@bongos/core 1.19.317 → 1.19.319

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.317",
-  "core_contract": "1.19.317",
-  "source_commit": "47d557d1d8a73aac8e99002c7a282f7bab39a700",
+  "core_version": "1.19.319",
+  "core_contract": "1.19.319",
+  "source_commit": "682a79a31b7882310cc854404a34a8743b0e3804",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T22:06:51.573Z",
+  "built_at": "2026-08-23T22:19:11.577Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1436,
+    "functional_verbatim": 1438,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1781,
-  "tree_sha256": "1a2430cfe83da4de17388e4663512e1eac2d35a6269e0f124f26e7004d09f0a8",
+  "file_count": 1783,
+  "tree_sha256": "7c253e075a3fb04c94cc2fb0df42550178740faa03e84c8e9c1cb7675be2c23f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2987,7 +2987,7 @@
     {
       "path": "modules/economy/cost.js",
       "mode": "0000644",
-      "sha256": "5d125e8b884ebfeb5687ee6748c49bf752d5757114ede98d0cabf2eee4a38b76"
+      "sha256": "01bc7725fe16388971fd4def2544d0de9af6b3a522973df7ef86386737933d40"
     },
     {
       "path": "modules/economy/credits.js",
@@ -3972,7 +3972,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "8f08c6d58db41ba247aaf5b04b5a8988365b469e96c0ad04c336f272ef308c4e"
+      "sha256": "28c61d55fe2b492f0fce4c99b60e88f0cbeb542c47c04482558818d65628e0d7"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4642,12 +4642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1bdb7a2ab4583036c92b3108244d5c30dc8aa6314ba28eb2339f3712deec806a"
+      "sha256": "cb1d669bd4b49b50fc37854b48c9363f3b6a7bccf503cd3a1291dfa87ac072ac"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2bbe8915c29c3f2cde9ef26aa885ddeb123f32caea804ed3146090147fa68a4d"
+      "sha256": "ca4620fbb1129ae165e0f7bfb9f4bc6d837c027a2d7326eec6d9418718bbf03c"
     },
     {
       "path": "public-docs/index.html",
@@ -5377,7 +5377,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "fa7803b178d64eda47d4f05032353582f7000359b13caea7d018112f03c9906a"
+      "sha256": "1e14a452c0ae53384facd6a20526a90106cb479c414937ebb7fe180f11c5fa31"
     },
     {
       "path": "scripts/gds/goal.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "e2e3cd6299f63b838ed5a78121eedcb44e76b3cc62b622581cd537c154b1d8ae"
+      "sha256": "c96e50e533f4e20dba91c6a26ac6efd2c6ad33ffcdc856eeb46af21a17e67975"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5832,7 +5832,12 @@
     {
       "path": "scripts/gds/session-cost.js",
       "mode": "0000644",
-      "sha256": "52d6c931fa0d7213632a365984ed360cb8df2d369762dbb417d0c0a1b74145a6"
+      "sha256": "fdf3b9d8e0089078da550ac65d0c012583cc21103a668deecf481383a73c9da1"
+    },
+    {
+      "path": "scripts/gds/session-digest-build.js",
+      "mode": "0000644",
+      "sha256": "95e5c21533f67588fd02fae311cef8985d3eee58ad3217fcb6e9998e1f4da965"
     },
     {
       "path": "scripts/gds/session-digest.js",
@@ -5867,7 +5872,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "f3005175abc0ba20e958381df6aee02402267e9956da466386656dd4e86ad8cf"
+      "sha256": "8f2c0ca63abae081cccfa96059ae07b008bd108f85866a248075cb4a1b7e025e"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -5942,7 +5947,7 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "e4ad34a4a98ad6e7327922c36a60eb54cbb507ca3e26a9ec793f5a9390eacd77"
+      "sha256": "065095ccdcb104ede0312375484f62b23742fa1bc446f9749505c22b71babb5d"
     },
     {
       "path": "scripts/gds/upgrade.js",
@@ -6327,7 +6332,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7301568d229fc28265cf1ad41b4d568923cc18d1f7098ef5403c971ed531839a"
+      "sha256": "c918c65478a9b35e7a10371f117e8a826c063f577331147740f9fa8ffa121161"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7252,7 +7257,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "360712fee43b00b410e4b3b8ca27e801ae41966ac0c5ce0a4679fa7943aa554b"
+      "sha256": "ce97c74d749ec3574c0683160b3ce5dad8a7af2dcf1ce53fd23e95f5e0ad480d"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",
@@ -8287,7 +8292,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "09c5e96eadbfd99f26579fbf67b2ccdf39c6c04415a2596e9dbd4644be8d3ebe"
+      "sha256": "5a9ea0bf7b4d776a6f9036b8bd060fef76335533274ed748e9b9d742da6960d3"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -8507,7 +8512,12 @@
     {
       "path": "tests/session_cost.mjs",
       "mode": "0000644",
-      "sha256": "6531fd14dbfc025543c4855c326746c126cfcc94173b9a724e56f74a989a1d4e"
+      "sha256": "5f330f79eee8c39dc589d892ba5fa6835906e7b61ff5fe52aec3285721e84876"
+    },
+    {
+      "path": "tests/session_cost_row_raise.mjs",
+      "mode": "0000644",
+      "sha256": "74a106432222df7d8e845ec409bd2e1d49aff18bf80cdeff032cfe91b1d6dc3f"
     },
     {
       "path": "tests/session_digest.mjs",
@@ -8527,7 +8537,7 @@
     {
       "path": "tests/session_records.mjs",
       "mode": "0000644",
-      "sha256": "c33e4f5bb635eb523bc7014fe8cfad343b7ab7753822644ce987cd419520c748"
+      "sha256": "8c62fe0bec07aea4c30f84d296eb7b40c9550606aacf6cb63f9644ca34f12069"
     },
     {
       "path": "tests/session_reward_on_land.mjs",
@@ -8862,7 +8872,7 @@
     {
       "path": "tests/update_channel.mjs",
       "mode": "0000644",
-      "sha256": "4e082a36725d91f00d5fc0cc266d32bf607c144994ac88cb2abb3b49149632da"
+      "sha256": "3b0912dcda6888b4daa2cd13bbef0cddddafc425c39a509dc4955ce77ddd720e"
     },
     {
       "path": "tests/upgrade.mjs",

package/modules/economy/cost.js

@@ -105,23 +105,51 @@ async function logCost({
   outputUsd = null,
   // task #385 / migration 181: which skill invocation incurred this cost.
   skillName = null,
+  // task 1003217 — opt-in MONOTONIC RAISE on (source, source_ref) conflict.
+  //
+  // Default false, so every existing caller keeps the plain insert-once
+  // idempotency it relies on. The session reconciler below sets it true: a
+  // long session's digest GROWS on every ship, and a cost row written from an
+  // early digest must be allowed to catch up, or the session is billed at its
+  // first hour forever (the bug this task fixes).
+  //
+  // Safe because the update SETS an absolute amount rather than adding to one:
+  // re-running with the same figure is a no-op, so there is no double-count
+  // path, and the WHERE guard means a row can only ever move UP.
+  raiseOnConflict = false,
 }) {
   // V3.R11 (#91): builder_id is the per-builder attribution column added by
   // migration 046. Routes default it to the authed builder, so the only
   // legitimately-null builder_id is for historical rows or system-injected
   // costs (infra, domain, etc.) that don't belong to any one person.
+  // Monotonic raise (opt-in) vs the historical insert-once. `recorded_at` moves
+  // with the amount so the reconciler's "digest is newer than the priced row"
+  // predicate settles instead of re-firing every sweep.
+  const conflictAction = raiseOnConflict
+    ? `DO UPDATE SET
+         amount_usd      = EXCLUDED.amount_usd,
+         description     = EXCLUDED.description,
+         fresh_input_usd = EXCLUDED.fresh_input_usd,
+         cache_read_usd  = EXCLUDED.cache_read_usd,
+         cache_write_usd = EXCLUDED.cache_write_usd,
+         output_usd      = EXCLUDED.output_usd,
+         recorded_at     = EXCLUDED.recorded_at
+       WHERE EXCLUDED.amount_usd > cost_log.amount_usd`
+    : 'DO NOTHING';
   const { rows } = await pool.query(
     `INSERT INTO cost_log (task_id, amount_usd, category, description, source, source_ref, recorded_at, builder_id,
                            fresh_input_usd, cache_read_usd, cache_write_usd, output_usd, skill_name)
      VALUES ($1, $2, $3, $4, $5, $6, COALESCE($7, now()), $8, $9, $10, $11, $12, $13)
      ON CONFLICT (source, source_ref)
        WHERE source IS NOT NULL AND source_ref IS NOT NULL
-       DO NOTHING
+       ${conflictAction}
      RETURNING id, recorded_at`,
     [taskId, amountUsd, category, description, source, sourceRef, recordedAt, builderId,
      freshInputUsd, cacheReadUsd, cacheWriteUsd, outputUsd, skillName || null]
   );
-  return rows[0] ?? null; // null when ON CONFLICT skipped the insert
+  // null when the conflict clause skipped the write (DO NOTHING, or a raise that
+  // would not have moved the row upward).
+  return rows[0] ?? null;
 }
 
 // task 1366 (System 1) — server-side session-cost reconciler.
@@ -144,25 +172,45 @@ async function logCost({
 //                        first crack at posting (avoids racing it). 15m default.
 //   - limit            : per-sweep cap (runaway guard; there are normally few).
 //
-// The NOT EXISTS checks BOTH the interactive key (session_id) AND the subagent
-// key (session_id || ':sub') — session-cost.js splits a captured session into
-// those two rows (task 1344), so a session the client captured even partially
-// is skipped entirely (we only have the combined model_usage, so we can't split
-// it; better to defer to the client's split than to add a duplicate total).
-// Returns { scanned, reconciled, totalUsd, unknownModels } for logging.
+// A session the CLIENT split into interactive + subagent rows (session_id ||
+// ':sub', task 1344) is skipped entirely — we hold only the combined
+// model_usage, so we cannot reproduce that split and should defer to it.
+//
+// task 1003217 — WHY THIS NO LONGER SKIPS EVERY PRICED SESSION. It used to
+// exclude any session that had a cost row at all. But `session_records` is
+// upserted on EVERY ship, so a session that ships twelve tasks has a digest
+// from its FIRST ship, and this sweep priced that partial digest ~15 minutes
+// later and then never looked again — logCost's DO NOTHING silently dropped
+// every subsequent, larger figure. Measured on prod: a 9.3-hour session was
+// billed at its first 56 minutes, and across four audited sessions the ledger
+// captured 14%, 14%, 16% and 54% of real spend. Now a session is revisited
+// while its digest is NEWER than the row we priced from it, and logCost raises
+// the row monotonically. `recorded_at` advances on each raise, so a settled
+// session stops matching and the sweep converges.
+//
+// Historical rows are NOT re-priced downward: llm-pricing.js is explicit that a
+// paid row records what was charged, and ADR 0054 paid credits from it. The
+// raise is upward-only, so pre-fix inflated rows stay as they are — expect a
+// visible step change in cost-per-ship at deploy rather than a rewritten past.
+// Returns { scanned, reconciled, raised, totalUsd, unknownModels } for logging.
 async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}) {
   const mins = Number.isFinite(Number(olderThanMinutes)) ? Number(olderThanMinutes) : 15;
   const lim = Number.isFinite(Number(limit)) ? Number(limit) : 500;
   const { rows } = await pool.query(
-    `SELECT sr.session_id, sr.builder_id, sr.model_usage
+    `SELECT sr.session_id, sr.builder_id, sr.model_usage,
+            c.amount_usd AS prior_usd
        FROM session_records sr
+       LEFT JOIN cost_log c
+              ON c.source = 'session:interactive'
+             AND c.source_ref = sr.session_id
       WHERE sr.model_usage IS NOT NULL
         AND sr.uploaded_at < now() - ($1 || ' minutes')::interval
         AND NOT EXISTS (
-          SELECT 1 FROM cost_log c
-           WHERE c.source_ref = sr.session_id
-              OR c.source_ref = sr.session_id || ':sub'
+          SELECT 1 FROM cost_log s
+           WHERE s.source_ref = sr.session_id || ':sub'
         )
+        -- Never priced, or the digest has grown since we priced it.
+        AND (c.id IS NULL OR c.recorded_at < sr.uploaded_at)
       ORDER BY sr.uploaded_at DESC
       LIMIT $2`,
     [String(mins), lim]
@@ -170,6 +218,7 @@ async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}
 
   const round4 = (n) => Math.round((Number(n) || 0) * 10000) / 10000;
   let reconciled = 0;
+  let raised = 0;
   let totalUsd = 0;
   const unknownModels = new Set();
   for (const r of rows) {
@@ -177,34 +226,50 @@ async function reconcileSessionCosts({ olderThanMinutes = 15, limit = 500 } = {}
     for (const m of comp.unknown_models) unknownModels.add(m);
     const amount = round4(comp.total_usd);
     if (!(amount > 0)) continue; // nothing priceable on this row — skip
+    const prior = round4(r.prior_usd);
+    // A row already at or above this figure needs no write: the digest grew but
+    // the price did not (or the stored row predates a pricing fix and is higher,
+    // which we deliberately leave alone).
+    if (prior > 0 && amount <= prior) continue;
     const id8 = String(r.session_id).slice(0, 8);
     const unkNote = comp.unknown_models.length
       ? ` [unpriced model(s) priced as opus: ${comp.unknown_models.join(',')}]`
       : '';
+    const provenance = prior > 0
+      ? `raised from $${prior.toFixed(4)} as the session grew`
+      : 'reconciled from digest; client cost-hook did not post';
     const inserted = await logCost({
       amountUsd: amount,
       category: 'api',
       source: 'session:interactive',
-      // SAME key the client would use → ON CONFLICT DO NOTHING prevents any
-      // double-count if the client also posts later.
+      // SAME key the client would use, so a client post and this sweep can
+      // never both land as separate rows.
       sourceRef: r.session_id,
       builderId: r.builder_id,
-      description: `session ${id8} — $${amount.toFixed(4)} (reconciled from digest; client cost-hook did not post)${unkNote}`.slice(0, 1000),
+      // Upward-only: catches a long session up as it ships more tasks, and can
+      // never lower a row that has already been paid from.
+      raiseOnConflict: true,
+      description: `session ${id8} — $${amount.toFixed(4)} (${provenance})${unkNote}`.slice(0, 1000),
       freshInputUsd: round4(comp.fresh_input_usd),
       cacheReadUsd: round4(comp.cache_read_usd),
       cacheWriteUsd: round4(comp.cache_write_usd),
       outputUsd: round4(comp.output_usd),
     });
-    // inserted === null means ON CONFLICT skipped it (client raced in between the
-    // SELECT and the INSERT) — expected + idempotent, not counted.
+    // inserted === null means the conflict clause skipped the write (the client
+    // raced in between the SELECT and the INSERT, or the raise would not have
+    // moved the row up) — expected + idempotent, not counted.
     if (inserted) {
-      reconciled++;
-      totalUsd += amount;
+      if (prior > 0) raised++;
+      else reconciled++;
+      // Bill only the INCREMENT on a raise, so this figure stays a true
+      // "spend recorded by this sweep" rather than re-counting the whole row.
+      totalUsd += amount - prior;
     }
   }
   return {
     scanned: rows.length,
     reconciled,
+    raised,
     totalUsd: round4(totalUsd),
     unknownModels: Array.from(unknownModels),
   };

package/modules/lifecycle/publish-reconciler.js

@@ -804,12 +804,17 @@ async function runCostSweep(deps = {}) {
   if (typeof reconciler.reconcileSessionCosts !== 'function') return { skipped: 'unsupported' };
   try {
     const cost = await reconciler.reconcileSessionCosts();
-    if (cost && cost.reconciled > 0) {
+    // task 1003217: `raised` counts long sessions caught up as their digest grew.
+    // It is reported alongside `reconciled` — a sweep that only raised rows did
+    // real ledger work and must not log silence.
+    const raised = Number(cost && cost.raised) || 0;
+    if (cost && (cost.reconciled > 0 || raised > 0)) {
       const unk = cost.unknownModels && cost.unknownModels.length
         ? ` [unpriced→opus: ${cost.unknownModels.join(',')}]`
         : '';
+      const raisedNote = raised > 0 ? `, raised ${raised}` : '';
       logFn(
-        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
+        `[publish-reconciler] session-cost: scanned ${cost.scanned}, reconciled ${cost.reconciled}${raisedNote} cost_log row(s) totalling $${Number(cost.totalUsd || 0).toFixed(4)}${unk}`
       );
     }
     return cost;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.317",
+  "version": "1.19.319",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.317",
+      "version": "1.19.319",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.317",
+  "version": "1.19.319",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",