fix: parse bare-today headline in aggregate mode

.gitignore

@@ -29,6 +29,7 @@ docs/superpowers/
 
 # Debug / logs
 *.log
+*.heapsnapshot
 npm-debug.log*
 
 # Cache

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Fixed
+- **Ranged commands decode cache shards incrementally instead of assembling whole multi-hundred-megabyte files.** Session month shards now decode one turn at a time and keep only in-range turns (with the exact same kept/dropped/carry contract as before, verified by the range-filter suite, including a 30k-turn record test); shard loads run serially and the pre-lock snapshot is released before the canonical reload instead of overlapping it. All retained strings are detached from tokenizer buffers (sliced views pinned whole input chunks: ~1.2GB unexplained heap on this corpus). Shards at or under 256MB skip the streaming walk and decode with plain JSON.parse through the same per-record projection (byte-identical results, pinned by the size-gate parity suite): 166MB of shards in 333ms instead of 15-20s, while the walk still bounds the shard past V8's max string length. Out-of-range turns contribute their raw dedup keys to cross-file suppression markers, and provider-scoped queries skip unrelated sections.
+ - **The codex result cache streams instead of whole-parsing.** The single result file decodes entry by entry (a top-level decode assembled hundreds of megabytes first); discovery labels come from calls-free metadata without loading the calls map; publishes merge dirty entries over the published bytes instead of rewriting from memory; single-flight loads are shared across concurrent readers and retry when a publish lands mid-decode, with a global clear epoch so in-flight loads cannot repopulate a cleared memo.
+- **Cross-file dedup keys are full SHA-256 digests instead of raw strings.** Dropped-key markers and shared dedup sets store 32-character digests (~140MB of raw key characters on the reporter corpus); every insert and lookup hashes uniformly, and a collision would suppress rather than fabricate a call. The set is a plain class (not a Set subclass) so unadapted consumers fail at compile time; Antigravity RPC conversations ride along as paired bare keys since prefix matching cannot work on digests.
+- **The bare-today headline parses in aggregate mode.** `overview -p today` (all-provider, unfiltered) now strips per-call payloads the headline never reads (tool sequences, dedup keys, per-call paths, name arrays; shell commands are extracted first for PR launch matching) per provider right after parsing, so peak tracks one provider instead of the corpus. The strip is a denylist, so future fields stay populated. Totals, days, models, categories, tools, and the rendered text are byte-identical to the full parse (proven by the lite-parity suite). The shared parse memo is bypassed in both directions so stripped graphs never mix with full-session consumers.
+
 ### Fixed (desktop)
 - **The Models table shows every model that ran, including the ones under a cent.** The CLI's `models` command defaults `minCost` to $0.01, and the desktop bridge passed neither `--min-cost` nor `--unpriced`, so the table silently dropped every row below a cent — which by construction excluded every unpriced row too (a `0 >= 0.01` filter), leaving #1443's dimming and add-alias affordances unreachable in the shipped app. `codeburn:getModels` now passes `--min-cost 0` (and the demo bridge mirrors it), so sub-cent and unpriced rows arrive and render with their existing dim treatment; on a real lifetime corpus that recovers 10 rows and 2,160 calls the default filter hid (43 → 53 rows, verified in both themes). A row priced between $0.00 and $0.01 renders as "$0.00" without dimming — it is genuinely priced, just below the display floor. Fixes #1465.
 - **Packaging no longer aborts on a checkout whose path contains a UUID.** `app/scripts/stage-cli.mjs` resolved the CLI's production dependency closure by matching each `npm ls --parseable` line against the checkout's absolute `<root>/node_modules/` prefix, and npm 11 and later redact UUID-shaped path segments to `***` in that output — so on CI runners and scratch worktrees under a UUID directory the match found nothing and packaging died with the misleading "is the root npm installed?". The top-level package name is now read by position (after the N-th `/node_modules` occurrence, N counted off the real root path, which the redaction cannot move) instead of by absolute-prefix match, so redacted, Windows-separated and nested-checkout shapes all resolve; a missing `npm_execpath` also fails with its own message instead of degrading into the empty-closure one. Fixes #1466.

package.json

@@ -66,6 +66,7 @@
     "ink": "^7.0.0",
     "react": "^19.2.5",
     "selfsigned": "^5.5.0",
+    "stream-json": "^3.6.0",
     "strip-ansi": "^7.2.0",
     "undici": "^7.27.2",
     "zod": "^3.25.76"