sessions: attribute PR spend per turn instead of per session

[iamtoruk]

Problem

The "Spend by pull request" surfaces (CLI codeburn sessions --by-pr, the pullRequests payload, and the desktop PR tab) attributed spend by reference: a session counted its full cost toward every PR it referenced. One long orchestration session that touched many PRs rendered a wall of identical rows (same full-session cost, same call count on every PR), which is useless for seeing where money actually went.

Core change: per-turn attribution

Attribution is now per turn. During transcript parsing, PR references are captured per turn (prRefs on the cached turn shape), reusing the existing pr-link extraction; the session-level prLinks stays the union. A pure, unit-tested state machine (attributeSessionPrSpend) walks a session's turns in order, carrying currentPrSet = the PR set of the most recent turn that referenced any PR. Each turn's cost/calls are attributed to that set, split evenly across a multi-PR merge-sweep turn. Turns before the first reference form an unattributed bucket. Rows are now summable; the CLI and app footers report the attributed sum plus the unattributed remainder.

A session whose transcript expired before per-turn capture keeps its session-level prLinks but has no per-turn refs; it falls back to an even whole-session split, flagged approx (~ prefix + tooltip).

Range inclusion still keys a turn on its first call timestamp; that is the pre-existing boundary model for date filtering, unchanged by this PR.

Review fixes folded into this PR

• Cache migration. The session-cache version bump now adopts the prior version's expired-source PR entries instead of abandoning them, and the claude scan preserves and surfaces PR-bearing orphans, so a PR-linked session whose transcript was later deleted still appears (as a legacy even-split) rather than vanishing. The durable daily cache is not touched; the recent-window daily backfill uses a primary-wins merge, so surfacing orphans cannot double-count history.
• Date-range carry. The parser captures the PR set active at the start of the in-range turn slice and seeds the state machine with it, mirroring the existing branch carry-forward. A PR referenced before the window now owns its later, in-range, ref-less turns instead of the session collapsing to a whole-session approx split.
• Top-N honesty. The payload caps rows at the top 20 but reports the attributed total for all PRs; it now also sends the count and cost of the capped-away PRs, and the app renders an "Other (N more PRs)" row so the visible table reconciles to the total.
• Old-payload compatibility. A desktop build reading a payload from an older CLI (by-reference rows, no attributed/unattributed fields) keeps the old non-summable footer wording and never renders NaN.
• Whole call counts. A multi-PR turn splits its calls by largest-remainder, so per-PR counts stay integral (a 1-call, 2-PR turn no longer shows as 2 calls).
• Footer reconciliation. The CLI and app footers sum the rounded row values actually shown, so the visible column adds up to the stated total.
• Session identity. Distinct-session counts key on project + sessionId, not sessionId alone.

Second-round review follow-ups

• Mixed legacy/live rows reconcile. A PR row combining an expired-legacy contribution (even-split, no turn data) with a live per-turn contribution now emits an explicit "Legacy estimate (no per-turn detail)" category carrying the legacy share, so the expansion always sums to the row cost instead of silently dropping the legacy portion. A legacy-only row still shows no breakdown.
• Per-file v5 adoption. The version-bump adoption validates each cached file individually, so one malformed entry is skipped rather than rejecting the whole prior cache and dropping every valid expired PR session with it.
• Other row is a summary line. The desktop "Other (N more PRs)" line moved to the table footer as a muted, separated summary rather than a sorted row (its aggregate cost can exceed a visible row).
• Expansion state is not stale. Row expansion resets whenever the PR set changes (period, provider, or a refresh that alters the list).
• Bounded model lists. Payload models per row are capped to the top 4 by attributed cost with a name-ascending tie-break; categories get the same stable tie-break.

New surfaces: models and categories

Each PR contribution records the models of its calls and the turn's task category (split by the same share on a multi-PR turn); legacy even-split rows carry the model union but no category breakdown (none can be honestly assigned). Payload rows gain models (short names, cost-desc) and categories (label + cost, cost-desc, omitted when empty). The CLI --by-pr gains a Models column. The desktop table is now full-width with a Models column and click-to-expand rows showing a per-category cost breakdown with proportional bars, keyboard accessible, with the PR link still opening independently.

Validation

Unit and integration tests cover the state machine (interleaved parallel PRs, multi-ref split, pre-reference overhead, range-carry seed, legacy fallback, largest-remainder calls, project+sessionId dedup, models and categories), the prRefs round-trip through the real incremental-append path (continuation merge and straddle fallback), the version-bump adoption of an expired PR session, the payload round-trip, and the desktop expansion / models / old-payload cases. Root suite, app suite, and tsc are green.

Real-data drive on a frozen snapshot of a heavy orchestration session that shipped roughly thirty PRs, comparing the old and new engines from the same transcripts:

• Old engine: every PR row showed the identical full-session cost and call count (the bug).
• New engine, full-session range: distinct per-PR rows whose attributed sum plus the unattributed remainder equals the old distinct-session total to the cent, with the Models column populated.
• New engine, a "today" range that starts mid-session: the old engine collapsed to a wall of identical rows again, while the new engine showed only the PRs actually carried into the window with their true split, proving the date-range carry fix.
• The per-session sum invariant (attributed + unattributed = session total) held exactly, and category breakdowns matched the shape of the work (implementation PRs skewed to coding, a fix PR skewed to debugging).