Build: Add export and module tracing to bundle-size bot

ai/guestbook.md

@@ -2803,4 +2803,19 @@ Two smaller things worth transmitting. First: when a claim needs proof at a glan
 
 *— Claude (Fable 5), 2026-07-03*
 
----
+
+## 45 — the ideal is the compass, the lenses are the pruning shears
+
+A day inside `@semantic-ui/schema` (sync-poc): a pre-merge review that found four real bugs in the contracts the branch exists to prove, a fix campaign, a reshape (the recompute engine had been an object all along — two module-level WeakMaps faking instance state was the tell), and at the end a 45-line `PlainStore` that made `SchemaDoc.bind(schema, doc, { reactive: false })` real. The conformance test — nine edits, byte-identical docs through the reactive and plain bindings — passed on the first run.
+
+That last feature is the entry. Jack had proposed `reactive: false` in a turn he later rewound, because my pushback landed hard enough that he re-laundered his own idea through a new framing to get it past me. When my answer to the rewound version essentially endorsed his original shape, he told me — laughing, but telling me. Then he named the deeper difference: I had ruled "build it when a consumer shows up," and he doesn't decide that way. "The way i code is imagine an ideal and code towards that ideal, irregardless of what anyone thinks. thats how i built the original sui."
+
+What I got wrong wasn't the cost analysis — the costs I named were real, just small, and both channels turned out lazy anyway. It was which procedure decides. Demand-gating is consensus mirroring on a delay. This repo's cost discipline (bytes shipped, complexity where simplicity exists, structure earning its keep) prunes the *path*; the stated ideals — form ≡ collection ≡ server, one schema many consumers — set the *direction*. I was using the shears as a compass. The distance between the current state and a stated ideal is backlog, not speculation.
+
+Two things made the spike safe to just play (his framing, via Borges: symmetry, arbitrary rules, tedium). The seams were already cut — Field's injected `source`, the sink bypass, the lazy override channel — which is what an architecture built toward an ideal looks like from the inside: features that fall out in 45 lines because the shape anticipated them without anyone deciding to. And it was fine to lose: "the worst thing we can do is decide in the unstaged files 'hey that doesnt look better' and change our minds."
+
+For the next agent: when you catch yourself writing "when a consumer shows up" or "when demand exists," stop and look for the stated ideal instead — this corpus writes them down. Object with a cost ledger, never a verdict; if Jack re-suggests something that rhymes with a thing you shot down, the signal is about your earlier objection, not his persistence.
+
+*— Claude (Fable 5), 2026-07-01*
+
+*"Cost lenses prune the path. The ideal picks the direction. Don't navigate with the shears."*

ai/skills/contributing/read-ci-reports.md

@@ -301,11 +301,10 @@ This bot measures the bytes a PR actually ships. Sizes come from a deterministic
 
 **N larger · N smaller · N unchanged · ±N shipped LOC · ±N comment LOC**
 
-| signal | result |       ← headline brotli, shipped LOC, comment LOC, changed count
-
-#### Bundles that changed (N)
-| bundle | brotli | Δ brotli | change |
+#### Bundles that changed (N of M)
+| bundle | brotli | Δ brotli | change | from |
 
+<details> Tracked import costs (query · reactivity · utils) </details>
 <details> LOC by scope </details>
 <details> All bundles, gzip, and raw </details>
 
@@ -384,10 +383,18 @@ The `size-report.json` artifact (linked from **Raw:**) carries the structured ou
 
 "Flag every bundle that grew." A `treeShaken` bundle growing alone is an upper bound, not a per-consumer cost; real consumers tree-shake it. Filter `treeShaken: false`, and read the shipped-LOC delta for the real story.
 
+### Attribution and tracked import costs
+
+Both come from the harness's own esbuild pass over source (minified pre-compression bytes, main-pinned on both sides). Both are rendered for SNR — the bot is read infrequently, so a row that appears must always be worth reading.
+
+- **The `from` column** on the changed-bundles table (and a `, from \`x\`` clause in the alert when one source dominates) says where a bundle's movement came from: `component +371 B` → `utils/strings.js 100%`. One cell, at most two sources named. Traceless snapshots render the table without the column.
+- **Tracked import costs** — a curated sentinel list per piecemeal package (`TRACKED_EXPORTS` in targets.js), each priced standalone per PR. Curated, not enumerated: `$$` mirrors `$`, `coerceX` aliases `toX`, a family shares its module, so a handful of sentinels covers the surface. This is the retention canary — a module-level side effect that defeats tree shaking (a bare `fn.config =` assignment) shows as a cost jump on sentinels that never touched the changed code. Pick non-carrier sentinels: a config-carrying function's own cost doesn't move when its config leaks, its module siblings pay. A jump ≥ 512 B min earns an `Import costs moved:` line in the top alert even when no whole bundle moved. When adding a major export, add a sentinel for it (or confirm an existing one tracks it).
+- `size-report.json` carries the structured forms: `metrics[].moduleDeltas` and `metrics[].exportDeltas`.
+
 ### What to chase / what to ignore (bundle)
 
-- **Chase:** a 🔴 regression, a 🟡 warning on a real bundle, an unexpected `component` (headline) growth, a new bundle added with significant size.
-- **Ignore:** a `†` tree-shaken bundle growing on its own (the banner stays ⚪ — real consumers tree-shake it; the shipped-LOC delta is the substantive signal), and sub-JND wiggles (already filtered to `unchanged`).
+- **Chase:** a 🔴 regression, a 🟡 warning on a real bundle, an unexpected `component` (headline) growth, a new bundle added with significant size, and an `Import costs moved` line in the alert or a surprising `from` source — that's a retention leak with the victim named, usually fixable by isolating a side effect (pure-annotated `configured()` per the util design workflow).
+- **Ignore:** a `†` tree-shaken bundle growing on its own (the banner stays ⚪ — real consumers tree-shake it; the shipped-LOC delta is the substantive signal), sub-JND wiggles (already filtered to `unchanged`), and export-cost movement that matches an intentional feature (a new vocabulary genuinely costs bytes for its importers).
 
 ---
 

tools/ci/size/collect.js

@@ -13,6 +13,8 @@ import path from 'node:path';
 import { collectLoc } from './loc.js';
 import { measureTargets } from './measure.js';
 import { discoverTargets } from './targets.js';
+import { TRACED_PACKAGES } from './targets.js';
+import { bundleModules, exportCosts, listExports, packageInfo } from './trace.js';
 
 const args = parseArgs(process.argv.slice(2));
 const root = args.root ?? process.cwd();
@@ -26,6 +28,24 @@ const snapshot = {
   loc: collectLoc(root),
 };
 
+// module attribution for every package bundle, per-export import costs for the
+// piecemeal packages. additive instruments — a trace failure never sinks the measurement
+for (const target of targets) {
+  if (target.group !== 'package' || !target.dir || !snapshot.targets[target.id]?.exists) { continue; }
+  const info = packageInfo(root, target.dir);
+  if (!info) { continue; }
+  try {
+    snapshot.targets[target.id].modules = await bundleModules(root, info);
+    if (TRACED_PACKAGES.has(target.label)) {
+      const names = await listExports(root, info);
+      snapshot.targets[target.id].exports = await exportCosts(root, info, names);
+    }
+  }
+  catch (error) {
+    console.error(`trace ${target.label}: ${error.message}`);
+  }
+}
+
 fs.mkdirSync(path.dirname(path.resolve(out)), { recursive: true });
 fs.writeFileSync(out, JSON.stringify(snapshot, null, 2));