@bongos/core 1.19.317 → 1.19.318

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.317",
-  "core_contract": "1.19.317",
-  "source_commit": "47d557d1d8a73aac8e99002c7a282f7bab39a700",
+  "core_version": "1.19.318",
+  "core_contract": "1.19.318",
+  "source_commit": "01d0a25617f7ca9212b310552724d7eb8c183a32",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T22:06:51.573Z",
+  "built_at": "2026-08-23T22:11:19.148Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1436,
+    "functional_verbatim": 1438,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1781,
-  "tree_sha256": "1a2430cfe83da4de17388e4663512e1eac2d35a6269e0f124f26e7004d09f0a8",
+  "file_count": 1783,
+  "tree_sha256": "24fa1a6a45d9a8ad89550dcdf06b82e5aeffa56776dcd6666a1be6524d9d4a6e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2987,7 +2987,7 @@
     {
       "path": "modules/economy/cost.js",
       "mode": "0000644",
-      "sha256": "5d125e8b884ebfeb5687ee6748c49bf752d5757114ede98d0cabf2eee4a38b76"
+      "sha256": "01bc7725fe16388971fd4def2544d0de9af6b3a522973df7ef86386737933d40"
     },
     {
       "path": "modules/economy/credits.js",
@@ -3972,7 +3972,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "8f08c6d58db41ba247aaf5b04b5a8988365b469e96c0ad04c336f272ef308c4e"
+      "sha256": "28c61d55fe2b492f0fce4c99b60e88f0cbeb542c47c04482558818d65628e0d7"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4642,12 +4642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1bdb7a2ab4583036c92b3108244d5c30dc8aa6314ba28eb2339f3712deec806a"
+      "sha256": "509e4a76d5eb6f21fd8c926c6bf7ec9f1938d62ed4055558e2d3911858166b38"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2bbe8915c29c3f2cde9ef26aa885ddeb123f32caea804ed3146090147fa68a4d"
+      "sha256": "5e3c53bb9627f4dcf747e5e7bc8fa7fb0e136554f04d96081137ca1bc05654ad"
     },
     {
       "path": "public-docs/index.html",
@@ -5672,7 +5672,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "e2e3cd6299f63b838ed5a78121eedcb44e76b3cc62b622581cd537c154b1d8ae"
+      "sha256": "c96e50e533f4e20dba91c6a26ac6efd2c6ad33ffcdc856eeb46af21a17e67975"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5832,7 +5832,12 @@
     {
       "path": "scripts/gds/session-cost.js",
       "mode": "0000644",
-      "sha256": "52d6c931fa0d7213632a365984ed360cb8df2d369762dbb417d0c0a1b74145a6"
+      "sha256": "fdf3b9d8e0089078da550ac65d0c012583cc21103a668deecf481383a73c9da1"
+    },
+    {
+      "path": "scripts/gds/session-digest-build.js",
+      "mode": "0000644",
+      "sha256": "95e5c21533f67588fd02fae311cef8985d3eee58ad3217fcb6e9998e1f4da965"
     },
     {
       "path": "scripts/gds/session-digest.js",
@@ -5867,7 +5872,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "f3005175abc0ba20e958381df6aee02402267e9956da466386656dd4e86ad8cf"
+      "sha256": "8f2c0ca63abae081cccfa96059ae07b008bd108f85866a248075cb4a1b7e025e"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -6327,7 +6332,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7301568d229fc28265cf1ad41b4d568923cc18d1f7098ef5403c971ed531839a"
+      "sha256": "af9d10cbaf1d6320df892f4d0e1403c0f5f1bb6e8c314695e89477690ba7fc85"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8287,7 +8292,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "09c5e96eadbfd99f26579fbf67b2ccdf39c6c04415a2596e9dbd4644be8d3ebe"
+      "sha256": "5a9ea0bf7b4d776a6f9036b8bd060fef76335533274ed748e9b9d742da6960d3"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -8507,7 +8512,12 @@
     {
       "path": "tests/session_cost.mjs",
       "mode": "0000644",
-      "sha256": "6531fd14dbfc025543c4855c326746c126cfcc94173b9a724e56f74a989a1d4e"
+      "sha256": "5f330f79eee8c39dc589d892ba5fa6835906e7b61ff5fe52aec3285721e84876"
+    },
+    {
+      "path": "tests/session_cost_row_raise.mjs",
+      "mode": "0000644",
+      "sha256": "74a106432222df7d8e845ec409bd2e1d49aff18bf80cdeff032cfe91b1d6dc3f"
     },
     {
       "path": "tests/session_digest.mjs",
@@ -8527,7 +8537,7 @@
     {
       "path": "tests/session_records.mjs",
       "mode": "0000644",
-      "sha256": "c33e4f5bb635eb523bc7014fe8cfad343b7ab7753822644ce987cd419520c748"
+      "sha256": "8c62fe0bec07aea4c30f84d296eb7b40c9550606aacf6cb63f9644ca34f12069"
     },
     {
       "path": "tests/session_reward_on_land.mjs",

package/modules/economy/cost.js

@@ -105,23 +105,51 @@ async function logCost({
   outputUsd = null,
   // task #385 / migration 181: which skill invocation incurred this cost.
   skillName = null,
+  // task 1003217 — opt-in MONOTONIC RAISE on (source, source_ref) conflict.
+  //
+  // Default false, so every existing caller keeps the plain insert-once
+  // idempotency it relies on. The session reconciler below sets it true: a
+  // long session's digest GROWS on every ship, and a cost row written from an
+  // early digest must be allowed to catch up, or the session is billed at its
+  // first hour forever (the bug this task fixes).
+  //
+  // Safe because the update SETS an absolute amount rather than adding to one:
+  // re-running with the same figure is a no-op, so there is no double-count
+  // path, and the WHERE guard means a row can only ever move UP.
+  raiseOnConflict = false,
 }) {
   // V3.R11 (#91): builder_id is the per-builder attribution column added by
   // migration 046. Routes default it to the authed builder, so the only
   // legitimately-null builder_id is for historical rows or system-injected
   // costs (infra, domain, etc.) that don't belong to any one person.
+  // Monotonic raise (opt-in) vs the historical insert-once. `recorded_at` moves
+  // with the amount so the reconciler's "digest is newer than the priced row"
+  // predicate settles instead of re-firing every sweep.
+  const conflictAction = raiseOnConflict
+    ? `DO UPDATE SET
+         amount_usd      = EXCLUDED.amount_usd,
+         description     = EXCLUDED.description,
+         fresh_input_usd = EXCLUDED.fresh_input_usd,
+         cache_read_usd  = EXCLUDED.cache_read_usd,
+         cache_write_usd = EXCLUDED.cache_write_usd,
+         output_usd      = EXCLUDED.output_usd,
+         recorded_at     = EXCLUDED.recorded_at
+       WHERE EXCLUDED.amount_usd > cost_log.amount_usd`
+    : 'DO NOTHING';
   const { rows } = await pool.query(
     `INSERT INTO cost_log (task_id, amount_usd, category, description, source, source_ref, recorded_at, builder_id,
                            fresh_input_usd, cache_read_usd, cache_write_usd, output_usd, skill_name)
      VALUES ($1, $2, $3, $4, $5, $6, COALESCE($7, now()), $8, $9, $10, $11, $12, $13)
      ON CONFLICT (source, source_ref)
        WHERE source IS NOT NULL AND source_ref IS NOT NULL
-       DO NOTHING
+       ${conflictAction}
      RETURNING id, recorded_at`,
     [taskId, amountUsd, category, description, source, sourceRef, recordedAt, builderId,
      freshInputUsd, cacheReadUsd, cacheWriteUsd, outputUsd, skillName || null]
   );
-  return rows[0] ?? null; // null when ON CONFLICT skipped the insert
+  // null when the conflict clause skipped the write (DO NOTHING, or a raise that
+  // would not have moved the row upward).
+  return rows[0] ?? null;
 }
 
 // task 1366 (System 1) — server-side session-cost reconciler.
@@ -144,25 +172,45 @@ async function logCost({
 //                        first crack at posting (avoids racing it). 15m default.
 //   - limit            : per-sweep cap (runaway guard; there are normally few).
 //
-// The NOT EXISTS checks BOTH the interactive key (session_id) AND the subagent
-// key (session_id || ':sub') — session-cost.js splits a captured session into
-// those two rows (task 1344), so a session the client captured even partially
-// is skipped entirely (we only have the combined model_usage, so we can't split
-// it; better to defer to the client's split than to add a duplicate total).
-// Returns { scanned, reconciled, totalUsd, unknownModels } for logging.
+// A session the CLIENT split into interactive + subagent rows (session_id ||
+// ':sub', task 1344) is skipped entirely — we hold only the combined
+// model_usage, so we cannot reproduce that split and should defer to it.
+//
+// task 1003217 — WHY THIS NO LONGER SKIPS EVERY PRICED SESSION. It used to
+// exclude any session that had a cost row at all. But `session_records` is
+// upserted on EVERY ship, so a session that ships twelve tasks has a digest
+// from its FIRST ship, and this sweep priced that partial digest ~15 minutes
+// later and then never looked again — logCost's DO NOTHING silently dropped
+// every subsequent, larger figure. Measured on prod: a 9.3-hour session was
+// billed at its first 56 minutes, and across four audited sessions the ledger
+// captured 14%, 14%, 16% and 54% of real spend. Now a session is revisited
+// while its digest is NEWER than the row we priced from it, and logCost raises
+// the row monotonically. `recorded_at` advances on each raise, so a settled
+// session stops matching and the sweep converges.
+//
+// Historical rows are NOT re-priced downward: llm-pricing.js is explicit that a
+// paid row records what was charged, and ADR 0054 paid credits from it. The
+// raise is upward-only, so pre-fix inflated rows stay as they are — expect a
+// visible step change in cost-per-ship at deploy rather than a rewritten past.
+// Returns { scanned, reconciled, raised, totalUsd, unknownModels } for logging.
 async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}) {
   const mins = Number.isFinite(Number(olderThanMinutes)) ? Number(olderThanMinutes) : 15;
   const lim = Number.isFinite(Number(limit)) ? Number(limit) : 500;
   const { rows } = await pool.query(
-    `SELECT sr.session_id, sr.builder_id, sr.model_usage
+    `SELECT sr.session_id, sr.builder_id, sr.model_usage,
+            c.amount_usd AS prior_usd
        FROM session_records sr
+       LEFT JOIN cost_log c
+              ON c.source = 'session:interactive'
+             AND c.source_ref = sr.session_id
       WHERE sr.model_usage IS NOT NULL
         AND sr.uploaded_at < now() - ($1 || ' minutes')::interval
         AND NOT EXISTS (
-          SELECT 1 FROM cost_log c
-           WHERE c.source_ref = sr.session_id
-              OR c.source_ref = sr.session_id || ':sub'
+          SELECT 1 FROM cost_log s
+           WHERE s.source_ref = sr.session_id || ':sub'
         )
+        -- Never priced, or the digest has grown since we priced it.
+        AND (c.id IS NULL OR c.recorded_at < sr.uploaded_at)
       ORDER BY sr.uploaded_at DESC
       LIMIT $2`,
     [String(mins), lim]
@@ -170,6 +218,7 @@ async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}
 
   const round4 = (n) => Math.round((Number(n) || 0) * 10000) / 10000;
   let reconciled = 0;
+  let raised = 0;
   let totalUsd = 0;
   const unknownModels = new Set();
   for (const r of rows) {
@@ -177,34 +226,50 @@ async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}
     for (const m of comp.unknown_models) unknownModels.add(m);
     const amount = round4(comp.total_usd);
     if (!(amount > 0)) continue; // nothing priceable on this row — skip
+    const prior = round4(r.prior_usd);
+    // A row already at or above this figure needs no write: the digest grew but
+    // the price did not (or the stored row predates a pricing fix and is higher,
+    // which we deliberately leave alone).
+    if (prior > 0 && amount <= prior) continue;
     const id8 = String(r.session_id).slice(0, 8);
     const unkNote = comp.unknown_models.length
       ? ` [unpriced model(s) priced as opus: ${comp.unknown_models.join(',')}]`
       : '';
+    const provenance = prior > 0
+      ? `raised from $${prior.toFixed(4)} as the session grew`
+      : 'reconciled from digest; client cost-hook did not post';
     const inserted = await logCost({
       amountUsd: amount,
       category: 'api',
       source: 'session:interactive',
-      // SAME key the client would use → ON CONFLICT DO NOTHING prevents any
-      // double-count if the client also posts later.
+      // SAME key the client would use, so a client post and this sweep can
+      // never both land as separate rows.
       sourceRef: r.session_id,
       builderId: r.builder_id,
-      description: `session ${id8} — $${amount.toFixed(4)} (reconciled from digest; client cost-hook did not post)${unkNote}`.slice(0, 1000),
+      // Upward-only: catches a long session up as it ships more tasks, and can
+      // never lower a row that has already been paid from.
+      raiseOnConflict: true,
+      description: `session ${id8} — $${amount.toFixed(4)} (${provenance})${unkNote}`.slice(0, 1000),
       freshInputUsd: round4(comp.fresh_input_usd),
       cacheReadUsd: round4(comp.cache_read_usd),
       cacheWriteUsd: round4(comp.cache_write_usd),
       outputUsd: round4(comp.output_usd),
     });
-    // inserted === null means ON CONFLICT skipped it (client raced in between the
-    // SELECT and the INSERT) — expected + idempotent, not counted.
+    // inserted === null means the conflict clause skipped the write (the client
+    // raced in between the SELECT and the INSERT, or the raise would not have
+    // moved the row up) — expected + idempotent, not counted.
     if (inserted) {
-      reconciled++;
-      totalUsd += amount;
+      if (prior > 0) raised++;
+      else reconciled++;
+      // Bill only the INCREMENT on a raise, so this figure stays a true
+      // "spend recorded by this sweep" rather than re-counting the whole row.
+      totalUsd += amount - prior;
     }
   }
   return {
     scanned: rows.length,
     reconciled,
+    raised,
     totalUsd: round4(totalUsd),
     unknownModels: Array.from(unknownModels),
   };

package/modules/lifecycle/publish-reconciler.js

@@ -804,12 +804,17 @@ async function runCostSweep(deps = {}) {
   if (typeof reconciler.reconcileSessionCosts !== 'function') return { skipped: 'unsupported' };
   try {
     const cost = await reconciler.reconcileSessionCosts();
-    if (cost && cost.reconciled > 0) {
+    // task 1003217: `raised` counts long sessions caught up as their digest grew.
+    // It is reported alongside `reconciled` — a sweep that only raised rows did
+    // real ledger work and must not log silence.
+    const raised = Number(cost && cost.raised) || 0;
+    if (cost && (cost.reconciled > 0 || raised > 0)) {
       const unk = cost.unknownModels && cost.unknownModels.length
         ? ` [unpriced→opus: ${cost.unknownModels.join(',')}]`
         : '';
+      const raisedNote = raised > 0 ? `, raised ${raised}` : '';
       logFn(
-        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
+        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled}${raisedNote} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
       );
     }
     return cost;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.317",
+  "version": "1.19.318",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.317",
+      "version": "1.19.318",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.317",
+  "version": "1.19.318",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -104,7 +104,14 @@ const INTEGRATION = new Set([
   'government_board_membership_db',
   'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
-  'scouting_rollup_fanout', 'session_records', 'setup_smoke',
+  'scouting_rollup_fanout', 'session_records',
+  // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
+  // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a
+  // revisit predicate comparing cost_log.recorded_at to the digest upload. The
+  // DB-free siblings (session_records, session_cost) cover the transcript
+  // de-duplication half.
+  'session_cost_row_raise',
+  'setup_smoke',
   'status-probe',
 ]);
 

package/scripts/gds/session-cost.js

@@ -146,9 +146,19 @@ function roundTiers(t) {
 }
 
 // Sum usage per model across the transcript, then price each model's total.
+//
+// task 1003217 — usage is deduped by `message.id`. Claude Code writes one
+// transcript line per content block of an assistant message (thinking / text /
+// tool_use) and repeats the SAME `message.usage` on every one of them, so
+// summing per line priced a single API call two or three times (measured 2.22x
+// inflation over 12 real transcripts). The evidence — including the cache-chain
+// identity that proves a line-group is one call — is written up above
+// buildSessionDigest in ./session-digest-build.js. A transcript whose messages
+// carry no `id` degrades to the old per-line behaviour.
 function priceTranscript(transcriptPath) {
   const raw = fs.readFileSync(transcriptPath, 'utf8');
   const perModel = new Map(); // model -> {input, output, read, c5, c1h}
+  const seenMessageIds = new Set();
   for (const line of raw.split('\n')) {
     if (!line.trim()) continue;
     let o;
@@ -159,6 +169,12 @@ function priceTranscript(transcriptPath) {
     // generated messages (compaction, interrupts) — no real API call, usage is
     // a zero placeholder. Pricing them would mislabel them as an unknown model.
     if (!usage || !msg.model || msg.model === '<synthetic>') continue;
+    // One API call, many lines — price it once (task 1003217).
+    const msgId = typeof msg.id === 'string' && msg.id ? msg.id : null;
+    if (msgId !== null) {
+      if (seenMessageIds.has(msgId)) continue;
+      seenMessageIds.add(msgId);
+    }
     const m = perModel.get(msg.model) || { input: 0, output: 0, read: 0, c5: 0, c1h: 0 };
     m.input += Number(usage.input_tokens) || 0;
     m.output += Number(usage.output_tokens) || 0;

package/scripts/gds/session-digest-build.js

@@ -0,0 +1,261 @@
+// scripts/gds/session-digest-build.js — the PURE transcript→digest builder.
+//
+// Extracted from scripts/gds/ship.js (task 1003217, serving the de-monolith goal
+// of task 1003203: nothing over 1,500 lines). ship.js was 4,646 lines and this
+// block — snippetOf + buildSessionDigest and their two constants — is pure,
+// separately tested, and shared: ship.js uploads a digest mid-ship and
+// session-digest.js uploads the final one on the SessionEnd seam.
+//
+// It has NO dependency on ship.js, which is what makes the split safe: ship.js
+// imports and re-exports this, so its public surface (and tests/session_records.mjs)
+// is unchanged, and the existing session-digest.js -> ship.js import cannot become
+// a cycle.
+//
+// NB the prose above deliberately says "imports", not the r-e-q-u-i-r-e call
+// spelled with './ship' — the fitness require-graph (scripts/gds/fitness-ratchets.js
+// requireGraph) scans raw file text and does NOT strip comments, so naming that
+// call here invented a phantom session-digest-build <-> ship cycle and tripped the
+// require_cycle_count ratchet. Same trap the curated-set parser in run-unit-tests.js
+// warns about for quoted words in ITS comments.
+//
+// The transcript-grade secret scrubber + its ADR-0022 internals live in
+// modules/security/secret-scrub.js — extracted (task 1211 / GDS-V4 R72) so the
+// public-mirror export pipeline can reuse the ONE copy of the secret shapes
+// without requiring ship.js (whose grader / Discord / sound / session deps are
+// absent in a bare CI job). See that module for the recall-first design (a missed
+// secret is a compromise; over-redaction is cosmetic).
+const { scrubSecrets } = require('../../modules/security/secret-scrub');
+
+// snippetOf — short, single-line, scrubbed excerpt for footgun context.
+function snippetOf(text, extraSecrets, max = 160) {
+  if (typeof text !== 'string' || text.length === 0) return undefined;
+  // Drop NULs first: Postgres rejects a literal NUL in jsonb, so ONE of them anywhere in
+  // ONE snippet made the whole digest unstorable — POST /sessions answered 500 and
+  // the session never paid. UTF-16LE tool output (`wsl --list` is the observed
+  // case) is full of them, and \s below does NOT match NUL, so it must go here.
+  const flat = text.replace(/\0/g, '').replace(/\s+/g, ' ').trim();
+  if (!flat) return undefined;
+  const cut = flat.length > max ? flat.slice(0, max) : flat;
+  const scrubbed = scrubSecrets(cut, extraSecrets);
+  return scrubbed || undefined;
+}
+
+// buildSessionDigest — turn parsed Claude Code transcript entries into
+// { startedAt, endedAt, durationSeconds, totalTokens, metrics, detail }.
+// Pure (no I/O) + exported for unit tests. `detail` is per-turn metadata + short
+// scrubbed snippets, capped at maxTurns (head+tail kept when over).
+// Harness guardrail retries (task 959) — an is_error tool_result that is NOT real
+// friction but the agent harness rejecting a tool call: an Edit/Write before the
+// file was Read ("File has not been read yet"), or a foreground sleep ("Blocked:
+// sleep"). These were counted in tool_error_count, inflating it and skewing the
+// BFG's order=tool_errors ranking (top sessions ranked on benign retries). They
+// now go into a separate harness_retry_count so tool_error_count stays NET — and
+// because the sessions/search ordering reads metrics->>'tool_error_count'
+// (src/bongos/db.js), that ordering automatically uses the net figure with no route
+// change. (ADR 0027 lineage — the 6D session evaluator.)
+const HARNESS_RETRY_RE =
+  /File has not been read yet|Read it first before (?:writing|editing)|Blocked:\s*sleep|sleep is blocked in (?:the )?foreground/i;
+
+// task 1676 — the family bucket unlabeled token-bearing turns are folded into so
+// the cost-plus reward (ADR 0054) prices the real spend instead of rounding to $0.
+// A concrete, priceable model id (llm-pricing.js maps it to the opus family by
+// substring) — NOT a fabricated dollar figure; it carries the REAL token counts
+// ship.js already parsed, priced server-side like any other bucket.
+const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
+
+// task 1003217 — ONE API CALL IS MANY TRANSCRIPT LINES.
+//
+// Claude Code writes a separate transcript line per content block of a single
+// assistant message (thinking / text / tool_use), and EVERY one of those lines
+// repeats the SAME `message.usage` object. Summing usage per line therefore
+// counted one API call's tokens two or three times: measured 2.22x inflation
+// across 12 real transcripts in this project (2,357 usage-bearing lines,
+// naive cache_read 551,095,738 vs deduped 248,555,962).
+//
+// `message.id` is the API call's identity — the usage tuples are byte-identical
+// across lines sharing an id. The proof that a line-GROUP is one call is the
+// cache chain: cache_read[n] == cache_read[n-1] + cache_creation[n-1] closes on
+// 99.1% of links after de-duplication (the residue is compaction boundaries)
+// and holds for none of them before it.
+//
+// This mattered because ADR 0054 pays round(true_cost_usd x 1.20) from these
+// very numbers, so the inflation flowed into cost-plus rewards.
+//
+// `assistant_turns` is deliberately left as the LINE count (existing consumers
+// order on it); `api_calls` is the new honest step count. A transcript whose
+// messages carry no `id` degrades to exactly the old behaviour.
+function buildSessionDigest(entries, opts = {}) {
+  const extra = opts.extraSecrets || [];
+  const MAX_TURNS = opts.maxTurns || 4000;
+  const seenMessageIds = new Set();
+  const m = {
+    assistant_turns: 0,
+    api_calls: 0, // distinct message.id — the real number of API round-trips
+    user_turns: 0,
+    tool_use_count: 0,
+    tool_result_count: 0,
+    tool_error_count: 0, // NET real errors (harness guardrail retries excluded)
+    harness_retry_count: 0, // benign harness guardrail retries (task 959)
+    tokens: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
+    model_usage: {}, // per-model token buckets for the cost-plus reward (task 1005)
+    // task 1676: tokens from turns with NO model id (not '<synthetic>'). Folded
+    // into a priceable bucket after the loop, then stripped from the digest.
+    _unlabeled: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
+  };
+  const detail = [];
+  let firstTs = null;
+  let lastTs = null;
+  let i = 0;
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!e || typeof e !== 'object') continue;
+    const ts = typeof e.timestamp === 'string' ? e.timestamp : null;
+    if (ts) {
+      if (!firstTs) firstTs = ts;
+      lastTs = ts;
+    }
+    const msg = e.message;
+    if (e.type === 'assistant' && msg) {
+      m.assistant_turns++;
+      // Dedup usage per API call (see the note above buildSessionDigest). A
+      // repeat line contributes ZERO tokens but still gets its detail row, so
+      // the per-turn record stays faithful and summing detail stays correct.
+      const msgId = typeof msg.id === 'string' && msg.id ? msg.id : null;
+      const dupUsage = msgId !== null && seenMessageIds.has(msgId);
+      if (msgId !== null) seenMessageIds.add(msgId);
+      if (!dupUsage) m.api_calls++;
+      const u = dupUsage ? {} : (msg.usage || {});
+      const tin = u.input_tokens || 0;
+      const tout = u.output_tokens || 0;
+      const tcr = u.cache_read_input_tokens || 0;
+      const tcc = u.cache_creation_input_tokens || 0;
+      m.tokens.input += tin;
+      m.tokens.output += tout;
+      m.tokens.cache_read += tcr;
+      m.tokens.cache_creation += tcc;
+      // task 1005: per-model bucket for the cost-plus token reward, reusing the
+      // tin/tout/tcr/tcc already parsed above (no second pass). Skip synthetic
+      // turns (a grader 429 etc. emits no real model id AND no real spend).
+      const model = msg.model;
+      if (model === '<synthetic>') {
+        // synthetic: no real spend — exclude from BOTH model_usage and the
+        // task-1676 unlabeled-remainder fold below (don't price phantom tokens).
+      } else if (model) {
+        const mu = m.model_usage[model] || (m.model_usage[model] =
+          { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
+        mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
+      } else {
+        // task 1676: a token-bearing turn with NO model id. Previously dropped
+        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
+        // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
+        // attribute them to a real, priceable family bucket after the loop.
+        m._unlabeled.input += tin; m._unlabeled.output += tout;
+        m._unlabeled.cache_read += tcr; m._unlabeled.cache_creation += tcc;
+      }
+      const tools = [];
+      let textLen = 0;
+      let firstText = '';
+      if (Array.isArray(msg.content)) {
+        for (const c of msg.content) {
+          if (c && c.type === 'tool_use') {
+            m.tool_use_count++;
+            tools.push(String(c.name || '?'));
+          } else if (c && c.type === 'text' && typeof c.text === 'string') {
+            textLen += c.text.length;
+            if (!firstText) firstText = c.text;
+          }
+        }
+      }
+      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
+      // Marks a line that shares its API call with an earlier one, so a reader
+      // can tell a genuinely-zero-usage turn from a de-duplicated repeat.
+      if (dupUsage) row.dup = 1;
+      if (tools.length) row.tools = tools;
+      if (textLen) row.text_len = textLen;
+      const snip = snippetOf(firstText, extra);
+      if (snip) row.snippet = snip;
+      detail.push(row);
+      i++;
+    } else if (e.type === 'user' && msg) {
+      m.user_turns++;
+      let results = 0;
+      let errors = 0;
+      let harnessRetries = 0;
+      let firstResult = '';
+      if (Array.isArray(msg.content)) {
+        for (const c of msg.content) {
+          if (c && c.type === 'tool_result') {
+            results++;
+            m.tool_result_count++;
+            const text = typeof c.content === 'string'
+              ? c.content
+              : Array.isArray(c.content)
+                ? c.content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join(' ')
+                : '';
+            if (c.is_error) {
+              // Split benign harness guardrail retries out of the net error count
+              // so order=tool_errors ranks on real friction (task 959).
+              if (HARNESS_RETRY_RE.test(text)) {
+                harnessRetries++;
+                m.harness_retry_count++;
+              } else {
+                errors++;
+                m.tool_error_count++;
+              }
+            }
+            if (!firstResult) firstResult = text;
+          }
+        }
+      }
+      const row = { i, role: 'user', ts };
+      if (results) row.tool_results = results;
+      if (errors) row.tool_errors = errors;
+      if (harnessRetries) row.harness_retries = harnessRetries;
+      const snip = snippetOf(firstResult, extra);
+      if (snip) row.snippet = snip;
+      detail.push(row);
+      i++;
+    }
+  }
+  m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
+  // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
+  // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
+  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
+  // agent path that gap was the difference between total_tokens>0 (so the digest
+  // passes the route's empty-session guard + gets stored) and model_usage={} (so
+  // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model
+  // usage" symptom. Fold the unlabeled remainder (NOT synthetic turns) into a real,
+  // priceable family bucket so the cost-plus reward reflects the true spend rather
+  // than silently dropping to $0. opus is the conservative family for an unlabeled
+  // turn (matches llm-pricing.js's unknown-model fallback) — this instance runs
+  // opus by default, and pricing an unlabeled turn as opus never UNDER-pays.
+  const un = m._unlabeled;
+  if (un.input + un.output + un.cache_read + un.cache_creation > 0) {
+    const fb = m.model_usage[UNATTRIBUTED_MODEL] || (m.model_usage[UNATTRIBUTED_MODEL] =
+      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
+    fb.input += un.input; fb.output += un.output;
+    fb.cache_read += un.cache_read; fb.cache_creation += un.cache_creation;
+  }
+  delete m._unlabeled; // scratch — never persisted to the digest
+  let boundedDetail = detail;
+  if (detail.length > MAX_TURNS) {
+    const head = Math.floor(MAX_TURNS * 0.7);
+    const tail = MAX_TURNS - head;
+    boundedDetail = detail.slice(0, head).concat(detail.slice(detail.length - tail));
+    m.detail_truncated = true;
+    m.detail_total_turns = detail.length;
+  }
+  let durationSeconds = null;
+  if (firstTs && lastTs) {
+    const d = (Date.parse(lastTs) - Date.parse(firstTs)) / 1000;
+    if (Number.isFinite(d) && d >= 0) durationSeconds = Math.round(d);
+  }
+  return {
+    startedAt: firstTs,
+    endedAt: lastTs,
+    durationSeconds,
+    totalTokens: m.total_tokens,
+    metrics: m,
+    detail: boundedDetail,
+  };
+}
+module.exports = { snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL };

package/scripts/gds/ship.js

@@ -386,205 +386,14 @@ const {
   redactHighEntropy, collectEnvSecrets,
 } = require('../../modules/security/secret-scrub');
 
-// snippetOf — short, single-line, scrubbed excerpt for footgun context.
-function snippetOf(text, extraSecrets, max = 160) {
-  if (typeof text !== 'string' || text.length === 0) return undefined;
-  // Drop NULs first: Postgres rejects a literal NUL in jsonb, so ONE of them anywhere in
-  // ONE snippet made the whole digest unstorable — POST /sessions answered 500 and
-  // the session never paid. UTF-16LE tool output (`wsl --list` is the observed
-  // case) is full of them, and \s below does NOT match NUL, so it must go here.
-  const flat = text.replace(/\0/g, '').replace(/\s+/g, ' ').trim();
-  if (!flat) return undefined;
-  const cut = flat.length > max ? flat.slice(0, max) : flat;
-  const scrubbed = scrubSecrets(cut, extraSecrets);
-  return scrubbed || undefined;
-}
+// snippetOf + buildSessionDigest moved to ./session-digest-build (task 1003217,
+// serving the de-monolith goal of task 1003203) — pure, separately tested, and
+// shared with session-digest.js. Re-exported below so this file's public surface
+// and tests/session_records.mjs are unchanged.
+const {
+  snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL,
+} = require('./session-digest-build');
 
-// buildSessionDigest — turn parsed Claude Code transcript entries into
-// { startedAt, endedAt, durationSeconds, totalTokens, metrics, detail }.
-// Pure (no I/O) + exported for unit tests. `detail` is per-turn metadata + short
-// scrubbed snippets, capped at maxTurns (head+tail kept when over).
-// Harness guardrail retries (task 959) — an is_error tool_result that is NOT real
-// friction but the agent harness rejecting a tool call: an Edit/Write before the
-// file was Read ("File has not been read yet"), or a foreground sleep ("Blocked:
-// sleep"). These were counted in tool_error_count, inflating it and skewing the
-// BFG's order=tool_errors ranking (top sessions ranked on benign retries). They
-// now go into a separate harness_retry_count so tool_error_count stays NET — and
-// because the sessions/search ordering reads metrics->>'tool_error_count'
-// (src/bongos/db.js), that ordering automatically uses the net figure with no route
-// change. (ADR 0027 lineage — the 6D session evaluator.)
-const HARNESS_RETRY_RE =
-  /File has not been read yet|Read it first before (?:writing|editing)|Blocked:\s*sleep|sleep is blocked in (?:the )?foreground/i;
-
-// task 1676 — the family bucket unlabeled token-bearing turns are folded into so
-// the cost-plus reward (ADR 0054) prices the real spend instead of rounding to $0.
-// A concrete, priceable model id (llm-pricing.js maps it to the opus family by
-// substring) — NOT a fabricated dollar figure; it carries the REAL token counts
-// ship.js already parsed, priced server-side like any other bucket.
-const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
-
-function buildSessionDigest(entries, opts = {}) {
-  const extra = opts.extraSecrets || [];
-  const MAX_TURNS = opts.maxTurns || 4000;
-  const m = {
-    assistant_turns: 0,
-    user_turns: 0,
-    tool_use_count: 0,
-    tool_result_count: 0,
-    tool_error_count: 0, // NET real errors (harness guardrail retries excluded)
-    harness_retry_count: 0, // benign harness guardrail retries (task 959)
-    tokens: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-    model_usage: {}, // per-model token buckets for the cost-plus reward (task 1005)
-    // task 1676: tokens from turns with NO model id (not '<synthetic>'). Folded
-    // into a priceable bucket after the loop, then stripped from the digest.
-    _unlabeled: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-  };
-  const detail = [];
-  let firstTs = null;
-  let lastTs = null;
-  let i = 0;
-  for (const e of Array.isArray(entries) ? entries : []) {
-    if (!e || typeof e !== 'object') continue;
-    const ts = typeof e.timestamp === 'string' ? e.timestamp : null;
-    if (ts) {
-      if (!firstTs) firstTs = ts;
-      lastTs = ts;
-    }
-    const msg = e.message;
-    if (e.type === 'assistant' && msg) {
-      m.assistant_turns++;
-      const u = msg.usage || {};
-      const tin = u.input_tokens || 0;
-      const tout = u.output_tokens || 0;
-      const tcr = u.cache_read_input_tokens || 0;
-      const tcc = u.cache_creation_input_tokens || 0;
-      m.tokens.input += tin;
-      m.tokens.output += tout;
-      m.tokens.cache_read += tcr;
-      m.tokens.cache_creation += tcc;
-      // task 1005: per-model bucket for the cost-plus token reward, reusing the
-      // tin/tout/tcr/tcc already parsed above (no second pass). Skip synthetic
-      // turns (a grader 429 etc. emits no real model id AND no real spend).
-      const model = msg.model;
-      if (model === '<synthetic>') {
-        // synthetic: no real spend — exclude from BOTH model_usage and the
-        // task-1676 unlabeled-remainder fold below (don't price phantom tokens).
-      } else if (model) {
-        const mu = m.model_usage[model] || (m.model_usage[model] =
-          { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-        mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
-      } else {
-        // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
-        // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
-        // attribute them to a real, priceable family bucket after the loop.
-        m._unlabeled.input += tin; m._unlabeled.output += tout;
-        m._unlabeled.cache_read += tcr; m._unlabeled.cache_creation += tcc;
-      }
-      const tools = [];
-      let textLen = 0;
-      let firstText = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_use') {
-            m.tool_use_count++;
-            tools.push(String(c.name || '?'));
-          } else if (c && c.type === 'text' && typeof c.text === 'string') {
-            textLen += c.text.length;
-            if (!firstText) firstText = c.text;
-          }
-        }
-      }
-      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
-      if (tools.length) row.tools = tools;
-      if (textLen) row.text_len = textLen;
-      const snip = snippetOf(firstText, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    } else if (e.type === 'user' && msg) {
-      m.user_turns++;
-      let results = 0;
-      let errors = 0;
-      let harnessRetries = 0;
-      let firstResult = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_result') {
-            results++;
-            m.tool_result_count++;
-            const text = typeof c.content === 'string'
-              ? c.content
-              : Array.isArray(c.content)
-                ? c.content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join(' ')
-                : '';
-            if (c.is_error) {
-              // Split benign harness guardrail retries out of the net error count
-              // so order=tool_errors ranks on real friction (task 959).
-              if (HARNESS_RETRY_RE.test(text)) {
-                harnessRetries++;
-                m.harness_retry_count++;
-              } else {
-                errors++;
-                m.tool_error_count++;
-              }
-            }
-            if (!firstResult) firstResult = text;
-          }
-        }
-      }
-      const row = { i, role: 'user', ts };
-      if (results) row.tool_results = results;
-      if (errors) row.tool_errors = errors;
-      if (harnessRetries) row.harness_retries = harnessRetries;
-      const snip = snippetOf(firstResult, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    }
-  }
-  m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
-  // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
-  // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
-  // agent path that gap was the difference between total_tokens>0 (so the digest
-  // passes the route's empty-session guard + gets stored) and model_usage={} (so
-  // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model
-  // usage" symptom. Fold the unlabeled remainder (NOT synthetic turns) into a real,
-  // priceable family bucket so the cost-plus reward reflects the true spend rather
-  // than silently dropping to $0. opus is the conservative family for an unlabeled
-  // turn (matches llm-pricing.js's unknown-model fallback) — this instance runs
-  // opus by default, and pricing an unlabeled turn as opus never UNDER-pays.
-  const un = m._unlabeled;
-  if (un.input + un.output + un.cache_read + un.cache_creation > 0) {
-    const fb = m.model_usage[UNATTRIBUTED_MODEL] || (m.model_usage[UNATTRIBUTED_MODEL] =
-      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-    fb.input += un.input; fb.output += un.output;
-    fb.cache_read += un.cache_read; fb.cache_creation += un.cache_creation;
-  }
-  delete m._unlabeled; // scratch — never persisted to the digest
-  let boundedDetail = detail;
-  if (detail.length > MAX_TURNS) {
-    const head = Math.floor(MAX_TURNS * 0.7);
-    const tail = MAX_TURNS - head;
-    boundedDetail = detail.slice(0, head).concat(detail.slice(detail.length - tail));
-    m.detail_truncated = true;
-    m.detail_total_turns = detail.length;
-  }
-  let durationSeconds = null;
-  if (firstTs && lastTs) {
-    const d = (Date.parse(lastTs) - Date.parse(firstTs)) / 1000;
-    if (Number.isFinite(d) && d >= 0) durationSeconds = Math.round(d);
-  }
-  return {
-    startedAt: firstTs,
-    endedAt: lastTs,
-    durationSeconds,
-    totalTokens: m.total_tokens,
-    metrics: m,
-    detail: boundedDetail,
-  };
-}
 
 // classifyUploadSkip — PURE decision for whether the session upload must skip,
 // and the clear, actionable reason why. Separated from I/O so it is unit-tested

package/src/module-api.js

@@ -1061,8 +1061,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.315 with no explicit bump. run 32669347711. (task 1002620)
 //   1.19.317 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
+//   1.19.318 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.317'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.318'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_reconciler.mjs

@@ -1695,3 +1695,41 @@ setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);
+
+// --- task 1003217: a sweep that only RAISED rows must not log silence --------
+
+test('1003217 runCostSweep reports raised rows (a raise-only sweep still logs)', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 3, totalUsd: 45, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(r.raised, 3, 'the raised count passes through');
+  assert.equal(logs.length, 1, 'a sweep that raised 3 rows logged — the old guard was reconciled>0 only');
+  assert.match(logs[0], /raised 3/, 'and the raise is named in the line');
+});
+
+test('1003217 a sweep that did nothing at all still logs nothing', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 0, totalUsd: 0, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 0, 'no ledger work → no line, as before');
+});
+
+test('1003217 an older deps bundle with no `raised` key still logs on reconciled', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 2, reconciled: 2, totalUsd: 3, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 1);
+  assert.doesNotMatch(logs[0], /raised/, 'no phantom "raised 0" noise when the key is absent');
+});

package/tests/session_cost.mjs

@@ -131,3 +131,67 @@ test('1344 addComponents / addTiers / roundTiers are pure and additive', () => {
   const rounded = sc.roundTiers({ fresh_input_usd: 1.000049, cache_read_usd: 0, cache_write_usd: 0, output_usd: 0 });
   assert.equal(rounded.fresh_input_usd, 1.0); // round to 4dp
 });
+
+// ---------- task 1003217: price one API call once, not once per line ----------
+//
+// A single assistant message is written to the transcript as several lines (one
+// per content block: thinking / text / tool_use), each repeating the SAME
+// message.usage. priceTranscript must dedup on message.id. Measured 2.22x
+// over-pricing on 12 real transcripts before this fix — and ADR 0054 pays
+// round(true_cost_usd x 1.20) off this number.
+function splitLine(id, model, usage, block) {
+  return JSON.stringify({ message: { id, role: 'assistant', model, usage, content: [block] } });
+}
+
+test('1003217 priceTranscript charges a split assistant message ONCE', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup-'));
+  const p = path.join(dir, 'split.jsonl');
+  const usage = { output_tokens: M }; // opus-5 output = $25/M
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'thinking', thinking: 'hmm' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'ok' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  assert.equal(r.total, 25, 'one call at 1M opus output = $25, NOT $75');
+});
+
+test('1003217 priceTranscript still charges distinct message ids separately', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup2-'));
+  const p = path.join(dir, 'three.jsonl');
+  const usage = { output_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_2', 'claude-opus-5', usage, { type: 'text', text: 'b' }),
+    splitLine('msg_3', 'claude-opus-5', usage, { type: 'text', text: 'c' }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 75, 'three real calls = $75');
+});
+
+test('1003217 priceTranscript keeps the tier split consistent with the deduped total', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup3-'));
+  const p = path.join(dir, 'tiers.jsonl');
+  const usage = { output_tokens: M, cache_read_input_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  // opus-5: output $25/M, cache_read $0.50/M → $25.50 for ONE call.
+  assert.equal(r.total, 25.5);
+  assert.equal(r.tiers.output_usd, 25);
+  assert.equal(r.tiers.cache_read_usd, 0.5);
+  const tierSum = r.tiers.fresh_input_usd + r.tiers.cache_read_usd
+    + r.tiers.cache_write_usd + r.tiers.output_usd;
+  assert.ok(Math.abs(tierSum - r.total) < 1e-9, 'the four tiers must still sum to total');
+});
+
+test('1003217 a transcript with no message.id prices per line (unchanged legacy path)', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup4-'));
+  const p = path.join(dir, 'noid.jsonl');
+  fs.writeFileSync(p, [
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 50, 'no id to dedup on → both lines charged');
+});

package/tests/session_cost_row_raise.mjs

@@ -0,0 +1,139 @@
+// tests/session_cost_row_raise.mjs — task 1003217 (real DB).
+//
+// BUG A: a long session's cost row froze at the FIRST ship. `session_records`
+// is upserted on every ship, so a twelve-task session has a digest from its
+// first ship; the reconciler priced that partial digest ~15 min later, and
+// logCost's `ON CONFLICT DO NOTHING` then silently dropped every later, larger
+// figure. Prod evidence: a 9.3-hour session billed at its first 56 minutes;
+// across four audited sessions the ledger held 14%, 14%, 16% and 54% of real
+// spend.
+//
+// What this pins, against real SQL because every claim here IS the SQL:
+//   • a never-priced session still gets its row (the original task-1366 job),
+//   • a session whose digest GREW is revisited and its row RAISED,
+//   • the raise is monotonic — a lower figure never lowers a paid row,
+//   • the sweep CONVERGES: once settled, a second run books nothing,
+//   • totalUsd bills only the INCREMENT on a raise, never the whole row again,
+//   • a client-split session (source_ref || ':sub') is still left alone.
+//
+// Real-DB integration test: self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=postgres:///bongos_test node --test tests/session_cost_row_raise.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const probe = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+let live = true;
+try { await probe.query('SELECT 1 FROM cost_log LIMIT 1'); } catch (e) {
+  console.log(`session_cost_row_raise.mjs SKIPPED — no reachable Postgres with the GDS schema (${e.code || e.message}).`);
+  live = false;
+}
+await probe.end().catch(() => {});
+
+const B = 90000411;                       // fixture builder
+const S1 = 'sess-raise-0000000000000001'; // grows across ships
+const S2 = 'sess-raise-0000000000000002'; // client-split, must be untouched
+const M = 1_000_000;
+
+// opus-5 cache_read is $0.50/M, so cache_read tokens make a clean, exact figure.
+const digest = (cacheReadM) => ({ 'claude-opus-5': { input: 0, output: 0, cache_read: cacheReadM * M, cache_creation: 0 } });
+
+if (live) {
+  const cost = require('../modules/economy/cost.js');
+  const pool = cost.pool || new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+  const q = (sql, p) => pool.query(sql, p).then((r) => r.rows);
+
+  const seedDigest = async (sid, cacheReadM, uploadedAgoMin) => q(
+    `INSERT INTO session_records (session_id, builder_id, model_usage, uploaded_at)
+     VALUES ($1,$2,$3::jsonb, now() - ($4 || ' minutes')::interval)
+     ON CONFLICT (session_id) DO UPDATE SET
+       model_usage = EXCLUDED.model_usage, uploaded_at = EXCLUDED.uploaded_at`,
+    [sid, B, JSON.stringify(digest(cacheReadM)), String(uploadedAgoMin)]
+  );
+  const row = async (sid) => (await q(
+    `SELECT amount_usd, cache_read_usd, description, recorded_at FROM cost_log
+      WHERE source='session:interactive' AND source_ref=$1`, [sid]))[0];
+  const rowCount = async (sid) => Number((await q(
+    `SELECT count(*) n FROM cost_log WHERE source_ref LIKE $1 || '%'`, [sid]))[0].n);
+  // Backdate the priced row, modelling production: the sweep prices an early
+  // partial digest, and the session keeps shipping for hours afterwards. The
+  // revisit predicate is `cost_log.recorded_at < session_records.uploaded_at`,
+  // so the row must genuinely predate the digest growth for a raise to be due.
+  const backdateRow = async (sid, minsAgo) => q(
+    `UPDATE cost_log SET recorded_at = now() - ($2 || ' minutes')::interval
+      WHERE source='session:interactive' AND source_ref=$1`, [sid, String(minsAgo)]);
+
+  const cleanup = async () => {
+    await q(`DELETE FROM cost_log WHERE source_ref LIKE 'sess-raise-%'`);
+    await q(`DELETE FROM session_records WHERE session_id LIKE 'sess-raise-%'`);
+    await q(`DELETE FROM builders WHERE id=$1`, [B]);
+  };
+
+  await cleanup();
+  await q(`INSERT INTO builders (id, github_id, github_login, display_name, rank)
+           VALUES ($1, 990000411, 'fixture-raise','fixture-raise','xenos')
+           ON CONFLICT (id) DO NOTHING`, [B]);
+
+  test('1003217 a never-priced session gets its row (the original task-1366 job)', async () => {
+    await seedDigest(S1, 10, 30); // 10M cache_read = $5.00
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.ok(r.scanned >= 1, 'the unpriced session is scanned');
+    const got = await row(S1);
+    assert.equal(Number(got.amount_usd), 5, 'priced at $5.00');
+    assert.match(got.description, /client cost-hook did not post/, 'first write keeps its provenance wording');
+  });
+
+  test('1003217 the row is RAISED when the digest grows (the frozen-row bug)', async () => {
+    // Priced an hour ago, off the first ship's partial digest...
+    await backdateRow(S1, 60);
+    // ...then the session shipped more tasks: the digest is replaced with the
+    // fuller transcript figure and uploaded_at moves forward.
+    await seedDigest(S1, 100, 20); // 100M cache_read = $50.00
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 1, 'exactly one row raised');
+    const got = await row(S1);
+    assert.equal(Number(got.amount_usd), 50, 'row caught up from $5 to $50');
+    assert.equal(Number(got.cache_read_usd), 50, 'the tier split is rewritten too, not left stale');
+    assert.match(got.description, /raised from \$5\.0000 as the session grew/, 'the raise is legible in the ledger');
+    // Only the increment is billed as this sweep's spend.
+    assert.ok(Math.abs(r.totalUsd - 45) < 1e-6, `totalUsd should be the $45 increment, got ${r.totalUsd}`);
+    assert.equal(await rowCount(S1), 1, 'still ONE row — a raise must never fork a second');
+  });
+
+  test('1003217 the sweep converges: a settled session books nothing on the next run', async () => {
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 0, 'nothing left to raise');
+    assert.equal(r.reconciled, 0, 'nothing left to insert');
+    assert.equal(Number((await row(S1)).amount_usd), 50, 'the row is unchanged');
+  });
+
+  test('1003217 the raise is MONOTONIC — a smaller figure never lowers a paid row', async () => {
+    // This is the "do not re-price history" guarantee: after the dedup fix
+    // (bug B) a re-priced old session computes LOWER, and llm-pricing.js is
+    // explicit that a paid row records what was charged. It must hold.
+    await backdateRow(S1, 60);
+    await seedDigest(S1, 4, 20); // would be $2.00 — far below the $50 on file
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 0, 'a downward move is not a raise');
+    assert.equal(Number((await row(S1)).amount_usd), 50, 'the row held at $50');
+    assert.ok(Math.abs(r.totalUsd) < 1e-9, 'and nothing was billed');
+  });
+
+  test('1003217 a client-split session (:sub) is still left entirely alone', async () => {
+    await seedDigest(S2, 10, 30);
+    await q(`INSERT INTO cost_log (amount_usd, category, source, source_ref, builder_id)
+             VALUES (1.23,'api','session:subagent',$1 || ':sub',$2)`, [S2, B]);
+    const before = await rowCount(S2);
+    await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(await rowCount(S2), before, 'no interactive row invented alongside the client split');
+    assert.equal(await row(S2), undefined, 'specifically: no session:interactive row for it');
+  });
+
+  test('cleanup', async () => {
+    await cleanup();
+    if (!cost.pool) await pool.end().catch(() => {});
+  });
+}

package/tests/session_records.mjs

@@ -405,3 +405,75 @@ test('a failed/empty subagent spawn digests to 0 tokens despite 1 assistant turn
 console.log('');
 console.log(`Session-records (6D.1) tests: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);
+
+// ---------- task 1003217: one API call is many transcript lines ----------
+//
+// Claude Code writes a separate line per content block of one assistant message
+// (thinking / text / tool_use) and repeats the SAME message.usage on each. The
+// digest must price the call ONCE. Measured 2.22x inflation on real transcripts
+// before this fix.
+function splitCallFixture() {
+  const usage = {
+    input_tokens: 2,
+    output_tokens: 799,
+    cache_read_input_tokens: 63182,
+    cache_creation_input_tokens: 3227,
+  };
+  const mk = (content) => ({
+    type: 'assistant',
+    timestamp: '2026-08-21T19:23:47.000Z',
+    message: { id: 'msg_01SPLIT', model: 'claude-opus-5', usage, content },
+  });
+  return [
+    mk([{ type: 'thinking', thinking: 'weighing it up' }]),
+    mk([{ type: 'text', text: 'Here is the plan.' }]),
+    mk([{ type: 'tool_use', name: 'Bash', input: { command: 'ls' } }]),
+  ];
+}
+
+test('1003217 buildSessionDigest prices one split assistant message ONCE, not per line', () => {
+  const d = buildSessionDigest(splitCallFixture());
+  // 3 transcript lines, 1 API call.
+  assert.equal(d.metrics.assistant_turns, 3, 'assistant_turns stays the LINE count for existing consumers');
+  assert.equal(d.metrics.api_calls, 1, 'api_calls is the honest round-trip count');
+  assert.equal(d.metrics.tokens.output, 799, 'output counted once, not 3x');
+  assert.equal(d.metrics.tokens.cache_read, 63182, 'cache_read counted once, not 3x');
+  assert.equal(d.metrics.tokens.cache_creation, 3227);
+  assert.equal(d.metrics.tokens.input, 2);
+  assert.equal(d.totalTokens, 2 + 799 + 63182 + 3227);
+  assert.deepEqual(d.metrics.model_usage['claude-opus-5'], {
+    input: 2, output: 799, cache_read: 63182, cache_creation: 3227,
+  }, 'model_usage — the cost-plus reward basis (ADR 0054) — must not be inflated');
+  // The tool_use on the third line is still seen.
+  assert.equal(d.metrics.tool_use_count, 1);
+});
+
+test('1003217 the detail rows still sum to the true usage (repeats zeroed + flagged)', () => {
+  const d = buildSessionDigest(splitCallFixture());
+  const asst = d.detail.filter((r) => r.role === 'assistant');
+  assert.equal(asst.length, 3, 'every line keeps its detail row');
+  const sum = (k) => asst.reduce((a, r) => a + (r[k] || 0), 0);
+  assert.equal(sum('cache_read'), 63182, 'summing detail must not double-count');
+  assert.equal(sum('out'), 799);
+  assert.equal(asst.filter((r) => r.dup === 1).length, 2, 'the two repeat lines are flagged dup');
+  assert.equal(asst[0].dup, undefined, 'the first line of the call is not a dup');
+});
+
+test('1003217 distinct message ids are still counted separately', () => {
+  const usage = { input_tokens: 0, output_tokens: 10, cache_read_input_tokens: 100, cache_creation_input_tokens: 0 };
+  const mk = (id) => ({
+    type: 'assistant',
+    timestamp: '2026-08-21T19:23:47.000Z',
+    message: { id, model: 'claude-opus-5', usage, content: [{ type: 'text', text: 'x' }] },
+  });
+  const d = buildSessionDigest([mk('msg_A'), mk('msg_B'), mk('msg_C')]);
+  assert.equal(d.metrics.api_calls, 3);
+  assert.equal(d.metrics.tokens.cache_read, 300, 'three real calls = three times the usage');
+});
+
+test('1003217 a transcript with no message.id degrades to the old per-line behaviour', () => {
+  const d = buildSessionDigest(fixture()); // fixture() messages carry no id
+  assert.equal(d.metrics.tokens.input, 300, 'unchanged from the pre-fix expectation');
+  assert.equal(d.metrics.tokens.output, 130);
+  assert.equal(d.metrics.api_calls, 2, 'with no id to dedup on, every line is its own call');
+});