cctally 1.100.0 → 1.102.0

package/bin/_cctally_dashboard.py

@@ -982,6 +982,8 @@ def _source_safe_claude_project_detail(
         "key": key,
         "label": label,
         "window_weeks": detail.get("window_weeks"),
+        "window_start_at": detail.get("window_start_at"),
+        "window_end_at": detail.get("window_end_at"),
         "window_cost_usd": detail.get("window_cost_usd"),
         "window_attributed_pct": detail.get("window_attributed_pct"),
         "models": detail.get("models", []),
@@ -1330,6 +1332,7 @@ def _build_claude_source_detail(
     recorded_windows, block_start_overrides, canonical_intervals = (
         _load_recorded_five_hour_windows(start_at - BLOCK_DURATION, end_at + BLOCK_DURATION)
     )
+    entry_membership: dict[int, list[UsageEntry]] = {}
     blocks = _group_entries_into_blocks(
         entries,
         mode="auto",
@@ -1337,6 +1340,7 @@ def _build_claude_source_detail(
         block_start_overrides=block_start_overrides,
         canonical_intervals=canonical_intervals,
         now=now_utc,
+        _entry_membership=entry_membership,
     )
     target = next(
         (block for block in blocks if not block.is_gap and block.start_time == start_at),
@@ -1344,9 +1348,7 @@ def _build_claude_source_detail(
     )
     if target is None:
         raise SourceResourceNotFound()
-    block_entries = [
-        entry for entry in entries if target.start_time <= entry.timestamp < target.end_time
-    ]
+    block_entries = entry_membership[id(target)]
     return _source_safe_claude_block_detail(
         _build_block_detail(target, block_entries), key=key,
     )
@@ -1662,6 +1664,28 @@ def _make_sync_loop_collaborators(*, ref, hub) -> dict:
     }
 
 
+@contextlib.contextmanager
+def _rebuilding_claim(mark_rebuilding, *, prepare=None):
+    """Bracket one owner-scoped rebuilding claim, including preparation.
+
+    ``prepare`` may itself publish/claim (``_SnapshotRef.capture_batch`` does),
+    so it belongs inside the same structural cleanup boundary as the explicit
+    mark.  This is the single guard used by the periodic loop and both
+    synchronous HTTP rebuild routes; a future exception between claim and work
+    therefore cannot strand ``rebuilding=true`` for the process lifetime.
+    """
+    prepared = None
+    try:
+        if prepare is not None:
+            prepared = prepare()
+        if mark_rebuilding is not None:
+            mark_rebuilding(True)
+        yield prepared
+    finally:
+        if mark_rebuilding is not None:
+            mark_rebuilding(False)
+
+
 def _dashboard_sync_loop(
     *,
     stop,
@@ -1705,43 +1729,32 @@ def _dashboard_sync_loop(
     settlement counters, which must not advance for a batch that never existed.
     """
     while not stop.is_set():
-        batch = None
+        prepare = None
         if (pending_request is not None and capture_batch is not None
                 and pending_request()):
-            batch = capture_batch()
-        if mark_rebuilding is not None:
-            # BEFORE t0: the publish is a non-blocking queue put, and keeping
-            # it outside the measured span leaves the #313 bound's algebra
-            # exactly as it is. An automatic tick reaches this with no batch
-            # captured, which is the whole point — `rebuilding` describes the
-            # iteration, not the request that may or may not have started it.
-            mark_rebuilding(True)
-        t0 = monotonic()
-        status, warnings = "ok", ()
-        try:
-            result = (run_iteration(batch=batch) if batch is not None
-                      else run_iteration())
-            if isinstance(result, dict):
-                warnings = tuple(result.get("warnings") or ())
-        except Exception:  # noqa: BLE001 — see below
-            # An escaped exception must not kill the only drainer: an accepted
-            # 202 would then never reach a terminal state, and the client would
-            # hold `queued…` forever waiting for a settlement no surviving
-            # thread can publish.
-            status = "failed"
-            _log_sync_iteration_failure()
-        finally:
-            # Failure time is charged to the cooldown exactly like success
-            # time, so a crash loop cannot busy-spin.
-            work = monotonic() - t0
-            if batch is not None and settle is not None:
-                settle(batch[0], status, warnings)
-            if mark_rebuilding is not None:
-                # Every exit path, including an escaped exception: a flag left
-                # set would pin the client's chip at `syncing…` for the life of
-                # the process. `settle` has already cleared it on a requested
-                # tick, so this publishes nothing extra there.
-                mark_rebuilding(False)
+            prepare = capture_batch
+        # Claim publication stays BEFORE t0, preserving #313's measured-work
+        # algebra, but the shared guard begins before capture_batch because that
+        # preparation also claims this thread's owner id.
+        with _rebuilding_claim(mark_rebuilding, prepare=prepare) as batch:
+            t0 = monotonic()
+            status, warnings = "ok", ()
+            try:
+                result = (run_iteration(batch=batch) if batch is not None
+                          else run_iteration())
+                if isinstance(result, dict):
+                    warnings = tuple(result.get("warnings") or ())
+            except Exception:  # noqa: BLE001 — see below
+                # An escaped exception must not kill the only drainer: an
+                # accepted 202 would then never reach a terminal state.
+                status = "failed"
+                _log_sync_iteration_failure()
+            finally:
+                # Failure time is charged to the cooldown exactly like success
+                # time, so a crash loop cannot busy-spin.
+                work = monotonic() - t0
+                if batch is not None and settle is not None:
+                    settle(batch[0], status, warnings)
 
         deadline = _next_deadline(t0, interval, work)
         floor = t0 + 2.0 * work
@@ -2017,6 +2030,10 @@ def _build_alert_payload_weekly(*args, **kwargs):
     return sys.modules["cctally"]._build_alert_payload_weekly(*args, **kwargs)
 
 
+def synthetic_preview_week_start(*args, **kwargs):
+    return sys.modules["cctally"].synthetic_preview_week_start(*args, **kwargs)
+
+
 def _build_alert_payload_five_hour(*args, **kwargs):
     return sys.modules["cctally"]._build_alert_payload_five_hour(*args, **kwargs)
 
@@ -2385,42 +2402,10 @@ class _SnapshotRef:
         # therefore remove only the clearing thread's own claim; `rebuilding`
         # is then true exactly while at least one rebuilder holds one.
         #
-        # Owner scoping made a LEAKED CLAIM strictly worse than the boolean it
-        # replaced, so do not record the opposite. Under the boolean a leaked
-        # `True` was cleared by whichever rebuilder next reached `set_final`, so
-        # it self-healed on the following rebuild. Every clear site here discards
-        # `threading.get_ident()`, so a claim left behind by a thread that has
-        # exited can be discarded by NO other thread, and `rebuilding` would stay
-        # true — pinning every client's chip at `syncing…` for the life of the
-        # process.
-        #
-        # No leak is reachable today, but the argument splits by CALLER, not by
-        # add site. `mark_rebuilding` below is reached from both routes — the
-        # sync loop through `_make_sync_loop_collaborators` and an HTTP handler
-        # thread through `DashboardHTTPHandler.mark_rebuilding` — so reading one
-        # add site answers for neither. Four callers add a claim.
-        #
-        # Two of the four are bracketed: `_handle_post_sync` and
-        # `_handle_post_settings` each mark inside a `try` whose `finally`
-        # clears, so nothing between the two can leak the claim.
-        #
-        # The other two are the sync loop's `capture_batch()` and its
-        # `mark_rebuilding(True)`, and they are NOT bracketed. Both run before
-        # `t0` and therefore before the `try:` whose `finally` clears them; the
-        # loop's own comment at `mark_rebuilding(True)` gives the #313
-        # duty-algebra reason for that one's placement. `_dashboard_sync_loop`'s
-        # `while` has no outer handler, so a raise in that gap would kill the
-        # drainer and leak the claim together. The gap is safe because nothing
-        # in it raises: the `_restamp_locked()` each add performs is a
-        # `dataclasses.replace` over `DataSnapshot`, a plain dataclass with no
-        # `__post_init__`, no `init=False` field and no `InitVar`;
-        # `SSEHub.publish` holds its own lock and swallows
-        # `queue.Full`/`queue.Empty`; `ref.get()` is a lock-and-return; and what
-        # remains is a clock read and two local assignments.
-        #
-        # A new `add` must therefore satisfy one of the two: a same-thread
-        # `finally` that clears it, or a proven non-raising path to one. There
-        # is no self-healing path behind either.
+        # Owner scoping makes a leaked claim permanent: another thread cannot
+        # discard this thread's id. All three rebuilding routes therefore use
+        # `_rebuilding_claim`, whose boundary begins before any preparation
+        # that can claim and ends after the terminal publish.
         self._rebuilding_owners: set[int] = set()
         self._snap = self._stamped_locked(initial)
 
@@ -3770,7 +3755,22 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
        recorded-windows-widening trick (loads reset windows from
        ``[start - BLOCK_DURATION, end + BLOCK_DURATION]`` so a recorded
        reset just outside the visible window can still anchor blocks
-       inside it) and the strict-window entry filter.
+       inside it) and the post-group block-overlap filter.
+
+    #620 S1 D8: the entry set is grouped into native blocks FIRST and the
+    week filter is then applied to whole blocks, retaining every block whose
+    interval overlaps ``[week_start_at, week_end_at)`` with its full native
+    totals. It used to filter ENTRIES to the week before grouping, so a
+    block straddling a week boundary was folded from only the part of itself
+    that fell inside the week — while ``/api/block/<iso>`` fetches the
+    block's own native window and applies no week clip, so the panel and its
+    own drilldown reported different totals for the same ``start_at`` and
+    the panel's was permanently short. Selecting a block that overlaps the
+    week is the deliberate part of the contract and stays; clipping a
+    selected block's contents was the defect.
+
+    The fetch already read one block duration on each side, so this needs no
+    additional query.
 
     Returning the full ``BlocksView`` (rows + totals) lets the sync
     thread populate ``DataSnapshot.blocks_total_cost_usd`` /
@@ -3781,13 +3781,12 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
     fetch_start = week_start_at - BLOCK_DURATION
     fetch_end = week_end_at + BLOCK_DURATION
     entries = get_entries(fetch_start, fetch_end, skip_sync=skip_sync)
-    entries = [e for e in entries if week_start_at <= e.timestamp < week_end_at]
 
     recorded_windows, block_start_overrides, canonical_intervals = (
         _load_recorded_five_hour_windows(fetch_start, fetch_end)
     )
     c = _cctally()
-    return c.build_blocks_view(
+    view = c.build_blocks_view(
         entries,
         now_utc=now_utc,
         recorded_windows=recorded_windows,
@@ -3798,6 +3797,60 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
         display_tz=display_tz,
         mode="auto",
     )
+    return _blocks_view_overlapping_week(
+        view, week_start_at=week_start_at, week_end_at=week_end_at,
+    )
+
+
+def _blocks_view_overlapping_week(view, *, week_start_at, week_end_at):
+    """Retain only the blocks whose interval overlaps
+    ``[week_start_at, week_end_at)``, keeping each retained block's FULL
+    native totals (#620 S1 D8).
+
+    Overlap is the standard half-open test ``start < week_end and end >
+    week_start``: a block that merely touches a bound (its end exactly at
+    ``week_start_at``, or its start exactly at ``week_end_at``) shares no
+    instant with the week and is not retained.
+
+    Totals are re-derived from the retained non-gap blocks so the React
+    panel's ``footer total == sum(visible rows)`` invariant still holds, and
+    ``aggregated`` is filtered in lockstep so no consumer can read a block
+    set that disagrees with ``rows``.
+    """
+    kept_blocks = []
+    total_cost = 0.0
+    total_tokens = 0
+    kept_starts = set()
+    for b in view.aggregated:
+        start = getattr(b, "start_time", None)
+        end = getattr(b, "end_time", None)
+        if start is None or end is None:
+            # API-anchored views carry dicts, not Blocks. This adapter only
+            # ever sees the heuristic path, but degrade by retaining rather
+            # than silently dropping a shape we cannot classify.
+            kept_blocks.append(b)
+            continue
+        if not (start < week_end_at and end > week_start_at):
+            continue
+        kept_blocks.append(b)
+        if getattr(b, "is_gap", False):
+            continue
+        # Plain `+=` rather than `stable_sum`, deliberately: this mirrors
+        # `build_blocks_view`'s own accumulation (`bin/_lib_view_models.py`),
+        # and this function exists to publish the SAME totals that view
+        # publishes. A different fold here could disagree with it in the last
+        # ULP, which is the divergence the function was written to remove.
+        total_cost += b.cost_usd
+        total_tokens += b.total_tokens
+        kept_starts.add(start.astimezone(dt.timezone.utc).isoformat())
+    rows = tuple(r for r in view.rows if r.start_at in kept_starts)
+    return dataclasses.replace(
+        view,
+        rows=rows,
+        aggregated=tuple(kept_blocks),
+        total_cost_usd=total_cost,
+        total_tokens=total_tokens,
+    )
 
 
 def _dashboard_build_blocks_panel(conn: "sqlite3.Connection",
@@ -4152,6 +4205,158 @@ def _projects_week_start_monday_utc(ts: "dt.datetime") -> "dt.datetime":
     )
 
 
+class _ProjectsWeekGrid:
+    """The ordered half-open subscription intervals the Projects panel
+    attributes cost into (#620 S1 D1).
+
+    ``_projects_week_start_monday_utc`` above is the fallback used when no
+    snapshot anchor is available; this is what replaces it when one IS
+    available. Intervals come from ``_compute_subscription_weeks``, the same
+    kernel ``cmd_project`` buckets by, so the panel and the CLI describe one
+    set of weeks rather than two.
+
+    Intervals are half-open ``[start, end)`` and are NOT assumed to be seven
+    days long: Anthropic's reset day drifts, and a drifted cycle produces a
+    genuinely short week. ``end_for`` therefore returns the interval's own
+    end, never ``start + 7d``.
+    """
+
+    __slots__ = ("starts", "ends", "_end_by_start", "_start_by_date")
+
+    def __init__(self, bounds: "list[tuple[dt.datetime, dt.datetime]]"):
+        ordered = sorted(bounds, key=lambda b: b[0])
+        self.starts = [b[0] for b in ordered]
+        self.ends = [b[1] for b in ordered]
+        self._end_by_start = {s: e for s, e in ordered}
+        # `weekly_usage_snapshots.week_start_date` is the date-only lookup
+        # key a legacy row carries when it has no `week_start_at`. Later
+        # intervals win a collision, matching the "last capture per week
+        # wins" rule the percentage read already applies.
+        self._start_by_date = {s.date(): s for s in self.starts}
+
+    def __bool__(self) -> bool:
+        return bool(self.starts)
+
+    def week_for(self, ts: "dt.datetime") -> "dt.datetime | None":
+        """The start of the interval containing ``ts``, or None when ``ts``
+        falls outside every interval.
+
+        First-match-wins on the reset-day-drift overlap the clamp can leave
+        behind — the same walk-back `cmd_project._week_start_for` performs,
+        so an entry near a drifted boundary lands in the same week on both
+        surfaces.
+        """
+        ts_utc = ts.astimezone(dt.timezone.utc)
+        idx = bisect.bisect_right(self.starts, ts_utc) - 1
+        if idx < 0:
+            return None
+        while idx > 0 and self.starts[idx - 1] <= ts_utc < self.ends[idx - 1]:
+            idx -= 1
+        if self.starts[idx] <= ts_utc < self.ends[idx]:
+            return self.starts[idx]
+        return None
+
+    def start_for_date(self, day: "dt.date") -> "dt.datetime | None":
+        """The interval start whose own date is ``day``, for a legacy
+        snapshot row that carries ``week_start_date`` but no
+        ``week_start_at``."""
+        return self._start_by_date.get(day)
+
+    def end_for(self, start: "dt.datetime") -> "dt.datetime":
+        """The interval's real end. Falls back to ``start + 7d`` only for a
+        start this grid does not know, which the padding below produces."""
+        return self._end_by_start.get(start, start + dt.timedelta(days=7))
+
+    def window_ending_at(
+        self, cw_start: "dt.datetime", weeks_back: int,
+    ) -> "list[tuple[dt.datetime, dt.datetime]]":
+        """The last ``weeks_back`` intervals up to and including the one
+        starting at ``cw_start``, oldest first.
+
+        When the grid holds fewer than ``weeks_back`` intervals at or before
+        ``cw_start``, the head is padded backwards in seven-day steps. The
+        padding is a genuine no-anchor tail — history older than any snapshot
+        — so the seven-day assumption is the right one there.
+
+        The walk itself lives in ``_lib_subscription_weeks`` because
+        ``cmd_project`` performs the same one; a copy here is how the two
+        surfaces drifted apart in the first place.
+        """
+        return _cctally().subscription_window_ending_at(
+            list(zip(self.starts, self.ends)), cw_start, weeks_back,
+        )
+
+
+def _projects_week_grid(
+    conn: "sqlite3.Connection",
+    *,
+    anchor_utc: "dt.datetime",
+    weeks_back: int,
+    account_key: "str | None" = None,
+) -> "_ProjectsWeekGrid | None":
+    """Build the panel's subscription-week grid, or None when no snapshot
+    row carries an anchor.
+
+    Returning None is the deliberate no-anchor path: the caller then keeps
+    ``_projects_week_start_monday_utc`` throughout, which is what that
+    function was written for and what every anchorless fixture already
+    exercises byte-identically.
+
+    Cost: one grouped read of ``weekly_usage_snapshots`` plus the reset-event
+    join `_compute_subscription_weeks` already performs. It adds no walk over
+    ``session_entries`` and nothing per entry, so this does not re-open the
+    per-tick rescan #583 owns.
+    """
+    acct_pred = "" if account_key is None else " AND account_key = ?"
+    acct_params: tuple = () if account_key is None else (account_key,)
+    try:
+        row = conn.execute(
+            "SELECT COUNT(*) FROM weekly_usage_snapshots "
+            "WHERE week_start_at IS NOT NULL "
+            "  AND week_end_at IS NOT NULL "
+            "  AND week_start_date IS NOT NULL"
+            f"{acct_pred}",
+            acct_params,
+        ).fetchone()
+    except sqlite3.OperationalError:
+        return None
+    if not row or not row[0]:
+        return None
+
+    # A generous provisional range, defined once in `_lib_subscription_weeks`
+    # because `cmd_project` needs the identical range: the extrapolation
+    # anchor `_compute_subscription_weeks` picks is relative to `range_start`,
+    # so two callers asking the same question over different ranges can be
+    # handed differently-phased intervals for the same history.
+    range_start, range_end = _cctally().subscription_window_probe_range(
+        anchor_utc, weeks_back,
+    )
+    try:
+        subweeks = _cctally()._compute_subscription_weeks(
+            conn, range_start, range_end, account_key=account_key,
+        )
+    except Exception:
+        # A malformed anchor must not take the panel down; the Monday
+        # fallback still renders a coherent (if approximate) window.
+        return None
+    bounds: "list[tuple[dt.datetime, dt.datetime]]" = []
+    for sw in subweeks:
+        try:
+            s = parse_iso_datetime(
+                sw.start_ts, "projects week.start_ts",
+            ).astimezone(dt.timezone.utc)
+            e = parse_iso_datetime(
+                sw.end_ts, "projects week.end_ts",
+            ).astimezone(dt.timezone.utc)
+        except (TypeError, ValueError):
+            continue
+        if e > s:
+            bounds.append((s, e))
+    if not bounds:
+        return None
+    return _ProjectsWeekGrid(bounds)
+
+
 def _projects_week_label(week_start: "dt.datetime") -> str:
     """Render a `wk Mon DD` label for the trend chart x-axis.
 
@@ -4200,9 +4405,25 @@ def _projects_iter_session_entries(conn: "sqlite3.Connection",
     downstream. An ``EXPLAIN QUERY PLAN`` regression asserts the mutation_seq
     index seek (``tests/test_projects_envelope.py``).
     """
-    since_iso = since.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
+    # The SQL bounds are an outward-widened CANDIDATE filter; the real
+    # membership test is the Python one every caller applies
+    # (`_fold_projects_entry`'s interval gate, `_week_for`, or
+    # `_fetch_delta_rows`' own pre-filter). #620 S1: the lower bound is
+    # widened by one second because ingestion stores
+    # `timestamp.astimezone(utc).isoformat()`, which keeps a `+00:00`
+    # offset, while this predicate spells its bound `Z` — and SQLite
+    # compares the column lexically, where `+` (0x2B) sorts BELOW `Z`
+    # (0x5A). An entry stored at exactly `since`, or in the first second
+    # after it, therefore sorts below the bound and is dropped before any
+    # Python gate runs. That was unreachable while a week always started at
+    # Monday 00:00 UTC, which carries no entries; a real subscription week
+    # starts at the reset instant, and an entry lands on it routinely. The
+    # widening admits at most one extra second of candidates, which the
+    # Python gate then rejects, so no caller's result changes except the one
+    # that was silently losing the boundary entry.
+    since_iso = (
+        since.astimezone(dt.timezone.utc) - dt.timedelta(seconds=1)
+    ).strftime("%Y-%m-%dT%H:%M:%SZ")
     until_iso = until.astimezone(dt.timezone.utc).strftime(
         "%Y-%m-%dT%H:%M:%SZ"
     )
@@ -4393,6 +4614,25 @@ def _shared_range_row_to_usage_entry(row):
     )
 
 
+def _shared_range_row_to_priced_usage_entry(row):
+    """Prepare one shared row's effective cost once for both range folds."""
+    entry = _shared_range_row_to_usage_entry(row)
+    if entry.model == "<synthetic>":
+        return entry
+    return _cctally().UsageEntry(
+        timestamp=entry.timestamp,
+        model=entry.model,
+        usage=entry.usage,
+        cost_usd=_calculate_entry_cost(
+            entry.model,
+            entry.usage,
+            mode="auto",
+            cost_usd=entry.cost_usd,
+        ),
+        source_path=entry.source_path,
+    )
+
+
 def _fold_prepared_daily_entries(
     accumulators, entries, *, display_tz=None, mode: str = "auto",
 ):
@@ -4504,6 +4744,10 @@ class _ProjWeekBucket(NamedTuple):
     first_order: str
     first_id: int
     first_key: "Any"
+    # Retained so selected-window totals can deduplicate a session that is
+    # active in more than one subscription bucket (#634). The default keeps
+    # older fixture constructors source-compatible.
+    session_ids: "frozenset[str]" = frozenset()
 
 
 def _fold_projects_entry(
@@ -4512,7 +4756,9 @@ def _fold_projects_entry(
     *,
     resolver_cache: dict,
     week_start: "dt.datetime | None",
+    week_end: "dt.datetime | None" = None,
     prepared_daily_entries: "list | None" = None,
+    priced_entry=None,
 ) -> "float | None":
     """Fold ONE ``_projects_iter_session_entries`` row onto ``mut`` (the shared
     per-row body, #271 §20 Codex-P1a).
@@ -4524,6 +4770,15 @@ def _fold_projects_entry(
     row is filtered out (``<synthetic>`` model, or its Monday-anchored week ≠
     ``week_start``) — the caller then skips ``week_total`` / ``tail`` advance.
 
+    The membership gate is the half-open interval ``[week_start, week_end)``
+    (#620 S1 D1). It was a ``_projects_week_start_monday_utc(ts) ==
+    week_start`` equality, which is the SAME predicate whenever ``week_start``
+    is a Monday 00:00 UTC and ``week_end`` is ``week_start + 7d`` — so every
+    Monday-anchored caller is byte-unchanged — but the interval form also
+    admits a real subscription week that neither starts on a Monday nor runs
+    a full seven days. ``week_end`` defaults to ``week_start + 7d`` for a
+    caller that has not been threaded through yet.
+
     ``mut[bp]`` is the running mutable dict ``{"cost_usd": float,
     "sessions": set, "first_seen": dt, "last_seen": dt, "first_order": ts_iso,
     "first_id": int, "first_key": ProjectKey}``. The first row seen for a
@@ -4546,32 +4801,43 @@ def _fold_projects_entry(
     if model == "<synthetic>":
         return None
     ts = parse_iso_datetime(ts_iso, "session_entries.timestamp_utc")
-    if week_start is not None and _projects_week_start_monday_utc(ts) != week_start:
-        return None
-    usage = claude_usage_dict(   # #195 chokepoint
-        input_tokens=input_tok,
-        output_tokens=output_tok,
-        cache_creation_tokens=cache_create,
-        cache_read_tokens=cache_read,
-        cache_1h_tokens=cache_1h,
-        speed=speed,
-    )
-    entry_cost = _calculate_entry_cost(
-        model,
-        usage,
-        mode="auto",
-        cost_usd=cost_raw,
-    )
+    if week_start is not None:
+        w_end = (
+            week_end if week_end is not None
+            else week_start + dt.timedelta(days=7)
+        )
+        if not (week_start <= ts < w_end):
+            return None
+    if priced_entry is None:
+        usage = claude_usage_dict(   # #195 chokepoint
+            input_tokens=input_tok,
+            output_tokens=output_tok,
+            cache_creation_tokens=cache_create,
+            cache_read_tokens=cache_read,
+            cache_1h_tokens=cache_1h,
+            speed=speed,
+        )
+        entry_cost = _calculate_entry_cost(
+            model,
+            usage,
+            mode="auto",
+            cost_usd=cost_raw,
+        )
+    else:
+        usage = priced_entry.usage
+        entry_cost = priced_entry.cost_usd
     if prepared_daily_entries is not None:
         # #567: preserve the canonical daily entry and aggregator while
         # handing off the effective cost this pass already computed.
-        prepared_daily_entries.append(c.UsageEntry(
-            timestamp=dt.datetime.fromisoformat(ts_iso),
-            model=model,
-            usage=usage,
-            cost_usd=entry_cost,
-            source_path=source_path,
-        ))
+        prepared_daily_entries.append(
+            priced_entry if priced_entry is not None else c.UsageEntry(
+                timestamp=dt.datetime.fromisoformat(ts_iso),
+                model=model,
+                usage=usage,
+                cost_usd=entry_cost,
+                source_path=source_path,
+            )
+        )
     pkey = c._resolve_project_key(project_path, "git-root", resolver_cache)
     bp = pkey.bucket_path
     a = mut.get(bp)
@@ -4600,6 +4866,7 @@ def _fold_projects_entry(
 
 def fold_projects_over_range(
     rows, *, resolver_cache=None, prepared_daily_entries=None,
+    priced_entries=None,
 ) -> "dict[str, dict]":
     """Fold an ALREADY-MATERIALISED candidate stream into per-bucket totals.
 
@@ -4622,13 +4889,17 @@ def fold_projects_over_range(
     """
     mut: "dict[str, dict]" = {}
     cache = {} if resolver_cache is None else resolver_cache
-    for row in rows:
+    if priced_entries is not None and len(priced_entries) != len(rows):
+        raise ValueError("priced shared-range entries do not match source rows")
+    for index, row in enumerate(rows):
         _fold_projects_entry(
             mut,
             row,
             resolver_cache=cache,
             week_start=None,
             prepared_daily_entries=prepared_daily_entries,
+            priced_entry=(
+                priced_entries[index] if priced_entries is not None else None),
         )
     return mut
 
@@ -4900,25 +5171,35 @@ def _shared_range_cache_payload(
     }
 
 
-def build_cached_claude_range_aggregates(
+@dataclass(frozen=True)
+class ClaudeRangeAggregateCapture:
+    """Cache-owned inputs for one post-transaction Claude range fold."""
+
+    base: tuple
+    max_entry_id: int
+    entry_mutation_seq: int
+    shared_end_exclusive: object
+    prior: object
+    delta_rows: tuple
+    full_rows: tuple | None
+
+
+def capture_cached_claude_range_aggregates(
     conn,
     *,
     shared_start,
     shared_end_exclusive,
-    now_utc,
     display_tz,
-    legacy_labels,
     max_entry_id: "int | None" = None,
     entry_mutation_seq: "int | None" = None,
     generation: int = 0,
 ):
-    """Build or increment the one-snapshot Claude range folds (#567).
+    """Capture only cache-backed inputs for the #567 append accumulator.
 
-    Pure appends are folded onto the cached raw accumulators.  A shifted range
-    floor, backwards clock, generation or session-file identity change,
-    non-monotone signature, or an id-stable mutation of an already-folded row
-    falls back to one full ordered pass.  The cache stores no public labels, so
-    the current legacy population is reapplied on every publication.
+    This half may run under `_tui_build_source_bundle`'s pinned transaction. It
+    performs no deepcopy, pricing, project fold, daily fold, payload assembly,
+    or memo mutation. The returned rows are ordinary immutable SQLite tuples,
+    so the caller can end the read transaction before consuming them.
     """
     if max_entry_id is None or entry_mutation_seq is None:
         observed_id, observed_seq = _shared_range_entry_signature(conn)
@@ -4935,7 +5216,8 @@ def build_cached_claude_range_aggregates(
         generation=generation,
     )
     prior = _CLAUDE_RANGE_AGGREGATE_MEMO.get("state")
-    state = None
+    delta_rows: tuple = ()
+    full_rows: tuple | None = None
     if isinstance(prior, dict) and prior.get("base") == base:
         monotone = (
             max_entry_id >= prior["max_entry_id"]
@@ -4951,9 +5233,6 @@ def build_cached_claude_range_aggregates(
             )
         )
         if monotone and not old_row_changed:
-            project_mut = copy.deepcopy(prior["project_mut"])
-            daily_accumulators = copy.deepcopy(prior["daily_accumulators"])
-            resolver_cache = dict(prior["resolver_cache"])
             delta_by_id = {}
             for row in _shared_range_entries_after_id(
                 conn, prior["max_entry_id"],
@@ -4971,85 +5250,198 @@ def build_cached_claude_range_aggregates(
                 ):
                     if row[0] <= prior["max_entry_id"]:
                         delta_by_id[row[0]] = row
-            delta_rows = sorted(
+            delta_rows = tuple(sorted(
                 delta_by_id.values(),
                 key=lambda row: (row[1], row[0]),
-            )
+            ))
             prior_tail = prior["tail"]
-            if prior_tail is None or all(
+            if not (prior_tail is None or all(
                 (row[1], row[0]) > prior_tail
                 for row in delta_rows
                 if row[2] != "<synthetic>"
-            ):
-                prepared = []
-                for row in delta_rows:
-                    _fold_projects_entry(
-                        project_mut,
-                        row,
-                        resolver_cache=resolver_cache,
-                        week_start=None,
-                        prepared_daily_entries=prepared,
-                    )
-                _fold_prepared_daily_entries(
-                    daily_accumulators,
-                    prepared,
-                    display_tz=display_tz,
-                )
-                tail = prior_tail
-                real_delta = [
-                    row for row in delta_rows if row[2] != "<synthetic>"
-                ]
-                if real_delta:
-                    last = real_delta[-1]
-                    tail = (last[1], last[0])
-                state = {
-                    "base": base,
-                    "max_entry_id": max_entry_id,
-                    "entry_mutation_seq": entry_mutation_seq,
-                    "end_exclusive": shared_end_exclusive,
-                    "tail": tail,
-                    "project_mut": project_mut,
-                    "daily_accumulators": daily_accumulators,
-                    "resolver_cache": resolver_cache,
-                }
-    if state is None:
-        rows = tuple(iter_shared_range_entries(
+            )):
+                # An out-of-order append cannot be folded onto the accumulator.
+                # Capture the cold carrier while the same snapshot is pinned;
+                # discovering this after rollback would require a second read
+                # generation.
+                full_rows = tuple(iter_shared_range_entries(
+                    conn, start=shared_start,
+                    end_exclusive=shared_end_exclusive,
+                ))
+                delta_rows = ()
+        else:
+            full_rows = tuple(iter_shared_range_entries(
+                conn, start=shared_start,
+                end_exclusive=shared_end_exclusive,
+            ))
+    else:
+        full_rows = tuple(iter_shared_range_entries(
             conn, start=shared_start, end_exclusive=shared_end_exclusive,
         ))
-        prepared = []
-        resolver_cache = {}
-        project_mut = fold_projects_over_range(
-            rows,
-            resolver_cache=resolver_cache,
-            prepared_daily_entries=prepared,
+    return ClaudeRangeAggregateCapture(
+        base=base,
+        max_entry_id=max_entry_id,
+        entry_mutation_seq=entry_mutation_seq,
+        shared_end_exclusive=shared_end_exclusive,
+        prior=prior,
+        delta_rows=delta_rows,
+        full_rows=full_rows,
+    )
+
+
+def build_cached_claude_range_aggregates_from_capture(
+    capture: ClaudeRangeAggregateCapture,
+    *,
+    now_utc,
+    display_tz,
+    legacy_labels,
+    tolerate_leg_failures: bool = False,
+):
+    """Fold and publish one captured Claude range accumulator outside the pin.
+
+    ``tolerate_leg_failures`` is the source-bundle path's typed degradation
+    seam. Project identity resolution and the daily calendar are independent
+    folds over the same captured rows, so a project-only fault must not discard
+    a valid daily result. The one-shot compatibility wrapper keeps the legacy
+    raise-on-any-fault contract by leaving it false.
+    """
+    prior = capture.prior
+    incremental = capture.full_rows is None and isinstance(prior, dict)
+    rows = capture.delta_rows if incremental else (capture.full_rows or ())
+    payload: dict[str, object] = {}
+    outcomes = {
+        "projects": {"state": "ok"},
+        "daily": {"state": "ok"},
+    }
+    failures: dict[str, Exception] = {}
+    project_mut = None
+    resolver_cache = None
+    daily_accumulators = None
+
+    try:
+        prepared = tuple(
+            _shared_range_row_to_priced_usage_entry(row) for row in rows)
+    except Exception as exc:
+        prepared = ()
+        failures["projects"] = exc
+        failures["daily"] = exc
+        outcomes["projects"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+        outcomes["daily"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    try:
+        if "projects" in failures:
+            raise failures["projects"]
+        if incremental:
+            project_mut = copy.deepcopy(prior["project_mut"])
+            resolver_cache = dict(prior["resolver_cache"])
+            for row, priced_entry in zip(rows, prepared):
+                _fold_projects_entry(
+                    project_mut,
+                    row,
+                    resolver_cache=resolver_cache,
+                    week_start=None,
+                    priced_entry=priced_entry,
+                )
+        else:
+            resolver_cache = {}
+            project_mut = fold_projects_over_range(
+                rows,
+                resolver_cache=resolver_cache,
+                priced_entries=prepared,
+            )
+        payload["projects"] = _project_aggregate_rows_from_folded(
+            project_mut, legacy_labels)
+    except Exception as exc:
+        failures["projects"] = exc
+        outcomes["projects"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    try:
+        if "daily" in failures:
+            raise failures["daily"]
+        daily_accumulators = (
+            copy.deepcopy(prior["daily_accumulators"])
+            if incremental else {}
         )
-        daily_accumulators = {}
         _fold_prepared_daily_entries(
-            daily_accumulators, prepared, display_tz=display_tz,
-        )
+            daily_accumulators, prepared, display_tz=display_tz)
+        daily_buckets = _finalize_daily_accumulators(daily_accumulators)
+        daily_rows = _build_daily_aggregate_rows_from_buckets(
+            daily_buckets, now_utc=now_utc, display_tz=display_tz)
+        c = _cctally()
+        payload["daily"] = [
+            c.daily_panel_row_to_wire(row) for row in daily_rows]
+    except Exception as exc:
+        failures["daily"] = exc
+        outcomes["daily"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    if incremental:
+        tail = prior["tail"]
+        real_delta = [
+            row for row in capture.delta_rows if row[2] != "<synthetic>"
+        ]
+        if real_delta:
+            last = real_delta[-1]
+            tail = (last[1], last[0])
+    else:
         real_rows = [row for row in rows if row[2] != "<synthetic>"]
         tail = None
         if real_rows:
             last = real_rows[-1]
             tail = (last[1], last[0])
+
+    if not failures:
         state = {
-            "base": base,
-            "max_entry_id": max_entry_id,
-            "entry_mutation_seq": entry_mutation_seq,
-            "end_exclusive": shared_end_exclusive,
+            "base": capture.base,
+            "max_entry_id": capture.max_entry_id,
+            "entry_mutation_seq": capture.entry_mutation_seq,
+            "end_exclusive": capture.shared_end_exclusive,
             "tail": tail,
             "project_mut": project_mut,
             "daily_accumulators": daily_accumulators,
             "resolver_cache": resolver_cache,
         }
-    payload = _shared_range_cache_payload(
-        state,
-        legacy_labels=legacy_labels,
+        _cctally()._load_sibling("_lib_snapshot_cache")._assert_owner()
+        _CLAUDE_RANGE_AGGREGATE_MEMO["state"] = state
+
+    if failures and not tolerate_leg_failures:
+        raise next(iter(failures.values()))
+    if tolerate_leg_failures:
+        return payload, outcomes
+    return payload
+
+
+def build_cached_claude_range_aggregates(
+    conn,
+    *,
+    shared_start,
+    shared_end_exclusive,
+    now_utc,
+    display_tz,
+    legacy_labels,
+    max_entry_id: "int | None" = None,
+    entry_mutation_seq: "int | None" = None,
+    generation: int = 0,
+):
+    """One-shot compatibility wrapper for non-pinned focused callers."""
+    capture = capture_cached_claude_range_aggregates(
+        conn,
+        shared_start=shared_start,
+        shared_end_exclusive=shared_end_exclusive,
+        display_tz=display_tz,
+        max_entry_id=max_entry_id,
+        entry_mutation_seq=entry_mutation_seq,
+        generation=generation,
+    )
+    return build_cached_claude_range_aggregates_from_capture(
+        capture,
         now_utc=now_utc,
         display_tz=display_tz,
+        legacy_labels=legacy_labels,
     )
-    _CLAUDE_RANGE_AGGREGATE_MEMO["state"] = state
-    return payload
 
 
 def _aggregate_projects_week_raw(
@@ -5080,7 +5472,8 @@ def _aggregate_projects_week_raw(
         conn, since=week_start, until=week_end,
     ):
         entry_cost = _fold_projects_entry(
-            mut, row, resolver_cache=resolver_cache, week_start=week_start,
+            mut, row, resolver_cache=resolver_cache,
+            week_start=week_start, week_end=week_end,
         )
         if entry_cost is None:
             continue
@@ -5104,6 +5497,7 @@ def _finalize_projects_mut(mut: dict) -> "dict[str, _ProjWeekBucket]":
             first_order=a["first_order"],
             first_id=a["first_id"],
             first_key=a["first_key"],
+            session_ids=frozenset(a["sessions"]),
         )
         for bp, a in mut.items()
     }
@@ -5143,7 +5537,7 @@ def _aggregate_projects_week(
 def _assemble_projects_via_cache(
     conn: "sqlite3.Connection",
     *,
-    weeks_full: "list[dt.datetime]",
+    week_bounds: "list[tuple[dt.datetime, dt.datetime]]",
     cw_start: "dt.datetime",
     cw_end: "dt.datetime",
     cur_max_id: int,
@@ -5186,9 +5580,16 @@ def _assemble_projects_via_cache(
         for bp, wb in week_buckets.items():
             buckets[(bp, w)] = {
                 "cost_usd": wb.cost_usd,
-                # `sessions` is only ever `len()`-d downstream; a `range` of the
-                # cached count reproduces that without storing the id set.
-                "sessions": range(wb.sessions_count),
+                # Window totals union these identities so a resumed session
+                # crossing a reset is counted once. The range fallback serves
+                # test/legacy constructors that predate ``session_ids``.
+                "sessions": (
+                    wb.session_ids
+                    if wb.session_ids
+                    else frozenset(
+                        (w, index) for index in range(wb.sessions_count)
+                    )
+                ),
                 "first_seen": wb.first_seen,
                 "last_seen": wb.last_seen,
             }
@@ -5218,33 +5619,47 @@ def _assemble_projects_via_cache(
             if r[2] == "<synthetic>":  # r[2] = model
                 continue
             ts = parse_iso_datetime(r[1], "session_entries.timestamp_utc")
-            if _projects_week_start_monday_utc(ts) != cw_start:
+            if not (cw_start <= ts < cw_end):
                 continue
             out.append(r)
         out.sort(key=lambda r: (r[1], r[0]))  # (ts_iso, id)
         return out
 
-    for w in weeks_full:
+    # The cache identity below is `(start, end)`, while the spec named
+    # "account, exact start, exact end". The account axis is omitted
+    # deliberately, not by oversight: this panel always folds merged
+    # (`_projects_week_grid` is called here with `account_key=None`), so
+    # every entry in this cache was produced by the one merged read and two
+    # scopes cannot collide in it. Adding a constant third component would
+    # be a key that never varies. If the panel ever gains an account scope,
+    # the axis has to be added at the same time — an account-scoped fold
+    # served from a merged slot is a wrong answer, not a stale one.
+    for w, w_end in week_bounds:
         if w == cw_start:
             week_buckets, week_total = sc.accumulate_projects_current_week(
-                week_key=sc.projects_env_week_key(cw_start),
+                # #620 S1: the accumulator's identity is the INTERVAL. An
+                # early reset that moves the current week's bounds must
+                # cold-refold the slot rather than keep appending to a
+                # running aggregate folded over the old window.
+                week_key=sc.projects_env_week_key(cw_start, cw_end),
                 cur_max_id=cur_max_id,
                 cur_max_seq=cur_max_seq,
                 fetch_all_raw=_fetch_all_raw,
                 fetch_delta_rows=_fetch_delta_rows,
                 finalize=_finalize_projects_mut,
                 fold=lambda mut, row: _fold_projects_entry(
-                    mut, row, resolver_cache=resolver_cache, week_start=cw_start,
+                    mut, row, resolver_cache=resolver_cache,
+                    week_start=cw_start, week_end=cw_end,
                 ),
             )
         else:
-            week_iso = sc.projects_env_week_key(w)
+            week_iso = sc.projects_env_week_key(w, w_end)
             hit = sc.projects_env_week_get(week_iso)
             if hit is not None:
                 week_buckets, week_total = hit
             else:
                 week_buckets, week_total = _aggregate_projects_week(
-                    conn, week_start=w, week_end=w + dt.timedelta(days=7),
+                    conn, week_start=w, week_end=w_end,
                     resolver_cache=resolver_cache,
                 )
                 sc.projects_env_week_put(week_iso, week_buckets, week_total)
@@ -5268,14 +5683,21 @@ def _build_projects_envelope(
     shape from spec §5.2 (no per-model breakdowns, no first/last seen
     per session, no per-row $/1%; just cost / attributed_pct / sessions).
 
-    Week boundaries follow ``cmd_project``'s Monday-anchored UTC
-    fallback (``bin/cctally:4711``); ``weekly_usage_snapshots`` rows are
-    matched by ``week_start_date`` (date-only) for ``attributed_pct``.
-
-    ``current_week`` is passed through opaquely — if non-None and
-    carrying a ``.week_start_at`` UTC datetime, that boundary supplants
-    the Monday fallback for the current week's bucket. None (the
-    default) preserves the fallback.
+    Week boundaries are the real subscription intervals (#620 S1 D1):
+    ``_projects_week_grid`` derives them from ``_compute_subscription_weeks``,
+    the same kernel ``cmd_project`` buckets by, so the two surfaces attribute
+    the same projects over the same weeks. A ``weekly_usage_snapshots`` row
+    is matched onto an interval by its ``week_start_at`` anchor, falling back
+    to ``week_start_date`` for a legacy row that carries no anchor; a row
+    that matches no interval contributes nothing, leaving ``attributed_pct``
+    None rather than attributing over a mismatched population. Only a store
+    with no anchored snapshot at all falls back to
+    ``_projects_week_start_monday_utc``, which is what that function was
+    written for.
+
+    ``current_week`` is passed through opaquely — if non-None and carrying a
+    ``.week_start_at`` UTC datetime, that instant selects which interval is
+    the current week. None (the default) uses ``now_utc``.
 
     Determinism: same conn + same ``now_utc`` ⇒ byte-identical JSON
     (R-PROJ5 invariant). Per-tick memoized on
@@ -5330,33 +5752,51 @@ def _build_projects_envelope(
         return cached
 
     # ---- Week-start anchor (current subscription week) ------------------
-    # ``TuiCurrentWeek.week_start_at`` is NOT a valid Monday lookup key
-    # after ``_apply_midweek_reset_override`` — it is shifted to the
-    # in-week reset instant (e.g. Friday 13:00 UTC) while the bucket
-    # aggregator below snaps every entry to its containing ISO-Monday
-    # via ``_week_for``. Using ``cw_key`` directly as the bucket-lookup
-    # key strands all current-week activity in an empty bucket and emits
-    # ``rows: []`` with ``total_cost_usd: 0.0``. Snap to the canonical
-    # Monday-UTC week anchor here so the lookup keys align — same
-    # invariant the weekly handling notes call out for
-    # ``weekly_usage_snapshots``/``percent_milestones`` cross-table
-    # joins. Regression: ``tests/fixtures/dashboard/reset-week/`` +
+    # #620 S1 D1. The panel buckets cost into the REAL subscription
+    # intervals — the ones `_compute_subscription_weeks` derives from the
+    # retained reset anchors, and the ones `cmd_project` already buckets by.
+    # `_projects_week_start_monday_utc` remains what its own docstring says
+    # it is: the fallback for when no anchor is available. It used to be
+    # applied to the anchor itself, which discarded the very thing it was
+    # written to defer to, so the cost window and the quota window described
+    # different intervals for every account whose reset is not exactly
+    # Monday midnight UTC — in practice almost all of them.
+    #
+    # ``TuiCurrentWeek.week_start_at`` after ``_apply_midweek_reset_override``
+    # is the in-week reset instant rather than the week's start. It is used
+    # here only to locate the containing interval, never as a bucket key, so
+    # a shifted value resolves to the same week the entry walk uses and no
+    # activity is stranded. Regression:
+    # ``tests/fixtures/dashboard/reset-week/`` +
     # ``test_current_week_rows_populated_after_midweek_reset``.
-    if cw_key is not None:
-        cw_start = _projects_week_start_monday_utc(cw_key)
+    anchor_instant = cw_key if cw_key is not None else now_utc
+    grid = _projects_week_grid(
+        conn, anchor_utc=anchor_instant, weeks_back=weeks_back,
+    )
+    cw_start = grid.week_for(anchor_instant) if grid is not None else None
+    if cw_start is None:
+        # No anchor covers `now` — the genuine fallback path, byte-identical
+        # to the pre-#620 behaviour for a store with no anchored snapshots.
+        grid = None
+        cw_start = _projects_week_start_monday_utc(anchor_instant)
+        cw_end = cw_start + dt.timedelta(days=7)
+        week_bounds = [
+            (
+                cw_start - dt.timedelta(days=7 * (weeks_back - 1 - i)),
+                cw_start - dt.timedelta(days=7 * (weeks_back - 2 - i)),
+            )
+            for i in range(weeks_back)
+        ]
     else:
-        cw_start = _projects_week_start_monday_utc(now_utc)
+        cw_end = grid.end_for(cw_start)
+        week_bounds = grid.window_ending_at(cw_start, weeks_back)
 
-    # Build a list of canonical Monday-anchored week starts ending with
-    # cw_start, oldest → newest, of length ``weeks_back``. Clamping to
+    # Week starts, oldest → newest, of length ``weeks_back``. Clamping to
     # actual history happens after the entry walk reveals what weeks
     # have any activity.
-    weeks_full = [
-        cw_start - dt.timedelta(days=7 * (weeks_back - 1 - i))
-        for i in range(weeks_back)
-    ]
-    cw_end = cw_start + dt.timedelta(days=7)
-    since_dt = weeks_full[0]
+    weeks_full = [b[0] for b in week_bounds]
+    end_by_week = {s: e for s, e in week_bounds}
+    since_dt = week_bounds[0][0]
     until_dt = cw_end  # exclusive end; SQL is `>= since AND <= until`
 
     # ---- Bucket entries per (ProjectKey, week_start) --------------------
@@ -5371,7 +5811,7 @@ def _build_projects_envelope(
     # HTTP-drill): the original single full-window walk, byte-unchanged.
     if use_projects_env_cache:
         buckets, total_cost_by_week, key_by_bucket = _assemble_projects_via_cache(
-            conn, weeks_full=weeks_full, cw_start=cw_start, cw_end=cw_end,
+            conn, week_bounds=week_bounds, cw_start=cw_start, cw_end=cw_end,
             cur_max_id=max_id, cur_max_seq=entry_mutation_seq,
         )
     else:
@@ -5387,8 +5827,13 @@ def _build_projects_envelope(
         key_by_bucket = {}
 
         def _week_for(ts: dt.datetime) -> "dt.datetime | None":
-            wstart = _projects_week_start_monday_utc(ts)
-            if wstart < weeks_full[0] or wstart > weeks_full[-1]:
+            if grid is not None:
+                wstart = grid.week_for(ts)
+                if wstart is None:
+                    return None
+            else:
+                wstart = _projects_week_start_monday_utc(ts)
+            if wstart not in end_by_week:
                 return None
             return wstart
 
@@ -5478,34 +5923,78 @@ def _build_projects_envelope(
     # (bin/cctally:1162-1168) and the doctor credited-week check
     # (bin/cctally:8706-8714).
     #
-    # Portable per-key-latest pattern: read rows ordered by capture-
-    # ascending and let later rows overwrite. The final value per key
-    # is the most-recent snapshot.
+    # Reduce to one latest NON-NULL row per candidate date in SQLite, then let
+    # Python resolve those bounded rows onto the anchored interval grid. NULL
+    # rows never erased the prior known value in the former ascending fold, so
+    # they are excluded before ranking. The outer capture order preserves the
+    # same final-overwrite behaviour if two legacy date keys resolve to one
+    # interval. The date bounds keep historical status-line ticks out of the
+    # scan, while the per-date ranking makes the rows crossing into Python
+    # proportional to candidate boundary dates rather than tick count. Do not
+    # LIMIT before Python resolves legacy date keys: an unresolvable key must
+    # not evict a valid rendered-week row (#620 S1 A3).
     weekly_pct_by_week: dict[dt.datetime, float] = {}
     try:
         cur = conn.execute(
-            "SELECT week_start_date, weekly_percent "
-            "FROM weekly_usage_snapshots "
-            "ORDER BY captured_at_utc ASC, id ASC"
+            "WITH ranked AS ("
+            " SELECT week_start_date, week_start_at, weekly_percent,"
+            " captured_at_utc, id,"
+            " ROW_NUMBER() OVER ("
+            "  PARTITION BY week_start_date"
+            "  ORDER BY captured_at_utc DESC, id DESC"
+            " ) AS latest_rank"
+            " FROM weekly_usage_snapshots"
+            " WHERE week_start_date >= ? AND week_start_date < ?"
+            " AND date(week_start_date) IS NOT NULL"
+            " AND weekly_percent IS NOT NULL"
+            ")"
+            " SELECT week_start_date, week_start_at, weekly_percent"
+            " FROM ranked WHERE latest_rank = 1"
+            " ORDER BY captured_at_utc ASC, id ASC",
+            (
+                since_dt.date().isoformat(),
+                cw_end.date().isoformat(),
+            ),
         )
         rows = cur.fetchall()
     except sqlite3.OperationalError:
         # No weekly_usage_snapshots table — leaves attributed_pct = None
         # throughout (acceptable per spec §2.7).
         rows = []
-    for week_date_str, weekly_pct in rows:
+    for week_date_str, week_start_at, weekly_pct in rows:
         try:
             wd = dt.date.fromisoformat(week_date_str)
         except (TypeError, ValueError):
             continue
-        # Snap the date to UTC Monday 00:00 (matches the bucketing key).
-        wstart = dt.datetime.combine(
-            wd, dt.time(0, 0, 0), tzinfo=dt.timezone.utc,
-        )
-        # Snap to Monday (snapshot rows that captured a non-Monday week
-        # boundary still align to the same canonical bucket as the entry
-        # walk, since the bucketing is Monday-anchored).
-        wstart = _projects_week_start_monday_utc(wstart)
+        wstart: "dt.datetime | None" = None
+        if grid is not None:
+            # #620 S1 D1. Resolve the row onto the SAME interval the entry
+            # walk buckets into, so the numerator, the denominator and this
+            # percentage are all taken from one half-open window before the
+            # multiplication below.
+            if week_start_at:
+                try:
+                    anchor = parse_iso_datetime(
+                        week_start_at, "weekly_usage_snapshots.week_start_at",
+                    ).astimezone(dt.timezone.utc)
+                except (TypeError, ValueError):
+                    anchor = None
+                if anchor is not None:
+                    wstart = grid.week_for(anchor)
+            if wstart is None:
+                # A legacy row carrying only the date-only boundary. One
+                # shared interval still serves both the cost and the
+                # percentage; taking them from different intervals is never
+                # acceptable, so an unresolvable row contributes nothing and
+                # `attributed_pct` stays None (#620 S1 A3).
+                wstart = grid.start_for_date(wd)
+            if wstart is None:
+                continue
+        else:
+            # No anchor anywhere in the store: the genuine Monday fallback.
+            wstart = _projects_week_start_monday_utc(dt.datetime.combine(
+                wd, dt.time(0, 0, 0), tzinfo=dt.timezone.utc,
+            ))
         if weekly_pct is not None:
             weekly_pct_by_week[wstart] = float(weekly_pct)
 
@@ -5532,12 +6021,11 @@ def _build_projects_envelope(
     if weeks_with_activity:
         # Window = inclusive [oldest_active_week, cw_start]. Always emits
         # cw_start (panel + trend share the same current_week column).
+        # Keyed by the SAME rule as the current week (#620 S1 D1) — the
+        # subscription intervals themselves, not a seven-day walk, because
+        # a mixed keying inside one panel is the defect restated.
         oldest = min(weeks_with_activity[0], cw_start)
-        trend_weeks = []
-        w = oldest
-        while w <= cw_start:
-            trend_weeks.append(w)
-            w += dt.timedelta(days=7)
+        trend_weeks = [w for w in weeks_full if oldest <= w <= cw_start]
     else:
         trend_weeks = [cw_start]
 
@@ -5613,6 +6101,19 @@ def _build_projects_envelope(
             sessions_per_week.append(len(b["sessions"]))
             first_seen_per_week.append(_iso_z(b["first_seen"]))
             last_seen_per_week.append(_iso_z(b["last_seen"]))
+        session_counts_by_window: dict[str, int] = {}
+        for window_weeks in PROJECT_WINDOW_WEEKS_CHOICES:
+            selected_weeks = trend_weeks[-window_weeks:]
+            # Cached real buckets contribute string identities; the
+            # source-compatible fallback contributes opaque tuple identities.
+            window_sessions: set[object] = set()
+            for selected_week in selected_weeks:
+                selected_bucket = buckets.get((bp, selected_week))
+                if selected_bucket is not None:
+                    window_sessions.update(selected_bucket["sessions"])
+            session_counts_by_window[str(window_weeks)] = len(
+                window_sessions,
+            )
         # Skip projects with zero total cost across the entire window
         # (the bucket-loop only enters projects that have at least one
         # entry, so this is mainly a safety check).
@@ -5624,6 +6125,7 @@ def _build_projects_envelope(
             "weekly_cost":         weekly_cost,
             "weekly_pct":          weekly_pct_arr,
             "sessions_per_week":   sessions_per_week,
+            "session_counts_by_window": session_counts_by_window,
             "first_seen_per_week": first_seen_per_week,
             "last_seen_per_week":  last_seen_per_week,
         })
@@ -5729,14 +6231,87 @@ def _project_detail_for_window(
     if bucket_path is None:
         return None
 
-    # ---- Window bounds (Monday-anchored UTC fallback, like the builder) -
+    # ---- Window bounds, from the envelope's own current-week anchor ----
+    # That anchor is the account's real subscription week start; the
+    # Monday-midnight snap is only the no-anchor fallback (#620).
     cw_start = parse_iso_datetime(
         env["current_week"]["week_start_at"],
         "projects.current_week.week_start_at",
+    ).astimezone(dt.timezone.utc)
+
+    # The drill resolves the SAME interval union its panel resolved, by
+    # rebuilding the panel's grid rather than stepping back in seven-day
+    # multiples. Subscription reset shifts can leave gaps between buckets;
+    # the outer start/end pair is only a candidate-query bound, while
+    # ``window_intervals`` is the authoritative membership contract.
+    # `_ProjectsWeekGrid` exists because a drifted reset day produces a
+    # genuinely short week: on `non-monday-anchor` at `weeks_back=4` the grid
+    # starts the window at 2026-03-27T09:00Z while a seven-day walk yields
+    # 2026-03-26T09:00Z, and an early reset that shortens the current week
+    # would likewise leave a `cw_start + 7d` end counting cost past the
+    # week's real end. `window_start_at` / `window_end_at` publish these
+    # bounds to the client as authoritative, so a divergence here renders a
+    # window the panel never computed.
+    #
+    # The grid is rebuilt from the PANEL'S OWN anchor, not from `cw_start`.
+    # `_projects_week_grid` derives its provisional range from an ISO-Monday
+    # snap of whatever anchor it is handed, and `cw_start` is the interval
+    # START while the panel anchors on `current_week.week_start_at` — which
+    # after `_apply_midweek_reset_override` is the in-week reset instant and
+    # can sit up to a week later. The two therefore snap to different Mondays
+    # and `_compute_subscription_weeks` can pick a different extrapolation
+    # anchor for each, so window equality would rest on a coincidence rather
+    # than on the two surfaces asking the same question. `cw_start` remains
+    # the anchor `window_ending_at` walks back from, because that walk needs
+    # an interval start.
+    panel_anchor = getattr(current_week, "week_start_at", None)
+    if not isinstance(panel_anchor, dt.datetime):
+        panel_anchor = now_utc
+    detail_grid = _projects_week_grid(
+        conn, anchor_utc=panel_anchor, weeks_back=weeks_back,
     )
-    since_dt = cw_start - dt.timedelta(days=7 * (weeks_back - 1))
-    until_dt = cw_start + dt.timedelta(days=7)
-
+    detail_bounds = (
+        detail_grid.window_ending_at(cw_start, weeks_back)
+        if detail_grid is not None else []
+    )
+    if detail_bounds:
+        since_dt = detail_bounds[0][0]
+        until_dt = detail_bounds[-1][1]
+    else:
+        # No anchor covers this start — the same no-anchor tail the panel
+        # falls back to, where the seven-day assumption is the right one.
+        since_dt = cw_start - dt.timedelta(days=7 * (weeks_back - 1))
+        until_dt = cw_start + dt.timedelta(days=7)
+        detail_bounds = [(since_dt, until_dt)]
+    detail_bounds_utc = [
+        (
+            start.astimezone(dt.timezone.utc),
+            end.astimezone(dt.timezone.utc),
+        )
+        for start, end in detail_bounds
+    ]
+    window_intervals = [
+        {"start_at": _iso_z(start), "end_at": _iso_z(end)}
+        for start, end in detail_bounds_utc
+    ]
+    since_iso = since_dt.astimezone(dt.timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    until_iso = until_dt.astimezone(dt.timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    # SQL candidate bound, NOT the published one. Ingestion stores
+    # `timestamp_utc` as `…+00:00` while these bounds are spelled `…Z`, and
+    # SQLite compares that column lexically with `+` (0x2B) below `Z` (0x5A).
+    # So the lower bound drops an entry sitting exactly on it and the upper
+    # bound admits one sitting exactly on it — an asymmetry in both
+    # directions. Widening the lower bound by a second makes SQL an outward
+    # candidate filter at both ends; the half-open membership test is then
+    # enforced on the PARSED datetime in the entry loop, which is the only
+    # place it can be stated honestly.
+    since_sql_iso = (
+        since_dt.astimezone(dt.timezone.utc) - dt.timedelta(seconds=1)
+    ).strftime("%Y-%m-%dT%H:%M:%SZ")
     # ---- Build bucket → source_paths map for SQL-side scoping ----------
     # Walk session_files (~8k rows) once instead of session_entries
     # (~150k+ rows). _resolve_project_key gets called at most ~distinct-
@@ -5787,6 +6362,9 @@ def _project_detail_for_window(
             "key":                    project_key,
             "bucket_path":            bucket_path,
             "window_weeks":           weeks_back,
+            "window_start_at":        since_iso,
+            "window_end_at":          until_iso,
+            "window_intervals":       window_intervals,
             "window_cost_usd":        0.0,
             "window_attributed_pct":  None,
             "models":                 [],
@@ -5810,13 +6388,6 @@ def _project_detail_for_window(
         [(p,) for p in bucket_source_paths],
     )
 
-    since_iso = since_dt.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
-    until_iso = until_dt.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
-
     # ---- Walk session_entries (project-scoped) once -------------------
     # INNER JOIN to _drill_paths drops every row whose source_path
     # doesn't belong to this bucket. The Python-side filter that
@@ -5832,7 +6403,7 @@ def _project_detail_for_window(
         "LEFT JOIN session_files sf ON sf.path = e.source_path "
         "WHERE e.timestamp_utc >= ? AND e.timestamp_utc <= ? "
         "ORDER BY e.timestamp_utc ASC, e.id ASC",
-        (since_iso, until_iso),
+        (since_sql_iso, until_iso),
     )
 
     # Per-model rollup: {model -> {cost_usd, sessions, in, out, cache_*}}
@@ -5855,6 +6426,17 @@ def _project_detail_for_window(
         # on _drill_paths already restricted the result set to entries
         # whose source_path belongs to this bucket.
         ts = parse_iso_datetime(ts_iso, "session_entries.timestamp_utc")
+        # The half-open membership test. The SQL bounds above are a widened
+        # candidate filter that admits a second on each side, because the
+        # column's stored offset spelling and the bound's spelling do not
+        # compare the way the interval means; this is where the interval is
+        # actually decided.
+        ts_utc = ts.astimezone(dt.timezone.utc)
+        if not any(
+            interval_start <= ts_utc < interval_end
+            for interval_start, interval_end in detail_bounds_utc
+        ):
+            continue
         entry_cost = _calculate_entry_cost(
             model,
             claude_usage_dict(   # #195 chokepoint
@@ -5977,6 +6559,9 @@ def _project_detail_for_window(
         "key":                    project_key,
         "bucket_path":            bucket_path,
         "window_weeks":           weeks_back,
+        "window_start_at":        since_iso,
+        "window_end_at":          until_iso,
+        "window_intervals":       window_intervals,
         "window_cost_usd":        window_cost,
         "window_attributed_pct":  win_pct,
         "models":                 models_out,
@@ -6191,6 +6776,36 @@ def _qs_str(q: dict, key: str, default: str | None) -> str | None:
     return vals[0] if vals else default
 
 
+def _qs_flag(q: dict, key: str) -> bool:
+    """Parse a single query-string boolean.
+
+    A bare `?flag` and `?flag=1` are both true; `0`, `false` and `no` are
+    false. Written out rather than spelled `bool(_qs_str(...))`, because that
+    reads `?reveal_projects=0` as a REQUEST to reveal — the string "0" is
+    truthy — which is the wrong direction for a privacy switch.
+    """
+    raw = _qs_str(q, key, None)
+    if raw is None:
+        return False
+    return raw.strip().lower() not in ("0", "false", "no", "off")
+
+
+class _DiagnosisSelectorError(Exception):
+    """A `/api/diagnosis` request whose selectors are wrong (#620 S2).
+
+    Distinct from `EstablishmentFailure`, whose codes are the closed
+    report-establishment enum. A selector this route rejects — an unknown
+    source, an account combined with `source=all` — never reached the point of
+    establishing a report, so it carries its own code rather than borrowing one
+    from that enum and claiming a stage it never got to.
+    """
+
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+        self.message = message
+
+
 # ── /api/debug/backend on-demand cache-state helpers (issue #276, Session A) ──
 # All read-only, cheap, and privacy-safe: they leak ONLY row counts, signature
 # legs (ints/tuples), pending-flag names, and the tool version — never prompt /
@@ -6471,6 +7086,11 @@ _GET_ROUTES = (
     ("exact", "/api/share/presets", "_handle_share_presets_get", None, False),
     ("exact", "/api/share/history", "_handle_share_history_get", None, False),
     ("exact", "/api/doctor", "_handle_get_doctor", None, False),
+    # #620 S2 — the on-demand diagnosis. Exact, so it can neither shadow nor
+    # be shadowed by the parameterized conversation routes below (dispatch
+    # compares exact paths first, so the placement here is a convention).
+    ("exact", "/api/diagnosis", "_handle_get_diagnosis",
+     ("scope", "endpoint.diagnosis"), False),
     ("exact", "/api/debug/backend", "_handle_get_debug_backend", None, False),
     ("exact", "/api/conversations/facets", "_handle_get_conversations_facets",
      ("scope", "endpoint.conversations_facets"), False),
@@ -6948,32 +7568,22 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             })
             return
         try:
-            # The locked section is a REBUILD, and this is the path an
-            # uncontended manual refresh actually takes, so it reports itself
-            # like every other rebuild does.
-            cls.mark_rebuilding(True)
-            warnings: list = []
-            if do_refresh:
-                if cls.no_sync:
-                    warnings.append({"code": "refresh_skipped_no_sync"})
-                else:
-                    result = _refresh_usage_inproc()
-                    if result.status != "ok":
-                        warnings.append({"code": result.status})
-            try:
-                cls.run_sync_now_locked()
-            except Exception as exc:
-                self.log_error("/api/sync rebuild failed: %r", exc)
-                self.send_error(500, "sync failed")
-                return
+            with _rebuilding_claim(cls.mark_rebuilding):
+                warnings: list = []
+                if do_refresh:
+                    if cls.no_sync:
+                        warnings.append({"code": "refresh_skipped_no_sync"})
+                    else:
+                        result = _refresh_usage_inproc()
+                        if result.status != "ok":
+                            warnings.append({"code": result.status})
+                try:
+                    cls.run_sync_now_locked()
+                except Exception as exc:
+                    self.log_error("/api/sync rebuild failed: %r", exc)
+                    self.send_error(500, "sync failed")
+                    return
         finally:
-            # Drops THIS thread's claim only, so the ordering against the lock
-            # release is not what makes it safe: a concurrent rebuilder's claim
-            # is a different set member and this call cannot touch it, whichever
-            # side of the release it runs on. On the success path the rebuild's
-            # terminal publish has already dropped this thread's claim and this
-            # adds no frame; the exception path is what needs it.
-            cls.mark_rebuilding(False)
             sync_lock.release()
 
         if warnings:
@@ -7992,12 +8602,10 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # outside the acquire because `run_sync_now` takes `sync_lock` itself;
         # a wait for a rebuild already in flight is honestly in-flight too.
         try:
-            type(self).mark_rebuilding(True)
-            type(self).run_sync_now()
+            with _rebuilding_claim(type(self).mark_rebuilding):
+                type(self).run_sync_now()
         except Exception as exc:
             eprint(f"warning: settings broadcast failed: {exc!r}")
-        finally:
-            type(self).mark_rebuilding(False)
 
         self._respond_json(200, out)
 
@@ -8098,10 +8706,17 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             return
 
         if axis == "weekly":
+            # Mirrors the CLI `alerts test --axis weekly` branch: the preview
+            # carries the reset INSTANT a real crossing carries, so it renders
+            # the instant form rather than the day-granularity fallback.
+            preview_week_start = synthetic_preview_week_start()
             payload = _build_alert_payload_weekly(
                 threshold=threshold,
                 crossed_at_utc=now_utc_iso(),
-                week_start_date=dt.date.today().isoformat(),
+                week_start_date=preview_week_start.date().isoformat(),
+                week_start_at=preview_week_start.isoformat().replace(
+                    "+00:00", "Z"
+                ),
                 cumulative_cost_usd=1.23,
                 dollars_per_percent=0.01,
             )
@@ -8409,6 +9024,250 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             self.log_error("/api/doctor failed after commit: %r", exc)
             self.close_connection = True
 
+    # ── GET /api/diagnosis (#620 S2, spec §5) ───────────────────────────────
+    #
+    # The on-demand diagnosis. NOT an envelope key: an envelope key would pay
+    # #607's client per-frame cost on every tick for a surface most ticks never
+    # display, and would force a deliberate re-take of the byte-identity
+    # baseline at bench/baselines/envelope-oracle.json.
+
+    def _send_diagnosis_json(self, status: int, body: dict) -> None:
+        encoded = encode_dashboard_json_bytes(body, ensure_ascii=False)
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Cache-Control", "no-cache")
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _diagnosis_selectors(self, query):
+        """Resolve one request's selectors into a `DiagnosisScope`.
+
+        Raises `_DiagnosisSelectorError` for anything the caller got wrong and
+        `EstablishmentFailure` for anything that could not be established. Both
+        are 400 here; only `store_unavailable` and `generation_incoherent` are
+        503, because those two say the machine could not answer rather than
+        that the request was wrong.
+        """
+        c = _cctally()
+        diagnosis = c._load_sibling("_cctally_diagnosis")
+        sources = c._load_sibling("_cctally_diagnosis_sources")
+        kernel = c._load_sibling("_lib_diagnosis")
+
+        source = _qs_str(query, "source", "claude") or "claude"
+        if source not in ("claude", "codex", "all"):
+            raise _DiagnosisSelectorError(
+                "invalid_selector",
+                f"source must be claude, codex or all, not {source!r}")
+        account = _qs_str(query, "account", None)
+        if account is not None and source == "all":
+            # Account keys are provider-scoped, so one selector cannot address
+            # both providers. The CLI exits 2 on the same condition.
+            raise _DiagnosisSelectorError(
+                "invalid_selector",
+                "account cannot be combined with source=all "
+                "(account keys are provider-scoped)")
+        speed = _qs_str(query, "speed", None)
+        if speed in ("auto", ""):
+            speed = None
+        if speed is not None and speed not in ("standard", "fast"):
+            raise _DiagnosisSelectorError(
+                "invalid_selector",
+                f"speed must be auto, standard or fast, not {speed!r}")
+
+        raw_tz = _qs_str(query, "tz", None)
+        config = _apply_display_tz_override(
+            load_config(), type(self).display_tz_pref_override,
+        )
+        try:
+            tz_name = diagnosis.resolve_tz_name(
+                argparse.Namespace(tz=raw_tz), config,
+            )
+        except ValueError as exc:
+            raise _DiagnosisSelectorError("invalid_selector", str(exc)) from exc
+
+        now_utc = _command_as_of()
+        start_raw = _qs_str(query, "start_at", None)
+        end_raw = _qs_str(query, "end_at", None)
+        if start_raw or end_raw:
+            # The alert-follow path carries INSTANTS, not calendar days: a
+            # five-hour block start is not a date, so the window grammar's
+            # date-only form cannot reproduce the window a warning fired
+            # against. Explicit bounds are how that window reaches the route.
+            if not (start_raw and end_raw):
+                raise kernel.EstablishmentFailure(
+                    kernel.EstablishmentError.RANGE_UNRESOLVED.value,
+                    "start_at and end_at must be given together")
+            start_at = parse_iso_datetime(start_raw, "start_at")
+            end_at = parse_iso_datetime(end_raw, "end_at")
+            start_at = (start_at.replace(tzinfo=dt.timezone.utc)
+                        if start_at.tzinfo is None
+                        else start_at.astimezone(dt.timezone.utc))
+            end_at = (end_at.replace(tzinfo=dt.timezone.utc)
+                      if end_at.tzinfo is None
+                      else end_at.astimezone(dt.timezone.utc))
+            label = ""
+        else:
+            token = _qs_str(query, "window", "this-week") or "this-week"
+            diff_kernel = c._load_sibling("_lib_diff_kernel")
+            try:
+                parsed = diagnosis._resolve_window(
+                    argparse.Namespace(window=token), now_utc, tz_name,
+                )
+            except diff_kernel.NoAnchorError as exc:
+                # A week token this machine holds no anchor for is an
+                # unresolved RANGE. It is a `RuntimeError`, so without this it
+                # reached the outer handler and was served as 500 — an
+                # unexplained internal error for a request the server could
+                # perfectly well describe.
+                raise kernel.EstablishmentFailure(
+                    kernel.EstablishmentError.RANGE_UNRESOLVED.value,
+                    str(exc)) from exc
+            start_at, end_at, label = (parsed.start_utc, parsed.end_utc,
+                                       parsed.label)
+
+        account_key = None
+        if account is not None:
+            account_key = self._resolve_diagnosis_account(
+                sources, account,
+                source if source in ("claude", "codex") else "claude",
+            )
+        # DiagnosisScope's own __post_init__ raises `range_unresolved` for a
+        # naive or inverted window, so an out-of-order pair is rejected by the
+        # same rule the CLI applies rather than by a second one here.
+        return sources.DiagnosisScope(
+            source=source,
+            account_key=account_key,
+            window_start=start_at,
+            window_end=end_at,
+            effective_speed=speed,
+            display_tz=tz_name,
+            label=label,
+        ), now_utc, _qs_flag(query, "reveal_projects")
+
+    @staticmethod
+    def _resolve_diagnosis_account(sources, ref: str, provider: str):
+        """Resolve `?account=` over the diagnosis's own read-only open path.
+
+        `resolve_account_filter` reaches stats.db through the ordinary opener,
+        which migrates, repairs, imports and replays. This route reads and
+        never writes, so it resolves the ref over `mode=ro`, exactly as
+        `cmd_explain` does — and a ref that could not be resolved for ANY
+        reason, including a machine with no registry at all, is an unresolved
+        account rather than an unavailable store.
+        """
+        import _lib_accounts as accounts
+        kernel = _cctally()._load_sibling("_lib_diagnosis")
+        try:
+            conn = sources.open_read_only("stats")
+        except kernel.EstablishmentFailure as exc:
+            raise kernel.EstablishmentFailure(
+                kernel.EstablishmentError.ACCOUNT_UNRESOLVED.value,
+                f"account {ref!r} is ambiguous or unknown "
+                f"(this machine holds no account registry)") from exc
+        try:
+            return accounts.resolve_account_ref(conn, ref, provider)
+        except accounts.AccountRefError as exc:
+            raise kernel.EstablishmentFailure(
+                kernel.EstablishmentError.ACCOUNT_UNRESOLVED.value,
+                f"account {ref!r} is ambiguous or unknown") from exc
+        finally:
+            conn.close()
+
+    def _handle_get_diagnosis(self) -> None:
+        """`GET /api/diagnosis` — the on-demand diagnosis (#620 S2, spec §5).
+
+        Read-only and mutating nothing: the whole read goes through
+        `_cctally_diagnosis_sources`, whose only opener is a `mode=ro` connect
+        that performs no schema work, no migration, no legacy import and no
+        contract repair. It runs on the request thread, outside the snapshot
+        build and outside its pinned cache transaction.
+
+        `_require_api_auth` applies automatically, before dispatch. No CSRF
+        check: `_check_origin_csrf` is opt-in for the routes that mutate, and
+        this one does not.
+
+        Status codes: 200 for any valid coherently-generated report, including
+        a healthy one, an empty one and one whose fields are withheld; 400 for
+        a malformed selector and for an unresolved range or account; 503 for
+        `generation_incoherent`, for `store_unavailable`, and for a report the
+        kernel's `unreadable_store_is_terminal` holds over — that last one
+        publishes the withheld REPORT as the body, not an empty error, for the
+        same reason the CLI still prints it while exiting 3: a person needs to
+        read the typed cause. 500 for an unexpected invariant failure, which is
+        never converted into a healthy 200.
+        """
+        import urllib.parse as _urlparse
+
+        c = _cctally()
+        kernel = c._load_sibling("_lib_diagnosis")
+        diagnosis = c._load_sibling("_cctally_diagnosis")
+        sources = c._load_sibling("_cctally_diagnosis_sources")
+        query = _urlparse.parse_qs(_urlparse.urlparse(self.path).query)
+
+        # Preparation and commit are separate, as on every other JSON route:
+        # before headers a failure can still become a JSON 500; after them the
+        # only valid recovery is log + close.
+        try:
+            try:
+                scope, now_utc, reveal = self._diagnosis_selectors(query)
+                # Evaluated ONCE, before the plan is resolved, and threaded
+                # into plan stage 1. A class denied there is settled: the
+                # store it would have needed is never opened, probed or
+                # digested, and the identifier this response publishes
+                # describes what actually ran rather than what was intended.
+                # The predicate itself is untouched (D-E) — this composes it,
+                # it does not change it.
+                report = sources.build_diagnosis(
+                    scope, measured_at=now_utc,
+                    transcripts_visible=self._transcripts_visible_to_request(),
+                )
+            except _DiagnosisSelectorError as exc:
+                self._send_diagnosis_json(
+                    400, {"error": exc.message, "code": exc.code})
+                return
+            except ValueError as exc:
+                # A malformed instant from `parse_iso_datetime`.
+                self._send_diagnosis_json(400, {
+                    "error": str(exc),
+                    "code": kernel.EstablishmentError.RANGE_UNRESOLVED.value,
+                })
+                return
+            except kernel.EstablishmentFailure as exc:
+                # `store_unavailable` reaches this arm only from SELECTOR
+                # resolution — the week anchor, which reads stats.db through
+                # the ordinary opener. It can never arrive from
+                # `build_diagnosis`, which converts every store failure it
+                # meets into `_unavailable_provider_result` so the withheld
+                # report is published rather than lost; nor from
+                # `_resolve_diagnosis_account`, which re-codes an unopenable
+                # stats.db as `account_unresolved`. Both conversions are
+                # deliberate, so do not read the mapping as dead code.
+                status = 503 if exc.code in (
+                    kernel.EstablishmentError.STORE_UNAVAILABLE.value,
+                    kernel.EstablishmentError.GENERATION_INCOHERENT.value,
+                ) else 400
+                self._send_diagnosis_json(
+                    status, {"error": exc.message, "code": exc.code})
+                return
+
+            scopes = {result.source: diagnosis._scope_for(sources, scope,
+                                                          result.source)
+                      for result in report.results}
+            body = diagnosis.diagnosis_to_wire(report, scopes=scopes,
+                                               reveal_projects=reveal)
+            status = 503 if kernel.unreadable_store_is_terminal(report) else 200
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("/api/diagnosis failed before commit: %r", exc)
+            self._send_diagnosis_json(500, {"error": "internal error"})
+            return
+
+        try:
+            self._send_diagnosis_json(status, body)
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("/api/diagnosis failed after commit: %r", exc)
+            self.close_connection = True
+
     def _handle_get_session_detail(self, path: str) -> None:
         """Return TuiSessionDetail JSON for the given session id (spec §3.2).
 
@@ -8727,12 +9586,14 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             entries_in_window = list(get_entries(
                 start_at, end_at, skip_sync=self.no_sync,
             ))
+            entry_membership: dict[int, list[UsageEntry]] = {}
             blocks = _group_entries_into_blocks(
                 entries_in_window, mode="auto",
                 recorded_windows=recorded_windows,
                 block_start_overrides=block_start_overrides,
                 canonical_intervals=canonical_intervals,
                 now=now_utc,
+                _entry_membership=entry_membership,
             )
             target = next(
                 (b for b in blocks
@@ -8743,10 +9604,7 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 status = 404
                 body = encode_dashboard_json_bytes({"error": "block not found"})
             else:
-                block_entries = [
-                    e for e in entries_in_window
-                    if target.start_time <= e.timestamp < target.end_time
-                ]
+                block_entries = entry_membership[id(target)]
                 # Resolve display tz once per request so the block detail's
                 # `label` matches the snapshot envelope's blocks panel.
                 # Shared resolver -- same warn-once semantics as