cctally 1.107.0 → 1.108.0

package/CHANGELOG.md

@@ -5,6 +5,54 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.108.0] - 2026-09-05
+
+### Added
+- Codex reporting prices `gpt-6-astra` from OpenAI's published standard, cached-input, long-context and Fast-mode rates instead of the legacy `gpt-5` fallback.
+- `cctally alerts test` gains `--axis quota` and `--axis meter-rate-change`, so you can rehearse those two notifications instead of waiting for a real crossing or rate change. `--threshold` does not apply to `meter-rate-change`.
+- `cctally percent-breakdown` and `cctally report --detail` name a run of percent thresholds that one observation recorded, and print `observation_gap` where the marginal cost showed a bare `n/a`. `--json` adds `marginalCostWithheldCause`.
+- On an install with more than one account for a provider, every alert toast names the account it belongs to, as the dashboard's Recent Alerts list already did.
+- `cctally doctor` gains `hooks.codex_liveness_7d`, which FAILs when an enabled Codex hook has not succeeded in seven days. It reads the per-root success markers, so log rotation cannot hide a hook that stopped firing.
+
+### Changed
+- `cctally weekly`, `cctally report` and `cctally project` render a week credited twice as three rows, one per billing cycle. A dictionary keyed on the week alone now keeps only the last cycle; key on the week and its start instant together.
+- `cctally weekly`, `cctally report` and `cctally project` start the first cycle of a week whose boundary moved and was then credited at the moved boundary. The previous week keeps its own spend, which was counted into the credited week.
+- Upgrading from 1.107.0 or earlier rebuilds the disposable stats index once, because a weekly reset now records the observation it came from and a rate change records its evidence. Commands report the rebuild until it finishes.
+- A metering-rate change recorded before this upgrade reports no evidence rather than inventing any.
+- A weekly credit is recorded at the exact second Anthropic issued it rather than the top of that hour, so a reading captured earlier in the same hour stays in the cycle it belongs to.
+- A pre-credit reading captured before a second weekly credit now survives and is shown inside the earlier cycle, because each credit's cleanup is scoped to its own instant instead of reaching back past the previous credit.
+- `cctally doctor` now reads Codex's own hook trust record and FAILs when the cctally handler is disabled or was never trusted in Codex `/hooks`, instead of reporting it as installed.
+- `cctally doctor` warns when the Codex handler changed after Codex last recorded a trust decision about it, and when that record cannot be read at all.
+- `cctally setup` refuses at exit 1 when reconciling the Codex handler would land it on a trust decision Codex recorded about a different handler. The message names the file, the slots and the fix.
+- When Codex's trust record changes mid-run, the `cctally setup` refusal names each Codex hooks file it had already rewritten and the dated backup of its previous contents. `--json` adds `changed_hooks_backups`.
+- `cctally doctor` states how many Codex roots are installed beside how many are enabled, so two installed-but-untrusted handlers no longer read as `0/2 root(s) enabled` alone.
+- `cctally setup` recognizes a Codex handler written by a different install channel and collapses it into one canonical handler, instead of adding a second one beside it.
+- `cctally setup --json` moves to `schema_version: 2`: the `installed_review_required` state is retired, and per-root `changes` becomes a per-event object with separate added, removed and unchanged counts.
+- `cctally setup --dry-run` and the applied run now report the same added, removed and unchanged Codex handler counts for the same input.
+- The dashboard and the TUI stop treating a Codex handler as trusted merely because it is present, and re-check that trust when `config.toml` changes, so a hook disabled while either was running no longer certifies stale conversation cost.
+- A freshly installed Codex handler reports as untrusted, and `cctally doctor` FAILs, until you approve it in Codex `/hooks`. Until then the dashboard and the TUI walk every Codex session on each refresh.
+- Two `cctally setup` messages read as ordinary English again: the orphaned `[hooks.state]` remedy says to remove the entry from the file by hand, and a moved trust slot says the handler would move from one key to the other.
+
+### Fixed
+- A percent milestone crossed on a week that holds two recorded resets is listed again. It was filed against one cycle while `cctally percent-breakdown` listed another, so the crossing appeared under neither.
+- Every view of a credited week picks the cycle the week is currently in, not the reset written last. `cctally diff`, the TUI's per-percent modal and the dashboard's milestone list could each name an earlier cycle.
+- A weekly threshold notification names the billing cycle that crossed. On a week credited more than once it read `Week starting Jun 05` for every cycle, naming all of them at once; an uncredited week reads exactly as before.
+- A second Anthropic usage reset inside one subscription week now registers. Every reset in a week shared one slot, so the first held it and later ones were discarded, leaving the reported percentage at the pre-reset high-water mark.
+- A weekly reset observed while cctally is interrupted is no longer lost, and one zero reading can no longer confirm itself into a credit. The pending-reset state moved into the database and commits or rolls back with the reset it fired.
+- A stale pre-credit reading that a credit removed stays removed after `cctally db rebuild --db stats`. The removal is recorded, so a rebuild no longer restores the reading and holds the reported percentage at the pre-credit high.
+- An idle session no longer holds the reported weekly percentage at a stale value. It re-renders its status line from a cached rate-limit block, and that block is now ignored in full once its five-hour window has closed.
+- A severe metering-rate drop now raises a red alert toast instead of the amber that made it look like a smaller drop, and the toast's rate chip matches the colour Recent Alerts already showed for the same event.
+- A metering-rate change detected while the quota calibration was withheld now records which calibration was withheld and how many baseline days were missing, instead of pointing you at a fitted budget that may never have been produced.
+- A metering-rate change whose notification failed and is retried later now carries that same disclosure, because it is read back from the recorded change rather than re-derived from a later run.
+- A metering-rate toast now names the calibration that was withheld and why, instead of pointing you at a fitted budget that may not exist. An ordinary rate change reads exactly as it did before.
+- Recent Alerts shows the evidence behind a metering-rate change: the withheld calibration, the detector's inputs, the composition provenance, and how many baseline days were withheld.
+- An alert toast on a multi-account install states how to dismiss it again, on its own line below the alert's own text rather than above it, so a screen reader reads the alert before it reads how to close it.
+- Alert toasts are usable from the keyboard: press Enter or Space to dismiss one, or to activate its own button and open the window it names. A focused toast states the alert before how to close it, and dismissing one restores focus.
+- The dashboard's Daily panel reads `loading` while it hydrates, instead of reporting the 30-day window as `withheld` over a loading skeleton.
+- The dashboard's Trend panel states its title in full on a phone. The week and cycle counts moved to the wrapping sub-line the other cards use, so the title is no longer cut off mid-word.
+- The dashboard's Daily panel prints its total and peak-day amounts in full on a narrow window. Below about 400px the two summary columns stack instead of cutting the dollar figures off.
+- An install upgrading from a version that predates the append-only journal no longer records a second copy of a reset it already had, so a credited week keeps its own cycles instead of gaining an extra one.
+
 ## [1.107.0] - 2026-09-04
 
 ### Changed

package/bin/_cctally_alerts.py

@@ -252,9 +252,16 @@ def _alert_label_prefix(axis: str, account_key: "str | None",
     install's alert text stays byte-identical to today.
 
     Delegates the R8 gate + label precedence to the single-definition helpers
-    ``_cctally_account.real_account_count`` / ``account_label`` (P2-CQ1) so the
-    ">1 real account" trigger and the key->label map have exactly one home; this
-    wrapper only opens the RO connection and stays best-effort/never-raise.
+    ``_cctally_account.provider_is_decorated`` / ``account_label`` (P2-CQ1) so
+    the ">1 real account" trigger and the key->label map have exactly one home;
+    this wrapper only opens the RO connection and stays best-effort/never-raise.
+
+    #702: the gate is the canonical predicate itself, negated at the call site.
+    This site previously inverted the underlying counter by hand
+    (``real_account_count(conn, vendor) <= 1``), which is a second written form
+    of the R8 threshold — the arrangement that lets the two spellings disagree
+    if the threshold ever moves. ``provider_is_decorated`` is ``> 1``, so the
+    suppressed branch is ``not provider_is_decorated(...)``.
 
     #697: the VENDOR comes from the payload's own ``provider`` when it carries
     one, and from ``_AXIS_VENDOR`` otherwise. The metering-rate-change family
@@ -288,7 +295,7 @@ def _alert_label_prefix(axis: str, account_key: "str | None",
             connect=lambda p: _sq.connect(f"file:{p}?mode=ro", uri=True),
         )
         try:
-            if _cctally_account.real_account_count(conn, vendor) <= 1:
+            if not _cctally_account.provider_is_decorated(conn, vendor):
                 return ""
             # #416 §6: population-aware, so two accounts that auto-label to
             # one email do not print the same alert prefix.
@@ -400,8 +407,27 @@ def _dispatch_alert_notification(
         # rate transition has no percentage threshold for `severity_for` to
         # map. Reading it verbatim is what keeps the three tiers meaningful
         # here; falling through would floor every transition at `info`.
+        #
+        # #750 S2: the vocabulary is RESOLVED from the kernel's own tuple
+        # rather than restated as a literal. A restated literal makes this the
+        # second written form of the same rule, which is exactly the
+        # arrangement #747 closed on the envelope: a fourth member added to
+        # `RATE_CHANGE_SEVERITIES`, to the TypeScript tuple and to the CSS
+        # passes every parity test and is still clamped to `info` here, so the
+        # OS notification's urgency and the trailing `alerts.log` column are
+        # wrong while the suite is green.
+        #
+        # Guarded the same way `_cctally_dashboard_envelope` guards its copy,
+        # and an unresolvable kernel degrades to NO clamp. This function's
+        # contract is that it never raises, and clamping against an empty
+        # vocabulary would send every correct severity to `info`.
         severity = str(payload.get("severity") or "info")
-        if severity not in ("info", "warn", "alarm"):
+        try:
+            _severities = frozenset(
+                _load_lib("_lib_meter_rate_change").RATE_CHANGE_SEVERITIES)
+        except Exception:                              # noqa: BLE001
+            _severities = None
+        if _severities is not None and severity not in _severities:
             severity = "info"
     else:
         try:
@@ -484,6 +510,54 @@ def _dispatch_alert_notification(
     return status
 
 
+def _synthetic_instant_days_ago(days: int) -> str:
+    """A timezone-aware ISO instant `days` before now (#699).
+
+    Negative goes forward, which is what a quota reset needs. Both non-registry
+    synthetics require real instants rather than placeholders: the rate-change
+    body renders an effective date, and the quota body renders a reset.
+    """
+    moment = dt.datetime.now(dt.timezone.utc) - dt.timedelta(days=days)
+    return moment.isoformat().replace("+00:00", "Z")
+
+
+def _test_alert_account_key(vendor: str) -> str:
+    """A REAL account key for `vendor`, else the vendor-wide sentinel (#699).
+
+    This is what makes the R8 `[<label>]` prefix observable from
+    `alerts test`: on a decorated install the synthetic carries a key the
+    registry can label, and on a single-account install it falls back to `*`,
+    which `_alert_label_prefix` suppresses — so that install's output stays
+    byte-identical, exactly as R8 requires.
+
+    Best-effort and never-raise, following `_alert_label_prefix`: a missing
+    database, an unreadable registry or an empty one all degrade to the
+    sentinel rather than turning a rehearsal into an error path.
+    """
+    try:
+        import sqlite3 as _sq
+        import _cctally_account
+        import _cctally_store
+        db_path = _cctally_core.DB_PATH
+        if not db_path.exists():
+            return _lib_accounts.VENDOR_WIDE
+        conn = _cctally_store.stats_open_guarded(
+            db_path,
+            connect=lambda p: _sq.connect(f"file:{p}?mode=ro", uri=True),
+        )
+        try:
+            for row in _cctally_account.load_accounts(conn, vendor):
+                key = str(row.get("account_key") or "")
+                if key and key not in (_lib_accounts.UNATTRIBUTED,
+                                       _lib_accounts.VENDOR_WIDE):
+                    return key
+        finally:
+            conn.close()
+    except Exception:                                  # noqa: BLE001
+        return _lib_accounts.VENDOR_WIDE
+    return _lib_accounts.VENDOR_WIDE
+
+
 def cmd_alerts_test(args: argparse.Namespace) -> int:
     """Send a synthetic test alert through the dispatch pipeline.
 
@@ -510,9 +584,28 @@ def cmd_alerts_test(args: argparse.Namespace) -> int:
         axis = "codex_budget"
     elif args.axis == "projected":
         axis = "projected"
+    elif args.axis == "quota":
+        axis = "quota"
+    elif args.axis == "meter-rate-change":
+        axis = "meter_rate_change"
     else:
         axis = "five_hour"
-    threshold = int(args.threshold)
+    # #699: `--threshold` now defaults to None so that "supplied" is
+    # distinguishable from "defaulted". Every axis that takes one still gets 90
+    # when it is omitted, which keeps the existing surface byte-identical.
+    raw_threshold = getattr(args, "threshold", None)
+    if axis == "meter_rate_change" and raw_threshold is not None:
+        # Exit 2 is native-usage per docs/cli-contract.md. The message names
+        # BOTH the axis and the flag: a refusal that does not say what failed
+        # costs the reader more than one that gives no reason at all.
+        print(
+            "cctally: --axis meter-rate-change does not accept --threshold; "
+            "a metering-rate change has no percentage threshold and carries "
+            "an explicit severity instead",
+            file=sys.stderr,
+        )
+        return 2
+    threshold = 90 if raw_threshold is None else int(raw_threshold)
     # --threshold range stays [1, 100] (F5): the cap is axis-uniform with the
     # existing weekly/5h thresholds. Over-budget tiers (>100%) are a v2
     # deferral, not an oversight — see spec §2 (F5).
@@ -603,6 +696,54 @@ def cmd_alerts_test(args: argparse.Namespace) -> int:
             denominator=denominator,
             week_start_at=dt.date.today().isoformat(),
         )
+    elif axis == "meter_rate_change":
+        # #699: the family is deliberately NOT in `AXIS_REGISTRY`, so there is
+        # no `_build_alert_payload_*` helper for it. The synthetic descriptor
+        # is built HERE and passed through the real
+        # `_lib_meter_rate_change.alert_payload`, which is what keeps that
+        # kernel clock-, database- and policy-free while still rehearsing the
+        # exact payload production dispatches.
+        import _lib_meter_rate_change as _mrc
+        previous, new = 2_442_620.0, 1_665_096.0
+        effective = _synthetic_instant_days_ago(7)
+        payload = _mrc.alert_payload(_mrc.RateChangeTransition(
+            provider="claude",
+            account_key=_test_alert_account_key("claude"),
+            effective_from=effective,
+            previous_units_per_point=previous,
+            new_units_per_point=new,
+            # Computed by the real kernel rather than hardcoded, so a change
+            # to the severity boundaries is rehearsed here too. These rates
+            # are a 31.8% drop — the maintainer's own observed transition —
+            # which lands on `alarm`.
+            severity=_mrc.transition_severity(previous, new),
+            detected_at=now_utc_iso(),
+            # The #690 disclosure, so the rehearsal exercises the withheld
+            # copy rather than only the ordinary path.
+            withholding_status="unsupported-model-mix",
+            detector_input_causes='["unsupported-composition"]',
+            composition_provenance='["forecast-aggregate"]',
+            baseline_withheld_days=3,
+        ))
+    elif axis == "quota":
+        # #699: also outside `AXIS_REGISTRY`, but this one HAS a payload
+        # builder, so the synthetic goes through it unchanged. `source` is
+        # `codex` because that is the only vendor this family observes, and
+        # `_AXIS_VENDOR` maps the axis to the same vendor for the R8 lookup.
+        payload = _build_alert_payload_quota(
+            source="codex",
+            source_root_key="default",
+            logical_limit_key="weekly",
+            observed_slot=_synthetic_instant_days_ago(2),
+            window_minutes=10080,
+            resets_at_utc=_synthetic_instant_days_ago(-5),
+            threshold=threshold,
+            kind="weekly",
+            crossed_at_utc=now_utc_iso(),
+            qualifying_percent=float(threshold),
+            projected_percent=min(100.0, float(threshold) + 5.0),
+            account_key=_test_alert_account_key("codex"),
+        )
     else:
         payload = _build_alert_payload_five_hour(
             threshold=threshold,

package/bin/_cctally_core.py

@@ -410,7 +410,33 @@ _init_paths_from_env()
 # install and the table would simply never appear. `quota_alert_arming` is the
 # precedent the family follows — a journaled STATE record whose boundary
 # survives a rebuild, so history cannot re-fire.
-STATS_INDEX_EPOCH = 1011
+# 1011 -> 1012 (#750 S2 §3.6): the rate-change disclosure evidence. Adds four
+# NULLABLE columns to `meter_rate_change_events` — `withholding_status`,
+# `detector_input_causes`, `composition_provenance` and
+# `baseline_withheld_days` — so a transition admitted by #688's
+# detection-keyed path carries the analysis's own stamp on the ROW rather than
+# only on the notification that may never have been delivered. It is an epoch
+# bump for the same two reasons every bump since 1005 carries: the 13-entry
+# registry is frozen, AND an epoch-current open returns before any schema
+# work, so neither a `@stats_migration` handler nor an
+# `add_column_if_missing` would ever run on an upgraded install and the
+# columns would simply never appear.
+# 1012 -> 1013 (#750 S3 §1.6): reset-event origin identity plus transactional
+# debounce state. Adds `week_reset_events.origin_observation_id` (the raw
+# journal id of the observation that caused the reset) and the two PARTIAL
+# unique indexes that carry the dual-shaped identity — a row with an origin is
+# unique on `(account_key, origin_observation_id)`, a legacy origin-null row
+# keeps the old `(account_key, old_week_end_at, new_week_end_at)` tuple, and
+# the table-level UNIQUE is retired because a single index cannot express
+# both. Also adds `weekly_reset_debounce_state`, which replaces the filesystem
+# reset-to-zero marker so an ARM or a CONFIRM commits in the same stats
+# transaction as the journal cursor and the reset event. The identity change
+# is what lets two genuinely distinct resets share one boundary tuple while
+# one physical reset detected twice stays one event. The mechanical reason it
+# is a bump and not a migration is unchanged: the registry is frozen at 13,
+# and an epoch-current open returns before any schema work, so a handler or an
+# `add_column_if_missing` would never run on an upgraded install.
+STATS_INDEX_EPOCH = 1013
 LEGACY_STATS_HEAD = 13
 
 #: #496 S1 F1. A NEW branch, for a state that cannot occur before the
@@ -1682,6 +1708,34 @@ def _apply_quota_projection_schema(conn: sqlite3.Connection) -> None:
         -- would call the same one. The FINGERPRINT stays out of the key
         -- deliberately: including it would re-alert on our own algorithm
         -- revisions.
+        -- #690 / #692 (epoch 1012) adds the last four columns: the disclosure
+        -- evidence captured at DETECTION time, stored as four independent
+        -- facts rather than one merged status taxonomy. Folding the baseline
+        -- count into `withholding_status` would make an otherwise healthy
+        -- successor read as currently withheld.
+        --
+        -- NULL, an empty array and 0 are THREE distinct states and every
+        -- consumer must preserve the distinction: NULL means legacy or
+        -- unrecoverable evidence, an empty typed set means assessed with no
+        -- such origin, 0 means a clean baseline, and a positive count means
+        -- thin baseline evidence. The #689 regime-recovery route sees stored
+        -- calibration regimes and no `QuotaAnalysis` at all, and all four
+        -- values are analysis-derived, so on that route all four are NULL by
+        -- construction — which is why every one of them is nullable.
+        --
+        -- `detector_input_causes` and `composition_provenance` hold canonical
+        -- JSON arrays of enum VALUES, never their `repr`, so a sixth
+        -- `CompositionProvenance` origin added later cannot silently alias
+        -- onto an existing one. `baseline_withheld_days` carries
+        -- `baseline_fit.population["withheld"]` — the count of fenced
+        -- observations carrying a cause that fall strictly BEFORE
+        -- `window_start` — as a count rather than a boolean, so zero, one and
+        -- many stay distinguishable and honest copy stays possible.
+        --
+        -- These comments sit OUTSIDE the statement deliberately: SQLite
+        -- stores the CREATE TABLE text verbatim, so a comment written inside
+        -- it lands in `sqlite_schema.sql`, in every `iterdump()` golden and
+        -- in `_REBUILD_SCHEMA_FINGERPRINT`.
         CREATE TABLE IF NOT EXISTS meter_rate_change_events (
             id                       INTEGER PRIMARY KEY AUTOINCREMENT,
             provider                 TEXT    NOT NULL,
@@ -1693,6 +1747,10 @@ def _apply_quota_projection_schema(conn: sqlite3.Connection) -> None:
             detected_at_utc          TEXT    NOT NULL,
             created_at_utc           TEXT    NOT NULL,
             notified_at              TEXT,
+            withholding_status       TEXT,
+            detector_input_causes    TEXT,
+            composition_provenance   TEXT,
+            baseline_withheld_days   INTEGER,
             UNIQUE(provider, account_key, effective_from)
         );
         CREATE INDEX IF NOT EXISTS idx_meter_rate_change_events_key
@@ -2217,6 +2275,14 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         # start — preventing the API's -7d-derived new week from overlapping
         # the old week. Inserted by cmd_record_usage on detection; read by
         # _apply_reset_events_to_weekrefs and the cost live-recompute path.
+        # #750 S3 §1.1: identity is DUAL-SHAPED, carried by the two partial
+        # unique indexes below rather than by a table-level UNIQUE. A row that
+        # names its originating observation is unique on
+        # `(account_key, origin_observation_id)`; a legacy row with no origin
+        # keeps the old `(account_key, old_week_end_at, new_week_end_at)`
+        # tuple. One index cannot express both, and a single index over the
+        # tuple would refuse a second genuine reset that happens to share a
+        # boundary pair with the first.
         conn.execute(
             """
             CREATE TABLE IF NOT EXISTS week_reset_events (
@@ -2227,13 +2293,55 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
                 effective_reset_at_utc TEXT NOT NULL,
                 observed_pre_credit_pct REAL,
                 account_key TEXT NOT NULL DEFAULT 'unattributed',
-                UNIQUE(account_key, old_week_end_at, new_week_end_at)
+                origin_observation_id TEXT
             )
             """
         )
         add_column_if_missing(
             conn, "week_reset_events", "account_key",
             "TEXT NOT NULL DEFAULT 'unattributed'")
+        add_column_if_missing(
+            conn, "week_reset_events", "origin_observation_id", "TEXT")
+        # #750 S3 §1.7. A pre-journal store's `week_reset_events` was created
+        # with a table-level UNIQUE that epoch 1013 retires, and
+        # `CREATE TABLE IF NOT EXISTS` cannot change an existing table. Left in
+        # place it survives the cutover and keeps refusing a legitimate second
+        # in-place credit — the very refusal this session removes. Rebuild the
+        # one table into the current shape, preserving row ids, BEFORE the two
+        # partial indexes are created (a DROP TABLE takes its indexes with it)
+        # and before the backfill runs.
+        _rebuild_retired_week_reset_uniqueness(conn)
+        conn.execute(
+            "CREATE UNIQUE INDEX IF NOT EXISTS idx_week_reset_events_origin "
+            "ON week_reset_events(account_key, origin_observation_id) "
+            "WHERE origin_observation_id IS NOT NULL"
+        )
+        conn.execute(
+            "CREATE UNIQUE INDEX IF NOT EXISTS "
+            "idx_week_reset_events_legacy_tuple "
+            "ON week_reset_events(account_key, old_week_end_at, "
+            "new_week_end_at) WHERE origin_observation_id IS NULL"
+        )
+        # #750 S3 §1.3: the transactional replacement for the filesystem
+        # reset-to-zero marker. ARM upserts the row, CONFIRM / CLEAR /
+        # FIRE_IMMEDIATE delete it, and every mutation commits in the same
+        # stats transaction as the journal cursor and the reset event, which is
+        # what closes both crash windows the filesystem marker left open. It is
+        # disposable operational state rather than journal truth, so an epoch
+        # rebuild legitimately loses it: a real reset simply re-arms and
+        # confirms one tick later.
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS weekly_reset_debounce_state (
+                account_key               TEXT PRIMARY KEY,
+                week_start_date           TEXT NOT NULL,
+                week_end_at               TEXT NOT NULL,
+                baseline_pct              REAL NOT NULL,
+                first_zero_at_utc         TEXT NOT NULL,
+                first_zero_observation_id TEXT
+            )
+            """
+        )
         _backfill_week_reset_events(conn)
 
         # ── five_hour_reset_events (Anthropic-issued in-place 5h credits) ──
@@ -2974,6 +3082,77 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
 # === WeekRef cluster ================================================
 
 
+#: The epoch-1013 column set of `week_reset_events`, in declaration order.
+#: `_rebuild_retired_week_reset_uniqueness` copies the intersection of this and
+#: whatever the existing table has, so a column added later in the schema apply
+#: (`journal_id`) is simply re-added afterwards by its own guarded ALTER.
+_WEEK_RESET_EVENT_COLUMNS = (
+    "id", "detected_at_utc", "old_week_end_at", "new_week_end_at",
+    "effective_reset_at_utc", "observed_pre_credit_pct", "account_key",
+    "origin_observation_id",
+)
+
+
+def _rebuild_retired_week_reset_uniqueness(conn) -> bool:
+    """Rebuild `week_reset_events` without its retired table-level UNIQUE.
+
+    #750 S3 §1.7. Epoch 1013 moved identity onto the originating observation
+    and expresses it as two PARTIAL unique indexes, which one table-level
+    constraint cannot represent. A table created by an older binary still
+    carries `UNIQUE(account_key, old_week_end_at, new_week_end_at)`, and
+    `CREATE TABLE IF NOT EXISTS` is a no-op against it, so the constraint would
+    survive the cutover and keep refusing a second genuine in-place credit.
+
+    Idempotent by construction: the trigger is the presence of a UNIQUE
+    CONSTRAINT index (`PRAGMA index_list` origin `'u'`), which only a
+    table-level UNIQUE creates and which the rebuilt shape does not have, so a
+    second call is a no-op. Row ids are preserved, because the cutover stamps
+    `journal_id = b:week_reset_events:<rowid>` from them and a renumbering
+    would give the same physical facts new logical identities.
+
+    Returns True when it rebuilt.
+    """
+    try:
+        columns = [str(row[1]) for row in
+                   conn.execute("PRAGMA table_info(week_reset_events)")]
+        if not columns:
+            return False
+        constrained = any(
+            str(row[3]) == "u"
+            for row in conn.execute("PRAGMA index_list(week_reset_events)")
+        )
+    except sqlite3.DatabaseError:
+        return False
+    if not constrained:
+        return False
+    carried = [name for name in _WEEK_RESET_EVENT_COLUMNS if name in columns]
+    column_list = ", ".join(carried)
+    conn.execute(
+        """
+        CREATE TABLE week_reset_events__rebuild_1013 (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            detected_at_utc        TEXT NOT NULL,
+            old_week_end_at        TEXT NOT NULL,
+            new_week_end_at        TEXT NOT NULL,
+            effective_reset_at_utc TEXT NOT NULL,
+            observed_pre_credit_pct REAL,
+            account_key TEXT NOT NULL DEFAULT 'unattributed',
+            origin_observation_id TEXT
+        )
+        """
+    )
+    conn.execute(
+        f"INSERT INTO week_reset_events__rebuild_1013 ({column_list}) "
+        f"SELECT {column_list} FROM week_reset_events"
+    )
+    conn.execute("DROP TABLE week_reset_events")
+    conn.execute(
+        "ALTER TABLE week_reset_events__rebuild_1013 "
+        "RENAME TO week_reset_events"
+    )
+    return True
+
+
 def _canonicalize_optional_iso(value: str | None, label: str) -> str | None:
     if value is None:
         return None
@@ -3056,6 +3235,123 @@ def _get_latest_row_for_week(
     ).fetchone()
 
 
+def _latest_reset_event_for_end(
+    conn: sqlite3.Connection,
+    new_week_end_at: str,
+    *,
+    account_key: str | None,
+    as_of_utc: "str | None" = None,
+) -> "sqlite3.Row | None":
+    """The ACTIVE segment's `week_reset_events` row for a week end, or None.
+
+    #750 S3 B3. One chokepoint for the read sites that ask "which segment
+    of this week is the live one", because they disagreed with each other and
+    all were wrong in the same direction.
+
+    The order is `unixepoch(effective_reset_at_utc) DESC, id DESC`. The
+    instant is the semantic cycle boundary, so it is what decides; `id` is
+    only a deterministic tie-breaker for two rows recording the same instant,
+    and ordering on it ALONE answers "whichever row was written last", which
+    a backfill can make the older reset. `unixepoch(...)`, never a lexical
+    compare: the column carries mixed offset spellings and a textual ORDER BY
+    mis-orders them on a non-UTC host, the same defence
+    `_reset_aware_floor` documents.
+
+    ``account_key`` scopes the read; ``None`` is the explicit merged read and
+    is byte-stable on a single-account install. It matters because the match
+    is on the end instant alone, and two accounts hold weeks that share one.
+
+    ``as_of_utc`` restricts the answer to segments already in effect at that
+    capture instant, which is what the milestone WRITER asks (#750 S3, Unit B
+    review): a crossing belongs to the segment that was live when it was
+    observed, not to one credited afterwards. It narrows the question rather
+    than changing it, so the ordering is the same ordering — the writer kept
+    its own `ORDER BY id DESC` copy of this query and therefore stamped
+    `percent_milestones.reset_event_id` with a segment
+    `cmd_percent_breakdown` does not filter on, and the milestone rendered
+    nowhere.
+    """
+    acct_pred = "" if account_key is None else " AND account_key = ?"
+    acct_params: tuple = () if account_key is None else (account_key,)
+    as_of_pred = ""
+    as_of_params: tuple = ()
+    if as_of_utc is not None:
+        as_of_pred = " AND unixepoch(effective_reset_at_utc) <= unixepoch(?)"
+        as_of_params = (as_of_utc,)
+    # The columns are NAMED rather than taken with `SELECT *`. `week_reset_
+    # events` is an epoch-versioned table that has already gained and lost
+    # columns (epoch 1013 added `origin_observation_id` and retired a
+    # constraint), and under `*` a column that goes away fails at whichever
+    # consumer happens to read it, one call frame away from the query. Named,
+    # it fails here. This is the read set: `id` is the segment identity
+    # `percent-breakdown` filters milestones on, `effective_reset_at_utc` is
+    # the boundary `_diff_resolve_anchor` moves the window start to, and the
+    # remaining three are the row's own identity for a caller that needs it.
+    return conn.execute(
+        f"""
+        SELECT id, account_key, old_week_end_at, new_week_end_at,
+               effective_reset_at_utc
+        FROM week_reset_events
+        WHERE new_week_end_at = ?{acct_pred}{as_of_pred}
+        ORDER BY unixepoch(effective_reset_at_utc) DESC, id DESC
+        LIMIT 1
+        """,
+        (new_week_end_at,) + acct_params + as_of_params,
+    ).fetchone()
+
+
+def _ordered_in_place_cuts(
+    cuts: "list[tuple[dt.datetime, str]] | None",
+    week_start_at: str | None,
+    week_end_dt: dt.datetime,
+) -> "list[tuple[dt.datetime, str]]":
+    """The week's in-place cuts, strictly inside it, deduplicated and ascending.
+
+    #750 S3 B2. Deduplication is on the parsed INSTANT rather than on the
+    stored text, because two rows can spell one instant in different offsets.
+    A cut on either boundary would emit a zero-width segment, which is not a
+    billing cycle, so both bounds are strict.
+
+    The two bounds degrade INDEPENDENTLY (#750 S3, Unit B review). When the
+    week's own start is absent or unparseable the lower bound cannot be
+    tested, and the cut is admitted, as it was before this filter existed.
+    The upper bound is a different quantity and the caller always has it, so
+    it still applies: skipping it alongside the lower one admitted a cut at or
+    after the week's end, and the tail `[cn, end)` it produced was inverted or
+    zero-width. That asymmetry was inherited from the two per-applier copies
+    rather than chosen.
+
+    ``week_start_at`` is the week's EFFECTIVE start — the caller passes the
+    boundary shift when the week carries one, so a cut that predates the shift
+    falls outside this week and is rejected rather than producing a head
+    segment that runs backwards. It is a raw ISO string rather than a `WeekRef`
+    or a `SubWeek`, because BOTH appliers apply this same bound and they had
+    two identical copies of it, neither with a test, until the Unit B review.
+    It lives here, beside `_latest_reset_event_for_end`, because the two
+    together are the whole of "which reset bounds this segment".
+    """
+    if not cuts:
+        return []
+    start_dt = None
+    if week_start_at:
+        try:
+            start_dt = parse_iso_datetime(week_start_at, "week_start_at")
+        except ValueError:
+            start_dt = None
+    ordered: list[tuple[dt.datetime, str]] = []
+    seen: set = set()
+    for cut_dt, cut_raw in sorted(cuts, key=lambda c: c[0]):
+        if cut_dt in seen:
+            continue
+        if cut_dt >= week_end_dt:
+            continue
+        if start_dt is not None and cut_dt <= start_dt:
+            continue
+        seen.add(cut_dt)
+        ordered.append((cut_dt, cut_raw))
+    return ordered
+
+
 def _reset_aware_floor(
     conn: sqlite3.Connection,
     week_start_date: str,

package/bin/_cctally_dashboard.py

@@ -1892,7 +1892,10 @@ def _conversation_frontier_context():
     try:
         codex_hooks_mod = _cctally()._load_sibling("_lib_codex_hooks")
         hook_roots = codex_hooks_mod.codex_hook_roots(codex_homes)
-        codex_guards = tuple(root.hooks_path for root in hook_roots)
+        # config.toml joins the guard set (#719 §2.6a): a certificate seeded
+        # while the handler was enabled must not survive Codex flipping
+        # `enabled = false` under it.
+        codex_guards = codex_hooks_mod.codex_frontier_guard_paths(hook_roots)
     except Exception:
         codex_hooks_mod = None
         hook_roots = ()
@@ -1916,27 +1919,12 @@ def _conversation_frontier_context():
             return False
 
     def codex_trusted():
+        # Counting owned handlers proved nothing about whether Codex would
+        # run them (#719). Route through the one shared kernel, which is
+        # fail-closed on every state that is not `installed_enabled`.
         if codex_hooks_mod is None:
             return False
-        try:
-            trusted = bool(hook_roots)
-            for hook_root in hook_roots:
-                document = codex_hooks_mod._read_hooks_document(
-                    hook_root.hooks_path)
-                hooks = document.get("hooks", {})
-                for event in codex_hooks_mod.CODEX_HOOK_EVENTS:
-                    owned = sum(
-                        1
-                        for group in hooks.get(event, ())
-                        if isinstance(group, dict)
-                        for handler in group.get("hooks", ())
-                        if codex_hooks_mod.is_dashboard_activity_codex_hook_handler(
-                            handler)
-                    )
-                    trusted = trusted and owned >= 1
-            return trusted
-        except Exception:
-            return False
+        return codex_hooks_mod.codex_hook_roots_all_enabled(hook_roots)
 
     return frontier_mod, {
         "claude": (claude_roots, claude_guards, claude_trusted()),