[AbirAbbas]

What was true

Client.settle recovers a late OpenRouter receipt for a torn, cut or unmetered streamed answer. Its direct-service guard returned early unless the attempt's base classified as OpenRouter, in which case fetchReceiptAt sent the direct service's own key to openrouter.ai/.../generation. #1887's TestLateReceiptFollowsTheOverflowRoute asserted that behaviour.

What is true now

A direct client returns before any receipt lookup, whatever the attempt base. Ordinary usage billing still runs first, and the router road's late-receipt recovery is unchanged.

Reach

No shipped configuration reached the old path. Every shipped overflow door (Z.ai, Moonshot and Qwen pay-as-you-go) belongs to the same vendor as the configured service, so the attempt base never classified as OpenRouter for a direct client. This closes the guard before any future door could open it.

Tests (from the contract, fake transports recording host and bearer)

• TestV1V3DirectLateReceiptNeverUsesAnOverflowHost: a direct client on its configured base, its metered door, and an OpenRouter attempt base, for torn, stalled and unmetered endings with and without usage. It makes no lookup and banks nothing new; a reported-usage answer is billed exactly once, as before.
• TestV2RouterTornAnswerRecoversWithItsOwnBearer: a torn router answer is still recovered from openrouter.ai with the router's own bearer: two requests, the same recovered price and tokens, and one recovered usage event.
• Before the fix, the three missing-usage OpenRouter cases failed with GET /api/v1/generation carrying Bearer vendor-key. After it, they pass.

Gates: gofmt, go vet ./internal/provider/, go test -count=1 for provider, telemetry and config, make test-laws, and make pr-ready.

Follow-ups found by the audit, not changed here

Both can change behaviour a person sees, so they need their own decision:

• Video polling (internal/provider/media.go ~252/284/387): a provider-supplied absolute polling_url is fetched with the client's bearer whatever its host. Downloads already check sameHostAsBase; polling does not.
• Redirects: the default HTTP clients keep Go's redirect policy, which forwards Authorization to subdomains of the original host. Credential-free probes already refuse redirects.

Also in this PR

• receiptResult's five-second wait for the receipt worker is now a thirty-second hang ceiling. Under shared-box load it was exceeded by two receipt tests that pass in a tenth of a second alone; a passing test still returns the moment the worker reports. Test-only.

---

🤖 Generated with Claude Code

[AbirAbbas]

The two follow-ups above are filed with stub replications: #1895 (video polling sends the key to any polling host) and #1896 (redirects to subdomains and other ports keep the key).