cctally 1.111.0 → 1.112.0

package/CHANGELOG.md

@@ -5,6 +5,23 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.112.0] - 2026-09-29
+
+### Added
+- Claude cost reports price `claude-sonnet-5-5` at its published input, output and cache rates instead of showing $0 for new usage.
+
+### Changed
+- `cctally dashboard` uses less CPU while idle on a large history.
+
+### Fixed
+- The Conversation Viewer keeps project-filtered browse working with any number of unreadable Codex project paths, avoids repeated metadata schema probes, and preserves SQLite alias ordering.
+- The TUI and dashboard clear a Codex metadata retry as soon as its transient partial generation is rejected, so the first healthy refresh recovers immediately instead of waiting through a stale retry delay.
+- `cctally db rederive` corrects costs recorded while a model had no rate card, including provably unpriced $0 five-hour blocks. A Codex budget alert that fallback pricing overstated is retired and can fire again when real spend crosses.
+- After `cctally db rederive --yes`, a still-crossed Claude budget, projected or project-budget alert no longer breaks every later stats ingest until the period ends, and fired five-hour alerts stay in Recent Alerts.
+- On phones, the dashboard's `Current Usage` dialog shows its full title and hides the onboarding hint while the dialog is open.
+- An idle `cctally dashboard` no longer rebuilds its Codex view on every refresh after a Codex weekly reset with no newer Codex activity, which cost steady CPU while nothing changed.
+- `cctally db rederive` no longer reprices the unchanged five-hour milestones of a closed block whose cost is frozen when a rate card changes: each keeps its recorded cumulative cost; its marginal changes only to follow the prior milestone.
+
 ## [1.111.0] - 2026-09-24
 
 ### Fixed

package/README.md

@@ -30,15 +30,14 @@ Your Claude Code plan meters you with a percentage that creeps up all week. ccta
 </p>
 
 <!-- cctally:latest-stable:begin -->
-**Latest stable: v1.109.0** (2026-09-15)
+**Latest stable: v1.111.0** (2026-09-24)
 
-Highlights from the `v1.104.0` to `v1.109.0` stable upgrade:
+Highlights from the `v1.109.0` to `v1.111.0` stable upgrade:
 
-- The dashboard picks up a new pricing revision without a restart. It re-reads the deployed pricing file every 60 seconds, adopts a complete newer revision, and keeps serving; no connected client is dropped.
-- The conversation filter popover says `Projects appear once indexing finishes.` in place of `No projects.` while the transcript index is being rebuilt. Model counts stay live on the Claude tab.
-- The dashboard's Projects panel gives every billing cycle of a credited week its own percentage. Both cycles shared one calendar date, and only the later reading survived, so the second cycle could never carry one.
+- After `cctally update` or a Homebrew upgrade installs a newer version, a running `dashboard` restarts itself so new prices and code apply. Restart it yourself once after installing this release, and after any manual `npm install -g`.
+- A `dashboard` restart after an update no longer leaves an extra Node process running on npm installs.
 
-[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.109.0)
+[See every change in this stable upgrade](https://github.com/omrikais/cctally/releases/tag/v1.111.0)
 <!-- cctally:latest-stable:end -->
 
 ## Quick start

package/bin/_cctally_cache.py

@@ -9478,6 +9478,7 @@ def _sum_codex_cost_for_range(
     speed: str = "auto",
     skip_sync: bool = False,
     account_key: "str | None" = None,
+    pricing_provenance: "dict | None" = None,
 ) -> float:
     """Sum USD Codex cost of all `codex_session_entries` in ``[start, end)``.
 
@@ -9511,17 +9512,23 @@ def _sum_codex_cost_for_range(
     """
     c = _cctally()
     eff_speed = c._resolve_codex_speed(speed)
+    entries = c.get_codex_entries(
+        start, end, skip_sync=skip_sync, account_key=account_key,
+    )
+    if pricing_provenance is not None:
+        import _lib_cost_provenance
+        total, evidence = _lib_cost_provenance.codex_cost_with_provenance(
+            entries, end=end, speed=eff_speed,
+        )
+        pricing_provenance.update(evidence)
+        return total
     total = 0.0
-    for entry in c.get_codex_entries(start, end, skip_sync=skip_sync,
-                                     account_key=account_key):
+    for entry in entries:
         if entry.timestamp >= end:
             continue
         total += c._calculate_codex_entry_cost(
-            entry.model,
-            entry.input_tokens,
-            entry.cached_input_tokens,
-            entry.output_tokens,
-            entry.reasoning_output_tokens,
+            entry.model, entry.input_tokens, entry.cached_input_tokens,
+            entry.output_tokens, entry.reasoning_output_tokens,
             speed=eff_speed,
         )
     return total

package/bin/_cctally_core.py

@@ -468,7 +468,12 @@ _init_paths_from_env()
 # a migration is unchanged: the registry is frozen at 13, and an epoch-current
 # open returns before any schema work, so a handler or an
 # `add_column_if_missing` would never run on an upgraded install.
-STATS_INDEX_EPOCH = 1015
+# 1015 -> 1016 (#869): an open five-hour block records the pricing evidence
+# used to compute its current cost. Closing a different block on a successor
+# tick must carry that earlier evidence into the journal, even after this
+# binary learns a new model card. A pre-existing open projection that was
+# rebuilt without the marker remains unproven until a new tick recomputes it.
+STATS_INDEX_EPOCH = 1016
 LEGACY_STATS_HEAD = 13
 
 #: #496 S1 F1. A NEW branch, for a state that cannot occur before the
@@ -2506,6 +2511,7 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
                 total_cache_create_tokens     INTEGER NOT NULL DEFAULT 0,
                 total_cache_read_tokens       INTEGER NOT NULL DEFAULT 0,
                 total_cost_usd                REAL    NOT NULL DEFAULT 0,
+                pricing_provenance_json       TEXT,
                 is_closed                     INTEGER NOT NULL DEFAULT 0,
                 created_at_utc                TEXT    NOT NULL,
                 last_updated_at_utc           TEXT    NOT NULL,
@@ -2517,6 +2523,8 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         add_column_if_missing(
             conn, "five_hour_blocks", "account_key",
             "TEXT NOT NULL DEFAULT 'unattributed'")
+        add_column_if_missing(
+            conn, "five_hour_blocks", "pricing_provenance_json", "TEXT")
         conn.execute(
             """
             CREATE INDEX IF NOT EXISTS idx_five_hour_blocks_block_start

package/bin/_cctally_dashboard_envelope.py

@@ -56,8 +56,8 @@ from _cctally_core import (
 )
 from _lib_dashboard_sources import (
     SOURCE_SCHEMA_VERSION,
-    canonical_alerted_at as _canonical_alerted_at,
-    canonical_alerted_at_sql as _canonical_alerted_at_sql,
+    alerted_at_order_key as _alerted_at_order_key,
+    alerted_at_order_key_sql as _alerted_at_order_key_sql,
     dashboard_resource_key as _dashboard_resource_key,
 )
 from _lib_display_tz import _compute_display_block, format_display_dt
@@ -475,9 +475,10 @@ def _alert_account_resolver(conn: sqlite3.Connection):
 # and a row excluded there is unrecoverable. Two spellings of one instant
 # compare equal here; a nonzero offset — which the ``all-combined`` fixture
 # stores deliberately — orders by its true instant rather than by its
-# local-time text.
-_CANON_ALERTED_AT = _canonical_alerted_at_sql()
-_CANON_ALERTED_AT_M = _canonical_alerted_at_sql("m.alerted_at")
+# local-time text. #869 F14: the key carries the full sub-second instant, so a
+# Codex crossing fired later in the same second as a Claude alert sorts newer.
+_CANON_ALERTED_AT = _alerted_at_order_key_sql()
+_CANON_ALERTED_AT_M = _alerted_at_order_key_sql("m.alerted_at")
 
 
 def _envelope_rows_weekly(
@@ -1169,7 +1170,7 @@ def _build_alerts_envelope_array(
         # `_combined_alert_rows` does — otherwise the operator sees an empty
         # panel and a message that identifies nothing.
         try:
-            return _canonical_alerted_at(alert["alerted_at"])
+            return _alerted_at_order_key(alert["alerted_at"])
         except (KeyError, ValueError) as exc:
             identity = alert.get("key") or alert.get("id")
             raise ValueError(

package/bin/_cctally_dashboard_sources.py

@@ -55,15 +55,17 @@ from _lib_dashboard_sources import (
     SourceDashboardState,
     SourceDashboardWarning,
     assess_codex_projection_coherence,
+    alerted_at_order_key,
+    alerted_at_order_key_sql,
     build_metadata_health,
     canonical_alerted_at,
-    canonical_alerted_at_sql,
     claude_stats_digest,
     combined_accounting_version,
     codex_stats_digest,
     dashboard_resource_key,
 )
 from _lib_quota import (
+    FUTURE_CLOCK_SKEW_SECONDS,
     QuotaWindowIdentity,
     build_blocks,
     build_history,
@@ -627,26 +629,12 @@ def _codex_quota_reuse_identity(
                 "stats_identity must be the three-digest tuple or None")
     elif not isinstance(stats_conn, sqlite3.Connection):
         return None
-    try:
-        seq_row = cache_conn.execute(
-            "SELECT seq FROM sqlite_sequence "
-            "WHERE name='quota_window_change_log'"
-        ).fetchone()
-        table = cache_conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' "
-            "AND name='quota_window_change_log'"
-        ).fetchone()
-        revision_row = cache_conn.execute(
-            "SELECT value FROM cache_meta "
-            "WHERE key='codex_window_attribution_revision'"
-        ).fetchone()
-        db_path = next(
-            str(row[2]) for row in cache_conn.execute("PRAGMA database_list")
-            if str(row[1]) == "main"
-        )
-    except (sqlite3.Error, StopIteration):
-        return None
-    if table is None:
+    # #857: the cache.db legs are read through the snapshot-cache kernel, which
+    # states each leg's query once and shares it with the doctor's quota probe
+    # and the dashboard's quota-dependency identity.
+    db_path = _lib_snapshot_cache.codex_main_database_path(cache_conn)
+    legs = _lib_snapshot_cache.codex_quota_observation_legs(cache_conn)
+    if db_path is None or legs is None:
         return None
     if stats_identity is None:
         try:
@@ -660,12 +648,7 @@ def _codex_quota_reuse_identity(
             return None
         except sqlite3.Error:
             return None
-    return (
-        db_path,
-        0 if seq_row is None else int(seq_row[0]),
-        "" if revision_row is None else str(revision_row[0]),
-        *stats_identity,
-    )
+    return (db_path, *legs, *stats_identity)
 
 
 def _cached_codex_quota_observations(**kwargs) -> tuple[object, ...]:
@@ -1190,51 +1173,82 @@ def _codex_next_decision_at(
     crossing. That is one rebuild per deadline (a handful per weekly cycle), not
     one per tick.
 
-    The deadline is the ``min`` of three candidate kinds, dropping any candidate
-    at or before ``now_utc``:
-
-    1. every selected cycle's ``resets_at`` (expiry — including the
-       #341 multi-account case where account A expires while B stays live);
-    2. ``latest_physical_capture + stale_after_seconds(window)`` for every weekly
-       history with a live baseline (fresh -> stale). This is a deliberate
-       SUPERSET of the §3.2 ranking participants — it also covers histories whose
-       freshness is ``"future"``/``"unavailable"`` and so never enter the ranking
-       — because an extra candidate can only pull the deadline EARLIER, and an
-       earlier deadline is always the conservative direction;
-    3. the ``captured_at`` of any future-dated weekly observation
-       (future -> fresh / baseline eligibility).
+    The deadline is the ``min`` of every candidate below, dropping any
+    candidate at or before ``now_utc``. #857 made the set COMPLETE, because a
+    settled cycle-unavailable generation now idles until this instant: a
+    transition with no candidate is never picked up at all, and one whose
+    candidate fires early is lost too — the rebuild at the early instant drops
+    the candidate (it is no longer after ``now``) while the transition it stood
+    for is still ahead. Each candidate is therefore the FIRST instant its
+    transition is observable, under the resolver's own comparison:
+
+    1. every weekly baseline's ``canonical_resets_at`` — selected or not, since
+       an UNSELECTED boundary expiring is what resolves a ``conflicting``
+       account (the resolver drops ``resets_at <= now``, so the reset instant
+       itself is the first expired one). Every selected cycle's ``resets_at`` is
+       one of these; they stay listed explicitly for the #341 multi-account case
+       where account A expires while B stays live;
+    2. every weekly baseline's nominal start plus one microsecond: the resolver
+       rejects ``start >= now`` (#599), so a window captured ahead of its start
+       becomes eligible strictly after it, on frozen evidence;
+    3. for every weekly history with a baseline that has not reset: the
+       fresh -> stale flip of its latest physical capture, which
+       ``quota_freshness`` takes when the whole-second age EXCEEDS
+       ``stale_after_seconds`` — ``capture + stale_after + 1s``, not
+       ``capture + stale_after`` — and the future -> fresh flip, when the
+       truncated age stops being below ``-FUTURE_CLOCK_SKEW_SECONDS`` —
+       strictly after ``capture - (skew + 1)s``. This is a deliberate SUPERSET
+       of the §3.2 ranking participants, because an extra candidate can only
+       pull the deadline EARLIER and costs one rebuild at an instant where the
+       verdict could have changed;
+    4. the ``captured_at`` of any future-dated weekly observation (baseline
+       eligibility, ``captured_at <= now``). Recorded BEFORE the model-scoped
+       skip: the pool label is read from the baseline and ``limit_name`` is not
+       part of history identity, so a future capture can move a history out of
+       a model-scoped pool.
 
     Returns ``None`` when nothing can flip. Server-only: it rides ``clock_data``
     and never reaches the public source envelope.
     """
+    one_microsecond = dt.timedelta(microseconds=1)
     candidates: list[dt.datetime] = []
     for cycle in cycles:
         candidates.append(cycle.resets_at.astimezone(UTC))
     for history in build_history(tuple(observations)):
         if history.identity.window_minutes != 10_080:
             continue
+        # 4. A capture ahead of ``now`` is not baseline-eligible yet, so this
+        # runs even for a history with no live baseline at all.
+        for observation in (
+            *history.observations, *history.physical_observations,
+        ):
+            captured_at = observation.captured_at.astimezone(UTC)
+            if captured_at > now_utc:
+                candidates.append(captured_at)
         baseline = select_baseline(history.observations, now_utc)
         if codex_history_is_model_scoped(history, baseline=baseline):
             continue
+        if baseline is None:
+            continue
         # #428: the anchor, so the decision deadline describes the same window
         # the hero publishes rather than a jitter sibling up to 600s away.
-        if baseline is not None and baseline.canonical_resets_at > now_utc:
+        resets_at = baseline.canonical_resets_at.astimezone(UTC)
+        window = dt.timedelta(minutes=history.identity.window_minutes)
+        candidates.append(resets_at)                                # 1.
+        candidates.append(resets_at - window + one_microsecond)     # 2.
+        if resets_at > now_utc:                                     # 3.
             latest = latest_physical_observation(history.physical_observations)
             if latest is not None:
+                latest_at = latest.captured_at.astimezone(UTC)
+                candidates.append(latest_at + dt.timedelta(
+                    seconds=stale_after_seconds(
+                        history.identity.window_minutes) + 1,
+                ))
                 candidates.append(
-                    latest.captured_at.astimezone(UTC)
-                    + dt.timedelta(
-                        seconds=stale_after_seconds(history.identity.window_minutes),
-                    )
+                    latest_at
+                    - dt.timedelta(seconds=FUTURE_CLOCK_SKEW_SECONDS + 1)
+                    + one_microsecond
                 )
-        # A capture ahead of ``now`` is not baseline-eligible yet, so this runs
-        # even for a history with no live baseline at all.
-        for observation in (
-            *history.observations, *history.physical_observations,
-        ):
-            captured_at = observation.captured_at.astimezone(UTC)
-            if captured_at > now_utc:
-                candidates.append(captured_at)
     live = [candidate for candidate in candidates if candidate > now_utc]
     return min(live) if live else None
 
@@ -4447,7 +4461,8 @@ def _alerts_wire(
     # row that fired most recently but crossed longest ago was dropped at the
     # LIMIT and never reached the panel at all. `created_at` stays as an
     # equal-valued compatibility alias for a client reading a pre-v7 envelope.
-    canon = canonical_alerted_at_sql()
+    # #869 F14: the full instant, so a same-second pair keeps its newer row.
+    canon = alerted_at_order_key_sql()
 
     def _instants(raw: object) -> dict[str, str]:
         value = canonical_alerted_at(raw)
@@ -4506,7 +4521,7 @@ def _alerts_wire(
         return ()
     return tuple(sorted(
         rows,
-        key=lambda item: canonical_alerted_at(item["alerted_at"]),
+        key=lambda item: alerted_at_order_key(item["alerted_at"]),
         reverse=True,
     )[:SOURCE_HISTORY_LIMIT])
 
@@ -7441,6 +7456,13 @@ class _CodexAccountingCapture:
     #: safety came from the compare-and-swap rather than from the signature,
     #: and carrying the value makes the signature answer for itself.
     population_signature: tuple | None = None
+    #: #857: the accounting provenance token THIS capture's accounting result
+    #: returned — carried for the same reason as the signature above, because
+    #: overlay publication or a concurrent capture can move the module state
+    #: before the fold stamps it. ``None`` when the capture bypassed the
+    #: qualified accounting read: such a generation names no population, and
+    #: borrowing the process's current token would name one it never read.
+    provenance_token: int | None = None
 
 
 #: The detail routes' horizon: one year ending at the generation instant. The
@@ -7532,6 +7554,8 @@ def _capture_codex_accounting(
     changed_old: tuple[object, ...] = ()
     changed_new: tuple[object, ...] = ()
     population_signature: tuple | None = None
+    # #857: set only by a qualified read that returned; every bypass keeps it.
+    provenance_token: int | None = None
 
     def fallback_entries() -> tuple[object, ...]:
         nonlocal metadata_read_failed, failed_legs
@@ -7600,6 +7624,7 @@ def _capture_codex_accounting(
             changed_old = cached_accounting.changed_old
             changed_new = cached_accounting.changed_new
             population_signature = cached_accounting.population_signature
+            provenance_token = cached_accounting.provenance_token
             entries: tuple[object, ...] = qualified_entries
         except QualifiedMetadataUnavailable as exc:
             _lib_log.get_logger("dashboard").warning(
@@ -7644,6 +7669,8 @@ def _capture_codex_accounting(
         failed_legs=failed_legs,
         population_signature=(
             None if metadata_incomplete else population_signature),
+        provenance_token=(
+            None if metadata_incomplete else provenance_token),
     )
 
 
@@ -9253,6 +9280,14 @@ def _build_codex_source_state(
             "codex_next_decision_at": _codex_next_decision_at(
                 quota_observations, cycles_all, context.now_utc,
             ),
+            # #857: the accounting provenance token of the population THIS
+            # build's capture read (`None` when it bypassed the qualified
+            # read). A retained generation is admitted only while this equals
+            # the token of the population the process last consumed, so a
+            # build that consumed accounting and then failed to publish leaves
+            # every older generation refused, whatever the failure site.
+            _lib_snapshot_cache.CODEX_ACCOUNTING_PROVENANCE_KEY: (
+                accounting_capture.provenance_token),
         },
         private_session_labels=private_session_labels,
         # #819: the SAME reading that gated decoration above. Attaching it here

package/bin/_cctally_doctor.py

@@ -1032,31 +1032,17 @@ def _codex_quota_observation_signal() -> "tuple | None":
     except sqlite3.Error:
         return None
     try:
-        table = conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' "
-            "AND name='quota_window_change_log'"
-        ).fetchone()
-        if table is None:
-            return None
-        seq_row = conn.execute(
-            "SELECT seq FROM sqlite_sequence "
-            "WHERE name='quota_window_change_log'"
-        ).fetchone()
-        revision_row = conn.execute(
-            "SELECT value FROM cache_meta "
-            "WHERE key='codex_window_attribution_revision'"
-        ).fetchone()
-    except sqlite3.Error:
-        return None
+        # #857: the two ledger legs are stated once, in the snapshot-cache
+        # kernel, and shared with the dashboard's Codex quota-dependency
+        # identity rather than restated here.
+        legs = _cctally()._load_sibling(
+            "_lib_snapshot_cache"
+        ).codex_quota_observation_legs(conn)
     finally:
         conn.close()
-    return (
-        str(path),
-        stat.st_dev,
-        stat.st_ino,
-        0 if seq_row is None else int(seq_row[0]),
-        "" if revision_row is None else str(revision_row[0]),
-    )
+    if legs is None:
+        return None
+    return (str(path), stat.st_dev, stat.st_ino, *legs)
 
 
 def _load_codex_quota_observations_for_doctor(*, force_cold: bool = False):
@@ -1079,6 +1065,67 @@ def _load_codex_quota_observations_for_doctor(*, force_cold: bool = False):
     return loaded
 
 
+# The all-history project-metadata partition is the other large immutable input
+# in a warm dashboard Doctor gather.  On the production-shaped #857 copy it
+# cost 422-432 ms per call while returning the same six counts every 30-second
+# Doctor refresh.  Retain only that raw partition, never a Doctor verdict or a
+# clock-derived field, under the cache identity plus the existing physical
+# mutation sequence.  Codex ingest advances that sequence in the same
+# transaction as token, thread, root, cursor, and metadata writes, which are
+# exactly the three-table inputs of ``load_codex_project_metadata_health``.
+# Replacement is covered separately by device/inode, and an absent or malformed
+# signal always takes the cold path.  The path is the one the passed connection
+# opened, never the global ``CACHE_DB_PATH``: the sequence is read from that
+# connection, so the file identity must describe the same file (#857).
+_CODEX_PROJECT_METADATA_MEMO: "dict[tuple, object]" = {}
+
+
+def _codex_project_metadata_signal(
+    cache_conn: sqlite3.Connection,
+) -> "tuple | None":
+    try:
+        path = next(
+            str(row[2]) for row in cache_conn.execute("PRAGMA database_list")
+            if len(row) > 2 and str(row[1]) == "main" and row[2]
+        )
+        stat = os.stat(path)
+        row = cache_conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_physical_mutation_seq'"
+        ).fetchone()
+        if row is None:
+            return None
+        sequence = int(row[0])
+        if sequence < 0:
+            return None
+    except (OSError, StopIteration, sqlite3.Error, TypeError, ValueError):
+        return None
+    return (path, stat.st_dev, stat.st_ino, sequence)
+
+
+def _load_codex_project_metadata_health_for_doctor(
+    cache_conn: sqlite3.Connection,
+    *,
+    force_cold: bool = False,
+):
+    signal = (
+        None if force_cold
+        else _codex_project_metadata_signal(cache_conn)
+    )
+    if signal is not None:
+        cached = _CODEX_PROJECT_METADATA_MEMO.get(signal)
+        if cached is not None:
+            return cached
+    analytics = _cctally()._load_sibling("_cctally_source_analytics")
+    loaded = analytics.load_codex_project_metadata_health(
+        cache_conn=cache_conn,
+    )
+    if signal is not None:
+        _CODEX_PROJECT_METADATA_MEMO.clear()
+        _CODEX_PROJECT_METADATA_MEMO[signal] = loaded
+    return loaded
+
+
 _QUOTA_NO_CHANGE: dict = {
     "active": False, "assessed": True, "effective_from": None,
     "previous_units_per_point": None, "new_units_per_point": None,
@@ -1835,10 +1882,9 @@ def _doctor_gather_state_impl(
                     # connection.  A failed probe is health evidence, not an
                     # empty corpus: the kernel renders it as a distinct FAIL.
                     try:
-                        import _cctally_source_analytics
-
-                        health = _cctally_source_analytics.load_codex_project_metadata_health(
-                            cache_conn=conn,
+                        health = _load_codex_project_metadata_health_for_doctor(
+                            conn,
+                            force_cold=_force_cold_inputs,
                         )
                         codex_project_metadata_health = {
                             "total_rows": health.total_rows,

package/bin/_cctally_forecast.py

@@ -3173,7 +3173,8 @@ def cmd_budget(args: argparse.Namespace) -> int:
 
             def _codex_backstop_leg(ictx):
                 c.maybe_record_codex_budget_milestone(
-                    {}, conn=ictx.conn, alert_sink=ictx.pending_alerts)
+                    {}, conn=ictx.conn, alert_sink=ictx.pending_alerts,
+                    journal_ctx=ictx)
                 if projected_on:
                     c.maybe_record_projected_alert(
                         {}, only_metrics={"codex_budget_usd"},