@bongos/core 1.19.443 → 1.19.444

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.443",
-  "core_contract": "1.19.443",
-  "source_commit": "2e6da9fe02d34bf143e0e9594c918bb9a040fd29",
+  "core_version": "1.19.444",
+  "core_contract": "1.19.444",
+  "source_commit": "6a56c81be62cf4638f6b5b72bd88cf7523135092",
   "source_ref": "HEAD",
-  "built_at": "2026-08-30T19:15:33.921Z",
+  "built_at": "2026-08-30T20:54:19.941Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 370,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2147,
-  "tree_sha256": "d25acff4d119ed422abec9100c8ebeaa0cd1d33e851cc57fbb3b78408d060195",
+  "tree_sha256": "7285bb9b1aa117e2737ae06222ec335d9d10c8437c1d89036eeb141d1fa0a46a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -717,7 +717,7 @@
     {
       "path": "docs/adr/0054-session-token-reward-cost-plus.md",
       "mode": "0000644",
-      "sha256": "0b345b36f099781477667d3568d4afa1bdc67e39a23039f265eb3cc0ce3997be"
+      "sha256": "63457c6355aa510ca0840f8cd783e69a5d9ce9a6764e90896f5efcf117e557bb"
     },
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
@@ -2002,7 +2002,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "20a0df037f1aac6a1ef7a5a1e0899003ffc7255091fbf046f39edf3b6a17f119"
+      "sha256": "b600ec9449f02043cdd38525642177270148161abd142830c308d5949eb9ef24"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6152,12 +6152,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8f5287cfad2d118016691d00f94d58d1c260f01f902cdcc2a793abeb2fbc49bc"
+      "sha256": "d98226fae4927f559b5317bdf43b5a10d5274b899afba24f98863c8bb8b52865"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "22d4558b60946c1fc2ca2702a83bfdf4a3cd452a563d520bbeff1fd510558f41"
+      "sha256": "ba49db7e69feb40ac43df19e0b38bde6fd4dc553d77533a7e0253233efc899fc"
     },
     {
       "path": "public-docs/index.html",
@@ -7167,12 +7167,12 @@
     {
       "path": "scripts/gds/session-digest-build.js",
       "mode": "0000644",
-      "sha256": "95e5c21533f67588fd02fae311cef8985d3eee58ad3217fcb6e9998e1f4da965"
+      "sha256": "2409e6e4bb4edbe67336ebffb63832ba2c07830b8af858f5c372e4ba093cf192"
     },
     {
       "path": "scripts/gds/session-digest.js",
       "mode": "0000644",
-      "sha256": "133189036f34e14f45ba7f70b874fddb92b84e8925c16604ebbdf06bed7f6d23"
+      "sha256": "81500cc2955e7159720a5cf260fa73e3790c0b4fd0c2e50cb64dbc481b5882ae"
     },
     {
       "path": "scripts/gds/session-eval.js",
@@ -7267,7 +7267,7 @@
     {
       "path": "scripts/gds/ship-session-upload.js",
       "mode": "0000644",
-      "sha256": "8a700110c7e13249dc16991b481c6abf385c9c4ee7d1e683b7d495f6aef5f708"
+      "sha256": "46749850c4ccd88797978282d0345ff73a34f10e670922e52a8dbf75664ca3a7"
     },
     {
       "path": "scripts/gds/ship-state.js",
@@ -7287,7 +7287,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "342dd41ae45a1c7babd30b0ec136706034e4873a43bb6779a7df428bcceffb33"
+      "sha256": "7264827d7dc6a5d8babf5b0f6aa8384fa9c14fca71ba07a649226ce98dd84e0d"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -7802,7 +7802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1b8b0ca8cb8d04dd2e96c16ec31f42ac105c1434e2ff49c5f19ff195b33832cb"
+      "sha256": "cf2b8751ec0c1b79dce16d5117243cf917b15c62b798b66a68c8f857f1762557"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8452,7 +8452,7 @@
     {
       "path": "tests/credit_grant.mjs",
       "mode": "0000644",
-      "sha256": "2b871880fc9e6d636c5fb93d2641abad964f4d3e0ed1e78939b12dc849a7631d"
+      "sha256": "dcb35adea926027490b7ca20a59fd596d2db097cc84ec004a372e922602098c8"
     },
     {
       "path": "tests/criterion_authoring_gate.mjs",

package/docs/adr/0054-session-token-reward-cost-plus.md

@@ -61,3 +61,17 @@ Revisit when: (a) per-task token attribution lands (the unit becomes the task, n
 - `computeSessionTokenReward` in `src/bongos/db.js` changed accordingly; `tests/credit_grant.mjs` updated; `llm-pricing.js` (the token→USD table) is **unchanged** — only the cents→dollars scale factor moved.
 - **History was re-denominated, not left mixed.** Per the "append-only, reversible" rule above, existing `session.token_reward` rows were **not mutated**; a single compensating `credit_log` row (`reason='redenominate.token_reward_dollars'`, `task_id` → [#1138](https://example.com/builders#/task/1138)) restates the running total from cents to dollars, and the `total_credits` trigger nets it automatically. The original cents rows remain as historical record; the `session_records.token_reward_example` display mirror was divided by 100 to match. At amendment time builder `#1` (example-owner) was the only holder of token rewards, so this touched one builder.
 - **The per-task `credits_reward` path (ADR 0023) is untouched** — it stays a unitless author estimate. The two-conventions tension (§"Two drachma conventions, one ledger") is now *narrower* (both paths read on a ~dollar scale) but not formally reconciled; trigger (c) remains open for a full reconciliation.
+
+## Amendment — 2026-08-30 (task 1003435): the priced unit is the SESSION, subagents included
+
+**A gap in the Decision's premise, not a change to its formula.** The formula above prices `session_records.model_usage`, and that map was built from exactly one file — the interactive transcript. Claude Code persists Agent/Task-tool spawns in a sibling subtree (`<project-dir>/<session-id>/subagents/*.jsonl`), so a session's subagent tokens were invisible to the reward. The spend ledger had already closed this gap on its side: [ADR 0028](<redacted>.md)'s `session-cost.js` prices that subtree into its own `session:<redacted> cost row. Only the reward still read one file.
+
+That inverted the methodology's own instruction. CLAUDE.md tells builders to delegate freely and to route most subagent work to the top model tier; following it moved real, productive spend into a bucket the reward could not see, so the same work paid less when it was parallelized. This is **not** the accepted waste risk recorded in §"The residual rewards waste risk" — that section knowingly accepts paying for tokens that turned out wasteful. This was the opposite failure: guidance-following spend that earned nothing.
+
+**Change:** `model_usage` now describes the whole session — the interactive thread plus its subagents subtree. Grader worker transcripts are excluded **by signature**, not by location, reusing `looksLikeGraderTranscript()`, because a grader run can nest inside a `subagents/` dir and its cost is already captured through the worker envelope; re-pricing it would double-count, which is the ADR 0028 invariant.
+
+**The deliberate asymmetry, recorded because it looks like a bug otherwise.** Only `model_usage` grew. `detail`, `metrics.tokens`, `assistant_turns` and `total_tokens` remain the **interactive thread's** record. Those feed the BFG session corpus and the inefficiency evaluator ([ADR 0027](<redacted>.md)), which reason about one agent's turn-by-turn behaviour; splicing N subagent transcripts into that per-turn story would distort the very signal it exists to measure, and bloat the payload. So `total_tokens` is deliberately **less than** the sum of `model_usage`, and three counters — `subagent_files`, `subagent_tokens`, `subagent_grader_skipped` — carry the difference explicitly rather than leaving a reader to infer it from a mismatch.
+
+**The acceptance test is a reconciliation, not a fixture.** `tests/credit_grant.mjs` runs both real pricing paths over one on-disk fixture and asserts the reward's `true_cost_usd` equals the sum of that session's `session:<redacted> and `session:<redacted> cost rows within independent-rounding epsilon — so a change made to one side and not the other fails the build. Idempotency is unchanged: the award is still a per-session watermark, so a re-ship pays only the increment and never twice.
+
+**Not done here, and an owner decision:** past parallel sessions were underpaid. History stays append-only; a backfill would be its own task, with the 2026-06-15 re-denomination above as the worked precedent for the compensating-row shape.

package/docs/module-api-changelog.md

@@ -1323,5 +1323,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.441 with no explicit bump. run 33326781131. (task 1002620)
   1.19.443 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.442 with no explicit bump. run 33330337830. (task 1002620)
+  1.19.444 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.443 with no explicit bump. run 33334908383. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.443",
+  "version": "1.19.444",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.443",
+      "version": "1.19.444",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.443",
+  "version": "1.19.444",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/session-digest-build.js

@@ -87,6 +87,16 @@ const UNATTRIBUTED_MODEL = 'claude-opus-4-8';
 function buildSessionDigest(entries, opts = {}) {
   const extra = opts.extraSecrets || [];
   const MAX_TURNS = opts.maxTurns || 4000;
+  // usageOnly — build the token metrics but no `detail`. For the callers that
+  // want ONLY a transcript's model_usage (the subagents-subtree fold, task
+  // 1003435), where the per-turn rows would be discarded anyway and the snippet
+  // scrubbing is the expensive part. It exists so that fold can reuse THIS
+  // function — the one place the token semantics live — instead of a second copy
+  // that could drift, without paying for output nobody reads. The waste is worth
+  // avoiding on both upload paths, and on the SessionEnd one it is load-bearing:
+  // that hook runs under a 6-second watchdog, so a slow pass there doesn't just
+  // cost time, it drops the upload.
+  const usageOnly = opts.usageOnly === true;
   const seenMessageIds = new Set();
   const m = {
     assistant_turns: 0,
@@ -165,15 +175,17 @@ function buildSessionDigest(entries, opts = {}) {
           }
         }
       }
-      const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
-      // Marks a line that shares its API call with an earlier one, so a reader
-      // can tell a genuinely-zero-usage turn from a de-duplicated repeat.
-      if (dupUsage) row.dup = 1;
-      if (tools.length) row.tools = tools;
-      if (textLen) row.text_len = textLen;
-      const snip = snippetOf(firstText, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
+      if (!usageOnly) {
+        const row = { i, role: 'assistant', ts, in: tin, out: tout, cache_read: tcr, cache_creation: tcc };
+        // Marks a line that shares its API call with an earlier one, so a reader
+        // can tell a genuinely-zero-usage turn from a de-duplicated repeat.
+        if (dupUsage) row.dup = 1;
+        if (tools.length) row.tools = tools;
+        if (textLen) row.text_len = textLen;
+        const snip = snippetOf(firstText, extra);
+        if (snip) row.snippet = snip;
+        detail.push(row);
+      }
       i++;
     } else if (e.type === 'user' && msg) {
       m.user_turns++;
@@ -206,13 +218,15 @@ function buildSessionDigest(entries, opts = {}) {
           }
         }
       }
-      const row = { i, role: 'user', ts };
-      if (results) row.tool_results = results;
-      if (errors) row.tool_errors = errors;
-      if (harnessRetries) row.harness_retries = harnessRetries;
-      const snip = snippetOf(firstResult, extra);
-      if (snip) row.snippet = snip;
-      detail.push(row);
+      if (!usageOnly) {
+        const row = { i, role: 'user', ts };
+        if (results) row.tool_results = results;
+        if (errors) row.tool_errors = errors;
+        if (harnessRetries) row.harness_retries = harnessRetries;
+        const snip = snippetOf(firstResult, extra);
+        if (snip) row.snippet = snip;
+        detail.push(row);
+      }
       i++;
     }
   }
@@ -258,4 +272,22 @@ function buildSessionDigest(entries, opts = {}) {
     detail: boundedDetail,
   };
 }
-module.exports = { snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL };
+// mergeModelUsage — fold one model_usage map into another, in place, so a
+// session's tokens can be summed across the several transcripts one session
+// actually writes (the interactive thread + its subagent subtree — task
+// 1003435). PURE apart from mutating `target`, which the caller owns. The four
+// buckets are the session_records model_usage shape, NOT the transcript
+// *_input_tokens shape; keep them in step with buildSessionDigest above.
+function mergeModelUsage(target, addition) {
+  for (const [model, u] of Object.entries(addition || {})) {
+    const bucket = target[model] || (target[model] =
+      { input: 0, output: 0, cache_read: 0, cache_creation: 0 });
+    bucket.input += Number(u && u.input) || 0;
+    bucket.output += Number(u && u.output) || 0;
+    bucket.cache_read += Number(u && u.cache_read) || 0;
+    bucket.cache_creation += Number(u && u.cache_creation) || 0;
+  }
+  return target;
+}
+
+module.exports = { snippetOf, buildSessionDigest, mergeModelUsage, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL };

package/scripts/gds/session-digest.js

@@ -34,7 +34,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { cliClient, loadSession, arg } = require('./cli-lib');
-const { buildSessionDigest, collectEnvSecrets } = require('./ship');
+const { buildSessionDigest, collectEnvSecrets, foldSubagentUsage } = require('./ship');
 
 
 // Claude Code encodes a project transcript dir by replacing every non-alnum
@@ -144,6 +144,10 @@ async function main() {
     if (session.token) extraSecrets.push(session.token);
 
     const digest = buildSessionDigest(parseTranscript(transcriptPath), { extraSecrets });
+    // task 1003435: fold this session's subagents subtree into model_usage, the
+    // same way the on-ship upload does — the whole session's tokens, not just the
+    // interactive thread's.
+    foldSubagentUsage(digest, transcriptPath, sessionId);
 
     // task_ids:[] — the server upsert UNIONs task_ids, so the on-ship task
     // attribution is preserved; this end-of-session upload's job is to refresh
@@ -157,6 +161,12 @@ async function main() {
       ended_at: digest.endedAt,
       detail: digest.detail,
       metrics: digest.metrics,
+      // model_usage is its OWN column, and the upsert overwrites it from the
+      // body — so omitting it here (as this hook did until task 1003435) wiped
+      // the map the on-ship upload had just stored, leaving the reward with
+      // nothing to price. It is the LAST upload of the session, so it must carry
+      // the fullest picture, not the emptiest.
+      model_usage: digest.metrics.model_usage || {},
     };
     const api = await cliClient({ allowUnauthenticated: true });
     const r = await api.sessions.postSessions({ body: payload });

package/scripts/gds/ship-session-upload.js

@@ -43,9 +43,16 @@ const {
 // shared with session-digest.js. Re-exported below so this file's public surface
 // and tests/session_records.mjs are unchanged.
 const {
-  snippetOf, buildSessionDigest, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL,
+  snippetOf, buildSessionDigest, mergeModelUsage, HARNESS_RETRY_RE, UNATTRIBUTED_MODEL,
 } = require('./session-digest-build');
 
+// The subagent subtree walker + the grader-transcript signature live in
+// session-cost.js, which already prices that subtree for the SPEND ledger. The
+// reward reads the same tokens, so it must use the SAME two definitions or the
+// two ledgers describe different sessions (task 1003435). session-cost.js guards
+// its own entry point behind require.main, so importing it is side-effect free.
+const { listJsonlRecursive, looksLikeGraderTranscript } = require('./session-cost.js');
+
 
 // classifyUploadSkip — PURE decision for whether the session upload must skip,
 // and the clear, actionable reason why. Separated from I/O so it is unit-tested
@@ -109,6 +116,94 @@ function recordUploadSkip(taskId, { code, reason }, opts = {}) {
   }
 }
 
+// parseJsonl — one transcript file's text into parsed entries, skipping any
+// malformed line (best-effort, exactly like the rest of this path).
+function parseJsonl(raw) {
+  const entries = [];
+  for (const line of String(raw || '').split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      entries.push(JSON.parse(t));
+    } catch (_) {
+      /* skip a malformed line — best-effort */
+    }
+  }
+  return entries;
+}
+
+// subagentModelUsage — the per-model TOKEN counts this session's ad-hoc
+// subagents burned, so the cost-plus reward (ADR 0054) can see them.
+//
+// WHY (task 1003435): Agent/Task-tool spawns persist in a sibling subtree,
+// <project-dir>/<session-id>/subagents/*.jsonl — never in the main transcript.
+// session-cost.js already prices that subtree into a `session:subagent` cost_log
+// row, so the SPEND ledger sees it; the digest read one file, so the REWARD did
+// not. That paid a builder who follows CLAUDE.md's "delegate freely" less than
+// one who did identical work in the main thread, and made the two ledgers
+// disagree about the same session.
+//
+// Grader transcripts are excluded BY SIGNATURE, not by location: a grader run
+// can nest inside a subagents/ dir, and its cost is already captured via the
+// worker envelope, so pricing it here would double-count (the ADR 0028
+// invariant). Each file goes through buildSessionDigest so the token semantics —
+// dedup by message.id, skip `<synthetic>`, fold unlabeled turns into a priceable
+// bucket — are the ONE implementation, never a second one that can drift.
+function subagentModelUsage(sessionDir) {
+  const modelUsage = {};
+  let files = 0;
+  let tokens = 0;
+  let graderSkipped = 0;
+  for (const f of listJsonlRecursive(sessionDir)) {
+    if (looksLikeGraderTranscript(f)) { graderSkipped++; continue; }
+    let digest;
+    try {
+      digest = buildSessionDigest(parseJsonl(fs.readFileSync(f, 'utf8')), { usageOnly: true });
+    } catch (_) {
+      continue; // an unreadable subagent file must never fail a ship
+    }
+    if (!(digest.totalTokens > 0)) continue;
+    files++;
+    tokens += digest.totalTokens;
+    mergeModelUsage(modelUsage, digest.metrics.model_usage);
+  }
+  return { modelUsage, files, tokens, graderSkipped };
+}
+
+// foldSubagentUsage — add the session's subagent tokens to `digest`'s
+// model_usage, IN PLACE, and record what was folded.
+//
+// model_usage ONLY, deliberately (task 1003435). model_usage is the reward's
+// input, so it must describe the whole session. `detail`, `metrics.tokens`,
+// `assistant_turns` and `total_tokens` stay the INTERACTIVE thread's record:
+// they feed the BFG corpus + the inefficiency evaluator, which reason about one
+// agent's turn-by-turn behaviour, and splicing N subagent transcripts into that
+// per-turn story would distort the very signal it exists to measure (and bloat
+// the payload). The three subagent_* counters are how a reader tells the two
+// apart instead of inferring a discrepancy from a mismatch.
+function foldSubagentUsage(digest, transcriptPath, sessionId) {
+  if (!digest || !digest.metrics || !transcriptPath || !sessionId) return digest;
+  // Path-traversal guard. The session id is interpolated into a filesystem path
+  // below, and what comes out of that path is priced into a payout — so a value
+  // carrying `../` could aim the walk at an arbitrary directory and fold
+  // fabricated token counts into the reward's input. Guarded HERE rather than at
+  // each call site: uploadSessionOnShip already screens the id before resolving
+  // the transcript, but the SessionEnd hook takes it straight off stdin, and any
+  // future caller would inherit the same hole. Same shape as the check in
+  // uploadSessionOnShip — a plain UUID-ish token, nothing else.
+  if (!/^[A-Za-z0-9_-]+$/.test(String(sessionId))) return digest;
+  const sessionDir = path.join(path.dirname(transcriptPath), sessionId);
+  const sub = subagentModelUsage(sessionDir);
+  if (sub.files === 0 && sub.graderSkipped === 0) return digest;
+  digest.metrics.model_usage = mergeModelUsage(
+    digest.metrics.model_usage || {}, sub.modelUsage
+  );
+  digest.metrics.subagent_files = sub.files;
+  digest.metrics.subagent_tokens = sub.tokens;
+  digest.metrics.subagent_grader_skipped = sub.graderSkipped;
+  return digest;
+}
+
 async function uploadSessionOnShip(taskId) {
   try {
     const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
@@ -135,17 +230,7 @@ async function uploadSessionOnShip(taskId) {
       recordUploadSkip(taskId, decision);
       return null;
     }
-    const raw = fs.readFileSync(transcriptPath, 'utf8');
-    const entries = [];
-    for (const line of raw.split('\n')) {
-      const t = line.trim();
-      if (!t) continue;
-      try {
-        entries.push(JSON.parse(t));
-      } catch (_) {
-        /* skip a malformed line — best-effort */
-      }
-    }
+    const entries = parseJsonl(fs.readFileSync(transcriptPath, 'utf8'));
     // Dynamic secrets to scrub: every secret-shaped env VALUE (Apple/MAC_* CI
     // creds, a baked GDS/DO token, GITHUB_TOKEN, ANTHROPIC_API_KEY, …) plus this
     // run's live GDS session token. Defense in depth on top of the pattern +
@@ -157,6 +242,10 @@ async function uploadSessionOnShip(taskId) {
     const s = await loadSession();
     if (s && s.token) extraSecrets.push(s.token);
     const digest = buildSessionDigest(entries, { extraSecrets });
+    // task 1003435: the interactive transcript is only part of what this session
+    // spent — fold the subagents subtree into model_usage so the cost-plus reward
+    // prices the same tokens the cost ledger already bills.
+    foldSubagentUsage(digest, transcriptPath, sessionId);
     // task 1270: surface the session usage so the completion card can show
     // Claude tokens + an estimated cost. Returned even when the POST below fails
     // (we already have the digest) — the card is best-effort either way.
@@ -215,4 +304,5 @@ module.exports = {
   classifyUploadSkip,
   recordUploadSkip,
   uploadSessionOnShip,
+  foldSubagentUsage,
 };

package/scripts/gds/ship.js

@@ -99,7 +99,9 @@ const {
   resolveInstanceBase,
   shouldBailOnFetchFailure,
 } = require('./ship-deploy-target.js');
-const { classifyUploadSkip, recordUploadSkip } = require('./ship-session-upload.js');
+const {
+  classifyUploadSkip, recordUploadSkip, foldSubagentUsage,
+} = require('./ship-session-upload.js');
 const {
   classifyLandOutcome,
   formatPublishFailure,
@@ -176,6 +178,10 @@ module.exports = {
   // secret corpus test (tests/scrubber_corpus.mjs) can exercise each layer + tune.
   shannonEntropy, looksHighEntropySecret, redactHighEntropy, collectEnvSecrets,
   classifyUploadSkip, recordUploadSkip,
+  // task 1003435: the subagents-subtree fold, shared with the SessionEnd hook —
+  // both uploads must send the SAME whole-session model_usage or whichever runs
+  // last decides what the builder is paid for.
+  foldSubagentUsage,
   // #678: re-grade path + the grade-step helpers it shares with shipMain.
   // Exporting these formalizes learning #43 (which had to "replicate ~10
   // lines" because runSubagentGrader wasn't reachable).

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.443'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.444'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/credit_grant.mjs

@@ -588,6 +588,242 @@ await test('cost-plus-only cascade: a 0 per-task credit → idea-promotion slice
   assert.equal(client.queries.length, 0, 'no lineage lookup, no bonus INSERT when the base credit is 0');
 });
 
+// =========================================================================
+// (7) task 1003435 — a PARALLEL session (one claim, several subagents).
+//
+// The cost ledger has always billed a session's subagents subtree in its own
+// `session:subagent` cost_log row, but model_usage — the reward's only input —
+// was built from ONE file, the interactive transcript. So a builder who followed
+// CLAUDE.md's "delegate freely" moved most of a session's real spend into a
+// bucket the reward could not see, and the two ledgers described different
+// sessions.
+//
+// The acceptance test is that RECONCILIATION: what the reward prices must equal
+// what the ledger bills, within independent-rounding epsilon. It runs both real
+// pricing paths over the same on-disk fixture rather than asserting a hand-typed
+// number on either side, so a change to one that is not made to the other reds.
+// =========================================================================
+
+const fs = require('node:fs');
+const os = require('node:os');
+const nodePath = require('node:path');
+const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/gds/session-cost.js');
+const { buildSessionDigest } = require('../scripts/gds/session-digest-build.js');
+const { foldSubagentUsage } = require('../scripts/gds/ship-session-upload.js');
+const { priceModelUsage } = require('../src/bongos/llm-pricing.js');
+
+const PARALLEL_SID = 'sess-parallel';
+
+// One assistant transcript line. `id` is the API call's identity — two lines
+// sharing one are ONE call, which is what makes the dedup assertion below real.
+function asstLine(id, model, usage) {
+  return JSON.stringify({
+    type: 'assistant',
+    timestamp: '2026-08-30T00:00:00.000Z',
+    message: { id, model, usage, content: [{ type: 'text', text: 'work' }] },
+  });
+}
+function userLine(text) {
+  return JSON.stringify({
+    type: 'user',
+    timestamp: '2026-08-30T00:00:00.000Z',
+    message: { role: 'user', content: text },
+  });
+}
+function parseJsonlText(raw) {
+  return raw.split('\n').filter((l) => l.trim()).map((l) => JSON.parse(l));
+}
+
+// A session that spawned three subagents, one of them a grader. Mirrors the real
+// on-disk layout: the interactive transcript is a FILE, and the subagents live in
+// a sibling DIRECTORY named for the session id.
+function makeParallelFixture() {
+  const dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), 'otb-parallel-'));
+  const mainPath = nodePath.join(dir, `${PARALLEL_SID}.jsonl`);
+  // opus: 150k in / 30k out / 1.5M read / 40k write = $0.75+$0.75+$0.75+$0.25 = $2.50.
+  // m1 is written twice (one API call, two content blocks) — priced ONCE.
+  const dup = asstLine('m1', 'claude-opus-4-8', {
+    input_tokens: 100_000, output_tokens: 20_000,
+    cache_read_input_tokens: 1_000_000, cache_creation_input_tokens: 40_000,
+  });
+  fs.writeFileSync(mainPath, [
+    userLine('ship task 1003435'),
+    dup,
+    dup,
+    asstLine('m2', 'claude-opus-4-8', {
+      input_tokens: 50_000, output_tokens: 10_000,
+      cache_read_input_tokens: 500_000, cache_creation_input_tokens: 0,
+    }),
+  ].join('\n'));
+
+  const subagents = nodePath.join(dir, PARALLEL_SID, 'subagents');
+  const nested = nodePath.join(subagents, 'nested');
+  fs.mkdirSync(nested, { recursive: true });
+  // opus subagent: 200k in / 40k out / 2M read = $1.00+$1.00+$1.00 = $3.00
+  fs.writeFileSync(nodePath.join(subagents, 'agent-a.jsonl'), [
+    userLine('audit the pricing path'),
+    asstLine('a1', 'claude-opus-4-8', {
+      input_tokens: 200_000, output_tokens: 40_000, cache_read_input_tokens: 2_000_000,
+    }),
+  ].join('\n'));
+  // sonnet subagent, one level deeper — the walk is recursive:
+  // 100k in / 20k out / 1M read = $0.20+$0.20+$0.20 = $0.60
+  fs.writeFileSync(nodePath.join(nested, 'agent-b.jsonl'), [
+    userLine('read the ledger rows'),
+    asstLine('b1', 'claude-sonnet-5', {
+      input_tokens: 100_000, output_tokens: 20_000, cache_read_input_tokens: 1_000_000,
+    }),
+  ].join('\n'));
+  // A GRADER worker nested in the subagents dir. Its $5.00 is already captured via
+  // the worker envelope, so pricing it here would double-count (ADR 0028).
+  fs.writeFileSync(nodePath.join(nested, 'grader-worker.jsonl'), [
+    userLine('You are the **Hacker** — a specialist adversarial subagent. Find the holes.'),
+    asstLine('g1', 'claude-opus-4-8', { input_tokens: 1_000_000 }),
+  ].join('\n'));
+
+  return { dir, mainPath, sessionDir: nodePath.join(dir, PARALLEL_SID) };
+}
+
+const fixture = makeParallelFixture();
+const INTERACTIVE_USD = 2.50;
+const SUBAGENT_USD = 3.60;
+const SESSION_USD = INTERACTIVE_USD + SUBAGENT_USD; // $6.10
+// Each cost_log row is rounded to 4dp independently and priceModelUsage rounds
+// its own total, so the two sides may disagree by a rounding step per row.
+const EPSILON = 0.0002;
+
+// The digest the ship uploads for this session, subagents folded in.
+function parallelDigest() {
+  const digest = buildSessionDigest(parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8')));
+  foldSubagentUsage(digest, fixture.mainPath, PARALLEL_SID);
+  return digest;
+}
+
+await test('1003435 the cost ledger bills interactive + subagent, grader excluded', () => {
+  const inter = priceTranscript(fixture.mainPath);
+  const sub = priceSubagents(fixture.sessionDir);
+  assert.equal(Math.round(inter.total * 100) / 100, INTERACTIVE_USD, 'm1 priced once, not twice');
+  assert.equal(Math.round(sub.subagentTotal * 100) / 100, SUBAGENT_USD);
+  assert.equal(sub.subagentFiles, 2);
+  assert.equal(sub.graderSkipped, 1, 'the grader worker is skipped by signature');
+  const built = buildCostRows({ sessionId: PARALLEL_SID, inter, sub });
+  assert.equal(built.rows.length, 2, 'one :interactive row + one :subagent row');
+  assert.equal(Math.round(built.rowsTotal * 100) / 100, SESSION_USD);
+});
+
+await test('1003435 model_usage now carries the subagents subtree, grader excluded', () => {
+  const digest = parallelDigest();
+  const models = Object.keys(digest.metrics.model_usage).sort();
+  assert.deepEqual(models, ['claude-opus-4-8', 'claude-sonnet-5'],
+    'the sonnet subagent reached model_usage, which only the fold can do');
+  assert.equal(digest.metrics.subagent_files, 2);
+  assert.equal(digest.metrics.subagent_grader_skipped, 1);
+  // The grader's 1M opus input tokens must be in NEITHER ledger.
+  assert.equal(digest.metrics.model_usage['claude-opus-4-8'].input, 350_000,
+    '150k interactive + 200k subagent — the grader\'s 1M is not counted');
+});
+
+await test('1003435 detail + total_tokens stay the INTERACTIVE thread\'s record', () => {
+  const interactiveOnly = buildSessionDigest(
+    parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'))
+  );
+  const digest = parallelDigest();
+  // The fold is model_usage ONLY: detail and the turn/token metrics feed the BFG
+  // corpus + inefficiency evaluator, which reason about ONE agent's turn-by-turn
+  // behaviour. Splicing N subagent transcripts into that would distort the very
+  // signal they measure, so the subagent_* counters carry the difference instead.
+  assert.equal(digest.detail.length, interactiveOnly.detail.length);
+  assert.equal(digest.totalTokens, interactiveOnly.totalTokens);
+  assert.equal(digest.metrics.assistant_turns, interactiveOnly.metrics.assistant_turns);
+});
+
+await test('1003435 ACCEPTANCE: the reward reconciles with the session\'s cost_log rows', () => {
+  const inter = priceTranscript(fixture.mainPath);
+  const sub = priceSubagents(fixture.sessionDir);
+  const ledgerUsd = buildCostRows({ sessionId: PARALLEL_SID, inter, sub }).rowsTotal;
+  const rewardUsd = priceModelUsage(parallelDigest().metrics.model_usage).true_cost_usd;
+  assert.ok(Math.abs(rewardUsd - ledgerUsd) <= EPSILON,
+    `reward priced $${rewardUsd} but the ledger billed $${ledgerUsd}`);
+});
+
+await test('1003435 a parallel session is PAID for its subagents', async () => {
+  const client = fakeClient();
+  client.enqueue(NO_PRIOR);
+  client.enqueue([{ id: 99 }]);
+  const digest = parallelDigest();
+  const res = await awardSessionTokenReward(
+    client, 7, PARALLEL_SID, digest.metrics.model_usage, digest.totalTokens
+  );
+  assert.equal(res.awarded, true);
+  assert.equal(res.trueCostUsd, SESSION_USD);
+  assert.equal(res.drachmae, Math.round(SESSION_USD * 1.20)); // $6.10 × 1.20 = 7.32 → 7
+  // The bug this closes: interactive-only priced the same session at $2.50 → 3.
+  const before = computeSessionTokenReward(INTERACTIVE_USD).drachmae;
+  assert.ok(res.drachmae > before, `subagent-blind reward was ${before}, now ${res.drachmae}`);
+});
+
+await test('1003435 a re-ship of the same session is still a no-op (one award per session)', async () => {
+  const digest = parallelDigest();
+  const client = fakeClient();
+  // The watermark already holds everything this session is worth.
+  client.enqueue(ledger(Math.round(SESSION_USD * 1.20), 0));
+  const res = await awardSessionTokenReward(
+    client, 7, PARALLEL_SID, digest.metrics.model_usage, digest.totalTokens
+  );
+  assert.equal(res.awarded, false);
+  assert.equal(res.drachmae, 0);
+  assert.equal(client.queries.length, 1, 'SELECT only — a second upload must not pay again');
+});
+
+await test('1003435 a traversing session id folds NOTHING (the walk feeds a payout)', () => {
+  // The id is interpolated into a filesystem path whose contents get priced, so
+  // a `../` value could aim the walk at another directory and fold fabricated
+  // tokens into the reward. The on-ship caller screens the id before resolving
+  // the transcript; the SessionEnd hook takes it straight off stdin — so the
+  // guard lives in foldSubagentUsage, where every caller gets it.
+  const entries = parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'));
+  const clean = buildSessionDigest(entries).metrics.model_usage;
+  for (const hostile of ['../' + PARALLEL_SID, `${PARALLEL_SID}/..`, 'a/../../etc', '']) {
+    const digest = foldSubagentUsage(buildSessionDigest(entries), fixture.mainPath, hostile);
+    assert.deepEqual(digest.metrics.model_usage, clean, `folded for id ${JSON.stringify(hostile)}`);
+    assert.equal(digest.metrics.subagent_files, undefined);
+  }
+  // …and the legitimate id still folds, so the guard is not just refusing everything.
+  const ok = foldSubagentUsage(buildSessionDigest(entries), fixture.mainPath, PARALLEL_SID);
+  assert.equal(ok.metrics.subagent_files, 2);
+});
+
+await test('1003435 usageOnly changes what is BUILT, never what is COUNTED', () => {
+  // The fold reuses buildSessionDigest so the token semantics — dedup by
+  // message.id, skip <synthetic>, fold unlabeled turns — have ONE home. usageOnly
+  // only drops the per-turn rows it would discard (and their snippet scrubbing,
+  // which the SessionEnd watchdog gives a hard time budget). If it ever changed a
+  // count, the reward and the ledger would quietly diverge again.
+  const entries = parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'));
+  const full = buildSessionDigest(entries);
+  const lean = buildSessionDigest(entries, { usageOnly: true });
+  assert.deepEqual(lean.metrics.model_usage, full.metrics.model_usage);
+  assert.equal(lean.totalTokens, full.totalTokens);
+  assert.equal(lean.metrics.assistant_turns, full.metrics.assistant_turns);
+  assert.equal(lean.metrics.api_calls, full.metrics.api_calls);
+  assert.deepEqual(lean.detail, [], 'the detail rows are what usageOnly skips');
+  assert.ok(full.detail.length > 0);
+});
+
+await test('1003435 a session with no subagents is untouched (no regression)', () => {
+  const dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), 'otb-solo-'));
+  const mainPath = nodePath.join(dir, 'sess-solo.jsonl');
+  fs.writeFileSync(mainPath, asstLine('s1', 'claude-opus-4-8', { input_tokens: 110_000 }));
+  const entries = parseJsonlText(fs.readFileSync(mainPath, 'utf8'));
+  const before = buildSessionDigest(entries);
+  const after = foldSubagentUsage(buildSessionDigest(entries), mainPath, 'sess-solo');
+  assert.deepEqual(after.metrics.model_usage, before.metrics.model_usage);
+  assert.equal(after.metrics.subagent_files, undefined, 'no counters when there is nothing to count');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+fs.rmSync(fixture.dir, { recursive: true, force: true });
+
 // -------------------------------------------------------------------------
 // runner summary
 // -------------------------------------------------------------------------