agentwrangler 0.1.0 → 0.1.1-next.2f6c1df

package/dist/hook/precompact-checkpoint-hook.mjs

@@ -11,6 +11,7 @@
  * committed). The hook writes no transcript content to stdout/stderr.
  */
 
+import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -19,9 +20,11 @@ import { fileURLToPath } from "node:url";
 
 const MAX_COUNT = 20;
 const MAX_BYTES = 500 * 1024 * 1024; // 500 MiB across all snapshots
+const MAX_COLLISION_ATTEMPTS = 16;
 
-// Monotonic counter so two firings in the same millisecond get distinct filenames
-// that still sort in write order (the timestamp dominates; this breaks same-ms ties).
+// A per-process counter preserves local write ordering.  The random token prevents
+// separately spawned hooks with the same session and millisecond from choosing the
+// same name; exclusive creation below is the final no-overwrite guard.
 let snapshotCounter = 0;
 
 /** The directory snapshots are written to (overridable for tests). */
@@ -33,7 +36,8 @@ export function checkpointDir() {
 export function snapshotName(sessionId, now) {
   snapshotCounter = (snapshotCounter + 1) % 1_000_000;
   const stamp = now.toISOString().replace(/[:.]/g, "-");
-  return `${encodeURIComponent(sessionId)}-${stamp}-${String(snapshotCounter).padStart(6, "0")}.jsonl`;
+  const counter = String(snapshotCounter).padStart(6, "0");
+  return `${encodeURIComponent(sessionId)}-${stamp}-${counter}-${randomBytes(6).toString("hex")}.jsonl`;
 }
 
 /**
@@ -43,14 +47,49 @@ export function snapshotName(sessionId, now) {
 export function writeCheckpoint(transcriptPath, sessionId, dir, now = new Date()) {
   if (typeof transcriptPath !== "string" || !fs.existsSync(transcriptPath)) return null;
   fs.mkdirSync(dir, { recursive: true });
-  const dest = path.join(dir, snapshotName(sessionId, now));
-  fs.copyFileSync(transcriptPath, dest);
-  try {
-    fs.chmodSync(dest, 0o600);
-  } catch {
-    // chmod is a no-op boundary on Windows; the user-profile ACL is the equivalent guard.
+  for (let attempt = 0; attempt < MAX_COLLISION_ATTEMPTS; attempt += 1) {
+    const dest = path.join(dir, snapshotName(sessionId, now));
+    try {
+      fs.copyFileSync(transcriptPath, dest, fs.constants.COPYFILE_EXCL);
+    } catch (error) {
+      if (error?.code === "EEXIST") continue;
+      throw error;
+    }
+    try {
+      fs.chmodSync(dest, 0o600);
+    } catch {
+      // chmod is a no-op boundary on Windows; the user-profile ACL is the equivalent guard.
+    }
+    return dest;
   }
-  return dest;
+  return null;
+}
+
+/**
+ * Return the timestamp encoded by a snapshot filename, or null for files this hook did
+ * not create. Malformed .jsonl files are deliberately left alone by retention.
+ */
+function snapshotTimestamp(name) {
+  const match =
+    /-(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z-\d{6}(?:-[a-f0-9]{12})?\.jsonl$/.exec(
+      name,
+    );
+  if (!match) return null;
+  const [, year, month, day, hour, minute, second, millisecond] = match;
+  const timestamp = Date.parse(
+    `${year}-${month}-${day}T${hour}:${minute}:${second}.${millisecond}Z`,
+  );
+  if (Number.isNaN(timestamp)) return null;
+  const parsed = new Date(timestamp);
+  return parsed.getUTCFullYear() === Number(year) &&
+    parsed.getUTCMonth() + 1 === Number(month) &&
+    parsed.getUTCDate() === Number(day) &&
+    parsed.getUTCHours() === Number(hour) &&
+    parsed.getUTCMinutes() === Number(minute) &&
+    parsed.getUTCSeconds() === Number(second) &&
+    parsed.getUTCMilliseconds() === Number(millisecond)
+    ? timestamp
+    : null;
 }
 
 /** Prune oldest snapshots beyond the count cap, then beyond the total-byte cap. */
@@ -60,30 +99,40 @@ export function enforceRetention(dir, maxCount = MAX_COUNT, maxBytes = MAX_BYTES
     entries = fs
       .readdirSync(dir)
       .filter((name) => name.endsWith(".jsonl"))
-      .sort() // timestamp-derived names sort chronologically
       .map((name) => {
         const full = path.join(dir, name);
-        return { full, size: fs.statSync(full).size };
-      });
+        const timestamp = snapshotTimestamp(name);
+        if (timestamp === null) return null;
+        try {
+          const stat = fs.statSync(full);
+          if (!stat.isFile()) return null;
+          return { full, name, size: stat.size, timestamp, mtimeMs: stat.mtimeMs };
+        } catch {
+          // A vanished or unreadable entry must not prevent pruning known snapshots.
+          return null;
+        }
+      })
+      .filter((entry) => entry !== null)
+      .sort(
+        (a, b) =>
+          a.timestamp - b.timestamp || a.mtimeMs - b.mtimeMs || a.name.localeCompare(b.name),
+      );
   } catch {
     return; // dir missing or unreadable — nothing to prune
   }
 
-  const removeOldest = () => {
-    const victim = entries.shift();
-    if (!victim) return;
+  let count = entries.length;
+  let total = entries.reduce((sum, entry) => sum + entry.size, 0);
+  for (const victim of entries) {
+    if (count <= maxCount && total <= maxBytes) break;
     try {
       fs.rmSync(victim.full);
-    } catch {
-      // A locked or already-removed snapshot is not worth failing for.
+    } catch (error) {
+      // A locked snapshot still counts. Try each later candidate at most once.
+      if (error?.code !== "ENOENT") continue;
     }
-  };
-
-  while (entries.length > maxCount) removeOldest();
-  let total = entries.reduce((sum, entry) => sum + entry.size, 0);
-  while (entries.length > 0 && total > maxBytes) {
-    total -= entries[0].size;
-    removeOldest();
+    count -= 1;
+    total -= victim.size;
   }
 }
 

package/dist/ingest/ingestor.js

@@ -18,7 +18,7 @@ import { Health } from "./health.js";
 import { PARSER_VERSION, projectLine } from "./parser.js";
 import { PricingSnapshotStore, seedListPrices } from "./pricing.js";
 import { DEFAULT_RECONCILE_OPTIONS, reconcileSessions, } from "./reconcile.js";
-import { loadOffset, saveOffset, tailFile } from "./tail.js";
+import { fileVersion, loadOffset, sameFileVersion, saveOffset, tailFile, } from "./tail.js";
 import { LONG_GAP_THRESHOLD_S } from "./types.js";
 import { backfillDiscoveredCwd, defaultReadCwd, defaultReadRemote, resolveWorkspaceMappings, } from "./workspace-mapping.js";
 export const DEFAULT_INGESTOR_OPTIONS = {
@@ -41,10 +41,9 @@ export class Ingestor {
     countedResults = new Set(); // toolUseIds already summed
     resultBytesByMsg = new Map(); // messageId → running byte sum
     lineCursor = new Map(); // filePath → complete lines consumed
-    lastSize = new Map(); // filePath → last-seen size (skip unchanged files)
+    lastVersion = new Map(); // filePath → last-seen version
     discoveryCache = createDiscoveryCache();
     unresolvedRemotes = new Set();
-    userTurnTsBySession = new Map(); // sessionId → epoch-ms of user turns
     // Prepared statements.
     stInsertTurn;
     stInsertSession;
@@ -52,7 +51,11 @@ export class Ingestor {
     stBumpUserTurnCount;
     stBumpFrictionCounts;
     stSetGapAggregates;
+    stInsertMetricEvent;
+    stGetMetricTimestamps;
     stGetGapN;
+    stGetMetricBaseline;
+    stSetMetricBaseline;
     stInsertToolEvent;
     stUpsertToolEventMetadata;
     stSetToolResult;
@@ -93,7 +96,16 @@ export class Ingestor {
          interrupt_count  = interrupt_count  + ?
        WHERE session_id = ?`);
         this.stSetGapAggregates = db.prepare("UPDATE sessions SET gap_median_s=?, gap_p90_s=?, long_gap_count=?, gap_n=? WHERE session_id=?");
-        this.stGetGapN = db.prepare("SELECT gap_n FROM sessions WHERE session_id=?");
+        this.stInsertMetricEvent = db.prepare(`INSERT OR IGNORE INTO ingest_metric_events
+         (event_id, session_id, user_turn_ts, is_user_turn,
+          is_compact_summary, is_api_error, is_interrupt)
+       VALUES (?,?,?,?,?,?,?)`);
+        this.stGetMetricTimestamps = db.prepare(`SELECT user_turn_ts FROM ingest_metric_events
+       WHERE session_id = ? AND is_user_turn = 1 AND user_turn_ts IS NOT NULL`);
+        this.stGetGapN = db.prepare("SELECT gap_n FROM sessions WHERE session_id = ?");
+        this.stGetMetricBaseline = db.prepare("SELECT seeded_offset FROM ingest_metric_baselines WHERE file_path = ?");
+        this.stSetMetricBaseline = db.prepare(`INSERT INTO ingest_metric_baselines (file_path, seeded_offset) VALUES (?, ?)
+       ON CONFLICT(file_path) DO UPDATE SET seeded_offset = excluded.seeded_offset`);
         this.stInsertToolEvent = db.prepare(`INSERT INTO tool_events
          (event_id, session_id, ts, tool_name, input_bytes, result_bytes, input_hash, exit_class, commit_sha)
        VALUES (?,?,?,?,?,?,?,?,?)
@@ -236,9 +248,8 @@ export class Ingestor {
         this.countedResults.clear();
         this.resultBytesByMsg.clear();
         this.lineCursor.clear();
-        this.lastSize.clear();
+        this.lastVersion.clear();
         this.unresolvedRemotes.clear();
-        this.userTurnTsBySession.clear();
     }
     // ── internals ──────────────────────────────────────────────────────────────
     ingestAllKnown() {
@@ -278,31 +289,39 @@ export class Ingestor {
     }
     /** Tail one file from its stored offset and ingest the complete new lines. */
     ingestFile(filePath, projectSlug) {
-        // Cheap size guard: transcripts are append-only, so an unchanged file size
-        // means zero new complete lines. Skip it before touching the DB — this keeps
-        // the 2s tail tick from doing ~4,700 sqlite writes across ~2,352 idle files
+        // Skip only when size, identity, and timestamps all match. This keeps the
+        // 2s tail tick from touching the DB for idle files while still noticing
+        // same-size rewrites and path replacement.
         // every tick, which was starving the daemon's event loop (outcomes pass).
         // Keep the per-file stat: directory mtimes only decide when to refresh paths;
         // they cannot safely replace append/rotation change detection for each file.
-        let curSize;
+        let currentVersion;
         try {
-            curSize = fs.statSync(filePath).size;
+            currentVersion = fileVersion(fs.statSync(filePath));
         }
         catch {
             return; // file vanished between discovery and tail; nothing to ingest
         }
-        if (this.lastSize.get(filePath) === curSize)
-            return; // unchanged since last tick — no new bytes
-        this.lastSize.set(filePath, curSize);
+        const previousVersion = this.lastVersion.get(filePath);
+        if (previousVersion !== undefined && sameFileVersion(previousVersion, currentVersion))
+            return;
+        this.lastVersion.set(filePath, currentVersion);
         this.health.fileSeen();
         registerWorkspace(this.db, projectSlug);
         const stored = loadOffset(this.db, filePath);
-        const result = tailFile(filePath, stored);
+        this.seedLegacyMetricPrefix(filePath, stored?.offset ?? null, currentVersion.size);
+        const result = tailFile(filePath, stored, currentVersion);
         if (result.wasReset)
             this.lineCursor.set(filePath, 0);
         if (result.lines.length === 0) {
-            // Still persist head-hash/offset so first-touch rotation detection is armed.
-            saveOffset(this.db, filePath, result.newOffset, result.newHeadHash);
+            if (stored === null ||
+                stored.offset !== result.newOffset ||
+                stored.headHash !== result.newHeadHash ||
+                stored.fileVersion === null ||
+                !sameFileVersion(stored.fileVersion, currentVersion)) {
+                saveOffset(this.db, filePath, result.newOffset, result.newHeadHash, currentVersion);
+            }
+            this.stSetMetricBaseline.run(filePath, result.newOffset);
             return;
         }
         const defaultSessionId = sessionStemFor(filePath);
@@ -317,9 +336,50 @@ export class Ingestor {
         });
         tx();
         this.lineCursor.set(filePath, base + result.lines.length);
-        saveOffset(this.db, filePath, result.newOffset, result.newHeadHash);
+        saveOffset(this.db, filePath, result.newOffset, result.newHeadHash, currentVersion);
+        this.stSetMetricBaseline.run(filePath, result.newOffset);
         this.health.fileParsed();
     }
+    /**
+     * Upgrade bridge for offsets created before the metric-event ledger existed.
+     * Already-consumed complete lines are registered without advancing counters.
+     */
+    seedLegacyMetricPrefix(filePath, storedOffset, currentSize) {
+        const baseline = this.stGetMetricBaseline.get(filePath);
+        if (baseline !== undefined)
+            return;
+        if (storedOffset === null || storedOffset <= 0 || storedOffset > currentSize) {
+            this.stSetMetricBaseline.run(filePath, 0);
+            return;
+        }
+        const fd = fs.openSync(filePath, "r");
+        try {
+            const buf = Buffer.alloc(storedOffset);
+            const bytesRead = fs.readSync(fd, buf, 0, storedOffset, 0);
+            let lastNl = -1;
+            for (let i = bytesRead - 1; i >= 0; i--) {
+                if (buf[i] === 0x0a) {
+                    lastNl = i;
+                    break;
+                }
+            }
+            const lines = lastNl < 0 ? [] : buf.subarray(0, lastNl).toString("utf8").split("\n");
+            const defaultSessionId = sessionStemFor(filePath);
+            this.db.transaction(() => {
+                for (const raw of lines) {
+                    if (raw.length === 0)
+                        continue;
+                    const proj = projectLine(raw, { defaultSessionId });
+                    if (proj.kind === "record")
+                        this.recordMetricEvent(raw, proj, false);
+                }
+                this.stSetMetricBaseline.run(filePath, storedOffset);
+            })();
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
     applyLine(raw, ctx, workspaceId, filePath, lineNo) {
         const proj = projectLine(raw, ctx);
         if (proj.kind === "quarantine") {
@@ -339,31 +399,13 @@ export class Ingestor {
         if (lineSessionId !== null) {
             this.ensureSession(lineSessionId, workspaceId, filePath, lineTs === "" ? null : lineTs);
         }
-        if (proj.isUserTurn === true) {
-            this.stBumpUserTurnCount.run(proj.sessionId);
-            if (typeof proj.ts === "string" && proj.ts.length > 0) {
-                const epochMs = Date.parse(proj.ts);
-                if (Number.isFinite(epochMs)) {
-                    const list = this.userTurnTsBySession.get(proj.sessionId);
-                    if (list !== undefined) {
-                        list.push(epochMs);
-                    }
-                    else {
-                        this.userTurnTsBySession.set(proj.sessionId, [epochMs]);
-                    }
-                    this.applyGapAggregates(proj.sessionId);
-                }
-            }
-        }
-        // Friction counters (RV2a): compact summary, API error, interrupt.
-        if (proj.isCompactSummary || proj.isApiErrorMessage || proj.isInterrupt) {
-            // Ensure session row exists for lines that carry only top-level flags
-            // (no turn, command, or tool events — so lineSessionId would be null).
-            if (lineSessionId === null) {
-                this.ensureSession(proj.sessionId, workspaceId, filePath, null);
-            }
-            this.stBumpFrictionCounts.run(proj.isCompactSummary ? 1 : 0, proj.isApiErrorMessage ? 1 : 0, proj.isInterrupt ? 1 : 0, proj.sessionId);
+        if (lineSessionId === null &&
+            (proj.isCompactSummary || proj.isApiErrorMessage || proj.isInterrupt)) {
+            this.ensureSession(proj.sessionId, workspaceId, filePath, null);
         }
+        // User/friction aggregates advance only for a structurally new source record.
+        // The persisted digest makes replay idempotent across restarts and files.
+        this.recordMetricEvent(raw, proj, true);
         // Command markers → tool_events(local_command) for hygiene evaluation.
         if (proj.command !== null) {
             this.recordCommand(proj.command.sessionId, proj.command.ts, proj.command.command);
@@ -457,25 +499,83 @@ export class Ingestor {
             .slice(0, 20)}`;
         this.stInsertToolEvent.run(eventId, sessionId, ts, "local_command", null, null, command, null, null);
     }
-    applyGapAggregates(sessionId) {
-        const tsList = this.userTurnTsBySession.get(sessionId);
-        if (tsList === undefined || tsList.length === 0) {
-            this.clearGapAggregatesUnlessRicher(sessionId);
+    recordMetricEvent(raw, proj, applyAggregates) {
+        if (!proj.isUserTurn &&
+            !proj.isCompactSummary &&
+            !proj.isApiErrorMessage &&
+            !proj.isInterrupt) {
             return;
         }
-        const sorted = [...tsList].sort((a, b) => a - b);
+        const flags = [
+            proj.isUserTurn ? "u" : "",
+            proj.isCompactSummary ? "c" : "",
+            proj.isApiErrorMessage ? "a" : "",
+            proj.isInterrupt ? "i" : "",
+        ].join("");
+        let sourceIdentity;
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.uuid === "string" && parsed.uuid.trim() !== "") {
+                sourceIdentity = `uuid:${parsed.uuid}`;
+            }
+            else {
+                const message = parsed.message;
+                const messageId = typeof message === "object" && message !== null
+                    ? message.id
+                    : null;
+                if (typeof messageId === "string" && messageId.trim() !== "") {
+                    sourceIdentity = `message:${String(parsed.type ?? "")}:${messageId}:${flags}`;
+                }
+                else {
+                    sourceIdentity = `raw:${crypto.createHash("sha256").update(raw).digest("hex")}`;
+                }
+            }
+        }
+        catch {
+            // projectLine already parsed record lines; retain a safe fallback if that contract changes.
+            sourceIdentity = `raw:${crypto.createHash("sha256").update(raw).digest("hex")}`;
+        }
+        const eventId = crypto
+            .createHash("sha256")
+            .update(`${proj.sessionId}\0${sourceIdentity}`)
+            .digest("hex");
+        const validUserTs = proj.isUserTurn && typeof proj.ts === "string" && Number.isFinite(Date.parse(proj.ts))
+            ? proj.ts
+            : null;
+        const inserted = this.stInsertMetricEvent.run(eventId, proj.sessionId, validUserTs, proj.isUserTurn ? 1 : 0, proj.isCompactSummary ? 1 : 0, proj.isApiErrorMessage ? 1 : 0, proj.isInterrupt ? 1 : 0);
+        if (!applyAggregates || inserted.changes === 0)
+            return;
+        if (proj.isUserTurn)
+            this.stBumpUserTurnCount.run(proj.sessionId);
+        if (proj.isCompactSummary || proj.isApiErrorMessage || proj.isInterrupt) {
+            this.stBumpFrictionCounts.run(proj.isCompactSummary ? 1 : 0, proj.isApiErrorMessage ? 1 : 0, proj.isInterrupt ? 1 : 0, proj.sessionId);
+        }
+        if (validUserTs !== null)
+            this.applyGapAggregates(proj.sessionId);
+    }
+    applyGapAggregates(sessionId) {
+        const rows = this.stGetMetricTimestamps.all(sessionId);
+        const sorted = rows
+            .map((row) => Date.parse(row.user_turn_ts))
+            .filter((epochMs) => Number.isFinite(epochMs))
+            .sort((a, b) => a - b);
         const gaps = [];
         for (let i = 1; i < sorted.length; i++) {
             gaps.push((sorted[i] - sorted[i - 1]) / 1000);
         }
         const gapN = gaps.length;
+        const stored = this.stGetGapN.get(sessionId);
+        // During the 017 upgrade, a session's legacy timestamps can be spread across
+        // files that have not all established their metric-ledger baselines yet.
+        // Preserve the richer legacy aggregate until the ledger has caught up.
+        if (stored !== undefined && gapN < stored.gap_n)
+            return;
         if (gapN === 0) {
-            this.clearGapAggregatesUnlessRicher(sessionId);
+            this.stSetGapAggregates.run(null, null, 0, 0, sessionId);
             return;
         }
-        // gapN >= 1: a real gap was observed in-process. Always write it — even a partial,
-        // post-restart sample reflects genuine current friction (e.g. a new long gap) and
-        // must not be suppressed just because it's smaller than a pre-restart gap_n.
+        // The persisted event ledger supplies the complete known history across
+        // restarts and source files, so this aggregate can be recomputed deterministically.
         const g = [...gaps].sort((a, b) => a - b);
         const mid = g.length;
         const gapMedianS = mid % 2 === 1
@@ -486,17 +586,6 @@ export class Ingestor {
         const longGapCount = g.filter((x) => x > LONG_GAP_THRESHOLD_S).length;
         this.stSetGapAggregates.run(gapMedianS, gapP90S, longGapCount, gapN, sessionId);
     }
-    // Write-guard for the "no computable gap" collapse (0 or 1 in-process user turns):
-    // the in-memory turn-timestamp map resets on every daemon restart, so this state is
-    // reached on the first post-restart user turn even when a prior cold runBackscan()
-    // already persisted a richer gap_n. Skip the null/zero write in that case so it
-    // doesn't clobber the richer aggregate.
-    clearGapAggregatesUnlessRicher(sessionId) {
-        const storedRow = this.stGetGapN.get(sessionId);
-        if ((storedRow?.gap_n ?? 0) > 0)
-            return;
-        this.stSetGapAggregates.run(null, null, 0, 0, sessionId);
-    }
     quarantine(filePath, lineNo, errorClass) {
         const qId = crypto
             .createHash("sha1")

package/dist/ingest/pricing.js

@@ -62,6 +62,21 @@ export function modelTier(model) {
     }
     return null;
 }
+/**
+ * SQL predicate matching premium-priced models on a `model` column: Opus plus
+ * the Fable/Mythos families (Fable's $10/$50 base is 2× Opus). Shared by every
+ * premium-share aggregate so the family list can't drift between queries.
+ */
+export const PREMIUM_MODEL_SQL = "(model LIKE '%opus%' OR model LIKE '%fable%' OR model LIKE '%mythos%')";
+/**
+ * Input list price ($/MTok) for a model, for ordering model lists
+ * most-expensive first. Derived from LIST_PRICES via modelTier so a new tier
+ * automatically sorts by its price; unpriceable models return 0 (sort last).
+ */
+export function modelInputListPrice(model) {
+    const tier = modelTier(model);
+    return tier === null ? 0 : (LIST_PRICES[tier]?.[0] ?? 0);
+}
 function addDaysIso(iso, days) {
     const d = new Date(iso);
     d.setUTCDate(d.getUTCDate() + days);

package/dist/ingest/tail.js

@@ -14,6 +14,22 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 const HEAD_BYTES = 256; // bytes hashed for rotation detection
+export function fileVersion(stat) {
+    return {
+        size: stat.size,
+        dev: String(stat.dev),
+        ino: String(stat.ino),
+        mtimeMs: stat.mtimeMs,
+        ctimeMs: stat.ctimeMs,
+    };
+}
+export function sameFileVersion(a, b) {
+    return (a.size === b.size &&
+        a.dev === b.dev &&
+        a.ino === b.ino &&
+        a.mtimeMs === b.mtimeMs &&
+        a.ctimeMs === b.ctimeMs);
+}
 /** SHA-256 of the first n bytes of a file (or fewer if the file is shorter). */
 function headHashN(filePath, n) {
     let fd;
@@ -51,12 +67,12 @@ export function headHash(filePath) {
  * Tail one file from its stored offset. Returns complete lines only.
  * See module header for the rotation/truncation contract.
  */
-export function tailFile(filePath, stored) {
+export function tailFile(filePath, stored, currentVersion) {
     let storedOffset = stored?.offset ?? 0;
     let storedHead = stored?.headHash ?? null;
-    let stat;
+    let version = currentVersion;
     try {
-        stat = fs.statSync(filePath);
+        version ??= fileVersion(fs.statSync(filePath));
     }
     catch {
         return {
@@ -67,7 +83,7 @@ export function tailFile(filePath, stored) {
             wasReset: false,
         };
     }
-    const fileSize = stat.size;
+    const fileSize = version.size;
     let event = null;
     let wasReset = false;
     const curHead = fileSize > 0 ? headHash(filePath) : "";
@@ -84,6 +100,12 @@ export function tailFile(filePath, stored) {
         }
         // fileSize < storedN: size regression — headChanged stays false; handled below.
     }
+    const storedVersion = stored?.fileVersion ?? null;
+    const identityChanged = storedVersion !== null &&
+        (storedVersion.dev !== version.dev || storedVersion.ino !== version.ino);
+    const equalSizeTimestampChanged = storedVersion !== null &&
+        storedVersion.size === version.size &&
+        (storedVersion.mtimeMs !== version.mtimeMs || storedVersion.ctimeMs !== version.ctimeMs);
     if (storedOffset > fileSize) {
         // Size regression always means truncation, regardless of head change.
         event = "TRUNCATION";
@@ -91,7 +113,7 @@ export function tailFile(filePath, stored) {
         wasReset = true;
         storedHead = curHead;
     }
-    else if (headChanged) {
+    else if (identityChanged || equalSizeTimestampChanged || headChanged) {
         event = "ROTATION";
         storedOffset = 0;
         wasReset = true;
@@ -135,18 +157,40 @@ export function tailFile(filePath, stored) {
 /** Read the persisted offset for a file, or null if never tailed. */
 export function loadOffset(db, filePath) {
     const row = db
-        .prepare("SELECT byte_offset, file_hash_head FROM ingest_offsets WHERE file_path = ?")
+        .prepare("SELECT byte_offset, file_hash_head, file_size, file_dev, file_ino, file_mtime_ms, file_ctime_ms FROM ingest_offsets WHERE file_path = ?")
         .get(filePath);
     if (row === undefined)
         return null;
-    return { offset: row.byte_offset, headHash: row.file_hash_head };
+    const hasVersion = row.file_size !== null &&
+        row.file_dev !== null &&
+        row.file_ino !== null &&
+        row.file_mtime_ms !== null &&
+        row.file_ctime_ms !== null;
+    return {
+        offset: row.byte_offset,
+        headHash: row.file_hash_head,
+        fileVersion: hasVersion
+            ? {
+                size: row.file_size,
+                dev: row.file_dev,
+                ino: row.file_ino,
+                mtimeMs: row.file_mtime_ms,
+                ctimeMs: row.file_ctime_ms,
+            }
+            : null,
+    };
 }
 /** Upsert the persisted offset for a file. */
-export function saveOffset(db, filePath, offset, headHash) {
-    db.prepare(`INSERT INTO ingest_offsets (file_path, byte_offset, file_hash_head, updated_at)
-     VALUES (?,?,?,?)
+export function saveOffset(db, filePath, offset, headHash, version) {
+    db.prepare(`INSERT INTO ingest_offsets (file_path, byte_offset, file_hash_head, file_size, file_dev, file_ino, file_mtime_ms, file_ctime_ms, updated_at)
+     VALUES (?,?,?,?,?,?,?,?,?)
      ON CONFLICT(file_path) DO UPDATE SET
        byte_offset = excluded.byte_offset,
        file_hash_head = excluded.file_hash_head,
-       updated_at = excluded.updated_at`).run(filePath, offset, headHash, new Date().toISOString());
+       file_size = excluded.file_size,
+       file_dev = excluded.file_dev,
+       file_ino = excluded.file_ino,
+       file_mtime_ms = excluded.file_mtime_ms,
+       file_ctime_ms = excluded.file_ctime_ms,
+       updated_at = excluded.updated_at`).run(filePath, offset, headHash, version.size, version.dev, version.ino, version.mtimeMs, version.ctimeMs, new Date().toISOString());
 }

package/dist/query/api/cost-per-success.js

@@ -21,6 +21,7 @@ export function getCostPerSuccess(db, workspaceId, from, to) {
             to,
             workspaceId,
             workspaceId,
+            workspaceId,
             from,
             to,
             workspaceId,
@@ -46,6 +47,14 @@ export function getCostPerSuccess(db, workspaceId, from, to) {
            JOIN merged_work_items mwi ON mwi.work_item_id = swl.work_item_id
           WHERE 1 = 1${sessionFilter}
        ),
+       merged_session_links AS (
+         SELECT swl.session_id, COUNT(DISTINCT swl.work_item_id) AS merged_pr_links
+           FROM session_work_links swl
+           JOIN merged_work_items mwi ON mwi.work_item_id = swl.work_item_id
+           JOIN sessions s ON s.session_id = swl.session_id
+          WHERE 1 = 1${sessionFilter}
+          GROUP BY swl.session_id
+       ),
        in_window_sessions AS (
          SELECT s.session_id, s.cost_equiv_u
            FROM sessions s
@@ -64,6 +73,8 @@ export function getCostPerSuccess(db, workspaceId, from, to) {
        SELECT
          (SELECT COUNT(*) FROM merged_work_items) AS merged_pr_count,
          (SELECT COUNT(*) FROM closed_unmerged_work_items) AS closed_unmerged_count,
+         (SELECT COUNT(*) FROM merged_session_links) AS unique_linked_session_count,
+         (SELECT COUNT(*) FROM merged_session_links WHERE merged_pr_links > 1) AS shared_linked_session_count,
          CASE WHEN (SELECT COUNT(*) FROM merged_work_items) = 0 THEN NULL
               ELSE (SELECT COALESCE(SUM(cost_equiv_u), 0) FROM merged_session_costs) * 1.0
                    / (SELECT COUNT(*) FROM merged_work_items)
@@ -91,13 +102,14 @@ export function getCostPerSuccess(db, workspaceId, from, to) {
     };
     return buildResponse(data, {
         claim_kind: "OBS_PROXY",
+        metric_definition_version: "esf-1",
         n: data.merged_pr_count,
         window: { from, to },
         qualification: {
             provisional_excluded: false,
             unpriced_turns: 0,
             claim_kinds_count: 1,
-            note: "Directional (OBS_PROXY): survivorship bias (heavy-spend sessions that never open a PR are invisible); reviewer-dependence (merge is a human decision, not a quality guarantee); linkage-coverage cap (only linkage_coverage_pct% of in-window sessions are linked to a PR, so unlinked spend is excluded). cost_per_merged_pr_u uses lifecycle attribution: each merged PR carries the full cost of every linked session whenever it ran, so narrowing the window changes the PR population, not the per-PR cost.",
+            note: "Directional (OBS_PROXY): Unique linked-session cost / merged PRs. The terminal-date PR cohort counts each linked session once, even when it links to multiple merged PRs; shared sessions are coverage, not per-PR allocation. Full linked-session lifecycle cost is used, while linkage_coverage_pct is a separate session-start coverage observation. Unknown pricing is not free. Survivorship bias and reviewer dependence remain.",
         },
         ...(workspaceId === null ? {} : { drilldown_ids: { workspace_id: workspaceId } }),
     });