trusty-mpm 1.8.2

//! The instruction/language-compression savings producer (#6958).
//!
//! Why: the owner asked to see what "language compression" is worth. The one
//! place trusty-mpm folds instruction prose is the composer that writes
//! `INSTRUCTIONS-COMPILED.md`, so that is where the number is available: it
//! knows every candidate instruction body it read and the exact bytes it
//! delivered. Measuring there — rather than against a dated constant recorded
//! by hand — means the figure re-derives itself when the instruction corpus
//! changes, and it goes to zero honestly when nothing was folded.
//!
//! What: `record_instruction_compression_in_with`, called from
//! [`crate::core::instruction_pipeline::write_compiled_prompt_recording_in`].
//! #7514 split that off the bare write, which now records nothing, and made the
//! ledger's root a parameter rather than a read of the process home directory —
//! each launch path resolves the ambient root once, in its own named wrapper.
//! It compares the folded source set against the
//! delivered prompt and appends one [`crate::core::savings::SavingsRow`] per
//! session launch when, and only when, the delivered prompt is smaller.
//!
//! **What counts as "folded".** The source set is every instruction body the
//! composer READ for this session: the ten bundled section sources, each
//! named-section override body it read from the project's `CLAUDE.md`, and the
//! UNDEDUPED agent roster. Each is a candidate; only part of each reaches the
//! output, so the delta is what the composer folded away.
//!
//! **The roster is source, not just output (#7616).** Until #7616 the roster was
//! counted only on the delivered side, on the reasoning that generated context
//! "has no source file behind it" — which made `compiled >= sources` permanent
//! for a project that overrides nothing, and the field measurement was 26,810 B
//! of sources against a 26,695 B prompt (0.4%). That reasoning was wrong twice
//! over. The roster generator resolves the FULL deployed inventory and delivers
//! only the entries the harness's own `Available agent types` listing omits
//! (#4513), so the dropped entries are read-and-discarded exactly as an
//! overridden section body is. And the composer now performs a real fold on the
//! authored prose as well ([`crate::core::instruction_fold`]), which it did not
//! before. The detected stack profile still has no larger source behind it and
//! is still counted only where it lands. A savings figure has to be able to come
//! out zero, or it is not a measurement — and it still does, on a machine with
//! no roster and a corpus with nothing to fold.
//!
//! Everything here is best-effort: an unresolvable session id, an unpriceable
//! model, or an unwritable ledger each skip the row. A missing savings row must
//! never cost a session its launch.
//!
//! **Which session a row is keyed by (#7209, corrected by #7245).** The
//! compiled prompt lives at
//! `<harness-root>/.trusty-mpm/sessions/<scope>/INSTRUCTIONS-COMPILED.md`,
//! where `<scope>` is [`crate::core::harness_root::session_scope`] — the
//! managed session id, or `local`. The `💸` statusline segment folds this
//! ledger by the id Claude Code sends it on stdin, which is
//! [`crate::core::savings::CLAUDE_CODE_SESSION_ID_ENV`] and is a different
//! value.
//!
//! #7209 keyed the row by that variable when it is set. It never is here: this
//! producer runs in the `tm` process that compiles the prompt, before `claude`
//! is spawned, and Claude Code exports the variable into its own children only.
//! Every row therefore fell back to the directory name, which is the one key the
//! statusline cannot match. So since #7245 the fallback does not write a row at
//! all — it STAGES it through [`crate::core::savings_sidecar::stage_row`], and
//! the first `tm hook` invocation (which runs inside Claude Code and knows the
//! id) appends it. The directory location is unchanged: one compiled prompt per
//! managed session is what that path is for.
//!
//! **The decline that zeroes this technique (#7245, narrowed by #7617).** When
//! the compiled prompt is not smaller than its sources there is nothing to
//! record, and for a project that overrides no instruction section that is
//! permanently true — the composer ADDS generated context and folds nothing
//! away. #7245 raised that decline to a per-launch `warn!`; #7867 put it back
//! at `debug!` — [`crate::core::savings_sidecar::log_no_fold_once`], naming both
//! byte counts once per project. The decline touches the `💸` segment not at
//! all: since #7867 that segment folds `compress` and `divert` rows only. `tm
//! doctor`'s `instruction_fold` row is where an operator reads this state.
//!
//! Test: the inline suite in `savings_instructions_tests.rs` —
//! `no_row_when_the_compiled_prompt_is_not_smaller`,
//! `a_folded_source_set_produces_a_row`, `no_row_when_the_model_cannot_be_priced`,
//! `folded_source_bytes_adds_an_override_body`,
//! `the_row_is_keyed_by_the_claude_session_id`,
//! `no_claude_id_stages_the_row_instead_of_writing_an_unfoldable_one`,
//! `a_staged_row_becomes_foldable_at_the_first_hook_invocation`,
//! `a_prompt_that_folds_nothing_warns_once_and_writes_no_row`,
//! `the_row_reports_the_compiled_prompts_own_size`,
//! `a_stub_compiled_prompt_writes_no_row`.
//!
//! **The implausibly small compiled prompt (#7491).** `compiled < sources` was
//! the producer's only plausibility test, and a stub, a truncated write, or a
//! stale file at the compiled-prompt path passes it trivially — the owner's
//! ledger carried `sources 22559 B - compiled 13 B`, a claimed ~100% reduction
//! that inflated the `💸` percentage for as long as the append-only ledger kept
//! it. [`min_plausible_compiled_bytes`] is now the floor, and a file below it
//! declines the row with a `warn!` naming the path and both byte counts.

use std::path::Path;

use crate::core::harness_root::{HARNESS_DIR, SESSIONS_DIR};
use crate::core::instruction_pipeline::COMPILED_PROMPT_FILE;
use crate::core::savings::{
    BYTES_PER_TOKEN, SavingsRow, TECHNIQUE_INSTRUCTION_COMPRESSION, claude_code_session_id, now_ts,
    savings_log_in,
};
use crate::core::savings_sidecar::{log_no_fold_once, stage_row};

/// The PM section sources' byte figures a fold is measured against (#9012).
///
/// Why: the sections are runtime content, so the sizes come from the content
/// source the prompt was composed from, not from compiled-in constants.
/// What: `total` — every canonical section file's length summed; `min` — the
/// smallest one, the floor below which a compiled prompt cannot be an
/// assembly of them.
/// Test: `folded_source_bytes_counts_the_bundled_sections`.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) struct SectionBytes {
    /// Every canonical section file's length, summed.
    pub(crate) total: usize,
    /// The smallest canonical section file's length.
    pub(crate) min: usize,
}

impl SectionBytes {
    /// The figures for `content`'s canonical section files.
    pub(crate) fn of(content: &crate::core::framework_content::FrameworkContent) -> Self {
        let lens: Vec<usize> = crate::core::instruction_pipeline::SECTION_FILES
            .iter()
            .map(|path| content.instruction(path).map_or(0, str::len))
            .collect();
        Self {
            total: lens.iter().sum(),
            min: lens.iter().copied().min().unwrap_or(0),
        }
    }
}

/// Append one `instruction-compression` row for a session whose compiled prompt
/// came out smaller than the sources that fed it.
///
/// Why: called from the compiled-prompt writer's recording entry points so every
/// launch path — fresh start, daemon resume, in-place relaunch — records the same
/// way without each one growing its own call. #7514 removed the ambient
/// `record_instruction_compression` that resolved `framework_root` from the
/// process home directory: every caller reachable from a test wrote into the
/// operator's own ledger through it. Each launch path now resolves the ambient
/// root once, in its own named wrapper, and passes it down. #7746 split the
/// roster resolver out too: the ambient one reads process-global
/// `$CLAUDE_CONFIG_DIR`/`$HOME`, which raced a concurrently running
/// `RosterTiers`-guarded test mutating either variable between a caller's own
/// read of [`ambient_source_bytes`] and this function's internal
/// recomputation of the same number. Callers that need a deterministic count
/// instead — today, only the regression test — supply `roster_source`
/// directly;
/// [`crate::core::instruction_pipeline::write_compiled_prompt_recording_in`]
/// passes [`ambient_roster_source_bytes`], unchanged from before the split.
/// What: reads the Claude Code session id the statusline folds by, then defers to
/// [`record_instruction_compression_to`] against `framework_root`, with
/// `roster_source` supplied by the caller.
/// Test: `a_bare_compiled_write_records_no_savings_row`,
/// `a_recording_compiled_write_reaches_the_named_framework_root`.
pub(crate) fn record_instruction_compression_in_with(
    framework_root: &Path,
    sections: SectionBytes,
    dest: &Path,
    prompt: &str,
    roster_source: impl FnOnce(&Path) -> usize,
) {
    // #7209: the row's key is the Claude Code session id, not the directory name.
    record_instruction_compression_to(
        framework_root,
        sections,
        dest,
        prompt,
        claude_code_session_id(),
        roster_source,
        resolve_pm_price,
    );
}

/// Bytes of the roster the composer read, before the #4513 dedup dropped every
/// agent the harness publishes itself.
///
/// Why (#7616): this is the half of the fold that was attributed to neither
/// side. The composer resolves the full deployed-agent inventory and delivers
/// only the entries the harness's own `Available agent types` listing omits, so
/// the dropped entries are read-and-discarded source in exactly the sense an
/// overridden section body is — and counting them only on the delivered side is
/// what made `compiled >= sources` permanent for a project with no override.
/// What: renders the UNDEDUPED roster for `project_dir`'s tiers and returns its
/// length; `0` when no agent is deployed anywhere, which is honest — a machine
/// with no roster folds no roster.
/// Test: `the_roster_dedup_counts_as_folded_source` (the arithmetic),
/// `roster_source_bytes_are_zero_without_a_roster` (the tier seam).
///
/// `pub(crate)` since #7746:
/// [`crate::core::instruction_pipeline::write_compiled_prompt_recording_in`]
/// names it as the default `roster_source` argument to
/// [`record_instruction_compression_in_with`].
pub(crate) fn ambient_roster_source_bytes(project_dir: &Path) -> usize {
    let dirs = crate::core::delegation_authority::deployed_agent_dirs(project_dir);
    roster_source_bytes_from(&dirs)
}

/// [`ambient_roster_source_bytes`] against an explicit tier list.
///
/// Why (#7616): the ambient entry point resolves `$CLAUDE_CONFIG_DIR` and the
/// caller's home directory, so on a provisioned machine it can never return `0`
/// and the "no roster folds no roster" branch is untestable through it. Taking
/// the tiers is the seam that makes that branch assertable without mutating
/// process-global state, the same shape `delegation_authority` already uses for
/// `roster_section_from_dirs`.
/// What: the length of the UNDEDUPED roster render for `dirs`, or `0` when no
/// agent is deployed in any of them.
/// Test: `roster_source_bytes_are_zero_without_a_roster`.
fn roster_source_bytes_from(dirs: &[std::path::PathBuf]) -> usize {
    crate::core::delegation_authority::roster_section_from_dirs(dirs)
        .map(|section| section.len())
        .unwrap_or(0)
}

// #8019: the entry point this names was renamed by #7514/#7584; the link
// still pointed at the pre-split `record_instruction_compression_in`.
/// [`record_instruction_compression_in_with`] against an explicit framework
/// root, session id and price.
///
/// Why: the three ambient reads the entry point makes — the framework root under
/// the operator's home, the harness's session-id variable, and the configured
/// PM model — are exactly what makes the keying decision untestable in place.
/// Passing all three in keeps the test on a tempdir root with no process-env
/// mutation, which the `tm` binary's env ratchet (#5544) and parallel test
/// binaries both require. `framework_root` rather than a ledger path because
/// #7245 gave this function a second destination under that root: the staging
/// file, which has to land beside the ledger the hook will later append to.
/// What: derives the compile-time session id and the harness root from `dest`
/// (which is always
/// `<harness-root>/.trusty-mpm/sessions/<id>/INSTRUCTIONS-COMPILED.md`),
/// measures the fold, prices the token delta, and then either appends the row —
/// when `claude_session_id` gives it the key the statusline folds by — or stages
/// it for the first `tm hook` invocation, which is the first process that knows
/// that key. A prompt that folded nothing warns once per project and writes
/// nothing. Silent no-op on every other failure.
/// Test: `the_row_is_keyed_by_the_claude_session_id`,
/// `no_claude_id_stages_the_row_instead_of_writing_an_unfoldable_one`,
/// `a_prompt_that_folds_nothing_warns_once_and_writes_no_row`.
fn record_instruction_compression_to(
    framework_root: &Path,
    sections: SectionBytes,
    dest: &Path,
    prompt: &str,
    claude_session_id: Option<String>,
    roster_source: impl FnOnce(&Path) -> usize,
    price: impl FnOnce() -> Option<(String, f64)>,
) {
    let Some((compiled_prompt_id, harness_root)) = session_and_root(dest) else {
        // #7514: a destination that is not a compiled-prompt path has no session
        // and no harness root to measure against, so there is nothing to record.
        tracing::warn!(
            compiled_prompt = %dest.display(),
            "not a <root>/.trusty-mpm/sessions/<id>/INSTRUCTIONS-COMPILED.md path, so \
             neither the session nor the source set it would be measured against is \
             known; writing no instruction-compression savings row"
        );
        return;
    };
    let source_bytes = folded_source_bytes(sections, &harness_root, roster_source(&harness_root));
    let compiled_bytes = prompt.len();
    // #7491: a compiled prompt this small is not a fold, it is a stub,
    // a truncated write, or a stale file at the compiled-prompt path.
    if compiled_bytes < min_plausible_compiled_bytes(sections) {
        tracing::warn!(
            compiled_prompt = %dest.display(),
            compiled_bytes,
            source_bytes,
            floor = min_plausible_compiled_bytes(sections),
            "the compiled prompt is smaller than the smallest instruction section \
             it is assembled from, so it cannot be a real compiled prompt; writing \
             no instruction-compression savings row rather than a near-100% one"
        );
        return;
    }
    // #7867: checked here, where the project root is in hand, so the decline is
    // recorded once per project at `debug!` — an override-free project folding
    // nothing is the ordinary state, and it feeds no operator-facing figure.
    if compiled_bytes >= source_bytes {
        log_no_fold_once(framework_root, &harness_root, source_bytes, compiled_bytes);
        return;
    }
    // #7209: the statusline folds by the id Claude Code sends it, so a row keyed
    // by the compiled-prompt directory name never matches for a managed session.
    let session_id = claude_session_id
        .clone()
        .unwrap_or_else(|| compiled_prompt_id.clone());
    let Some(row) = instruction_compression_row(&session_id, source_bytes, compiled_bytes, price)
    else {
        return;
    };
    // #7245: this process is the compiler, not a child of Claude Code, so an
    // absent id here is the NORMAL case rather than an edge one. Staging the row
    // hands it to the first hook, which can key it correctly.
    if claude_session_id.is_none() {
        stage_row(framework_root, dest, &row);
        return;
    }
    let ledger = savings_log_in(framework_root);
    // #7658: this append fires on every compose that runs with the harness's
    // session id exported, which a `tm` subprocess of a live Claude session
    // inherits — 312 byte-identical rows for one session. `append_row_once`
    // consults the ledger first; see `savings::append_row_once` for why the
    // guard lives there rather than here.
    if let Err(source) = crate::core::savings::append_row_once(&ledger, &row) {
        tracing::warn!(
            ledger = %ledger.display(),
            %source,
            "could not append the instruction-compression savings row"
        );
    }
}

/// Re-measure the fold from a compiled prompt already on disk and append the
/// row under a known Claude session id.
///
/// Why (#7411): staging is the only way this producer's row reaches the ledger
/// for a normal launch, so a staged file that is lost — an unwritable
/// `pending-savings/`, a compile whose row was discarded, a `tm` upgraded
/// between the compile and the hook — leaves the session with no row at all and
/// the `💸` segment blank for the rest of it. The compiled prompt itself
/// survives on disk, and it is the same input the producer measured, so the
/// hook can redo the measurement instead of inventing a second staging
/// mechanism to protect the first.
/// What: reads `compiled_prompt`, then runs the ordinary producer against it
/// with `claude_session_id` supplied, which makes it append rather than stage.
/// Reports whether a row landed, read back off the ledger — the producer
/// declines silently for an unpriceable model or a prompt that folded nothing,
/// and a caller must not report those as a row. Callers guard against the
/// double-append themselves with [`crate::core::savings::has_row`].
/// Test: `rederiving_from_the_compiled_prompt_appends_under_the_session_id`,
/// `rederiving_a_prompt_that_folds_nothing_appends_nothing`.
pub(crate) fn rederive_from_compiled_prompt(
    framework_root: &Path,
    compiled_prompt: &Path,
    claude_session_id: &str,
) -> bool {
    let Ok(prompt) = std::fs::read_to_string(compiled_prompt) else {
        return false;
    };
    // #9012: the section sizes come from content; with none, nothing is measured.
    let Some((_, harness_root)) = session_and_root(compiled_prompt) else {
        return false;
    };
    // #9396: re-deriving a row is read-only; it never fetches.
    let content = match crate::core::content_source::framework_content_local(Some(&harness_root)) {
        Ok(content) => content,
        Err(err) => {
            tracing::debug!(%err, "no instructional content; not re-deriving the savings row");
            return false;
        }
    };
    let ledger = savings_log_in(framework_root);
    record_instruction_compression_to(
        framework_root,
        SectionBytes::of(&content),
        compiled_prompt,
        &prompt,
        Some(claude_session_id.to_string()),
        ambient_roster_source_bytes,
        resolve_pm_price,
    );
    crate::core::savings::has_row(
        &ledger,
        claude_session_id,
        TECHNIQUE_INSTRUCTION_COMPRESSION,
    )
}

/// Split `<harness-root>/.trusty-mpm/sessions/<id>/INSTRUCTIONS-COMPILED.md`
/// into its session id and its harness root.
///
/// Why: the writer takes only a destination path, and the harness root the
/// source set is measured against is encoded in it. Deriving it here rather
/// than widening the writer's signature keeps the three launch call sites
/// unchanged.
/// What: the session id is the parent directory's name — the FALLBACK key since
/// #7209, used only when the harness exported no Claude Code session id; the
/// harness root is three directories above that (`sessions/`, `.trusty-mpm/`,
/// the root).
/// Returns `None` for any path not of that shape.
///
/// #7514: it now CHECKS that shape. It used to take the parent as a session id
/// and count three directories up for the root without looking at what those
/// directories were called, so `<tmp>/a/b/INSTRUCTIONS-COMPILED.md` resolved to
/// session `b` under root `<tmp>` — which is exactly the
/// `session_id":"b" … compiled 13 B` row the owner's ledger carried, produced by
/// this crate's own `write_compiled_prompt_to_creates_parent_dirs` fixture. A
/// path that is not a compiled prompt now declines, so no row can be attributed
/// to a directory that is not a session.
/// Test: `session_and_root_reads_the_compiled_prompt_path`,
/// `session_and_root_rejects_a_short_path`,
/// `session_and_root_rejects_a_path_that_is_not_under_sessions`,
/// `a_malformed_compiled_prompt_path_records_no_row`.
fn session_and_root(dest: &Path) -> Option<(String, std::path::PathBuf)> {
    if dest.file_name()? != std::ffi::OsStr::new(COMPILED_PROMPT_FILE) {
        return None;
    }
    let session_dir = dest.parent()?;
    let session_id = session_dir.file_name()?.to_str()?.to_string();
    let sessions_dir = session_dir.parent()?;
    if sessions_dir.file_name()? != std::ffi::OsStr::new(SESSIONS_DIR) {
        return None;
    }
    let harness_dir = sessions_dir.parent()?;
    if harness_dir.file_name()? != std::ffi::OsStr::new(HARNESS_DIR) {
        return None;
    }
    Some((session_id, harness_dir.parent()?.to_path_buf()))
}

/// Total bytes of every instruction body the composer read for this project.
///
/// Why: see the module header — this is the "before" half of the fold, and it
/// has to include the override bodies as well as the bundled sections, because
/// an override is a source the composer read and (partly) discarded.
/// What: the ten bundled section sources, every accepted named-section
/// override body found in the project's `CLAUDE.md`, and `roster_source_bytes`
/// — the UNDEDUPED roster render (#7616). Rejected override blocks are excluded:
/// the composer did not fold them, it declined them.
/// Test: `folded_source_bytes_counts_the_bundled_sections`,
/// `folded_source_bytes_adds_an_override_body`,
/// `the_roster_dedup_counts_as_folded_source`.
fn folded_source_bytes(
    sections: SectionBytes,
    project_dir: &Path,
    roster_source_bytes: usize,
) -> usize {
    let bundled = sections.total;
    let overrides: usize = crate::core::claude_md_sections::scan_project(project_dir)
        .overrides
        .iter()
        .map(|applied| applied.body.len())
        .sum();
    // #7616: the undeduped roster is read-and-partly-discarded source too.
    bundled + overrides + roster_source_bytes
}

/// What the fold actually achieved for `project_dir`, last time it ran.
///
/// Why (#7616): the decline branch is silent by design — it warns once per
/// project into the daemon log and writes no ledger row — so an operator seeing
/// no `💸` segment had nowhere to look for the reason. `tm doctor` is the
/// surface that answers "is this working", and it had no compression check at
/// all. This is the measurement behind that check, taken from the same inputs
/// the producer uses so the two can never report different numbers.
/// What: `(source_bytes, compiled_bytes)` for the most recently written compiled
/// prompt under `<project>/.trusty-mpm/sessions/`, or `None` when no session has
/// compiled one yet. The source side is [`folded_source_bytes`] with this
/// machine's roster, exactly as at launch.
/// Test: `the_fold_measurement_is_none_before_any_session_compiles`,
/// `the_fold_measurement_reads_the_newest_compiled_prompt`.
pub(crate) fn measure_project_fold(
    project_dir: &Path,
    sections: SectionBytes,
) -> Option<(usize, usize)> {
    let prompt = crate::core::savings_sidecar::compiled_prompts_in(project_dir)
        .into_iter()
        .next()?;
    let compiled_bytes = std::fs::metadata(&prompt).ok()?.len() as usize;
    Some((ambient_source_bytes(project_dir, sections), compiled_bytes))
}

/// [`folded_source_bytes`] with this machine's roster resolved.
///
/// Why (#7616): three callers need the same number — the doctor check, and two
/// tests that must build a fixture prompt provably ABOVE the source set to
/// exercise the decline branch. Before the roster joined the source side they
/// could sum [`crate::core::instruction_pipeline::SECTION_SOURCES`] themselves;
/// now that would undercount and the fixture would land on the wrong branch.
/// What: the bundled sections, the project's override bodies, and the undeduped
/// roster for `project_dir`'s tiers.
/// Test: `the_fold_measurement_reads_the_newest_compiled_prompt`.
pub(crate) fn ambient_source_bytes(project_dir: &Path, sections: SectionBytes) -> usize {
    // #7746: delegates to the seamed variant below with the ambient roster
    // resolver, so this production entry point is unchanged.
    source_bytes_with(project_dir, sections, ambient_roster_source_bytes)
}

/// [`ambient_source_bytes`] with an explicit roster-byte resolver (the test
/// seam, #7746) — mirrors [`record_instruction_compression_in_with`] so a
/// test can compute the SAME number the recording write will, with neither
/// call depending on `$CLAUDE_CONFIG_DIR`/`$HOME`.
/// Test: `a_recording_compiled_write_reaches_the_named_framework_root`.
pub(crate) fn source_bytes_with(
    project_dir: &Path,
    sections: SectionBytes,
    roster_source: impl FnOnce(&Path) -> usize,
) -> usize {
    folded_source_bytes(sections, project_dir, roster_source(project_dir))
}

/// The smallest byte count a real compiled PM prompt can have.
///
/// Why (#7491): the ledger recorded `sources 22559 B - compiled 13 B` — a
/// claimed ~100% reduction — because the producer's only plausibility test was
/// `compiled < sources`, which a stub, a truncated write, or a stale file at the
/// compiled-prompt path passes trivially. The ledger is append-only, so one such
/// row inflates the `💸` percentage for as long as it is folded.
/// What: the smallest single bundled instruction section. The compiled prompt is
/// an assembly of those sections (with overrides substituted for some of them),
/// so anything below one whole section cannot be such an assembly. Derived from
/// the corpus rather than spelled as a constant, so it re-derives when the
/// sections change.
/// Test: `a_stub_compiled_prompt_writes_no_row`,
/// `the_row_reports_the_compiled_prompts_own_size`.
pub(crate) fn min_plausible_compiled_bytes(sections: SectionBytes) -> usize {
    sections.min
}

/// Build the row, or decline to.
///
/// Why: separating the arithmetic and every decline condition from the IO is
/// what makes "writes no row when the compiled output is not smaller" a unit
/// test rather than a filesystem assertion.
/// What: returns `None` when the compiled output is not strictly smaller, when
/// the byte delta rounds to no whole token, when `price` cannot price the
/// session's model, or when the resulting cost is not strictly positive.
/// `price` resolves the session's model and its USD-per-million input rate.
/// Test: `no_row_when_the_compiled_prompt_is_not_smaller`,
/// `no_row_when_the_model_cannot_be_priced`,
/// `instruction_compression_tokens_use_the_shared_divisor`.
fn instruction_compression_row(
    session_id: &str,
    source_bytes: usize,
    compiled_bytes: usize,
    price: impl FnOnce() -> Option<(String, f64)>,
) -> Option<SavingsRow> {
    if compiled_bytes >= source_bytes {
        // #7245: the caller checks this first and warns once per project, so
        // reaching here means a direct unit-test call. Kept as the builder's own
        // guard — the arithmetic below is only meaningful on a real fold.
        tracing::debug!(
            session_id,
            source_bytes,
            compiled_bytes,
            "instruction composition folded nothing away; writing no savings row"
        );
        return None;
    }
    let saved_bytes = source_bytes - compiled_bytes;
    let tokens_saved = (saved_bytes as f64 / BYTES_PER_TOKEN).floor() as i64;
    if tokens_saved <= 0 {
        return None;
    }
    let (model, input_per_million) = price()?;
    let cost_saved_usd = (tokens_saved as f64 / 1_000_000.0) * input_per_million;
    if !cost_saved_usd.is_finite() || cost_saved_usd <= 0.0 {
        return None;
    }
    Some(SavingsRow {
        ts: now_ts(),
        session_id: session_id.to_string(),
        technique: TECHNIQUE_INSTRUCTION_COMPRESSION.to_string(),
        tokens_saved,
        // #7179: the percent segment's denominator — the folded source set's
        // own token count. Floor of a non-negative byte count: never negative.
        tokens_before: (source_bytes as f64 / BYTES_PER_TOKEN).floor() as u64,
        cost_saved_usd,
        basis: format!(
            "sources {source_bytes} B - compiled {compiled_bytes} B, \
             at {BYTES_PER_TOKEN} B/token, priced at {model} input \
             ${input_per_million}/Mtok"
        ),
        // #6972: authoritative here, unlike in the divert producer — this runs at
        // launch, off the chain that produced the session's own `--model` flag.
        model_source: crate::core::session_model::MODEL_SOURCE_LAUNCH_CONFIG.to_string(),
    })
}

/// Resolve the session's PM model and its input price.
///
/// Why: the price table is `trusty_common::inference::pricing` — the
/// most complete of the workspace's three and the one the epic already names as
/// the consolidation target. This feature adds no fourth table, and it prices
/// nothing it cannot look up: an unrecognised model slug declines the row
/// rather than substituting a guessed rate.
/// What: resolves the PM model through the same `resolve_pm_model` chain the
/// launcher uses, then returns `(slug, input USD per million tokens)`, or `None`
/// when the table does not know the family.
/// Test: `resolve_pm_price_agrees_with_the_shared_table`.
fn resolve_pm_price() -> Option<(String, f64)> {
    let config = crate::core::config::MpmConfig::load_default();
    let model = crate::core::model_inject::resolve_pm_model(&config, None);
    let pricing = trusty_common::inference::pricing(&model)?;
    Some((model, pricing.input))
}

#[cfg(test)]
#[path = "savings_instructions_tests.rs"]
mod tests;