cctally 1.106.0 → 1.108.0

package/CHANGELOG.md

@@ -5,6 +5,74 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.108.0] - 2026-09-05
+
+### Added
+- Codex reporting prices `gpt-6-astra` from OpenAI's published standard, cached-input, long-context and Fast-mode rates instead of the legacy `gpt-5` fallback.
+- `cctally alerts test` gains `--axis quota` and `--axis meter-rate-change`, so you can rehearse those two notifications instead of waiting for a real crossing or rate change. `--threshold` does not apply to `meter-rate-change`.
+- `cctally percent-breakdown` and `cctally report --detail` name a run of percent thresholds that one observation recorded, and print `observation_gap` where the marginal cost showed a bare `n/a`. `--json` adds `marginalCostWithheldCause`.
+- On an install with more than one account for a provider, every alert toast names the account it belongs to, as the dashboard's Recent Alerts list already did.
+- `cctally doctor` gains `hooks.codex_liveness_7d`, which FAILs when an enabled Codex hook has not succeeded in seven days. It reads the per-root success markers, so log rotation cannot hide a hook that stopped firing.
+
+### Changed
+- `cctally weekly`, `cctally report` and `cctally project` render a week credited twice as three rows, one per billing cycle. A dictionary keyed on the week alone now keeps only the last cycle; key on the week and its start instant together.
+- `cctally weekly`, `cctally report` and `cctally project` start the first cycle of a week whose boundary moved and was then credited at the moved boundary. The previous week keeps its own spend, which was counted into the credited week.
+- Upgrading from 1.107.0 or earlier rebuilds the disposable stats index once, because a weekly reset now records the observation it came from and a rate change records its evidence. Commands report the rebuild until it finishes.
+- A metering-rate change recorded before this upgrade reports no evidence rather than inventing any.
+- A weekly credit is recorded at the exact second Anthropic issued it rather than the top of that hour, so a reading captured earlier in the same hour stays in the cycle it belongs to.
+- A pre-credit reading captured before a second weekly credit now survives and is shown inside the earlier cycle, because each credit's cleanup is scoped to its own instant instead of reaching back past the previous credit.
+- `cctally doctor` now reads Codex's own hook trust record and FAILs when the cctally handler is disabled or was never trusted in Codex `/hooks`, instead of reporting it as installed.
+- `cctally doctor` warns when the Codex handler changed after Codex last recorded a trust decision about it, and when that record cannot be read at all.
+- `cctally setup` refuses at exit 1 when reconciling the Codex handler would land it on a trust decision Codex recorded about a different handler. The message names the file, the slots and the fix.
+- When Codex's trust record changes mid-run, the `cctally setup` refusal names each Codex hooks file it had already rewritten and the dated backup of its previous contents. `--json` adds `changed_hooks_backups`.
+- `cctally doctor` states how many Codex roots are installed beside how many are enabled, so two installed-but-untrusted handlers no longer read as `0/2 root(s) enabled` alone.
+- `cctally setup` recognizes a Codex handler written by a different install channel and collapses it into one canonical handler, instead of adding a second one beside it.
+- `cctally setup --json` moves to `schema_version: 2`: the `installed_review_required` state is retired, and per-root `changes` becomes a per-event object with separate added, removed and unchanged counts.
+- `cctally setup --dry-run` and the applied run now report the same added, removed and unchanged Codex handler counts for the same input.
+- The dashboard and the TUI stop treating a Codex handler as trusted merely because it is present, and re-check that trust when `config.toml` changes, so a hook disabled while either was running no longer certifies stale conversation cost.
+- A freshly installed Codex handler reports as untrusted, and `cctally doctor` FAILs, until you approve it in Codex `/hooks`. Until then the dashboard and the TUI walk every Codex session on each refresh.
+- Two `cctally setup` messages read as ordinary English again: the orphaned `[hooks.state]` remedy says to remove the entry from the file by hand, and a moved trust slot says the handler would move from one key to the other.
+
+### Fixed
+- A percent milestone crossed on a week that holds two recorded resets is listed again. It was filed against one cycle while `cctally percent-breakdown` listed another, so the crossing appeared under neither.
+- Every view of a credited week picks the cycle the week is currently in, not the reset written last. `cctally diff`, the TUI's per-percent modal and the dashboard's milestone list could each name an earlier cycle.
+- A weekly threshold notification names the billing cycle that crossed. On a week credited more than once it read `Week starting Jun 05` for every cycle, naming all of them at once; an uncredited week reads exactly as before.
+- A second Anthropic usage reset inside one subscription week now registers. Every reset in a week shared one slot, so the first held it and later ones were discarded, leaving the reported percentage at the pre-reset high-water mark.
+- A weekly reset observed while cctally is interrupted is no longer lost, and one zero reading can no longer confirm itself into a credit. The pending-reset state moved into the database and commits or rolls back with the reset it fired.
+- A stale pre-credit reading that a credit removed stays removed after `cctally db rebuild --db stats`. The removal is recorded, so a rebuild no longer restores the reading and holds the reported percentage at the pre-credit high.
+- An idle session no longer holds the reported weekly percentage at a stale value. It re-renders its status line from a cached rate-limit block, and that block is now ignored in full once its five-hour window has closed.
+- A severe metering-rate drop now raises a red alert toast instead of the amber that made it look like a smaller drop, and the toast's rate chip matches the colour Recent Alerts already showed for the same event.
+- A metering-rate change detected while the quota calibration was withheld now records which calibration was withheld and how many baseline days were missing, instead of pointing you at a fitted budget that may never have been produced.
+- A metering-rate change whose notification failed and is retried later now carries that same disclosure, because it is read back from the recorded change rather than re-derived from a later run.
+- A metering-rate toast now names the calibration that was withheld and why, instead of pointing you at a fitted budget that may not exist. An ordinary rate change reads exactly as it did before.
+- Recent Alerts shows the evidence behind a metering-rate change: the withheld calibration, the detector's inputs, the composition provenance, and how many baseline days were withheld.
+- An alert toast on a multi-account install states how to dismiss it again, on its own line below the alert's own text rather than above it, so a screen reader reads the alert before it reads how to close it.
+- Alert toasts are usable from the keyboard: press Enter or Space to dismiss one, or to activate its own button and open the window it names. A focused toast states the alert before how to close it, and dismissing one restores focus.
+- The dashboard's Daily panel reads `loading` while it hydrates, instead of reporting the 30-day window as `withheld` over a loading skeleton.
+- The dashboard's Trend panel states its title in full on a phone. The week and cycle counts moved to the wrapping sub-line the other cards use, so the title is no longer cut off mid-word.
+- The dashboard's Daily panel prints its total and peak-day amounts in full on a narrow window. Below about 400px the two summary columns stack instead of cutting the dollar figures off.
+- An install upgrading from a version that predates the append-only journal no longer records a second copy of a reset it already had, so a credited week keeps its own cycles instead of gaining an extra one.
+
+## [1.107.0] - 2026-09-04
+
+### Changed
+- The same-window weekly credit model introduced in 1.106.0 is reverted. A week is anchored to its billing cycle again, and a recorded credit no longer rewrites the week in place or withholds the `$/1%` figure.
+- Upgrading from 1.106.0 rebuilds the disposable stats index once. On a large store that took about a minute here, and commands report that a rebuild is running until it finishes.
+- `claude-fable-5-1` and `claude-mythos-5-1` each count as their own model family in the weekly quota model, instead of being pooled with the model they follow. Your quota calibration refits once on the next `cctally quota` run.
+- `cctally doctor` separates the one refused-pricing-write state that restarting cctally cannot clear — a recorded pricing date it cannot read — from the ordinary one, and names the step that does clear it.
+- A shared `cctally weekly` artifact labels each row by the date its cycle began, matching the terminal table and the dashboard. On a week Anthropic reset early, that label and the artifact's stated period both move forward.
+- The dashboard's Projects panel counts a credited week as the two billing cycles it is, so its week grid covers fewer calendar days for the same week count.
+- The `cctally weekly` and `cctally report` artifacts, the dashboard's Weekly panel footer and the Weekly modal title all count billing cycles rather than weeks, because a credited week supplies two rows. `Avg %/wk` is now `Avg %/cycle`.
+
+### Fixed
+- `cctally weekly` renders a week credited in place as two rows, one per billing cycle, matching `cctally report`. The cycle before the credit had no row at all, and its spend was missing from the table and from `--json` totals.
+- The dashboard's Weekly panel and the TUI show both cycles of a credited week from one source, so a week's two rows can no longer disagree with the panel total beside them.
+- `cctally project` counts a credited week as the two billing cycles it is, so `--weeks N` spans a shorter calendar range there. `attributedUsedPercent` rises, because the cycle before the credit matches its usage snapshot again.
+- A `cctally dashboard` left running across a pricing update can no longer overwrite corrected conversation cost from the table it started with. It keeps ingesting, your conversations stay listed, and `cctally doctor` says to restart it.
+- `cctally doctor` reports a refused conversation-cost write from any process that hit it, including short-lived ones like the status line and `cctally daily` that never open the conversation store.
+- `cctally cache-sync --rebuild` says it did nothing when it may not rewrite conversation cost, instead of reporting `0 processed` and exiting 0. It names both reasons: a stored pricing table newer than this one, or one that is not a date.
+- `cctally doctor`'s refused-pricing-write warning clears once cctally is running current with the store, including after a refused `cctally cache-sync --rebuild`. That refusal previously left a warning the documented remedy could not clear.
+
 ## [1.106.0] - 2026-09-03
 
 ### Changed

package/bin/_cctally_alerts.py

@@ -252,9 +252,16 @@ def _alert_label_prefix(axis: str, account_key: "str | None",
     install's alert text stays byte-identical to today.
 
     Delegates the R8 gate + label precedence to the single-definition helpers
-    ``_cctally_account.real_account_count`` / ``account_label`` (P2-CQ1) so the
-    ">1 real account" trigger and the key->label map have exactly one home; this
-    wrapper only opens the RO connection and stays best-effort/never-raise.
+    ``_cctally_account.provider_is_decorated`` / ``account_label`` (P2-CQ1) so
+    the ">1 real account" trigger and the key->label map have exactly one home;
+    this wrapper only opens the RO connection and stays best-effort/never-raise.
+
+    #702: the gate is the canonical predicate itself, negated at the call site.
+    This site previously inverted the underlying counter by hand
+    (``real_account_count(conn, vendor) <= 1``), which is a second written form
+    of the R8 threshold — the arrangement that lets the two spellings disagree
+    if the threshold ever moves. ``provider_is_decorated`` is ``> 1``, so the
+    suppressed branch is ``not provider_is_decorated(...)``.
 
     #697: the VENDOR comes from the payload's own ``provider`` when it carries
     one, and from ``_AXIS_VENDOR`` otherwise. The metering-rate-change family
@@ -288,7 +295,7 @@ def _alert_label_prefix(axis: str, account_key: "str | None",
             connect=lambda p: _sq.connect(f"file:{p}?mode=ro", uri=True),
         )
         try:
-            if _cctally_account.real_account_count(conn, vendor) <= 1:
+            if not _cctally_account.provider_is_decorated(conn, vendor):
                 return ""
             # #416 §6: population-aware, so two accounts that auto-label to
             # one email do not print the same alert prefix.
@@ -400,8 +407,27 @@ def _dispatch_alert_notification(
         # rate transition has no percentage threshold for `severity_for` to
         # map. Reading it verbatim is what keeps the three tiers meaningful
         # here; falling through would floor every transition at `info`.
+        #
+        # #750 S2: the vocabulary is RESOLVED from the kernel's own tuple
+        # rather than restated as a literal. A restated literal makes this the
+        # second written form of the same rule, which is exactly the
+        # arrangement #747 closed on the envelope: a fourth member added to
+        # `RATE_CHANGE_SEVERITIES`, to the TypeScript tuple and to the CSS
+        # passes every parity test and is still clamped to `info` here, so the
+        # OS notification's urgency and the trailing `alerts.log` column are
+        # wrong while the suite is green.
+        #
+        # Guarded the same way `_cctally_dashboard_envelope` guards its copy,
+        # and an unresolvable kernel degrades to NO clamp. This function's
+        # contract is that it never raises, and clamping against an empty
+        # vocabulary would send every correct severity to `info`.
         severity = str(payload.get("severity") or "info")
-        if severity not in ("info", "warn", "alarm"):
+        try:
+            _severities = frozenset(
+                _load_lib("_lib_meter_rate_change").RATE_CHANGE_SEVERITIES)
+        except Exception:                              # noqa: BLE001
+            _severities = None
+        if _severities is not None and severity not in _severities:
             severity = "info"
     else:
         try:
@@ -484,6 +510,54 @@ def _dispatch_alert_notification(
     return status
 
 
+def _synthetic_instant_days_ago(days: int) -> str:
+    """A timezone-aware ISO instant `days` before now (#699).
+
+    Negative goes forward, which is what a quota reset needs. Both non-registry
+    synthetics require real instants rather than placeholders: the rate-change
+    body renders an effective date, and the quota body renders a reset.
+    """
+    moment = dt.datetime.now(dt.timezone.utc) - dt.timedelta(days=days)
+    return moment.isoformat().replace("+00:00", "Z")
+
+
+def _test_alert_account_key(vendor: str) -> str:
+    """A REAL account key for `vendor`, else the vendor-wide sentinel (#699).
+
+    This is what makes the R8 `[<label>]` prefix observable from
+    `alerts test`: on a decorated install the synthetic carries a key the
+    registry can label, and on a single-account install it falls back to `*`,
+    which `_alert_label_prefix` suppresses — so that install's output stays
+    byte-identical, exactly as R8 requires.
+
+    Best-effort and never-raise, following `_alert_label_prefix`: a missing
+    database, an unreadable registry or an empty one all degrade to the
+    sentinel rather than turning a rehearsal into an error path.
+    """
+    try:
+        import sqlite3 as _sq
+        import _cctally_account
+        import _cctally_store
+        db_path = _cctally_core.DB_PATH
+        if not db_path.exists():
+            return _lib_accounts.VENDOR_WIDE
+        conn = _cctally_store.stats_open_guarded(
+            db_path,
+            connect=lambda p: _sq.connect(f"file:{p}?mode=ro", uri=True),
+        )
+        try:
+            for row in _cctally_account.load_accounts(conn, vendor):
+                key = str(row.get("account_key") or "")
+                if key and key not in (_lib_accounts.UNATTRIBUTED,
+                                       _lib_accounts.VENDOR_WIDE):
+                    return key
+        finally:
+            conn.close()
+    except Exception:                                  # noqa: BLE001
+        return _lib_accounts.VENDOR_WIDE
+    return _lib_accounts.VENDOR_WIDE
+
+
 def cmd_alerts_test(args: argparse.Namespace) -> int:
     """Send a synthetic test alert through the dispatch pipeline.
 
@@ -510,9 +584,28 @@ def cmd_alerts_test(args: argparse.Namespace) -> int:
         axis = "codex_budget"
     elif args.axis == "projected":
         axis = "projected"
+    elif args.axis == "quota":
+        axis = "quota"
+    elif args.axis == "meter-rate-change":
+        axis = "meter_rate_change"
     else:
         axis = "five_hour"
-    threshold = int(args.threshold)
+    # #699: `--threshold` now defaults to None so that "supplied" is
+    # distinguishable from "defaulted". Every axis that takes one still gets 90
+    # when it is omitted, which keeps the existing surface byte-identical.
+    raw_threshold = getattr(args, "threshold", None)
+    if axis == "meter_rate_change" and raw_threshold is not None:
+        # Exit 2 is native-usage per docs/cli-contract.md. The message names
+        # BOTH the axis and the flag: a refusal that does not say what failed
+        # costs the reader more than one that gives no reason at all.
+        print(
+            "cctally: --axis meter-rate-change does not accept --threshold; "
+            "a metering-rate change has no percentage threshold and carries "
+            "an explicit severity instead",
+            file=sys.stderr,
+        )
+        return 2
+    threshold = 90 if raw_threshold is None else int(raw_threshold)
     # --threshold range stays [1, 100] (F5): the cap is axis-uniform with the
     # existing weekly/5h thresholds. Over-budget tiers (>100%) are a v2
     # deferral, not an oversight — see spec §2 (F5).
@@ -603,6 +696,54 @@ def cmd_alerts_test(args: argparse.Namespace) -> int:
             denominator=denominator,
             week_start_at=dt.date.today().isoformat(),
         )
+    elif axis == "meter_rate_change":
+        # #699: the family is deliberately NOT in `AXIS_REGISTRY`, so there is
+        # no `_build_alert_payload_*` helper for it. The synthetic descriptor
+        # is built HERE and passed through the real
+        # `_lib_meter_rate_change.alert_payload`, which is what keeps that
+        # kernel clock-, database- and policy-free while still rehearsing the
+        # exact payload production dispatches.
+        import _lib_meter_rate_change as _mrc
+        previous, new = 2_442_620.0, 1_665_096.0
+        effective = _synthetic_instant_days_ago(7)
+        payload = _mrc.alert_payload(_mrc.RateChangeTransition(
+            provider="claude",
+            account_key=_test_alert_account_key("claude"),
+            effective_from=effective,
+            previous_units_per_point=previous,
+            new_units_per_point=new,
+            # Computed by the real kernel rather than hardcoded, so a change
+            # to the severity boundaries is rehearsed here too. These rates
+            # are a 31.8% drop — the maintainer's own observed transition —
+            # which lands on `alarm`.
+            severity=_mrc.transition_severity(previous, new),
+            detected_at=now_utc_iso(),
+            # The #690 disclosure, so the rehearsal exercises the withheld
+            # copy rather than only the ordinary path.
+            withholding_status="unsupported-model-mix",
+            detector_input_causes='["unsupported-composition"]',
+            composition_provenance='["forecast-aggregate"]',
+            baseline_withheld_days=3,
+        ))
+    elif axis == "quota":
+        # #699: also outside `AXIS_REGISTRY`, but this one HAS a payload
+        # builder, so the synthetic goes through it unchanged. `source` is
+        # `codex` because that is the only vendor this family observes, and
+        # `_AXIS_VENDOR` maps the axis to the same vendor for the R8 lookup.
+        payload = _build_alert_payload_quota(
+            source="codex",
+            source_root_key="default",
+            logical_limit_key="weekly",
+            observed_slot=_synthetic_instant_days_ago(2),
+            window_minutes=10080,
+            resets_at_utc=_synthetic_instant_days_ago(-5),
+            threshold=threshold,
+            kind="weekly",
+            crossed_at_utc=now_utc_iso(),
+            qualifying_percent=float(threshold),
+            projected_percent=min(100.0, float(threshold) + 5.0),
+            account_key=_test_alert_account_key("codex"),
+        )
     else:
         payload = _build_alert_payload_five_hour(
             threshold=threshold,