@codyswann/lisa 2.328.2 → 2.328.3

package/plugins/lisa-copilot/skills/lisa-usage-accounting/SKILL.md

@@ -154,12 +154,24 @@ The implementation path should use the shared utility layer (`parseLisaUsageSect
 `mergeLisaUsageEntries`, `createLisaUsageRollup`, `upsertLisaUsageSection`) rather than duplicating
 token parsing or markdown rendering in each caller.
 
-### Step 4 — Persist and report
+### Step 4 — Persist, verify by read-back, and report
 
 1. If the rendered ledger body is byte-identical to the current managed surface, return `outcome:
    no-op`.
 2. Otherwise write the body or managed comment through the host adapter.
-3. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
+3. **Read the written surface back from the host and parse it.** Run
+   `verifyLisaUsageSectionIntegrity(<stored body>, { entryIds: <ids just written> })`. A write is
+   successful only when that returns `ok: true`. The host's mutation result is not evidence — a
+   Linear `issueUpdate` returned `success: true` while silently discarding every entry token
+   (2026-08-04), which is the defect this step exists to catch.
+4. If verification fails on the body, retry the identical payload as a managed comment and verify
+   that surface the same way. Return `outcome: comment-fallback` with a warning naming the failed
+   surface and the issue codes.
+5. If verification fails on every surface, return `outcome: blocked` with the issue codes in
+   `error.message`. **Never leave a rollup token behind whose `direct_entry_ids` names entries that
+   cannot be parsed from the same surface** — restore the prior managed content rather than
+   reporting success over an unreadable ledger.
+6. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
    any fallback warning.
 
 If the host write fails, preserve the exact error text in `error.message`. Do not collapse write
@@ -179,4 +191,6 @@ failures into a generic "usage update failed."
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.
+- Never report `updated` on the strength of a mutation's return value. Verification is read-back
+  and parse, on every surface, every write.
 - Never overwrite unrelated artifact body content. Rewrite only the managed usage section/comment.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/usage-accounting-reference.mdc

@@ -80,14 +80,24 @@ cost rollups under the normal pricing and currency rules.
 
 ## Machine-readable tokens
 
-Every visible direct entry row contains the backward-compatible 17-field primary token:
+Every visible direct entry row has a corresponding backward-compatible 17-field primary token:
 
 ```text
 <!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
 ```
 
-The row immediately follows it with a correlated measured-subset extension. Writers serialize an
-omitted value as `null` instead of `undefined`:
+**Entry tokens are never rendered inside a table row.** They occupy their own lines below the
+visible table, and they correlate to their rows by `entry_id`, not by position. Hosts that
+normalize markdown re-serialize a table from its parsed cell model and discard anything that is
+not a cell: measured against Linear on 2026-08-04, an HTML comment trailing a table row is
+destroyed on write while the same comment on its own line round-trips byte-identically. The
+row-trailing layout therefore produced a ledger that reported a successful write, rendered
+correctly for humans, and enumerated **zero** entries — with a surviving rollup token still naming
+them. Parsing is position-agnostic and always has been, so sections written in the historical
+row-trailing layout still enumerate, and migrate to the own-line layout on their next rewrite.
+
+The primary token is immediately followed on the same line by a correlated measured-subset
+extension. Writers serialize an omitted value as `null` instead of `undefined`:
 
 ```text
 <!-- lisa:usage-entry-measured-subset entry_id=<id> measured_subset_tokens=<n|null> -->
@@ -146,7 +156,9 @@ _Managed by Lisa. Regenerated on each usage update; do not edit by hand._
 
 | Flow | Model | Source | Tokens | Cost |
 |---|---|---|---:|---:|
-| ...human-readable rows ending with `lisa-usage-entry` tokens... |
+| ...human-readable rows, cells only, no tokens... |
+
+<!-- lisa:usage-entry ... --> <!-- lisa:usage-entry-measured-subset ... -->
 
 ### Rollup
 
@@ -159,8 +171,29 @@ _Managed by Lisa. Regenerated on each usage update; do not edit by hand._
 <!-- lisa:usage-rollup ... -->
 ```
 
+Every machine-readable token sits on its own line, outside every table. One entry contributes one
+token line; multiple entries contribute consecutive token lines in the same order as their visible
+rows.
+
 Writers may add host-specific surrounding prose, but they must preserve the heading, the managed-note line, the direct-entry tokens, and the single rollup token.
 
+## Write verification
+
+A write surface can accept a section, report success, and silently destroy part of it. **Verify
+every managed write by reading the stored bytes back and parsing them — never by the mutation's
+return value.** A write is successful only when the stored surface satisfies the rollup/entry
+agreement invariant below. A caller that cannot verify a surface must fall back to one it can, or
+fail loudly; it must never report success over an unreadable ledger.
+
+- Every `entry_id` in the rollup's `direct_entry_ids` resolves to a parseable direct entry in the
+  same section.
+- Every parseable direct entry in the section appears in the rollup's `direct_entry_ids`.
+- Every entry the caller just wrote is parseable from the stored surface.
+
+`verifyLisaUsageSectionIntegrity` in the shared utility layer implements exactly these checks and
+returns structured issue codes (`missing-section`, `missing-entry-token`, `missing-rollup-token`,
+`unrecorded-entry`). Callers run it against the read-back body, not against the payload they sent.
+
 ## Rollup and dedupe behavior
 
 Rollups aggregate descendant usage from native tracker hierarchy, documented generated-work references, and explicit `parent_artifact_ref` links. Within one artifact rollup:

package/plugins/lisa-cursor/skills/lisa-usage-accounting/SKILL.md

@@ -154,12 +154,24 @@ The implementation path should use the shared utility layer (`parseLisaUsageSect
 `mergeLisaUsageEntries`, `createLisaUsageRollup`, `upsertLisaUsageSection`) rather than duplicating
 token parsing or markdown rendering in each caller.
 
-### Step 4 — Persist and report
+### Step 4 — Persist, verify by read-back, and report
 
 1. If the rendered ledger body is byte-identical to the current managed surface, return `outcome:
    no-op`.
 2. Otherwise write the body or managed comment through the host adapter.
-3. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
+3. **Read the written surface back from the host and parse it.** Run
+   `verifyLisaUsageSectionIntegrity(<stored body>, { entryIds: <ids just written> })`. A write is
+   successful only when that returns `ok: true`. The host's mutation result is not evidence — a
+   Linear `issueUpdate` returned `success: true` while silently discarding every entry token
+   (2026-08-04), which is the defect this step exists to catch.
+4. If verification fails on the body, retry the identical payload as a managed comment and verify
+   that surface the same way. Return `outcome: comment-fallback` with a warning naming the failed
+   surface and the issue codes.
+5. If verification fails on every surface, return `outcome: blocked` with the issue codes in
+   `error.message`. **Never leave a rollup token behind whose `direct_entry_ids` names entries that
+   cannot be parsed from the same surface** — restore the prior managed content rather than
+   reporting success over an unreadable ledger.
+6. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
    any fallback warning.
 
 If the host write fails, preserve the exact error text in `error.message`. Do not collapse write
@@ -179,4 +191,6 @@ failures into a generic "usage update failed."
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.
+- Never report `updated` on the strength of a mutation's return value. Verification is read-back
+  and parse, on every surface, every write.
 - Never overwrite unrelated artifact body content. Rewrite only the managed usage section/comment.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.328.2",
+  "version": "2.328.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/reference/usage-accounting.md

@@ -75,14 +75,24 @@ cost rollups under the normal pricing and currency rules.
 
 ## Machine-readable tokens
 
-Every visible direct entry row contains the backward-compatible 17-field primary token:
+Every visible direct entry row has a corresponding backward-compatible 17-field primary token:
 
 ```text
 <!-- lisa:usage-entry entry_id=<id> flow=<flow> run_id=<run-id> provider=<provider> model=<model> source=<source> input_tokens=<n|null> cached_input_tokens=<n|null> output_tokens=<n|null> reasoning_tokens=<n|null> total_tokens=<n|null> cost=<decimal|null> currency=<code|null> pricing_status=<status> pricing_source=<ref|null> artifact_ref=<ref> parent_artifact_ref=<ref-or-empty> -->
 ```
 
-The row immediately follows it with a correlated measured-subset extension. Writers serialize an
-omitted value as `null` instead of `undefined`:
+**Entry tokens are never rendered inside a table row.** They occupy their own lines below the
+visible table, and they correlate to their rows by `entry_id`, not by position. Hosts that
+normalize markdown re-serialize a table from its parsed cell model and discard anything that is
+not a cell: measured against Linear on 2026-08-04, an HTML comment trailing a table row is
+destroyed on write while the same comment on its own line round-trips byte-identically. The
+row-trailing layout therefore produced a ledger that reported a successful write, rendered
+correctly for humans, and enumerated **zero** entries — with a surviving rollup token still naming
+them. Parsing is position-agnostic and always has been, so sections written in the historical
+row-trailing layout still enumerate, and migrate to the own-line layout on their next rewrite.
+
+The primary token is immediately followed on the same line by a correlated measured-subset
+extension. Writers serialize an omitted value as `null` instead of `undefined`:
 
 ```text
 <!-- lisa:usage-entry-measured-subset entry_id=<id> measured_subset_tokens=<n|null> -->
@@ -141,7 +151,9 @@ _Managed by Lisa. Regenerated on each usage update; do not edit by hand._
 
 | Flow | Model | Source | Tokens | Cost |
 |---|---|---|---:|---:|
-| ...human-readable rows ending with `lisa-usage-entry` tokens... |
+| ...human-readable rows, cells only, no tokens... |
+
+<!-- lisa:usage-entry ... --> <!-- lisa:usage-entry-measured-subset ... -->
 
 ### Rollup
 
@@ -154,8 +166,29 @@ _Managed by Lisa. Regenerated on each usage update; do not edit by hand._
 <!-- lisa:usage-rollup ... -->
 ```
 
+Every machine-readable token sits on its own line, outside every table. One entry contributes one
+token line; multiple entries contribute consecutive token lines in the same order as their visible
+rows.
+
 Writers may add host-specific surrounding prose, but they must preserve the heading, the managed-note line, the direct-entry tokens, and the single rollup token.
 
+## Write verification
+
+A write surface can accept a section, report success, and silently destroy part of it. **Verify
+every managed write by reading the stored bytes back and parsing them — never by the mutation's
+return value.** A write is successful only when the stored surface satisfies the rollup/entry
+agreement invariant below. A caller that cannot verify a surface must fall back to one it can, or
+fail loudly; it must never report success over an unreadable ledger.
+
+- Every `entry_id` in the rollup's `direct_entry_ids` resolves to a parseable direct entry in the
+  same section.
+- Every parseable direct entry in the section appears in the rollup's `direct_entry_ids`.
+- Every entry the caller just wrote is parseable from the stored surface.
+
+`verifyLisaUsageSectionIntegrity` in the shared utility layer implements exactly these checks and
+returns structured issue codes (`missing-section`, `missing-entry-token`, `missing-rollup-token`,
+`unrecorded-entry`). Callers run it against the read-back body, not against the payload they sent.
+
 ## Rollup and dedupe behavior
 
 Rollups aggregate descendant usage from native tracker hierarchy, documented generated-work references, and explicit `parent_artifact_ref` links. Within one artifact rollup:

package/plugins/src/base/skills/lisa-usage-accounting/SKILL.md

@@ -154,12 +154,24 @@ The implementation path should use the shared utility layer (`parseLisaUsageSect
 `mergeLisaUsageEntries`, `createLisaUsageRollup`, `upsertLisaUsageSection`) rather than duplicating
 token parsing or markdown rendering in each caller.
 
-### Step 4 — Persist and report
+### Step 4 — Persist, verify by read-back, and report
 
 1. If the rendered ledger body is byte-identical to the current managed surface, return `outcome:
    no-op`.
 2. Otherwise write the body or managed comment through the host adapter.
-3. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
+3. **Read the written surface back from the host and parse it.** Run
+   `verifyLisaUsageSectionIntegrity(<stored body>, { entryIds: <ids just written> })`. A write is
+   successful only when that returns `ok: true`. The host's mutation result is not evidence — a
+   Linear `issueUpdate` returned `success: true` while silently discarding every entry token
+   (2026-08-04), which is the defect this step exists to catch.
+4. If verification fails on the body, retry the identical payload as a managed comment and verify
+   that surface the same way. Return `outcome: comment-fallback` with a warning naming the failed
+   surface and the issue codes.
+5. If verification fails on every surface, return `outcome: blocked` with the issue codes in
+   `error.message`. **Never leave a rollup token behind whose `direct_entry_ids` names entries that
+   cannot be parsed from the same surface** — restore the prior managed content rather than
+   reporting success over an unreadable ledger.
+6. Return the exact writable surface used, direct entry ids, rolled-up child entry ids, totals, and
    any fallback warning.
 
 If the host write fails, preserve the exact error text in `error.message`. Do not collapse write
@@ -179,4 +191,6 @@ failures into a generic "usage update failed."
 - Never skip rollup dedupe. Child totals are keyed by stable `entry_id`, not by child ref count.
 - Never silently drop to comments. Return `outcome: comment-fallback` so the caller can surface the
   writable surface that actually holds the ledger.
+- Never report `updated` on the strength of a mutation's return value. Verification is read-back
+  and parse, on every surface, every write.
 - Never overwrite unrelated artifact body content. Rewrite only the managed usage section/comment.