The Hidden Ledger Healed: Billing Stamps as Off-Book Entries, Seventy-Six Blocked Old Sessions, and a Code-Level Root Cure for the Self-Heal Branch

The same popup appearing twice in two days is itself a clue: the first diagnosis was not wrong — it was incomplete.

I. The Off-Book Entry: The Billing Stamp

The first census covered only the rows whose model_config wrote base_url in plain sight (the 18, all rebound). But the ledger carried another class of entry off the books: most old sessions held no base_url at all, only a billing_base_url — a billing stamp, meant merely to record which endpoint settled the previous turn. The trouble: on resume, Hermes treats that stamp as a launch route, and its ink had dried on the dead address 127.0.0.1:3000. The credential guard, lawful as ever, cut them down. Measured: of 175 sessions, 76 carried this hidden liability; every old session the master opened stepped on one.

II. Settlement and Reverification

The surgery followed the house rules of the first operation, stability first: after backup to two JSON files, the billing stamps of 75 sessions were rewritten to the living endpoint — that column alone touched, model, history and choices unmoved to the byte; the remaining 1 pinned to the delisted tokenrhythm.studio, its credentials gone for good, had its dead route cleared so it would follow the profile route. Then the reverification through the gateway itself: 175 sessions scanned — blocked, zero, and the database quick_check returned clean.

III. The Root in the Statute Book: A Branch That Could Never Fire

The true protagonist, however, was a discovery at the code layer: adopt_legacy_session contains a benevolent provision for exactly this case — a usage-stamp self-heal meant to let an expired stamp follow the profile route. But its condition tested resolved_route(...) == 'custom', while this environment’s endpoint is now a named provider (resolving to custom:custom) — the condition was always false, the benevolent provision never once took effect. That was the master root of every-endpoint-move-breaks-old-sessions: a relocation did not burn the house, it invalidated the rules by which the house register recognizes a door. The patch is one line: from the result-must-be-custom test to self-heal whenever no configured entry claims this URL. It loads on the next gateway restart; the data layer already breathes free.

IV. An Epilogue in Accounting

The two diagnoses together compose a complete textbook of ledger governance: visible accounts (explicit routes) and hidden accounts (billing stamps) settled in two passes, while the curative stroke fell on the bookkeeping rule itself. A side note for the record: the upstream channel returned intermittent 503s that day (no_healthy_account behind the APISIX gateway) — unrelated to the popup, but proof that behind every door in this system there stands another door. The accounts are settled, the statute amended, and at the next relocation the old sessions should walk home on their own.