diff --git a/packages/amico-run/src/authoring.ts b/packages/amico-run/src/authoring.ts
index 788046eb..f160a6d1 100644
--- a/packages/amico-run/src/authoring.ts
+++ b/packages/amico-run/src/authoring.ts
@@ -20,6 +20,12 @@ export interface AuthoringConfig {
   exemplars?: string; // abs path to exemplars/index.json
   verify_harness?: string; // abs path to julia/verify_rollout.jl
   verify_tolerance: number; // tier-3 re-rollout agreement (absolute)
+  /** Absolute path to the session's STAGED solve template — the copy whose SOLVER
+   *  is already substituted from the selected tier. `resolve` returns this as
+   *  template_path when present, so the vetted workflow AGENTS.md documents
+   *  ("copy template_path") lands on the same file the preamble points at.
+   *  Absent for a bare dev invocation, which falls back to the registry path. */
+  staged_template?: string;
 }
 
 export const DEFAULT_ALLOWLIST = ["Piccolo", "Legato", "Intonato", "NamedTrajectories", "DirectTrajOpt"];
@@ -62,6 +68,7 @@ export function readAuthoring(): { config: AuthoringConfig; warning?: string } {
       exemplars: typeof data.exemplars === "string" ? data.exemplars : undefined,
       verify_harness: typeof data.verify_harness === "string" ? data.verify_harness : undefined,
       verify_tolerance: typeof data.verify_tolerance === "number" ? data.verify_tolerance : DEFAULT_TOLERANCE,
+      staged_template: typeof data.staged_template === "string" ? data.staged_template : undefined,
     },
   };
 }
diff --git a/packages/amico-run/src/launch.ts b/packages/amico-run/src/launch.ts
index dd118c86..f8181384 100644
--- a/packages/amico-run/src/launch.ts
+++ b/packages/amico-run/src/launch.ts
@@ -13,7 +13,8 @@ import { RemoteExecutor } from "./remote_executor.js";
 import { ConfigError, type Executor, type Finished, type SubmitOpts } from "./types.js";
 import { readAuthoring } from "./authoring.js";
 import { runGate } from "./gate.js";
-import { readSolverMode } from "./solver_mode.js";
+import { hpTierSelected } from "./solver_mode.js";
+import { hasCloudConfig } from "./remote_config.js";
 import { assembleWarrantContext } from "./warrant_context.js";
 import { runVerification } from "./verify.js";
 import { trySubcommand } from "./subcommands.js";
@@ -43,6 +44,7 @@ export async function launch(argv: string[]): Promise<number> {
   let specPath: string | undefined;
   const opts: SubmitOpts = { julia: {} };
   let projectExplicit = false;
+  let executorExplicit = false;
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -59,6 +61,7 @@ export async function launch(argv: string[]): Promise<number> {
           return 0;
         case "--executor":
           executor = next();
+          executorExplicit = true;
           break;
         case "--lab":
           opts.lab = next();
@@ -126,25 +129,52 @@ export async function launch(argv: string[]): Promise<number> {
     console.error(`amico-run: unknown --executor ${executor} (supported: local, remote)`);
     return 64;
   }
-  // Piccolissimo + Altissimo is a CLOUD-ONLY tier, so a LOCAL launch is refused
-  // while it is the selected solver. This lives here, not in runGate, because
-  // the gate only sees --spec runs (see `if (specPath)` below) — this line is
-  // the one choke point EVERY run passes through, spec or not.
+  // Piccolissimo + Altissimo is a CLOUD-ONLY tier. This lives here, not in
+  // runGate, because the gate only sees --spec runs (see `if (specPath)` below) —
+  // this is the one choke point EVERY run passes through, spec or not.
   //
-  // Why it is needed at all: selecting HP grants the `issimo` entitlement, so
-  // the import scan would happily admit a local `using Piccolissimo` and the
-  // solve would precompile the HP stack (and IPOPT) on the laptop — the exact
-  // failure this tier exists to avoid, and what amico-run's process-group
-  // timeout used to SIGTERM mid-precompile.
+  // Why it exists at all: selecting HP grants the `issimo` entitlement, so the
+  // import scan would happily admit a local `using Piccolissimo` and the solve
+  // would precompile the HP stack (and IPOPT) on the laptop — the exact failure
+  // this tier exists to avoid, and what amico-run's process-group timeout used to
+  // SIGTERM mid-precompile.
   //
-  // Fails SAFE: an absent or corrupt solver-mode.json reads as piccolo, so
+  // Two different situations, deliberately handled differently:
+  //   - executor defaulted (no --executor at all): PROMOTE to remote. Selecting
+  //     the cloud tier IS the routing decision; making the caller restate it as a
+  //     flag only creates a way to get it wrong. Previously this returned 64 and
+  //     relied on the agent reading the message and retrying — a round-trip that
+  //     surfaced to users as a failed run.
+  //   - --executor local passed EXPLICITLY: refuse. That is a direct
+  //     contradiction of the selected tier, and silently inverting an explicit
+  //     flag is worse than an error.
+  //
+  // Fails SAFE either way: with neither signal present this reads as piccolo, so
   // ordinary local runs behave exactly as before.
-  if (executor === "local" && readSolverMode() === "hp") {
+  if (executor === "local" && hpTierSelected()) {
+    if (executorExplicit) {
+      console.error(
+        `amico-run: Piccolissimo + Altissimo runs in Harmoniqs Cloud and never solves locally — this launch is --executor local. ` +
+          `Drop the flag (cloud is automatic for this tier), or switch the solver to Piccolo (the model · solver control) for local solves.`,
+      );
+      return 64;
+    }
+    // Do not promote into a broken remote. Without a connection the submit would
+    // fail deep in RemoteExecutor with `cloud config not found: ~/.amico/cloud.json`
+    // — accurate, but it names a file the user has never heard of instead of the
+    // control they need. Promotion made this path reachable by DEFAULT, so it has
+    // to say the human thing.
+    if (!hasCloudConfig()) {
+      console.error(
+        `amico-run: Piccolissimo + Altissimo runs in Harmoniqs Cloud, but no cloud connection is configured. ` +
+          `Connect Harmoniqs Cloud in the Connections panel (paste your API key), or switch the solver to Piccolo for local solves.`,
+      );
+      return 64;
+    }
+    executor = "remote";
     console.error(
-      `amico-run: Piccolissimo + Altissimo runs in Harmoniqs Cloud and never solves locally — this launch is --executor local. ` +
-        `Run it with --executor remote, or switch the solver to Piccolo (the model · solver control) for local solves.`,
+      `amico-run: solver is Piccolissimo + Altissimo → running in Harmoniqs Cloud (--executor remote, automatic for this tier)`,
     );
-    return 64;
   }
   // --spec + --executor remote is SUPPORTED (High-Performance + Cloud, tier=hpc):
   // the launch gate is a static local check and runs identically for both
@@ -155,6 +185,44 @@ export async function launch(argv: string[]): Promise<number> {
     console.error(`amico-run: --julia/--project/--sysimage are ignored with --executor remote (the runner image owns the environment)`);
   }
 
+  // ── cloud telemetry preflight ──
+  // A cloud script that never writes run.log CANNOT stream anything to the Run
+  // Inspector, and the user pays the full queue + instance-boot wait to find out.
+  //
+  // Why run.log specifically: /solves/{id}/stats greps AMICODE_ITER out of the
+  // run.log the sidecar syncs from the working directory. Printing to stdout is
+  // NOT enough — the runner's stdout goes to the SSM command stream, which no API
+  // exposes. The bundled template handles this (its emit() appends to run.log
+  // whenever TASK_ID is set, and the runner sets TASK_ID), so a script copied from
+  // the template passes this check for free.
+  //
+  // This is a refusal rather than a warning because it is a certainty, not a risk:
+  // three cloud runs in two days produced an empty Inspector this way, every one of
+  // them a hand-authored script (two with invented API that also died at load).
+  // Warnings on stderr have not changed that. Failing here costs a second and names
+  // the fix; failing in the cloud costs ten minutes and names nothing.
+  // Gated on hasCloudConfig() so error PRECEDENCE is preserved: a remote launch
+  // with no connection at all should still report the missing connection, which is
+  // the more fundamental problem, rather than being pre-empted by a telemetry
+  // complaint about a script that was never going to run.
+  if (executor === "remote" && script && hasCloudConfig()) {
+    let text = "";
+    try {
+      text = readFileSync(script, "utf8");
+    } catch {
+      /* unreadable script — the executor reports that with its own message */
+    }
+    if (text !== "" && !text.includes("run.log")) {
+      console.error(
+        `amico-run: this script cannot stream telemetry from Harmoniqs Cloud — it never writes run.log, so the Run Inspector would stay empty for the whole solve.\n` +
+          `  The cloud reads iterations by grepping AMICODE_ITER out of run.log in the run directory; stdout does not reach it.\n` +
+          `  Fix: author from the bundled solve template (the path AGENTS.md gives you) instead of writing the script from scratch — its emit() writes run.log already.\n` +
+          `  If you are deliberately hand-rolling, append each AMICODE_ITER line to "run.log" in the working directory as well as printing it.`,
+      );
+      return 64;
+    }
+  }
+
   // ── spec C: the launch gate. Failures leave NO run dir and exit 64. ──
   if (specPath) {
     // specRaw was parsed above (problem_spec detection). Only read the script for
diff --git a/packages/amico-run/src/solver_mode.ts b/packages/amico-run/src/solver_mode.ts
index 1c44eb8a..4617d565 100644
--- a/packages/amico-run/src/solver_mode.ts
+++ b/packages/amico-run/src/solver_mode.ts
@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { readAuthoring } from "./authoring.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -41,3 +42,30 @@ export function readSolverMode(env: NodeJS.ProcessEnv = process.env): SolverMode
     return "piccolo";
   }
 }
+
+/** Is the Piccolissimo + Altissimo tier selected, by EITHER of the two signals
+ *  that record it?
+ *
+ *  solver-mode.json alone is not enough. It only changes when something posts a
+ *  `status:"switching"` request, so a dropped write leaves it stale — observed
+ *  2026-08-05, where it read `piccolo` (dated Jul 28) while the entitlement was
+ *  granted and Harmoniqs Cloud was connected. Routing keyed off that file alone,
+ *  so a paid-tier solve ran locally on IPOPT and no surface anywhere said so.
+ *
+ *  The second signal is the entitlement-resolved allowlist in authoring.json,
+ *  which session prep writes from the SAME switch and which amico-run already
+ *  reads for the gate. Piccolissimo in the allowlist means the issimo entitlement
+ *  is granted, and switching back to Piccolo revokes it — so it is self-cleaning
+ *  rather than a second thing to keep in sync.
+ *
+ *  OR, not AND, deliberately: of the two ways to be wrong, silently charging
+ *  someone for the cloud tier and giving them a local IPOPT solve is much worse
+ *  than telling a revoked user to reconnect. Still fails SAFE overall — with
+ *  neither signal present this is false and local runs behave exactly as before. */
+export function hpTierSelected(
+  env: NodeJS.ProcessEnv = process.env,
+  allowlist?: readonly string[],
+): boolean {
+  if (readSolverMode(env) === "hp") return true;
+  return (allowlist ?? readAuthoring().config.allowlist).includes("Piccolissimo");
+}
diff --git a/packages/amico-run/src/subcommands.ts b/packages/amico-run/src/subcommands.ts
index c6027b1c..8202b0dc 100644
--- a/packages/amico-run/src/subcommands.ts
+++ b/packages/amico-run/src/subcommands.ts
@@ -49,7 +49,20 @@ export function resolveCommand(argv: string[]): number {
   const out: Record<string, unknown> = { tier: match.tier };
   if (match.template) {
     out.source = { template_id: match.template.id };
-    out.template_path = resolve(registryDir, match.template.path);
+    // Prefer the session's STAGED template. The registry path is the BUNDLED file,
+    // whose {{SOLVER}} placeholder is unsubstituted and degrades to ipopt — so an
+    // HP user following the documented vetted workflow ("copy template_path") got
+    // a Piccolo/IPOPT script no matter what the solver toggle said. The staged copy
+    // is the same template with SOLVER already resolved from the selected tier, and
+    // it is the file AGENTS.md's preamble points at, so the two instructions now
+    // agree instead of contradicting each other.
+    //
+    // Falls back to the registry path when no session staged one (a bare dev
+    // invocation), which is the historical behaviour.
+    out.template_path =
+      config.staged_template && existsSync(config.staged_template)
+        ? config.staged_template
+        : resolve(registryDir, match.template.path);
     out.packages = match.template.packages;
   } else if (match.exemplar) {
     out.source = { exemplar_id: match.exemplar.id };
diff --git a/packages/amico-run/test/cli.test.ts b/packages/amico-run/test/cli.test.ts
index dfeef6c1..9e55d844 100644
--- a/packages/amico-run/test/cli.test.ts
+++ b/packages/amico-run/test/cli.test.ts
@@ -5,6 +5,11 @@ import { join } from "node:path";
 import { fakeJulia, hermeticOpsEnv, readToml, tmpRoot } from "./helpers.js";
 import { FakeCloud } from "./fake_cloud.js";
 
+/** Stand-in for a template-derived cloud script: it appends telemetry to
+ *  run.log, which is what the cloud actually greps and what the telemetry
+ *  preflight requires. A bare stub would be refused, correctly. */
+const REMOTE_STUB = 'open("run.log", "a") do io\n    println(io, "AMICODE_ITER iter=1 f=1e-2")\nend\n';
+
 const BUNDLE = join(__dirname, "..", "dist", "amico-run.js");
 beforeAll(() => {
   execFileSync("node", [join(__dirname, "..", "esbuild.config.mjs")], { cwd: join(__dirname, "..") });
@@ -27,7 +32,7 @@ describe("amico-run CLI", () => {
   it("clean solve: relays iter lines, prints AMICODE_FINISHED, exits 0", () => {
     const root = tmpRoot();
     const julia = fakeJulia(root, "j", `console.log('AMICODE_ITER iter=1 f=0.5'); console.log('DONE f=0.99')`);
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia]);
     expect(r.code).toBe(0);
     expect(r.stdout).toContain("AMICODE_ITER iter=1 f=0.5");
@@ -36,7 +41,7 @@ describe("amico-run CLI", () => {
   it("julia rc 7 passes through as exit 7", () => {
     const root = tmpRoot();
     const r = run([
-      fakeJulia(root, "s.jl", ""),
+      fakeJulia(root, "s.jl", REMOTE_STUB),
       "--runs-root",
       join(root, "runs"),
       "--julia",
@@ -53,13 +58,13 @@ describe("amico-run CLI", () => {
   });
   it("unknown flag → 64 (never silently swallowed, spec Q68)", () => {
     const root = tmpRoot();
-    const r = run([fakeJulia(root, "s.jl", ""), "--gates", "X"]);
+    const r = run([fakeJulia(root, "s.jl", REMOTE_STUB), "--gates", "X"]);
     expect(r.code).toBe(64);
     expect(r.stderr).toMatch(/unknown flag/);
   });
   it("--executor remote without cloud config → 64 (config-class), no run dir", () => {
     const root = tmpRoot();
-    const r = run([fakeJulia(root, "s.jl", ""), "--executor", "remote", "--runs-root", join(root, "runs")], {
+    const r = run([fakeJulia(root, "s.jl", REMOTE_STUB), "--executor", "remote", "--runs-root", join(root, "runs")], {
       AMICO_CLOUD_FILE: join(root, "no-such-cloud.json"), // hermetic: ignore any real ~/.amico/cloud.json
       AMICO_CLOUD_URL: "",
       AMICO_CLOUD_TOKEN: "",
@@ -71,7 +76,7 @@ describe("amico-run CLI", () => {
 
   it("--executor bogus → 64 naming the supported set", () => {
     const root = tmpRoot();
-    const r = run([fakeJulia(root, "s.jl", ""), "--executor", "bogus"]);
+    const r = run([fakeJulia(root, "s.jl", REMOTE_STUB), "--executor", "bogus"]);
     expect(r.code).toBe(64);
     expect(r.stderr).toMatch(/local, remote/);
   });
@@ -83,7 +88,7 @@ describe("amico-run CLI", () => {
     const root = tmpRoot();
     writeFileSync(join(root, "spec.json"), "{}");
     const r = run(
-      [fakeJulia(root, "s.jl", ""), "--executor", "remote", "--spec", join(root, "spec.json")],
+      [fakeJulia(root, "s.jl", REMOTE_STUB), "--executor", "remote", "--spec", join(root, "spec.json")],
       { AMICO_CLOUD_URL: "http://127.0.0.1:1", AMICO_CLOUD_TOKEN: "t" },
     );
     expect(r.code).toBe(64);
@@ -102,7 +107,7 @@ describe("amico-run CLI", () => {
     };
     try {
       const root = tmpRoot();
-      const script = fakeJulia(root, "s.jl", "");
+      const script = fakeJulia(root, "s.jl", REMOTE_STUB);
       // ASYNC lane (the SIGTERM-test pattern, cli.test.ts:191-196) — NEVER the
       // sync run() helper here: FakeCloud runs IN this test process, and
       // execFileSync would block the event loop, so the fake could never answer
@@ -128,7 +133,7 @@ describe("amico-run CLI", () => {
   }, 15000);
   it("--spec: gate failure → 64, one-line stderr reason, NO run dir (spec C)", () => {
     const root = tmpRoot();
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     writeFileSync(join(root, "bad.json"), JSON.stringify({ nope: true }));
     const r = run([
       script,
@@ -145,7 +150,7 @@ describe("amico-run CLI", () => {
   });
   it("--spec pass: solvespec.json persisted canonical + run.toml v2 stamped (spec C)", () => {
     const root = tmpRoot();
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const spec = {
       schema_version: "2",
       script_path: script,
@@ -178,7 +183,7 @@ describe("amico-run CLI", () => {
   });
   it("--spec env.kind=project sets the julia --project arg from env.project (spec C)", () => {
     const root = tmpRoot();
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const env = join(root, "env");
     mkdirSync(env, { recursive: true });
     writeFileSync(join(env, "Project.toml"), `[deps]\n`);
@@ -198,7 +203,7 @@ describe("amico-run CLI", () => {
   });
   it("--spec tier=free: verification runs after FINISHED (AMICODE_VERIFIED + verification.toml); vetted: neither (spec C)", () => {
     const root = tmpRoot();
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const env = join(root, "env");
     mkdirSync(env, { recursive: true });
     writeFileSync(join(env, "Project.toml"), `[deps]\n`);
@@ -262,7 +267,7 @@ describe("amico-run CLI", () => {
     // has no cloud config in scope (env pair cleared, cloud.json pointed at a
     // nonexistent file) — a local free solve must still complete, exit 0.
     const root = tmpRoot();
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const env = join(root, "env");
     mkdirSync(env, { recursive: true });
     writeFileSync(join(env, "Project.toml"), `[deps]\n`);
@@ -287,7 +292,7 @@ describe("amico-run CLI", () => {
   it("SIGTERM to the CLI → abort lane, exit 130", async () => {
     const root = tmpRoot();
     const julia = fakeJulia(root, "j", `console.log('READY'); setInterval(() => {}, 1000)`);
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const code: number = await new Promise((resolveP) => {
       const child = execFile("node", [BUNDLE, script, "--runs-root", join(root, "runs"), "--julia", julia], {
         env: { ...process.env, ...hermeticOpsEnv() },
diff --git a/packages/amico-run/test/cloud_telemetry_preflight.test.ts b/packages/amico-run/test/cloud_telemetry_preflight.test.ts
new file mode 100644
index 00000000..a00ebaa6
--- /dev/null
+++ b/packages/amico-run/test/cloud_telemetry_preflight.test.ts
@@ -0,0 +1,155 @@
+import { describe, it, expect, beforeAll } from "vitest";
+import { execFile, execFileSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpRoot, fakeJulia, hermeticOpsEnv } from "./helpers.js";
+import { FakeCloud } from "./fake_cloud.js";
+
+// A cloud script that never writes run.log cannot stream ANYTHING to the Run
+// Inspector, and the user pays the full queue + instance-boot wait to discover it.
+//
+// Why run.log and not stdout: /solves/{id}/stats greps AMICODE_ITER out of the
+// run.log the sidecar syncs from the working directory. The runner's stdout goes to
+// the SSM command stream, which no API exposes — verified on task
+// e4b25689 (HTTP 200, stats: []) and again on 975a7c07 and 64b8.
+//
+// Three cloud runs in two days hit this, every one a hand-authored script:
+//   x-gate-transmon-56    invented CubicSplinePulse kwargs, CallbackLogger, get_fidelity
+//   x-gate-transmon-hpc   a Jul-28 script reused verbatim; ZeroOrderPulse into
+//                         SplinePulseProblem, which Piccolo 1.19 rejects outright
+//   x-gate-transmon-hpc-3 CubicSplinePulseProblem (undefined) and
+//                         AltissimoOptions(intermediate_callback=…) (no such field)
+// None wrote run.log. LOCAL runs are unaffected: LocalExecutor pipes the child's
+// stdout into run.log itself (local_executor.ts:293), so the script need not.
+
+const BUNDLE = join(__dirname, "..", "dist", "amico-run.js");
+beforeAll(() => {
+  execFileSync("node", [join(__dirname, "..", "esbuild.config.mjs")], { cwd: join(__dirname, "..") });
+});
+
+/** A hand-rolled script that prints telemetry but never writes the file. */
+const STDOUT_ONLY = `using Printf
+@printf("AMICODE_ITER iter=1 f=1.0e-2 inf_pr=1e-8 inf_du=1e-6\\n")
+println("DONE fidelity=0.99")
+`;
+
+/** What the bundled template does: print AND append to run.log under TASK_ID. */
+const WRITES_RUN_LOG = `function emit(line)
+    println(line)
+    if haskey(ENV, "TASK_ID")
+        open("run.log", "a") do io
+            println(io, line)
+        end
+    end
+end
+emit("AMICODE_ITER iter=1 f=1.0e-2 inf_pr=1e-8 inf_du=1e-6")
+emit("DONE fidelity=0.99")
+`;
+
+function scriptWith(root: string, name: string, body: string): string {
+  const p = join(root, name);
+  writeFileSync(p, body);
+  return p;
+}
+
+describe("cloud telemetry preflight", () => {
+  it("refuses a remote launch whose script never writes run.log", () => {
+    const root = tmpRoot();
+    const script = scriptWith(root, "stdout_only.jl", STDOUT_ONLY);
+    let out = { code: 0, stderr: "" };
+    try {
+      execFileSync("node", [BUNDLE, script, "--executor", "remote", "--runs-root", join(root, "runs")], {
+        encoding: "utf8",
+        // a cloud config must EXIST for the preflight to be reachable — with no
+        // connection at all the missing-connection error takes precedence, which is
+        // the more fundamental problem. Pointed at a dead port: the whole claim is
+        // that we refuse before ever contacting it (next test).
+        env: {
+          ...process.env,
+          ...hermeticOpsEnv(),
+          AMICO_CLOUD_URL: "http://127.0.0.1:1",
+          AMICO_CLOUD_TOKEN: "x",
+        },
+      });
+    } catch (e) {
+      const err = e as { status?: number; stderr?: string };
+      out = { code: err.status ?? -1, stderr: err.stderr ?? "" };
+    }
+    expect(out.code).toBe(64);
+    expect(out.stderr).toMatch(/cannot stream telemetry/);
+    // the message must be ACTIONABLE — the whole point is that a cloud failure
+    // names nothing, so this one has to name both the cause and the fix
+    expect(out.stderr).toMatch(/run\.log/);
+    expect(out.stderr).toMatch(/stdout does not reach it/);
+    expect(out.stderr).toMatch(/solve template/);
+  });
+
+  it("refuses BEFORE submitting — no cloud round trip, no run dir", () => {
+    const root = tmpRoot();
+    const script = scriptWith(root, "stdout_only.jl", STDOUT_ONLY);
+    let stdout = "";
+    try {
+      stdout = execFileSync("node", [BUNDLE, script, "--executor", "remote", "--runs-root", join(root, "runs")], {
+        encoding: "utf8",
+        // a cloud URL that would hang/refuse if we ever got as far as submitting
+        env: { ...process.env, ...hermeticOpsEnv(), AMICO_CLOUD_URL: "http://127.0.0.1:1", AMICO_CLOUD_TOKEN: "x" },
+      });
+    } catch (e) {
+      stdout = (e as { stdout?: string }).stdout ?? "";
+    }
+    expect(stdout).not.toMatch(/AMICODE_FINISHED/);
+  });
+
+  it("passes a template-derived script and the run completes", async () => {
+    const fake = new FakeCloud();
+    await fake.start();
+    fake.state = {
+      task_status: "Running",
+      liveness: "alive",
+      iters: [],
+      runLog: "AMICODE_ITER iter=1 f=1.0e-2 inf_pr=1e-8 inf_du=1e-6",
+      finished: { status: "completed" },
+    };
+    try {
+      const root = tmpRoot();
+      const script = scriptWith(root, "from_template.jl", WRITES_RUN_LOG);
+      const r = await new Promise<{ code: number; stdout: string; stderr: string }>((resolveP) => {
+        let stdout = "";
+        let stderr = "";
+        const child = execFile("node", [BUNDLE, script, "--executor", "remote", "--runs-root", join(root, "runs")], {
+          env: { ...process.env, ...hermeticOpsEnv(), AMICO_CLOUD_URL: fake.base, AMICO_CLOUD_TOKEN: fake.token },
+        });
+        child.stdout!.on("data", (d: string) => {
+          stdout += d;
+        });
+        child.stderr!.on("data", (d: string) => {
+          stderr += d;
+        });
+        child.on("exit", (c) => resolveP({ code: c ?? -1, stdout, stderr }));
+      });
+      expect(r.stderr).not.toMatch(/cannot stream telemetry/);
+      expect(r.code).toBe(0);
+      expect(r.stdout).toMatch(/AMICODE_FINISHED status=completed exitCode=0/);
+    } finally {
+      await fake.stop();
+    }
+  }, 15000);
+
+  it("leaves LOCAL runs alone — LocalExecutor writes run.log from stdout itself", () => {
+    // The same stdout-only script is perfectly fine locally, so the check must not
+    // fire there or it would break every ordinary free-tier solve.
+    const root = tmpRoot();
+    const julia = fakeJulia(
+      root,
+      "j",
+      `console.log('AMICODE_ITER iter=1 f=1.0e-2 inf_pr=1e-8 inf_du=1e-6'); console.log('DONE f=0.99')`,
+    );
+    const script = scriptWith(root, "stdout_only.jl", STDOUT_ONLY);
+    const stdout = execFileSync(
+      "node",
+      [BUNDLE, script, "--runs-root", join(root, "runs"), "--julia", julia],
+      { encoding: "utf8", env: { ...process.env, ...hermeticOpsEnv() } },
+    );
+    expect(stdout).toMatch(/AMICODE_FINISHED status=completed exitCode=0/);
+  });
+});
diff --git a/packages/amico-run/test/fake_cloud.ts b/packages/amico-run/test/fake_cloud.ts
index d8b88ba8..a86fbfca 100644
--- a/packages/amico-run/test/fake_cloud.ts
+++ b/packages/amico-run/test/fake_cloud.ts
@@ -19,11 +19,58 @@ export interface FakeState {
   finished?: { status: "completed" | "failed" | "aborted" };
   liveness: "alive" | "gone";
   iters: FakeIter[]; // Δ4 stats: full history each poll (client dedups on high-water)
+  /** A run.log body, served through the SAME transform the deployed /stats lambda
+   *  applies (statsFromRunLog below). Prefer this to `iters` for anything that has
+   *  to survive contact with the real service: `iters` lets a test hand the client
+   *  pre-parsed records the live endpoint would never produce for our own
+   *  telemetry lines, which is exactly how the drift keeps recurring. */
+  runLog?: string;
   frame?: { iter: number; png_base64: string }; // Δ4 frames: newest only
   framesBroken?: boolean; // 500 the frames endpoint — resolution (a) lane
   pulse?: Array<{ raw: string }>; // Δ4 pulse: AMICODE_PULSE_META + AMICODE_PULSE lines, full history each poll
 }
 
+/** Port of the deployed lambda's stats extraction, line for line
+ *  (terraform/lambda_code/solves_poll/lambda_function.py:155-160):
+ *
+ *      if "AMICODE_ITER" in line:
+ *          payload = line.split("AMICODE_ITER", 1)[1].strip()
+ *          stats.append(json.loads(payload) if payload.startswith("{") else {"raw": payload})
+ *
+ *  The consequence worth internalising: our telemetry lines are `iter=7 f=… ` —
+ *  key=value, NOT JSON — so the live endpoint returns `{raw: "iter=7 f=…"}`, never
+ *  `{iter: 7, f: …}`. A test that seeds the parsed form is testing a payload the
+ *  server cannot send. That mistake shipped twice: it is why real cloud solves
+ *  came back with zero iterations while every test passed. */
+export function statsFromRunLog(runLog: string): Array<Record<string, unknown>> {
+  const out: Array<Record<string, unknown>> = [];
+  for (const line of runLog.split("\n")) {
+    if (!line.includes("AMICODE_ITER")) continue;
+    const payload = line.split("AMICODE_ITER").slice(1).join("AMICODE_ITER").trim();
+    if (payload.startsWith("{")) {
+      try {
+        out.push(JSON.parse(payload) as Record<string, unknown>);
+        continue;
+      } catch {
+        out.push({ raw: line.trim() });
+        continue;
+      }
+    }
+    out.push({ raw: payload });
+  }
+  return out;
+}
+
+/** The pulse half of the same grep. AMICODE_PULSE_META and AMICODE_PULSE lines are
+ *  relayed VERBATIM as {raw} — they are never JSON — and the client dedups (meta
+ *  once, pulse on the iteration high-water). */
+export function pulseFromRunLog(runLog: string): Array<{ raw: string }> {
+  return runLog
+    .split("\n")
+    .filter((l) => l.includes("AMICODE_PULSE"))
+    .map((l) => ({ raw: l.trim() }));
+}
+
 export class FakeCloud {
   readonly token = "test-token-abc";
   readonly taskId = "task-0001";
@@ -96,13 +143,22 @@ export class FakeCloud {
     // the live payloads; a fake that agrees with the client instead of the server
     // proves nothing.
     if (url === `/solves/${this.taskId}/stats`) {
-      return send(200, { task_id: this.taskId, stats: this.state.iters, submitter: "test" });
+      // runLog wins when set: it goes through the deployed lambda's own transform,
+      // so the test sees the records the live service would actually return.
+      const stats = this.state.runLog !== undefined ? statsFromRunLog(this.state.runLog) : this.state.iters;
+      return send(200, { task_id: this.taskId, stats, submitter: "test" });
     }
     // pulse mirrors stats' shape: {task_id, pulse: [{raw}], submitter}, where the
     // cloud greps AMICODE_PULSE_META + AMICODE_PULSE lines out of the S3 run.log
     // (never JSON, so always {raw}). Full history each poll — the client dedups.
     if (url === `/solves/${this.taskId}/pulse`) {
-      return send(200, { task_id: this.taskId, pulse: this.state.pulse ?? [], submitter: "test" });
+      // Same run.log, same reason as /stats: the deployed endpoint greps
+      // AMICODE_PULSE_META + AMICODE_PULSE out of it (never JSON, so always
+      // {raw}). Verified live — /pulse returns 200 {pulse: []} for a run whose
+      // run.log was never written, exactly like /stats.
+      const pulse =
+        this.state.runLog !== undefined ? pulseFromRunLog(this.state.runLog) : (this.state.pulse ?? []);
+      return send(200, { task_id: this.taskId, pulse, submitter: "test" });
     }
     if (url === `/solves/${this.taskId}/frames`) {
       if (this.state.framesBroken) return send(500, { error: "frames unavailable" });
diff --git a/packages/amico-run/test/helpers.ts b/packages/amico-run/test/helpers.ts
index 498d68c7..d5a22772 100644
--- a/packages/amico-run/test/helpers.ts
+++ b/packages/amico-run/test/helpers.ts
@@ -14,8 +14,19 @@ export function tmpRoot(): string {
  *  (found exactly that way, 2026-07-28). Points at an empty temp dir: absent
  *  files are the fresh-install state every reader already fails safe to.
  *  Spread it BEFORE per-test overrides so a test can still opt into an ops dir. */
-export function hermeticOpsEnv(): { AMICODE_OPS_DIR: string } {
-  return { AMICODE_OPS_DIR: mkdtempSync(join(tmpdir(), "amico-run-ops-")) };
+export function hermeticOpsEnv(): { AMICODE_OPS_DIR: string; AMICO_AUTHORING_FILE: string } {
+  const dir = mkdtempSync(join(tmpdir(), "amico-run-ops-"));
+  return {
+    AMICODE_OPS_DIR: dir,
+    // Pin authoring.json too, not just the ops dir. hpTierSelected() reads the
+    // entitlement-resolved allowlist as its SECOND signal, and a developer's real
+    // ~/.amico/authoring/authoring.json grants Piccolissimo — so without this a
+    // local-run test on this machine sees the cloud tier, promotes, and SUBMITS A
+    // REAL JOB to live staging. That has already happened once. The path
+    // deliberately does not exist: readAuthoring() then falls back to
+    // DEFAULT_ALLOWLIST, which carries no issimo package.
+    AMICO_AUTHORING_FILE: join(dir, "authoring-absent.json"),
+  };
 }
 
 export function readToml(path: string): Record<string, unknown> {
diff --git a/packages/amico-run/test/setup.ts b/packages/amico-run/test/setup.ts
index 4a2596a8..e7392399 100644
--- a/packages/amico-run/test/setup.ts
+++ b/packages/amico-run/test/setup.ts
@@ -21,3 +21,26 @@ process.env.AMICO_CRITIC_BIN = "/nonexistent/amico-test-guard/no-real-model-call
 if (!process.env.AMICO_LEDGER) {
   process.env.AMICO_LEDGER = "/nonexistent/amico-test-guard/ledger.jsonl";
 }
+
+// Same reasoning again, for the cloud: NO TEST MAY EVER SUBMIT A REAL SOLVE.
+//
+// hpTierSelected() treats the entitlement-resolved allowlist in authoring.json as a signal that
+// the Piccolissimo + Altissimo tier is active, and a developer's REAL
+// ~/.amico/authoring/authoring.json grants Piccolissimo. So any test that launches without
+// --executor promotes to remote, reads the developer's live cloud.json, and submits a billed
+// staging job. That is not hypothetical: estimate.test.ts did exactly this and sat 13.5 minutes
+// polling the real cloud before failing.
+//
+// Fails CLOSED the same way as the guards above — a path that cannot exist makes readAuthoring()
+// fall back to DEFAULT_ALLOWLIST, which carries no issimo package, so the tier reads as the free
+// local one. A test that WANTS the cloud tier writes its own authoring.json and points
+// AMICO_AUTHORING_FILE at it (hermeticOpsEnv / authoringGrantingIssimo), which is explicit.
+if (!process.env.AMICO_AUTHORING_FILE) {
+  process.env.AMICO_AUTHORING_FILE = "/nonexistent/amico-test-guard/authoring.json";
+}
+// Belt to that brace: even with the tier misread, an absent cloud config makes the promotion
+// refuse (exit 64) instead of reaching a real endpoint. Only set when the test has not chosen its
+// own — FakeCloud-based tests pass AMICO_CLOUD_URL explicitly.
+if (!process.env.AMICO_CLOUD_URL && !process.env.AMICO_CLOUD_TOKEN) {
+  process.env.AMICO_CLOUD_FILE = "/nonexistent/amico-test-guard/cloud.json";
+}
diff --git a/packages/amico-run/test/solver_mode.test.ts b/packages/amico-run/test/solver_mode.test.ts
index b8e3c11f..8cbe4606 100644
--- a/packages/amico-run/test/solver_mode.test.ts
+++ b/packages/amico-run/test/solver_mode.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeAll } from "vitest";
 import { execFile, execFileSync } from "node:child_process";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpRoot, fakeJulia } from "./helpers.js";
 import { FakeCloud } from "./fake_cloud.js";
@@ -8,13 +8,37 @@ import { readSolverMode, solverModeFile } from "../src/solver_mode.js";
 
 // Piccolissimo + Altissimo is a cloud-only tier. These tests pin the two halves
 // of that guarantee: the reader that decides which solver is selected, and the
-// launch refusal that makes "cloud-only" true rather than merely advertised.
+// launch behaviour that makes "cloud-only" true rather than merely advertised —
+// a defaulted executor is PROMOTED to the cloud, an explicit --executor local is
+// REFUSED. Both halves matter: promotion is what makes the tier automatic, and
+// the refusal is what keeps it from being silently overridden.
+
+/** Stand-in for a template-derived cloud script: it appends telemetry to
+ *  run.log, which is what the cloud actually greps and what the telemetry
+ *  preflight requires. A bare stub would be refused, correctly. */
+const REMOTE_STUB = 'open("run.log", "a") do io\n    println(io, "AMICODE_ITER iter=1 f=1e-2")\nend\n';
 
 const BUNDLE = join(__dirname, "..", "dist", "amico-run.js");
 beforeAll(() => {
   execFileSync("node", [join(__dirname, "..", "esbuild.config.mjs")], { cwd: join(__dirname, "..") });
 });
 
+/** An authoring.json path that does NOT exist, so readAuthoring() falls back to
+ *  DEFAULT_ALLOWLIST (no issimo package). Without this the suite reads the
+ *  DEVELOPER's real allowlist, which grants Piccolissimo — every local-run case
+ *  below would then promote and submit a real job to live staging. */
+function noAuthoring(root: string): string {
+  return join(root, "authoring-absent.json");
+}
+
+/** An authoring.json whose entitlement-resolved allowlist grants Piccolissimo —
+ *  i.e. what session prep writes once the issimo entitlement is granted. */
+function authoringGrantingIssimo(root: string): string {
+  const p = join(root, "authoring.json");
+  writeFileSync(p, JSON.stringify({ allowlist: ["Piccolo", "Piccolissimo"], support_set: [], verify_tolerance: 0.001 }));
+  return p;
+}
+
 function run(args: string[], env: Record<string, string> = {}): { code: number; stdout: string; stderr: string } {
   try {
     const stdout = execFileSync("node", [BUNDLE, ...args], { encoding: "utf8", env: { ...process.env, ...env } });
@@ -63,32 +87,83 @@ describe("readSolverMode", () => {
 });
 
 describe("Piccolissimo + Altissimo never solves locally", () => {
-  // The bug: selecting HP grants the `issimo` entitlement, so the import scan
-  // admits a local `using Piccolissimo` and the laptop precompiles the whole HP
-  // stack (IPOPT included) until amico-run's process-group timeout SIGTERMs it
-  // mid-precompile. Refusing the launch is the durable fix.
-  it("refuses a local launch and exits 64", () => {
+  // The bug this guards: selecting HP grants the `issimo` entitlement, so the
+  // import scan admits a local `using Piccolissimo` and the laptop precompiles the
+  // whole HP stack (IPOPT included) until amico-run's process-group timeout
+  // SIGTERMs it mid-precompile.
+  //
+  // A DEFAULTED executor is promoted to remote rather than refused. Refusing it
+  // (the original behaviour) meant every plain `amico-run script.jl` under the
+  // cloud tier exited 64 and depended on the agent reading the message and
+  // retrying — users saw that round-trip as a failed run.
+  it("promotes a defaulted launch to the cloud instead of refusing it", async () => {
+    const fake = new FakeCloud();
+    await fake.start();
+    fake.state = {
+      task_status: "Running",
+      liveness: "alive",
+      iters: [{ iter: 1, f: "1.0e-2", inf_pr: "1e-8", inf_du: "1e-6" }], // served as {stats} on the wire
+      finished: { status: "completed" },
+    };
+    try {
+      const root = tmpRoot();
+      const ops = opsDirWith(root, JSON.stringify({ mode: "hp", status: "ready" }));
+      // a --julia that would SHOUT if it ever ran: promotion means it never does
+      const julia = fakeJulia(root, "j", `require('fs').writeFileSync(${JSON.stringify(join(root, "ran-locally"))}, 'x')`);
+      const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+      const r = await new Promise<{ code: number; stdout: string; stderr: string }>((resolveP) => {
+        let stdout = "";
+        let stderr = "";
+        // NO --executor flag: that is the whole point of this case
+        const child = execFile("node", [BUNDLE, script, "--runs-root", join(root, "runs"), "--julia", julia], {
+          env: { ...process.env, AMICODE_OPS_DIR: ops, AMICO_AUTHORING_FILE: noAuthoring(root), AMICO_CLOUD_URL: fake.base, AMICO_CLOUD_TOKEN: fake.token },
+        });
+        child.stdout!.on("data", (d: string) => {
+          stdout += d;
+        });
+        child.stderr!.on("data", (d: string) => {
+          stderr += d;
+        });
+        child.on("exit", (c) => resolveP({ code: c ?? -1, stdout, stderr }));
+      });
+      expect(r.code).toBe(0);
+      expect(r.stderr).toMatch(/running in Harmoniqs Cloud/);
+      // it went to the cloud, not to the laptop
+      expect(r.stdout).toMatch(/AMICODE_FINISHED status=completed exitCode=0/);
+      expect(existsSync(join(root, "ran-locally"))).toBe(false);
+    } finally {
+      await fake.stop();
+    }
+  }, 15000);
+
+  // An EXPLICIT --executor local contradicts the selected tier. Silently inverting
+  // a flag the caller typed is worse than an error, so this one still exits 64.
+  it("refuses an explicit --executor local and exits 64", () => {
     const root = tmpRoot();
     const ops = opsDirWith(root, JSON.stringify({ mode: "hp", status: "ready" }));
     const julia = fakeJulia(root, "j", `console.log('DONE f=0.99')`);
-    const script = fakeJulia(root, "s.jl", "");
-    const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], { AMICODE_OPS_DIR: ops });
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+    const r = run([script, "--executor", "local", "--runs-root", join(root, "runs"), "--julia", julia], {
+      AMICODE_OPS_DIR: ops,
+    });
     expect(r.code).toBe(64);
     expect(r.stderr).toContain("Harmoniqs Cloud");
     expect(r.stderr).toMatch(/never solves locally/);
     // it must name the way out, in both directions
-    expect(r.stderr).toMatch(/--executor remote/);
+    expect(r.stderr).toMatch(/cloud is automatic for this tier/);
     expect(r.stderr).toMatch(/switch the solver to Piccolo/);
   });
 
-  // The refusal has to cover a bare `amico-run script.jl` too: runGate only sees
-  // --spec runs, so a gate-only check would leave the commonest path open.
-  it("refuses even with no --spec (the gate never runs on that path)", () => {
+  // Both behaviours have to cover a bare `amico-run script.jl` too: runGate only
+  // sees --spec runs, so a gate-only check would leave the commonest path open.
+  it("covers the no --spec path (the gate never runs there)", () => {
     const root = tmpRoot();
     const ops = opsDirWith(root, JSON.stringify({ mode: "hp", status: "ready" }));
     const julia = fakeJulia(root, "j", `console.log('DONE f=0.99')`);
-    const script = fakeJulia(root, "s.jl", "");
-    const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], { AMICODE_OPS_DIR: ops });
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+    const r = run([script, "--executor", "local", "--runs-root", join(root, "runs"), "--julia", julia], {
+      AMICODE_OPS_DIR: ops,
+    });
     expect(r.code).toBe(64);
     // and it dies BEFORE any run dir exists — no half-run to clean up
     expect(r.stdout).not.toContain("AMICODE_FINISHED");
@@ -112,12 +187,12 @@ describe("Piccolissimo + Altissimo never solves locally", () => {
     try {
       const root = tmpRoot();
       const ops = opsDirWith(root, JSON.stringify({ mode: "hp", status: "ready" }));
-      const script = fakeJulia(root, "s.jl", "");
+      const script = fakeJulia(root, "s.jl", REMOTE_STUB);
       const r = await new Promise<{ code: number; stdout: string; stderr: string }>((resolveP) => {
         let stdout = "";
         let stderr = "";
         const child = execFile("node", [BUNDLE, script, "--executor", "remote", "--runs-root", join(root, "runs")], {
-          env: { ...process.env, AMICODE_OPS_DIR: ops, AMICO_CLOUD_URL: fake.base, AMICO_CLOUD_TOKEN: fake.token },
+          env: { ...process.env, AMICODE_OPS_DIR: ops, AMICO_AUTHORING_FILE: noAuthoring(root), AMICO_CLOUD_URL: fake.base, AMICO_CLOUD_TOKEN: fake.token },
         });
         child.stdout!.on("data", (d: string) => {
           stdout += d;
@@ -139,8 +214,8 @@ describe("Piccolissimo + Altissimo never solves locally", () => {
     const root = tmpRoot();
     const ops = opsDirWith(root, JSON.stringify({ mode: "piccolo", status: "ready" }));
     const julia = fakeJulia(root, "j", `console.log('AMICODE_ITER iter=1 f=0.5'); console.log('DONE f=0.99')`);
-    const script = fakeJulia(root, "s.jl", "");
-    const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], { AMICODE_OPS_DIR: ops });
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+    const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], { AMICODE_OPS_DIR: ops, AMICO_AUTHORING_FILE: noAuthoring(root) });
     expect(r.code).toBe(0);
     expect(r.stderr).not.toMatch(/never solves locally/);
   });
@@ -148,10 +223,80 @@ describe("Piccolissimo + Altissimo never solves locally", () => {
   it("no solver-mode.json at all → local runs work (fresh install)", () => {
     const root = tmpRoot();
     const julia = fakeJulia(root, "j", `console.log('DONE f=0.99')`);
-    const script = fakeJulia(root, "s.jl", "");
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
     const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], {
       AMICODE_OPS_DIR: join(root, "absent-ops"),
+      AMICO_AUTHORING_FILE: noAuthoring(root),
+    });
+    expect(r.code).toBe(0);
+  });
+});
+
+// The 2026-08-05 field report: "it ran a solve but it used a vetted template so it
+// ran locally", with Piccolissimo + Altissimo selected. Reproduced from the real
+// machine state — solver-mode.json read `piccolo` and was dated a week earlier,
+// while the issimo entitlement WAS granted, cloud.json was live, and Harmoniqs
+// Cloud showed connected. Routing keyed off that one stale file, so the paid tier
+// silently reverted to a local IPOPT solve and no surface said so.
+describe("a stale solver-mode.json cannot silently downgrade the paid tier", () => {
+  it("promotes to the cloud on the ENTITLEMENT alone when the mode file is stale", async () => {
+    const fake = new FakeCloud();
+    await fake.start();
+    fake.state = { task_status: "Running", liveness: "alive", iters: [], finished: { status: "completed" } };
+    try {
+      const root = tmpRoot();
+      // exactly the observed state: the file says piccolo, the entitlement says HP
+      const ops = opsDirWith(root, JSON.stringify({ mode: "piccolo", status: "ready", switched_at: "2026-07-28T22:15:00.000Z" }));
+      const julia = fakeJulia(root, "j", `require('fs').writeFileSync(${JSON.stringify(join(tmpRoot(), "should-not-exist"))}, 'x')`);
+      const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+      const r = await new Promise<{ code: number; stderr: string; stdout: string }>((resolveP) => {
+        let stdout = "";
+        let stderr = "";
+        const child = execFile("node", [BUNDLE, script, "--runs-root", join(root, "runs"), "--julia", julia], {
+          env: {
+            ...process.env,
+            AMICODE_OPS_DIR: ops,
+            AMICO_AUTHORING_FILE: authoringGrantingIssimo(root), // the second signal
+            AMICO_CLOUD_URL: fake.base,
+            AMICO_CLOUD_TOKEN: fake.token,
+          },
+        });
+        child.stdout!.on("data", (d: string) => { stdout += d; });
+        child.stderr!.on("data", (d: string) => { stderr += d; });
+        child.on("exit", (c) => resolveP({ code: c ?? -1, stdout, stderr }));
+      });
+      expect(r.code).toBe(0);
+      expect(r.stderr).toMatch(/running in Harmoniqs Cloud/);
+      expect(r.stdout).toMatch(/AMICODE_FINISHED status=completed exitCode=0/);
+    } finally {
+      await fake.stop();
+    }
+  }, 15000);
+
+  it("an explicit --executor local is refused on the entitlement alone too", () => {
+    const root = tmpRoot();
+    const ops = opsDirWith(root, JSON.stringify({ mode: "piccolo", status: "ready" }));
+    const julia = fakeJulia(root, "j", `console.log('DONE f=0.99')`);
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+    const r = run([script, "--executor", "local", "--runs-root", join(root, "runs"), "--julia", julia], {
+      AMICODE_OPS_DIR: ops,
+      AMICO_AUTHORING_FILE: authoringGrantingIssimo(root),
+    });
+    expect(r.code).toBe(64);
+    expect(r.stderr).toMatch(/never solves locally/);
+  });
+
+  it("NEITHER signal → local, so the free tier is untouched", () => {
+    // The fail-safe direction. This is the common case and must not regress.
+    const root = tmpRoot();
+    const ops = opsDirWith(root, JSON.stringify({ mode: "piccolo", status: "ready" }));
+    const julia = fakeJulia(root, "j", `console.log('DONE f=0.99')`);
+    const script = fakeJulia(root, "s.jl", REMOTE_STUB);
+    const r = run([script, "--runs-root", join(root, "runs"), "--julia", julia], {
+      AMICODE_OPS_DIR: ops,
+      AMICO_AUTHORING_FILE: noAuthoring(root),
     });
     expect(r.code).toBe(0);
+    expect(r.stderr).not.toMatch(/Harmoniqs Cloud/);
   });
 });
diff --git a/packages/amico-run/test/subcommands.test.ts b/packages/amico-run/test/subcommands.test.ts
index 6f374fae..2fb88dc2 100644
--- a/packages/amico-run/test/subcommands.test.ts
+++ b/packages/amico-run/test/subcommands.test.ts
@@ -3,7 +3,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { readToml } from "./helpers.js";
+import { readToml, hermeticOpsEnv } from "./helpers.js";
 
 const BUNDLE = join(__dirname, "..", "dist", "amico-run.js");
 beforeAll(() => {
@@ -160,3 +160,62 @@ describe("sandbox — bundled-asset production path", () => {
     rmSync(target, { recursive: true, force: true });
   });
 });
+
+// "if I say run a piccolissimo altissimo solve it might use piccolo because the
+// vetted template uses piccolo" (2026-08-06). AGENTS.md documents the vetted
+// workflow as "copy template_path", and template_path was always the BUNDLED
+// registry file — whose {{SOLVER}} placeholder is unsubstituted and degrades to
+// ipopt. So an agent following the workflow got Piccolo/IPOPT no matter what the
+// solver toggle said, while the AGENTS.md preamble pointed at a different file
+// (the staged copy). Two instructions, two files, one of them wrong.
+describe("resolve returns the session's STAGED template, not the bundled one", () => {
+  function authoringWith(extra: Record<string, unknown>): string {
+    const dir = mkdtempSync(join(tmpdir(), "auth-"));
+    // REGISTRY is the registry.toml BODY; materialize it so `resolve` can read it
+    // and so template_path resolves relative to a real directory.
+    const registry = join(dir, "registry.toml");
+    writeFileSync(registry, REGISTRY);
+    const p = join(dir, "authoring.json");
+    writeFileSync(
+      p,
+      JSON.stringify({
+        allowlist: ["Piccolo", "Piccolissimo"],
+        support_set: ["JLD2", "TOML", "Printf", "CairoMakie"],
+        registry,
+        verify_tolerance: 0.001,
+        ...extra,
+      }),
+    );
+    return p;
+  }
+
+  function resolveWith(authoring: string): Record<string, unknown> {
+    const out = execFileSync(
+      "node",
+      [BUNDLE, "resolve", "--platform", "transmon", "--kind", "gate_synthesis", "--size", "1"],
+      { encoding: "utf8", env: { ...process.env, ...hermeticOpsEnv(), AMICO_AUTHORING_FILE: authoring } },
+    );
+    return JSON.parse(out) as Record<string, unknown>;
+  }
+
+  it("prefers staged_template when the session staged one", () => {
+    const staged = join(mkdtempSync(join(tmpdir(), "proj-")), "solve.jl");
+    writeFileSync(staged, 'SOLVER = let s = "altissimo"\n    Symbol(s)\nend\n');
+    const out = resolveWith(authoringWith({ staged_template: staged }));
+    expect(out.tier).toBe("vetted");
+    expect(out.template_path).toBe(staged);
+  });
+
+  it("falls back to the registry path when nothing was staged (bare dev invocation)", () => {
+    const out = resolveWith(authoringWith({}));
+    expect(out.tier).toBe("vetted");
+    expect(String(out.template_path)).toMatch(/solve_template\.jl$/);
+  });
+
+  it("falls back when staged_template points at a file that is gone", () => {
+    // A stale authoring.json from a previous session must not send the agent to a
+    // path that no longer exists — that would be a worse failure than the old one.
+    const out = resolveWith(authoringWith({ staged_template: "/nonexistent/staged/solve.jl" }));
+    expect(String(out.template_path)).toMatch(/solve_template\.jl$/);
+  });
+});
diff --git a/packages/extension/media/ui/atoms/pill.ts b/packages/extension/media/ui/atoms/pill.ts
index d76c6066..742b3b90 100644
--- a/packages/extension/media/ui/atoms/pill.ts
+++ b/packages/extension/media/ui/atoms/pill.ts
@@ -24,11 +24,26 @@ defineStyle(
   }
   .pill.done    { color: var(--color-ok); }
   .pill.failed  { color: var(--color-fail); }
+  /* cloud — WHERE the run executes, not how it is going. The one badge here that
+   * is a filled brand swatch: "this is the paid tier, running in Harmoniqs
+   * Cloud" is the strongest claim the topbar makes, and the lemon fill is how
+   * this product says "special". Obeys the brand rule in brand.css — yellow is a
+   * FILL, never an ink — so the label is --color-on-accent (black, 18.7:1) and
+   * the edge is the theme-solved hairline rather than the lemon trying to bound
+   * itself against a light background. */
+  .pill.cloud { color: var(--color-on-accent); background: var(--color-accent-fill);
+                border-color: var(--color-accent-edge); }
+  /* The status dot becomes a cloud glyph. Declared AFTER .no-dot so a caller
+   * passing dot:false cannot silently erase it (equal specificity, later wins). */
+  .pill.cloud::before { content: "☁"; width: auto; height: auto; background: none;
+                        border-radius: 0; font-size: 1.15em; line-height: 1; }
   @keyframes pill-pulse { 0%,100% { opacity: 1; transform: scale(1); } 50% { opacity: 0.35; transform: scale(0.7); } }
 `,
 );
 
-export type PillState = "idle" | "running" | "done" | "failed";
+/** Process states, plus `cloud` — a BADGE state describing a property of the run
+ *  (where it executes) rather than how it is progressing. */
+export type PillState = "idle" | "running" | "done" | "failed" | "cloud";
 
 export interface PillOptions {
   /** Status dot before the label (default true). Badges pass false. */
diff --git a/packages/extension/media/ui/views/inspector.ts b/packages/extension/media/ui/views/inspector.ts
index 8f831a1f..0e86ad94 100644
--- a/packages/extension/media/ui/views/inspector.ts
+++ b/packages/extension/media/ui/views/inspector.ts
@@ -105,10 +105,18 @@ function createPanel(post: (msg: unknown) => void, runId?: string): Panel {
   brand.className = "row gap-sm brand";
   brand.append(logo({ variant: "reduced" }), text("", "Run Inspector").el);
 
+  // WHERE this run executes. Hidden by default and revealed only for a cloud
+  // run, so the badge carries information when it appears — a local run gets no
+  // "LOCAL" chrome for users to learn to ignore. It sits beside the run id (the
+  // answer to "what am I looking at") rather than out by the status pill, which
+  // is about how the solve is going.
+  const location = pill("cloud", "Harmoniqs Cloud");
+  location.el.hidden = true;
+
   const topbar = document.createElement("div");
   topbar.className = "row wrap";
   status.el.classList.add("push-end");
-  topbar.append(brand, runLabel.el, status.el);
+  topbar.append(brand, runLabel.el, location.el, status.el);
 
   const grid = document.createElement("div");
   grid.className = "insp-metrics";
@@ -196,6 +204,10 @@ function createPanel(post: (msg: unknown) => void, runId?: string): Panel {
         case "runlabel":
           runLabel.set(String(msg.text ?? ""));
           break;
+        case "location":
+          // Cloud runs announce themselves; anything else leaves the topbar bare.
+          location.el.hidden = msg.cloud !== true;
+          break;
         case "timing": {
           if (msg.terminal) {
             clearTick();
diff --git a/packages/extension/scores/pulse-designer/templates/solve.jl b/packages/extension/scores/pulse-designer/templates/solve.jl
index f0dee59a..bff3c1de 100644
--- a/packages/extension/scores/pulse-designer/templates/solve.jl
+++ b/packages/extension/scores/pulse-designer/templates/solve.jl
@@ -18,12 +18,59 @@ T          = 10.0       # gate time (ns)
 N          = 50         # timesteps
 drive_max  = 0.2        # per-quadrature drive bound (GHz)
 max_iter   = 60
-SOLVER     = :ipopt     # :ipopt (default) or :altissimo (High-Performance + Cloud)
 # ─────────────────────────────────────────────────────────────────────────
 
+# The solver follows the SELECTED SOLVER MODE, substituted at session prep — it is
+# NOT an authoring decision. Piccolo mode → :ipopt; Piccolissimo + Altissimo (the
+# paid cloud tier) → :altissimo, every run, automatically. Do not hand-edit this:
+# the two backends need different callback wiring (below), and a mismatch between
+# the selected tier and the solver is how a "High-Performance" run quietly ends up
+# on IPOPT.
+#
+# Written as a substituted STRING rather than a bare `{{SOLVER}}` symbol so that an
+# unsubstituted template is still valid Julia: if session prep could not stage a
+# copy, this reads as :ipopt (a working local solve) instead of raising a syntax
+# error on the placeholder itself.
+SOLVER = let s = "{{SOLVER}}"
+    Symbol(startswith(s, "{{") ? "ipopt" : s)
+end
+
 SOLVER in (:ipopt, :altissimo) || error("SOLVER must be :ipopt or :altissimo, got $SOLVER")
 if SOLVER === :altissimo
     @eval using Piccolissimo   # AltissimoOptions lives here, not in Piccolo
+    @eval using DirectTrajOpt
+
+    # ── dispatch bridge: DirectTrajOpt 0.9.7 moved the backend extension point ──
+    # DTO 0.9.7 renamed it from `Solvers.solve!` to `_solve`, and its fallback only
+    # @error-LOGS and returns nothing. Piccolissimo (through 0.2.0) still defines
+    # the OLD name, so under 0.9.7 nothing matches and every Altissimo solve is a
+    # silent NO-OP that still reports success: `iterations = 0`, fidelity left at
+    # the random initial guess, FINISHED completed/exit 0. Verified on this machine
+    # (run r20260729-103718Z-12e3: 0 iters, fidelity 0.048, reported "converged").
+    #
+    # Altissimo is not the bug — its host interface moved out from under it. Until
+    # Piccolissimo migrates upstream, bridge it here: the solve script ships per
+    # submission, so this reaches the cloud runner with no image rebake.
+    #
+    # Guard on WHICH method would be called, not on `methods(...)` being empty:
+    # DTO has two fallbacks (one typed `Any`, one `AbstractSolverOptions`) and
+    # AltissimoOptions matches both, so an emptiness test never installs the bridge.
+    _alt_dispatch = try
+        m = which(DirectTrajOpt._solve, (DirectTrajOpt.DirectTrajOptProblem, Piccolissimo.AltissimoOptions))
+        string(m.sig.parameters[3])
+    catch
+        "none"
+    end
+    if _alt_dispatch in ("Any", "AbstractSolverOptions", "DirectTrajOpt.AbstractSolverOptions", "none")
+        @eval DirectTrajOpt._solve(
+            prob::DirectTrajOpt.DirectTrajOptProblem,
+            options::Piccolissimo.AltissimoOptions;
+            kwargs...,
+        ) = DirectTrajOpt.Solvers.solve!(prob, options; kwargs...)
+        println("AMICODE_NOTE bridged AltissimoOptions onto DirectTrajOpt._solve " *
+                "(DTO $(pkgversion(DirectTrajOpt)) moved the extension point; was resolving to $_alt_dispatch)")
+        flush(stdout)
+    end
 end
 
 # ── telemetry sink ───────────────────────────────────────────────────────────
@@ -158,6 +205,7 @@ end
 # derive from those rather than emitting NaN — a real number the client can plot
 # beats a placeholder it has to special-case.
 function alt_cb(x, info)
+    alt_cb_fired[] = true   # tells the stdout bridge below to stand down (one numbering scheme per run)
     k = Int(info.outer_iter); iters[] = k
     ok = pulse_emit(x, k)   # frames + AMICODE_PULSE + cooperative STOP
     inf_pr = haskey(info, :inf_pr) ? info.inf_pr : max(info.eq_viol, info.ineq_viol)
@@ -166,18 +214,188 @@ function alt_cb(x, info)
     return ok
 end
 
+# Altissimo telemetry needs TWO independent sources, because neither one is
+# reliable across the Piccolissimo versions in the wild:
+#   1. alt_cb above — the good path: it carries frames as well as numbers. But it
+#      only fires where Piccolissimo forwards a caller `callback` into
+#      Altissimo.optimize!. Piccolissimo 0.2.0 declares
+#      `solve!(prob, ::AltissimoOptions; kwargs...)` and forwards a HARDCODED
+#      whitelist (tol, polish*, …) — `callback` is not on it, so on 0.2.0 and the
+#      current cloud image alt_cb never runs at all.
+#   2. the stdout bridge below — the floor: Altissimo's own iteration table always
+#      prints under `verbose`, on old builds too, so translating those rows into
+#      AMICODE_ITER gives the Run Inspector a live curve no matter what the
+#      installed Piccolissimo forwards.
+# Belt and braces on purpose. With only (1), an Altissimo run on the shipped image
+# reports `iterations = 0` and the Inspector stays dark — that is exactly the
+# 2026-07-29 failure (fidelity 0.048 reported as a converged result).
+#
+# Row shapes, both from Altissimo/src/Optimizer.jl:
+#   inner step   " %5s  %13.6e  %10.3e  %10.3e  …"   iter column is "·"
+#   final outer  " %5d  %13.6e  %10.3e  %10.3e  …"   iter column is the outer index
+# Columns 2-4 are objective, inf_pr, and the dual measure (‖∇L‖ inner /
+# stationarity outer) — the same three the IPOPT path plots.
+#
+# Numbering is SEQUENTIAL over rows, not read out of the iter column: that column
+# is "·" for every inner step and only becomes an integer on the last outer
+# iteration, so trusting it yields a single point at the end (verified: a 5-outer
+# run printed 1 integer row and ~200 "·" rows). Each inner row is one optimizer
+# step, so counting rows gives the dense curve IPOPT streams locally.
+const ALT_ROW = r"^\s*(?:·|\d+)\s+([-+0-9.eE]+)\s+([-+0-9.eE]+)\s+([-+0-9.eE]+)\s"
+alt_cb_fired = Ref(false)
+
+# WHICH channel carries this run, decided BEFORE the solve starts.
+#
+# Deciding reactively — stand the bridge down once alt_cb first fires — is a race,
+# and it loses. alt_cb fires at the END of an outer iteration, so by then the
+# bridge has already translated every inner row of outer #1 under its own
+# numbering. Observed on Piccolissimo 0.3.1: the curve climbed to 51 (bridge,
+# counting inner rows) then reset to 1 (callback, counting outer iterations) —
+# 51 → 1 → 1 → 2 → 2 …, which the Inspector plots as a sawtooth and which reads
+# as a diverging solve.
+#
+# The two scales are irreconcilable (dense inner steps vs sparse outer
+# iterations), so exactly ONE channel may emit. Prefer the callback wherever it is
+# forwarded: it carries pulse frames as well as numbers, which the table cannot.
+#
+# A version gate, because forwarding is not introspectable: Piccolissimo 0.3.x
+# passes `callback` into Altissimo.optimize!; 0.2.x drops it via a hardcoded kwarg
+# whitelist. alt_cb_fired stays as a belt — if a backport forwards it on an older
+# version, the bridge still stands down once the callback proves itself.
+const CB_FORWARDED = try
+    pkgversion(Piccolissimo) >= v"0.3.0"
+catch
+    false
+end
+
+"""Run the Altissimo solve, mirroring its verbose table into AMICODE_ITER lines.
+
+Writes through to the ORIGINAL stdout and appends run.log directly instead of
+calling `emit()`: stdout is redirected for the duration of the solve, so emit()
+would feed the very pipe this reader is draining."""
+function solve_altissimo_streaming(qcp, opts, cb)
+    real_out = stdout
+    pipe = Pipe()
+    Base.link_pipe!(pipe; reader_supports_async = true, writer_supports_async = true)
+    seq = Ref(0)
+    reader = @async begin
+        for line in eachline(pipe)
+            println(real_out, line)              # the raw table still reaches the log
+            flush(real_out)
+            # Where the callback IS forwarded it supersedes this bridge: it numbers
+            # by outer iteration and carries frames, and two numbering schemes
+            # interleaved in one run.log would plot as a sawtooth.
+            (CB_FORWARDED || alt_cb_fired[]) && continue
+            m = match(ALT_ROW, line)
+            m === nothing && continue
+            # The captures must be REAL numbers. `[-+0-9.eE]+` also matches the
+            # bare "-" Altissimo prints as a placeholder in columns that do not
+            # apply to a row, which shipped as `AMICODE_ITER iter=1 f=-` on a live
+            # cloud run (task c584) — the Inspector then plots a non-numeric
+            # objective for the first points of the curve.
+            vals = map(c -> tryparse(Float64, c), (m.captures[1], m.captures[2], m.captures[3]))
+            any(isnothing, vals) && continue
+            seq[] += 1
+            iters[] = seq[]
+            out = @sprintf("AMICODE_ITER iter=%d f=%s inf_pr=%s inf_du=%s",
+                           seq[], m.captures[1], m.captures[2], m.captures[3])
+            println(real_out, out)
+            flush(real_out)
+            if CLOUD_RUN
+                try
+                    open("run.log", "a") do io
+                        println(io, out)
+                    end
+                catch   # telemetry must never take down a solve
+                end
+            end
+        end
+    end
+    try
+        redirect_stdout(pipe) do
+            solve!(qcp; options = opts, callback = cb)
+        end
+    finally
+        close(pipe.in)
+        try
+            wait(reader)
+        catch
+        end
+        close(pipe)
+    end
+    # Say which channel carried the run — the two produce different iteration
+    # SCALES (outer iterations vs inner steps), so a reader comparing two runs
+    # needs to know which they are looking at.
+    if alt_cb_fired[]
+        emit("AMICODE_NOTE Altissimo telemetry came from the solver callback " *
+             "(Piccolissimo $(pkgversion(Piccolissimo)) forwards it): iterations count OUTER " *
+             "iterations, and per-iteration pulse frames are available")
+    else
+        emit("AMICODE_NOTE Piccolissimo $(pkgversion(Piccolissimo)) does not forward `callback` to " *
+             "Altissimo, so iterations were read from the solver's own table ($(seq[]) rows, one per " *
+             "INNER step) and per-iteration pulse frames are unavailable; the final pulse is still written")
+    end
+end
+
+# Fingerprint the stack this run actually used. A cloud run executes against the
+# runner's BAKED bundle, not the caller's environment, so "which Piccolissimo was
+# that?" is otherwise unanswerable after the fact — and it is the first question
+# every cloud failure raises. Emitted before the solve so it survives a solve that
+# dies. Also records whether the callback channel is live, since the two channels
+# count different things (outer iterations vs inner steps).
+emit("AMICODE_ENV piccolo=$(pkgversion(Piccolo)) " *
+     (SOLVER === :altissimo ?
+        "piccolissimo=$(pkgversion(Piccolissimo)) dto=$(pkgversion(DirectTrajOpt)) " *
+        "callback_forwarded=$(CB_FORWARDED) " : "") *
+     "julia=$(VERSION) solver=$(SOLVER)")
+
+# Any exception from here on is reported INTO run.log before it propagates.
+#
+# On a cloud run the exception is otherwise invisible: julia's stderr goes to the
+# SSM command stream, which no API exposes, so the user gets `failed, exit 1` and
+# nothing else — that is exactly what happened to task 582a, which reached
+# AMICODE_PULSE_META and then died with no recoverable reason. emit() writes
+# run.log, which the sidecar syncs and the poller greps, so this makes the next
+# failure self-diagnosing without waiting on an infra change.
+#
+# Rethrown, not swallowed: the run must still FAIL. A solve that reports success
+# after an exception is the silent-no-op class of bug this template already guards
+# against elsewhere.
+function report_and_rethrow(e, bt)
+    try
+        emit("AMICODE_ERROR $(sprint(showerror, e))")
+        for frame in first(stacktrace(bt), 12)
+            emit("AMICODE_ERROR   at $(frame)")
+        end
+    catch
+        # never let the reporter mask the original failure
+    end
+    rethrow(e)
+end
+
 t0 = time()
-if SOLVER === :altissimo
+try
+    if SOLVER === :altissimo
     # The budget goes on the OPTIONS, not as a solve! kwarg. solve!(::AltissimoOptions)
     # forwards a hardcoded list to Altissimo.optimize! and swallows the rest, so a
     # `max_iter =` here is silently dropped and the solve quietly runs Altissimo's
     # default 20 outer iterations instead of the FILL-IN value.
-    solve!(qcp; options = Piccolissimo.AltissimoOptions(max_outer_iter = max_iter), callback = alt_cb)
+    #
+    # verbose = true is load-bearing, not chatter: it is what makes the iteration
+    # table — and therefore the stdout telemetry bridge above — exist at all.
+    solve_altissimo_streaming(
+        qcp,
+        Piccolissimo.AltissimoOptions(max_outer_iter = max_iter, verbose = true),
+        alt_cb,
+    )
 else
     solve!(qcp; max_iter = max_iter, print_level = 1,
            options = IpoptOptions(intermediate_callback = pulse_emit),
            callback = CB.callback_factory(cb_log))
 end
+catch e
+    report_and_rethrow(e, catch_backtrace())
+end
 wall = time() - t0
 
 # Fidelity over the COMPUTATIONAL subspace, from a fresh high-tolerance rollout.
@@ -215,4 +433,16 @@ open("result.toml.tmp", "w") do io
     ))
 end
 mv("result.toml.tmp", "result.toml"; force = true)
+
+# A solve that recorded ZERO iterations did not optimize anything — the fidelity
+# above is the random initial guess. Say so instead of letting FINISHED's
+# completed/exit-0 read as a converged result downstream. This is the failure that
+# hid a silently no-op'd Altissimo backend behind a "converged" badge
+# (iterations = 0, fidelity = 0.048, 2026-07-29): the run LOOKED successful, so
+# nobody checked. Partial artifacts are still written — the run is recorded, it
+# just stops claiming a result it does not have.
+if iters[] == 0
+    emit("AMICODE_WARN no iterations were recorded — the optimizer never reported progress, so " *
+         "fidelity=$(fid) is the INITIAL guess, NOT a converged result (solver=$(SOLVER))")
+end
 emit("DONE fidelity=$(fid)")
diff --git a/packages/extension/src/extension.ts b/packages/extension/src/extension.ts
index 1af702ad..6fd9082a 100644
--- a/packages/extension/src/extension.ts
+++ b/packages/extension/src/extension.ts
@@ -37,7 +37,7 @@ import { OpencodeEventClient } from "./sse_client";
 import { RunsManager } from "./runs_manager";
 import { stageDemoRun } from "./demo_replay";
 import { writeStopFile, savePulseTo, catalogPulsesDir, stopPlan, forceStop, runLogMtime } from "./run_controls";
-import { watchSolverMode, applyEntitlementForMode, readSolverModeState } from "./solver_mode";
+import { watchSolverMode, applyEntitlementForMode, reconcileSolverMode } from "./solver_mode";
 import { runSetCloudKeyCommand } from "./cloud_key";
 import { amicodeOpsDir } from "./substrate/vault_store";
 import { stagePasqalConnector } from "./pasqal_assets";
@@ -430,11 +430,7 @@ export async function activate(ctx: vscode.ExtensionContext): Promise<void> {
     // MODE-SELECTED vetted template: HP sessions get the Piccolissimo variant
     // (same run-dir contract, spline solver layer). An AGENTS.md instruction
     // can't beat the procedural template path — the file itself must swap.
-    templateSrc: path.resolve(
-      ctx.extensionPath,
-      "templates",
-      readSolverModeState().mode === "hp" ? "solve_template_hp.jl" : "solve_template.jl",
-    ),
+    templateSrc: path.resolve(ctx.extensionPath, "scores", "pulse-designer", "templates", "solve.jl"),
     juliaProject: resolveJuliaProject(vscode.workspace.getConfiguration("amicode").get<string>("juliaProject", "")),
     skillRoots: cfgArr("skillRoots"),
     skillLibraryRoots: cfgLibraryRoots(),
@@ -565,6 +561,21 @@ export async function activate(ctx: vscode.ExtensionContext): Promise<void> {
     });
     ctx.subscriptions.push({ dispose: () => void serverManager?.stop() });
 
+    // Before watching for NEW switches, repair a half-landed old one. The mode
+    // file only changes on a `status:"switching"` request, so a dropped write
+    // leaves it stale while the issimo entitlement says otherwise — and every
+    // cloud decision (routing, template SOLVER, the app's own toggle) reads the
+    // file. Observed 2026-08-05: file said piccolo (Jul 28) with issimo granted
+    // and Harmoniqs Cloud connected, so a paid-tier solve ran locally on IPOPT
+    // and nothing anywhere said so.
+    {
+      const { healed, mode } = reconcileSolverMode();
+      if (healed)
+        opencodeChannel.appendLine(
+          `[solver] solver-mode.json disagreed with the issimo entitlement — healed to ${mode}. ` +
+            `A switch request lost its write; the tier is ${mode}.`,
+        );
+    }
     // Solver-mode switcher (rchari/solver-wire): the app's toggle POSTs
     // {status:"switching"}; we do the REAL switch — grant/revoke the issimo
     // entitlement, re-prep the session project (skills/scores/allowlist follow
@@ -578,11 +589,7 @@ export async function activate(ctx: vscode.ExtensionContext): Promise<void> {
           agentsSrc: path.resolve(ctx.extensionPath, "AGENTS.md"),
           // Same mode-selection as boot; `mode` is the requested target of THIS
           // switch (the state file still reads status:"switching" here).
-          templateSrc: path.resolve(
-            ctx.extensionPath,
-            "templates",
-            mode === "hp" ? "solve_template_hp.jl" : "solve_template.jl",
-          ),
+          templateSrc: path.resolve(ctx.extensionPath, "scores", "pulse-designer", "templates", "solve.jl"),
           juliaProject: resolveJuliaProject(
             vscode.workspace.getConfiguration("amicode").get<string>("juliaProject", ""),
           ),
@@ -710,11 +717,7 @@ export async function activate(ctx: vscode.ExtensionContext): Promise<void> {
     const port = vscode.workspace.getConfiguration("amicode").get<number>("opencodePort", 0);
     const project2 = prepareOpencodeProject({
       agentsSrc: path.resolve(ctx.extensionPath, "AGENTS.md"),
-      templateSrc: path.resolve(
-        ctx.extensionPath,
-        "templates",
-        readSolverModeState().mode === "hp" ? "solve_template_hp.jl" : "solve_template.jl",
-      ),
+      templateSrc: path.resolve(ctx.extensionPath, "scores", "pulse-designer", "templates", "solve.jl"),
       juliaProject: resolveJuliaProject(vscode.workspace.getConfiguration("amicode").get<string>("juliaProject", "")),
       skillRoots: cfgArr("skillRoots"),
       skillLibraryRoots: cfgLibraryRoots(),
diff --git a/packages/extension/src/opencode_config.ts b/packages/extension/src/opencode_config.ts
index 5eace34c..4ccdacc8 100644
--- a/packages/extension/src/opencode_config.ts
+++ b/packages/extension/src/opencode_config.ts
@@ -15,7 +15,7 @@ import {
   type LibraryRoot,
   type LibraryRootSpec,
 } from "./scores/package_skills";
-import { readSolverModeState } from "./solver_mode";
+import { effectiveSolverMode } from "./solver_mode";
 import { buildRoutingSection, readRoutingContext } from "./routing";
 import {
   readProfileMd,
@@ -232,6 +232,13 @@ export function writeAuthoringConfig(
   entitlementsDir: string,
   scoresRoot: string = DEFAULT_SCORES_ROOT,
   skills: SkillIndexEntry[] = [],
+  /** The session's STAGED solve template — the copy with SOLVER already
+   *  substituted from the selected tier. amico-run's `resolve` returns this as
+   *  template_path so the documented vetted workflow ("copy template_path") lands
+   *  on the same file AGENTS.md points at. Without it, resolve hands back the
+   *  BUNDLED registry path, whose {{SOLVER}} is unsubstituted and degrades to
+   *  ipopt — so an HP user following the workflow silently got IPOPT. */
+  stagedTemplate?: string,
 ): void {
   try {
     const ents = readLocalEntitlements(entitlementsDir);
@@ -272,6 +279,7 @@ export function writeAuthoringConfig(
           exemplars: AUTHORING_ASSETS.exemplars,
           verify_harness: AUTHORING_ASSETS.verifyHarness,
           verify_tolerance: tolerance,
+          ...(stagedTemplate ? { staged_template: stagedTemplate } : {}),
           // Additive session record (spec §3): the dual-source skill index the
           // agent was given. amico-run ignores unknown fields; schema_version stays 1.
           skills,
@@ -294,7 +302,7 @@ export function writeAuthoringConfig(
  *  connection, else exit 64); this section makes the agent do the right thing
  *  and, crucially, BLOCK-WITH-PROMPT when no cloud key is connected. */
 export function solverModeSection(): string {
-  if (readSolverModeState().mode !== "hp") return "";
+  if (effectiveSolverMode() !== "hp") return "";
   const cloudConnected =
     !!process.env.AMICO_CLOUD_URL || fs.existsSync(path.join(os.homedir(), ".amico", "cloud.json"));
   const routing = cloudConnected
@@ -302,15 +310,18 @@ export function solverModeSection(): string {
       "mode, so never ask the user where a solve should run. Author it as: " +
       '`tier="hpc"`, `executor="remote"`, `env.kind="provisioned"` (via `amico-run --spec <spec> ' +
       "<script.jl> --executor remote`). The runner image has Piccolissimo/Altissimo pre-baked, so there " +
-      "is NO local precompile and NO sandbox — never author a sandbox env for HP. A local launch is " +
-      "REFUSED by amico-run while this solver is selected (exit 64), so attempting one only wastes a turn. " +
-      "Live iteration frames stream to the Inspector; note that per-iteration AMICODE_ITER stats + the " +
-      "cooperative Stop are not yet available on the cloud bundle, and re-rollout verification is skipped " +
-      "for cloud runs (say so). Only claim cloud execution when the launch actually used `--executor remote`."
+      "is NO local precompile and NO sandbox — never author a sandbox env for HP. amico-run routes this " +
+      "tier to the cloud on its own (a launch with no `--executor` is promoted to remote) and REFUSES an " +
+      "explicit `--executor local` (exit 64), so attempting a local run only wastes a turn. " +
+      "Per-iteration `AMICODE_ITER` stats and live frames both stream to the Inspector. Two real limits to " +
+      "state plainly if they come up: the cooperative Stop needs the solver callback, which the cloud " +
+      "bundle's Piccolissimo does not forward to Altissimo (so Stop may not interrupt a cloud solve), and " +
+      "re-rollout verification is skipped for cloud runs. " +
+      "Only claim cloud execution when the launch actually ran remotely."
     : "Harmoniqs Cloud is NOT connected (no API key). Piccolissimo + Altissimo is a PAID cloud tier and " +
       "CANNOT run locally — do NOT attempt a local Piccolissimo solve (it will fail three ways: amico-run " +
-      "refuses a local launch in this mode, the private package can't be instantiated in a sandbox, and " +
-      "the gate rejects a local hpc run). Instead, STOP and tell the user: " +
+      "refuses the launch in this mode and tells the user to connect, the private package can't be " +
+      "instantiated in a sandbox, and the gate rejects a local hpc run). Instead, STOP and tell the user: " +
       '"Piccolissimo + Altissimo needs a Harmoniqs Cloud connection — click **Piccolissimo + Altissimo** ' +
       "in the model · solver control on the dashboard and connect your API key there (or run **Amico: " +
       'Connect Cloud**, which opens the same flow)." Offer to switch back to the free local Piccolo solver ' +
@@ -326,23 +337,30 @@ export function solverModeSection(): string {
     "`EmbeddedOperator`, `UnitaryTrajectory` — every problem-setup name comes from Piccolo. The failure is " +
     "an UndefVarError at load time, before any solve starts, and on a cloud run you pay the full queue and " +
     "instance-boot wait before seeing it. " +
-    "**Solver backend:** the default remains IPOPT (`IpoptOptions`), which is what streams per-iteration " +
-    "telemetry — its `intermediate_callback` produces the Inspector's frames and the `AMICODE_ITER` lines. " +
-    "If the researcher asks for the **Altissimo** backend (the augmented-Lagrangian GPU solver, " +
-    "`AltissimoOptions`), switch it by setting **`SOLVER = :altissimo`** in the template's FILL-IN block — that " +
-    "one line is the whole change. Do NOT hand-roll the solve call: the template already re-hangs BOTH telemetry " +
-    "channels onto Altissimo's `(x, info)` hook (the frames come off `IpoptOptions.intermediate_callback`, which " +
-    "`AltissimoOptions` does not have, so a hand-written call loses the Inspector's frames as well as its " +
-    "numbers), passes the budget as `AltissimoOptions(max_outer_iter = max_iter)` (a `max_iter` given to " +
-    "`solve!` is silently DROPPED on that path — the solve would quietly run 20 outer iterations), and derives " +
-    "`inf_pr`/`inf_du` on older Altissimo builds. " +
-    "Also TELL THEM that live iterations depend on the INSTALLED version. " +
-    "Current Piccolissimo main accepts a `callback` on `solve!(::AltissimoOptions)` and forwards it to " +
-    "`Altissimo.optimize!`, which fires it every outer iteration; older builds swallow `kwargs...` and forward " +
-    "nothing, so an Altissimo run there emits NO AMICODE_ITER lines and the Run Inspector stays dark until the " +
-    "solve finishes. Do not promise live iterations you have not seen: run it, and if no AMICODE_ITER line " +
-    "appears in the first iterations, say so plainly rather than implying the solve is stuck. Never switch to " +
-    "Altissimo silently. " +
+    "**COPY THE TEMPLATE. Do not write a solve script from memory.** Read the template file and edit its " +
+    "FILL-IN parameters — that is the whole authoring step. Every cloud solve that has failed so far failed " +
+    "this way: the script was authored from scratch and invented API that does not exist. Real examples, all " +
+    "from ONE script (2026-08-05, task 975a7c07): " +
+    "`CubicSplinePulse(; T=…, n_knots=…, n_drives=…, bounds=…)` — every real method takes POSITIONAL " +
+    "arguments, so an all-keyword call matches nothing; `CallbackLogger(qcp)` — not defined in Piccolo or " +
+    "Piccolissimo; `get_fidelity(qcp)` — not defined either. That script died with a MethodError at LOAD " +
+    "time, before any optimization, after the user had already paid the full queue and instance-boot wait. " +
+    "If you need a name the template does not already use, verify it against the package instead of " +
+    "guessing: a plausible-looking name you have not checked is the most expensive mistake available on " +
+    "this tier. " +
+    "**Solver backend — already decided, do not touch it.** The template you copy arrives with its " +
+    "`SOLVER` line ALREADY SET to Altissimo, because Piccolissimo + Altissimo is the selected solver. " +
+    "Do NOT edit that line, and do NOT hand-write the `solve!` call. The template wires Altissimo's " +
+    "`(x, info)` callback for both telemetry channels (frames AND `AMICODE_ITER` — the frames come off " +
+    "`IpoptOptions.intermediate_callback`, which `AltissimoOptions` has no equivalent of, so a hand-rolled " +
+    "call loses the Inspector's plots as well as its numbers), passes the budget as " +
+    "`AltissimoOptions(max_outer_iter = max_iter)` (a `max_iter` given to `solve!` is silently DROPPED on " +
+    "that path and the solve quietly runs 20 outer iterations), and bridges the DirectTrajOpt 0.9.7 " +
+    "extension-point rename so the backend actually dispatches. " +
+    "**Report what the artifacts say, never what the exit code says.** A `completed` / exit-0 run can still " +
+    "have optimized NOTHING: read `result.toml` and if `iterations` is 0 — or the template emitted " +
+    "`AMICODE_WARN` — the fidelity is the random initial guess, so say the run did not converge. Do not call " +
+    "a 0-iteration run successful. " +
     routing +
     "\n"
   );
@@ -356,7 +374,7 @@ export function solverModeSection(): string {
  *  before. The estimate SUGGESTS the confirm's default; the researcher always
  *  confirms, per-solve, never auto-routed. */
 export function routingSection(): string {
-  return buildRoutingSection(readRoutingContext(readSolverModeState().mode));
+  return buildRoutingSection(readRoutingContext(effectiveSolverMode()));
 }
 
 /** The model pin to inject into the generated config, or undefined.
@@ -523,9 +541,32 @@ export function prepareOpencodeProject(opts: OpencodeConfigOptions): OpencodePro
   const raw = fs.existsSync(opts.agentsSrc)
     ? fs.readFileSync(opts.agentsSrc, "utf8")
     : "# Amicode\nRead the template at {{TEMPLATE_PATH}}, fill params, run `amico-run <script>`.\n";
+  // The solve template is STAGED (substituted into the project dir) rather than
+  // read in place, so `SOLVER` follows the selected solver mode automatically
+  // instead of being an authoring decision the agent could get wrong.
+  // Piccolissimo + Altissimo is a paid cloud tier; a run of it that quietly used
+  // IPOPT is not the product the user selected. Permission grants follow this
+  // path (buildOpencodeConfigContent derives them from templatePath), so pointing
+  // at the staged copy needs no extra rule.
+  const solverSymbol = effectiveSolverMode() === "hp" ? "altissimo" : "ipopt";
+  const stagedTemplate = path.join(projectDir, path.basename(opts.templateSrc));
+  try {
+    fs.writeFileSync(
+      stagedTemplate,
+      fs.readFileSync(opts.templateSrc, "utf8").replaceAll("{{SOLVER}}", solverSymbol),
+      "utf8",
+    );
+  } catch (e) {
+    // Fall back to the bundled original. The template's SOLVER line is written so
+    // that an unsubstituted placeholder still parses and reads as :ipopt, so the
+    // worst case here is a local Piccolo solve, not a syntax error.
+    console.warn(`amicode: could not stage the solve template (${e}); using the bundled path`);
+  }
+  const templateForAgent = fs.existsSync(stagedTemplate) ? stagedTemplate : opts.templateSrc;
+
   const filled = raw
     .replaceAll("{{JULIA_PROJECT}}", opts.juliaProject ?? resolveJuliaProject(""))
-    .replaceAll("{{TEMPLATE_PATH}}", opts.templateSrc);
+    .replaceAll("{{TEMPLATE_PATH}}", templateForAgent);
 
   // Score runtime ("data-defined, prompt-executed", scores spec §6): compile the
   // selected score (v1: boot-time selection of score #0, pulse-designer) over the
@@ -639,6 +680,7 @@ export function prepareOpencodeProject(opts: OpencodeConfigOptions): OpencodePro
     opts.entitlementsDir ?? path.join(os.homedir(), ".amico", "amicode"),
     opts.scoresRoot ?? DEFAULT_SCORES_ROOT,
     skillEntries,
+    templateForAgent,
   );
 
   // Register the resolved skills as opencode-native skills: stage ONLY this set
@@ -693,7 +735,7 @@ export function prepareOpencodeProject(opts: OpencodeConfigOptions): OpencodePro
   return {
     projectDir,
     agentsPath,
-    templatePath: opts.templateSrc,
+    templatePath: templateForAgent,   // the STAGED copy (SOLVER substituted), so grants + agent reads agree
     skillPaths: skillEntries.map((e) => e.path),
     skillsStageDir,
     vaultDir,
diff --git a/packages/extension/src/routing.ts b/packages/extension/src/routing.ts
index 88849480..786912cd 100644
--- a/packages/extension/src/routing.ts
+++ b/packages/extension/src/routing.ts
@@ -124,8 +124,9 @@ export function buildRoutingSection(ctx: RoutingContext): string {
     '`env.kind="provisioned"` on solvespec.json, then launch with `amico-run --spec <spec> ' +
     "<script.jl> --executor remote`.\n" +
     "- **Never dispatch this solver locally.** The runner image has Piccolissimo/Altissimo " +
-    "pre-baked; a laptop would precompile the HP stack from scratch. amico-run REFUSES a local " +
-    "launch while this solver is selected (exit 64), so a local attempt only wastes a turn.\n" +
+    "pre-baked; a laptop would precompile the HP stack from scratch. amico-run routes this tier " +
+    "to the cloud on its own — a launch with no `--executor` is promoted to remote — and it " +
+    "REFUSES an explicit `--executor local` (exit 64), so a local attempt only wastes a turn.\n" +
     "- **`amico-run estimate` is still worth running** to report size and cost to the " +
     "researcher, but it no longer decides anything: an estimate that fits in local RAM does " +
     "not make an HP solve local.\n" +
diff --git a/packages/extension/src/run_inspector.ts b/packages/extension/src/run_inspector.ts
index 84418d1c..39f54747 100644
--- a/packages/extension/src/run_inspector.ts
+++ b/packages/extension/src/run_inspector.ts
@@ -36,6 +36,8 @@ let INSPECTOR: InspectorView | undefined;
 interface PaneBuffer {
   runId: string;
   runLabel?: string;
+  /** True for a Harmoniqs Cloud run — drives the topbar location badge. */
+  cloud?: boolean;
   warming: boolean;
   completion?: { status: string; fidelity?: number };
   pulseMeta?: PulseMeta;
@@ -105,6 +107,7 @@ class InspectorView implements vscode.WebviewViewProvider {
   private replayPane(view: vscode.WebviewView, p: PaneBuffer): void {
     const rid = p.runId;
     if (p.runLabel !== undefined) view.webview.postMessage({ type: "runlabel", runId: rid, text: p.runLabel });
+    if (p.cloud) view.webview.postMessage({ type: "location", runId: rid, cloud: true });
     if (p.timing) view.webview.postMessage({ type: "timing", runId: rid, ...p.timing });
     if (p.warming) view.webview.postMessage({ type: "warming", runId: rid });
     if (p.pulseMeta) view.webview.postMessage({ type: "pulsemeta", runId: rid, ...p.pulseMeta });
@@ -205,6 +208,13 @@ class InspectorView implements vscode.WebviewViewProvider {
     if (this.view) this.view.webview.postMessage({ type: "runlabel", runId, text: label });
   }
 
+  /** Mark a run as executing in Harmoniqs Cloud (topbar badge). Buffered per run
+   *  like every other pane message, so reopening the panel keeps the badge. */
+  setCloudRun(runId: string): void {
+    this.paneFor(runId).cloud = true;
+    if (this.view) this.view.webview.postMessage({ type: "location", runId, cloud: true });
+  }
+
   /** Timing for the elapsed/rate/ETA strip (ported from the single-run host —
    *  now runId-keyed + pane-buffered like every other message). */
   postTiming(runId: string, t: TimingInfo): void {
diff --git a/packages/extension/src/run_location.ts b/packages/extension/src/run_location.ts
new file mode 100644
index 00000000..d061fcf0
--- /dev/null
+++ b/packages/extension/src/run_location.ts
@@ -0,0 +1,15 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+/** Where a run executed, for display. A run dir is the authority: `remote.json`
+ *  (task_id + base_url) is written by RemoteExecutor and by nothing else, so its
+ *  presence IS the cloud signal. Deliberately not a new run.toml field —
+ *  run.schema.json is additionalProperties:false, which is why the remote
+ *  executor put task_id in this sidecar in the first place. */
+export function isCloudRun(runDir: string): boolean {
+  try {
+    return fs.existsSync(path.join(runDir, "remote.json"));
+  } catch {
+    return false;
+  }
+}
diff --git a/packages/extension/src/runs_manager.ts b/packages/extension/src/runs_manager.ts
index fd2fad87..4150dfca 100644
--- a/packages/extension/src/runs_manager.ts
+++ b/packages/extension/src/runs_manager.ts
@@ -5,8 +5,9 @@ import { getInspector } from "./run_inspector";
 import { LogTailer } from "./log_tailer";
 import { parseIndexLine, RunRegistry, type RunRecord } from "./run_registry";
 import { parseMaxIter } from "./run_timing";
+import { isCloudRun } from "./run_location";
 import type { StatusBarManager } from "./status_bar";
-import type { RunStatus } from "./types";
+import type { RunState, RunStatus } from "./types";
 import {
   AMICODE_ITER_RE,
   ingestRunDir,
@@ -185,7 +186,7 @@ export class RunsManager implements vscode.Disposable {
         sel.latestIter !== undefined &&
         this.liveStatus(sel.runDir) === "stalled"
       ) {
-        this.opts.statusBar?.setRun({
+        this.setRunState({
           runId: sel.runId,
           outputDir: sel.runDir,
           startedAt: 0,
@@ -251,6 +252,7 @@ export class RunsManager implements vscode.Disposable {
     const ins = getInspector();
     ins?.reveal();
     ins?.setRunLabel(runId, runId);
+    if (isCloudRun(rec.runDir)) ins?.setCloudRun(runId);
     ins?.activate(runId); // 1.3: switch the visible pane
     const p = this.pipelines.get(runId);
     if (p) {
@@ -260,7 +262,7 @@ export class RunsManager implements vscode.Disposable {
       // Point the single status bar at the selected run from registry state
       // (routeIter/completeRun keep it current from here).
       const r = this.registry.get(runId)!;
-      this.opts.statusBar?.setRun({
+      this.setRunState({
         runId,
         outputDir: r.runDir,
         startedAt: 0,
@@ -396,6 +398,8 @@ export class RunsManager implements vscode.Disposable {
       const ins = getInspector();
       if (!this.booting) ins?.reveal(); // boot replay must not steal focus
       ins?.setRunLabel(runId, runId);
+      const rdir = this.registry.get(runId)?.runDir;
+      if (rdir && isCloudRun(rdir)) ins?.setCloudRun(runId);
       ins?.activate(runId);
     }
 
@@ -480,7 +484,7 @@ export class RunsManager implements vscode.Disposable {
         // A finished run's replay must not stamp running/stalled per line — its
         // completion event (below) sets the bar exactly once at the end.
         if (this.registry.get(rid)?.phase !== "finished") {
-          this.opts.statusBar?.setRun({
+          this.setRunState({
             runId: rid,
             outputDir: rec.runDir,
             startedAt: 0,
@@ -491,7 +495,7 @@ export class RunsManager implements vscode.Disposable {
       },
       run: (c: RunCompletion) => {
         getInspector()?.postCompletion(rid, c.status, c.fidelity);
-        this.opts.statusBar?.setRun({
+        this.setRunState({
           runId: rid,
           outputDir: rec.runDir,
           startedAt: 0,
@@ -508,6 +512,29 @@ export class RunsManager implements vscode.Disposable {
     };
   }
 
+  /** The one seam that reaches the status bar, so "this run is in the cloud" is
+   *  stamped in ONE place instead of at six call sites — the six that exist today
+   *  are how a per-site flag would end up set on five of them and quietly missing
+   *  on the sixth. Callers pass what they know; location is derived from the run
+   *  dir, which is the authority for it. */
+  private setRunState(state: RunState): void {
+    this.opts.statusBar?.setRun({ ...state, cloud: this.isCloud(state.outputDir) });
+  }
+
+  /** Cached like liveStatus below, and for the same reason (this rides the
+   *  per-iteration path). Cached FOREVER rather than on a TTL: remote.json is
+   *  written once at submit and never removed, so the answer cannot change for a
+   *  given run dir. */
+  private readonly cloudCache = new Map<string, boolean>();
+  private isCloud(runDir: string): boolean {
+    let hit = this.cloudCache.get(runDir);
+    if (hit === undefined) {
+      hit = isCloudRun(runDir);
+      this.cloudCache.set(runDir, hit);
+    }
+    return hit;
+  }
+
   /** "running" only if run.log is actually moving. A FINISHED-less run whose
    *  log has been silent >10 min is wedged (OOM, killed host) — never let a
    *  boot replay of its old iter lines stamp "running · iter N" on the status
@@ -538,7 +565,7 @@ export class RunsManager implements vscode.Disposable {
     getInspector()?.postIterationRecord(p.runId, rec);
     if (this.selected === p.runId) {
       // Live status-bar update — "running · iter N" as it solves (#5 AC3).
-      this.opts.statusBar?.setRun({
+      this.setRunState({
         runId: p.runId,
         outputDir: p.runDir,
         startedAt: 0,
@@ -593,7 +620,7 @@ export class RunsManager implements vscode.Disposable {
     getInspector()?.postTiming(c.runId, { wallSeconds, terminal: true });
     this.opts.onRunFinished?.({ runId: c.runId, runDir: rec.runDir, status: c.status });
     if (this.selected === c.runId) {
-      this.opts.statusBar?.setRun({
+      this.setRunState({
         runId: c.runId,
         outputDir: rec.runDir,
         startedAt: 0,
diff --git a/packages/extension/src/solver_mode.ts b/packages/extension/src/solver_mode.ts
index 8ce14e88..1f3122cc 100644
--- a/packages/extension/src/solver_mode.ts
+++ b/packages/extension/src/solver_mode.ts
@@ -40,6 +40,62 @@ export function writeSolverModeReady(mode: SolverMode, file: string = solverMode
   fs.writeFileSync(file, JSON.stringify({ mode, status: "ready", switched_at: new Date().toISOString() }));
 }
 
+/** Is the `issimo` entitlement granted — i.e. is the Piccolissimo + Altissimo
+ *  tier actually active?
+ *
+ *  This is the DURABLE record of the tier, and a self-cleaning one: the only
+ *  writer is applyEntitlementForMode, which grants on hp and REVOKES on piccolo.
+ *  solver-mode.json, by contrast, only changes when someone posts a
+ *  `status:"switching"` request, so it can sit stale while the entitlement is
+ *  right — observed on 2026-08-05, where the file read `piccolo` (dated Jul 28)
+ *  with issimo granted, a live cloud.json, and a connected Harmoniqs Cloud. Every
+ *  cloud decision keys off that file, so the whole tier silently reverted to
+ *  local: no HP guidance, a template staged for IPOPT, and no cloud promotion. */
+export function issimoGranted(entitlementsDir: string = amicodeOpsDir()): boolean {
+  try {
+    const parsed = parseToml(fs.readFileSync(path.join(entitlementsDir, "entitlements.toml"), "utf8")) as {
+      codes?: unknown;
+    };
+    return Array.isArray(parsed.codes) && parsed.codes.includes("issimo");
+  } catch {
+    return false; // absent/corrupt → not entitled, so we fail toward the free local tier
+  }
+}
+
+/** The mode the rest of the extension must act on: hp if EITHER signal says so.
+ *
+ *  OR, not AND, and deliberately: the two signals disagree only when the switch
+ *  handshake half-landed, and of the two failure directions, "the user paid for
+ *  the cloud tier and silently got a local IPOPT solve" is far worse than "a
+ *  revoked user is told to connect". A user who genuinely wants local switches to
+ *  Piccolo, which revokes the entitlement, so both signals agree again. */
+export function effectiveSolverMode(
+  file: string = solverModeFile(),
+  entitlementsDir: string = amicodeOpsDir(),
+): SolverMode {
+  return readSolverModeState(file).mode === "hp" || issimoGranted(entitlementsDir) ? "hp" : "piccolo";
+}
+
+/** Bring solver-mode.json back in line with the entitlement at activation.
+ *
+ *  effectiveSolverMode() keeps the EXTENSION correct on its own, but the file is
+ *  a shared contract: the app's solver toggle renders from it (so a stale file
+ *  shows "Piccolo" selected while the user is on the paid tier), and amico-run
+ *  reads it directly. Healing it once at boot fixes every reader at the source
+ *  instead of teaching each one the same OR. Returns what it did, for the log —
+ *  a heal means the switch handshake dropped a write, which is worth knowing. */
+export function reconcileSolverMode(
+  file: string = solverModeFile(),
+  entitlementsDir: string = amicodeOpsDir(),
+): { healed: boolean; mode: SolverMode } {
+  const onDisk = readSolverModeState(file);
+  const mode = effectiveSolverMode(file, entitlementsDir);
+  // Never touch a switch in flight — the watcher owns that write.
+  if (onDisk.status === "switching" || onDisk.mode === mode) return { healed: false, mode };
+  writeSolverModeReady(mode, file);
+  return { healed: true, mode };
+}
+
 // NOTE: there is deliberately NO extension-side "write {status:switching}"
 // helper anymore. Switch requests come from the fork server (the app's toggle
 // POST, and the connections credential route's HP flip — #167); the extension
diff --git a/packages/extension/src/status_bar.ts b/packages/extension/src/status_bar.ts
index 4cb1efb1..c1f5d0cb 100644
--- a/packages/extension/src/status_bar.ts
+++ b/packages/extension/src/status_bar.ts
@@ -10,11 +10,23 @@ import type { RunState } from "./types";
 export function statusBarLabel(serverReady: boolean, run?: RunState): { text: string; tooltip: string } {
   if (!serverReady) return { text: "$(loading~spin) Amicode (booting)", tooltip: "Spawning opencode server…" };
   const dir = run?.outputDir ?? "";
+  // A cloud run says so on the ONE surface that is always visible, even with the
+  // Inspector closed — the status bar is where a user checks "what is happening
+  // right now", and "am I burning cloud credits?" belongs to that question.
+  // Only while the run is in flight: once it is done, its outcome is the story.
+  const where = run?.cloud ? " · $(cloud) cloud" : "";
+  const inWhere = run?.cloud ? "Harmoniqs Cloud" : dir;
   switch (run?.status) {
     case "starting":
-      return { text: "$(sync~spin) Amicode · warming…", tooltip: `Julia warming up in ${dir}` };
+      return {
+        text: `$(sync~spin) Amicode · ${run.cloud ? "$(cloud) cloud · queued…" : "warming…"}`,
+        tooltip: run.cloud ? `Queued in Harmoniqs Cloud — mirroring to ${dir}` : `Julia warming up in ${dir}`,
+      };
     case "running":
-      return { text: `$(gear~spin) Amicode · iter ${run.latestIter ?? "—"}`, tooltip: `Solve running in ${dir}` };
+      return {
+        text: `$(gear~spin) Amicode${where} · iter ${run.latestIter ?? "—"}`,
+        tooltip: `Solve running in ${inWhere}`,
+      };
     case "stalled":
       return {
         text: "$(warning) Amicode · stalled",
diff --git a/packages/extension/src/types.ts b/packages/extension/src/types.ts
index 8d1c7583..3219a12c 100644
--- a/packages/extension/src/types.ts
+++ b/packages/extension/src/types.ts
@@ -28,6 +28,8 @@ export interface RunState {
   status: RunStatus;
   latestIter?: number;
   fidelity?: number;
+  /** Executing in Harmoniqs Cloud (the paid Piccolissimo + Altissimo tier). */
+  cloud?: boolean;
 }
 
 /** Parsed AMICODE_ITER line from spike_solve.jl stdout. */
diff --git a/packages/extension/templates/solve_template_hp.jl b/packages/extension/templates/solve_template_hp.jl
deleted file mode 100644
index 47d11165..00000000
--- a/packages/extension/templates/solve_template_hp.jl
+++ /dev/null
@@ -1,190 +0,0 @@
-#!/usr/bin/env julia
-# Amicode HP solve template (Piccolissimo) — fill in the `# FILL IN` block, then:
-#   amico-run --project <julia-project> solve.jl
-# Emits the SAME run-dir contract as solve_template.jl (AMICODE_ITER, iter_<N>.png,
-# AMICODE_PULSE_META/AMICODE_PULSE, STOP-file cooperative stop, result.toml,
-# pulse.jld2, DONE) — the inspector/run-card readers cannot tell the modes apart.
-# HP swap = the SOLVER LAYER: Piccolissimo's continuous-time `SplineIntegrator`
-# (true cubic-spline dynamics via ODE propagation with analytic sensitivities)
-# inside Piccolo's `SplinePulseProblem`, instead of the piecewise-constant
-# ZeroOrderPulse + SmoothPulseProblem bilinear path. The optimizer stays Ipopt:
-# AMICODE_ITER needs the raw IPM state (obj/inf_pr/inf_du) and the STOP poll
-# rides Ipopt's intermediate callback — Altissimo exposes neither (Q74).
-# HP layer: SplineIntegrator, Tsit5Alg (composes with Piccolo). The next line
-# MUST stay bare `using Piccolissimo` — the cloud wrapper comments out only an
-# EXACT `using Piccolissimo`, so a trailing comment makes it fail to resolve.
-using Piccolissimo
-using Piccolo
-using CairoMakie   # loads PiccoloMakieExt → gives LivePulsePlotCallback its impl
-using JLD2
-using TOML
-using Printf
-
-# ── FILL IN ──────────────────────────────────────────────────────────────
-δ          = 0.2        # anharmonicity (GHz, positive convention)
-levels     = 3          # transmon levels modeled (3 = qubit + 1 leakage; bump to 4–5 for more leakage realism)
-gate       = GATES[:X]
-T          = 10.0       # gate time (ns)
-N          = 50         # timesteps
-drive_max  = 0.2        # per-quadrature drive bound (GHz)
-max_iter   = 60
-# ─────────────────────────────────────────────────────────────────────────
-
-sys = TransmonSystem(; δ = δ, levels = levels, drive_bounds = fill(drive_max, 2))
-op  = size(gate, 1) == sys.levels ? gate : EmbeddedOperator(gate, sys)
-
-times   = collect(range(0.0, T, length = N))
-initial = 0.1 * randn(sys.n_drives, N)
-# Cubic Hermite spline pulse: knot values AND tangents (:u, :du) are the decision
-# variables (tangents init to zero). This is the pulse family Piccolissimo's
-# spline integrator propagates exactly.
-qtraj = UnitaryTrajectory(sys, CubicSplinePulse(initial, times), op)
-# Piccolissimo's continuous-time integrator: per-interval ODE propagation of the
-# actual spline (Tsit5, adaptive), with analytic sensitivity equations for the
-# Jacobian — vs the default BilinearIntegrator's piecewise-constant model.
-integrator = SplineIntegrator(qtraj, N; alg = Tsit5Alg())
-qcp = SplinePulseProblem(qtraj, N;
-    integrator = integrator,
-    piccolo_options = PiccoloOptions(timesteps_all_equal = true),
-    Q = 100.0, R = 1e-2)
-prob = hasproperty(qcp, :prob) ? qcp.prob : qcp
-
-# Per-iter live plot flows through Piccolo's `LivePulsePlotCallback`, an
-# `AbstractIntermediateCallback` (the blessed, solver-agnostic per-iter plot
-# idiom — see AGENTS.md). It reconstructs the pulse from the optimizer's primal
-# each iteration and writes `iter_<N>.png` into the run dir; the Run Inspector
-# reads those frames. `every` is the redraw cadence. (No hand-rolled plotting:
-# the PNGs are the callback's job, not the script's. `extract_pulse` has a
-# CubicSplinePulse method, so the frames render the true spline.)
-const PLOT_EVERY = 6
-live_plot = LivePulsePlotCallback(qtraj, prob.trajectory; every = PLOT_EVERY, save_dir = ".")
-
-# Pulse-data telemetry (#66, prototype-grade): raw knot values per iteration as
-# AMICODE_PULSE lines on stdout (→ run.log), riding the SAME solver-agnostic
-# (primal, iter) hook as the live plot — the inspector renders them natively.
-# Additive to the run-dir contract: consumers that don't know the lines ignore
-# them. META once (shape + bounds), then one record per iteration (~1KB).
-struct PulseEmitCallback <: AbstractIntermediateCallback
-    inner::Any   # delegate (the live plot) — fires first, keeps the PNG cadence
-    traj::Any    # prob.trajectory — synced from the primal, then read
-end
-function (cb::PulseEmitCallback)(primal, iter)
-    # Cooperative stop: the Run Inspector's Stop button drops a STOP file into the
-    # run dir (== cwd). Returning false from Ipopt's intermediate_callback halts
-    # the solve (User_Requested_Stop) at the next iteration; solve! returns
-    # normally, so the partial pulse.jld2/result.toml still get written below.
-    if isfile("STOP")
-        println("AMICODE_STOPPED"); flush(stdout)
-        return false
-    end
-    ok = cb.inner(primal, iter)
-    try
-        traj = cb.traj
-        expected = traj.dim * traj.N + traj.global_dim
-        if length(primal) == expected
-            # Own sync — the delegate only updates the trajectory on its plot cadence.
-            # Qualified: `update!` is also exported by Makie/CairoMakie — the
-            # unqualified binding is ambiguous once the plotting stack loads.
-            if traj.global_dim > 0
-                Piccolo.NamedTrajectories.update!(traj, collect(view(primal, 1:expected)); type = :both)
-            else
-                Piccolo.NamedTrajectories.update!(traj, collect(view(primal, 1:(traj.dim * traj.N))); type = :data)
-            end
-            # Drive component name differs by problem flavor (:u current, :a
-            # legacy). Membership check (not `something(traj.u, traj.a)`): it
-            # keeps the fallback reachable without leaning on property access
-            # returning `nothing` for missing components (review nit, #67).
-            A = :u in traj.names ? traj.u : (:a in traj.names ? traj.a : missing)
-            A === missing && error("no drive component (:u/:a) on trajectory")
-            vals = join((join((@sprintf("%.6g", v) for v in row), ",") for row in eachrow(A)), ";")
-            @printf("AMICODE_PULSE iter=%d dt=%.6g a=%s\n", iter, first(Piccolo.get_timesteps(traj)), vals)
-            flush(stdout)
-        end
-    catch e
-        @warn "pulse emit failed" exception = e maxlog = 3   # never let telemetry kill the solve
-    end
-    return ok
-end
-pulse_emit = PulseEmitCallback(live_plot, prob.trajectory)
-
-let ls = join(("\"a_$i\"" for i in 1:sys.n_drives), ","),
-    bs = join(("$(-drive_max):$(drive_max)" for _ in 1:sys.n_drives), ",")
-    println("AMICODE_PULSE_META drives=$(sys.n_drives) knots=$N labels=$ls bounds=$bs")
-    flush(stdout)
-end
-
-# AMICODE_ITER text telemetry stays on the RAW Ipopt callback — it needs the rich
-# IPM state (obj_value/inf_pr/inf_du) that the agnostic `(primal, iter)` contract
-# doesn't carry. Both callbacks fire once per iteration (DTO composes the raw
-# callback with `intermediate_callback`); the live inspector is ipopt-only (Q74).
-const CB = Piccolo.Callbacks
-iters = Ref(0)
-function cb_log(optimizer, st; kwargs...)
-    k = Int(st.iter_count); iters[] = k
-    @printf("AMICODE_ITER iter=%d f=%.6e inf_pr=%.3e inf_du=%.3e\n", k, st.obj_value, st.inf_pr, st.inf_du)
-    flush(stdout)
-    return true
-end
-
-t0 = time()
-# pulse_emit restored (#177) via the version-pinned intermediate-callback API.
-# Verified against the PINNED DirectTrajOpt, not docs: julia/Manifest.toml pins
-# DTO 0.9.7 (git-tree-sha1 c722d301a8d064de5d9ab67e5bc8a1dff893683a, identical
-# to `git rev-parse v0.9.7^{tree}` in DirectTrajOpt.jl), where `IpoptOptions`
-# declares `intermediate_callback::Any` — an `AbstractIntermediateCallback` the
-# Ipopt backend wraps into `(primal, iter) -> Bool` (full NLP primal each IPM
-# iteration, restoration phase skipped) and composes with the raw `callback`
-# below: every callback fires once per iteration, the solve continues iff all
-# return true. The hasfield guard is the #157 lesson: a cloud bundle still
-# baked with DTO ≤ 0.9.6 has no such field (the kwarg MethodError that killed
-# cloud solves), so it degrades to stats-only — AMICODE_ITER flows, frames
-# dark — instead of crashing before the solve.
-ipopt_opts = if hasfield(IpoptOptions, :intermediate_callback)
-    IpoptOptions(intermediate_callback = pulse_emit)   # → iter_<N>.png + AMICODE_PULSE + STOP poll
-else
-    @warn "DirectTrajOpt < 0.9.7: no IpoptOptions.intermediate_callback — per-iter frames disabled (AMICODE_ITER still flows)"
-    IpoptOptions()
-end
-solve!(qcp; max_iter = max_iter, print_level = 1,
-       options = ipopt_opts,
-       callback = CB.callback_factory(cb_log))
-wall = time() - t0
-
-# Fidelity over the COMPUTATIONAL subspace, from a fresh high-tolerance rollout.
-# Two reasons this is the right metric:
-#   - subspace (not full-space): the embedded goal pins identity on the leakage
-#     level, which the solve doesn't enforce — full-space would read ~0.44 even
-#     for a perfect qubit gate. We want the gate fidelity on {|0>,|1>}.
-#   - rollout (not the raw final propagator): re-integrating at 1e-8 yields a
-#     clean unitary, avoiding the ~1e-6 norm-drift that made the raw block read >1.
-# `interpolation = :cubic` reconstructs the Hermite spline from (:u, :du) — the
-# rollout integrates the SAME pulse the spline integrator optimized.
-Uroll = iso_vec_to_operator(unitary_rollout(get_trajectory(qcp), sys; interpolation = :cubic)[:, end])
-fid   = unitary_fidelity(Uroll, op.operator; subspace = op.subspace)
-
-# End-of-solve guarantee frame — STILL through LivePulsePlotCallback (no bespoke
-# plot). The live callback fires at iters 0, PLOT_EVERY, 2·PLOT_EVERY, …; a solve
-# that converges in < PLOT_EVERY iters would otherwise leave only the iter-0
-# random-init frame (inspector stuck showing the initial guess). Re-invoke the
-# callback once at every=1 with the FINAL primal so the last frame is the
-# converged pulse. prob.trajectory is the final iterate here (DTO synced it after
-# solve!), so this reconstructs the same primal the callback saw per-iter.
-let final_cb = LivePulsePlotCallback(qtraj, prob.trajectory; every = 1, save_dir = ".")
-    tr = prob.trajectory
-    final_primal = tr.global_dim > 0 ? vcat(collect(tr.datavec), collect(tr.global_data)) : collect(tr.datavec)
-    final_cb(final_primal, iters[])
-end
-
-JLD2.save("pulse.jld2", "traj", prob.trajectory)   # key "traj" so `load_traj` can reload it (warm-start)
-open("result.toml.tmp", "w") do io
-    # Record the regime each run actually solved (scalar FILL-IN params), so the
-    # result is self-describing — not just fidelity/iterations.
-    TOML.print(io, Dict(
-        "schema_version" => "1",   # run-dir contract version (@amicode/schema result schema)
-        "fidelity" => fid, "iterations" => iters[], "wall_seconds" => wall,
-        "params" => Dict("delta" => δ, "levels" => levels, "T" => T, "N" => N,
-                         "drive_max" => drive_max, "max_iter" => max_iter),
-    ))
-end
-mv("result.toml.tmp", "result.toml"; force = true)
-println("DONE fidelity=$(fid)"); flush(stdout)
diff --git a/packages/extension/test/agents_md.test.ts b/packages/extension/test/agents_md.test.ts
index 4a9a9cc0..d27538b5 100644
--- a/packages/extension/test/agents_md.test.ts
+++ b/packages/extension/test/agents_md.test.ts
@@ -211,11 +211,29 @@ describe("HP solver-mode guidance: how to select Altissimo", () => {
     }
   };
 
-  it("names SOLVER = :altissimo as the switch, and forbids hand-rolling the call", async () => {
+  it("says the SOLVER line arrives already set, and forbids hand-writing the call", async () => {
     const s = await hpSection();
     expect(s).not.toBe(""); // guard: a misfiring mode gate would make these vacuous
-    expect(s).toMatch(/SOLVER = :altissimo/);
-    expect(s).toMatch(/Do NOT hand-roll/i);
+    // The backend is substituted at session prep from the solver mode, so the
+    // guidance must present it as decided — not quote a literal line the agent
+    // might then "fix". (Staging tests in opencode_config.test.ts pin the value.)
+    expect(s).toMatch(/`SOLVER` line ALREADY SET to Altissimo/);
+    expect(s).toMatch(/do NOT edit that line/i);
+    expect(s).toMatch(/do NOT hand-write/i);
+  });
+
+  it("forbids authoring from memory and names the API it actually hallucinated", async () => {
+    // Three cloud solves, three hand-authored scripts, zero uses of the vetted
+    // template. The last one invented CubicSplinePulse's signature, CallbackLogger
+    // and get_fidelity, and died with a MethodError at load — after the user paid
+    // the queue and boot wait. Naming the real symbols is what made the earlier
+    // `using Piccolo` guidance stick (#225), so do the same here.
+    const s = await hpSection();
+    expect(s).toMatch(/COPY THE TEMPLATE/);
+    expect(s).toMatch(/do not write a solve script from memory/i);
+    expect(s).toMatch(/CallbackLogger/);
+    expect(s).toMatch(/get_fidelity/);
+    expect(s).toMatch(/POSITIONAL/);
   });
 
   it("states both traps a hand-rolled call would hit: lost frames and a dropped budget", async () => {
diff --git a/packages/extension/test/cloud_badge.test.ts b/packages/extension/test/cloud_badge.test.ts
new file mode 100644
index 00000000..b21f99eb
--- /dev/null
+++ b/packages/extension/test/cloud_badge.test.ts
@@ -0,0 +1,55 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// The cloud badge is the surface that answers "am I running on the tier I'm
+// paying for?". Two things have to hold for it to be worth having: it must obey
+// the brand's fill rule (a gold INK is illegible on light themes — brand.css),
+// and it must survive a panel reopen like every other pane message, or it
+// silently disappears mid-solve.
+
+const PILL = readFileSync(join(__dirname, "..", "media", "ui", "atoms", "pill.ts"), "utf8");
+const VIEW = readFileSync(join(__dirname, "..", "media", "ui", "views", "inspector.ts"), "utf8");
+const HOST = readFileSync(join(__dirname, "..", "src", "run_inspector.ts"), "utf8");
+
+describe("cloud badge obeys the brand rule: yellow is a FILL, never an ink", () => {
+  it("the lemon is the background and the label is on-accent, never accent-coloured text", () => {
+    const rule = /\.pill\.cloud\s*\{([^}]*)\}/.exec(PILL)?.[1] ?? "";
+    expect(rule).toContain("background: var(--color-accent-fill)");
+    expect(rule).toContain("color: var(--color-on-accent)");
+    // the failure this prevents: `color: var(--color-accent*)` — 1.1:1 on white
+    expect(rule).not.toMatch(/color:\s*var\(--color-accent(-ink|-fill)?\)/);
+  });
+
+  it("the edge is the theme-solved hairline, so the badge bounds itself on light themes", () => {
+    expect(/\.pill\.cloud\s*\{[^}]*\}/.exec(PILL)?.[0] ?? "").toContain("--color-accent-edge");
+  });
+
+  it("the cloud glyph cannot be erased by a caller passing dot:false", () => {
+    // Equal specificity (.pill.no-dot::before vs .pill.cloud::before), so source
+    // order decides — cloud must come last.
+    const noDot = PILL.indexOf(".pill.no-dot::before");
+    const cloud = PILL.indexOf(".pill.cloud::before");
+    expect(noDot).toBeGreaterThan(-1);
+    expect(cloud).toBeGreaterThan(noDot);
+    expect(PILL).toMatch(/\.pill\.cloud::before\s*\{[^}]*content:\s*"☁"/);
+  });
+});
+
+describe("cloud badge appears only when it means something", () => {
+  it("the view hides it by default and reveals it only on cloud === true", () => {
+    expect(VIEW).toMatch(/location\.el\.hidden = true/); // default: absent
+    expect(VIEW).toMatch(/case "location":/);
+    // strictly true — an absent/garbled flag must not light up a paid-tier badge
+    expect(VIEW).toMatch(/location\.el\.hidden = msg\.cloud !== true/);
+  });
+
+  it("the host buffers it per pane, so reopening the panel keeps the badge", () => {
+    // Every other pane message is replayed in replayPane; a badge that only ever
+    // posted live would vanish the moment the user closed and reopened the view.
+    expect(HOST).toMatch(/setCloudRun\(runId: string\)/);
+    expect(HOST).toMatch(/paneFor\(runId\)\.cloud = true/);
+    const replay = /private replayPane\([\s\S]*?\n  \}/.exec(HOST)?.[0] ?? "";
+    expect(replay).toMatch(/p\.cloud.*type: "location".*cloud: true/s);
+  });
+});
diff --git a/packages/extension/test/inspector_webview_view.test.ts b/packages/extension/test/inspector_webview_view.test.ts
index 763b5262..51480dec 100644
--- a/packages/extension/test/inspector_webview_view.test.ts
+++ b/packages/extension/test/inspector_webview_view.test.ts
@@ -23,7 +23,11 @@ const iter = (runId: string, n: number) => ({
 });
 const panes = (v: { el: HTMLElement }) => [...v.el.querySelectorAll(".pane")];
 const activePane = (v: { el: HTMLElement }) => v.el.querySelector(".pane.active");
-const pillText = (pane: Element | null | undefined) => pane?.querySelector(".pill")?.textContent;
+// The RUN-STATE pill specifically. The topbar now carries a second pill (the
+// Harmoniqs Cloud location badge), so a bare ".pill" query returns whichever
+// comes first in the DOM. role=status is the status pill's own semantic hook —
+// the same one a screen reader keys off — so it is the honest selector here.
+const pillText = (pane: Element | null | undefined) => pane?.querySelector(".pill[role=status]")?.textContent;
 
 describe("Inspector webview router (1.3 per-run panes)", () => {
   it("activate shows exactly one pane and hides the empty-state hint", () => {
@@ -92,3 +96,44 @@ describe("Inspector webview router (1.3 per-run panes)", () => {
     expect(pillText(r1)).toBe("converged"); // r1 untouched by the switch
   });
 });
+
+// The location badge: the answer to "is this run on the tier I'm paying for?".
+// Asserted through the real DOM the user sees, not the stylesheet source.
+const cloudBadge = (pane: Element | null | undefined) =>
+  [...(pane?.querySelectorAll(".pill") ?? [])].find((p) => p.textContent === "Harmoniqs Cloud");
+
+describe("Harmoniqs Cloud location badge", () => {
+  it("is absent from a pane until a location message says cloud", () => {
+    const v = createInspectorView(() => {});
+    v.onMessage({ type: "activate", runId: "r1" });
+    const badge = cloudBadge(activePane(v));
+    // present in the DOM but hidden — a local run shows no cloud chrome at all
+    expect((badge as HTMLElement | undefined)?.hidden).toBe(true);
+  });
+
+  it("appears on the run it was sent for, and NOT on a sibling local run", () => {
+    const v = createInspectorView(() => {});
+    v.onMessage({ type: "activate", runId: "rCloud" });
+    v.onMessage({ type: "location", runId: "rCloud", cloud: true });
+    v.onMessage(iter("rLocal", 1)); // a second, local run in its own pane
+    const cloudPane = [...panes(v)].find((p) => !(cloudBadge(p) as HTMLElement).hidden);
+    expect(cloudPane).toBeTruthy();
+    // exactly one pane claims the cloud — panes must not leak each other's state
+    expect(panes(v).filter((p) => !(cloudBadge(p) as HTMLElement).hidden)).toHaveLength(1);
+  });
+
+  it("a location message without cloud:true never lights the badge", () => {
+    const v = createInspectorView(() => {});
+    v.onMessage({ type: "activate", runId: "r1" });
+    v.onMessage({ type: "location", runId: "r1" }); // malformed / local
+    expect((cloudBadge(activePane(v)) as HTMLElement).hidden).toBe(true);
+  });
+
+  it("the badge does not disturb the run-state pill beside it", () => {
+    const v = createInspectorView(() => {});
+    v.onMessage({ type: "activate", runId: "r1" });
+    v.onMessage({ type: "location", runId: "r1", cloud: true });
+    v.onMessage(iter("r1", 3));
+    expect(pillText(activePane(v))).toBe("running");
+  });
+});
diff --git a/packages/extension/test/opencode_config.test.ts b/packages/extension/test/opencode_config.test.ts
index 0e1c1fee..3c447221 100644
--- a/packages/extension/test/opencode_config.test.ts
+++ b/packages/extension/test/opencode_config.test.ts
@@ -262,11 +262,13 @@ describe("prepareOpencodeProject", () => {
     });
     const agents = readFileSync(p.agentsPath, "utf8");
     expect(agents).toContain("/opt/piccolo");
-    expect(agents).toContain(templateSrc); // {{TEMPLATE_PATH}} → the absolute bundled template
     expect(agents).not.toMatch(/\{\{.*?\}\}/); // no residual placeholders
-    expect(p.templatePath).toBe(templateSrc); // points at the bundled source, not a copy
+    // {{TEMPLATE_PATH}} resolves to the STAGED template (see the staging tests
+    // below): the agent must read the copy whose SOLVER matches the selected tier.
+    expect(agents).toContain(p.templatePath);
+    expect(p.templatePath).toBe(join(p.projectDir, "solve_template.jl"));
   });
-  it("does NOT copy the template or write a vestigial .opencode/opencode.json into the session dir", () => {
+  it("does NOT write a vestigial .opencode/opencode.json into the session dir", () => {
     const ext = fakeExtRoot();
     const p = prepareOpencodeProject({
       agentsSrc: join(ext, "AGENTS.md"),
@@ -274,7 +276,6 @@ describe("prepareOpencodeProject", () => {
       juliaProject: "/opt/piccolo",
       vaultDir: "",
     });
-    expect(existsSync(join(p.projectDir, "solve_template.jl"))).toBe(false);
     expect(existsSync(join(p.projectDir, ".opencode", "opencode.json"))).toBe(false);
   });
   it("reuses an explicit projectDir across activations (creates it, re-prepare is idempotent)", () => {
@@ -295,6 +296,85 @@ describe("prepareOpencodeProject", () => {
   });
 });
 
+describe("solve-template staging (SOLVER follows the selected tier, not the agent)", () => {
+  // A paid Piccolissimo + Altissimo run that quietly solved on IPOPT is not the
+  // product the user selected, and it is invisible in the result — same artifacts,
+  // same "converged" badge. So the backend is substituted from the solver mode at
+  // session prep instead of being an authoring decision the agent could get wrong.
+  function withMode(mode: "piccolo" | "hp", run: () => void) {
+    const opsDir = mkdtempSync(join(tmpdir(), "ops-"));
+    writeFileSync(join(opsDir, "solver-mode.json"), JSON.stringify({ mode, status: "ready" }));
+    const prev = process.env.AMICODE_OPS_DIR;
+    process.env.AMICODE_OPS_DIR = opsDir;
+    try {
+      run();
+    } finally {
+      if (prev === undefined) delete process.env.AMICODE_OPS_DIR;
+      else process.env.AMICODE_OPS_DIR = prev;
+    }
+  }
+
+  function stage(mode: "piccolo" | "hp"): { staged: string; templatePath: string; agents: string } {
+    const ext = mkdtempSync(join(tmpdir(), "extroot-"));
+    writeFileSync(join(ext, "AGENTS.md"), "# A\nproject: {{JULIA_PROJECT}}\ntemplate: {{TEMPLATE_PATH}}\n");
+    mkdirSync(join(ext, "templates"));
+    // the real template's shape: a substituted STRING, valid Julia either way
+    writeFileSync(
+      join(ext, "templates", "solve_template.jl"),
+      'SOLVER = let s = "{{SOLVER}}"\n    Symbol(startswith(s, "{{") ? "ipopt" : s)\nend\n',
+    );
+    let out!: { staged: string; templatePath: string; agents: string };
+    withMode(mode, () => {
+      const p = prepareOpencodeProject({
+        agentsSrc: join(ext, "AGENTS.md"),
+        templateSrc: join(ext, "templates", "solve_template.jl"),
+        juliaProject: "/opt/piccolo",
+        vaultDir: "",
+      });
+      out = {
+        staged: readFileSync(p.templatePath, "utf8"),
+        templatePath: p.templatePath,
+        agents: readFileSync(p.agentsPath, "utf8"),
+      };
+    });
+    return out;
+  }
+
+  it("hp mode → the staged template selects altissimo", () => {
+    const r = stage("hp");
+    expect(r.staged).toContain('"altissimo"');
+    expect(r.staged).not.toContain("{{SOLVER}}");
+  });
+
+  it("piccolo mode → the staged template selects ipopt", () => {
+    const r = stage("piccolo");
+    expect(r.staged).toContain('"ipopt"');
+    expect(r.staged).not.toContain("{{SOLVER}}");
+  });
+
+  it("the agent is pointed at the STAGED copy, not the bundled original", () => {
+    const r = stage("hp");
+    // AGENTS.md's {{TEMPLATE_PATH}} and the grant-bearing templatePath must agree,
+    // or the agent reads one file while permissions describe another.
+    expect(r.agents).toContain(r.templatePath);
+    expect(r.templatePath).toMatch(/solve_template\.jl$/);
+  });
+
+  it("the SHIPPED template keeps the placeholder inside a string, so staging failure degrades", () => {
+    // If staging ever fails (unwritable project dir), the agent reads the bundled
+    // original — so the placeholder must be valid Julia UNSUBSTITUTED. A bare
+    // `SOLVER = {{SOLVER}}` is a syntax error, which turns a degraded local solve
+    // into a script that cannot even parse. Guards the shipped file, not a mock.
+    const shipped = readFileSync(
+      join(__dirname, "..", "scores", "pulse-designer", "templates", "solve.jl"),
+      "utf8",
+    );
+    expect(shipped).toContain('"{{SOLVER}}"'); // quoted, i.e. a string literal
+    expect(shipped).not.toMatch(/SOLVER\s*=\s*\{\{SOLVER\}\}/); // never the bare form
+    expect(shipped).toMatch(/startswith\(s, "\{\{"\) \? "ipopt"/); // and it falls back to local
+  });
+});
+
 describe("routingSection (Δ10 #63 — per-solve routing guidance splice)", () => {
   // Isolate BOTH seams the section reads: the solver-mode file ($AMICODE_OPS_DIR)
   // and the connections status cache ($AMICODE_CONNECTIONS_FILE). No network, no
diff --git a/packages/extension/test/packaging.test.ts b/packages/extension/test/packaging.test.ts
index d47cee7c..626c5017 100644
--- a/packages/extension/test/packaging.test.ts
+++ b/packages/extension/test/packaging.test.ts
@@ -23,7 +23,6 @@ const REQUIRED = [
   "extension/readme.md", // marketplace detail-page body (vsce lowercases README.md) — a dropped README = blank listing page
 
   "extension/templates/solve_template.jl",
-  "extension/templates/solve_template_hp.jl", // HP-mode vetted template (Piccolissimo) — mode-selected at prep time
   // spec C authoring assets — the tiered resolver + verification chain break
   // silently if any of these is dropped from the vsix.
   "extension/templates/registry.toml", // tier-1 template registry + support set + sandbox uuid map
diff --git a/packages/extension/test/remote_statemachine.test.ts b/packages/extension/test/remote_statemachine.test.ts
index da5a7afe..21a1987f 100644
--- a/packages/extension/test/remote_statemachine.test.ts
+++ b/packages/extension/test/remote_statemachine.test.ts
@@ -16,6 +16,7 @@ const { inspector } = vi.hoisted(() => ({
     postIterationRecord: vi.fn(),
     postPulse: vi.fn(),
     setRunLabel: vi.fn(),
+    setCloudRun: vi.fn(),
     activate: vi.fn(),
     reveal: vi.fn(),
   },
@@ -57,6 +58,10 @@ describe("Δ9 — remote run through the SAME inspector state machine", () => {
       // 1. warming — identical to the local fresh-run lane (runs_manager.test.ts:98-101)
       expect(inspector.setWarmingUp).toHaveBeenCalledWith(h.runId);
       expect(inspector.setRunLabel).toHaveBeenCalledWith(h.runId, h.runId);
+      // …plus the cloud badge. End-to-end proof: a real RemoteExecutor.submit
+      // wrote the remote.json this reads, so the pane a user actually sees
+      // carries the Harmoniqs Cloud badge — not a dim string in the run label.
+      expect(inspector.setCloudRun).toHaveBeenCalledWith(h.runId);
       expect(inspector.activate).toHaveBeenCalledWith(h.runId);
       expect(m.selectedRun).toBe(h.runId);
 
@@ -111,3 +116,145 @@ describe("Δ9 — remote run through the SAME inspector state machine", () => {
     }
   });
 });
+
+// Δ-next: the WHOLE cloud iteration chain, driven by a real run.log body.
+//
+// This is the test that was missing every time cloud iterations "didn't work".
+// The three failures all lived in the seam between what the service returns and
+// what the client expected, and every existing test seeded the CLIENT's shape, so
+// they passed while real solves came back empty. Here the fake is handed a run.log
+// and applies the deployed lambda's own extraction (statsFromRunLog), so the
+// records under test are the ones the live endpoint produces: {raw: "iter=…"},
+// key=value, never pre-parsed JSON.
+//
+// The run.log body is exactly what lands on the runner once aws-infra#230
+// redirects julia's output there — including the Altissimo stdout-bridge lines,
+// which are the version-independent telemetry path.
+describe("cloud iterations reach the Inspector from a real run.log", () => {
+  // Own reset: the inspector mock is module-level and the other block's beforeEach
+  // does not reach here, so without this the "no iterations" case inherits the
+  // previous test's calls and passes or fails for the wrong reason.
+  beforeEach(() => {
+    for (const f of Object.values(inspector)) f.mockClear();
+  });
+
+  // A REAL run.log, captured from an actual Altissimo solve on Piccolissimo 0.3.1
+  // (test/fixtures/altissimo_cloud_run.log). Using captured output rather than a
+  // hand-written fixture is the point: every previous version of this test seeded
+  // what the CLIENT expected, which is how three drift bugs shipped green.
+  const CAPTURED = readFileSync(join(__dirname, "fixtures", "altissimo_cloud_run.log"), "utf8");
+
+  const RUN_LOG = [
+    "AMICODE_NOTE bridged AltissimoOptions onto DirectTrajOpt._solve (DTO 0.9.7 moved the extension point)",
+    "  iter      objective      inf_pr      inf_du    lg(ρ)",
+    "     ·   4.810437e+01   0.000e+00   1.074e+02      0.0",
+    "AMICODE_ITER iter=1 f=8.831003e+01 inf_pr=0.000e+00 inf_du=4.104e+01",
+    "AMICODE_ITER iter=2 f=1.203608e+01 inf_pr=0.000e+00 inf_du=8.812e+01",
+    "AMICODE_ITER iter=3 f=7.804919e-03 inf_pr=1.078e-01 inf_du=6.604e+01",
+    "DONE fidelity=0.9993",
+  ].join("\n");
+
+  it("key=value {raw} records become iteration records in the pane", async () => {
+    const fake = new FakeCloud();
+    await fake.start();
+    const root = mkdtempSync(join(tmpdir(), "runs-"));
+    const m = new RunsManager({ runsRoot: root, channel });
+    m.start();
+    const ex = new RemoteExecutor({ config: { baseUrl: fake.base, token: fake.token }, pollMs: 10 });
+    try {
+      const script = join(root, "s.jl");
+      writeFileSync(script, "//\n");
+      const h = await ex.submit(script, { runsRoot: root });
+      tick(m);
+
+      fake.state.task_status = "Running";
+      fake.state.runLog = RUN_LOG; // served through the REAL lambda transform
+
+      // the highest iteration must arrive — proof the raw form parsed
+      await until(() => readFileSync(join(h.runDir, "run.log"), "utf8").includes("iter=3"));
+      tick(m);
+      expect(inspector.postIterationRecord).toHaveBeenCalledWith(h.runId, expect.objectContaining({ iter: 3 }));
+
+      // and the numeric fields survived the round trip — an iteration count with
+      // no objective would plot as a flat line and read as "not converging"
+      const call = inspector.postIterationRecord.mock.calls.find(
+        (c: unknown[]) => (c[1] as { iter: number }).iter === 3,
+      );
+      expect((call![1] as { f_val: number }).f_val).toBeCloseTo(7.804919e-3, 12);
+
+      // non-AMICODE_ITER lines (the NOTE, the raw Altissimo table) must not become
+      // iterations — the lambda greps, so a loose parser would ingest the table too
+      const iters = inspector.postIterationRecord.mock.calls.map((c: unknown[]) => (c[1] as { iter: number }).iter);
+      expect(iters.every((n: number) => [1, 2, 3].includes(n))).toBe(true);
+
+      fake.state.finished = { status: "completed" };
+      await h.finished;
+      tick(m);
+      expect(inspector.postCompletion).toHaveBeenCalledWith(h.runId, "completed", undefined);
+    } finally {
+      m.dispose();
+      await fake.stop();
+    }
+  }, 15000);
+
+  it("a REAL captured solve log drives the chain end to end", async () => {
+    const fake = new FakeCloud();
+    await fake.start();
+    const root = mkdtempSync(join(tmpdir(), "runs-"));
+    const m = new RunsManager({ runsRoot: root, channel });
+    m.start();
+    const ex = new RemoteExecutor({ config: { baseUrl: fake.base, token: fake.token }, pollMs: 10 });
+    try {
+      const script = join(root, "s.jl");
+      writeFileSync(script, "//\n");
+      const h = await ex.submit(script, { runsRoot: root });
+      tick(m);
+      fake.state.task_status = "Running";
+      fake.state.runLog = CAPTURED; // real solver output, real lambda transform
+
+      await until(() => readFileSync(join(h.runDir, "run.log"), "utf8").includes("iter=4"));
+      tick(m);
+      // the captured solve ran 4 outer iterations; all four must land
+      for (const n of [1, 2, 3, 4]) {
+        expect(inspector.postIterationRecord).toHaveBeenCalledWith(h.runId, expect.objectContaining({ iter: n }));
+      }
+      // and the objective from the real log, not a placeholder
+      const last = inspector.postIterationRecord.mock.calls.find(
+        (c: unknown[]) => (c[1] as { iter: number }).iter === 4,
+      );
+      expect((last![1] as { f_val: number }).f_val).toBeCloseTo(4.790788e-2, 10);
+      // the pulse meta from the same log arms the plot
+      expect(inspector.postPulse).toHaveBeenCalled();
+    } finally {
+      m.dispose();
+      await fake.stop();
+    }
+  }, 15000);
+
+  it("an empty run.log yields no iterations and no crash (the observed live case)", async () => {
+    // What every cloud solve returned before aws-infra#230: stats: []. The client
+    // must treat that as "nothing yet", not as an error or a zero-th iteration.
+    const fake = new FakeCloud();
+    await fake.start();
+    const root = mkdtempSync(join(tmpdir(), "runs-"));
+    const m = new RunsManager({ runsRoot: root, channel });
+    m.start();
+    const ex = new RemoteExecutor({ config: { baseUrl: fake.base, token: fake.token }, pollMs: 10 });
+    try {
+      const script = join(root, "s.jl");
+      writeFileSync(script, "//\n");
+      const h = await ex.submit(script, { runsRoot: root });
+      tick(m); // discovery — without it the manager never registers the run
+      fake.state.task_status = "Running";
+      fake.state.runLog = "";
+      fake.state.finished = { status: "completed" };
+      await h.finished;
+      tick(m);
+      expect(inspector.postIterationRecord).not.toHaveBeenCalled();
+      expect(inspector.postCompletion).toHaveBeenCalledWith(h.runId, "completed", undefined);
+    } finally {
+      m.dispose();
+      await fake.stop();
+    }
+  }, 15000);
+});
diff --git a/packages/extension/test/run_location.test.ts b/packages/extension/test/run_location.test.ts
new file mode 100644
index 00000000..35f067e2
--- /dev/null
+++ b/packages/extension/test/run_location.test.ts
@@ -0,0 +1,32 @@
+import { describe, it, expect } from "vitest";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isCloudRun } from "../src/run_location";
+
+// A cloud run and a local run used to produce an IDENTICAL Inspector pane, so a
+// user paying for Piccolissimo + Altissimo had no way to see from the UI that the
+// solve went to the cloud. The run dir answers it: remote.json is written by
+// RemoteExecutor and by nothing else. What the UI does with the answer lives in
+// cloud_badge.test.ts (topbar badge) and status_bar.test.ts (status bar).
+
+function runDir(files: Record<string, string>): string {
+  const d = mkdtempSync(join(tmpdir(), "rundir-"));
+  for (const [name, body] of Object.entries(files)) writeFileSync(join(d, name), body);
+  return d;
+}
+
+describe("isCloudRun", () => {
+  it("a remote run dir carries remote.json", () => {
+    const d = runDir({ "remote.json": JSON.stringify({ task_id: "t-1", base_url: "https://api" }) });
+    expect(isCloudRun(d)).toBe(true);
+  });
+
+  it("a local run dir does not", () => {
+    expect(isCloudRun(runDir({ "run.toml": 'run_id = "r1"\n' }))).toBe(false);
+  });
+
+  it("a missing dir is not a cloud run, and never throws", () => {
+    expect(isCloudRun(join(tmpdir(), "definitely-absent-", String(Math.random())))).toBe(false);
+  });
+});
diff --git a/packages/extension/test/runs_manager.test.ts b/packages/extension/test/runs_manager.test.ts
index b2d781ef..99890cdd 100644
--- a/packages/extension/test/runs_manager.test.ts
+++ b/packages/extension/test/runs_manager.test.ts
@@ -27,6 +27,7 @@ const { inspector } = vi.hoisted(() => ({
     postIterationRecord: vi.fn(),
     postPulse: vi.fn(),
     setRunLabel: vi.fn(),
+    setCloudRun: vi.fn(),
     activate: vi.fn(),
     reveal: vi.fn(),
   },
diff --git a/packages/extension/test/smoke_corpus.test.ts b/packages/extension/test/smoke_corpus.test.ts
index 15f85960..e84d8496 100644
--- a/packages/extension/test/smoke_corpus.test.ts
+++ b/packages/extension/test/smoke_corpus.test.ts
@@ -31,6 +31,7 @@ const { inspector } = vi.hoisted(() => ({
     postIterationRecord: vi.fn(),
     postPulse: vi.fn(),
     setRunLabel: vi.fn(),
+    setCloudRun: vi.fn(),
     activate: vi.fn(),
     reveal: vi.fn(),
   },
diff --git a/packages/extension/test/solver_mode_reconcile.test.ts b/packages/extension/test/solver_mode_reconcile.test.ts
new file mode 100644
index 00000000..c45f6061
--- /dev/null
+++ b/packages/extension/test/solver_mode_reconcile.test.ts
@@ -0,0 +1,141 @@
+import { describe, it, expect } from "vitest";
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  effectiveSolverMode,
+  issimoGranted,
+  reconcileSolverMode,
+  readSolverModeState,
+} from "../src/solver_mode";
+
+// The 2026-08-05 field report: a Piccolissimo + Altissimo solve ran locally on
+// IPOPT. Cause: solver-mode.json read `piccolo` (dated a week earlier) while the
+// issimo entitlement WAS granted and Harmoniqs Cloud was connected. Every cloud
+// decision in the extension keys off that file — routing guidance, the template's
+// SOLVER, the app's own toggle — so one dropped write silently reverted the whole
+// paid tier, and nothing anywhere said so.
+
+function ops(mode: string | undefined, codes: string[] | undefined): string {
+  const dir = mkdtempSync(join(tmpdir(), "ops-"));
+  if (mode !== undefined) writeFileSync(join(dir, "solver-mode.json"), JSON.stringify({ mode, status: "ready" }));
+  if (codes !== undefined)
+    writeFileSync(join(dir, "entitlements.toml"), `codes = [${codes.map((c) => `"${c}"`).join(", ")}]\n`);
+  return dir;
+}
+const modeFile = (dir: string) => join(dir, "solver-mode.json");
+
+describe("issimoGranted — the durable, self-cleaning record of the tier", () => {
+  it("true when the entitlement carries issimo, false when it does not", () => {
+    expect(issimoGranted(ops("piccolo", ["issimo"]))).toBe(true);
+    expect(issimoGranted(ops("piccolo", ["something-else"]))).toBe(false);
+  });
+  it("absent / corrupt entitlements → false, never a throw (fresh install)", () => {
+    expect(issimoGranted(ops("piccolo", undefined))).toBe(false);
+    const d = ops("piccolo", undefined);
+    writeFileSync(join(d, "entitlements.toml"), "{{ not toml");
+    expect(issimoGranted(d)).toBe(false);
+  });
+});
+
+describe("effectiveSolverMode — hp if EITHER signal says so", () => {
+  it("the reported bug: stale piccolo file + granted entitlement → hp", () => {
+    const d = ops("piccolo", ["issimo"]);
+    expect(readSolverModeState(modeFile(d)).mode).toBe("piccolo"); // what the file says
+    expect(effectiveSolverMode(modeFile(d), d)).toBe("hp"); // what we act on
+  });
+  it("file says hp, entitlement not yet written → still hp (switch mid-flight)", () => {
+    const d = ops("hp", []);
+    expect(effectiveSolverMode(modeFile(d), d)).toBe("hp");
+  });
+  it("both say piccolo → piccolo, so the free tier is untouched", () => {
+    const d = ops("piccolo", []);
+    expect(effectiveSolverMode(modeFile(d), d)).toBe("piccolo");
+  });
+  it("nothing on disk at all → piccolo (fail safe to the free local tier)", () => {
+    expect(effectiveSolverMode(modeFile(ops(undefined, undefined)), ops(undefined, undefined))).toBe("piccolo");
+  });
+});
+
+describe("reconcileSolverMode — heal the shared file at the source", () => {
+  it("rewrites a stale piccolo file to hp, and says it healed", () => {
+    // Healing the FILE (not just our own reads) is what fixes the other readers:
+    // the app's solver toggle renders from it, and amico-run reads it directly.
+    const d = ops("piccolo", ["issimo"]);
+    const r = reconcileSolverMode(modeFile(d), d);
+    expect(r).toEqual({ healed: true, mode: "hp" });
+    expect(readSolverModeState(modeFile(d)).mode).toBe("hp"); // persisted
+  });
+
+  it("is a no-op when the file already agrees — no needless write, no false alarm", () => {
+    const d = ops("hp", ["issimo"]);
+    expect(reconcileSolverMode(modeFile(d), d)).toEqual({ healed: false, mode: "hp" });
+  });
+
+  it("never touches a switch in flight — the watcher owns that write", () => {
+    // Racing the watcher would settle a switch at the wrong mode.
+    const d = ops("piccolo", ["issimo"]);
+    writeFileSync(modeFile(d), JSON.stringify({ mode: "piccolo", status: "switching" }));
+    expect(reconcileSolverMode(modeFile(d), d).healed).toBe(false);
+    expect(readSolverModeState(modeFile(d)).status).toBe("switching"); // left alone
+  });
+
+  it("does NOT auto-downgrade an hp file when the entitlement is missing", () => {
+    // Deliberately asymmetric. A silent downgrade to a local solve is the exact
+    // failure this change exists to kill, so `hp` is sticky: we never take the
+    // cloud tier away from someone behind their back. The opposite direction is
+    // cheap by comparison — an unentitled user who reaches the cloud gets a
+    // "connect Harmoniqs Cloud" message, which is visible and actionable.
+    //
+    // Nothing is stranded by this: switching to Piccolo writes BOTH halves (the
+    // entitlement revoke and the mode file), so the ordinary path still lands on
+    // piccolo. This governs only the half-landed case.
+    const d = ops("hp", []);
+    expect(effectiveSolverMode(modeFile(d), d)).toBe("hp");
+    expect(reconcileSolverMode(modeFile(d), d)).toEqual({ healed: false, mode: "hp" });
+    expect(readFileSync(modeFile(d), "utf8")).toContain('"hp"'); // untouched
+  });
+});
+
+// "if I say run a piccolissimo altissimo solve it might use piccolo because the
+// vetted template uses piccolo" (2026-08-06). Three templates existed and the
+// selection was not a function of the toggle:
+//   templates/solve_template.jl      Piccolo    + IPOPT   ← the only vetted entry
+//   templates/solve_template_hp.jl   Piccolissimo + IPOPT ← never registered, and
+//                                                           it did not use Altissimo
+//   scores/.../templates/solve.jl    either, real Altissimo
+// Consolidated to the last one, SOLVER substituted from the mode, so the toggle IS
+// the decision. These pin that it stays that way.
+describe("the solver toggle deterministically decides the backend", () => {
+  const SCORE_TEMPLATE = join(__dirname, "..", "scores", "pulse-designer", "templates", "solve.jl");
+
+  it("the consolidated template is the only one the extension stages", () => {
+    const ext = readFileSync(join(__dirname, "..", "src", "extension.ts"), "utf8");
+    // no mode-branching over two template FILES — the branch belongs in SOLVER,
+    // not in which file gets picked, or the two files drift (and they did)
+    expect(ext).not.toMatch(/solve_template_hp\.jl/);
+    expect(ext).toMatch(/"scores", "pulse-designer", "templates", "solve\.jl"/);
+    expect(existsSync(join(__dirname, "..", "templates", "solve_template_hp.jl"))).toBe(false);
+  });
+
+  it("that template really runs Altissimo when SOLVER says so — not IPOPT wearing its name", () => {
+    // solve_template_hp.jl claimed to be the HP template while calling
+    // `solve!(qcp; max_iter, print_level=1, …)` — an IPOPT call with zero
+    // AltissimoOptions. That is how a paid Altissimo run silently became IPOPT.
+    const t = readFileSync(SCORE_TEMPLATE, "utf8");
+    expect(t).toMatch(/AltissimoOptions\(/);
+    expect(t).toMatch(/verbose = true/); // else no iteration table, no telemetry
+    expect(t).toMatch(/DirectTrajOpt\._solve/); // the 0.9.7 dispatch bridge
+    expect(t).toMatch(/solve_altissimo_streaming/); // the stdout → AMICODE_ITER bridge
+    expect(t).toMatch(/open\("run\.log", "a"\)/); // what /stats greps
+  });
+
+  it("and it still serves the free tier: SOLVER=ipopt keeps the local IPOPT path", () => {
+    const t = readFileSync(SCORE_TEMPLATE, "utf8");
+    expect(t).toMatch(/IpoptOptions\(/);
+    expect(t).toMatch(/SOLVER === :altissimo/); // one file, branch inside
+    // Piccolissimo is imported only on the altissimo branch, so a free-tier
+    // script never needs the entitled package
+    expect(t).toMatch(/@eval using Piccolissimo/);
+  });
+});
diff --git a/packages/extension/test/status_bar.test.ts b/packages/extension/test/status_bar.test.ts
index 1e011ebb..6f13c495 100644
--- a/packages/extension/test/status_bar.test.ts
+++ b/packages/extension/test/status_bar.test.ts
@@ -33,3 +33,39 @@ describe("statusBarLabel stalled", () => {
     expect(tooltip).toMatch(/wedged|10\+ min/i);
   });
 });
+
+// "Am I burning cloud credits right now?" is a status-bar question: it is the one
+// surface visible with the Inspector closed. A cloud run and a local run used to
+// render an identical label.
+describe("statusBarLabel names Harmoniqs Cloud while a cloud run is in flight", () => {
+  it("running on cloud carries the cloud icon and still shows iter N", () => {
+    const { text, tooltip } = statusBarLabel(true, run("running", { latestIter: 42, cloud: true }));
+    expect(text).toContain("$(cloud)");
+    expect(text).toContain("42"); // the location is additive — it never costs the progress
+    expect(tooltip).toMatch(/Harmoniqs Cloud/);
+  });
+
+  it("a cloud run that is still queued says queued, not warming", () => {
+    // "warming" describes Julia precompiling locally, which is exactly what does
+    // NOT happen on the cloud tier (the runner image is pre-baked) — so the local
+    // word would be a lie about where the wait is coming from.
+    const { text, tooltip } = statusBarLabel(true, run("starting", { cloud: true }));
+    expect(text).toMatch(/queued/i);
+    expect(text).not.toMatch(/warming/i);
+    expect(tooltip).toMatch(/Harmoniqs Cloud/);
+  });
+
+  it("a LOCAL run is byte-identical to before — no cloud chrome anywhere", () => {
+    expect(statusBarLabel(true, run("running", { latestIter: 42 })).text).toBe(
+      "$(gear~spin) Amicode · iter 42",
+    );
+    expect(statusBarLabel(true, run("starting")).text).toBe("$(sync~spin) Amicode · warming…");
+  });
+
+  it("once a cloud run finishes, its OUTCOME is the story — no lingering badge", () => {
+    // The badge answers "where is this running"; a finished run isn't running.
+    const { text } = statusBarLabel(true, run("completed", { fidelity: 0.9993, cloud: true }));
+    expect(text).toContain("0.9993");
+    expect(text).not.toContain("$(cloud)");
+  });
+});