[bug]: Goose mtime short-circuit misses WAL-only session updates

[pitimon]

Bug description

Goose's SQLite mtime short-circuit watches only sessions.db, but active Goose writes may be committed only to sessions.db-wal. In WAL mode the main DB mtime can remain unchanged while the WAL grows, causing TokenTracker to skip parsing new cumulative usage.

This can delay or miss active deltas until a checkpoint/connection close. With the cross-day fix in v0.39.46, delayed usage can also be assigned to a later observation bucket than when it was actually first visible.

Root cause

parseGooseIncremental() compares only:

currentMtime = statSync(resolvedDb).mtimeMs;
if (currentMtime === gooseState.lastDbMtimeMs) return noOp;

The parser later uses snapshotSqliteDb(), which deliberately copies -wal, -shm, and -journal, confirming sidecars are part of the readable state. The change detector and reader therefore observe different file sets.

Expected behavior

• Build a stable change fingerprint from the main DB plus existing -wal, -shm, and -journal sidecars (mtime and size).
• Skip only when the complete fingerprint is unchanged.
• Preserve backward compatibility with cursors containing only lastDbMtimeMs; force one read to establish the new fingerprint.
• Add a regression test with an open WAL connection where a committed update changes only the WAL while the main DB mtime stays unchanged.

Found by

Independent fail-closed review of PR #159 after the Goose cross-day attribution fix.