.mark.asyncio
+async def test_standalone_turn_holding_a_pinned_opener_records_zero(tmp_path, monkeypatch):
+    """A pinned opener has no simulator call behind it, so 0.0 is its real duration.
+
+    ``UserMessage.generation_duration_ms`` is None by design for a pinned
+    ``initial_prompt``; the branch must record 0.0 rather than raising on the
+    division.
+
+    This is a NO-RAISE guard, not a regression test: 0.0 is also what the old
+    code produced, so reverting the fix leaves it green. Its sibling above
+    (`test_standalone_turn_records_the_simulator_call_duration`) is the one
+    that fails on a revert.
+    """
+
+    async def _create(self):
+        return _ExplodingAgent("agent exploded on turn 1")
+
+    monkeypatch.setattr(Orchestrator, "_create_agent", _create)
+    _install_fake_simulator(monkeypatch, responses=["never reached"])
+
+    task = _build_task()
+    orch = Orchestrator(task=task, run_dir=tmp_path / "run" / "sim", variant_id="default")
+    result = await orch.run()
+
+    openers = [
+        t
+        for t in result.iterations
+        if [type(m).__name__ for m in t.messages] == ["UserMessage"] and t.messages[0].generation_duration_ms is None
+    ]
+    assert openers, "expected a standalone turn holding the pinned opener"
+    assert all(t.duration_seconds == 0.0 for t in openers)
diff --git a/tests/test_token_usage.py b/tests/test_token_usage.py
index 71bf6035..ed78af8b 100644
--- a/tests/test_token_usage.py
+++ b/tests/test_token_usage.py
@@ -1099,6 +1099,18 @@ def test_builds_message_with_full_breakdown(self):
         # The sub-agent's returned text becomes a text content block.
         assert result.content_blocks and result.content_blocks[0].text == "answer: 5050"
 
+    def test_records_no_generation_window(self):
+        # This generation arrives as a tool result and is never streamed, so
+        # there is no window to measure. None says that; 0.0 would claim the
+        # sub-agent answered instantly.
+        msg = self._make_msg(
+            {"agentId": "agent-abc", "usage": {"input_tokens": 1, "output_tokens": 2}},
+            result_content="done",
+        )
+        result = ClaudeCodeAgent._synthesize_subagent_terminal_message(msg, "claude-x")
+        assert result is not None
+        assert result.generation_duration_ms is None
+
     def test_returns_none_for_non_agent_tool(self):
         # Bash/Read/Write results have no agentId
         msg = self._make_msg({"status": "completed", "output": "hello"})

From 8338278ccbaa75436ee2706a918dde008d7b6b47 Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 15:19:03 -0700
Subject: [PATCH 03/10] =?UTF-8?q?fix(antigravity):=203/6=20=E2=80=94=20mea?=
 =?UTF-8?q?sure=20a=20real=20generation=20window?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reducer read `datetime.now()` once per flush and passed it as BOTH
`started_at` and `completed_at`, with a hardcoded
`generation_duration_ms=0.0`. Every Antigravity row therefore reported no
generation time at all: the task page's Generation cell read 0ms and its
thinking/tool/text breakdown rendered 0%, for months, with nothing
failing. 15% of wall clock was accounted for, against 97% on claude-code.

The window is now marked at the turn's start (both stamps from one
instant, captured in `communicate()`) and advanced by each flush that
actually emits a message — never by the early-returning no-op flush, whose
guard precedes every clock read.

Tool execution that closes inside a window is subtracted, because this
harness interleaves tool calls into one generation: the Step for the tool
arrives and only a later `usage_metadata` Step cuts the message. The
subtraction is the UNION of the closed intervals, clipped to the window —
not the sum of their durations. Antigravity resolves several calls from
one Step and backgrounds anything over ten seconds, so the intervals
overlap; summing them over-subtracts by exactly the overlap, and four
concurrent 400ms calls inside a 1000ms window would total 1600ms and clamp
the result back to the 0.0 this commit exists to remove. Clipping is the
other half: a tool that opened before the window only spent part of its
life inside it.

Do not "simplify" the subtraction to resetting the mark on tool end. A
harness-local Read can close 8ms after it opens while 6.4s of model time
separates the two flushes around it (measured:
2026-09-09_04-18-50/skill-rpa-uia-google-search), so a reset reports 8ms
and loses the 6.4s. A controlled-clock test pins this.

With the union clipped to the window, `max(0.0, ...)` is now only a
clock-jitter guard — the span is monotonic while the intervals are wall —
and a negative result logs at debug, since a clamped 0.0 is otherwise
indistinguishable from a real instant generation.

Still deliberately unaccounted (audit P2-1): time spent waiting on a tool
that is STILL open contributes nothing to any subtraction, so an
orphan-poll turn's window includes the wait.

Token buckets are untouched and `assert_reconciliation` passes unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/coder_eval/agents/antigravity_agent.py | 107 +++++-
 tests/test_antigravity_agent.py            | 384 +++++++++++++++++++++
 2 files changed, 486 insertions(+), 5 deletions(-)

diff --git a/src/coder_eval/agents/antigravity_agent.py b/src/coder_eval/agents/antigravity_agent.py
index f4db1f55..71fc5148 100644
--- a/src/coder_eval/agents/antigravity_agent.py
+++ b/src/coder_eval/agents/antigravity_agent.py
@@ -200,6 +200,35 @@ def _enum_value(x: Any) -> Any:
     return getattr(x, "value", x)
 
 
+def _busy_ms(spans: list[tuple[datetime, datetime]], lo: datetime, hi: datetime) -> float:
+    """Wall milliseconds inside ``[lo, hi]`` where at least ONE span was running.
+
+    The union, not the sum. Antigravity resolves several tool calls from one
+    ``Step`` and backgrounds anything over ten seconds, so tool intervals
+    routinely overlap; adding their durations over-counts the busy time by
+    exactly the overlap. Subtracting such a sum from a generation window
+    understates generation and, with enough concurrency, drives it negative —
+    reintroducing the ``0.0`` this whole change exists to remove (four
+    concurrent 400 ms calls inside a 1000 ms window sum to 1600 ms).
+
+    Clipping to ``[lo, hi]`` is the other half: a tool that opened before this
+    window only spent part of its life inside it, and only that part is not
+    generation time here.
+    """
+    clipped = sorted((max(s, lo), min(e, hi)) for s, e in spans if min(e, hi) > max(s, lo))
+    if not clipped:
+        return 0.0
+    total = 0.0
+    open_start, open_end = clipped[0]
+    for start, end in clipped[1:]:
+        if start > open_end:  # disjoint — bank the run and start a new one
+            total += (open_end - open_start).total_seconds() * 1000.0
+            open_start, open_end = start, end
+        else:  # overlapping or adjacent — extend the run
+            open_end = max(open_end, end)
+    return total + (open_end - open_start).total_seconds() * 1000.0
+
+
 def _to_token_usage(usage: Any, model: str | None) -> TokenUsage:
     """Map a ``google.antigravity.types.UsageMetadata`` to coder_eval ``TokenUsage``.
 
@@ -554,6 +583,7 @@ async def communicate(
 
         self._begin_turn()
         turn_start_time = time.monotonic()
+        turn_start_wall = datetime.now()
         task_id = str(self.config.type)
         model = self._effective_model()
         collector = EventCollector()
@@ -570,6 +600,7 @@ async def communicate(
             iteration=self._iteration,
             model=model,
             turn_start_time=turn_start_time,
+            turn_start_wall=turn_start_wall,
             max_turns=max_turns,
         )
 
@@ -803,6 +834,7 @@ def __init__(
         iteration: int,
         model: str,
         turn_start_time: float,
+        turn_start_wall: datetime,
         max_turns: int | None = None,
     ) -> None:
         self._agent = agent
@@ -842,6 +874,22 @@ def __init__(
         self._tool_last_status: dict[str, Any] = {}
         # Content blocks accumulated since the last per-generation flush.
         self._blocks: list[ContentBlock] = []
+        # Generation-window mark: where the CURRENT generation started. Set to
+        # the turn's own start so the first window includes prompt submission
+        # and connection setup — real time the model call cost, and the same
+        # choice Claude makes (its mark is also the turn start). Both stamps
+        # come from the SAME instant, captured by communicate(), so the
+        # recorded bounds and the measured duration describe one span.
+        # Advanced only by a flush that actually emitted a message.
+        self._gen_mark_monotonic: float = turn_start_time
+        self._gen_mark_wall: datetime = turn_start_wall
+        # Execution intervals of tools that CLOSED since the mark. This harness
+        # interleaves tool calls into one generation — the Step for the tool
+        # arrives and only a later usage_metadata Step cuts the message — so a
+        # window legitimately contains tool time that is not model time. Kept
+        # as intervals, not a running total, because they overlap (see
+        # _busy_ms).
+        self._tool_spans_since_mark: list[tuple[datetime, datetime]] = []
 
     @property
     def ended_cleanly(self) -> bool:
@@ -947,6 +995,7 @@ def _handle_tool_call(self, call: Any, step: Any, done: bool, sstatus: Any, call
             )
             completed = datetime.now()
             started = start_tel.execution_started_at or completed
+            tool_ms = max((completed - started).total_seconds() * 1000.0, 0.0)
             end_tel = start_tel.model_copy(
                 update={
                     "parameters": self._params(start_tel.tool_name, call.args, self._tool_input_keys.get(cid)),
@@ -954,9 +1003,15 @@ def _handle_tool_call(self, call: Any, step: Any, done: bool, sstatus: Any, call
                     "result_summary": str(result_text) if result_text is not None else None,
                     "error_message": (step.error or "tool failed") if errored else None,
                     "execution_completed_at": completed,
-                    "duration_ms": max((completed - started).total_seconds() * 1000.0, 0.0),
+                    "duration_ms": tool_ms,
                 }
             )
+            # This tool closed inside the open generation window, so its time is
+            # not model time. The INTERVAL is recorded, not the duration: tool
+            # calls overlap here, and only their union may be subtracted (see
+            # _busy_ms). Only the DONE path records one — a tool force-closed at
+            # finalize has duration_ms None and was never timed.
+            self._tool_spans_since_mark.append((started, completed))
             self.commands.append(end_tel)
             self.emit.on_event(
                 ToolEndEvent(
@@ -997,14 +1052,50 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
         """
         if not self._blocks and gen.is_empty():
             return
-        now = datetime.now()
+        now_monotonic = time.monotonic()
+        now_wall = datetime.now()
+        # Model-generation time = the whole window MINUS the tool executions
+        # that closed inside it.
+        #
+        # Do NOT "simplify" this to resetting the mark when a tool ends. That
+        # loses real model time: measured on run 2026-09-09_04-18-50, task
+        # skill-rpa-uia-google-search, a harness-local Read closed 8 ms after
+        # it opened while 6.4 s of model time separated the two flushes around
+        # it — a reset would have reported 8 ms and dropped the 6.4 s.
+        # Subtracting closed tool time handles that case AND its opposite (a
+        # 43 s Bash, where the model time really is the flush-to-DONE
+        # remainder).
+        #
+        # What this deliberately over-reports: time spent WAITING on a tool
+        # that is still open. Only CLOSED intervals are subtracted, so an
+        # orphaned/backgrounded call contributes nothing while the poll loop
+        # sleeps on it. That reaches two windows — the one finalize cuts when
+        # no usage_metadata ever arrived (tens of minutes on an orphan-poll
+        # task), and any ordinary window whose flush lands while the call is
+        # still open. Accounting for that wait is separate work (audit P2-1);
+        # do not read such a number as model time.
+        span_ms = (now_monotonic - self._gen_mark_monotonic) * 1000.0
+        tool_ms = _busy_ms(self._tool_spans_since_mark, self._gen_mark_wall, now_wall)
+        generation_ms = span_ms - tool_ms
+        if generation_ms < 0:
+            # _busy_ms clips to this window and unions overlaps, so it cannot
+            # exceed the window's own wall span. Reaching here means the two
+            # clocks disagree (the span is monotonic, the tool intervals are
+            # wall), i.e. jitter — worth a line in the task log, because the
+            # clamped 0.0 below is otherwise indistinguishable from a real
+            # instant generation. Numbers only: no agent output is logged.
+            self._agent._log.debug(
+                "Generation window went negative (span=%.1fms tool=%.1fms); clamping to 0.",
+                span_ms,
+                tool_ms,
+            )
         for i, block in enumerate(self._blocks):
             block.sequence = i
         self.messages.append(
             AssistantMessage(
-                started_at=now,  # noqa: CE059  # one clock read; a real window lands with the next commit
-                completed_at=now,
-                generation_duration_ms=0.0,  # noqa: CE058  # replaced with a real measured window next commit
+                started_at=self._gen_mark_wall,
+                completed_at=now_wall,
+                generation_duration_ms=max(0.0, generation_ms),
                 content_blocks=list(self._blocks),
                 tool_use_ids=[b.tool_use_id for b in self._blocks if b.block_type == "tool_use" and b.tool_use_id],
                 input_tokens=gen.uncached_input_tokens,
@@ -1017,6 +1108,12 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
         )
         self._assistant_turns += 1
         self._blocks = []
+        # Advance the mark ONLY after a message was actually appended. The
+        # early return above means a no-op flush leaves the window open, so a
+        # later real generation still measures from where it began.
+        self._gen_mark_monotonic = now_monotonic
+        self._gen_mark_wall = now_wall
+        self._tool_spans_since_mark = []
 
     def _agent_output(self) -> str:
         if self._output_parts:
diff --git a/tests/test_antigravity_agent.py b/tests/test_antigravity_agent.py
index b4b6b837..29c09254 100644
--- a/tests/test_antigravity_agent.py
+++ b/tests/test_antigravity_agent.py
@@ -8,6 +8,8 @@
 import os
 import sys
 from collections.abc import Callable
+from datetime import datetime, timedelta
+from itertools import pairwise
 from types import ModuleType, SimpleNamespace
 from typing import Any
 
@@ -24,6 +26,7 @@
 from coder_eval.models import AgentKind, AntigravityAgentConfig, parse_agent_config
 from coder_eval.plugins import ensure_plugins_loaded
 from coder_eval.pricing import calculate_cost
+from tests._fixtures.golden_streams._scrub import assert_reconciliation
 
 
 def test_antigravity_registered_to_agent_and_config():
@@ -1565,3 +1568,384 @@ async def test_cap_reached_on_a_poll_redrain_stops_polling(monkeypatch):
     assert [c.tool_id for c in record.commands if c.result_status == "unknown"] == ["bg2"]
     assert conv.receive_steps_call_count == 2  # initial drain + one poll re-drain, then stop
     assert conv.cancel_call_count == 1
+
+
+# ---------------------------------------------------------------------------
+# Generation window
+#
+# Antigravity used to read datetime.now() ONCE per flush and pass it as both
+# bounds with generation_duration_ms=0.0, so every task page reported 0ms of
+# generation. The reducer now measures a real window and subtracts the tool
+# executions that closed inside it — this harness interleaves tool calls into
+# one generation, so a window legitimately contains time that is not model time.
+# ---------------------------------------------------------------------------
+
+_CLOCK_BASE = datetime(2026, 1, 1, 12, 0, 0)
+
+
+class _Clock:
+    """Controlled stand-in for the two clocks the reducer reads.
+
+    ONE monotonically advancing counter, read by both clocks: every read —
+    `time.monotonic()` or `datetime.now()` — costs TICK_MS. So the fixture's
+    timeline is driven by read ORDER, not by elapsed time, and the two clocks
+    are deliberately coupled rather than independent. That is enough to pin
+    the arithmetic exactly; it is NOT a cross-check that the reducer keeps the
+    two clocks in their proper roles (a variant deriving the span from the
+    wall stamps would pass every test here). The module's only clock uses are
+    `time.monotonic` and `datetime.now`, so patching these two covers it.
+    """
+
+    TICK_MS = 100.0
+
+    def __init__(self) -> None:
+        self.ms = 0.0
+
+    def _advance(self) -> float:
+        self.ms += self.TICK_MS
+        return self.ms
+
+    def monotonic(self) -> float:
+        return self._advance() / 1000.0
+
+    def now(self) -> datetime:
+        return _CLOCK_BASE + timedelta(milliseconds=self._advance())
+
+
+def _install_clock(monkeypatch, clock: _Clock) -> None:
+    import coder_eval.agents.antigravity_agent as agent_module
+
+    monkeypatch.setattr(agent_module, "time", SimpleNamespace(monotonic=clock.monotonic))
+    monkeypatch.setattr(agent_module, "datetime", SimpleNamespace(now=clock.now))
+
+
+def _assistant(record):
+    return [m for m in record.messages if m.role == "assistant"]
+
+
+class TestBusyMs:
+    """`_busy_ms` is the UNION of tool intervals, clipped to the window.
+
+    A scalar sum was wrong twice over: overlapping tools (this harness
+    resolves several calls from one Step and backgrounds anything over ten
+    seconds) get counted more than once, and a tool that opened before the
+    window gets charged in full to it. Subtracting such a sum from a
+    generation window understates generation and, with enough concurrency,
+    drives it negative — reintroducing the 0.0 this change removes.
+    """
+
+    @staticmethod
+    def _at(ms: float) -> datetime:
+        return _CLOCK_BASE + timedelta(milliseconds=ms)
+
+    def _busy(self, spans, lo=0, hi=10_000) -> float:
+        from coder_eval.agents.antigravity_agent import _busy_ms
+
+        return _busy_ms([(self._at(s), self._at(e)) for s, e in spans], self._at(lo), self._at(hi))
+
+    def test_no_spans_is_zero(self):
+        assert self._busy([]) == 0.0
+
+    def test_a_single_span_is_its_own_length(self):
+        assert self._busy([(100, 400)]) == 300.0
+
+    def test_disjoint_spans_add(self):
+        assert self._busy([(100, 200), (500, 700)]) == 300.0
+
+    def test_overlapping_spans_count_once(self):
+        # The defect: summing gives 400, but only 300ms of wall time was busy.
+        assert self._busy([(100, 300), (200, 400)]) == 300.0
+
+    def test_a_contained_span_adds_nothing(self):
+        assert self._busy([(100, 900), (300, 400)]) == 800.0
+
+    def test_adjacent_spans_merge_without_double_counting_the_seam(self):
+        assert self._busy([(100, 200), (200, 300)]) == 200.0
+
+    def test_input_order_does_not_matter(self):
+        assert self._busy([(500, 700), (100, 300), (200, 400)]) == 500.0
+
+    def test_a_span_is_clipped_to_the_window(self):
+        # Opened before the window and closed after it: only the overlap counts.
+        assert self._busy([(0, 5_000)], lo=1_000, hi=1_500) == 500.0
+
+    def test_a_span_entirely_outside_the_window_is_dropped(self):
+        assert self._busy([(0, 500)], lo=1_000, hi=2_000) == 0.0
+
+    def test_a_zero_length_span_is_dropped(self):
+        assert self._busy([(100, 100)]) == 0.0
+
+
+async def test_concurrent_tools_do_not_over_subtract(monkeypatch):
+    """Overlapping tool calls are subtracted once, not once each.
+
+    Four calls opened by one Step and closed by the next overlap almost
+    entirely. Summing their durations exceeded the window and clamped
+    `generation_duration_ms` to 0.0 — the pre-change symptom, with a 0%
+    breakdown on the task page and nothing failing.
+    """
+    _install_clock(monkeypatch, _Clock())
+    opens = _step(
+        "TOOL_CALL",
+        "ACTIVE",
+        target="TARGET_ENVIRONMENT",
+        tool_calls=[_tc("run_command", f"t{i}", {"command_line": f"job{i}"}) for i in range(4)],
+    )
+    closes = _step(
+        "TOOL_CALL",
+        "DONE",
+        target="TARGET_ENVIRONMENT",
+        tool_calls=[_tc("run_command", f"t{i}", {"command_line": f"job{i}", "exit_code": 0}) for i in range(4)],
+    )
+    steps = [
+        _step("THINKING", "DONE", thinking="first", usage=_usage(100, 0, 5, 5)),
+        opens,
+        closes,
+        _step("THINKING", "DONE", thinking="second", usage=_usage(100, 0, 5, 5)),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    second = _assistant(record)[1]
+    tools = [c for c in record.commands if c.tool_id.startswith("t")]
+    assert len(tools) == 4
+    span_ms = (second.completed_at - second.started_at).total_seconds() * 1000.0
+    summed_ms = sum(c.duration_ms or 0.0 for c in tools)
+
+    assert summed_ms > span_ms, "fixture must make the naive sum exceed the window"
+    assert second.generation_duration_ms > 0, "the naive sum clamped this to 0.0"
+    # Union of the four overlapping intervals, not their sum.
+    busy_ms = (
+        max(c.execution_completed_at for c in tools) - min(c.execution_started_at for c in tools)
+    ).total_seconds() * 1000.0
+    assert second.generation_duration_ms == pytest.approx(span_ms - busy_ms)
+
+
+async def test_generation_window_is_measured_not_zero():
+    """Every streaming generation reports a real, positive window.
+
+    Asserts the PROPERTY, not a millisecond value — this runs on the real
+    clock, so only the shape is deterministic.
+    """
+    steps = [
+        _step("THINKING", "DONE", thinking="first", usage=_usage(100, 0, 5, 5)),
+        _step("THINKING", "DONE", thinking="second", usage=_usage(120, 0, 6, 4)),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    messages = _assistant(record)
+    assert len(messages) == 2
+    for m in messages:
+        assert m.generation_duration_ms is not None
+        assert m.generation_duration_ms > 0
+        assert m.started_at < m.completed_at
+
+
+async def test_consecutive_windows_chain_end_to_start():
+    """Message n+1 begins where message n ended — the mark IS the previous flush."""
+    steps = [
+        _step("THINKING", "DONE", thinking="a", usage=_usage(100, 0, 5, 5)),
+        _step("THINKING", "DONE", thinking="b", usage=_usage(100, 0, 5, 5)),
+        _step("TEXT_RESPONSE", "DONE", content="c", content_delta="c", complete=True, usage=_usage(100, 0, 5, 0)),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    messages = _assistant(record)
+    assert len(messages) == 3
+    for earlier, later in pairwise(messages):
+        assert later.started_at == earlier.completed_at
+
+
+async def test_tool_execution_is_subtracted_from_the_window(monkeypatch):
+    """A tool closing inside a generation is not counted as model time.
+
+    This is the test that pins the design decision. Without it, "simplifying"
+    the subtraction to a reset-on-tool-end passes everything else — and loses
+    real model time, because a harness-local tool can close 8 ms after it opens
+    while seconds of model time separate the two flushes around it.
+    """
+    clock = _Clock()
+    _install_clock(monkeypatch, clock)
+    steps = [
+        _step("THINKING", "DONE", thinking="plan", usage=_usage(100, 0, 5, 5)),
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls"})],
+        ),
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls", "exit_code": 0})],
+        ),
+        _step(
+            "TEXT_RESPONSE", "DONE", content="done", content_delta="done", complete=True, usage=_usage(200, 0, 10, 0)
+        ),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    messages = _assistant(record)
+    assert len(messages) == 2
+    second = messages[1]
+    bash = next(c for c in record.commands if c.tool_name == "Bash")
+
+    # The window spans 400ms of wall clock and contains a 100ms tool call, so
+    # 300ms of it was the model generating. Cross-checked against the recorded
+    # bounds, which come from the OTHER clock the reducer reads.
+    span_ms = (second.completed_at - second.started_at).total_seconds() * 1000.0
+    assert bash.duration_ms == pytest.approx(100.0)
+    assert span_ms == pytest.approx(400.0)
+    assert second.generation_duration_ms == pytest.approx(span_ms - bash.duration_ms)
+    assert second.generation_duration_ms == pytest.approx(300.0)
+
+
+async def test_a_straddling_tool_is_charged_only_for_its_in_window_part(monkeypatch):
+    """A tool open across a flush is clipped to the window it is subtracted from.
+
+    `t1` opens before the first flush and closes after it. Only the part that
+    elapsed INSIDE the second window is not generation time there; charging
+    its full duration would understate generation and, with a long enough
+    overhang, drive the result to a clamped 0.0 — the very value this change
+    exists to stop publishing.
+    """
+    _install_clock(monkeypatch, _Clock())
+    steps = [
+        # t1 opens here and stays open across the first flush.
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "slow"})],
+        ),
+        # t2 opens and closes entirely inside the first window.
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t2", {"command_line": "quick"})],
+        ),
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t2", {"command_line": "quick", "exit_code": 0})],
+        ),
+        _step("THINKING", "DONE", thinking="first", usage=_usage(100, 0, 5, 5)),
+        # t1 closes in the SECOND window, carrying the first window's overhang.
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "slow", "exit_code": 0})],
+        ),
+        _step("THINKING", "DONE", thinking="second", usage=_usage(100, 0, 5, 5)),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    second = _assistant(record)[1]
+    slow = next(c for c in record.commands if c.tool_id == "t1")
+    span_ms = (second.completed_at - second.started_at).total_seconds() * 1000.0
+    in_window_ms = (slow.execution_completed_at - second.started_at).total_seconds() * 1000.0
+
+    assert slow.duration_ms > span_ms, "fixture must produce a straddling tool"
+    assert 0 < in_window_ms < slow.duration_ms, "part of the tool ran before this window"
+    assert second.generation_duration_ms == pytest.approx(span_ms - in_window_ms)
+    assert second.generation_duration_ms > 0
+
+
+async def test_a_no_op_flush_does_not_move_the_mark(monkeypatch):
+    """An empty generation must leave the open window alone.
+
+    The early return in `_flush_generation` sits before any mark handling, so
+    a usage_metadata step carrying nothing must not restart the measurement —
+    otherwise the real generation that follows reports only the time since the
+    empty one.
+    """
+    real = _step("THINKING", "DONE", thinking="real", usage=_usage(100, 0, 5, 5))
+    # Zero usage and no content: reaches the flush, appends nothing.
+    empty = _step("THINKING", "DONE", usage=_usage(0, 0, 0, 0))
+
+    # Two runs off identical fresh clocks. The empty flush returns before any
+    # clock read, so it must leave the window — and therefore the real
+    # generation's recorded bounds — byte-identical.
+    _install_clock(monkeypatch, _Clock())
+    without = _assistant(await _agent_with_steps([real]).communicate("go"))
+
+    _install_clock(monkeypatch, _Clock())
+    with_empty = _assistant(await _agent_with_steps([empty, real]).communicate("go"))
+
+    assert len(with_empty) == 1, "the empty generation must not produce a message"
+    assert with_empty[0].started_at == without[0].started_at
+    assert with_empty[0].generation_duration_ms == without[0].generation_duration_ms
+
+
+async def test_generation_and_tool_time_account_for_the_turn():
+    """Σ generation + Σ tool execution lands inside the turn's own duration.
+
+    Bounds, not equality: the fake conversation's own overhead sits in the
+    residual. Before this change the generation half was identically 0.
+    """
+    steps = [
+        _step("THINKING", "DONE", thinking="plan", usage=_usage(100, 0, 5, 5)),
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls"})],
+        ),
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls", "exit_code": 0})],
+        ),
+        _step(
+            "TEXT_RESPONSE", "DONE", content="done", content_delta="done", complete=True, usage=_usage(200, 0, 10, 0)
+        ),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    gen_ms = sum(m.generation_duration_ms or 0.0 for m in _assistant(record))
+    tool_ms = sum(c.duration_ms or 0.0 for c in record.commands)
+    turn_ms = record.duration_seconds * 1000.0
+
+    assert gen_ms > 0
+    assert gen_ms + tool_ms <= turn_ms
+    assert gen_ms + tool_ms >= 0.5 * turn_ms
+
+
+async def test_timing_change_moves_no_token_bucket():
+    """The window is three timing fields; the token buckets must not shift.
+
+    Runs on a stream that also exercises the new timing, so a regression in
+    `_flush_generation` shows up here as a token failure too.
+    """
+    steps = [
+        _step("THINKING", "DONE", thinking="plan", usage=_usage(1000, 0, 10, 20)),
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls"})],
+        ),
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "ls", "exit_code": 0})],
+            usage=_usage(1200, 0, 15, 5),
+        ),
+        _step(
+            "TEXT_RESPONSE", "DONE", content="done", content_delta="done", complete=True, usage=_usage(1300, 0, 30, 0)
+        ),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    assert record.token_usage is not None
+    assert record.token_usage.output_tokens == (10 + 20) + (15 + 5) + (30 + 0)
+    assert record.token_usage.uncached_input_tokens == 1000 + 1200 + 1300
+    # The reconciliation invariant, via the shared SSOT helper rather than a
+    # local re-implementation of two of its four buckets.
+    assert_reconciliation(record.model_dump(mode="json"))
+    assert all(m.generation_duration_ms is not None for m in _assistant(record))

From 8bc547260e0983f004ac698bbeec34b1975d5d1e Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 16:01:07 -0700
Subject: [PATCH 04/10] =?UTF-8?q?fix(codex):=204/6=20=E2=80=94=20real=20to?=
 =?UTF-8?q?ol-execution=20bounds,=20and=20stop=20double-counting=20them?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Codex SDK reports `started_at_ms` and `completed_at_ms` on every item
notification. The agent read the start (for message windows) and threw both
away for telemetry, publishing the SDK item's own `duration_ms` instead:
`0.0` for 70 of 211 commands in one nightly, absent for 25 more, and no
`execution_started_at` / `execution_completed_at` at all, so no Codex tool
call could be placed on a timeline.

One `_item_timing` helper now resolves timing for all three telemetry
builders, so a command, a file change and an MCP call cannot disagree.
Both raw stamps are checked BEFORE conversion — `_ms_to_dt(None)` is
`datetime.now()`, so pairing a real stamp with a missing one would
fabricate an interval running to the present moment. Without stamps the
SDK's own duration is used only when it reports something: a `0` there is
an unreported duration, not an instant command. `timestamp` becomes the
tool's own start rather than `datetime.now()` at completion, which placed
every call after its own execution; nothing orders on it
(`collector._ordered_commands` sorts on `sequence_number`).

Orphans keep their known start — the SDK marks `started_at_ms` required,
so it IS knowable — while completion and duration stay None. Codex was the
only harness whose unresolved calls could not be placed on a timeline.

Publishing those bounds exposed a double-count the plan had assumed away.
`_flush_message`'s generation window is seeded from the first item's start
and extended to the LAST item's completion, so any generation containing a
tool call already contains that tool's execution: a tool-only emission
reported 250ms of "generation" beside a 250ms `echo hi`, and a collab
scenario put 1790ms of generation-plus-tool inside a 900ms window. Left
alone, the task page's new Unaccounted cell would have read -98% on every
Codex row. The window now subtracts the union of the closed tool intervals
clipped to it — the same treatment, and now the same shared helper
(`agents/_timing.py::busy_ms`, moved out of the Antigravity agent), as the
previous commit. Generation + tool execution equals the window exactly.

The golden snapshots cannot catch a swapped stamp — the scrubber masks
every non-null timestamp, so they assert presence, not value — so the
wiring has its own end-to-end test that reads the values back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/coder_eval/agents/_timing.py              |  42 +++++
 src/coder_eval/agents/antigravity_agent.py    |  38 +---
 src/coder_eval/agents/codex_agent.py          | 169 ++++++++++++++++--
 .../golden_streams/codex_fixtures.py          |  49 +++--
 .../expected/codex_b_command_execution.json   |   4 +-
 .../codex_d_cross_flush_is_error.json         |   4 +-
 .../expected/codex_e_orphan_tool.json         |   2 +-
 .../expected/codex_f_collab_fallback.json     |  12 +-
 tests/test_antigravity_agent.py               |   6 +-
 tests/test_codex_agent.py                     | 138 +++++++++++++-
 tests/test_codex_agent_unit.py                | 149 +++++++++++++++
 tests/test_command_statistics.py              |  37 ++++
 12 files changed, 573 insertions(+), 77 deletions(-)
 create mode 100644 src/coder_eval/agents/_timing.py

diff --git a/src/coder_eval/agents/_timing.py b/src/coder_eval/agents/_timing.py
new file mode 100644
index 00000000..6d568e56
--- /dev/null
+++ b/src/coder_eval/agents/_timing.py
@@ -0,0 +1,42 @@
+"""Shared timing helpers for agent implementations.
+
+Two harnesses interleave tool execution into a single generation window —
+Antigravity (the Step for the tool arrives and only a later ``usage_metadata``
+Step cuts the message) and Codex (``_flush_message``'s window is extended to
+the last item's ``completed_at_ms``). Both must therefore subtract the tool
+time from the window before publishing ``generation_duration_ms``, and both
+must subtract the same thing: the UNION of the closed intervals, clipped to
+the window.
+"""
+
+from datetime import datetime
+
+
+def busy_ms(spans: list[tuple[datetime, datetime]], lo: datetime, hi: datetime) -> float:
+    """Wall milliseconds inside ``[lo, hi]`` where at least ONE span was running.
+
+    The union, not the sum. Tool intervals overlap in practice — Antigravity
+    resolves several calls from one ``Step`` and backgrounds anything over ten
+    seconds; Codex spawns collab agents that run concurrently — so adding
+    their durations over-counts the busy time by exactly the overlap.
+    Subtracting such a sum from a generation window understates generation
+    and, with enough concurrency, drives it negative: four concurrent 400 ms
+    calls inside a 1000 ms window sum to 1600 ms, clamping the result to the
+    ``0.0`` that "unknown timing says unknown" exists to eliminate.
+
+    Clipping to ``[lo, hi]`` is the other half: a tool that opened before this
+    window only spent part of its life inside it, and only that part is not
+    generation time here.
+    """
+    clipped = sorted((max(s, lo), min(e, hi)) for s, e in spans if min(e, hi) > max(s, lo))
+    if not clipped:
+        return 0.0
+    total = 0.0
+    open_start, open_end = clipped[0]
+    for start, end in clipped[1:]:
+        if start > open_end:  # disjoint — bank the run and start a new one
+            total += (open_end - open_start).total_seconds() * 1000.0
+            open_start, open_end = start, end
+        else:  # overlapping or adjacent — extend the run
+            open_end = max(open_end, end)
+    return total + (open_end - open_start).total_seconds() * 1000.0
diff --git a/src/coder_eval/agents/antigravity_agent.py b/src/coder_eval/agents/antigravity_agent.py
index 71fc5148..6432114d 100644
--- a/src/coder_eval/agents/antigravity_agent.py
+++ b/src/coder_eval/agents/antigravity_agent.py
@@ -31,6 +31,7 @@
 
 from coder_eval.agent import Agent, AgentState
 from coder_eval.agents._logging import PrefixedAdapter
+from coder_eval.agents._timing import busy_ms
 from coder_eval.agents.registry import AgentRegistry
 from coder_eval.agents.watchdog import ThreadedWatchdog
 from coder_eval.config import settings
@@ -200,35 +201,6 @@ def _enum_value(x: Any) -> Any:
     return getattr(x, "value", x)
 
 
-def _busy_ms(spans: list[tuple[datetime, datetime]], lo: datetime, hi: datetime) -> float:
-    """Wall milliseconds inside ``[lo, hi]`` where at least ONE span was running.
-
-    The union, not the sum. Antigravity resolves several tool calls from one
-    ``Step`` and backgrounds anything over ten seconds, so tool intervals
-    routinely overlap; adding their durations over-counts the busy time by
-    exactly the overlap. Subtracting such a sum from a generation window
-    understates generation and, with enough concurrency, drives it negative —
-    reintroducing the ``0.0`` this whole change exists to remove (four
-    concurrent 400 ms calls inside a 1000 ms window sum to 1600 ms).
-
-    Clipping to ``[lo, hi]`` is the other half: a tool that opened before this
-    window only spent part of its life inside it, and only that part is not
-    generation time here.
-    """
-    clipped = sorted((max(s, lo), min(e, hi)) for s, e in spans if min(e, hi) > max(s, lo))
-    if not clipped:
-        return 0.0
-    total = 0.0
-    open_start, open_end = clipped[0]
-    for start, end in clipped[1:]:
-        if start > open_end:  # disjoint — bank the run and start a new one
-            total += (open_end - open_start).total_seconds() * 1000.0
-            open_start, open_end = start, end
-        else:  # overlapping or adjacent — extend the run
-            open_end = max(open_end, end)
-    return total + (open_end - open_start).total_seconds() * 1000.0
-
-
 def _to_token_usage(usage: Any, model: str | None) -> TokenUsage:
     """Map a ``google.antigravity.types.UsageMetadata`` to coder_eval ``TokenUsage``.
 
@@ -888,7 +860,7 @@ def __init__(
         # arrives and only a later usage_metadata Step cuts the message — so a
         # window legitimately contains tool time that is not model time. Kept
         # as intervals, not a running total, because they overlap (see
-        # _busy_ms).
+        # busy_ms).
         self._tool_spans_since_mark: list[tuple[datetime, datetime]] = []
 
     @property
@@ -1009,7 +981,7 @@ def _handle_tool_call(self, call: Any, step: Any, done: bool, sstatus: Any, call
             # This tool closed inside the open generation window, so its time is
             # not model time. The INTERVAL is recorded, not the duration: tool
             # calls overlap here, and only their union may be subtracted (see
-            # _busy_ms). Only the DONE path records one — a tool force-closed at
+            # busy_ms). Only the DONE path records one — a tool force-closed at
             # finalize has duration_ms None and was never timed.
             self._tool_spans_since_mark.append((started, completed))
             self.commands.append(end_tel)
@@ -1075,10 +1047,10 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
         # still open. Accounting for that wait is separate work (audit P2-1);
         # do not read such a number as model time.
         span_ms = (now_monotonic - self._gen_mark_monotonic) * 1000.0
-        tool_ms = _busy_ms(self._tool_spans_since_mark, self._gen_mark_wall, now_wall)
+        tool_ms = busy_ms(self._tool_spans_since_mark, self._gen_mark_wall, now_wall)
         generation_ms = span_ms - tool_ms
         if generation_ms < 0:
-            # _busy_ms clips to this window and unions overlaps, so it cannot
+            # busy_ms clips to this window and unions overlaps, so it cannot
             # exceed the window's own wall span. Reaching here means the two
             # clocks disagree (the span is monotonic, the tool intervals are
             # wall), i.e. jitter — worth a line in the task log, because the
diff --git a/src/coder_eval/agents/codex_agent.py b/src/coder_eval/agents/codex_agent.py
index 872ca0bc..b7577f3d 100644
--- a/src/coder_eval/agents/codex_agent.py
+++ b/src/coder_eval/agents/codex_agent.py
@@ -17,6 +17,7 @@
 
 from coder_eval.agent import Agent, AgentState
 from coder_eval.agents._logging import PrefixedAdapter, log_raw_sdk_event
+from coder_eval.agents._timing import busy_ms
 from coder_eval.agents.registry import AgentRegistry
 from coder_eval.agents.watchdog import ThreadedWatchdog
 from coder_eval.config import settings
@@ -179,6 +180,64 @@ def _ms_to_dt(ms: int | None) -> datetime:
     return datetime.fromtimestamp(ms / 1000)
 
 
+class _ItemTiming(NamedTuple):
+    """When a Codex tool item ran, as the four fields CommandTelemetry records."""
+
+    timestamp: datetime
+    execution_started_at: datetime | None
+    execution_completed_at: datetime | None
+    duration_ms: float | None
+
+
+def _item_timing(started_ms: int | None, completed_ms: int | None, sdk_duration_ms: float | None) -> _ItemTiming:
+    """Resolve a tool item's timing from the SDK's millisecond stamps.
+
+    One helper for all three telemetry builders, so a command, a file change
+    and an MCP call cannot disagree about what a missing stamp means.
+
+    BOTH stamps or neither. Pairing a real stamp with ``_ms_to_dt(None)`` —
+    which is ``datetime.now()`` — would fabricate an interval out of one
+    reading and the current time, so the raw ``int | None`` values are checked
+    BEFORE conversion, never after.
+
+    With both present, ``timestamp`` becomes the tool's own start. It used to
+    be ``datetime.now()`` at COMPLETION, which places the call after its own
+    execution. Ordering is unaffected either way: ``TurnRecord.commands`` is
+    sorted on ``sequence_number`` (``collector._ordered_commands``).
+
+    Without them, the SDK item's own ``duration_ms`` is used only when it
+    reports something. A ``0`` (or, defensively, a negative) there is an
+    UNREPORTED duration, not an instant command — 70 of 211 commands in one
+    nightly reported ``0`` for calls the message gaps show took seconds — so
+    it becomes ``None`` and leaves both sides of every average instead of
+    dragging them toward zero.
+
+    ``generation_completed_at`` is deliberately absent from this tuple, for
+    all three builders: it means "when the model finished emitting the
+    ``tool_use`` block", which Codex's stream does not carry per tool.
+    Deriving it from the flush time would be a guess.
+    """
+    if started_ms is not None and completed_ms is not None:
+        started = _ms_to_dt(started_ms)
+        return _ItemTiming(
+            timestamp=started,
+            execution_started_at=started,
+            execution_completed_at=_ms_to_dt(completed_ms),
+            # Clamped for clock skew; both bounds stay as reported so the
+            # anomaly remains visible in the record.
+            duration_ms=max(0.0, float(completed_ms - started_ms)),
+        )
+    # Explicit `is None or <= 0`, never `sdk_duration_ms or None` — that is
+    # the CE058 coalesce read backwards, and it hides the decision being made.
+    duration = None if sdk_duration_ms is None or sdk_duration_ms <= 0 else float(sdk_duration_ms)
+    return _ItemTiming(
+        timestamp=datetime.now(),
+        execution_started_at=None,
+        execution_completed_at=None,
+        duration_ms=duration,
+    )
+
+
 def _status_value(status: Any) -> str:
     """Normalize a Codex status (enum or str) to its lowercase string value."""
     value = getattr(status, "value", status)
@@ -397,7 +456,25 @@ def _flush_message(self, last: Any) -> None:
         action_blocks = [b for b in self.open_blocks if b.block_type != "thinking"]
         started = _ms_to_dt(self.open_start_ms)
         completed = _ms_to_dt(self.open_end_ms if self.open_end_ms is not None else self.open_start_ms)
-        gen_ms = max((completed - started).total_seconds() * 1000.0, 0.0)
+        # The window is seeded from the first item's start and extended to the
+        # LAST item's completion, so for any generation containing a tool call
+        # it already CONTAINS that tool's execution. Publishing the raw span as
+        # generation time double-counts it against the tool's own duration_ms:
+        # a tool-only emission reported 250ms of "generation" for a 250ms
+        # `echo hi`, and the task page's Generation + Tool exec then exceeded
+        # the wall clock they must reconcile to.
+        #
+        # Same treatment, and the same shared helper, as Antigravity: subtract
+        # the UNION of the closed tool intervals clipped to this window. A sum
+        # would over-subtract wherever they overlap, which Codex produces
+        # natively via concurrent collab agents.
+        tool_spans = [
+            (c.execution_started_at, c.execution_completed_at)
+            for c in self.commands
+            if c.execution_started_at is not None and c.execution_completed_at is not None
+        ]
+        span_ms = max((completed - started).total_seconds() * 1000.0, 0.0)
+        gen_ms = max(0.0, span_ms - busy_ms(tool_spans, started, completed))
         message_id = f"{self.turn_id}-msg-{self.gen_index}"
 
         # Output split: reasoning portion to the thinking row, the remainder to
@@ -498,10 +575,17 @@ def on_item_started(self, notification: Any) -> None:
         if root_type is not None and root_type not in _CONTENT_ITEM_TYPES:
             tool_id = item_id or f"{root_type}_{self.next_sequence}"
             self.seq_by_id[tool_id] = self.next_sequence
+            # The start stamp is known HERE, so record it on the start
+            # telemetry too. close_open_tools publishes this object verbatim
+            # for an orphan, and without it Codex was the only harness whose
+            # unresolved tool calls could not be placed on a timeline at all
+            # (OpenCode, Pi and Antigravity all set it at tool start).
+            started_at = _ms_to_dt(started_at_ms) if started_at_ms is not None else None
             start_tel = CommandTelemetry(
                 tool_name=self._agent._tool_name(root_type),
                 tool_id=tool_id,
-                timestamp=datetime.now(),
+                timestamp=started_at or datetime.now(),
+                execution_started_at=started_at,
                 parameters=self._agent._tool_parameters(root, root_type),
                 sequence_number=self.next_sequence,
             )
@@ -527,7 +611,18 @@ def on_item_completed(self, notification: Any) -> None:
             # This tool is now resolved — drop it from the orphan set.
             self.open_tools.pop(tool_id, None)
 
-            telemetry, is_error = self._agent._telemetry_for_item(root, root_type, tool_id, seq)
+            # The SDK reports both ends of the execution; `on_item_started`
+            # banked the start. Passing them in is what lets the builders
+            # record real execution bounds instead of a duration the SDK often
+            # leaves at 0.
+            telemetry, is_error = self._agent._telemetry_for_item(
+                root,
+                root_type,
+                tool_id,
+                seq,
+                started_ms=self.start_ms_by_id.get(tool_id),
+                completed_ms=completed_ms,
+            )
             if telemetry:
                 self.commands.append(telemetry)
             self.emit.on_event(
@@ -1702,26 +1797,46 @@ def _tool_parameters(self, root: Any, root_type: str | None) -> dict[str, Any]:
         return {}
 
     def _telemetry_for_item(
-        self, root: Any, root_type: str | None, tool_id: str, seq: int
+        self,
+        root: Any,
+        root_type: str | None,
+        tool_id: str,
+        seq: int,
+        *,
+        started_ms: int | None = None,
+        completed_ms: int | None = None,
     ) -> tuple[CommandTelemetry | None, bool]:
         """Build (telemetry, is_error) for a completed tool item.
 
         commandExecution/fileChange keep their dedicated rich extractors; every
         other tool kind routes through the generic builder so it still produces
         countable telemetry.
+
+        The SDK's millisecond stamps arrive as arguments rather than being read
+        back out of the reducer, so each builder stays a pure function of what
+        it is given.
         """
         if root_type == "commandExecution":
             exit_code = getattr(root, "exit_code", None)
-            return self._extract_command_telemetry(root, seq), exit_code != 0
+            return self._extract_command_telemetry(root, seq, started_ms, completed_ms), exit_code != 0
         if root_type == "fileChange":
             changes = getattr(root, "changes", []) or []
             status_str = _status_value(getattr(root, "status", "completed"))
             failed = status_str in _FILE_CHANGE_FAILURE_STATUSES
-            return self._extract_file_change_telemetry(tool_id, changes, status_str, seq), failed
-        return self._extract_generic_telemetry(root, root_type, tool_id, seq)
+            return (
+                self._extract_file_change_telemetry(tool_id, changes, status_str, seq, started_ms, completed_ms),
+                failed,
+            )
+        return self._extract_generic_telemetry(root, root_type, tool_id, seq, started_ms, completed_ms)
 
     def _extract_generic_telemetry(
-        self, root: Any, root_type: str | None, tool_id: str, seq: int
+        self,
+        root: Any,
+        root_type: str | None,
+        tool_id: str,
+        seq: int,
+        started_ms: int | None = None,
+        completed_ms: int | None = None,
     ) -> tuple[CommandTelemetry | None, bool]:
         """CommandTelemetry for any tool item without a dedicated extractor.
 
@@ -1733,13 +1848,15 @@ def _extract_generic_telemetry(
             err = getattr(root, "error", None)
             success = getattr(root, "success", None)
             is_error = bool(err) or success is False or status_str in _FILE_CHANGE_FAILURE_STATUSES
-            duration_ms = getattr(root, "duration_ms", None)
+            timing = _item_timing(started_ms, completed_ms, getattr(root, "duration_ms", None))
             return (
                 CommandTelemetry(
                     tool_name=self._tool_name(root_type),
                     tool_id=tool_id,
-                    timestamp=datetime.now(),
-                    duration_ms=float(duration_ms) if duration_ms is not None else None,
+                    timestamp=timing.timestamp,
+                    execution_started_at=timing.execution_started_at,
+                    execution_completed_at=timing.execution_completed_at,
+                    duration_ms=timing.duration_ms,
                     parameters=self._tool_parameters(root, root_type),
                     result_status="error" if is_error else ("success" if status_str else "unknown"),
                     result_summary=self._summarize_tool_item(root, root_type),
@@ -2162,7 +2279,13 @@ def _subagent_text_message(
             parent_tool_use_id=parent_tool_use_id,
         )
 
-    def _extract_command_telemetry(self, command_item: Any, sequence: int) -> CommandTelemetry | None:
+    def _extract_command_telemetry(
+        self,
+        command_item: Any,
+        sequence: int,
+        started_ms: int | None = None,
+        completed_ms: int | None = None,
+    ) -> CommandTelemetry | None:
         """Extract CommandTelemetry from a CommandExecutionThreadItem.
 
         Maps Codex command execution details to the CommandTelemetry format used by Claude Code.
@@ -2199,11 +2322,14 @@ def _extract_command_telemetry(self, command_item: Any, sequence: int) -> Comman
             # Build parameters from command string
             parameters = {"command": command}
 
+            timing = _item_timing(started_ms, completed_ms, duration_ms)
             return CommandTelemetry(
                 tool_name="Bash",
                 tool_id=command_id,
-                timestamp=datetime.now(),
-                duration_ms=float(duration_ms) if duration_ms is not None else None,
+                timestamp=timing.timestamp,
+                execution_started_at=timing.execution_started_at,
+                execution_completed_at=timing.execution_completed_at,
+                duration_ms=timing.duration_ms,
                 parameters=parameters,
                 result_status=result_status,
                 result_summary=result_summary,
@@ -2216,7 +2342,13 @@ def _extract_command_telemetry(self, command_item: Any, sequence: int) -> Comman
             return None
 
     def _extract_file_change_telemetry(
-        self, change_id: str, changes: Any, status: Any, sequence: int
+        self,
+        change_id: str,
+        changes: Any,
+        status: Any,
+        sequence: int,
+        started_ms: int | None = None,
+        completed_ms: int | None = None,
     ) -> CommandTelemetry | None:
         """Build CommandTelemetry for a Codex fileChange item.
 
@@ -2231,11 +2363,14 @@ def _extract_file_change_telemetry(
             paths = [str(c.path) for c in changes if hasattr(c, "path")] if changes else []
             status_str = _status_value(status)
             failed = status_str in _FILE_CHANGE_FAILURE_STATUSES
+            timing = _item_timing(started_ms, completed_ms, None)
             return CommandTelemetry(
                 tool_name="Write",
                 tool_id=change_id,
-                timestamp=datetime.now(),
-                duration_ms=None,
+                timestamp=timing.timestamp,
+                execution_started_at=timing.execution_started_at,
+                execution_completed_at=timing.execution_completed_at,
+                duration_ms=timing.duration_ms,
                 parameters={"paths": paths},
                 result_status="error" if failed else "success",
                 result_summary=(
diff --git a/tests/_fixtures/golden_streams/codex_fixtures.py b/tests/_fixtures/golden_streams/codex_fixtures.py
index 8a688aaf..e58bf345 100644
--- a/tests/_fixtures/golden_streams/codex_fixtures.py
+++ b/tests/_fixtures/golden_streams/codex_fixtures.py
@@ -30,8 +30,33 @@
 # --- Notification factories (mirror test_codex_agent) -----------------------
 
 
-def _item(method: str, root: SimpleNamespace) -> SimpleNamespace:
-    return SimpleNamespace(method=method, payload=SimpleNamespace(item=SimpleNamespace(root=root)))
+# Fixed epoch milliseconds, so every derived duration is deterministic and the
+# golden snapshots pin a real value rather than a scrubbed clock read.
+_T0_MS = 1_800_000_000_000
+
+
+def _item(
+    method: str,
+    root: SimpleNamespace,
+    *,
+    started_at_ms: int | None = None,
+    completed_at_ms: int | None = None,
+) -> SimpleNamespace:
+    """One item notification.
+
+    ``started_at_ms`` / ``completed_at_ms`` sit on the PAYLOAD, beside ``item``,
+    which is where the agent reads them from
+    (``getattr(notification.payload, ...)``). They default to None so a
+    scenario that says nothing about timing behaves exactly as before.
+    """
+    return SimpleNamespace(
+        method=method,
+        payload=SimpleNamespace(
+            item=SimpleNamespace(root=root),
+            started_at_ms=started_at_ms,
+            completed_at_ms=completed_at_ms,
+        ),
+    )
 
 
 def _delta(text: str) -> SimpleNamespace:
@@ -160,8 +185,8 @@ def _build_catalogue() -> list[CodexScenario]:
         CodexScenario(
             name="b_command_execution",
             notifications=[
-                _item("item/started", cmd),
-                _item("item/completed", cmd),
+                _item("item/started", cmd, started_at_ms=_T0_MS),
+                _item("item/completed", cmd, completed_at_ms=_T0_MS + 250),
                 _token_usage(inp=120, out=30, cached=0),
                 _turn_completed(),
             ],
@@ -189,9 +214,9 @@ def _build_catalogue() -> list[CodexScenario]:
         CodexScenario(
             name="d_cross_flush_is_error",
             notifications=[
-                _item("item/started", cmd_d),
+                _item("item/started", cmd_d, started_at_ms=_T0_MS),
                 _token_usage(inp=90, out=15, cached=0),
-                _item("item/completed", cmd_d),
+                _item("item/completed", cmd_d, completed_at_ms=_T0_MS + 400),
                 _turn_completed(),
             ],
         )
@@ -202,7 +227,9 @@ def _build_catalogue() -> list[CodexScenario]:
         CodexScenario(
             name="e_orphan_tool",
             notifications=[
-                _item("item/started", _command("cmd_orphan")),
+                # A real ItemStartedNotification always carries this (the SDK
+                # marks it required), so the orphan's start IS knowable.
+                _item("item/started", _command("cmd_orphan"), started_at_ms=_T0_MS),
                 _delta("done"),
                 _turn_completed(),
             ],
@@ -217,10 +244,10 @@ def _build_catalogue() -> list[CodexScenario]:
         CodexScenario(
             name="f_collab_fallback",
             notifications=[
-                _item("item/started", spawn),
-                _item("item/completed", spawn),
-                _item("item/started", wait),
-                _item("item/completed", wait),
+                _item("item/started", spawn, started_at_ms=_T0_MS),
+                _item("item/completed", spawn, completed_at_ms=_T0_MS + 120),
+                _item("item/started", wait, started_at_ms=_T0_MS + 130),
+                _item("item/completed", wait, completed_at_ms=_T0_MS + 900),
                 _delta("done"),
                 _turn_completed(),
             ],
diff --git a/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json b/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
index 2bda3725..a4fd16af 100644
--- a/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
+++ b/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
@@ -6,8 +6,8 @@
       "assistant_turn_index": null,
       "duration_ms": "<scrubbed>",
       "error_message": null,
-      "execution_completed_at": null,
-      "execution_started_at": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
       "generation_completed_at": null,
       "parameters": {
         "command": "echo hi"
diff --git a/tests/_fixtures/golden_streams/expected/codex_d_cross_flush_is_error.json b/tests/_fixtures/golden_streams/expected/codex_d_cross_flush_is_error.json
index d9470370..55959efe 100644
--- a/tests/_fixtures/golden_streams/expected/codex_d_cross_flush_is_error.json
+++ b/tests/_fixtures/golden_streams/expected/codex_d_cross_flush_is_error.json
@@ -6,8 +6,8 @@
       "assistant_turn_index": null,
       "duration_ms": "<scrubbed>",
       "error_message": "hi\n",
-      "execution_completed_at": null,
-      "execution_started_at": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
       "generation_completed_at": null,
       "parameters": {
         "command": "echo hi"
diff --git a/tests/_fixtures/golden_streams/expected/codex_e_orphan_tool.json b/tests/_fixtures/golden_streams/expected/codex_e_orphan_tool.json
index f7ed5458..438c798e 100644
--- a/tests/_fixtures/golden_streams/expected/codex_e_orphan_tool.json
+++ b/tests/_fixtures/golden_streams/expected/codex_e_orphan_tool.json
@@ -7,7 +7,7 @@
       "duration_ms": null,
       "error_message": null,
       "execution_completed_at": null,
-      "execution_started_at": null,
+      "execution_started_at": "<scrubbed>",
       "generation_completed_at": null,
       "parameters": {
         "command": "echo hi"
diff --git a/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json b/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
index 23988d27..74d457e3 100644
--- a/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
+++ b/tests/_fixtures/golden_streams/expected/codex_f_collab_fallback.json
@@ -4,10 +4,10 @@
   "commands": [
     {
       "assistant_turn_index": null,
-      "duration_ms": null,
+      "duration_ms": "<scrubbed>",
       "error_message": null,
-      "execution_completed_at": null,
-      "execution_started_at": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
       "generation_completed_at": null,
       "parameters": {
         "model": "gpt-5.5",
@@ -25,10 +25,10 @@
     },
     {
       "assistant_turn_index": null,
-      "duration_ms": null,
+      "duration_ms": "<scrubbed>",
       "error_message": null,
-      "execution_completed_at": null,
-      "execution_started_at": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
       "generation_completed_at": null,
       "parameters": {
         "operation": "wait"
diff --git a/tests/test_antigravity_agent.py b/tests/test_antigravity_agent.py
index 29c09254..78e9b2e6 100644
--- a/tests/test_antigravity_agent.py
+++ b/tests/test_antigravity_agent.py
@@ -1624,7 +1624,7 @@ def _assistant(record):
 
 
 class TestBusyMs:
-    """`_busy_ms` is the UNION of tool intervals, clipped to the window.
+    """`busy_ms` is the UNION of tool intervals, clipped to the window.
 
     A scalar sum was wrong twice over: overlapping tools (this harness
     resolves several calls from one Step and backgrounds anything over ten
@@ -1639,9 +1639,9 @@ def _at(ms: float) -> datetime:
         return _CLOCK_BASE + timedelta(milliseconds=ms)
 
     def _busy(self, spans, lo=0, hi=10_000) -> float:
-        from coder_eval.agents.antigravity_agent import _busy_ms
+        from coder_eval.agents._timing import busy_ms
 
-        return _busy_ms([(self._at(s), self._at(e)) for s, e in spans], self._at(lo), self._at(hi))
+        return busy_ms([(self._at(s), self._at(e)) for s, e in spans], self._at(lo), self._at(hi))
 
     def test_no_spans_is_zero(self):
         assert self._busy([]) == 0.0
diff --git a/tests/test_codex_agent.py b/tests/test_codex_agent.py
index c12215b4..7198e271 100644
--- a/tests/test_codex_agent.py
+++ b/tests/test_codex_agent.py
@@ -5,6 +5,8 @@
 it isn't installed, so `make test` / CI stay green without the extra.
 """
 
+from datetime import datetime
+
 import pytest
 
 
@@ -504,8 +506,23 @@ def test_get_state_returns_current_state():
 from coder_eval.errors import AgentCrashError, TurnTimeoutError  # noqa: E402
 
 
-def _item_notification(method: str, root: SimpleNamespace) -> SimpleNamespace:
-    return SimpleNamespace(method=method, payload=SimpleNamespace(item=SimpleNamespace(root=root)))
+def _item_notification(
+    method: str,
+    root: SimpleNamespace,
+    *,
+    started_at_ms: int | None = None,
+    completed_at_ms: int | None = None,
+) -> SimpleNamespace:
+    """One item notification. The stamps sit on the PAYLOAD, beside ``item``,
+    which is where the real SDK puts them and where the agent reads them."""
+    return SimpleNamespace(
+        method=method,
+        payload=SimpleNamespace(
+            item=SimpleNamespace(root=root),
+            started_at_ms=started_at_ms,
+            completed_at_ms=completed_at_ms,
+        ),
+    )
 
 
 def _delta(text: str) -> SimpleNamespace:
@@ -2162,3 +2179,120 @@ async def test_cooperative_stop_still_skips_sub_agent_recovery(self, monkeypatch
         record = await agent.communicate("delegate it", should_stop=lambda: True)
 
         assert not [c for c in record.commands if c.tool_name == "Bash"]
+
+
+_BOUNDS_EPOCH_MS = 1_800_000_000_000
+
+
+def _bounds_command_item(item_id: str = "cmd_1") -> SimpleNamespace:
+    return SimpleNamespace(
+        type="commandExecution",
+        id=item_id,
+        command="echo hi",
+        exit_code=0,
+        aggregated_output="hi",
+        duration_ms=None,
+    )
+
+
+class TestExecutionBoundsWiring:
+    """The notification -> builder wiring, end to end through communicate().
+
+    The builder arithmetic is covered in test_codex_agent_unit.py by calling
+    `_telemetry_for_item` directly. That leaves the WIRING untested, and the
+    golden snapshots cannot cover it: `_scrub.py` masks every non-null
+    timestamp to "<scrubbed>", so they assert presence, not value. Swapping
+    `started_ms` and `completed_ms` at the single production call site would
+    make every command 0ms with a zero-width window and still match every
+    snapshot byte-for-byte. These two tests read the values.
+    """
+
+    async def test_stamps_reach_the_record_with_the_right_values(self):
+        notifications = [
+            _item_notification("item/started", _bounds_command_item(), started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", _bounds_command_item(), completed_at_ms=_BOUNDS_EPOCH_MS + 250),
+            _token_usage(inp=10, out=5, cached=0),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        cmd = next(c for c in record.commands if c.tool_id == "cmd_1")
+        assert cmd.execution_started_at == datetime.fromtimestamp(_BOUNDS_EPOCH_MS / 1000)
+        assert cmd.execution_completed_at == datetime.fromtimestamp((_BOUNDS_EPOCH_MS + 250) / 1000)
+        assert cmd.duration_ms == 250.0
+        assert cmd.execution_started_at < cmd.execution_completed_at
+
+    async def test_an_orphaned_tool_keeps_its_known_start_but_no_end(self):
+        # Force-closed without an item/completed. The start IS known (the SDK
+        # marks started_at_ms required), so it is recorded; nothing timed the
+        # rest, so completion and duration stay None.
+        notifications = [
+            _item_notification("item/started", _bounds_command_item("cmd_orphan"), started_at_ms=_BOUNDS_EPOCH_MS),
+            _delta("done"),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        orphan = next(c for c in record.commands if c.tool_id == "cmd_orphan")
+        assert orphan.result_status == "unknown"
+        assert orphan.execution_started_at == datetime.fromtimestamp(_BOUNDS_EPOCH_MS / 1000)
+        assert orphan.execution_completed_at is None
+        assert orphan.duration_ms is None
+
+
+class TestGenerationWindowExcludesToolExecution:
+    """A tool closing inside a generation window is not model time.
+
+    `_flush_message`'s window is seeded from the first item's start and
+    extended to the LAST item's completion, so any generation containing a
+    tool call already CONTAINS that tool's execution. Publishing the raw span
+    double-counted it against the tool's own duration_ms — Generation + Tool
+    exec then exceeded the wall clock they are shown against.
+    """
+
+    async def test_a_tool_only_emission_reports_no_generation_time(self):
+        # The whole 250ms window was `echo hi` running. Reporting 250ms of
+        # "generation" beside a 250ms command is the same interval twice.
+        notifications = [
+            _item_notification("item/started", _bounds_command_item(), started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", _bounds_command_item(), completed_at_ms=_BOUNDS_EPOCH_MS + 250),
+            _token_usage(inp=10, out=5, cached=0),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        assistant = [m for m in record.messages if m.role == "assistant"]
+        cmd = next(c for c in record.commands if c.tool_id == "cmd_1")
+        assert cmd.duration_ms == 250.0
+        assert sum(m.generation_duration_ms or 0.0 for m in assistant) == 0.0
+
+    async def test_generation_plus_tool_exec_does_not_exceed_the_window(self):
+        # Two tools inside one window: the sum of what the page shows as
+        # Generation and Tool exec must fit inside the span they are shown
+        # against, or Phase 1's Unaccounted cell renders a negative share.
+        first = _bounds_command_item("cmd_a")
+        second = _bounds_command_item("cmd_b")
+        notifications = [
+            _item_notification("item/started", first, started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", first, completed_at_ms=_BOUNDS_EPOCH_MS + 120),
+            _item_notification("item/started", second, started_at_ms=_BOUNDS_EPOCH_MS + 130),
+            _item_notification("item/completed", second, completed_at_ms=_BOUNDS_EPOCH_MS + 900),
+            _token_usage(inp=10, out=5, cached=0),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        assistant = [m for m in record.messages if m.role == "assistant"]
+        gen_ms = sum(m.generation_duration_ms or 0.0 for m in assistant)
+        tool_ms = sum(c.duration_ms or 0.0 for c in record.commands)
+        window_ms = 900.0  # the emission's own span, first start -> last completion
+
+        assert tool_ms == 120.0 + 770.0
+        # The 10ms gap between the two tools is the only generation time the
+        # stream lets us attribute.
+        assert gen_ms == pytest.approx(10.0)
+        assert gen_ms + tool_ms == pytest.approx(window_ms)
diff --git a/tests/test_codex_agent_unit.py b/tests/test_codex_agent_unit.py
index 1ef0289c..ee480f63 100644
--- a/tests/test_codex_agent_unit.py
+++ b/tests/test_codex_agent_unit.py
@@ -15,8 +15,11 @@
 from __future__ import annotations
 
 import time
+from datetime import datetime
 from types import SimpleNamespace
 
+import pytest
+
 from coder_eval.agents.codex_agent import _CLAUDE_TO_CODEX_TOOL_MAP, CodexAgent
 from coder_eval.models import AgentKind, parse_agent_config
 
@@ -129,3 +132,149 @@ def test_command_output_recorded_whole_not_truncated(self):
         # result_tokens (ceil(len/4)) must scale with the real output, not ~31.
         assert cmd.result_tokens >= len(big_output) // 4
         assert cmd.result_tokens > 100
+
+
+# ---------------------------------------------------------------------------
+# Execution bounds
+#
+# The SDK delivers `started_at_ms` / `completed_at_ms` on the item notification
+# and the agent discarded both, publishing the item's own `duration_ms`
+# instead — 0.0 for 70 of 211 commands in one nightly, absent for 25 more, and
+# no execution bounds at all, so no Codex tool call could be placed on a
+# timeline. All three telemetry builders now derive their timing identically.
+#
+# Pure logic: the builders take plain SimpleNamespace roots, so these live
+# here rather than behind test_codex_agent.py's importorskip — otherwise a
+# clean `make test` (which syncs no codex extra) skips them entirely.
+# ---------------------------------------------------------------------------
+
+_EPOCH_MS = 1_800_000_000_000
+
+
+def _command_item(item_id: str = "cmd_1", *, duration_ms: object = None) -> SimpleNamespace:
+    return SimpleNamespace(
+        type="commandExecution",
+        id=item_id,
+        command="echo hi",
+        exit_code=0,
+        aggregated_output="hi",
+        duration_ms=duration_ms,
+    )
+
+
+def _generic_item(item_id: str = "mcp_1", *, duration_ms: object = None) -> SimpleNamespace:
+    return SimpleNamespace(
+        type="mcpToolCall",
+        id=item_id,
+        server="srv",
+        tool="lookup",
+        arguments={"q": "x"},
+        status="completed",
+        error=None,
+        success=True,
+        duration_ms=duration_ms,
+    )
+
+
+def _file_change_item(item_id: str = "fc_1", *, duration_ms: object = None) -> SimpleNamespace:
+    """A fileChange root. The SDK reports no duration for one, so
+    ``duration_ms`` is accepted (for signature parity with the other two
+    factories) and deliberately ignored."""
+    del duration_ms
+    return SimpleNamespace(
+        type="fileChange",
+        id=item_id,
+        changes=[SimpleNamespace(path="out.txt")],
+        status="completed",
+    )
+
+
+# (root factory, root_type) for each of the three builders, so a fix in one
+# cannot pass for the others.
+_BUILDERS = [
+    pytest.param(_command_item, "commandExecution", id="commandExecution"),
+    pytest.param(_file_change_item, "fileChange", id="fileChange"),
+    pytest.param(_generic_item, "mcpToolCall", id="generic"),
+]
+
+# The two whose SDK item carries a duration at all. NAMED, not sliced
+# positionally: reordering _BUILDERS must not silently point the fallback
+# tests at fileChange, where the value is discarded and they would pass
+# while asserting nothing.
+_BUILDERS_WITH_SDK_DURATION = [_BUILDERS[0], _BUILDERS[2]]
+
+
+class TestExecutionBoundsFromSdkStamps:
+    """All three builders derive bounds and duration from the SDK stamps."""
+
+    @staticmethod
+    def _build(root, root_type, *, started_ms=None, completed_ms=None):
+        agent = CodexAgent(parse_agent_config(type=AgentKind.CODEX, model="gpt-5.5"))
+        telemetry, _ = agent._telemetry_for_item(
+            root, root_type, getattr(root, "id", "x"), 0, started_ms=started_ms, completed_ms=completed_ms
+        )
+        assert telemetry is not None
+        return telemetry
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS)
+    def test_both_stamps_give_bounds_and_an_exact_duration(self, factory, root_type):
+        tel = self._build(factory(), root_type, started_ms=_EPOCH_MS, completed_ms=_EPOCH_MS + 250)
+        assert tel.execution_started_at == datetime.fromtimestamp(_EPOCH_MS / 1000)
+        assert tel.execution_completed_at == datetime.fromtimestamp((_EPOCH_MS + 250) / 1000)
+        assert tel.duration_ms == 250.0
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS)
+    def test_timestamp_is_the_tools_own_start(self, factory, root_type):
+        # It used to be datetime.now() at COMPLETION, which places the call
+        # after its own execution.
+        tel = self._build(factory(), root_type, started_ms=_EPOCH_MS, completed_ms=_EPOCH_MS + 250)
+        assert tel.timestamp == datetime.fromtimestamp(_EPOCH_MS / 1000)
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS)
+    def test_only_one_stamp_never_fabricates_an_interval(self, factory, root_type):
+        # _ms_to_dt(None) is datetime.now(), so pairing a real stamp with a
+        # missing one would invent an interval running to the present moment.
+        tel = self._build(factory(), root_type, started_ms=_EPOCH_MS, completed_ms=None)
+        assert tel.execution_started_at is None
+        assert tel.execution_completed_at is None
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS)
+    def test_a_backwards_pair_clamps_but_keeps_both_bounds(self, factory, root_type):
+        # Clock skew. The duration cannot be negative, but the anomaly stays
+        # visible in the record.
+        tel = self._build(factory(), root_type, started_ms=_EPOCH_MS + 500, completed_ms=_EPOCH_MS)
+        assert tel.duration_ms == 0.0
+        assert tel.execution_started_at is not None
+        assert tel.execution_completed_at is not None
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS_WITH_SDK_DURATION)
+    def test_derived_duration_wins_over_a_conflicting_sdk_value(self, factory, root_type):
+        tel = self._build(factory(duration_ms=0), root_type, started_ms=_EPOCH_MS, completed_ms=_EPOCH_MS + 250)
+        assert tel.duration_ms == 250.0
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS_WITH_SDK_DURATION)
+    def test_no_stamps_falls_back_to_a_reported_sdk_duration(self, factory, root_type):
+        tel = self._build(factory(duration_ms=12), root_type)
+        assert tel.execution_started_at is None
+        assert tel.duration_ms == 12.0
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS_WITH_SDK_DURATION)
+    def test_an_sdk_zero_is_unreported_not_instant(self, factory, root_type):
+        # The case that motivated the change: 70 of 211 commands in one
+        # nightly reported 0 for calls the message gaps show took seconds.
+        assert self._build(factory(duration_ms=0), root_type).duration_ms is None
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS_WITH_SDK_DURATION)
+    def test_a_negative_sdk_duration_is_unreported_too(self, factory, root_type):
+        assert self._build(factory(duration_ms=-5), root_type).duration_ms is None
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS_WITH_SDK_DURATION)
+    def test_an_absent_sdk_duration_stays_unknown(self, factory, root_type):
+        assert self._build(factory(), root_type).duration_ms is None
+
+    @pytest.mark.parametrize(("factory", "root_type"), _BUILDERS)
+    def test_generation_completed_at_is_left_unset(self, factory, root_type):
+        # Codex's stream does not say when the model finished emitting the
+        # tool_use block; deriving it from the flush time would be a guess.
+        tel = self._build(factory(), root_type, started_ms=_EPOCH_MS, completed_ms=_EPOCH_MS + 1)
+        assert tel.generation_completed_at is None
diff --git a/tests/test_command_statistics.py b/tests/test_command_statistics.py
index 8606bf62..bab27b60 100644
--- a/tests/test_command_statistics.py
+++ b/tests/test_command_statistics.py
@@ -28,6 +28,43 @@ def test_avg_time_excludes_commands_without_timing(self):
             f"Should divide by timed commands (2), not all commands (4)"
         )
 
+    def test_nothing_timed_reports_no_average_rather_than_zero(self):
+        """`avg_command_time_ms` is `float | None` so it can say "unmeasured".
+
+        Reachable since the Claude orphan coalesce was deleted: a turn whose
+        only tool call is force-closed without a tool result has no timed
+        command at all. A 0 here rendered "0ms average command time" in the
+        HTML report for a run where nothing was ever timed.
+        """
+        now = datetime.now()
+        commands = [
+            CommandTelemetry(tool_name="Bash", tool_id="1", timestamp=now, duration_ms=None),
+            CommandTelemetry(tool_name="Bash", tool_id="2", timestamp=now, duration_ms=None),
+        ]
+        turn = TurnRecord(iteration=1, user_input="test", agent_output="test", commands=commands)
+        stats = calculate_command_statistics([turn])
+
+        assert stats.avg_command_time_ms is None
+        assert stats.total_command_time_ms == 0.0
+
+    def test_an_untimed_command_is_not_ranked_among_the_slowest(self):
+        """The slowest list is built from timed commands only.
+
+        It used to coalesce a missing duration to 0.0, which put an untimed
+        command in a "slowest" ranking at the bottom — a measurement it never
+        had. The pre-filter and the reported value are now the same fact.
+        """
+        now = datetime.now()
+        commands = [
+            CommandTelemetry(tool_name="Read", tool_id="1", timestamp=now, duration_ms=50.0),
+            CommandTelemetry(tool_name="Bash", tool_id="2", timestamp=now, duration_ms=None),
+        ]
+        turn = TurnRecord(iteration=1, user_input="test", agent_output="test", commands=commands)
+        stats = calculate_command_statistics([turn])
+
+        assert [c.tool_id for c in stats.slowest_commands] == ["1"]
+        assert stats.slowest_commands[0].duration_ms == 50.0
+
     def test_zero_duration_counted_as_timed(self):
         """A command with duration_ms=0.0 should be counted as timed (not excluded)."""
         now = datetime.now()

From 57f7b5998852f3d55ba49e0b24e28d26ff766eaf Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 16:36:19 -0700
Subject: [PATCH 05/10] =?UTF-8?q?fix(evalboard):=205/6=20=E2=80=94=20appor?=
 =?UTF-8?q?tion=20a=20mixed=20emission=20by=20content=20size?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The message reducer assumed one block kind per emission, which is a Claude
CLI property. Everywhere else it breaks, and it breaks twice.

TIME: all of a raw's generationMs went to the first kind the priority chain
tested. Measured 98.5% thinking on codex and 99.8% on delegate, where 93%
of emissions carry more than one kind.

OUTPUT: the first pass handed a raw's ENTIRE outputTokens to its tool
blocks, and flush() then added the same whole figure to thinkingOutSum
whenever the raw also carried a thinking block. The same tokens were
counted twice for 93% of Delegate's emissions, inflating the cost
simulator's thinking lever.

Both are now apportioned by ONE content-size weight vector per raw,
computed once and stored, so the two can never disagree. Weights are
content size and depend on no output figure: deriving thinking as
`outputTokens - toolWeight` looks natural and is always 0 when a tool is
present (150 of 174 sampled emissions), which would produce the exact
mirror of the bug — 100% tool, 0% thinking.

`splitByWeight` puts `tool` first so it is never the remainder kind. The
tool share is also computed in the first pass, and if one site rounded
while the other took the remainder they disagreed at a tie and the parts
over-summed by a token — the same double-count, one decimal down. A
rounding sweep pins it.

Single-kind emissions take an explicit path and are byte-identical to
before, including per-tool figures; claude-code pages must not move. A
mixed emission with nothing sizeable to weigh by lands in a new
`mixedGenMs`, rendered as "unsplit" — the timeline legend already uses
MIXED for "multiple block types", which is the case this cell is normally
empty for. Per-kind percentages all divide by the whole so they sum to
100%; only the red thinking tint uses the attributable part.

Codex's `_flush_message` no longer concentrates a generation's whole
duration on its first sub-message. It splits by output-token share — a
real per-spec measurement, unlike the evalboard's content-size proxy —
while input and cache tokens stay on the first sub-message, because those
are per-call billing figures and were never the generation's to divide.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../__tests__/message-timeline.test.tsx       | 119 ++++++
 .../app/runs/[id]/[...task]/_sections.tsx     |  42 ++-
 evalboard/lib/__tests__/parseMessages.test.ts | 345 +++++++++++++++++-
 evalboard/lib/__tests__/thinkingSim.test.ts   |   1 +
 evalboard/lib/runs.ts                         | 252 +++++++++++--
 src/coder_eval/agents/codex_agent.py          |  32 +-
 tests/test_codex_agent.py                     | 123 +++++++
 7 files changed, 869 insertions(+), 45 deletions(-)

diff --git a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
index 70db7a22..9f5ec5b7 100644
--- a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
+++ b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
@@ -13,6 +13,7 @@ function makeMessage(overrides: Partial<MessageEvent> = {}): MessageEvent {
         thinkingMs: null,
         textMs: 1000,
         toolGenMs: null,
+        mixedGenMs: null,
         blockTypes: ["text"],
         thinkingText: null,
         text: "hello",
@@ -578,3 +579,121 @@ describe("MessageTimelineSection — Unaccounted cell", () => {
         ).toHaveAttribute("title", expect.stringContaining("sandbox setup"));
     });
 });
+
+// A mixed-kind emission's per-kind split is apportioned by content size, so
+// the page must say so and must not let the unattributable part distort the
+// thinking share.
+describe("MessageTimelineSection — mixed generation sub-cell", () => {
+    function cellValue(label: string): string {
+        const parent = screen.getByText(label).parentElement as HTMLElement;
+        return (parent.children[1] as HTMLElement).textContent ?? "";
+    }
+
+    test("a mixed message renders the mixed sub-cell with its value", () => {
+        render(
+            <MessageTimelineSection
+                messages={[
+                    makeMessage({
+                        generationMs: 1000,
+                        thinkingMs: 100,
+                        textMs: null,
+                        toolGenMs: null,
+                        mixedGenMs: 900,
+                    }),
+                ]}
+            />,
+        );
+        expect(screen.getByText("unsplit")).toBeInTheDocument();
+        expect(cellValue("unsplit")).toContain("900ms");
+    });
+
+    test("a fully attributed message renders no mixed sub-cell at all", () => {
+        // claude-code's shape: the layout must look exactly as it does today.
+        render(
+            <MessageTimelineSection
+                messages={[
+                    makeMessage({
+                        generationMs: 1000,
+                        thinkingMs: null,
+                        textMs: 1000,
+                        toolGenMs: null,
+                        mixedGenMs: null,
+                    }),
+                ]}
+            />,
+        );
+        expect(screen.queryByText("unsplit")).toBeNull();
+    });
+
+    test("the thinking tint is computed against the ATTRIBUTABLE part", () => {
+        // 100ms of thinking out of 100ms attributable is 100% — red — even
+        // though it is only 10% of the raw generation total.
+        render(
+            <MessageTimelineSection
+                messages={[
+                    makeMessage({
+                        generationMs: 1000,
+                        thinkingMs: 100,
+                        textMs: null,
+                        toolGenMs: null,
+                        mixedGenMs: 900,
+                    }),
+                ]}
+            />,
+        );
+        const thinking = screen.getByText("thinking").parentElement as HTMLElement;
+        expect((thinking.children[1] as HTMLElement).className).toContain("text-red-700");
+    });
+
+    test("a low thinking share against a fully attributed total is not tinted", () => {
+        render(
+            <MessageTimelineSection
+                messages={[
+                    makeMessage({
+                        generationMs: 1000,
+                        thinkingMs: 100,
+                        textMs: null,
+                        toolGenMs: 900,
+                        mixedGenMs: null,
+                    }),
+                ]}
+            />,
+        );
+        const thinking = screen.getByText("thinking").parentElement as HTMLElement;
+        expect((thinking.children[1] as HTMLElement).className).not.toContain("text-red-700");
+    });
+
+    test("the four sub-cell percentages sum to 100%, not 190%", () => {
+        // The tint uses the ATTRIBUTABLE denominator; the displayed shares
+        // must not, or thinking reads as 100% of a generation it was 10% of
+        // — on exactly the emission class this phase stops over-crediting.
+        render(
+            <MessageTimelineSection
+                messages={[
+                    makeMessage({
+                        generationMs: 1000,
+                        thinkingMs: 100,
+                        textMs: null,
+                        toolGenMs: null,
+                        mixedGenMs: 900,
+                    }),
+                ]}
+            />,
+        );
+        const pct = (label: string) => {
+            const cell = screen.getByText(label).parentElement as HTMLElement;
+            const m = /\((-?\d+)%\)/.exec(cell.textContent ?? "");
+            return m ? Number(m[1]) : 0;
+        };
+        expect(pct("thinking")).toBe(10);
+        expect(pct("tool") + pct("text") + pct("unsplit") + pct("thinking")).toBe(100);
+    });
+
+    test("the Generation cell says the mixed split is an estimate", () => {
+        render(<MessageTimelineSection messages={[makeMessage()]} />);
+        expect(screen.getByText("Generation").parentElement).toHaveAttribute(
+            "title",
+            expect.stringContaining("apportioned by content size"),
+        );
+    });
+});
diff --git a/evalboard/app/runs/[id]/[...task]/_sections.tsx b/evalboard/app/runs/[id]/[...task]/_sections.tsx
index 0b00578d..34bcd2c6 100644
--- a/evalboard/app/runs/[id]/[...task]/_sections.tsx
+++ b/evalboard/app/runs/[id]/[...task]/_sections.tsx
@@ -366,6 +366,7 @@ export function MessageTimelineSection({
     const thinkingMs = messages.reduce((s, m) => s + (m.thinkingMs ?? 0), 0);
     const textMs = messages.reduce((s, m) => s + (m.textMs ?? 0), 0);
     const toolGenMs = messages.reduce((s, m) => s + (m.toolGenMs ?? 0), 0);
+    const mixedMs = messages.reduce((s, m) => s + (m.mixedGenMs ?? 0), 0);
     const toolExecMs = messages.reduce(
         (s, m) => s + m.toolUses.reduce((a, t) => a + (t.durationMs ?? 0), 0),
         0,
@@ -378,7 +379,13 @@ export function MessageTimelineSection({
             s + m.toolUses.filter((t) => (t.durationMs ?? 0) >= SLOW_TOOL_MS).length,
         0,
     );
-    const thinkingShare = totalGenMs > 0 ? thinkingMs / totalGenMs : 0;
+    // TINT ONLY. Against the ATTRIBUTABLE part, because an emission no kind
+    // could claim would otherwise drag the thinking share down for a reason
+    // unrelated to thinking. The DISPLAYED percentages all divide by
+    // totalGenMs instead, so the four of them sum to 100% — mixing the two
+    // denominators made them sum to 190%.
+    const attributableGenMs = totalGenMs - mixedMs;
+    const thinkingShare = attributableGenMs > 0 ? thinkingMs / attributableGenMs : 0;
 
     // Wall clock the agent stream does not explain. Negative means generation
     // and tool execution overlapped, which is a real signal — never clamped.
@@ -408,14 +415,21 @@ export function MessageTimelineSection({
                     </div>
                     <div className="text-gray-900 font-medium">{messageCount}</div>
                 </div>
-                <div>
+                <div
+                    title="model-generation time. Within an emission that mixed block kinds, the per-kind split is apportioned by content size — an estimate for those emissions, not a measurement. 'unsplit' is time in an emission with no apportionable content at all, so it belongs to no kind."
+                >
                     <div className="text-gray-500 uppercase tracking-wide text-[10px]">
                         Generation
                     </div>
                     <div className="text-gray-900 font-medium">
                         {fmtMs(totalGenMs)}
                     </div>
-                    <div className="mt-1 grid grid-cols-3 gap-2 text-[10px]">
+                    <div
+                        className={
+                            "mt-1 grid gap-2 text-[10px] " +
+                            (mixedMs > 0 ? "grid-cols-4" : "grid-cols-3")
+                        }
+                    >
                         <div>
                             <div className="text-gray-500">thinking</div>
                             <div
@@ -429,7 +443,7 @@ export function MessageTimelineSection({
                                 {totalGenMs > 0 && (
                                     <span className="text-gray-400">
                                         {" "}
-                                        ({Math.round(thinkingShare * 100)}%)
+                                        ({Math.round((thinkingMs / totalGenMs) * 100)}%)
                                     </span>
                                 )}
                             </div>
@@ -458,6 +472,26 @@ export function MessageTimelineSection({
                                 )}
                             </div>
                         </div>
+                        {mixedMs > 0 && (
+                            <div>
+                                {/* NOT "mixed": the legend above already uses
+                                    MIXED for a message carrying multiple block
+                                    types, which is ~93% of Delegate's rows and
+                                    the very case this cell is usually EMPTY
+                                    for. This is the leftover no kind claimed.
+                                    Backed by MessageEvent.mixedGenMs. */}
+                                <div className="text-gray-500">unsplit</div>
+                                <div className="text-gray-800 font-medium tabular-nums">
+                                    {fmtMs(mixedMs)}
+                                    {totalGenMs > 0 && (
+                                        <span className="text-gray-400">
+                                            {" "}
+                                            ({Math.round((mixedMs / totalGenMs) * 100)}%)
+                                        </span>
+                                    )}
+                                </div>
+                            </div>
+                        )}
                     </div>
                 </div>
                 <div>
diff --git a/evalboard/lib/__tests__/parseMessages.test.ts b/evalboard/lib/__tests__/parseMessages.test.ts
index e1e034bd..15e73427 100644
--- a/evalboard/lib/__tests__/parseMessages.test.ts
+++ b/evalboard/lib/__tests__/parseMessages.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, test } from "vitest";
-import { approxTokens, parseMessages, type TurnEntry } from "../runs";
+import { approxTokens, kindWeights, parseMessages, type TurnEntry } from "../runs";
 
 // Helper: a single assistant MessageEntry with one content block. coder_eval
 // emits one message-entry per content-block kind, which is the shape these
@@ -948,3 +948,346 @@ describe("parseMessages — open-weight cost apportionment", () => {
         expect(r.costUsd).toBeCloseTo(14, 6);
     });
 });
+
+// A raw with MULTIPLE block kinds in one message entry — the Delegate shape.
+// 93% of its emissions are mixed (142/174 are thinking+tool_use), which the
+// old priority chain booked entirely to whichever kind it tested first.
+function mixedMsg(opts: {
+    startedAt: string;
+    completedAt: string;
+    genMs: number | null;
+    outputTokens?: number | null;
+    thinking?: string;
+    text?: string;
+    toolParams?: Record<string, unknown> | null;
+}) {
+    const blocks: Record<string, unknown>[] = [];
+    if (opts.thinking !== undefined) {
+        blocks.push({ block_type: "thinking", thinking: opts.thinking });
+    }
+    if (opts.text !== undefined) {
+        blocks.push({ block_type: "text", text: opts.text });
+    }
+    if (opts.toolParams !== undefined && opts.toolParams !== null) {
+        blocks.push({ block_type: "tool_use", tool_use_id: "tu_1" });
+    }
+    return {
+        role: "assistant",
+        started_at: opts.startedAt,
+        completed_at: opts.completedAt,
+        generation_duration_ms: opts.genMs,
+        output_tokens: opts.outputTokens ?? null,
+        content_blocks: blocks,
+    };
+}
+
+function toolCmd(params: Record<string, unknown>, toolId = "tu_1") {
+    // `tool_id`, not `tool_use_id`: that is the key parseMessages resolves a
+    // block against. With the wrong field the command never resolves, params
+    // fall back to {}, and EVERY tool weighs exactly 1 — which silently makes
+    // a content-size split test assert nothing.
+    return {
+        tool_id: toolId,
+        tool_name: "Bash",
+        parameters: params,
+        result_status: "success",
+    };
+}
+
+describe("kindWeights", () => {
+    test("units are consistent: chars are converted, tool proxies are not", () => {
+        // 400 chars / 4 = 100 tokens, weighed against a 100-token tool proxy.
+        const w = kindWeights(400, 0, [100]);
+        expect(w.thinking).toBe(100);
+        expect(w.tool).toBe(100);
+        expect(w.text).toBe(0);
+    });
+
+    test("total is the sum of its parts", () => {
+        const w = kindWeights(400, 80, [10, 5]);
+        expect(w.total).toBe(w.thinking + w.tool + w.text);
+        expect(w.total).toBe(100 + 20 + 15);
+    });
+
+    test("no content at all weighs nothing", () => {
+        expect(kindWeights(0, 0, []).total).toBe(0);
+    });
+});
+
+describe("parseMessages — mixed-kind emissions", () => {
+    // Every case here asserts BOTH invariants, so a change that fixes one
+    // side and breaks the other cannot pass.
+    //
+    // TIME is always exact: mixedGenMs is the bucket for whatever no kind
+    // could claim, so the four parts reconstruct generationMs.
+    //
+    // OUTPUT has no mixed bucket, by design — an emission with nothing
+    // sizeable attributes its output to no kind rather than inventing a
+    // fourth output figure. So the parts may only UNDER-sum, never over,
+    // and `exactOutput` asks for equality wherever content existed. It is
+    // the over-sum that was the bug: the same tokens counted twice.
+    function assertSums(
+        e: ReturnType<typeof parseMessages>[number],
+        { exactOutput = true }: { exactOutput?: boolean } = {},
+    ) {
+        if (e.generationMs != null) {
+            expect(
+                (e.thinkingMs ?? 0) +
+                    (e.textMs ?? 0) +
+                    (e.toolGenMs ?? 0) +
+                    (e.mixedGenMs ?? 0),
+            ).toBeCloseTo(e.generationMs, 6);
+        }
+        if (e.outputTokens != null) {
+            const attributed =
+                (e.thinkingOutputTokens ?? 0) +
+                (e.textOutputTokens ?? 0) +
+                e.toolUses.reduce((a, t) => a + (t.outputTokens ?? 0), 0);
+            expect(attributed).toBeLessThanOrEqual(e.outputTokens);
+            if (exactOutput) expect(attributed).toBe(e.outputTokens);
+        }
+    }
+
+    test("thinking + tool_use splits BOTH time and output by content size", () => {
+        // The 142-of-174 Delegate case. Thinking text is 400 chars (100
+        // proxy-tokens); the tool's params are sized to match, so the split
+        // is roughly even — and crucially neither bucket gets 0 or all.
+        const params = { command: "x".repeat(396) };
+        const events = parseMessages([
+            {
+                messages: [
+                    mixedMsg({
+                        startedAt: "2026-01-01T00:00:00.000Z",
+                        completedAt: "2026-01-01T00:00:10.000Z",
+                        genMs: 10_000,
+                        outputTokens: 1000,
+                        thinking: "t".repeat(400),
+                        toolParams: params,
+                    }),
+                ],
+                commands: [toolCmd(params)],
+            },
+        ]);
+        expect(events).toHaveLength(1);
+        const e = events[0];
+
+        // The command resolved, so the tool really is weighed by its args.
+        expect(e.toolUses[0].toolName).toBe("Bash");
+        // 400 thinking chars -> 100 proxy-tokens; the params serialize to
+        // ~102. Neither ~0% nor ~100%: today's bug reported 99.8% thinking,
+        // and the `outputTokens - toolWeight` trap would report 100% tool.
+        expect(e.thinkingMs).toBeGreaterThan(4_000);
+        expect(e.thinkingMs).toBeLessThan(6_000);
+        expect(e.toolGenMs).toBeGreaterThan(4_000);
+        expect(e.toolGenMs).toBeLessThan(6_000);
+        expect(e.mixedGenMs).toBeNull();
+        // The double-count: 1000 output tokens used to be attributed to
+        // thinking AND to the tool, so this summed to 2000.
+        expect(
+            (e.thinkingOutputTokens ?? 0) + (e.toolUses[0].outputTokens ?? 0),
+        ).toBe(1000);
+        // Per-tool generation time is the tool SHARE, not the whole emission
+        // — a tool row must not out-report the tool total above it. Within a
+        // millisecond: the group total is rounded to integer ms, the per-tool
+        // figure is not.
+        expect(Math.abs((e.toolUses[0].genMs ?? 0) - (e.toolGenMs ?? 0))).toBeLessThan(1);
+        // The bug this replaces: the tool row carried the WHOLE emission.
+        expect(e.toolUses[0].genMs).toBeLessThan(6_000);
+        assertSums(e);
+    });
+
+    test("neither invariant over-sums across a rounding sweep", () => {
+        // The tie case: two Math.round calls on shares that add to the total
+        // can each round up. Booking the tool share in the first pass and the
+        // rest via splitByWeight made that reachable, so sweep it.
+        for (const thinkChars of [100, 397, 400, 401, 800, 1201, 2000]) {
+            for (const proxyChars of [96, 200, 396, 404, 800]) {
+                for (const out of [613, 999, 1000, 1001]) {
+                    const params = { command: "z".repeat(proxyChars) };
+                    const [e] = parseMessages([
+                        {
+                            messages: [
+                                mixedMsg({
+                                    startedAt: "2026-01-01T00:00:00.000Z",
+                                    completedAt: "2026-01-01T00:00:10.000Z",
+                                    genMs: 10_000,
+                                    outputTokens: out,
+                                    thinking: "t".repeat(thinkChars),
+                                    toolParams: params,
+                                }),
+                            ],
+                            commands: [toolCmd(params)],
+                        },
+                    ]);
+                    const attributed =
+                        (e.thinkingOutputTokens ?? 0) +
+                        (e.textOutputTokens ?? 0) +
+                        e.toolUses.reduce((a, t) => a + (t.outputTokens ?? 0), 0);
+                    expect(attributed).toBe(out);
+                    expect(
+                        (e.thinkingMs ?? 0) +
+                            (e.textMs ?? 0) +
+                            (e.toolGenMs ?? 0) +
+                            (e.mixedGenMs ?? 0),
+                    ).toBeCloseTo(10_000, 6);
+                }
+            }
+        }
+    });
+
+    test("text + thinking + tool_use splits three ways and sums exactly", () => {
+        const params = { command: "y".repeat(200) };
+        const events = parseMessages([
+            {
+                messages: [
+                    mixedMsg({
+                        startedAt: "2026-01-01T00:00:00.000Z",
+                        completedAt: "2026-01-01T00:00:09.000Z",
+                        genMs: 9000,
+                        outputTokens: 999,
+                        thinking: "t".repeat(400),
+                        text: "x".repeat(120),
+                        toolParams: params,
+                    }),
+                ],
+                commands: [toolCmd(params)],
+            },
+        ]);
+        const e = events[0];
+        expect(e.thinkingMs).toBeGreaterThan(0);
+        expect(e.textMs).toBeGreaterThan(0);
+        expect(e.toolGenMs).toBeGreaterThan(0);
+        assertSums(e);
+    });
+
+    test("empty thinking text reads as all-tool, not as unattributable", () => {
+        // Some harnesses hide CoT. "We have no thinking content to size" is
+        // an honest all-tool reading; mixedGenMs is for having NOTHING.
+        const params = { command: "z".repeat(200) };
+        const events = parseMessages([
+            {
+                messages: [
+                    mixedMsg({
+                        startedAt: "2026-01-01T00:00:00.000Z",
+                        completedAt: "2026-01-01T00:00:04.000Z",
+                        genMs: 4000,
+                        outputTokens: 400,
+                        thinking: "",
+                        toolParams: params,
+                    }),
+                ],
+                commands: [toolCmd(params)],
+            },
+        ]);
+        const e = events[0];
+        expect(e.toolGenMs).toBe(4000);
+        expect(e.thinkingMs).toBeNull();
+        expect(e.mixedGenMs).toBeNull();
+        assertSums(e);
+    });
+
+    test("a mixed emission with no sizeable content lands in mixed", () => {
+        // Previously this fell through all three chain branches and was
+        // silently dropped from the breakdown while still counting in genSum.
+        const events = parseMessages([
+            {
+                messages: [
+                    mixedMsg({
+                        startedAt: "2026-01-01T00:00:00.000Z",
+                        completedAt: "2026-01-01T00:00:00.500Z",
+                        genMs: 500,
+                        outputTokens: 10,
+                        thinking: "",
+                        text: "",
+                    }),
+                ],
+            },
+        ]);
+        const e = events[0];
+        expect(e.mixedGenMs).toBe(500);
+        expect(e.thinkingMs).toBeNull();
+        expect(e.textMs).toBeNull();
+        // Nothing was sizeable, so the output belongs to no kind either.
+        expect(e.thinkingOutputTokens ?? 0).toBe(0);
+        expect(e.textOutputTokens ?? 0).toBe(0);
+        assertSums(e, { exactOutput: false });
+    });
+
+    test("a measured zero does not invent a mixed bucket", () => {
+        const events = parseMessages([
+            {
+                messages: [
+                    mixedMsg({
+                        startedAt: "2026-01-01T00:00:00.000Z",
+                        completedAt: "2026-01-01T00:00:00.000Z",
+                        genMs: 0,
+                        outputTokens: 10,
+                        thinking: "",
+                        text: "",
+                    }),
+                ],
+            },
+        ]);
+        expect(events[0].mixedGenMs).toBeNull();
+    });
+
+    test("a repeated single kind is still single-kind", () => {
+        // ['tool_use','tool_use'] is ONE kind — compare distinct kinds, not
+        // array length, or two parallel calls read as a mixed emission.
+        const params = { command: "ls" };
+        const entry = mixedMsg({
+            startedAt: "2026-01-01T00:00:00.000Z",
+            completedAt: "2026-01-01T00:00:03.000Z",
+            genMs: 3000,
+            outputTokens: 60,
+            toolParams: params,
+        });
+        entry.content_blocks.push({ block_type: "tool_use", tool_use_id: "tu_2" });
+        const events = parseMessages([
+            {
+                messages: [entry],
+                commands: [toolCmd(params), toolCmd(params, "tu_2")],
+            },
+        ]);
+        const e = events[0];
+        expect(e.toolGenMs).toBe(3000);
+        expect(e.mixedGenMs).toBeNull();
+        assertSums(e);
+    });
+
+    test("Codex shape: two single-kind raws sharing a message_id", () => {
+        const events = parseMessages([
+            {
+                messages: [
+                    {
+                        role: "assistant",
+                        message_id: "m1",
+                        started_at: "2026-01-01T00:00:00.000Z",
+                        completed_at: "2026-01-01T00:00:00.800Z",
+                        generation_duration_ms: 800,
+                        content_blocks: [{ block_type: "thinking", thinking: "plan" }],
+                    },
+                    {
+                        role: "assistant",
+                        message_id: "m1",
+                        started_at: "2026-01-01T00:00:00.800Z",
+                        completed_at: "2026-01-01T00:00:01.000Z",
+                        generation_duration_ms: 200,
+                        content_blocks: [
+                            { block_type: "tool_use", tool_use_id: "tu_1" },
+                        ],
+                    },
+                ],
+                commands: [toolCmd({ command: "ls" })],
+            },
+        ]);
+        // They regroup into ONE MessageEvent, but each raw is single-kind, so
+        // the breakdown is real rather than apportioned.
+        expect(events).toHaveLength(1);
+        const e = events[0];
+        expect(e.thinkingMs).toBe(800);
+        expect(e.toolGenMs).toBe(200);
+        expect(e.mixedGenMs).toBeNull();
+        assertSums(e);
+    });
+});
diff --git a/evalboard/lib/__tests__/thinkingSim.test.ts b/evalboard/lib/__tests__/thinkingSim.test.ts
index 1c7116e6..c4395509 100644
--- a/evalboard/lib/__tests__/thinkingSim.test.ts
+++ b/evalboard/lib/__tests__/thinkingSim.test.ts
@@ -63,6 +63,7 @@ function call(opts: {
         thinkingMs: opts.thinkingMs,
         textMs: null,
         toolGenMs: null,
+        mixedGenMs: null,
         blockTypes: [],
         thinkingText: null,
         text: null,
diff --git a/evalboard/lib/runs.ts b/evalboard/lib/runs.ts
index 0b39e439..36aea409 100644
--- a/evalboard/lib/runs.ts
+++ b/evalboard/lib/runs.ts
@@ -219,6 +219,19 @@ export interface MessageEvent {
     thinkingMs: number | null;    // portion of generationMs attributable to thinking blocks
     textMs: number | null;        // portion of generationMs attributable to text blocks
     toolGenMs: number | null;     // portion of generationMs attributable to tool_use blocks
+    // Generation time in an emission that mixed block kinds but carried no
+    // apportionable content, so it belongs to no kind. Null when everything
+    // was attributable — which is every single-kind (claude-code) emission.
+    // Rendered as "unsplit" (the MIXED badge already means something else).
+    //
+    // thinkingMs + textMs + toolGenMs + mixedGenMs === generationMs, always.
+    //
+    // The OUTPUT side has no such bucket, so its sibling invariant —
+    // thinkingOutputTokens + textOutputTokens + Σ toolUses[].outputTokens
+    // === outputTokens — holds for every emission EXCEPT one with no
+    // sizeable content, whose output is attributed to no kind. It can only
+    // under-sum, never over: over-summing was the double-count this replaced.
+    mixedGenMs: number | null;
     blockTypes: ("thinking" | "tool_use" | "text")[];
     thinkingText: string | null;  // concatenated thinking blocks
     text: string | null;          // concatenated text blocks (final reply chunks)
@@ -1656,6 +1669,72 @@ export function approxTokens(params: Record<string, unknown> | null | undefined)
     }
 }
 
+// Approximate share of one emission's generated content per block kind, in
+// ~tokens. Used to apportion BOTH generation time and output tokens inside a
+// mixed-kind emission, so the two can never disagree.
+//
+// Content size is a proxy, not a measurement: thinking is generated at a
+// slower per-token rate than tool args (see thinkingSim.ts), so this
+// apportions the emission's own recorded totals rather than claiming to
+// measure each kind.
+//
+// NOT derived from outputTokens. The first pass assigns a raw's ENTIRE
+// outputTokens to its tools, so `outputTokens - toolWeight` is always 0
+// whenever a tool is present — 150 of 174 sampled Delegate emissions — which
+// would produce the exact mirror of the bug this fixes: 100% tool, 0%
+// thinking. The weights depend on no output figure at all.
+export interface KindWeights {
+    thinking: number;
+    tool: number;
+    text: number;
+    total: number;
+}
+
+export function kindWeights(
+    thinkingChars: number,
+    textChars: number,
+    toolProxies: number[],
+): KindWeights {
+    // toolTokenProxies are ALREADY in approxTokens units, so all three terms
+    // are the same unit — do not mix chars with tokens here.
+    const thinking = Math.ceil(thinkingChars / CHARS_PER_TOKEN);
+    const text = Math.ceil(textChars / CHARS_PER_TOKEN);
+    const tool = toolProxies.reduce((a, b) => a + b, 0);
+    return { thinking, tool, text, total: thinking + tool + text };
+}
+
+// Split `amount` across the kinds that are present, in proportion to `w`,
+// rounding each and giving the LAST present kind the exact remainder so the
+// parts sum to `amount` with no drift.
+//
+// `tool` is deliberately FIRST, so it is never the remainder kind. The tool
+// share is also computed independently in the first pass (it is booked
+// per-tool there), and the two must agree exactly — if `tool` took the
+// remainder here while the first pass rounded, the two rounders disagree at
+// a tie and the parts OVER-sum by 1, which is the double-count this phase
+// exists to remove. Keeping `tool` on the rounded branch makes both sites
+// compute the identical expression.
+function splitByWeight(
+    amount: number,
+    w: KindWeights,
+): { thinking: number; tool: number; text: number } {
+    const out = { thinking: 0, tool: 0, text: 0 };
+    if (w.total <= 0) return out;
+    const kinds = (["tool", "thinking", "text"] as const).filter((k) => w[k] > 0);
+    let assigned = 0;
+    for (let i = 0; i < kinds.length; i++) {
+        const k = kinds[i];
+        if (i === kinds.length - 1) {
+            out[k] = amount - assigned;
+        } else {
+            const share = Math.round((amount * w[k]) / w.total);
+            out[k] = share;
+            assigned += share;
+        }
+    }
+    return out;
+}
+
 export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
     const out: MessageEvent[] = [];
     let order = 0;
@@ -1687,6 +1766,11 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
             textParts: string[];
             toolUses: MessageToolUse[];
             toolTokenProxies: number[];
+            // Per-kind content weights, computed ONCE at the end of the first
+            // pass and read by both the per-tool split there and flush()'s
+            // group-level attribution. Stored rather than recomputed so the
+            // two cannot drift apart.
+            kindW: KindWeights;
             inputTokens: number | null;
             outputTokens: number | null;
             cacheWriteTokens: number | null;
@@ -1720,6 +1804,7 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                 textParts: [],
                 toolUses: [],
                 toolTokenProxies: [],
+                kindW: { thinking: 0, tool: 0, text: 0, total: 0 },
                 inputTokens:
                     typeof msg.input_tokens === "number" ? msg.input_tokens : null,
                 outputTokens:
@@ -1788,37 +1873,70 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                     });
                 }
             }
-            // Split the raw's generation time across its tool_use blocks,
-            // weighted by an approximate token count (param payload size).
-            // The SDK only reports one generation_duration_ms per raw, so for
-            // parallel tool_uses we attribute proportional to argument size —
-            // larger calls plausibly cost more output tokens to generate. Falls
-            // back to even-split when all proxies are zero.
+            // ONE weight vector for this raw, apportioning its generation time
+            // AND its output tokens across the block kinds it carries. Computed
+            // once here so the per-tool figures below and the group-level
+            // buckets in flush() cannot disagree.
+            r.kindW = kindWeights(
+                r.thinkingParts.join("").length,
+                r.textParts.join("").length,
+                r.toolTokenProxies,
+            );
+            const kindW = r.kindW;
+            // The TOOL SHARE of the raw's generation time, then that share
+            // across the raw's own tools by argument size — larger calls
+            // plausibly cost more output tokens to generate. Falls back to an
+            // even split when all proxies are zero.
+            //
+            // The share matters: a mixed emission used to hand each tool row
+            // the raw's ENTIRE generationMs, so a single tool could render
+            // 10000ms directly beneath a 99ms tool total in the same section.
+            // For a single-kind tool raw the share is 1, so claude-code's
+            // per-tool numbers are unchanged.
             if (r.generationMs != null && r.toolUses.length > 0) {
                 const proxies = r.toolTokenProxies;
                 const total = proxies.reduce((a, b) => a + b, 0);
+                // Short-circuit when the tool IS the whole emission, rather
+                // than computing (x*n)/n — which is not bit-identical to x for
+                // every IEEE-754 input. Makes "claude-code's per-tool numbers
+                // are unchanged" structural instead of empirical.
+                const toolGenTotal =
+                    kindW.total <= 0 || kindW.tool === kindW.total
+                        ? r.generationMs
+                        : (r.generationMs * kindW.tool) / kindW.total;
                 for (let i = 0; i < r.toolUses.length; i++) {
                     const weight =
                         total > 0 ? proxies[i] / total : 1 / r.toolUses.length;
-                    r.toolUses[i].genMs = r.generationMs * weight;
+                    r.toolUses[i].genMs = toolGenTotal * weight;
                 }
             }
-            // Per-tool output tokens. The agent records output_tokens per
-            // emission, so a tool emission's output_tokens belongs to its
-            // tool_use block(s) directly — no gen-time guesswork. Only when a
-            // single emission carries multiple parallel tool_uses do we split
-            // it (by arg-size proxy, exact remainder on the last tool).
+            // Per-tool output tokens. The TOOL SHARE of the emission's output
+            // first (by the same weight vector that splits its generation
+            // time, so the two can never disagree), then that share across the
+            // raw's own tools by arg-size proxy, exact remainder on the last.
+            //
+            // The tool share used to be the raw's ENTIRE outputTokens, while
+            // flush() ALSO added the whole figure to thinkingOutSum whenever
+            // the raw carried a thinking block — attributing the same tokens
+            // twice for 93% of Delegate's emissions and inflating the cost
+            // simulator's thinking lever.
             if (r.outputTokens != null && r.toolUses.length > 0) {
+                // Same expression splitByWeight uses for its `tool` part, so
+                // the two sites round identically and cannot over-sum.
+                const toolOutTotal =
+                    kindW.total > 0
+                        ? Math.round((r.outputTokens * kindW.tool) / kindW.total)
+                        : r.outputTokens;
                 const proxies = r.toolTokenProxies;
                 const total = proxies.reduce((a, b) => a + b, 0);
                 let assigned = 0;
                 for (let i = 0; i < r.toolUses.length; i++) {
                     if (i === r.toolUses.length - 1) {
-                        r.toolUses[i].outputTokens = r.outputTokens - assigned;
+                        r.toolUses[i].outputTokens = toolOutTotal - assigned;
                     } else {
                         const weight =
                             total > 0 ? proxies[i] / total : 1 / r.toolUses.length;
-                        const share = Math.round(r.outputTokens * weight);
+                        const share = Math.round(toolOutTotal * weight);
                         r.toolUses[i].outputTokens = share;
                         assigned += share;
                     }
@@ -1850,6 +1968,11 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
             let haveText = false;
             let toolGenSum = 0;
             let haveToolGen = false;
+            // Generation time in a mixed-kind emission with no apportionable
+            // content at all, so it belongs to no kind. Keeps
+            // thinkingMs + textMs + toolGenMs + mixedGenMs === generationMs.
+            let mixedSum = 0;
+            let haveMixed = false;
             let inputTokSum = 0;
             let haveInputTok = false;
             let outputTokSum = 0;
@@ -1882,15 +2005,50 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                 if (r.generationMs != null) {
                     genSum += r.generationMs;
                     haveGen = true;
-                    if (r.blockTypes.includes("thinking")) {
-                        thinkSum += r.generationMs;
-                        haveThink = true;
-                    } else if (r.blockTypes.includes("tool_use")) {
-                        toolGenSum += r.generationMs;
-                        haveToolGen = true;
-                    } else if (r.blockTypes.includes("text")) {
-                        textSum += r.generationMs;
-                        haveText = true;
+                }
+                // ONE weight vector per raw, apportioning both its generation
+                // time and its output tokens — that is what keeps the two
+                // consistent. Distinct kinds, not array length, so a raw
+                // carrying ['tool_use','tool_use'] stays single-kind.
+                const kinds = new Set(r.blockTypes);
+                const w = r.kindW;
+                if (r.generationMs != null) {
+                    if (kinds.size === 1) {
+                        // The claude-code path: one kind, all of it. Byte-for-byte
+                        // as before — these numbers must not move.
+                        const only = [...kinds][0];
+                        if (only === "thinking") {
+                            thinkSum += r.generationMs;
+                            haveThink = true;
+                        } else if (only === "tool_use") {
+                            toolGenSum += r.generationMs;
+                            haveToolGen = true;
+                        } else {
+                            textSum += r.generationMs;
+                            haveText = true;
+                        }
+                    } else if (w.total > 0) {
+                        const part = splitByWeight(r.generationMs, w);
+                        if (w.thinking > 0) {
+                            thinkSum += part.thinking;
+                            haveThink = true;
+                        }
+                        if (w.tool > 0) {
+                            toolGenSum += part.tool;
+                            haveToolGen = true;
+                        }
+                        if (w.text > 0) {
+                            textSum += part.text;
+                            haveText = true;
+                        }
+                    } else {
+                        // Mixed kinds but nothing sizeable to apportion by (a
+                        // tokens-only emission, or hidden CoT with empty args).
+                        // It belongs to no kind — a missing number beats a
+                        // wrong one. Only a POSITIVE amount sets the flag, so a
+                        // legal measured 0 does not invent a mixed bucket.
+                        mixedSum += r.generationMs;
+                        if (r.generationMs > 0) haveMixed = true;
                     }
                 }
                 if (r.inputTokens != null) {
@@ -1900,15 +2058,26 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                 if (r.outputTokens != null) {
                     outputTokSum += r.outputTokens;
                     haveOutputTok = true;
-                    // Attribute the emission's output to its block kind (each
-                    // raw is one kind; priority mirrors the gen-time split).
-                    // Tool output is attached per-tool in the first pass.
-                    if (r.blockTypes.includes("thinking")) {
-                        thinkingOutSum += r.outputTokens;
-                        haveThinkingOut = true;
-                    } else if (r.blockTypes.includes("text")) {
-                        textOutSum += r.outputTokens;
-                        haveTextOut = true;
+                    // The non-tool share only: the tool share was booked
+                    // per-tool in the first pass, from THIS SAME vector.
+                    if (kinds.size === 1) {
+                        if (kinds.has("thinking")) {
+                            thinkingOutSum += r.outputTokens;
+                            haveThinkingOut = true;
+                        } else if (kinds.has("text")) {
+                            textOutSum += r.outputTokens;
+                            haveTextOut = true;
+                        }
+                    } else if (w.total > 0) {
+                        const part = splitByWeight(r.outputTokens, w);
+                        if (w.thinking > 0) {
+                            thinkingOutSum += part.thinking;
+                            haveThinkingOut = true;
+                        }
+                        if (w.text > 0) {
+                            textOutSum += part.text;
+                            haveTextOut = true;
+                        }
                     }
                 }
                 if (r.cacheWriteTokens != null) {
@@ -1924,11 +2093,18 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                     haveReasoning = true;
                 }
             }
-            // Per-block output comes straight from each emission's recorded
-            // output_tokens (thinking + text here, tools in the first pass) —
-            // the agent already split the call total across blocks by content
-            // length, so there's no re-approximation to do. These sum to the
-            // group's outputTokens.
+            // Per-block output. For a SINGLE-KIND emission it comes straight
+            // from the recorded output_tokens (thinking + text here, tools in
+            // the first pass) — the agent already split the call total across
+            // block-emissions by content length, so there is nothing to
+            // re-approximate. A MIXED emission is one recorded figure covering
+            // several kinds, so the reducer does apportion it, by kindWeights.
+            //
+            // These sum to the group's outputTokens EXCEPT for an emission
+            // with no sizeable content at all (kindWeights total 0), which
+            // attributes its output to no kind: there is no unsplit bucket on
+            // the output side, only on the time side. Reachable on claude-code
+            // via a sub-agent terminal message with empty result text.
             const textOutputTokens = haveTextOut ? textOutSum : null;
             out.push({
                 index: ++order,
@@ -1939,6 +2115,7 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                 thinkingMs: haveThink ? thinkSum : null,
                 textMs: haveText ? textSum : null,
                 toolGenMs: haveToolGen ? toolGenSum : null,
+                mixedGenMs: haveMixed ? mixedSum : null,
                 blockTypes,
                 thinkingText: previewString(
                     thinkingParts.join("\n").trim(),
@@ -2016,6 +2193,7 @@ export function parseMessages(turns: TurnEntry[]): MessageEvent[] {
                 thinkingMs: null,
                 textMs: null,
                 toolGenMs: null,
+                mixedGenMs: null,
                 blockTypes: [],
                 thinkingText: null,
                 text: null,
diff --git a/src/coder_eval/agents/codex_agent.py b/src/coder_eval/agents/codex_agent.py
index b7577f3d..98c762bc 100644
--- a/src/coder_eval/agents/codex_agent.py
+++ b/src/coder_eval/agents/codex_agent.py
@@ -482,14 +482,40 @@ def _flush_message(self, last: Any) -> None:
         think_out = reasoning_tok if action_blocks else total_output
         action_out = max(total_output - reasoning_tok, 0) if thinking_blocks else total_output
 
-        # Sub-message specs in generation order (thinking first). The FIRST carries
-        # the gen's input/cache + gen-time; the rest carry 0 (no double-count).
+        # Sub-message specs in generation order (thinking first). The FIRST
+        # carries the gen's input/cache — those are per-CALL billing figures
+        # and must not be split. Generation TIME is different: it is a
+        # property of the content, so it is apportioned below.
         specs: list[tuple[list[ContentBlock], int, int]] = []
         if thinking_blocks:
             specs.append((thinking_blocks, think_out, reasoning_tok))
         if action_blocks:
             specs.append((action_blocks, action_out, 0))
 
+        # Split gen_ms across the sub-messages by their own OUTPUT-TOKEN
+        # share, giving the last the remainder so the parts reconstruct
+        # gen_ms (to float precision — the shares are rounded to 1e-6 ms, so
+        # do not assert exact equality on an arbitrary measured window).
+        # Concentrating it all on the first reported the thinking row as the
+        # entire generation and the action row as instant. With no output
+        # recorded anywhere, split evenly — there is nothing to weigh by, and
+        # one row taking all of it would be a guess dressed as a measurement.
+        #
+        # NOTE this weighs by output tokens while the evalboard's own
+        # mixed-emission split weighs by CONTENT SIZE. Deliberate, not an
+        # oversight to unify: here the SDK hands us a real per-spec token
+        # count, so there is no need to approximate one from content length.
+        out_total = sum(out_tok for _, out_tok, _ in specs)
+        gen_parts: list[float] = []
+        assigned = 0.0
+        for idx, (_, out_tok, _) in enumerate(specs):
+            if idx == len(specs) - 1:
+                gen_parts.append(gen_ms - assigned)
+            else:
+                share = round(gen_ms * (out_tok / out_total if out_total > 0 else 1 / len(specs)), 6)
+                gen_parts.append(share)
+                assigned += share
+
         for idx, (blocks, out_tok, reas_tok) in enumerate(specs):
             for i, blk in enumerate(blocks):
                 blk.sequence = i
@@ -498,7 +524,7 @@ def _flush_message(self, last: Any) -> None:
                 AssistantMessage(
                     started_at=started,
                     completed_at=completed,
-                    generation_duration_ms=gen_ms if first else 0.0,
+                    generation_duration_ms=gen_parts[idx],
                     content_blocks=blocks,
                     tool_use_ids=[b.tool_use_id for b in blocks if b.block_type == "tool_use" and b.tool_use_id],
                     input_tokens=gen_input if first else 0,
diff --git a/tests/test_codex_agent.py b/tests/test_codex_agent.py
index 7198e271..8174eb55 100644
--- a/tests/test_codex_agent.py
+++ b/tests/test_codex_agent.py
@@ -2296,3 +2296,126 @@ async def test_generation_plus_tool_exec_does_not_exceed_the_window(self):
         # stream lets us attribute.
         assert gen_ms == pytest.approx(10.0)
         assert gen_ms + tool_ms == pytest.approx(window_ms)
+
+
+class TestFlushMessageGenTimeSplit:
+    """`gen_ms` is apportioned across sub-messages by their output share.
+
+    It used to land entirely on the FIRST spec, so a thinking+action
+    generation reported the thinking row as the whole generation and the
+    action row as instant — 98.5% of Codex generation time booked to
+    thinking. Billing tokens still travel with the first spec only; time is a
+    property of the content, not of the call.
+    """
+
+    @staticmethod
+    def _flush(*, gen_ms: float, think_out: int, action_out: int, thinking: bool = True):
+        """Drive `_flush_message` with a controlled window and output split."""
+        # Build the reducer directly; only the flush path is under test.
+        from coder_eval.agents.codex_agent import _CodexTurnState
+        from coder_eval.models import ContentBlock
+        from coder_eval.streaming.callbacks import CompositeStreamCallback
+        from coder_eval.streaming.collector import EventCollector
+
+        agent = CodexAgent(parse_agent_config(type=AgentKind.CODEX, model="gpt-5.5"))
+        collector = EventCollector()
+        st = _CodexTurnState(
+            agent,
+            emit=CompositeStreamCallback([collector]),
+            task_id="codex",
+            turn_id="codex-1",
+            collector=collector,
+            commands=[],
+            messages=[],
+            user_input="go",
+            iteration=1,
+            turn_start_time=0.0,
+        )
+        st.open_blocks = [
+            *([ContentBlock(block_type="thinking", sequence=0, thinking="plan")] if thinking else []),
+            ContentBlock(block_type="text", sequence=0, text="answer"),
+        ]
+        st.open_start_ms = _BOUNDS_EPOCH_MS
+        st.open_end_ms = _BOUNDS_EPOCH_MS + int(gen_ms)
+        # Non-zero input/cache, so "billing stays on the first spec" is an
+        # assertion that can actually fail rather than 0 == 0.
+        last = SimpleNamespace(
+            input_tokens=500,
+            cached_input_tokens=200,
+            output_tokens=think_out + action_out,
+            reasoning_output_tokens=think_out,
+        )
+        st._flush_message(last)
+        return st.messages
+
+    def test_time_splits_by_output_share_and_sums_exactly(self):
+        msgs = self._flush(gen_ms=1000, think_out=800, action_out=200)
+        assert [m.generation_duration_ms for m in msgs] == [800.0, 200.0]
+        assert sum(m.generation_duration_ms or 0.0 for m in msgs) == 1000.0
+
+    def test_rounding_leaves_no_drift(self):
+        msgs = self._flush(gen_ms=1000, think_out=333, action_out=667)
+        assert sum(m.generation_duration_ms or 0.0 for m in msgs) == 1000.0
+
+    def test_no_output_anywhere_splits_evenly(self):
+        # Nothing to weigh by; one row taking all of it would be a guess.
+        msgs = self._flush(gen_ms=1000, think_out=0, action_out=0)
+        assert [m.generation_duration_ms for m in msgs] == [500.0, 500.0]
+
+    def test_billing_tokens_stay_on_the_first_sub_message_only(self):
+        # Time is split; input/cache are per-CALL figures and must not be.
+        # The comment this phase edited previously claimed the two travelled
+        # together, so assert them apart explicitly.
+        msgs = self._flush(gen_ms=1000, think_out=800, action_out=200)
+        assert len(msgs) == 2
+        assert msgs[0].input_tokens == 500 - 200  # fresh slice
+        assert msgs[0].cache_read_tokens == 200
+        assert msgs[1].input_tokens == 0
+        assert msgs[1].cache_creation_tokens == 0
+        assert msgs[1].cache_read_tokens == 0
+        # ...while the TIME did split.
+        assert msgs[1].generation_duration_ms == 200.0
+
+    def test_a_single_spec_flush_carries_all_of_gen_ms(self):
+        msgs = self._flush(gen_ms=1000, think_out=0, action_out=400, thinking=False)
+        assert len(msgs) == 1
+        assert msgs[0].generation_duration_ms == 1000.0
+
+    async def test_the_split_survives_end_to_end_through_communicate(self):
+        """Pinned here, not in the golden master.
+
+        `_scrub.py` masks `generation_duration_ms` to "<scrubbed>" whenever
+        it is non-null, so a snapshot cannot tell 1000/0 (the old behaviour)
+        from 800/200 (the new one). The only way to assert the split reaches
+        a real TurnRecord is to read the values back.
+        """
+        last = SimpleNamespace(input_tokens=100, output_tokens=50, cached_input_tokens=8, reasoning_output_tokens=20)
+        total = SimpleNamespace(input_tokens=100, output_tokens=50, cached_input_tokens=8)
+        reasoning = _reasoning_item(text="plan")
+        notifications = [
+            # item/started is what banks the stamp (on_item_completed does not
+            # read one), and it is recorded for every item kind, not just tools.
+            _item_notification("item/started", reasoning, started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", reasoning),
+            _delta("final answer"),
+            _item_notification(
+                "item/completed",
+                SimpleNamespace(type="agentMessage", id="m1", text="final answer"),
+                completed_at_ms=_BOUNDS_EPOCH_MS + 1000,
+            ),
+            SimpleNamespace(
+                method="thread/tokenUsage/updated",
+                payload=SimpleNamespace(token_usage=SimpleNamespace(last=last, total=total)),
+            ),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("think then answer")
+
+        assistant = [m for m in record.messages if m.role == "assistant"]
+        assert len(assistant) == 2, "expected a thinking and an action sub-message"
+        # Output was 20 reasoning / 30 action, so the 1000ms window splits
+        # 400/600 — NOT 1000/0, which is what concentrating it on the first
+        # sub-message produced.
+        assert [m.generation_duration_ms for m in assistant] == [400.0, 600.0]
+        assert sum(m.generation_duration_ms or 0.0 for m in assistant) == 1000.0

From 765d9047401bc6533fd4339b529dc70627a7eb1c Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 16:53:06 -0700
Subject: [PATCH 06/10] =?UTF-8?q?test(golden):=206/6=20=E2=80=94=20every?=
 =?UTF-8?q?=20harness=20has=20a=20recorded=20stream,=20and=20a=20timing=20?=
 =?UTF-8?q?sensor?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only claude-code and codex had golden coverage, so the three harnesses
whose timing was worst had no recorded stream at all. Antigravity,
OpenCode and Pi now each have one, with the `_step` / `_FakeProcess` /
event-builder helpers MOVED out of the agent test modules and imported
back rather than copied — those modules' own tests are unchanged.

`assert_timing_captured` is the sensor an AST rule cannot be. It replays
the real reducer and asserts what static analysis cannot see: that a
resolved command carries both execution bounds and a duration, and that a
turn which streamed a generation reports a positive window somewhere. It
runs on the UNSCRUBBED dump, because the scrubber masks values while
preserving None and present-vs-absent is the whole assertion.

It is a scenario-level floor rather than a per-entry rule, and that is
forced by the snapshots: `claude_d_subagent_terminal` holds two
content-bearing messages of which exactly one is legitimately None, so no
flag could express "this one but not that one". The exemptions live in one
`NO_GENERATION_WINDOW` set beside the coverage mapping, not as a field on
five dissimilar dataclasses, and each names its reason. Strict is the
default: a new scenario is asserted to have a window until someone says
otherwise.

Two of those exemptions were not in the plan's table, which was computed
from snapshots where the value is scrubbed and so could not see them:
`claude_i_in_loop_deadline_break` drives a scripted constant clock, and two
Codex scenarios have zero-width windows by stream shape. A third candidate
was fixed instead of exempted — `codex_b_command_execution` gained a reply,
so it carries real generation content rather than being tool-only. Fix the
fixture before weakening the sensor.

Coverage is derived from `AgentKind`, excluding only NONE (agentless) and
UNKNOWN (a sentinel), each with its reason — an allowlist of exclusions, so
a new member fails until someone decides. The negative cases run the real
check against a mutated copy rather than restating its condition.

`HARNESS_PARITY.md` gains a `## Timing capture` section: where each field
comes from per harness, why `generation_duration_ms` is model-generation
time rather than the span between its own bounds, why Codex leaves
`generation_completed_at` unset, and the two divergences left open —
Antigravity's orphan-poll wait and Delegate's missing bounds — both also
recorded in the deferred-work file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/harness-candidates.md                 |  49 +++
 docs/agents/HARNESS_PARITY.md                 |  62 ++++
 tests/_fixtures/golden_streams/__init__.py    |   3 +-
 tests/_fixtures/golden_streams/_scrub.py      |  51 ++++
 .../golden_streams/antigravity_fixtures.py    | 279 ++++++++++++++++++
 .../golden_streams/codex_fixtures.py          |  13 +-
 .../antigravity_a_single_text_turn.json       |  52 ++++
 .../antigravity_b_tool_call_resolved.json     |  83 ++++++
 ...y_c_thinking_and_tool_same_generation.json |  92 ++++++
 .../expected/antigravity_d_orphaned_tool.json |  72 +++++
 .../antigravity_e_multi_generation.json       | 106 +++++++
 .../expected/codex_b_command_execution.json   |  11 +-
 .../expected/opencode_a_single_text_turn.json |  57 ++++
 .../opencode_b_tool_call_resolved.json        | 106 +++++++
 .../expected/pi_a_single_text_turn.json       |  47 +++
 .../expected/pi_b_tool_call_resolved.json     | 155 ++++++++++
 .../golden_streams/opencode_fixtures.py       | 227 ++++++++++++++
 tests/_fixtures/golden_streams/pi_fixtures.py | 207 +++++++++++++
 tests/test_agent_golden_master.py             | 245 ++++++++++++++-
 tests/test_antigravity_agent.py               | 106 +------
 tests/test_opencode_agent.py                  | 132 +--------
 tests/test_pi_agent.py                        | 132 +--------
 22 files changed, 1942 insertions(+), 345 deletions(-)
 create mode 100644 tests/_fixtures/golden_streams/antigravity_fixtures.py
 create mode 100644 tests/_fixtures/golden_streams/expected/antigravity_a_single_text_turn.json
 create mode 100644 tests/_fixtures/golden_streams/expected/antigravity_b_tool_call_resolved.json
 create mode 100644 tests/_fixtures/golden_streams/expected/antigravity_c_thinking_and_tool_same_generation.json
 create mode 100644 tests/_fixtures/golden_streams/expected/antigravity_d_orphaned_tool.json
 create mode 100644 tests/_fixtures/golden_streams/expected/antigravity_e_multi_generation.json
 create mode 100644 tests/_fixtures/golden_streams/expected/opencode_a_single_text_turn.json
 create mode 100644 tests/_fixtures/golden_streams/expected/opencode_b_tool_call_resolved.json
 create mode 100644 tests/_fixtures/golden_streams/expected/pi_a_single_text_turn.json
 create mode 100644 tests/_fixtures/golden_streams/expected/pi_b_tool_call_resolved.json
 create mode 100644 tests/_fixtures/golden_streams/opencode_fixtures.py
 create mode 100644 tests/_fixtures/golden_streams/pi_fixtures.py

diff --git a/.claude/harness-candidates.md b/.claude/harness-candidates.md
index b292fd67..c2b20644 100644
--- a/.claude/harness-candidates.md
+++ b/.claude/harness-candidates.md
@@ -489,3 +489,52 @@ with the two `action.yml` items above — one considered change to the action's
   run. Guard would need cross-method dataflow over each `Agent`-subclass turn-state
   class (write sites vs read sites), which the AST-only CExxx runner can't express
   in ~30 min — deferred. Caught in: Pi harness Phase 2 quality review.
+
+- [ ] A duration/count aggregate over run-task rows that fails to exclude
+  `mature_skipped`. Nothing guards it: the CExxx runner is Python-AST only and
+  this defect class lives in the evalboard's TypeScript. A codex nightly
+  rendered "1300 tasks · 15h 29m" for the 397 tasks that actually ran. Fixed
+  for the two whole-run sites by extracting `deriveRunDuration`; a general
+  guard needs a TS lint surface the harness does not have.
+  Caught in: timing-capture Phase 1 review.
+
+- [ ] Subtracting a SUM of intervals from a wall span where the intervals can
+  overlap. Semantic, not syntactic — an AST rule cannot tell a sum of
+  durations from a union. Antigravity shipped it: four concurrent 400ms tool
+  calls inside a 1000ms window summed to 1600ms and clamped generation to the
+  0.0 the change existed to remove. The real guard is the replay-based
+  `assert_timing_captured` golden sensor, which now exists; a static rule
+  would not have caught it. Caught in: timing-capture Phase 3 review.
+
+- [ ] A test fixture whose field name does not exist on the type it models.
+  `parseMessages`'s `CommandEntry` keys on `tool_id`; a fixture using
+  `tool_use_id` never resolves, params fall back to `{}`, and every tool
+  weighs exactly 1 — which silently turned a "split by content size" test
+  into a 99%-thinking assertion that passed. TypeScript accepts it because
+  the fixtures are untyped object literals. Typing the fixture factories
+  against the real interfaces would guard the whole class; that is a
+  sweep across the evalboard test suite, not ~30 min.
+  Caught in: timing-capture Phase 5 review.
+
+### Deferred timing divergences (not guardrails — accounting gaps)
+
+Recorded here as well as in `docs/agents/HARNESS_PARITY.md` § Known
+divergences, so the deferred-work record is one place. Measurements in
+`c/time-bugs-audit.md`.
+
+- [ ] **Antigravity books orphan-poll waiting as agent duration** (audit P2-1).
+  A task can spend `0.8 × turn_timeout` waiting on a tool call that never
+  reaches DONE — 14 tasks, 9.6h of one 83h run. Only CLOSED tool intervals are
+  subtracted from a generation window, so that wait stays inside whichever
+  window contains it; the force-close records `execution_completed_at` while
+  leaving `duration_ms` as `None`. Deliberately out of scope of the timing
+  work: closing it means deciding whether a backgrounded tool's elapsed time
+  is model time (the model IS generating while it runs), which is a semantic
+  question, not a bug fix.
+
+- [ ] **Delegate (`delegate-sdk`) records no execution bounds** (audit P3-1).
+  It reports `duration_ms` but neither `execution_started_at` nor
+  `execution_completed_at`, so its tool calls cannot be placed on a timeline.
+  Coverage is ~88%, so it is not urgent. The agent lives in the separate
+  `coder_eval_uipath` repo; mirror the Codex change there
+  (`_item_timing` + threading the SDK stamps through the telemetry builders).
diff --git a/docs/agents/HARNESS_PARITY.md b/docs/agents/HARNESS_PARITY.md
index 7da24b4e..c36f232e 100644
--- a/docs/agents/HARNESS_PARITY.md
+++ b/docs/agents/HARNESS_PARITY.md
@@ -17,6 +17,68 @@ This page is the contract for what each run limit means per harness, plus the sh
 | `run_limits.task_timeout` | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic |
 | `run_limits.stop_early` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` (event granularity) | cooperative `should_stop` (event granularity — Pi streams incrementally) |
 
+## Timing capture
+
+What each harness records about *when* things happened, and how much of a task's
+wall clock its numbers account for.
+
+| Field | claude-code | codex | antigravity | opencode | pi |
+|---|---|---|---|---|---|
+| `generation_duration_ms` source | harness clock: previous SDK event → this message | SDK item stamps, minus tool execution inside the window | harness clock: previous flush → this flush, minus tool execution inside the window | harness clock, per CLI step | harness clock, per CLI turn |
+| tool `duration_ms` source | measured around the tool result | SDK `completed_at_ms − started_at_ms`; the item's own `duration_ms` only as a fallback | measured ACTIVE → DONE | measured around the tool event | measured around the tool event |
+| `execution_started_at` / `execution_completed_at` | derived from the measured duration | SDK stamps (both, or neither) | measured at ACTIVE / DONE | measured | measured |
+| `generation_completed_at` | set | `None` — see below | `None` | `None` | `None` |
+| `Σ generation + Σ tool ≈ turn duration` | yes | yes | yes | yes | yes |
+
+**`generation_duration_ms` is model-generation time, not `completed_at − started_at`.**
+Two harnesses interleave tool execution into a single generation window.
+Antigravity reports a `Step` for the tool and only a later `usage_metadata`
+`Step` cuts the message; Codex's message window is seeded from the first item's
+start and extended to the last item's completion. In both, the span between the
+recorded bounds legitimately CONTAINS tool time that the model did not spend
+generating, so both subtract it — the **union** of the closed tool intervals
+clipped to the window (`agents/_timing.py::busy_ms`), never the sum, because
+tool calls overlap: Antigravity resolves several from one `Step` and backgrounds
+anything over ten seconds, and Codex spawns collab agents concurrently. Summing
+them over-subtracts by exactly the overlap and, with enough concurrency, drives
+the result to a clamped zero.
+
+The consequence worth knowing: on a Codex emission that carries *only* a tool
+call, the whole measured window was that tool running, so the recorded
+generation time is legitimately `0.0`. That is a measurement, not a placeholder
+— `None` is what "never measured" looks like.
+
+**Why Codex leaves `generation_completed_at` as `None`.** It means "when the
+model finished emitting the `tool_use` block". Codex's stream does not carry
+that per tool; deriving it from the flush time would be a guess. Note also that
+`CommandTelemetry.timestamp` is the tool's own start on codex, antigravity,
+opencode and pi, and the generation-completed moment on claude-code. Nothing
+orders on it — `TurnRecord.commands` is sorted by `sequence_number` — but the
+field's own docstring still describes only the claude-code reading.
+
+**Codex `duration_ms` covers more than the command run.** Derived from the item
+stamps, it is the item's lifecycle (queueing and approval included) rather than
+the SDK's own narrower command-execution figure, which it deliberately overrides
+— the SDK reported `0` for 70 of 211 commands in one nightly. `fileChange` and
+generic tool items now carry a duration where they previously carried none, so
+`avg_command_time_ms` and `total_command_time_ms` for a Codex run describe every
+tool call rather than shell commands alone.
+
+### Known divergences
+
+- **Delegate (`delegate-sdk`, out of tree)** records `duration_ms` but no
+  execution bounds, so its tool calls cannot be placed on a timeline. Its
+  coverage is ~88%. Mirror the Codex change in `coder_eval_uipath`
+  (audit P3-1).
+- **Antigravity books orphan-poll waiting as agent duration.** A task can spend
+  `0.8 × turn_timeout` waiting on a tool call that never reaches DONE — 14 tasks
+  and 9.6h of one 83h run. Only CLOSED tool intervals are subtracted, so that
+  wait stays inside whichever generation window contains it, and the force-close
+  records `execution_completed_at` while leaving `duration_ms` as `None`
+  (audit P2-1).
+
+Both are deliberately deferred; see `c/time-bugs-audit.md` for the measurements.
+
 ## `max_turns` counts visible turns on Codex and Antigravity
 
 A "visible turn" is one entry in the run's timeline: one resolved tool call. It is
diff --git a/tests/_fixtures/golden_streams/__init__.py b/tests/_fixtures/golden_streams/__init__.py
index 7ff1113d..dbec503a 100644
--- a/tests/_fixtures/golden_streams/__init__.py
+++ b/tests/_fixtures/golden_streams/__init__.py
@@ -14,8 +14,9 @@
 from tests._fixtures.golden_streams._scrub import (
     SCRUB_PLACEHOLDER,
     assert_reconciliation,
+    assert_timing_captured,
     scrub,
 )
 
 
-__all__ = ["SCRUB_PLACEHOLDER", "assert_reconciliation", "scrub"]
+__all__ = ["SCRUB_PLACEHOLDER", "assert_reconciliation", "assert_timing_captured", "scrub"]
diff --git a/tests/_fixtures/golden_streams/_scrub.py b/tests/_fixtures/golden_streams/_scrub.py
index fa368828..890f3d57 100644
--- a/tests/_fixtures/golden_streams/_scrub.py
+++ b/tests/_fixtures/golden_streams/_scrub.py
@@ -97,3 +97,54 @@ def assert_reconciliation(record: dict[str, Any]) -> None:
     assert out_sum == usage["output_tokens"], "output bucket does not reconcile"
     assert cw_sum == usage["cache_creation_input_tokens"], "cache_creation bucket does not reconcile"
     assert cr_sum == usage["cache_read_input_tokens"], "cache_read bucket does not reconcile"
+
+
+def assert_timing_captured(record: dict[str, Any], *, expect_generation_window: bool) -> None:
+    """Assert a TurnRecord dump actually recorded the timing it could measure.
+
+    Run on the UNSCRUBBED dump. ``scrub()`` masks values but preserves ``None``
+    (see its docstring), and present-vs-absent IS the whole assertion here — a
+    scrubbed snapshot can tell you a field was set, never that it was set to
+    something meaningful.
+
+    An AST rule cannot see that an SDK returned ``0.0``; this replay-based
+    sensor can. Two checks:
+
+    **Unconditional.** Every command that RESOLVED (``result_status`` of
+    ``"success"`` or ``"error"``) carries ``execution_started_at``,
+    ``execution_completed_at`` and ``duration_ms``. A force-closed orphan
+    (``"unknown"``) is exempt: it was never timed, and saying so is the honest
+    record. Where a scenario resolves no command the check is vacuously true,
+    which is correct rather than weak — the scenario is asserting nothing
+    about commands because it has none.
+
+    **Flagged.** When ``expect_generation_window``, at least one assistant
+    entry reports a ``generation_duration_ms`` that is non-``None`` AND
+    greater than zero.
+
+    Why a scenario-level floor rather than a per-entry rule: no per-entry form
+    works against the real snapshots. ``claude_d_subagent_terminal`` holds two
+    content-bearing assistant messages of which exactly one is legitimately
+    ``None`` (the synthesized sub-agent generation, delivered as a tool result
+    and never streamed), so no scenario-level flag can express "this one but
+    not that one". And "never exactly 0.0" conflicts with the clamps that can
+    legitimately produce a measured zero. The detailed per-message contract
+    lives in each agent's own unit tests; this is the cross-harness floor.
+    """
+    for command in record.get("commands") or []:
+        if command.get("result_status") not in ("success", "error"):
+            continue
+        tool = command.get("tool_id")
+        for field in ("execution_started_at", "execution_completed_at", "duration_ms"):
+            assert command.get(field) is not None, (
+                f"resolved command {tool!r} has no {field}: a command that ran and "
+                "returned was timed, so the record must say when and for how long"
+            )
+
+    if not expect_generation_window:
+        return
+    windows = [m.get("generation_duration_ms") for m in record.get("messages") or [] if m.get("role") == "assistant"]
+    assert any(w is not None and w > 0 for w in windows), (
+        f"no assistant message reports a positive generation window (saw {windows!r}); "
+        "the harness measured no model time at all for a turn that streamed one"
+    )
diff --git a/tests/_fixtures/golden_streams/antigravity_fixtures.py b/tests/_fixtures/golden_streams/antigravity_fixtures.py
new file mode 100644
index 00000000..17f4ccf8
--- /dev/null
+++ b/tests/_fixtures/golden_streams/antigravity_fixtures.py
@@ -0,0 +1,279 @@
+"""Antigravity golden-master scenarios: recorded Step streams + a runner.
+
+The agent drains ``conversation.receive_steps()``, so a scenario is an ordered
+list of ``Step``-shaped ``SimpleNamespace`` objects (or a list of batches, one
+per successive drain). No SDK is needed: ``test_antigravity_agent``'s own
+docstring notes the module does not require ``google-antigravity``, and the
+driver here is the same ``SimpleNamespace`` fake.
+
+The ``_step`` / ``_usage`` / ``_tc`` / ``_FakeConversation`` / ``_agent_with_steps``
+helpers live HERE and are imported back into ``test_antigravity_agent`` — one
+definition, two consumers.
+"""
+
+from __future__ import annotations
+
+import pathlib
+from dataclasses import dataclass
+from types import SimpleNamespace
+from typing import Any
+from unittest.mock import patch
+
+from coder_eval.agents import antigravity_agent
+from coder_eval.agents.antigravity_agent import AntigravityAgent
+from coder_eval.models import parse_agent_config
+
+
+def _usage(prompt: int, cached: int, candidates: int, thoughts: int) -> SimpleNamespace:
+    return SimpleNamespace(
+        prompt_token_count=prompt,
+        cached_content_token_count=cached,
+        candidates_token_count=candidates,
+        thoughts_token_count=thoughts,
+        total_token_count=prompt + candidates + thoughts,
+    )
+
+
+def _tc(name: str, tid: str, args: dict) -> SimpleNamespace:
+    return SimpleNamespace(name=name, id=tid, args=args)
+
+
+def _step(
+    stype,
+    status,
+    *,
+    source="MODEL",
+    target="TARGET_USER",
+    tool_calls=None,
+    content="",
+    content_delta="",
+    thinking="",
+    thinking_delta="",
+    usage=None,
+    complete=None,
+    error="",
+    step_index=0,
+    trajectory_id="",
+):
+    # Plain strings stand in for the SDK's str-enums (_enum_value passes them through).
+    return SimpleNamespace(
+        type=stype,
+        status=status,
+        source=source,
+        target=target,
+        tool_calls=tool_calls or [],
+        content=content,
+        content_delta=content_delta,
+        thinking=thinking,
+        thinking_delta=thinking_delta,
+        usage_metadata=usage,
+        is_complete_response=complete,
+        error=error,
+        step_index=step_index,
+        trajectory_id=trajectory_id,
+    )
+
+
+class _FakeConversation:
+    """Scriptable fake SDK conversation.
+
+    ``steps`` is either a flat list (one batch, yielded on the first
+    ``receive_steps()`` call) or a list of batches (one per successive
+    ``receive_steps()`` call — the shape a poll loop drains repeatedly). Once
+    the authored batches are exhausted, further calls yield an EMPTY batch —
+    this mirrors the real SDK's local connection, which drains a queue and
+    returns immediately with nothing once idle; it never replays already-
+    yielded steps. A test standing in for a background job that never
+    resolves should author one batch that opens the orphan and let
+    exhaustion naturally fall through to empty polls, not repeat itself.
+    """
+
+    def __init__(self, steps):
+        self._batches = list(steps) if steps and isinstance(steps[0], list) else [steps]
+        self._batch_index = 0
+        self.last_response = ""
+        self.receive_steps_call_count = 0
+        self.cancel_call_count = 0
+
+    async def send(self, prompt, **kwargs):
+        return None
+
+    async def receive_steps(self):
+        self.receive_steps_call_count += 1
+        batch = self._batches[self._batch_index] if self._batch_index < len(self._batches) else []
+        self._batch_index += 1
+        for s in batch:
+            yield s
+
+    async def cancel(self):
+        self.cancel_call_count += 1
+
+
+def _agent_with_steps(steps):
+    agent = AntigravityAgent(parse_agent_config(type="antigravity", model="gemini-3.5-flash"))
+    agent.working_directory = pathlib.Path("/tmp")
+    agent._sdk_agent = SimpleNamespace(conversation=_FakeConversation(steps), is_started=True)
+    return agent
+
+
+async def _no_sleep(_seconds: float) -> None:
+    """Stand-in for asyncio.sleep in the poll loop — no real wait."""
+    return None
+
+
+@dataclass
+class AntigravityScenario:
+    """One recorded Step stream.
+
+    No ``expects`` knob: every scenario here replays cleanly. The crash and
+    timeout paths are covered by ``test_antigravity_agent``'s own tests, which
+    need to assert on the exception rather than on a snapshot. Add the branch
+    back with the first scenario that needs it, not before.
+    """
+
+    name: str
+    steps: list[Any]
+
+
+async def run_antigravity_scenario(scenario: AntigravityScenario, working_dir: str) -> dict[str, Any]:
+    """Replay one scenario and return the resulting record as a plain dump."""
+    agent = _agent_with_steps(scenario.steps)
+    agent.working_directory = pathlib.Path(working_dir)
+    # Neutralize the orphan poll loop's real 5s sleeps. `d_orphaned_tool`
+    # leaves a tool ACTIVE on purpose, which is exactly the path that waits —
+    # up to 120 cycles, i.e. ten minutes of wall clock in a unit test. The
+    # loop's LOGIC is what the scenario records; the waiting is not.
+    with patch.object(antigravity_agent.asyncio, "sleep", _no_sleep):
+        record = await agent.communicate("do it")
+    return record.model_dump(mode="json")
+
+
+def _build_catalogue() -> list[AntigravityScenario]:
+    """One scenario per behaviour that has actually bitten."""
+    scenarios: list[AntigravityScenario] = []
+
+    # (a) a single text response with usage -> one assistant message.
+    scenarios.append(
+        AntigravityScenario(
+            name="a_single_text_turn",
+            steps=[
+                _step(
+                    "TEXT_RESPONSE",
+                    "DONE",
+                    content="All done.",
+                    content_delta="All done.",
+                    complete=True,
+                    usage=_usage(100, 0, 20, 0),
+                ),
+            ],
+        )
+    )
+
+    # (b) a tool call that resolves -> command telemetry with both bounds.
+    scenarios.append(
+        AntigravityScenario(
+            name="b_tool_call_resolved",
+            steps=[
+                _step(
+                    "TOOL_CALL",
+                    "ACTIVE",
+                    target="TARGET_ENVIRONMENT",
+                    tool_calls=[_tc("run_command", "t1", {"command_line": "echo hi"})],
+                ),
+                _step(
+                    "TOOL_CALL",
+                    "DONE",
+                    target="TARGET_ENVIRONMENT",
+                    tool_calls=[
+                        _tc("run_command", "t1", {"command_line": "echo hi", "exit_code": 0, "combined_output": "hi"})
+                    ],
+                ),
+                _step(
+                    "TEXT_RESPONSE",
+                    "DONE",
+                    content="done",
+                    content_delta="done",
+                    complete=True,
+                    usage=_usage(120, 0, 15, 0),
+                ),
+            ],
+        )
+    )
+
+    # (c) thinking and a tool inside ONE generation — the interleaved shape the
+    # generation-window subtraction exists for.
+    scenarios.append(
+        AntigravityScenario(
+            name="c_thinking_and_tool_same_generation",
+            steps=[
+                _step("THINKING", "DONE", thinking="planning"),
+                _step(
+                    "TOOL_CALL",
+                    "ACTIVE",
+                    target="TARGET_ENVIRONMENT",
+                    tool_calls=[_tc("view_file", "t1", {"file_path": "a.py"})],
+                ),
+                _step(
+                    "TOOL_CALL",
+                    "DONE",
+                    target="TARGET_ENVIRONMENT",
+                    tool_calls=[_tc("view_file", "t1", {"file_path": "a.py", "output": "x = 1"})],
+                ),
+                _step(
+                    "TEXT_RESPONSE",
+                    "DONE",
+                    content="read it",
+                    content_delta="read it",
+                    complete=True,
+                    usage=_usage(200, 0, 40, 10),
+                ),
+            ],
+        )
+    )
+
+    # (d) a tool left ACTIVE -> force-closed unresolved, honestly untimed.
+    scenarios.append(
+        AntigravityScenario(
+            name="d_orphaned_tool",
+            steps=[
+                _step(
+                    "TOOL_CALL",
+                    "ACTIVE",
+                    target="TARGET_ENVIRONMENT",
+                    tool_calls=[_tc("run_command", "bg1", {"command_line": "sleep 999"})],
+                ),
+                _step(
+                    "TEXT_RESPONSE",
+                    "DONE",
+                    content="backgrounded",
+                    content_delta="backgrounded",
+                    complete=True,
+                    usage=_usage(90, 0, 10, 0),
+                ),
+            ],
+        )
+    )
+
+    # (e) three generations -> three chained windows.
+    scenarios.append(
+        AntigravityScenario(
+            name="e_multi_generation",
+            steps=[
+                _step("THINKING", "DONE", thinking="first", usage=_usage(100, 0, 10, 5)),
+                _step("THINKING", "DONE", thinking="second", usage=_usage(110, 0, 12, 6)),
+                _step(
+                    "TEXT_RESPONSE",
+                    "DONE",
+                    content="third",
+                    content_delta="third",
+                    complete=True,
+                    usage=_usage(120, 0, 14, 0),
+                ),
+            ],
+        )
+    )
+
+    return scenarios
+
+
+ANTIGRAVITY_SCENARIOS: list[AntigravityScenario] = _build_catalogue()
diff --git a/tests/_fixtures/golden_streams/codex_fixtures.py b/tests/_fixtures/golden_streams/codex_fixtures.py
index e58bf345..30008af7 100644
--- a/tests/_fixtures/golden_streams/codex_fixtures.py
+++ b/tests/_fixtures/golden_streams/codex_fixtures.py
@@ -179,7 +179,12 @@ def _build_catalogue() -> list[CodexScenario]:
         )
     )
 
-    # (b) commandExecution start+complete + tokenUsage + turn/completed.
+    # (b) commandExecution start+complete, then a reply, + tokenUsage +
+    # turn/completed. The reply is not decoration: without it the emission is
+    # tool-ONLY, its whole window is the command's execution, and the
+    # generation-window subtraction correctly reports 0ms of model time —
+    # which would make this scenario blind to a harness that stopped
+    # measuring generation at all.
     cmd = _command("cmd_b")
     scenarios.append(
         CodexScenario(
@@ -187,6 +192,12 @@ def _build_catalogue() -> list[CodexScenario]:
             notifications=[
                 _item("item/started", cmd, started_at_ms=_T0_MS),
                 _item("item/completed", cmd, completed_at_ms=_T0_MS + 250),
+                _delta("done"),
+                _item(
+                    "item/completed",
+                    _agent_message("done"),
+                    completed_at_ms=_T0_MS + 400,
+                ),
                 _token_usage(inp=120, out=30, cached=0),
                 _turn_completed(),
             ],
diff --git a/tests/_fixtures/golden_streams/expected/antigravity_a_single_text_turn.json b/tests/_fixtures/golden_streams/expected/antigravity_a_single_text_turn.json
new file mode 100644
index 00000000..e388dae4
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/antigravity_a_single_text_turn.json
@@ -0,0 +1,52 @@
+{
+  "agent_output": "All done.",
+  "assistant_turn_count": 1,
+  "commands": [],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "All done.",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 100,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 20,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "gemini-3.5-flash",
+  "num_turns": 1,
+  "result_summary": null,
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 100,
+    "output_tokens": 20,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 100
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/antigravity_b_tool_call_resolved.json b/tests/_fixtures/golden_streams/expected/antigravity_b_tool_call_resolved.json
new file mode 100644
index 00000000..062c9556
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/antigravity_b_tool_call_resolved.json
@@ -0,0 +1,83 @@
+{
+  "agent_output": "done",
+  "assistant_turn_count": 1,
+  "commands": [
+    {
+      "assistant_turn_index": null,
+      "duration_ms": "<scrubbed>",
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "command": "echo hi"
+      },
+      "result_data": null,
+      "result_status": "success",
+      "result_summary": "hi",
+      "result_tokens": 1,
+      "sequence_number": 0,
+      "timestamp": "<scrubbed>",
+      "tool_id": "t1",
+      "tool_name": "Bash"
+    }
+  ],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "tool_use",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": null,
+          "tool_use_id": "t1"
+        },
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 1,
+          "signature": null,
+          "text": "done",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 120,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 15,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": [
+        "t1"
+      ]
+    }
+  ],
+  "model_used": "gemini-3.5-flash",
+  "num_turns": 1,
+  "result_summary": null,
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 120,
+    "output_tokens": 15,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 120
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/antigravity_c_thinking_and_tool_same_generation.json b/tests/_fixtures/golden_streams/expected/antigravity_c_thinking_and_tool_same_generation.json
new file mode 100644
index 00000000..c767a652
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/antigravity_c_thinking_and_tool_same_generation.json
@@ -0,0 +1,92 @@
+{
+  "agent_output": "read it",
+  "assistant_turn_count": 1,
+  "commands": [
+    {
+      "assistant_turn_index": null,
+      "duration_ms": "<scrubbed>",
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "file_path": "a.py"
+      },
+      "result_data": null,
+      "result_status": "success",
+      "result_summary": "x = 1",
+      "result_tokens": 2,
+      "sequence_number": 0,
+      "timestamp": "<scrubbed>",
+      "tool_id": "t1",
+      "tool_name": "Read"
+    }
+  ],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "thinking",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": "planning",
+          "tool_use_id": null
+        },
+        {
+          "block_type": "tool_use",
+          "is_error": false,
+          "sequence": 1,
+          "signature": null,
+          "text": null,
+          "thinking": null,
+          "tool_use_id": "t1"
+        },
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 2,
+          "signature": null,
+          "text": "read it",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 200,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 50,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 10,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": [
+        "t1"
+      ]
+    }
+  ],
+  "model_used": "gemini-3.5-flash",
+  "num_turns": 1,
+  "result_summary": null,
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 200,
+    "output_tokens": 50,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 200
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/antigravity_d_orphaned_tool.json b/tests/_fixtures/golden_streams/expected/antigravity_d_orphaned_tool.json
new file mode 100644
index 00000000..2cc1c723
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/antigravity_d_orphaned_tool.json
@@ -0,0 +1,72 @@
+{
+  "agent_output": "backgrounded",
+  "assistant_turn_count": 1,
+  "commands": [
+    {
+      "assistant_turn_index": null,
+      "duration_ms": null,
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "command": "sleep 999"
+      },
+      "result_data": null,
+      "result_status": "unknown",
+      "result_summary": null,
+      "result_tokens": 0,
+      "sequence_number": 0,
+      "timestamp": "<scrubbed>",
+      "tool_id": "bg1",
+      "tool_name": "Bash"
+    }
+  ],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "backgrounded",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 90,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 10,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "gemini-3.5-flash",
+  "num_turns": 1,
+  "result_summary": null,
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 90,
+    "output_tokens": 10,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 90
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/antigravity_e_multi_generation.json b/tests/_fixtures/golden_streams/expected/antigravity_e_multi_generation.json
new file mode 100644
index 00000000..ee0f36cb
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/antigravity_e_multi_generation.json
@@ -0,0 +1,106 @@
+{
+  "agent_output": "third",
+  "assistant_turn_count": 3,
+  "commands": [],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "thinking",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": "first",
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 100,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 15,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 5,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": []
+    },
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "thinking",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": "second",
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 110,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 18,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 6,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": []
+    },
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "third",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 120,
+      "message_id": null,
+      "model": "gemini-3.5-flash",
+      "output_tokens": 14,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": null,
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "gemini-3.5-flash",
+  "num_turns": 3,
+  "result_summary": null,
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 330,
+    "output_tokens": 47,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 330
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json b/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
index a4fd16af..4f1ce309 100644
--- a/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
+++ b/tests/_fixtures/golden_streams/expected/codex_b_command_execution.json
@@ -1,5 +1,5 @@
 {
-  "agent_output": "{\n  \"completed_at\": null,\n  \"duration_ms\": 1500,\n  \"error\": null,\n  \"id\": \"turn_1\",\n  \"items\": [],\n  \"items_view\": \"TurnItemsView.full\",\n  \"started_at\": null,\n  \"status\": \"TurnStatus.completed\"\n}",
+  "agent_output": "done",
   "assistant_turn_count": 1,
   "commands": [
     {
@@ -41,6 +41,15 @@
           "text": null,
           "thinking": null,
           "tool_use_id": "cmd_b"
+        },
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 1,
+          "signature": null,
+          "text": "done",
+          "thinking": null,
+          "tool_use_id": null
         }
       ],
       "generation_duration_ms": "<scrubbed>",
diff --git a/tests/_fixtures/golden_streams/expected/opencode_a_single_text_turn.json b/tests/_fixtures/golden_streams/expected/opencode_a_single_text_turn.json
new file mode 100644
index 00000000..3d65a879
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/opencode_a_single_text_turn.json
@@ -0,0 +1,57 @@
+{
+  "agent_output": "All done.",
+  "assistant_turn_count": 1,
+  "commands": [],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 0,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "All done.",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 100,
+      "message_id": "msg_1",
+      "model": "deepseek/deepseek-v4-pro",
+      "output_tokens": 20,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "stop",
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "deepseek/deepseek-v4-pro",
+  "num_turns": 1,
+  "result_summary": {
+    "is_error": false,
+    "result": null,
+    "stop_reason": "stop",
+    "subtype": "completed"
+  },
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "input_tokens": 100,
+    "output_tokens": 20,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 100
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/opencode_b_tool_call_resolved.json b/tests/_fixtures/golden_streams/expected/opencode_b_tool_call_resolved.json
new file mode 100644
index 00000000..571de997
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/opencode_b_tool_call_resolved.json
@@ -0,0 +1,106 @@
+{
+  "agent_output": "Created the file.",
+  "assistant_turn_count": 2,
+  "commands": [
+    {
+      "assistant_turn_index": 1,
+      "duration_ms": "<scrubbed>",
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "file_path": "main.py"
+      },
+      "result_data": null,
+      "result_status": "success",
+      "result_summary": "print('hi')",
+      "result_tokens": 3,
+      "sequence_number": 1,
+      "timestamp": "<scrubbed>",
+      "tool_id": "call_1",
+      "tool_name": "Read"
+    }
+  ],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 5,
+      "cache_read_tokens": 10,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "tool_use",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": null,
+          "tool_use_id": "call_1"
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 85,
+      "message_id": "msg_1",
+      "model": "deepseek/deepseek-v4-pro",
+      "output_tokens": 20,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "tool-calls",
+      "tool_use_ids": [
+        "call_1"
+      ]
+    },
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 40,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "Created the file.",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 10,
+      "message_id": "msg_2",
+      "model": "deepseek/deepseek-v4-pro",
+      "output_tokens": 37,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 7,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "stop",
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "deepseek/deepseek-v4-pro",
+  "num_turns": 2,
+  "result_summary": {
+    "is_error": false,
+    "result": null,
+    "stop_reason": "stop",
+    "subtype": "completed"
+  },
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 5,
+    "cache_read_input_tokens": 50,
+    "input_tokens": 150,
+    "output_tokens": 57,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 95
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/pi_a_single_text_turn.json b/tests/_fixtures/golden_streams/expected/pi_a_single_text_turn.json
new file mode 100644
index 00000000..49083eac
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/pi_a_single_text_turn.json
@@ -0,0 +1,47 @@
+{
+  "agent_output": "",
+  "assistant_turn_count": 1,
+  "commands": [],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 64,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 100,
+      "message_id": null,
+      "model": "openrouter/moonshotai/kimi-k3",
+      "output_tokens": 20,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 0,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "stop",
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "openrouter/moonshotai/kimi-k3",
+  "num_turns": 1,
+  "result_summary": {
+    "is_error": false,
+    "result": null,
+    "stop_reason": "stop",
+    "subtype": "completed"
+  },
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 64,
+    "input_tokens": 164,
+    "output_tokens": 20,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 100
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/expected/pi_b_tool_call_resolved.json b/tests/_fixtures/golden_streams/expected/pi_b_tool_call_resolved.json
new file mode 100644
index 00000000..a1c1aa85
--- /dev/null
+++ b/tests/_fixtures/golden_streams/expected/pi_b_tool_call_resolved.json
@@ -0,0 +1,155 @@
+{
+  "agent_output": "Created `hello.txt` and read it back. Contents: **hi**",
+  "assistant_turn_count": 3,
+  "commands": [
+    {
+      "assistant_turn_index": 1,
+      "duration_ms": "<scrubbed>",
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "content": "hi",
+        "file_path": "hello.txt"
+      },
+      "result_data": null,
+      "result_status": "success",
+      "result_summary": "Successfully wrote 2 bytes to hello.txt",
+      "result_tokens": 10,
+      "sequence_number": 1,
+      "timestamp": "<scrubbed>",
+      "tool_id": "write:0",
+      "tool_name": "Write"
+    },
+    {
+      "assistant_turn_index": 2,
+      "duration_ms": "<scrubbed>",
+      "error_message": null,
+      "execution_completed_at": "<scrubbed>",
+      "execution_started_at": "<scrubbed>",
+      "generation_completed_at": null,
+      "parameters": {
+        "file_path": "hello.txt"
+      },
+      "result_data": null,
+      "result_status": "success",
+      "result_summary": "hi",
+      "result_tokens": 1,
+      "sequence_number": 2,
+      "timestamp": "<scrubbed>",
+      "tool_id": "read:1",
+      "tool_name": "Read"
+    }
+  ],
+  "crash_reason": null,
+  "crashed": false,
+  "duration_seconds": "<scrubbed>",
+  "iteration": 1,
+  "max_turns_exhausted": false,
+  "messages": [
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 1024,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "tool_use",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": null,
+          "tool_use_id": "write:0"
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 406,
+      "message_id": "gen-1788516760-h7AqlA8rocYqvzr5bE9l",
+      "model": "openrouter/moonshotai/kimi-k3",
+      "output_tokens": 77,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 8,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "toolUse",
+      "tool_use_ids": [
+        "write:0"
+      ]
+    },
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 1024,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "tool_use",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": null,
+          "thinking": null,
+          "tool_use_id": "read:1"
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 512,
+      "message_id": "gen-1788516762-S6qNOttzQjEAZuTdBsee",
+      "model": "openrouter/moonshotai/kimi-k3",
+      "output_tokens": 52,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 3,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "toolUse",
+      "tool_use_ids": [
+        "read:1"
+      ]
+    },
+    {
+      "cache_creation_tokens": 0,
+      "cache_read_tokens": 1536,
+      "completed_at": "<scrubbed>",
+      "content_blocks": [
+        {
+          "block_type": "text",
+          "is_error": false,
+          "sequence": 0,
+          "signature": null,
+          "text": "Created `hello.txt` and read it back. Contents: **hi**",
+          "thinking": null,
+          "tool_use_id": null
+        }
+      ],
+      "generation_duration_ms": "<scrubbed>",
+      "input_tokens": 79,
+      "message_id": "gen-1788516764-PDS1DE9HRseKaqHTeGIx",
+      "model": "openrouter/moonshotai/kimi-k3",
+      "output_tokens": 31,
+      "parent_tool_use_id": null,
+      "reasoning_tokens": 3,
+      "role": "assistant",
+      "started_at": "<scrubbed>",
+      "stop_reason": "stop",
+      "tool_use_ids": []
+    }
+  ],
+  "model_used": "openrouter/moonshotai/kimi-k3",
+  "num_turns": 3,
+  "result_summary": {
+    "is_error": false,
+    "result": null,
+    "stop_reason": "stop",
+    "subtype": "completed"
+  },
+  "timestamp": "<scrubbed>",
+  "token_usage": {
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 3584,
+    "input_tokens": 4581,
+    "output_tokens": 160,
+    "total_cost_usd": "<scrubbed>",
+    "uncached_input_tokens": 997
+  },
+  "user_input": "do it"
+}
diff --git a/tests/_fixtures/golden_streams/opencode_fixtures.py b/tests/_fixtures/golden_streams/opencode_fixtures.py
new file mode 100644
index 00000000..f88c6a32
--- /dev/null
+++ b/tests/_fixtures/golden_streams/opencode_fixtures.py
@@ -0,0 +1,227 @@
+"""OpenCode golden-master scenarios: recorded CLI event lines + a runner.
+
+The agent shells out to ``opencode run --format json`` and reduces its
+newline-delimited JSON, so a scenario is an ordered list of event LINES and the
+driver is a fake process that replays them. No Python package to guard on:
+``pyproject.toml`` declares ``opencode = []``.
+
+The event helpers, the ``HAPPY_STREAM`` sample and the ``_FakeProcess`` /
+``_RunningProcess`` fakes live HERE and are imported back into
+``test_opencode_agent`` — one definition, two consumers. The ``patch_exec``
+pytest FIXTURE stays in that module (it needs ``monkeypatch``); the runner
+below does the same patching with a plain context manager.
+
+The lines mirror events CAPTURED FROM A LIVE run — the CLI's own compact
+vocabulary (``step_start`` / ``step_finish`` / ``text`` / ``tool_use``, payload
+under ``part``). Do NOT "correct" them toward the ``session.next.*`` names in
+the server's OpenAPI schema: those describe ``opencode serve``'s SSE surface,
+and an earlier version of this harness parsed them and silently captured zero
+telemetry on a real run.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+from dataclasses import dataclass
+from typing import Any
+from unittest.mock import patch
+
+from coder_eval.agents.opencode_agent import OpenCodeAgent
+from coder_eval.models import OpenCodeAgentConfig
+
+
+SESSION = "ses_test123"
+
+
+def _evt(event_type: str, part: dict[str, Any]) -> str:
+    """One CLI event line: payload under ``part``, sessionID on the envelope."""
+    return json.dumps(
+        {"type": event_type, "timestamp": 1786663016802, "sessionID": SESSION, "part": {"sessionID": SESSION, **part}}
+    )
+
+
+def _tokens(inp: int, out: int, *, write: int = 0, read: int = 0, reasoning: int = 0) -> dict[str, Any]:
+    """Token payload in the NESTED convention (total = input+output+reasoning, cache
+    counted inside `input`); see TestTokenShapeIsObservable for the flat one."""
+    return {
+        "total": inp + out + reasoning,
+        "input": inp,
+        "output": out,
+        "reasoning": reasoning,
+        "cache": {"write": write, "read": read},
+    }
+
+
+HAPPY_STREAM = [
+    _evt("step_start", {"id": "prt_1", "messageID": "msg_1", "type": "step-start"}),
+    _evt(
+        "tool_use",
+        {
+            "id": "prt_2",
+            "messageID": "msg_1",
+            "type": "tool",
+            "tool": "read",
+            "callID": "call_1",
+            "state": {
+                "status": "completed",
+                "input": {"filePath": "main.py"},
+                "output": "print('hi')",
+                "time": {"start": 1786663018214, "end": 1786663018231},
+            },
+        },
+    ),
+    _evt(
+        "step_finish",
+        {
+            "id": "prt_3",
+            "messageID": "msg_1",
+            "reason": "tool-calls",
+            "cost": 0.001,
+            "tokens": _tokens(100, 20, write=5, read=10),
+        },
+    ),
+    _evt("step_start", {"id": "prt_4", "messageID": "msg_2", "type": "step-start"}),
+    _evt("text", {"id": "prt_5", "messageID": "msg_2", "type": "text", "text": "Created the file."}),
+    _evt(
+        "step_finish",
+        {
+            "id": "prt_6",
+            "messageID": "msg_2",
+            "reason": "stop",
+            "cost": 0.002,
+            "tokens": _tokens(50, 30, read=40, reasoning=7),
+        },
+    ),
+]
+
+
+class _FakeProcess:
+    def __init__(self, lines: list[str], returncode: int = 0, stderr: bytes = b"") -> None:
+        self._lines = [f"{line}\n".encode() for line in lines]
+        self.returncode: int | None = None
+        self._final_returncode = returncode
+        self._stderr = stderr
+        self.pid = 4242
+        self.terminated = False
+        self.killed = False
+        self.stdout = self
+
+    async def readline(self) -> bytes:
+        if self._lines:
+            return self._lines.pop(0)
+        self.returncode = self._final_returncode
+        return b""
+
+    async def read(self) -> bytes:
+        return self._stderr
+
+    async def wait(self) -> int:
+        self.returncode = self._final_returncode
+        return self.returncode
+
+    def terminate(self) -> None:
+        self.terminated = True
+        self.returncode = self._final_returncode
+
+    def kill(self) -> None:
+        self.killed = True
+        self.returncode = self._final_returncode
+
+
+class _RunningProcess(_FakeProcess):
+    """A process that stays alive until it is explicitly terminated or killed.
+
+    Needed for teardown assertions: the plain fake reports an exit code as soon
+    as ``wait()`` is awaited, so ``kill()`` would (correctly) skip ``terminate()``
+    on an already-dead process and the test would prove nothing.
+    """
+
+    def __init__(self, lines: list[str], **kwargs: Any) -> None:
+        super().__init__(lines, **kwargs)
+        self._exited = asyncio.Event()
+
+    async def wait(self) -> int:
+        await self._exited.wait()
+        self.returncode = self._final_returncode
+        return self.returncode
+
+    def terminate(self) -> None:
+        self.terminated = True
+        self._exited.set()
+
+    def kill(self) -> None:
+        self.killed = True
+        self._exited.set()
+
+
+def _agent() -> OpenCodeAgent:
+    return OpenCodeAgent(OpenCodeAgentConfig(type="opencode", model="deepseek/deepseek-v4-pro"), task_id="t1")
+
+
+@dataclass
+class OpenCodeScenario:
+    """One recorded CLI event stream.
+
+    No ``expects`` knob: every scenario here replays cleanly. The crash and
+    timeout paths live in the agent's own test module, which asserts on the
+    exception rather than on a snapshot.
+    """
+
+    name: str
+    lines: list[str]
+
+
+async def run_opencode_scenario(scenario: OpenCodeScenario, working_dir: str) -> dict[str, Any]:
+    """Replay one scenario and return the resulting record as a plain dump."""
+    proc = _FakeProcess(scenario.lines)
+
+    async def fake_exec(*_argv: str, **_kwargs: Any) -> _FakeProcess:
+        proc.stderr = proc  # type: ignore[assignment]
+        return proc
+
+    agent = _agent()
+    with (
+        patch.object(asyncio, "create_subprocess_exec", fake_exec),
+        patch("shutil.which", lambda _name: "/usr/local/bin/opencode"),
+        patch.object(os, "killpg", lambda _pgid, _sig: None, create=True),
+    ):
+        await agent.start(working_dir)
+        record = await agent.communicate("do it")
+    return record.model_dump(mode="json")
+
+
+def _build_catalogue() -> list[OpenCodeScenario]:
+    scenarios: list[OpenCodeScenario] = []
+
+    # (a) one step producing text, then a step_finish carrying the usage.
+    scenarios.append(
+        OpenCodeScenario(
+            name="a_single_text_turn",
+            lines=[
+                _evt("step_start", {"id": "prt_1", "messageID": "msg_1"}),
+                _evt("text", {"id": "prt_2", "messageID": "msg_1", "text": "All done."}),
+                _evt(
+                    "step_finish",
+                    {
+                        "id": "prt_3",
+                        "messageID": "msg_1",
+                        "reason": "stop",
+                        "cost": 0.001,
+                        "tokens": _tokens(100, 20),
+                    },
+                ),
+            ],
+        )
+    )
+
+    # (b) a resolved tool call inside a step.
+    scenarios.append(
+        OpenCodeScenario(name="b_tool_call_resolved", lines=list(HAPPY_STREAM)),
+    )
+
+    return scenarios
+
+
+OPENCODE_SCENARIOS: list[OpenCodeScenario] = _build_catalogue()
diff --git a/tests/_fixtures/golden_streams/pi_fixtures.py b/tests/_fixtures/golden_streams/pi_fixtures.py
new file mode 100644
index 00000000..26297241
--- /dev/null
+++ b/tests/_fixtures/golden_streams/pi_fixtures.py
@@ -0,0 +1,207 @@
+"""Pi golden-master scenarios: recorded CLI event lines + a runner.
+
+The agent shells out to ``pi -p --mode json`` and reduces its newline-delimited
+JSON, so a scenario is an ordered list of event LINES and the driver is a fake
+process that replays them. No Python package to guard on: ``pyproject.toml``
+declares ``pi = []``.
+
+The event helpers, the ``HAPPY_STREAM`` sample (read from
+``tests/fixtures/pi_happy_stream.jsonl``) and the ``_FakeProcess`` /
+``_RunningProcess`` fakes live HERE and are imported back into
+``test_pi_agent`` — one definition, two consumers. The ``patch_exec`` pytest
+FIXTURE stays in that module (it needs ``monkeypatch``); the runner below does
+the same patching with a plain context manager.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from unittest.mock import patch
+
+from coder_eval.agents.pi_agent import PiAgent
+from coder_eval.models import PiAgentConfig
+
+
+# tests/_fixtures/golden_streams/ -> tests/fixtures/ (this module moved two
+# directories deeper than the test file the path was written for).
+_FIXTURE = Path(__file__).resolve().parents[2] / "fixtures" / "pi_happy_stream.jsonl"
+HAPPY_STREAM = _FIXTURE.read_text(encoding="utf-8").splitlines()
+
+# Derived from the fixture's three `turn_end` usages (per-generation, summed):
+#   input   406 + 512 + 79   = 997
+#   output  (69+8)+(49+3)+(28+3) = 160   (reasoning folds into the output rate)
+#   cacheRead 1024 + 1024 + 1536 = 3584
+#   cost.total 0.002177194 + 0.002192494 + 0.000951666 = 0.005321354
+EXPECTED_INPUT = 997
+EXPECTED_OUTPUT = 160
+EXPECTED_CACHE_READ = 3584
+EXPECTED_COST = 0.005321354
+
+
+def _turn_start() -> str:
+    return json.dumps({"type": "turn_start"})
+
+
+def _turn_end(*, inp: int, out: int, cache_read: int = 0, cache_write: int = 0, reasoning: int = 0, cost: float = 0.0):
+    """A `turn_end` event carrying that step's own (per-generation) usage."""
+    usage: dict[str, Any] = {
+        "input": inp,
+        "output": out,
+        "cacheRead": cache_read,
+        "cacheWrite": cache_write,
+        "reasoning": reasoning,
+        "totalTokens": inp + out + cache_read + cache_write,
+        "cost": {"total": cost},
+    }
+    return json.dumps(
+        {"type": "turn_end", "message": {"role": "assistant", "usage": usage, "stopReason": "stop"}, "toolResults": []}
+    )
+
+
+def _tool_start(call_id: str, name: str, args: dict[str, Any]) -> str:
+    return json.dumps({"type": "tool_execution_start", "toolCallId": call_id, "toolName": name, "args": args})
+
+
+def _tool_end(call_id: str, name: str, text: str, *, is_error: bool = False) -> str:
+    return json.dumps(
+        {
+            "type": "tool_execution_end",
+            "toolCallId": call_id,
+            "toolName": name,
+            "result": {"content": [{"type": "text", "text": text}]},
+            "isError": is_error,
+        }
+    )
+
+
+class _FakeProcess:
+    def __init__(self, lines: list[str], returncode: int = 0, stderr: bytes = b"") -> None:
+        self._lines = [f"{line}\n".encode() for line in lines]
+        self.returncode: int | None = None
+        self._final_returncode = returncode
+        self._stderr = stderr
+        self.pid = 4242
+        self.terminated = False
+        self.killed = False
+        self.stdout = self
+
+    async def readline(self) -> bytes:
+        if self._lines:
+            return self._lines.pop(0)
+        self.returncode = self._final_returncode
+        return b""
+
+    async def read(self) -> bytes:
+        return self._stderr
+
+    async def wait(self) -> int:
+        self.returncode = self._final_returncode
+        return self.returncode
+
+    def terminate(self) -> None:
+        self.terminated = True
+        self.returncode = self._final_returncode
+
+    def kill(self) -> None:
+        self.killed = True
+        self.returncode = self._final_returncode
+
+
+class _RunningProcess(_FakeProcess):
+    """A process that stays alive until it is explicitly terminated or killed."""
+
+    def __init__(self, lines: list[str], **kwargs: Any) -> None:
+        super().__init__(lines, **kwargs)
+        self._exited = asyncio.Event()
+
+    async def wait(self) -> int:
+        await self._exited.wait()
+        self.returncode = self._final_returncode
+        return self.returncode
+
+    def terminate(self) -> None:
+        self.terminated = True
+        self._exited.set()
+
+    def kill(self) -> None:
+        self.killed = True
+        self._exited.set()
+
+
+class _ExplodingRunningProcess(_RunningProcess):
+    """Raises from ``readline`` mid-stream AND stays alive, like the real CLI.
+
+    ``_ExplodingProcess`` inherits the plain fake's ``wait()``, which reports an
+    exit code the instant it is awaited — so it can never model the case that
+    matters for teardown: the read loop dying while the CLI is still streaming.
+    """
+
+    async def readline(self) -> bytes:
+        if self._lines:
+            return self._lines.pop(0)
+        raise ValueError("Separator is not found, and chunk exceed the limit")
+
+
+def _agent() -> PiAgent:
+    return PiAgent(PiAgentConfig(type="pi", model="openrouter/moonshotai/kimi-k3"), task_id="t1")
+
+
+@dataclass
+class PiScenario:
+    """One recorded CLI event stream.
+
+    No ``expects`` knob: every scenario here replays cleanly. The crash and
+    timeout paths live in the agent's own test module, which asserts on the
+    exception rather than on a snapshot.
+    """
+
+    name: str
+    lines: list[str]
+
+
+async def run_pi_scenario(scenario: PiScenario, working_dir: str) -> dict[str, Any]:
+    """Replay one scenario and return the resulting record as a plain dump."""
+    proc = _FakeProcess(scenario.lines)
+
+    async def fake_exec(*_argv: str, **_kwargs: Any) -> _FakeProcess:
+        proc.stderr = proc  # type: ignore[assignment]
+        return proc
+
+    agent = _agent()
+    with (
+        patch.object(asyncio, "create_subprocess_exec", fake_exec),
+        patch("shutil.which", lambda _name: "/usr/local/bin/pi"),
+        patch.object(os, "killpg", lambda _pgid, _sig: None, create=True),
+    ):
+        await agent.start(working_dir)
+        record = await agent.communicate("do it")
+    return record.model_dump(mode="json")
+
+
+def _build_catalogue() -> list[PiScenario]:
+    scenarios: list[PiScenario] = []
+
+    # (a) one turn producing text, with its own per-generation usage.
+    scenarios.append(
+        PiScenario(
+            name="a_single_text_turn",
+            lines=[
+                _turn_start(),
+                json.dumps({"type": "text", "text": "All done."}),
+                _turn_end(inp=100, out=20, cache_read=64, cost=0.001),
+            ],
+        )
+    )
+
+    # (b) the captured live stream: three turns with resolved tool calls.
+    scenarios.append(PiScenario(name="b_tool_call_resolved", lines=list(HAPPY_STREAM)))
+
+    return scenarios
+
+
+PI_SCENARIOS: list[PiScenario] = _build_catalogue()
diff --git a/tests/test_agent_golden_master.py b/tests/test_agent_golden_master.py
index d3ded997..aac9d58d 100644
--- a/tests/test_agent_golden_master.py
+++ b/tests/test_agent_golden_master.py
@@ -23,8 +23,12 @@
 
 import pytest
 
-from tests._fixtures.golden_streams import assert_reconciliation, scrub
+from coder_eval.models import AgentKind
+from tests._fixtures.golden_streams import assert_reconciliation, assert_timing_captured, scrub
+from tests._fixtures.golden_streams.antigravity_fixtures import ANTIGRAVITY_SCENARIOS, run_antigravity_scenario
 from tests._fixtures.golden_streams.claude_fixtures import CLAUDE_SCENARIOS, run_claude_scenario
+from tests._fixtures.golden_streams.opencode_fixtures import OPENCODE_SCENARIOS, run_opencode_scenario
+from tests._fixtures.golden_streams.pi_fixtures import PI_SCENARIOS, run_pi_scenario
 
 
 # Codex is an optional extra (mirrors test_codex_agent's guard). Import its
@@ -38,6 +42,34 @@
     run_codex_scenario = None
 
 
+# Scenarios that legitimately produce no measurable generation window. Strict
+# is the default: a new scenario is asserted to have one until it is named
+# here, so a harness that silently stops recording windows fails instead of
+# passing. Each entry carries the reason it cannot have one.
+NO_GENERATION_WINDOW: frozenset[str] = frozenset(
+    {
+        "claude_g_crash_format_placeholder",  # crash partial: 0 assistant messages
+        "claude_h1_timeout_process_error",  # timeout partial: 0 assistant messages
+        "claude_h2_process_error_crash",  # crash partial: 0 assistant messages
+        # Drives a SCRIPTED monotonic clock (a constant 1000.0 until the
+        # deadline flips) so the deadline break is deterministic. The window
+        # is zero by fixture construction, not by anything the harness did.
+        "claude_i_in_loop_deadline_break",
+        "codex_g_items_rebuild",  # rollout rebuild: Turn items carry no timestamps
+        # Codex emissions whose ENTIRE measurable window was tool execution.
+        # The window is subtracted down to 0 because that is the honest
+        # answer, not because nothing was recorded — see the generation-window
+        # subtraction in codex_agent._flush_message.
+        "codex_d_cross_flush_is_error",  # flush lands before the tool completes: zero-width window
+        "codex_e_orphan_tool",  # the tool never completes, so the window never opens
+    }
+)
+
+
+def _expect_window(harness: str, scenario_name: str) -> bool:
+    return f"{harness}_{scenario_name}" not in NO_GENERATION_WINDOW
+
+
 _EXPECTED_DIR = Path(__file__).parent / "_fixtures" / "golden_streams" / "expected"
 _REGEN = os.environ.get("GOLDEN_REGEN", "").strip().lower() in {"1", "true", "yes", "on"}
 
@@ -69,6 +101,7 @@ async def test_claude_golden(scenario, tmp_path):
     # Reconciliation is asserted on the UNscrubbed dump (token buckets are never
     # scrubbed, but cost/timestamps are — assert before masking to be explicit).
     assert_reconciliation(raw)
+    assert_timing_captured(raw, expect_generation_window=_expect_window("claude", scenario.name))
     _compare_or_regen(f"claude_{scenario.name}", scrub(raw))
 
 
@@ -78,6 +111,7 @@ async def test_claude_golden(scenario, tmp_path):
 async def test_codex_golden(scenario, tmp_path):
     raw = await run_codex_scenario(scenario, str(tmp_path))
     assert_reconciliation(raw)
+    assert_timing_captured(raw, expect_generation_window=_expect_window("codex", scenario.name))
     _compare_or_regen(f"codex_{scenario.name}", scrub(raw))
 
 
@@ -96,3 +130,212 @@ async def test_codex_reconciliation_invariant(scenario, tmp_path):
     """The per-bucket reconciliation invariant holds for every Codex snapshot."""
     raw = await run_codex_scenario(scenario, str(tmp_path))
     assert_reconciliation(raw)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", ANTIGRAVITY_SCENARIOS, ids=lambda s: s.name)
+async def test_antigravity_golden(scenario, tmp_path):
+    raw = await run_antigravity_scenario(scenario, str(tmp_path))
+    assert_reconciliation(raw)
+    assert_timing_captured(raw, expect_generation_window=_expect_window("antigravity", scenario.name))
+    _compare_or_regen(f"antigravity_{scenario.name}", scrub(raw))
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", ANTIGRAVITY_SCENARIOS, ids=lambda s: s.name)
+async def test_antigravity_reconciliation_invariant(scenario, tmp_path):
+    """The per-bucket reconciliation invariant holds for every Antigravity snapshot."""
+    assert_reconciliation(await run_antigravity_scenario(scenario, str(tmp_path)))
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", OPENCODE_SCENARIOS, ids=lambda s: s.name)
+async def test_opencode_golden(scenario, tmp_path):
+    raw = await run_opencode_scenario(scenario, str(tmp_path))
+    assert_reconciliation(raw)
+    assert_timing_captured(raw, expect_generation_window=_expect_window("opencode", scenario.name))
+    _compare_or_regen(f"opencode_{scenario.name}", scrub(raw))
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", OPENCODE_SCENARIOS, ids=lambda s: s.name)
+async def test_opencode_reconciliation_invariant(scenario, tmp_path):
+    """The per-bucket reconciliation invariant holds for every OpenCode snapshot."""
+    assert_reconciliation(await run_opencode_scenario(scenario, str(tmp_path)))
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", PI_SCENARIOS, ids=lambda s: s.name)
+async def test_pi_golden(scenario, tmp_path):
+    raw = await run_pi_scenario(scenario, str(tmp_path))
+    assert_reconciliation(raw)
+    assert_timing_captured(raw, expect_generation_window=_expect_window("pi", scenario.name))
+    _compare_or_regen(f"pi_{scenario.name}", scrub(raw))
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("scenario", PI_SCENARIOS, ids=lambda s: s.name)
+async def test_pi_reconciliation_invariant(scenario, tmp_path):
+    """The per-bucket reconciliation invariant holds for every Pi snapshot."""
+    assert_reconciliation(await run_pi_scenario(scenario, str(tmp_path)))
+
+
+# The ONE place a harness is listed for golden coverage. Derived from AgentKind
+# rather than from register_builtins, whose built-in list is a hardcoded tuple
+# inside the function body that returns nothing and exposes no set.
+SCENARIOS_BY_AGENT: dict[AgentKind, list[Any]] = {
+    AgentKind.CLAUDE_CODE: CLAUDE_SCENARIOS,
+    AgentKind.CODEX: CODEX_SCENARIOS,
+    AgentKind.ANTIGRAVITY: ANTIGRAVITY_SCENARIOS,
+    AgentKind.OPENCODE: OPENCODE_SCENARIOS,
+    AgentKind.PI: PI_SCENARIOS,
+}
+
+# An ALLOWLIST of exclusions, not a denylist of inclusions: a new AgentKind
+# member fails the coverage test until someone decides which it is.
+_NO_GOLDEN_COVERAGE: dict[AgentKind, str] = {
+    # The agentless backend (NoOpAgent): it runs no model and streams nothing,
+    # so there is no event stream to record.
+    AgentKind.NONE: "agentless backend — runs no model, streams nothing",
+    # A sentinel for "agent type could not be determined". Never registered.
+    AgentKind.UNKNOWN: "sentinel for an undeterminable type — never registered",
+}
+
+
+def unaccounted_harnesses(mapping: dict[AgentKind, list[Any]]) -> set[AgentKind]:
+    """AgentKind members that are neither covered by `mapping` nor excluded."""
+    return set(AgentKind) - (set(mapping) | set(_NO_GOLDEN_COVERAGE))
+
+
+def harnesses_without_scenarios(mapping: dict[AgentKind, list[Any]]) -> set[AgentKind]:
+    """Covered harnesses whose scenario list is EMPTY.
+
+    An empty list must fail: a coverage check guarding zero streams is not a
+    coverage check (mirrors runner.py's "a lint rule guarding zero files must
+    fail, not pass").
+    """
+    return {kind for kind, scenarios in mapping.items() if not scenarios}
+
+
+class TestGoldenCoverage:
+    """Every built-in harness has at least one recorded stream.
+
+    A third-party plugin agent (e.g. coder_eval_uipath's ``delegate-sdk``, when
+    that package happens to be installed in the dev env) is deliberately out of
+    scope — which is why this keys on ``AgentKind`` and not on the live
+    registry.
+
+    The two checks are extracted as module-level functions so the negative
+    cases below can run the REAL check against a mutated copy, rather than
+    restating the condition (which passes whatever the check does).
+    """
+
+    def test_every_builtin_agent_kind_is_accounted_for(self):
+        missing = unaccounted_harnesses(SCENARIOS_BY_AGENT)
+        assert not missing, (
+            f"AgentKind member(s) {sorted(k.value for k in missing)} have no golden scenarios and are "
+            "not excluded. Add scenarios, or add an entry to _NO_GOLDEN_COVERAGE with the reason."
+        )
+        assert not (set(SCENARIOS_BY_AGENT) & set(_NO_GOLDEN_COVERAGE)), "a harness cannot be both covered and excluded"
+
+    def test_every_covered_harness_has_scenarios(self):
+        empty = harnesses_without_scenarios(SCENARIOS_BY_AGENT)
+        if not _HAS_CODEX:
+            # The optional extra is absent, so CODEX_SCENARIOS is [] by
+            # construction — not by anyone forgetting to record a stream.
+            empty -= {AgentKind.CODEX}
+        assert not empty, f"listed as covered but has NO scenarios: {sorted(k.value for k in empty)}"
+
+    def test_the_check_catches_an_unaccounted_member(self):
+        # Mutate a COPY and run the REAL check against it.
+        shrunk = {k: v for k, v in SCENARIOS_BY_AGENT.items() if k is not AgentKind.PI}
+        assert unaccounted_harnesses(shrunk) == {AgentKind.PI}
+
+    def test_the_check_catches_an_empty_scenario_list(self):
+        emptied = dict(SCENARIOS_BY_AGENT) | {AgentKind.PI: []}
+        assert AgentKind.PI in harnesses_without_scenarios(emptied)
+
+
+class TestAssertTimingCaptured:
+    """The sensor itself. An AST rule cannot see that an SDK returned 0.0."""
+
+    @staticmethod
+    def _record(*, windows: list[float | None] = (), commands: list[dict[str, Any]] = ()) -> dict[str, Any]:
+        return {
+            "messages": [{"role": "assistant", "generation_duration_ms": w} for w in windows],
+            "commands": list(commands),
+        }
+
+    def test_a_positive_window_passes(self):
+        assert_timing_captured(self._record(windows=[12.5]), expect_generation_window=True)
+
+    def test_a_none_window_raises_when_one_is_expected(self):
+        with pytest.raises(AssertionError, match="positive generation window"):
+            assert_timing_captured(self._record(windows=[None]), expect_generation_window=True)
+
+    def test_exactly_zero_raises_too(self):
+        # The Antigravity defect's exact signature: a value that is present,
+        # numeric, and means nothing was measured.
+        with pytest.raises(AssertionError, match="positive generation window"):
+            assert_timing_captured(self._record(windows=[0.0]), expect_generation_window=True)
+
+    def test_a_none_window_passes_when_none_is_expected(self):
+        assert_timing_captured(self._record(windows=[None]), expect_generation_window=False)
+
+    def test_one_positive_among_several_passes(self):
+        # The FLOOR, not a per-entry rule. claude_d_subagent_terminal holds two
+        # content-bearing messages of which exactly one is legitimately None,
+        # and no scenario-level flag could express "this one but not that one".
+        assert_timing_captured(self._record(windows=[None, 8.0]), expect_generation_window=True)
+
+    def test_a_resolved_command_missing_a_bound_raises(self):
+        record = self._record(
+            windows=[5.0],
+            commands=[
+                {
+                    "tool_id": "t1",
+                    "result_status": "success",
+                    "duration_ms": 10.0,
+                    "execution_started_at": "2026-01-01T00:00:00",
+                    "execution_completed_at": None,
+                }
+            ],
+        )
+        with pytest.raises(AssertionError, match="execution_completed_at"):
+            assert_timing_captured(record, expect_generation_window=True)
+
+    def test_a_resolved_command_missing_its_duration_raises(self):
+        record = self._record(
+            windows=[5.0],
+            commands=[
+                {
+                    "tool_id": "t1",
+                    "result_status": "error",
+                    "duration_ms": None,
+                    "execution_started_at": "2026-01-01T00:00:00",
+                    "execution_completed_at": "2026-01-01T00:00:01",
+                }
+            ],
+        )
+        with pytest.raises(AssertionError, match="duration_ms"):
+            assert_timing_captured(record, expect_generation_window=True)
+
+    def test_an_unresolved_command_is_exempt(self):
+        # Force-closed without a result: never timed, and saying so is the
+        # honest record.
+        record = self._record(
+            windows=[5.0],
+            commands=[
+                {
+                    "tool_id": "orphan",
+                    "result_status": "unknown",
+                    "duration_ms": None,
+                    "execution_started_at": None,
+                    "execution_completed_at": None,
+                }
+            ],
+        )
+        assert_timing_captured(record, expect_generation_window=True)
+
+    def test_a_scenario_with_no_commands_is_vacuously_fine(self):
+        assert_timing_captured(self._record(windows=[5.0]), expect_generation_window=True)
diff --git a/tests/test_antigravity_agent.py b/tests/test_antigravity_agent.py
index 78e9b2e6..d25b249c 100644
--- a/tests/test_antigravity_agent.py
+++ b/tests/test_antigravity_agent.py
@@ -27,6 +27,13 @@
 from coder_eval.plugins import ensure_plugins_loaded
 from coder_eval.pricing import calculate_cost
 from tests._fixtures.golden_streams._scrub import assert_reconciliation
+from tests._fixtures.golden_streams.antigravity_fixtures import (
+    _agent_with_steps,
+    _no_sleep,
+    _step,
+    _tc,
+    _usage,
+)
 
 
 def test_antigravity_registered_to_agent_and_config():
@@ -235,105 +242,6 @@ def test_gemini_models_are_priced(model: str):
 # --- communicate() step-stream mapping (SDK mocked via fake Step stream) ---------
 
 
-def _usage(prompt: int, cached: int, candidates: int, thoughts: int) -> SimpleNamespace:
-    return SimpleNamespace(
-        prompt_token_count=prompt,
-        cached_content_token_count=cached,
-        candidates_token_count=candidates,
-        thoughts_token_count=thoughts,
-        total_token_count=prompt + candidates + thoughts,
-    )
-
-
-def _tc(name: str, tid: str, args: dict) -> SimpleNamespace:
-    return SimpleNamespace(name=name, id=tid, args=args)
-
-
-def _step(
-    stype,
-    status,
-    *,
-    source="MODEL",
-    target="TARGET_USER",
-    tool_calls=None,
-    content="",
-    content_delta="",
-    thinking="",
-    thinking_delta="",
-    usage=None,
-    complete=None,
-    error="",
-    step_index=0,
-    trajectory_id="",
-):
-    # Plain strings stand in for the SDK's str-enums (_enum_value passes them through).
-    return SimpleNamespace(
-        type=stype,
-        status=status,
-        source=source,
-        target=target,
-        tool_calls=tool_calls or [],
-        content=content,
-        content_delta=content_delta,
-        thinking=thinking,
-        thinking_delta=thinking_delta,
-        usage_metadata=usage,
-        is_complete_response=complete,
-        error=error,
-        step_index=step_index,
-        trajectory_id=trajectory_id,
-    )
-
-
-class _FakeConversation:
-    """Scriptable fake SDK conversation.
-
-    ``steps`` is either a flat list (one batch, yielded on the first
-    ``receive_steps()`` call) or a list of batches (one per successive
-    ``receive_steps()`` call — the shape a poll loop drains repeatedly). Once
-    the authored batches are exhausted, further calls yield an EMPTY batch —
-    this mirrors the real SDK's local connection, which drains a queue and
-    returns immediately with nothing once idle; it never replays already-
-    yielded steps. A test standing in for a background job that never
-    resolves should author one batch that opens the orphan and let
-    exhaustion naturally fall through to empty polls, not repeat itself.
-    """
-
-    def __init__(self, steps):
-        self._batches = list(steps) if steps and isinstance(steps[0], list) else [steps]
-        self._batch_index = 0
-        self.last_response = ""
-        self.receive_steps_call_count = 0
-        self.cancel_call_count = 0
-
-    async def send(self, prompt, **kwargs):
-        return None
-
-    async def receive_steps(self):
-        self.receive_steps_call_count += 1
-        batch = self._batches[self._batch_index] if self._batch_index < len(self._batches) else []
-        self._batch_index += 1
-        for s in batch:
-            yield s
-
-    async def cancel(self):
-        self.cancel_call_count += 1
-
-
-def _agent_with_steps(steps):
-    from pathlib import Path
-
-    agent = AntigravityAgent(parse_agent_config(type="antigravity", model="gemini-3.5-flash"))
-    agent.working_directory = Path("/tmp")
-    agent._sdk_agent = SimpleNamespace(conversation=_FakeConversation(steps), is_started=True)
-    return agent
-
-
-async def _no_sleep(_seconds: float) -> None:
-    """Stand-in for asyncio.sleep in poll-loop tests — no real wait."""
-    return None
-
-
 class _FiringWatchdog:
     """Fake ThreadedWatchdog that fires ``on_timeout`` synchronously at entry.
 
diff --git a/tests/test_opencode_agent.py b/tests/test_opencode_agent.py
index e6f16ba2..d526ae79 100644
--- a/tests/test_opencode_agent.py
+++ b/tests/test_opencode_agent.py
@@ -43,130 +43,14 @@
     TurnEndStatus,
     TurnStartEvent,
 )
-
-
-SESSION = "ses_test123"
-
-
-def _evt(event_type: str, part: dict[str, Any]) -> str:
-    """One CLI event line: payload under ``part``, sessionID on the envelope."""
-    return json.dumps(
-        {"type": event_type, "timestamp": 1786663016802, "sessionID": SESSION, "part": {"sessionID": SESSION, **part}}
-    )
-
-
-def _tokens(inp: int, out: int, *, write: int = 0, read: int = 0, reasoning: int = 0) -> dict[str, Any]:
-    """Token payload in the NESTED convention (total = input+output+reasoning, cache
-    counted inside `input`); see TestTokenShapeIsObservable for the flat one."""
-    return {
-        "total": inp + out + reasoning,
-        "input": inp,
-        "output": out,
-        "reasoning": reasoning,
-        "cache": {"write": write, "read": read},
-    }
-
-
-HAPPY_STREAM = [
-    _evt("step_start", {"id": "prt_1", "messageID": "msg_1", "type": "step-start"}),
-    _evt(
-        "tool_use",
-        {
-            "id": "prt_2",
-            "messageID": "msg_1",
-            "type": "tool",
-            "tool": "read",
-            "callID": "call_1",
-            "state": {
-                "status": "completed",
-                "input": {"filePath": "main.py"},
-                "output": "print('hi')",
-                "time": {"start": 1786663018214, "end": 1786663018231},
-            },
-        },
-    ),
-    _evt(
-        "step_finish",
-        {
-            "id": "prt_3",
-            "messageID": "msg_1",
-            "reason": "tool-calls",
-            "cost": 0.001,
-            "tokens": _tokens(100, 20, write=5, read=10),
-        },
-    ),
-    _evt("step_start", {"id": "prt_4", "messageID": "msg_2", "type": "step-start"}),
-    _evt("text", {"id": "prt_5", "messageID": "msg_2", "type": "text", "text": "Created the file."}),
-    _evt(
-        "step_finish",
-        {
-            "id": "prt_6",
-            "messageID": "msg_2",
-            "reason": "stop",
-            "cost": 0.002,
-            "tokens": _tokens(50, 30, read=40, reasoning=7),
-        },
-    ),
-]
-
-
-class _FakeProcess:
-    def __init__(self, lines: list[str], returncode: int = 0, stderr: bytes = b"") -> None:
-        self._lines = [f"{line}\n".encode() for line in lines]
-        self.returncode: int | None = None
-        self._final_returncode = returncode
-        self._stderr = stderr
-        self.pid = 4242
-        self.terminated = False
-        self.killed = False
-        self.stdout = self
-
-    async def readline(self) -> bytes:
-        if self._lines:
-            return self._lines.pop(0)
-        self.returncode = self._final_returncode
-        return b""
-
-    async def read(self) -> bytes:
-        return self._stderr
-
-    async def wait(self) -> int:
-        self.returncode = self._final_returncode
-        return self.returncode
-
-    def terminate(self) -> None:
-        self.terminated = True
-        self.returncode = self._final_returncode
-
-    def kill(self) -> None:
-        self.killed = True
-        self.returncode = self._final_returncode
-
-
-class _RunningProcess(_FakeProcess):
-    """A process that stays alive until it is explicitly terminated or killed.
-
-    Needed for teardown assertions: the plain fake reports an exit code as soon
-    as ``wait()`` is awaited, so ``kill()`` would (correctly) skip ``terminate()``
-    on an already-dead process and the test would prove nothing.
-    """
-
-    def __init__(self, lines: list[str], **kwargs: Any) -> None:
-        super().__init__(lines, **kwargs)
-        self._exited = asyncio.Event()
-
-    async def wait(self) -> int:
-        await self._exited.wait()
-        self.returncode = self._final_returncode
-        return self.returncode
-
-    def terminate(self) -> None:
-        self.terminated = True
-        self._exited.set()
-
-    def kill(self) -> None:
-        self.killed = True
-        self._exited.set()
+from tests._fixtures.golden_streams.opencode_fixtures import (
+    HAPPY_STREAM,
+    SESSION,
+    _evt,
+    _FakeProcess,
+    _RunningProcess,
+    _tokens,
+)
 
 
 @pytest.fixture
diff --git a/tests/test_pi_agent.py b/tests/test_pi_agent.py
index f0c305fe..1496e37f 100644
--- a/tests/test_pi_agent.py
+++ b/tests/test_pi_agent.py
@@ -37,124 +37,20 @@
     TurnEndStatus,
     TurnStartEvent,
 )
-
-
-_FIXTURE = Path(__file__).parent / "fixtures" / "pi_happy_stream.jsonl"
-HAPPY_STREAM = _FIXTURE.read_text(encoding="utf-8").splitlines()
-
-# Derived from the fixture's three `turn_end` usages (per-generation, summed):
-#   input   406 + 512 + 79   = 997
-#   output  (69+8)+(49+3)+(28+3) = 160   (reasoning folds into the output rate)
-#   cacheRead 1024 + 1024 + 1536 = 3584
-#   cost.total 0.002177194 + 0.002192494 + 0.000951666 = 0.005321354
-EXPECTED_INPUT = 997
-EXPECTED_OUTPUT = 160
-EXPECTED_CACHE_READ = 3584
-EXPECTED_COST = 0.005321354
-
-
-def _turn_start() -> str:
-    return json.dumps({"type": "turn_start"})
-
-
-def _turn_end(*, inp: int, out: int, cache_read: int = 0, cache_write: int = 0, reasoning: int = 0, cost: float = 0.0):
-    """A `turn_end` event carrying that step's own (per-generation) usage."""
-    usage: dict[str, Any] = {
-        "input": inp,
-        "output": out,
-        "cacheRead": cache_read,
-        "cacheWrite": cache_write,
-        "reasoning": reasoning,
-        "totalTokens": inp + out + cache_read + cache_write,
-        "cost": {"total": cost},
-    }
-    return json.dumps(
-        {"type": "turn_end", "message": {"role": "assistant", "usage": usage, "stopReason": "stop"}, "toolResults": []}
-    )
-
-
-def _tool_start(call_id: str, name: str, args: dict[str, Any]) -> str:
-    return json.dumps({"type": "tool_execution_start", "toolCallId": call_id, "toolName": name, "args": args})
-
-
-def _tool_end(call_id: str, name: str, text: str, *, is_error: bool = False) -> str:
-    return json.dumps(
-        {
-            "type": "tool_execution_end",
-            "toolCallId": call_id,
-            "toolName": name,
-            "result": {"content": [{"type": "text", "text": text}]},
-            "isError": is_error,
-        }
-    )
-
-
-class _FakeProcess:
-    def __init__(self, lines: list[str], returncode: int = 0, stderr: bytes = b"") -> None:
-        self._lines = [f"{line}\n".encode() for line in lines]
-        self.returncode: int | None = None
-        self._final_returncode = returncode
-        self._stderr = stderr
-        self.pid = 4242
-        self.terminated = False
-        self.killed = False
-        self.stdout = self
-
-    async def readline(self) -> bytes:
-        if self._lines:
-            return self._lines.pop(0)
-        self.returncode = self._final_returncode
-        return b""
-
-    async def read(self) -> bytes:
-        return self._stderr
-
-    async def wait(self) -> int:
-        self.returncode = self._final_returncode
-        return self.returncode
-
-    def terminate(self) -> None:
-        self.terminated = True
-        self.returncode = self._final_returncode
-
-    def kill(self) -> None:
-        self.killed = True
-        self.returncode = self._final_returncode
-
-
-class _RunningProcess(_FakeProcess):
-    """A process that stays alive until it is explicitly terminated or killed."""
-
-    def __init__(self, lines: list[str], **kwargs: Any) -> None:
-        super().__init__(lines, **kwargs)
-        self._exited = asyncio.Event()
-
-    async def wait(self) -> int:
-        await self._exited.wait()
-        self.returncode = self._final_returncode
-        return self.returncode
-
-    def terminate(self) -> None:
-        self.terminated = True
-        self._exited.set()
-
-    def kill(self) -> None:
-        self.killed = True
-        self._exited.set()
-
-
-class _ExplodingRunningProcess(_RunningProcess):
-    """Raises from ``readline`` mid-stream AND stays alive, like the real CLI.
-
-    ``_ExplodingProcess`` inherits the plain fake's ``wait()``, which reports an
-    exit code the instant it is awaited — so it can never model the case that
-    matters for teardown: the read loop dying while the CLI is still streaming.
-    """
-
-    async def readline(self) -> bytes:
-        if self._lines:
-            return self._lines.pop(0)
-        raise ValueError("Separator is not found, and chunk exceed the limit")
+from tests._fixtures.golden_streams.pi_fixtures import (
+    EXPECTED_CACHE_READ,
+    EXPECTED_COST,
+    EXPECTED_INPUT,
+    EXPECTED_OUTPUT,
+    HAPPY_STREAM,
+    _ExplodingRunningProcess,
+    _FakeProcess,
+    _RunningProcess,
+    _tool_end,
+    _tool_start,
+    _turn_end,
+    _turn_start,
+)
 
 
 @pytest.fixture

From 49334c11d732b4d84595777abd9318cfb0c752ac Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 17:17:53 -0700
Subject: [PATCH 07/10] fix: code review fixes for timing capture & reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cross-cutting review caught that the change stopped at three of five
harnesses while the parity table it adds claimed all five.

OpenCode and Pi carry the identical double-count removed from Codex: both
mark a generation window at `step_start` / `turn_start` and close it at
`step_finish` / `turn_end`, and every tool call runs INSIDE that window
while also publishing its own measured duration. Replayed through the real
reducers, a 1s tool inside one step produced `Unaccounted: -99%` — in the
very cell added to catch this. Both now subtract the same union of closed
tool intervals, via the same `busy_ms`, making it four call sites for one
helper. The parity table and its prose say four harnesses interleave, not
two, and name claude-code as the one that does not need the subtraction
(it marks the end of the previous SDK event, so tool time falls between
windows rather than inside one).

The Unaccounted cell also double-counted every sub-agent on every harness.
A sub-agent's emissions carry a `parentToolUseId` and its spawning Agent
call's duration already spans the whole sub-agent run, so summing over all
messages counted its generation twice — a 140s claude-code task with a
120s Agent call containing 90s of sub-agent generation reported -57%. The
strip now sums the main thread only. A negative residual gets its own
amber tint: overlap is a different fact from a large positive residual,
and identical grey hid it.

`scopeRunTasks` was a third duration derivation that phase 1 missed, so
the Duration column used one definition unfiltered and another with a tag
filter active — and a single mature-skipped row with no duration flipped
the all-present guard, rendering "—" for a run whose executed rows were
all timed.

`assert_timing_captured` now also requires the recorded bounds to span the
window it reports. Two harnesses take the duration from a monotonic clock
and the bounds from the wall clock, so a reducer can publish a healthy
duration beside two stamps that collapsed — which is exactly the case
CE059's docstring claims this sensor covers and, until now, it did not.

The cost simulator picked its primary model by generation time, under a
comment asserting that "generation time is recorded for every emission" —
a premise this change invalidated. With every window null it weighed all
models at zero and the first one encountered won, so a Haiku sub-agent
listed before the main Opus message priced the whole task at Haiku rates.
It now falls back to output tokens, then to an equal vote.

CE058 ships five syntactic forms; CLAUDE.md and the rule's own docstring
still said four, omitting the `model_copy(update={...})` dict — the shape
the Antigravity DONE path actually writes through.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                                     |  2 +-
 docs/agents/HARNESS_PARITY.md                 | 27 ++++---
 .../__tests__/message-timeline.test.tsx       | 41 +++++++++++
 .../app/runs/[id]/[...task]/_sections.tsx     | 37 +++++++---
 evalboard/lib/__tests__/overview.test.ts      | 24 +++++++
 evalboard/lib/__tests__/thinkingSim.test.ts   | 32 ++++++++-
 evalboard/lib/overview.ts                     |  8 +++
 evalboard/lib/thinkingSim.ts                  | 17 +++--
 src/coder_eval/agents/opencode_agent.py       | 19 ++++-
 src/coder_eval/agents/pi_agent.py             | 19 ++++-
 tests/_fixtures/golden_streams/_scrub.py      | 23 ++++--
 tests/lint/rules/ce058_no_timing_literal.py   |  4 +-
 tests/test_agent_golden_master.py             | 27 ++++++-
 tests/test_opencode_agent.py                  | 71 +++++++++++++++++++
 tests/test_pi_agent.py                        | 69 ++++++++++++++++++
 15 files changed, 380 insertions(+), 40 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 75382d4d..616945b8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -236,7 +236,7 @@ make plugin-reference  # the plugin's bundled criteria reference from the models
 
 Editing `src/coder_eval/pricing.py` means editing `evalboard/lib/pricing.ts` too — it is a hand-copied mirror, and `evalboard/lib/__tests__/pricing-parity.test.ts` fails the build on drift in either direction.
 
-Recent additions, each traceable to a shipped defect: **CE058** (in `src/coder_eval/`, an unknown timing value may not become a numeric literal — `duration_ms is None` means *never timed* and `0.0` means *timed and instant*, so writing the literal publishes the second while meaning the first. One invariant, one id, four syntactic forms — a zero constructor keyword, `x or 0`, `x if x is not None else 0.0`, and `if x.duration_ms is None: x.duration_ms = 0.0`. Antigravity constructed EVERY message with `generation_duration_ms=0.0`, so the task page's Generation cell read `0ms` and its breakdown rendered `0%` for months with nothing failing; Codex published the SDK's `0.0` as a measured command duration, so `avg_command_time_ms` divided real milliseconds by a command count of which 70 of 211 in one nightly had never been timed. The fourth form is the one no existing rule shape covered and is where a live instance was hiding — `claude_code_agent._finalize_commands` set `0.0` on every command force-closed without a tool result, in the one harness a timing audit had called healthy. BLIND SPOT, stated in the rule's docstring: form 1 keys on the callee's spelling, so renaming the `AssistantMessageTelemetry` import alias silently disarms it there), **CE059** (in `src/coder_eval/agents/`, an `AssistantMessage` may not receive the same `ast.Name` for both `started_at` and `completed_at` — the Antigravity reducer read `datetime.now()` once and passed it as both bounds, so `started_at == completed_at` on 368 of 368 sampled messages. A separate id from CE058 because it is a separate invariant, a zero-length window whatever the duration field says, and one invariant per id is what makes a `# noqa` mean one thing. It does NOT fire when the same call passes `generation_duration_ms=None`: a call that says, in the field built to say it, that no window was measurable is not claiming one — that exemption is what keeps the rule pointed at the misleading case instead of accumulating four permanent suppressions on the rollout-rebuild and sub-agent-synthesis sites), **CE056** (no bare `CODER_EVAL_IN_CONTAINER` literal outside `models/container_paths.py` — the CE053 shape again: a rename-safety constant that shipped beside the literal it replaced, and the straggler was the single WRITER, so a rename would have disarmed four security/correctness gates at once with nothing failing; CE052 cannot catch it because that rule inspects `if` guards and the writer is not one), **CE055** (a criterion `path:` in `tasks/` must be sandbox-relative — an absolute path is joined onto the sandbox root, which DISCARDS the root, so containment refuses it and the criterion can never match whatever the agent does; two in-tree tasks were broken this way and the pair is the argument for a static rule on top of the runtime `CheckerMisuseError`: `byod_smoke_test` IS in a CI bucket and produced only `Results: 7/8 succeeded` plus a gating 0.0 reading "file does not exist" for a file that existed, while `dockerfile_build_example` is in NO bucket, so nothing ran it and no runtime guard was ever reached — the fix is never to relax containment but to say what the criterion means, `run_command: test -f /opt/marker`, a claim about the container IMAGE rather than about the agent's workspace), **CE054** (an `environment_info` key that is READ must be WRITTEN somewhere in `src/` — the bag is `dict[str, Any]`, so nothing connects reader to writer, and the `reference_digest` anti-cheat guard shipped as a read with no writer anywhere: `.get()` returned `None`, the guard took its early return, and CLAUDE.md plus the user guide both described it as protection it never provided), **CE048** (never call a Typer command function in process — its parameter defaults are `OptionInfo` sentinels, not values, and the sentinel is TRUTHY, so `in_place=None` silently selected the wrong branch; the fix is the `run_pipeline` / `run_evaluation` / `run_plan` split, and this rule is the one that also scans `tests/`, since that is the only place the defect occurs), **CE049** (never coalesce a possibly-unmeasured score to a numeric literal — `score or 0.0` publishes "measured and scored zero" while meaning "never measured", which is how an ungraded night reached four unfiltered `avg(Score)` dashboards as a real zero), **CE050** (no untyped `getattr` probe for a discriminated-union field — pyright cannot see the string, so a rename degrades the guard to a permanent no-op; scoped to criterion-shaped receivers because `command`/`tool`/`prompt` are far too common to flag on their own), **CE051** (a sandbox driver may not be rewritten silently — the driver IS the isolation boundary, so a downgrade must be an explicit, stamped, operator-visible decision), **CE053** (no bare run-record or run-LOG filename literal outside `path_utils` — widened to `docker.log` / `grade.docker.log` / `task.log` / `grade.log` after the same shape recurred: `docker.log` was produced in `isolation/` and consumed in `orchestration/` as three unrelated literals, and because the consumer guards its copy with `is_file()`, a rename would have silently discarded the only record of why a grading container failed — `TASK_JSON_FILENAME` shipped with a rename-safety rationale while twelve exact literals stayed unmigrated, including all three `rglob("task.json")` sites the constant's own comment cites as its reason to exist, so it created the second source of truth it argues against), **CE052** (an `os._exit` must sit inside a branch testing `CODER_EVAL_IN_CONTAINER` — it is the right primitive only for reaping the container's own disposable main process, and `run_task_internal_command` armed its heartbeat watchdog, a daemon thread whose whole authority is `os._exit(137)`, unconditionally: a test that invoked the command in-process left the pytest worker holding that thread, which exited the worker 40s later inside an unrelated test file, naming a different test on each run and on each platform with no traceback — and the dead worker's lost coverage data then failed the gate as `65.13 < 80.00`, naming neither the test nor the cause), **CE037** (no unreferenced module-level private helper in `src/` — a helper whose docstring documents a bug the live code still has is worse than none), **CE038** (in an `@asynccontextmanager`, the acquire must sit INSIDE the `try` whose `finally` releases it — `asyncio.shield` protects the inner task, NOT the await, so a cancel on `__aenter__` skips the unwind while the work completes), **CE039** (a criterion checker must not return a gating `score=0.0` from an `except OSError` over a path the *task author* named — that books an eval-config error as an agent failure; raise `CheckerMisuseError` instead, and `# noqa: CE039` the cases that really are the agent's), **CE047** (every onboarding/marketing surface — README, `docs/index.md`, `docs/comparison.md`, `docs/llms.txt`, `mkdocs.yml`'s `site_description`, the Pages stub, and pyproject's `description`/`keywords` — must name every built-in `AgentKind`; OpenCode shipped while four of those seven still listed three harnesses, and nothing failed), **CE057** (a module copied into the recorder directory beside a generated sandbox shim — `models.sandbox.SIDECAR_MODULES`, currently `argv_match.py` — may import stdlib only. The failure is silent: the sidecar runs where `coder_eval` and its dependencies are not installed, so one package import makes every shadowed CLI die with an ImportError the agent reads as "the tool is broken", costing a whole run to diagnose. The rule derives its target set from that exported tuple and a test asserts it matches a file that exists — a lint rule guarding zero files must fail, not pass).
+Recent additions, each traceable to a shipped defect: **CE058** (in `src/coder_eval/`, an unknown timing value may not become a numeric literal — `duration_ms is None` means *never timed* and `0.0` means *timed and instant*, so writing the literal publishes the second while meaning the first. One invariant, one id, five syntactic forms — a zero constructor keyword, `x or 0`, `x if x is not None else 0.0`, `if x.duration_ms is None: x.duration_ms = 0.0`, and a `model_copy(update={...})` dict (the shape the Antigravity DONE path writes through, which a keyword-only rule cannot see). Antigravity constructed EVERY message with `generation_duration_ms=0.0`, so the task page's Generation cell read `0ms` and its breakdown rendered `0%` for months with nothing failing; Codex published the SDK's `0.0` as a measured command duration, so `avg_command_time_ms` divided real milliseconds by a command count of which 70 of 211 in one nightly had never been timed. The fourth form is the one no existing rule shape covered and is where a live instance was hiding — `claude_code_agent._finalize_commands` set `0.0` on every command force-closed without a tool result, in the one harness a timing audit had called healthy. BLIND SPOT, stated in the rule's docstring: form 1 keys on the callee's spelling, so renaming the `AssistantMessageTelemetry` import alias silently disarms it there), **CE059** (in `src/coder_eval/agents/`, an `AssistantMessage` may not receive the same `ast.Name` for both `started_at` and `completed_at` — the Antigravity reducer read `datetime.now()` once and passed it as both bounds, so `started_at == completed_at` on 368 of 368 sampled messages. A separate id from CE058 because it is a separate invariant, a zero-length window whatever the duration field says, and one invariant per id is what makes a `# noqa` mean one thing. It does NOT fire when the same call passes `generation_duration_ms=None`: a call that says, in the field built to say it, that no window was measurable is not claiming one — that exemption is what keeps the rule pointed at the misleading case instead of accumulating four permanent suppressions on the rollout-rebuild and sub-agent-synthesis sites), **CE056** (no bare `CODER_EVAL_IN_CONTAINER` literal outside `models/container_paths.py` — the CE053 shape again: a rename-safety constant that shipped beside the literal it replaced, and the straggler was the single WRITER, so a rename would have disarmed four security/correctness gates at once with nothing failing; CE052 cannot catch it because that rule inspects `if` guards and the writer is not one), **CE055** (a criterion `path:` in `tasks/` must be sandbox-relative — an absolute path is joined onto the sandbox root, which DISCARDS the root, so containment refuses it and the criterion can never match whatever the agent does; two in-tree tasks were broken this way and the pair is the argument for a static rule on top of the runtime `CheckerMisuseError`: `byod_smoke_test` IS in a CI bucket and produced only `Results: 7/8 succeeded` plus a gating 0.0 reading "file does not exist" for a file that existed, while `dockerfile_build_example` is in NO bucket, so nothing ran it and no runtime guard was ever reached — the fix is never to relax containment but to say what the criterion means, `run_command: test -f /opt/marker`, a claim about the container IMAGE rather than about the agent's workspace), **CE054** (an `environment_info` key that is READ must be WRITTEN somewhere in `src/` — the bag is `dict[str, Any]`, so nothing connects reader to writer, and the `reference_digest` anti-cheat guard shipped as a read with no writer anywhere: `.get()` returned `None`, the guard took its early return, and CLAUDE.md plus the user guide both described it as protection it never provided), **CE048** (never call a Typer command function in process — its parameter defaults are `OptionInfo` sentinels, not values, and the sentinel is TRUTHY, so `in_place=None` silently selected the wrong branch; the fix is the `run_pipeline` / `run_evaluation` / `run_plan` split, and this rule is the one that also scans `tests/`, since that is the only place the defect occurs), **CE049** (never coalesce a possibly-unmeasured score to a numeric literal — `score or 0.0` publishes "measured and scored zero" while meaning "never measured", which is how an ungraded night reached four unfiltered `avg(Score)` dashboards as a real zero), **CE050** (no untyped `getattr` probe for a discriminated-union field — pyright cannot see the string, so a rename degrades the guard to a permanent no-op; scoped to criterion-shaped receivers because `command`/`tool`/`prompt` are far too common to flag on their own), **CE051** (a sandbox driver may not be rewritten silently — the driver IS the isolation boundary, so a downgrade must be an explicit, stamped, operator-visible decision), **CE053** (no bare run-record or run-LOG filename literal outside `path_utils` — widened to `docker.log` / `grade.docker.log` / `task.log` / `grade.log` after the same shape recurred: `docker.log` was produced in `isolation/` and consumed in `orchestration/` as three unrelated literals, and because the consumer guards its copy with `is_file()`, a rename would have silently discarded the only record of why a grading container failed — `TASK_JSON_FILENAME` shipped with a rename-safety rationale while twelve exact literals stayed unmigrated, including all three `rglob("task.json")` sites the constant's own comment cites as its reason to exist, so it created the second source of truth it argues against), **CE052** (an `os._exit` must sit inside a branch testing `CODER_EVAL_IN_CONTAINER` — it is the right primitive only for reaping the container's own disposable main process, and `run_task_internal_command` armed its heartbeat watchdog, a daemon thread whose whole authority is `os._exit(137)`, unconditionally: a test that invoked the command in-process left the pytest worker holding that thread, which exited the worker 40s later inside an unrelated test file, naming a different test on each run and on each platform with no traceback — and the dead worker's lost coverage data then failed the gate as `65.13 < 80.00`, naming neither the test nor the cause), **CE037** (no unreferenced module-level private helper in `src/` — a helper whose docstring documents a bug the live code still has is worse than none), **CE038** (in an `@asynccontextmanager`, the acquire must sit INSIDE the `try` whose `finally` releases it — `asyncio.shield` protects the inner task, NOT the await, so a cancel on `__aenter__` skips the unwind while the work completes), **CE039** (a criterion checker must not return a gating `score=0.0` from an `except OSError` over a path the *task author* named — that books an eval-config error as an agent failure; raise `CheckerMisuseError` instead, and `# noqa: CE039` the cases that really are the agent's), **CE047** (every onboarding/marketing surface — README, `docs/index.md`, `docs/comparison.md`, `docs/llms.txt`, `mkdocs.yml`'s `site_description`, the Pages stub, and pyproject's `description`/`keywords` — must name every built-in `AgentKind`; OpenCode shipped while four of those seven still listed three harnesses, and nothing failed), **CE057** (a module copied into the recorder directory beside a generated sandbox shim — `models.sandbox.SIDECAR_MODULES`, currently `argv_match.py` — may import stdlib only. The failure is silent: the sidecar runs where `coder_eval` and its dependencies are not installed, so one package import makes every shadowed CLI die with an ImportError the agent reads as "the tool is broken", costing a whole run to diagnose. The rule derives its target set from that exported tuple and a test asserts it matches a file that exists — a lint rule guarding zero files must fail, not pass).
 
 When fixing a bug, ask: *could a custom lint rule have prevented this?* If the root cause is a mechanically detectable pattern (e.g., "always import from `coder_eval.models`", "never call blocking IO in async"), add a rule to `tests/lint/rules/` following the CE001+ pattern and wire it up in `tests/lint/runner.py`. This turns a one-time fix into permanent enforcement. See `tests/test_custom_lint.py` for how rules are tested. (Doc-surface / whole-tree rules that reason over Markdown/YAML or the entire `src/` tree rather than one `.py` AST at a time — CE026–CE031, CE033–CE036 — are not `BaseRule`s in the runner; they are wired as dedicated `@pytest.mark.lint` test classes. CE036 enforces the `live_verdict` determinism + monotonicity contract (`criteria/base.py`) that `EarlyStopWatcher`'s latching, deferred fail-stop, and flip-attribution silently depend on: monotonicity over arbitrary Python is undecidable, so instead of a static check it REPLAYS each live criterion against every prefix of recorded trajectories (`tests/lint/live_verdict_contract.py::CASES`) — on the authored ordering AND under seeded shuffles (`permuted_violations`, which catch order-sensitive bugs the authored walk misses) — and asserts the property directly, plus registry-derived coverage — every `LiveSuccessCriterion` in the union must have cases, and every polarity its instances claim via `live_decidable_polarities()` must actually be reached by one (otherwise a single always-`undecided` fixture would "cover" a type while proving nothing). Adding a live criterion therefore means adding `ContractCase`s in the same change. CE035 resolves every `steps.<id>.outputs.<key>` / `needs.<job>.outputs.<key>` reference in `.github/workflows/**` to a writer that actually produces that key — GitHub expands an unwritten output to the empty string, so a typo degrades a gate silently and actionlint models `steps.*.outputs` as an open string map. CE034 scans `tasks/` and forces an armed, live-*passable* `command_executed` to set `require_success` — a crashed invocation would otherwise latch a live PASS, fire `on_pass: stop`, and let FIRED-ONLY armed gating report SUCCESS without ever consulting the unarmed criteria (negative assertions are fail-only and are exempt). CE033 keeps the plugin's bundled `reference/criteria.md` in parity with the `SuccessCriterion` union that generates it (`make plugin-reference` writes it; the rule re-renders and diffs — never hand-edit the file). CE031 guards against dead config: a behavior-driving field on `SimulationConfig`/`RunLimits`/`Dataset` that no code reads by name. CE026 keeps the GitHub Action's onboarding surfaces honest — `README.md`, `docs/CI_GATE.md`, `docs/tutorials/02-ci-pipeline.md`, and the plugin's `ci` skill, whose emitted workflow users copy into their own repos: a page's *first* Action snippet must show the agent-runtime prerequisite steps (pinned to the `action-dogfood` job that proves them in CI), a zero-install absolute next to such a snippet must name the channel it means, every `github.com/marketplace/actions/<slug>` link plus the shields badge label must match `action.yml`'s `name:`, and every `with:` key on a snippet's action step must be a real `action.yml` input (GitHub ignores unknown inputs, so a rename would silently degrade every copied workflow). Renaming an action input or changing its runtime prerequisites therefore means updating the skill too.)
 
diff --git a/docs/agents/HARNESS_PARITY.md b/docs/agents/HARNESS_PARITY.md
index c36f232e..4b429032 100644
--- a/docs/agents/HARNESS_PARITY.md
+++ b/docs/agents/HARNESS_PARITY.md
@@ -24,29 +24,34 @@ wall clock its numbers account for.
 
 | Field | claude-code | codex | antigravity | opencode | pi |
 |---|---|---|---|---|---|
-| `generation_duration_ms` source | harness clock: previous SDK event → this message | SDK item stamps, minus tool execution inside the window | harness clock: previous flush → this flush, minus tool execution inside the window | harness clock, per CLI step | harness clock, per CLI turn |
+| `generation_duration_ms` source | harness clock: previous SDK event → this message | SDK item stamps, minus tool execution inside the window | harness clock: previous flush → this flush, minus tool execution inside the window | harness clock per CLI step, minus tool execution inside the step | harness clock per CLI turn, minus tool execution inside the turn |
 | tool `duration_ms` source | measured around the tool result | SDK `completed_at_ms − started_at_ms`; the item's own `duration_ms` only as a fallback | measured ACTIVE → DONE | measured around the tool event | measured around the tool event |
 | `execution_started_at` / `execution_completed_at` | derived from the measured duration | SDK stamps (both, or neither) | measured at ACTIVE / DONE | measured | measured |
 | `generation_completed_at` | set | `None` — see below | `None` | `None` | `None` |
 | `Σ generation + Σ tool ≈ turn duration` | yes | yes | yes | yes | yes |
 
 **`generation_duration_ms` is model-generation time, not `completed_at − started_at`.**
-Two harnesses interleave tool execution into a single generation window.
-Antigravity reports a `Step` for the tool and only a later `usage_metadata`
-`Step` cuts the message; Codex's message window is seeded from the first item's
-start and extended to the last item's completion. In both, the span between the
-recorded bounds legitimately CONTAINS tool time that the model did not spend
-generating, so both subtract it — the **union** of the closed tool intervals
+Four of the five harnesses interleave tool execution into a single generation
+window. Antigravity reports a `Step` for the tool and only a later
+`usage_metadata` `Step` cuts the message; Codex's message window is seeded from
+the first item's start and extended to the last item's completion; OpenCode
+opens its window at `step_start` and closes it at `step_finish`, and Pi at
+`turn_start` / `turn_end`, with every tool call running inside. In all four the
+span between the recorded bounds legitimately CONTAINS tool time that the model
+did not spend generating, so all four subtract it — the **union** of the closed tool intervals
 clipped to the window (`agents/_timing.py::busy_ms`), never the sum, because
 tool calls overlap: Antigravity resolves several from one `Step` and backgrounds
 anything over ten seconds, and Codex spawns collab agents concurrently. Summing
 them over-subtracts by exactly the overlap and, with enough concurrency, drives
 the result to a clamped zero.
 
-The consequence worth knowing: on a Codex emission that carries *only* a tool
-call, the whole measured window was that tool running, so the recorded
-generation time is legitimately `0.0`. That is a measurement, not a placeholder
-— `None` is what "never measured" looks like.
+The consequence worth knowing: on an emission that carries *only* a tool call,
+the whole measured window was that tool running, so the recorded generation
+time is legitimately `0.0`. That is a measurement, not a placeholder — `None`
+is what "never measured" looks like. Only `claude-code` does not need the
+subtraction: it marks the end of the previous SDK event and reads again when
+the next message arrives, so a tool's execution falls between two windows
+rather than inside one.
 
 **Why Codex leaves `generation_completed_at` as `None`.** It means "when the
 model finished emitting the `tool_use` block". Codex's stream does not carry
diff --git a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
index 9f5ec5b7..bbeb5638 100644
--- a/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
+++ b/evalboard/app/runs/[id]/[...task]/__tests__/message-timeline.test.tsx
@@ -570,6 +570,47 @@ describe("MessageTimelineSection — Unaccounted cell", () => {
         renderStrip(1);
         expect(cell("Unaccounted").textContent).toBe("-4.0s (-400%)");
         expect(cell("Unaccounted").className).not.toContain("text-red-700");
+        // Its own colour: overlap is a different fact from a large positive
+        // residual, and identical grey to a healthy row would hide it.
+        expect(cell("Unaccounted").className).toContain("text-amber-700");
+    });
+
+    test("a sub-agent is not counted as both generation and parent tool time", () => {
+        // The Agent call's durationMs already spans the sub-agent's whole run,
+        // so adding the sub-agent's own generation on top double-counts it.
+        const agentCall = {
+            toolName: "Agent",
+            toolUseId: "tu_agent",
+            summary: "spawn",
+            argText: null,
+            description: null,
+            genMs: null,
+            durationMs: 6000,
+            isError: false,
+            resultPreview: null,
+            outputTokens: null,
+            resultTokens: null,
+        };
+        const main = makeMessage({
+            index: 1,
+            generationMs: 1000,
+            textMs: 1000,
+            toolUses: [agentCall],
+        });
+        const child = makeMessage({
+            index: 2,
+            generationMs: 5000,
+            textMs: 5000,
+            parentToolUseId: "tu_agent",
+        });
+        render(
+            <MessageTimelineSection messages={[main, child]} taskDurationSeconds={10} />,
+        );
+        // 10s − 1s main generation − 6s Agent call = 3s. Counting the child's
+        // 5s of generation too would report -2s.
+        expect(cell("Unaccounted").textContent).toBe("3.0s (30%)");
+        expect(cell("Generation").textContent).toBe("1.0s");
+        expect(cell("Tool exec").textContent).toBe("6.0s");
     });
 
     test("the cell explains that the residual is not only agent time", () => {
diff --git a/evalboard/app/runs/[id]/[...task]/_sections.tsx b/evalboard/app/runs/[id]/[...task]/_sections.tsx
index 34bcd2c6..77ed0aa4 100644
--- a/evalboard/app/runs/[id]/[...task]/_sections.tsx
+++ b/evalboard/app/runs/[id]/[...task]/_sections.tsx
@@ -362,19 +362,28 @@ export function MessageTimelineSection({
     const messageCount = messages.filter((m) => m.role === "assistant").length;
 
     // Roll-up stats for the summary strip.
-    const totalGenMs = messages.reduce((s, m) => s + (m.generationMs ?? 0), 0);
-    const thinkingMs = messages.reduce((s, m) => s + (m.thinkingMs ?? 0), 0);
-    const textMs = messages.reduce((s, m) => s + (m.textMs ?? 0), 0);
-    const toolGenMs = messages.reduce((s, m) => s + (m.toolGenMs ?? 0), 0);
-    const mixedMs = messages.reduce((s, m) => s + (m.mixedGenMs ?? 0), 0);
-    const toolExecMs = messages.reduce(
+    //
+    // MAIN THREAD ONLY. A sub-agent's emissions carry a parentToolUseId and
+    // are nested under the Agent tool call that spawned them — and that call's
+    // own durationMs already spans the sub-agent's entire run, generation and
+    // nested tools alike. Summing over every message counts the sub-agent
+    // twice: once as generation, once inside its parent's execution. On a 140s
+    // task with a 120s Agent call containing 90s of sub-agent generation, the
+    // Unaccounted residual came out at -57%.
+    const mainThread = messages.filter((m) => m.parentToolUseId == null);
+    const totalGenMs = mainThread.reduce((s, m) => s + (m.generationMs ?? 0), 0);
+    const thinkingMs = mainThread.reduce((s, m) => s + (m.thinkingMs ?? 0), 0);
+    const textMs = mainThread.reduce((s, m) => s + (m.textMs ?? 0), 0);
+    const toolGenMs = mainThread.reduce((s, m) => s + (m.toolGenMs ?? 0), 0);
+    const mixedMs = mainThread.reduce((s, m) => s + (m.mixedGenMs ?? 0), 0);
+    const toolExecMs = mainThread.reduce(
         (s, m) => s + m.toolUses.reduce((a, t) => a + (t.durationMs ?? 0), 0),
         0,
     );
-    const slowGen = messages.filter(
+    const slowGen = mainThread.filter(
         (m) => (m.generationMs ?? 0) >= SLOW_GEN_MS,
     ).length;
-    const slowTool = messages.reduce(
+    const slowTool = mainThread.reduce(
         (s, m) =>
             s + m.toolUses.filter((t) => (t.durationMs ?? 0) >= SLOW_TOOL_MS).length,
         0,
@@ -510,9 +519,15 @@ export function MessageTimelineSection({
                     </div>
                     <div
                         className={
-                            unaccountedShare != null && unaccountedShare >= 0.25
-                                ? "text-red-700 font-medium"
-                                : "text-gray-900 font-medium"
+                            unaccountedMs != null && unaccountedMs < 0
+                                ? // Overlap, not unreported time — a different
+                                  // fact from a large positive residual, so a
+                                  // different colour rather than the same grey
+                                  // a healthy row gets.
+                                  "text-amber-700 font-medium"
+                                : unaccountedShare != null && unaccountedShare >= 0.25
+                                  ? "text-red-700 font-medium"
+                                  : "text-gray-900 font-medium"
                         }
                     >
                         {fmtMs(unaccountedMs)}
diff --git a/evalboard/lib/__tests__/overview.test.ts b/evalboard/lib/__tests__/overview.test.ts
index 3ed4582f..38b20899 100644
--- a/evalboard/lib/__tests__/overview.test.ts
+++ b/evalboard/lib/__tests__/overview.test.ts
@@ -1126,6 +1126,30 @@ describe("projectRunRow", () => {
         expect(row).toMatchObject({ tasksRun: 2, tasksExecuted: 2 });
     });
 
+    test("filtered, a mature-skipped match leaves BOTH sides of the duration", () => {
+        // The unfiltered path goes through deriveRunDuration, which excludes
+        // them. Before this, typing a filter switched to a different
+        // definition — and one skipped row with no duration flipped the
+        // all-present guard, rendering "—" for a run whose executed rows were
+        // all timed.
+        const row = projectRunRow(
+            run("r", [
+                task({ taskId: "a", tags: ["keep"], durationSeconds: 30 }),
+                task({ taskId: "b", tags: ["keep"], durationSeconds: 20 }),
+                task({
+                    taskId: "c",
+                    tags: ["keep"],
+                    durationSeconds: null,
+                    matureSkipped: true,
+                }),
+            ]),
+            "keep",
+            null,
+        );
+        expect(row?.taskDurationSeconds).toBe(50);
+        expect(row?.tasksExecuted).toBe(2);
+    });
+
     test("filtered, tasksExecuted excludes a mature-skipped match", () => {
         const row = projectRunRow(
             run("r", [
diff --git a/evalboard/lib/__tests__/thinkingSim.test.ts b/evalboard/lib/__tests__/thinkingSim.test.ts
index c4395509..cb0560de 100644
--- a/evalboard/lib/__tests__/thinkingSim.test.ts
+++ b/evalboard/lib/__tests__/thinkingSim.test.ts
@@ -43,8 +43,10 @@ function toolUse(
 // map on them, so fixtures must not all collide on index 0.
 let __callIndex = 0;
 function call(opts: {
-    generationMs: number;
-    thinkingMs: number;
+    // Nullable to match MessageEvent: a rollout rebuild or a sub-agent
+    // generation delivered as a tool result has no measurable window.
+    generationMs: number | null;
+    thinkingMs: number | null;
     outputTokens: number;
     cacheWriteTokens?: number | null;
     thinkingOutputTokens?: number | null;
@@ -1136,3 +1138,29 @@ describe("projectThinking — robust across ALL lever combinations", () => {
         expect(b.coeffOutput).toBeCloseTo(a.coeffOutput, 5);
     });
 });
+
+// `generation_duration_ms` is `float | None`: a rollout rebuild or a sub-agent
+// generation delivered as a tool result has no measurable window. A turn built
+// entirely from those used to weigh every model at 0, so the primary model was
+// decided by map-insertion order.
+describe("buildThinkingModel — primary model with no generation timing", () => {
+    test("falls back to output tokens when no message has a window", () => {
+        // Haiku is listed FIRST and would win on insertion order alone, but
+        // Sonnet produced 10x the output.
+        const messages = [
+            call({ generationMs: null, thinkingMs: null, outputTokens: 30, model: "claude-haiku-4-5" }),
+            call({ generationMs: null, thinkingMs: null, outputTokens: 300, model: "claude-sonnet-4-6" }),
+        ];
+        const m = buildThinkingModel(messages, TOTALS, 0.5);
+        expect(m).not.toBeNull();
+        expect(m?.model).toBe("claude-sonnet-4-6");
+    });
+
+    test("generation time still wins where it exists", () => {
+        const messages = [
+            call({ generationMs: 10, thinkingMs: 0, outputTokens: 900, model: "claude-haiku-4-5" }),
+            call({ generationMs: 500, thinkingMs: 0, outputTokens: 10, model: "claude-sonnet-4-6" }),
+        ];
+        expect(buildThinkingModel(messages, TOTALS, 0.5)?.model).toBe("claude-sonnet-4-6");
+    });
+})
diff --git a/evalboard/lib/overview.ts b/evalboard/lib/overview.ts
index 176a5a60..bd32866c 100644
--- a/evalboard/lib/overview.ts
+++ b/evalboard/lib/overview.ts
@@ -1110,6 +1110,13 @@ export function scopeRunTasks(
     // Cost sums any matching task that recorded one; duration is only meaningful
     // when every matching task has one (otherwise the partial sum would
     // understate the slice — mirrors readRunOverview's whole-run rule).
+    //
+    // Mature-skipped rows leave BOTH sides of the duration, exactly as they do
+    // in deriveRunDuration: they are carried-forward passes that never ran.
+    // Without this the filtered slice used a different definition than the
+    // unfiltered one — and worse, ONE skipped row with no duration flipped
+    // durAllPresent and rendered "—" for a run whose executed rows were all
+    // timed.
     let costSum = 0;
     let costHasAny = false;
     let durSum = 0;
@@ -1119,6 +1126,7 @@ export function scopeRunTasks(
             costSum += t.totalCostUsd;
             costHasAny = true;
         }
+        if (t.matureSkipped) continue;
         if (t.durationSeconds != null) {
             durSum += t.durationSeconds;
         } else {
diff --git a/evalboard/lib/thinkingSim.ts b/evalboard/lib/thinkingSim.ts
index 4817b579..0c28d23f 100644
--- a/evalboard/lib/thinkingSim.ts
+++ b/evalboard/lib/thinkingSim.ts
@@ -299,11 +299,20 @@ export function buildThinkingModel(
     // output (the main agent model, not background haiku compaction calls).
     const modelOut = new Map<string, number>();
     const totalGen = messages.reduce((s, m) => s + (m.generationMs ?? 0), 0);
+    const totalOut = messages.reduce((s, m) => s + (m.outputTokens ?? 0), 0);
     for (const m of messages) {
-        // Weight by generation time, not output_tokens: the CLI's per-message
-        // output is unreliable (see thinking estimate below), but generation
-        // time is recorded for every emission.
-        const w = m.generationMs ?? 0;
+        // Weight by generation time where there is any: the CLI's per-message
+        // output is unreliable (see thinking estimate below).
+        //
+        // But generation time is NOT recorded for every emission — a rollout
+        // rebuild or a sub-agent generation delivered as a tool result has no
+        // measurable window and reports null. A turn built entirely from those
+        // weighs every model at 0, and the first one encountered wins by
+        // accident: a Haiku sub-agent listed before the main Opus message
+        // would price the whole task at Haiku rates. Fall back to output
+        // tokens, then to an equal vote, so the choice is at least a stated
+        // rule rather than map-insertion order.
+        const w = totalGen > 0 ? (m.generationMs ?? 0) : totalOut > 0 ? (m.outputTokens ?? 0) : 1;
         if (m.model) modelOut.set(m.model, (modelOut.get(m.model) ?? 0) + w);
     }
     let primaryModel: string | null = null;
diff --git a/src/coder_eval/agents/opencode_agent.py b/src/coder_eval/agents/opencode_agent.py
index 076a8bf4..b33c0807 100644
--- a/src/coder_eval/agents/opencode_agent.py
+++ b/src/coder_eval/agents/opencode_agent.py
@@ -43,6 +43,7 @@
 from typing import Any, ClassVar, Literal, NoReturn
 
 from coder_eval.agent import Agent
+from coder_eval.agents._timing import busy_ms
 from coder_eval.errors import AgentCrashError, TurnTimeoutError
 from coder_eval.isolation.docker_runner import STDOUT_LINE_LIMIT_BYTES
 from coder_eval.models import (
@@ -310,6 +311,14 @@ def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str
         self.step_started_at: datetime | None = None
         self.step_text_parts: list[str] = []
         self.step_tool_ids: list[str] = []
+        # Execution intervals of tools that CLOSED inside the open
+        # generation window. Every tool call runs INSIDE the window, so
+        # publishing the raw span as generation time counts the same
+        # milliseconds twice — once here and once as the tool's own
+        # duration_ms. Intervals, not a running total: they overlap
+        # whenever the harness runs tools concurrently, and only their
+        # union may be subtracted (agents/_timing.py::busy_ms).
+        self.step_tool_spans: list[tuple[datetime, datetime]] = []
 
         # callID -> (telemetry, started_at) for tools awaiting a result.
         self.open_tools: dict[str, CommandTelemetry] = {}
@@ -347,6 +356,7 @@ def on_step_start(self, part: dict[str, Any]) -> None:
         self.step_started_at = datetime.now()
         self.step_text_parts = []
         self.step_tool_ids = []
+        self.step_tool_spans = []
         self.emit(
             TurnStartEvent(
                 task_id=self.task_id,
@@ -464,6 +474,10 @@ def _close_tool(
         telemetry.execution_completed_at = completed
         if telemetry.execution_started_at is not None:
             telemetry.duration_ms = (completed - telemetry.execution_started_at).total_seconds() * 1000
+            # This tool ran inside the open generation window, so its time is
+            # not model time. Only a RESOLVED tool contributes: one force-closed
+            # without a result was never timed.
+            self.step_tool_spans.append((telemetry.execution_started_at, completed))
         telemetry.result_status = _RESULT_STATUS[status]
         # Stored untruncated by design (sub-agent returns must survive whole).
         telemetry.result_summary = summary
@@ -684,7 +698,10 @@ def on_step_finish(self, part: dict[str, Any]) -> None:
             AssistantMessage(
                 started_at=started,
                 completed_at=completed,
-                generation_duration_ms=(completed - started).total_seconds() * 1000,
+                generation_duration_ms=max(
+                    0.0,
+                    (completed - started).total_seconds() * 1000 - busy_ms(self.step_tool_spans, started, completed),
+                ),
                 content_blocks=blocks,
                 tool_use_ids=list(self.step_tool_ids),
                 input_tokens=step_in,
diff --git a/src/coder_eval/agents/pi_agent.py b/src/coder_eval/agents/pi_agent.py
index 0b50dd4b..11fb8b73 100644
--- a/src/coder_eval/agents/pi_agent.py
+++ b/src/coder_eval/agents/pi_agent.py
@@ -77,6 +77,7 @@
 
 from coder_eval.agent import Agent
 from coder_eval.agents._skills import _plugin_skill_dirs  # shared plugin->skills resolver
+from coder_eval.agents._timing import busy_ms
 from coder_eval.errors import AgentCrashError, TurnTimeoutError
 from coder_eval.isolation.docker_runner import STDOUT_LINE_LIMIT_BYTES
 from coder_eval.models import (
@@ -287,6 +288,14 @@ def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str
         self.turn_started_at: datetime | None = None
         self.turn_text_parts: list[str] = []
         self.turn_tool_ids: list[str] = []
+        # Execution intervals of tools that CLOSED inside the open
+        # generation window. Every tool call runs INSIDE the window, so
+        # publishing the raw span as generation time counts the same
+        # milliseconds twice — once here and once as the tool's own
+        # duration_ms. Intervals, not a running total: they overlap
+        # whenever the harness runs tools concurrently, and only their
+        # union may be subtracted (agents/_timing.py::busy_ms).
+        self.turn_tool_spans: list[tuple[datetime, datetime]] = []
 
         # toolCallId -> telemetry for tools awaiting a result.
         self.open_tools: dict[str, CommandTelemetry] = {}
@@ -347,6 +356,7 @@ def on_turn_start(self) -> None:
         self.turn_started_at = datetime.now()
         self.turn_text_parts = []
         self.turn_tool_ids = []
+        self.turn_tool_spans = []
         self.emit(
             TurnStartEvent(
                 task_id=self.task_id,
@@ -431,6 +441,10 @@ def _close_tool(
         telemetry.execution_completed_at = completed
         if telemetry.execution_started_at is not None:
             telemetry.duration_ms = (completed - telemetry.execution_started_at).total_seconds() * 1000
+            # This tool ran inside the open generation window, so its time is
+            # not model time. Only a RESOLVED tool contributes: one force-closed
+            # without a result was never timed.
+            self.turn_tool_spans.append((telemetry.execution_started_at, completed))
         telemetry.result_status = _RESULT_STATUS[status]
         # Stored untruncated by design (sub-agent returns must survive whole).
         telemetry.result_summary = summary
@@ -572,7 +586,10 @@ def on_turn_end(self, obj: dict[str, Any]) -> None:
             AssistantMessage(
                 started_at=started,
                 completed_at=completed,
-                generation_duration_ms=(completed - started).total_seconds() * 1000,
+                generation_duration_ms=max(
+                    0.0,
+                    (completed - started).total_seconds() * 1000 - busy_ms(self.turn_tool_spans, started, completed),
+                ),
                 content_blocks=blocks,
                 tool_use_ids=list(self.turn_tool_ids),
                 input_tokens=step_in,
diff --git a/tests/_fixtures/golden_streams/_scrub.py b/tests/_fixtures/golden_streams/_scrub.py
index 890f3d57..c84cc77d 100644
--- a/tests/_fixtures/golden_streams/_scrub.py
+++ b/tests/_fixtures/golden_streams/_scrub.py
@@ -120,7 +120,15 @@ def assert_timing_captured(record: dict[str, Any], *, expect_generation_window:
 
     **Flagged.** When ``expect_generation_window``, at least one assistant
     entry reports a ``generation_duration_ms`` that is non-``None`` AND
-    greater than zero.
+    greater than zero AND whose recorded bounds actually span it
+    (``completed_at > started_at``).
+
+    The bounds half is not redundant. Two harnesses derive the duration from a
+    MONOTONIC clock and the bounds from the wall clock, so the two can
+    disagree: a reducer could report a healthy duration beside two stamps that
+    collapsed to one instant. CE059 catches that statically only when both
+    bounds are the same ``ast.Name``; when they are two different names
+    holding the same value it cannot, and this is the check that does.
 
     Why a scenario-level floor rather than a per-entry rule: no per-entry form
     works against the real snapshots. ``claude_d_subagent_terminal`` holds two
@@ -143,8 +151,13 @@ def assert_timing_captured(record: dict[str, Any], *, expect_generation_window:
 
     if not expect_generation_window:
         return
-    windows = [m.get("generation_duration_ms") for m in record.get("messages") or [] if m.get("role") == "assistant"]
-    assert any(w is not None and w > 0 for w in windows), (
-        f"no assistant message reports a positive generation window (saw {windows!r}); "
-        "the harness measured no model time at all for a turn that streamed one"
+    assistant = [m for m in record.get("messages") or [] if m.get("role") == "assistant"]
+    windows = [(m.get("generation_duration_ms"), m.get("started_at"), m.get("completed_at")) for m in assistant]
+    assert any(
+        duration is not None and duration > 0 and started is not None and completed is not None and completed > started
+        for duration, started, completed in windows
+    ), (
+        f"no assistant message reports a positive generation window with bounds that span it "
+        f"(saw (duration, started_at, completed_at) = {windows!r}); the harness measured no model "
+        "time at all for a turn that streamed one, or its two clocks disagree"
     )
diff --git a/tests/lint/rules/ce058_no_timing_literal.py b/tests/lint/rules/ce058_no_timing_literal.py
index 1f10f06a..45bae047 100644
--- a/tests/lint/rules/ce058_no_timing_literal.py
+++ b/tests/lint/rules/ce058_no_timing_literal.py
@@ -15,8 +15,8 @@
 milliseconds by a command count of which 70 of 211 in one nightly had never
 been timed at all.
 
-Four syntactic forms, one invariant, one id — these are the four the codebase
-actually produced:
+Five syntactic forms, one invariant, one id — the shapes the codebase actually
+produced:
 
 1. a ``0`` / ``0.0`` constructor keyword on one of the telemetry constructors
    that carry these fields;
diff --git a/tests/test_agent_golden_master.py b/tests/test_agent_golden_master.py
index aac9d58d..4c54d0a2 100644
--- a/tests/test_agent_golden_master.py
+++ b/tests/test_agent_golden_master.py
@@ -260,9 +260,23 @@ class TestAssertTimingCaptured:
     """The sensor itself. An AST rule cannot see that an SDK returned 0.0."""
 
     @staticmethod
-    def _record(*, windows: list[float | None] = (), commands: list[dict[str, Any]] = ()) -> dict[str, Any]:
+    def _record(
+        *,
+        windows: list[float | None] = (),
+        commands: list[dict[str, Any]] = (),
+        bounds_collapse: bool = False,
+    ) -> dict[str, Any]:
+        """A record whose bounds span each window, unless `bounds_collapse`."""
         return {
-            "messages": [{"role": "assistant", "generation_duration_ms": w} for w in windows],
+            "messages": [
+                {
+                    "role": "assistant",
+                    "generation_duration_ms": w,
+                    "started_at": "2026-01-01T00:00:00",
+                    "completed_at": "2026-01-01T00:00:00" if bounds_collapse else "2026-01-01T00:00:01",
+                }
+                for w in windows
+            ],
             "commands": list(commands),
         }
 
@@ -279,6 +293,15 @@ def test_exactly_zero_raises_too(self):
         with pytest.raises(AssertionError, match="positive generation window"):
             assert_timing_captured(self._record(windows=[0.0]), expect_generation_window=True)
 
+    def test_collapsed_bounds_raise_even_with_a_healthy_duration(self):
+        # Two harnesses take the duration from a MONOTONIC clock and the
+        # bounds from the wall clock, so a reducer can report a real duration
+        # beside two stamps that collapsed to one instant. CE059 sees that
+        # statically only when both bounds are the same ast.Name; this is the
+        # check for when they are two different names holding one value.
+        with pytest.raises(AssertionError, match="bounds that span it"):
+            assert_timing_captured(self._record(windows=[500.0], bounds_collapse=True), expect_generation_window=True)
+
     def test_a_none_window_passes_when_none_is_expected(self):
         assert_timing_captured(self._record(windows=[None]), expect_generation_window=False)
 
diff --git a/tests/test_opencode_agent.py b/tests/test_opencode_agent.py
index d526ae79..0c140887 100644
--- a/tests/test_opencode_agent.py
+++ b/tests/test_opencode_agent.py
@@ -19,6 +19,7 @@
 import json
 import os
 import signal
+from datetime import datetime, timedelta
 from typing import Any
 
 import pytest
@@ -1779,3 +1780,73 @@ def test_orphan_result_is_never_dropped(self):
         assert event.tool.tool_name == "unknown"
         assert event.tool.result_status == "unknown"
         assert event.tool.error_message == "no result observed"
+
+
+class TestGenerationWindowExcludesToolExecution:
+    """A tool running inside a step is not model time.
+
+    OpenCode marks the window at `step_start` and closes it at
+    `step_finish`, and every tool call executes INSIDE it while also
+    publishing its own measured `duration_ms`. Publishing the raw span as
+    generation time counted the same milliseconds twice, which the task
+    page's Unaccounted cell renders as a ~-100% residual.
+
+    Driven at the reducer rather than through `communicate()`: the window is
+    two `datetime.now()` reads and the tool interval comes from the event
+    payload, so only setting both explicitly makes the arithmetic
+    deterministic.
+    """
+
+    WINDOW_START = datetime(2026, 1, 1, 12, 0, 0)
+    WINDOW_END = datetime(2026, 1, 1, 12, 0, 1)  # a 1000ms step
+
+    def _finish_step(self, monkeypatch, spans):
+        import coder_eval.agents.opencode_agent as agent_module
+
+        class _Clock(datetime):
+            @staticmethod
+            def now(tz=None):
+                return TestGenerationWindowExcludesToolExecution.WINDOW_END
+
+        state = _OpenCodeTurnState(task_id="t1", iteration=1, user_input="do it", model="deepseek/deepseek-v4-pro")
+        state.step_started_at = self.WINDOW_START
+        state.step_tool_spans = list(spans)
+        monkeypatch.setattr(agent_module, "datetime", _Clock)
+        state.on_step_finish({"reason": "stop", "tokens": {"input": 100, "output": 20}})
+        assistant = [m for m in state.messages if m.role == "assistant"]
+        assert len(assistant) == 1
+        return assistant[0]
+
+    def test_tool_time_inside_the_step_is_subtracted(self, monkeypatch):
+        # A 500ms tool squarely inside the 1000ms step.
+        message = self._finish_step(
+            monkeypatch,
+            [(self.WINDOW_START + timedelta(milliseconds=200), self.WINDOW_START + timedelta(milliseconds=700))],
+        )
+        span_ms = (message.completed_at - message.started_at).total_seconds() * 1000.0
+        assert span_ms == pytest.approx(1000.0)
+        assert message.generation_duration_ms == pytest.approx(500.0)
+
+    def test_a_step_with_no_tools_keeps_its_whole_window(self, monkeypatch):
+        message = self._finish_step(monkeypatch, [])
+        assert message.generation_duration_ms == pytest.approx(1000.0)
+
+    def test_concurrent_tools_are_subtracted_once(self, monkeypatch):
+        # Two overlapping 500ms tools occupy 600ms of wall clock, not 1000ms.
+        # Summing them would leave 0 generation for a step that generated 400.
+        message = self._finish_step(
+            monkeypatch,
+            [
+                (self.WINDOW_START + timedelta(milliseconds=100), self.WINDOW_START + timedelta(milliseconds=600)),
+                (self.WINDOW_START + timedelta(milliseconds=200), self.WINDOW_START + timedelta(milliseconds=700)),
+            ],
+        )
+        assert message.generation_duration_ms == pytest.approx(400.0)
+
+    def test_the_window_never_goes_negative(self, monkeypatch):
+        # A tool whose recorded interval straddles the step is clipped to it.
+        message = self._finish_step(
+            monkeypatch,
+            [(self.WINDOW_START - timedelta(seconds=30), self.WINDOW_END + timedelta(seconds=30))],
+        )
+        assert message.generation_duration_ms == 0.0
diff --git a/tests/test_pi_agent.py b/tests/test_pi_agent.py
index 1496e37f..a0cace11 100644
--- a/tests/test_pi_agent.py
+++ b/tests/test_pi_agent.py
@@ -17,6 +17,7 @@
 import json
 import os
 import signal
+from datetime import datetime, timedelta
 from pathlib import Path
 from typing import Any
 
@@ -1089,3 +1090,71 @@ async def test_zero_reported_cost_on_an_unpriced_model_stays_zero(self, patch_ex
         record = await _run(_agent(model="nowhere/not-a-real-model"), tmp_path)
         assert record.token_usage is not None
         assert record.token_usage.total_cost_usd == 0.0
+
+
+class TestGenerationWindowExcludesToolExecution:
+    """A tool running inside a turn is not model time.
+
+    Pi marks the window at `turn_start` and closes it at `turn_end`, and
+    every tool call executes INSIDE it while also publishing its own
+    measured `duration_ms`. Publishing the raw span as generation time
+    counted the same milliseconds twice, which the task page's Unaccounted
+    cell renders as a ~-100% residual.
+
+    Driven at the reducer: the window is two `datetime.now()` reads and the
+    tool interval comes from the event payload, so only setting both
+    explicitly makes the arithmetic deterministic.
+    """
+
+    WINDOW_START = datetime(2026, 1, 1, 12, 0, 0)
+    WINDOW_END = datetime(2026, 1, 1, 12, 0, 1)  # a 1000ms turn
+
+    def _finish_turn(self, monkeypatch, spans):
+        import coder_eval.agents.pi_agent as agent_module
+
+        class _Clock(datetime):
+            @staticmethod
+            def now(tz=None):
+                return TestGenerationWindowExcludesToolExecution.WINDOW_END
+
+        state = _PiTurnState(task_id="t", iteration=1, user_input="x", model="m")
+        state.turn_started_at = self.WINDOW_START
+        state.turn_tool_spans = list(spans)
+        monkeypatch.setattr(agent_module, "datetime", _Clock)
+        state.on_turn_end(
+            {"message": {"role": "assistant", "usage": {"input": 100, "output": 20}, "stopReason": "stop"}}
+        )
+        assistant = [m for m in state.messages if m.role == "assistant"]
+        assert len(assistant) == 1
+        return assistant[0]
+
+    def test_tool_time_inside_the_turn_is_subtracted(self, monkeypatch):
+        message = self._finish_turn(
+            monkeypatch,
+            [(self.WINDOW_START + timedelta(milliseconds=200), self.WINDOW_START + timedelta(milliseconds=700))],
+        )
+        span_ms = (message.completed_at - message.started_at).total_seconds() * 1000.0
+        assert span_ms == pytest.approx(1000.0)
+        assert message.generation_duration_ms == pytest.approx(500.0)
+
+    def test_a_turn_with_no_tools_keeps_its_whole_window(self, monkeypatch):
+        assert self._finish_turn(monkeypatch, []).generation_duration_ms == pytest.approx(1000.0)
+
+    def test_concurrent_tools_are_subtracted_once(self, monkeypatch):
+        # Two overlapping 500ms tools occupy 600ms, not 1000ms. Summing them
+        # would leave 0 generation for a turn that generated 400.
+        message = self._finish_turn(
+            monkeypatch,
+            [
+                (self.WINDOW_START + timedelta(milliseconds=100), self.WINDOW_START + timedelta(milliseconds=600)),
+                (self.WINDOW_START + timedelta(milliseconds=200), self.WINDOW_START + timedelta(milliseconds=700)),
+            ],
+        )
+        assert message.generation_duration_ms == pytest.approx(400.0)
+
+    def test_the_window_never_goes_negative(self, monkeypatch):
+        message = self._finish_turn(
+            monkeypatch,
+            [(self.WINDOW_START - timedelta(seconds=30), self.WINDOW_END + timedelta(seconds=30))],
+        )
+        assert message.generation_duration_ms == 0.0

From cf79e20a6f82fa0256b048036ce74f99ecb4324d Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 17:18:03 -0700
Subject: [PATCH 08/10] docs(harness): record the legacy token-migration
 double-count as a follow-up

Surfaced by the timing-capture final review but out of that change's
scope (token accounting was explicitly excluded, and the validator is
untouched by it). A real bug rather than a guardrail candidate: a legacy
record's full-prompt input_tokens is adopted as the UNCACHED slice, so the
computed total adds the cache buckets a second time.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/harness-candidates.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.claude/harness-candidates.md b/.claude/harness-candidates.md
index c2b20644..5eef1adc 100644
--- a/.claude/harness-candidates.md
+++ b/.claude/harness-candidates.md
@@ -538,3 +538,16 @@ divergences, so the deferred-work record is one place. Measurements in
   Coverage is ~88%, so it is not urgent. The agent lives in the separate
   `coder_eval_uipath` repo; mirror the Codex change there
   (`_item_timing` + threading the SDK stamps through the telemetry builders).
+
+- [ ] **Pre-existing, surfaced by this work's final review: `TokenUsage._adopt_legacy_input_tokens`
+  double-counts the cache buckets.** The validator copies a legacy record's
+  full-prompt `input_tokens` straight into `uncached_input_tokens`, and the
+  computed `input_tokens` then adds `cache_creation` + `cache_read` again. A
+  legacy record with `input_tokens=1000`, `cache_creation=200`, `cache_read=150`
+  reloads as 1350 prompt tokens and bills 1000 at the uncached rate instead of
+  650. Affects every report, budget check and detached regrade over a
+  pre-split run that used prompt caching. NOT touched by the timing work
+  (token accounting was explicitly out of its scope) and not a guardrail
+  candidate — a real bug needing its own change, with a decision about
+  whether legacy records can be distinguished from current ones at all.
+  Caught in: timing-capture final review (gpt-5.6-sol).

From 237437b15b5189357741088d29c3a22c7f7b340e Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 21:26:15 -0700
Subject: [PATCH 09/10] fix(harness): time the generation Codex never measured;
 stop Antigravity double-counting an open tool
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live runs of tasks/hello_date across all five harnesses — the invariant no
unit test can prove against a real SDK — found two defects.

Codex published `generation_duration_ms=0.0` on a message carrying 98 output
tokens, reproducibly. Its window was seeded from the item's EXECUTION stamp,
so a tool-only emission's window equalled the tool's own interval and the
subtraction clamped to zero, while the 2694 ms that generated the item sat in
the preceding gap attributed to nothing. Only 15.8% of a 17 s turn was
accounted for, which is also why clause 3 passed there: it under-measured too
heavily to breach anything. Windows now tile from the previous flush's end,
kept in the SDK's own clock — seeding the mark from time.time() would mix our
clock with the SDK's inside a single subtraction. Three live runs: 64-86%.

Antigravity broke the branch's headline invariant. Sum(generation) +
Sum(command) exceeded the turn's own duration_seconds by 0.26 ms, because a
tool still OPEN at flush time had its already-elapsed portion published as
generation and then counted again as its duration_ms. These contiguous
windows have no slack to absorb that: 5 pre-fix runs ranged -0.26 to
+8.69 ms out of ~12 s, so it was a coin flip rather than a rounding artifact.
Open calls are now subtracted too, bounded at the flush; when one later
closes, the DONE path hands its full interval to the next window, where
busy_ms clips it to the post-flush remainder, so nothing is subtracted twice.
12 post-fix runs are all positive (min +0.23 ms). This replaces the comment
deferring the case to audit P2-1.

Codex gets the same open-tool treatment, since tiling is what makes that
double-count reachable there.

Both new tests fail without their fix (Codex 0.0 vs 1900.0; Antigravity
300.0 vs 100.0). Final sweep: 5/5 harnesses pass all three clauses.

Known and deliberately not papered over: Codex's remaining 14-36% is the
latency before the SDK's first item stamp, which the stream gives no way to
measure, and Antigravity's margin stays thin by construction because its
windows tile ~100% of the turn.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/coder_eval/agents/antigravity_agent.py | 33 ++++++----
 src/coder_eval/agents/codex_agent.py       | 67 +++++++++++++++----
 tests/test_antigravity_agent.py            | 46 +++++++++++++
 tests/test_codex_agent.py                  | 76 ++++++++++++++++++++--
 4 files changed, 194 insertions(+), 28 deletions(-)

diff --git a/src/coder_eval/agents/antigravity_agent.py b/src/coder_eval/agents/antigravity_agent.py
index 6432114d..6c3269ec 100644
--- a/src/coder_eval/agents/antigravity_agent.py
+++ b/src/coder_eval/agents/antigravity_agent.py
@@ -1026,8 +1026,8 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
             return
         now_monotonic = time.monotonic()
         now_wall = datetime.now()
-        # Model-generation time = the whole window MINUS the tool executions
-        # that closed inside it.
+        # Model-generation time = the whole window MINUS the tool execution
+        # that happened inside it.
         #
         # Do NOT "simplify" this to resetting the mark when a tool ends. That
         # loses real model time: measured on run 2026-09-09_04-18-50, task
@@ -1038,16 +1038,27 @@ def _flush_generation(self, gen: TokenUsage, reasoning_tokens: int) -> None:
         # 43 s Bash, where the model time really is the flush-to-DONE
         # remainder).
         #
-        # What this deliberately over-reports: time spent WAITING on a tool
-        # that is still open. Only CLOSED intervals are subtracted, so an
-        # orphaned/backgrounded call contributes nothing while the poll loop
-        # sleeps on it. That reaches two windows — the one finalize cuts when
-        # no usage_metadata ever arrived (tens of minutes on an orphan-poll
-        # task), and any ordinary window whose flush lands while the call is
-        # still open. Accounting for that wait is separate work (audit P2-1);
-        # do not read such a number as model time.
+        # A tool that is still OPEN at flush time counts too, bounded at
+        # `now_wall`. Subtracting only CLOSED intervals published the portion
+        # of a straddling call that ran before the boundary as generation,
+        # while the call's own duration_ms counted it again — the one
+        # double-count that this harness's contiguous windows have no slack to
+        # absorb. Measured on tasks/hello_date: a Bash opening 1.7 ms before
+        # the flush drove Sum(generation) + Sum(command) 0.26 ms PAST the turn
+        # wall, on a turn whose whole headroom was 1.4 ms. The four sibling
+        # runs passed by 1.2-8.7 ms out of ~12 s, so this was a coin flip, not
+        # a rounding artifact.
+        #
+        # No double subtraction: when the call later closes, the DONE path
+        # appends its full interval to the NEXT window's list, where busy_ms
+        # clips it to the post-flush remainder.
         span_ms = (now_monotonic - self._gen_mark_monotonic) * 1000.0
-        tool_ms = busy_ms(self._tool_spans_since_mark, self._gen_mark_wall, now_wall)
+        still_open = [
+            (tel.execution_started_at, now_wall)
+            for cid, tel in self._open_tools.items()
+            if cid not in self._closed_tools and tel.execution_started_at is not None
+        ]
+        tool_ms = busy_ms(self._tool_spans_since_mark + still_open, self._gen_mark_wall, now_wall)
         generation_ms = span_ms - tool_ms
         if generation_ms < 0:
             # busy_ms clips to this window and unions overlaps, so it cannot
diff --git a/src/coder_eval/agents/codex_agent.py b/src/coder_eval/agents/codex_agent.py
index 98c762bc..b8ffea86 100644
--- a/src/coder_eval/agents/codex_agent.py
+++ b/src/coder_eval/agents/codex_agent.py
@@ -393,6 +393,15 @@ def __init__(
         self.open_blocks: list[ContentBlock] = []
         self.open_start_ms: int | None = None
         self.open_end_ms: int | None = None
+        # Where the NEXT generation window starts: the previous flush's end.
+        # Windows tile the turn contiguously, as they do on Antigravity and
+        # claude-code. None until the first flush, which falls back to its own
+        # first item — the SDK gives no "turn began" stamp, and inventing one
+        # from time.time() would mix our clock with the SDK's inside a single
+        # subtraction. Advanced ONLY by a flush that actually appended a
+        # message, so a no-op flush leaves the window open and a later real
+        # generation still measures from where it began.
+        self.gen_mark_ms: int | None = None
         self.start_ms_by_id: dict[str, int] = {}
         self.blocks_by_id: dict[str, ContentBlock] = {}
         # Tools that emitted item/started but not item/completed; whatever remains
@@ -454,25 +463,55 @@ def _flush_message(self, last: Any) -> None:
 
         thinking_blocks = [b for b in self.open_blocks if b.block_type == "thinking"]
         action_blocks = [b for b in self.open_blocks if b.block_type != "thinking"]
-        started = _ms_to_dt(self.open_start_ms)
-        completed = _ms_to_dt(self.open_end_ms if self.open_end_ms is not None else self.open_start_ms)
-        # The window is seeded from the first item's start and extended to the
-        # LAST item's completion, so for any generation containing a tool call
-        # it already CONTAINS that tool's execution. Publishing the raw span as
-        # generation time double-counts it against the tool's own duration_ms:
-        # a tool-only emission reported 250ms of "generation" for a 250ms
-        # `echo hi`, and the task page's Generation + Tool exec then exceeded
-        # the wall clock they must reconcile to.
+        # The window runs from the PREVIOUS flush's end, not from this
+        # generation's first item. The SDK stamps an item with the moment it
+        # began EXECUTING, so seeding from it discarded the model time that
+        # produced the item — the gap between the last item's completion and
+        # this one's start. Measured on tasks/hello_date: a Write emission
+        # spanning 2 ms (start 20:50:39.063, end .065) reported 98 output
+        # tokens, and the 2694 ms of real generation sat in the preceding gap,
+        # attributed to nothing. Across that turn only 15.8% of the 17 s wall
+        # clock was accounted for. Tiling matches Antigravity and claude-code,
+        # and is what lets Sum(generation) + Sum(tool) reconcile to the turn.
+        #
+        # min() is defensive: a stamp that goes backwards must never push the
+        # window start PAST the first item and invert the span.
+        window_start_ms = self.gen_mark_ms if self.gen_mark_ms is not None else self.open_start_ms
+        if window_start_ms is not None and self.open_start_ms is not None:
+            window_start_ms = min(window_start_ms, self.open_start_ms)
+        window_end_ms = self.open_end_ms if self.open_end_ms is not None else self.open_start_ms
+        started = _ms_to_dt(window_start_ms)
+        completed = _ms_to_dt(window_end_ms)
+        # The window is extended to the LAST item's completion, so any
+        # generation containing a tool call already CONTAINS that tool's
+        # execution. Publishing the raw span as generation time double-counts
+        # it against the tool's own duration_ms: a tool-only emission reported
+        # 250ms of "generation" for a 250ms `echo hi`, and the task page's
+        # Generation + Tool exec then exceeded the wall clock they must
+        # reconcile to.
         #
         # Same treatment, and the same shared helper, as Antigravity: subtract
-        # the UNION of the closed tool intervals clipped to this window. A sum
-        # would over-subtract wherever they overlap, which Codex produces
-        # natively via concurrent collab agents.
+        # the UNION of the tool intervals clipped to this window. A sum would
+        # over-subtract wherever they overlap, which Codex produces natively
+        # via concurrent collab agents.
+        #
+        # Closed intervals, plus any call still OPEN at this flush bounded at
+        # the window end. Excluding the open ones publishes the part of a
+        # straddling call that ran inside this window as generation while the
+        # call's own duration_ms counts it again — harmless while the windows
+        # were too narrow to overlap a tool, and a live double-count now that
+        # they tile. Antigravity hit exactly that and broke the invariant by
+        # 0.26 ms; the fix travels with the tiling that makes it reachable.
         tool_spans = [
             (c.execution_started_at, c.execution_completed_at)
             for c in self.commands
             if c.execution_started_at is not None and c.execution_completed_at is not None
         ]
+        tool_spans += [
+            (t.execution_started_at, completed)
+            for t in self.open_tools.values()
+            if t.execution_started_at is not None and t.execution_started_at < completed
+        ]
         span_ms = max((completed - started).total_seconds() * 1000.0, 0.0)
         gen_ms = max(0.0, span_ms - busy_ms(tool_spans, started, completed))
         message_id = f"{self.turn_id}-msg-{self.gen_index}"
@@ -537,6 +576,10 @@ def _flush_message(self, last: Any) -> None:
                 )
             )
         self.gen_index += 1
+        # A message was appended, so the next window starts where this one
+        # ended. Both early returns above leave the mark alone on purpose.
+        if window_end_ms is not None:
+            self.gen_mark_ms = window_end_ms
         self.open_blocks = []
         self.open_start_ms = None
         self.open_end_ms = None
diff --git a/tests/test_antigravity_agent.py b/tests/test_antigravity_agent.py
index d25b249c..c17986a9 100644
--- a/tests/test_antigravity_agent.py
+++ b/tests/test_antigravity_agent.py
@@ -1762,6 +1762,52 @@ async def test_a_straddling_tool_is_charged_only_for_its_in_window_part(monkeypa
     assert second.generation_duration_ms > 0
 
 
+async def test_a_tool_still_open_at_the_flush_is_not_generation_time(monkeypatch):
+    """The sibling of the straddle test above, for the window the tool opened IN.
+
+    Subtracting only CLOSED intervals published the part of a still-running
+    call that had already elapsed as model time, while the call's own
+    `duration_ms` counted it again. These windows tile the turn, so there is no
+    slack to absorb that: measured on tasks/hello_date with a live
+    gemini-3.1-pro-preview, a Bash opening 1.7 ms before the flush drove
+    Sum(generation) + Sum(command) 0.26 ms PAST the turn's own
+    `duration_seconds`, on a turn whose entire headroom was 1.4 ms. Four
+    sibling runs passed by 1.2-8.7 ms out of ~12 s, so it was a coin flip.
+    """
+    _install_clock(monkeypatch, _Clock())
+    steps = [
+        # t1 opens here and is STILL RUNNING when the first window is cut.
+        _step(
+            "TOOL_CALL",
+            "ACTIVE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "slow"})],
+        ),
+        _step("THINKING", "DONE", thinking="first", usage=_usage(100, 0, 5, 5)),
+        _step(
+            "TOOL_CALL",
+            "DONE",
+            target="TARGET_ENVIRONMENT",
+            tool_calls=[_tc("run_command", "t1", {"command_line": "slow", "exit_code": 0})],
+        ),
+        _step("THINKING", "DONE", thinking="second", usage=_usage(100, 0, 5, 5)),
+    ]
+    record = await _agent_with_steps(steps).communicate("go")
+
+    first = _assistant(record)[0]
+    slow = next(c for c in record.commands if c.tool_id == "t1")
+    span_ms = (first.completed_at - first.started_at).total_seconds() * 1000.0
+    # The part of t1 that had already run when this window was cut.
+    in_window_ms = (first.completed_at - slow.execution_started_at).total_seconds() * 1000.0
+
+    assert slow.execution_started_at < first.completed_at, "fixture must open the tool in this window"
+    assert slow.execution_completed_at > first.completed_at, "...and leave it open across the flush"
+    assert first.generation_duration_ms == pytest.approx(span_ms - in_window_ms)
+    # The whole point: what the page shows as Generation plus what it shows as
+    # Tool exec must still fit in the window they are shown against.
+    assert first.generation_duration_ms + in_window_ms == pytest.approx(span_ms)
+
+
 async def test_a_no_op_flush_does_not_move_the_mark(monkeypatch):
     """An empty generation must leave the open window alone.
 
diff --git a/tests/test_codex_agent.py b/tests/test_codex_agent.py
index 8174eb55..342f7297 100644
--- a/tests/test_codex_agent.py
+++ b/tests/test_codex_agent.py
@@ -2245,11 +2245,15 @@ async def test_an_orphaned_tool_keeps_its_known_start_but_no_end(self):
 class TestGenerationWindowExcludesToolExecution:
     """A tool closing inside a generation window is not model time.
 
-    `_flush_message`'s window is seeded from the first item's start and
-    extended to the LAST item's completion, so any generation containing a
-    tool call already CONTAINS that tool's execution. Publishing the raw span
-    double-counted it against the tool's own duration_ms — Generation + Tool
-    exec then exceeded the wall clock they are shown against.
+    `_flush_message`'s window is extended to the LAST item's completion, so
+    any generation containing a tool call already CONTAINS that tool's
+    execution. Publishing the raw span double-counted it against the tool's
+    own duration_ms — Generation + Tool exec then exceeded the wall clock they
+    are shown against.
+
+    See TestGenerationWindowsTileTheTurn for where each window BEGINS; these
+    cases all describe a turn's first generation, which has no predecessor to
+    tile from and so still starts at its own first item.
     """
 
     async def test_a_tool_only_emission_reports_no_generation_time(self):
@@ -2298,6 +2302,68 @@ async def test_generation_plus_tool_exec_does_not_exceed_the_window(self):
         assert gen_ms + tool_ms == pytest.approx(window_ms)
 
 
+class TestGenerationWindowsTileTheTurn:
+    """Each generation window runs from the PREVIOUS one's end, not its own first item.
+
+    The SDK stamps an item with the moment it began EXECUTING, so a window
+    seeded from that stamp discards the model time that produced the item.
+    Observed on tasks/hello_date with a live gpt-5.5: a Write emission spanning
+    2 ms reported 98 output tokens while the 2694 ms that generated it sat in
+    the preceding gap, attributed to nothing, and the emission published
+    `generation_duration_ms=0.0` — a fabricated "instant generation" of exactly
+    the kind CE058 exists to stop. Only 15.8% of that 17 s turn was accounted
+    for; tiling took three live runs to 66-86%.
+    """
+
+    async def test_the_gap_before_an_emission_is_its_generation_time(self):
+        first = _bounds_command_item("cmd_a")
+        second = _bounds_command_item("cmd_b")
+        notifications = [
+            # gen 0: a tool that ran for 100ms, starting the turn.
+            _item_notification("item/started", first, started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", first, completed_at_ms=_BOUNDS_EPOCH_MS + 100),
+            _token_usage(inp=10, out=5, cached=0),
+            # gen 1: 1900ms of model time, THEN a 50ms tool. The stream stamps
+            # only the tool, so the 1900ms is visible solely as the gap.
+            _item_notification("item/started", second, started_at_ms=_BOUNDS_EPOCH_MS + 2000),
+            _item_notification("item/completed", second, completed_at_ms=_BOUNDS_EPOCH_MS + 2050),
+            _token_usage(inp=10, out=5, cached=0),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        assistant = [m for m in record.messages if m.role == "assistant"]
+        assert len(assistant) == 2
+        # Seeded from its own first item, this window was 50ms of pure tool
+        # execution and published 0.0.
+        assert assistant[1].generation_duration_ms == pytest.approx(1900.0)
+        # ...and it abuts its predecessor rather than starting at the tool.
+        assert assistant[1].started_at == assistant[0].completed_at
+
+    async def test_tool_time_is_still_excluded_from_a_tiled_window(self):
+        """Tiling must not re-admit the double-count 4/6 removed."""
+        first = _bounds_command_item("cmd_a")
+        second = _bounds_command_item("cmd_b")
+        notifications = [
+            _item_notification("item/started", first, started_at_ms=_BOUNDS_EPOCH_MS),
+            _item_notification("item/completed", first, completed_at_ms=_BOUNDS_EPOCH_MS + 100),
+            _token_usage(inp=10, out=5, cached=0),
+            _item_notification("item/started", second, started_at_ms=_BOUNDS_EPOCH_MS + 2000),
+            _item_notification("item/completed", second, completed_at_ms=_BOUNDS_EPOCH_MS + 2050),
+            _token_usage(inp=10, out=5, cached=0),
+            _turn_completed(),
+        ]
+        agent = _started_agent(parse_agent_config(type=AgentKind.CODEX), notifications)
+        record = await agent.communicate("go")
+
+        gen_ms = sum(m.generation_duration_ms or 0.0 for m in record.messages if m.role == "assistant")
+        tool_ms = sum(c.duration_ms or 0.0 for c in record.commands)
+        # The turn the stream describes runs from the first stamp to the last.
+        assert tool_ms == pytest.approx(150.0)
+        assert gen_ms + tool_ms == pytest.approx(2050.0)
+
+
 class TestFlushMessageGenTimeSplit:
     """`gen_ms` is apportioned across sub-messages by their output share.
 

From d809c93103ba47c134ab23b29bc037e21c3fdf85 Mon Sep 17 00:00:00 2001
From: uipreliga <tomasz.religa@uipath.com>
Date: Thu, 10 Sep 2026 21:45:22 -0700
Subject: [PATCH 10/10] fix(opencode): tile generation windows from the
 previous step's finish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenCode bounded each window at `step_start`/`step_finish`, but the CLI
announces a step only once it is already producing one, so the model time
that PRODUCED the step landed in the gap before it and was attributed to
nothing. Measured on tasks/hello_date with a live claude-haiku-4.5: gaps of
857 ms and 851 ms carrying no tool at all (the Write inside them took 7 ms).

Same defect and same fix as the Codex half of 237437b1 — a `gen_mark`
carrying the previous step's finish. The first window deliberately does NOT
tile: everything before the first `step_start` is CLI process spawn, and
folding it in would report Node's boot as model generation.

Four live runs, before -> after:

  accounted   33.9% -> 57.9%
  inter-message gaps   1788 ms -> 0 ms

That is the whole of the gap bucket, and it is all that this change claims.
The remaining 42% is one bucket, `head` (3376 ms of spawn + time-to-first-
token), which is real wall time that is neither model nor tool and has no
home in a TurnRecord that carries only those two. So OpenCode stays above
the evalboard's 25% Unaccounted threshold on a short task; closing that
needs the harness-overhead bucket, not a wider window. Noted so the next
reader does not mistake a partial recovery for the finished job.

All three clauses still hold (headroom 2.7-5.0 s across the four runs), and
both new tests fail without the fix (200.0 vs 1000.0).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/coder_eval/agents/opencode_agent.py | 24 ++++++++-
 tests/test_opencode_agent.py            | 68 +++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/src/coder_eval/agents/opencode_agent.py b/src/coder_eval/agents/opencode_agent.py
index b33c0807..708f38ec 100644
--- a/src/coder_eval/agents/opencode_agent.py
+++ b/src/coder_eval/agents/opencode_agent.py
@@ -309,6 +309,20 @@ def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str
         # needs it to close a TurnStartEvent the stream never got to close.
         self.step_open = False
         self.step_started_at: datetime | None = None
+        # Where the NEXT generation window starts: the previous step's finish.
+        # The CLI announces a step only once it is already producing one, so a
+        # window bounded by `step_start` drops the model time that PRODUCED the
+        # step into the gap before it. Measured on tasks/hello_date with a live
+        # claude-haiku-4.5: two gaps of 857 ms and 851 ms, carrying no tool
+        # (the Write inside them took 7 ms), attributed to nothing — 24% of the
+        # turn's wall clock, enough on its own to hold OpenCode above the
+        # evalboard's 25% "Unaccounted" red threshold.
+        #
+        # None until the first step finishes, and deliberately so: the first
+        # window keeps its own `step_start`, because everything before it is
+        # CLI process spawn, not model time. Tiling that in would report Node's
+        # boot as generation. Same shape as Codex's `gen_mark_ms`.
+        self.gen_mark: datetime | None = None
         self.step_text_parts: list[str] = []
         self.step_tool_ids: list[str] = []
         # Execution intervals of tools that CLOSED inside the open
@@ -685,8 +699,11 @@ def on_step_finish(self, part: dict[str, Any]) -> None:
         if isinstance(finish, str) and finish:
             self.stop_reason = finish
 
-        started = self.step_started_at or datetime.now()
         completed = datetime.now()
+        step_start = self.step_started_at or completed
+        # Tile from the previous step's finish; min() keeps a clock that went
+        # backwards from inverting the span.
+        started = min(self.gen_mark, step_start) if self.gen_mark is not None else step_start
         blocks: list[ContentBlock] = []
         step_text = "".join(self.step_text_parts)
         if step_text:
@@ -714,6 +731,11 @@ def on_step_finish(self, part: dict[str, Any]) -> None:
                 message_id=str(part.get("messageID") or "") or None,
             )
         )
+        # A message was appended, so the next window starts where this one
+        # ended. Only `step_finish` advances the mark: a step that never
+        # finished published nothing, so tiling past it would attribute its
+        # time to whichever step finishes next.
+        self.gen_mark = completed
         self.emit(
             TurnEndEvent(
                 task_id=self.task_id,
diff --git a/tests/test_opencode_agent.py b/tests/test_opencode_agent.py
index 0c140887..572bb972 100644
--- a/tests/test_opencode_agent.py
+++ b/tests/test_opencode_agent.py
@@ -1850,3 +1850,71 @@ def test_the_window_never_goes_negative(self, monkeypatch):
             [(self.WINDOW_START - timedelta(seconds=30), self.WINDOW_END + timedelta(seconds=30))],
         )
         assert message.generation_duration_ms == 0.0
+
+
+class TestGenerationWindowsTileTheTurn:
+    """Each step's window runs from the PREVIOUS step's finish, not its own `step_start`.
+
+    The CLI announces a step only once it is already producing one, so the
+    model time that PRODUCED the step lands in the gap before it. Measured on
+    tasks/hello_date with a live claude-haiku-4.5: gaps of 857 ms and 851 ms
+    carrying no tool at all (the Write inside them took 7 ms), attributed to
+    nothing — 24% of the turn, on its own enough to hold OpenCode above the
+    evalboard's 25% "Unaccounted" red threshold.
+
+    Driven at the reducer for the same reason as the sibling class above: the
+    window is two `datetime.now()` reads, so only setting them explicitly
+    makes the arithmetic deterministic.
+    """
+
+    T0 = datetime(2026, 1, 1, 12, 0, 0)
+
+    @staticmethod
+    def _finish_at(monkeypatch, state, *, step_start, now):
+        import coder_eval.agents.opencode_agent as agent_module
+
+        class _Clock(datetime):
+            @staticmethod
+            def now(tz=None):
+                return now
+
+        state.step_started_at = step_start
+        state.step_tool_spans = []
+        monkeypatch.setattr(agent_module, "datetime", _Clock)
+        state.on_step_finish({"reason": "stop", "tokens": {"input": 100, "output": 20}})
+
+    def _two_steps(self, monkeypatch):
+        state = _OpenCodeTurnState(task_id="t1", iteration=1, user_input="do it", model="deepseek/deepseek-v4-pro")
+        # Step 1 runs T0 -> T0+1000.
+        self._finish_at(monkeypatch, state, step_start=self.T0, now=self.T0 + timedelta(milliseconds=1000))
+        # 800ms of model time, then a step the CLI only announces at T0+1800.
+        self._finish_at(
+            monkeypatch,
+            state,
+            step_start=self.T0 + timedelta(milliseconds=1800),
+            now=self.T0 + timedelta(milliseconds=2000),
+        )
+        return [m for m in state.messages if m.role == "assistant"]
+
+    def test_the_gap_before_a_step_is_its_generation_time(self, monkeypatch):
+        first, second = self._two_steps(monkeypatch)
+        # Bounded by its own step_start, this window was 200ms and the 800ms
+        # that produced it was attributed to nothing.
+        assert second.generation_duration_ms == pytest.approx(1000.0)
+        assert second.started_at == first.completed_at
+
+    def test_the_first_step_keeps_its_own_start(self, monkeypatch):
+        """Everything before the first `step_start` is CLI spawn, not model time.
+
+        Tiling the first window back to the turn's start would report Node's
+        boot — 3.1 s of OpenCode's measured head — as generation.
+        """
+        first, _ = self._two_steps(monkeypatch)
+        assert first.started_at == self.T0
+        assert first.generation_duration_ms == pytest.approx(1000.0)
+
+    def test_the_steps_leave_no_gap_between_them(self, monkeypatch):
+        first, second = self._two_steps(monkeypatch)
+        covered = (second.completed_at - first.started_at).total_seconds() * 1000.0
+        gen = sum(m.generation_duration_ms or 0.0 for m in (first, second))
+        assert gen == pytest.approx(covered)