cctally 1.111.0 → 1.113.0

package/bin/_lib_dashboard_sources.py

@@ -6,8 +6,10 @@ import datetime as dt
 import hashlib
 import json
 import math
+import os
 import re
 import sqlite3
+import time
 from dataclasses import dataclass
 from types import MappingProxyType
 from typing import Literal, Mapping
@@ -717,6 +719,54 @@ def reuse_coherent_source_state(
     return prior if _reusable_provider(prior) and prior.data_version == data_version else None
 
 
+#: The complete warning-code set of a settled cycle-unavailable generation.
+SETTLED_CODEX_CYCLE_WARNING_CODES = frozenset(("codex_cycle_unavailable",))
+
+
+def settled_codex_cycle_unavailable(state: object) -> bool:
+    """Whether a Codex generation is the SETTLED cycle-unavailable state (#857).
+
+    The one Codex-only predicate both TUI retention legs consult. It names the
+    everyday state of an install that has not used Codex since its last weekly
+    reset: the build SUCCEEDED, every domain it publishes is current, and the
+    only thing withheld is the hero, because no native weekly boundary contains
+    ``now``. That is ``partial`` and ``fresh`` with data present and exactly one
+    warning code, ``codex_cycle_unavailable``.
+
+    It is deliberately narrower than "partial for a known cause". Every
+    neighbour still rebuilds: a composite with an incoherent projection (the
+    certificate-recovery case), an unresolved account scope (#819), incomplete
+    metadata (the retry kernel's own business), an unknown code, stale or
+    missing data, a failed aggregate fold, and a RETRYABLE metadata carrier,
+    which no reuse or retention gate may admit (#846). The cause is NOT added to
+    ``_lib_source_retry.RETAINABLE_PARTIAL_CAUSES``: that allowlist also decides
+    composite keys, and this state is not a throttled retry but a generation
+    with nothing left to retry.
+
+    This predicate states only the SHAPE. Whether the shape may be republished
+    this tick is the caller's question — its captured input identity must still
+    be current and its decision deadline must not have passed — because only
+    the caller holds the current identity and the clock.
+    """
+    if not isinstance(state, SourceDashboardState) or state.source != "codex":
+        return False
+    if (
+        state.availability != "partial"
+        or state.freshness != "fresh"
+        or state.data is None
+        or not state.data_version
+    ):
+        return False
+    if frozenset(
+        warning.code for warning in state.warnings
+    ) != SETTLED_CODEX_CYCLE_WARNING_CODES:
+        return False
+    health = state.metadata_health
+    if health is not None and bool(health.get("retryable")):
+        return False
+    return not aggregate_scope_failed(state)
+
+
 # === #556 S1 — the typed combined outcome (spec §3.5, §3.7) =================
 #
 # `combined` is the sum, over both providers, of that provider's accounting
@@ -987,15 +1037,7 @@ def _decorated_combined_leg(
     }, ()
 
 
-def canonical_alerted_at(value: object) -> str:
-    """Normalize an aware ISO-8601 firing instant to one UTC ``Z`` spelling.
-
-    #556 S3 §2.2. The union sorted on a field one writer never wrote, so a
-    missing or malformed value must raise here rather than degrade to a
-    sentinel that sorts silently. Sub-second precision is truncated, so two
-    alerts firing in the same second compare equal and fall back to source
-    order; no writer emits it today.
-    """
+def _parse_alerted_at(value: object) -> dt.datetime:
     if not isinstance(value, str) or not value:
         raise ValueError(f"alerted_at must be a non-empty ISO-8601 string, got {value!r}")
     try:
@@ -1004,25 +1046,96 @@ def canonical_alerted_at(value: object) -> str:
         raise ValueError(f"unparseable alerted_at {value!r}") from exc
     if parsed.tzinfo is None:
         raise ValueError(f"naive alerted_at {value!r}; an aware instant is required")
-    return parsed.astimezone(dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    return parsed.astimezone(dt.timezone.utc)
+
+
+def canonical_alerted_at(value: object) -> str:
+    """Normalize an aware ISO-8601 firing instant to one UTC ``Z`` spelling.
+
+    #556 S3 §2.2. The union sorted on a field one writer never wrote, so a
+    missing or malformed value must raise here rather than degrade to a
+    sentinel that sorts silently. A whole-second instant keeps its historical
+    ``…SSZ`` spelling. #869 F14: a Codex budget crossing records the exact
+    microsecond cutoff its spend scan used, so a sub-second instant keeps its
+    six-digit fraction instead of being truncated into a tie with a Claude
+    alert from the same second. This value is for publication; ordering uses
+    :func:`alerted_at_order_key`, because two widths do not sort as text.
+    """
+    parsed = _parse_alerted_at(value)
+    if parsed.microsecond:
+        return parsed.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+    return parsed.strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def alerted_at_order_key(value: object) -> str:
+    """The full firing instant as fixed-width UTC text: ``…SS.ffffffZ``.
+
+    #869 F14. Every truncation and union across vendors compares firing
+    instants, and a whole-second Claude alert must sort before a Codex alert
+    fired later in the same second. Fixed width makes text order equal instant
+    order, and :func:`alerted_at_order_key_sql` produces the same string in
+    SQLite. Raises exactly as :func:`canonical_alerted_at` does.
+    """
+    return _parse_alerted_at(value).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+
+
+def _alerted_at_fraction_sql(column: str) -> str:
+    """The six-digit sub-second fraction of an ISO-8601 value, in SQLite.
+
+    SQLite's date functions keep only milliseconds, so the fraction is read
+    from the text itself. A UTC offset is a whole number of minutes, so the
+    source fraction is also the UTC instant's fraction.
+    """
+    tail = f"substr({column}, 21)"
+    digits = (
+        f"substr({tail}, 1, CASE "
+        f"WHEN instr({tail}, 'Z') > 0 THEN instr({tail}, 'Z') - 1 "
+        f"WHEN instr({tail}, '+') > 0 THEN instr({tail}, '+') - 1 "
+        f"WHEN instr({tail}, '-') > 0 THEN instr({tail}, '-') - 1 "
+        f"ELSE length({tail}) END)"
+    )
+    return (
+        f"(CASE WHEN substr({column}, 20, 1) = '.' "
+        f"THEN substr({digits} || '000000', 1, 6) ELSE '000000' END)"
+    )
+
+
+def alerted_at_order_key_sql(column: str = "alerted_at") -> str:
+    """The SQL twin of :func:`alerted_at_order_key`, for ``ORDER BY … LIMIT``.
+
+    #556 S3 §2.3 / #869 F14. Every per-axis ``LIMIT`` decides MEMBERSHIP, not
+    merely order, so it must compare the full instant: two rows fired in the
+    same second are otherwise tie-broken by an unrelated column and the newer
+    one can be dropped before any later projection sees it. SQLite parses the
+    offset for the seconds part and the text supplies the fraction, so for
+    every aware spelling this returns the Python helper's string —
+    ``tests/test_556_s3_alert_ordering.py`` pins that agreement. A naive value
+    is read as UTC here where the Python helper raises; an unparseable value
+    yields ``NULL``, which sorts last under ``DESC``. The expression names
+    ``column`` several times, so a bound parameter must be numbered (``?1``).
+    """
+    return (
+        f"(strftime('%Y-%m-%dT%H:%M:%S', {column}) || '.' || "
+        f"{_alerted_at_fraction_sql(column)} || 'Z')"
+    )
 
 
 def canonical_alerted_at_sql(column: str = "alerted_at") -> str:
-    """The SQL twin of :func:`canonical_alerted_at`, for ordering in SQLite.
-
-    #556 S3 §2.3. Every per-axis ``LIMIT`` decides MEMBERSHIP, not merely
-    order, so a row excluded by a textual comparison of two spellings of one
-    instant cannot be recovered by any later projection. SQLite parses the
-    timezone indicator, so for every aware spelling this returns the same
-    canonical UTC ``Z`` string the Python helper returns —
-    ``tests/test_556_s3_alert_ordering.py`` pins that agreement over the
-    committed estate. The twins diverge on exactly one input: SQLite reads a
-    naive value as UTC where the Python helper raises, so such a row is ordered
-    here and rejected later. An unparseable value yields SQL ``NULL``, which
-    sorts last under ``DESC``, so the ``LIMIT`` usually drops that row before
-    composition can reject it — corruption is truncated away, not surfaced.
+    """The SQL twin of :func:`canonical_alerted_at`, for the same spelling.
+
+    #556 S3 §2.3 / #869 F14. It agrees with the Python helper for every aware
+    spelling, including a sub-second one, and is kept so a writer emitting a
+    spelling only one side understands surfaces in the agreement test. It is
+    variable-width, so it never orders a ``LIMIT``; that is
+    :func:`alerted_at_order_key_sql`'s job.
     """
-    return f"strftime('%Y-%m-%dT%H:%M:%SZ', {column})"
+    fraction = _alerted_at_fraction_sql(column)
+    return (
+        f"(CASE WHEN {fraction} = '000000' "
+        f"THEN strftime('%Y-%m-%dT%H:%M:%SZ', {column}) "
+        f"ELSE strftime('%Y-%m-%dT%H:%M:%S', {column}) || '.' || {fraction} "
+        f"|| 'Z' END)"
+    )
 
 
 def _leg_period(
@@ -1525,7 +1638,7 @@ def _combined_alert_rows(
 
     def _instant(row: Mapping[str, object]) -> str:
         try:
-            return canonical_alerted_at(row.get("alerted_at"))
+            return alerted_at_order_key(row.get("alerted_at"))
         except ValueError as exc:
             identity = row.get("id") if row.get("id") is not None else row.get("key")
             raise ValueError(
@@ -1827,10 +1940,116 @@ _CLAUDE_STATS_DIGEST_RELATIONS: tuple[tuple[str, str], ...] = (
 )
 
 
+_STATS_RELATIONS_DIGEST_MEMO: "dict[tuple, str]" = {}
+
+# A file timestamp is only as fine as its filesystem: nanoseconds on APFS, a
+# kernel tick on ext4, one second on HFS+, two on FAT. Two commits inside one
+# tick can leave identical timestamps, so no digest is memoized until the
+# file's newest timestamp is at least this old. Any later commit then carries a
+# strictly newer timestamp, whatever the granularity up to this bound.
+_STATS_DIGEST_MEMO_SETTLE_SECONDS = 2.0
+
+
+def _stats_memo_now() -> float:
+    """The wall clock the settle window is measured on (a test seam)."""
+    return time.time()
+
+
+def _stats_relations_digest_signal(
+    stats_conn: sqlite3.Connection,
+) -> "tuple | None":
+    """Return the stats file's write identity, or no cache key.
+
+    The journal cursor cannot serve as this identity. ``_run_cycle`` runs the
+    Codex projection leg and the budget-config reconcile on a cycle that
+    consumed no journal bytes and rewrites the cursor to the same high-water
+    mark, and the own-connection reconcile branches, the incomplete-projection
+    reconciliation and every administrative writer never touch it at all.
+
+    Every committed SQLite write in rollback-journal mode rewrites pages of the
+    main file, which moves its mtime and ctime, so the file's ``stat`` covers
+    all of those writers, in every process, without enumerating them. SQLite
+    skips an overwrite whose bytes are unchanged, so an idle cycle that
+    rewrites the cursor and selector rows to identical values leaves the file,
+    and this key, untouched. ``(st_dev, st_ino)`` covers a rebuilt or replaced
+    index, and ``st_size`` rides along for free.
+
+    The file is only ever ``stat``-ed, never opened: closing a second
+    descriptor on a database file releases every POSIX lock this process's
+    SQLite connections hold on it.
+
+    A connection inside a transaction may be reading its own uncommitted
+    writes, which the file does not show yet, so it stays on the cold path, as
+    does an in-memory or temporary store.
+    """
+    if stats_conn.in_transaction:
+        return None
+    try:
+        rows = stats_conn.execute("PRAGMA database_list").fetchall()
+        path = next(
+            str(row[2]) for row in rows
+            if len(row) > 2 and str(row[1]) == "main" and row[2]
+        )
+        stat = os.stat(path)
+    except (OSError, StopIteration, sqlite3.Error, TypeError, ValueError):
+        return None
+    return (
+        path, stat.st_dev, stat.st_ino, stat.st_size,
+        stat.st_mtime_ns, stat.st_ctime_ns,
+    )
+
+
+def _stats_relations_digest_memoizable(
+    stats_conn: sqlite3.Connection,
+    signal: tuple,
+    observed_at: float,
+) -> bool:
+    """May a digest computed under ``signal`` be served to a later read?
+
+    Only when the file did not move while the relations were read, the file had
+    settled before they were, and the store is not in WAL mode. A WAL commit
+    lands in the ``-wal`` file and leaves the main file's timestamps alone, so
+    the key could not see it. The mode is read here, after the relation reads,
+    because a connection reports ``wal`` only once it has read the file. A later
+    switch into WAL is itself a write to the main file, so a stored entry never
+    has to be re-checked.
+    """
+    newest = max(signal[4], signal[5]) / 1e9
+    if observed_at - newest < _STATS_DIGEST_MEMO_SETTLE_SECONDS:
+        return False
+    try:
+        if stats_conn.in_transaction:
+            return False
+        mode = stats_conn.execute("PRAGMA journal_mode").fetchone()
+        if mode is None or str(mode[0]).lower() == "wal":
+            return False
+        stat = os.stat(signal[0])
+    except (OSError, sqlite3.Error, TypeError, ValueError):
+        return False
+    return signal[1:] == (
+        stat.st_dev, stat.st_ino, stat.st_size,
+        stat.st_mtime_ns, stat.st_ctime_ns,
+    )
+
+
 def _stats_relations_digest(
     stats_conn: sqlite3.Connection,
     relations: tuple[tuple[str, str], ...],
+    *,
+    memo_namespace: "str | None" = None,
 ) -> str:
+    signal = None
+    observed_at = 0.0
+    if memo_namespace is not None:
+        # The clock is read BEFORE the file, so the settle test compares the
+        # file against an instant no later than the relation reads.
+        observed_at = _stats_memo_now()
+        signal = _stats_relations_digest_signal(stats_conn)
+    key = (memo_namespace, signal) if signal is not None else None
+    if key is not None:
+        cached = _STATS_RELATIONS_DIGEST_MEMO.get(key)
+        if cached is not None:
+            return cached
     relation_rows: list[list[list[object]]] = []
     for _name, query in relations:
         try:
@@ -1846,7 +2065,15 @@ def _stats_relations_digest(
         ensure_ascii=False,
         separators=(",", ":"),
     ).encode("utf-8")
-    return hashlib.sha256(canonical).hexdigest()
+    digest = hashlib.sha256(canonical).hexdigest()
+    if key is not None and _stats_relations_digest_memoizable(
+        stats_conn, signal, observed_at,
+    ):
+        for prior in tuple(_STATS_RELATIONS_DIGEST_MEMO):
+            if prior[0] == memo_namespace:
+                _STATS_RELATIONS_DIGEST_MEMO.pop(prior, None)
+        _STATS_RELATIONS_DIGEST_MEMO[key] = digest
+    return digest
 
 
 def claude_stats_digest(stats_conn: sqlite3.Connection) -> str:
@@ -1855,7 +2082,11 @@ def claude_stats_digest(stats_conn: sqlite3.Connection) -> str:
     A missing table is an empty relation, so an older or fresh stats database
     still has a stable digest — the same posture ``codex_stats_digest`` takes.
     """
-    return _stats_relations_digest(stats_conn, _CLAUDE_STATS_DIGEST_RELATIONS)
+    return _stats_relations_digest(
+        stats_conn,
+        _CLAUDE_STATS_DIGEST_RELATIONS,
+        memo_namespace="claude",
+    )
 
 
 def codex_stats_digest(stats_conn: sqlite3.Connection) -> str:
@@ -1866,7 +2097,11 @@ def codex_stats_digest(stats_conn: sqlite3.Connection) -> str:
     then follows the source all-or-prior failure matrix instead of publishing a
     guessed identity.
     """
-    return _stats_relations_digest(stats_conn, _CODEX_STATS_DIGEST_RELATIONS)
+    return _stats_relations_digest(
+        stats_conn,
+        _CODEX_STATS_DIGEST_RELATIONS,
+        memo_namespace="codex",
+    )
 
 
 def assess_codex_projection_coherence(

package/bin/_lib_doctor.py

@@ -1011,7 +1011,7 @@ def _check_db_version_ahead(s: DoctorState) -> CheckResult:
             # current index as a mismatch; keep this in lockstep with core
             # (#496 S5b §6.1). It stays a literal because this kernel is pure and
             # must not import `_cctally_core`.
-            epoch = 1015
+            epoch = 1016
         mismatch = uv > legacy_head and uv != epoch
         return {"user_version": uv, "legacy_head": legacy_head, "epoch": epoch,
                 "mismatch": mismatch}
@@ -3528,7 +3528,7 @@ def _check_journal_writer_guard(s: DoctorState) -> CheckResult:
 # not promise one it cannot deliver.
 _REDERIVABLE_CONFLICT_PREFIXES = (
     "sa:", "wcs:", "wce:", "wr:", "fhc:", "fhbc:", "pm:", "fhm:",
-    "bm:", "pjm:", "pbm:",
+    "bm:", "bm2:", "pjm:", "pjm2:", "pbm:", "pbm2:",
 )
 
 

package/bin/_lib_ingest_frontier.py

@@ -1456,33 +1456,125 @@ def _provider_complete(conn, provider: str) -> bool:
     return row is not None
 
 
-def _source_paths(conn, provider: str) -> tuple[pathlib.Path, ...]:
+def _source_paths(conn, provider: str) -> tuple[str, ...]:
+    """Every absolute accounting source path, as the stored string.
+
+    Strings rather than ``pathlib.Path`` objects: ``_source_directory_closure``
+    resolves each distinct parent directory once, so building a path object
+    per source row here was pure overhead on a large store (#880).
+    """
     table = _ingest_source_table(provider)
     return tuple(
-        pathlib.Path(str(row[0]))
+        str(row[0])
         for row in conn.execute(f"SELECT path FROM {table}")
         if row[0] and os.path.isabs(str(row[0]))
     )
 
 
-def _directory_paths(conn, provider: str, roots) -> tuple[pathlib.Path, ...]:
+def _is_canonical_absolute(raw: str) -> bool:
+    """Whether ``str(pathlib.Path(raw)) == raw`` for an absolute ``raw``.
+
+    POSIX pathlib drops empty and ``.`` segments and a trailing separator, and
+    keeps a leading ``//`` as a distinct anchor. A string with none of those
+    spellings is already in pathlib's form, so its parent is the text before
+    its last separator. ``/`` itself is excluded so that every string this
+    accepts has a non-empty final segment.
+    """
+    return (
+        raw.startswith("/")
+        and "//" not in raw
+        and "/./" not in raw
+        and not raw.endswith("/")
+        and not raw.endswith("/.")
+    )
+
+
+def _add_source_chain_pathlib(raw: str, normalized_roots, directories) -> None:
+    """The original per-source pathlib derivation, for a non-canonical string.
+
+    Adds the parent of ``raw`` and every directory above it, up to and
+    including the FIRST root in ``normalized_roots`` order that lexically
+    contains it. A parent outside every root contributes nothing.
+    """
+    parent = pathlib.Path(raw).parent
+    for root in normalized_roots:
+        try:
+            parent.relative_to(root)
+        except ValueError:
+            continue
+        cur = parent
+        while True:
+            directories.add(str(cur))
+            if cur == root:
+                break
+            cur = cur.parent
+        break
+
+
+def _source_directory_closure(read_sources, roots) -> tuple[pathlib.Path, ...]:
+    """The directory set a walk certifies: the roots, plus each source's chain.
+
+    A source contributes its parent and every directory above it up to the
+    FIRST configured root, in the caller's order, that lexically contains the
+    parent; a source outside every root contributes nothing. That is exactly
+    the per-source ``pathlib`` derivation this replaced, and it returns the
+    same sorted tuple of ``pathlib.Path`` objects.
+
+    What changed is the cost (#880). Thousands of source rows share a few
+    thousand parent directories, and the old loop built a path object per row,
+    tested it against each root with ``relative_to``, and re-walked an
+    ancestor chain its siblings had already collected. Here a canonical string
+    is handled as text: each distinct parent is resolved once, and a chain
+    walk stops at the first directory whose chain up to the SAME root is
+    already collected. The memo is keyed by root, not shared, because with
+    nested roots a directory can be complete up to an inner root while the
+    directories between that inner root and an outer one are not — stopping
+    at "already in the set" would lose them whenever the outer root comes
+    first. A non-canonical string (``//``, ``/./``, a trailing separator)
+    falls back to the original pathlib computation for that one row.
+
+    ``read_sources`` is called only after the roots are resolved, the order
+    the pathlib derivation used, so an unresolvable root fails as the OSError
+    the seed path treats as a non-certifiable walk rather than behind a store
+    error.
+    """
     normalized_roots = tuple(pathlib.Path(root).absolute() for root in roots)
-    directories = set(normalized_roots)
-    for source in _source_paths(conn, provider):
-        parent = source.parent
-        for root in normalized_roots:
-            try:
-                parent.relative_to(root)
-            except ValueError:
+    root_strings = tuple(str(root) for root in normalized_roots)
+    # A canonical parent strictly below root `r` starts with `r + "/"`; the
+    # filesystem root is already its own prefix. A root anchored at `//` can
+    # contain no canonical parent, and none of its prefixes match one.
+    root_prefixes = tuple(
+        root if root.endswith("/") else root + "/" for root in root_strings)
+    directories = set(root_strings)
+    # complete[i]: directories whose whole chain up to root i is collected.
+    complete = tuple({root} for root in root_strings)
+    resolved_parents = set()
+    for raw in read_sources():
+        if not _is_canonical_absolute(raw):
+            _add_source_chain_pathlib(raw, normalized_roots, directories)
+            continue
+        parent = raw[:raw.rfind("/")] or "/"
+        if parent in resolved_parents:
+            continue
+        resolved_parents.add(parent)
+        for index, prefix in enumerate(root_prefixes):
+            if parent != root_strings[index] and not parent.startswith(prefix):
                 continue
+            chain = complete[index]
             cur = parent
-            while True:
+            # Terminates: `cur` lies strictly below root i until it becomes
+            # root i, which is in `chain` from the start.
+            while cur not in chain:
+                chain.add(cur)
                 directories.add(cur)
-                if cur == root:
-                    break
-                cur = cur.parent
+                cur = cur[:cur.rfind("/")] or "/"
             break
-    return tuple(sorted(directories, key=str))
+    return tuple(pathlib.Path(directory) for directory in sorted(directories))
+
+
+def _directory_paths(conn, provider: str, roots) -> tuple[pathlib.Path, ...]:
+    return _source_directory_closure(
+        lambda: _source_paths(conn, provider), roots)
 
 
 def _directory_identity(conn, provider: str, roots):
@@ -1493,10 +1585,28 @@ def _directory_identity(conn, provider: str, roots):
 
 
 def _restat_directory_identity(saved):
-    return {
-        raw: _stat_identity_or_missing(pathlib.Path(raw))
-        for raw in saved
-    }
+    """Restat every saved directory key; ``(0, 0, 0, 0)`` when it is gone.
+
+    Both frontiers run this on every idle tick over thousands of keys. The
+    keys are ``str(path)`` of the paths the walk stated, already in pathlib's
+    normalized form, so ``os.stat`` on the key stats exactly what
+    ``pathlib.Path(key).stat()`` would — without building a path object per
+    key per tick, which cost about three times the stat itself (#880).
+
+    That equivalence holds for exactly those keys: non-empty ``str`` values
+    with no trailing separator. An empty key, a trailing slash, bytes or an
+    integer would behave differently, and the walk never records one.
+    """
+    identity = {}
+    for raw in saved:
+        try:
+            st = os.stat(raw)
+        except OSError:
+            identity[raw] = (0, 0, 0, 0)
+        else:
+            identity[raw] = (
+                st.st_dev, st.st_ino, st.st_mtime_ns, st.st_ctime_ns)
+    return identity
 
 
 def _guard_identity(paths):
@@ -1935,33 +2045,22 @@ def _conversation_source_table(provider: str) -> str:
     raise ValueError("unknown provider")
 
 
-def _conversation_source_paths(conn, provider: str) -> tuple[pathlib.Path, ...]:
+def _conversation_source_paths(conn, provider: str) -> tuple[str, ...]:
+    """Every absolute transcript source path, as the stored string.
+
+    The transcript twin of ``_source_paths``, and a string for the same reason.
+    """
     table = _conversation_source_table(provider)
     return tuple(
-        pathlib.Path(str(row[0]))
+        str(row[0])
         for row in conn.execute(f"SELECT path FROM {table}")
         if row[0] and os.path.isabs(str(row[0]))
     )
 
 
 def _conversation_directory_paths(conn, provider: str, roots):
-    normalized_roots = tuple(pathlib.Path(root).absolute() for root in roots)
-    directories = set(normalized_roots)
-    for source in _conversation_source_paths(conn, provider):
-        parent = source.parent
-        for root in normalized_roots:
-            try:
-                parent.relative_to(root)
-            except ValueError:
-                continue
-            cur = parent
-            while True:
-                directories.add(cur)
-                if cur == root:
-                    break
-                cur = cur.parent
-            break
-    return tuple(sorted(directories, key=str))
+    return _source_directory_closure(
+        lambda: _conversation_source_paths(conn, provider), roots)
 
 
 def _conversation_directory_identity(conn, provider: str, roots):

package/bin/_lib_pricing.py

@@ -63,7 +63,7 @@ def _chip_for_model(name: str) -> str:
 # fingerprint a store recorded and refuses a write from an older process. That
 # comparison is day-granular by construction, so two revisions sharing a date
 # compare equal and the older process is authorized to write.
-PRICING_SNAPSHOT_DATE = "2026-09-23"
+PRICING_SNAPSHOT_DATE = "2026-09-30"
 PRICING_STALENESS_DAYS = 60  # release pre-flight WARNs past this age
 
 
@@ -400,6 +400,11 @@ PRICING_DRIFT_ALLOWLIST: list[dict] = [
 #   MTok, $5 five-minute cache write, $0.20 cache read, and 2x fast rate.
 #   Its 1M context uses standard rates throughout. The pricing fingerprint
 #   advances to 2026-09-23 because another revision already used 2026-09-22.
+#   2026-09-29: added claude-sonnet-5-5 at Anthropic's published $2/$10 per
+#   MTok, $2.50 five-minute cache write and $0.20 cache read, the same card
+#   as Sonnet 5 and the standard 0.1x read multiplier. 1M context at standard
+#   pricing, so NO above-200k tier, and no fast mode, so no fast multiplier.
+#   Verified against LiteLLM's anthropic-provider row on 2026-09-29.
 # Anthropic prices a cache WRITE by TTL: 1.25x base input for a 5-minute write,
 # 2x for a 1-hour write. Both WRITE multipliers are documented as applying
 # consistently across all supported models, so the 1h rate is DERIVED from
@@ -646,6 +651,13 @@ CLAUDE_MODEL_PRICING: dict[str, dict[str, Any]] = {
         "cache_creation_input_token_cost": 2.5e-06,
         "cache_read_input_token_cost": 2e-07,
     },
+    "claude-sonnet-5-5": {
+        # Source: https://platform.claude.com/docs/en/models/sonnet-5-5/overview
+        "input_cost_per_token": 2e-06,
+        "output_cost_per_token": 1e-05,
+        "cache_creation_input_token_cost": 2.5e-06,
+        "cache_read_input_token_cost": 2e-07,
+    },
 }
 
 # Anthropic fast-mode pricing is genuinely model-specific. Unsupported models
@@ -750,6 +762,11 @@ _unknown_model_warnings: set[str] = set()
 #   card at $12.50 input / $1.25 cached input / $75.00 output per MTok.
 #   The current OpenAI table lists its 5.6 successor instead. LiteLLM does
 #   not publish an above-272K rate for 5.5 Cyber, so do not infer that tier.
+#   2026-09-29: added gpt-6.1-sol from OpenAI's model and pricing pages:
+#   Standard $2.00 input / $0.10 cached input / $10.00 output per MTok;
+#   above 272K, $4.00 / $0.20 / $15.00. Fast mode is 2x. LiteLLM does not
+#   yet carry this identifier. The snapshot date advances to 2026-09-30
+#   because the Sonnet 5.5 sync already used 2026-09-29 (#705).
 #
 # Billing rules:
 # - reasoning_output_tokens is billed at the *output* rate (matches
@@ -915,6 +932,17 @@ CODEX_MODEL_PRICING: dict[str, dict[str, Any]] = {
         "cache_read_input_token_cost_above_272k_tokens": 4e-07,
         "output_cost_per_token_above_272k_tokens": 1.5e-05,
     },
+    "gpt-6.1-sol": {
+        # Source: https://developers.openai.com/api/docs/models/gpt-6.1-sol
+        # Standard $2.00/M input, $0.10/M cached input, $10.00/M output;
+        # above 272K input, rates are 2x input/cache and 1.5x output.
+        "input_cost_per_token": 2e-06,
+        "cache_read_input_token_cost": 1e-07,
+        "output_cost_per_token": 1e-05,
+        "input_cost_per_token_above_272k_tokens": 4e-06,
+        "cache_read_input_token_cost_above_272k_tokens": 2e-07,
+        "output_cost_per_token_above_272k_tokens": 1.5e-05,
+    },
     "gpt-6-luna": {
         # Source: https://developers.openai.com/api/docs/models/gpt-6-luna
         "input_cost_per_token": 1e-07,