cctally 1.110.0 → 1.112.0

package/bin/_cctally_dashboard_sources.py

@@ -55,15 +55,17 @@ from _lib_dashboard_sources import (
     SourceDashboardState,
     SourceDashboardWarning,
     assess_codex_projection_coherence,
+    alerted_at_order_key,
+    alerted_at_order_key_sql,
     build_metadata_health,
     canonical_alerted_at,
-    canonical_alerted_at_sql,
     claude_stats_digest,
     combined_accounting_version,
     codex_stats_digest,
     dashboard_resource_key,
 )
 from _lib_quota import (
+    FUTURE_CLOCK_SKEW_SECONDS,
     QuotaWindowIdentity,
     build_blocks,
     build_history,
@@ -627,26 +629,12 @@ def _codex_quota_reuse_identity(
                 "stats_identity must be the three-digest tuple or None")
     elif not isinstance(stats_conn, sqlite3.Connection):
         return None
-    try:
-        seq_row = cache_conn.execute(
-            "SELECT seq FROM sqlite_sequence "
-            "WHERE name='quota_window_change_log'"
-        ).fetchone()
-        table = cache_conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' "
-            "AND name='quota_window_change_log'"
-        ).fetchone()
-        revision_row = cache_conn.execute(
-            "SELECT value FROM cache_meta "
-            "WHERE key='codex_window_attribution_revision'"
-        ).fetchone()
-        db_path = next(
-            str(row[2]) for row in cache_conn.execute("PRAGMA database_list")
-            if str(row[1]) == "main"
-        )
-    except (sqlite3.Error, StopIteration):
-        return None
-    if table is None:
+    # #857: the cache.db legs are read through the snapshot-cache kernel, which
+    # states each leg's query once and shares it with the doctor's quota probe
+    # and the dashboard's quota-dependency identity.
+    db_path = _lib_snapshot_cache.codex_main_database_path(cache_conn)
+    legs = _lib_snapshot_cache.codex_quota_observation_legs(cache_conn)
+    if db_path is None or legs is None:
         return None
     if stats_identity is None:
         try:
@@ -660,12 +648,7 @@ def _codex_quota_reuse_identity(
             return None
         except sqlite3.Error:
             return None
-    return (
-        db_path,
-        0 if seq_row is None else int(seq_row[0]),
-        "" if revision_row is None else str(revision_row[0]),
-        *stats_identity,
-    )
+    return (db_path, *legs, *stats_identity)
 
 
 def _cached_codex_quota_observations(**kwargs) -> tuple[object, ...]:
@@ -1190,51 +1173,82 @@ def _codex_next_decision_at(
     crossing. That is one rebuild per deadline (a handful per weekly cycle), not
     one per tick.
 
-    The deadline is the ``min`` of three candidate kinds, dropping any candidate
-    at or before ``now_utc``:
-
-    1. every selected cycle's ``resets_at`` (expiry — including the
-       #341 multi-account case where account A expires while B stays live);
-    2. ``latest_physical_capture + stale_after_seconds(window)`` for every weekly
-       history with a live baseline (fresh -> stale). This is a deliberate
-       SUPERSET of the §3.2 ranking participants — it also covers histories whose
-       freshness is ``"future"``/``"unavailable"`` and so never enter the ranking
-       — because an extra candidate can only pull the deadline EARLIER, and an
-       earlier deadline is always the conservative direction;
-    3. the ``captured_at`` of any future-dated weekly observation
-       (future -> fresh / baseline eligibility).
+    The deadline is the ``min`` of every candidate below, dropping any
+    candidate at or before ``now_utc``. #857 made the set COMPLETE, because a
+    settled cycle-unavailable generation now idles until this instant: a
+    transition with no candidate is never picked up at all, and one whose
+    candidate fires early is lost too — the rebuild at the early instant drops
+    the candidate (it is no longer after ``now``) while the transition it stood
+    for is still ahead. Each candidate is therefore the FIRST instant its
+    transition is observable, under the resolver's own comparison:
+
+    1. every weekly baseline's ``canonical_resets_at`` — selected or not, since
+       an UNSELECTED boundary expiring is what resolves a ``conflicting``
+       account (the resolver drops ``resets_at <= now``, so the reset instant
+       itself is the first expired one). Every selected cycle's ``resets_at`` is
+       one of these; they stay listed explicitly for the #341 multi-account case
+       where account A expires while B stays live;
+    2. every weekly baseline's nominal start plus one microsecond: the resolver
+       rejects ``start >= now`` (#599), so a window captured ahead of its start
+       becomes eligible strictly after it, on frozen evidence;
+    3. for every weekly history with a baseline that has not reset: the
+       fresh -> stale flip of its latest physical capture, which
+       ``quota_freshness`` takes when the whole-second age EXCEEDS
+       ``stale_after_seconds`` — ``capture + stale_after + 1s``, not
+       ``capture + stale_after`` — and the future -> fresh flip, when the
+       truncated age stops being below ``-FUTURE_CLOCK_SKEW_SECONDS`` —
+       strictly after ``capture - (skew + 1)s``. This is a deliberate SUPERSET
+       of the §3.2 ranking participants, because an extra candidate can only
+       pull the deadline EARLIER and costs one rebuild at an instant where the
+       verdict could have changed;
+    4. the ``captured_at`` of any future-dated weekly observation (baseline
+       eligibility, ``captured_at <= now``). Recorded BEFORE the model-scoped
+       skip: the pool label is read from the baseline and ``limit_name`` is not
+       part of history identity, so a future capture can move a history out of
+       a model-scoped pool.
 
     Returns ``None`` when nothing can flip. Server-only: it rides ``clock_data``
     and never reaches the public source envelope.
     """
+    one_microsecond = dt.timedelta(microseconds=1)
     candidates: list[dt.datetime] = []
     for cycle in cycles:
         candidates.append(cycle.resets_at.astimezone(UTC))
     for history in build_history(tuple(observations)):
         if history.identity.window_minutes != 10_080:
             continue
+        # 4. A capture ahead of ``now`` is not baseline-eligible yet, so this
+        # runs even for a history with no live baseline at all.
+        for observation in (
+            *history.observations, *history.physical_observations,
+        ):
+            captured_at = observation.captured_at.astimezone(UTC)
+            if captured_at > now_utc:
+                candidates.append(captured_at)
         baseline = select_baseline(history.observations, now_utc)
         if codex_history_is_model_scoped(history, baseline=baseline):
             continue
+        if baseline is None:
+            continue
         # #428: the anchor, so the decision deadline describes the same window
         # the hero publishes rather than a jitter sibling up to 600s away.
-        if baseline is not None and baseline.canonical_resets_at > now_utc:
+        resets_at = baseline.canonical_resets_at.astimezone(UTC)
+        window = dt.timedelta(minutes=history.identity.window_minutes)
+        candidates.append(resets_at)                                # 1.
+        candidates.append(resets_at - window + one_microsecond)     # 2.
+        if resets_at > now_utc:                                     # 3.
             latest = latest_physical_observation(history.physical_observations)
             if latest is not None:
+                latest_at = latest.captured_at.astimezone(UTC)
+                candidates.append(latest_at + dt.timedelta(
+                    seconds=stale_after_seconds(
+                        history.identity.window_minutes) + 1,
+                ))
                 candidates.append(
-                    latest.captured_at.astimezone(UTC)
-                    + dt.timedelta(
-                        seconds=stale_after_seconds(history.identity.window_minutes),
-                    )
+                    latest_at
+                    - dt.timedelta(seconds=FUTURE_CLOCK_SKEW_SECONDS + 1)
+                    + one_microsecond
                 )
-        # A capture ahead of ``now`` is not baseline-eligible yet, so this runs
-        # even for a history with no live baseline at all.
-        for observation in (
-            *history.observations, *history.physical_observations,
-        ):
-            captured_at = observation.captured_at.astimezone(UTC)
-            if captured_at > now_utc:
-                candidates.append(captured_at)
     live = [candidate for candidate in candidates if candidate > now_utc]
     return min(live) if live else None
 
@@ -4447,7 +4461,8 @@ def _alerts_wire(
     # row that fired most recently but crossed longest ago was dropped at the
     # LIMIT and never reached the panel at all. `created_at` stays as an
     # equal-valued compatibility alias for a client reading a pre-v7 envelope.
-    canon = canonical_alerted_at_sql()
+    # #869 F14: the full instant, so a same-second pair keeps its newer row.
+    canon = alerted_at_order_key_sql()
 
     def _instants(raw: object) -> dict[str, str]:
         value = canonical_alerted_at(raw)
@@ -4506,7 +4521,7 @@ def _alerts_wire(
         return ()
     return tuple(sorted(
         rows,
-        key=lambda item: canonical_alerted_at(item["alerted_at"]),
+        key=lambda item: alerted_at_order_key(item["alerted_at"]),
         reverse=True,
     )[:SOURCE_HISTORY_LIMIT])
 
@@ -7441,6 +7456,13 @@ class _CodexAccountingCapture:
     #: safety came from the compare-and-swap rather than from the signature,
     #: and carrying the value makes the signature answer for itself.
     population_signature: tuple | None = None
+    #: #857: the accounting provenance token THIS capture's accounting result
+    #: returned — carried for the same reason as the signature above, because
+    #: overlay publication or a concurrent capture can move the module state
+    #: before the fold stamps it. ``None`` when the capture bypassed the
+    #: qualified accounting read: such a generation names no population, and
+    #: borrowing the process's current token would name one it never read.
+    provenance_token: int | None = None
 
 
 #: The detail routes' horizon: one year ending at the generation instant. The
@@ -7532,6 +7554,8 @@ def _capture_codex_accounting(
     changed_old: tuple[object, ...] = ()
     changed_new: tuple[object, ...] = ()
     population_signature: tuple | None = None
+    # #857: set only by a qualified read that returned; every bypass keeps it.
+    provenance_token: int | None = None
 
     def fallback_entries() -> tuple[object, ...]:
         nonlocal metadata_read_failed, failed_legs
@@ -7600,6 +7624,7 @@ def _capture_codex_accounting(
             changed_old = cached_accounting.changed_old
             changed_new = cached_accounting.changed_new
             population_signature = cached_accounting.population_signature
+            provenance_token = cached_accounting.provenance_token
             entries: tuple[object, ...] = qualified_entries
         except QualifiedMetadataUnavailable as exc:
             _lib_log.get_logger("dashboard").warning(
@@ -7644,6 +7669,8 @@ def _capture_codex_accounting(
         failed_legs=failed_legs,
         population_signature=(
             None if metadata_incomplete else population_signature),
+        provenance_token=(
+            None if metadata_incomplete else provenance_token),
     )
 
 
@@ -9253,6 +9280,14 @@ def _build_codex_source_state(
             "codex_next_decision_at": _codex_next_decision_at(
                 quota_observations, cycles_all, context.now_utc,
             ),
+            # #857: the accounting provenance token of the population THIS
+            # build's capture read (`None` when it bypassed the qualified
+            # read). A retained generation is admitted only while this equals
+            # the token of the population the process last consumed, so a
+            # build that consumed accounting and then failed to publish leaves
+            # every older generation refused, whatever the failure site.
+            _lib_snapshot_cache.CODEX_ACCOUNTING_PROVENANCE_KEY: (
+                accounting_capture.provenance_token),
         },
         private_session_labels=private_session_labels,
         # #819: the SAME reading that gated decoration above. Attaching it here

package/bin/_cctally_doctor.py

@@ -1032,31 +1032,17 @@ def _codex_quota_observation_signal() -> "tuple | None":
     except sqlite3.Error:
         return None
     try:
-        table = conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' "
-            "AND name='quota_window_change_log'"
-        ).fetchone()
-        if table is None:
-            return None
-        seq_row = conn.execute(
-            "SELECT seq FROM sqlite_sequence "
-            "WHERE name='quota_window_change_log'"
-        ).fetchone()
-        revision_row = conn.execute(
-            "SELECT value FROM cache_meta "
-            "WHERE key='codex_window_attribution_revision'"
-        ).fetchone()
-    except sqlite3.Error:
-        return None
+        # #857: the two ledger legs are stated once, in the snapshot-cache
+        # kernel, and shared with the dashboard's Codex quota-dependency
+        # identity rather than restated here.
+        legs = _cctally()._load_sibling(
+            "_lib_snapshot_cache"
+        ).codex_quota_observation_legs(conn)
     finally:
         conn.close()
-    return (
-        str(path),
-        stat.st_dev,
-        stat.st_ino,
-        0 if seq_row is None else int(seq_row[0]),
-        "" if revision_row is None else str(revision_row[0]),
-    )
+    if legs is None:
+        return None
+    return (str(path), stat.st_dev, stat.st_ino, *legs)
 
 
 def _load_codex_quota_observations_for_doctor(*, force_cold: bool = False):
@@ -1079,6 +1065,67 @@ def _load_codex_quota_observations_for_doctor(*, force_cold: bool = False):
     return loaded
 
 
+# The all-history project-metadata partition is the other large immutable input
+# in a warm dashboard Doctor gather.  On the production-shaped #857 copy it
+# cost 422-432 ms per call while returning the same six counts every 30-second
+# Doctor refresh.  Retain only that raw partition, never a Doctor verdict or a
+# clock-derived field, under the cache identity plus the existing physical
+# mutation sequence.  Codex ingest advances that sequence in the same
+# transaction as token, thread, root, cursor, and metadata writes, which are
+# exactly the three-table inputs of ``load_codex_project_metadata_health``.
+# Replacement is covered separately by device/inode, and an absent or malformed
+# signal always takes the cold path.  The path is the one the passed connection
+# opened, never the global ``CACHE_DB_PATH``: the sequence is read from that
+# connection, so the file identity must describe the same file (#857).
+_CODEX_PROJECT_METADATA_MEMO: "dict[tuple, object]" = {}
+
+
+def _codex_project_metadata_signal(
+    cache_conn: sqlite3.Connection,
+) -> "tuple | None":
+    try:
+        path = next(
+            str(row[2]) for row in cache_conn.execute("PRAGMA database_list")
+            if len(row) > 2 and str(row[1]) == "main" and row[2]
+        )
+        stat = os.stat(path)
+        row = cache_conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_physical_mutation_seq'"
+        ).fetchone()
+        if row is None:
+            return None
+        sequence = int(row[0])
+        if sequence < 0:
+            return None
+    except (OSError, StopIteration, sqlite3.Error, TypeError, ValueError):
+        return None
+    return (path, stat.st_dev, stat.st_ino, sequence)
+
+
+def _load_codex_project_metadata_health_for_doctor(
+    cache_conn: sqlite3.Connection,
+    *,
+    force_cold: bool = False,
+):
+    signal = (
+        None if force_cold
+        else _codex_project_metadata_signal(cache_conn)
+    )
+    if signal is not None:
+        cached = _CODEX_PROJECT_METADATA_MEMO.get(signal)
+        if cached is not None:
+            return cached
+    analytics = _cctally()._load_sibling("_cctally_source_analytics")
+    loaded = analytics.load_codex_project_metadata_health(
+        cache_conn=cache_conn,
+    )
+    if signal is not None:
+        _CODEX_PROJECT_METADATA_MEMO.clear()
+        _CODEX_PROJECT_METADATA_MEMO[signal] = loaded
+    return loaded
+
+
 _QUOTA_NO_CHANGE: dict = {
     "active": False, "assessed": True, "effective_from": None,
     "previous_units_per_point": None, "new_units_per_point": None,
@@ -1835,10 +1882,9 @@ def _doctor_gather_state_impl(
                     # connection.  A failed probe is health evidence, not an
                     # empty corpus: the kernel renders it as a distinct FAIL.
                     try:
-                        import _cctally_source_analytics
-
-                        health = _cctally_source_analytics.load_codex_project_metadata_health(
-                            cache_conn=conn,
+                        health = _load_codex_project_metadata_health_for_doctor(
+                            conn,
+                            force_cold=_force_cold_inputs,
                         )
                         codex_project_metadata_health = {
                             "total_rows": health.total_rows,

package/bin/_cctally_forecast.py

@@ -3173,7 +3173,8 @@ def cmd_budget(args: argparse.Namespace) -> int:
 
             def _codex_backstop_leg(ictx):
                 c.maybe_record_codex_budget_milestone(
-                    {}, conn=ictx.conn, alert_sink=ictx.pending_alerts)
+                    {}, conn=ictx.conn, alert_sink=ictx.pending_alerts,
+                    journal_ctx=ictx)
                 if projected_on:
                     c.maybe_record_projected_alert(
                         {}, only_metrics={"codex_budget_usd"},

package/bin/_cctally_journal.py

@@ -1409,12 +1409,19 @@ class IngestContext:
     # (reset INSERT OR IGNORE rowcount == 1), so a crash-replayed reset never
     # re-suppresses with a divergent list.
     suppression_map: dict = field(default_factory=dict)
+    # Indexed by (event kind, local row id) until harvest persists the marker.
+    pricing_provenance: dict = field(default_factory=dict)
     # Task B rederive seam. Normal ingest leaves both defaults unchanged.
     # A scratch planner supplies an in-memory sink so derived events are captured
     # instead of appended to the durable journal, and disables projection-file
     # writes while still exercising the same SQLite derivation/fold code.
     event_sink: "list | None" = None
     projection_writes: bool = True
+    # #869 `db rederive` scratch replay only. Its keys name the (account_key,
+    # window key) blocks the planner must prove; each value becomes the
+    # retained entries behind the totals that block last applied. Live ingest
+    # leaves it None and keeps no entries.
+    block_source_evidence: "dict | None" = None
     # Operator-reviewed scratch replay only. Normal ingest leaves this empty.
     held_weekly_observation_ids: frozenset[str] = field(default_factory=frozenset)
     reviewed_weekly_basis_by_account: dict = field(default_factory=dict)
@@ -4127,7 +4134,10 @@ def _apply_generic_evt(conn, evt):
         return None
     cols = {"journal_id": evt["id"]}
     for key, value in payload.items():
-        if key == "kind":
+        # `journal_identity_version` names how the event id was minted (#869
+        # alert-latch re-fire incarnations: bm2/pjm2/pbm2); it is journal
+        # metadata, never a column.
+        if key in ("kind", "_pricing", "journal_identity_version"):
             continue
         if key in spec.fk_refs:
             column, ref_table = spec.fk_refs[key]
@@ -4493,7 +4503,7 @@ def _apply_block_close(conn, evt):
     parent = {"journal_id": evt["id"]}
     children = {}
     for key, value in payload.items():
-        if key == "kind":
+        if key in ("kind", "_pricing"):
             continue
         if key in _BLOCK_CHILD_KEYS:
             children[key] = value or []
@@ -4552,7 +4562,7 @@ def _apply_reset_with_suppression(conn, evt):
         return None
     cols = {"journal_id": evt["id"]}
     for key, value in payload.items():
-        if key in ("kind", "suppression", "suppression_table"):
+        if key in ("kind", "suppression", "suppression_table", "_pricing"):
             continue
         if key in spec.fk_refs:
             column, ref_table = spec.fk_refs[key]
@@ -4834,6 +4844,59 @@ def _build_harvest_evt(ctx, spec, row):
             {k: cr[k] for k in cr.keys() if k not in ("id", "block_id")}
             for cr in child_rows
         ]
+    if spec.kind == "five_hour_block_close":
+        raw_pricing = row["pricing_provenance_json"]
+        if raw_pricing is not None:
+            try:
+                pricing = json.loads(raw_pricing)
+            except (TypeError, ValueError) as exc:
+                raise JournalError(
+                    "five_hour_block_close has malformed computation-time "
+                    "pricing provenance"
+                ) from exc
+            if (
+                not isinstance(pricing, dict)
+                or pricing.get("version") != 1
+                or not isinstance(pricing.get("pricingDate"), str)
+                or not pricing["pricingDate"]
+                or not isinstance(pricing.get("unpricedModels"), list)
+                or any(not isinstance(model, str) or not model
+                       for model in pricing["unpricedModels"])
+                or pricing["unpricedModels"] != sorted(set(
+                    pricing["unpricedModels"]
+                ))
+                or (
+                    "uncertainModels" in pricing
+                    and (
+                        not isinstance(pricing["uncertainModels"], list)
+                        or any(not isinstance(model, str) or not model
+                               for model in pricing["uncertainModels"])
+                        or pricing["uncertainModels"] != sorted(set(
+                            pricing["uncertainModels"]
+                        ))
+                    )
+                )
+            ):
+                raise JournalError(
+                    "five_hour_block_close has incomplete computation-time "
+                    "pricing provenance"
+                )
+            positive_models = {
+                child["model"] for child in payload.get("_models", [])
+                if sum(int(child.get(key) or 0) for key in (
+                    "input_tokens", "output_tokens", "cache_create_tokens",
+                    "cache_read_tokens",
+                )) > 0
+            }
+            if not (
+                set(pricing["unpricedModels"])
+                | set(pricing.get("uncertainModels") or [])
+            ) <= positive_models:
+                raise JournalError(
+                    "five_hour_block_close pricing provenance does not match "
+                    "its computed model population"
+                )
+            payload["_pricing"] = pricing
     # #750 S3 §1.1: ONE producer for the id parts and for the suppression-map
     # key. A family with an `id_parts_fn` (today only `week_reset_events`,
     # whose identity is dual-shaped) supplies both from that callable; every
@@ -4851,11 +4914,85 @@ def _build_harvest_evt(ctx, spec, row):
         supp = ctx.suppression_map.get(supp_key)
         if supp:
             payload["suppression"] = list(supp)
+    provenance = ctx.pricing_provenance.get((spec.kind, int(row["id"])))
+    if provenance is not None:
+        payload["_pricing"] = provenance
     eid = _lib_journal.evt_id(spec.id_prefix, *parts)
+    refire_prefix = _LATCH_REFIRE_ID_PREFIXES.get(spec.kind)
+    if (
+        refire_prefix is not None
+        and ctx.event_sink is None
+        and _latch_event_was_retired(conn, eid)
+    ):
+        # #869 F6/V1: a correction retired this natural key's earlier crossing
+        # with a higher-revision tombstone, so a revision-0 event under the
+        # same id can never become effective. A later crossing is a new
+        # incarnation: its id adds the crossing instant, while the table's
+        # natural key still deduplicates it. Every other crossing, and every
+        # already-journaled id, keeps the legacy spelling.
+        eid = _lib_journal.evt_id(
+            refire_prefix, *parts, row["crossed_at_utc"])
+        payload["journal_identity_version"] = 2
     at = row[spec.at_column] if spec.at_column else _now_iso()
     return _lib_journal.make_evt(kind=spec.kind, id=eid, at=at, payload=payload)
 
 
+#: #869 F6/V1. The id prefix, per alert-latch kind, of a crossing that re-fires
+#: after a correction tombstoned the natural key's earlier crossing (the legacy
+#: prefix + identity version 2). `db rederive` retires these latches, so each
+#: one needs a spelling a later live crossing can journal under.
+#:
+#: Coupling: the live writers (`_claude_latch_recreates_retired_crossing` in
+#: `_cctally_record`) stamp a recreated CLAUDE latch without notifying, on the
+#: premise that every Claude-latch tombstone is the claude-usage family's
+#: stale-config retirement, never a verdict that the crossing was false. A
+#: future rule that retires a Claude latch as a false crossing must record
+#: that distinction durably, or the genuine later crossing is silently
+#: suppressed.
+_LATCH_REFIRE_ID_PREFIXES = {
+    "budget": "bm2",
+    "projected": "pjm2",
+    "project_budget": "pbm2",
+}
+
+
+def _latch_event_was_retired(conn, legacy_event_id) -> bool:
+    """True iff the effective selection for this natural-key id is a tombstone.
+
+    Read from the live effective metadata the rebuild published, never
+    recomputed. A missing row or an active event keeps the legacy id.
+    """
+    prior = _metadata_row(conn, legacy_event_id)
+    return prior is not None and str(prior[1]) == "tombstone"
+
+
+def latch_crossing_was_retired(conn, kind, rowid) -> bool:
+    """True iff alert-latch row ``rowid`` re-creates a retired crossing (#869).
+
+    ``kind`` is a latch family with a re-fire incarnation (``budget``,
+    ``projected``, ``project_budget``). The row's legacy natural-key event id
+    is minted exactly as harvest mints it, and the answer is the live effective
+    metadata's: a tombstone means a completed correction batch retired an
+    earlier crossing of this natural key, so harvest will journal this row
+    under the kind's version-2 prefix. A live writer calls this in the same
+    transaction as its insert, before harvest runs, so both decisions read one
+    durable fact.
+    """
+    if kind not in _LATCH_REFIRE_ID_PREFIXES:
+        raise ValueError(f"{kind!r} has no re-fire incarnation")
+    [spec] = [item for item in _HARVEST_SPECS if item.kind == kind]
+    if spec.fk_refs or spec.id_parts_fn is not None:
+        raise ValueError(f"{kind!r} ids are not plain natural-key columns")
+    row = conn.execute(
+        f"SELECT {', '.join(spec.id_parts)} FROM {spec.table} WHERE id = ?",
+        (int(rowid),),
+    ).fetchone()
+    if row is None:
+        return False
+    return _latch_event_was_retired(
+        conn, _lib_journal.evt_id(spec.id_prefix, *tuple(row)))
+
+
 def _emit_harvest_row(ctx, spec, row):
     """Journal and stamp one already-selected natural-keyed row."""
     conn = ctx.conn
@@ -5334,7 +5471,10 @@ def _run_config_reconcile(ctx, reconcile_config) -> None:
         if fn is None:
             continue
         try:
-            fn(validated_budget, conn=ctx.conn)
+            if axis == "codex_budget":
+                fn(validated_budget, conn=ctx.conn, journal_ctx=ctx)
+            else:
+                fn(validated_budget, conn=ctx.conn)
         except Exception as exc:  # best-effort; never break the cycle over a reconcile
             print(f"[budget-reconcile] {name} failed: {exc}", file=sys.stderr)
     # Per-project reconcile takes `touched_projects` as its 2nd positional
@@ -6086,7 +6226,8 @@ def _effective_event_for_convergence(conn, event_id) -> dict:
 
 # Effect keys that ride an evt payload but are NOT target-table columns.
 _EVT_EFFECT_KEYS = frozenset(
-    {"kind", "suppression", "suppression_table", "floor_suppression", "hwm_floor"}
+    {"kind", "suppression", "suppression_table", "floor_suppression",
+     "hwm_floor", "_pricing", "journal_identity_version"}
 )
 
 
@@ -8020,7 +8161,7 @@ _REBUILD_REQUIRED_INDEXES = frozenset(
 # omitted column, constraint, partial predicate, or index definition.  An epoch
 # schema change must update this contract alongside STATS_INDEX_EPOCH.
 _REBUILD_SCHEMA_FINGERPRINT = (
-    "b8f18315bce871bd9692ba1db73cf7e2bda716b360616fc65149ce209248906d"
+    "e0f2225f00843952b4887fa8afb046edacd3da0642d0f402ebaa5219a6e30697"
 )