@xerg/cli 0.5.1 → 0.5.3

package/dist/index.js

@@ -122,23 +122,6 @@ import { closeSync, openSync, readSync } from "fs";
 function sha1(input) {
   return createHash("sha1").update(input).digest("hex");
 }
-function sha1File(path) {
-  const hash = createHash("sha1");
-  const fd = openSync(path, "r");
-  const buffer = Buffer.allocUnsafe(64 * 1024);
-  try {
-    let bytesRead = 0;
-    do {
-      bytesRead = readSync(fd, buffer, 0, buffer.length, null);
-      if (bytesRead > 0) {
-        hash.update(buffer.subarray(0, bytesRead));
-      }
-    } while (bytesRead > 0);
-  } finally {
-    closeSync(fd);
-  }
-  return hash.digest("hex");
-}
 
 // ../core/src/utils/time.ts
 function parseSince(value) {
@@ -736,354 +719,80 @@ async function inspectCursorUsageCsv(options) {
 }
 
 // ../core/src/db/client.ts
-import { mkdirSync } from "fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
 import { dirname } from "path";
-import Database from "better-sqlite3";
-
-// ../core/src/db/schema.ts
-var SCHEMA_VERSION = 1;
-var SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS source_files (
-  id TEXT PRIMARY KEY,
-  path TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  file_hash TEXT NOT NULL,
-  mtime_ms INTEGER NOT NULL,
-  size_bytes INTEGER NOT NULL,
-  imported_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS runs (
-  id TEXT PRIMARY KEY,
-  source_path TEXT NOT NULL,
-  source_kind TEXT NOT NULL,
-  timestamp TEXT NOT NULL,
-  workflow TEXT NOT NULL,
-  environment TEXT NOT NULL,
-  tags_json TEXT NOT NULL,
-  total_cost_usd REAL NOT NULL,
-  total_tokens INTEGER NOT NULL,
-  observed_cost_usd REAL NOT NULL,
-  estimated_cost_usd REAL NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS calls (
-  id TEXT PRIMARY KEY,
-  run_id TEXT NOT NULL,
-  timestamp TEXT NOT NULL,
-  provider TEXT NOT NULL,
-  model TEXT NOT NULL,
-  input_tokens INTEGER NOT NULL,
-  output_tokens INTEGER NOT NULL,
-  cost_usd REAL NOT NULL,
-  cost_source TEXT NOT NULL,
-  latency_ms INTEGER,
-  tool_calls INTEGER NOT NULL,
-  retries INTEGER NOT NULL,
-  attempt INTEGER,
-  iteration INTEGER,
-  status TEXT,
-  task_class TEXT,
-  cache_hit INTEGER NOT NULL,
-  cache_cost_usd REAL,
-  metadata_json TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS findings (
-  id TEXT PRIMARY KEY,
-  audit_id TEXT NOT NULL,
-  classification TEXT NOT NULL,
-  confidence TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  title TEXT NOT NULL,
-  summary TEXT NOT NULL,
-  scope TEXT NOT NULL,
-  scope_id TEXT NOT NULL,
-  cost_impact_usd REAL NOT NULL,
-  details_json TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS pricing_catalog (
-  id TEXT PRIMARY KEY,
-  provider TEXT NOT NULL,
-  model TEXT NOT NULL,
-  effective_date TEXT NOT NULL,
-  input_per_1m REAL NOT NULL,
-  output_per_1m REAL NOT NULL,
-  cached_input_per_1m REAL
-);
-
-CREATE TABLE IF NOT EXISTS audit_snapshots (
-  id TEXT PRIMARY KEY,
-  created_at TEXT NOT NULL,
-  summary_json TEXT NOT NULL
-);
-`;
-
-// ../core/src/db/client.ts
-function createDb(path) {
-  mkdirSync(dirname(path), { recursive: true });
-  const sqlite = new Database(path);
-  const currentVersion = sqlite.pragma("user_version", { simple: true });
-  if (currentVersion > SCHEMA_VERSION) {
-    sqlite.close();
-    throw new Error(
-      `Unsupported Xerg database schema version ${currentVersion}. This build supports up to ${SCHEMA_VERSION}.`
+var SNAPSHOT_STORE_VERSION = 1;
+function readStoredSnapshotRows(path) {
+  if (!existsSync(path)) {
+    return [];
+  }
+  try {
+    return normalizeStore(JSON.parse(readFileSync2(path, "utf8"))).auditSnapshots.sort(
+      (left, right) => right.createdAt.localeCompare(left.createdAt)
     );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    process.stderr.write(`Warning: skipping unreadable local snapshot store ${path}: ${message}
+`);
+    return [];
   }
-  sqlite.exec(SCHEMA_SQL);
-  if (currentVersion < SCHEMA_VERSION) {
-    sqlite.pragma(`user_version = ${SCHEMA_VERSION}`);
+}
+function writeStoredSnapshotRows(path, rows) {
+  mkdirSync(dirname(path), { recursive: true });
+  const store = {
+    version: SNAPSHOT_STORE_VERSION,
+    auditSnapshots: rows.sort((left, right) => right.createdAt.localeCompare(left.createdAt))
+  };
+  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync(tempPath, `${JSON.stringify(store, null, 2)}
+`, "utf8");
+  renameSync(tempPath, path);
+}
+function upsertStoredAuditSnapshot(path, row) {
+  const rows = readStoredSnapshotRows(path);
+  if (rows.some((existing) => existing.id === row.id)) {
+    return;
   }
-  return { sqlite };
+  writeStoredSnapshotRows(path, [...rows, row]);
 }
-
-// ../core/src/db/persist.ts
-function persistAudit(audit, dbPath) {
-  const { sqlite } = createDb(dbPath);
-  const importedAt = isoNow();
-  const pricingRows = audit.pricingCatalog.map((entry) => ({
-    ...entry,
-    cachedInputPer1m: entry.cachedInputPer1m ?? null
-  }));
-  const sourceFileRows = audit.summary.sourceFiles.map((file) => ({
-    id: sha1(`${file.path}:${file.mtimeMs}:${file.sizeBytes}`),
-    path: file.path,
-    kind: file.kind,
-    fileHash: sha1File(file.path),
-    mtimeMs: Math.trunc(file.mtimeMs),
-    sizeBytes: file.sizeBytes,
-    importedAt
-  }));
-  const runRows = audit.runs.map((run2) => ({
-    id: run2.id,
-    sourcePath: run2.sourcePath,
-    sourceKind: run2.sourceKind,
-    timestamp: run2.timestamp,
-    workflow: run2.workflow,
-    environment: run2.environment,
-    tagsJson: JSON.stringify(run2.tags),
-    totalCostUsd: run2.totalCostUsd,
-    totalTokens: run2.totalTokens,
-    observedCostUsd: run2.observedCostUsd,
-    estimatedCostUsd: run2.estimatedCostUsd
-  }));
-  const callRows = audit.runs.flatMap(
-    (run2) => run2.calls.map((call) => ({
-      id: call.id,
-      runId: call.runId,
-      timestamp: call.timestamp,
-      provider: call.provider,
-      model: call.model,
-      inputTokens: call.inputTokens,
-      outputTokens: call.outputTokens,
-      costUsd: call.costUsd,
-      costSource: call.costSource,
-      latencyMs: call.latencyMs,
-      toolCalls: call.toolCalls,
-      retries: call.retries,
-      attempt: call.attempt,
-      iteration: call.iteration,
-      status: call.status,
-      taskClass: call.taskClass,
-      cacheHit: call.cacheHit,
-      cacheCostUsd: call.cacheCostUsd,
-      metadataJson: JSON.stringify(call.metadata)
-    }))
-  );
-  const findingRows = audit.summary.findings.map((finding) => ({
-    id: finding.id,
-    auditId: audit.summary.auditId,
-    classification: finding.classification,
-    confidence: finding.confidence,
-    kind: finding.kind,
-    title: finding.title,
-    summary: finding.summary,
-    scope: finding.scope,
-    scopeId: finding.scopeId,
-    costImpactUsd: finding.costImpactUsd,
-    detailsJson: JSON.stringify(finding.details)
-  }));
-  const persistTransaction = sqlite.transaction(() => {
-    insertMany(
-      sqlite,
-      `
-        INSERT OR IGNORE INTO pricing_catalog (
-          id,
-          provider,
-          model,
-          effective_date,
-          input_per_1m,
-          output_per_1m,
-          cached_input_per_1m
-        ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      `,
-      pricingRows.map((row) => [
-        row.id,
-        row.provider,
-        row.model,
-        row.effectiveDate,
-        row.inputPer1m,
-        row.outputPer1m,
-        row.cachedInputPer1m
-      ])
-    );
-    insertMany(
-      sqlite,
-      `
-        INSERT OR IGNORE INTO source_files (
-          id,
-          path,
-          kind,
-          file_hash,
-          mtime_ms,
-          size_bytes,
-          imported_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      `,
-      sourceFileRows.map((row) => [
-        row.id,
-        row.path,
-        row.kind,
-        row.fileHash,
-        row.mtimeMs,
-        row.sizeBytes,
-        row.importedAt
-      ])
-    );
-    insertMany(
-      sqlite,
-      `
-        INSERT OR IGNORE INTO runs (
-          id,
-          source_path,
-          source_kind,
-          timestamp,
-          workflow,
-          environment,
-          tags_json,
-          total_cost_usd,
-          total_tokens,
-          observed_cost_usd,
-          estimated_cost_usd
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `,
-      runRows.map((row) => [
-        row.id,
-        row.sourcePath,
-        row.sourceKind,
-        row.timestamp,
-        row.workflow,
-        row.environment,
-        row.tagsJson,
-        row.totalCostUsd,
-        row.totalTokens,
-        row.observedCostUsd,
-        row.estimatedCostUsd
-      ])
-    );
-    insertMany(
-      sqlite,
-      `
-        INSERT OR IGNORE INTO calls (
-          id,
-          run_id,
-          timestamp,
-          provider,
-          model,
-          input_tokens,
-          output_tokens,
-          cost_usd,
-          cost_source,
-          latency_ms,
-          tool_calls,
-          retries,
-          attempt,
-          iteration,
-          status,
-          task_class,
-          cache_hit,
-          cache_cost_usd,
-          metadata_json
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `,
-      callRows.map((row) => [
-        row.id,
-        row.runId,
-        row.timestamp,
-        row.provider,
-        row.model,
-        row.inputTokens,
-        row.outputTokens,
-        row.costUsd,
-        row.costSource,
-        row.latencyMs ?? null,
-        row.toolCalls,
-        row.retries,
-        row.attempt ?? null,
-        row.iteration ?? null,
-        row.status ?? null,
-        row.taskClass ?? null,
-        row.cacheHit ? 1 : 0,
-        row.cacheCostUsd ?? null,
-        row.metadataJson
-      ])
-    );
-    insertMany(
-      sqlite,
-      `
-        INSERT OR IGNORE INTO findings (
-          id,
-          audit_id,
-          classification,
-          confidence,
-          kind,
-          title,
-          summary,
-          scope,
-          scope_id,
-          cost_impact_usd,
-          details_json
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `,
-      findingRows.map((row) => [
-        row.id,
-        row.auditId,
-        row.classification,
-        row.confidence,
-        row.kind,
-        row.title,
-        row.summary,
-        row.scope,
-        row.scopeId,
-        row.costImpactUsd,
-        row.detailsJson
-      ])
-    );
-    sqlite.prepare(
-      `
-          INSERT OR IGNORE INTO audit_snapshots (
-            id,
-            created_at,
-            summary_json
-          ) VALUES (?, ?, ?)
-        `
-    ).run(audit.summary.auditId, audit.summary.generatedAt, JSON.stringify(audit.summary));
-  });
-  try {
-    persistTransaction();
-  } finally {
-    sqlite.close();
+function normalizeStore(input) {
+  if (!input || typeof input !== "object") {
+    throw new Error("Snapshot store is not an object.");
   }
+  const store = input;
+  if (store.version !== SNAPSHOT_STORE_VERSION) {
+    throw new Error(`Unsupported snapshot store version ${String(store.version)}.`);
+  }
+  if (!Array.isArray(store.auditSnapshots)) {
+    throw new Error("Snapshot store auditSnapshots field is missing or invalid.");
+  }
+  return {
+    version: SNAPSHOT_STORE_VERSION,
+    auditSnapshots: store.auditSnapshots.map(normalizeSnapshotRow)
+  };
 }
-function insertMany(sqlite, sql, rows) {
-  if (rows.length === 0) {
-    return;
+function normalizeSnapshotRow(input) {
+  if (!input || typeof input !== "object") {
+    throw new Error("Snapshot row is not an object.");
   }
-  const statement = sqlite.prepare(sql);
-  for (const row of rows) {
-    statement.run(...row);
+  const row = input;
+  if (typeof row.id !== "string" || typeof row.createdAt !== "string" || typeof row.summaryJson !== "string") {
+    throw new Error("Snapshot row is missing id, createdAt, or summaryJson.");
   }
+  return {
+    id: row.id,
+    createdAt: row.createdAt,
+    summaryJson: row.summaryJson
+  };
+}
+
+// ../core/src/db/persist.ts
+function persistAudit(audit, dbPath) {
+  upsertStoredAuditSnapshot(dbPath, {
+    id: audit.summary.auditId,
+    createdAt: audit.summary.generatedAt,
+    summaryJson: JSON.stringify(audit.summary)
+  });
 }
 
 // ../core/src/report/comparison.ts
@@ -1165,6 +874,36 @@ function buildTaxonomyBuckets(findings, classification) {
   }
   return Array.from(buckets.values()).sort((left, right) => right.spendUsd - left.spendUsd);
 }
+function buildWasteBySignalSource(findings) {
+  const rollup = {
+    observedUsd: 0,
+    inferredUsd: 0,
+    declaredUsd: 0,
+    unknownUsd: 0,
+    inferredShare: null
+  };
+  for (const finding of findings) {
+    if (finding.classification !== "waste") {
+      continue;
+    }
+    if (finding.signalSource === "observed") {
+      rollup.observedUsd = round2(rollup.observedUsd + finding.costImpactUsd);
+      continue;
+    }
+    if (finding.signalSource === "inferred") {
+      rollup.inferredUsd = round2(rollup.inferredUsd + finding.costImpactUsd);
+      continue;
+    }
+    if (finding.signalSource === "declared") {
+      rollup.declaredUsd = round2(rollup.declaredUsd + finding.costImpactUsd);
+      continue;
+    }
+    rollup.unknownUsd = round2(rollup.unknownUsd + finding.costImpactUsd);
+  }
+  const knownTotal = rollup.observedUsd + rollup.inferredUsd + rollup.declaredUsd;
+  rollup.inferredShare = rollup.unknownUsd > 0 ? null : Number((knownTotal === 0 ? 0 : rollup.inferredUsd / knownTotal).toFixed(4));
+  return rollup;
+}
 function toSpendMap(rows) {
   return new Map(rows.map((row) => [row.key, row.spendUsd]));
 }
@@ -1280,6 +1019,7 @@ function hydrateAuditSummary(summary) {
     opportunityByKind: summary.opportunityByKind?.length > 0 ? summary.opportunityByKind : buildTaxonomyBuckets(summary.findings, "opportunity"),
     spendByDay: summary.spendByDay ?? [],
     wasteByDay: summary.wasteByDay ?? [],
+    wasteBySignalSource: summary.wasteBySignalSource ?? buildWasteBySignalSource(summary.findings),
     recommendations: summary.recommendations ?? [],
     notes: summary.notes ?? [],
     pricingCoverage: summary.pricingCoverage ?? null,
@@ -1300,6 +1040,7 @@ function buildAuditComparison(current, baseline) {
     baselineWasteSpendUsd: baseline.wasteSpendUsd,
     baselineOpportunitySpendUsd: baseline.opportunitySpendUsd,
     baselineStructuralWasteRate: baseline.structuralWasteRate,
+    baselineWasteBySignalSource: baseline.wasteBySignalSource ?? buildWasteBySignalSource(baseline.findings),
     deltaTotalSpendUsd: round2(current.totalSpendUsd - baseline.totalSpendUsd),
     deltaObservedSpendUsd: round2(current.observedSpendUsd - baseline.observedSpendUsd),
     deltaEstimatedSpendUsd: round2(current.estimatedSpendUsd - baseline.estimatedSpendUsd),
@@ -1326,19 +1067,7 @@ function parseAuditSummary(row) {
   }
 }
 function listStoredAuditSummaries(dbPath) {
-  const { sqlite } = createDb(dbPath);
-  try {
-    const rows = sqlite.prepare(
-      `
-          SELECT id, summary_json AS summaryJson
-          FROM audit_snapshots
-          ORDER BY created_at DESC
-        `
-    ).all();
-    return rows.map((row) => parseAuditSummary(row)).filter((summary) => summary !== null);
-  } finally {
-    sqlite.close();
-  }
+  return readStoredSnapshotRows(dbPath).map((row) => parseAuditSummary(row)).filter((summary) => summary !== null);
 }
 function readLatestComparableAuditSummary(input) {
   return listStoredAuditSummaries(input.dbPath).find((summary) => {
@@ -1350,6 +1079,8 @@ function readLatestComparableAuditSummary(input) {
 }
 
 // ../core/src/findings/cursor.ts
+var CACHE_CARRYOVER_RULE_ID = "cursor_cache_ratio_v1";
+var MAX_MODE_CONCENTRATION_RULE_ID = "cursor_max_mode_concentration_v1";
 function round3(value) {
   return Number(value.toFixed(6));
 }
@@ -1419,6 +1150,13 @@ function buildCursorUsageFindings(runs) {
       scopeId: "all",
       scopeLabel: "Cursor usage",
       costImpactUsd: cacheImpactUsd,
+      signalSource: "observed",
+      ruleId: CACHE_CARRYOVER_RULE_ID,
+      evidence: {
+        callIds: cacheAwareCalls.map((call) => call.id).sort(),
+        runIds: Array.from(new Set(cacheAwareCalls.map((call) => call.runId))).sort(),
+        sourceKinds: ["cursor-usage-csv"]
+      },
       details: {
         cacheReadShare: round3(cacheReadShare),
         cacheCoverageShare: round3(cacheCoverageShare),
@@ -1447,6 +1185,13 @@ function buildCursorUsageFindings(runs) {
         scopeId: "all",
         scopeLabel: "Cursor usage",
         costImpactUsd: round3(maxModeSpendUsd * 0.2),
+        signalSource: "observed",
+        ruleId: MAX_MODE_CONCENTRATION_RULE_ID,
+        evidence: {
+          callIds: maxModeCalls.map((call) => call.id).sort(),
+          runIds: Array.from(new Set(maxModeCalls.map((call) => call.runId))).sort(),
+          sourceKinds: ["cursor-usage-csv"]
+        },
         details: {
           maxModeSpendUsd: round3(maxModeSpendUsd),
           maxModeSpendShare: round3(maxModeSpendShare),
@@ -1468,55 +1213,178 @@ function buildCursorUsageFindings(runs) {
 }
 
 // ../core/src/findings/engine.ts
+var RETRY_OBSERVED_RULE_ID = "retry_explicit_failed_attempt_v1";
+var RETRY_INFERRED_RULE_ID = "retry_later_attempt_proxy_v1";
+var LOOP_RULE_ID = "loop_iteration_threshold_v1";
+var CONTEXT_OUTLIER_RULE_ID = "context_outlier_tokens_v1";
+var IDLE_SPEND_RULE_ID = "idle_workflow_name_v1";
+var CANDIDATE_DOWNGRADE_RULE_ID = "candidate_downgrade_task_model_v1";
+var LOOP_WASTE_START_ITERATION = 6;
+var LOOP_FINDING_MIN_ITERATION = 7;
 function createFinding2(input) {
   return {
     ...input,
     id: sha1(
-      `${input.kind}:${input.scope}:${input.scopeId}:${input.title}:${input.costImpactUsd}:${input.summary}`
+      `${input.kind}:${input.scope}:${input.scopeId}:${input.title}:${input.costImpactUsd}:${input.summary}:${input.signalSource ?? "unknown"}:${input.ruleId ?? "none"}`
     )
   };
 }
 function round4(value) {
   return Number(value.toFixed(6));
 }
+function isFailedOrAborted(call) {
+  const status = (call.status ?? "").toLowerCase();
+  return status.includes("error") || status.includes("fail") || status.includes("abort");
+}
+function hasExplicitRetrySignal(call) {
+  return (call.attempt ?? 1) > 1 || call.retries > 0;
+}
+function toTimestampMs(call) {
+  const timestamp = new Date(call.timestamp).getTime();
+  return Number.isFinite(timestamp) ? timestamp : Number.POSITIVE_INFINITY;
+}
+function sortCallsByTime(calls) {
+  return calls.map((call, index) => ({ call, index })).sort((left, right) => {
+    const delta = toTimestampMs(left.call) - toTimestampMs(right.call);
+    return delta === 0 ? left.index - right.index : delta;
+  });
+}
+function canUseStructuralSignals(sourceKind) {
+  return sourceKind === "gateway";
+}
+function hasLaterExplicitRetryAttempt(sortedCalls, currentIndex) {
+  const current = sortedCalls[currentIndex]?.call;
+  if (!current) {
+    return false;
+  }
+  return sortedCalls.slice(currentIndex + 1).some(({ call }) => {
+    if (!hasExplicitRetrySignal(call)) {
+      return false;
+    }
+    if (current.attempt !== null && call.attempt !== null) {
+      return call.attempt > current.attempt;
+    }
+    return true;
+  });
+}
+function uniqueSourceKinds(calls, runs) {
+  const runById = new Map(runs.map((run2) => [run2.id, run2]));
+  return Array.from(
+    new Set(
+      calls.map((call) => runById.get(call.runId)?.sourceKind).filter((sourceKind) => Boolean(sourceKind))
+    )
+  ).sort();
+}
+function buildRetryFinding(input) {
+  const retryCost = input.calls.reduce((sum, call) => sum + call.costUsd, 0);
+  const observed = input.signalSource === "observed";
+  return createFinding2({
+    classification: "waste",
+    confidence: observed ? "high" : "medium",
+    kind: "retry-waste",
+    title: observed ? "Retry waste is consuming measurable spend" : "Retry waste is likely present from later retry attempts",
+    summary: observed ? `${input.calls.length} failed or aborted call${input.calls.length === 1 ? "" : "s"} were followed by explicit retry attempts, making their spend retry overhead.` : `${input.calls.length} later retry attempt${input.calls.length === 1 ? "" : "s"} were counted as proxy retry overhead because the earlier failed attempt was not separately countable.`,
+    scope: "global",
+    scopeId: "all",
+    scopeLabel: "workspace",
+    costImpactUsd: round4(retryCost),
+    signalSource: input.signalSource,
+    ruleId: input.ruleId,
+    evidence: {
+      callIds: input.calls.map((call) => call.id).sort(),
+      runIds: Array.from(new Set(input.calls.map((call) => call.runId))).sort(),
+      sourceKinds: uniqueSourceKinds(input.calls, input.runs)
+    },
+    details: {
+      retryCallCount: input.calls.length
+    }
+  });
+}
 function buildFindings(runs) {
   const findings = [];
   const wasteAttributions = [];
-  const allCalls = runs.flatMap((run2) => run2.calls.map((call) => ({ run: run2, call })));
-  const retryCandidates = allCalls.filter(({ call }) => {
-    const status = (call.status ?? "").toLowerCase();
-    return status.includes("error") || status.includes("fail");
-  });
-  const retryCost = retryCandidates.reduce((sum, item) => sum + item.call.costUsd, 0);
-  if (retryCost > 0) {
+  const observedRetryCalls = [];
+  const inferredRetryCalls = [];
+  const retryCoveredCallIds = /* @__PURE__ */ new Set();
+  for (const run2 of runs.filter((candidate) => canUseStructuralSignals(candidate.sourceKind))) {
+    const sortedCalls = sortCallsByTime(run2.calls);
+    sortedCalls.forEach(({ call }, index) => {
+      if (!isFailedOrAborted(call)) {
+        return;
+      }
+      if (!hasExplicitRetrySignal(call) && !hasLaterExplicitRetryAttempt(sortedCalls, index)) {
+        return;
+      }
+      if (!hasLaterExplicitRetryAttempt(sortedCalls, index)) {
+        return;
+      }
+      observedRetryCalls.push(call);
+      retryCoveredCallIds.add(call.id);
+      const later = sortedCalls.slice(index + 1).find(({ call: laterCall }) => hasExplicitRetrySignal(laterCall));
+      if (later) {
+        retryCoveredCallIds.add(later.call.id);
+      }
+    });
+    for (const { call } of sortedCalls) {
+      if (!hasExplicitRetrySignal(call) || retryCoveredCallIds.has(call.id)) {
+        continue;
+      }
+      const hasEarlierCountableFailure = sortedCalls.some(({ call: earlier }) => {
+        if (earlier.id === call.id) {
+          return false;
+        }
+        return toTimestampMs(earlier) < toTimestampMs(call) && isFailedOrAborted(earlier);
+      });
+      if (!hasEarlierCountableFailure) {
+        inferredRetryCalls.push(call);
+        retryCoveredCallIds.add(call.id);
+      }
+    }
+  }
+  if (observedRetryCalls.length > 0) {
     wasteAttributions.push(
-      ...retryCandidates.map(({ call }) => ({
+      ...observedRetryCalls.map((call) => ({
         kind: "retry-waste",
         timestamp: call.timestamp,
         wasteUsd: call.costUsd
       }))
     );
     findings.push(
-      createFinding2({
-        classification: "waste",
-        confidence: "high",
+      buildRetryFinding({
+        calls: observedRetryCalls,
+        runs,
+        signalSource: "observed",
+        ruleId: RETRY_OBSERVED_RULE_ID
+      })
+    );
+  }
+  if (inferredRetryCalls.length > 0) {
+    wasteAttributions.push(
+      ...inferredRetryCalls.map((call) => ({
         kind: "retry-waste",
-        title: "Retry waste is consuming measurable spend",
-        summary: `${retryCandidates.length} failed call${retryCandidates.length === 1 ? "" : "s"} were followed by additional work, making their spend pure retry overhead.`,
-        scope: "global",
-        scopeId: "all",
-        scopeLabel: "workspace",
-        costImpactUsd: round4(retryCost),
-        details: {
-          failedCallCount: retryCandidates.length
-        }
+        timestamp: call.timestamp,
+        wasteUsd: call.costUsd
+      }))
+    );
+    findings.push(
+      buildRetryFinding({
+        calls: inferredRetryCalls,
+        runs,
+        signalSource: "inferred",
+        ruleId: RETRY_INFERRED_RULE_ID
       })
     );
   }
-  for (const run2 of runs) {
-    const maxIteration = Math.max(...run2.calls.map((call) => call.iteration ?? 0));
-    if (maxIteration >= 7) {
-      const loopCalls = run2.calls.filter((call) => (call.iteration ?? 0) > 5);
+  for (const run2 of runs.filter((candidate) => canUseStructuralSignals(candidate.sourceKind))) {
+    const iterations = run2.calls.map((call) => call.iteration).filter((iteration) => iteration !== null);
+    if (iterations.length === 0) {
+      continue;
+    }
+    const maxIteration = Math.max(...iterations);
+    if (maxIteration >= LOOP_FINDING_MIN_ITERATION) {
+      const loopCalls = run2.calls.filter(
+        (call) => (call.iteration ?? 0) >= LOOP_WASTE_START_ITERATION
+      );
       const loopCost = loopCalls.reduce((sum, call) => sum + call.costUsd, 0);
       wasteAttributions.push(
         ...loopCalls.map((call) => ({
@@ -1531,14 +1399,22 @@ function buildFindings(runs) {
           confidence: "high",
           kind: "loop-waste",
           title: `Workflow "${run2.workflow}" ran beyond efficient loop bounds`,
-          summary: `This run reached ${maxIteration} iterations. Xerg treats the spend after iteration 5 as likely loop waste.`,
+          summary: `This run reached ${maxIteration} iterations. Xerg treats spend from iteration ${LOOP_WASTE_START_ITERATION} onward as loop waste.`,
           scope: "run",
           scopeId: run2.workflow,
           scopeLabel: run2.workflow,
           costImpactUsd: round4(loopCost),
+          signalSource: "observed",
+          ruleId: LOOP_RULE_ID,
+          evidence: {
+            callIds: loopCalls.map((call) => call.id).sort(),
+            runIds: [run2.id],
+            sourceKinds: [run2.sourceKind]
+          },
           details: {
             workflow: run2.workflow,
-            maxIteration
+            maxIteration,
+            thresholdIteration: LOOP_WASTE_START_ITERATION
           }
         })
       );
@@ -1573,6 +1449,12 @@ function buildFindings(runs) {
             scopeId: workflow,
             scopeLabel: workflow,
             costImpactUsd: round4(outlierCost),
+            signalSource: "observed",
+            ruleId: CONTEXT_OUTLIER_RULE_ID,
+            evidence: {
+              runIds: outlierRuns.map((run2) => run2.id).sort(),
+              sourceKinds: Array.from(new Set(outlierRuns.map((run2) => run2.sourceKind))).sort()
+            },
             details: {
               workflow,
               averageInputTokens: round4(average),
@@ -1598,6 +1480,12 @@ function buildFindings(runs) {
           scopeId: workflow,
           scopeLabel: workflow,
           costImpactUsd: round4(idleCost),
+          signalSource: "observed",
+          ruleId: IDLE_SPEND_RULE_ID,
+          evidence: {
+            runIds: idleRuns.map((run2) => run2.id).sort(),
+            sourceKinds: Array.from(new Set(idleRuns.map((run2) => run2.sourceKind))).sort()
+          },
           details: {
             workflow
           }
@@ -1620,6 +1508,13 @@ function buildFindings(runs) {
           scopeId: workflow,
           scopeLabel: workflow,
           costImpactUsd: round4(spend * 0.3),
+          signalSource: "observed",
+          ruleId: CANDIDATE_DOWNGRADE_RULE_ID,
+          evidence: {
+            callIds: downgradeCalls.map((call) => call.id).sort(),
+            runIds: Array.from(new Set(downgradeCalls.map((call) => call.runId))).sort(),
+            sourceKinds: uniqueSourceKinds(downgradeCalls, runs)
+          },
           details: {
             workflow,
             expensiveCallCount: downgradeCalls.length,
@@ -1781,7 +1676,7 @@ var templatesByKind = {
     severity: "high",
     effort: "low",
     titleFn: (finding) => `Reduce retry waste in ${formatScopeLabel(finding)}`,
-    summaryFn: (finding) => `${finding.summary} This is confirmed retry overhead, so it is a fix-now issue rather than an experiment.`,
+    summaryFn: (finding) => finding.signalSource === "observed" ? `${finding.summary} This is confirmed retry overhead, so it is a fix-now issue rather than an experiment.` : `${finding.summary} Treat this as likely retry overhead and inspect the retry wrapper before classifying the full amount as proven waste.`,
     whereToChangeFn: (finding) => `Reduce retries or add exponential backoff in the retry wrapper for ${formatScopeLabel(finding)}.`,
     validationPlanFn: () => "Ship the change, then rerun `xerg audit --compare --push` against the same source. Retry waste should drop materially on the next audit.",
     actionsFn: () => [
@@ -2128,6 +2023,7 @@ function buildAuditSummary(input) {
     structuralWasteRate: Number(
       (totalSpendUsd === 0 ? 0 : wasteSpendUsd / totalSpendUsd).toFixed(4)
     ),
+    wasteBySignalSource: buildWasteBySignalSource(input.findings),
     wasteByKind: buildTaxonomyBuckets(input.findings, "waste"),
     opportunityByKind: buildTaxonomyBuckets(input.findings, "opportunity"),
     spendByWorkflow: buildBreakdown(
@@ -2169,7 +2065,7 @@ import { homedir as homedir2 } from "os";
 import { basename as basename2, join as join3 } from "path";
 
 // ../core/src/normalize/hermes.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { basename } from "path";
 
 // ../core/src/utils/records.ts
@@ -2255,7 +2151,7 @@ function parseJsonLine(line) {
   }
 }
 function parseJsonLines(path) {
-  const content = readFileSync2(path, "utf8");
+  const content = readFileSync3(path, "utf8");
   const lines = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const records = [];
   for (const line of lines) {
@@ -2608,7 +2504,7 @@ function getAppPaths() {
   };
 }
 function getDefaultDbPath() {
-  return join(getAppPaths().data, "xerg.db");
+  return join(getAppPaths().data, "xerg-snapshots.json");
 }
 function getDefaultOpenClawSessionsPattern() {
   return join(getUserHome(), ".openclaw", "agents", "*", "sessions", "*.jsonl");
@@ -2799,10 +2695,10 @@ async function detectOpenClawSources(options) {
 }
 
 // ../core/src/normalize/openclaw.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { basename as basename3 } from "path";
 function parseJsonLines2(path) {
-  const content = readFileSync3(path, "utf8");
+  const content = readFileSync4(path, "utf8");
   const lines = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const records = [];
   for (const line of lines) {
@@ -3445,9 +3341,18 @@ function formatUsdDelta(value) {
   const sign = value > 0 ? "+" : "";
   return `${sign}${formatUsd(value)}`;
 }
+function formatUsdRate(value) {
+  return formatUsd(value);
+}
 function isCursorUsageSummary(summary) {
   return summary.sourceFiles.some((source) => source.kind === "cursor-usage-csv");
 }
+function divideOrZero(numerator, denominator) {
+  return denominator === 0 ? 0 : numerator / denominator;
+}
+function formatInferredShare(value) {
+  return value === null || value === void 0 ? "unavailable" : formatPercent(value);
+}
 function topRows(rows, limit = 5) {
   return rows.slice(0, limit).map((row) => {
     return `- ${row.key}: ${formatUsd(row.spendUsd)} (${formatPercent(row.observedShare)} observed)`;
@@ -3532,6 +3437,35 @@ function renderFindingChange(change, state) {
   }
   return `- New: ${change.title} (${formatUsd(change.currentCostImpactUsd ?? 0)})`;
 }
+function renderCompareCoreRows(summary) {
+  if (!summary.comparison) {
+    return [];
+  }
+  const comparison = summary.comparison;
+  const baselineWastePerRun = divideOrZero(
+    comparison.baselineWasteSpendUsd,
+    comparison.baselineRunCount
+  );
+  const currentWastePerRun = divideOrZero(summary.wasteSpendUsd, summary.runCount);
+  const baselineWastePer1kCalls = divideOrZero(
+    comparison.baselineWasteSpendUsd,
+    comparison.baselineCallCount / 1e3
+  );
+  const currentWastePer1kCalls = divideOrZero(summary.wasteSpendUsd, summary.callCount / 1e3);
+  return [
+    "## Before / after",
+    `Compared against ${comparison.baselineGeneratedAt}`,
+    `- Waste rate: ${formatPercent(comparison.baselineStructuralWasteRate)} -> ${formatPercent(summary.structuralWasteRate)} (${formatPercentDelta(comparison.deltaStructuralWasteRate)})`,
+    `- Waste per run: ${formatUsdRate(baselineWastePerRun)} -> ${formatUsdRate(currentWastePerRun)} (${formatUsdDelta(currentWastePerRun - baselineWastePerRun)})`,
+    `- Waste per 1k calls: ${formatUsdRate(baselineWastePer1kCalls)} -> ${formatUsdRate(currentWastePer1kCalls)} (${formatUsdDelta(currentWastePer1kCalls - baselineWastePer1kCalls)})`,
+    `- Inferred waste share: ${formatInferredShare(comparison.baselineWasteBySignalSource?.inferredShare)} -> ${formatInferredShare(summary.wasteBySignalSource?.inferredShare)}`,
+    "- CPO: unavailable (no outcome signal)",
+    `- Total spend (workload-dependent): ${formatUsd(comparison.baselineTotalSpendUsd)} -> ${formatUsd(summary.totalSpendUsd)} (${formatUsdDelta(comparison.deltaTotalSpendUsd)})`,
+    `- Structural waste (workload-dependent): ${formatUsd(comparison.baselineWasteSpendUsd)} -> ${formatUsd(summary.wasteSpendUsd)} (${formatUsdDelta(comparison.deltaWasteSpendUsd)})`,
+    `- Runs analyzed: ${comparison.baselineRunCount} -> ${summary.runCount} (${comparison.deltaRunCount > 0 ? "+" : ""}${comparison.deltaRunCount})`,
+    `- Model calls: ${comparison.baselineCallCount} -> ${summary.callCount} (${comparison.deltaCallCount > 0 ? "+" : ""}${comparison.deltaCallCount})`
+  ];
+}
 function renderCompareBlock(summary) {
   if (!summary.comparison) {
     return [];
@@ -3552,13 +3486,7 @@ function renderCompareBlock(summary) {
     )
   ].slice(0, 5);
   return [
-    "## Before / after",
-    `Compared against ${comparison.baselineGeneratedAt}`,
-    `- Total spend: ${formatUsd(comparison.baselineTotalSpendUsd)} -> ${formatUsd(summary.totalSpendUsd)} (${formatUsdDelta(comparison.deltaTotalSpendUsd)})`,
-    `- Structural waste: ${formatUsd(comparison.baselineWasteSpendUsd)} -> ${formatUsd(summary.wasteSpendUsd)} (${formatUsdDelta(comparison.deltaWasteSpendUsd)})`,
-    `- Waste rate: ${formatPercent(comparison.baselineStructuralWasteRate)} -> ${formatPercent(summary.structuralWasteRate)} (${formatPercentDelta(comparison.deltaStructuralWasteRate)})`,
-    `- Runs analyzed: ${comparison.baselineRunCount} -> ${summary.runCount} (${comparison.deltaRunCount > 0 ? "+" : ""}${comparison.deltaRunCount})`,
-    `- Model calls: ${comparison.baselineCallCount} -> ${summary.callCount} (${comparison.deltaCallCount > 0 ? "+" : ""}${comparison.deltaCallCount})`,
+    ...renderCompareCoreRows(summary),
     biggestImprovement ? `- Biggest improvement: ${describeSpendDelta(biggestImprovement)}` : "- Biggest improvement: none detected",
     biggestRegression ? `- Biggest regression: ${describeSpendDelta(biggestRegression)}` : "- Biggest regression: none detected",
     firstWorkflowToInspect ? `- First workflow to inspect now: ${firstWorkflowToInspect}` : "- First workflow to inspect now: no workflow delta available",
@@ -3682,10 +3610,7 @@ function renderCursorCompareBlock(summary) {
   const modeSwing = comparison.workflowDeltas[0];
   const modelSwing = comparison.modelDeltas[0];
   return [
-    "## Before / after",
-    `Compared against ${comparison.baselineGeneratedAt}`,
-    `- Total spend: ${formatUsd(comparison.baselineTotalSpendUsd)} -> ${formatUsd(summary.totalSpendUsd)} (${formatUsdDelta(comparison.deltaTotalSpendUsd)})`,
-    `- Rows analyzed: ${formatCount(comparison.baselineRunCount)} -> ${formatCount(summary.runCount)} (${comparison.deltaRunCount > 0 ? "+" : ""}${comparison.deltaRunCount})`,
+    ...renderCompareCoreRows(summary),
     `- Usage rows with pricing: ${formatCount(summary.pricingCoverage?.pricedCallCount ?? 0)}`,
     modeSwing ? `- Mode swing to inspect: ${describeSpendDelta(modeSwing)}` : "- Mode swing to inspect: none",
     modelSwing ? `- Model swing to inspect: ${describeSpendDelta(modelSwing)}` : "- Model swing to inspect: none"
@@ -3779,7 +3704,7 @@ function renderCursorMarkdownSummary(summary) {
     "",
     "## Findings",
     ...summary.findings.slice(0, 10).map((finding) => {
-      return `- **${finding.title}** (${finding.classification}, ${finding.confidence}) \u2014 ${finding.summary} Estimated impact: ${formatUsd(finding.costImpactUsd)}.`;
+      return `- **${finding.title}** (${finding.classification}, ${finding.confidence}). ${finding.summary} Estimated impact: ${formatUsd(finding.costImpactUsd)}.`;
     }),
     "",
     ...renderActionQueue(summary),
@@ -3862,21 +3787,13 @@ function renderMarkdownSummary(summary) {
     "",
     "## Findings",
     ...summary.findings.slice(0, 10).map((finding) => {
-      return `- **${finding.title}** (${finding.classification}, ${finding.confidence}) \u2014 ${finding.summary} Estimated impact: ${formatUsd(finding.costImpactUsd)}.`;
+      return `- **${finding.title}** (${finding.classification}, ${finding.confidence}). ${finding.summary} Estimated impact: ${formatUsd(finding.costImpactUsd)}.`;
     }),
     "",
     ...renderActionQueue(summary)
   ];
   if (summary.comparison) {
-    const comparison = summary.comparison;
-    lines.push(
-      "",
-      "## Before / after",
-      `- Compared against: ${comparison.baselineGeneratedAt}`,
-      `- Total spend: ${formatUsd(comparison.baselineTotalSpendUsd)} -> ${formatUsd(summary.totalSpendUsd)} (${formatUsdDelta(comparison.deltaTotalSpendUsd)})`,
-      `- Structural waste: ${formatUsd(comparison.baselineWasteSpendUsd)} -> ${formatUsd(summary.wasteSpendUsd)} (${formatUsdDelta(comparison.deltaWasteSpendUsd)})`,
-      `- Waste rate: ${formatPercent(comparison.baselineStructuralWasteRate)} -> ${formatPercent(summary.structuralWasteRate)} (${formatPercentDelta(comparison.deltaStructuralWasteRate)})`
-    );
+    lines.push("", ...renderCompareBlock(summary));
   }
   return lines.join("\n");
 }
@@ -4006,12 +3923,12 @@ async function pushAudit(payload, config) {
 }
 
 // src/push/config.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join5 } from "path";
 
 // src/auth/credentials.ts
-import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname2, join as join4 } from "path";
 function getCredentialsPath() {
@@ -4023,13 +3940,13 @@ function storeCredentials(token) {
   const dir = dirname2(credPath);
   mkdirSync3(dir, { recursive: true });
   const data = { token, storedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  writeFileSync(credPath, JSON.stringify(data, null, 2), { mode: 384 });
+  writeFileSync2(credPath, JSON.stringify(data, null, 2), { mode: 384 });
 }
 function loadStoredCredentials() {
   const credPath = getCredentialsPath();
   try {
-    if (!existsSync(credPath)) return null;
-    const raw = readFileSync4(credPath, "utf8");
+    if (!existsSync2(credPath)) return null;
+    const raw = readFileSync5(credPath, "utf8");
     const parsed = JSON.parse(raw);
     return parsed.token || null;
   } catch {
@@ -4039,7 +3956,7 @@ function loadStoredCredentials() {
 function clearCredentials() {
   const credPath = getCredentialsPath();
   try {
-    if (!existsSync(credPath)) return false;
+    if (!existsSync2(credPath)) return false;
     rmSync(credPath);
     return true;
   } catch {
@@ -4061,7 +3978,7 @@ function loadPushConfig() {
     };
   }
   try {
-    const raw = readFileSync5(CONFIG_PATH, "utf8");
+    const raw = readFileSync6(CONFIG_PATH, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.apiKey) {
       return {
@@ -4880,13 +4797,13 @@ function formatBytes2(bytes) {
 }
 
 // src/transport/config.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve3 } from "path";
 function loadRemoteConfig(configPath) {
   const resolved = resolve3(configPath);
   let raw;
   try {
-    raw = readFileSync6(resolved, "utf8");
+    raw = readFileSync7(resolved, "utf8");
   } catch {
     throw new Error(`Cannot read remote config at ${resolved}`);
   }
@@ -5033,11 +4950,11 @@ function resolveRemoteHost(target) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 function getCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
-    const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf8"));
     return packageJson.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -5573,7 +5490,8 @@ function renderMcpCredentialSourceMessage(config) {
 }
 
 // src/prompts.ts
-import { confirm, select } from "@inquirer/prompts";
+import confirm from "@inquirer/confirm";
+import select from "@inquirer/select";
 function hasPromptTty() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
@@ -5591,7 +5509,7 @@ async function promptSelect(message, choices) {
 }
 
 // src/commands/push.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 async function runPushCommand(options) {
   const payload = options.file ? loadPayloadFromFile(options.file) : loadLatestCachedAuditPayload();
   if (options.dryRun) {
@@ -5615,7 +5533,7 @@ async function runPushCommand(options) {
 function loadPayloadFromFile(filePath) {
   let raw;
   try {
-    raw = readFileSync8(filePath, "utf8");
+    raw = readFileSync9(filePath, "utf8");
   } catch {
     throw new Error(`Cannot read file: ${filePath}`);
   }
@@ -5986,7 +5904,7 @@ function renderRailwayDoctorReport(report) {
 }
 
 // src/commands/mcp-setup.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname3, join as join8 } from "path";
 var HOSTED_MCP_URL = "https://mcp.xerg.ai/mcp";
 var MCP_SERVER_NAME = "xerg";
@@ -6072,7 +5990,7 @@ async function runMcpSetupFlow() {
 async function handleCursorSetup(snippet, config) {
   const cursorDir = join8(process.cwd(), ".cursor");
   const cursorConfigPath = join8(cursorDir, "mcp.json");
-  if (existsSync2(cursorDir)) {
+  if (existsSync3(cursorDir)) {
     const shouldWrite = await promptConfirm(
       "Write a project-scoped Cursor MCP config to .cursor/mcp.json?",
       true
@@ -6119,9 +6037,9 @@ function tomlString(value) {
 function writeCursorConfig(filePath, config) {
   mkdirSync6(dirname3(filePath), { recursive: true });
   let parsed = {};
-  if (existsSync2(filePath)) {
+  if (existsSync3(filePath)) {
     try {
-      parsed = JSON.parse(readFileSync9(filePath, "utf8"));
+      parsed = JSON.parse(readFileSync10(filePath, "utf8"));
     } catch {
       throw new Error(`Cursor config is not valid JSON: ${filePath}`);
     }
@@ -6134,7 +6052,7 @@ function writeCursorConfig(filePath, config) {
     ...existingServers ?? {},
     xerg: buildHostedMcpConfig(config).mcpServers.xerg
   };
-  writeFileSync2(filePath, `${JSON.stringify(parsed, null, 2)}
+  writeFileSync3(filePath, `${JSON.stringify(parsed, null, 2)}
 `);
 }
 
@@ -6346,7 +6264,7 @@ Options:
   --compare                   Compare this audit to the newest compatible prior local snapshot
   --json                      Render the report as JSON
   --markdown                  Render the report as Markdown
-  --db <path>                 Custom SQLite database path
+  --db <path>                 Custom JSON snapshot path
   --no-db                     Skip local persistence
 
 Remote options (SSH, OpenClaw only):