cctally 1.113.0 → 1.115.0

package/bin/_lib_doctor.py

@@ -232,6 +232,10 @@ class DoctorState:
     # evidence. None is the normal state; each record contains counts/reasons
     # but never configured paths or provider identifiers.
     codex_prune_refusals: Optional[list[dict]] = None
+    codex_compressed_census: Optional[dict] = None
+    codex_decoder_capability: Optional[str] = None
+    codex_container_status: Optional[dict] = None
+    codex_maintenance_debt: Optional[dict] = None
     # #705: the conversations store's refused-pricing-write record, read
     # verbatim from cache_meta. None means no refusal is recorded. A record
     # that exists but cannot be parsed arrives as {"__malformed__": True}
@@ -343,6 +347,18 @@ class DoctorState:
     # retained corpus from unreadable metadata.
     codex_project_metadata_health: Optional[dict] = None
     codex_project_metadata_error: Optional[str] = None
+    # #825/#832 (spec section 8, F9): the account-bound legacy-writer evidence.
+    # `{"available": bool, "cutoverId", "excludedCount", "coordinateDigest",
+    # "evidence": <sidecar document or None>}` from the validated admission
+    # summary (a deep run substitutes its own whole-journal recomputation).
+    # None / available=False is reported as unavailable, never as zero.
+    legacy_writer: Optional[dict] = None
+    # #825/#832 (spec section 8, F16): the outcome quarantine, read from the
+    # validated index. `{"available": bool, "triggered": bool, "accounts":
+    # [{"account", "accountLabel", "accountingPaused", "controlPaused",
+    # "accountingSince", "controlSince"}]}`. None / available=False is
+    # reported as unavailable, never as OK.
+    outcome_quarantine: Optional[dict] = None
     # Beta-channel (spec 2026-07-21 §3): the configured RELEASE channel
     # (stable|beta) that `cctally update` tracks — DISTINCT from the preview
     # `channel` (prod|preview) above. Populated by doctor_gather_state from a
@@ -391,6 +407,11 @@ class DoctorState:
     journal_cursor_lag_bytes: Optional[int] = None
     journal_hw_segment: Optional[str] = None
     journal_cursor_segment: Optional[str] = None
+    #   * journal_cursor_invalid (#946) — the applied cursor names no safe
+    #     endpoint: past its segment's size, or inside a line. The lag beside
+    #     it is then not a measure of anything consumed, so it is never
+    #     reported as caught up.
+    journal_cursor_invalid: bool = False
     journal_heal_incidents: Optional[list] = None
     journal_heal_detections: Optional[list] = None
     #   * retained_artifacts (#496 S6 §7.3) — the read-only retention scan
@@ -423,6 +444,15 @@ class DoctorState:
     journal_protocol_violations: Optional[list] = None
     journal_protocol_acknowledged: Optional[list] = None
     journal_protocol_error: Optional[str] = None
+    #   * journal_listing_error (#825/#832 fix round K11, K9K10-R6) — why the
+    #     segment listing failed. An unlistable journal is never an empty one.
+    #   * journal_scan_error (K9K10-R6/R11) — why the deep scan could not
+    #     complete: an unreadable segment, a raising admission-boundary lookup
+    #     or an unreadable excluded population. The scan's checks are then
+    #     unavailable — never zero excluded records, never an unfiltered
+    #     conflict scan.
+    journal_listing_error: Optional[str] = None
+    journal_scan_error: Optional[str] = None
     # Multi-account attribution (#341). A dict (None when unavailable) with:
     #   * claude_identity_status — "identified" | "stably_absent" | "torn"
     #   * claude_email — the active Claude email (or None)
@@ -441,6 +471,14 @@ class DoctorState:
     # known file-level backup/sync root. Only provider/status are retained so
     # reports never expose the machine-specific data path.
     backup_sync_state: Optional[dict] = None
+    # #901: transcript-store page size, so `db.conversations_reclaimable`
+    # judges the paced-reclaim thresholds on observed bytes.
+    conversations_db_page_size: Optional[int] = None
+    # #901 §5.6: running dashboards' write telemetry, gathered read-only —
+    # the local instance's own snapshot in the dashboard process, or
+    # descriptor discovery plus one bounded loopback probe per live
+    # instance elsewhere. {"mode", "instances": [...]}; None = not gathered.
+    dashboard_disk_writes: Optional[dict] = None
 
 
 @dataclasses.dataclass(frozen=True)
@@ -1011,7 +1049,7 @@ def _check_db_version_ahead(s: DoctorState) -> CheckResult:
             # current index as a mismatch; keep this in lockstep with core
             # (#496 S5b §6.1). It stays a literal because this kernel is pure and
             # must not import `_cctally_core`.
-            epoch = 1016
+            epoch = 1018
         mismatch = uv > legacy_head and uv != epoch
         return {"user_version": uv, "legacy_head": legacy_head, "epoch": epoch,
                 "mismatch": mismatch}
@@ -1346,6 +1384,95 @@ def _check_data_codex_replay(s: DoctorState) -> CheckResult:
     )
 
 
+def _check_data_codex_compressed_rollouts(s: DoctorState) -> CheckResult:
+    """#968 5.6 with operator clarifications D2, D3 and D6.
+
+    `warn` when any of three conditions holds: compressed rollouts exist and
+    no decoder is available; a verification ended `unverified` (D3, at once,
+    never debt); verification, reading or deletion work has been pending for
+    more than 24 hours (D2, D6). The summary states each true condition's
+    sentence once, joined by a single space, in that order. Otherwise pending
+    work is `ok` "continuing", and the all-clear sentence is used only when
+    no compressed rollout is unread, pending or unverified. Never FAIL: a
+    missing optional decoder is an environment limitation.
+    """
+    if s.codex_compressed_census is None:
+        return CheckResult(
+            id="data.codex_compressed_rollouts", title="Compressed Codex rollouts",
+            severity="warn", summary="unavailable (compressed Codex rollout census)",
+            remediation=None, details={"available": False})
+    census = s.codex_compressed_census
+    compressed = int(census.get("compressedOnly", 0) or 0)
+    never = int(census.get("neverIngested", 0) or 0)
+    incomplete = int(census.get("retainedIncomplete", 0) or 0)
+    unverified = int(census.get("unverified", 0) or 0)
+    debt = s.codex_maintenance_debt or {}
+    maintenance_partial = (s.codex_maintenance_debt is None
+                           or debt.get("coverage") == "partial")
+    verifications = int(debt.get("verifications", 0) or 0)
+    deletions = int(debt.get("deletions", 0) or 0)
+    no_decoder = s.codex_decoder_capability == "unavailable"
+    # D6: with a decoder, an unread or partly read compressed rollout is
+    # pending reading work; without one it is the no-decoder condition.
+    reads = 0 if no_decoder else never + incomplete
+    details = {
+        "compressedOnly": compressed,
+        "retainedComplete": int(census.get("retainedComplete", 0) or 0),
+        "retainedIncomplete": incomplete,
+        "neverIngested": never,
+        "unverified": unverified,
+        "verificationDebt": verifications,
+        "readDebt": reads,
+        "pruneDebt": deletions,
+    }
+    if maintenance_partial:
+        details["maintenanceCoverage"] = "partial"
+        if s.codex_maintenance_debt is None:
+            details["verificationDebt"] = None
+            details["pruneDebt"] = None
+    status = s.codex_container_status or {}
+    if status.get("census") == "partial":
+        details["census"] = "partial"
+        details["observedAt"] = status.get("observedAt")
+    if compressed:
+        details["decoderAvailable"] = not no_decoder
+    pending = bool(verifications or reads or deletions)
+    sentences = []
+    if compressed and no_decoder:
+        sentences.append(
+            f"{compressed} compressed Codex rollouts can't be read on this "
+            f"Python ({never} never ingested). Cached history was kept. "
+            "Install `backports.zstd` or use Python 3.14+.")
+    if unverified:
+        sentences.append(
+            f"{unverified} compressed Codex rollouts kept their cached history "
+            "but couldn't be verified against it.")
+    if pending and debt.get("olderThan24h"):
+        sentences.append(
+            "Codex history maintenance has been pending for more than 24 hours "
+            f"({verifications} verifications, {reads} reads, {deletions} "
+            "deletions).")
+    if sentences:
+        severity, summary = "warn", " ".join(sentences)
+    elif pending:
+        severity = "ok"
+        summary = "Codex history maintenance is continuing in the background."
+    elif maintenance_partial:
+        severity = "warn"
+        summary = "unavailable (compressed Codex rollout census)"
+    else:
+        severity = "ok"
+        summary = "All compressed Codex rollouts are readable and verified."
+    return CheckResult(
+        id="data.codex_compressed_rollouts",
+        title="Compressed Codex rollouts",
+        severity=severity,
+        summary=summary,
+        remediation=None,
+        details=details,
+    )
+
+
 def _check_data_codex_prune_safety(s: DoctorState) -> CheckResult:
     """Surface a fail-closed orphan-prune decision instead of silent loss."""
     records = [
@@ -2916,92 +3043,119 @@ def _check_db_reclaimable(s: DoctorState) -> CheckResult:
 
 
 def _check_db_conversations_reclaimable(s: DoctorState) -> CheckResult:
-    """Surface transcript-store free pages without mutating the DB (#320)."""
+    """Transcript free space against the paced-reclaim policy (#320, #780,
+    #901). Read-only; judged on the OBSERVED freelist, never on a record.
+
+    OK for retained slack below the reclaim start threshold — reusable pages
+    kept on purpose (operator decision Q2). WARN for an eligible backlog being
+    paced, including one whose attempts are failing (`reclaim_failure`); a
+    scheduled wait is not "stuck". FAIL at the hard ceiling, where transcript
+    rebuilds are refused."""
+    import _lib_conversation_retention as _conv_retention
+
     page_count = s.conversations_db_page_count
     freelist_count = s.conversations_db_freelist_count
-    ratio = None
-    if (
-        isinstance(page_count, int)
-        and not isinstance(page_count, bool)
-        and page_count > 0
-        and isinstance(freelist_count, int)
-        and not isinstance(freelist_count, bool)
+    page_size = s.conversations_db_page_size
+    measured = (
+        all(isinstance(v, int) and not isinstance(v, bool)
+            for v in (page_count, freelist_count, page_size))
+        and page_count > 0 and page_size > 0
         and 0 <= freelist_count <= page_count
-    ):
-        ratio = freelist_count / page_count
+    )
+    geometry = (
+        _conv_retention.StoreGeometry(page_count, freelist_count, page_size)
+        if measured else None)
+    record = (s.conversations_reclaim_pending
+              if isinstance(s.conversations_reclaim_pending, dict) else None)
+    episode = bool(record and record.get("eligible") is True)
+    failure = record.get("last_failure") if record else None
+    if not isinstance(failure, dict):
+        failure = None
+    free_bytes = geometry.free_bytes if geometry is not None else None
     details = {
         "conversations_db_page_count": page_count,
         "conversations_db_freelist_count": freelist_count,
-        "conversations_db_free_ratio": ratio,
-        "warn_ratio": DOCTOR_RECLAIMABLE_WARN_RATIO,
+        "conversations_db_page_size": page_size,
+        "conversations_db_free_ratio": (
+            freelist_count / page_count if geometry is not None else None),
+        "reclaimable_bytes": free_bytes,
+        "reclaim_start_bytes": _conv_retention.RECLAIM_START_BYTES,
+        "reclaim_start_ratio": _conv_retention.RECLAIM_START_RATIO,
+        "reclaim_stop_bytes": _conv_retention.RECLAIM_STOP_BYTES,
+        "reclaim_stop_ratio": _conv_retention.RECLAIM_STOP_RATIO,
+        "reclaim_ceiling_bytes": _conv_retention.RECLAIM_CEILING_BYTES,
+        "reclaim_episode_active": episode if record is not None else None,
+        "reclaim_failure": failure,
     }
-    # #780: the reclaim backlog rides on this check rather than adding a new
-    # check id, and it contributes NOTHING — no detail key, no severity change
-    # — on a store with no pending record. That is every store that has never
-    # fallen behind, so an install in the ordinary state renders exactly what
-    # it rendered before.
-    pending = s.conversations_reclaim_pending
-    if pending:
-        import _lib_conversation_retention as _conv_retention
-
-        backlog = _conv_retention.reclaim_backlog_bytes(pending)
-        details["reclaim_pending"] = pending
-        details["reclaim_backlog_bytes"] = backlog
-        details["reclaim_ceiling_bytes"] = _conv_retention.RECLAIM_CEILING_BYTES
-        if _conv_retention.reclaim_backlog_over_ceiling(pending):
-            return CheckResult(
-                id="db.conversations_reclaimable",
-                title="Reclaimable transcript space",
-                severity="fail",
-                summary=(
-                    f"reclaim backlog {_gib_text(backlog)} is at or over the "
-                    f"{_gib_text(_conv_retention.RECLAIM_CEILING_BYTES)} "
-                    "ceiling; transcript rebuilds are refused"
-                ),
-                remediation=(
-                    "Run `cctally db vacuum --db conversations` to drain the "
-                    "backlog, then `cctally db checkpoint --db conversations`."
-                ),
-                details=details,
-            )
-        if _conv_retention.reclaim_backlog_escalated(pending):
-            return CheckResult(
-                id="db.conversations_reclaimable",
-                title="Reclaimable transcript space",
-                severity="warn",
-                summary=(
-                    f"reclaim backlog {_gib_text(backlog)} is draining across "
-                    "continuation passes"
-                ),
-                remediation=(
-                    "No action is required unless it keeps growing; "
-                    "`cctally db vacuum --db conversations` drains it now."
-                ),
-                details=details,
-            )
-    if ratio is not None and ratio >= DOCTOR_RECLAIMABLE_WARN_RATIO:
+    title = "Reclaimable transcript space"
+    if _conv_retention.backlog_over_ceiling(free_bytes):
         return CheckResult(
-            id="db.conversations_reclaimable",
-            title="Reclaimable transcript space",
-            severity="warn",
+            id="db.conversations_reclaimable", title=title, severity="fail",
             summary=(
-                f"high — {ratio * 100:.1f}% of conversations.db pages are free"
+                f"reclaim backlog {_gib_text(free_bytes)} is at or over the "
+                f"{_gib_text(_conv_retention.RECLAIM_CEILING_BYTES)} "
+                "ceiling; transcript rebuilds are refused"
             ),
             remediation=(
-                "Run `cctally db vacuum --db conversations` to reclaim disk space."
+                "Run `cctally db vacuum --db conversations` to drain the "
+                "backlog, then `cctally db checkpoint --db conversations`."
             ),
             details=details,
         )
+    if _conv_retention.reclaim_episode_active(geometry, episode):
+        # Q9: a paced wait is not a refused attempt. A planner refusal is an
+        # in-memory pass record of the running dashboard (it writes nothing
+        # durable), read from `writeIo.reclaimRefusal`; a connection-settings
+        # or SQLite failure stays the durable `reclaim_failure`, as before.
+        refusal = _latest_reclaim_refusal(s.dashboard_disk_writes)
+        wait = ("refused" if refusal is not None
+                else "failing" if failure is not None else "paced")
+        remediation = (
+            "No action is required unless it keeps growing; "
+            "`cctally db vacuum --db conversations` drains it now.")
+        if refusal is not None:
+            remediation = (
+                "Reclaim attempts are being refused "
+                f"({refusal['reason'].replace('_', ' ')}); "
+                "`cctally db vacuum --db conversations` reclaims the space "
+                "at once.")
+        return CheckResult(
+            id="db.conversations_reclaimable", title=title, severity="warn",
+            summary=(
+                f"Reclaiming {_gib_text(free_bytes)} of free transcript "
+                "space at a paced rate."
+            ),
+            remediation=remediation,
+            details={**details, "reclaim_wait": wait,
+                     "reclaim_refusal": refusal},
+        )
     return CheckResult(
-        id="db.conversations_reclaimable",
-        title="Reclaimable transcript space",
-        severity="ok",
-        summary="below threshold",
-        remediation=None,
-        details=details,
+        id="db.conversations_reclaimable", title=title, severity="ok",
+        summary="below threshold", remediation=None, details=details,
     )
 
 
+def _latest_reclaim_refusal(gathered) -> "dict | None":
+    """The newest planner refusal any running dashboard reports in its
+    `writeIo.reclaimRefusal`, with that dashboard's port; None when none
+    does (or no dashboard runs)."""
+    latest = None
+    entries = gathered.get("instances") if isinstance(gathered, dict) else None
+    for entry in entries or ():
+        if not isinstance(entry, dict) or entry.get("probe") != "ok":
+            continue
+        refusal = (entry.get("write_io") or {}).get("reclaimRefusal")
+        if (not isinstance(refusal, dict)
+                or not isinstance(refusal.get("reason"), str)
+                or not isinstance(refusal.get("at"), str)):
+            continue
+        candidate = {"reason": refusal["reason"], "at": refusal["at"],
+                     "port": entry.get("port")}
+        if latest is None or candidate["at"] > latest["at"]:
+            latest = candidate
+    return latest
+
+
 #: A stuck reclaim entry has persisted past this, so no pass will clear it.
 _RECLAIM_STUCK_AFTER_SECONDS = 24 * 3600
 
@@ -3238,6 +3392,28 @@ _JOURNAL_CURSOR_LAG_WARN_BYTES = 4 * 1024 * 1024
 _JOURNAL_HEAL_RECENT_SECONDS = 7 * 24 * 3600
 
 
+def _journal_unreadable_remediation(s: DoctorState) -> str:
+    """K9K10-R6: the remediation for a journal doctor could not read. Fix
+    round K12 (K11R-12): it names the resolved data directory (a dev
+    checkout or `CCTALLY_DATA_DIR` is not the default path)."""
+    journal = f"{str(s.app_dir or '').rstrip('/')}/journal/"
+    return (f"Check the permissions of {journal} and the disk, then run "
+            "`cctally doctor --deep` again")
+
+
+def _journal_scan_unavailable(check_id: str, title: str, s: DoctorState,
+                              details: dict) -> CheckResult:
+    """A deep-scan check the scan could not complete (K9K10-R6): WARN,
+    unavailable, with the cause."""
+    return CheckResult(
+        id=check_id, title=title, severity="warn",
+        summary=f"unavailable ({s.journal_scan_error})",
+        remediation=_journal_unreadable_remediation(s),
+        details={**details, "scanned": True, "available": False,
+                 "error": s.journal_scan_error},
+    )
+
+
 def _check_journal_presence(s: DoctorState) -> CheckResult:
     """The journal directory exists and is appendable. A pre-cutover (legacy)
     install has NO journal yet — that is INFO (OK), never a FAIL."""
@@ -3249,6 +3425,15 @@ def _check_journal_presence(s: DoctorState) -> CheckResult:
         )
     details = {"present": True, "appendable": s.journal_appendable,
                "segments": s.journal_segment_count}
+    if s.journal_listing_error:
+        return CheckResult(
+            id="journal.presence", title="Journal", severity="warn",
+            summary=(f"segment listing unavailable "
+                     f"({s.journal_listing_error})"),
+            remediation=_journal_unreadable_remediation(s),
+            details={**details, "segments": None,
+                     "listingError": s.journal_listing_error},
+        )
     if s.journal_appendable is False:
         return CheckResult(
             id="journal.presence", title="Journal", severity="warn",
@@ -3272,6 +3457,9 @@ def _check_journal_integrity(s: DoctorState) -> CheckResult:
             id="journal.integrity", title="Journal integrity", severity="ok",
             summary="no journal", remediation=None, details={"present": False},
         )
+    if s.journal_scan_error:
+        return _journal_scan_unavailable(
+            "journal.integrity", "Journal integrity", s, {})
     if s.journal_malformed_count is None:
         return CheckResult(
             id="journal.integrity", title="Journal integrity", severity="ok",
@@ -3313,6 +3501,16 @@ def _check_journal_index_freshness(s: DoctorState) -> CheckResult:
     details = {"lag_bytes": lag, "hw_segment": s.journal_hw_segment,
                "cursor_segment": s.journal_cursor_segment,
                "warn_bytes": _JOURNAL_CURSOR_LAG_WARN_BYTES}
+    if s.journal_cursor_invalid:
+        # #946: lag is computed from the safe applied cursor, and this one is
+        # not safe, so no amount of lag here means "caught up".
+        details["cursor_invalid"] = True
+        return CheckResult(
+            id="journal.index_freshness", title="Journal index", severity="warn",
+            summary="index cursor is not at a journal line boundary",
+            remediation="Run `cctally db rebuild --db stats`",
+            details=details,
+        )
     if lag == 0:
         return CheckResult(
             id="journal.index_freshness", title="Journal index", severity="ok",
@@ -3547,6 +3745,9 @@ def _check_journal_conflicts(s: DoctorState) -> CheckResult:
             remediation=None,
             details={"scanned": True, "available": False, "conflicts": None},
         )
+    if s.journal_scan_error:
+        return _journal_scan_unavailable(
+            "journal.conflicts", "Journal conflicts", s, {"conflicts": None})
     if s.journal_conflicts is None:
         return CheckResult(
             id="journal.conflicts", title="Journal conflicts", severity="ok",
@@ -3585,6 +3786,283 @@ def _check_journal_conflicts(s: DoctorState) -> CheckResult:
     )
 
 
+def _check_journal_legacy_writer(s: DoctorState) -> CheckResult:
+    """#825/#832 (spec section 8, F9, operator Q4): records an older cctally
+    process wrote after the account-bound cutover are excluded from current
+    accounting. WARN while the latest excluded population was first observed
+    under seven days ago; OK with a historical note after seven quiet days.
+    Never asserts that an old writer is alive, and never reports a missing
+    summary as zero. An incomplete legacy spool inventory is also a WARN,
+    independently of the excluded-record count (spec revision 5, section
+    8; `_with_legacy_spool_inventory`)."""
+    result = _legacy_writer_count_result(s)
+    inventory = (s.legacy_writer or {}).get("legacySpoolInventory")
+    if not inventory or inventory.get("available", False):
+        return result
+    return _with_legacy_spool_inventory(result, inventory)
+
+
+def _with_legacy_spool_inventory(result: CheckResult,
+                                 inventory: dict) -> CheckResult:
+    """Spec revision 5 (section 8): an incomplete legacy spool inventory is a
+    WARN independently of the excluded-record count. It names the path, the
+    failed operation and the error, never claims an old writer exists, and
+    says detection is paused only when the validated index holds the
+    durable `inventory-incomplete` marker. An inventory that failed for any
+    other reason (fix round K12, K11R-13) names no file: it is reported
+    unavailable with its cause."""
+    if inventory.get("unavailableCause") and not inventory.get("path"):
+        return _with_unavailable_spool_inventory(
+            result, inventory, inventory["unavailableCause"])
+    text = LEGACY_SPOOL_INVENTORY_TEXT.format(
+        path=inventory.get("path"), operation=inventory.get("operation"),
+        error=inventory.get("error"))
+    if inventory.get("paused"):
+        text += " " + LEGACY_SPOOL_INVENTORY_PAUSED_TEXT
+    note = "legacy status-line inventory unavailable"
+    if result.severity == "warn":
+        summary = f"{result.summary}; {note}"
+        remediation = (f"{result.remediation} {text}" if result.remediation
+                       else text)
+    else:
+        summary = (f"{note} ({inventory.get('operation')} "
+                   f"{inventory.get('path')}: {inventory.get('error')})")
+        remediation = text
+    return CheckResult(
+        id=result.id, title=result.title, severity="warn", summary=summary,
+        remediation=remediation,
+        details={**(result.details or {}),
+                 "legacySpoolInventory": dict(inventory)},
+    )
+
+
+def _with_unavailable_spool_inventory(result: CheckResult, inventory: dict,
+                                      cause: str) -> CheckResult:
+    """`_with_legacy_spool_inventory` for an inventory that names no file:
+    a WARN, "legacy status-line inventory unavailable ({cause})", which keeps
+    the excluded-record half's own summary and remediation."""
+    note = f"legacy status-line inventory unavailable ({cause})"
+    if result.severity == "warn":
+        summary, remediation = f"{result.summary}; {note}", result.remediation
+    else:
+        summary, remediation = note, None
+    return CheckResult(
+        id=result.id, title=result.title, severity="warn", summary=summary,
+        remediation=remediation,
+        details={**(result.details or {}),
+                 "legacySpoolInventory": dict(inventory)},
+    )
+
+
+def _legacy_writer_count_result(s: DoctorState) -> CheckResult:
+    """The excluded-record half of `journal.legacy_writer`."""
+    import _lib_legacy_writer_evidence as _lw
+
+    data = s.legacy_writer
+    if data and data.get("unavailableCause"):
+        # K9K10-R6/R11: the deep recomputation could not complete. The count
+        # is unavailable — never zero, never the stale summary.
+        return CheckResult(
+            id="journal.legacy_writer", title="Legacy writer",
+            severity="warn",
+            summary=f"unavailable ({data['unavailableCause']})",
+            remediation=_journal_unreadable_remediation(s),
+            details={"available": False,
+                     "unavailableCause": data["unavailableCause"]},
+        )
+    if not data or not data.get("available"):
+        # No current summary (for example an older process republished its
+        # own epoch). The durable sidecar alone still proves an excluded
+        # population and when it was first observed, so it decides the leg;
+        # without one the leg is unavailable, never zero.
+        sidecar = _lw.from_document((data or {}).get("evidence"))
+        if sidecar is None or sidecar.excluded_count <= 0:
+            return CheckResult(
+                id="journal.legacy_writer", title="Legacy writer",
+                severity="ok",
+                summary="unavailable (no current admission summary)",
+                remediation=None,
+                details={"available": False},
+            )
+        verdict = _lw.classify(sidecar, excluded_count=sidecar.excluded_count,
+                               now=s.now_utc)
+        return _legacy_writer_verdict_result(
+            verdict, count=sidecar.excluded_count,
+            details={"available": False, "source": "evidence-sidecar",
+                     "cutoverId": sidecar.cutover_id,
+                     "excludedCount": sidecar.excluded_count,
+                     "state": verdict.state,
+                     "lastSeenAt": verdict.last_seen_at})
+    cutover_id = data.get("cutoverId")
+    count = int(data.get("excludedCount") or 0)
+    if cutover_id is None:
+        return CheckResult(
+            id="journal.legacy_writer", title="Legacy writer", severity="ok",
+            summary="no account-bound cutover yet", remediation=None,
+            details={"available": True, "cutoverId": None,
+                     "excludedCount": count, "state": "none",
+                     "lastSeenAt": None},
+        )
+    # A missing or stale sidecar reads as "first observed now", which can only
+    # lengthen a warning (spec section 8).
+    evidence = _lw.observe(
+        _lw.from_document(data.get("evidence")), cutover_id=cutover_id,
+        excluded_count=count, coordinate_digest=data.get("coordinateDigest"),
+        now=s.now_utc)
+    verdict = _lw.classify(evidence, excluded_count=count, now=s.now_utc)
+    details = {"available": True, "cutoverId": cutover_id,
+               "excludedCount": count, "state": verdict.state,
+               "lastSeenAt": verdict.last_seen_at}
+    if verdict.state == "none":
+        return CheckResult(
+            id="journal.legacy_writer", title="Legacy writer", severity="ok",
+            summary="no legacy writes since the account-bound cutover",
+            remediation=None, details=details,
+        )
+    return _legacy_writer_verdict_result(verdict, count=count, details=details)
+
+
+def _legacy_writer_verdict_result(verdict, *, count: int,
+                                  details: dict) -> CheckResult:
+    """The WARN (recent) or historical OK (quiet) result in the approved
+    spec-section-8 content: the count, the last-seen time and the remedy."""
+    import _lib_legacy_writer_evidence as _lw
+
+    if verdict.state == "recent":
+        return CheckResult(
+            id="journal.legacy_writer", title="Legacy writer", severity="warn",
+            summary=(f"{count} record(s) an older cctally process wrote after "
+                     "the upgrade were excluded from accounting (last seen "
+                     f"{verdict.last_seen_at})"),
+            remediation=_lw.REMEDY, details=details,
+        )
+    return CheckResult(
+        id="journal.legacy_writer", title="Legacy writer", severity="ok",
+        summary=(f"no legacy writes in the last {_lw.QUIET_DAYS} days "
+                 f"({count} excluded in total, last seen "
+                 f"{verdict.last_seen_at})"),
+        remediation=None, details=details,
+    )
+
+
+#: Spec revision 5 (section 8), operator-owned wording, verbatim: an
+#: incomplete legacy spool inventory, and the sentence added when the
+#: validated index holds its durable `inventory-incomplete` marker.
+LEGACY_SPOOL_INVENTORY_TEXT = (
+    "cctally cannot read {path} ({operation}: {error}), one of the "
+    "status-line files an older cctally release used. Until it can, cctally "
+    "cannot tell whether an older process changed it. Check the file's "
+    "permissions and the disk.")
+LEGACY_SPOOL_INVENTORY_PAUSED_TEXT = (
+    "Automatic credit and reset detection is paused because of this, and "
+    "making the file readable again does not end the pause (see "
+    "`accounting.outcome_quarantine`); usage recording continues.")
+
+
+#: Operator-approved wording (#825/#832 spec section 8), verbatim.
+OUTCOME_QUARANTINE_ACCOUNTING_TEXT = (
+    "Automatic credit and reset detection is paused for {account} since "
+    "{time} because an older cctally process wrote data after the upgrade. It "
+    "resumes only after cctally verifies a clean reading for this account, "
+    "typically the first one after an idle period spanning a weekly reset; "
+    "there is no guaranteed time. If your usage was reset in place meanwhile, "
+    "record it with `cctally record-credit`.")
+OUTCOME_QUARANTINE_CONTROL_TEXT = (
+    "Status-line drop detection also waits for a successful usage refresh for "
+    "this account.")
+#: Spec revision 3 (section 8; operator decision dec-2b5bcf910816), verbatim:
+#: an account paused by an unresolved spool marker. It replaces the "resumes
+#: only after..." sentence and already names drop detection, so no control
+#: sentence is appended.
+OUTCOME_QUARANTINE_SPOOL_MARKER_TEXT = (
+    "Automatic credit, reset and status-line drop detection is paused for "
+    "{account} since {time} because an older cctally process wrote "
+    "status-line data after the upgrade. This version of cctally cannot yet "
+    "confirm a safe point to resume, so the pause does not end on its own; "
+    "usage recording continues. If your usage was reset in place meanwhile, "
+    "record it with `cctally record-credit`.")
+#: Spec revision 5 (section 8), operator-owned wording, verbatim: an account
+#: paused by a marker an incomplete legacy spool inventory left.
+OUTCOME_QUARANTINE_INVENTORY_MARKER_TEXT = (
+    "Automatic credit, reset and status-line drop detection is paused for "
+    "{account} since {time} because cctally could not read the status-line "
+    "files an older cctally release used, so it cannot rule out that an "
+    "older process changed them. This version of cctally cannot yet confirm "
+    "a safe point to resume, so the pause does not end on its own; usage "
+    "recording continues. If your usage was reset in place meanwhile, record "
+    "it with `cctally record-credit`.")
+#: Operator decision dec-5d2a9c2b004a (escalation esc-8a386c207966): the
+#: standalone sentence for an account missing only its control certificate.
+#: The approved control sentence above opens with "also", so it reads only as
+#: an addendum to the accounting one.
+OUTCOME_QUARANTINE_CONTROL_ONLY_TEXT = (
+    "Status-line drop detection is paused for {account} since {time}. It "
+    "resumes after a successful usage refresh for this account.")
+
+
+def _outcome_quarantine_message(row: dict) -> str:
+    """One account's paused outcome classes, in the approved wording. A
+    missing control certificate appends its sentence to the accounting one;
+    alone, it gets its own operator-approved standalone sentence."""
+    label = row.get("accountLabel") or row.get("account")
+    if row.get("unresolvedSpoolMarker"):
+        text = (OUTCOME_QUARANTINE_INVENTORY_MARKER_TEXT
+                if row.get("spoolMarkerCause") == "inventory-incomplete"
+                else OUTCOME_QUARANTINE_SPOOL_MARKER_TEXT)
+        return text.format(
+            account=label, time=row.get("accountingSince") or "an unknown time")
+    if row.get("accountingPaused"):
+        text = OUTCOME_QUARANTINE_ACCOUNTING_TEXT.format(
+            account=label, time=row.get("accountingSince") or "an unknown time")
+        if row.get("controlPaused"):
+            text += " " + OUTCOME_QUARANTINE_CONTROL_TEXT
+        return text
+    return OUTCOME_QUARANTINE_CONTROL_ONLY_TEXT.format(
+        account=label, time=row.get("controlSince") or "an unknown time")
+
+
+def _check_accounting_outcome_quarantine(s: DoctorState) -> CheckResult:
+    """#825/#832 (spec section 8, F16, operator Q9): after a post-cutover
+    legacy write or legacy spool change, automatic outcomes are withheld per
+    account until certified recovery. OK when no account is quarantined; WARN
+    naming per account what is paused and since when; unavailable — WARN,
+    never OK — on an unavailable or unvalidated index. Separate from
+    `journal.legacy_writer`: seven quiet days do not mean outcomes resumed.
+    Never claims when recovery will happen. While a spool marker is
+    unresolved (spec revision 3) every row uses the marker wording and the
+    details carry the markers."""
+    data = s.outcome_quarantine
+    title = "Outcome quarantine"
+    if not data or not data.get("available"):
+        return CheckResult(
+            id="accounting.outcome_quarantine", title=title, severity="warn",
+            summary="unavailable (no validated stats index)",
+            remediation=("Run any cctally command to bring the stats index "
+                         "up to date, then run `cctally doctor` again."),
+            details={"available": False, "accounts": []},
+        )
+    rows = []
+    for row in data.get("accounts") or []:
+        rows.append({**row, "message": _outcome_quarantine_message(row)})
+    details = {"available": True, "triggered": bool(data.get("triggered")),
+               "accounts": rows}
+    if data.get("unresolvedSpoolMarkers"):
+        details["unresolvedSpoolMarkers"] = list(data["unresolvedSpoolMarkers"])
+    if not rows:
+        return CheckResult(
+            id="accounting.outcome_quarantine", title=title, severity="ok",
+            summary=("no account is quarantined" if data.get("triggered")
+                     else "no legacy write or spool change since the upgrade"),
+            remediation=None, details=details,
+        )
+    return CheckResult(
+        id="accounting.outcome_quarantine", title=title, severity="warn",
+        summary=(f"automatic outcomes paused for {len(rows)} account(s)"),
+        remediation=" ".join(row["message"] for row in rows),
+        details=details,
+    )
+
+
 def _check_journal_protocol(s: DoctorState) -> CheckResult:
     """Report selector failure or whole-batch tainting without false health."""
     if (
@@ -4086,6 +4564,7 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         ("journal.writer_guard", "_check_journal_writer_guard"),
         ("journal.conflicts", "_check_journal_conflicts"),
         ("journal.protocol", "_check_journal_protocol"),
+        ("journal.legacy_writer", "_check_journal_legacy_writer"),
         ("journal.quota_projection", "_check_journal_quota_projection"),
     )),
     ("data", "Data", (
@@ -4099,6 +4578,7 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         # after the pair rather than between them.
         ("data.codex_project_metadata", "_check_data_codex_project_metadata"),
         ("data.codex_prune_safety", "_check_data_codex_prune_safety"),
+        ("data.codex_compressed_rollouts", "_check_data_codex_compressed_rollouts"),
         ("data.codex_replay", "_check_data_codex_replay"),
         ("data.codex_ingest_backlog", "_check_data_codex_ingest_backlog"),
         ("data.codex_quota", "_check_data_codex_quota"),
@@ -4120,6 +4600,12 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         ("accounts.codex_window_attribution",
          "_check_accounts_codex_window_attribution"),
     )),
+    # #825/#832 spec section 8: reported separately from the seven-day
+    # `journal.legacy_writer` recency, because quiet time never decides
+    # recovery.
+    ("accounting", "Accounting", (
+        ("accounting.outcome_quarantine", "_check_accounting_outcome_quarantine"),
+    )),
     ("pricing", "Pricing", (
         ("pricing.coverage", "_check_pricing_coverage"),
         # #705. Cannot FAIL, so `doctor`'s exit code is unaffected — the same
@@ -4149,6 +4635,12 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
     ("telemetry", "Telemetry", (
         ("telemetry.state", "_check_telemetry"),
     )),
+    # #901 §5.6. Never FAILs, so `doctor`'s exit code is unaffected. Last, so
+    # every existing check keeps its order.
+    ("performance", "Performance", (
+        ("performance.dashboard_disk_writes",
+         "_check_performance_dashboard_disk_writes"),
+    )),
 )
 
 
@@ -4322,6 +4814,159 @@ def _check_quota_meter_drift(s: DoctorState) -> CheckResult:
     )
 
 
+_DISK_WRITES_ID = "performance.dashboard_disk_writes"
+_DISK_WRITES_TITLE = "Dashboard disk writes"
+_DISK_WRITES_REMEDIATION = (
+    "Run `cctally dashboard-perf` for the breakdown, and report it if it "
+    "persists."
+)
+
+
+def _words(reason) -> str:
+    return str(reason or "unavailable").replace("_", " ")
+
+
+#: PR-9: probe failures doctor cannot overcome from here (it sends no token
+#: and probes over loopback only), each with its sentence fragment.
+_NOT_MEASURABLE_FROM_HERE = {
+    "authentication_required": "needs its access token",
+    "not_loopback_reachable": "is not reachable over loopback",
+}
+
+
+def _check_performance_dashboard_disk_writes(s: DoctorState) -> CheckResult:
+    """Running dashboards' disk writes against the write budget, and
+    transcript maintenance against its allowance (#901 §5.6, §5.7).
+
+    WARN when a measured running dashboard is over budget, when a live
+    instance cannot supply valid telemetry, or when the durable maintenance
+    ledger is over its allowance (so that leg needs no running dashboard).
+    OK otherwise: none running, within budget, a statistic that has no
+    verdict yet (named by its reason), a dashboard doctor cannot measure from
+    here (a token-mode or non-loopback bind), or a platform with no counter.
+    Never FAIL."""
+    import _lib_write_budget as wb
+
+    gathered = (s.dashboard_disk_writes
+                if isinstance(s.dashboard_disk_writes, dict)
+                else {"mode": "error", "instances": []})
+    record = (s.conversations_reclaim_pending
+              if isinstance(s.conversations_reclaim_pending, dict) else {})
+    maintenance = wb.maintenance_statistic(record.get("ledger"), s.now_utc)
+    rows, over, cannot, within, warming, platform = [], [], [], [], [], []
+    unmeasured = []
+    for entry in gathered.get("instances") or ():
+        if not isinstance(entry, dict):
+            continue
+        port = entry.get("port")
+        write_io = entry.get("write_io") if entry.get("probe") == "ok" else None
+        budget = (write_io or {}).get("budget") or {}
+        if write_io is None:
+            verdict, reason = "unavailable", entry.get("reason") or "unreachable"
+            if reason in _NOT_MEASURABLE_FROM_HERE:
+                # PR-9: doctor sends no token and probes over loopback only,
+                # so these never answer it: a note, not a warning.
+                unmeasured.append((port, reason))
+            else:
+                cannot.append((port, reason))
+        elif write_io.get("status") != "ok":
+            verdict = "unavailable"
+            reason = write_io.get("reason") or "counter_error"
+            if reason == "unsupported_platform":
+                platform.append((port, reason))
+            else:
+                cannot.append((port, reason))
+        else:
+            verdict, reason = budget.get("verdict"), None
+            if verdict == "over":
+                over.append((port, write_io, budget))
+            elif verdict == "ok":
+                within.append((port, write_io))
+            else:
+                verdict = "insufficient"
+                reason = (budget.get("reasons") or ["warming_up"])[0]
+                warming.append((port, reason))
+        rows.append({
+            "instance_id": entry.get("instance_id"),
+            "port": port,
+            "pid": entry.get("pid"),
+            "verdict": verdict,
+            "reason": reason,
+            "bytes_per_minute": (write_io or {}).get("bytesPerMinute"),
+            "mean_bytes_per_publication": (write_io or {}).get(
+                "meanBytesPerTick"),
+            "bytes_per_minute_limit": budget.get("bytesPerMinuteLimit"),
+            "mean_bytes_per_publication_limit": budget.get(
+                "meanBytesPerTickLimit"),
+        })
+    rows.sort(key=lambda row: (row["port"] is None, row["port"] or 0))
+    details = {
+        "policy_version": wb.POLICY_VERSION,
+        "mode": gathered.get("mode"),
+        "instances": rows,
+        "maintenance": maintenance.as_details(),
+    }
+    warn = []
+    for port, write_io, budget in sorted(over, key=lambda item: item[0] or 0):
+        reasons = budget.get("reasons") or []
+        if ("publication_over_limit" in reasons
+                and "rate_over_limit" not in reasons):
+            warn.append(
+                f"The running dashboard (port {port}) is writing "
+                f"{wb.format_mib(write_io.get('meanBytesPerTick') or 0)} per "
+                f"publication, over its "
+                f"{wb.format_mib(budget.get('meanBytesPerTickLimit') or 0)} "
+                f"per publication budget.")
+        else:
+            warn.append(
+                f"The running dashboard (port {port}) is writing "
+                f"{wb.format_mib(write_io.get('bytesPerMinute') or 0)}/min, "
+                f"over its "
+                f"{wb.format_mib(budget.get('bytesPerMinuteLimit') or 0)}/min "
+                f"budget.")
+    for port, reason in sorted(cannot, key=lambda item: item[0] or 0):
+        warn.append(f"The running dashboard (port {port}) cannot report its "
+                    f"disk writes ({_words(reason)}).")
+    if maintenance.verdict == "over":
+        warn.append(
+            f"Transcript maintenance was charged "
+            f"{wb.format_size(maintenance.charged_bytes)} over the last "
+            f"{wb.format_window_hm(maintenance.window_minutes)}, over its "
+            f"{wb.format_size(maintenance.allowance_bytes)} allowance.")
+    if warn:
+        return CheckResult(
+            id=_DISK_WRITES_ID, title=_DISK_WRITES_TITLE, severity="warn",
+            summary=" ".join(warn), remediation=_DISK_WRITES_REMEDIATION,
+            details=details)
+    if within:
+        port, write_io = sorted(within, key=lambda item: item[0] or 0)[0]
+        summary = (f"Within budget: "
+                   f"{wb.format_mib(write_io.get('bytesPerMinute') or 0)}/min "
+                   f"over the last 5 minutes.")
+    elif warming:
+        # PR-8: the first instance's own reason; only `warming_up` is
+        # "no samples yet".
+        _port, reason = sorted(warming, key=lambda item: item[0] or 0)[0]
+        summary = f"Disk writes: {wb.statistic_reason_phrase(reason)}."
+    elif unmeasured:
+        port, reason = sorted(unmeasured, key=lambda item: item[0] or 0)[0]
+        summary = (f"Disk writes: the dashboard on port {port} "
+                   f"{_NOT_MEASURABLE_FROM_HERE[reason]}, so it is not "
+                   "measured from here.")
+    elif platform:
+        summary = f"Disk writes: unavailable ({_words(platform[0][1])})."
+    elif gathered.get("mode") == "error":
+        summary = "Disk writes: unavailable (gather failed)."
+    elif gathered.get("mode") == "not_probed":
+        summary = ("Disk writes: not measured here; run `cctally doctor` to "
+                   "check running dashboards.")
+    else:
+        summary = "No dashboard is running."
+    return CheckResult(
+        id=_DISK_WRITES_ID, title=_DISK_WRITES_TITLE, severity="ok",
+        summary=summary, remediation=None, details=details)
+
+
 def _evaluate_one(check_id: str, check_fn_name: str,
                   state: DoctorState) -> CheckResult:
     """Invoke a single check evaluator by name, catching any exception so