@@ -119,6 +119,7 @@ func TestEveryServedMethodIsGuarded(t *testing.T) {
 		rpc.MethodCreate, rpc.MethodFork, rpc.MethodPromote, rpc.MethodKill,
 		rpc.MethodList, rpc.MethodAttach, rpc.MethodBind, rpc.MethodResolve,
 		rpc.MethodUnbind, rpc.MethodStatus, rpc.MethodSaveBindings, rpc.MethodAriaRead,
+		rpc.MethodProviderLedger,
 	} {
 		if hs.Map[m] == nil {
 			t.Fatalf("method %s missing from the guarded map", m)
 
@@ -0,0 +1,118 @@
+package angelus
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/jack-work/figaro/internal/rpc"
+	"github.com/jack-work/figaro/internal/wirelog"
+)
+
+// The ledger is only worth having if it survives the trip to the CLI. This
+// drives a real refused round-trip through the real transport and reads it
+// back through the handler, because that is the path an operator uses at
+// three in the morning.
+func TestProviderLedgerHandlerReportsARefusal(t *testing.T) {
+	wirelog.ResizeLedger(64)
+	t.Cleanup(func() { wirelog.ResizeLedger(256) })
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Retry-After", "3600")
+		w.Header().Set("request-id", "req_quota")
+		w.Header().Set("anthropic-ratelimit-input-tokens-reset", "2026-08-14T20:00:00Z")
+		w.WriteHeader(http.StatusTooManyRequests)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: &wirelog.Transport{Inner: http.DefaultTransport}}
+	req, err := http.NewRequestWithContext(
+		wirelog.WithAria(context.Background(), "94f0752b"),
+		http.MethodPost, srv.URL, strings.NewReader("{}"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	h := &handlers{}
+	params, _ := json.Marshal(rpc.ProviderLedgerRequest{Aria: "94f0752b"})
+	out, err := h.providerLedger(context.Background(), params)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := out.(rpc.ProviderLedgerResponse)
+	if !ok {
+		t.Fatalf("unexpected response type %T", out)
+	}
+	if len(got.Rounds) != 1 {
+		t.Fatalf("want 1 round for the aria, got %d", len(got.Rounds))
+	}
+	r := got.Rounds[0]
+	if r.Status != http.StatusTooManyRequests {
+		t.Errorf("status = %d", r.Status)
+	}
+	if r.RetryAfterS != 3600 {
+		t.Errorf("retry_after_s = %d; this is the field the whole feature exists for", r.RetryAfterS)
+	}
+	if r.RequestID != "req_quota" {
+		t.Errorf("request_id = %q", r.RequestID)
+	}
+	if r.StartedAtMS == 0 {
+		t.Error("started_at_ms not carried to the wire")
+	}
+	if r.RateLimit["input-tokens-reset"] != "2026-08-14T20:00:00Z" {
+		t.Errorf("ratelimit headers lost: %v", r.RateLimit)
+	}
+}
+
+// The aria filter has to actually filter, or "why is 94f0752b stuck" comes
+// back as the whole daemon's traffic.
+func TestProviderLedgerFiltersByAriaAndLimit(t *testing.T) {
+	wirelog.ResizeLedger(64)
+	t.Cleanup(func() { wirelog.ResizeLedger(256) })
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: &wirelog.Transport{Inner: http.DefaultTransport}}
+	for _, aria := range []string{"aaaa1111", "bbbb2222", "aaaa1111", "aaaa1111"} {
+		req, _ := http.NewRequest(http.MethodGet, srv.URL, nil)
+		req = req.WithContext(wirelog.WithAria(req.Context(), aria))
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+	}
+
+	h := &handlers{}
+	params, _ := json.Marshal(rpc.ProviderLedgerRequest{Aria: "aaaa1111"})
+	out, _ := h.providerLedger(context.Background(), params)
+	got := out.(rpc.ProviderLedgerResponse)
+	if len(got.Rounds) != 3 {
+		t.Fatalf("aria filter returned %d rounds, want 3", len(got.Rounds))
+	}
+	if got.Retained != 4 {
+		t.Errorf("retained = %d, want 4 - the caller must be able to tell a filter from an empty ring", got.Retained)
+	}
+
+	params, _ = json.Marshal(rpc.ProviderLedgerRequest{Aria: "aaaa1111", Limit: 2})
+	out, _ = h.providerLedger(context.Background(), params)
+	got = out.(rpc.ProviderLedgerResponse)
+	if len(got.Rounds) != 2 {
+		t.Fatalf("limit ignored: %d rounds", len(got.Rounds))
+	}
+	// Newest last: a limit takes the tail, not the head.
+	if got.Rounds[0].Seq >= got.Rounds[1].Seq {
+		t.Error("rounds must come back oldest-first")
+	}
+}
@@ -876,7 +876,7 @@ slot, so a lone positional is then the aria. With no figaro available
 first: if the casting then fails, that partial is spelled out.
 
 ATTENDING A FORM, with no arguments at all, mints a figaro for it and
-casts it: the other entrance to `+"`figaro new -C`"+`, the same operation from
+casts it: the other entrance to ` + "`figaro new -C`" + `, the same operation from
 the other end. There, -O/-S dress the ARIA, because the form already
 exists; attending an ARIA they mint the ROLE, for the same reason.
 
@@ -1471,15 +1471,18 @@ flow writes both through the daemon, so a client never has to know the path.`,
 	r.Register(&cmdkit.Command{
 		Name:  "doctor",
 		Group: "System",
-		Short: "Store maintenance: gc removes dead channels; schema reports channel versions; mem reports the daemon's footprint; librettos recounts derived-form observers; skills lists what the binary ships",
-		Usage: "doctor <gc [--dry-run] | schema | term | mem [-j] | librettos [--dry-run] | skills [-j]>",
+		Short: "Store and provider health: gc removes dead channels; schema reports channel versions; mem reports the daemon's footprint; provider shows recent provider round-trips (including in-flight); librettos recounts derived-form observers; skills lists what the binary ships",
+		Usage: "doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | skills [-j]>",
 		Flags: []cmdkit.FlagDef{
 			{Long: "dry-run", Short: "n", IsBool: true, Description: "Report what would be removed without touching the store"},
-			{Long: "json", Short: "j", IsBool: true, Description: "Machine-readable output (mem)"},
+			{Long: "json", Short: "j", IsBool: true, Description: "Machine-readable output (mem, provider)"},
+			{Long: "id", Description: "Restrict to one aria (provider)"},
+			// -n is already dry-run on this command, so count takes -c.
+			{Long: "count", Short: "c", Description: "How many rows to show (provider); default 20"},
 		},
 		Run: func(ctx *cmdkit.RunContext) error {
 			if len(ctx.Args) != 1 {
-				return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | librettos [--dry-run] | skills [-j]>")
+				return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | skills [-j]>")
 			}
 			switch ctx.Args[0] {
 			case "gc":
@@ -1490,12 +1493,14 @@ flow writes both through the daemon, so a client never has to know the path.`,
 				return runDoctorTerm()
 			case "mem":
 				return runDoctorMem(ctx.BoolFlag("json"))
+			case "provider":
+				return runDoctorProvider(ctx.Flag("id"), ctx.Flag("count"), ctx.BoolFlag("json"))
 			case "librettos":
 				return runDoctorLibrettos(ctx.BoolFlag("dry-run"))
 			case "skills":
 				return runDoctorSkills(ctx.BoolFlag("json"))
 			}
-			return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | librettos [--dry-run] | skills [-j]>")
+			return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | skills [-j]>")
 		},
 	})
 
 
@@ -0,0 +1,171 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/jack-work/figaro/internal/angelus"
+	"github.com/jack-work/figaro/internal/rpc"
+	"github.com/jack-work/figaro/internal/transport"
+)
+
+// runDoctorProvider answers the question no figaro surface could answer:
+// "this aria is not responding - what is the provider actually doing?"
+//
+// `status` said idle. `queue` was empty. The log said nothing. The trace file
+// had the answer - a 429 with an hour-long Retry-After - but only for turns
+// that had already ended, because spans export on end, and only to someone
+// willing to write a JSON scanner. Meanwhile the request that was STILL
+// hanging appeared nowhere at all.
+//
+// This reads the transport's own ring: rows are written at departure and
+// completed in place, so an in-flight request is visible while it is the
+// problem rather than after it is history.
+func runDoctorProvider(ariaID, count string, asJSON bool) error {
+	limit := 20
+	if count != "" {
+		n, err := strconv.Atoi(count)
+		if err != nil || n < 0 {
+			return fmt.Errorf("-n takes a count, got %q", count)
+		}
+		limit = n
+	}
+
+	cli, err := angelus.DialClient(transport.UnixEndpoint(angelusSocketPath()))
+	if err != nil {
+		return fmt.Errorf("no angelus running: %w", err)
+	}
+	defer cli.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	resp, err := cli.ProviderLedger(ctx, ariaID, limit)
+	if err != nil {
+		return fmt.Errorf("the running angelus cannot report provider round-trips; `figaro stop` and retry: %w", err)
+	}
+
+	if asJSON {
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(resp)
+	}
+
+	if len(resp.Rounds) == 0 {
+		if resp.Retained == 0 {
+			fmt.Println("no provider round-trips recorded yet")
+		} else {
+			fmt.Printf("no round-trips for that filter (%d retained overall)\n", resp.Retained)
+		}
+		return nil
+	}
+
+	fmt.Printf("%-12s %-9s %-6s %-9s %-9s %-8s %s\n",
+		"time", "aria", "status", "duration", "req", "retry", "endpoint")
+	for _, r := range resp.Rounds {
+		when := time.UnixMilli(r.StartedAtMS).Format("15:04:05.000")
+		aria := r.Aria
+		if aria == "" {
+			aria = "-"
+		}
+
+		status, dur := "…", "in flight"
+		if !r.InFlight {
+			status = strconv.Itoa(r.Status)
+			if r.Status == 0 {
+				status = "err"
+			}
+			dur = humanMillis(r.DurationMS)
+		} else {
+			// An in-flight row's age is the number that matters: a request
+			// out for four minutes is the story.
+			dur = "in flight " + humanMillis(time.Since(time.UnixMilli(r.StartedAtMS)).Milliseconds())
+		}
+
+		retry := "-"
+		if r.RetryAfterS > 0 {
+			retry = (time.Duration(r.RetryAfterS) * time.Second).String()
+		}
+
+		fmt.Printf("%-12s %-9s %-6s %-9s %-9s %-8s %s\n",
+			when, aria, status, dur, humanBytes(r.ReqBytes), retry, shortEndpoint(r.URL))
+	}
+
+	summarizeProviderTrouble(resp.Rounds)
+	return nil
+}
+
+// summarizeProviderTrouble names the diagnosis rather than leaving it in the
+// table. The table is evidence; an operator wants the verdict.
+func summarizeProviderTrouble(rounds []rpc.ProviderRound) {
+	var refused, inFlight int
+	var worstRetry int64
+	var reset string
+	for _, r := range rounds {
+		if r.InFlight {
+			inFlight++
+		}
+		if r.Status == 429 || r.Status == 529 {
+			refused++
+			if r.RetryAfterS > worstRetry {
+				worstRetry = r.RetryAfterS
+			}
+			for _, k := range sortedRateLimitKeys(r.RateLimit) {
+				if strings.Contains(k, "reset") && reset == "" {
+					reset = r.RateLimit[k]
+				}
+			}
+		}
+	}
+	if refused == 0 && inFlight == 0 {
+		return
+	}
+	fmt.Println()
+	if refused > 0 {
+		fmt.Printf("%d of %d round-trips were refused for quota.\n", refused, len(rounds))
+		if worstRetry > 0 {
+			fmt.Printf("the provider asked for up to %s; a wait that long is a usage window,\n",
+				(time.Duration(worstRetry) * time.Second).String())
+			fmt.Println("not a throttle, and no amount of retrying will shorten it.")
+		}
+		if reset != "" {
+			fmt.Printf("limit resets %s\n", reset)
+		}
+	}
+	if inFlight > 0 {
+		fmt.Printf("%d request(s) still in flight.\n", inFlight)
+	}
+}
+
+func sortedRateLimitKeys(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func humanMillis(ms int64) string {
+	if ms < 1000 {
+		return fmt.Sprintf("%dms", ms)
+	}
+	return (time.Duration(ms) * time.Millisecond).Round(100 * time.Millisecond).String()
+}
+
+// shortEndpoint keeps the part of a URL that distinguishes one call from
+// another; the host repeats on every row and earns no column.
+func shortEndpoint(raw string) string {
+	if i := strings.Index(raw, "://"); i >= 0 {
+		raw = raw[i+3:]
+	}
+	if i := strings.Index(raw, "/"); i >= 0 {
+		return raw[i:]
+	}
+	return raw
+}