cctally 1.109.0 → 1.110.0

package/CHANGELOG.md

@@ -5,6 +5,52 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.110.0] - 2026-09-22
+
+### Added
+- Claude cost reports price `claude-opus-5-5` at its published input, output, cache and Fast-mode rates instead of showing $0 for new usage.
+- Codex cost reports price `gpt-6-luna` at its published Standard, long-context and Fast-mode rates, and resolve `gpt-daybreak-red-latest` to the current Cyber card.
+- Historical `gpt-5.5-cyber` Codex turns use their retained LiteLLM OpenAI-provider rate card instead of the legacy `gpt-5` fallback.
+- Codex reporting prices `gpt-6-sol` from OpenAI's published Standard, cached-input, long-context and Fast-mode rates instead of the legacy `gpt-5` fallback.
+- The dashboard's `Blocks` panel marks Claude rows whose cost and model figures come from the facts retained when the block closed, without recalculating those figures from the current cache.
+- Maintainers can turn latest full-backlog triage into a dependency-safe Codex execution plan and run automatically in two Sol/High worktree slots, with refresh-safe splitting, one resumable monitor, and no worker-created orchestration chain.
+
+### Fixed
+- Codex long-context requests above 272K input tokens now use OpenAI's higher input, cached-input and output rates for the entire request, including Fast-mode costs and dashboard cache savings.
+- The dashboard promptly releases a Conversation Viewer live-tail thread when its reader closes, instead of retaining each one until the next 15-second keep-alive.
+- The dashboard's Current Week modal reliably returns keyboard focus to the hero after Escape, even when a source-selector click is still pending under load.
+- The `Blocks` detail modal connects its retained-facts explanation to the cost and token figures for screen readers.
+- The `dashboard` fully hides its onboarding hint while an alert toast is active on a phone, so the alert action stays visible while the original onboarding timer continues.
+- `cctally db rederive` retains a weekly cost snapshot when replay names the same range instants with different UTC-offset spelling, so reviewed corrections do not rewrite unchanged cost facts.
+- `cctally db rederive` can apply an operator-reviewed weekly correction without carrying unrelated baseline drift. Version 2 manifests can preserve or release an accepted snapshot identity and pin both plan hashes before append.
+- `cctally db rederive` preserves closed five-hour costs and accepted snapshot references when current replay rules revisit the same retained evidence.
+- A Conversation Viewer link that waits for its outline now limits a failed page load to three requests, then shows the connection error with a Retry button for the linked message.
+- `cctally db rederive` now refuses a correction that would add a burst of matching weekly reset events, and its JSON preview breaks action counts out by event kind for inspection.
+- Dashboard diagnosis and conversation outlines now bound request surges and stalled reads. A timed-out diagnosis process is retired so later requests recover, and unchanged dashboard files revalidate without rereading or recompression.
+- The dashboard's `Current Week` five-hour block now follows the account that supplied the displayed weekly percentage. Its credits and crossings stay with that account when two accounts share a window, including while browsing older blocks.
+- The dashboard's Claude Session detail now shows cache rebuilds and cache savings over plain HTTP LAN access, including the healthy zero-rebuild state. Opening the same session over loopback and LAN shows the same verified outline.
+- Dashboard panel headings now shorten before their action buttons escape narrow cards, including when Projects data is unavailable.
+- The dashboard calls Claude's credited window a cycle in the hero and milestone modal. Its cost comparison names a comparable cycle, multi-account spend no longer implies one common cycle, and week-scoped panels keep their week labels.
+- The dashboard's phone-width account cards now show a swipe cue while more cards remain, and long snapshot ages stay readable inside the hero.
+- At phone widths where the dashboard source-status chip is shown, warning labels now name both the affected area and its state, such as `Accounts unavailable` or `Projects partial`.
+- The dashboard's `Send test alert` preview now shows the same account chip and dismiss hint as a real alert on single-account and multi-account installs.
+- Closing a dashboard modal now returns keyboard focus to its opener, and explanatory card text no longer opens a modal when clicked.
+- The dashboard's All-source Daily detail shows a single-provider day's model costs once, without an empty second provider row.
+- The dashboard's Projects modal presents its cycle window and chart scale as separate radio groups for screen readers.
+- Corrupt Codex token or timestamp values no longer empty the provider. Valid costs and projects remain visible while affected rows are skipped and counted, including rows in a budget period older than the detail view.
+- Long identifiers in Doctor remediation text now wrap inside the modal at narrow screen widths instead of being clipped.
+- One Codex conversation whose stored project path cannot be read no longer empties the whole Codex provider. Every other project is published from current data, and the affected rows are reported as withheld.
+- A Codex project path the store cannot read is counted and named in `cctally doctor`, under a third reason beside the missing key and missing thread join it already reports.
+- A refresh that could not read project metadata is replaced on the next refresh instead of being kept for up to two minutes.
+- A refresh whose project metadata could not be read states so in the Projects panel body, so an empty panel is no longer silent about why.
+- The Conversation Viewer opens a conversation whose stored project path cannot be read, showing no project instead of failing, and its spawned-agent links, raw export and live tail work again.
+- No conversation list, filter, search hit or outline shows a project for a conversation whose stored project path can no longer be read.
+- An anonymized transcript export refuses while any Codex project path cannot be read, rather than producing bytes that only look scrubbed. `cctally transcript export` exits 3 and the viewer says so; `--raw` is unaffected.
+- An account-scoped anonymized Codex transcript now scrubs project paths tied to that account. If path ownership is uncertain, export and the viewer's Anon copy refuse instead of claiming the copy is anonymous.
+- In the Conversation Viewer, a refused anonymized per-turn copy now shows a red X on the control, so a tap visibly reports that nothing was copied.
+- The dashboard's Session detail no longer logs a failed outline request when a transcript was not kept. The Conversation Viewer names a temporarily unavailable transcript store on deep links and while search results load.
+- `cctally explain` and the dashboard's Explain view retry a brief database change before reporting that the read could not complete.
+
 ## [1.109.0] - 2026-09-15
 
 ### Added

package/README.md

@@ -30,15 +30,15 @@ Your Claude Code plan meters you with a percentage that creeps up all week. ccta
 </p>
 
 <!-- cctally:latest-stable:begin -->
-**Latest stable: v1.104.0** (2026-08-29)
+**Latest stable: v1.109.0** (2026-09-15)
 
-Highlights from the `v1.101.0` to `v1.104.0` stable upgrade:
+Highlights from the `v1.104.0` to `v1.109.0` stable upgrade:
 
-- `cctally quota` reports how much of your weekly quota your usage consumes and whether Anthropic has changed the metering rate, from a budget fitted to your own history rather than a shipped constant. See `docs/commands/quota.md`.
-- `cctally quota --json` publishes the fit, the current week's consumption and projection, the composition support radii and the detector's own bound under `schemaVersion` 1.
-- `cctally quota --reset-calibration` discards the stored calibration for one account, and `--since` and `--watch-from` narrow or override the window the analysis uses.
+- The dashboard picks up a new pricing revision without a restart. It re-reads the deployed pricing file every 60 seconds, adopts a complete newer revision, and keeps serving; no connected client is dropped.
+- The conversation filter popover says `Projects appear once indexing finishes.` in place of `No projects.` while the transcript index is being rebuilt. Model counts stay live on the Claude tab.
+- The dashboard's Projects panel gives every billing cycle of a credited week its own percentage. Both cycles shared one calendar date, and only the later reading survived, so the second cycle could never carry one.
 
-[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.104.0)
+[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.109.0)
 <!-- cctally:latest-stable:end -->
 
 ## Quick start

package/bin/_cctally_cache.py

@@ -136,6 +136,9 @@ import _lib_quota
 # #496 S5b §4: the journal-to-cache coverage certificate kernel. Stdlib-only,
 # so it is circular-safe for the same reason.
 import _lib_cache_coverage
+# #845 §4.1: the decode helper is a stdlib-only leaf that imports nothing from
+# this package, so binding it here is circular-safe for the same reason.
+import _lib_codex_metadata
 
 
 # Module-level back-ref shims for the three out-of-scope JSONL/project
@@ -2766,18 +2769,45 @@ def _recompute_codex_rollups(
         models = sorted({r.model for r in rows if r.model})
         models_json = json.dumps(models) if models else None
         source_root_key = rows[0].source_root_key
+        # #845 §4.7. The two columns are read as BLOBs and decoded field by
+        # field, so one undecodable byte no longer raises here and no longer
+        # fails the whole recompute. The table name stays UNQUALIFIED, because
+        # this writer must honor account scoping: under
+        # `scope_conversations_db_to_account` it sees the empty TEMP view on
+        # purpose.
         thread = conn.execute(
-            "SELECT cwd, git_json, parent_thread_id, source_root_key "
+            "SELECT CAST(cwd AS BLOB) AS cwd_blob, "
+            "CAST(git_json AS BLOB) AS git_json_blob, parent_thread_id, "
+            "source_root_key "
             "FROM codex_conversation_threads WHERE conversation_key = ?",
             (conversation_key,),
         ).fetchone()
         cwd = git_json = parent_thread_id = None
+        thread_malformed = False
         if thread is not None:
-            cwd, git_json, parent_thread_id, thread_root = thread
+            cwd_blob, git_json_blob, parent_thread_id, thread_root = thread
+            decoded = _lib_codex_metadata.decode_codex_project_metadata(
+                cwd_blob, git_json_blob)
+            cwd, git_json = decoded.cwd, decoded.git_json
+            # The DIRECT-ONLY predicate: this writer resolves the thread's own
+            # fields through `_codex_conversation_project_attribution`, which
+            # stops at a usable `cwd`, so a valid `cwd` beside an undecodable
+            # `git_json` is still attributed.
+            thread_malformed = _lib_codex_metadata.codex_metadata_is_malformed(
+                decoded, None)
             if thread_root:
                 source_root_key = thread_root
-        project_key, project_label = _codex_conversation_project_attribution(
-            source_root_key, cwd, git_json)
+        if thread_malformed:
+            # `(unassigned)` is a real answer for a thread with no metadata.
+            # Persisting it for a thread whose metadata could not be READ would
+            # stamp a wrong answer that every later read prefers, which is the
+            # failure class `docs/codex-gotchas.md` records for the materialized
+            # `"(unassigned)"`. NULL is the absence every reader already
+            # handles.
+            project_key = project_label = None
+        else:
+            project_key, project_label = _codex_conversation_project_attribution(
+                source_root_key, cwd, git_json)
         conn.execute(
             "INSERT INTO codex_conversation_rollups "
             "(conversation_key, source_root_key, parent_thread_id, item_count, "
@@ -11012,23 +11042,42 @@ def scope_conversations_db_to_account(
     }
     safe_project_attribution: dict[str, tuple[str | None, str | None]] = {}
     for conversation_key in codex_keys:
+        # #845 §4.7. The thread is re-tested EVEN WHEN a rollup is persisted:
+        # a rollup materialized before the thread was corrupted carries a
+        # pre-corruption attribution, and preferring it would keep publishing
+        # an answer the store can no longer support. The raw table is named
+        # explicitly because the unqualified name is an empty TEMP view here.
+        thread = conn.execute(
+            "SELECT source_root_key, CAST(cwd AS BLOB) AS cwd_blob, "
+            "CAST(git_json AS BLOB) AS git_json_blob "
+            "FROM cache_db.codex_conversation_threads WHERE conversation_key=?",
+            (conversation_key,),
+        ).fetchone()
+        decoded = None
+        thread_malformed = False
+        if thread is not None:
+            decoded = _lib_codex_metadata.decode_codex_project_metadata(
+                thread[1], thread[2])
+            thread_malformed = _lib_codex_metadata.codex_metadata_is_malformed(
+                decoded, None)
         persisted = conn.execute(
             "SELECT project_key,project_label "
             "FROM main.codex_conversation_rollups WHERE conversation_key=?",
             (conversation_key,),
         ).fetchone()
         if persisted is not None:
-            safe_project_attribution[conversation_key] = persisted
-            continue
-        thread = conn.execute(
-            "SELECT source_root_key,cwd,git_json "
-            "FROM cache_db.codex_conversation_threads WHERE conversation_key=?",
-            (conversation_key,),
-        ).fetchone()
-        if thread is not None:
             safe_project_attribution[conversation_key] = (
-                _codex_conversation_project_attribution(*thread)
+                (None, None) if thread_malformed else persisted
             )
+            continue
+        if thread is not None:
+            if thread_malformed:
+                safe_project_attribution[conversation_key] = (None, None)
+            else:
+                safe_project_attribution[conversation_key] = (
+                    _codex_conversation_project_attribution(
+                        thread[0], decoded.cwd, decoded.git_json)
+                )
     _recompute_codex_rollups(
         conn, codex_keys, advance_render_revision=False,
     )

package/bin/_cctally_core.py

@@ -1923,7 +1923,11 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
     import importlib
     _cctally_store = importlib.import_module("_cctally_store")
 
-    ensure_dirs()
+    # Alternate targets are private scratch indexes. A rederive preview may
+    # open one while the live data directory has never had a logs/ directory;
+    # creating that directory would violate the preview's zero-write contract.
+    if _target_path is None:
+        ensure_dirs()
     # #453: probe the live index before the maintenance-shared opener. During
     # a large detached rebuild that opener can wait for its bounded 5-second
     # guard; a statusline arriving mid-replay would otherwise pay that delay