feat(blackbox): record per-call subscription attribution

[Kyzcreig]

Summary

Stacked on #799. Records every Hermes-managed upstream completion attempt in the C1 turn_api_calls ledger, pairing raw relay identity headers with the exact call usage object.

 completion attempt
+  snapshot x-pool-served-by / x-pool-route-id
   parse response usage
+  allocate turn-local seq under lock
+  append turn_api_calls row
 retry / fallback classification

• Success rows carry normalized usage, provider/model, HTTP 200, sub identity, route ID, and wire/pinned provenance.
• Failed attempts append zero-token rows before Hermes retry/failover classification.
• Pooled Anthropic and chat-completions paths preserve raw response headers without echoing them into subsequent requests.
• Partial-stream stubs retain the failure-recorded marker so one physical attempt cannot be counted twice.
• Missing/invalid attribution remains fail-open for inference and increments an in-process anomaly counter.

Acceptance coverage

• AC3: mid-turn two-sub failover; 429→200; pinned providers; headerless 200; delegated independent turn; concurrent parent/subagent.
• AC4: production build_api_kwargs echo probe with mutation control.
• I4: per-call token sum equals parent turn totals in SQLite integration.
• Mutation receipts: deleting direct recorder wiring, streaming recorder wiring, partial-stub marker, response carrier, or accumulator emission makes the targeted tests red.

Verification

• scripts/run_tests.sh tests/agent/test_api_call_attribution.py tests/agent/test_stream_surrogate_splicer.py tests/plugins/blackbox -q → 187 passed, 0 failed.
• scripts/run_tests.sh tests/agent/test_anthropic_adapter.py -q → 108 passed, 0 failed.
• Broad suite completed 7,227 passes; five resource-saturation failures/timeouts passed immediate isolated rerun (635 passed, 0 failed).
• git diff --check → clean.
• Independent adversarial review pass 3: APPROVE-WITH-CHANGES; all required changes applied, including live partial-stub wiring gate.

Stack

Base branch is daedalus-opus/t_75b1f823-api-calls / #799. Retarget this PR to main after #799 lands.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

apollo/merge-pass 2026-09-23: not landable as-is — rebase onto current main conflicts (conflicts in plugins/blackbox/store.py against #915 + #787; 3 slices red on the stale head.). Re-port by content is card t_aa0a07fd. Draft until then.

[Kyzcreig]

Superseded by merged #913 (52ba20d). That PR explicitly cherry-picked this PR's accumulator commit 842558300d14e8cabff8e6b0c26c02770c4b8552, then fixed the Anthropic non-streaming transport seam and per-turn sequence test, and added legacy-ledger fixture coverage. #799 had already landed the turn_api_calls schema, guarded migration, insert, cascade retention, and rollup; #913 carried the residual _snapshot_pool_headers, _record_successful_api_call / _record_failed_api_call, record_api_call, streaming/non-streaming attribution, and source tests. Main also contains #915's legacy index migration fix and #787's UNKNOWN usage plumbing, neither of which should be reverted by re-porting this older branch.

Verified on current fork main at 2605de02cf0d98a048fe2d13d65608f8db51c200: tests/agent/test_api_call_attribution.py, test_stream_surrogate_splicer.py, tests/plugins/blackbox/test_api_calls.py, and test_api_calls_compat.py → 62 passed. No residual #828 behavior to re-port. Closing this stale vehicle, not dropping the feature.