ccdeck 3.35.1 → 3.36.0

package/dist/web/index.html

@@ -62,8 +62,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CR_USWmE.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-8Q-n811d.css">
+    <script type="module" crossorigin src="/assets/index-MjcQ231B.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CuVOi3gc.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.35.1",
+  "version": "3.36.0",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -60,7 +60,8 @@
     "3.29.9",
     "3.33.1",
     "3.35.0",
-    "3.35.1"
+    "3.35.1",
+    "3.36.0"
   ],
   "3.34.1": [
     {

package/src/server/cli-versions.mjs

@@ -1,5 +1,5 @@
 // The versions of the Claude Code and Codex CLIs this machine has, for the
-// anonymous "which CLIs, at which version" count the reporter sends (reports.mjs).
+// "which CLIs, at which version" count the reporter sends (reports.mjs).
 //
 // SPAWNED, BUT NEVER ON THE BOOT PATH. claude-dir.mjs measured a Claude Code
 // child at ~3.0s and says out loud that boot is the wrong place to spend one, so

package/src/server/deck-prefs.mjs

@@ -78,7 +78,7 @@ export const DEFAULTS = Object.freeze({
   // `auto when idle`, which defaulted on as a localStorage key; it moved here so
   // the server can read it with no page open.
   autoUpdate: true,
-  // ANONYMOUS REPORTS (#1853), ON unless somebody turns them off — the owner's
+  // USAGE REPORTS (#1853), ON unless somebody turns them off — the owner's
   // decision, 2026-09-30: nobody is asked, the README says what is sent, and
   // Appearance holds the switch. See reports.mjs for what is sent, and
   // reportsVetoed for the launch-time veto that wins over this.
@@ -660,7 +660,7 @@ export function notificationsVetoed(env = process.env) {
   return env[OFF_ENV] === "1";
 }
 
-/** Did the machine rule out anonymous reports (#1853), whatever the switch says?
+/** Did the machine rule out usage reports (#1853), whatever the switch says?
  *  AGENTS_DECK_NO_REPORTS=1 does, and so does AGENTS_DECK_NO_INSTALL=1, which
  *  the README promises "turns off everything but the quota reads". */
 export function reportsVetoed(env = process.env) {

package/src/server/index.mjs

@@ -135,7 +135,7 @@ import { applyLanPrefs, resetLanLoaded } from "./lan-deck.mjs";
 import { handleLanInvite, handleLanPeer, handleLanStatus, handleLanSync } from "./lan-routes.mjs";
 // GET and POST /api/prefs — see prefs-routes.mjs.
 import { handlePrefsGiveBack, handlePrefsRead, handlePrefsWrite } from "./prefs-routes.mjs";
-// Anonymous reports and the feedback dialog (#1853). The requests to
+// Usage reports and the feedback dialog (#1853). The requests to
 // api.ccdeck.dev are made in reports.mjs, never in this file.
 import { handleClientError, handleFeedback, handleReportsWrite } from "./reports-routes.mjs";
 import { reporter } from "./reports.mjs";
@@ -481,9 +481,10 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       // deck that had it on comes back with it on, and a launcher that only
       // asked the registry never binds a port it is about to walk away from.
       prefsRead.then(() => applyLanPrefs()).catch(() => {});
-      // Anonymous reports (#1853): what is due once the prefs are read, then a
-      // check every few hours on an unref'd timer. Switched off in Appearance,
-      // or with AGENTS_DECK_NO_REPORTS / AGENTS_DECK_NO_INSTALL, nothing is sent.
+      // Usage reports (#1853): what is due once the prefs are read, then a
+      // check every few hours plus a lighter ~10-minute heartbeat, both on
+      // unref'd timers. Switched off in Appearance, or with
+      // AGENTS_DECK_NO_REPORTS / AGENTS_DECK_NO_INSTALL, nothing is sent.
       reporter.start();
       // Auto-switch resumes only if the user previously turned it on; the
       // module reads its own persisted flag and does nothing otherwise. Its

package/src/server/reports-routes.mjs

@@ -18,7 +18,7 @@ async function readJson(req, res, limit) {
   }
 }
 
-/** `POST /api/reports` `{ on }`: Appearance's "Send anonymous reports" switch. */
+/** `POST /api/reports` `{ on }`: Appearance's "Send usage reports" switch. */
 export async function handleReportsWrite(req, res, { report = reporter } = {}) {
   const body = await readJson(req, res, 1_000);
   if (typeof body?.on !== "boolean") return send(res, 400, { ok: false, reason: "bad_request" });

package/src/server/reports.mjs

@@ -1,4 +1,8 @@
-// Anonymous reports, on unless the person switched them off (#1853).
+// Usage reports, on unless the person switched them off (#1853). They are NOT
+// anonymous: with reports on, every one carries a stable, hashed device id — an
+// identifier for this machine — and the server records the IP the report arrives
+// from. What never leaves is the person's sessions, prompts, files, project
+// names and paths.
 //
 // WHAT GOES OUT, to api.ccdeck.dev, while `prefs.reports` is true and the
 // machine has not vetoed it (reportsVetoed):
@@ -11,11 +15,15 @@
 //     subagents and projects — numbers, never their names,
 //   - errors: a request handler that threw on this server, or an error the page
 //     caught, with home folders, email addresses and key-shaped strings
-//     scrubbed out before they leave.
+//     scrubbed out before they leave,
+//   - a "ping" heartbeat, every ten minutes or so while the deck runs, which
+//     moves the install's "last seen" so the admin can show who is online now.
+//     It writes no event and carries the install id alone — no facts, no
+//     fingerprint.
 //
-// Each carries the install id, the version, the OS and CPU architecture, the
-// channel (the desktop app, npm, or a source checkout) and the runtime, plus a
-// coarse sketch of the environment: the logical CPU count, the RAM in MB, the
+// Each event carries the install id, the version, the OS and CPU architecture,
+// the channel (the desktop app, npm, or a source checkout) and the runtime, plus
+// a coarse sketch of the environment: the logical CPU count, the RAM in MB, the
 // locale, the shell and terminal names, and the Claude Code and Codex CLI
 // versions. Every one of those is a small fixed token or a number, safe by
 // construction — no path, no hostname, no user name, no project name, no prompt,
@@ -23,6 +31,14 @@
 // field that cannot be told is left out rather than guessed. The install id is
 // random, made at the first check-in, and tied to nothing on the machine.
 //
+// The one field that IS derived from the machine is `deviceId`: a stable, hashed
+// device id sent with EVERY report — install, update and active — while reports
+// are on, never on the ping and never on errors. It is an identifier: it follows
+// one machine across runs, which is why the reports are no longer anonymous. It
+// is personal data, so it leaves only as a one-way hash of stable machine traits,
+// never those traits in the clear (see deviceIdToken). It rides with the facts,
+// so it stops entirely the moment reports are switched off or vetoed.
+//
 // NOBODY IS ASKED, AND NOTHING IS HIDDEN. The owner chose on-by-default
 // (2026-09-30): the README says what is sent, Appearance holds the switch, and
 // AGENTS_DECK_NO_REPORTS=1 keeps it off from the first start.
@@ -36,8 +52,8 @@
 // dropped: it is a nicety for the people who make ccdeck, and no part of the
 // deck depends on it.
 
-import { randomUUID } from "node:crypto";
-import { cpus as osCpus, homedir, totalmem } from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { arch as osArch, cpus as osCpus, homedir, hostname, platform as osPlatform, totalmem } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inApp } from "./app-host.mjs";
@@ -51,6 +67,12 @@ const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const TIMEOUT_MS = 6000;
 /** How often a long-running deck checks whether a new day wants its "active". */
 const CHECK_IN_EVERY_MS = 6 * 60 * 60 * 1000;
+/** The heartbeat's beat: a lighter timer than the check-in that only moves the
+ *  install's "last seen", so the admin can count who is online now. Ten minutes,
+ *  plus up to `PING_JITTER_MS` of random spread, so a fleet started together does
+ *  not all beat on the same tick. */
+const PING_EVERY_MS = 10 * 60 * 1000;
+const PING_JITTER_MS = 2 * 60 * 1000;
 /** Errors per hour this deck may send, and how long one error is not repeated. */
 const ERRORS_PER_HOUR = 20;
 const SAME_ERROR_QUIET_MS = 60 * 60 * 1000;
@@ -69,14 +91,18 @@ export function reportsOn(prefs, env = process.env) {
 //
 // Everything added to an install's facts here is a count or a small fixed token,
 // safe by construction: no path, no hostname, no user name, no free text ever
-// reaches any of them, so there is nothing to scrub. Each is optional — a field
-// that cannot be told is left undefined and so never sent, and none of these can
-// throw, because a report is a nicety and no part of the deck may hang on it.
+// reaches any of them, so there is nothing to scrub. The ONE exception is
+// `deviceId` below — it is derived from identifying machine traits (the hostname
+// among them), so it is personal data, which is exactly why it leaves only as a
+// one-way hash and never as the traits themselves (see deviceIdToken). Each is
+// optional — a field that cannot be told is left undefined and so never sent, and
+// none of these can throw, because a report is a nicety and no part of the deck
+// may hang on it.
 
 // The keys the API caps, so a value that would be rejected for length is not
 // sent: it is trimmed to the cap here instead. Only ever tokens the shape of a
 // terminal name, a shell name, a locale or a version — never anything free.
-const TOKEN_CAPS = { locale: 16, shell: 16, term: 32, claudeVersion: 32, codexVersion: 32 };
+const TOKEN_CAPS = { locale: 16, shell: 16, term: 32, claudeVersion: 32, codexVersion: 32, deviceId: 64 };
 
 /** A value reduced to the API's token shape `^[0-9A-Za-z.+_-]+$`: spaces become
  *  "_" (so "Apple Terminal" rides as "Apple_Terminal"), every other disallowed
@@ -104,6 +130,54 @@ function totalMemMb() {
   try { return count(Math.round(totalmem() / 1024 / 1024)); } catch { return undefined; }
 }
 
+/**
+ * A stable, non-reversible fingerprint of the machine, as an opaque token.
+ *
+ * PRIVACY — READ THIS. Unlike every other facts field, this is PERSONAL DATA: a
+ * stable id that follows one machine across runs, and one of its ingredients
+ * (`os.hostname()`) can name a person. That is exactly why it leaves only as a
+ * one-way hash, never as the traits in the clear — the traits are concatenated,
+ * run through SHA-256, and only the first 16 hex characters ship, so the machine
+ * details cannot be read back out of what leaves. It is identifying all the same:
+ * it is stable per machine, so it is what makes the reports no longer anonymous,
+ * and it ships with every report while reports are on. The token is hex, so it
+ * matches the API's `^[0-9A-Za-z.+_-]+$` shape and its 16 characters sit well
+ * under the 64 cap.
+ * Built from traits that do not change between restarts — platform, arch, CPU
+ * model and count, total RAM, and the hostname folded into the hash ONLY — and it
+ * never throws: a trait that cannot be read just yields a different, still stable,
+ * token. The traits are a parameter so a test can hash a fixed machine.
+ */
+export function deviceIdToken(traits = machineTraits()) {
+  try {
+    const seed = [traits.platform, traits.arch, traits.cpuModel, traits.cpuCount, traits.memBytes, traits.hostname]
+      .map(part => String(part ?? ""))
+      .join("\u0000");
+    return createHash("sha256").update(seed).digest("hex").slice(0, 16);
+  } catch {
+    return undefined;
+  }
+}
+
+/** The stable machine traits the fingerprint hashes — never sent themselves,
+ *  only the hash of them. `hostname()` is identifying and is read here solely to
+ *  be folded into that hash, never returned to a path that sends facts. */
+function machineTraits() {
+  try {
+    const list = osCpus();
+    return {
+      platform: osPlatform(),
+      arch: osArch(),
+      cpuModel: list?.[0]?.model,
+      cpuCount: list?.length,
+      memBytes: totalmem(),
+      hostname: hostname(),
+    };
+  } catch {
+    return {};
+  }
+}
+
 /**
  * The UI locale as a token — "en-US", "de-DE". The runtime's own resolved
  * locale first, then `LANG`/`LC_ALL` with any `.UTF-8` encoding stripped. The
@@ -168,6 +242,7 @@ export function installFacts({
   locale = localeToken(env),
   shell = shellToken(env, platform),
   term = termToken(env),
+  deviceId = deviceIdToken(),
   claudeVersion,
   codexVersion,
 } = {}) {
@@ -185,6 +260,9 @@ export function installFacts({
   addIf(facts, "locale", token(locale, TOKEN_CAPS.locale));
   addIf(facts, "shell", token(shell, TOKEN_CAPS.shell));
   addIf(facts, "term", token(term, TOKEN_CAPS.term));
+  // The one derived, hashed, personal field. Present on the events that carry
+  // facts; stripped from errors, and never on the heartbeat (see below).
+  addIf(facts, "deviceId", token(deviceId, TOKEN_CAPS.deviceId));
   addIf(facts, "claudeVersion", token(claudeVersion, TOKEN_CAPS.claudeVersion));
   addIf(facts, "codexVersion", token(codexVersion, TOKEN_CAPS.codexVersion));
   return facts;
@@ -246,6 +324,7 @@ export function createReporter({
   const errorsSent = [];
   const lastSentAt = new Map();
   let timer = null;
+  let pingTimer = null;
 
   /** The CLI versions to add to the facts right now, tokenised and omitted when
    *  not yet known — read on every send so the background probe's result appears
@@ -358,6 +437,23 @@ export function createReporter({
     }
   }
 
+  /** The heartbeat. While reports are on and an id exists, tell the API this deck
+   *  is still here — it moves the install's "last seen" and writes no event, so it
+   *  carries the id and nothing else: no facts, no deviceId. Like every send it is
+   *  dropped if it cannot get through, and it never throws. No id yet means the
+   *  first check-in has not run, so there is nothing to be online under and
+   *  nothing is sent; the check-in that makes the id is what puts this deck
+   *  online, and the ping only keeps that fresh. */
+  async function ping() {
+    try {
+      const p = prefs.current();
+      if (!reportsOn(p, env) || !p.report.installId) return;
+      await call("POST", "/v1/app/ping", { installId: p.report.installId });
+    } catch {
+      // The lightest of the niceties: a heartbeat that could not be sent is gone.
+    }
+  }
+
   /** The switch. On checks in, which makes an id if there is none; off drops the id and asks for a deletion. */
   async function setReports(on) {
     if (on) {
@@ -389,26 +485,44 @@ export function createReporter({
     errorsSent.push(at);
     lastSentAt.set(key, at);
     const stack = typeof error?.stack === "string" ? scrub(error.stack, home).slice(0, STACK_MAX) : undefined;
-    const { runtime: _runtime, ...fields } = factsNow();
+    // Less the runtime, and less the deviceId — an error is not one of the events
+    // the fingerprint rides on, so the personal field never leaves on one.
+    const { runtime: _runtime, deviceId: _deviceId, ...fields } = factsNow();
     return call("POST", "/v1/app/errors", { installId: p.report.installId, ...fields, where, message, stack });
   }
 
-  /** Check in once the prefs are read, and every few hours after, on a timer
-   *  that never holds the process open. */
+  /** The heartbeat timer, rescheduled from itself so each beat carries fresh
+   *  jitter — a fixed interval would let a fleet that started as one beat as one.
+   *  Unref'd, so it never holds the process open. */
+  function scheduleNextPing() {
+    pingTimer = setTimeout(() => {
+      void ping();
+      scheduleNextPing();
+    }, PING_EVERY_MS + Math.floor(Math.random() * PING_JITTER_MS));
+    pingTimer.unref?.();
+  }
+
+  /** Check in once the prefs are read, and every few hours after; and beat a
+   *  heartbeat on its own, lighter timer. Both timers never hold the process
+   *  open. The first check-in already puts a freshly launched deck online, so the
+   *  first ping is a full interval out — nothing pings at boot. */
   function start() {
     Promise.resolve(ready).catch(() => {}).then(checkIn);
     if (!timer) {
       timer = setInterval(() => void checkIn(), CHECK_IN_EVERY_MS);
       timer.unref?.();
     }
+    if (!pingTimer) scheduleNextPing();
   }
 
   function stop() {
     if (timer) clearInterval(timer);
     timer = null;
+    if (pingTimer) clearTimeout(pingTimer);
+    pingTimer = null;
   }
 
-  return { checkIn, setReports, reportError, start, stop };
+  return { checkIn, ping, setReports, reportError, start, stop };
 }
 
 // ── the deck's own providers ─────────────────────────────────────────────────

package/src/server/session-enrichment.mjs

@@ -20,7 +20,7 @@ import { scanAgentsMdFiles, scanClaudeMdFiles } from "./memory-files.mjs";
 import { RECAP_MARK } from "./session-recap.mjs";
 // The shared transcript cursor every pass below reads through — see
 // transcript-scan.mjs.
-import { hasSpend, mergeUsageByModel, newUsageTotals, scanTranscript } from "./transcript-scan.mjs";
+import { copyUsageBucket, hasSpend, mergeUsageByModel, newUsageTotals, scanTranscript } from "./transcript-scan.mjs";
 // event-pipeline.mjs's pushEvent, reached without importing it — see
 // event-sink.mjs.
 import { pushEvent } from "./event-sink.mjs";
@@ -78,7 +78,7 @@ function knownModelId(sid) {
 }
 
 /** How many subagents the deck has seen across the sessions it still tracks —
- *  the coarse "subagents" count the anonymous "active" report carries
+ *  the coarse "subagents" count the "active" report carries
  *  (reports.mjs). Reused, not new state: `subsSig` is already the per-session
  *  signature of the subagent models resolved for it, so its keys are the
  *  subagents. A signature that will not parse is skipped rather than guessed at.
@@ -314,7 +314,7 @@ export async function readUsageByModelFromTranscript(path) {
   const out = {};
   for (const [model, u] of Object.entries(state.usageByModel)) {
     if (!hasSpend(u)) continue;
-    out[model] = { ...u };
+    out[model] = copyUsageBucket(u);
   }
   return Object.keys(out).length ? out : null;
 }

package/src/server/session-tracking.mjs

@@ -148,7 +148,7 @@ function forgetSession(sid) {
 }
 
 /** How many sessions the deck is still tracking — the size of the LRU the watch
- *  polls, which is the coarse "how many sessions" the anonymous "active" report
+ *  polls, which is the coarse "how many sessions" the "active" report
  *  counts (reports.mjs). Reused, not new state: the Map is already the deck's
  *  own answer to which sessions it still holds anything for. Never a session id,
  *  a name or a path — only the count. */

package/src/server/transcript-scan.mjs

@@ -104,6 +104,19 @@ const USAGE_FIELD_RE = {
 // `server_tool_use`, several fields earlier. Match the sub-object on the raw
 // line instead of on the extracted blob.
 const CACHE_CREATION_BLOCK_RE = /"cache_creation"\s*:\s*\{([^}]*)\}/g;
+// Claude Code writes an `iterations` array into the usage block, one entry per
+// model iteration of the request, and every entry carries a `cache_creation`
+// sub-object of its own. The request's split is the top-level one; the entries
+// restate it. Matching every `cache_creation` on the line counted the split once
+// per copy — 141,066 of 192,917 assistant lines on one machine carry the array,
+// and on each of them the 1-hour and 5-minute tokens summed to twice the flat
+// `cache_creation_input_tokens`, so every cache write was billed twice. The
+// array is cut out before the split is read. Its entries hold only numbers and
+// sub-objects, never a bracket inside a string, so one level of nesting is the
+// whole of what the pattern has to span; a key quoted inside a message reaches
+// the line as `\"iterations\"` and is not matched, for the reason
+// TOOL_USE_RESULT_KEY_RE gives below.
+const ITERATIONS_ARRAY_RE = /"iterations"\s*:\s*\[(?:[^[\]]|\[[^[\]]*\])*\]/g;
 // A finished `Task`/`Agent` call is written into the PARENT's transcript as a
 // top-level `toolUseResult`, and that object carries a `usage` block of its own
 // — the subagent's LAST API turn, restated on the parent's line. Those same
@@ -149,6 +162,50 @@ function grabUsageField(blob, key) {
 // model — the behaviour the whole deck had before #686.
 const MAX_TRANSCRIPT_USAGE_MODELS = 32;
 
+// A request's `usage.speed` (#754). Claude Code's fast mode runs the same model
+// id at `speed: "fast"`, and Anthropic bills it at a premium, so the speed is
+// part of which rate card a token is billed against, the way the model is. The
+// API documents the value as "fast" or "standard", and Claude Code writes the
+// usage object into the transcript verbatim — `speed` is on every final
+// assistant line it writes today, "standard" on all 140,532 of them on one
+// machine. Absent, null and "standard" are all the standard speed and add
+// nothing here, so a session that never ran fast has buckets of exactly the
+// shape it always had.
+//
+// Anything else is kept as a share of its model's bucket, under `speeds`, and
+// the client prices each share at its own speed's rates or not at all. The
+// value is bytes this process was handed, so it is held to a short token and a
+// few distinct values per model, the same reason MAX_TRANSCRIPT_USAGE_MODELS
+// caps the models; whatever fails either test is kept under
+// UNRECOGNISED_SPEED, which no rate table names, so it is counted and left
+// unpriced rather than priced at the standard rate.
+const STANDARD_SPEED = "standard";
+const UNRECOGNISED_SPEED = "unrecognised";
+const SPEED_VALUE_RE = /^[a-z][a-z0-9_-]{0,31}$/i;
+const MAX_SPEEDS_PER_MODEL = 4;
+
+/** The speed a line's request was billed at, or null for the standard one.
+ *  `record` is the line parsed, or null when it names no model — and a line
+ *  that names no model is billed at the standard speed, as every line was. */
+function billedSpeed(record) {
+  const speed = record?.message?.usage?.speed;
+  if (speed === undefined || speed === null || speed === STANDARD_SPEED) return null;
+  return typeof speed === "string" && SPEED_VALUE_RE.test(speed) ? speed : UNRECOGNISED_SPEED;
+}
+
+/** The share of `bucket` billed at `speed`, created on first sight. Null for
+ *  the standard speed or a bucket we could not attribute. `Object.hasOwn`
+ *  rather than a plain read, because `constructor` passes SPEED_VALUE_RE and
+ *  every object already answers it. */
+function speedBucketFor(bucket, speed) {
+  if (!bucket || !speed) return null;
+  const speeds = bucket.speeds ?? (bucket.speeds = {});
+  if (Object.hasOwn(speeds, speed)) return speeds[speed];
+  const key = Object.keys(speeds).length < MAX_SPEEDS_PER_MODEL ? speed : UNRECOGNISED_SPEED;
+  if (!Object.hasOwn(speeds, key)) speeds[key] = newUsageTotals();
+  return speeds[key];
+}
+
 /** The per-model usage bucket for `model`, created on first sight. Null for a
  *  line whose tokens we cannot attribute — no model seen yet in this file, or
  *  the cap above already reached. */
@@ -166,19 +223,40 @@ function usageBucketFor(state, model) {
  *  `cache_creation` sub-object splits cache writes into by TTL. */
 const USAGE_BLOCK_FIELDS = ["input_tokens", "output_tokens", "cache_read_input_tokens", "cache_creation_input_tokens"];
 const CACHE_SPLIT_FIELDS = ["ephemeral_1h_input_tokens", "ephemeral_5m_input_tokens"];
+const USAGE_TOTAL_FIELDS = [...USAGE_BLOCK_FIELDS, ...CACHE_SPLIT_FIELDS];
 
 /** Charge `fields` of one usage blob to the file's flat totals and, when the
  *  tokens can be attributed, to their model's bucket too — the same number
  *  into both, read once, so the split and the total it splits go on summing
- *  to each other. */
-function chargeUsage(state, bucket, blob, fields) {
+ *  to each other. A request billed at a speed other than standard is charged
+ *  to that speed's share of the bucket as well, which is a subset of the
+ *  bucket and not an addition to it. */
+function chargeUsage(state, bucket, blob, fields, speedBucket) {
   for (const k of fields) {
     const n = grabUsageField(blob, k);
     state.usage[k] += n;
     if (bucket) bucket[k] += n;
+    if (speedBucket) speedBucket[k] += n;
   }
 }
 
+/** Add one bucket's counters, and its speed shares, into `dst`. */
+function addUsageBucket(dst, src) {
+  for (const k of USAGE_TOTAL_FIELDS) dst[k] += src[k] ?? 0;
+  if (!src.speeds) return dst;
+  for (const [speed, share] of Object.entries(src.speeds)) {
+    const into = speedBucketFor(dst, speed);
+    for (const k of USAGE_TOTAL_FIELDS) into[k] += share[k] ?? 0;
+  }
+  return dst;
+}
+
+/** A bucket's counters and speed shares, sharing no object with the scan state
+ *  it was read from. */
+function copyUsageBucket(u) {
+  return addUsageBucket(newUsageTotals(), u);
+}
+
 /** Add `src`'s per-model buckets into `dst`, key for key, and return `dst`.
  *  Under the same cap as the per-file map, so a session that delegates to
  *  hundreds of files cannot assemble an unbounded one out of bounded parts. */
@@ -191,7 +269,7 @@ function mergeUsageByModel(dst, src) {
       bucket = newUsageTotals();
       dst[model] = bucket;
     }
-    for (const k of Object.keys(bucket)) bucket[k] += u[k] ?? 0;
+    addUsageBucket(bucket, u);
   }
   return dst;
 }
@@ -394,11 +472,12 @@ function foldUsageLine(state, line, record) {
   // and the two would stop summing to each other.
   const billed = billedUsageText(line);
   const bucket = usageBucketFor(state, state.lastModel);
+  const speedBucket = speedBucketFor(bucket, billedSpeed(record));
   for (const m of billed.matchAll(USAGE_BLOCK_RE)) {
-    chargeUsage(state, bucket, m[1], USAGE_BLOCK_FIELDS);
+    chargeUsage(state, bucket, m[1], USAGE_BLOCK_FIELDS, speedBucket);
   }
-  for (const m of billed.matchAll(CACHE_CREATION_BLOCK_RE)) {
-    chargeUsage(state, bucket, m[1], CACHE_SPLIT_FIELDS);
+  for (const m of billed.replace(ITERATIONS_ARRAY_RE, "").matchAll(CACHE_CREATION_BLOCK_RE)) {
+    chargeUsage(state, bucket, m[1], CACHE_SPLIT_FIELDS, speedBucket);
   }
 }
 
@@ -580,5 +659,5 @@ function scanTranscript(path) {
 // rather than marked at each declaration so that every declaration above reads
 // exactly as it did where it came from.
 export {
-  scanTranscript, newUsageTotals, hasSpend, mergeUsageByModel, repeatsRequestUsage,
+  scanTranscript, newUsageTotals, hasSpend, mergeUsageByModel, copyUsageBucket, repeatsRequestUsage,
 };