cctally 1.113.0 → 1.115.0

package/bin/_cctally_config.py

@@ -529,6 +529,43 @@ def resolve_retention_days(config: dict) -> int:
     return default
 
 
+#: The test-only switch (#965). Honored only at exactly "1", only when no
+#: retention setting exists, and only for code running from a git checkout.
+CONVERSATION_RETENTION_TEST_SWITCH = "CCTALLY_TEST_CONVERSATION_RETENTION_DEFAULT_OFF"
+
+
+def _conversation_retention_setting_absent(config) -> bool:
+    """True when no ``conversation.retention_days`` setting exists (#965 5.2).
+
+    Absent: no ``conversation`` key, or a ``conversation`` dictionary without
+    ``retention_days``. A present key of any value (``null`` and malformed
+    values included), a non-dictionary ``conversation`` and a non-dictionary
+    config are not absent: they keep ``resolve_retention_days``'s meaning."""
+    if not isinstance(config, dict):
+        return False
+    if "conversation" not in config:
+        return True
+    block = config["conversation"]
+    return isinstance(block, dict) and "retention_days" not in block
+
+
+def resolve_prune_retention_days(config: dict) -> int:
+    """Operational transcript-retention window of the three prune paths (#965).
+
+    ``resolve_retention_days`` stays the reporting resolver (``config get``,
+    the settings manifest, docs). This one differs in exactly one case: with
+    no retention setting, the test switch at exactly ``"1"`` and a ``.git``
+    entry at the running code's root, it returns ``0`` (keep forever). The
+    switch and the marker are read on every call; nothing is cached, written
+    or logged. docs/fixtures-gotchas.md, "Conversation retention is off in
+    test environments (#965)"."""
+    if (_conversation_retention_setting_absent(config)
+            and os.environ.get(CONVERSATION_RETENTION_TEST_SWITCH) == "1"
+            and _cctally_core._has_git_checkout_marker()):
+        return 0
+    return resolve_retention_days(config)
+
+
 def _config_codex_leaf_value(config: dict, key: str) -> object:
     """Read one nested Codex budget leaf with its public default.
 

package/bin/_cctally_core.py

@@ -76,6 +76,8 @@ def _init_paths_from_env() -> None:
     global STATUSLINE_CANDIDATE_DIR, STATUSLINE_SELECTED_PATH
     global STATUSLINE_TRANSPORT_MARKER_PATH
     global STATUSLINE_AUTHORITATIVE_7D_PATH, STATUSLINE_AUTHORITATIVE_5H_PATH
+    global STATUSLINE_ACCOUNT_BOUND_DIR, LEGACY_SPOOL_BASELINE_PATH
+    global ACCOUNT_BOUND_CUTOVER_CACHE_PATH, LEGACY_WRITER_EVIDENCE_PATH
     global OAUTH_BACKOFF_MARKER_PATH, OAUTH_BACKOFF_COUNT_PATH
     global UPDATE_STATE_PATH, UPDATE_SUPPRESS_PATH
     global UPDATE_LOCK_PATH, UPDATE_LOG_PATH, UPDATE_LOG_ROTATED_PATH
@@ -184,6 +186,19 @@ def _init_paths_from_env() -> None:
     STATUSLINE_TRANSPORT_MARKER_PATH = APP_DIR / "statusline-transport.last"
     STATUSLINE_AUTHORITATIVE_7D_PATH = APP_DIR / "statusline-authoritative-7d.json"
     STATUSLINE_AUTHORITATIVE_5H_PATH = APP_DIR / "statusline-authoritative-5h.json"
+    # #825/#832 account-bound protocol (spec section 7). Every current
+    # coordination file lives under its own sibling root; the legacy paths
+    # above are never read as authority after the cutover, only compared with
+    # the journal-anchored legacy spool baseline. The coordinate cache only
+    # accelerates locating the cutover op and never confers authority; the
+    # legacy-writer evidence sidecar is diagnostic only (spec section 8).
+    STATUSLINE_ACCOUNT_BOUND_DIR = APP_DIR / "statusline-account-bound-v1"
+    LEGACY_SPOOL_BASELINE_PATH = (
+        STATUSLINE_ACCOUNT_BOUND_DIR / "legacy-spool-baseline.json")
+    ACCOUNT_BOUND_CUTOVER_CACHE_PATH = (
+        STATUSLINE_ACCOUNT_BOUND_DIR / "cutover-coordinate.json")
+    LEGACY_WRITER_EVIDENCE_PATH = (
+        STATUSLINE_ACCOUNT_BOUND_DIR / "legacy-writer-evidence.json")
     OAUTH_BACKOFF_MARKER_PATH = APP_DIR / "oauth-backoff.until"
     # Consecutive-429 counter (text int) driving the headerless exponential
     # backoff (base * 2**count). Separate from the deadline marker so the
@@ -261,6 +276,18 @@ def _repo_root() -> pathlib.Path:
     return pathlib.Path(__file__).resolve().parent.parent
 
 
+def _has_git_checkout_marker() -> bool:
+    """True iff the running code has a ``.git`` entry at its root (#965 5.1).
+
+    A main checkout has a ``.git`` directory and a linked worktree a ``.git``
+    file; both count. Eligibility follows the code's resolved location
+    (``_repo_root()``), never the current directory, and is evaluated on every
+    call. No suppressor (``CCTALLY_DISABLE_DEV_AUTODETECT``,
+    ``CCTALLY_ALLOW_PROD_MIGRATION``) affects it. npm and Homebrew installs
+    ship without ``.git``, so they never read True."""
+    return (_repo_root() / ".git").exists()
+
+
 def _is_dev_checkout() -> bool:
     """True iff running from a git checkout (a ``.git`` entry at the repo
     root — a directory for a main checkout, a file for a worktree) AND the
@@ -272,7 +299,7 @@ def _is_dev_checkout() -> bool:
     install copies ship without ``.git`` so they never read True."""
     if _truthy_env("CCTALLY_DISABLE_DEV_AUTODETECT"):
         return False
-    return (_repo_root() / ".git").exists()
+    return _has_git_checkout_marker()
 
 
 def is_preview_channel() -> bool:
@@ -473,9 +500,33 @@ _init_paths_from_env()
 # tick must carry that earlier evidence into the journal, even after this
 # binary learns a new model card. A pre-existing open projection that was
 # rebuilt without the marker remains unproven until a new tick recomputes it.
-STATS_INDEX_EPOCH = 1016
+# 1016 -> 1017 (#901 §5.3, T3): read indexes only. Every stats digest relation
+# (`_lib_dashboard_sources._CODEX_STATS_DIGEST_RELATIONS` and
+# `_CLAUDE_STATS_DIGEST_RELATIONS`) sorted its whole relation through a temp
+# b-tree on every dashboard build, and `_fetch_current_week_snapshots` grouped
+# every boundary-aware and legacy-date snapshot the same way; each now streams
+# through an index in its own order (`_STATS_READ_INDEX_DDL`). No table or
+# column changes and no digest byte moves. The same epoch carries Amendment 1's
+# history-read indexes (items 2-7 and 9, `c901-design-2`, with item 2's second
+# single-root index from Amendment 1c, `c901-design-3`): every full dashboard
+# build enumerated weekly blocks, milestone weeks, root keys, group pairs,
+# reset events and subscription anchors through temp b-trees. The mechanical
+# reason this is a bump and not a migration is unchanged: the registry is
+# frozen at 13, and an epoch-current open returns before any schema work, so a
+# schema helper alone would never run on an upgraded install.
+# 1017 -> 1018 (#825/#832 spec section 6): the same journal now has a different
+# authoritative interpretation — the account-bound admission predicate excludes
+# unstamped post-cutover records before any derivation — so an index
+# materialized under the old interpretation is not current even though its
+# schema is usable. The epoch also carries the disposable
+# `journal_admission_summary` table, whose presence is the protocol marker
+# `_cctally_store.validated_read_snapshot` checks inside each decision
+# scope's own snapshot. An epoch transition, not a numbered migration: the
+# registry stays frozen at 13.
+STATS_INDEX_EPOCH = 1018
 LEGACY_STATS_HEAD = 13
 
+
 #: #496 S1 F1. A NEW branch, for a state that cannot occur before the
 #: publication transaction exists: a replacement index was published and then
 #: failed validation on a fresh connection. The existing corrupt-stats text
@@ -1861,6 +1912,207 @@ def _apply_quota_projection_schema(conn: sqlite3.Connection) -> None:
             "next_evaluation_by_root_json", "TEXT NOT NULL DEFAULT '{}'")
 
 
+#: #901 §5.3 (T3), epoch 1017: (table, columns the index reads, DDL). Each
+#: index's leading columns are the statement's equality filter (when it has
+#: one) followed by its ORDER BY / GROUP BY list, so the statement streams off
+#: the index with no sorter; the digest indexes are covering, because every
+#: digest relation selects exactly its ordering columns. SQLite stores each
+#: statement verbatim in `sqlite_schema`, which `_REBUILD_SCHEMA_FINGERPRINT`
+#: hashes: change the text and the fingerprint must move with it.
+_STATS_READ_INDEX_DDL: "tuple[tuple[str, tuple[str, ...], str], ...]" = (
+    ("quota_projection_state", ("source_root_key", "physical_signature"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_projection_state_digest "
+     "ON quota_projection_state(source_root_key, physical_signature)"),
+    ("quota_window_blocks",
+     ("source", "source_root_key", "logical_limit_key", "observed_slot",
+      "window_minutes", "limit_id", "limit_name", "resets_at_utc",
+      "nominal_start_at_utc", "first_observed_at_utc", "last_observed_at_utc",
+      "first_percent", "current_percent", "orphaned_at"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_blocks_digest "
+     "ON quota_window_blocks(source, source_root_key, logical_limit_key, "
+     "observed_slot, window_minutes, limit_id, limit_name, resets_at_utc, "
+     "nominal_start_at_utc, first_observed_at_utc, last_observed_at_utc, "
+     "first_percent, current_percent, orphaned_at) WHERE source='codex'"),
+    ("quota_percent_milestones",
+     ("source", "source_root_key", "logical_limit_key", "observed_slot",
+      "window_minutes", "resets_at_utc", "percent_threshold",
+      "captured_at_utc", "high_water_percent", "orphaned_at"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_milestones_digest "
+     "ON quota_percent_milestones(source, source_root_key, logical_limit_key, "
+     "observed_slot, window_minutes, resets_at_utc, percent_threshold, "
+     "captured_at_utc, high_water_percent, orphaned_at) WHERE source='codex'"),
+    ("quota_threshold_events",
+     ("source", "source_root_key", "logical_limit_key", "observed_slot",
+      "window_minutes", "resets_at_utc", "threshold", "qualifying_kind",
+      "qualifying_percent", "projected_percent", "severity", "created_at_utc",
+      "disposition", "alerted_at", "suppressed_at", "orphaned_at"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_threshold_events_digest "
+     "ON quota_threshold_events(source, source_root_key, logical_limit_key, "
+     "observed_slot, window_minutes, resets_at_utc, threshold, "
+     "qualifying_kind, qualifying_percent, projected_percent, severity, "
+     "created_at_utc, disposition, alerted_at, suppressed_at, orphaned_at) "
+     "WHERE source='codex'"),
+    ("budget_milestones",
+     ("vendor", "period_start_at", "period", "threshold", "budget_usd",
+      "spent_usd", "consumption_pct", "crossed_at_utc", "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_budget_milestones_codex_digest "
+     "ON budget_milestones(vendor, period_start_at, period, threshold, "
+     "budget_usd, spent_usd, consumption_pct, crossed_at_utc, alerted_at) "
+     "WHERE vendor='codex'"),
+    ("projected_milestones",
+     ("metric", "week_start_at", "period", "threshold", "projected_value",
+      "denominator", "crossed_at_utc", "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_projected_milestones_codex_digest "
+     "ON projected_milestones(metric, week_start_at, period, threshold, "
+     "projected_value, denominator, crossed_at_utc, alerted_at) "
+     "WHERE metric='codex_budget_usd'"),
+    ("percent_milestones",
+     ("week_start_date", "percent_threshold", "reset_event_id", "account_key",
+      "captured_at_utc", "cumulative_cost_usd", "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_percent_milestones_alert_digest "
+     "ON percent_milestones(week_start_date, percent_threshold, "
+     "reset_event_id, account_key, captured_at_utc, cumulative_cost_usd, "
+     "alerted_at) WHERE alerted_at IS NOT NULL"),
+    ("five_hour_milestones",
+     ("five_hour_window_key", "percent_threshold", "reset_event_id",
+      "account_key", "captured_at_utc", "block_cost_usd", "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_five_hour_milestones_alert_digest "
+     "ON five_hour_milestones(five_hour_window_key, percent_threshold, "
+     "reset_event_id, account_key, captured_at_utc, block_cost_usd, "
+     "alerted_at) WHERE alerted_at IS NOT NULL"),
+    ("budget_milestones",
+     ("vendor", "period_start_at", "period", "threshold", "account_key",
+      "budget_usd", "spent_usd", "consumption_pct", "crossed_at_utc",
+      "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_budget_milestones_alert_digest "
+     "ON budget_milestones(vendor, period_start_at, period, threshold, "
+     "account_key, budget_usd, spent_usd, consumption_pct, crossed_at_utc, "
+     "alerted_at) WHERE vendor <> 'codex' AND alerted_at IS NOT NULL"),
+    ("projected_milestones",
+     ("week_start_at", "period", "metric", "threshold", "account_key",
+      "projected_value", "denominator", "crossed_at_utc", "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_projected_milestones_alert_digest "
+     "ON projected_milestones(week_start_at, period, metric, threshold, "
+     "account_key, projected_value, denominator, crossed_at_utc, alerted_at) "
+     "WHERE metric <> 'codex_budget_usd' AND alerted_at IS NOT NULL"),
+    ("project_budget_milestones",
+     ("week_start_at", "project_key", "threshold", "account_key",
+      "budget_usd", "spent_usd", "consumption_pct", "crossed_at_utc",
+      "alerted_at"),
+     "CREATE INDEX IF NOT EXISTS idx_project_budget_milestones_alert_digest "
+     "ON project_budget_milestones(week_start_at, project_key, threshold, "
+     "account_key, budget_usd, spent_usd, consumption_pct, crossed_at_utc, "
+     "alerted_at) WHERE alerted_at IS NOT NULL"),
+    ("weekly_usage_snapshots",
+     ("week_start_at", "week_end_at", "week_start_date", "account_key",
+      "weekly_observation_held", "captured_at_utc"),
+     "CREATE INDEX IF NOT EXISTS idx_usage_week_boundary_group "
+     "ON weekly_usage_snapshots(week_start_at, week_end_at, week_start_date, "
+     "account_key, weekly_observation_held, captured_at_utc) "
+     "WHERE week_start_at IS NOT NULL AND week_end_at IS NOT NULL"),
+    ("weekly_usage_snapshots",
+     ("week_start_date", "week_end_date", "account_key",
+      "weekly_observation_held", "captured_at_utc"),
+     "CREATE INDEX IF NOT EXISTS idx_usage_week_date_group "
+     "ON weekly_usage_snapshots(week_start_date, week_end_date, account_key, "
+     "weekly_observation_held, captured_at_utc)"),
+    # Amendment 1 (binding Codex answer `c901-design-2`): the recurring history
+    # reads the #901 plan guard escalated. Item 2: `_load_codex_cycles` orders
+    # every weekly block of the active roots by reset; the partial predicate
+    # deliberately keeps orphaned rows so `include_orphaned=True` streams too.
+    # Amendment 1b widened it past the reset second: `_canonicalize_codex_
+    # cluster` keeps the first maximal member, so the order of rows tied on one
+    # second is observable, and the trailing columns make it explicit. The
+    # table's UNIQUE constraint makes them unique within the population.
+    # Amendment 1c (`c901-design-3`): the legacy plan fed its sorter in two
+    # different orders. A read of two or more roots scanned
+    # `idx_quota_blocks_active` (ties by root, account, orphaned_at, limit,
+    # slot, reset spelling); a read of exactly one root seeked the UNIQUE
+    # autoindex (the same order without orphaned_at). The first index below
+    # serves the multi-root read, the second the single-root read, each in its
+    # legacy tie order.
+    ("quota_window_blocks",
+     ("source", "window_minutes", "resets_at_utc", "source_root_key",
+      "account_key", "orphaned_at", "logical_limit_key", "observed_slot"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_blocks_weekly_reset_order "
+     "ON quota_window_blocks(unixepoch(resets_at_utc) DESC, "
+     "source_root_key ASC, account_key ASC, orphaned_at ASC, "
+     "logical_limit_key ASC, observed_slot ASC, resets_at_utc ASC) "
+     "WHERE source='codex' AND window_minutes=10080"),
+    ("quota_window_blocks",
+     ("source", "window_minutes", "resets_at_utc", "source_root_key",
+      "account_key", "logical_limit_key", "observed_slot"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_blocks_weekly_single_root_order "
+     "ON quota_window_blocks(unixepoch(resets_at_utc) DESC, "
+     "source_root_key ASC, account_key ASC, "
+     "logical_limit_key ASC, observed_slot ASC, resets_at_utc ASC) "
+     "WHERE source='codex' AND window_minutes=10080"),
+    # Item 3: `_navigable_claude_refs` de-duplicates every milestone week; a
+    # full index, because the alert digest index cannot see unalerted rows.
+    ("percent_milestones", ("week_start_date",),
+     "CREATE INDEX IF NOT EXISTS idx_percent_milestones_week_date "
+     "ON percent_milestones(week_start_date ASC)"),
+    # Item 4: `_historic_root_keys` reads the complete relations.
+    ("quota_percent_milestones", ("source_root_key",),
+     "CREATE INDEX IF NOT EXISTS idx_quota_milestones_root "
+     "ON quota_percent_milestones(source_root_key ASC)"),
+    ("quota_threshold_events", ("source_root_key",),
+     "CREATE INDEX IF NOT EXISTS idx_quota_threshold_events_root "
+     "ON quota_threshold_events(source_root_key ASC)"),
+    # Item 5 (and item 4's quota_window_blocks leg): one root's distinct
+    # (group key, group digest) pairs stream after three equality columns.
+    ("quota_window_blocks",
+     ("source_root_key", "source", "orphaned_at", "physical_group_key",
+      "physical_group_digest"),
+     "CREATE INDEX IF NOT EXISTS idx_quota_blocks_root_group_pairs "
+     "ON quota_window_blocks(source_root_key ASC, source ASC, orphaned_at ASC, "
+     "physical_group_key ASC, physical_group_digest ASC)"),
+    # Items 6 and 7: the WeekRef reset-event applier and
+    # `in_place_cut_instants` read every event in the chokepoint's order.
+    ("week_reset_events", ("effective_reset_at_utc", "id"),
+     "CREATE INDEX IF NOT EXISTS idx_week_reset_events_effective_order "
+     "ON week_reset_events(unixepoch(effective_reset_at_utc) DESC, id DESC)"),
+    # Item 9: `_compute_subscription_weeks` scans representative rows in
+    # (minimum start, date) order and picks and aggregates each date's
+    # qualifying population. The order index's predicate omits the answer's
+    # `week_start_date IS NOT NULL`: the column is NOT NULL, so SQLite drops
+    # that term from the outer scan's WHERE and then cannot prove the partial
+    # index usable ("no query solution" under INDEXED BY, measured). The
+    # indexed population is identical. The pick index keeps the term, because
+    # every lookup through it carries a date equality that implies it.
+    ("weekly_usage_snapshots",
+     ("week_start_at", "week_end_at", "week_start_date"),
+     "CREATE INDEX IF NOT EXISTS idx_usage_subscription_anchor_order "
+     "ON weekly_usage_snapshots(week_start_at ASC, week_start_date ASC) "
+     "WHERE week_start_at IS NOT NULL AND week_end_at IS NOT NULL"),
+    ("weekly_usage_snapshots",
+     ("week_start_date", "week_start_at", "week_end_at", "id"),
+     "CREATE INDEX IF NOT EXISTS idx_usage_subscription_anchor_pick "
+     "ON weekly_usage_snapshots(week_start_date ASC, week_start_at ASC, id ASC) "
+     "WHERE week_start_at IS NOT NULL AND week_end_at IS NOT NULL "
+     "AND week_start_date IS NOT NULL"),
+)
+
+
+def _apply_stats_read_indexes(conn: sqlite3.Connection) -> None:
+    """Create each #901 read index whose table and columns exist (epoch 1017).
+
+    ``open_db`` calls this twice: beside the quota projection schema, and
+    again after the stats migration dispatcher, because a legacy store being
+    cut over gains one indexed column (``reset_event_id``, migration 005) only
+    from the dispatcher. Every statement is IF NOT EXISTS, so the second call
+    creates exactly what the first had to skip, and an index is never attempted
+    over a column that is not there yet.
+    """
+    for table, required, statement in _STATS_READ_INDEX_DDL:
+        columns = {
+            str(row[0]) for row in conn.execute(
+                "SELECT name FROM pragma_table_info(?)", (table,))
+        }
+        if set(required) <= columns:
+            conn.execute(statement)
+
+
 def open_db(*, _target_path=None) -> sqlite3.Connection:
     # ``_target_path`` (internal, keyword-only) builds/opens the stats index at
     # an ALTERNATE path instead of the module-global ``DB_PATH`` — the seam
@@ -2129,6 +2381,10 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
                     conn, _STATS_MIGRATIONS, "stats.db"
                 )
             return conn
+        # PR-3: everything below is pending schema, migration or cutover work;
+        # it sorts under FILE, and the writer temp store is selected again
+        # before the connection is returned.
+        _cctally_store.apply_schema_work_temp_store(conn)
         _fixups_current = _cctally_store.stats_open_fixups_current(conn)
         conn.execute(
             """
@@ -2854,6 +3110,7 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         # without running its handler, so this open-time call is the sole creator).
         if not _fixups_current:
             _apply_quota_projection_schema(conn)
+        _apply_stats_read_indexes(conn)
 
         # Migration framework dispatcher. Replaces the prior inline gate stack
         # (has_blocks + _migration_done) with the framework's _run_pending_-
@@ -2871,6 +3128,7 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         _run_pending_migrations(
             conn, registry=_STATS_MIGRATIONS, db_label="stats.db",
         )
+        _apply_stats_read_indexes(conn)
 
         # One-time historical backfill of five_hour_blocks (rollup only;
         # milestones are forward-only per spec §4.3 / [Write-once milestones]).
@@ -3089,6 +3347,106 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
             "cutover_seen INTEGER NOT NULL DEFAULT 0, "
             "cutover_account_key TEXT)"
         )
+        # #825/#832 epoch 1018 (spec section 8): the bounded, disposable
+        # summary of the complete journal records the admission predicate
+        # EXCLUDED (post-cutover records without the current writer
+        # generation). Ingest extends it inside its cycle transaction and a
+        # rebuild reproduces it from the pinned prefix; `complete_through` is
+        # NULL when the row was started mid-journal (it then describes only
+        # what it saw). Coordinates are JSON `{"segment", "offset"}` text, and
+        # `coordinate_digest` is the order-independent population digest of
+        # every excluded coordinate (`_lib_account_protocol`).
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS journal_admission_summary ("
+            "id INTEGER PRIMARY KEY CHECK (id = 1), "
+            "cutover_id TEXT, "
+            "scanned_high_water TEXT, "
+            "excluded_total INTEGER NOT NULL DEFAULT 0, "
+            "family_counts_json TEXT NOT NULL DEFAULT '{}', "
+            "first_excluded_coordinate TEXT, "
+            "latest_excluded_coordinate TEXT, "
+            "coordinate_digest TEXT, "
+            "complete_through TEXT, "
+            # The boundary payload this summary classified against, so the
+            # live ingest path resolves admission without scanning the journal.
+            "boundary_json TEXT)"
+        )
+        # #825/#832 fix round A (Codex fix-round-1 Q1): the derivation
+        # frontier. Every admitted derivable input at or before this journal
+        # coordinate has had its decisions journaled by a current binary. Live
+        # ingest advances it with the cursor only while the two are equal; a
+        # rebuild carries it from a trusted predecessor index or sets it after
+        # the shared completion step proved the window. Absent means unknown,
+        # which the completion step reads as "replay from the cutover".
+        # Fix round C (P1-1): the frontier counts CONSUMED INPUTS, and the
+        # decisions a cycle derives from them land beyond it, so the row also
+        # names the output end — the coordinate through which every decision
+        # derived from an input at or before the frontier is journaled, with
+        # nothing between the two derived from a later input. NULL means
+        # nothing is owed beyond the frontier.
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS journal_derivation_frontier ("
+            "id INTEGER PRIMARY KEY CHECK (id = 1), "
+            "segment TEXT NOT NULL, "
+            "offset INTEGER NOT NULL, "
+            "output_segment TEXT, "
+            "output_offset INTEGER)"
+        )
+        # An index an earlier build of this epoch created lacks the two
+        # columns; additive, so it keeps its frontier row.
+        add_column_if_missing(
+            conn, "journal_derivation_frontier", "output_segment", "TEXT")
+        add_column_if_missing(
+            conn, "journal_derivation_frontier", "output_offset", "INTEGER")
+        # Revision 2 (#946, Codex design-fix-round-3 Q5): the proof
+        # generation. A row written under the old traversal rule (NULL here)
+        # may name a valid endpoint past an input nothing derived, so only
+        # `_cctally_journal.DERIVATION_PROOF_GENERATION` is trusted.
+        add_column_if_missing(
+            conn, "journal_derivation_frontier", "proof_generation", "INTEGER")
+        # #825/#832 fix round A (Codex fix-round-1 Q2): the physical revision
+        # inventory of every EXCLUDED event or correction action the index has
+        # consumed, by logical id. Admission hides these from effective
+        # selection, so without it a current writer would classify the id NEW
+        # and append a revision-0 twin the previous release reads as a
+        # same-revision conflict.
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS journal_excluded_event_revisions ("
+            "event_id TEXT PRIMARY KEY, "
+            "max_rev INTEGER NOT NULL)"
+        )
+        # #825/#832 epoch 1018 (spec 5.6 item 9): the outcome quarantine. A
+        # deterministic function of journal order that ingest extends inside
+        # its cycle transaction and a rebuild reproduces from the pinned
+        # prefix: one row per uncertainty trigger (an excluded record or a
+        # current `legacy_spool_activity` op, at its physical coordinate), the
+        # whole-prefix envelope per scope ("excluded" applies to every
+        # account), and each account's accounting and control certificates
+        # with the trigger sequence they were granted against. A certificate
+        # granted against an older sequence is void; a missing or
+        # unverifiable row reads as quarantined.
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS outcome_quarantine_triggers ("
+            "seq INTEGER PRIMARY KEY, "
+            "segment TEXT, "
+            "byte_offset INTEGER, "
+            "kind TEXT NOT NULL, "
+            "reason TEXT NOT NULL, "
+            "at TEXT)"
+        )
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS outcome_quarantine_envelope ("
+            "scope TEXT PRIMARY KEY, "
+            "envelope_json TEXT NOT NULL)"
+        )
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS outcome_quarantine_certificates ("
+            "account_key TEXT PRIMARY KEY, "
+            "accounting_certificate_json TEXT, "
+            "accounting_trigger_seq INTEGER, "
+            "control_certificate_json TEXT, "
+            "control_trigger_seq INTEGER)"
+        )
         conn.execute(
             "CREATE TABLE IF NOT EXISTS journal_selector_batches ("
             "batch_id TEXT PRIMARY KEY, "
@@ -3148,6 +3506,45 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
             "started_at_utc TEXT NOT NULL, "
             "stamped_at_utc TEXT NOT NULL)"
         )
+        # #825/#832 Task 4.0 (epoch 1018): a milestone whose snapshot a
+        # credit's stale-replica removal deleted. The removal's band starts at
+        # floor10 of the arming tick, so it also reaches the GENUINE pre-credit
+        # peak tick when that tick shares the arming tick's ten-minute slot —
+        # and that tick is the one that crossed the last weekly and five-hour
+        # milestones. A rebuild folds the suppression (order 30) before the
+        # milestones (order 60), so their journaled `usage_snapshot_ref` named
+        # a row that no longer existed and the NOT NULL row was silently
+        # dropped; the next tick then re-recorded the highest weekly milestone
+        # and its conflict convergence raised on every cycle.
+        #
+        # The tombstone records every journaled snapshot the index deleted —
+        # the live stale-replica removals and the suppression appliers alike,
+        # because a trigger sees every DELETE — so the fold's ONE resolver
+        # (`_cctally_journal._resolve_fold_ref`) can tell "a suppression
+        # removed it" from a genuinely unresolvable reference. The trigger's
+        # second half points every milestone that referenced the deleted row at
+        # the 0 "no snapshot row" sentinel, which is what the rebuild resolves
+        # such a reference to, so the live index and a rebuild agree. Both
+        # milestone readers already treat 0 as "no row": the five-hour
+        # milestone read LEFT JOINs (and so publishes the effective weekly
+        # value as unavailable, as it already did for the dangling rowid), and
+        # the observation-gap classifier never continues a run through 0.
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS usage_snapshot_suppressions ("
+            "journal_id TEXT PRIMARY KEY)"
+        )
+        conn.execute(
+            "CREATE TRIGGER IF NOT EXISTS trg_usage_snapshot_suppression "
+            "AFTER DELETE ON weekly_usage_snapshots "
+            "BEGIN "
+            "INSERT OR IGNORE INTO usage_snapshot_suppressions (journal_id) "
+            "SELECT OLD.journal_id WHERE OLD.journal_id IS NOT NULL; "
+            "UPDATE percent_milestones SET usage_snapshot_id = 0 "
+            "WHERE usage_snapshot_id = OLD.id; "
+            "UPDATE five_hour_milestones SET usage_snapshot_id = 0 "
+            "WHERE usage_snapshot_id = OLD.id; "
+            "END"
+        )
 
         # §6.2 backfill gate (Task 8): stamp the one-shot marker AFTER the three
         # open-time backfills ran, so the next open skips them (and their probes)
@@ -3186,6 +3583,7 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
                     except Exception:
                         pass
                     raise
+        _cctally_store.apply_writer_temp_store(conn)
         return conn