cctally 1.108.0 → 1.110.0

package/bin/_cctally_dashboard_envelope.py

@@ -172,12 +172,16 @@ def _select_current_block_for_envelope(
     *,
     current_used_pct: "float | None",
     now_utc: "dt.datetime",
+    account_key: "str | None" = None,
 ) -> "dict | None":
     """Select the current 5h block for the dashboard's current_week envelope.
 
     Selection rule (spec §4.1): pick the row from ``five_hour_blocks`` whose
     ``five_hour_window_key`` matches the latest ``weekly_usage_snapshots``
-    row's ``five_hour_window_key``. Returns None when no row matches —
+    row's ``five_hour_window_key``. When ``account_key`` names the account
+    whose weekly percentage is displayed, all physical reads here use it;
+    a multi-account caller without that identity receives no block. Returns
+    None when no row matches —
     binding to the latest snapshot's key (rather than highest
     ``block_start_at``) prevents the panel's "current 5h session" copy from
     surfacing stale closed blocks.
@@ -211,7 +215,10 @@ def _select_current_block_for_envelope(
 
     Delta semantics:
       - Non-crossed block: ``current_used_pct - seven_day_pct_at_block_start``
-        (the natural "how much 7d% has changed during this 5h block" read).
+        (the natural "how much 7d% has changed during this 5h block" read), where
+        that axis is the CREDIT-AWARE read of the column rather than the stored
+        number (#834 S1, #835) — so a value an in-place weekly credit retired makes
+        both the published axis and the delta ``None``.
       - Crossed block (``crossed_seven_day_reset == 1``): the block straddles
         a weekly reset, so the natural delta would be dominated by the
         reset itself (e.g. −94pp) rather than the user's actual burn-rate.
@@ -222,36 +229,100 @@ def _select_current_block_for_envelope(
       - ``None`` only when ``current_used_pct`` is unknown OR the
         block-start anchor is missing AND no post-reset anchor was found.
     """
+    # HELD-INCLUSIVE, deliberately (#769 S11, #824). This read asks which
+    # five-hour window is current, and a `weekly_observation_held` row's
+    # five-hour fields are the writing tick's own — it is the freshest
+    # statement of that key. Its `week_start_at` is a byte copy of the
+    # non-held row it was derived from, so scoping the post-reset lookup
+    # below by it is unaffected.
     snap = conn.execute(
         """
         SELECT five_hour_window_key, week_start_at
           FROM weekly_usage_snapshots
          WHERE captured_at_utc <= ?
+           AND (? IS NULL OR account_key = ?)
          ORDER BY captured_at_utc DESC, id DESC
          LIMIT 1
         """,
-        (_iso_z(now_utc),),
+        (_iso_z(now_utc), account_key, account_key),
     ).fetchone()
     if snap is None or snap["five_hour_window_key"] is None:
         return None
 
+    # The account supplied by `_tui_build_current_week` is the owner of the
+    # displayed weekly percentage. On a decorated multi-account store the
+    # absence of that identity is not permission to select an arbitrary block.
+    import _cctally_account
+    if account_key is None and _cctally_account.provider_is_decorated(
+            conn, "claude"):
+        return None
+
+    # #834 S1 (#836): `id` and `account_key` are selected so the live
+    # current-week milestone read can name ONE account's block. Block uniqueness
+    # is `(account_key, five_hour_window_key)`, and the milestone read used to
+    # filter on the window key alone, so one physical window's per-account blocks
+    # all showed every account's milestones. Both land on the returned dict under
+    # a leading underscore. `_five_hour_block_wire` strips the selectors and
+    # publishes the account identity only above #341's R8 decoration threshold.
+    #
+    # Account-qualified selection binds the block and its downstream milestone
+    # read to the displayed weekly account; the unqualified order remains the
+    # historical <=1-real-account fallback for published byte stability.
+    # #834 S1 (#835) Gate A R8: `first_observed_at_utc` and `five_hour_resets_at`
+    # are selected because the credit-aware read below needs them — they are the
+    # START axis's capture instant and its fallback. `seven_day_pct_at_block_end`
+    # is deliberately NOT selected, and round three's comment claiming the
+    # credit-aware read needs it was wrong: this route publishes the start axis
+    # alone, the helper's second return value is discarded, and the helper tests
+    # each axis's stored value before resolving anything, so an absent end value
+    # skips a second week resolution and a second band set for a number nobody
+    # reads. `last_observed_at_utc` stays, and NOT because the helper needs it:
+    # every column the helper reads goes through `block.get(...)`, so dropping
+    # this one would raise nothing and change no published field — the end
+    # instant it feeds is discarded with the end axis. It stays because the
+    # helper's contract is a block ROW, and pruning this SELECT to the subset the
+    # helper happens to read today would couple this route to the helper's
+    # internals. Round four's comment implied necessity instead.
     block = conn.execute(
         """
-        SELECT five_hour_window_key, block_start_at, last_observed_at_utc,
+        SELECT id, account_key,
+               five_hour_window_key, block_start_at, five_hour_resets_at,
+               first_observed_at_utc, last_observed_at_utc,
                seven_day_pct_at_block_start,
                crossed_seven_day_reset
-          FROM five_hour_blocks
+         FROM five_hour_blocks
          WHERE five_hour_window_key = ?
+           AND (? IS NULL OR account_key = ?)
            AND is_closed = 0
            AND five_hour_resets_at > ?
+         ORDER BY id ASC
+         LIMIT 1
         """,
-        (snap["five_hour_window_key"], _iso_z(now_utc)),
+        (snap["five_hour_window_key"], account_key, account_key,
+         _iso_z(now_utc)),
     ).fetchone()
     if block is None:
         return None
 
     crossed = bool(block["crossed_seven_day_reset"])
-    p_start = block["seven_day_pct_at_block_start"]
+    # #834 S1 (#835) Gate A R8: THE THIRD CONSUMER of the two derived weekly axes
+    # goes through the one read-time filter, the same one `cmd_five_hour_blocks` and
+    # `cmd_five_hour_breakdown` use. Reading the column raw published the value an
+    # in-place weekly credit retired, and `seven_day_pct_delta_pp` then published
+    # the difference between the live post-credit percentage and that retired
+    # number, which is a burn nobody observed. Measured on a store credited at 63.0
+    # with `current_used_pct` at 20.0: `seven_day_pct_at_block_start: 63.0` and
+    # `seven_day_pct_delta_pp: -43.0`, while the helper answered `(None, None)` for
+    # the same row. `sqlite3.Row` has no `.get()`, so the row is converted.
+    #
+    # Neither field is rendered by any client today: both are declared in
+    # `dashboard/web/src/types/envelope.ts` and used in one vitest module,
+    # `seven_day_pct_delta_pp` does not occur in the built bundle, and the TUI reads
+    # only `credits` / `five_hour_window_key` / `_account_key` / `_block_id` off
+    # this dict. This is therefore a correction to a published MACHINE surface, made
+    # because the marginal cost is one call site.
+    p_start, _p_end = sys.modules["cctally"]._credit_aware_block_weekly_axes(
+        conn, dict(block), now_utc=now_utc)
 
     # When the block crossed a weekly reset, recompute the delta against
     # the first post-reset snapshot inside the block instead of the
@@ -263,11 +334,19 @@ def _select_current_block_for_envelope(
     # the lookup to the current weekly window.
     p_anchor = p_start
     if crossed and snap["week_start_at"] is not None:
+        # `weekly_observation_held = 0` (#769 S11, #824): this is a weekly
+        # value selected by a CAPTURE-TIME window, which is exactly the shape a
+        # held row corrupts. A held row can be the first row captured after the
+        # reset while its weekly value was copied from a row captured BEFORE
+        # it, so the block's delta would be anchored on a pre-reset percentage
+        # and report a burn nobody observed.
         post = conn.execute(
             """
             SELECT weekly_percent
-              FROM weekly_usage_snapshots
+             FROM weekly_usage_snapshots
              WHERE week_start_at = ?
+               AND (? IS NULL OR account_key = ?)
+               AND weekly_observation_held = 0
                AND unixepoch(captured_at_utc) >= unixepoch(?)
                AND unixepoch(captured_at_utc) <= unixepoch(?)
              ORDER BY captured_at_utc ASC, id ASC
@@ -275,6 +354,7 @@ def _select_current_block_for_envelope(
             """,
             (
                 snap["week_start_at"],
+                account_key, account_key,
                 block["block_start_at"],
                 _iso_z(now_utc),
             ),
@@ -298,9 +378,10 @@ def _select_current_block_for_envelope(
         SELECT effective_reset_at_utc, prior_percent, post_percent
           FROM five_hour_reset_events
          WHERE five_hour_window_key = ?
+           AND (? IS NULL OR account_key = ?)
          ORDER BY effective_reset_at_utc ASC
         """,
-        (int(block["five_hour_window_key"]),),
+        (int(block["five_hour_window_key"]), account_key, account_key),
     ).fetchall()
     credits = [
         {
@@ -321,9 +402,34 @@ def _select_current_block_for_envelope(
         "seven_day_pct_delta_pp":       delta,
         "crossed_seven_day_reset":      crossed,
         "credits":                      credits,
+        # #834 S1 (#836): INTERNAL selector fields, stripped by
+        # `_five_hour_block_wire` before publication. See the block SELECT above.
+        "_block_id":                    int(block["id"]),
+        "_account_key":                 block["account_key"],
+        "_account_decorated":           _cctally_account.provider_is_decorated(
+            conn, "claude"),
     }
 
 
+#: The selector fields retained for downstream reads. A rowid is meaningless to
+#: a client; the account key is published only when #341's R8 gate permits
+#: account decoration (more than one real Claude account).
+_INTERNAL_BLOCK_KEYS = ("_block_id", "_account_key", "_account_decorated")
+
+
+def _five_hour_block_wire(block: "dict | None") -> "dict | None":
+    """Publish the current block with R8-gated account identity.
+
+    Single-account output keeps the historical six-key shape. The caller's
+    dict retains its selectors for the live milestone read."""
+    if not isinstance(block, dict):
+        return block
+    wire = {k: v for k, v in block.items() if k not in _INTERNAL_BLOCK_KEYS}
+    if block.get("_account_decorated"):
+        wire["account_key"] = block["_account_key"]
+    return wire
+
+
 # === Alerts-envelope per-axis row-mappers (Task F) =========================
 # Each mapper turns one axis's ``alerted_at IS NOT NULL`` milestone rows into
 # the shared envelope-item dicts. The SQL is genuinely heterogeneous per axis
@@ -766,6 +872,11 @@ def _unavailable_source_wire() -> dict:
         "last_success_at": None,
         "capabilities": {},
         "data": None,
+        # #834 S2 (#828, #829): present and null, not absent. Every source
+        # entry within one schema version carries the same keys, so a client
+        # never has to branch on key presence to tell a v12 payload's honest
+        # "no evidence" from an older server's payload that has no such field.
+        "metadata_health": None,
     }
 
 
@@ -812,6 +923,15 @@ def _source_state_to_wire(state: object) -> dict:
             for name, capability in capabilities.items()
         },
         "data": _source_wire_value(getattr(state, "data", None)),
+        # #834 S2 (#828, #829): published from the state's carrier and from
+        # nowhere else, so the value the detail routes decide from and the
+        # value the client normalizes are the same object. `None` on a
+        # provider that describes no Codex metadata — and on every payload an
+        # older server produced, which is why the client normalizes an absent
+        # object to unknown rather than to healthy.
+        "metadata_health": _source_wire_value(
+            getattr(state, "metadata_health", None)
+        ),
     }
 
 
@@ -1320,6 +1440,27 @@ def _basis_presentation(basis):
     return out or None
 
 
+def _trend_week_start_at(w) -> "str | None":
+    """``TuiTrendRow.week_start_at`` as canonical UTC ISO, or None.
+
+    #750 S4 §3.1. The row already carries the instant as a required
+    `dt.datetime`; the envelope simply omitted it, so the client had only
+    `label` to key on and a credited week's cycles can render one label.
+    `getattr` tolerates the minimal trend shapes (SimpleNamespace test rows,
+    older fixtures) the neighbouring fields already tolerate.
+    """
+    value = getattr(w, "week_start_at", None)
+    if value is None:
+        return None
+    if isinstance(value, str):
+        return value
+    try:
+        return value.astimezone(dt.timezone.utc).isoformat().replace(
+            "+00:00", "Z")
+    except (AttributeError, TypeError, ValueError):
+        return None
+
+
 def _forecast_quota_envelope(fc, cw, rate_change):
     """Spec §10's optional typed `forecast.quota` object.
 
@@ -1756,7 +1897,7 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
         }
 
     def _blocks_row_to_dict(r: "BlocksPanelRow") -> dict:
-        return {
+        row = {
             "start_at":  r.start_at,
             "end_at":    r.end_at,
             "anchor":    r.anchor,
@@ -1765,6 +1906,11 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
             "models":    list(r.models),
             "label":     r.label,
         }
+        # Additive only for retained rows: the client treats absence as
+        # computed, preserving the pre-existing computed-row wire shape.
+        if r.facts_source == "retained":
+            row["facts_source"] = "retained"
+        return row
 
     def _daily_row_to_dict(r: "DailyPanelRow") -> dict:
         # #556 S2 §6.3a: one owner for the daily row wire shape. The All-only
@@ -2157,7 +2303,11 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                 # `_tui_build_current_week`. `getattr` with default keeps
                 # legacy fixture modules that construct TuiCurrentWeek
                 # directly (without the new field) compatible.
-                "five_hour_block":          getattr(cw, "five_hour_block", None),
+                # #834 S1 (#836): the ONE publication site, so
+                # `_five_hour_block_wire` is where the internal selector fields
+                # are dropped and the wire shape stays byte-unchanged.
+                "five_hour_block":          _five_hour_block_wire(
+                    getattr(cw, "five_hour_block", None)),
                 "milestones": [
                     {
                         "percent":                m.percent,
@@ -2222,6 +2372,10 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                         "dollar_per_pct": w.dollars_per_percent,
                         "delta":          w.delta_dpp,
                         "is_current":     bool(w.is_current),
+                        # #750 S4 §3.1: the segment instant. `label` is
+                        # year-free and a credited week's cycles can render
+                        # the same one, so it cannot be a React key.
+                        "week_start_at":  _trend_week_start_at(w),
                         # #264 S3: additive weekly cost (already on the row via
                         # build_trend_view); rendered by the Trend modal's Cost
                         # column. ``getattr`` (like ``project_key`` /
@@ -2241,6 +2395,8 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                         "dollar_per_pct": w.dollars_per_percent,
                         "delta":          w.delta_dpp,
                         "is_current":     bool(w.is_current),
+                        # #750 S4 §3.1: the segment instant (see weeks[]).
+                        "week_start_at":  _trend_week_start_at(w),
                         # #264 S3: additive weekly cost (see weeks[] above; same
                         # getattr tolerance for minimal/older trend shapes).
                         "cost_usd":       round(_wc, 4) if (_wc := getattr(w, "weekly_cost_usd", None)) is not None else None,

package/bin/_cctally_dashboard_share.py

@@ -49,7 +49,6 @@ from _cctally_core import open_db, parse_iso_datetime
 from _cctally_config import save_config, _load_config_unlocked
 from _lib_fmt import stable_sum
 from _lib_pricing import _calculate_entry_cost, claude_usage_dict
-from _lib_five_hour import _canonical_5h_window_key
 from _lib_display_tz import _resolve_tz, resolve_display_tz_name
 
 
@@ -525,48 +524,154 @@ def _share_per_day_per_project_for_range(
     return out
 
 
+def _share_block_ownership_context(range_start, range_end):
+    """The canonical five-hour windows competing over ``[range_start,
+    range_end]``, as ``(windows, owner_key_by_block_start_epoch)``.
+
+    #751a: a block cannot decide what it owns without knowing what its
+    neighbours own, so the caller widens this range past what it displays
+    purely in order to exclude a predecessor's entries.
+    """
+    import _lib_blocks
+
+    _selected, _overrides, canonical_intervals = (
+        sys.modules["cctally"]._load_recorded_five_hour_windows(
+            range_start, range_end,
+        )
+    )
+    windows = []
+    owner_key_by_start: dict[int, object] = {}
+    for anchor, (block_start, reset) in canonical_intervals.items():
+        windows.append(_lib_blocks.OwnedWindow(
+            key=anchor, start=block_start, reset=reset,
+        ))
+        owner_key_by_start[int(block_start.timestamp())] = anchor
+    return windows, owner_key_by_start
+
+
+def _share_entry_cost(entry) -> float:
+    usage = claude_usage_dict(   # #195 chokepoint
+        input_tokens=entry.input_tokens,
+        output_tokens=entry.output_tokens,
+        cache_creation_tokens=entry.cache_creation_tokens,
+        cache_read_tokens=entry.cache_read_tokens,
+        cache_1h_tokens=getattr(entry, "cache_1h_tokens", None),
+        speed=getattr(entry, "speed", None),
+    )
+    return _calculate_entry_cost(
+        entry.model, usage, mode="auto", cost_usd=entry.cost_usd,
+    )
+
+
+def _share_per_block_per_project_by_ownership(starts, iso_by_start_epoch):
+    """Per-block per-project costs over the entries each block OWNS.
+
+    The rollup-table path above is the canonical source; this runs only
+    when that table is empty or unreadable. It used to sweep each block's
+    raw ``[start, start + 5h]`` interval through
+    ``_share_all_projects_for_range``, which is an independent
+    reselection: two windows overlapping after a reset shift each claimed
+    the overlap entries, and the artifact's per-block per-project
+    breakdown double-counted them (#751a review P2-1).
+
+    Ownership is resolved once, by the one rule in
+    ``_lib_blocks.partition_entries_by_owner``. A block with no canonical
+    row is heuristic, so it reads the leftovers — the entries no exact
+    window contains — inside its own interval, which is the grouping
+    pass's own treatment of them.
+    """
+    import _lib_blocks
+
+    five_hours = dt.timedelta(hours=5)
+    earliest, latest = min(starts), max(starts)
+    out: dict[str, dict[str, float]] = {
+        iso: {} for iso in iso_by_start_epoch.values()
+    }
+    try:
+        windows, owner_key_by_start = _share_block_ownership_context(
+            earliest - five_hours, latest + 2 * five_hours,
+        )
+        # late-binding: reach the dashboard module object so both the ns-patch
+        # (share tests) and a dashboard-object patch (rebuild-parity) are
+        # honored (#279 S5 F1 / spec §3).
+        entries = list(
+            sys.modules["_cctally_dashboard"].get_claude_session_entries(
+                earliest, latest + 2 * five_hours, skip_sync=True,
+            )
+        )
+    except Exception:
+        return out
+    owned, leftovers = _lib_blocks.partition_entries_by_owner(entries, windows)
+    for start in starts:
+        block_iso = iso_by_start_epoch[int(start.timestamp())]
+        owner_key = owner_key_by_start.get(int(start.timestamp()))
+        if owner_key is None:
+            mine = [
+                e for e in leftovers
+                if start <= e.timestamp < start + five_hours
+            ]
+        else:
+            mine = owned.get(owner_key, [])
+        bucket = out[block_iso]
+        for entry in mine:
+            key = entry.project_path or "(unknown)"
+            bucket[key] = bucket.get(key, 0.0) + _share_entry_cost(entry)
+    return out
+
+
 def _share_per_block_per_project(
     recent_blocks: list[dict],
 ) -> dict[str, dict[str, float]]:
     """Aggregate per-block per-project costs from `five_hour_block_projects`.
 
     Returns {block_start_at_iso: {project_path_or_'(unknown)': cost_usd}}.
-    Block.start_at → five_hour_window_key via `_canonical_5h_window_key`
-    (10-min floor; same chokepoint as `maybe_update_five_hour_block`,
-    per CLAUDE.md "5-hour windows" gotcha — never derive a third key shape).
-
-    Fallback (rollup empty/unreadable): per-block sweep over
-    `_share_all_projects_for_range` — uncapped, accuracy parity with the
-    canonical path. Fires only during the first tick after fresh install
-    or before stats-migration `002_five_hour_block_projects_backfill_v1`
-    completes. Issue #33.
+
+    The rollup rows are reached through their parent's `block_start_at`
+    rather than through a window key derived here. `five_hour_block_projects.
+    five_hour_window_key` is canonicalized from the window's RESET, so a key
+    derived from the block's START missed every row by the block duration and
+    the lookup never resolved — which made the fallback the effective path
+    (#751a review P2-1). Resolving the parent by its own recorded start is a
+    lookup rather than a second derivation, so no third key shape is created
+    (CLAUDE.md "5-hour windows").
+
+    Fallback (rollup empty/unreadable): `_share_per_block_per_project_by_
+    ownership`, which prices the entries each block owns. Fires only during
+    the first tick after fresh install or before stats-migration
+    `002_five_hour_block_projects_backfill_v1` completes. Issue #33.
     """
     if not recent_blocks:
         return {}
     out: dict[str, dict[str, float]] = {}
-    keys: list[int] = []
-    iso_by_key: dict[int, str] = {}
+    starts: list[dt.datetime] = []
+    iso_by_start_epoch: dict[int, str] = {}
     for b in recent_blocks:
         try:
             ts = parse_iso_datetime(b["start_at"], "share.block.start_at")
         except (ValueError, KeyError):
             continue
-        wk = _canonical_5h_window_key(int(ts.timestamp()))
-        keys.append(wk)
-        iso_by_key[wk] = b["start_at"]
-    if not keys:
+        ts = ts.astimezone(dt.timezone.utc)
+        starts.append(ts)
+        iso_by_start_epoch[int(ts.timestamp())] = b["start_at"]
+    if not starts:
         return out
+    epochs = list(iso_by_start_epoch)
     try:
         conn = open_db()
-        placeholders = ",".join("?" for _ in keys)
-        rows = conn.execute(
-            f"SELECT five_hour_window_key, project_path, cost_usd "
-            f"FROM five_hour_block_projects "
-            f"WHERE five_hour_window_key IN ({placeholders})",
-            keys,
-        ).fetchall()
-        for wk, project_path, cost in rows:
-            block_iso = iso_by_key.get(wk)
+        try:
+            placeholders = ",".join("?" for _ in epochs)
+            rows = conn.execute(
+                f"SELECT unixepoch(b.block_start_at) AS start_epoch, "
+                f"       p.project_path, p.cost_usd "
+                f"  FROM five_hour_block_projects p "
+                f"  JOIN five_hour_blocks b ON b.id = p.block_id "
+                f" WHERE unixepoch(b.block_start_at) IN ({placeholders})",
+                epochs,
+            ).fetchall()
+        finally:
+            conn.close()
+        for start_epoch, project_path, cost in rows:
+            block_iso = iso_by_start_epoch.get(int(start_epoch))
             if block_iso is None:
                 continue
             proj = project_path or "(unknown)"
@@ -576,15 +681,7 @@ def _share_per_block_per_project(
             return out
     except (sqlite3.DatabaseError, OSError):
         pass
-    # Fallback: per-block uncapped session_entries sweep.
-    for b in recent_blocks:
-        try:
-            ts = parse_iso_datetime(b["start_at"], "share.block.start_at")
-        except (ValueError, KeyError):
-            continue
-        end = ts + dt.timedelta(hours=5)
-        out[b["start_at"]] = sys.modules["cctally"]._share_all_projects_for_range(ts, end)
-    return out
+    return _share_per_block_per_project_by_ownership(starts, iso_by_start_epoch)
 
 
 def _build_share_panel_data(panel: str, options: dict,
@@ -1327,7 +1424,28 @@ def _build_projects_share_panel_data(options: dict,
     week_end = cw_start + dt.timedelta(days=7)
     now = _share_now_utc()
     period_end = week_end if week_end <= now else now
-    period_start = cw_start - dt.timedelta(days=7 * (effective_weeks - 1))
+    # #750 S4 §4.7: the period start comes from the SELECTED INTERVAL
+    # IDENTITIES, not from `cw_start - 7 * (effective_weeks - 1)`. A credited
+    # week adds a billing cycle without adding seven calendar days, so the
+    # seven-day arithmetic advertises a period WIDER than the data the
+    # artifact aggregated the moment one is inside the window. The instants
+    # come from `projects.trend.weeks[].week_start_at` (§2.2). The old
+    # arithmetic remains the fallback for an envelope that predates the
+    # field, where it is still the best available answer.
+    _selected_starts = [
+        w.get("week_start_at") for w in (trend.get("weeks") or [])
+        if isinstance(w, dict) and w.get("week_start_at")
+    ][-effective_weeks:]
+    period_start = None
+    if _selected_starts:
+        try:
+            period_start = parse_iso_datetime(
+                _selected_starts[0], "projects.trend.week_start_at",
+            )
+        except (TypeError, ValueError):
+            period_start = None
+    if period_start is None:
+        period_start = cw_start - dt.timedelta(days=7 * (effective_weeks - 1))
 
     return {
         "rows":           rows,
@@ -1533,7 +1651,7 @@ def _share_codex_state_for_period(data_snap, *, panel: str, options: dict):
             ),
             data_version=(
                 f"share:codex:{panel}:{range_start.isoformat()}:"
-                f"{now_override.isoformat()}:{semantics.identity}"
+                f"{now_override.isoformat()}:{semantics.codex_identity}"
             ),
         )
     finally: