Avoid repeated cost-poll failures for unreadable session logs #223

Summary

ScanCostTracker remembers some unreadable-session failures but does not mark a session when opening its file fails. An inaccessible session can therefore fail each subsequent poll, including before its thread ID is known and it can be filtered out as unrelated.

Current status

The current cost reader still rethrows non-missing-file open failures without setting the session's unreadable state. Optional cost-tracking isolation in #331 reduced the impact on unbudgeted callers, so the original claim that every otherwise successful unbudgeted scan becomes a failure is no longer accurate.

#970 is an open proposal for permission-denied session files. It does not cover every failure first encountered during the final refresh.

Deterministic reproduction

The original test used the exported ScanCostTracker with a synthetic session file made unreadable using chmod 000; no model request or credentials were needed. Equivalent permission-error injection can make the test independent of the executing user's privileges.

Relevant flow:

if (session.unreadable) return;
try {
  file = await open(path, "r");
} catch (error) {
  if (isMissingFile(error)) return;
  throw error; // no session state records this failure
}

An oversized event, by contrast, sets the unreadable flag before throwing. If opening fails before session_meta is read, the session has no thread ID, so the normal unrelated-thread filtering cannot classify it.

Remaining cases

1. Repeated polling: a known unreadable file should not cause the same open failure on every poll.
2. Budgeted scans: preserve explicit-budget behavior and clearly report unavailable accounting; do not silently claim complete usage or weaken the cost guard.
3. Final refresh: stop(fallbackUsage) awaits refresh before using its fallback. A first failure at that point can still prevent the caller's available usage from being used as intended.

Regression coverage should distinguish optional tracking, explicit budgets, unrelated sessions, and a failure first appearing at finalization. Directory-enumeration permission errors have a related but separate lifecycle and were not part of the original file-level fix.