Session JSONLs are rewritten on resume/compact — historical usage numbers silently drift (repro + field data)

While building a routing audit over my own 34 days of Claude Code usage (~26k messages backfilled), I found that resume/compact rewrites session JSONL files: between two scans of the same file, 5 assistant messages vanished and the file mtime bumped. Any tool that recomputes usage by re-reading live session files (mine did too, initially) will show drifting historical numbers.

Minimal repro: snapshot a long session's JSONL → resume the session and let it compact → diff message uuids.

My mitigation was an append-only ingest log keyed by message uuid (numbers frozen at first sight). Write-up with data: https://dev.to/lizhuojunx86/a-missing-model-line-was-half-my-ai-agent-overspend-auditing-34-days-of-multi-model-claude-code-mc7

Curious: have your users reported "yesterday's total changed" style drift? Happy to share the repro data.