@bongos/core 1.19.316 → 1.19.318

package/modules/lifecycle/publish-reconciler.js

@@ -804,12 +804,17 @@ async function runCostSweep(deps = {}) {
   if (typeof reconciler.reconcileSessionCosts !== 'function') return { skipped: 'unsupported' };
   try {
     const cost = await reconciler.reconcileSessionCosts();
-    if (cost && cost.reconciled > 0) {
+    // task 1003217: `raised` counts long sessions caught up as their digest grew.
+    // It is reported alongside `reconciled` — a sweep that only raised rows did
+    // real ledger work and must not log silence.
+    const raised = Number(cost && cost.raised) || 0;
+    if (cost && (cost.reconciled > 0 || raised > 0)) {
       const unk = cost.unknownModels && cost.unknownModels.length
         ? ` [unpriced→opus: ${cost.unknownModels.join(',')}]`
         : '';
+      const raisedNote = raised > 0 ? `, raised ${raised}` : '';
       logFn(
-        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
+        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled}${raisedNote} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
       );
     }
     return cost;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.316",
+  "version": "1.19.318",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.316",
+      "version": "1.19.318",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.316",
+  "version": "1.19.318",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/coreB-carve-proof.sh

@@ -50,6 +50,13 @@
 #   FULL_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # also run the full CI gate
 #   SKIP_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # legs 1-4 only (fast)
 
+# task 1003204 (goal 1000079): the lifecycle data layer is no longer one file —
+# modules/lifecycle/db.js is a re-export facade over twelve db-*.js units. Every
+# proof below that greps "the lifecycle db" must scan the FAMILY, or it silently
+# stops covering code that merely moved between units (and can even pass off a
+# doc-comment in the facade, which is exactly what happened before this fix).
+LIFECYCLE_DB="modules/lifecycle/db.js $(ls modules/lifecycle/db-*.js 2>/dev/null | tr '\n' ' ')"
+
 set -uo pipefail
 cd "$(dirname "$0")/../.."   # repo root (consistent with portability-smoke-*.sh)
 
@@ -191,10 +198,12 @@ grep -q "registerProvider('reward'" modules/economy/routes/reward.js 2>/dev/null
   && ok "economy registers the 'reward' provider at boot (modules/economy/routes/reward.js)" \
   || bad "economy does not registerProvider('reward')"
 # the lifecycle db slice carved to modules/lifecycle/db.js at R86 — it resolves the reward port there.
-if grep -q "resolveOptional('reward')" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in modules/lifecycle/db.js)"
+# task 1003204 split that slice into db.js + db-*.js, so scan the whole family: the
+# port call now lives in the unit that owns the transaction, not in the facade.
+if grep -q "resolveOptional('reward')" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in the lifecycle db family)"
 else
-  bad "the lifecycle does not resolve 'reward' via the seam in modules/lifecycle/db.js"
+  bad "the lifecycle does not resolve 'reward' via the seam in the modules/lifecycle db family"
 fi
 # no core file requires the moved economy files directly (llm-pricing stays core).
 if grep -rnE "require\(['\"][^'\"]*/(cost|streak|achievements|cost-summary-shape)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v module-api | grep -v 'modules/economy' | grep -qv llm-pricing; then
@@ -352,11 +361,11 @@ grep -q "registerProvider('onboarding'" modules/onboarding/routes/onboarding.js
   || bad "onboarding does not registerProvider('onboarding')"
 # the lifecycle's claim/ship carved to modules/lifecycle/db.js at R86 (it ticks the
 # onboarding stage there); core auth.js (the auth callbacks) stays and resolves it too.
-if grep -q "resolveOptional('onboarding')" modules/lifecycle/db.js 2>/dev/null \
+if grep -q "resolveOptional('onboarding')" $LIFECYCLE_DB 2>/dev/null \
    && grep -q "resolveOptional('onboarding')" src/bongos/auth.js 2>/dev/null; then
-  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in modules/lifecycle/db.js + core auth.js)"
+  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in the lifecycle db family + core auth.js)"
 else
-  bad "the lifecycle or core does not resolve 'onboarding' via the seam (modules/lifecycle/db.js + auth.js)"
+  bad "the lifecycle or core does not resolve 'onboarding' via the seam (lifecycle db family + auth.js)"
 fi
 # no core file requires a moved onboarding domain file directly. The match is
 # scoped to the moved domain basenames; the onboarding CLIs (setup/onboarding-
@@ -590,10 +599,10 @@ if grep -qE "^async function (claimTask|shipTask|createTask|resolveClaim)\b" src
 else
   ok "the lifecycle state-machine SQL left src/bongos/db.js — the residue is the kernel identity/auth/twin slice (ADR 0093 §3)"
 fi
-if grep -qE "async function (claimTask|shipTask|createTask)\b" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle state-machine SQL now lives in modules/lifecycle/db.js (claim/ship/createTask/…)"
+if grep -qE "async function (claimTask|shipTask|createTask)\b" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle state-machine SQL now lives in the modules/lifecycle db family (claim/ship/createTask/…)"
 else
-  bad "the lifecycle state-machine SQL not found in modules/lifecycle/db.js"
+  bad "the lifecycle state-machine SQL not found in the modules/lifecycle db family"
 fi
 # lifecycle registers the `lifecycle` port; core read routes + cascade-dispatch resolve it.
 grep -q "registerProvider('lifecycle'" modules/lifecycle/routes/lifecycle.js 2>/dev/null \

package/scripts/gds/fitness.js

@@ -971,8 +971,12 @@ const PROMPT_IDENTITY_LITERALS = [
 // 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
 // 401 that locked a builder out of re-authenticating — a valid token verified
 // against the wrong host — and nothing in CI could see it (idea 1000564).
-const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts/gds'];
-const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
+// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
+// founder DB default (task 1002755) survived every gate because the detector never
+// saw the file — a gate that cannot see the file class the bug lives in is worse
+// than no gate, because it is trusted.
+const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
+const IDENTITY_SCAN_EXTRA_FILES = [];
 // PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
 //
 // Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
@@ -1010,7 +1014,15 @@ const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
 //     units on that box invoke these by path. Re-pointing an instance's backups is
 //     deployment work, not a branding read. Their COUNT is still frozen here, so a
 //     NEW literal in any of them fails exactly like one in an unlisted file.
+//   * fitness.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
+//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
+//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     three passed pre-1002756 only by the old stripper's accidents (phantom
+//     blocks + regex-blindness); now they are seen and counted.
 const IDENTITY_SCAN_ALLOWED = {
+  'scripts/gds/fitness.js': 2,
+  'scripts/gds/package-core.js': 1,
+  'scripts/gds/seed-v3-tasks.js': 14,
   'scripts/gds/audit-replay.sh': 1,
   'scripts/gds/db-backup-nightly.sh': 1,
   'scripts/gds/db-backup-offsite.sh': 2,
@@ -1041,28 +1053,10 @@ const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
 // Directories with no authored source to gate.
 const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
 
-// Strip comments so a rationale comment naming the old brand never trips the scan.
-// The JS // strip is `://`-safe (keeps the char before `//` unless it's `:`), so a
-// hardcoded "https://amazonprimea.com" URL is NOT truncated and still gets caught.
-function stripCommentsForIdentity(text, ext) {
-  let t = String(text == null ? '' : text);
-  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
-  // Shell has no block comments, so it returns BEFORE the /* */ strip below (a
-  // `"$TMP"/*` glob would otherwise eat real code). Only FULL-LINE `#` comments
-  // (and the shebang) are stripped: cutting from an inline `#` would truncate
-  // `${v#p}` / `$#` lines and could hide a literal sitting after them.
-  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
-  t = t.replace(/\/\*[\s\S]*?\*\//g, ''); // block comments (js + css)
-  // Split on /\r?\n/, NOT '\n' (task 1002428). On a CRLF checkout the old split
-  // left a trailing \r on every line, and since `.` does not match \r the `.*$`
-  // in the line-comment pattern could never reach end-of-string — so NO line
-  // comment was stripped and every rationale comment naming the old brand was
-  // scanned as if it were code. That silently broke this function's whole
-  // contract ("a rationale comment naming the old brand never trips the scan")
-  // on Windows, and made the check disagree with Linux CI on the same tree.
-  if (ext === '.js') t = t.split(/\r?\n/).map((l) => l.replace(/(^|[^:])\/\/.*$/, '$1')).join('\n');
-  return t;
-}
+// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
+// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
+// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
+const { stripCommentsForIdentity } = require('./identity-strip');
 
 // Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
 // Returns violation strings. Exported for the "actually catches a re-hardcode" test.
@@ -1153,7 +1147,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/gds/** + kernel-prompt CLIs, minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
+    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
   };
 }
 
@@ -1798,8 +1792,22 @@ const GOAL_VOCAB_SURFACE = [
 // allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
 // the only thing that can regress here — a membership query reaching for the old
 // column — with no false positives to excuse.
+// task 1003204 (goal 1000079) split that 5k-line file into db.js (a re-export
+// facade) + twelve db-*.js units, so the membership SQL is no longer in db.js at
+// all. Enumerate the family from disk rather than naming one file: a line-scoped
+// scan costs nothing on the units that hold no membership SQL, and a future
+// re-carve cannot silently disarm the rule by moving the queries again.
+const LIFECYCLE_DB_FILES = (() => {
+  const dir = path.join(CORE_ROOT, 'modules', 'lifecycle');
+  try {
+    return fs.readdirSync(dir)
+      .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+      .sort()
+      .map((f) => `modules/lifecycle/${f}`);
+  } catch { return ['modules/lifecycle/db.js']; }
+})();
 const GOAL_VOCAB_LINE_SCOPED = [
-  { file: 'modules/lifecycle/db.js', mustMention: /goal_members/ },
+  ...LIFECYCLE_DB_FILES.map((file) => ({ file, mustMention: /goal_members/ })),
   // sso.js is the federation surface: only the lines that name the membership table
   // or its upsert are in scope, so the file's other server-to-server prose stays out.
   { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },

package/scripts/gds/identity-strip.js

@@ -0,0 +1,75 @@
+'use strict';
+// identity-strip.js — comment stripping for fitness.js Check 13 (the hardcoded-
+// identity gate), extracted in task 1002756. Strips comments so a rationale
+// comment naming the old brand never trips the scan, WITHOUT ever letting a
+// comment marker inside another construct change state.
+//
+// Per extension:
+//   .html — <!-- --> blocks removed.
+//   .sh   — FULL-LINE `#` comments (and the shebang) only: cutting from an inline
+//           `#` would truncate `${v#p}` / `$#` lines and could hide a literal
+//           sitting after them. Shell has no block comments, so no /* */ pass (a
+//           `"$TMP"/*` glob would otherwise eat real code).
+//   .css  — /* */ blocks removed (css has only block comments).
+//   .js   — a single character-level pass (task 1002756). The old two-regex
+//           approach (block strip THEN line strip) could be OPENED by a `/*`
+//           sitting inside a `//` line comment — provision.js's
+//           `// … import <dir>/*.caddy` paired with a real `*/` 330 lines later
+//           and silently deleted everything between from the scanned text,
+//           hiding a genuine hardcoded literal in that window. The scanner
+//           tracks string state (' " ` — literals INSIDE strings are what the
+//           gate exists to catch, so string bodies are PRESERVED), comment
+//           state, and regex-literal state (a `//` or `/*` inside /…/ is not a
+//           comment; regex bodies are preserved). CRLF-safe by construction
+//           (task 1002428): newlines pass through untouched, and block-comment
+//           newlines are kept so reported line numbers hold.
+const KEYWORDS_BEFORE_REGEX = new Set(['return', 'typeof', 'case', 'in', 'of', 'instanceof', 'new', 'delete', 'void', 'do', 'else', 'yield', 'await']);
+
+function stripCommentsForIdentity(text, ext) {
+  const t = String(text == null ? '' : text);
+  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
+  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
+  if (ext === '.css') return t.replace(/\/\*[\s\S]*?\*\//g, '');
+  let out = '';
+  const n = t.length;
+  let i = 0;
+  const regexCanFollow = () => {
+    const trimmed = out.replace(/[ \t]+$/, '');
+    if (trimmed === '' || /[\n(,=:[!&|?{};+\-*%~^<>]$/.test(trimmed)) return true;
+    const word = /[A-Za-z_$][\w$]*$/.exec(trimmed);
+    return !!(word && KEYWORDS_BEFORE_REGEX.has(word[0]));
+  };
+  while (i < n) {
+    const c = t[i], d = t[i + 1];
+    if (c === '/' && d === '/') { while (i < n && t[i] !== '\n') i++; continue; } // line comment
+    if (c === '/' && d === '*') { // block comment — keep newlines so line numbers hold
+      i += 2;
+      while (i < n && !(t[i] === '*' && t[i + 1] === '/')) { if (t[i] === '\n') out += '\n'; i++; }
+      i += 2; continue;
+    }
+    if (c === '\'' || c === '"' || c === '`') { // string — body PRESERVED (leaks live here)
+      const q = c; out += c; i++;
+      while (i < n && t[i] !== q) {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        out += t[i]; i++;
+      }
+      out += q; i++; continue;
+    }
+    if (c === '/' && regexCanFollow()) { // regex literal — body preserved, markers inert
+      out += '/'; i++;
+      let inClass = false;
+      while (i < n && (inClass || t[i] !== '/') && t[i] !== '\n') {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        if (t[i] === '[') inClass = true;
+        else if (t[i] === ']') inClass = false;
+        out += t[i]; i++;
+      }
+      if (t[i] === '/') { out += '/'; i++; }
+      continue;
+    }
+    out += c; i++;
+  }
+  return out;
+}
+
+module.exports = { stripCommentsForIdentity };

package/scripts/gds/provision.js

@@ -158,9 +158,11 @@ const CONFIG = {
   // on the control plane, where the token + the packaging tools live. UNSET
   // (default) = every step runs locally, byte-identical to today.
   remoteHost: process.env.PROVISION_REMOTE_HOST || null,
-  // The co-hosting box's checkout dir — the cwd for the remote migrate (its relative
-  // ./scripts/migrate.sh). Defaults to that box's shared checkout.
-  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || '/home/lars/amazonprimea',
+  // The co-hosting box's checkout dir — the remote migrate's cwd. NO baked-in default
+  // (task 1002756: the founder-pinned path was an identity leak, and a silent wrong
+  // cwd aims mutating SSH steps at a dir that may not exist); remote mode requires it
+  // explicitly (guarded at the makeExec call), local mode never reads it.
+  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || null,
   // ssh options for the control-plane → co-hosting hop. BatchMode so a missing key
   // fails fast (never hangs on a prompt); accept-new pins the host key on first
   // connect (the operator can pre-seed known_hosts for strict pinning).
@@ -2441,6 +2443,8 @@ async function main() {
   // local) for the box-mutating steps; controlExec is ALWAYS local — the token
   // step (Cloudflare DNS hook) + the standalone repo scaffold run on the control
   // plane where the token + packaging tools live (task 2065, ADR 0130).
+  // Remote mode needs an explicit checkout dir (task 1002756 — no founder default).
+  if (CONFIG.remoteHost && !CONFIG.remoteCwd) { console.error('PROVISION_REMOTE_HOST is set but PROVISION_REMOTE_CHECKOUT is not — name the co-hosting box\'s checkout dir (the old hardcoded default was removed, task 1002756).'); process.exit(2); }
   const exec = makeExec({ apply, remoteHost: CONFIG.remoteHost, remoteCwd: CONFIG.remoteCwd, sshOpts: CONFIG.sshOpts });
   const controlExec = makeExec({ apply });
   const deps = {

package/scripts/gds/run-unit-tests.js

@@ -104,7 +104,14 @@ const INTEGRATION = new Set([
   'government_board_membership_db',
   'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
-  'scouting_rollup_fanout', 'session_records', 'setup_smoke',
+  'scouting_rollup_fanout', 'session_records',
+  // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
+  // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a
+  // revisit predicate comparing cost_log.recorded_at to the digest upload. The
+  // DB-free siblings (session_records, session_cost) cover the transcript
+  // de-duplication half.
+  'session_cost_row_raise',
+  'setup_smoke',
   'status-probe',
 ]);
 

package/scripts/gds/session-cost.js

@@ -146,9 +146,19 @@ function roundTiers(t) {
 }
 
 // Sum usage per model across the transcript, then price each model's total.
+//
+// task 1003217 — usage is deduped by `message.id`. Claude Code writes one
+// transcript line per content block of an assistant message (thinking / text /
+// tool_use) and repeats the SAME `message.usage` on every one of them, so
+// summing per line priced a single API call two or three times (measured 2.22x
+// inflation over 12 real transcripts). The evidence — including the cache-chain
+// identity that proves a line-group is one call — is written up above
+// buildSessionDigest in ./session-digest-build.js. A transcript whose messages
+// carry no `id` degrades to the old per-line behaviour.
 function priceTranscript(transcriptPath) {
   const raw = fs.readFileSync(transcriptPath, 'utf8');
   const perModel = new Map(); // model -> {input, output, read, c5, c1h}
+  const seenMessageIds = new Set();
   for (const line of raw.split('\n')) {
     if (!line.trim()) continue;
     let o;
@@ -159,6 +169,12 @@ function priceTranscript(transcriptPath) {
     // generated messages (compaction, interrupts) — no real API call, usage is
     // a zero placeholder. Pricing them would mislabel them as an unknown model.
     if (!usage || !msg.model || msg.model === '<synthetic>') continue;
+    // One API call, many lines — price it once (task 1003217).
+    const msgId = typeof msg.id === 'string' && msg.id ? msg.id : null;
+    if (msgId !== null) {
+      if (seenMessageIds.has(msgId)) continue;
+      seenMessageIds.add(msgId);
+    }
     const m = perModel.get(msg.model) || { input: 0, output: 0, read: 0, c5: 0, c1h: 0 };
     m.input += Number(usage.input_tokens) || 0;
     m.output += Number(usage.output_tokens) || 0;

package/scripts/gds/session-digest-build.js

@@ -0,0 +1,261 @@
+// scripts/gds/session-digest-build.js — the PURE transcript→digest builder.
+//
+// Extracted from scripts/gds/ship.js (task 1003217, serving the de-monolith goal
+// of task 1003203: nothing over 1,500 lines). ship.js was 4,646 lines and this
+// block — snippetOf + buildSessionDigest and their two constants — is pure,
+// separately tested, and shared: ship.js uploads a digest mid-ship and
+// session-digest.js uploads the final one on the SessionEnd seam.
+//
+// It has NO dependency on ship.js, which is what makes the split safe: ship.js
+// imports and re-exports this, so its public surface (and tests/session_records.mjs)
+// is unchanged, and the existing session-digest.js -> ship.js import cannot become
+// a cycle.
+//
+// NB the prose above deliberately says "imports", not the r-e-q-u-i-r-e call
+// spelled with './ship' — the fitness require-graph (scripts/gds/fitness-ratchets.js
+// requireGraph) scans raw file text and does NOT strip comments, so naming that
+// call here invented a phantom session-digest-build <-> ship cycle and tripped the
+// require_cycle_count ratchet. Same trap the curated-set parser in run-unit-tests.js
+// warns about for quoted words in ITS comments.
+//
+// The transcript-grade secret scrubber + its ADR-0022 internals live in
+// modules/security/secret-scrub.js — extracted (task 1211 / GDS-V4 R72) so the
+// public-mirror export pipeline can reuse the ONE copy of the secret shapes
+// without requiring ship.js (whose grader / Discord / sound / session deps are
+// absent in a bare CI job). See that module for the recall-first design (a missed
+// secret is a compromise; over-redaction is cosmetic).
+const { scrubSecrets } = require('../../modules/security/secret-scrub');
+
+// snippetOf — short, single-line, scrubbed excerpt for footgun context.
+function snippetOf(text, extraSecrets, max = 160) {
+  if (typeof text !== 'string' || text.length === 0) return undefined;
+  // Drop NULs first: Postgres rejects a literal NUL in jsonb, so ONE of them anywhere in
+  // ONE snippet made the whole digest unstorable — POST /sessions answered 500 and
+  // the session never paid. UTF-16LE tool output (`wsl --list` is the observed
+  // case) is full of them, and \s below does NOT match NUL, so it must go here.
+  const flat = text.replace(/\0/g, '').replace(/\s+/g, ' ').trim();
+  if (!flat) return undefined;
+  const cut = flat.length > max ? flat.slice(0, max) : flat;
+  const scrubbed = scrubSecrets(cut, extraSecrets);
+  return scrubbed || undefined;
+}
+
+// buildSessionDigest — turn parsed Claude Code transcript entries into
+// { startedAt, endedAt, durationSeconds, totalTokens, metrics, detail }.
+// Pure (no I/O) + exported for unit tests. `detail` is per-turn metadata + short
+// scrubbed snippets, capped at maxTurns (head+tail kept when over).
+// Harness guardrail retries (task 959) — an is_error tool_result that is NOT real
+// friction but the agent harness rejecting a tool call: an Edit/Write before the
+// file was Read ("File has not been read yet"), or a foreground sleep ("Blocked:
+// sleep"). These were counted in tool_error_count, inflating it and skewing the
+// BFG's order=tool_errors ranking (top sessions ranked on benign retries). They
+// now go into a separate harness_retry_count so tool_error_count stays NET — and
+// because the sessions/search ordering reads metrics->>'tool_error_count'
+// (src/bongos/db.js), that ordering automatically uses the net figure with no route
+// change. (ADR 0027 lineage — the 6D session evaluator.)
+const HARNESS_RETRY_RE =
+  /File has not been read yet|Read it first before (?:writing|editing)|Blocked:\s*sleep|sleep is blocked in (?:the )?foreground/i;
+
+// task 1676 — the family bucket unlabeled token-bearing turns are folded into so
+// the cost-plus reward (ADR 0054) prices the real spend instead of rounding to $0.
+// A concrete, priceable model id (llm-pricing.js maps it to the opus family by
+// substring) — NOT a fabricated dollar figure; it carries the REAL token counts
+// ship.js already parsed, priced server-side like any other bucket.
+const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
+
+// task 1003217 — ONE API CALL IS MANY TRANSCRIPT LINES.
+//
+// Claude Code writes a separate transcript line per content block of a single
+// assistant message (thinking / text / tool_use), and EVERY one of those lines
+// repeats the SAME `message.usage` object. Summing usage per line therefore
+// counted one API call's tokens two or three times: measured 2.22x inflation
+// across 12 real transcripts in this project (2,357 usage-bearing lines,
+// naive cache_read 551,095,738 vs deduped 248,555,962).
+//
+// `message.id` is the API call's identity — the usage tuples are byte-identical
+// across lines sharing an id. The proof that a line-GROUP is one call is the
+// cache chain: cache_read[n] == cache_read[n-1] + cache_creation[n-1] closes on
+// 99.1% of links after de-duplication (the residue is compaction boundaries)
+// and holds for none of them before it.
+//
+// This mattered because ADR 0054 pays round(true_cost_usd x 1.20) from these
+// very numbers, so the inflation flowed into cost-plus rewards.
+//
+// `assistant_turns` is deliberately left as the LINE count (existing consumers
+// order on it); `api_calls` is the new honest step count. A transcript whose
+// messages carry no `id` degrades to exactly the old behaviour.
+function buildSessionDigest(entries, opts = {}) {
+  const extra = opts.extraSecrets || [];
+  const MAX_TURNS = opts.maxTurns || 4000;
+  const seenMessageIds = new Set();
+  const m = {
+    assistant_turns: 0,
+    api_calls: 0, // distinct message.id — the real number of API round-trips
+    user_turns: 0,
+    tool_use_count: 0,
+    tool_result_count: 0,
+    tool_error_count: 0, // NET real errors (harness guardrail retries excluded)
+    harness_retry_count: 0, // benign harness guardrail retries (task 959)
+    tokens: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
+    model_usage: {}, // per-model token buckets for the cost-plus reward (task 1005)
+    // task 1676: tokens from turns with NO model id (not '<synthetic>'). Folded
+    // into a priceable bucket after the loop, then stripped from the digest.
+    _unlabeled: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
+  };
+  const detail = [];
+  let firstTs = null;
+  let lastTs = null;
+  let i = 0;
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!e || typeof e !== 'object') continue;
+    const ts = typeof e.timestamp === 'string' ? e.timestamp : null;
+    if (ts) {
+      if (!firstTs) firstTs = ts;
+      lastTs = ts;
+    }
+    const msg = e.message;
+    if (e.type === 'assistant' && msg) {
+      m.assistant_turns++;
+      // Dedup usage per API call (see the note above buildSessionDigest). A
+      // repeat line contributes ZERO tokens but still gets its detail row, so
+      // the per-turn record stays faithful and summing detail stays correct.
+      const msgId = typeof msg.id === 'string' && msg.id ? msg.id : null;
+      const dupUsage = msgId !== null && seenMessageIds.has(msgId);
+      if (msgId !== null) seenMessageIds.add(msgId);
+      if (!dupUsage) m.api_calls++;
+      const u = dupUsage ? {} : (msg.usage || {});
+      const tin = u.input_tokens || 0;
+      const tout = u.output_tokens || 0;
+      const tcr = u.cache_read_input_tokens || 0;
+      const tcc = u.cache_creation_input_tokens || 0;
+      m.tokens.input += tin;
+      m.tokens.output += tout;
+      m.tokens.cache_read += tcr;
+      m.tokens.cache_creation += tcc;
+      // task 1005: per-model bucket for the cost-plus token reward, reusing the
+      // tin/tout/tcr/tcc already parsed above (no second pass). Skip synthetic
+      // turns (a grader 429 etc. emits no real model id AND no real spend).
+      const model = msg.model;
+      if (model === '<synthetic>') {
+        // synthetic: no real spend — exclude from BOTH model_usage and the
+        // task-1676 unlabeled-remainder fold below (don't price phantom tokens).
+      } else if (model) {
+        const mu = m.model_usage[model] || (m.model_usage[model] =
+          { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
+        mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
+      } else {
+        // task 1676: a token-bearing turn with NO model id. Previously dropped
+        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
+        // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
+        // attribute them to a real, priceable family bucket after the loop.
+        m._unlabeled.input += tin; m._unlabeled.output += tout;
+        m._unlabeled.cache_read += tcr; m._unlabeled.cache_creation += tcc;
+      }
+      const tools = [];
+      let textLen = 0;
+      let firstText = '';
+      if (Array.isArray(msg.content)) {
+        for (const c of msg.content) {
+          if (c && c.type === 'tool_use') {
+            m.tool_use_count++;
+            tools.push(String(c.name || '?'));
+          } else if (c && c.type === 'text' && typeof c.text === 'string') {
+            textLen += c.text.length;
+            if (!firstText) firstText = c.text;
+          }
+        }
+      }
+      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
+      // Marks a line that shares its API call with an earlier one, so a reader
+      // can tell a genuinely-zero-usage turn from a de-duplicated repeat.
+      if (dupUsage) row.dup = 1;
+      if (tools.length) row.tools = tools;
+      if (textLen) row.text_len = textLen;
+      const snip = snippetOf(firstText, extra);
+      if (snip) row.snippet = snip;
+      detail.push(row);
+      i++;
+    } else if (e.type === 'user' && msg) {
+      m.user_turns++;
+      let results = 0;
+      let errors = 0;
+      let harnessRetries = 0;
+      let firstResult = '';
+      if (Array.isArray(msg.content)) {
+        for (const c of msg.content) {
+          if (c && c.type === 'tool_result') {
+            results++;
+            m.tool_result_count++;
+            const text = typeof c.content === 'string'
+              ? c.content
+              : Array.isArray(c.content)
+                ? c.content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join(' ')
+                : '';
+            if (c.is_error) {
+              // Split benign harness guardrail retries out of the net error count
+              // so order=tool_errors ranks on real friction (task 959).
+              if (HARNESS_RETRY_RE.test(text)) {
+                harnessRetries++;
+                m.harness_retry_count++;
+              } else {
+                errors++;
+                m.tool_error_count++;
+              }
+            }
+            if (!firstResult) firstResult = text;
+          }
+        }
+      }
+      const row = { i, role: 'user', ts };
+      if (results) row.tool_results = results;
+      if (errors) row.tool_errors = errors;
+      if (harnessRetries) row.harness_retries = harnessRetries;
+      const snip = snippetOf(firstResult, extra);
+      if (snip) row.snippet = snip;
+      detail.push(row);
+      i++;
+    }
+  }
+  m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
+  // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
+  // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
+  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
+  // agent path that gap was the difference between total_tokens>0 (so the digest
+  // passes the route's empty-session guard + gets stored) and model_usage={} (so
+  // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model
+  // usage" symptom. Fold the unlabeled remainder (NOT synthetic turns) into a real,
+  // priceable family bucket so the cost-plus reward reflects the true spend rather
+  // than silently dropping to $0. opus is the conservative family for an unlabeled
+  // turn (matches llm-pricing.js's unknown-model fallback) — this instance runs
+  // opus by default, and pricing an unlabeled turn as opus never UNDER-pays.
+  const un = m._unlabeled;
+  if (un.input + un.output + un.cache_read + un.cache_creation > 0) {
+    const fb = m.model_usage[UNATTRIBUTED_MODEL] || (m.model_usage[UNATTRIBUTED_MODEL] =
+      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
+    fb.input += un.input; fb.output += un.output;
+    fb.cache_read += un.cache_read; fb.cache_creation += un.cache_creation;
+  }
+  delete m._unlabeled; // scratch — never persisted to the digest
+  let boundedDetail = detail;
+  if (detail.length > MAX_TURNS) {
+    const head = Math.floor(MAX_TURNS * 0.7);
+    const tail = MAX_TURNS - head;
+    boundedDetail = detail.slice(0, head).concat(detail.slice(detail.length - tail));
+    m.detail_truncated = true;
+    m.detail_total_turns = detail.length;
+  }
+  let durationSeconds = null;
+  if (firstTs && lastTs) {
+    const d = (Date.parse(lastTs) - Date.parse(firstTs)) / 1000;
+    if (Number.isFinite(d) && d >= 0) durationSeconds = Math.round(d);
+  }
+  return {
+    startedAt: firstTs,
+    endedAt: lastTs,
+    durationSeconds,
+    totalTokens: m.total_tokens,
+    metrics: m,
+    detail: boundedDetail,
+  };
+}
+module.exports = { snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL };