@genesislcap/ai-assistant 15.4.1 → 15.6.0

package/dist/esm/state/ai-assistant-slice.js

@@ -1,4 +1,5 @@
 import { createSlice } from '@genesislcap/foundation-redux';
+import { emptyUsage, sumUsage } from '../utils/sum-usage';
 /**
  * Build a fresh default session state. A factory (not just a shared const) so
  * each call returns independent collections — `resetSession` can hand back a
@@ -16,8 +17,7 @@ export function createDefaultSessionState() {
         suggestionsState: { status: 'idle' },
         contextTokens: undefined,
         contextLimit: undefined,
-        sessionCostUsd: 0,
-        sessionTokensConsumed: 0,
+        sessionUsage: emptyUsage(),
         activeModel: undefined,
         activeProviderName: undefined,
         providerStatuses: [],
@@ -70,11 +70,8 @@ export const aiAssistantSlice = createSlice({
         setContextLimit(state, action) {
             state.contextLimit = action.payload;
         },
-        setSessionCostUsd(state, action) {
-            state.sessionCostUsd = action.payload;
-        },
-        setSessionTokensConsumed(state, action) {
-            state.sessionTokensConsumed = action.payload;
+        setSessionUsage(state, action) {
+            state.sessionUsage = action.payload;
         },
         setActiveModel(state, action) {
             state.activeModel = action.payload;
@@ -135,7 +132,13 @@ export const aiAssistantSlice = createSlice({
             state.messages = p.messages;
             state.pinnedAgentName = p.pinnedAgentName;
             state.flowOwnerAgentName = p.flowOwnerAgentName;
-            state.sessionCostUsd = p.sessionCostUsd;
+            // Derive the totals from the restored transcript rather than trusting a stored
+            // counter. Restore dispatches this action directly, bypassing the host's
+            // `messages` setter — the thing that normally recomputes — so a stored total
+            // would sit stale (historically at 0) until the next turn arrived. The
+            // transcript is the source of truth: per-message usage survives the snapshot,
+            // and a compacted summary carries the usage of the turns it replaced.
+            state.sessionUsage = sumUsage(p.messages);
             state.contextTokens = p.contextTokens;
             state.contextLimit = p.contextLimit;
             state.activeModel = p.activeModel;

package/dist/esm/state/ai-assistant-slice.test.js

@@ -8,10 +8,14 @@ Suite('loadSession hydrates the restorable fields and forces idle', () => {
     let start = createDefaultSessionState();
     start = reduce(start, setState('loading')); // prove it overrides any prior state
     const payload = {
-        messages: [{ role: 'user', content: 'hi' }],
+        // Usage rides on the message: `loadSession` derives the session totals from the
+        // restored transcript rather than from a stored counter, so the cost has to be in
+        // the messages for the assertion below to see it.
+        messages: [
+            { role: 'user', content: 'hi', cost: 1.25, inputTokens: 100, outputTokens: 20 },
+        ],
         pinnedAgentName: 'Guided Booking',
         flowOwnerAgentName: 'Guided Booking',
-        sessionCostUsd: 1.25,
         contextTokens: 1200,
         contextLimit: 200000,
         activeModel: 'claude-sonnet-4-6',
@@ -21,7 +25,11 @@ Suite('loadSession hydrates the restorable fields and forces idle', () => {
     assert.is(next.messages.length, 1);
     assert.is(next.pinnedAgentName, 'Guided Booking');
     assert.is(next.flowOwnerAgentName, 'Guided Booking');
-    assert.is(next.sessionCostUsd, 1.25);
+    assert.is(next.sessionUsage.costUsd, 1.25);
+    // Derived from the same walk: 100 prompt tokens with no cache split reported, so all
+    // of it is uncached input, plus the 20 generated.
+    assert.is(next.sessionUsage.uncachedInputTokens, 100);
+    assert.is(next.sessionUsage.outputTokens, 20);
     assert.is(next.contextTokens, 1200);
     assert.is(next.contextLimit, 200000);
     assert.is(next.activeModel, 'claude-sonnet-4-6');
@@ -35,7 +43,6 @@ Suite('resetSession wipes back to a fresh default', () => {
         messages: [],
         pinnedAgentName: 'A',
         flowOwnerAgentName: 'A',
-        sessionCostUsd: 9,
         contextTokens: 5,
         contextLimit: 10,
         activeModel: 'm',
@@ -43,7 +50,7 @@ Suite('resetSession wipes back to a fresh default', () => {
     }));
     const cleared = reduce(state, resetSession());
     assert.is(cleared.messages.length, 0);
-    assert.is(cleared.sessionCostUsd, 0);
+    assert.is(cleared.sessionUsage.costUsd, 0);
     assert.is(cleared.pinnedAgentName, null);
     assert.is(cleared.flowOwnerAgentName, null);
     assert.is(cleared.contextTokens, undefined);

package/dist/esm/state/debug-event-log.js

@@ -195,8 +195,8 @@ export const DEBUG_LOG_README = [
     'This is an exported debug log for the Genesis AI assistant. Read it top-to-bottom.',
     '`timeline` is the entire session as one array, already sorted chronologically by `timestamp` (ISO 8601). Every entry has a `kind`.',
     'Timestamps are millisecond-resolution; entries that share the same millisecond are ordered by a fixed kind rank (event, then turn, then message), which is a heuristic and may not reflect exact causal order within that millisecond — e.g. a user message and the turn it triggered, or a final assistant message and its turn.end event, can appear in either order depending on whether they landed in the same millisecond. Read the logical structure of a turn rather than over-interpreting the micro-ordering of co-timestamped entries of different kinds.',
-    "kind:'message' — the conversation. `role` is user/assistant/tool/system-event/synthetic-user; `agentName` says which agent produced it; `toolCalls`/`toolResult`/`interaction` carry tool and widget activity; `inputTokens`/`outputTokens`/`cost` are per-message LLM usage, and `externalCostUsd` is any non-LLM cost a widget reported for its own external service calls (folded into the session cost total alongside `cost`). On model-produced assistant messages, `model` is the concrete model id that generated it (e.g. 'gemini-2.5-flash-lite') and `providerName` is the registry slot it resolved under (e.g. a tier name like 'high'/'low', or the default); together they attribute the message — and any tool calls it carries — to an exact model even across a mid-session vendor/tier switch, where one slot name can map to different models before and after the switch. Both are undefined on any entry that is NOT an LLM response: non-assistant roles (user/tool/system-event) and 'synthetic-user' echoes; assistant interaction/widget entries (empty content carrying an `interaction` — a rendered widget, not a model turn); driver-authored assistant fallbacks (the timeout, repeated-malformed-call, and empty-response apology messages); and messages restored from a session persisted before these fields existed. One partial case: on a genuine model turn whose provider exposes no `getStatus` (or reports no model), `providerName` is still set but `model` alone is undefined. A 'synthetic-user' message is a display-only echo of an interaction outcome (e.g. the answer a widget reported): it renders on the user's side of the chat and `agentName` is the agent that created it, but it is never sent to the LLM — so it has no matching 'turn' and the model learns the outcome only from the corresponding tool result.",
-    "Sub-agent messages appear inline. When a tool delegates to a sub-agent (via `requestSubAgent`), the sub-agent's whole conversation — its own assistant/tool messages, each with their own `content`/`thinking`/`toolCalls`/`toolResult` and per-message `model`/`providerName`/`inputTokens`/`outputTokens`/`cost` — is hoisted into the timeline as ordinary kind:'message' entries, interleaved by timestamp right after the tool call that spawned them (so you read the delegation top-to-bottom). A hoisted entry is marked: `subAgentDepth` is its delegation depth (1 for a sub-agent, 2 for a sub-agent's sub-agent, …), `subAgentOf` is the id of the parent tool call that spawned it (correlates it back even when two sub-agents run in one parent turn), `subAgentName` is the sub-agent's own name, and `agentName` is rewritten to a `\"<parent> › <sub-agent>\"` breadcrumb (composing when nested, e.g. `\"UI Builder › Planner › Grounding\"`). The sub-agent's per-LLM-call snapshots also surface as kind:'turn' entries with an N-M `turnIndex`, and subagent.started/completed (or subagent.failed) events bracket the run. Per-message `cost` on hoisted entries is already part of the session total (it is summed from the un-flattened history), so summing the top-level timeline does NOT double-count.",
+    "kind:'message' — the conversation. `role` is user/assistant/tool/system-event/synthetic-user; `agentName` says which agent produced it; `toolCalls`/`toolResult`/`interaction` carry tool and widget activity; `inputTokens`/`outputTokens`/`cost` are per-message LLM usage, where `inputTokens` is the WHOLE prompt for that request and `cacheReadTokens`/`cacheWriteTokens` BREAK IT DOWN rather than add to it — uncached input is `inputTokens` minus those two, and adding the cache fields to `inputTokens` counts the prompt twice. The cache fields are absent on providers that report no cache split (Gemini reports reads only, since implicit caching bills no write) and on messages persisted before they existed, so read them as 0 when missing. Each bucket bills at a different rate — cache reads a fraction of uncached input, cache writes a premium, output highest — so a large token count at a small cost means the prompt was mostly cache hits. `externalCostUsd` is any non-LLM cost a widget reported for its own external service calls (folded into the session cost total alongside `cost`). On model-produced assistant messages, `model` is the concrete model id that generated it (e.g. 'gemini-2.5-flash-lite') and `providerName` is the registry slot it resolved under (e.g. a tier name like 'high'/'low', or the default); together they attribute the message — and any tool calls it carries — to an exact model even across a mid-session vendor/tier switch, where one slot name can map to different models before and after the switch. Both are undefined on any entry that is NOT an LLM response: non-assistant roles (user/tool/system-event) and 'synthetic-user' echoes; assistant interaction/widget entries (empty content carrying an `interaction` — a rendered widget, not a model turn); driver-authored assistant fallbacks (the timeout, repeated-malformed-call, and empty-response apology messages); and messages restored from a session persisted before these fields existed. One partial case: on a genuine model turn whose provider exposes no `getStatus` (or reports no model), `providerName` is still set but `model` alone is undefined. A 'synthetic-user' message is a display-only echo of an interaction outcome (e.g. the answer a widget reported): it renders on the user's side of the chat and `agentName` is the agent that created it, but it is never sent to the LLM — so it has no matching 'turn' and the model learns the outcome only from the corresponding tool result.",
+    "Sub-agent messages appear inline. When a tool delegates to a sub-agent (via `requestSubAgent`), the sub-agent's whole conversation — its own assistant/tool messages, each with their own `content`/`thinking`/`toolCalls`/`toolResult` and per-message `model`/`providerName`/`inputTokens`/`outputTokens`/`cacheReadTokens`/`cacheWriteTokens`/`cost` — is hoisted into the timeline as ordinary kind:'message' entries, interleaved by timestamp right after the tool call that spawned them (so you read the delegation top-to-bottom). A hoisted entry is marked: `subAgentDepth` is its delegation depth (1 for a sub-agent, 2 for a sub-agent's sub-agent, …), `subAgentOf` is the id of the parent tool call that spawned it (correlates it back even when two sub-agents run in one parent turn), `subAgentName` is the sub-agent's own name, and `agentName` is rewritten to a `\"<parent> › <sub-agent>\"` breadcrumb (composing when nested, e.g. `\"UI Builder › Planner › Grounding\"`). The sub-agent's per-LLM-call snapshots also surface as kind:'turn' entries with an N-M `turnIndex`, and subagent.started/completed (or subagent.failed) events bracket the run. Per-message `cost` on hoisted entries is already part of the session total (it is summed from the un-flattened history), so summing the top-level timeline does NOT double-count.",
     "kind:'turn' — one LLM call. `turnIndex` is a string: a top-level turn is the bare counter ('0', '1', …); a sub-agent's turns are numbered under the parent turn that activated them ('3-1', '3-2', …, and a nested sub-agent contributes '3-2-1', …), and `agentName` names the agent that ran the turn. `systemPrompt` and `toolNames` are what the model saw. A systemPrompt of '<repeated — identical to turn N>' was byte-identical to turn N and de-duplicated; the full prompt is shown whenever it changes (often because a stateful agent advanced), so prompt evolution is visible.",
     "kind:'turn'.`agentSnapshot` — the active agent's own view of its internal state, captured at that turn. An agent opts into this by exposing a `getDebugSnapshot()` that returns JSON-serializable per-state info; stateful/flow agents wire it automatically, so you can watch a flow advance turn-by-turn (e.g. current step, cursor, collected fields, pending changes). Absent for agents that don't expose one.",
     "kind:'event' — a meta/lifecycle event. `type` names it (see below); `detail` carries structured data. `detail.placement` is the emitting UI instance: 'bubble' (collapsed), 'panel' (popped-out), or 'standalone'.",

package/dist/esm/state/persistence/session-persistence.integration.test.js

@@ -61,7 +61,11 @@ Suite('save → reload → restore brings back messages, selection, counters', (
     const restored = reduce(freshStore, loadSession(toLoadSessionPayload(snapshot)));
     assert.is(restored.messages.length, 2);
     assert.is(restored.pinnedAgentName, 'Guided Booking');
-    assert.is(restored.sessionCostUsd, 0.5);
+    // Cost comes from the restored transcript, NOT the snapshot's stored counter — so it
+    // is whatever the messages actually carry. Computed independently here rather than
+    // by calling the summing helper under test.
+    const expectedCost = restored.messages.reduce((sum, m) => { var _a, _b; return sum + ((_a = m.cost) !== null && _a !== void 0 ? _a : 0) + ((_b = m.externalCostUsd) !== null && _b !== void 0 ? _b : 0); }, 0);
+    assert.is(restored.sessionUsage.costUsd, expectedCost);
     assert.is(restored.contextTokens, 800);
     assert.is(restored.contextLimit, 200000);
     assert.is(restored.activeModel, 'claude-sonnet-4-6');

package/dist/esm/state/persistence/session-persister.js

@@ -225,7 +225,7 @@ export class SessionPersister {
                     activeAgentName: (_d = s.activeAgent) === null || _d === void 0 ? void 0 : _d.name,
                     pinnedAgentName: s.pinnedAgentName,
                     flowOwnerAgentName: null,
-                    sessionCostUsd: s.sessionCostUsd,
+                    sessionCostUsd: s.sessionUsage.costUsd,
                     contextTokens: s.contextTokens,
                     contextLimit: s.contextLimit,
                     activeModel: s.activeModel,
@@ -256,7 +256,7 @@ export class SessionPersister {
                 activeAgentName: (_f = s.activeAgent) === null || _f === void 0 ? void 0 : _f.name,
                 pinnedAgentName: s.pinnedAgentName,
                 flowOwnerAgentName: s.flowOwnerAgentName,
-                sessionCostUsd: s.sessionCostUsd,
+                sessionCostUsd: s.sessionUsage.costUsd,
                 contextTokens: s.contextTokens,
                 contextLimit: s.contextLimit,
                 activeModel: s.activeModel,

package/dist/esm/state/persistence/session-persister.test.js

@@ -44,7 +44,16 @@ function makePersister(over = {}) {
                 flowActivationPrompt: null,
                 activeAgent: undefined,
                 pinnedAgentName: null,
-                sessionCostUsd: 0,
+                // Inline rather than via `emptyUsage()` to keep this mock self-contained. The
+                // shape matters: the persister reads `sessionUsage.costUsd`, so a mock missing
+                // the object crashes the autosave timer rather than failing an assertion.
+                sessionUsage: {
+                    costUsd: 0,
+                    uncachedInputTokens: 0,
+                    cacheReadTokens: 0,
+                    cacheWriteTokens: 0,
+                    outputTokens: 0,
+                },
                 get restoring() {
                     return f.restoring;
                 },

package/dist/esm/state/persistence/session-snapshot.js

@@ -92,12 +92,16 @@ export function isRestorableSession(value, opts) {
  * @internal
  */
 export function toLoadSessionPayload(s) {
-    var _a, _b, _c;
+    var _a, _b;
     return {
         messages: s.messages,
         pinnedAgentName: (_a = s.pinnedAgentName) !== null && _a !== void 0 ? _a : null,
         flowOwnerAgentName: (_b = s.flowOwnerAgentName) !== null && _b !== void 0 ? _b : null,
-        sessionCostUsd: (_c = s.sessionCostUsd) !== null && _c !== void 0 ? _c : 0,
+        // `sessionCostUsd` is deliberately NOT projected: the slice re-derives cost and
+        // token totals from `messages` on load. The snapshot field is still written (its
+        // shape is public, and it is a useful cross-check in a saved blob), but it is no
+        // longer authoritative — a snapshot saved mid-reset could hold a zeroed total
+        // while its transcript still shows the spend.
         contextTokens: s.contextTokens,
         contextLimit: s.contextLimit,
         activeModel: s.activeModel,

package/dist/esm/state/persistence/session-snapshot.test.js

@@ -49,7 +49,10 @@ Suite('toLoadSessionPayload projects only the redux-restorable fields', () => {
     const p = toLoadSessionPayload(base());
     assert.is(p.pinnedAgentName, 'A');
     assert.is(p.flowOwnerAgentName, null);
-    assert.is(p.sessionCostUsd, 2);
+    // Cost is deliberately NOT projected — the slice re-derives it (and the token
+    // buckets) from `messages`, so a stored counter would be a second, divergeable
+    // source of truth.
+    assert.is(p.sessionCostUsd, undefined);
     assert.is(p.contextTokens, 10);
     assert.is(p.contextLimit, 100);
     assert.is(p.activeModel, 'm');

package/dist/esm/state/persistence/stateful-restore.e2e.test.js

@@ -55,7 +55,16 @@ function makeMemoryProvider() {
 function makeStoreFake(over = {}) {
     return {
         store: {
-            aiAssistant: Object.assign({ messages: [], flowOwnerAgentName: null, flowActivationPrompt: null, activeAgent: undefined, pinnedAgentName: null, sessionCostUsd: 0, contextTokens: 0, contextLimit: 0, activeModel: undefined, activeProviderName: undefined, restoring: false }, over),
+            aiAssistant: Object.assign({ messages: [], flowOwnerAgentName: null, flowActivationPrompt: null, activeAgent: undefined, pinnedAgentName: null, 
+                // The persister reads `sessionUsage.costUsd` when building a snapshot, so this
+                // has to be the object rather than a bare cost scalar.
+                sessionUsage: {
+                    costUsd: 0,
+                    uncachedInputTokens: 0,
+                    cacheReadTokens: 0,
+                    cacheWriteTokens: 0,
+                    outputTokens: 0,
+                }, contextTokens: 0, contextLimit: 0, activeModel: undefined, activeProviderName: undefined, restoring: false }, over),
         },
         actions: {
             aiAssistant: {

package/dist/esm/styles/settings-section.js

@@ -0,0 +1,39 @@
+import { css } from '@genesislcap/web-core';
+/**
+ * Heading style for a settings-modal section, published so a host can title its own section.
+ *
+ * The assistant renders no heading for the `settings-app` slot — no text and no icon — because
+ * only the host knows what that section is. The consequence is that a host supplying one has to
+ * reproduce the styling of the built-in headings beside it, and a copied rule drifts the moment
+ * either side changes. So the declarations live here, are applied by the assistant's own
+ * headings, and are exported for the host to apply to its.
+ *
+ * Compose it into a component's styles and put `ai-settings-section-title` on the heading:
+ *
+ * ```ts
+ * import { assistantSettingsSectionTitleStyles } from '@genesislcap/ai-assistant';
+ *
+ * const styles = css`
+ *   ${assistantSettingsSectionTitleStyles}
+ *   :host { display: block; }
+ * `;
+ * ```
+ *
+ * Carries no margin on purpose: spacing belongs to the surrounding layout, which differs
+ * between the assistant's own sections and a slotted one, and is the single declaration hosts
+ * had to diverge on when they copied this rule.
+ *
+ * @beta
+ */
+export const assistantSettingsSectionTitleStyles = css `
+  .ai-settings-section-title {
+    display: flex;
+    align-items: center;
+    gap: calc(var(--design-unit) * 2px);
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--neutral-foreground-hint);
+  }
+`;

package/dist/esm/utils/condense-history.js

@@ -98,7 +98,7 @@ function estimateTokensSaved(origLen, stubLen) {
  * @param onCondensed - Invoked once per payload at its full→stub transition.
  */
 export function applyCondensation(history, policies, ctx, onCondensed) {
-    var _a;
+    var _a, _b;
     if (policies.size === 0)
         return history;
     const triggersOf = (entry) => Array.isArray(entry.policy.on) ? entry.policy.on : [entry.policy.on];
@@ -106,15 +106,26 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
     // lookup. For each `superseded` key the LAST call in history order survives.
     // The name lookup lets a tool message (which carries only an id) name its tool
     // in stubs and events.
+    // Batch boundary: the collapse set is resolved as of this model-call and stays put
+    // until the next boundary, so the prefix is append-only in between. `batchCalls` of 1
+    // (the default) makes this `ctx.modelCall` — i.e. no batching.
+    const batchCalls = Math.max(1, Math.floor((_a = ctx.batchCalls) !== null && _a !== void 0 ? _a : 1));
+    const asOf = batchCalls === 1 ? ctx.modelCall : Math.floor(ctx.modelCall / batchCalls) * batchCalls;
+    // A call made after the boundary is invisible to this pass in BOTH directions: it
+    // cannot supersede an older call (which would collapse the older payload early), and
+    // it cannot itself collapse (which would elide the very result just fetched). Unbatched,
+    // the boundary is the live clock and this gate is off entirely — a call registered on
+    // the current model-call is still eligible, as it always was.
+    const withinBatch = (entry) => batchCalls === 1 || entry.iteration <= asOf;
     const latestByKey = new Map();
     const nameById = new Map();
     for (const msg of history) {
-        if (!((_a = msg.toolCalls) === null || _a === void 0 ? void 0 : _a.length))
+        if (!((_b = msg.toolCalls) === null || _b === void 0 ? void 0 : _b.length))
             continue;
         for (const tc of msg.toolCalls) {
             nameById.set(tc.id, tc.name);
             const entry = policies.get(tc.id);
-            if (!entry)
+            if (!entry || !withinBatch(entry))
                 continue;
             for (const t of triggersOf(entry)) {
                 if (t.kind === 'superseded')
@@ -128,7 +139,7 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
             // past the last allowed view: turns:1 → seen once, then gone. Monotonic
             // clock, so this holds across turn boundaries too.
             case 'age':
-                return ctx.modelCall - entry.iteration > trig.turns;
+                return asOf - entry.iteration > trig.turns;
             case 'turnEnd':
                 return ctx.turn > entry.turn;
             case 'agentEnd':
@@ -144,7 +155,9 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
     };
     // The first listed trigger that fires — drives the collapse, the stub reason,
     // and the event label. `undefined` means the payload stays full.
-    const firstFired = (toolCallId, entry) => triggersOf(entry).find((t) => triggerFires(toolCallId, entry, t));
+    const firstFired = (toolCallId, entry) => withinBatch(entry)
+        ? triggersOf(entry).find((t) => triggerFires(toolCallId, entry, t))
+        : undefined;
     return history.map((msg) => {
         var _a, _b, _c, _d;
         // Tool-call ARGS live on the assistant message.

package/dist/esm/utils/condense-history.test.js

@@ -27,6 +27,7 @@ const ctx = (o = {}) => {
         turn: (_b = o.turn) !== null && _b !== void 0 ? _b : 0,
         activationEnded: (_c = o.activationEnded) !== null && _c !== void 0 ? _c : (() => false),
         phaseEnded: (_d = o.phaseEnded) !== null && _d !== void 0 ? _d : (() => false),
+        batchCalls: o.batchCalls,
     });
 };
 const sink = () => {
@@ -336,3 +337,69 @@ suite('multi-trigger first-wins: the earliest-listed firing trigger is the reaso
     assert.is((_b = events.find((e) => e.toolCallId === 'm2')) === null || _b === void 0 ? void 0 : _b.trigger, 'turnEnd', 'the supersession survivor still collapses via the next trigger');
 });
 suite.run();
+// ── batched collapse (GENC-1476) ───────────────────────────────────────────
+// Condensation rewrites history in place, so collapsing the instant a trigger fires
+// breaks the prompt cache on nearly every call of a re-read loop. Batching holds the
+// collapse set still between boundaries.
+const batch = createLogicSuite('applyCondensation batching');
+/** A re-read loop: `n` reads of the same path, each registered one model-call apart. */
+const reReadLoop = (n) => {
+    const history = [];
+    const policies = new Map();
+    for (let i = 1; i <= n; i += 1) {
+        history.push(asstCall(`r${i}`, 'vfs_read', { path: 'A.tsx' }), toolMsg(`r${i}`, big()));
+        policies.set(`r${i}`, reg({ on: { kind: 'superseded', by: 'A.tsx' }, response: 'pointer' }, { iteration: i }));
+    }
+    return { history, policies };
+};
+/** Result content of every tool message, in order. */
+const results = (out) => out.filter((m) => m.role === 'tool').map((m) => { var _a, _b; return (_b = (_a = m.toolResult) === null || _a === void 0 ? void 0 : _a.content) !== null && _b !== void 0 ? _b : ''; });
+batch('without batching every superseded read collapses immediately', () => {
+    const { history, policies } = reReadLoop(4);
+    const out = results(applyCondensation(history, policies, ctx({ modelCall: 4 }), sink().on));
+    // Only the newest survives; the other three are already stubs.
+    assert.is(out.filter((c) => c.startsWith('[')).length, 3);
+    assert.is(out[3].length, big().length);
+});
+batch('batching leaves the prefix untouched between boundaries', () => {
+    const { history, policies } = reReadLoop(4);
+    // Boundary is floor(4/10)*10 = 0, so no call is within the batch yet.
+    const out = results(applyCondensation(history, policies, ctx({ modelCall: 4, batchCalls: 10 }), sink().on));
+    assert.equal(out.map((c) => c.length), [big().length, big().length, big().length, big().length]);
+});
+batch('the batch boundary collapses the backlog in one step', () => {
+    const { history, policies } = reReadLoop(12);
+    const before = results(applyCondensation(history, policies, ctx({ modelCall: 9, batchCalls: 10 }), sink().on));
+    const after = results(applyCondensation(history, policies, ctx({ modelCall: 10, batchCalls: 10 }), sink().on));
+    assert.is(before.filter((c) => c.startsWith('[')).length, 0);
+    // At the boundary, reads 1-9 collapse together; 10-12 are past it and stay full.
+    assert.is(after.filter((c) => c.startsWith('[')).length, 9);
+});
+batch('a call past the boundary neither collapses nor supersedes an older one', () => {
+    // The regression this guards: excluding the new call as a SUPERSEDER but still letting
+    // it collapse would elide the very result the agent just fetched.
+    const { history, policies } = reReadLoop(2);
+    policies.set('r2', reg({ on: { kind: 'superseded', by: 'A.tsx' }, response: 'pointer' }, { iteration: 7 }));
+    const out = results(applyCondensation(history, policies, ctx({ modelCall: 7, batchCalls: 5 }), sink().on));
+    assert.is(out[1].length, big().length, 'the newest read must stay full');
+    assert.is(out[0].length, big().length, 'the older read must not collapse early either');
+});
+batch('age is measured against the boundary, not the live clock', () => {
+    const history = [asstCall('g1', 'grep', {}), toolMsg('g1', big())];
+    const policies = new Map([
+        ['g1', reg({ on: { kind: 'age', turns: 1 }, response: 'pointer' }, { iteration: 1 })],
+    ]);
+    // Live clock says age 4 > 1 (would collapse); the boundary says 0, so it holds.
+    const held = results(applyCondensation(history, policies, ctx({ modelCall: 5, batchCalls: 10 }), sink().on));
+    assert.is(held[0].length, big().length);
+    const collapsed = results(applyCondensation(history, policies, ctx({ modelCall: 10, batchCalls: 10 }), sink().on));
+    assert.ok(collapsed[0].startsWith('['));
+});
+batch('batchCalls of 1, 0 or absent all keep the historical behaviour', () => {
+    for (const batchCalls of [1, 0, undefined]) {
+        const { history, policies } = reReadLoop(3);
+        const out = results(applyCondensation(history, policies, ctx({ modelCall: 3, batchCalls }), sink().on));
+        assert.is(out.filter((c) => c.startsWith('[')).length, 2, `batchCalls=${batchCalls}`);
+    }
+});
+batch.run();

package/dist/esm/utils/cost-session-history.js

@@ -1,9 +1,28 @@
+import { emptyUsage } from './sum-usage';
 const STORAGE_PREFIX = 'genesis-ai-assistant:cost-history:';
+/**
+ * Every bucket must be a number before a row is trusted. Checked per field rather than
+ * just testing for an object, because a partially-shaped `usage` would sum as `NaN` and
+ * silently poison every total on the Usage tab.
+ */
+function isAggregateUsage(value) {
+    if (typeof value !== 'object' || value == null)
+        return false;
+    const u = value;
+    return (typeof u.costUsd === 'number' &&
+        typeof u.uncachedInputTokens === 'number' &&
+        typeof u.cacheReadTokens === 'number' &&
+        typeof u.cacheWriteTokens === 'number' &&
+        typeof u.outputTokens === 'number');
+}
 /** localStorage key for a host-scoped cost history list. */
 export function costHistoryStorageKey(scope) {
     return `${STORAGE_PREFIX}${scope}`;
 }
-/** Load persisted cost sessions for a scope (newest first). */
+/**
+ * Load persisted cost sessions for a scope, in whatever order they were stored — this applies no
+ * ordering of its own. Display order is the caller's business; see `sortRecordsByRecency`.
+ */
 export function loadCostSessionHistory(scope) {
     if (typeof localStorage === 'undefined')
         return [];
@@ -31,17 +50,62 @@ export function saveCostSessionHistory(scope, records) {
         // Quota exceeded or private browsing — non-fatal.
     }
 }
-/** Prepend a record and persist. Returns the updated list. */
-export function appendCostSessionRecord(scope, record) {
-    const records = [record, ...loadCostSessionHistory(scope)];
-    saveCostSessionHistory(scope, records);
-    return records;
+/**
+ * Pure upsert — `records` with `record` replacing any row sharing its `projectKey`, or
+ * prepended when there is none.
+ *
+ * An upsert, not an append, because a row stands for a **project's lifetime usage** rather
+ * than a visit to it. Appending cut a fresh row per page-hide, so one project accumulated
+ * a stack of near-identical rows and its spend was counted once per refresh by anything
+ * summing the list.
+ *
+ * The resulting array order is incidental — it is insertion order, so a project returned to
+ * stays where it first landed. Do not read it as recency; `sortRecordsByRecency` is what the
+ * Usage tab renders through.
+ *
+ * Storage-agnostic on purpose: the same merge serves the synchronous `localStorage` path
+ * and the async provider-backed one, so the two can never drift on what "upsert" means.
+ * The caller owns persistence — see the assistant's `persistCostHistory`.
+ */
+export function upsertRecord(records, record) {
+    const at = records.findIndex((r) => r.projectKey === record.projectKey);
+    return at === -1 ? [record, ...records] : records.map((r, i) => (i === at ? record : r));
+}
+/**
+ * Rows most-recently-worked-on first, as a new array.
+ *
+ * Applied at read time rather than baked into the stored order, so it covers rows that came from
+ * a host provider as well as from `localStorage`, and so no write path has to maintain it.
+ *
+ * `updatedAt` is ISO-8601, which sorts lexicographically — no date parsing, and no dependence on
+ * the strings being valid dates. Sorting by it rather than by insertion order is what makes the
+ * list track use: the active project moves to the top on its first upsert and stays there, since
+ * its row is rewritten on every transcript change.
+ */
+export function sortRecordsByRecency(records) {
+    return [...records].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
 }
-/** Remove one record by id. Returns the updated list. */
-export function removeCostSessionRecord(scope, id) {
-    const records = loadCostSessionHistory(scope).filter((r) => r.id !== id);
-    saveCostSessionHistory(scope, records);
-    return records;
+/**
+ * The spend a project's next row must carry over from before its current transcript.
+ *
+ * `transcriptIsAuthoritative` means the open transcript already accounts for this project's
+ * history — true exactly when a session snapshot is restored on load. The two branches are
+ * not interchangeable, and picking the wrong one is silently destructive:
+ *
+ * - Authoritative: carry the previous row's own `banked` forward. Taking `usage` instead would
+ *   re-add the restored history on every reload, the compounding double-count this replaced.
+ * - Not authoritative: the whole previous total becomes banked, because nothing in the fresh
+ *   transcript accounts for it. Taking `banked` instead would rewrite the row down to the
+ *   current page-load and drop the project's earlier spend.
+ *
+ * Note both branches are idempotent — the result never includes the current transcript — which
+ * is what lets two assistant instances sharing a session write the same row.
+ */
+export function resolveBankedUsage(existing, transcriptIsAuthoritative) {
+    if (!existing)
+        return emptyUsage();
+    const carried = transcriptIsAuthoritative ? existing.banked : existing.usage;
+    return carried !== null && carried !== void 0 ? carried : emptyUsage();
 }
 /** Clear all persisted records for a scope. */
 export function clearCostSessionHistory(scope) {
@@ -62,14 +126,27 @@ export function formatCostSessionDate(iso) {
         year: 'numeric',
     }).format(new Date(iso));
 }
-function isCostSessionRecord(value) {
+/**
+ * Whether a value is a usable row. Exported because rows arrive by two routes and BOTH need it:
+ * `loadCostSessionHistory` filters the `localStorage` path here, and the assistant filters what a
+ * host provider returns. A row that skips this check is not merely ignored downstream — a
+ * half-shaped `usage` sums to `NaN` through every total, and a missing `updatedAt` throws inside
+ * the sort that orders the list, during render.
+ */
+export function isCostSessionRecord(value) {
     if (typeof value !== 'object' || value == null)
         return false;
     const r = value;
     return (typeof r.id === 'string' &&
+        // Rows written before the upsert model have no `projectKey` and cannot be keyed
+        // to a project, so they are discarded on load rather than silently pooled with
+        // the new per-project rows (where they would double-count that project).
+        typeof r.projectKey === 'string' &&
         typeof r.title === 'string' &&
-        typeof r.endedAt === 'string' &&
-        typeof r.costUsd === 'number' &&
-        typeof r.tokensConsumed === 'number' &&
+        typeof r.updatedAt === 'string' &&
+        isAggregateUsage(r.usage) &&
+        // Absent is valid (nothing banked / pre-dates the field); present must be whole, since
+        // a half-shaped `banked` would poison the lifetime total exactly as a bad `usage` would.
+        (r.banked === undefined || isAggregateUsage(r.banked)) &&
         Array.isArray(r.models));
 }