Record Model

tools/rooster_worker/drain.py calls this once per build attempt, just before it starts the builder subprocess, to say which model that attempt runs on. Frederick, 2026-10-06: builders run on the cheapest model that builds and escalate to a stronger one after a failed attempt -- so the split has to be visible afterwards (GET /api/system/seat-usage's builds_by_model_last_7_days), or "did Sonnet land it or did it take an Opus retry" is unanswerable.

Bookkeeping, never a gate: it stamps the open seat_build_sessions row (seat_usage.record_model), spends no attempt, moves no status, and NEVER 404s -- an issue with no open session (a human re-claim, a session already closed) comes back recorded: false, which the drain ignores. Ruling: docs/01_decisions/rulings/2026-10-06-cheap-builders-strong-reviewers.md.