@bongos/core 1.19.316 → 1.19.318

package/scripts/gds/ship.js

@@ -386,205 +386,14 @@ const {
   redactHighEntropy, collectEnvSecrets,
 } = require('../../modules/security/secret-scrub');
 
-// snippetOf — short, single-line, scrubbed excerpt for footgun context.
-function snippetOf(text, extraSecrets, max = 160) {
-  if (typeof text !== 'string' || text.length === 0) return undefined;
-  // Drop NULs first: Postgres rejects a literal NUL in jsonb, so ONE of them anywhere in
-  // ONE snippet made the whole digest unstorable — POST /sessions answered 500 and
-  // the session never paid. UTF-16LE tool output (`wsl --list` is the observed
-  // case) is full of them, and \s below does NOT match NUL, so it must go here.
-  const flat = text.replace(/\0/g, '').replace(/\s+/g, ' ').trim();
-  if (!flat) return undefined;
-  const cut = flat.length > max ? flat.slice(0, max) : flat;
-  const scrubbed = scrubSecrets(cut, extraSecrets);
-  return scrubbed || undefined;
-}
+// snippetOf + buildSessionDigest moved to ./session-digest-build (task 1003217,
+// serving the de-monolith goal of task 1003203) — pure, separately tested, and
+// shared with session-digest.js. Re-exported below so this file's public surface
+// and tests/session_records.mjs are unchanged.
+const {
+  snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL,
+} = require('./session-digest-build');
 
-// buildSessionDigest — turn parsed Claude Code transcript entries into
-// { startedAt, endedAt, durationSeconds, totalTokens, metrics, detail }.
-// Pure (no I/O) + exported for unit tests. `detail` is per-turn metadata + short
-// scrubbed snippets, capped at maxTurns (head+tail kept when over).
-// Harness guardrail retries (task 959) — an is_error tool_result that is NOT real
-// friction but the agent harness rejecting a tool call: an Edit/Write before the
-// file was Read ("File has not been read yet"), or a foreground sleep ("Blocked:
-// sleep"). These were counted in tool_error_count, inflating it and skewing the
-// BFG's order=tool_errors ranking (top sessions ranked on benign retries). They
-// now go into a separate harness_retry_count so tool_error_count stays NET — and
-// because the sessions/search ordering reads metrics->>'tool_error_count'
-// (src/bongos/db.js), that ordering automatically uses the net figure with no route
-// change. (ADR 0027 lineage — the 6D session evaluator.)
-const HARNESS_RETRY_RE =
-  /File has not been read yet|Read it first before (?:writing|editing)|Blocked:\s*sleep|sleep is blocked in (?:the )?foreground/i;
-
-// task 1676 — the family bucket unlabeled token-bearing turns are folded into so
-// the cost-plus reward (ADR 0054) prices the real spend instead of rounding to $0.
-// A concrete, priceable model id (llm-pricing.js maps it to the opus family by
-// substring) — NOT a fabricated dollar figure; it carries the REAL token counts
-// ship.js already parsed, priced server-side like any other bucket.
-const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
-
-function buildSessionDigest(entries, opts = {}) {
-  const extra = opts.extraSecrets || [];
-  const MAX_TURNS = opts.maxTurns || 4000;
-  const m = {
-    assistant_turns: 0,
-    user_turns: 0,
-    tool_use_count: 0,
-    tool_result_count: 0,
-    tool_error_count: 0, // NET real errors (harness guardrail retries excluded)
-    harness_retry_count: 0, // benign harness guardrail retries (task 959)
-    tokens: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-    model_usage: {}, // per-model token buckets for the cost-plus reward (task 1005)
-    // task 1676: tokens from turns with NO model id (not '<synthetic>'). Folded
-    // into a priceable bucket after the loop, then stripped from the digest.
-    _unlabeled: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-  };
-  const detail = [];
-  let firstTs = null;
-  let lastTs = null;
-  let i = 0;
-  for (const e of Array.isArray(entries) ? entries : []) {
-    if (!e || typeof e !== 'object') continue;
-    const ts = typeof e.timestamp === 'string' ? e.timestamp : null;
-    if (ts) {
-      if (!firstTs) firstTs = ts;
-      lastTs = ts;
-    }
-    const msg = e.message;
-    if (e.type === 'assistant' && msg) {
-      m.assistant_turns++;
-      const u = msg.usage || {};
-      const tin = u.input_tokens || 0;
-      const tout = u.output_tokens || 0;
-      const tcr = u.cache_read_input_tokens || 0;
-      const tcc = u.cache_creation_input_tokens || 0;
-      m.tokens.input += tin;
-      m.tokens.output += tout;
-      m.tokens.cache_read += tcr;
-      m.tokens.cache_creation += tcc;
-      // task 1005: per-model bucket for the cost-plus token reward, reusing the
-      // tin/tout/tcr/tcc already parsed above (no second pass). Skip synthetic
-      // turns (a grader 429 etc. emits no real model id AND no real spend).
-      const model = msg.model;
-      if (model === '<synthetic>') {
-        // synthetic: no real spend — exclude from BOTH model_usage and the
-        // task-1676 unlabeled-remainder fold below (don't price phantom tokens).
-      } else if (model) {
-        const mu = m.model_usage[model] || (m.model_usage[model] =
-          { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-        mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
-      } else {
-        // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
-        // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
-        // attribute them to a real, priceable family bucket after the loop.
-        m._unlabeled.input += tin; m._unlabeled.output += tout;
-        m._unlabeled.cache_read += tcr; m._unlabeled.cache_creation += tcc;
-      }
-      const tools = [];
-      let textLen = 0;
-      let firstText = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_use') {
-            m.tool_use_count++;
-            tools.push(String(c.name || '?'));
-          } else if (c && c.type === 'text' && typeof c.text === 'string') {
-            textLen += c.text.length;
-            if (!firstText) firstText = c.text;
-          }
-        }
-      }
-      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
-      if (tools.length) row.tools = tools;
-      if (textLen) row.text_len = textLen;
-      const snip = snippetOf(firstText, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    } else if (e.type === 'user' && msg) {
-      m.user_turns++;
-      let results = 0;
-      let errors = 0;
-      let harnessRetries = 0;
-      let firstResult = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_result') {
-            results++;
-            m.tool_result_count++;
-            const text = typeof c.content === 'string'
-              ? c.content
-              : Array.isArray(c.content)
-                ? c.content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join(' ')
-                : '';
-            if (c.is_error) {
-              // Split benign harness guardrail retries out of the net error count
-              // so order=tool_errors ranks on real friction (task 959).
-              if (HARNESS_RETRY_RE.test(text)) {
-                harnessRetries++;
-                m.harness_retry_count++;
-              } else {
-                errors++;
-                m.tool_error_count++;
-              }
-            }
-            if (!firstResult) firstResult = text;
-          }
-        }
-      }
-      const row = { i, role: 'user', ts };
-      if (results) row.tool_results = results;
-      if (errors) row.tool_errors = errors;
-      if (harnessRetries) row.harness_retries = harnessRetries;
-      const snip = snippetOf(firstResult, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    }
-  }
-  m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
-  // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
-  // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
-  // agent path that gap was the difference between total_tokens>0 (so the digest
-  // passes the route's empty-session guard + gets stored) and model_usage={} (so
-  // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model
-  // usage" symptom. Fold the unlabeled remainder (NOT synthetic turns) into a real,
-  // priceable family bucket so the cost-plus reward reflects the true spend rather
-  // than silently dropping to $0. opus is the conservative family for an unlabeled
-  // turn (matches llm-pricing.js's unknown-model fallback) — this instance runs
-  // opus by default, and pricing an unlabeled turn as opus never UNDER-pays.
-  const un = m._unlabeled;
-  if (un.input + un.output + un.cache_read + un.cache_creation > 0) {
-    const fb = m.model_usage[UNATTRIBUTED_MODEL] || (m.model_usage[UNATTRIBUTED_MODEL] =
-      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-    fb.input += un.input; fb.output += un.output;
-    fb.cache_read += un.cache_read; fb.cache_creation += un.cache_creation;
-  }
-  delete m._unlabeled; // scratch — never persisted to the digest
-  let boundedDetail = detail;
-  if (detail.length > MAX_TURNS) {
-    const head = Math.floor(MAX_TURNS * 0.7);
-    const tail = MAX_TURNS - head;
-    boundedDetail = detail.slice(0, head).concat(detail.slice(detail.length - tail));
-    m.detail_truncated = true;
-    m.detail_total_turns = detail.length;
-  }
-  let durationSeconds = null;
-  if (firstTs && lastTs) {
-    const d = (Date.parse(lastTs) - Date.parse(firstTs)) / 1000;
-    if (Number.isFinite(d) && d >= 0) durationSeconds = Math.round(d);
-  }
-  return {
-    startedAt: firstTs,
-    endedAt: lastTs,
-    durationSeconds,
-    totalTokens: m.total_tokens,
-    metrics: m,
-    detail: boundedDetail,
-  };
-}
 
 // classifyUploadSkip — PURE decision for whether the session upload must skip,
 // and the clear, actionable reason why. Separated from I/O so it is unit-tested

package/src/module-api.js

@@ -1059,8 +1059,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.314 with no explicit bump. run 32668969037. (task 1002620)
 //   1.19.316 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.315 with no explicit bump. run 32669347711. (task 1002620)
+//   1.19.317 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
+//   1.19.318 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.316'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.318'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -34,7 +34,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
@@ -113,7 +113,8 @@ await test('EXEC: every write goes through the caller-supplied exec (so a ship t
 });
 
 await test('EXEC: shipTask passes its transaction CLIENT, and the reconciler passes the pool', () => {
-  const db = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const db = lifecycleDbSource();
   // db.js is over the fitness oversize threshold, so the hook is ONE line there
   // and its body lives in done-when.closeCompletedWorkForShip. What must hold is
   // that the thing handed in is the txn client, not a pool.

package/tests/dependencies_migration.mjs

@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -22,7 +22,8 @@ const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const mig = read('migrations', '163_polymorphic_dependencies.sql');
 const migN = mig.replace(/\s+/g, ' ');
 // the task-dependency CRUD + the claim-gate slice carved to the lifecycle module at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 const { test, summary } = makeRunner();
 

package/tests/fitness.mjs

@@ -542,6 +542,49 @@ test('identity gate skips comments + instance-injected tokens (no false positive
   assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
 });
 
+// task 1002756 — the two holes that let migrate.sh's founder DB default survive:
+// (1) the stripper could be OPENED by a `/*` inside a `//` line comment (a real
+// `*/` hundreds of lines later then swallowed everything between — provision.js
+// lost ~330 lines from the scanned text), and (2) whole file classes were never
+// scanned. These lock the stripper; the root widening is pinned by the note test.
+test('identity gate: a /* inside a line comment cannot open a phantom block (task 1002756)', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '// glob note: import <dir>/*.caddy',        // the phantom opener shape
+    'const leak = "amazonprimea.example";',      // must STILL be seen
+    'doThing();',
+    '/* a real block */ const ok = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 1, 'the literal after a /*-bearing line comment must be caught');
+});
+
+test('identity gate: a // inside a block comment does not truncate the block', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '/* rationale: see https://amazonprimea.com — historical // note',
+    'still inside the block, amazonprimea again',
+    '*/',
+    'const clean = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 0, 'comment prose naming the brand must not trip the scan');
+});
+
+test('identity gate: comment markers inside strings and regex literals are inert', () => {
+  const { scanPromptIdentity } = fitness;
+  // A string containing /* must not open a comment that hides a later literal…
+  assert.equal(scanPromptIdentity('x.js', 'const g = "src/*.js";\nconst leak = "amazonprimea";').length, 1);
+  // …a regex containing the brand is code and IS caught (the detectors carve out their own hits)…
+  assert.equal(scanPromptIdentity('x.js', 'const re = /amazonprimea/i;').length, 1);
+  // …and a division sign is not mistaken for a regex opener that swallows code.
+  assert.equal(scanPromptIdentity('x.js', 'const x = a / b / c;\nconst leak = "amazonprimea";').length, 1);
+});
+
+test('identity gate scans the WHOLE scripts/ root, not just scripts/gds (task 1002756)', () => {
+  const r = fitness.checkKernelPromptsNoHardcodedIdentity();
+  assert.match(r.note, /scripts\/\*\* \(whole root/, 'note must document the widened root');
+  assert.equal(r.hardFail, false, 'live tree must be clean under the widened scan:\n' + r.violations.join('\n'));
+});
+
 // --- write-route validation build check (BV1.R12 / task 1999, ADR 0118) ---
 
 test('write-route validation check: the live tree is clean (R11 sweep reached 100%)', () => {

package/tests/goal_abuse_matrix.mjs

@@ -46,7 +46,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -201,7 +201,8 @@ await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (s
   assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
 });
 await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
-  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
   const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
   assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
   const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];

package/tests/goal_advisory.mjs

@@ -17,7 +17,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -25,7 +25,8 @@ const require = createRequire(import.meta.url);
 const { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory } = require('../modules/lifecycle/goal-advisory.js');
 
 const tasksSrc = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
-const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const { test, summary } = makeRunner();
 
 const V = 'BONGOS-V1';

package/tests/government_claim_eligibility.mjs

@@ -37,6 +37,7 @@ const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+import { lifecycleDbSource } from './helpers.mjs';
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 
@@ -147,7 +148,8 @@ test('the permission predicate cannot see requires_rank at all (structural)', ()
 });
 
 test('every claim path in db.js still gates on requires_rank as its own check', () => {
-  const src = fs.readFileSync(path.join(LIFECYCLE, 'db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const src = lifecycleDbSource();
   // claimTask, claimTasksBatch, validateClaimBatch — three call sites, three
   // separate rankAllowsTask conjuncts. If a refactor ever folds the floor into the
   // permission predicate, this count drops and the test reds.

package/tests/government_rank_sync.mjs

@@ -18,6 +18,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -189,8 +190,14 @@ test('the writer runs on the CALLER\'s transaction client when given one', () =>
 });
 
 test('both rank-change twins rotate the role inside their transaction', () => {
-  for (const rel of ['src/bongos/db.js', 'modules/lifecycle/db.js']) {
-    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+  // task 1003204: the lifecycle twin moved out of db.js into db-rank-authz.js
+  // when the monolith was carved up. Read the whole lifecycle family so the
+  // assertion follows the code instead of a filename.
+  const twins = [
+    ['src/bongos/db.js', fs.readFileSync(path.join(ROOT, 'src/bongos/db.js'), 'utf8')],
+    ['modules/lifecycle/db-*.js', lifecycleDbSource()],
+  ];
+  for (const [rel, src] of twins) {
     const body = src.slice(src.indexOf('async function _applyRankChangeTx'));
     const upd = body.indexOf('UPDATE builders SET rank');
     const sync = body.indexOf('await syncGovernanceRankRole(client');

package/tests/helpers.mjs

@@ -123,3 +123,22 @@ export function requireHostModule(require, spec, note) {
     throw err;
   }
 }
+
+// lifecycleDbSource — the LIFECYCLE data layer as one source string.
+//
+// task 1003204 (goal 1000079) split the 5,748-line modules/lifecycle/db.js into
+// db.js (a pure re-export facade) + twelve cohesive db-*.js units. A pile of
+// tests assert things about "the data layer" by regexing its source — that the
+// claim paths gate on requires_rank, that a literal appears in exactly one
+// place, that dependency CRUD points at the right table. Those assertions were
+// always about the LAYER, not about one filename, so they read the whole family
+// here. Reading the family (rather than repointing each test at whichever db-*
+// unit happens to hold the code today) also means a future re-carve moves code
+// between units without silently disarming the assertion.
+export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
+  const dir = path.join(modulesDir, 'lifecycle');
+  const files = fs.readdirSync(dir)
+    .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+}

package/tests/migration_allocation.mjs

@@ -28,6 +28,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -49,7 +50,8 @@ async function test(name, fn) {
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const migrationSql = read('migrations', '081_tasks_needs_migration.sql');
 // the tasks db slice + the tasks route carved to modules/lifecycle/ at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const routesSrc = read('modules', 'lifecycle', 'routes', 'tasks.js');
 const captureSrc = read('scripts', 'gds', 'capture.js');
 

package/tests/publish_reconciler.mjs

@@ -16,6 +16,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -1647,7 +1648,8 @@ test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires co
   const url = await import('node:url');
   const path = await import('node:path');
   const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
-  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
 
   // Every statement that writes shipped_at, ignoring SELECT projections and comments.
   const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
@@ -1693,3 +1695,41 @@ setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);
+
+// --- task 1003217: a sweep that only RAISED rows must not log silence --------
+
+test('1003217 runCostSweep reports raised rows (a raise-only sweep still logs)', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 3, totalUsd: 45, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(r.raised, 3, 'the raised count passes through');
+  assert.equal(logs.length, 1, 'a sweep that raised 3 rows logged — the old guard was reconciled>0 only');
+  assert.match(logs[0], /raised 3/, 'and the raise is named in the line');
+});
+
+test('1003217 a sweep that did nothing at all still logs nothing', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 0, totalUsd: 0, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 0, 'no ledger work → no line, as before');
+});
+
+test('1003217 an older deps bundle with no `raised` key still logs on reconciled', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 2, reconciled: 2, totalUsd: 3, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 1);
+  assert.doesNotMatch(logs[0], /raised/, 'no phantom "raised 0" noise when the key is absent');
+});

package/tests/rank_gate.mjs

@@ -26,6 +26,7 @@ const require = createRequire(import.meta.url);
 const auth = require('../src/bongos/auth.js');
 const db = require('../modules/lifecycle/db.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -319,7 +320,8 @@ console.log('\nlistClaimableTasks SQL rank-tier CASE (regression: thetes drift):
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 // listClaimableTasks carved to the lifecycle module at BV1.R86 — read the SQL there.
-const dbSrc = readFileSync(join(__dir, '..', 'modules', 'lifecycle', 'db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value', () => {
   // Isolate the listClaimableTasks function body so we don't match CASE

package/tests/reward_gate.mjs

@@ -25,6 +25,7 @@ const db = require('../modules/lifecycle/db.js');
 // the SAME singleton object db.js captured, so mutating its .query stubs the INSERT
 // createTask runs — no database needed.
 const sharedPool = require('../src/module-api.js').pool;
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 const root = join(__dir, '..');
@@ -132,7 +133,8 @@ t('null task is a no-op (no throw, no assignment)', () => {
 console.log('\nenforcement points (source-wiring — AUTO-ASSIGN):');
 
 const tasksRouteSrc = readFileSync(join(root, 'modules/lifecycle/routes/tasks.js'), 'utf8');
-const dbSrc = readFileSync(join(root, 'modules/lifecycle/db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const migration178 = readFileSync(join(root, 'migrations/178_reward_gate_auto_assign_revert_autopromote.sql'), 'utf8');
 
 t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)', () => {

package/tests/session_cost.mjs

@@ -131,3 +131,67 @@ test('1344 addComponents / addTiers / roundTiers are pure and additive', () => {
   const rounded = sc.roundTiers({ fresh_input_usd: 1.000049, cache_read_usd: 0, cache_write_usd: 0, output_usd: 0 });
   assert.equal(rounded.fresh_input_usd, 1.0); // round to 4dp
 });
+
+// ---------- task 1003217: price one API call once, not once per line ----------
+//
+// A single assistant message is written to the transcript as several lines (one
+// per content block: thinking / text / tool_use), each repeating the SAME
+// message.usage. priceTranscript must dedup on message.id. Measured 2.22x
+// over-pricing on 12 real transcripts before this fix — and ADR 0054 pays
+// round(true_cost_usd x 1.20) off this number.
+function splitLine(id, model, usage, block) {
+  return JSON.stringify({ message: { id, role: 'assistant', model, usage, content: [block] } });
+}
+
+test('1003217 priceTranscript charges a split assistant message ONCE', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup-'));
+  const p = path.join(dir, 'split.jsonl');
+  const usage = { output_tokens: M }; // opus-5 output = $25/M
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'thinking', thinking: 'hmm' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'ok' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  assert.equal(r.total, 25, 'one call at 1M opus output = $25, NOT $75');
+});
+
+test('1003217 priceTranscript still charges distinct message ids separately', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup2-'));
+  const p = path.join(dir, 'three.jsonl');
+  const usage = { output_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_2', 'claude-opus-5', usage, { type: 'text', text: 'b' }),
+    splitLine('msg_3', 'claude-opus-5', usage, { type: 'text', text: 'c' }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 75, 'three real calls = $75');
+});
+
+test('1003217 priceTranscript keeps the tier split consistent with the deduped total', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup3-'));
+  const p = path.join(dir, 'tiers.jsonl');
+  const usage = { output_tokens: M, cache_read_input_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  // opus-5: output $25/M, cache_read $0.50/M → $25.50 for ONE call.
+  assert.equal(r.total, 25.5);
+  assert.equal(r.tiers.output_usd, 25);
+  assert.equal(r.tiers.cache_read_usd, 0.5);
+  const tierSum = r.tiers.fresh_input_usd + r.tiers.cache_read_usd
+    + r.tiers.cache_write_usd + r.tiers.output_usd;
+  assert.ok(Math.abs(tierSum - r.total) < 1e-9, 'the four tiers must still sum to total');
+});
+
+test('1003217 a transcript with no message.id prices per line (unchanged legacy path)', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup4-'));
+  const p = path.join(dir, 'noid.jsonl');
+  fs.writeFileSync(p, [
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 50, 'no id to dedup on → both lines charged');
+});