cctally 1.100.0 → 1.101.0

package/CHANGELOG.md

@@ -5,6 +5,50 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.101.0] - 2026-08-19
+
+### Changed
+- Dashboard refreshes now release their coherent `cache.db` snapshot before constructing provider views, cutting the measured median read hold from 3.40 seconds to 1.04 seconds while preserving the exact published payload (#617).
+- Every dashboard warning state now offers the explanation for its own window. A row in Recent alerts, an alert toast, a warn or over budget block, and a capped forecast each carry a button that opens the surface explaining that warning: a weekly crossing opens the current week, a five-hour crossing opens that block, a calendar-month budget opens that month, a project-budget crossing opens that project's drill-down, and a projected-pace crossing opens the forecast. The window is checked before anything opens — a warning about a week the dashboard is no longer showing states that its window has closed and opens nothing at all, rather than quietly showing you the current week instead. A five-hour block still opens however old it is, as long as the alert recorded which block it was; an alert that recorded no block start says so and opens nothing. On Codex the button says `Open this cycle` rather than `Open this week`, because a Codex quota cycle is what it opens. A project-budget crossing on a machine with more than one account is recorded across all of them, so it states that it cannot be narrowed to one account's projects rather than picking one. Every button is an ordinary control reachable by Tab and activated by Enter or Space, and no keyboard shortcut is claimed (#620).
+- The dashboard's Projects table now writes out what its two percentages mean, under the week selector rather than only in a tooltip — a tooltip never appears on a phone. The `Used pp` column is relabelled `Used pp (sum)` and the caption states that it adds each week's attributed usage percentage across the selected window, so it is a sum of percentage points rather than a share of any one week; the caption also names the denominator of the `Cost share` column as total project spend in that same window. No column is added or removed. On an installation with more than one Claude account, both the Projects panel and the Projects table now also state that accounts are folded into one ranking and that their weekly quota percentages are never added together. That sentence appears on the Claude and All views only, because the Codex view ranks Codex projects and folds no Claude accounts at all (#620).
+- The conversation rail now states that the message count beside each session includes subagent sidechains, so a session whose work was mostly delegated no longer reads as a far longer conversation than it was. The count itself is unchanged (#620).
+- Every alert notification now ends with the command that explains it, scoped to that alert's own provider and window. A weekly crossing offers `cctally percent-breakdown --week-start` for the week that actually crossed, a five-hour crossing offers `cctally five-hour-breakdown --block-start` for that block, a budget crossing offers `cctally budget`, a project-budget crossing offers `cctally project` over that project and those dates, a projected-pace crossing offers `cctally forecast --explain`, and a quota crossing offers `cctally codex quota breakdown --reset-at` for that reset. The line states the provider and both bounds of the window it addresses, so following it re-measures the window the alert fired against rather than whatever window happens to be current. Where the alert did not retain enough to name a window — a projected budget crossing does not record which period it ran on — the line says so and offers nothing, rather than substituting the live window. A five-hour alert whose block has since been purged is treated the same way: the window it fired against is still stated, but no command is offered, because the block detail it would open is gone. A crossing whose window has already closed is treated the same way again, because the two commands that would explain it — `cctally budget` and `cctally forecast` — report only the period and the week that are live when you run them, and neither has a way to select an earlier one. A weekly crossing states the reset instant its subscription week actually runs from, which for almost every account is not midnight; a crossing recorded before cctally kept that instant states its week as two calendar dates with no clock reading, rather than a midnight it never observed. `alerts.log` is unchanged: the next step is part of the message body, not a new field (#620).
+- The warning states of `cctally forecast`, `budget`, `cache-report`, `project` and `diff` now name the command that explains them, in the same line the alerts use. A capped or low-confidence forecast offers `percent-breakdown` for that week; a warn or over budget verdict offers `project` over that vendor's own period, so the Codex block names Codex rather than the default; an anomalous `cache-report` row offers `range-cost` with a per-model breakdown of the same window; a `diff` whose two windows are of different lengths — where the dollars on screen are per-day normalizations — offers `range-cost` for window A's real total; and a `project` run whose cache is missing entries offers `cache-sync` for that provider. Each line states the provider and both bounds of the window it addresses. Healthy output is unchanged, and so is every `--json` payload. Two smaller consequences: the `project` warning about missing entries no longer repeats its remediation inline, because the new line carries it; and the `--until` a suggested command names is the last calendar day the window touches, which on a subscription week anchored to a real reset instant is not the day before the end. The `range-cost` commands suggested by `cache-report` and `diff` name full instants rather than dates, because `range-cost` reads its `-s` / `-e` as points in time and does not extend a bare date to the end of that day (#620).
+- The release preflight's local Linux matrix now provisions its three interpreter lanes from a prebuilt image instead of installing everything three times per cut, and overlaps with the authoritative suite in the release runbook. Running the three lanes at the same time was implemented and measured against fixed thresholds, and it was falsified: it met every resource and wall-clock threshold but produced load-sensitive dashboard and config HTTP failures — eight in one run and three in another, a different set each time — that single-lane runs over the same images did not, so the lanes stay sequential. Provisioning — the apt packages, the generated locale, the checksum-verified Node tarball, the from-source SQLite shell, the Python virtualenv and the frontend dependency tree — is baked into a content-addressed image per interpreter and rebuilt automatically whenever any input that can change it changes, so a stale image cannot enter a release gate and no operator step is added. The image carries a bounded weekly freshness epoch, because the previous gate was not reproducible but ambient-fresh (every lane ran `apt-get update`), and caching without a replacement policy would have frozen that environment indefinitely without ever failing. A failing lane no longer cancels the other two: the loop returned on the first failure, discarding what the other interpreters would have reported and forcing a blind rerun of all three, and it also skipped the HEAD and clean-tree rechecks that exist to stop a changed candidate certifying itself. Lane output streams to the terminal as it is produced, so the suite stays watchable, and is printed again in interpreter order at the end, because the ordered blocks are the release evidence. The gate also bounds its own image store: the weekly freshness epoch means the first cut of each new week mints a fresh three-image set, so after each successful resolve it removes lane images older than the current generation and one retained prior, and the untagged intermediates its two-pass build leaves — reclaiming 8 GB on the maintainer's host at the first run. One clean sequential run over already-resolved images was measured end to end at 73 minutes 16 seconds, which is four to five times the authoritative suite rather than comparable to it; the release runbook now states that figure, and overlapping the two gates costs approximately the matrix. The net effect on a cut is measured rather than estimated: preflight goes from about 92 minutes to about 73, of which the Gate 0 overlap is worth 968 seconds and removing per-lane provisioning about 150 more. That second figure comes from timing a three-image build with the layer cache emptied first — 153.8 seconds, about 51 per interpreter — which is also what a weekly freshness-epoch rebuild costs, in place of the ten to eighteen minutes the design estimated before anything was measured. `--acceptance` adds a measurement mode that retains each lane container so its exit and OOM state can be read, samples memory and `/tmp` every 250 ms, and evaluates fixed thresholds against the aligned sample streams — taking the lane schedule as an explicit input, because three sequential lanes start a lane duration apart and the concurrent start-spread and phase ceilings would refuse a healthy run. That input is checked rather than trusted: the gate derives the schedule from whether the measured lane intervals overlap and refuses to report a verdict when the derivation disagrees with what the driver declares, so a future return to concurrent lanes cannot be evaluated under sequential thresholds (#621).
+- Open dashboard tabs now share one browser update stream, so each server frame is parsed once and distributed to active tabs while hidden tabs still suspend independently (#607).
+- The dashboard now reads provider session and project-window data only from each provider's physical source. The retired duplicate provider members under `All` remain as schema-10 `null` compatibility stubs, but malformed or stale non-null values there can no longer become a second source of truth (#613).
+- Project drill-downs now render the exact provider-native interval queried by the server instead of reconstructing Claude's interval in the browser (#571).
+
+### Fixed
+- Public-test dependency closure now preserves the real directory depth of `Path(__file__)` parent chains, so a public test cannot hide a mirror-private fixture by addressing it relative to `tests/` (#626).
+- Conversation and dashboard verification now fail on missing goldens unless regeneration is explicit, and a failed regeneration write can no longer print success or let the scenario pass (#625).
+- The committed dashboard envelope oracle now verifies identically on macOS and every supported Linux/Python release lane. Its generated store uses resolved filesystem paths for reads and privacy containment while hashing one explicit logical corpus root for opaque identities, and Claude fixture ingestion now has a deterministic lexical file order instead of inheriting APFS or ext4 enumeration order. The oracle therefore keeps asserting the full Codex session metadata and aggregate payload across platforms rather than publishing two different identity universes from the same corpus (#622).
+- Project attribution percentages now describe the subscription week they are rendered against. The dashboard Projects panel measured each project's share of cost over ISO-Monday-midnight weeks while multiplying it by a quota percentage that belongs to your account's real reset cycle, so the numerator, the denominator and the percentage described three different windows. Published `attributed_pct` values change for every account whose weekly reset is not exactly Monday midnight UTC — in practice almost every account — and they change for historical weeks as well as the current one. This is a correction to figures that were previously wrong, not a change of definition. A related consequence: cost that fell between Monday midnight and your real reset instant was previously attributed to the wrong week, and on a reset late in the week it could vanish from the panel entirely (#620).
+- `cctally project --weeks N` now measures exactly the N subscription weeks it names. It resolved the start of its range by stepping back `7 * (N - 1)` days from the current week's start, which is short of the real start by a day for every drifted week inside the range — Anthropic's reset day moves, and a drifted cycle produces a genuinely short week, so over `--weeks 12` the range could begin several days inside the week before the one you asked for. That gap was not empty. Cost recorded in it was added to the reported total and attributed across whichever projects were active there; the earlier week's entire quota percentage was added to `Used %`, so the command reported N+1 weeks of quota against N weeks of spend; and where that earlier interval carried no usage snapshot, the output stated `Used % unavailable for 1 week — no usage snapshots recorded` about a week you had not asked about. `rangeStart`, `weeksInRange` and both totals move as a result, and the `--json` payload carries the corrected values under the same keys. A range given explicitly with `--since` / `--until` is unaffected (#620).
+- `cctally project --account <ref>` now buckets that account's spend against that account's own weekly boundaries, and reports that account's own quota percentage. It previously built the week boundaries and read the percentages across all accounts, so on a machine with two accounts that reset on different weekdays a filtered report measured one account's dollars against a merged window belonging to neither, and could add another account's quota percentage into the total. An invocation without `--account` is unchanged (#620).
+- Five-hour block totals no longer shrink where a block crosses a week boundary. The dashboard Blocks panel discarded the part of a block that fell outside the displayed week, while opening that same block's detail showed all of it, so the panel and its own drilldown disagreed and the panel was always the lower of the two. The panel now reports each block's whole native total (#620).
+- `cctally cache-report` now says which of four evaluation states each row is in, in a new `Eval` column: `anomaly`, `clear`, `partial`, or `not eval`. The terminal previously marked only rows that triggered an anomaly, so an unmarked row could equally mean "every check ran and found nothing", "one check was skipped because the baseline was too thin", or "no check could run at all", and there was no way to tell which. The thin-baseline skip itself has not changed; only its visibility. The same four states already drove the dashboard's Cache Report panel, and the two are now pinned to each other by a shared truth table so they cannot disagree. `--json` is unchanged. One consequence of the extra column: at the default 120-column terminal width the daily table no longer has room for the `Input` column and drops it, which is the same behaviour the by-session table has always had at that width — widen your terminal, or read `--json`, to see both (#620).
+- `cctally forecast` no longer reports a dollars-per-percent rate of exactly $0.00 for a week in which no usage has been observed. With no observed usage there is nothing to divide spend by, so the rate and every dollar figure derived from it — the daily budgets, the shareable report's `$ / 1%` row, and the dashboard's dollars-per-day projections — are now reported as unavailable instead of zero. Percent projections are unaffected, because they never depended on the rate. In `--json` the `dollars_per_percent` key is still present and is `null`, and `dollars_per_percent_source` carries the new value `no_usage_observed` (#620).
+- Shareable weekly, `$ / 1%` trend and forecast artifacts no longer print a measured-looking zero for a figure nothing measured. Three cases are corrected. A week's `$/% rate` on the weekly panel printed `$0.000` when the week carried no usage percentage to divide spend by. A week's `% used` on the weekly and trend panels printed `0.0%` when the week had a cost snapshot but no usage snapshot, which no reader could tell from a week that really used nothing — and on the trend panel that fabricated percentage was multiplied by a real rate, so it published a $0.00 weekly cost as well. The forecast artifact's `Days→90%` and `Days→100%` printed `0.0` when no rate had been observed, which states that you have already reached the ceiling; the truth is that the ceiling is not reachable on any timeline the data describes. All of these now read `n/a`, the same word these artifacts already use for a withheld dollar figure, and a target you genuinely have reached still reports `0.0` days. Artifacts whose figures were all measured are byte-for-byte unchanged (#620).
+- `cctally report --source all` now renders the whole Claude report — the current-week table and the trend table with its `$ / 1%` column — instead of the single line `Data available.` The all-source path read a compatible-totals object the report payload does not carry, so it found nothing to print while `cctally report` on its own printed everything. Both paths now call one renderer, so they cannot diverge again. `cctally project --source all`, `range-cost --source all` and `cache-report --source all` no longer print `Data available.` either: where Claude has rows but no compatible cost or token total, they say so and name the command that shows the full Claude detail (#620).
+- The `cctally report` trend table now marks a week shorter than seven days with `~` in the `#` column, and prints a line explaining the marker whenever at least one row carries it. An early reset ends a cycle before its scheduled boundary, and a `$ / 1%` computed over five days is not directly comparable with one computed over seven; the table previously gave no way to tell the two apart. A row is marked only when its span falls short of seven days by more than an hour, so ordinary reset jitter is never marked, and a table of full weeks is unchanged (#620).
+- `cctally budget` now annotates a low-confidence projection `(LOW CONF — limited evidence)` instead of `(LOW CONF — early in week)`. The condition that raises the annotation is a disjunction — the period is barely elapsed, or nothing has been spent yet — so on a fully elapsed period with no spend the old wording stated something that was simply not true. The condition itself is unchanged; only what it says about itself (#620).
+- `cctally forecast` now writes its low-confidence reasons in plain words rather than printing its internal codes. Where the terminal used to read `LOW CONF — insufficient data (elapsed_hours<24, no_sample_ge_24h)` it now reads `less than 24 hours into the week, no snapshot at least 24 hours old`, wrapped across as many lines as it needs so the panel frame stays intact. All four reasons are covered, an unfamiliar code is printed as-is rather than dropped, and `docs/commands/forecast.md` lists every trigger. `--json` is unchanged: `low_confidence_reasons` still carries the same codes (#620).
+- `cctally project` gains a `Cost Share` column giving each project's percentage of the total cost of the projects listed, with that total and that project count stated in a line under the table — the terminal has no hover, so the denominator is written out. It answers a different question from `Used %`, which is a share of your weekly quota rather than of listed spend. Model rows under `--breakdown` leave it blank, because a model's share of its own project is a different denominator again. One consequence of the extra column: at the default 120-column terminal width the remaining columns are narrower and more headers abbreviate — widen your terminal, or read `--json`, whose payload is unchanged (#620).
+- The dashboard's forecast tile now states when the data behind it is stale, degraded, or limited by what a provider can report. The combined view's provider cards already said so; a single-provider tab drew the projection and said nothing, so the same envelope produced a warning on one tab and silence on another. Both surfaces now render the same status and the same sentence (#620).
+- The dashboard's forecast detail now explains an unavailable `$ / 1%` instead of printing a bare dash, which was indistinguishable from a failure to load. Where no usage has been observed in the window there is no rate to measure, and the panel now says that (#620).
+- The dashboard's `$/1%` sparkline now leaves a gap for a week whose rate was never measured, instead of drawing a bar on the axis. A withheld week previously rendered at the chart's floor, which reads as a measured collapse to nearly zero; the shareable version of the same chart has always omitted such a point. The remaining weeks keep their positions, so the gap sits on the week that is actually missing, and they are no longer scaled against a value nothing measured (#620).
+- A historical week whose exact start and reset were never recorded now says so when you open it, instead of showing a bare date and a dash with no explanation. Its milestones, percentage and progress bar are unaffected and were always correct (#620).
+- The dashboard's week-history list no longer empties itself when one historical week is missing its reset instant. `percent_milestones.week_start_at` is nullable and post-dates the table, so a crossing recorded before that column existed carries only the week's calendar date; where such a week also has no usage snapshot, building the hero modal's week index raised, and the dashboard recorded the failure and published an empty list — so one old row removed every other week from the history at once, and `last_sync_error` was the only sign of it. A week with no recorded boundaries is now listed with its date label and no window, and every other week is listed as before (#620).
+- Codex reports now recognize `gpt-daybreak-blue-latest` as the runtime alias of `gpt-5.6-sol`, so retained Daybreak usage uses the Sol standard and fast rate cards with `isFallback=false` and no unknown-model warning (#606).
+- The pricing-freshness workflow now rewrites or closes only the auto-managed ledger carrying its durable body marker; a manually filed issue can share the `pricing-drift` label without being mistaken for automation-owned state (#606).
+- The dashboard now distinguishes paused, resuming, disconnected, and silent-stream states with accurate copy and wall-clock data age instead of contradictory generic connection guidance (#611).
+- A multi-account `All` view now shows combined spend only when every visible account subtotal and native provider period is server-certified and reconciles; otherwise it explains why the figure is withheld (#565).
+- The authoritative suite now rebuilds the canonical small dashboard corpus and verifies its committed envelope byte count, stable digest, and corpus fingerprint, so a stale envelope oracle fails the gate instead of remaining an unchecked sidecar (#608).
+- Doctor remediation commands now keep each CLI flag intact at 320px instead of wrapping between its leading hyphens and name (#616).
+- All seven dashboard range notes remain visible while consuming less fixed-panel height, restoring room for Recent Alerts on desktop without creating phone overflow (#573).
+- The pre-commit hook now rejects private maintainer identity literals in staged public-mirror blobs before they can enter a commit (#598).
+
 ## [1.100.0] - 2026-08-18
 
 ### Added

package/bin/_cctally_alerts.py

@@ -77,12 +77,15 @@ _alert_text_project_budget = _lib_alerts_payload._alert_text_project_budget
 _alert_text_codex_budget = _lib_alerts_payload._alert_text_codex_budget
 _alert_text_projected = _lib_alerts_payload._alert_text_projected
 _escape_applescript_string = _lib_alerts_payload._escape_applescript_string
+_with_next_step = _lib_alerts_payload._with_next_step
+alert_next_step_line = _lib_alerts_payload.alert_next_step_line
 _build_alert_payload_weekly = _lib_alerts_payload._build_alert_payload_weekly
 _build_alert_payload_five_hour = _lib_alerts_payload._build_alert_payload_five_hour
 _build_alert_payload_budget = _lib_alerts_payload._build_alert_payload_budget
 _build_alert_payload_project_budget = _lib_alerts_payload._build_alert_payload_project_budget
 _build_alert_payload_codex_budget = _lib_alerts_payload._build_alert_payload_codex_budget
 _build_alert_payload_projected = _lib_alerts_payload._build_alert_payload_projected
+synthetic_preview_week_start = _lib_alerts_payload.synthetic_preview_week_start
 
 
 def _build_alert_payload_quota(
@@ -133,7 +136,9 @@ def _alert_text_quota(payload: dict, _tz) -> tuple[str, str, str]:
         body = f"Projected {float(context.get('projected_percent') or 0):.0f}% by reset"
     else:
         body = f"Actual usage {float(context.get('qualifying_percent') or 0):.0f}%"
-    return title, subtitle, body
+    # Seventh axis, same affordance (#620 S1): quota is absent from the
+    # dashboard alert envelope, so the CLI line is the only routing it gets.
+    return title, subtitle, _with_next_step(body, payload, _tz)
 
 # Phase B: severity policy + the cross-platform dispatch kernel. The kernel is
 # pure (parameterized on platform + which_on_path); this module is the I/O glue
@@ -424,10 +429,16 @@ def cmd_alerts_test(args: argparse.Namespace) -> int:
         )
         return 2
     if axis == "weekly":
+        # The preview must carry the reset INSTANT a real crossing carries;
+        # without it the body renders the day-granularity fallback a
+        # pre-column historical row degrades to, which is not what this
+        # command exists to show.
+        preview_week_start = synthetic_preview_week_start()
         payload = _build_alert_payload_weekly(
             threshold=threshold,
             crossed_at_utc=now_utc_iso(),
-            week_start_date=dt.date.today().isoformat(),
+            week_start_date=preview_week_start.date().isoformat(),
+            week_start_at=preview_week_start.isoformat().replace("+00:00", "Z"),
             cumulative_cost_usd=1.23,
             dollars_per_percent=0.01,
         )

package/bin/_cctally_cache.py

@@ -498,7 +498,9 @@ def _iter_claude_jsonl_files():
     ``projects/`` tree. Shared by ``sync_cache`` and the conversation backfill
     so both ingest paths enumerate the IDENTICAL file set."""
     for claude_dir in _get_claude_data_dirs():
-        for jp in (claude_dir / "projects").glob("**/*.jsonl"):
+        for jp in sorted(
+            (claude_dir / "projects").glob("**/*.jsonl"), key=lambda path: str(path)
+        ):
             if jp.is_file():
                 yield jp
 

package/bin/_cctally_cache_report.py

@@ -21,6 +21,8 @@ from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 from _cctally_core import eprint, now_utc_iso, parse_iso_datetime, _command_as_of
 from _lib_fmt import stable_sum
 import _lib_cache_report as crk
+# #620 S1 D11: the one affordance shape every warning state renders.
+import _lib_alert_scope
 
 
 def _cctally():
@@ -130,6 +132,16 @@ def _layout_cache_table(
 
     content_widths = [len(h) for h in headers]
     for cells, _rt in raw_rows:
+        # An over-long row is a caller defect that no padding can repair, and
+        # it is reached here first — `content_widths[i]` would raise a bare
+        # `IndexError`. Report it as the module's own `ValueError`, which
+        # `main()` already handles (#620 S1: a short row is padded in
+        # `make_row`; only the surplus-cell case is refused).
+        if len(cells) > num_cols:
+            raise ValueError(
+                f"cache-report row has {len(cells)} cells, table has "
+                f"{num_cols}"
+            )
         for i, (text, _c) in enumerate(cells):
             content_widths[i] = max(content_widths[i], _max_line_width(text))
 
@@ -299,6 +311,21 @@ def _layout_cache_table(
         return text + " " * pad_needed
 
     def make_row(cells: list[str]) -> str:
+        # #620 S1 D6. A short row used to render silently: `enumerate(cells)`
+        # simply stopped early, so the row closed its border after however
+        # many cells it was given and the table lost a column on that line
+        # alone. That made the "every row type supplies the twelfth cell"
+        # invariant live only in a test.
+        #
+        # The guard pads rather than asserts. A bare `assert` is elided under
+        # `python -O`, which would restore the unclosed border on exactly the
+        # interpreter flag that removes it, and when it does fire it raises an
+        # uncaught `AssertionError` outside the documented exit taxonomy. A
+        # padded row closes its border under every flag. The OVER-long row is
+        # refused earlier, at the column-width scan, because that loop reaches
+        # the surplus cell first.
+        if len(cells) < num_cols:
+            cells = list(cells) + [""] * (num_cols - len(cells))
         parts: list[str] = []
         for i, cell_text in enumerate(cells):
             padded = padcell(cell_text, col_widths[i], aligns[i])
@@ -364,13 +391,37 @@ def _layout_cache_table(
     return "\n".join(lines)
 
 
+def _verdict_cell(row, *, red):
+    """The ``Evaluation`` cell for one data row (#620 S1 D6).
+
+    Both terminal render paths marked ONLY triggered rows, so an unmarked row
+    could mean three different things — evaluated and clean, one predicate
+    skipped, or nothing evaluated at all — and the reader had no way to tell
+    which. The dashboard has distinguished all four since #443 S2; this is the
+    terminal saying the same thing in words.
+
+    The classification itself comes from the shared kernel, never re-derived
+    here. The thin-baseline skip is unchanged: the unmarked tick over it was
+    the defect, not the skip.
+    """
+    verdict = crk.cache_row_verdict(
+        triggered=bool(row.anomaly_triggered),
+        reasons=list(row.anomaly_reasons or []),
+        unevaluated=list(row.anomaly_unevaluated or []),
+    )
+    label = crk.cache_row_verdict_label(verdict.state)
+    # Colour stays on the anomalous state only, matching the row's existing
+    # red treatment; the other three are informational, not warnings.
+    return (label, red if verdict.state == "anomalous" else None)
+
+
 def _render_cache_day_rows(
     rows: list["crk.CacheRow"], title: str, *, compact: bool = False,
 ) -> str:
     """Render daily-mode cache report.
 
     Columns: Date, Models, Cache %, Input, Cache Create, Cache Read,
-    Total Tokens, Cost (USD), $ Saved, $ Wasted, Net $.
+    Total Tokens, Cost (USD), $ Saved, $ Wasted, Net $, Eval.
     """
     c = _cctally()
     color = c._supports_color_stdout()
@@ -394,11 +445,11 @@ def _render_cache_day_rows(
     headers = [
         "Date", "Models", "Cache %", "Input",
         "Cache Create", "Cache Read", "Total Tokens", "Cost (USD)",
-        "$ Saved", "$ Wasted", "Net $",
+        "$ Saved", "$ Wasted", "Net $", "Eval",
     ]
     aligns = [
         "left", "left", "right", "right", "right", "right", "right", "right",
-        "right", "right", "right",
+        "right", "right", "right", "left",
     ]
 
     arrow = "  └─" if unicode_ok else "  |_"
@@ -421,10 +472,11 @@ def _render_cache_day_rows(
             (f"${row.saved_usd:.2f}", None),
             (f"${row.wasted_usd:.2f}", None),
             (f"${row.net_usd:+.2f}", None),
+            _verdict_cell(row, red=_red),
         ]
         # Anomaly visual treatment (data rows only — never breakdown/footer).
         # Cell-index map (daily): 0=Date, 1=Models, 2=Cache%, 3=Input, 4=CC,
-        # 5=CR, 6=Total, 7=Cost, 8=Saved, 9=Wasted, 10=Net $.
+        # 5=CR, 6=Total, 7=Cost, 8=Saved, 9=Wasted, 10=Net $, 11=Evaluation.
         if row.anomaly_triggered:
             first_text, first_style = data_cells[0]
             data_cells[0] = (
@@ -460,6 +512,12 @@ def _render_cache_day_rows(
                 (f"${mb.saved_usd:.2f}", _gray),
                 (f"${mb.wasted_usd:.2f}", _gray),
                 (f"${mb.net_usd:+.2f}", _gray),
+                # The verdict is classified per day, not per model, so a
+                # child row leaves it blank — as the project table's model
+                # rows leave Cost Share blank. The cell is still supplied:
+                # `make_row` pads nothing, so a short row renders one column
+                # narrow and its right border never closes.
+                ("", None),
             ]
             raw_rows.append((bd_cells, ROW_BREAKDOWN))
 
@@ -484,6 +542,10 @@ def _render_cache_day_rows(
         (f"${tot_saved:.2f}", _yellow),
         (f"${tot_wasted:.2f}", _yellow),
         (f"${tot_net:+.2f}", _yellow),
+        # A verdict describes one row's predicate run; there is no such
+        # thing as the total of several, so the footer leaves it blank —
+        # but it must still supply the cell (see the breakdown note above).
+        ("", None),
     ]
     raw_rows.append((footer_cells, ROW_FOOTER))
 
@@ -507,7 +569,7 @@ def _render_cache_session_rows(
 
     Columns: SessionId, Last Activity, Project, Cache %, Input,
     Cache Create, Cache Read, Total Tokens, Cost (USD), $ Saved,
-    $ Wasted, Net $.
+    $ Wasted, Net $, Eval.
 
     ``tz`` is the resolved display zone (None = host local). Last-Activity
     cells are rendered in this zone.
@@ -535,11 +597,13 @@ def _render_cache_session_rows(
         "SessionId", "Last Activity", "Project",
         "Cache %", "Input", "Cache Create", "Cache Read",
         "Total Tokens", "Cost (USD)", "$ Saved", "$ Wasted", "Net $",
+        "Eval",
     ]
     aligns = [
         "left", "left", "left",
         "right", "right", "right", "right",
         "right", "right", "right", "right", "right",
+        "left",
     ]
 
     arrow = "  └─" if unicode_ok else "  |_"
@@ -570,11 +634,12 @@ def _render_cache_session_rows(
             (f"${row.saved_usd:.2f}", None),
             (f"${row.wasted_usd:.2f}", None),
             (f"${row.net_usd:+.2f}", None),
+            _verdict_cell(row, red=_red),
         ]
         # Anomaly visual treatment (data rows only — never breakdown/footer).
         # Cell-index map (session): 0=SessionId, 1=Last Activity, 2=Project,
         # 3=Cache%, 4=Input, 5=CC, 6=CR, 7=Total, 8=Cost, 9=Saved, 10=Wasted,
-        # 11=Net $.
+        # 11=Net $, 12=Evaluation.
         if row.anomaly_triggered:
             first_text, first_style = data_cells[0]
             data_cells[0] = (
@@ -608,6 +673,9 @@ def _render_cache_session_rows(
                 (f"${mb.saved_usd:.2f}", _gray),
                 (f"${mb.wasted_usd:.2f}", _gray),
                 (f"${mb.net_usd:+.2f}", _gray),
+                # Blank for the same reason as the daily table's child rows;
+                # the cell is still supplied because `make_row` pads nothing.
+                ("", None),
             ]
             raw_rows.append((bd_cells, ROW_BREAKDOWN))
 
@@ -634,6 +702,8 @@ def _render_cache_session_rows(
         (f"${tot_saved:.2f}", _yellow),
         (f"${tot_wasted:.2f}", _yellow),
         (f"${tot_net:+.2f}", _yellow),
+        # Blank for the same reason as the daily table's footer.
+        ("", None),
     ]
     raw_rows.append((footer_cells, ROW_FOOTER))
 
@@ -1238,4 +1308,31 @@ def cmd_cache_report(args: argparse.Namespace) -> int:
 
     title = _build_cache_report_title(args, mode)
     print(_render_cache_report_table(rows, title, mode=mode, tz=tz, compact=args.compact))
+    # #620 S1 D11: an anomalous row routes to the command that shows what the
+    # flagged window was actually made of, over the same window and provider.
+    if any(getattr(r, "anomaly_triggered", False) for r in rows):
+        source = getattr(args, "source", None) or "claude"
+        # `range-cost -s/-e` are ISO-8601 INSTANTS, not inclusive days:
+        # `parse_iso_datetime` never extends a bare date to end-of-day and
+        # reads a naive value as HOST-LOCAL. A date-only selector therefore
+        # names a different, shorter window than the line states, so both
+        # bounds are emitted as full UTC instants.
+        #
+        # `_resolve_cache_report_window` returns both bounds aware in the
+        # DISPLAY zone (host-local when `display.tz` is `local`), and
+        # `strftime` formats the datetime's own fields while appending the
+        # `Z` as a literal character. Converting to UTC first is what makes
+        # the suffix true; without it the selector is a local wall clock
+        # labelled UTC.
+        since_utc = since.astimezone(dt.timezone.utc)
+        until_utc = until.astimezone(dt.timezone.utc)
+        print(_lib_alert_scope.next_step_line(
+            f"cctally range-cost -s {since_utc:%Y-%m-%dT%H:%M:%SZ} "
+            f"-e {until_utc:%Y-%m-%dT%H:%M:%SZ} "
+            f"-b --source {source}",
+            provider=source,
+            window_start=since,
+            window_end=until,
+            tz=tz,
+        ))
     return 0