Greptile Summary

This PR fixes a bug where files skipped by the session byte-budget cap were never recorded in state.snapshot, causing every subsequent capture_changes call to re-detect them as new, re-read their bytes from the VM, and re-emit the over-budget warning. The fix is a single state.snapshot.insert(path.clone(), *hash) before the continue in the budget-skip path.

• Production fix (container_session.rs line 734): advances the snapshot to the skipped file's current hash so future captures treat it as "accounted for" and only re-process it when its content actually changes.
• New test over_budget_file_advances_snapshot_and_is_not_reread: covers three scenarios — initial over-budget detection, no re-read on a second capture with unchanged content, and confirmed re-read when the file's content changes — using a purpose-built FakeSession / FakeSessionProxy pair that counts VM reads per path and selectively answers only the sha256sum listing command.

Confidence Score: 5/5

Safe to merge — the change is a single-line snapshot update that closes a well-understood re-read loop, and the byte-accounting invariants (bytes_total, captured, snapshot) remain consistent across all edge cases.

The production change is minimal and targeted: one insert before an existing continue. Tracing through previously-captured files that later grow over budget, brand-new over-budget files, and subsequent deletions all show correct byte-total accounting. The accompanying test covers the three critical scenarios (initial skip, no re-read on unchanged content, re-read on content change), and the FakeSession correctly guards against a future second exec call being mis-parsed as a listing.

No files require special attention.

Important Files Changed

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into fix/container-s..." | Re-trigger Greptile}

@greptile-apps