feat(campaign): machine-wide always-loaded token roll-up — pure layer (v5.9 B2a)

Extend the campaign ledger with a machine-wide always-loaded token bill, the
pure data-model + aggregation half of B2. Deliberately does NOT do live I/O:
the cross-repo readActiveConfig sweep that populates real numbers is B2b.

Design — shared layer counted ONCE, structurally:
- Ledger root gets an optional `sharedGlobal` summary (the always-loaded layer
  paid in every repo: global CLAUDE.md + agent listing + global MCP + unscoped
  global rules + active plugins' always components), stored ONCE via the new
  setSharedGlobal().
- Each repo entry gets an optional `tokens` summary (its PER-REPO delta only),
  set via the new setRepoTokens(); addRepo now seeds `tokens: null` (mirrors
  findingsBySeverity).
- rollUp() stays PURE and gains a `tokens` aggregate: machineWide = sharedGlobal
  + Σ(per-repo deltas), so the shared layer is counted exactly once by
  construction — the structural guard against the historic double-count bug.
  Plus a `byRepo` table ranked DESC by always-loaded cost ("most expensive
  repos") with a deterministic name tie-break.

Summary shape mirrors manifest's summarizeByLoadPattern exactly
({always|onDemand|external|unknown: {tokens,count}}) so B2b wires in trivially.

Keeps rollUp pure (no filesystem I/O) → byte-stable, respects the THIN campaign
motor invariant. Chosen over the plan's literal "run readActiveConfig inside
rollUp" which would break both (operator-approved deviation).

- 8 new ledger tests incl. the counted-once regression guard + byRepo ranking.
- Updated addRepo shape test (+tokens:null) and campaign-cli EMPTY_ROLLUP.
- No frozen snapshot affected (campaign is v5.7, absent from v5.0.0 baselines).
  Suite green: 1189 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scanners/lib/campaign-ledger.mjs

@@ -88,6 +88,7 @@ export function addRepo(ledger, { path, name } = {}, { now } = {}) {
     status: 'pending',
     sessionId: null,
     findingsBySeverity: null,
+    tokens: null,
     updatedDate: now,
   };
   return { ...ledger, updatedDate: now, repos: [...ledger.repos, repo] };
@@ -119,17 +120,76 @@ export function setRepoStatus(ledger, path, status, { now, findingsBySeverity, s
   return { ...ledger, updatedDate: now, repos };
 }
 
+/** Load-pattern buckets carried by a token summary (manifest `summarizeByLoadPattern` shape). */
+const LOAD_PATTERNS = Object.freeze(['always', 'onDemand', 'external', 'unknown']);
+
 /**
- * Machine-wide roll-up: repo counts by status, plus a severity total aggregated across every
- * repo that carries `findingsBySeverity`. Pure derivation — never mutates.
+ * Set the machine-wide SHARED global always-loaded layer (global CLAUDE.md + agent listing +
+ * global MCP + unscoped global rules + active plugins' always-loaded components). Stored ONCE
+ * at the ledger root — never per repo — so the machine-wide roll-up counts it exactly once
+ * (the structural guard against the historic double-count). The `summary` is the shape
+ * manifest's `summarizeByLoadPattern` emits: `{always|onDemand|external|unknown: {tokens,count}}`.
+ * Returns a NEW ledger. (B2b populates this from a live cross-repo sweep.)
  * @param {object} ledger
- * @returns {{totalRepos:number, byStatus:object, bySeverity:object, reposWithFindings:number}}
+ * @param {object} summary
+ * @param {{now: string}} opts
+ */
+export function setSharedGlobal(ledger, summary, { now } = {}) {
+  requireNow(now);
+  return { ...ledger, updatedDate: now, sharedGlobal: summary };
+}
+
+/**
+ * Attach a tracked repo's PER-REPO always-loaded token delta (its project-scoped contribution
+ * beyond the shared global layer — project CLAUDE.md / rules / agents / MCP). Same `summary`
+ * shape as `setSharedGlobal`. Mirrors `setRepoStatus`: throws if the repo is untracked. Returns
+ * a NEW ledger.
+ * @param {object} ledger
+ * @param {string} path
+ * @param {object} tokens
+ * @param {{now: string}} opts
+ */
+export function setRepoTokens(ledger, path, tokens, { now } = {}) {
+  requireNow(now);
+  const resolved = normalizePath(path);
+  const idx = ledger.repos.findIndex((r) => r.path === resolved);
+  if (idx === -1) {
+    throw new Error(`repo "${resolved}" is not in the ledger — addRepo first`);
+  }
+  const repos = ledger.repos.slice();
+  repos[idx] = { ...ledger.repos[idx], tokens, updatedDate: now };
+  return { ...ledger, updatedDate: now, repos };
+}
+
+/** Tolerantly read the four load-pattern token numbers from a stored summary (or null/old data). */
+function bucketTokens(summary) {
+  const out = {};
+  for (const k of LOAD_PATTERNS) {
+    const v = summary && summary[k];
+    out[k] = v && typeof v.tokens === 'number' ? v.tokens : 0;
+  }
+  return out;
+}
+
+/**
+ * Machine-wide roll-up: repo counts by status, a severity total across every repo carrying
+ * `findingsBySeverity`, AND a machine-wide always-loaded token bill. The token aggregate adds
+ * the SHARED global layer (counted once, from the ledger root) to the SUM of per-repo deltas,
+ * so `tokens.machineWide` is the honest "context spent every turn across the whole machine".
+ * Pure derivation — never mutates; tolerant of old ledgers without token fields.
+ * @param {object} ledger
+ * @returns {{totalRepos:number, byStatus:object, bySeverity:object, reposWithFindings:number, tokens:object}}
  */
 export function rollUp(ledger) {
   const byStatus = Object.fromEntries(STATUSES.map((s) => [s, 0]));
   const bySeverity = Object.fromEntries(SEVERITIES.map((s) => [s, 0]));
   let reposWithFindings = 0;
 
+  const sharedGlobal = bucketTokens(ledger.sharedGlobal);
+  const perRepoDelta = Object.fromEntries(LOAD_PATTERNS.map((k) => [k, 0]));
+  const byRepo = [];
+  let reposWithTokens = 0;
+
   for (const repo of ledger.repos) {
     if (byStatus[repo.status] !== undefined) byStatus[repo.status] += 1;
     const f = repo.findingsBySeverity;
@@ -139,8 +199,28 @@ export function rollUp(ledger) {
         if (typeof f[sev] === 'number') bySeverity[sev] += f[sev];
       }
     }
+    if (repo.tokens && typeof repo.tokens === 'object') {
+      reposWithTokens += 1;
+      const b = bucketTokens(repo.tokens);
+      for (const k of LOAD_PATTERNS) perRepoDelta[k] += b[k];
+      byRepo.push({ name: repo.name, path: repo.path, always: b.always, onDemand: b.onDemand, external: b.external });
+    }
   }
-  return { totalRepos: ledger.repos.length, byStatus, bySeverity, reposWithFindings };
+
+  // DESC by always-loaded cost ("most expensive repos"); deterministic name tie-break.
+  byRepo.sort((x, y) => y.always - x.always || x.name.localeCompare(y.name));
+
+  const machineWide = Object.fromEntries(
+    LOAD_PATTERNS.map((k) => [k, sharedGlobal[k] + perRepoDelta[k]]),
+  );
+
+  return {
+    totalRepos: ledger.repos.length,
+    byStatus,
+    bySeverity,
+    reposWithFindings,
+    tokens: { sharedGlobal, perRepoDelta, machineWide, reposWithTokens, byRepo },
+  };
 }
 
 /**