pan-wizard 3.28.0 → 3.30.0

package/pan-wizard-core/bin/lib/cost.cjs

@@ -30,8 +30,9 @@
  *   - hit rate: cache_read / (cache_read + input - cache_write) if any cache activity
  *
  * Rate table is approximate — real pricing comes from the provider's API.
- * Rates are US dollars per million tokens, indicative as of 2026-08. Users
- * can override with `.planning/config.json` → `cost.rates`.
+ * Rates are US dollars per million tokens, verified against each provider's
+ * pricing page on the date in RATES_VERIFIED_AT (below). Users can override with
+ * `.planning/config.json` → `cost.rates`.
  */
 
 const fs = require('fs');
@@ -47,63 +48,109 @@ const TOKENS_FILE = 'tokens.jsonl';
  * Override per-model in config.json → cost.rates.
  */
 const DEFAULT_RATES = {
-  // Anthropic — verified against platform pricing 2026-09-10. Opus 4.6+/Opus 5 are
-  // $5/$25 (the old $15/$75 Opus pricing ended with the 4.5 generation). Cache
-  // rates follow Anthropic's convention: read ≈ 0.1× input, write ≈ 1.25× input —
-  // EXCEPT Fable 5.1, whose cache reads bill at 0.025× input ($0.25). Fable 5.1
-  // needs its own row: without it the family-prefix fallback priced its reads at
-  // the Fable 5 rate, 4× too high on the model the `fable`/`best` aliases resolve to
-  // (model-config, read 2026-09-10: neither Fable model is any plan's default), and
-  // cached re-reads are the bulk of PAN's traffic (ADR-0044).
+  // Anthropic — platform.claude.com/docs/en/about-claude/pricing, every row read
+  // 2026-09-23. Opus 4.6+/Opus 5 are $5/$25 (the old $15/$75 Opus pricing ended with
+  // the 4.5 generation). cache_write is the 5-minute write rate (1.25× input; the
+  // 1-hour write bills 2×, which the ledger does not split yet). Cache reads follow
+  // the 0.1× convention EXCEPT on three models the page footnotes: Fable 5.1 and
+  // Mythos 5.1 at 0.025× input, Opus 5.5 at 0.05×. Each needs its own row, because
+  // the family-prefix fallback would otherwise price it at its predecessor's reads.
+  // Fable 5.1 is what the `fable`/`best` aliases resolve to (model-config: neither
+  // Fable model is any plan's default); cached re-reads are the bulk of PAN's
+  // traffic (ADR-0044).
   'claude-fable-5-1':   { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
   'claude-fable-5':     { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
-  // Mythos 5.1 / Mythos 5 (limited availability) — platform.claude.com/docs/en/about-claude/pricing,
-  // read 2026-09-10: $10/$50; the page's cache footnote names Fable 5.1 AND Mythos 5.1 as
-  // the two models whose cache reads bill at 0.025× input; Mythos 5 follows the 0.1× rule.
-  // Added for reality check R7: resolveRate returned null for both ids.
+  // Mythos 5.1 / Mythos 5 (limited availability): $10/$50; Mythos 5.1 reads at
+  // 0.025× input like Fable 5.1, Mythos 5 follows the 0.1× rule (R7).
   'claude-mythos-5-1':  { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
   'claude-mythos-5':    { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
+  // Opus 5.5 (claude-opus-5-5, released 2026-09-22): $4 input / $20 output, 5-minute
+  // writes $5, cache hits $0.20 — the page prices its hits at 0.05× input. Claude
+  // Code 2.1.280 made it the default model on every plan (model-config, read
+  // 2026-09-23), so PAN's inherit tier now runs on it. Without this row the family
+  // prefix priced it as Opus 5: cache reads 2.5× high, the rest a quarter high
+  // (reality check 2026-09-22, R25). The models overview lists no dated snapshot —
+  // from the 4.6 generation on, the dateless id is canonical.
+  'claude-opus-5-5':    { input: 4.0,  output: 20.0, cache_read: 0.20, cache_write: 5.0 },
   'claude-opus-5':      { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-8':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-7':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-6':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  // Opus 4.5 (dated id claude-opus-4-5-20251101) — same pricing page, read 2026-09-10:
-  // $5/$25/$0.50/$6.25. Without this row the dated id had no family prefix to land on
-  // and priced as null (R7).
+  // Opus 4.5 (dated id claude-opus-4-5-20251101): without this row the dated id had
+  // no family prefix to land on and priced as null (R7).
   'claude-opus-4-5':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   // Sonnet 5 is $2/$10: the launch price announced as introductory through
-  // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled
-  // (pricing page, read 2026-09-10). Lesson: never write down a pre-announced
-  // price — this row carried the future rate for a month and over-billed by half.
+  // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled.
+  // Lesson: never write down a pre-announced price — this row carried the future
+  // rate for a month and over-billed by half.
   'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50 },
   'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
-  // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929) — pricing page, read 2026-09-10:
-  // $3/$15/$0.30/$3.75 (the pre-Sonnet-5 rate; Sonnet 5 is $2/$10). R7.
+  // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929): $3/$15/$0.30/$3.75 (R7).
   'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
+  // Haiku 4.5: API id claude-haiku-4-5-20251001, alias claude-haiku-4-5.
   'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25 },
 
-  // OpenAI — verified against published pricing 2026-08. Prompt caching is a 90%
-  // input discount with no separate write charge, so cache_write bills at the
-  // plain input rate. GPT-5.6 ships in three tiers; the bare `gpt-5.6` id prices
-  // as the Sol flagship, with tier-specific keys for Terra/Luna (longest-prefix
-  // match wins in resolveRate). Luna reflects the 2026-07-30 price cut.
-  'gpt-5.6':            { input: 5.0,  output: 30.0, cache_read: 0.5,  cache_write: 5.0 },
-  'gpt-5.6-terra':      { input: 2.0,  output: 12.0, cache_read: 0.2,  cache_write: 2.0 },
-  'gpt-5.6-luna':       { input: 0.20, output: 1.20, cache_read: 0.02, cache_write: 0.20 },
+  // OpenAI — developers.openai.com/api/docs/pricing, Standard tier, short context
+  // (≤272K input tokens), read 2026-09-23. On the GPT-5.6 and GPT-6 families a cache
+  // write bills at 1.25× input IN PLACE of the input rate ("writes are not an
+  // additive fee"); GPT-5.5 charges no cache write ("-"), so its write tokens bill
+  // as plain input. Until 2026-09-22 this block said "no separate write charge" for
+  // every row, which had stopped being true — Terra and Luna writes were a fifth
+  // low (R27). Longest-prefix match lets each tier key win over a shorter one.
+  // GPT-6: Astra is the flagship; Sol and Luna were released 2026-09-22. Codex's
+  // config docs use gpt-6-sol as the default model and gpt-6-luna for lower-cost
+  // subagents (learn.chatgpt.com/docs/config-file/config-basic, /agent-configuration/subagents).
+  'gpt-6-astra':        { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
+  'gpt-6-sol':          { input: 2.0,  output: 10.0, cache_read: 0.2,  cache_write: 2.5 },
+  'gpt-6-luna':         { input: 0.10, output: 0.50, cache_read: 0.01, cache_write: 0.125 },
+  // GPT-5.6. The bare `gpt-5.6` id is an alias that "routes requests to GPT-5.6 Sol"
+  // (its model page, read 2026-09-23), so it carries Sol's row — not the $5/$30 it
+  // carried before, which no page listed. Sol's price is promotional "at least
+  // through November 21, 2026": re-read it after that date.
+  'gpt-5.6':            { input: 4.0,  output: 20.0, cache_read: 0.4,  cache_write: 5.0 },
+  'gpt-5.6-sol':        { input: 4.0,  output: 20.0, cache_read: 0.4,  cache_write: 5.0 },
+  'gpt-5.6-terra':      { input: 2.0,  output: 12.0, cache_read: 0.2,  cache_write: 2.5 },
+  'gpt-5.6-luna':       { input: 0.20, output: 1.20, cache_read: 0.02, cache_write: 0.25 },
+  // Priced only in the page's separate "Cyber models" table, not in the Standard tiers.
+  'gpt-5.6-cyber':      { input: 12.5, output: 75.0, cache_read: 1.25, cache_write: 15.625 },
   'gpt-5.5':            { input: 5.0,  output: 30.0, cache_read: 0.5,  cache_write: 5.0 },
 
-  // Google Gemini — published rates (per million tokens, approximate; users can override via config.json → cost.rates).
-  // Pro tiers use the <=200K-context tier; long-context calls may be billed at ~2x. Cache rates are Google's context-cache pricing (~25% of input rate).
+  // Google Gemini — ai.google.dev/gemini-api/docs/pricing, paid tier, text input,
+  // the ≤200K-token prompt tier where the page splits by length, read 2026-09-23.
+  // cache_read is the page's "context caching" price: 0.1× input on every row, not
+  // the 0.25× this block carried until 2026-09-22 (cache reads 2.5× high, R26). The
+  // tokens that CREATE a cache bill at the standard input price (Google Cloud's
+  // context-cache overview; the Gemini API pages list only cached-token and storage
+  // charges), so cache_write = input. Cache STORAGE bills per million tokens per
+  // HOUR, which a per-token table cannot carry: PAN's Gemini totals exclude it.
+  // The 3.6/3.7/3.8 Flash prices run "through December 31, 2026" and double from
+  // January 1, 2027 (the page states both) — re-read them after that date.
+  'gemini-3.8-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.7-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.6-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.5-flash':       { input: 1.50, output: 9.00, cache_read: 0.15,  cache_write: 1.50 },
+  'gemini-3.5-flash-lite':  { input: 0.30, output: 2.50, cache_read: 0.03,  cache_write: 0.30 },
+  // Shutdown announced for 2027-05-07 (deprecations page); replacement gemini-3.5-flash-lite.
+  'gemini-3.1-flash-lite':  { input: 0.25, output: 1.50, cache_read: 0.025, cache_write: 0.25 },
+  'gemini-3-flash-preview': { input: 0.50, output: 3.00, cache_read: 0.05,  cache_write: 0.50 },
+  // The page lists 3.1 Pro only as gemini-3.1-pro-preview; the bare id keeps the
+  // preview's row so records written under it stay priced.
+  'gemini-3.1-pro':         { input: 2.00, output: 12.0, cache_read: 0.20,  cache_write: 2.00 },
+  'gemini-3.1-pro-preview': { input: 2.00, output: 12.0, cache_read: 0.20,  cache_write: 2.00 },
+  // The 2.5 family is "not deprecated", but the models page limits access to users
+  // who have used it before — new projects cannot count on it (PAN's Google routing
+  // tiers moved off it, R28). Rows kept for the ledgers that recorded it.
+  'gemini-2.5-pro':         { input: 1.25, output: 10.0, cache_read: 0.125, cache_write: 1.25 },
+  'gemini-2.5-flash':       { input: 0.30, output: 2.50, cache_read: 0.03,  cache_write: 0.30 },
+  'gemini-2.5-flash-lite':  { input: 0.10, output: 0.40, cache_read: 0.01,  cache_write: 0.10 },
   // (gemini-1.5-pro removed 2026-06: retired model; records for it fall back to tier rates.)
-  'gemini-3.1-pro':         { input: 2.00, output: 12.0, cache_read: 0.50,   cache_write: 2.00 },
-  'gemini-3.1-pro-preview': { input: 2.00, output: 12.0, cache_read: 0.50,   cache_write: 2.00 },
-  'gemini-2.5-pro':         { input: 1.25, output: 10.0, cache_read: 0.3125, cache_write: 1.25 },
-  'gemini-2.5-flash':       { input: 0.30, output: 2.50, cache_read: 0.075,  cache_write: 0.30 },
-  'gemini-2.5-flash-lite':  { input: 0.10, output: 0.40, cache_read: 0.025,  cache_write: 0.10 },
-
-  // Tier fallbacks when model id is unknown (reasoning tracks current Opus pricing)
-  'reasoning': { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  'mid':       { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
+
+  // Tier fallbacks when the model id is unknown: reasoning tracks the default Opus
+  // (Opus 5.5 since 2026-09-22 — the model the inherit tier runs on for most users),
+  // mid the Sonnet the `sonnet` alias resolves to on the Anthropic API (Sonnet 5),
+  // fast Haiku 4.5.
+  'reasoning': { input: 4.0,  output: 20.0, cache_read: 0.20, cache_write: 5.0 },
+  'mid':       { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50 },
   'fast':      { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25 },
 };
 
@@ -330,23 +377,67 @@ function readRecords(cwd) {
  */
 /**
  * A record is "suspect" when its token counts are physically implausible for a
- * single subagent — the signature of the pre-v3.12.4 transcript-oversum bug
- * (billions of cache-read, cache-read dwarfing input, 100% cache-hit). Such
- * records are quarantined from aggregates so a poisoned ledger can't report
- * millions of dollars. See docs/FIELD-REPORT-army-2026-06.md.
+ * single subagent — the oversum signature: a session's cumulative usage booked
+ * to one subagent row (billions of cache-read, cache-read dwarfing input, 100%
+ * cache-hit). Written by pre-v3.12.4 hooks, and by the parent-transcript slice
+ * path of every later hook up to v3.28 whenever a slice started at cursor 0 on a
+ * long-lived session. Such records are quarantined from aggregates so a
+ * poisoned ledger can't report millions of dollars.
+ * See docs/FIELD-REPORT-army-2026-06.md.
  * @param {Object} r - a cost record
  * @returns {boolean}
  */
+// No single subagent runs for six hours — the longest native-workflow phase runs
+// measured in the harness finish inside an hour — while a parent-transcript slice
+// that spans a working day, or the idle night between two stops, does. Mirrored by
+// the hooks' SLICE_MAX_DURATION_MS, which nulls the span on write. Calibrated on
+// eleven field ledgers (2026-09): of the timed rows the old ratio rule flagged,
+// 55 spanned under three hours and 12 spanned six to twenty-four — the latter all
+// parent slices booked to a `general-purpose` or workflow subagent.
+const SUSPECT_MAX_DURATION_MS = 6 * 60 * 60 * 1000;
+
 function isSuspectRecord(r) {
   if (!r || typeof r !== 'object') return false;
+  // Rows measured from a transcript that belongs to exactly one actor — the
+  // subagent's own file (v3.29 hooks, `cost rebuild`) or the main thread's
+  // session file (`cost rebuild`) — cannot carry another actor's usage, so the
+  // oversum signature does not apply to them: a 24-day main thread with
+  // billions of cached reads is simply a long session, measured exactly.
+  if (r.token_source === 'agent-transcript' || r.token_source === 'session-transcript') return false;
   const cr = r.cache_read_tokens || 0;
   const io = (r.input_tokens || 0) + (r.output_tokens || 0);
   if (cr > 5e8) return true;                        // no scoped subagent re-reads >500M cached tokens
-  if (cr > 1e7 && cr > 100 * (io + 1)) return true; // cache-read dwarfs input+output
   if ((r.output_tokens || 0) > 1e7) return true;    // ~10M output = cumulative oversum
+  const dur = typeof r.duration_ms === 'number' ? r.duration_ms : null;
+  if (dur != null && dur > SUSPECT_MAX_DURATION_MS) return true; // a six-hour-plus "subagent" is a session's history
+  // Cache-read dwarfing input+output is the oversum signature ONLY for a row the
+  // hook could not time (pre-v3.20 rows, unreadable transcripts). A timed row
+  // with a plausible span is a real agent: under prompt caching every turn
+  // re-reads the cached context, so a hundred-turn agent legitimately reads
+  // 300× more cached tokens than it writes. Applied to timed rows, this rule
+  // had excluded fifty sub-hour agents (~3 billion real cache-read tokens)
+  // from eleven field ledgers (2026-09).
+  if (dur == null && cr > 1e7 && cr > 100 * (io + 1)) return true;
   return false;
 }
 
+/**
+ * A record is "empty" when it carries no tokens on any axis and no model: a
+ * spawn the hook could not measure — a sibling stop that arrived before the
+ * shared parent transcript had grown (the pre-v3.29 slice path), or a payload
+ * with neither usage nor a readable transcript. It has no cost and no tokens;
+ * counting it as a call inflated call counts by up to 2x in the field (480 of
+ * 976 rows across eleven ledgers, 2026-09). A zero-token row that names a model
+ * is NOT empty — that is a measured run that happened to use nothing.
+ * @param {Object} r - a cost record
+ * @returns {boolean}
+ */
+function isEmptyRecord(r) {
+  if (!r || typeof r !== 'object') return false;
+  if (r.model) return false;
+  return !(r.input_tokens || r.output_tokens || r.cache_read_tokens || r.cache_write_tokens);
+}
+
 function aggregate(cwd, opts) {
   const records = readRecords(cwd);
   const malformedSkipped = _lastReadMalformed; // captured before any later read
@@ -372,6 +463,7 @@ function aggregate(cwd, opts) {
     cost_usd: 0,
     cost_unknown: 0,
     suspect_excluded: 0,
+    empty_excluded: 0,
     malformed_skipped: malformedSkipped,
   };
 
@@ -393,9 +485,11 @@ function aggregate(cwd, opts) {
   }
 
   for (const r of filtered) {
-    // Quarantine physically-impossible records (pre-v3.12.4 transcript-oversum
-    // bug) so a poisoned ledger doesn't poison the totals / HUD / /pan:cost.
+    // Quarantine physically-impossible records (the transcript-oversum
+    // signature) so a poisoned ledger doesn't poison the totals / HUD / /pan:cost.
     if (isSuspectRecord(r)) { totals.suspect_excluded += 1; continue; }
+    // Skip unmeasured spawns: no tokens, no model, nothing to price or count.
+    if (isEmptyRecord(r)) { totals.empty_excluded += 1; continue; }
     totals.calls += 1;
     totals.input_tokens += r.input_tokens || 0;
     totals.output_tokens += r.output_tokens || 0;
@@ -452,7 +546,12 @@ function renderTable(agg) {
   lines.push(window);
   lines.push('');
   lines.push('Totals');
-  lines.push(`  Calls              : ${agg.totals.calls}${agg.totals.malformed_skipped > 0 ? ` (+${agg.totals.malformed_skipped} malformed)` : ''}`);
+  const skipped = [
+    agg.totals.suspect_excluded > 0 ? `${agg.totals.suspect_excluded} suspect` : null,
+    agg.totals.empty_excluded > 0 ? `${agg.totals.empty_excluded} empty` : null,
+    agg.totals.malformed_skipped > 0 ? `${agg.totals.malformed_skipped} malformed` : null,
+  ].filter(Boolean);
+  lines.push(`  Calls              : ${agg.totals.calls}${skipped.length ? ` (excluded: ${skipped.join(', ')})` : ''}`);
   lines.push(`  Input tokens       : ${agg.totals.input_tokens.toLocaleString()}`);
   lines.push(`  Output tokens      : ${agg.totals.output_tokens.toLocaleString()}`);
   lines.push(`  Cache read         : ${agg.totals.cache_read_tokens.toLocaleString()}`);
@@ -535,12 +634,22 @@ function cmdCostClear(cwd, raw) {
 
 // ─── Rate-table staleness ───────────────────────────────────────────────────
 
-// Date DEFAULT_RATES was last verified against published provider pricing.
-// Bump this whenever the table is re-verified; `models check` flags the table
-// once it is older than RATES_STALE_AFTER_DAYS (provider prices move faster
-// than PAN releases do).
-const RATES_VERIFIED_AT = '2026-09-10';
-const RATES_STALE_AFTER_DAYS = 180;
+// Date DEFAULT_RATES was last verified against published provider pricing — ALL
+// providers' pricing pages, not only Anthropic's (the 2026-09-10 bump covered the
+// Anthropic rows alone, and the Gemini and OpenAI rows it vouched for had never
+// matched their pages: reality check 2026-09-22, RC29). Bump it only when every
+// row has been read against its page that day.
+//
+// `models check` flags the table once it is older than RATES_STALE_AFTER_DAYS.
+// That window was half a year until 2026-09-22 (R38), which is longer than the
+// interval at which the lineup now moves: the default Claude model changed on
+// every plan inside twelve days of the last verification. Sixty days is the
+// review cadence the ecosystem reviews settled on. The calendar still cannot see
+// a default-model change inside the window — that is the job of the
+// documented-default-ids fixture test (tests/fixtures/documented-default-models.json,
+// R31), which fails the suite the day a documented default id has no exact row.
+const RATES_VERIFIED_AT = '2026-09-23';
+const RATES_STALE_AFTER_DAYS = 60;
 const RATE_TIERS = ['reasoning', 'mid', 'fast'];
 
 function checkRatesStaleness(now = new Date()) {
@@ -572,6 +681,7 @@ module.exports = {
   readRecords,
   aggregate,
   isSuspectRecord,
+  isEmptyRecord,
   renderTable,
   renderChart,
   resolveRate,

package/pan-wizard-core/bin/lib/git.cjs

@@ -82,7 +82,11 @@ function cmdGitCommit(cwd, opts, raw) {
   const commitArgs = amend ? ['commit', '--amend', '--no-edit'] : ['commit', '-m', finalMessage];
   const r = execGit(cwd, commitArgs);
   if (r.exitCode !== 0) {
-    if (r.stdout.includes('nothing to commit') || r.stderr.includes('nothing to commit')) {
+    // Git says "nothing to commit" for a clean tree and "nothing added to commit but
+    // untracked files present" when the only changes are untracked. Both mean no change
+    // was NEEDED; only the first was recognised, so the second was reported as a failed
+    // commit with "unknown git error" (measured 2026-09-17).
+    if ((r.stdout + r.stderr).includes('nothing to commit') || (r.stdout + r.stderr).includes('nothing added to commit')) {
       // No error key, exit 0: nothing to commit means no change was NEEDED, not that
       // a change failed. Pinned as a success in CLI-REFERENCE ("Error Shape").
       output({ committed: false, reason: 'nothing_to_commit' }, raw, 'nothing to commit');

package/pan-wizard-core/bin/lib/hud.cjs

@@ -424,8 +424,10 @@ function fmtTokens(n) {
 /**
  * Assess whether a cost ledger is trustworthy enough to show dollar figures.
  * Two failure modes are treated as "don't quote a number":
- *   - legacy: more records were quarantined as implausible than survived (the
- *     pre-v3.12.4 transcript-oversum bug) — reset advised.
+ *   - legacy: more records were quarantined as implausible than were measured
+ *     (the transcript-oversum signature: a session's cumulative usage booked to
+ *     one subagent, written by hooks before v3.29) — quarantine advised.
+ *     Unmeasured spawns (`empty_excluded`) count on neither side.
  *   - unresolved: every surviving record lacks a resolvable model→rate, so the
  *     computed spend is a misleading $0 even though real tokens were spent.
  * Returns { ok:true } when figures are safe to display.
@@ -439,7 +441,7 @@ function ledgerReliability(totals) {
     const total = suspect + calls;
     return {
       ok: false, kind: 'legacy',
-      message: `${suspect} of ${total} cost records are implausible (the pre-v3.12.4 telemetry capture bug). Reset the ledger with <b>pan-tools cost clear</b> — records captured after the fix are accurate.`,
+      message: `${suspect} of ${total} measured cost records are implausible (a session's usage booked to one subagent — rows written by hooks before v3.29). Rebuild the ledger from the transcripts with <b>pan-tools cost rebuild --apply</b> (dry-run first without the flag); if the transcripts are gone, quarantine it with <b>pan-tools hygiene clean --apply</b>. Rows captured by v3.29+ hooks are attributed per agent.`,
     };
   }
   if (calls > 0 && unknown >= calls) {

package/pan-wizard-core/bin/lib/hygiene.cjs

@@ -5,7 +5,9 @@
  * campaigns run: runtime installs fall behind the latest version, legacy
  * uppercase planning filenames linger from pre-v2.2 layouts, atomic-write
  * .tmp orphans survive crashes, per-agent memory logs grow past the cap,
- * cost ledgers written by pre-v3.12.4 hooks are 100% poisoned, telemetry
+ * cost ledgers carry oversum rows (a session's cumulative usage booked to one
+ * subagent — pre-v3.12.4 hooks wrote nothing else, and the parent-transcript
+ * slice path kept producing them up to v3.28), telemetry
  * trace sessions pile up unboundedly, and stray fragment `.planning/`
  * directories appear where a mapping step once ran.
  *
@@ -39,7 +41,7 @@ const {
   CHARS_PER_TOKEN,
   STATE_FILE,
 } = require('./constants.cjs');
-const { planningPath, planningRel } = require('./utils.cjs');
+const { planningPath, planningRel, detectPlanningModel } = require('./utils.cjs');
 const { detectForeignPlanningTree } = require('./foreign-planning.cjs');
 const { listMemoryAgents, readMemory, compactMemory } = require('./memory.cjs');
 const { readRecords, isSuspectRecord, METRICS_DIR, TOKENS_FILE } = require('./cost.cjs');
@@ -253,7 +255,8 @@ function recordMass(r) {
 }
 
 /**
- * H-5: cost ledger dominated by physically implausible (pre-v3.12.4) records.
+ * H-5: cost ledger dominated by physically implausible records — the oversum
+ * signature, a session's cumulative usage booked to one subagent row.
  *
  * Gated on token MASS as well as record count. A count-only gate passes a ledger
  * whose few bad rows carry most of the tokens — field case: 24% of rows suspect
@@ -286,7 +289,7 @@ function checkCostLedger(cwd) {
       : 'token mass';
   findings.push(mkFinding('poisoned-ledger', 'critical',
     planningRel(METRICS_DIR, TOKENS_FILE),
-    `${suspect}/${records.length} records suspect (${Math.round(ratio * 100)}% of rows, ${Math.round(massRatio * 100)}% of token mass) — pre-v3.12.4 oversum signature, tripped on ${basis}; aggregates quarantine them but the file is dead weight`,
+    `${suspect}/${records.length} records suspect (${Math.round(ratio * 100)}% of rows, ${Math.round(massRatio * 100)}% of token mass) — oversum signature (a session's cumulative usage booked to one subagent row), tripped on ${basis}; aggregates quarantine them but the file is dead weight. Run \`cost rebuild\` first while the session transcripts still exist — quarantining moves the whole ledger aside, and a rebuild afterwards has no rows left to keep`,
     { action: 'quarantine-ledger' }));
   return { findings };
 }
@@ -466,7 +469,7 @@ function checkCachedContext(cwd) {
   try {
     const ttl = assessCacheTtl(readRecords(cwd).filter(r => !isSuspectRecord(r)));
     if (ttl.recommend) {
-      findings.push(mkFinding('cache-context', 'info', planningRel(path.join(METRICS_DIR, TOKENS_FILE)), ttl.advice, null));
+      findings.push(mkFinding('cache-context', ttl.severity, planningRel(path.join(METRICS_DIR, TOKENS_FILE)), ttl.advice, null));
     }
   } catch { /* no ledger, or unreadable — nothing to say */ }
   return { findings };
@@ -494,15 +497,11 @@ function checkPlanningFragment(cwd) {
   const dir = planningPath(cwd);
   let entries = [];
   try { entries = fs.readdirSync(dir); } catch { return { findings, planning_exists: false }; }
-  const lower = entries.map(e => e.toLowerCase());
-  // Spine = anything that marks a deliberate PAN workflow: the phase model
-  // (project/state/phases/roadmap/requirements/milestones) OR the focus model
-  // (focus/quick) OR an orchestration campaign. A dir holding only generated
-  // artifacts (codebase maps, metrics, traces) is a stray fragment.
-  const SPINE = ['project.md', 'state.md', 'phases', 'roadmap.md', 'requirements.md',
-    'milestones', 'focus', 'quick', 'orchestration'];
-  const hasSpine = SPINE.some(s => lower.includes(s));
-  if (!hasSpine && entries.length > 0) {
+  // A spine is whatever marks a deliberate PAN workflow — the phase model, the focus
+  // model, or an orchestration campaign (PLANNING_MODEL_MARKERS, shared with
+  // `validate health` so the two verbs cannot disagree about a tree). A dir holding
+  // only generated artifacts (codebase maps, metrics, traces) is a stray fragment.
+  if (detectPlanningModel(dir).model === 'fragment') {
     findings.push(mkFinding('planning-fragment', 'info', planningRootRel(),
       `.planning exists with ${entries.length} entr${entries.length === 1 ? 'y' : 'ies'} (${entries.slice(0, 5).join(', ')}) but no workflow spine (project/state/phases/focus/…) — likely a stray partial run; review and delete manually`,
       null));
@@ -661,16 +660,14 @@ function applyFix(cwd, finding) {
         const dest = `${abs}.quarantined-${stamp}`;
         fs.renameSync(abs, dest);
 
-        // The cursor is a per-transcript high-water mark INTO the ledger we just
-        // moved aside. Left behind it points at rows that are no longer there,
-        // so the fresh ledger starts mid-stream and the next slice is undercounted.
-        // A "fresh ledger" that inherits the old ledger's read position is not fresh.
-        let cursorNote = '';
-        try {
-          const cursor = path.join(path.dirname(abs), COST_CURSOR_FILE);
-          fs.unlinkSync(cursor);
-          cursorNote = ', cursor reset';
-        } catch { /* no cursor to reset */ }
+        // The cost cursor (COST_CURSOR_FILE) STAYS. It is a per-TRANSCRIPT
+        // high-water mark — how many records of each session transcript the
+        // hooks have already attributed — not a position in the ledger, so it
+        // has nothing to do with the file being moved aside. This step used to
+        // delete it as "a fresh ledger must not inherit the old read position",
+        // and the next SubagentStop then re-summed every session transcript from
+        // line 0: a fresh oversum row the day after each quarantine (field,
+        // 2026-08-25 → 08-26). Quarantine and poison had become a loop.
 
         // Quarantine leaves a dated copy behind, and nothing else ever removes
         // one. Run hygiene a few times over a year and the metrics dir fills
@@ -680,7 +677,7 @@ function applyFix(cwd, finding) {
 
         return {
           applied: true,
-          detail: `renamed to ${path.basename(dest)}${cursorNote}${prunedNote} — fresh ledger starts clean`,
+          detail: `renamed to ${path.basename(dest)}${prunedNote} — fresh ledger starts clean; transcript cursor kept`,
         };
       }
       default:

package/pan-wizard-core/bin/lib/memory-rebuild.cjs

@@ -10,8 +10,8 @@
  *
  * Three derived targets:
  *   1. AGENTS.md — the universal, cross-runtime tools memory. PAN owns exactly
- *      the marker-fenced `<!-- BEGIN/END PAN WIZARD -->` section (every runtime,
- *      including Copilot/.github, reads AGENTS.md natively). User content
+ *      the marker-fenced `<!-- BEGIN/END PAN WIZARD -->` section (Codex, Copilot and
+ *      OpenCode read AGENTS.md natively; Claude via the CLAUDE.md bridge; Gemini reads GEMINI.md by default). User content
  *      outside the markers is preserved byte-for-byte.
  *   2. CLAUDE.md — the Claude bridge (`@AGENTS.md` import), regenerated only
  *      when the Claude runtime is installed here.
@@ -126,7 +126,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
   const targets = [];
   const warnings = [];
 
-  // 1. AGENTS.md — universal PAN section (all runtimes read it natively).
+  // 1. AGENTS.md — universal PAN section (Claude Code reads it through the bridge in step 2).
   {
     const p = path.join(cwd, 'AGENTS.md');
     const existing = safeReadFile(p);

package/pan-wizard-core/bin/lib/memory.cjs

@@ -301,11 +301,17 @@ function selectMemory(cwd, agent, opts = {}) {
 /**
  * Memory-load telemetry gate (ADR-0036 acceptance signal). Estimates the tokens
  * of memory that would be injected whole (every agent log) and compares to the
- * median per-agent input from the trustworthy cost ledger (suspect records
+ * median per-agent PROMPT from the trustworthy cost ledger (suspect records
  * quarantined). Read-only, non-blocking; degrades to an absolute-token check
  * when the ledger is thin.
  *
- * @returns {{memory_tokens, agents, median_input_tokens, fraction, status, advisory}}
+ * The prompt is `input + cache_read + cache_write`, not `input` alone: under prompt
+ * caching the uncached remainder is tens of tokens, so dividing by it reported 1.8k
+ * of memory as 8,940% of a "median agent input" and called it critical (field sweep
+ * 2026-09-17). Memory is injected into the whole prompt, so the whole prompt is what
+ * it must be measured against.
+ *
+ * @returns {{memory_tokens, agents, median_prompt_tokens, fraction, status, advisory}}
  */
 function memoryLoadBudget(cwd, opts = {}) {
   const { agents } = listMemoryAgents(cwd);
@@ -317,12 +323,12 @@ function memoryLoadBudget(cwd, opts = {}) {
   let median = null;
   try {
     const cost = require('./cost.cjs');
-    const inputs = (cost.readRecords(cwd) || [])
-      .filter(r => !cost.isSuspectRecord(r))
-      .map(r => Number(r.input_tokens) || 0)
+    const prompts = (cost.readRecords(cwd) || [])
+      .filter(r => !cost.isSuspectRecord(r) && !cost.isEmptyRecord(r))
+      .map(r => (Number(r.input_tokens) || 0) + (Number(r.cache_read_tokens) || 0) + (Number(r.cache_write_tokens) || 0))
       .filter(n => n > 0)
       .sort((a, b) => a - b);
-    if (inputs.length) median = inputs[Math.floor(inputs.length / 2)];
+    if (prompts.length) median = prompts[Math.floor(prompts.length / 2)];
   } catch { /* thin/absent ledger — absolute-token check only */ }
 
   const fraction = median ? memoryTokens / median : null;
@@ -335,9 +341,9 @@ function memoryLoadBudget(cwd, opts = {}) {
   const advisory = status === 'ok'
     ? 'Memory-load within budget.'
     : `Memory injection is ~${memoryTokens} tokens across ${agents.length} agent log(s)` +
-      (fraction != null ? ` (~${Math.round(fraction * 100)}% of median agent input)` : '') +
+      (fraction != null ? ` (~${Math.round(fraction * 100)}% of a median agent prompt)` : '') +
       `. Bound it with cue-scoped 'memory select' or trim with 'memory compact <agent>'.`;
-  return { memory_tokens: memoryTokens, agents: agents.length, median_input_tokens: median, fraction, status, advisory };
+  return { memory_tokens: memoryTokens, agents: agents.length, median_prompt_tokens: median, fraction, status, advisory };
 }
 
 // ─── CLI command wrappers ────────────────────────────────────────────────────

package/pan-wizard-core/bin/lib/optimize.cjs

@@ -134,9 +134,82 @@ function getCurrentSessionId(cwd) {
   }
 }
 
+/**
+ * Day-scoped auto-session id, the same shape the trace hook mints
+ * (`sess_auto_YYYYMMDD`) so a day's hook-written and agent-reported events share one
+ * session instead of splitting into two.
+ */
+function autoSessionId(now = new Date()) {
+  const p = (n) => String(n).padStart(2, '0');
+  return `sess_auto_${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}`;
+}
+
+/**
+ * How long a `current-session` pointer is evidence of a live session. An explicit
+ * (non-auto) session used to stay "current" indefinitely — a July session was still
+ * current in September in a field project, so `readActiveSessionMeta` in the cost hook
+ * backfilled two-month-old command/phase onto today's ledger rows, and agent-reported
+ * events would have landed in a long-dead session's directory (field sweep 2026-09-17).
+ */
+const SESSION_STALE_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Last time anything was written to a session: its event log if it has one, else the
+ * moment it started. Null when the session cannot be read at all.
+ */
+function sessionLastActivityMs(cwd, sid) {
+  const dir = path.join(getTracesDir(cwd), sid);
+  try {
+    return fs.statSync(path.join(dir, TRACE_EVENT_FILE)).mtimeMs;
+  } catch { /* no events yet */ }
+  try {
+    const meta = JSON.parse(fs.readFileSync(path.join(dir, OPT_SESSION_FILE), 'utf-8'));
+    const t = new Date(meta.started_at).getTime();
+    return Number.isFinite(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Is this session finished, or too old to still be the one running? Read-only —
+ * finalizing a stale session is the writing path's job (the trace hook's rollover).
+ */
+function isSessionStale(cwd, sid, now = Date.now()) {
+  const dir = path.join(getTracesDir(cwd), sid);
+  try {
+    const meta = JSON.parse(fs.readFileSync(path.join(dir, OPT_SESSION_FILE), 'utf-8'));
+    if (meta && meta.ended_at) return true;
+  } catch { /* unreadable meta — fall through to the age test */ }
+  const last = sessionLastActivityMs(cwd, sid);
+  if (last === null) return true;
+  return now - last > SESSION_STALE_MS;
+}
+
+/**
+ * Append one trace event.
+ *
+ * Creates the day's auto-session when none is active. It used to return false instead,
+ * and the 16 `optimize trace log` call sites in the workflows are fire-and-forget
+ * (`2>/dev/null || true`), so on the phase pipeline — which never starts a trace
+ * session — every agent-reported event was silently discarded. Across fourteen field
+ * projects the instrument held 3,737 events, 99.7% of them the completion rows the hook
+ * writes, and not one error, gap or correction in its whole history (sweep 2026-09-17).
+ * An explicit `--session` is still honoured verbatim.
+ */
 function logTraceEvent(cwd, event, sessionId) {
-  const sid = sessionId || getCurrentSessionId(cwd);
-  if (!sid) return false;
+  // An explicit id is honoured verbatim. A POINTER, by contrast, is only evidence while
+  // the session it names is alive; a dead one is no session at all.
+  let sid = sessionId || null;
+  if (!sid) {
+    const current = getCurrentSessionId(cwd);
+    if (current && !isSessionStale(cwd, current)) sid = current;
+  }
+  if (!sid) {
+    const created = initTraceSession(cwd, { sessionId: autoSessionId(), description: 'auto-session (day-scoped)' });
+    if (!created || created.error) return false;
+    sid = created.session_id;
+  }
 
   try {
     const sessionDir = path.join(getTracesDir(cwd), sid);
@@ -1290,6 +1363,9 @@ module.exports = {
   TRACE_EVENT_FILE,
   OPT_SESSION_FILE,
   CURRENT_SESSION_FILE,
+  autoSessionId,
+  isSessionStale,
+  SESSION_STALE_MS,
   EVENT_TYPES,
   IMPACT_LEVELS,
   VALID_SCOPES,