cctally 1.113.0 → 1.114.0

package/bin/_cctally_diagnosis_sources.py

@@ -1984,10 +1984,12 @@ _CODEX_THREADS_BY_NATIVE_SQL = """
 # reading `cache_create_tokens` off `session_entries` carries the split
 # column, because a missed site does not raise and does not move a golden — it
 # silently under-prices — and this map is one keystroke away from feeding a
-# cost fold.
+# cost fold. `input_tokens` (#929) is appended LAST so the existing row
+# indexes stay valid: a flagged turn's wasted estimate selects its pricing card
+# from the request's real prompt, input + creation + read.
 _CLAUDE_TURN_TOKENS_SQL = (
     "SELECT msg_id, req_id, cache_create_tokens, cache_read_tokens, "
-    "       cache_create_1h_tokens, speed "
+    "       cache_create_1h_tokens, speed, input_tokens "
     "FROM session_entries WHERE "
 )
 
@@ -2148,7 +2150,8 @@ def _placeholders(count: int) -> str:
 def _claude_turn_token_map(conn: sqlite3.Connection,
                            keys: Sequence[tuple], account_key: str | None
                            ) -> dict[tuple, dict]:
-    """`{(msg_id, req_id): {"cache_creation", "cache_read", "speed"}}`.
+    """`{(msg_id, req_id): {"cache_creation", "cache_read", "cache_1h",
+    "speed", "input"}}`.
 
     The cache-churn walk begins BEFORE the window, and those turns are state:
     their tokens move the running maximum and they contribute no support,
@@ -2171,6 +2174,7 @@ def _claude_turn_token_map(conn: sqlite3.Connection,
                 "cache_read": int(row[3] or 0),
                 "cache_1h": row[4],
                 "speed": row[5],
+                "input": int(row[6] or 0),
             }
     return usage
 
@@ -2432,8 +2436,13 @@ def _evaluate_cache_churn(scope: DiagnosisScope, bundle: StoreBundle,
                 continue
             flagged_keys.add(key)
             flagged_sessions.add(session)
+            # #929: the flagged request's real prompt selects the card.
+            turn = usage.get(key) or {}
             wasted.append(query._cache_failure_wasted_usd(
-                model, lost, speed=speed))
+                model, lost, speed=speed,
+                prompt_tokens=(turn.get("input", 0)
+                               + turn.get("cache_creation", 0)
+                               + turn.get("cache_read", 0))))
 
     known = set(all_sessions)
     seeded = set(streams)
@@ -4412,6 +4421,15 @@ def _start_forked_provider(args) -> tuple[int, int]:
             with os.fdopen(write_fd, "wb") as stream:
                 pickle.dump(payload, stream, protocol=5)
         finally:
+            # #901 W9 (Q14): `os._exit` skips `atexit`; a provider task that
+            # synced a store hands its frames to the checkpoint policy's
+            # finalizer. With nothing armed it does nothing.
+            try:
+                import _lib_wal_checkpoint
+
+                _lib_wal_checkpoint.finalize()
+            except BaseException:  # noqa: BLE001
+                pass
             os._exit(0)
     os.close(write_fd)
     return pid, read_fd

package/bin/_cctally_doctor.py

@@ -470,6 +470,78 @@ def _gather_writer_guard_log(now_utc: dt.datetime):
     }
 
 
+#: Bounded per-instance probe of a running dashboard's write telemetry.
+DASHBOARD_WRITE_IO_TIMEOUT_SECONDS = 2.0
+
+
+def _fetch_dashboard_write_io(descriptor: dict, *, timeout_s: float) -> dict:
+    """One loopback probe of a discovered dashboard (#901 §5.6).
+
+    Reuses `dashboard-perf`'s client — IP-literal loopback target, an
+    `Origin` matching the `Host` — and sends NO token, so an instance that
+    requires one answers 401 and is reported `authentication_required`: no
+    authentication bypass exists. The instance id in the answer must equal
+    the descriptor's, or the probe is an `identity_mismatch`."""
+    import _lib_write_io as wio
+
+    perf = _cctally()._cctally_dashboard_perf
+    base = {"instance_id": descriptor["instanceId"],
+            "port": descriptor["port"], "pid": descriptor["pid"]}
+    host = wio.loopback_target(descriptor.get("host"))
+    if host is None:
+        return {**base, "probe": "failed", "reason": "not_loopback_reachable",
+                "write_io": None}
+    try:
+        payload = perf._request(host, descriptor["port"], perf.WRITE_IO_PATH,
+                                token=None, timeout=timeout_s)
+    except perf.DashboardPerfError as exc:
+        return {**base, "probe": "failed", "reason": exc.reason,
+                "write_io": None}
+    write_io = payload.get("writeIo") if isinstance(payload, dict) else None
+    if not isinstance(write_io, dict):
+        return {**base, "probe": "failed", "reason": "malformed_response",
+                "write_io": None}
+    if write_io.get("instanceId") != descriptor["instanceId"]:
+        return {**base, "probe": "failed", "reason": "identity_mismatch",
+                "write_io": None}
+    return {**base, "probe": "ok", "reason": None, "write_io": write_io}
+
+
+def _gather_dashboard_disk_writes(
+    *, fetch=None, timeout_s: float = DASHBOARD_WRITE_IO_TIMEOUT_SECONDS,
+    discover: bool = True,
+) -> dict:
+    """Running dashboards' write telemetry for `performance.dashboard_disk_
+    writes` (#901 §5.6).
+
+    In the dashboard process the local instance's own snapshot is read
+    directly — no self-HTTP and no recursive gather. Anywhere else (the CLI,
+    the TUI) instances are discovered through their owner-readable
+    descriptors; a stale one (dead or reused pid) is ignored and never
+    deleted, because doctor is read-only. Discovery runs only for the
+    `cctally doctor` CLI (PR-11); with ``discover`` false nothing is probed and
+    the mode is ``not_probed``."""
+    import _lib_write_io as wio
+
+    local = wio.local_instance()
+    if local is not None:
+        return {"mode": "in_process", "instances": [{
+            "instance_id": local["instanceId"], "port": local["port"],
+            "pid": local["pid"], "probe": "ok", "reason": None,
+            "write_io": wio.write_io_payload(),
+        }]}
+    if not discover:
+        return {"mode": "not_probed", "instances": []}
+    probe = fetch or _fetch_dashboard_write_io
+    instances = [
+        probe(descriptor, timeout_s=timeout_s)
+        for descriptor in wio.read_instance_descriptors(_cctally_core.APP_DIR)
+        if wio.descriptor_is_live(descriptor)
+    ]
+    instances.sort(key=lambda entry: (entry["port"], entry["instance_id"]))
+    return {"mode": "discovery", "instances": instances}
+
+
 def _gather_statusline_pipeline(c, *, now_utc: dt.datetime) -> dict:
     """Read the #318 statusline pipeline without creating or pruning files."""
     now_epoch = int(now_utc.timestamp())
@@ -874,6 +946,26 @@ def _gather_codex_window_attribution_state() -> "dict | None":
         conn.close()
 
 
+def _journal_protocol_violation_rows(conn: sqlite3.Connection) -> list:
+    """Every stored protocol violation, parsed, in (batch, kind, fingerprint)
+    order: the doctor's shallow journal leg.
+
+    #901 Amendment 19 T1 (spec I1): the doctor holds every violation anyway,
+    so they are ordered here, in Python, where ``ORDER BY batch_id, kind,
+    fingerprint`` left a partial sorter over each batch's rows — and one batch
+    is not a bound. ``fingerprint`` is the primary key, so the order is total
+    and identical (text compared as UTF-8 bytes, SQLite's BINARY collation).
+    """
+    rows = conn.execute(
+        "SELECT batch_id, kind, fingerprint, violation_json "
+        "FROM journal_protocol_violations"
+    ).fetchall()
+    rows.sort(key=lambda row: tuple(
+        (value is not None, str(value or "").encode("utf-8"))
+        for value in row[:3]))
+    return [json.loads(str(row[3])) for row in rows]
+
+
 def _gather_accounts_state(now_utc: "dt.datetime") -> dict:
     """Best-effort account-attribution state for the doctor `accounts.*` legs
     (#341). Never raises: identity + registry reads are read-only and each guard
@@ -936,14 +1028,21 @@ def _gather_accounts_state(now_utc: "dt.datetime") -> dict:
         cutoff = (now_utc - dt.timedelta(days=7)).astimezone(
             dt.timezone.utc).isoformat()
         try:
-            for account_key, cnt in conn.execute(
-                "SELECT account_key, COUNT(*) FROM weekly_usage_snapshots "
-                "WHERE captured_at_utc >= ? GROUP BY account_key", (cutoff,)
-            ).fetchall():
+            # #901 Amendment 19 T1 (spec I1): counted in Python over the
+            # streamed rows, one total per class, where `GROUP BY
+            # account_key` sorted the trailing week's every snapshot through a
+            # temp b-tree — and a week of activity is not a bound.
+            attributed = unattributed = 0
+            for (account_key,) in conn.execute(
+                "SELECT account_key FROM weekly_usage_snapshots "
+                "WHERE captured_at_utc >= ?", (cutoff,)
+            ):
                 if account_key and account_key != "unattributed":
-                    state["recent_attributed"] += int(cnt)
+                    attributed += 1
                 else:
-                    state["recent_unattributed"] += int(cnt)
+                    unattributed += 1
+            state["recent_attributed"] += attributed
+            state["recent_unattributed"] += unattributed
         except sqlite3.DatabaseError:
             pass
     finally:
@@ -961,9 +1060,13 @@ def _gather_accounts_state(now_utc: "dt.datetime") -> dict:
 # contains no ingest and is not a whole tick; a whole tick is ingest plus
 # builder, and the builder is 70.5% of one measured live. Against a whole tick
 # the same probe is therefore 14%. It is one all-history
-# `load_codex_quota_observations` call whose SQL runs a `MAX(...) OVER
-# (PARTITION BY ...)` across every retained row (277,207 on that store) to
-# return one row per identity (16).
+# `load_codex_quota_observations(latest_per_identity=True)` call. Its SQL used
+# to run a `MAX(...) OVER (PARTITION BY ...)` across every retained row
+# (277,207 on that store; 565K and ~1.1 GB of temp-file writes per call on the
+# #901 live store); since #901 it reads the trigger-maintained
+# `codex_quota_partition_latest` summary plus one indexed seek per raw
+# partition. The memo below therefore remains a CPU optimisation and is no
+# longer load-bearing for disk writes.
 #
 # Only the ROWS are retained, and only while their evidence is unmoved. Every
 # `now`-derived interpretation over them is recomputed on every gather:
@@ -1249,6 +1352,7 @@ def doctor_gather_state(
     runtime_bind: "str | None" = None,
     deep: bool = False,
     force_cold_inputs: bool = False,
+    discover_dashboards: bool = False,
 ):
     """Gather doctor state while excluding cache-family replacement.
 
@@ -1262,6 +1366,11 @@ def doctor_gather_state(
     caller can obtain a genuinely fresh gather at a chosen instant. It exists
     for the equality gate that compares a reusing gather against a fresh one at
     an identical ``now_utc``; production callers leave it false.
+
+    ``discover_dashboards`` (PR-11) lets the gather probe other running
+    dashboards for their disk writes. Only the `cctally doctor` CLI passes it:
+    the TUI and every snapshot build gather on each rebuild, where serial
+    2-second probes of every live descriptor do not belong.
     """
     cache_lock = None
     cache_probe_allowed = not _cctally_core.CACHE_DB_PATH.exists()
@@ -1317,6 +1426,7 @@ def doctor_gather_state(
                 _cache_probe_allowed=cache_probe_allowed,
                 _cache_repair_marker=cache_repair_marker,
                 _force_cold_inputs=force_cold_inputs,
+                _discover_dashboards=discover_dashboards,
             )
     finally:
         if cache_lock is not None:
@@ -1334,6 +1444,7 @@ def _doctor_gather_state_impl(
     _cache_probe_allowed: bool,
     _cache_repair_marker: dict,
     _force_cold_inputs: bool = False,
+    _discover_dashboards: bool = False,
 ):
     """I/O chokepoint for `cctally doctor` (spec §7.2).
 
@@ -1727,6 +1838,7 @@ def _doctor_gather_state_impl(
         conv_rollup_sync_in_progress = False
         conversations_db_page_count = None
         conversations_db_freelist_count = None
+        conversations_db_page_size = None
         conversations_reclaim_pending = None
         codex_prune_refusals: list[dict] = []
         conversation_rollup_pricing_refusal: "dict | None" = None
@@ -1751,6 +1863,9 @@ def _doctor_gather_state_impl(
                         row = conn.execute("PRAGMA freelist_count").fetchone()
                         if row and row[0] is not None:
                             conversations_db_freelist_count = int(row[0])
+                        row = conn.execute("PRAGMA page_size").fetchone()
+                        if row and row[0] is not None:
+                            conversations_db_page_size = int(row[0])
                     except sqlite3.Error:
                         pass
                     try:
@@ -2407,14 +2522,8 @@ def _doctor_gather_state_impl(
                     if _cctally_core.DB_PATH.exists():
                         pc = _stats_ro_guarded()
                         try:
-                            protocol_rows = [
-                                json.loads(str(row[0]))
-                                for row in pc.execute(
-                                    "SELECT violation_json "
-                                    "FROM journal_protocol_violations "
-                                    "ORDER BY batch_id, kind, fingerprint"
-                                )
-                            ]
+                            protocol_rows = (
+                                _journal_protocol_violation_rows(pc))
                             journal_protocol_violations = [
                                 item for item in protocol_rows
                                 if not item.get("auditId")
@@ -2696,6 +2805,13 @@ def _doctor_gather_state_impl(
             _gather_codex_window_attribution_state()
             if _cache_probe_allowed else None)
 
+    # #901 §5.6: running dashboards' disk writes. Read-only; degrades.
+    try:
+        with _lib_perf.phase("doctor.dashboard_disk_writes"):
+            dashboard_disk_writes = _gather_dashboard_disk_writes(
+                discover=_discover_dashboards)
+    except Exception:  # noqa: BLE001 — a probe failure must not fail doctor
+        dashboard_disk_writes = {"mode": "error", "instances": []}
     return _lib_doctor.DoctorState(
         symlink_state=symlink_state,
         path_includes_local_bin=path_includes,
@@ -2792,6 +2908,8 @@ def _doctor_gather_state_impl(
         cache_db_freelist_count=cache_db_freelist_count,
         conversations_db_page_count=conversations_db_page_count,
         conversations_db_freelist_count=conversations_db_freelist_count,
+        conversations_db_page_size=conversations_db_page_size,
+        dashboard_disk_writes=dashboard_disk_writes,
         conversations_reclaim_pending=conversations_reclaim_pending,
         codex_quota_windows=codex_quota_windows,
         codex_hook_roots=codex_hook_roots,
@@ -2846,7 +2964,7 @@ def cmd_doctor(args: argparse.Namespace) -> int:
     # #279 S2 F5b: deep=True runs PRAGMA quick_check(1) — CLI-only (the
     # dashboard/TUI gather callers stay deep=False so their per-rebuild
     # gather never pays the multi-second cost on a large cache.db).
-    state = c.doctor_gather_state(deep=True)
+    state = c.doctor_gather_state(deep=True, discover_dashboards=True)
     report = _lib_doctor.run_checks(state)
     if getattr(args, "json", False):
         print(encode_dashboard_json(

package/bin/_cctally_five_hour.py

@@ -2689,10 +2689,10 @@ def cmd_five_hour_breakdown(args: argparse.Namespace) -> int:
                 ])
                 continue
             m = ev
-            cum = f"${m['blockCostUSD']:.6f}"
+            cum = _c._fmt_usd_accounting(m['blockCostUSD'], 6)
             marg = (
                 "n/a" if m["marginalCostUSD"] is None
-                else f"${m['marginalCostUSD']:.6f}"
+                else _c._fmt_usd_accounting(m['marginalCostUSD'], 6)
             )
             # #834 S1 (#836): the EFFECTIVE weekly value, never the raw one. A
             # weekly-clamped tick stored a reading no reader ever saw, and this

package/bin/_cctally_forecast.py

@@ -153,6 +153,25 @@ def _shape_week_samples(rows, *, include_held: bool,
     return out
 
 
+def _week_rows_by_capture(cursor, *, by_id: bool) -> list:
+    """One week's sample rows in capture order: ``captured_at_utc`` ascending,
+    then ``id`` when ``by_id`` (the row's trailing column, which this strips).
+
+    #901 Amendment 19 T1 (spec I1): the reader returns every row of the week
+    anyway, so ordering them here costs no structure beyond its own result,
+    where ``ORDER BY captured_at_utc`` sorted the whole week through a temp
+    b-tree — and one subscription week is not a bound. ``list.sort`` is stable
+    over the same scan SQLite's in-memory sorter consumed, so rows tied on one
+    capture instant keep the order they had.
+    """
+    rows = cursor.fetchall()
+    if by_id:
+        rows.sort(key=lambda row: (row[0], row[-1]))
+        return [row[:-1] for row in rows]
+    rows.sort(key=lambda row: row[0])
+    return rows
+
+
 def _fetch_current_week_snapshots(conn: sqlite3.Connection, now_utc: dt.datetime,
                                   *, account_key: "str | None" = None,
                                   include_held: bool = False,
@@ -264,6 +283,8 @@ def _fetch_current_week_snapshots(conn: sqlite3.Connection, now_utc: dt.datetime
         we_date = dt.date.fromisoformat(drow[1])
         week_start_at = dt.datetime.combine(ws_date, dt.time(0, 0), local_tz).astimezone(dt.timezone.utc)
         week_end_at = dt.datetime.combine(we_date + dt.timedelta(days=1), dt.time(0, 0), local_tz).astimezone(dt.timezone.utc)
+        # One date: `idx_usage_week_time` (week_start_date, captured_at_utc
+        # DESC, id DESC) serves this order outright, with no sorter.
         rows = conn.execute(
             "SELECT captured_at_utc, weekly_percent, five_hour_percent, "
             "       weekly_observation_held" + _owner_column + " "
@@ -293,16 +314,16 @@ def _fetch_current_week_snapshots(conn: sqlite3.Connection, now_utc: dt.datetime
             matching_texts.append(r[0])
     chosen_date = chosen[2]
     placeholders = ",".join("?" * len(matching_texts))
-    rows = conn.execute(
+    rows = _week_rows_by_capture(conn.execute(
         f"SELECT captured_at_utc, weekly_percent, five_hour_percent, "
-        f"       weekly_observation_held{_owner_column} "
+        f"       weekly_observation_held{_owner_column}"
+        f"{', id' if include_account else ''} "
         f"FROM weekly_usage_snapshots "
         f"WHERE (week_start_at IN ({placeholders}) "
         f"       OR (week_start_at IS NULL AND week_start_date = ?))"
-        f"{_acct_pred}{_held_pred} "
-        f"ORDER BY captured_at_utc{_sample_order}",
+        f"{_acct_pred}{_held_pred}",
         tuple(matching_texts) + (chosen_date,) + _acct_p,
-    ).fetchall()
+    ), by_id=include_account)
     samples = _shape_week_samples(rows, include_held=include_held,
                                   include_account=include_account)
     samples = [s for s in samples if s[0] <= now_utc]
@@ -2518,7 +2539,7 @@ def cmd_report(args: argparse.Namespace) -> int:
                 m_rows: list[list[str]] = []
                 for idx, m in enumerate(milestone_rows, start=1):
                     pct = f"{int(m['percent_threshold'])}%"
-                    cum = f"${float(m['cumulative_cost_usd']):.6f}"
+                    cum = c._fmt_usd_accounting(float(m['cumulative_cost_usd']), 6)
                     marg = c.observation_gap_marginal_cell(
                         m["marginal_cost_usd"],
                         withheld=(idx - 1) in gap_disclosure.withheld_indexes,

package/bin/_cctally_journal.py

@@ -2083,13 +2083,18 @@ _FILE_ACCOUNT_INSERT = (
 # to reach this statement for a record the map insert dropped, so the two guards
 # are belt-and-suspenders over disjoint failure modes: this one covers any
 # constraint the incarnation table might gain that the map table lacks.
+#
+# #901 §5.3c (W8): the MAX-set writes only when the incarnation advances, like
+# its ingest twin `_cctally_cache.set_codex_file_incarnation`, so replaying a
+# decision the store already holds issues no write.
 _FILE_INCARNATION_INSERT = (
     "INSERT OR IGNORE INTO codex_file_incarnations "
     "(file_identity, incarnation, updated_at_utc) "
     "VALUES (?,?,?) "
     "ON CONFLICT(file_identity) DO UPDATE SET "
-    "  incarnation = MAX(codex_file_incarnations.incarnation, excluded.incarnation), "
-    "  updated_at_utc = excluded.updated_at_utc"
+    "  incarnation = excluded.incarnation, "
+    "  updated_at_utc = excluded.updated_at_utc "
+    "WHERE excluded.incarnation > codex_file_incarnations.incarnation"
 )
 
 
@@ -2496,6 +2501,14 @@ _QUOTA_SNAPSHOT_UPSERT_CLAUSE = (
 )
 
 _QUOTA_SNAPSHOT_UPSERT = _QUOTA_SNAPSHOT_INSERT + _QUOTA_SNAPSHOT_UPSERT_CLAUSE
+
+# The natural key of `_QUOTA_SNAPSHOT_UPSERT_CLAUSE`, read before a replay
+# inserts (#901 W11): `(source, source_path, line_offset, logical_limit_key)`.
+_QUOTA_SNAPSHOT_STORED_ACCOUNT = (
+    "SELECT account_key FROM quota_window_snapshots "
+    "WHERE source = ? AND source_path = ? AND line_offset = ? "
+    "AND logical_limit_key = ?"
+)
 _QUOTA_SNAPSHOT_UPSERT_LEGACY = (
     _QUOTA_SNAPSHOT_INSERT_LEGACY + _QUOTA_SNAPSHOT_UPSERT_CLAUSE
 )
@@ -2695,8 +2708,20 @@ def _apply_quota_records(
         row_values = _quota_snapshot_values(rec, anchor)
         if not has_anchor:
             row_values = row_values[:-1]
+        # #901 §5.3c (W11, Q14): an INSERT into this AUTOINCREMENT table
+        # rewrites `sqlite_sequence` even when every row it carries is
+        # rejected, so replaying observations the walk already materialized
+        # wrote a page per ingest cycle. The stored row is read first and an
+        # insert that would change nothing is not issued; a genuine
+        # correction (a decision now governing a row stamped otherwise) still
+        # runs. AUTOINCREMENT and the sequence values are untouched.
+        stored = cache.execute(
+            _QUOTA_SNAPSHOT_STORED_ACCOUNT,
+            (row_values[0], row_values[2], row_values[3], row_values[6]),
+        ).fetchone()
         if not covered:
-            cache.execute(insert_sql, row_values)
+            if stored is None:
+                cache.execute(insert_sql, row_values)
             continue
         observed = rec.get("account")
         payload = rec.get("payload") or {}
@@ -2719,6 +2744,8 @@ def _apply_quota_records(
                 )
         values = list(row_values)
         values[16] = decided
+        if stored is not None and stored[0] == decided:
+            continue  # the upsert's guarded DO UPDATE would change nothing
         cache.execute(upsert_sql, tuple(values))
 
 
@@ -3259,7 +3286,12 @@ def _cache_applier(decoded, *, cursor=None, covered_to=None,
             return stop_idx
         try:
             import _cctally_cache
+            import _cctally_store
             cache.execute("PRAGMA busy_timeout=15000")
+            # #901 §4.7 (Q11): a raw cache writer, so it holds its statement
+            # journals in memory like the store openers' writers do. Only the
+            # temp store; locks and transaction order are unchanged.
+            _cctally_store.apply_writer_temp_store(cache)
             # Read and check the predecessor BEFORE the transaction opens
             # (spec §4.3, as corrected). `prior_is_extendable` checks contiguity
             # against this cycle's STARTING cursor — a predecessor applied
@@ -8117,6 +8149,8 @@ _REBUILD_REQUIRED_TABLES = frozenset(
 )
 _REBUILD_REQUIRED_INDEXES = frozenset(
     {
+        "idx_budget_milestones_alert_digest",
+        "idx_budget_milestones_codex_digest",
         "idx_budget_milestones_journal_id",
         "idx_budget_milestones_journal_id_null",
         "idx_cost_week_start_at_time",
@@ -8128,6 +8162,7 @@ _REBUILD_REQUIRED_INDEXES = frozenset(
         "idx_five_hour_blocks_block_start",
         "idx_five_hour_blocks_journal_id",
         "idx_five_hour_blocks_journal_id_null",
+        "idx_five_hour_milestones_alert_digest",
         "idx_five_hour_milestones_block",
         "idx_five_hour_milestones_journal_id",
         "idx_five_hour_milestones_journal_id_null",
@@ -8135,17 +8170,36 @@ _REBUILD_REQUIRED_INDEXES = frozenset(
         "idx_five_hour_reset_events_journal_id_null",
         "idx_journal_protocol_violations_batch",
         "idx_meter_rate_change_events_key",
+        "idx_percent_milestones_alert_digest",
         "idx_percent_milestones_journal_id",
         "idx_percent_milestones_journal_id_null",
+        "idx_percent_milestones_week_date",
+        "idx_project_budget_milestones_alert_digest",
         "idx_project_budget_milestones_journal_id",
         "idx_project_budget_milestones_journal_id_null",
+        "idx_projected_milestones_alert_digest",
+        "idx_projected_milestones_codex_digest",
         "idx_projected_milestones_journal_id",
         "idx_projected_milestones_journal_id_null",
         "idx_quota_blocks_active",
+        "idx_quota_blocks_digest",
+        "idx_quota_blocks_root_group_pairs",
+        "idx_quota_blocks_weekly_reset_order",
+        "idx_quota_blocks_weekly_single_root_order",
         "idx_quota_milestones_active",
+        "idx_quota_milestones_digest",
+        "idx_quota_milestones_root",
+        "idx_quota_projection_state_digest",
         "idx_quota_threshold_events_active",
+        "idx_quota_threshold_events_digest",
+        "idx_quota_threshold_events_root",
+        "idx_usage_subscription_anchor_order",
+        "idx_usage_subscription_anchor_pick",
+        "idx_usage_week_boundary_group",
+        "idx_usage_week_date_group",
         "idx_usage_week_start_at_time",
         "idx_usage_week_time",
+        "idx_week_reset_events_effective_order",
         "idx_week_reset_events_journal_id",
         "idx_week_reset_events_journal_id_null",
         "idx_week_reset_events_legacy_tuple",
@@ -8161,7 +8215,7 @@ _REBUILD_REQUIRED_INDEXES = frozenset(
 # omitted column, constraint, partial predicate, or index definition.  An epoch
 # schema change must update this contract alongside STATS_INDEX_EPOCH.
 _REBUILD_SCHEMA_FINGERPRINT = (
-    "e0f2225f00843952b4887fa8afb046edacd3da0642d0f402ebaa5219a6e30697"
+    "2ef6dab067703e612360245f9fbe4522290046dc6d8d7b009798a384cb5c27b8"
 )
 
 
@@ -9006,7 +9060,11 @@ def _open_publication_connection(destination) -> sqlite3.Connection:
         recover_interruptions=False,
     )
     try:
-        _cctally_store.apply_policy(conn, "stats")
+        # #901 §4.7 does not enumerate this writer, so it keeps SQLite's
+        # default temp store: the publication rewrites whole relations inside
+        # one transaction, and an in-memory statement journal for that would
+        # be proportional to the index.
+        _cctally_store.apply_policy(conn, "stats", memory_temp_store=False)
     except BaseException:
         try:
             conn.close()
@@ -10527,6 +10585,10 @@ def _run_bounded_recovery(
             try:
                 cache = sqlite3.connect(str(cache_path), timeout=15.0)
                 cache.execute("PRAGMA busy_timeout=15000")
+                # #901 §4.7 (Q11): statement journals in memory, before the
+                # chunk's transaction; nothing else about the chunk changes.
+                import _cctally_store
+                _cctally_store.apply_writer_temp_store(cache)
                 cache.execute("BEGIN IMMEDIATE")
                 if chunk_index > 0:
                     seq, digest = _recovery_state(cache)