cctally 1.110.0 → 1.111.0

package/CHANGELOG.md

@@ -5,6 +5,12 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.111.0] - 2026-09-24
+
+### Fixed
+- After `cctally update` or a Homebrew upgrade installs a newer version, a running `dashboard` restarts itself so new prices and code apply. Restart it yourself once after installing this release, and after any manual `npm install -g`.
+- A `dashboard` restart after an update no longer leaves an extra Node process running on npm installs.
+
 ## [1.110.0] - 2026-09-22
 
 ### Added

package/bin/_cctally_core.py

@@ -80,6 +80,7 @@ def _init_paths_from_env() -> None:
     global UPDATE_STATE_PATH, UPDATE_SUPPRESS_PATH
     global UPDATE_LOCK_PATH, UPDATE_LOG_PATH, UPDATE_LOG_ROTATED_PATH
     global UPDATE_CHECK_LAST_FETCH_PATH, CLAUDE_SETTINGS_PATH
+    global INSTALL_SUCCESS_RECORD_PATH
     global CLAUDE_PROJECTS_DIR, CLAUDE_JSON_PATH
     global TELEMETRY_INSTALL_ID_PATH, TELEMETRY_LAST_BEAT_PATH
     global TELEMETRY_NOTICE_SHOWN_PATH, TELEMETRY_FIRST_SEEN_PATH
@@ -195,6 +196,8 @@ def _init_paths_from_env() -> None:
     UPDATE_LOG_PATH = APP_DIR / "update.log"
     UPDATE_LOG_ROTATED_PATH = APP_DIR / "update.log.1"
     UPDATE_CHECK_LAST_FETCH_PATH = APP_DIR / "update-check.last-fetch"
+    # Written only by the install paths (#868), never by an update check.
+    INSTALL_SUCCESS_RECORD_PATH = APP_DIR / "install-success.json"
 
     # Anonymous install-count telemetry markers (see spec 2026-07-07).
     # All four derive from APP_DIR and are re-bound here so a redirected

package/bin/_cctally_dashboard.py

@@ -712,10 +712,6 @@ from _lib_aggregators import (
     _finalize_bucket,
 )
 from _lib_fmt import stable_sum
-# The MODULE, not just the names: #714's `pricing_snapshot_context` has to be
-# reached through the live module object so a test that swaps the snapshot is
-# seen by the request, build and sync entries below.
-import _lib_pricing
 from _lib_pricing import (_calculate_entry_cost, _chip_for_model,
                           _short_model_name, claude_usage_dict)
 from _lib_five_hour import _canonical_5h_window_key, _round_to_ten_minutes
@@ -2272,13 +2268,6 @@ def _make_dashboard_run_iteration(
 
     def run_iteration(batch=None) -> dict:
         warnings: list = []
-        # #714: the whole snapshot build runs on ONE pricing revision. A swap
-        # landing part-way through would publish a snapshot whose panels were
-        # priced from two different tables.
-        with _lib_pricing.pricing_snapshot_context():
-            return _run_iteration_body(batch, warnings)
-
-    def _run_iteration_body(batch, warnings: list) -> dict:
         if batch is not None and batch[1] and not skip_sync:
             with sync_lock:
                 result = _refresh_usage_inproc()
@@ -2556,103 +2545,38 @@ def _wake_schema_writer() -> None:
             _SCHEMA_WAKE_THREAD = None
 
 
-#: How often the pricing watch stats the deployed pricing file. A monotonic
-#: cadence, because a wall-clock one would re-poll or stall across a system
-#: clock change.
-_PRICING_WATCH_INTERVAL_S = 60.0
-
-
-class _PricingWatch:
-    """Detect a replaced `_lib_pricing.py` and adopt it in process (#714).
+_INSTALL_WATCH = None
 
-    An installer overwrites the deployed file under a running dashboard.
-    Nothing about that reaches this process: every CLI invocation re-imports
-    and picks the new tables up, and only a long-lived process holds the old
-    ones.
 
-    STAT FIRST, PARSE SECOND. The poll compares an inode/size/mtime signature
-    and parses only when it changed, so the steady state is one `stat` a
-    minute rather than an `ast.parse` of a 1,400-line file.
+def _start_install_watch(boot):
+    """Own the install watch on its own lifecycle thread, in every mode (#868).
 
-    NEVER RAISES OUT OF `poll_once`. The file it reads is one an installer may
-    be part-way through writing, so a half-written file is the ordinary case
-    rather than an exceptional one; a raising poll would end the thread and
-    leave the process permanently stale, which is the very condition this
-    exists to clear.
+    Not started from a git checkout, where file changes are development work,
+    not installs.
     """
-
-    def __init__(self, source_path=None, interval_s=None):
-        self.source_path = pathlib.Path(
-            source_path if source_path is not None
-            else sys.modules["_lib_pricing"].__file__)
-        self.interval_s = (_PRICING_WATCH_INTERVAL_S if interval_s is None
-                           else interval_s)
-        self._signature = None
-        self._stop = threading.Event()
-
-    def _current_signature(self):
-        try:
-            st = self.source_path.stat()
-        except OSError:
-            return None
-        return (st.st_dev, st.st_ino, st.st_size, st.st_mtime_ns)
-
-    def poll_once(self) -> bool:
-        """One check. Returns True iff a new snapshot was adopted."""
-        try:
-            signature = self._current_signature()
-            if signature is None or signature == self._signature:
-                return False
-            self._signature = signature
-            pricing = sys.modules["_lib_pricing"]
-            candidate = pricing.read_pricing_snapshot_from_source(
-                self.source_path)
-            if not pricing.adopt_pricing_candidate(candidate):
-                return False
-            eprint("[pricing] adopted pricing revision "
-                   f"{candidate.snapshot_date} without restarting")
-            return True
-        except Exception:  # noqa: BLE001
-            # Including `PricingCandidateRejected`: a rejected candidate is a
-            # normal outcome, and the signature is already recorded so the
-            # same bad file is not re-parsed every minute.
-            return False
-
-    def run(self) -> None:
-        while not self._stop.wait(self.interval_s):
-            self.poll_once()
-
-    def stop(self) -> None:
-        self._stop.set()
-
-
-_PRICING_WATCH: "_PricingWatch | None" = None
-
-
-def _start_pricing_watch() -> "_PricingWatch | None":
-    """Own the pricing detector on a lifecycle thread that runs in BOTH modes.
-
-    Deliberately not `_DashboardSyncThread` and not the conversation sync
-    thread: `cmd_dashboard` disables both under `--no-sync`, so a detector in
-    either would silently have no owner exactly where a long-lived process is
-    most likely to run.
-    """
-    global _PRICING_WATCH
-    if _PRICING_WATCH is not None:
-        return _PRICING_WATCH
+    global _INSTALL_WATCH
+    if _cctally_core._is_dev_checkout():
+        return None
+    if _INSTALL_WATCH is not None:
+        return _INSTALL_WATCH
     try:
-        watch = _PricingWatch()
-        watch.poll_once()  # establish the baseline signature; adopts nothing
-        thread = threading.Thread(
-            target=watch.run, name="cctally-pricing-watch", daemon=True)
-        thread.start()
+        watch = InstallWatch(
+            boot, worker_fn=lambda: getattr(_cctally(), "_UPDATE_WORKER", None))
+        watch.start()
     except Exception as exc:  # noqa: BLE001
-        eprint(f"[pricing] watch not started ({exc})")
+        eprint(f"[update] install watch not started ({exc})")
         return None
-    _PRICING_WATCH = watch
+    _INSTALL_WATCH = watch
     return watch
 
 
+def _stop_install_watch() -> None:
+    global _INSTALL_WATCH
+    watch, _INSTALL_WATCH = _INSTALL_WATCH, None
+    if watch is not None:
+        watch.stop()
+
+
 def _dashboard_maybe_prune_retention() -> None:
     """#313 P3 (F7): throttled transcript retention prune driven from the
     independent conversation sync thread. Opens a dedicated transcript
@@ -2812,18 +2736,7 @@ def _conversation_sync_pass() -> str:
     therefore NO SECOND OPEN ATTEMPT AFTER A FAILED OPEN — stated that narrowly
     because a successful pass opens the store twice by design, once here and
     once inside the prune.
-
-    #714: the whole pass runs on ONE pricing revision. This pass writes
-    materialized cost, so a swap landing between the Claude leg and the Codex
-    leg would derive one store's rollup from two revisions — the ordered-write
-    guard would not even see it, because both halves are the same process.
     """
-    with _lib_pricing.pricing_snapshot_context():
-        return _conversation_sync_pass_body()
-
-
-def _conversation_sync_pass_body() -> str:
-    """The body of `_conversation_sync_pass`, run under its pricing context."""
     try:
         conn = open_conversations_db()
     except (OSError, sqlite3.DatabaseError) as exc:
@@ -3375,6 +3288,14 @@ def _DashboardUpdateCheckThread(*args, **kwargs):
     return sys.modules["cctally"]._DashboardUpdateCheckThread(*args, **kwargs)
 
 
+def capture_install_boot_state(*args, **kwargs):
+    return sys.modules["cctally"].capture_install_boot_state(*args, **kwargs)
+
+
+def InstallWatch(*args, **kwargs):
+    return sys.modules["cctally"].InstallWatch(*args, **kwargs)
+
+
 # Module-level __getattr__ — lazy-resolves a handful of cctally globals at
 # attribute-access time (used for the ``except cctally.SomeError`` sites
 # that need real class identity, and for non-callable constants that the
@@ -8610,19 +8531,6 @@ _GET_ROUTES = (
      ("scope", "endpoint.conversation_detail"), True),
 )
 
-#: Handlers that block for the life of a client connection rather than for one
-#: response. `_dispatch` must NOT pin a pricing revision around these: the pin
-#: would last as long as the stream, so a viewer who left a tab open would keep
-#: pricing from whichever revision was live when the tab connected — the exact
-#: staleness #714 removes. Both are streams that carry no cost of their own;
-#: the envelopes they forward are priced by the build that produced them, which
-#: has its own context.
-_STREAMING_ROUTE_HANDLERS = frozenset({
-    "_serve_api_events",
-    "_handle_get_update_stream",
-    "_handle_get_conversation_events",
-})
-
 _POST_ROUTES = (
     ("exact", "/api/auth", "_handle_post_auth", None, False),
     ("exact", "/api/sync", "_handle_post_sync", None, False),
@@ -8758,13 +8666,6 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         eleven path-taking handlers. (NOTE: returning a bool, not ``fn()`` —
         the void handlers all return None, so a None-return contract could not
         tell "handled" from "unmatched".)
-
-        #714: every matched route runs inside a pricing-snapshot context, so a
-        response is never assembled from two pricing revisions when an
-        installer replaces `_lib_pricing.py` mid-request. The two long-lived
-        streaming routes are excluded — a context entered there would pin one
-        revision for the whole life of the stream, which is minutes to hours
-        and the opposite of what the reload exists to achieve.
         """
         path = self.path.split("?", 1)[0]
         for kind, pattern, name, perf, wants_path in table:
@@ -8778,19 +8679,14 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 continue
             fn = getattr(self, name)
             args = (path,) if wants_path else ()
-            if name in _STREAMING_ROUTE_HANDLERS:
-                pinned = contextlib.nullcontext()
-            else:
-                pinned = _lib_pricing.pricing_snapshot_context()
-            with pinned:
-                if perf is None:
+            if perf is None:
+                fn(*args)
+            elif perf[0] == "scope":
+                with self._perf_scope(perf[1]):
+                    fn(*args)
+            else:  # "phase"
+                with self._perf_gate().phase(perf[1]):
                     fn(*args)
-                elif perf[0] == "scope":
-                    with self._perf_scope(perf[1]):
-                        fn(*args)
-                else:  # "phase"
-                    with self._perf_gate().phase(perf[1]):
-                        fn(*args)
             return True
         return False
 
@@ -11731,7 +11627,9 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         as an explicit user pin; the worker resolves the selected channel
         afresh. CSRF-gated. Returns
         202 + ``{"run_id": ...}`` on accept; 409 + ``{"run_id_in_progress": ...}``
-        when another run is already in progress.
+        when another run is already in progress; 503 + ``{"error": ...}`` while
+        the install watcher holds the automatic-restart claim (#868), which
+        the unchanged client shows as a failed start.
         """
         if not self._check_origin_csrf():
             return
@@ -11753,7 +11651,11 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # The dashboard has no explicit-version input. Older clients sent the
         # cached beta target here; trusting it as a pin recreates #342 whenever
         # the registry advances while the modal is open.
-        accepted, run_id = worker.start(None)
+        try:
+            accepted, run_id = worker.start(None)
+        except sys.modules["cctally"].AutomaticRestartInProgress as exc:
+            self._respond_json(503, {"error": str(exc)})
+            return
         if accepted:
             self._respond_json(202, {"run_id": run_id})
         else:
@@ -12339,16 +12241,20 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     _cctally_core.enable_quota_projection_reconciliation()
 
     # Spec §5.7: capture the un-mutated argv + PATH-resolved entrypoint
-    # at boot so the in-place ``execvp`` after a successful update
-    # re-enters the user-facing wrapper (npm Node shim → CCTALLY_PYTHON
-    # honoured; brew symlink → post-upgrade Python script). Module-level
-    # globals live in cctally (declared at L23205 pre-extract); we write
-    # them via the module-proxy so ``UpdateWorker`` (in _cctally_update)
-    # reads the right values via ``cctally.X`` at call time.
+    # at boot. ``_resolve_execvp_target`` derives the in-place restart
+    # from them: an npm install execs Python directly on its own
+    # ``bin/cctally`` (no added Node process, #868), and a brew install
+    # re-enters the symlink into the newly linked keg. Module-level
+    # globals live in cctally; we write them via the module-proxy so
+    # ``UpdateWorker`` and the install watch (in _cctally_update) read the
+    # right values via ``cctally.X`` at call time.
     _c_boot = _cctally()
     _c_boot.ORIGINAL_SYS_ARGV = list(sys.argv)
     _c_boot.ORIGINAL_ENTRYPOINT = shutil.which("cctally")
     _c_boot._UPDATE_WORKER = UpdateWorker()
+    # #868: captured before any thread starts; the install watch compares every
+    # later poll against what this process booted from.
+    _install_boot = capture_install_boot_state()
 
     # Load config for the bind-host + expose-transcripts resolution below. (#217
     # S1 / U7b: dropped the dead ``args._resolved_tz = resolve_display_tz(...)``
@@ -12433,11 +12339,9 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     _cctally_cache_module.set_conversation_derivations_suppressed(
         bool(args.no_sync))
     _dashboard_startup_schema_migration(run_derivations=not bool(args.no_sync))
-    # #714: the pricing-file watch, in EVERY mode for the same reason. Both
-    # `_DashboardSyncThread` and `_make_conversation_sync_thread` are disabled
-    # under `--no-sync`, so a detector placed in either would have no owner in
-    # the one mode a long-lived read-only dashboard runs in.
-    _start_pricing_watch()
+    # #868: in EVERY mode, because `--no-sync` disables both sync threads and a
+    # long-lived read-only dashboard is still left behind by an install.
+    _start_install_watch(_install_boot)
     _heal = _dashboard_self_heal_orphans(skip_sync=bool(args.no_sync))
     if _heal is not None and _heal.pruned_files:
         print(f"dashboard: pruned {_heal.pruned_files} orphaned cache file(s) "
@@ -12703,6 +12607,8 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     try:
         _dashboard_wait_for_signal((_signal.SIGINT, _signal.SIGTERM))
     finally:
+        # First, so a shutdown can never be followed by an automatic restart.
+        _stop_install_watch()
         if sync_thread is not None:
             sync_thread.stop()
         conversation_sync_stop.set()

package/bin/_cctally_update.py

@@ -75,7 +75,12 @@ worker / polling thread:
   (two-thread pump → callbacks + log lines),
   ``_do_update_install`` (acquire lock → run steps → release →
   rotate log; dry-run path skips lock + subprocesses),
-  ``_resolve_execvp_target`` (npm shim re-entry path, spec §5.7).
+  ``_resolve_execvp_target`` (spec §5.7; npm execs Python directly
+  since #868) and ``_execvp_target_problem`` (target validity).
+- Install evidence (#868): ``install-success.json`` via
+  ``_write_install_success_record`` / ``_read_install_success_record``,
+  ``_update_lock_is_held``, ``_install_root_for_entrypoint``,
+  ``_read_changelog_version_at``, ``_install_layout``.
 - Dashboard surface: ``UpdateWorker`` (single-slot orchestrator,
   spec §5.6; idempotent-release contract per §5.6.1),
   ``_DashboardUpdateCheckThread`` (poll cadence ≠ network-call
@@ -184,12 +189,14 @@ import argparse
 import datetime as dt
 import fcntl
 import json
+import math
 import os
 import pathlib
 import queue
 import re
 import secrets
 import shlex
+import shutil
 import subprocess
 import sys
 import threading
@@ -677,6 +684,101 @@ def _release_update_lock(fd: int) -> None:
         pass
 
 
+_INSTALL_SUCCESS_RECORD_SCHEMA = 1
+
+
+@dataclass(frozen=True)
+class InstallSuccessRecord:
+    """One install event from ``install-success.json`` (#868)."""
+
+    version: str
+    at_utc: str
+    token: str
+
+
+def _write_install_success_record(version: str) -> None:
+    """Atomically replace the install-only success record (#868).
+
+    ``_do_update_check`` loads ``update-state.json`` before its network fetch
+    and saves that object afterward, so an install that stamps success during
+    the fetch loses its fields there. Only the install paths write this file,
+    so no update check can erase an install event. Every write mints a fresh
+    random token: a running dashboard compares tokens, never times, so a clock
+    step can neither hide a new install nor revive an old one.
+    """
+    path = _cctally_core.INSTALL_SUCCESS_RECORD_PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = (json.dumps({
+        "_schema": _INSTALL_SUCCESS_RECORD_SCHEMA,
+        "version": version,
+        "at_utc": _now_utc().isoformat(),
+        "token": secrets.token_hex(16),
+    }, sort_keys=True) + "\n").encode("utf-8")
+    tmp = path.with_name(f"{path.name}.tmp.{os.getpid()}")
+    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o644)
+    try:
+        try:
+            view = memoryview(payload)
+            while view:
+                view = view[os.write(fd, view):]
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.replace(str(tmp), str(path))
+    except BaseException:
+        try:
+            os.unlink(str(tmp))
+        except OSError:
+            pass
+        raise
+
+
+def _read_install_success_record() -> "InstallSuccessRecord | None":
+    """The current install-success record, or None when absent or malformed."""
+    try:
+        raw = json.loads(
+            _cctally_core.INSTALL_SUCCESS_RECORD_PATH.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    if not isinstance(raw, dict) or raw.get("_schema") != _INSTALL_SUCCESS_RECORD_SCHEMA:
+        return None
+    fields = (raw.get("version"), raw.get("at_utc"), raw.get("token"))
+    if not all(isinstance(v, str) and v for v in fields):
+        return None
+    try:
+        _release_parse_semver(fields[0])
+    except ValueError:
+        return None
+    return InstallSuccessRecord(*fields)
+
+
+def _update_lock_is_held() -> bool:
+    """True unless ``update.lock`` is provably free; never creates the file.
+
+    A shared non-blocking probe conflicts with the updater's exclusive lock. A
+    lock file left behind by a finished or crashed updater carries no lock, so
+    it reads as free. The probe holds its shared lock for an instant, so an
+    updater whose own non-blocking attempt lands in that instant takes its
+    contention path. Any other error proves nothing about the updater and
+    reads as held.
+    """
+    try:
+        fd = os.open(str(_cctally_core.UPDATE_LOCK_PATH), os.O_RDONLY)
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return True
+    try:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_SH | fcntl.LOCK_NB)
+        except OSError:
+            return True
+        fcntl.flock(fd, fcntl.LOCK_UN)
+        return False
+    finally:
+        os.close(fd)
+
+
 def _rotate_update_log_if_needed() -> None:
     """Rotate ``update.log`` → ``update.log.1`` when the live log
     crosses :data:`UPDATE_LOG_ROTATE_BYTES` (1 MB, spec §1.5).
@@ -905,6 +1007,9 @@ def _stamp_install_success_to_state(
          installed version. Skipped on brew for the reason above.
       4. ``state.latest_version`` — last resort, also covers the npm
          path when CHANGELOG is unreadable.
+
+    The same version is also written to ``install-success.json`` (#868),
+    which a running dashboard reads to decide whether to restart itself.
     """
     c = _cctally()
     state = c._load_update_state() or {"_schema": 1}
@@ -923,6 +1028,15 @@ def _stamp_install_success_to_state(
         state["current_version"] = cur
         state["last_install_success_at_utc"] = _now_utc().isoformat()
         c._save_update_state(state)
+        try:
+            c._write_install_success_record(cur)
+        except OSError as exc:
+            # The install itself succeeded; only a running dashboard's
+            # automatic restart loses its evidence.
+            eprint(f"cctally: could not write "
+                   f"{_cctally_core.INSTALL_SUCCESS_RECORD_PATH.name} ({exc}); "
+                   "a running dashboard will not restart itself for this "
+                   "install")
 
 
 def _self_heal_current_version() -> None:
@@ -2106,7 +2220,7 @@ def _do_update_install(
         c._rotate_update_log_if_needed()
 
 
-# === Dashboard execvp re-entry (spec §5.7) ===
+# === Dashboard execvp re-entry (spec §5.7; #868) ===
 # ORIGINAL_SYS_ARGV / ORIGINAL_ENTRYPOINT are captured at dashboard
 # server boot in cmd_dashboard (in bin/cctally, written via
 # ``global ORIGINAL_SYS_ARGV, ORIGINAL_ENTRYPOINT`` so the running
@@ -2117,26 +2231,81 @@ def _do_update_install(
 #
 # _resolve_execvp_target uses them to return (entrypoint, exec_argv)
 # for os.execvp:
-#   - npm: entrypoint = <prefix>/bin/cctally → Node shim, which
-#     re-resolves CCTALLY_PYTHON before re-spawning Python (so a
-#     custom interpreter setting survives the restart).
+#   - npm: the interpreter the Node shim would use (CCTALLY_PYTHON, else
+#     python3 on PATH) on the install's bin/cctally. Re-entering the shim
+#     would add a Node process per restart, because the shim starts Python
+#     with spawnSync and waits for it (#868).
 #   - brew: entrypoint = <brew>/bin/cctally → symlink into the
 #     post-upgrade Python script with its rewritten shebang.
 #   - Fallback when shutil.which("cctally") returned None: use
-#     sys.argv[0] directly. Loses the npm shim layer; we accept the
-#     degraded edge case rather than guess.
+#     sys.argv[0] directly.
+# The install watcher (#868) and UpdateWorker both refuse a target that
+# _execvp_target_problem rejects.
 
 
-def _resolve_execvp_target() -> tuple[str, list[str]]:
-    """Return (entrypoint, exec_argv) per spec §5.7.
+def _install_root_for_entrypoint(entrypoint: "str | None") -> "pathlib.Path | None":
+    """Install root behind a user-facing entrypoint, resolved afresh (#868).
 
-    Re-enters the npm shim by execvp'ing the PATH-resolved ``cctally``
-    (Node shim for npm, brew symlink for brew). Falls back to
-    ``sys.argv[0]`` only when ``shutil.which`` returned ``None`` at
-    dashboard boot (rare absolute-path invocation).
+    npm: ``<prefix>/bin/cctally`` → ``…/node_modules/cctally/bin/cctally-npm-shim.js``
+    → ``…/node_modules/cctally``. Homebrew: ``<prefix>/bin/cctally`` →
+    ``Cellar/cctally/<v>/libexec/bin/cctally`` → ``…/libexec``, where the
+    formula installs ``CHANGELOG.md``. The process's own ``CHANGELOG_PATH`` is
+    never used for this: it stays inside the install the process booted from.
+    """
+    if not entrypoint:
+        return None
+    try:
+        real = pathlib.Path(os.path.realpath(entrypoint))
+    except (OSError, ValueError):
+        return None
+    if real.parent.name != "bin":
+        return None
+    return real.parent.parent
+
+
+def _read_changelog_version_at(root) -> "str | None":
+    """Latest stamped version in ``<root>/CHANGELOG.md``, or None."""
+    try:
+        text = (pathlib.Path(root) / "CHANGELOG.md").read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return None
+    m = _cctally().RELEASE_HEADER_RE.search(text)
+    return m.group(1) if m else None
+
+
+def _install_layout(root) -> str:
+    """``"npm"``, ``"brew"`` or ``"other"`` for an install root."""
+    root = pathlib.Path(root)
+    if ((root / "bin" / "cctally-npm-shim.js").is_file()
+            and (root / "package.json").is_file()):
+        return "npm"
+    parts = root.parts
+    if (root.name == "libexec" and len(parts) >= 4
+            and parts[-4] == "Cellar" and parts[-3] == "cctally"):
+        return "brew"
+    return "other"
+
+
+def _resolve_execvp_target() -> tuple[str, list[str]]:
+    """Return (entrypoint, exec_argv) for the in-place restart.
+
+    npm installs exec the interpreter the shim would use (``CCTALLY_PYTHON``,
+    else ``python3`` on ``PATH``) on the install's ``bin/cctally`` directly, so
+    the serving Python process keeps its PID and the original shim stays its
+    only Node parent (#868). Homebrew re-enters the captured entrypoint, which
+    resolves into the newly linked keg. Falls back to ``sys.argv[0]`` only when
+    ``shutil.which`` returned ``None`` at dashboard boot.
     """
     c = _cctally()
     if c.ORIGINAL_ENTRYPOINT is not None:
+        root = _install_root_for_entrypoint(c.ORIGINAL_ENTRYPOINT)
+        if root is not None and _install_layout(root) == "npm":
+            python = os.environ.get("CCTALLY_PYTHON") or "python3"
+            if os.path.sep not in python:
+                python = shutil.which(python) or python
+            return (python,
+                    [python, str(root / "bin" / "cctally"),
+                     *c.ORIGINAL_SYS_ARGV[1:]])
         return (
             c.ORIGINAL_ENTRYPOINT,
             [c.ORIGINAL_ENTRYPOINT, *c.ORIGINAL_SYS_ARGV[1:]],
@@ -2144,6 +2313,34 @@ def _resolve_execvp_target() -> tuple[str, list[str]]:
     return (c.ORIGINAL_SYS_ARGV[0], list(c.ORIGINAL_SYS_ARGV))
 
 
+def _execvp_target_problem(entrypoint: str, argv: "list[str]") -> "str | None":
+    """Why ``os.execvp(entrypoint, argv)`` cannot start cctally, or None.
+
+    The executable must resolve to an executable file. When ``argv[1]`` is an
+    install's ``bin/cctally`` (the npm target), that script must exist and be
+    readable, the same file the npm shim checks before it starts Python.
+    """
+    path = entrypoint if os.path.sep in entrypoint else shutil.which(entrypoint)
+    if not path or not os.path.isfile(path) or not os.access(path, os.X_OK):
+        return f"restart target {entrypoint!r} is not an executable file"
+    if (len(argv) >= 2 and os.path.isabs(argv[1])
+            and pathlib.Path(argv[1]).parts[-2:] == ("bin", "cctally")):
+        if not (os.path.isfile(argv[1]) and os.access(argv[1], os.R_OK)):
+            return f"restart script {argv[1]!r} is missing or unreadable"
+    return None
+
+
+class AutomaticRestartInProgress(Exception):
+    """``UpdateWorker.start`` refused: the install watcher holds the restart
+    claim (#868, maintainer decision 6)."""
+
+    def __init__(self, version: str) -> None:
+        self.version = version
+        super().__init__(
+            f"The dashboard is restarting to load v{version}. "
+            "Try again in a moment.")
+
+
 class UpdateWorker:
     """Single-slot dashboard-side update orchestrator (spec §5.6).
 
@@ -2175,15 +2372,23 @@ class UpdateWorker:
         # consumer ever subscribes, ``start()`` reaps stale entries on
         # the next run.
         self._streams: dict[str, "queue.Queue"] = {}
+        # The install watcher's restart claim (#868): the candidate version
+        # while held, else None. Guarded by ``_lock`` together with
+        # ``_current_id``, so a claim and an admitted run exclude each other.
+        self._auto_restart_version: "str | None" = None
 
     def start(self, version: "str | None") -> tuple[bool, str]:
         """Begin a run. Returns (accepted, run_id).
 
         ``accepted=False`` when another run is in progress; the
         returned ``run_id`` is the in-progress one (so the caller can
-        surface it as ``run_id_in_progress`` to the client).
+        surface it as ``run_id_in_progress`` to the client). Raises
+        :class:`AutomaticRestartInProgress` while the install watcher holds
+        the restart claim (#868).
         """
         with self._lock:
+            if self._auto_restart_version is not None:
+                raise AutomaticRestartInProgress(self._auto_restart_version)
             if self._current_id is not None:
                 return (False, self._current_id)
             # Reap any stale entries from prior no-consumer runs. Safe
@@ -2206,6 +2411,26 @@ class UpdateWorker:
         with self._lock:
             return {"current_run_id": self._current_id}
 
+    def claim_automatic_restart(self, version: str) -> bool:
+        """Claim the in-place restart for the install watcher (#868).
+
+        Fails while an update run is admitted, because that run owns its own
+        stamp, flush, lock release and exec. The claim is not an update run:
+        it has no run id, stream or event, so ``status()`` still reports no
+        run and a client that clicks Update meanwhile gets
+        :class:`AutomaticRestartInProgress` from ``start``.
+        """
+        with self._lock:
+            if (self._current_id is not None
+                    or self._auto_restart_version is not None):
+                return False
+            self._auto_restart_version = version
+            return True
+
+    def release_automatic_restart(self) -> None:
+        with self._lock:
+            self._auto_restart_version = None
+
     def _emit(self, run_id: str, event: dict) -> None:
         q = self._streams.get(run_id)
         if q is not None:
@@ -2310,6 +2535,9 @@ class UpdateWorker:
             _log_update_event(log_fd, "INSTALL_SUCCESS")
             c._stamp_install_success_to_state(resolved_version, method)
             entrypoint, exec_argv = c._resolve_execvp_target()
+            problem = c._execvp_target_problem(entrypoint, exec_argv)
+            if problem is not None:
+                raise UpdateError(problem)
             self._emit(run_id, {"type": "execvp", "argv": exec_argv})
             try:
                 log_fd.close()
@@ -2347,6 +2575,184 @@ class UpdateWorker:
                 # start() sweeps stale entries on the next run.
 
 
+# === Install watch (#868) =================================================
+# A running dashboard restarts itself in place when a proven install puts a
+# strictly newer cctally under it. Spec:
+# docs/superpowers/specs/2026-09-23-868-dashboard-restart-on-install-design.md
+
+_INSTALL_WATCH_INTERVAL_S = 60.0
+_INSTALL_RESTART_RETRY_DELAYS_S = (60.0, 300.0, 900.0)
+_INSTALL_RESTART_FLUSH_S = 0.5
+
+
+@dataclass(frozen=True)
+class InstallBootState:
+    """What the dashboard process booted from. Later polls compare against it,
+    never against wall-clock time, so a restarted process cannot qualify on the
+    install it booted from."""
+
+    version: "str | None"
+    root: "pathlib.Path | None"
+    record_token: "str | None"
+
+
+def capture_install_boot_state() -> InstallBootState:
+    c = _cctally()
+    latest = c._release_read_latest_release_version()
+    record = _read_install_success_record()
+    return InstallBootState(
+        version=latest[0] if latest else None,
+        root=_install_root_for_entrypoint(c.ORIGINAL_ENTRYPOINT),
+        record_token=record.token if record else None,
+    )
+
+
+@dataclass(frozen=True)
+class RestartCandidate:
+    """A proven newer install. ``identity`` keys the retry budget: the version
+    with the record token (updater) or the resolved install root (Homebrew)."""
+
+    version: str
+    evidence: str
+    identity: tuple
+
+
+class InstallWatch:
+    """Restart the dashboard in place after a proven newer install (#868).
+
+    Proven means cctally's updater wrote a new install-success record, or
+    Homebrew switched the entrypoint into a newer keg. A manual npm install
+    rewrites files in place with no completion signal, so it never qualifies.
+
+    The restart meets the Update-button safety bar and no more: nothing is
+    stopped before the exec, and an in-flight write is interrupted as in a
+    crash. The claim on ``UpdateWorker`` keeps an admitted update run as the
+    sole owner of its own restart.
+    """
+
+    def __init__(self, boot, *, worker_fn, exec_fn=os.execvp,
+                 sleep_fn=time.sleep, monotonic_fn=time.monotonic,
+                 log_fn=None, interval_s=_INSTALL_WATCH_INTERVAL_S,
+                 retry_delays=_INSTALL_RESTART_RETRY_DELAYS_S,
+                 flush_s=_INSTALL_RESTART_FLUSH_S):
+        self._boot = boot
+        self._worker_fn = worker_fn
+        self._exec = exec_fn
+        self._sleep = sleep_fn
+        self._monotonic = monotonic_fn
+        self._log = log_fn or eprint
+        self.interval_s = interval_s
+        self._retry_delays = tuple(retry_delays)
+        self._flush_s = flush_s
+        # identity -> (failed attempts, monotonic time of the next attempt)
+        self._attempts: dict = {}
+        self._stop = threading.Event()
+        self._thread: "threading.Thread | None" = None
+
+    def _say(self, msg: str) -> None:
+        # A lost log line, e.g. stderr on a closed pipe, must not count as a
+        # failed restart attempt or end the watch thread.
+        try:
+            self._log(msg)
+        except Exception:  # noqa: BLE001
+            pass
+
+    def find_candidate(self) -> "RestartCandidate | None":
+        boot = self._boot
+        if boot.version is None:
+            return None
+        root = _install_root_for_entrypoint(_cctally().ORIGINAL_ENTRYPOINT)
+        if root is None:
+            return None
+        record = _read_install_success_record()
+        if (record is not None and record.token != boot.record_token
+                and _semver_gt(record.version, boot.version)
+                and not _update_lock_is_held()
+                and _read_changelog_version_at(root) == record.version):
+            return RestartCandidate(record.version, "updater",
+                                    (record.version, "updater", record.token))
+        # Homebrew links the new keg only after installing it completely, so
+        # the switch itself is the completion event.
+        if root != boot.root and _install_layout(root) == "brew":
+            version = _read_changelog_version_at(root)
+            if version and _semver_gt(version, boot.version):
+                return RestartCandidate(version, "brew",
+                                        (version, "brew", str(root)))
+        return None
+
+    def poll_once(self) -> str:
+        """One check. Returns ``"idle"``, ``"backoff"``, ``"exhausted"``,
+        ``"deferred"``, ``"stopped"``, ``"failed"`` or ``"exec"``."""
+        candidate = self.find_candidate()
+        if candidate is None:
+            return "idle"
+        now = self._monotonic()
+        prior = self._attempts.get(candidate.identity)
+        if prior is not None:
+            failures, next_at = prior
+            if failures > len(self._retry_delays):
+                return "exhausted"
+            if now < next_at:
+                return "backoff"
+        worker = self._worker_fn()
+        if worker is None:
+            return "deferred"
+        c = _cctally()
+        claimed = False
+        try:
+            entrypoint, argv = c._resolve_execvp_target()
+            problem = c._execvp_target_problem(entrypoint, argv)
+            if problem is None:
+                again = self.find_candidate()
+                if again is None or again.identity != candidate.identity:
+                    problem = "the install changed before the restart"
+            if problem is not None:
+                raise UpdateError(problem)
+            if not worker.claim_automatic_restart(candidate.version):
+                return "deferred"
+            claimed = True
+            self._say(f"[update] restarting dashboard: v{self._boot.version} "
+                      f"-> v{candidate.version} ({candidate.evidence} install)")
+            # Lets a POST /api/update already refused under the claim finish
+            # writing its 503 before the process image is replaced.
+            self._sleep(self._flush_s)
+            if self._stop.is_set():
+                worker.release_automatic_restart()
+                return "stopped"
+            self._exec(entrypoint, argv)
+        except Exception as exc:  # noqa: BLE001 — a failed attempt keeps serving
+            if claimed:
+                worker.release_automatic_restart()
+            failures = (prior[0] if prior else 0) + 1
+            delay = (self._retry_delays[failures - 1]
+                     if failures <= len(self._retry_delays) else math.inf)
+            self._attempts[candidate.identity] = (failures, now + delay)
+            self._say(f"[update] automatic restart to v{candidate.version} "
+                      f"failed: {exc}")
+            return "failed"
+        return "exec"
+
+    def run(self) -> None:
+        while not self._stop.wait(self.interval_s):
+            try:
+                self.poll_once()
+            except Exception as exc:  # noqa: BLE001 — the watch must not die
+                self._say(f"[update] install watch poll failed: {exc!r}")
+
+    def start(self) -> "threading.Thread":
+        thread = threading.Thread(target=self.run, name="cctally-install-watch",
+                                  daemon=True)
+        thread.start()
+        self._thread = thread
+        return thread
+
+    def stop(self, timeout: float = 2.0) -> None:
+        self._stop.set()
+        thread = self._thread
+        if thread is not None and thread is not threading.current_thread():
+            thread.join(timeout)
+
+
 class _DashboardUpdateCheckThread(threading.Thread):
     """Dedicated update-check polling thread (spec §3.5).
 

package/bin/_lib_cache_report.py

@@ -107,13 +107,10 @@ def _import_pricing_kernel():
 
 
 # ``DEFAULT_TIERED_THRESHOLD`` above is Anthropic's per-call >200K-tokens tier,
-# READ FROM ``_lib_pricing`` rather than duplicated here (#714). It used to be a
-# literal `200_000` with nothing keeping it equal to
-# ``_lib_pricing.TIERED_THRESHOLD``, which made it a pricing value a reload
-# could not replace. It is refreshed by ``PRICING_EXPORT_BINDINGS`` on every
-# swap, and ``_compute_entry_cache_dollars`` resolves it at CALL time — a
-# default argument would bind it once at function-definition time, so the
-# refresh would reach the name and never the calls.
+# READ FROM ``_lib_pricing.TIERED_THRESHOLD`` rather than duplicated here, so
+# the two cannot drift. ``_compute_entry_cache_dollars`` resolves it at CALL
+# time instead of binding it as a default argument, so this module global is
+# the one place the value is taken from.
 # Callers may still override via the ``tiered_threshold`` kwarg.
 
 
@@ -384,9 +381,9 @@ def _compute_entry_cache_dollars(
     warning for unknown models elsewhere.
 
     ``tiered_threshold=None`` resolves ``DEFAULT_TIERED_THRESHOLD`` HERE rather
-    than in the signature (#714). A default argument is evaluated once, at
-    function-definition time, so an in-process pricing reload would refresh the
-    module global and leave every call pricing from the superseded revision.
+    than in the signature. A default argument is evaluated once, at
+    function-definition time, so a change to the module global would never
+    reach the calls.
     """
     if tiered_threshold is None:
         tiered_threshold = DEFAULT_TIERED_THRESHOLD

package/bin/_lib_pricing.py

@@ -17,17 +17,12 @@ Spec: docs/superpowers/specs/2026-05-13-bin-cctally-split-design.md
 """
 from __future__ import annotations
 
-import contextlib as _contextlib
-import contextvars as _contextvars
 import dataclasses
 import datetime as dt
 import re
 import sys
-import threading as _threading
 from typing import Any
 
-_sys = sys
-
 
 def _eprint(*args: Any) -> None:
     print(*args, file=sys.stderr)
@@ -1448,36 +1443,20 @@ def _short_model_name(model: str) -> str:
 
 
 # ---------------------------------------------------------------------------
-# #714 — the published pricing snapshot, and the reader that replaces it
-#
-# Every CLI invocation re-imports this module, so only a long-lived process —
-# the dashboard — can hold pricing an installer has already replaced on disk.
-# Two rules shape everything below.
-#
-# A PARTIAL SWAP IS WORSE THAN NO SWAP. `PRICING_SNAPSHOT_DATE` is what gates
-# the materialized-cost write refusal in `_cctally_cache`, so replacing the
-# date alone clears the refusal and resumes writing cost computed from the old
-# tables. A candidate is therefore validated whole and adopted whole, or it is
-# rejected and the live snapshot is retained unchanged.
+# The pricing snapshot every cost kernel reads.
 #
-# NEVER `importlib.reload`. It executes arbitrary module code from a file an
-# installer has just written; it mutates a live module dict incrementally, so a
-# request in flight can see half a table; and it would not even fix the bug,
-# because reloading this module rebinds none of the import-time copies listed
-# in `PRICING_EXPORT_BINDINGS`. `ast.literal_eval` cannot execute code.
-
-
-class PricingCandidateRejected(Exception):
-    """A candidate pricing file was not adopted. Carries the reason."""
+# Built once at import from the module globals above and never replaced. A
+# long-lived dashboard does not reload pricing in process: after a proven
+# install of a newer version it restarts itself (#868), and after a manual
+# install it keeps these tables until the user restarts it.
 
 
 class PricingSnapshot:
     """One complete, immutable pricing revision.
 
-    Every pricing-affecting value lives here — not only the two tables. A
-    tier threshold, the Codex fallback model, an alias or a fast multiplier
-    left behind by a partial swap prices part of an entry from the previous
-    revision, which is the same defect as a stale table and harder to see.
+    Every pricing-affecting value lives here — not only the two tables: both
+    tier thresholds, the Codex fallback model, the aliases, the cache-write
+    multiplier and the fast multipliers.
 
     Hand-written frozen rather than ``@dataclasses.dataclass(frozen=True)``,
     for the reason `PricingFingerprintObservation` above states at length:
@@ -1522,81 +1501,6 @@ class PricingSnapshot:
                 f"codex_models={len(self.codex_pricing)})")
 
 
-#: The complete inventory of import-time copies, made explicit so it can be
-#: tested rather than asserted. `(module name, attribute, field accessor)`.
-#: `bin/cctally` copies the tables at import and both dashboard source modules
-#: read those copies, so a swap that missed one would price from a stale table
-#: with the refusal latch already cleared.
-PRICING_EXPORT_BINDINGS = (
-    ("_lib_pricing", "PRICING_SNAPSHOT_DATE", lambda s: s.snapshot_date),
-    ("_lib_pricing", "CLAUDE_MODEL_PRICING", lambda s: s.claude_pricing),
-    ("_lib_pricing", "CODEX_MODEL_PRICING", lambda s: s.codex_pricing),
-    ("_lib_pricing", "CODEX_MODEL_ALIASES", lambda s: s.aliases),
-    ("_lib_pricing", "TIERED_THRESHOLD",
-     lambda s: s.tier_thresholds["claude"]),
-    ("_lib_pricing", "CODEX_TIERED_THRESHOLD",
-     lambda s: s.tier_thresholds["codex"]),
-    ("_lib_pricing", "CODEX_LEGACY_FALLBACK_MODEL", lambda s: s.fallback_model),
-    ("_lib_pricing", "CACHE_WRITE_1H_MULTIPLIER",
-     lambda s: s.cache_write_1h_multiplier),
-    ("_lib_pricing", "CLAUDE_FAST_MULTIPLIER_OVERRIDES",
-     lambda s: s.fast_multipliers["claude"]),
-    ("_lib_pricing", "CODEX_FAST_MULTIPLIER_OVERRIDES",
-     lambda s: s.fast_multipliers["codex"]),
-    ("_lib_pricing", "CODEX_FAST_MULTIPLIER_FALLBACK",
-     lambda s: s.fast_multipliers["codex_fallback"]),
-    ("cctally", "PRICING_SNAPSHOT_DATE", lambda s: s.snapshot_date),
-    ("cctally", "CLAUDE_MODEL_PRICING", lambda s: s.claude_pricing),
-    ("cctally", "CODEX_MODEL_PRICING", lambda s: s.codex_pricing),
-    ("cctally", "TIERED_THRESHOLD", lambda s: s.tier_thresholds["claude"]),
-    ("cctally", "CODEX_TIERED_THRESHOLD",
-     lambda s: s.tier_thresholds["codex"]),
-    ("cctally", "CODEX_LEGACY_FALLBACK_MODEL", lambda s: s.fallback_model),
-    ("cctally", "CACHE_WRITE_1H_MULTIPLIER",
-     lambda s: s.cache_write_1h_multiplier),
-    ("cctally", "CLAUDE_FAST_MULTIPLIER_OVERRIDES",
-     lambda s: s.fast_multipliers["claude"]),
-    ("cctally", "CODEX_FAST_MULTIPLIER_OVERRIDES",
-     lambda s: s.fast_multipliers["codex"]),
-    ("cctally", "CODEX_FAST_MULTIPLIER_FALLBACK",
-     lambda s: s.fast_multipliers["codex_fallback"]),
-    # `_cctally_cache` binds the date as a module global on purpose, so a test
-    # can monkeypatch it; that affordance is preserved and the binding is
-    # simply refreshed here too.
-    ("_cctally_cache", "PRICING_SNAPSHOT_DATE", lambda s: s.snapshot_date),
-    # `_lib_cache_report` unpacks the multiplier and the Claude tier threshold
-    # at import. The threshold used to be a literal `200_000` in that file with
-    # nothing keeping it equal to `TIERED_THRESHOLD` here, which made it a
-    # pricing value no reload could replace; it is read from this module now
-    # and refreshed through this entry.
-    ("_lib_cache_report", "CACHE_WRITE_1H_MULTIPLIER",
-     lambda s: s.cache_write_1h_multiplier),
-    ("_lib_cache_report", "DEFAULT_TIERED_THRESHOLD",
-     lambda s: s.tier_thresholds["claude"]),
-)
-
-#: The names `read_pricing_snapshot_from_source` requires, each mapped to the
-#: `PricingSnapshot` field it fills. A missing OR non-literal name rejects the
-#: whole candidate.
-_CANDIDATE_ASSIGNMENTS = (
-    "PRICING_SNAPSHOT_DATE",
-    "CLAUDE_MODEL_PRICING",
-    "CODEX_MODEL_PRICING",
-    "CODEX_MODEL_ALIASES",
-    "TIERED_THRESHOLD",
-    "CODEX_TIERED_THRESHOLD",
-    "CODEX_LEGACY_FALLBACK_MODEL",
-    "CACHE_WRITE_1H_MULTIPLIER",
-    "CLAUDE_FAST_MULTIPLIER_OVERRIDES",
-    "CODEX_FAST_MULTIPLIER_OVERRIDES",
-    "CODEX_FAST_MULTIPLIER_FALLBACK",
-)
-
-_PRICING_PUBLISH_LOCK = _threading.Lock()
-_PRICING_CONTEXT = _contextvars.ContextVar("cctally_pricing_snapshot",
-                                           default=None)
-
-
 def _snapshot_from_module_globals() -> PricingSnapshot:
     return PricingSnapshot(
         snapshot_date=PRICING_SNAPSHOT_DATE,
@@ -1619,161 +1523,6 @@ _LIVE_PRICING_SNAPSHOT = _snapshot_from_module_globals()
 
 
 def current_pricing_snapshot() -> PricingSnapshot:
-    """The snapshot this caller must price from.
-
-    A caller inside `pricing_snapshot_context()` keeps the revision it entered
-    with, so a request, a dashboard snapshot build or a sync pass already
-    under way is never assembled from two revisions. Everyone else reads the
-    live pointer, which is one immutable object replaced by one assignment.
-    """
-    captured = _PRICING_CONTEXT.get()
-    return _LIVE_PRICING_SNAPSHOT if captured is None else captured
-
-
-@_contextlib.contextmanager
-def pricing_snapshot_context(snapshot: "PricingSnapshot | None" = None):
-    """Pin one revision for the duration of a request, build or sync pass."""
-    pinned = current_pricing_snapshot() if snapshot is None else snapshot
-    token = _PRICING_CONTEXT.set(pinned)
-    try:
-        yield pinned
-    finally:
-        _PRICING_CONTEXT.reset(token)
-
-
-def publish_pricing_snapshot(snapshot: PricingSnapshot) -> None:
-    """Swap the live pointer and refresh every import-time copy.
-
-    The pointer swap is one assignment of one frozen object, so a concurrent
-    reader observes the old revision whole or the new one whole. The binding
-    refresh that follows exists for call sites that still read a copied name;
-    every cost kernel in this module reads `current_pricing_snapshot()`
-    instead, so correctness does not depend on the refresh reaching a module
-    that has not been imported.
-    """
-    global _LIVE_PRICING_SNAPSHOT
-    with _PRICING_PUBLISH_LOCK:
-        _LIVE_PRICING_SNAPSHOT = snapshot
-        for module_name, attr, accessor in PRICING_EXPORT_BINDINGS:
-            module = _sys.modules.get(module_name)
-            if module is None:
-                continue
-            try:
-                setattr(module, attr, accessor(snapshot))
-            except Exception:  # noqa: BLE001
-                # A module that refuses an attribute set must not stop the
-                # rest of the inventory being refreshed.
-                _eprint(f"[pricing] could not refresh {module_name}.{attr}")
-
-
-def adopt_pricing_candidate(candidate: PricingSnapshot, *,
-                            force: bool = False) -> bool:
-    """Publish `candidate` iff it is strictly newer than the live snapshot.
-
-    `_lib_pricing` documents that a pricing revision always ADVANCES
-    `PRICING_SNAPSHOT_DATE`, so a candidate that does not is a rollback, a
-    corrupt read or the same revision read twice; each of those is a reason to
-    keep what is running. `force` exists for tests restoring a captured
-    snapshot and for nothing else.
-    """
-    if force:
-        publish_pricing_snapshot(candidate)
-        return True
-    live = _LIVE_PRICING_SNAPSHOT
-    new_date = parse_pricing_fingerprint(candidate.snapshot_date)
-    live_date = parse_pricing_fingerprint(live.snapshot_date)
-    if new_date is None:
-        return False
-    if live_date is not None and new_date <= live_date:
-        return False
-    publish_pricing_snapshot(candidate)
-    return True
-
-
-def _file_signature(path) -> tuple:
-    st = path.stat()
-    return (st.st_dev, st.st_ino, st.st_size, st.st_mtime_ns)
-
-
-def read_pricing_snapshot_from_source(path) -> PricingSnapshot:
-    """Build a candidate from the literal assignments in a pricing file.
-
-    `ast.parse` plus `ast.literal_eval`, never `importlib.reload` and never
-    `exec`: the file is one an installer has just written and this process
-    must not run it.
-
-    Raises `PricingCandidateRejected` — never returns a partial snapshot — on
-    a missing name, a name whose value is not a literal, a date that does not
-    parse, or a file whose inode/size/mtime signature changes while it is
-    being read, which is an installer replacing it mid-parse.
-    """
-    import ast
-    import pathlib as _pathlib
-
-    path = _pathlib.Path(path)
-    try:
-        before = _file_signature(path)
-        source = path.read_bytes()
-        after = _file_signature(path)
-    except OSError as exc:
-        raise PricingCandidateRejected(
-            f"pricing candidate could not be read: {exc}") from exc
-    if before != after:
-        raise PricingCandidateRejected(
-            "pricing candidate signature changed while it was being read")
-
-    try:
-        tree = ast.parse(source.decode("utf-8"), filename=str(path))
-    except (SyntaxError, UnicodeDecodeError) as exc:
-        raise PricingCandidateRejected(
-            f"pricing candidate does not parse: {exc}") from exc
-
-    found: "dict[str, Any]" = {}
-    for node in tree.body:
-        targets = []
-        if isinstance(node, ast.Assign):
-            targets = [t for t in node.targets if isinstance(t, ast.Name)]
-            value = node.value
-        elif isinstance(node, ast.AnnAssign) and isinstance(node.target,
-                                                            ast.Name):
-            targets = [node.target]
-            value = node.value
-        else:
-            continue
-        for target in targets:
-            if target.id not in _CANDIDATE_ASSIGNMENTS or value is None:
-                continue
-            try:
-                found[target.id] = ast.literal_eval(value)
-            except (ValueError, SyntaxError, TypeError) as exc:
-                raise PricingCandidateRejected(
-                    f"{target.id} is no longer a literal, so the in-process "
-                    f"pricing reload cannot read it: {exc}") from exc
-
-    missing = [name for name in _CANDIDATE_ASSIGNMENTS if name not in found]
-    if missing:
-        raise PricingCandidateRejected(
-            "pricing candidate is incomplete; adopting a partial revision "
-            "would clear the write refusal and price from the old tables. "
-            f"Missing: {', '.join(missing)}")
-
-    if parse_pricing_fingerprint(found["PRICING_SNAPSHOT_DATE"]) is None:
-        raise PricingCandidateRejected(
-            "pricing candidate has no orderable PRICING_SNAPSHOT_DATE: "
-            f"{found['PRICING_SNAPSHOT_DATE']!r}")
-
-    return PricingSnapshot(
-        snapshot_date=found["PRICING_SNAPSHOT_DATE"],
-        claude_pricing=found["CLAUDE_MODEL_PRICING"],
-        codex_pricing=found["CODEX_MODEL_PRICING"],
-        aliases=found["CODEX_MODEL_ALIASES"],
-        tier_thresholds={"claude": found["TIERED_THRESHOLD"],
-                         "codex": found["CODEX_TIERED_THRESHOLD"]},
-        fallback_model=found["CODEX_LEGACY_FALLBACK_MODEL"],
-        cache_write_1h_multiplier=found["CACHE_WRITE_1H_MULTIPLIER"],
-        fast_multipliers={
-            "claude": found["CLAUDE_FAST_MULTIPLIER_OVERRIDES"],
-            "codex": found["CODEX_FAST_MULTIPLIER_OVERRIDES"],
-            "codex_fallback": found["CODEX_FAST_MULTIPLIER_FALLBACK"],
-        },
-    )
+    """The snapshot every cost kernel prices from; it never changes after
+    import."""
+    return _LIVE_PRICING_SNAPSHOT

package/bin/cctally

@@ -351,6 +351,7 @@ UPDATE_LOCK_PATH = _cctally_core.UPDATE_LOCK_PATH
 UPDATE_LOG_PATH = _cctally_core.UPDATE_LOG_PATH
 UPDATE_LOG_ROTATED_PATH = _cctally_core.UPDATE_LOG_ROTATED_PATH
 UPDATE_CHECK_LAST_FETCH_PATH = _cctally_core.UPDATE_CHECK_LAST_FETCH_PATH
+INSTALL_SUCCESS_RECORD_PATH = _cctally_core.INSTALL_SUCCESS_RECORD_PATH
 
 CLAUDE_SETTINGS_PATH = _cctally_core.CLAUDE_SETTINGS_PATH
 
@@ -1356,6 +1357,10 @@ _persist_npm_prefix_to_state = _cctally_update._persist_npm_prefix_to_state
 _detect_install_method = _cctally_update._detect_install_method
 _persist_install_method_to_state = _cctally_update._persist_install_method_to_state
 _stamp_install_success_to_state = _cctally_update._stamp_install_success_to_state
+InstallSuccessRecord = _cctally_update.InstallSuccessRecord
+_write_install_success_record = _cctally_update._write_install_success_record
+_read_install_success_record = _cctally_update._read_install_success_record
+_update_lock_is_held = _cctally_update._update_lock_is_held
 _self_heal_current_version = _cctally_update._self_heal_current_version
 _BREW_VERSION_RE_LIST = _cctally_update._BREW_VERSION_RE_LIST
 _update_user_agent = _cctally_update._update_user_agent
@@ -1388,8 +1393,17 @@ _preflight_install = _cctally_update._preflight_install
 _build_update_steps = _cctally_update._build_update_steps
 _run_streaming = _cctally_update._run_streaming
 _do_update_install = _cctally_update._do_update_install
+_install_root_for_entrypoint = _cctally_update._install_root_for_entrypoint
+_read_changelog_version_at = _cctally_update._read_changelog_version_at
+_install_layout = _cctally_update._install_layout
 _resolve_execvp_target = _cctally_update._resolve_execvp_target
+_execvp_target_problem = _cctally_update._execvp_target_problem
+AutomaticRestartInProgress = _cctally_update.AutomaticRestartInProgress
 UpdateWorker = _cctally_update.UpdateWorker
+InstallBootState = _cctally_update.InstallBootState
+capture_install_boot_state = _cctally_update.capture_install_boot_state
+RestartCandidate = _cctally_update.RestartCandidate
+InstallWatch = _cctally_update.InstallWatch
 _DashboardUpdateCheckThread = _cctally_update._DashboardUpdateCheckThread
 cmd_update = _cctally_update.cmd_update
 _args_emit_json = _cctally_update._args_emit_json
@@ -2661,14 +2675,13 @@ def _warn_budget_bad_config_once(exc: Exception) -> None:
 # server boot in cmd_dashboard. The moved _resolve_execvp_target
 # uses them to return (entrypoint, exec_argv) for os.execvp:
 #
-#   - npm: entrypoint = <prefix>/bin/cctally → Node shim, which
-#     re-resolves CCTALLY_PYTHON before re-spawning Python (so a
-#     custom interpreter setting survives the restart).
+#   - npm: the interpreter the Node shim would use (CCTALLY_PYTHON,
+#     else python3 on PATH) on the install's bin/cctally, so a restart
+#     adds no Node process (#868).
 #   - brew: entrypoint = <brew>/bin/cctally → symlink into the
 #     post-upgrade Python script with its rewritten shebang.
 #   - Fallback when shutil.which("cctally") returned None: use
-#     sys.argv[0] directly. Loses the npm shim layer; we accept the
-#     degraded edge case rather than guess.
+#     sys.argv[0] directly.
 ORIGINAL_SYS_ARGV: list[str] = []
 ORIGINAL_ENTRYPOINT: "str | None" = None
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cctally",
-  "version": "1.110.0",
+  "version": "1.111.0",
   "description": "Claude Code usage tracker and local dashboard for Pro/Max subscription limits - weekly cost-per-percent trend, quota forecasts, threshold alerts. ccusage-compatible.",
   "homepage": "https://github.com/omrikais/cctally",
   "repository": {