Issue #2 — lifetime always >= session
ctx-stats lifetime line and bottom-line footer now combine disk-
aggregated lifetime (events * 256 tokens) with the current session's
in-memory token savings at the render edge. Two separate accounting
pipelines (server bytes vs hook session_events) get unified so a
fresh user / pre-flush session / pre-b8e11bf v1.0.103 sidecar no
longer surfaces the surprising "$X this session . $0.00 lifetime".

Issue #3 — replace engineer-speak with value-forward copy
The "MCP concurrency usage: mcp__context_mode__ctx_batch_execute
median=3 max=5 (43 calls)" block becomes:

  Parallel I/O  v one call did the work of many - faster runs,
  lower bill, same answer.
    ctx_batch_execute  43 batches . 3 typical, 5 peak

Internal mcp__*__ namespace stripped via non-greedy regex. Section
suppressed entirely when max_concurrency<=1 (no false parallelism
claim, no journalist-screenshot embarrassment).

Renders identically across all 14 adapters via formatReport().
Display-only - zero OS / runtime impact. Bundles auto-rebuild on
main push (CI), do not hand-edit *.bundle.mjs.

Tests: tests/analytics/format-report.test.ts +5 cases (3 monotonic,
2 copy/suppression). 50/50 analytics green. typecheck clean.

Add pure, ABI-bound classifiers that derive per-event metadata from
PostToolUse hook stdin so the bridge can ship full seed-shape parity
with the platform dashboard:

  * classifyError    -> {error_category, error_tool}; 10 categories
                       match seed.ts pickErrorClassification exactly
  * classifyCommand  -> {command_type, command_tool} for Bash calls
  * bucketizeDuration -> fast/medium/slow/timeout bucket on latency_ms

Per the OSS handoff (ANOMALY #3) these columns are not read by the
ingestion engine, but populating them keeps the dashboard rendering
symmetrically with seed and unblocks the bridge's column-parity work.

Tests: 34/34 GREEN. Pattern matrix covers one case per error category,
eight command buckets, four duration buckets, plus null/undefined/
empty-string and tokeniser edge cases (env-var prefix, sudo wrapper).

PRD-context-as-a-service §5 ABI parity.

…e anchor

Closes the final 11 starved columns to reach seed-shape ABI completeness.
Bridge envelope stays a dumb pipe; enrichment is purely upstream.

SESSION_START LIFECYCLE
- hooks/sessionstart.mjs now emits a canonical `{ type: 'session_start',
  category: 'session_start' }` event on every source transition (startup,
  resume, compact). The platform engine's `COUNT(DISTINCT CASE WHEN
  category='session_start' ...)` aggregate had no rows to count for v1.0.158
  forward — orphaning ~60 session-window patterns. Lifecycle anchor lands
  before db.close in each source branch so the rollup snapshot at that
  point is the first-row baseline.
- Cross-platform projectDir resolution: replaces hardcoded
  process.env.CLAUDE_PROJECT_DIR with getInputProjectDir(input) so all 14
  adapters resolve correctly (cursor's workspace_roots, codex/gemini/qwen's
  *_PROJECT_DIR env vars, input.cwd universal fallback).

BASH METADATA — ALGORITHMIC, NOT ENUMERATED
- command_tool: runner-aware extraction. Strips env assignments
  (NODE_ENV=test ...) and command runners (sudo / env / npx / pnpm / bunx /
  yarn — with subcommand strip for `pnpm exec`, `bun run`). Returns the
  basename of the executable, so /usr/local/bin/pytest and
  pnpm exec pytest both yield "pytest".
- command_type: 4-tier priority — (1) CANONICAL_TOOLS map for tools whose
  NAME implies type (pytest→test, eslint→lint, terraform→deploy — ~50
  curated entries covering dominant ecosystem invocations); (2) canonical
  verb scan at subcommand positions (npm test, cargo build) using
  CANONICAL_VERBS set (~13 verbs covering all ecosystems); (3) argument
  shape heuristics (tests/, .test.ts suffix, --prod flag, Dockerfile);
  (4) bare tool fallback (git→git, make→build); (5) "other". Original
  static regex enumeration replaced — it never converges across the long
  tail of CLI tools.
- exit_code: tool_response inspection. Captures explicit "exit status N"
  markers, "command not found" (→127), and line-anchored Error/Traceback/
  FAIL patterns. Soft signal per Anomaly #3 — engine doesn't read it but
  the column populates for seed-shape parity.
- duration_bucket: <5s / 5-30s / 30s+ buckets derived from latency_ms.

LATENCY — REUSES EXISTING PRETOOLUSE MARKER
- session-loaders reads `${tmpdir}/context-mode-latency-${sessionId}-
  ${toolName}.txt` (already written by pretooluse.mjs:177). Does NOT
  unlink — posttooluse.mjs:128-152 manages the lifecycle and emits its
  own slow-tool event downstream. Sanity-bounded delta (0 ≤ ms ≤ 86400000).

BLOCKER_STATUS — STRUCTURAL, NOT LEXICAL
- Derived from canonical event type, not regex on error_message:
  type='blocker' → "open"; type='blocker_resolved' → "resolved".
  session-extract already identifies blocker states semantically — we
  surface that classification rather than re-detecting via prose patterns
  (millions of error texts in the wild make any regex set lossy).

TESTS
- tests/integration/seed-parity-coverage.test.ts adds three suites:
  Bash metadata derivation (NODE_ENV=test pnpm exec pytest tests/
  → command_tool=pytest, command_type=test, exit_code=1), blocker_status
  event-type routing, latency_ms via PreToolUse marker. 7/7 green.
- Full hooks+session+integration regression: 1198 pass, 5 skipped, 1
  pre-existing failure (project-dir-strict — stale, unrelated).

NO ABI BREAK
- platform-bridge.mjs body unchanged: `{...ev, platform, ts}` (PRD §5.4).
- All new fields ride the envelope passthrough — server-side Zod accepts
  them per b3b98cc / ca44835 / extended schemas on platform main.
- Bridge stays a dumb pipe. Enrichment is purely upstream of maybeForward.

Refs PRD-context-as-a-service §5.2 §5.4, ADR-0001 schema parity,
docs/oss-handoff.txt Anomalies #2 + #3 closed.

Closes Issue #3 in v1.0.162 PRD — Claude Code Bug #15660 fallback.
Programmatic EnterPlanMode tool calls fire PostToolUse, but the /plan
slash command and Shift+Tab do not. Result: ~60-80% of real plan-mode
entries invisible in telemetry.

This patch wires an algorithmic slash detector into extractUserEvents
so /plan invocations from UserPromptSubmit emit a plan_enter event.
Shift+Tab remains unrecoverable without an upstream SDK change.

src/session/extract.ts:1591 — wires extractUserPlan into extractUserEvents
src/session/extract.ts:1607-1652 — extractUserPlan algorithmic detector
tests/session/extract-plan-fallback.test.ts — 15 tracers (RED→GREEN)

Algorithmic char-code scan (no regex):
- Skips leading space/tab
- Strict lowercase "/plan" prefix
- Word boundary check (space/tab/LF/CR) so "/plans" does not match
- Truncates argument at 120 chars before stamping data field

Test plan:
- npx vitest run tests/session/extract-plan-fallback.test.ts -> 15/15 GREEN
- Pre-existing project-dir-strict failure unrelated (confirmed via stash)