@bongos/core 1.19.317 → 1.19.319

package/scripts/gds/ship.js

@@ -386,205 +386,14 @@ const {
   redactHighEntropy, collectEnvSecrets,
 } = require('../../modules/security/secret-scrub');
 
-// snippetOf — short, single-line, scrubbed excerpt for footgun context.
-function snippetOf(text, extraSecrets, max = 160) {
-  if (typeof text !== 'string' || text.length === 0) return undefined;
-  // Drop NULs first: Postgres rejects a literal NUL in jsonb, so ONE of them anywhere in
-  // ONE snippet made the whole digest unstorable — POST /sessions answered 500 and
-  // the session never paid. UTF-16LE tool output (`wsl --list` is the observed
-  // case) is full of them, and \s below does NOT match NUL, so it must go here.
-  const flat = text.replace(/\0/g, '').replace(/\s+/g, ' ').trim();
-  if (!flat) return undefined;
-  const cut = flat.length > max ? flat.slice(0, max) : flat;
-  const scrubbed = scrubSecrets(cut, extraSecrets);
-  return scrubbed || undefined;
-}
+// snippetOf + buildSessionDigest moved to ./session-digest-build (task 1003217,
+// serving the de-monolith goal of task 1003203) — pure, separately tested, and
+// shared with session-digest.js. Re-exported below so this file's public surface
+// and tests/session_records.mjs are unchanged.
+const {
+  snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL,
+} = require('./session-digest-build');
 
-// buildSessionDigest — turn parsed Claude Code transcript entries into
-// { startedAt, endedAt, durationSeconds, totalTokens, metrics, detail }.
-// Pure (no I/O) + exported for unit tests. `detail` is per-turn metadata + short
-// scrubbed snippets, capped at maxTurns (head+tail kept when over).
-// Harness guardrail retries (task 959) — an is_error tool_result that is NOT real
-// friction but the agent harness rejecting a tool call: an Edit/Write before the
-// file was Read ("File has not been read yet"), or a foreground sleep ("Blocked:
-// sleep"). These were counted in tool_error_count, inflating it and skewing the
-// BFG's order=tool_errors ranking (top sessions ranked on benign retries). They
-// now go into a separate harness_retry_count so tool_error_count stays NET — and
-// because the sessions/search ordering reads metrics->>'tool_error_count'
-// (src/bongos/db.js), that ordering automatically uses the net figure with no route
-// change. (ADR 0027 lineage — the 6D session evaluator.)
-const HARNESS_RETRY_RE =
-  /File has not been read yet|Read it first before (?:writing|editing)|Blocked:\s*sleep|sleep is blocked in (?:the )?foreground/i;
-
-// task 1676 — the family bucket unlabeled token-bearing turns are folded into so
-// the cost-plus reward (ADR 0054) prices the real spend instead of rounding to $0.
-// A concrete, priceable model id (llm-pricing.js maps it to the opus family by
-// substring) — NOT a fabricated dollar figure; it carries the REAL token counts
-// ship.js already parsed, priced server-side like any other bucket.
-const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
-
-function buildSessionDigest(entries, opts = {}) {
-  const extra = opts.extraSecrets || [];
-  const MAX_TURNS = opts.maxTurns || 4000;
-  const m = {
-    assistant_turns: 0,
-    user_turns: 0,
-    tool_use_count: 0,
-    tool_result_count: 0,
-    tool_error_count: 0, // NET real errors (harness guardrail retries excluded)
-    harness_retry_count: 0, // benign harness guardrail retries (task 959)
-    tokens: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-    model_usage: {}, // per-model token buckets for the cost-plus reward (task 1005)
-    // task 1676: tokens from turns with NO model id (not '<synthetic>'). Folded
-    // into a priceable bucket after the loop, then stripped from the digest.
-    _unlabeled: { input: 0, output: 0, cache_read: 0, cache_creation: 0 },
-  };
-  const detail = [];
-  let firstTs = null;
-  let lastTs = null;
-  let i = 0;
-  for (const e of Array.isArray(entries) ? entries : []) {
-    if (!e || typeof e !== 'object') continue;
-    const ts = typeof e.timestamp === 'string' ? e.timestamp : null;
-    if (ts) {
-      if (!firstTs) firstTs = ts;
-      lastTs = ts;
-    }
-    const msg = e.message;
-    if (e.type === 'assistant' && msg) {
-      m.assistant_turns++;
-      const u = msg.usage || {};
-      const tin = u.input_tokens || 0;
-      const tout = u.output_tokens || 0;
-      const tcr = u.cache_read_input_tokens || 0;
-      const tcc = u.cache_creation_input_tokens || 0;
-      m.tokens.input += tin;
-      m.tokens.output += tout;
-      m.tokens.cache_read += tcr;
-      m.tokens.cache_creation += tcc;
-      // task 1005: per-model bucket for the cost-plus token reward, reusing the
-      // tin/tout/tcr/tcc already parsed above (no second pass). Skip synthetic
-      // turns (a grader 429 etc. emits no real model id AND no real spend).
-      const model = msg.model;
-      if (model === '<synthetic>') {
-        // synthetic: no real spend — exclude from BOTH model_usage and the
-        // task-1676 unlabeled-remainder fold below (don't price phantom tokens).
-      } else if (model) {
-        const mu = m.model_usage[model] || (m.model_usage[model] =
-          { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-        mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
-      } else {
-        // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
-        // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
-        // attribute them to a real, priceable family bucket after the loop.
-        m._unlabeled.input += tin; m._unlabeled.output += tout;
-        m._unlabeled.cache_read += tcr; m._unlabeled.cache_creation += tcc;
-      }
-      const tools = [];
-      let textLen = 0;
-      let firstText = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_use') {
-            m.tool_use_count++;
-            tools.push(String(c.name || '?'));
-          } else if (c && c.type === 'text' && typeof c.text === 'string') {
-            textLen += c.text.length;
-            if (!firstText) firstText = c.text;
-          }
-        }
-      }
-      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
-      if (tools.length) row.tools = tools;
-      if (textLen) row.text_len = textLen;
-      const snip = snippetOf(firstText, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    } else if (e.type === 'user' && msg) {
-      m.user_turns++;
-      let results = 0;
-      let errors = 0;
-      let harnessRetries = 0;
-      let firstResult = '';
-      if (Array.isArray(msg.content)) {
-        for (const c of msg.content) {
-          if (c && c.type === 'tool_result') {
-            results++;
-            m.tool_result_count++;
-            const text = typeof c.content === 'string'
-              ? c.content
-              : Array.isArray(c.content)
-                ? c.content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join(' ')
-                : '';
-            if (c.is_error) {
-              // Split benign harness guardrail retries out of the net error count
-              // so order=tool_errors ranks on real friction (task 959).
-              if (HARNESS_RETRY_RE.test(text)) {
-                harnessRetries++;
-                m.harness_retry_count++;
-              } else {
-                errors++;
-                m.tool_error_count++;
-              }
-            }
-            if (!firstResult) firstResult = text;
-          }
-        }
-      }
-      const row = { i, role: 'user', ts };
-      if (results) row.tool_results = results;
-      if (errors) row.tool_errors = errors;
-      if (harnessRetries) row.harness_retries = harnessRetries;
-      const snip = snippetOf(firstResult, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
-      i++;
-    }
-  }
-  m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
-  // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
-  // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
-  // agent path that gap was the difference between total_tokens>0 (so the digest
-  // passes the route's empty-session guard + gets stored) and model_usage={} (so
-  // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model
-  // usage" symptom. Fold the unlabeled remainder (NOT synthetic turns) into a real,
-  // priceable family bucket so the cost-plus reward reflects the true spend rather
-  // than silently dropping to $0. opus is the conservative family for an unlabeled
-  // turn (matches llm-pricing.js's unknown-model fallback) — this instance runs
-  // opus by default, and pricing an unlabeled turn as opus never UNDER-pays.
-  const un = m._unlabeled;
-  if (un.input + un.output + un.cache_read + un.cache_creation > 0) {
-    const fb = m.model_usage[UNATTRIBUTED_MODEL] || (m.model_usage[UNATTRIBUTED_MODEL] =
-      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
-    fb.input += un.input; fb.output += un.output;
-    fb.cache_read += un.cache_read; fb.cache_creation += un.cache_creation;
-  }
-  delete m._unlabeled; // scratch — never persisted to the digest
-  let boundedDetail = detail;
-  if (detail.length > MAX_TURNS) {
-    const head = Math.floor(MAX_TURNS * 0.7);
-    const tail = MAX_TURNS - head;
-    boundedDetail = detail.slice(0, head).concat(detail.slice(detail.length - tail));
-    m.detail_truncated = true;
-    m.detail_total_turns = detail.length;
-  }
-  let durationSeconds = null;
-  if (firstTs && lastTs) {
-    const d = (Date.parse(lastTs) - Date.parse(firstTs)) / 1000;
-    if (Number.isFinite(d) && d >= 0) durationSeconds = Math.round(d);
-  }
-  return {
-    startedAt: firstTs,
-    endedAt: lastTs,
-    durationSeconds,
-    totalTokens: m.total_tokens,
-    metrics: m,
-    detail: boundedDetail,
-  };
-}
 
 // classifyUploadSkip — PURE decision for whether the session upload must skip,
 // and the clear, actionable reason why. Separated from I/O so it is unit-tested

package/scripts/gds/update-channel.js

@@ -159,6 +159,18 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
       service: r.service ? String(r.service) : null,
       healthUrl: r.healthUrl ? String(r.healthUrl) : null,
       channel: normalizeChannel(r.channel == null ? defaultChannel : r.channel),
+      // Deploy topology (task 1003219). Optional, and only meaningful together: with
+      // versionUrl + deployTimer present the sweep can hand the bump to go-live.js and
+      // inherit its backup, pull-deploy-timer guard and INDEPENDENT box-side version
+      // read-back. Absent, the sweep falls back to calling `bongos upgrade` directly.
+      // Carried through here because a normalizer that silently drops a field makes an
+      // entry look enrolled while the capability it names never engages.
+      versionUrl: r.versionUrl ? String(r.versionUrl) : null,
+      deployTimer: r.deployTimer ? String(r.deployTimer) : null,
+      deployService: r.deployService ? String(r.deployService) : null,
+      backupDb: r.backupDb ? String(r.backupDb) : null,
+      backupDir: r.backupDir ? String(r.backupDir) : null,
+      registryPackage: r.registryPackage ? String(r.registryPackage) : null,
       // Per-instance env merged into the `bongos upgrade` child (e.g. PGDATABASE so the migrate step
       // hits THIS instance's DB, not the control plane's — see the live-op learnings for demo). Only
       // string values are kept; anything else is ignored.

package/src/module-api.js

@@ -1061,8 +1061,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.315 with no explicit bump. run 32669347711. (task 1002620)
 //   1.19.317 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
+//   1.19.318 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
+//   1.19.319 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.318 with no explicit bump. run 32670195088. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.317'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.319'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/go_live.mjs

@@ -296,48 +296,40 @@ test("'could not check' is a distinct halt from 'absent'", () => {
 // `env K=V` list that omits it drops it too. This cost a real failed go-live.
 // ---------------------------------------------------------------------------
 
-test('a forwarded secret NEVER enters argv — it is handed over via --preserve-env', () => {
-  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { forward: ['NPM_TOKEN'] });
-  assert.match(cmd, /--preserve-env=NPM_TOKEN/);
-  // THE REGRESSION (task 1003218). `env K="$K"` kept the value out of the script TEXT,
-  // but the shell expands it before sudo runs and sudo LOGS THE FULL argv — which put
-  // the real token into the droplet's persistent journal 26 times. So the command must
-  // not mention the variable as an assignment at all, by reference or otherwise.
-  assert.ok(!/NPM_TOKEN=/.test(cmd.replace('--preserve-env=NPM_TOKEN', '')),
-    'a secret must never appear as an argv assignment — sudo logs argv');
-  // Non-secret config is still passed plainly; seeing PGDATABASE in a log is useful.
+test('a privileged npm command DERIVES its token — no secret in argv at all', () => {
+  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { needsNpm: true });
+  // THE REGRESSION, TWICE (task 1003218). `env NPM_TOKEN="$NPM_TOKEN"` put the value in
+  // sudo's COMMAND= field. `--preserve-env=NPM_TOKEN` moved it to sudo's ENV= field —
+  // a different field of the SAME log line, which is not a fix. sudo logs its whole
+  // invocation, so the only safe answer is that the secret is never part of it.
+  assert.ok(!/NPM_TOKEN=npm_/.test(cmd), 'no token VALUE may appear');
+  assert.ok(!/--preserve-env/.test(cmd), '--preserve-env logs the value in ENV=');
+  assert.ok(!/env [^;]*NPM_TOKEN="\$NPM_TOKEN"/.test(cmd), 'no by-reference assignment in argv either');
+  // What SHOULD be there: the child deriving it, and refusing to run on an empty read.
+  assert.match(cmd, /_authToken/);
+  assert.match(cmd, /EMPTY NPM_TOKEN/);
+  // Non-secret config still travels plainly.
   assert.match(cmd, /PGDATABASE=cb/);
 });
 
-test('forwarding is only wired when the target names an env file to source from', () => {
-  // Otherwise K="$K" expands to empty and silently does nothing — a quiet no-op
-  // is worse than not trying.
-  assert.deepEqual(G.npmForward({ npmEnvFile: '/etc/x/npm.env' }), ['NPM_TOKEN']);
-  assert.deepEqual(G.npmForward({}), []);
+test('an empty token ABORTS rather than half-running', () => {
+  // An empty token sends npm to the PUBLIC registry, which 404s the private core, which
+  // auto-rolls-back "cleanly" — a failure that teaches you nothing. Fail loudly instead.
+  assert.match(G.NPM_AUTH_PREAMBLE, /exit 12/);
 });
 
-test('an unvetted variable name never reaches the command', () => {
-  const cmd = G.asOwner({ runAs: 'me' }, 'x', { forward: ['GOOD', 'bad name', '$(id)', '1BAD'] });
-  assert.match(cmd, /--preserve-env=GOOD/);
-  assert.ok(!cmd.includes('bad name') && !cmd.includes('$(id)') && !cmd.includes('1BAD'));
-});
-
-test('with no privilege drop a secret needs no mention at all', () => {
-  // The child already inherits our environment, so naming it would be pure exposure.
-  const cmd = G.asOwner({ env: { A: 'b' } }, 'x', { forward: ['NPM_TOKEN'] });
-  assert.equal(cmd, 'env A=b x');
+test('a command that does not need npm is left alone', () => {
+  const cmd = G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi');
+  assert.equal(cmd, 'sudo -u me -H env PGDATABASE=mydb HOME=/home/me echo hi');
   assert.ok(!cmd.includes('NPM_TOKEN'));
 });
 
-test('no forwarding leaves the documented sudo shape untouched', () => {
-  assert.equal(G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi'),
-    'sudo -u me -H env PGDATABASE=mydb HOME=/home/me echo hi');
+test('with no privilege drop the command still derives its own auth', () => {
+  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x', { needsNpm: true });
+  assert.ok(!cmd.startsWith('sudo'));
+  assert.match(cmd, /_authToken/);
 });
 
-// ---------------------------------------------------------------------------
-// A failed run must say what the tool said
-// ---------------------------------------------------------------------------
-
 test('the report surfaces the failing tool’s own words', () => {
   const out = G.renderReport({
     ok: false, failedAt: 'UPGRADE', targetName: 'web', from: '1.19.305', to: '1.19.306',
@@ -378,3 +370,44 @@ test('a spawn error is handled, not thrown', () => {
   const r = G.refreshMain({ run: () => ({ error: new Error('ENOENT'), status: null }) });
   assert.equal(r.ok, false);
 });
+
+// ---------------------------------------------------------------------------
+// Local execution — one engine, two callers (task 1003219)
+//
+// The nightly lane runs ON the box, so it cannot reach the deploy path through ssh.
+// Without a local mode it would need a second implementation, and the two would
+// drift — which is exactly how the unattended deploy ended up with WEAKER checks
+// than the manual one (no backup, no timer guard, no independent read-back).
+// ---------------------------------------------------------------------------
+
+test('a target with no ssh host is local; one with an ssh host is not', () => {
+  const base = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.equal(G.isLocalTarget(base), true);
+  assert.equal(G.isLocalTarget({ ...base, ssh: 'my-box' }), false);
+});
+
+test('ssh is OPTIONAL — a local target validates clean', () => {
+  const local = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.deepEqual(G.validateTarget('local', local), []);
+});
+
+test('the remaining required fields are still enforced for a local target', () => {
+  const errs = G.validateTarget('local', { instanceDir: '/i' });
+  for (const f of ['service', 'healthUrl', 'versionUrl', 'deployTimer']) {
+    assert.match(errs.join(' '), new RegExp(`missing required field "${f}"`));
+  }
+  // ssh must NOT be demanded any more.
+  assert.ok(!/missing required field "ssh"/.test(errs.join(' ')));
+});
+
+test('`local` is a boolean flag, not a shell token', () => {
+  const base = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.deepEqual(G.validateTarget('t', { ...base, local: true }), []);
+  assert.match(G.validateTarget('t', { ...base, local: 'yes' }).join(' '), /must be true or false/);
+});
+
+test('gitRefExists reports rather than throwing', () => {
+  assert.equal(G.gitRefExists('x', { run: () => ({ status: 0 }) }), true);
+  assert.equal(G.gitRefExists('x', { run: () => ({ status: 1 }) }), false);
+  assert.equal(G.gitRefExists('x', { run: () => ({ error: new Error('ENOENT') }) }), false);
+});

package/tests/publish_reconciler.mjs

@@ -1695,3 +1695,41 @@ setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);
+
+// --- task 1003217: a sweep that only RAISED rows must not log silence --------
+
+test('1003217 runCostSweep reports raised rows (a raise-only sweep still logs)', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 3, totalUsd: 45, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(r.raised, 3, 'the raised count passes through');
+  assert.equal(logs.length, 1, 'a sweep that raised 3 rows logged — the old guard was reconciled>0 only');
+  assert.match(logs[0], /raised 3/, 'and the raise is named in the line');
+});
+
+test('1003217 a sweep that did nothing at all still logs nothing', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 12, reconciled: 0, raised: 0, totalUsd: 0, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 0, 'no ledger work → no line, as before');
+});
+
+test('1003217 an older deps bundle with no `raised` key still logs on reconciled', async () => {
+  const logs = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => ({ scanned: 2, reconciled: 2, totalUsd: 3, unknownModels: [] }) },
+    log: (m) => logs.push(m),
+    error: () => {},
+  };
+  await reconciler.runCostSweep(deps);
+  assert.equal(logs.length, 1);
+  assert.doesNotMatch(logs[0], /raised/, 'no phantom "raised 0" noise when the key is absent');
+});

package/tests/session_cost.mjs

@@ -131,3 +131,67 @@ test('1344 addComponents / addTiers / roundTiers are pure and additive', () => {
   const rounded = sc.roundTiers({ fresh_input_usd: 1.000049, cache_read_usd: 0, cache_write_usd: 0, output_usd: 0 });
   assert.equal(rounded.fresh_input_usd, 1.0); // round to 4dp
 });
+
+// ---------- task 1003217: price one API call once, not once per line ----------
+//
+// A single assistant message is written to the transcript as several lines (one
+// per content block: thinking / text / tool_use), each repeating the SAME
+// message.usage. priceTranscript must dedup on message.id. Measured 2.22x
+// over-pricing on 12 real transcripts before this fix — and ADR 0054 pays
+// round(true_cost_usd x 1.20) off this number.
+function splitLine(id, model, usage, block) {
+  return JSON.stringify({ message: { id, role: 'assistant', model, usage, content: [block] } });
+}
+
+test('1003217 priceTranscript charges a split assistant message ONCE', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup-'));
+  const p = path.join(dir, 'split.jsonl');
+  const usage = { output_tokens: M }; // opus-5 output = $25/M
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'thinking', thinking: 'hmm' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'ok' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  assert.equal(r.total, 25, 'one call at 1M opus output = $25, NOT $75');
+});
+
+test('1003217 priceTranscript still charges distinct message ids separately', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup2-'));
+  const p = path.join(dir, 'three.jsonl');
+  const usage = { output_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_2', 'claude-opus-5', usage, { type: 'text', text: 'b' }),
+    splitLine('msg_3', 'claude-opus-5', usage, { type: 'text', text: 'c' }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 75, 'three real calls = $75');
+});
+
+test('1003217 priceTranscript keeps the tier split consistent with the deduped total', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup3-'));
+  const p = path.join(dir, 'tiers.jsonl');
+  const usage = { output_tokens: M, cache_read_input_tokens: M };
+  fs.writeFileSync(p, [
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'text', text: 'a' }),
+    splitLine('msg_1', 'claude-opus-5', usage, { type: 'tool_use', name: 'Bash' }),
+  ].join('\n'));
+  const r = sc.priceTranscript(p);
+  // opus-5: output $25/M, cache_read $0.50/M → $25.50 for ONE call.
+  assert.equal(r.total, 25.5);
+  assert.equal(r.tiers.output_usd, 25);
+  assert.equal(r.tiers.cache_read_usd, 0.5);
+  const tierSum = r.tiers.fresh_input_usd + r.tiers.cache_read_usd
+    + r.tiers.cache_write_usd + r.tiers.output_usd;
+  assert.ok(Math.abs(tierSum - r.total) < 1e-9, 'the four tiers must still sum to total');
+});
+
+test('1003217 a transcript with no message.id prices per line (unchanged legacy path)', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dedup4-'));
+  const p = path.join(dir, 'noid.jsonl');
+  fs.writeFileSync(p, [
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+    JSON.stringify({ message: { role: 'assistant', model: 'claude-opus-5', usage: { output_tokens: M } } }),
+  ].join('\n'));
+  assert.equal(sc.priceTranscript(p).total, 50, 'no id to dedup on → both lines charged');
+});

package/tests/session_cost_row_raise.mjs

@@ -0,0 +1,139 @@
+// tests/session_cost_row_raise.mjs — task 1003217 (real DB).
+//
+// BUG A: a long session's cost row froze at the FIRST ship. `session_records`
+// is upserted on every ship, so a twelve-task session has a digest from its
+// first ship; the reconciler priced that partial digest ~15 min later, and
+// logCost's `ON CONFLICT DO NOTHING` then silently dropped every later, larger
+// figure. Prod evidence: a 9.3-hour session billed at its first 56 minutes;
+// across four audited sessions the ledger held 14%, 14%, 16% and 54% of real
+// spend.
+//
+// What this pins, against real SQL because every claim here IS the SQL:
+//   • a never-priced session still gets its row (the original task-1366 job),
+//   • a session whose digest GREW is revisited and its row RAISED,
+//   • the raise is monotonic — a lower figure never lowers a paid row,
+//   • the sweep CONVERGES: once settled, a second run books nothing,
+//   • totalUsd bills only the INCREMENT on a raise, never the whole row again,
+//   • a client-split session (source_ref || ':sub') is still left alone.
+//
+// Real-DB integration test: self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=postgres:///bongos_test node --test tests/session_cost_row_raise.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const probe = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+let live = true;
+try { await probe.query('SELECT 1 FROM cost_log LIMIT 1'); } catch (e) {
+  console.log(`session_cost_row_raise.mjs SKIPPED — no reachable Postgres with the GDS schema (${e.code || e.message}).`);
+  live = false;
+}
+await probe.end().catch(() => {});
+
+const B = 90000411;                       // fixture builder
+const S1 = 'sess-raise-0000000000000001'; // grows across ships
+const S2 = 'sess-raise-0000000000000002'; // client-split, must be untouched
+const M = 1_000_000;
+
+// opus-5 cache_read is $0.50/M, so cache_read tokens make a clean, exact figure.
+const digest = (cacheReadM) => ({ 'claude-opus-5': { input: 0, output: 0, cache_read: cacheReadM * M, cache_creation: 0 } });
+
+if (live) {
+  const cost = require('../modules/economy/cost.js');
+  const pool = cost.pool || new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+  const q = (sql, p) => pool.query(sql, p).then((r) => r.rows);
+
+  const seedDigest = async (sid, cacheReadM, uploadedAgoMin) => q(
+    `INSERT INTO session_records (session_id, builder_id, model_usage, uploaded_at)
+     VALUES ($1,$2,$3::jsonb, now() - ($4 || ' minutes')::interval)
+     ON CONFLICT (session_id) DO UPDATE SET
+       model_usage = EXCLUDED.model_usage, uploaded_at = EXCLUDED.uploaded_at`,
+    [sid, B, JSON.stringify(digest(cacheReadM)), String(uploadedAgoMin)]
+  );
+  const row = async (sid) => (await q(
+    `SELECT amount_usd, cache_read_usd, description, recorded_at FROM cost_log
+      WHERE source='session:interactive' AND source_ref=$1`, [sid]))[0];
+  const rowCount = async (sid) => Number((await q(
+    `SELECT count(*) n FROM cost_log WHERE source_ref LIKE $1 || '%'`, [sid]))[0].n);
+  // Backdate the priced row, modelling production: the sweep prices an early
+  // partial digest, and the session keeps shipping for hours afterwards. The
+  // revisit predicate is `cost_log.recorded_at < session_records.uploaded_at`,
+  // so the row must genuinely predate the digest growth for a raise to be due.
+  const backdateRow = async (sid, minsAgo) => q(
+    `UPDATE cost_log SET recorded_at = now() - ($2 || ' minutes')::interval
+      WHERE source='session:interactive' AND source_ref=$1`, [sid, String(minsAgo)]);
+
+  const cleanup = async () => {
+    await q(`DELETE FROM cost_log WHERE source_ref LIKE 'sess-raise-%'`);
+    await q(`DELETE FROM session_records WHERE session_id LIKE 'sess-raise-%'`);
+    await q(`DELETE FROM builders WHERE id=$1`, [B]);
+  };
+
+  await cleanup();
+  await q(`INSERT INTO builders (id, github_id, github_login, display_name, rank)
+           VALUES ($1, 990000411, 'fixture-raise','fixture-raise','xenos')
+           ON CONFLICT (id) DO NOTHING`, [B]);
+
+  test('1003217 a never-priced session gets its row (the original task-1366 job)', async () => {
+    await seedDigest(S1, 10, 30); // 10M cache_read = $5.00
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.ok(r.scanned >= 1, 'the unpriced session is scanned');
+    const got = await row(S1);
+    assert.equal(Number(got.amount_usd), 5, 'priced at $5.00');
+    assert.match(got.description, /client cost-hook did not post/, 'first write keeps its provenance wording');
+  });
+
+  test('1003217 the row is RAISED when the digest grows (the frozen-row bug)', async () => {
+    // Priced an hour ago, off the first ship's partial digest...
+    await backdateRow(S1, 60);
+    // ...then the session shipped more tasks: the digest is replaced with the
+    // fuller transcript figure and uploaded_at moves forward.
+    await seedDigest(S1, 100, 20); // 100M cache_read = $50.00
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 1, 'exactly one row raised');
+    const got = await row(S1);
+    assert.equal(Number(got.amount_usd), 50, 'row caught up from $5 to $50');
+    assert.equal(Number(got.cache_read_usd), 50, 'the tier split is rewritten too, not left stale');
+    assert.match(got.description, /raised from \$5\.0000 as the session grew/, 'the raise is legible in the ledger');
+    // Only the increment is billed as this sweep's spend.
+    assert.ok(Math.abs(r.totalUsd - 45) < 1e-6, `totalUsd should be the $45 increment, got ${r.totalUsd}`);
+    assert.equal(await rowCount(S1), 1, 'still ONE row — a raise must never fork a second');
+  });
+
+  test('1003217 the sweep converges: a settled session books nothing on the next run', async () => {
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 0, 'nothing left to raise');
+    assert.equal(r.reconciled, 0, 'nothing left to insert');
+    assert.equal(Number((await row(S1)).amount_usd), 50, 'the row is unchanged');
+  });
+
+  test('1003217 the raise is MONOTONIC — a smaller figure never lowers a paid row', async () => {
+    // This is the "do not re-price history" guarantee: after the dedup fix
+    // (bug B) a re-priced old session computes LOWER, and llm-pricing.js is
+    // explicit that a paid row records what was charged. It must hold.
+    await backdateRow(S1, 60);
+    await seedDigest(S1, 4, 20); // would be $2.00 — far below the $50 on file
+    const r = await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(r.raised, 0, 'a downward move is not a raise');
+    assert.equal(Number((await row(S1)).amount_usd), 50, 'the row held at $50');
+    assert.ok(Math.abs(r.totalUsd) < 1e-9, 'and nothing was billed');
+  });
+
+  test('1003217 a client-split session (:sub) is still left entirely alone', async () => {
+    await seedDigest(S2, 10, 30);
+    await q(`INSERT INTO cost_log (amount_usd, category, source, source_ref, builder_id)
+             VALUES (1.23,'api','session:subagent',$1 || ':sub',$2)`, [S2, B]);
+    const before = await rowCount(S2);
+    await cost.reconcileSessionCosts({ olderThanMinutes: 15 });
+    assert.equal(await rowCount(S2), before, 'no interactive row invented alongside the client split');
+    assert.equal(await row(S2), undefined, 'specifically: no session:interactive row for it');
+  });
+
+  test('cleanup', async () => {
+    await cleanup();
+    if (!cost.pool) await pool.end().catch(() => {});
+  });
+}