cctally 1.110.0 → 1.112.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.112.0] - 2026-09-29
+
+### Added
+- Claude cost reports price `claude-sonnet-5-5` at its published input, output and cache rates instead of showing $0 for new usage.
+
+### Changed
+- `cctally dashboard` uses less CPU while idle on a large history.
+
+### Fixed
+- The Conversation Viewer keeps project-filtered browse working with any number of unreadable Codex project paths, avoids repeated metadata schema probes, and preserves SQLite alias ordering.
+- The TUI and dashboard clear a Codex metadata retry as soon as its transient partial generation is rejected, so the first healthy refresh recovers immediately instead of waiting through a stale retry delay.
+- `cctally db rederive` corrects costs recorded while a model had no rate card, including provably unpriced $0 five-hour blocks. A Codex budget alert that fallback pricing overstated is retired and can fire again when real spend crosses.
+- After `cctally db rederive --yes`, a still-crossed Claude budget, projected or project-budget alert no longer breaks every later stats ingest until the period ends, and fired five-hour alerts stay in Recent Alerts.
+- On phones, the dashboard's `Current Usage` dialog shows its full title and hides the onboarding hint while the dialog is open.
+- An idle `cctally dashboard` no longer rebuilds its Codex view on every refresh after a Codex weekly reset with no newer Codex activity, which cost steady CPU while nothing changed.
+- `cctally db rederive` no longer reprices the unchanged five-hour milestones of a closed block whose cost is frozen when a rate card changes: each keeps its recorded cumulative cost; its marginal changes only to follow the prior milestone.
+
+## [1.111.0] - 2026-09-24
+
+### Fixed
+- After `cctally update` or a Homebrew upgrade installs a newer version, a running `dashboard` restarts itself so new prices and code apply. Restart it yourself once after installing this release, and after any manual `npm install -g`.
+- A `dashboard` restart after an update no longer leaves an extra Node process running on npm installs.
+
 ## [1.110.0] - 2026-09-22
 
 ### Added

package/README.md

@@ -30,15 +30,14 @@ Your Claude Code plan meters you with a percentage that creeps up all week. ccta
 </p>
 
 <!-- cctally:latest-stable:begin -->
-**Latest stable: v1.109.0** (2026-09-15)
+**Latest stable: v1.111.0** (2026-09-24)
 
-Highlights from the `v1.104.0` to `v1.109.0` stable upgrade:
+Highlights from the `v1.109.0` to `v1.111.0` stable upgrade:
 
-- The dashboard picks up a new pricing revision without a restart. It re-reads the deployed pricing file every 60 seconds, adopts a complete newer revision, and keeps serving; no connected client is dropped.
-- The conversation filter popover says `Projects appear once indexing finishes.` in place of `No projects.` while the transcript index is being rebuilt. Model counts stay live on the Claude tab.
-- The dashboard's Projects panel gives every billing cycle of a credited week its own percentage. Both cycles shared one calendar date, and only the later reading survived, so the second cycle could never carry one.
+- After `cctally update` or a Homebrew upgrade installs a newer version, a running `dashboard` restarts itself so new prices and code apply. Restart it yourself once after installing this release, and after any manual `npm install -g`.
+- A `dashboard` restart after an update no longer leaves an extra Node process running on npm installs.
 
-[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.109.0)
+[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.111.0)
 <!-- cctally:latest-stable:end -->
 
 ## Quick start

package/bin/_cctally_cache.py

@@ -9478,6 +9478,7 @@ def _sum_codex_cost_for_range(
     speed: str = "auto",
     skip_sync: bool = False,
     account_key: "str | None" = None,
+    pricing_provenance: "dict | None" = None,
 ) -> float:
     """Sum USD Codex cost of all `codex_session_entries` in ``[start, end)``.
 
@@ -9511,17 +9512,23 @@ def _sum_codex_cost_for_range(
     """
     c = _cctally()
     eff_speed = c._resolve_codex_speed(speed)
+    entries = c.get_codex_entries(
+        start, end, skip_sync=skip_sync, account_key=account_key,
+    )
+    if pricing_provenance is not None:
+        import _lib_cost_provenance
+        total, evidence = _lib_cost_provenance.codex_cost_with_provenance(
+            entries, end=end, speed=eff_speed,
+        )
+        pricing_provenance.update(evidence)
+        return total
     total = 0.0
-    for entry in c.get_codex_entries(start, end, skip_sync=skip_sync,
-                                     account_key=account_key):
+    for entry in entries:
         if entry.timestamp >= end:
             continue
         total += c._calculate_codex_entry_cost(
-            entry.model,
-            entry.input_tokens,
-            entry.cached_input_tokens,
-            entry.output_tokens,
-            entry.reasoning_output_tokens,
+            entry.model, entry.input_tokens, entry.cached_input_tokens,
+            entry.output_tokens, entry.reasoning_output_tokens,
             speed=eff_speed,
         )
     return total

package/bin/_cctally_core.py

@@ -80,6 +80,7 @@ def _init_paths_from_env() -> None:
     global UPDATE_STATE_PATH, UPDATE_SUPPRESS_PATH
     global UPDATE_LOCK_PATH, UPDATE_LOG_PATH, UPDATE_LOG_ROTATED_PATH
     global UPDATE_CHECK_LAST_FETCH_PATH, CLAUDE_SETTINGS_PATH
+    global INSTALL_SUCCESS_RECORD_PATH
     global CLAUDE_PROJECTS_DIR, CLAUDE_JSON_PATH
     global TELEMETRY_INSTALL_ID_PATH, TELEMETRY_LAST_BEAT_PATH
     global TELEMETRY_NOTICE_SHOWN_PATH, TELEMETRY_FIRST_SEEN_PATH
@@ -195,6 +196,8 @@ def _init_paths_from_env() -> None:
     UPDATE_LOG_PATH = APP_DIR / "update.log"
     UPDATE_LOG_ROTATED_PATH = APP_DIR / "update.log.1"
     UPDATE_CHECK_LAST_FETCH_PATH = APP_DIR / "update-check.last-fetch"
+    # Written only by the install paths (#868), never by an update check.
+    INSTALL_SUCCESS_RECORD_PATH = APP_DIR / "install-success.json"
 
     # Anonymous install-count telemetry markers (see spec 2026-07-07).
     # All four derive from APP_DIR and are re-bound here so a redirected
@@ -465,7 +468,12 @@ _init_paths_from_env()
 # a migration is unchanged: the registry is frozen at 13, and an epoch-current
 # open returns before any schema work, so a handler or an
 # `add_column_if_missing` would never run on an upgraded install.
-STATS_INDEX_EPOCH = 1015
+# 1015 -> 1016 (#869): an open five-hour block records the pricing evidence
+# used to compute its current cost. Closing a different block on a successor
+# tick must carry that earlier evidence into the journal, even after this
+# binary learns a new model card. A pre-existing open projection that was
+# rebuilt without the marker remains unproven until a new tick recomputes it.
+STATS_INDEX_EPOCH = 1016
 LEGACY_STATS_HEAD = 13
 
 #: #496 S1 F1. A NEW branch, for a state that cannot occur before the
@@ -2503,6 +2511,7 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
                 total_cache_create_tokens     INTEGER NOT NULL DEFAULT 0,
                 total_cache_read_tokens       INTEGER NOT NULL DEFAULT 0,
                 total_cost_usd                REAL    NOT NULL DEFAULT 0,
+                pricing_provenance_json       TEXT,
                 is_closed                     INTEGER NOT NULL DEFAULT 0,
                 created_at_utc                TEXT    NOT NULL,
                 last_updated_at_utc           TEXT    NOT NULL,
@@ -2514,6 +2523,8 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         add_column_if_missing(
             conn, "five_hour_blocks", "account_key",
             "TEXT NOT NULL DEFAULT 'unattributed'")
+        add_column_if_missing(
+            conn, "five_hour_blocks", "pricing_provenance_json", "TEXT")
         conn.execute(
             """
             CREATE INDEX IF NOT EXISTS idx_five_hour_blocks_block_start

package/bin/_cctally_dashboard.py

@@ -712,10 +712,6 @@ from _lib_aggregators import (
     _finalize_bucket,
 )
 from _lib_fmt import stable_sum
-# The MODULE, not just the names: #714's `pricing_snapshot_context` has to be
-# reached through the live module object so a test that swaps the snapshot is
-# seen by the request, build and sync entries below.
-import _lib_pricing
 from _lib_pricing import (_calculate_entry_cost, _chip_for_model,
                           _short_model_name, claude_usage_dict)
 from _lib_five_hour import _canonical_5h_window_key, _round_to_ten_minutes
@@ -2272,13 +2268,6 @@ def _make_dashboard_run_iteration(
 
     def run_iteration(batch=None) -> dict:
         warnings: list = []
-        # #714: the whole snapshot build runs on ONE pricing revision. A swap
-        # landing part-way through would publish a snapshot whose panels were
-        # priced from two different tables.
-        with _lib_pricing.pricing_snapshot_context():
-            return _run_iteration_body(batch, warnings)
-
-    def _run_iteration_body(batch, warnings: list) -> dict:
         if batch is not None and batch[1] and not skip_sync:
             with sync_lock:
                 result = _refresh_usage_inproc()
@@ -2556,103 +2545,38 @@ def _wake_schema_writer() -> None:
             _SCHEMA_WAKE_THREAD = None
 
 
-#: How often the pricing watch stats the deployed pricing file. A monotonic
-#: cadence, because a wall-clock one would re-poll or stall across a system
-#: clock change.
-_PRICING_WATCH_INTERVAL_S = 60.0
-
-
-class _PricingWatch:
-    """Detect a replaced `_lib_pricing.py` and adopt it in process (#714).
+_INSTALL_WATCH = None
 
-    An installer overwrites the deployed file under a running dashboard.
-    Nothing about that reaches this process: every CLI invocation re-imports
-    and picks the new tables up, and only a long-lived process holds the old
-    ones.
 
-    STAT FIRST, PARSE SECOND. The poll compares an inode/size/mtime signature
-    and parses only when it changed, so the steady state is one `stat` a
-    minute rather than an `ast.parse` of a 1,400-line file.
+def _start_install_watch(boot):
+    """Own the install watch on its own lifecycle thread, in every mode (#868).
 
-    NEVER RAISES OUT OF `poll_once`. The file it reads is one an installer may
-    be part-way through writing, so a half-written file is the ordinary case
-    rather than an exceptional one; a raising poll would end the thread and
-    leave the process permanently stale, which is the very condition this
-    exists to clear.
+    Not started from a git checkout, where file changes are development work,
+    not installs.
     """
-
-    def __init__(self, source_path=None, interval_s=None):
-        self.source_path = pathlib.Path(
-            source_path if source_path is not None
-            else sys.modules["_lib_pricing"].__file__)
-        self.interval_s = (_PRICING_WATCH_INTERVAL_S if interval_s is None
-                           else interval_s)
-        self._signature = None
-        self._stop = threading.Event()
-
-    def _current_signature(self):
-        try:
-            st = self.source_path.stat()
-        except OSError:
-            return None
-        return (st.st_dev, st.st_ino, st.st_size, st.st_mtime_ns)
-
-    def poll_once(self) -> bool:
-        """One check. Returns True iff a new snapshot was adopted."""
-        try:
-            signature = self._current_signature()
-            if signature is None or signature == self._signature:
-                return False
-            self._signature = signature
-            pricing = sys.modules["_lib_pricing"]
-            candidate = pricing.read_pricing_snapshot_from_source(
-                self.source_path)
-            if not pricing.adopt_pricing_candidate(candidate):
-                return False
-            eprint("[pricing] adopted pricing revision "
-                   f"{candidate.snapshot_date} without restarting")
-            return True
-        except Exception:  # noqa: BLE001
-            # Including `PricingCandidateRejected`: a rejected candidate is a
-            # normal outcome, and the signature is already recorded so the
-            # same bad file is not re-parsed every minute.
-            return False
-
-    def run(self) -> None:
-        while not self._stop.wait(self.interval_s):
-            self.poll_once()
-
-    def stop(self) -> None:
-        self._stop.set()
-
-
-_PRICING_WATCH: "_PricingWatch | None" = None
-
-
-def _start_pricing_watch() -> "_PricingWatch | None":
-    """Own the pricing detector on a lifecycle thread that runs in BOTH modes.
-
-    Deliberately not `_DashboardSyncThread` and not the conversation sync
-    thread: `cmd_dashboard` disables both under `--no-sync`, so a detector in
-    either would silently have no owner exactly where a long-lived process is
-    most likely to run.
-    """
-    global _PRICING_WATCH
-    if _PRICING_WATCH is not None:
-        return _PRICING_WATCH
+    global _INSTALL_WATCH
+    if _cctally_core._is_dev_checkout():
+        return None
+    if _INSTALL_WATCH is not None:
+        return _INSTALL_WATCH
     try:
-        watch = _PricingWatch()
-        watch.poll_once()  # establish the baseline signature; adopts nothing
-        thread = threading.Thread(
-            target=watch.run, name="cctally-pricing-watch", daemon=True)
-        thread.start()
+        watch = InstallWatch(
+            boot, worker_fn=lambda: getattr(_cctally(), "_UPDATE_WORKER", None))
+        watch.start()
     except Exception as exc:  # noqa: BLE001
-        eprint(f"[pricing] watch not started ({exc})")
+        eprint(f"[update] install watch not started ({exc})")
         return None
-    _PRICING_WATCH = watch
+    _INSTALL_WATCH = watch
     return watch
 
 
+def _stop_install_watch() -> None:
+    global _INSTALL_WATCH
+    watch, _INSTALL_WATCH = _INSTALL_WATCH, None
+    if watch is not None:
+        watch.stop()
+
+
 def _dashboard_maybe_prune_retention() -> None:
     """#313 P3 (F7): throttled transcript retention prune driven from the
     independent conversation sync thread. Opens a dedicated transcript
@@ -2812,18 +2736,7 @@ def _conversation_sync_pass() -> str:
     therefore NO SECOND OPEN ATTEMPT AFTER A FAILED OPEN — stated that narrowly
     because a successful pass opens the store twice by design, once here and
     once inside the prune.
-
-    #714: the whole pass runs on ONE pricing revision. This pass writes
-    materialized cost, so a swap landing between the Claude leg and the Codex
-    leg would derive one store's rollup from two revisions — the ordered-write
-    guard would not even see it, because both halves are the same process.
     """
-    with _lib_pricing.pricing_snapshot_context():
-        return _conversation_sync_pass_body()
-
-
-def _conversation_sync_pass_body() -> str:
-    """The body of `_conversation_sync_pass`, run under its pricing context."""
     try:
         conn = open_conversations_db()
     except (OSError, sqlite3.DatabaseError) as exc:
@@ -3375,6 +3288,14 @@ def _DashboardUpdateCheckThread(*args, **kwargs):
     return sys.modules["cctally"]._DashboardUpdateCheckThread(*args, **kwargs)
 
 
+def capture_install_boot_state(*args, **kwargs):
+    return sys.modules["cctally"].capture_install_boot_state(*args, **kwargs)
+
+
+def InstallWatch(*args, **kwargs):
+    return sys.modules["cctally"].InstallWatch(*args, **kwargs)
+
+
 # Module-level __getattr__ — lazy-resolves a handful of cctally globals at
 # attribute-access time (used for the ``except cctally.SomeError`` sites
 # that need real class identity, and for non-callable constants that the
@@ -8610,19 +8531,6 @@ _GET_ROUTES = (
      ("scope", "endpoint.conversation_detail"), True),
 )
 
-#: Handlers that block for the life of a client connection rather than for one
-#: response. `_dispatch` must NOT pin a pricing revision around these: the pin
-#: would last as long as the stream, so a viewer who left a tab open would keep
-#: pricing from whichever revision was live when the tab connected — the exact
-#: staleness #714 removes. Both are streams that carry no cost of their own;
-#: the envelopes they forward are priced by the build that produced them, which
-#: has its own context.
-_STREAMING_ROUTE_HANDLERS = frozenset({
-    "_serve_api_events",
-    "_handle_get_update_stream",
-    "_handle_get_conversation_events",
-})
-
 _POST_ROUTES = (
     ("exact", "/api/auth", "_handle_post_auth", None, False),
     ("exact", "/api/sync", "_handle_post_sync", None, False),
@@ -8758,13 +8666,6 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         eleven path-taking handlers. (NOTE: returning a bool, not ``fn()`` —
         the void handlers all return None, so a None-return contract could not
         tell "handled" from "unmatched".)
-
-        #714: every matched route runs inside a pricing-snapshot context, so a
-        response is never assembled from two pricing revisions when an
-        installer replaces `_lib_pricing.py` mid-request. The two long-lived
-        streaming routes are excluded — a context entered there would pin one
-        revision for the whole life of the stream, which is minutes to hours
-        and the opposite of what the reload exists to achieve.
         """
         path = self.path.split("?", 1)[0]
         for kind, pattern, name, perf, wants_path in table:
@@ -8778,19 +8679,14 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 continue
             fn = getattr(self, name)
             args = (path,) if wants_path else ()
-            if name in _STREAMING_ROUTE_HANDLERS:
-                pinned = contextlib.nullcontext()
-            else:
-                pinned = _lib_pricing.pricing_snapshot_context()
-            with pinned:
-                if perf is None:
+            if perf is None:
+                fn(*args)
+            elif perf[0] == "scope":
+                with self._perf_scope(perf[1]):
+                    fn(*args)
+            else:  # "phase"
+                with self._perf_gate().phase(perf[1]):
                     fn(*args)
-                elif perf[0] == "scope":
-                    with self._perf_scope(perf[1]):
-                        fn(*args)
-                else:  # "phase"
-                    with self._perf_gate().phase(perf[1]):
-                        fn(*args)
             return True
         return False
 
@@ -11731,7 +11627,9 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         as an explicit user pin; the worker resolves the selected channel
         afresh. CSRF-gated. Returns
         202 + ``{"run_id": ...}`` on accept; 409 + ``{"run_id_in_progress": ...}``
-        when another run is already in progress.
+        when another run is already in progress; 503 + ``{"error": ...}`` while
+        the install watcher holds the automatic-restart claim (#868), which
+        the unchanged client shows as a failed start.
         """
         if not self._check_origin_csrf():
             return
@@ -11753,7 +11651,11 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # The dashboard has no explicit-version input. Older clients sent the
         # cached beta target here; trusting it as a pin recreates #342 whenever
         # the registry advances while the modal is open.
-        accepted, run_id = worker.start(None)
+        try:
+            accepted, run_id = worker.start(None)
+        except sys.modules["cctally"].AutomaticRestartInProgress as exc:
+            self._respond_json(503, {"error": str(exc)})
+            return
         if accepted:
             self._respond_json(202, {"run_id": run_id})
         else:
@@ -12339,16 +12241,20 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     _cctally_core.enable_quota_projection_reconciliation()
 
     # Spec §5.7: capture the un-mutated argv + PATH-resolved entrypoint
-    # at boot so the in-place ``execvp`` after a successful update
-    # re-enters the user-facing wrapper (npm Node shim → CCTALLY_PYTHON
-    # honoured; brew symlink → post-upgrade Python script). Module-level
-    # globals live in cctally (declared at L23205 pre-extract); we write
-    # them via the module-proxy so ``UpdateWorker`` (in _cctally_update)
-    # reads the right values via ``cctally.X`` at call time.
+    # at boot. ``_resolve_execvp_target`` derives the in-place restart
+    # from them: an npm install execs Python directly on its own
+    # ``bin/cctally`` (no added Node process, #868), and a brew install
+    # re-enters the symlink into the newly linked keg. Module-level
+    # globals live in cctally; we write them via the module-proxy so
+    # ``UpdateWorker`` and the install watch (in _cctally_update) read the
+    # right values via ``cctally.X`` at call time.
     _c_boot = _cctally()
     _c_boot.ORIGINAL_SYS_ARGV = list(sys.argv)
     _c_boot.ORIGINAL_ENTRYPOINT = shutil.which("cctally")
     _c_boot._UPDATE_WORKER = UpdateWorker()
+    # #868: captured before any thread starts; the install watch compares every
+    # later poll against what this process booted from.
+    _install_boot = capture_install_boot_state()
 
     # Load config for the bind-host + expose-transcripts resolution below. (#217
     # S1 / U7b: dropped the dead ``args._resolved_tz = resolve_display_tz(...)``
@@ -12433,11 +12339,9 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     _cctally_cache_module.set_conversation_derivations_suppressed(
         bool(args.no_sync))
     _dashboard_startup_schema_migration(run_derivations=not bool(args.no_sync))
-    # #714: the pricing-file watch, in EVERY mode for the same reason. Both
-    # `_DashboardSyncThread` and `_make_conversation_sync_thread` are disabled
-    # under `--no-sync`, so a detector placed in either would have no owner in
-    # the one mode a long-lived read-only dashboard runs in.
-    _start_pricing_watch()
+    # #868: in EVERY mode, because `--no-sync` disables both sync threads and a
+    # long-lived read-only dashboard is still left behind by an install.
+    _start_install_watch(_install_boot)
     _heal = _dashboard_self_heal_orphans(skip_sync=bool(args.no_sync))
     if _heal is not None and _heal.pruned_files:
         print(f"dashboard: pruned {_heal.pruned_files} orphaned cache file(s) "
@@ -12703,6 +12607,8 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     try:
         _dashboard_wait_for_signal((_signal.SIGINT, _signal.SIGTERM))
     finally:
+        # First, so a shutdown can never be followed by an automatic restart.
+        _stop_install_watch()
         if sync_thread is not None:
             sync_thread.stop()
         conversation_sync_stop.set()

package/bin/_cctally_dashboard_envelope.py

@@ -56,8 +56,8 @@ from _cctally_core import (
 )
 from _lib_dashboard_sources import (
     SOURCE_SCHEMA_VERSION,
-    canonical_alerted_at as _canonical_alerted_at,
-    canonical_alerted_at_sql as _canonical_alerted_at_sql,
+    alerted_at_order_key as _alerted_at_order_key,
+    alerted_at_order_key_sql as _alerted_at_order_key_sql,
     dashboard_resource_key as _dashboard_resource_key,
 )
 from _lib_display_tz import _compute_display_block, format_display_dt
@@ -475,9 +475,10 @@ def _alert_account_resolver(conn: sqlite3.Connection):
 # and a row excluded there is unrecoverable. Two spellings of one instant
 # compare equal here; a nonzero offset — which the ``all-combined`` fixture
 # stores deliberately — orders by its true instant rather than by its
-# local-time text.
-_CANON_ALERTED_AT = _canonical_alerted_at_sql()
-_CANON_ALERTED_AT_M = _canonical_alerted_at_sql("m.alerted_at")
+# local-time text. #869 F14: the key carries the full sub-second instant, so a
+# Codex crossing fired later in the same second as a Claude alert sorts newer.
+_CANON_ALERTED_AT = _alerted_at_order_key_sql()
+_CANON_ALERTED_AT_M = _alerted_at_order_key_sql("m.alerted_at")
 
 
 def _envelope_rows_weekly(
@@ -1169,7 +1170,7 @@ def _build_alerts_envelope_array(
         # `_combined_alert_rows` does — otherwise the operator sees an empty
         # panel and a message that identifies nothing.
         try:
-            return _canonical_alerted_at(alert["alerted_at"])
+            return _alerted_at_order_key(alert["alerted_at"])
         except (KeyError, ValueError) as exc:
             identity = alert.get("key") or alert.get("id")
             raise ValueError(