@codyswann/lisa 2.222.0 → 2.222.2

package/plugins/lisa/rules/reference/usage-accounting.md

@@ -31,7 +31,7 @@ Each direct usage entry records one logical Lisa run or sub-run on one artifact.
 | `output_tokens` | Output/completion tokens, or `null` when unavailable. |
 | `reasoning_tokens` | Reasoning/internal tokens, or `null` when unavailable/not exposed. |
 | `total_tokens` | Total trustworthy tokens for the entry, or `null`. |
-| `measured_subset_tokens` | Trustworthy measured subtotal for a known subset of the run, or `null`. |
+| `measured_subset_tokens` | Optional trustworthy measured subtotal for a known subset of the run. Omission is normalized to `null` so callers written before this field remain source-compatible. |
 | `cost` | Observed or estimated cost for this entry, or `null`. |
 | `currency` | ISO currency code when `cost` is known, otherwise `null`. |
 | `pricing_status` | `observed`, `estimated`, `missing`, or `unavailable`. |
@@ -69,16 +69,34 @@ total.
 - `unavailable`: the runtime exposed neither trustworthy cost nor enough trustworthy token data to estimate cost.
 
 Runtime-observed cost always wins over estimates. Estimated cost never overwrites an observed value. Missing pricing preserves token counts and a `null` cost.
+Token completeness and cost trust are independent: a `measured-subset` entry may still carry an
+observed trustworthy whole-run cost. Token rollups remain unknown, but that cost participates in
+cost rollups under the normal pricing and currency rules.
 
 ## Machine-readable tokens
 
-Every visible direct entry row ends with exactly one machine-readable token:
+Every visible direct entry row contains the backward-compatible 17-field primary token:
 
 ```text
-<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> measured_subset_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
+<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
 ```
 
-Field order is fixed. A reader parses the usage ledger by matching `<!-- lisa:usage-entry ` lines only; it never needs to scrape prose or table cell positions. String fields are percent-encoded before rendering and decoded after parsing, so whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the token.
+The row immediately follows it with a correlated measured-subset extension. Writers serialize an
+omitted value as `null` instead of `undefined`:
+
+```text
+<!-- lisa:usage-entry-measured-subset entry_id=<id> measured_subset_tokens=<n|null> -->
+```
+
+The primary field order is fixed and deliberately matches the pre-measured-subset contract so
+legacy 17-field readers continue to enumerate entries. Current readers correlate the extension by
+its percent-encoded `entry_id`. They also accept the `@codyswann/lisa@2.222.0` transitional marker,
+which placed `measured_subset_tokens` between `total_tokens` and `cost`, and migrate it to the
+primary-plus-extension layout on rewrite. Only that transitional additive field accepts the literal
+`undefined` emitted by an older caller and normalizes it to `null`; established numeric fields
+remain strict. String fields are percent-encoded before rendering and decoded after parsing, so
+whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the
+token.
 
 Every managed section also ends with exactly one rollup token:
 
@@ -91,6 +109,23 @@ Every managed section also ends with exactly one rollup token:
 - `child_refs` enumerates the child artifacts consulted for the rollup.
 - `total_*` fields equal direct plus child totals over the deduped entry set.
 
+If a direct entry or freshly resolved child entry is `measured-subset`, the corresponding token
+scope and combined `total_tokens` are `null`; a measured subtotal is never added to complete token
+counts. Other established nullable-entry behavior is unchanged. Cost rollups are computed
+independently, so a trustworthy whole-run cost is not discarded merely because token completeness
+is unknown.
+
+When freshly resolved child work contains a measured subset, the primary rollup token is followed
+by this optional backward-compatible extension:
+
+```text
+<!-- lisa:usage-rollup-token-status child_tokens_incomplete=true -->
+```
+
+The extension preserves child-token incompleteness across ordinary direct-entry rewrites that do
+not resolve children again. It is omitted when child token totals are not known to be incomplete,
+so legacy rollup objects and readers retain their established shape.
+
 The rollup token is the machine-readable summary. The visible rollup table mirrors it for humans. List fields are comma-delimited after encoding each item independently; commas inside an item are encoded as data, not treated as separators.
 
 ## Visible rendering contract
@@ -143,7 +178,9 @@ The rollup contract is additive across the hierarchy: PRDs may roll up Epics/Sto
 - Recompute the entire section on every write; never append ad hoc rows.
 - Sort direct entries deterministically by `(flow, run_id, entry_id)`.
 - Preserve existing entries with unchanged `entry_id` and refreshed field values.
-- Re-running with the same logical entry set must produce byte-identical output.
+- Re-running with the same logical entry set must produce byte-identical output. Rewriting a legacy
+  primary-only marker or the 2.222.0 transitional marker migrates once to the canonical
+  primary-plus-extension layout; subsequent rewrites are byte-identical.
 - Do not include timestamps in the section preamble or token lines.
 
 Idempotency is enforced by `entry_id` for direct entries and by the fixed rollup token field order for totals.

package/plugins/lisa/skills/lisa-usage-accounting/SKILL.md

@@ -69,7 +69,10 @@ fields.
 
 When the runtime exposes only a trustworthy subtotal, callers MUST use `source: measured-subset`,
 write the subtotal to `measured_subset_tokens`, and leave `total_tokens: null`. Do not coerce a
-known subset into `total_tokens`; rollups use `total_tokens` only for complete totals.
+known subset into `total_tokens`; rollups use `total_tokens` only for complete totals. The
+`measured_subset_tokens` field is optional for backward compatibility with callers that construct
+ordinary observed, estimated, or unavailable entries; the shared serializer normalizes omission
+to `null`. A trustworthy whole-run cost remains valid independently of incomplete token telemetry.
 
 ## Return shape
 
@@ -168,6 +171,11 @@ failures into a generic "usage update failed."
   canonical `usage-accounting` rule.
 - Never append a second `## Lisa Usage` section or a second managed usage comment.
 - Never treat missing usage as zero. Callers must record explicit `source: unavailable` entries.
+- Never add a measured subset to complete token totals. A mixed complete-plus-measured-subset
+  direct or child scope has `null` token rollups, while trustworthy whole-run cost rolls up
+  independently.
+- Never discard the optional child-token incompleteness state parsed from an existing rollup when
+  `child_refs` were not refreshed. Preserve it through ordinary direct-entry rewrites.
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-usage-accounting/SKILL.md

@@ -69,7 +69,10 @@ fields.
 
 When the runtime exposes only a trustworthy subtotal, callers MUST use `source: measured-subset`,
 write the subtotal to `measured_subset_tokens`, and leave `total_tokens: null`. Do not coerce a
-known subset into `total_tokens`; rollups use `total_tokens` only for complete totals.
+known subset into `total_tokens`; rollups use `total_tokens` only for complete totals. The
+`measured_subset_tokens` field is optional for backward compatibility with callers that construct
+ordinary observed, estimated, or unavailable entries; the shared serializer normalizes omission
+to `null`. A trustworthy whole-run cost remains valid independently of incomplete token telemetry.
 
 ## Return shape
 
@@ -168,6 +171,11 @@ failures into a generic "usage update failed."
   canonical `usage-accounting` rule.
 - Never append a second `## Lisa Usage` section or a second managed usage comment.
 - Never treat missing usage as zero. Callers must record explicit `source: unavailable` entries.
+- Never add a measured subset to complete token totals. A mixed complete-plus-measured-subset
+  direct or child scope has `null` token rollups, while trustworthy whole-run cost rolls up
+  independently.
+- Never discard the optional child-token incompleteness state parsed from an existing rollup when
+  `child_refs` were not refreshed. Preserve it through ordinary direct-entry rewrites.
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -32,6 +32,57 @@ if [ -z "$command_str" ]; then
   exit 0
 fi
 
+command_for_guards="$command_str"
+if command -v python3 >/dev/null 2>&1; then
+  command_for_guards="$(SAFETY_NET_COMMAND="$command_str" python3 - <<'PY'
+import os
+import re
+
+command = os.environ.get("SAFETY_NET_COMMAND", "")
+
+
+def strip_heredocs(text: str) -> str:
+    lines = text.splitlines()
+    output = []
+    pending = []
+    # Quoted strings are matched (and thereby skipped over) as plain,
+    # non-capturing alternatives BEFORE the heredoc-marker alternative gets a
+    # chance to run, so a "<<MARKER"-looking sequence inside a string literal
+    # (e.g. `echo "hello <<MARKER"`) is never mistaken for a real heredoc
+    # start. Only the heredoc-marker alternative captures a group.
+    marker_pattern = re.compile(
+        r'"(?:\\.|[^"])*"|\'[^\']*\''
+        r"|<<-?\s*(?:'([^']+)'|\"([^\"]+)\"|([A-Za-z_][A-Za-z0-9_]*))"
+    )
+    index = 0
+    while index < len(lines):
+        line = lines[index]
+        output.append(line)
+        pending.extend(
+            next(group for group in match.groups() if group)
+            for match in marker_pattern.finditer(line)
+            if any(match.groups())
+        )
+        index += 1
+        # Consume every pending heredoc body in order (chained same-line
+        # heredocs, e.g. `cat <<A <<B`, push more than one marker at once).
+        # Do NOT stop after the first terminator — dropping the `break` lets
+        # this loop keep dropping body lines until each pending marker is
+        # matched, instead of leaking the second body back into `output`
+        # where the destructive-pattern guards would see it.
+        while pending and index < len(lines):
+            if lines[index].strip() == pending[0]:
+                output.append(lines[index])
+                pending.pop(0)
+            index += 1
+    return "\n".join(output)
+
+
+print(strip_heredocs(command), end="")
+PY
+)"
+fi
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 block() {
@@ -49,11 +100,11 @@ EOF
 #    wildcard. Two gates ANDed: the command must invoke `rm` with BOTH a
 #    recursive and a force flag, AND name a catastrophic target. Splitting the
 #    flag check from the target check keeps each regex legible and testable.
-if printf '%s' "$command_str" \
+if printf '%s' "$command_for_guards" \
   | grep -Eiq '(^|[^[:alnum:]_./-])rm([[:space:]]+-[[:alnum:]-]+)*[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)' \
-  || printf '%s' "$command_str" \
+  || printf '%s' "$command_for_guards" \
   | grep -Eiq '(^|[^[:alnum:]_./-])rm[[:space:]].*(-r\b.*[[:space:]]-f\b|-f\b.*[[:space:]]-r\b|--recursive\b.*--force\b|--force\b.*--recursive\b)'; then
-  if printf '%s' "$command_str" \
+  if printf '%s' "$command_for_guards" \
     | grep -Eq '([[:space:]]|=)(/|/\*|/\.\*?|~|~/\*?|\$HOME\b|\$\{HOME\}|\*)([[:space:]]|/?\*?$)'; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
@@ -76,7 +127,7 @@ fi
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
 # protected force-push slip past. Uses awk (POSIX) instead of a GNU-only
 # `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
-normalized_command_str="$(printf '%s' "$command_str" \
+normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
 while IFS= read -r push_stmt; do
@@ -93,7 +144,7 @@ done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
 # 3. `git reset --hard` while the working tree has uncommitted changes — this
 #    silently discards them. Only blocks when the tree is actually dirty, so a
 #    clean-tree reset (a legitimate workflow) still passes.
-if printf '%s' "$command_str" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
+if printf '%s' "$command_for_guards" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
     block "git reset --hard on a dirty working tree would discard uncommitted changes (stash or commit first)"
@@ -101,7 +152,7 @@ if printf '%s' "$command_str" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+rese
 fi
 
 # 4. Dropping or truncating a database / schema / table.
-if printf '%s' "$command_str" \
+if printf '%s' "$command_for_guards" \
   | grep -Eiq '\b(drop[[:space:]]+(database|schema|table)|truncate[[:space:]]+(table[[:space:]]+)?[[:alnum:]_."`]+)\b'; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
@@ -113,7 +164,7 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_str" | grep -Eiq -- "$rule"; then
+    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
       block "matched a project custom safety rule (${rules_file##*/}): $rule"
     fi
   done <"$rules_file"

package/plugins/lisa-copilot/rules/eager/usage-accounting.md

@@ -17,7 +17,7 @@ Every artifact with inline body content gets exactly one section:
 Each direct entry records ONE logical Lisa run on ONE artifact. `entry_id` is the stable dedupe key — rewriting the same logical run with the same `entry_id` updates in place; a different run gets a different `entry_id`.
 
 - **`source`**: `observed` (runtime supplied) / `estimated` (derived from trustworthy metadata + pricing contract) / `measured-subset` (a trustworthy subtotal exists, but the complete run total is unknown) / `unavailable`.
-- **`measured_subset_tokens`**: measured subtotal for `measured-subset` entries only. Keep `total_tokens = null` so rollups do not treat a subset as a complete total.
+- **`measured_subset_tokens`**: optional measured subtotal for `measured-subset` entries only. Omission is normalized to `null` for backward-compatible callers. Keep `total_tokens = null` so rollups do not treat a subset as a complete total.
 - **`pricing_status`**: same trinary plus `missing` (cost not known but should be).
 - **Absence ≠ zero.** `null` means unknown; `0` means explicitly zero. Always write the entry — never silently omit.
 - Do NOT replace observed counts with estimates.
@@ -26,4 +26,8 @@ Each direct entry records ONE logical Lisa run on ONE artifact. `entry_id` is th
 
 Container artifacts (Epic, PRD, etc.) roll up usage from their direct children. Roll-up is recursive — a parent's `## Lisa Usage` aggregates its descendants' direct entries. Re-writes are idempotent: re-running an intake or lifecycle skill must not duplicate entries.
 
-Full schema (all 18 fields, pricing semantics, rollup math, idempotent-rewrite rules): [reference/usage-accounting.md](../reference/usage-accounting.md).
+Measured-child incompleteness is durable across ordinary rewrites through the optional
+`lisa:usage-rollup-token-status` extension. Do not infer completeness merely because a rewrite did
+not re-fetch child ledgers.
+
+Full schema (backward-compatible 17-field primary marker, correlated measured-subset extension, pricing semantics, rollup math, idempotent-migration rules): [reference/usage-accounting.md](../reference/usage-accounting.md).

package/plugins/lisa-copilot/rules/reference/usage-accounting.md

@@ -31,7 +31,7 @@ Each direct usage entry records one logical Lisa run or sub-run on one artifact.
 | `output_tokens` | Output/completion tokens, or `null` when unavailable. |
 | `reasoning_tokens` | Reasoning/internal tokens, or `null` when unavailable/not exposed. |
 | `total_tokens` | Total trustworthy tokens for the entry, or `null`. |
-| `measured_subset_tokens` | Trustworthy measured subtotal for a known subset of the run, or `null`. |
+| `measured_subset_tokens` | Optional trustworthy measured subtotal for a known subset of the run. Omission is normalized to `null` so callers written before this field remain source-compatible. |
 | `cost` | Observed or estimated cost for this entry, or `null`. |
 | `currency` | ISO currency code when `cost` is known, otherwise `null`. |
 | `pricing_status` | `observed`, `estimated`, `missing`, or `unavailable`. |
@@ -69,16 +69,34 @@ total.
 - `unavailable`: the runtime exposed neither trustworthy cost nor enough trustworthy token data to estimate cost.
 
 Runtime-observed cost always wins over estimates. Estimated cost never overwrites an observed value. Missing pricing preserves token counts and a `null` cost.
+Token completeness and cost trust are independent: a `measured-subset` entry may still carry an
+observed trustworthy whole-run cost. Token rollups remain unknown, but that cost participates in
+cost rollups under the normal pricing and currency rules.
 
 ## Machine-readable tokens
 
-Every visible direct entry row ends with exactly one machine-readable token:
+Every visible direct entry row contains the backward-compatible 17-field primary token:
 
 ```text
-<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> measured_subset_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
+<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
 ```
 
-Field order is fixed. A reader parses the usage ledger by matching `<!-- lisa:usage-entry ` lines only; it never needs to scrape prose or table cell positions. String fields are percent-encoded before rendering and decoded after parsing, so whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the token.
+The row immediately follows it with a correlated measured-subset extension. Writers serialize an
+omitted value as `null` instead of `undefined`:
+
+```text
+<!-- lisa:usage-entry-measured-subset entry_id=<id> measured_subset_tokens=<n|null> -->
+```
+
+The primary field order is fixed and deliberately matches the pre-measured-subset contract so
+legacy 17-field readers continue to enumerate entries. Current readers correlate the extension by
+its percent-encoded `entry_id`. They also accept the `@codyswann/lisa@2.222.0` transitional marker,
+which placed `measured_subset_tokens` between `total_tokens` and `cost`, and migrate it to the
+primary-plus-extension layout on rewrite. Only that transitional additive field accepts the literal
+`undefined` emitted by an older caller and normalizes it to `null`; established numeric fields
+remain strict. String fields are percent-encoded before rendering and decoded after parsing, so
+whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the
+token.
 
 Every managed section also ends with exactly one rollup token:
 
@@ -91,6 +109,23 @@ Every managed section also ends with exactly one rollup token:
 - `child_refs` enumerates the child artifacts consulted for the rollup.
 - `total_*` fields equal direct plus child totals over the deduped entry set.
 
+If a direct entry or freshly resolved child entry is `measured-subset`, the corresponding token
+scope and combined `total_tokens` are `null`; a measured subtotal is never added to complete token
+counts. Other established nullable-entry behavior is unchanged. Cost rollups are computed
+independently, so a trustworthy whole-run cost is not discarded merely because token completeness
+is unknown.
+
+When freshly resolved child work contains a measured subset, the primary rollup token is followed
+by this optional backward-compatible extension:
+
+```text
+<!-- lisa:usage-rollup-token-status child_tokens_incomplete=true -->
+```
+
+The extension preserves child-token incompleteness across ordinary direct-entry rewrites that do
+not resolve children again. It is omitted when child token totals are not known to be incomplete,
+so legacy rollup objects and readers retain their established shape.
+
 The rollup token is the machine-readable summary. The visible rollup table mirrors it for humans. List fields are comma-delimited after encoding each item independently; commas inside an item are encoded as data, not treated as separators.
 
 ## Visible rendering contract
@@ -143,7 +178,9 @@ The rollup contract is additive across the hierarchy: PRDs may roll up Epics/Sto
 - Recompute the entire section on every write; never append ad hoc rows.
 - Sort direct entries deterministically by `(flow, run_id, entry_id)`.
 - Preserve existing entries with unchanged `entry_id` and refreshed field values.
-- Re-running with the same logical entry set must produce byte-identical output.
+- Re-running with the same logical entry set must produce byte-identical output. Rewriting a legacy
+  primary-only marker or the 2.222.0 transitional marker migrates once to the canonical
+  primary-plus-extension layout; subsequent rewrites are byte-identical.
 - Do not include timestamps in the section preamble or token lines.
 
 Idempotency is enforced by `entry_id` for direct entries and by the fixed rollup token field order for totals.

package/plugins/lisa-copilot/skills/lisa-usage-accounting/SKILL.md

@@ -69,7 +69,10 @@ fields.
 
 When the runtime exposes only a trustworthy subtotal, callers MUST use `source: measured-subset`,
 write the subtotal to `measured_subset_tokens`, and leave `total_tokens: null`. Do not coerce a
-known subset into `total_tokens`; rollups use `total_tokens` only for complete totals.
+known subset into `total_tokens`; rollups use `total_tokens` only for complete totals. The
+`measured_subset_tokens` field is optional for backward compatibility with callers that construct
+ordinary observed, estimated, or unavailable entries; the shared serializer normalizes omission
+to `null`. A trustworthy whole-run cost remains valid independently of incomplete token telemetry.
 
 ## Return shape
 
@@ -168,6 +171,11 @@ failures into a generic "usage update failed."
   canonical `usage-accounting` rule.
 - Never append a second `## Lisa Usage` section or a second managed usage comment.
 - Never treat missing usage as zero. Callers must record explicit `source: unavailable` entries.
+- Never add a measured subset to complete token totals. A mixed complete-plus-measured-subset
+  direct or child scope has `null` token rollups, while trustworthy whole-run cost rolls up
+  independently.
+- Never discard the optional child-token incompleteness state parsed from an existing rollup when
+  `child_refs` were not refreshed. Preserve it through ordinary direct-entry rewrites.
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.222.0",
+  "version": "2.222.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -32,6 +32,57 @@ if [ -z "$command_str" ]; then
   exit 0
 fi
 
+command_for_guards="$command_str"
+if command -v python3 >/dev/null 2>&1; then
+  command_for_guards="$(SAFETY_NET_COMMAND="$command_str" python3 - <<'PY'
+import os
+import re
+
+command = os.environ.get("SAFETY_NET_COMMAND", "")
+
+
+def strip_heredocs(text: str) -> str:
+    lines = text.splitlines()
+    output = []
+    pending = []
+    # Quoted strings are matched (and thereby skipped over) as plain,
+    # non-capturing alternatives BEFORE the heredoc-marker alternative gets a
+    # chance to run, so a "<<MARKER"-looking sequence inside a string literal
+    # (e.g. `echo "hello <<MARKER"`) is never mistaken for a real heredoc
+    # start. Only the heredoc-marker alternative captures a group.
+    marker_pattern = re.compile(
+        r'"(?:\\.|[^"])*"|\'[^\']*\''
+        r"|<<-?\s*(?:'([^']+)'|\"([^\"]+)\"|([A-Za-z_][A-Za-z0-9_]*))"
+    )
+    index = 0
+    while index < len(lines):
+        line = lines[index]
+        output.append(line)
+        pending.extend(
+            next(group for group in match.groups() if group)
+            for match in marker_pattern.finditer(line)
+            if any(match.groups())
+        )
+        index += 1
+        # Consume every pending heredoc body in order (chained same-line
+        # heredocs, e.g. `cat <<A <<B`, push more than one marker at once).
+        # Do NOT stop after the first terminator — dropping the `break` lets
+        # this loop keep dropping body lines until each pending marker is
+        # matched, instead of leaking the second body back into `output`
+        # where the destructive-pattern guards would see it.
+        while pending and index < len(lines):
+            if lines[index].strip() == pending[0]:
+                output.append(lines[index])
+                pending.pop(0)
+            index += 1
+    return "\n".join(output)
+
+
+print(strip_heredocs(command), end="")
+PY
+)"
+fi
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 block() {
@@ -49,11 +100,11 @@ EOF
 #    wildcard. Two gates ANDed: the command must invoke `rm` with BOTH a
 #    recursive and a force flag, AND name a catastrophic target. Splitting the
 #    flag check from the target check keeps each regex legible and testable.
-if printf '%s' "$command_str" \
+if printf '%s' "$command_for_guards" \
   | grep -Eiq '(^|[^[:alnum:]_./-])rm([[:space:]]+-[[:alnum:]-]+)*[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)' \
-  || printf '%s' "$command_str" \
+  || printf '%s' "$command_for_guards" \
   | grep -Eiq '(^|[^[:alnum:]_./-])rm[[:space:]].*(-r\b.*[[:space:]]-f\b|-f\b.*[[:space:]]-r\b|--recursive\b.*--force\b|--force\b.*--recursive\b)'; then
-  if printf '%s' "$command_str" \
+  if printf '%s' "$command_for_guards" \
     | grep -Eq '([[:space:]]|=)(/|/\*|/\.\*?|~|~/\*?|\$HOME\b|\$\{HOME\}|\*)([[:space:]]|/?\*?$)'; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
@@ -76,7 +127,7 @@ fi
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
 # protected force-push slip past. Uses awk (POSIX) instead of a GNU-only
 # `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
-normalized_command_str="$(printf '%s' "$command_str" \
+normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
 while IFS= read -r push_stmt; do
@@ -93,7 +144,7 @@ done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
 # 3. `git reset --hard` while the working tree has uncommitted changes — this
 #    silently discards them. Only blocks when the tree is actually dirty, so a
 #    clean-tree reset (a legitimate workflow) still passes.
-if printf '%s' "$command_str" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
+if printf '%s' "$command_for_guards" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
     block "git reset --hard on a dirty working tree would discard uncommitted changes (stash or commit first)"
@@ -101,7 +152,7 @@ if printf '%s' "$command_str" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+rese
 fi
 
 # 4. Dropping or truncating a database / schema / table.
-if printf '%s' "$command_str" \
+if printf '%s' "$command_for_guards" \
   | grep -Eiq '\b(drop[[:space:]]+(database|schema|table)|truncate[[:space:]]+(table[[:space:]]+)?[[:alnum:]_."`]+)\b'; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
@@ -113,7 +164,7 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_str" | grep -Eiq -- "$rule"; then
+    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
       block "matched a project custom safety rule (${rules_file##*/}): $rule"
     fi
   done <"$rules_file"

package/plugins/lisa-cursor/rules/usage-accounting-reference.mdc

@@ -36,7 +36,7 @@ Each direct usage entry records one logical Lisa run or sub-run on one artifact.
 | `output_tokens` | Output/completion tokens, or `null` when unavailable. |
 | `reasoning_tokens` | Reasoning/internal tokens, or `null` when unavailable/not exposed. |
 | `total_tokens` | Total trustworthy tokens for the entry, or `null`. |
-| `measured_subset_tokens` | Trustworthy measured subtotal for a known subset of the run, or `null`. |
+| `measured_subset_tokens` | Optional trustworthy measured subtotal for a known subset of the run. Omission is normalized to `null` so callers written before this field remain source-compatible. |
 | `cost` | Observed or estimated cost for this entry, or `null`. |
 | `currency` | ISO currency code when `cost` is known, otherwise `null`. |
 | `pricing_status` | `observed`, `estimated`, `missing`, or `unavailable`. |
@@ -74,16 +74,34 @@ total.
 - `unavailable`: the runtime exposed neither trustworthy cost nor enough trustworthy token data to estimate cost.
 
 Runtime-observed cost always wins over estimates. Estimated cost never overwrites an observed value. Missing pricing preserves token counts and a `null` cost.
+Token completeness and cost trust are independent: a `measured-subset` entry may still carry an
+observed trustworthy whole-run cost. Token rollups remain unknown, but that cost participates in
+cost rollups under the normal pricing and currency rules.
 
 ## Machine-readable tokens
 
-Every visible direct entry row ends with exactly one machine-readable token:
+Every visible direct entry row contains the backward-compatible 17-field primary token:
 
 ```text
-<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> measured_subset_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
+<!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
 ```
 
-Field order is fixed. A reader parses the usage ledger by matching `<!-- lisa:usage-entry ` lines only; it never needs to scrape prose or table cell positions. String fields are percent-encoded before rendering and decoded after parsing, so whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the token.
+The row immediately follows it with a correlated measured-subset extension. Writers serialize an
+omitted value as `null` instead of `undefined`:
+
+```text
+<!-- lisa:usage-entry-measured-subset entry_id=<id> measured_subset_tokens=<n|null> -->
+```
+
+The primary field order is fixed and deliberately matches the pre-measured-subset contract so
+legacy 17-field readers continue to enumerate entries. Current readers correlate the extension by
+its percent-encoded `entry_id`. They also accept the `@codyswann/lisa@2.222.0` transitional marker,
+which placed `measured_subset_tokens` between `total_tokens` and `cost`, and migrate it to the
+primary-plus-extension layout on rewrite. Only that transitional additive field accepts the literal
+`undefined` emitted by an older caller and normalizes it to `null`; established numeric fields
+remain strict. String fields are percent-encoded before rendering and decoded after parsing, so
+whitespace, commas, and HTML comment terminators inside source values cannot split or truncate the
+token.
 
 Every managed section also ends with exactly one rollup token:
 
@@ -96,6 +114,23 @@ Every managed section also ends with exactly one rollup token:
 - `child_refs` enumerates the child artifacts consulted for the rollup.
 - `total_*` fields equal direct plus child totals over the deduped entry set.
 
+If a direct entry or freshly resolved child entry is `measured-subset`, the corresponding token
+scope and combined `total_tokens` are `null`; a measured subtotal is never added to complete token
+counts. Other established nullable-entry behavior is unchanged. Cost rollups are computed
+independently, so a trustworthy whole-run cost is not discarded merely because token completeness
+is unknown.
+
+When freshly resolved child work contains a measured subset, the primary rollup token is followed
+by this optional backward-compatible extension:
+
+```text
+<!-- lisa:usage-rollup-token-status child_tokens_incomplete=true -->
+```
+
+The extension preserves child-token incompleteness across ordinary direct-entry rewrites that do
+not resolve children again. It is omitted when child token totals are not known to be incomplete,
+so legacy rollup objects and readers retain their established shape.
+
 The rollup token is the machine-readable summary. The visible rollup table mirrors it for humans. List fields are comma-delimited after encoding each item independently; commas inside an item are encoded as data, not treated as separators.
 
 ## Visible rendering contract
@@ -148,7 +183,9 @@ The rollup contract is additive across the hierarchy: PRDs may roll up Epics/Sto
 - Recompute the entire section on every write; never append ad hoc rows.
 - Sort direct entries deterministically by `(flow, run_id, entry_id)`.
 - Preserve existing entries with unchanged `entry_id` and refreshed field values.
-- Re-running with the same logical entry set must produce byte-identical output.
+- Re-running with the same logical entry set must produce byte-identical output. Rewriting a legacy
+  primary-only marker or the 2.222.0 transitional marker migrates once to the canonical
+  primary-plus-extension layout; subsequent rewrites are byte-identical.
 - Do not include timestamps in the section preamble or token lines.
 
 Idempotency is enforced by `entry_id` for direct entries and by the fixed rollup token field order for totals.