cctally 1.113.0 → 1.115.0

package/bin/_lib_rederive.py

@@ -144,6 +144,24 @@ _OP_CLASSIFICATIONS = {
         "retained", "operator Codex window attribution is outside claude-usage"),
     "codex_window_attribution_retract": KindClassification(
         "retained", "operator Codex window retraction is outside claude-usage"),
+    # #825/#832 spec 5.1. The versioned reviewed decision is replayed into
+    # scratch exactly like its previous-release twin.
+    "claude_weekly_observation_decision_v2": KindClassification(
+        "retained_input",
+        "reviewed weekly-axis decisions are replayed into scratch"),
+    # The account-bound protocol ops are fence metadata: they decide what is
+    # admitted and anchor the legacy spool baseline, and nothing in the
+    # claude-usage family derives them.
+    "account_bound_cutover": KindClassification(
+        "retained", "the account-bound journal fence is replayed, never "
+        "re-derived"),
+    "legacy_spool_activity": KindClassification(
+        "retained", "legacy spool evidence is replayed, never re-derived"),
+    # The versioned journal-repair acknowledgement is an audit record over the
+    # raw prefix, outside claude-usage (its previous-release twin is consumed
+    # by the selector directly and never registered).
+    "journal_protocol_resolution_v2": KindClassification(
+        "retained", "journal-repair acknowledgements are audit records"),
 }
 
 
@@ -194,7 +212,15 @@ def validate_family_registry(*, evt_kinds: set[str],
     )
 
 
+# #874: the contract is structural. It names every column any planner reader
+# of the table reads (`_validate_cache_rows`, `_cache_fingerprint`,
+# `_joined_entries`, `iter_entries`), not only those the current journal
+# reaches, so whether a cache is accepted never depends on journal or pricing
+# state, and a missing column is a typed gap rather than a raw sqlite error.
 _SESSION_ENTRY_COLUMNS = frozenset({
+    "id",
+    "source_path",
+    "line_offset",
     "timestamp_utc",
     "model",
     "input_tokens",
@@ -202,7 +228,8 @@ _SESSION_ENTRY_COLUMNS = frozenset({
     "cache_create_tokens",
     "cache_read_tokens",
     "cache_create_1h_tokens",
-    "source_path",
+    "cost_usd_raw",
+    "speed",
     "account_key",
 })
 _SESSION_FILE_COLUMNS = frozenset({"path", "session_id", "project_path"})
@@ -228,6 +255,37 @@ def validate_claude_cache_contract(tables: Mapping[str, set[str]]) -> None:
         )
 
 
+# #874: the Codex columns `_cache_fingerprint(include_codex=True)` and the
+# Codex budget re-pricing reader (`iter_codex_entries`) read. Required only
+# when the planner reads the Codex cache at all.
+_CODEX_SESSION_ENTRY_COLUMNS = frozenset({
+    "source_path",
+    "line_offset",
+    "timestamp_utc",
+    "session_id",
+    "model",
+    "input_tokens",
+    "cached_input_tokens",
+    "output_tokens",
+    "reasoning_output_tokens",
+    "total_tokens",
+    "account_key",
+})
+
+
+def validate_codex_cache_contract(tables: Mapping[str, set[str]]) -> None:
+    """Fail before planning if the Codex cost inputs the planner reads are gone."""
+    if "codex_session_entries" not in tables:
+        raise RederiveDataGap("missing cache.db table codex_session_entries")
+    missing = sorted(
+        _CODEX_SESSION_ENTRY_COLUMNS - set(tables["codex_session_entries"]))
+    if missing:
+        raise RederiveDataGap(
+            "missing cache.db codex_session_entries column(s): "
+            + ", ".join(missing)
+        )
+
+
 def preserved_history(records: Iterable[Mapping], *,
                       evidence_retained: bool) -> dict[str, Mapping]:
     """Owned events the current re-derivation cannot reach, keyed by event id.
@@ -1270,9 +1328,48 @@ def _reconcile_snapshot_identities(
         )
 
 
+def _suppression_deletes_snapshot(record: Mapping, *, weekly: bool,
+                                  five_hour: bool) -> bool:
+    """Whether the stale-replica suppressions naming one snapshot delete it
+    (#825/#832 spec 4.7 revisions 6 and 7), as the journal appliers
+    materialize them. A five-hour credit retires an unheld row's five-hour
+    reading in place and deletes a held row; a weekly suppression makes a row
+    that carries its own five-hour reading weekly-held and deletes a row that
+    keeps no evidence on either axis. Both retirements together delete the
+    row, in either order."""
+    payload = record.get("payload") or {}
+    held = payload.get("weekly_observation_held") == 1
+    carries_five_hour = (
+        payload.get("five_hour_percent") is not None
+        and payload.get("five_hour_resets_at") is not None
+        and payload.get("source") != "record-credit"
+    )
+    if weekly and five_hour:
+        return True
+    if five_hour:
+        return held
+    if weekly:
+        return not carries_five_hour
+    return False
+
+
+def _without_snapshot_suppression(payload: Mapping) -> Mapping:
+    """``payload`` without its `weekly_usage_snapshots` stale-replica
+    suppression list. Since spec 4.7 revision 7 (fix round K16b) a
+    suppression that names a reviewed-held snapshot can leave it
+    materialized (a weekly credit keeps a row carrying its own five-hour
+    reading weekly-held), and that list is then a retirement effect on the
+    snapshot, not a reference that depends on it."""
+    if ("suppression" not in payload
+            or payload.get("suppression_table", "weekly_usage_snapshots")
+            != "weekly_usage_snapshots"):
+        return payload
+    return {key: value for key, value in payload.items() if key != "suppression"}
+
+
 def _preserve_reviewed_hold_dependencies(
     current: Mapping[str, Mapping], desired: dict[str, Mapping],
-    reviewed_weekly_hold_ids=(),
+    reviewed_weekly_hold_ids=(), historical_close_markers=None,
 ) -> None:
     """Keep frozen five-hour facts reached from exact reviewed holds.
 
@@ -1294,9 +1391,11 @@ def _preserve_reviewed_hold_dependencies(
     }
     if not snapshot_ids:
         return
-    suppressed_snapshot_ids = set()
+    weekly_named: set = set()
+    five_hour_named: set = set()
     for record in (*current.values(), *desired.values()):
-        suppression = (record.get("payload") or {}).get("suppression")
+        payload = record.get("payload") or {}
+        suppression = payload.get("suppression")
         if suppression is None:
             continue
         if not isinstance(suppression, list) or any(
@@ -1306,7 +1405,26 @@ def _preserve_reviewed_hold_dependencies(
                 "reviewed weekly hold suppression has an unfamiliar shape: "
                 + str(record.get("id"))
             )
-        suppressed_snapshot_ids.update(snapshot_ids & set(suppression))
+        named = snapshot_ids & set(suppression)
+        if (payload.get("suppression_table", "weekly_usage_snapshots")
+                != "weekly_usage_snapshots"):
+            continue
+        if payload.get("kind") == "five_hour_credit":
+            five_hour_named.update(named)
+        else:
+            weekly_named.update(named)
+    # #825/#832 spec 4.7 revision 7 (*Versioning and replay*, fix round
+    # K16b): suppression-list membership no longer implies whole-snapshot
+    # deletion. Each axis's stale-replica suppression retires its own axis
+    # (`_cctally_journal._apply_reset_with_suppression`), so a snapshot is
+    # deleted only where the materialization deletes it.
+    suppressed_snapshot_ids = {
+        snapshot_id for snapshot_id in weekly_named | five_hour_named
+        if _suppression_deletes_snapshot(
+            (desired.get(snapshot_id) or current.get(snapshot_id) or {}),
+            weekly=snapshot_id in weekly_named,
+            five_hour=snapshot_id in five_hour_named)
+    }
     if suppressed_snapshot_ids:
         for event_id, record in (*current.items(), *desired.items()):
             payload = record.get("payload") or {}
@@ -1328,7 +1446,8 @@ def _preserve_reviewed_hold_dependencies(
         payload = record.get("payload") or {}
         usage_ref = payload.get("usage_snapshot_ref")
         if usage_ref not in snapshot_ids:
-            if _contains_any_value(payload, snapshot_ids):
+            if _contains_any_value(_without_snapshot_suppression(payload),
+                                   snapshot_ids):
                 raise RederiveConflict(
                     "reviewed weekly hold dependency has an unfamiliar shape: "
                     + event_id
@@ -1373,7 +1492,8 @@ def _preserve_reviewed_hold_dependencies(
         payload = record.get("payload") or {}
         usage_ref = payload.get("usage_snapshot_ref")
         if usage_ref not in snapshot_ids:
-            if _contains_any_value(payload, snapshot_ids):
+            if _contains_any_value(_without_snapshot_suppression(payload),
+                                   snapshot_ids):
                 raise RederiveConflict(
                     "reviewed weekly hold dependency has an unfamiliar shape: "
                     + event_id
@@ -1413,7 +1533,9 @@ def _preserve_reviewed_hold_dependencies(
 
     held_windows = set()
     for snapshot_id in snapshot_ids:
-        payload = (current.get(snapshot_id) or {}).get("payload") or {}
+        # #885: only final support may freeze a close. A current snapshot
+        # absent from this dependency-closed target is retired by this plan.
+        payload = (desired.get(snapshot_id) or {}).get("payload") or {}
         if payload.get("kind") != "snapshot_accept":
             continue
         account_key = payload.get("account_key")
@@ -1449,6 +1571,21 @@ def _preserve_reviewed_hold_dependencies(
                 merged_payload[field] = proposed_payload[field]
         merged = dict(record)
         merged["payload"] = merged_payload
+        marker = (historical_close_markers or {}).get(event_id)
+        if marker is not None and not _same_child_population(
+            payload, proposed_payload,
+        ):
+            # Hold merging must not hide a failed population proof from the
+            # close resolver. Leave the unmarked frozen fact uncertain.
+            historical_close_markers.pop(event_id, None)
+            marker = None
+        if (marker is not None and not payload.get("_pricing")
+                and payload.get("pricing_provenance_json") is None):
+            # #885: the proof already checked replay's retained population.
+            # Compose its marker with the hold's money-preserving weekly-axis
+            # correction now, rather than waiting for structure to match on
+            # the next invocation. The hold still keeps every monetary byte.
+            merged = _with_close_marker(merged, marker)
         desired[event_id] = merged
 
 
@@ -1568,6 +1705,7 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
                             reviewed_weekly_hold_ids=(),
                             uncertain_cost_fact_ids=(),
                             historical_close_markers=None,
+                            physical_revisions=None,
                             enforce_guard=True) -> RederivePlan:
     """Diff current effective events against one scratch-derived desired set.
 
@@ -1602,6 +1740,12 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
     are decided by :func:`_resolve_closed_block_milestones` before the diff,
     the same way closes are decided before milestones."""
     conflicted_event_ids = frozenset(conflicted_event_ids or ())
+    historical_close_markers = dict(historical_close_markers or {})
+    # #825/#832 fix round A (Codex fix-round-1 Q2): the highest revision of
+    # every physical record admission hides (an excluded legacy event or
+    # correction action). A new revision is allocated above it, so the
+    # previous release never reads a same-revision conflict.
+    physical_revisions = dict(physical_revisions or {})
     desired = _desired_by_id(desired_events)
     current = {
         event_id: selected.record
@@ -1615,7 +1759,7 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
         snapshot_identity_decisions,
     )
     _preserve_reviewed_hold_dependencies(
-        current, desired, reviewed_weekly_hold_ids,
+        current, desired, reviewed_weekly_hold_ids, historical_close_markers,
     )
     retained_event_count = sum(
         1 for selected in selection.by_id.values()
@@ -1634,7 +1778,6 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
         for kind in sorted(_EVT_CLASSIFICATIONS)
     }
     actions: list[PlanAction] = []
-    historical_close_markers = dict(historical_close_markers or {})
     drifted_close_ids: set = set()
 
     def _kind(record):
@@ -1767,6 +1910,9 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
             disposition = "add"
             at = str(desired_record["at"])
             payload = dict(desired_record.get("payload") or {})
+        floor = physical_revisions.get(event_id)
+        if floor is not None and revision <= floor:
+            revision = floor + 1
         counts[disposition] += 1
         kind_record = (
             current_record if disposition == "tombstone"
@@ -1855,8 +2001,8 @@ def _replaced_block_closure(
     current content, whatever its total), or a money-preserving correction.
     A tombstone carries no payload; its block is read from its current
     record. Only reviewed actions are ever added, each once. The reverse
-    direction, a causal close action whose milestones are identical in both
-    plans, is #883's.
+    direction also applies (#883): an included replacing close brings its
+    milestone actions, even when B and R make those actions identically.
     """
     def block(action):
         if action.disposition == "tombstone":
@@ -1902,7 +2048,7 @@ def _replaced_block_closure(
         replacing.pop(key, None)
     triggered = {
         block(action) for action in included
-        if action.kind == "five_hour_milestone"
+        if action.kind in {"five_hour_milestone", "five_hour_block_close"}
         and block(action) in replacing
     }
     if not triggered:
@@ -1923,6 +2069,152 @@ def _replaced_block_closure(
     return expanded
 
 
+def _monetary_chain_closure(
+    included: list, reviewed_actions, current_events: Mapping[str, Mapping],
+) -> list:
+    """#883: retain the reviewed final predecessor basis of causal marginals.
+
+    An action can change a row's occupied threshold, segment or block cost.
+    The nearest-lower threshold group is then a dependency of every present
+    marginal above it, in both the current and reviewed final populations.
+    Filtering can otherwise leave behind a retired or moved successor with
+    its old marginal. Changed rows entering or leaving either interval are
+    dependencies too: keeping one would select the wrong predecessor.
+    Include dependencies in both directions, even when a
+    successor needs no action itself. A marginal-only correction therefore
+    brings a changed predecessor, but cannot propagate through its unchanged
+    block cost to unrelated siblings. Null marginals have no monetary edge.
+
+    Only reviewed actions are added. Frozen crossing costs have already been
+    settled by the full planner, so closing these edges never reprices them.
+    """
+    final = dict(current_events)
+    for action in reviewed_actions:
+        if action.disposition == "tombstone":
+            final.pop(action.event_id, None)
+        else:
+            final[action.event_id] = {"payload": action.payload or {}}
+
+    def monetary_position(record):
+        payload = (record or {}).get("payload") or {}
+        if payload.get("kind") != "five_hour_milestone":
+            return None
+        threshold = _usable_threshold(payload.get("percent_threshold"))
+        if threshold is None:
+            return None
+        return (_milestone_segment_key(payload), threshold,
+                payload.get("block_cost_usd"))
+
+    changed = {
+        action.event_id for action in reviewed_actions
+        if action.kind == "five_hour_milestone"
+        and monetary_position(current_events.get(action.event_id))
+        != monetary_position(final.get(action.event_id))
+    }
+    if not changed:
+        return included
+    def occupied_thresholds(events, event_ids):
+        occupied: dict[tuple, dict[int, set[str]]] = {}
+        for event_id in event_ids:
+            position = monetary_position(events.get(event_id))
+            if position is not None:
+                segment, threshold, _cost = position
+                occupied.setdefault(segment, {}).setdefault(
+                    threshold, set()).add(event_id)
+        return occupied
+
+    edges: dict[str, set[str]] = {}
+    for population, other in ((final, current_events), (current_events, final)):
+        occupied = occupied_thresholds(population, population)
+        changed_other = occupied_thresholds(other, changed)
+        for event_id, record in population.items():
+            payload = record.get("payload") or {}
+            position = monetary_position(record)
+            if (position is None or payload.get("marginal_cost_usd") is None
+                    or not _usable_amount(payload.get("block_cost_usd"))):
+                continue
+            segment, threshold, _cost = position
+            lower = [value for value in occupied[segment] if value < threshold]
+            nearest = max(lower) if lower else None
+            dependencies = (
+                occupied[segment][nearest] & changed if nearest is not None
+                else set()
+            )
+            for prior_threshold, prior_ids in changed_other.get(segment, {}).items():
+                if (prior_threshold < threshold
+                        and (nearest is None or prior_threshold >= nearest)):
+                    dependencies.update(prior_ids)
+            if dependencies:
+                edges.setdefault(event_id, set()).update(dependencies)
+                for dependency_id in dependencies:
+                    edges.setdefault(dependency_id, set()).add(event_id)
+    # Retained rows participate as dependency nodes too, although there is no
+    # reviewed action to emit for them. Visit each monetary edge once rather
+    # than rescanning the full graph for every later threshold in a chain.
+    required_ids = {action.event_id for action in included}
+    pending = list(required_ids)
+    while pending:
+        event_id = pending.pop()
+        added = edges.get(event_id, set()) - required_ids
+        required_ids.update(added)
+        pending.extend(added)
+    return [action for action in reviewed_actions
+            if action.event_id in required_ids]
+
+
+def _causal_snapshot_closure(actions, reviewed_by_id, current_events):
+    """Close explicit references, keeping a selected dependency if needed."""
+    action_by_id = {action.event_id: action for action in actions}
+    dependency_tombstones = set()
+    for action in actions:
+        if (action.disposition == "tombstone"
+                or action.kind not in _SNAPSHOT_DEPENDENT_KINDS):
+            continue
+        for field, expected_kind in _milestone_dependencies(action.kind).items():
+            reference = (action.payload or {}).get(field)
+            if reference in _EMPTY_REFERENCE_SENTINELS:
+                continue
+            dependency_action = action_by_id.get(reference)
+            if (dependency_action is not None
+                    and dependency_action.disposition == "tombstone"):
+                current = current_events.get(reference)
+                if ((current or {}).get("payload") or {}).get("kind") \
+                        != expected_kind:
+                    raise RederiveConflict(
+                        "causal milestone dependency cannot be retained: "
+                        + action.event_id)
+                dependency_tombstones.add(reference)
+    actions = [action for action in actions
+               if action.event_id not in dependency_tombstones]
+    target_events = dict(current_events)
+    for action in actions:
+        if action.disposition == "tombstone":
+            target_events.pop(action.event_id, None)
+        else:
+            target_events[action.event_id] = {"payload": action.payload or {}}
+    # Appending to this list intentionally visits newly required dependencies.
+    for action in actions:
+        if (action.disposition == "tombstone"
+                or action.kind not in _SNAPSHOT_DEPENDENT_KINDS):
+            continue
+        for field, expected_kind in _milestone_dependencies(action.kind).items():
+            reference = (action.payload or {}).get(field)
+            if reference in _EMPTY_REFERENCE_SENTINELS:
+                continue
+            target = target_events.get(reference)
+            if ((target or {}).get("payload") or {}).get("kind") == expected_kind:
+                continue
+            dependency = reviewed_by_id.get(reference)
+            if (dependency is None or dependency.disposition == "tombstone"
+                    or dependency.kind != expected_kind
+                    or (dependency.payload or {}).get("kind") != expected_kind):
+                raise RederiveConflict(
+                    "causal milestone dependency is missing: " + action.event_id)
+            actions.append(dependency)
+            target_events[reference] = {"payload": dependency.payload or {}}
+    return actions
+
+
 def causal_delta_plan(
     baseline: RederivePlan, reviewed: RederivePlan, *,
     current_events: Mapping[str, Mapping],
@@ -1939,8 +2231,8 @@ def causal_delta_plan(
     #875 (spec §4.5): a five-hour block whose close R replaces, by §4.1's
     money rule, is applied whole whenever the subset changes one of its
     milestones, and a block R holds frozen never is; see
-    :func:`_replaced_block_closure`. The snapshot-dependency closure then runs
-    over that expanded set.
+    :func:`_replaced_block_closure`. Monetary predecessor/successor edges and
+    snapshot references are closed with it until the final graph stabilizes.
     """
     if (
         baseline.journal_high_water != reviewed.journal_high_water
@@ -1971,73 +2263,18 @@ def causal_delta_plan(
             )
         )
     ]
-    actions = _replaced_block_closure(
-        actions, reviewed.actions, current_events)
-    action_by_id = {action.event_id: action for action in actions}
-    dependency_tombstones = set()
-    for action in actions:
-        if (action.disposition == "tombstone"
-                or action.kind not in _SNAPSHOT_DEPENDENT_KINDS):
-            continue
-        payload = action.payload or {}
-        for field, expected_kind in _milestone_dependencies(
-            action.kind
-        ).items():
-            reference = payload.get(field)
-            if reference in _EMPTY_REFERENCE_SENTINELS:
-                continue
-            dependency_action = action_by_id.get(reference)
-            if (dependency_action is not None
-                    and dependency_action.disposition == "tombstone"):
-                current = current_events.get(reference)
-                if ((current or {}).get("payload") or {}).get("kind") \
-                        != expected_kind:
-                    raise RederiveConflict(
-                        "causal milestone dependency cannot be retained: "
-                        + action.event_id
-                    )
-                dependency_tombstones.add(reference)
-    if dependency_tombstones:
-        actions = [
-            action for action in actions
-            if action.event_id not in dependency_tombstones
-        ]
-
-    target_events = dict(current_events)
-    for action in actions:
-        if action.disposition == "tombstone":
-            target_events.pop(action.event_id, None)
-        else:
-            target_events[action.event_id] = {"payload": action.payload or {}}
-    for action in actions:
-        if (action.disposition == "tombstone"
-                or action.kind not in _SNAPSHOT_DEPENDENT_KINDS):
-            continue
-        payload = action.payload or {}
-        for field, expected_kind in _milestone_dependencies(
-            action.kind
-        ).items():
-            reference = payload.get(field)
-            if reference in _EMPTY_REFERENCE_SENTINELS:
-                continue
-            target = target_events.get(reference)
-            if ((target or {}).get("payload") or {}).get("kind") \
-                    != expected_kind:
-                dependency = reviewed_by_id.get(reference)
-                if (
-                    dependency is None
-                    or dependency.disposition == "tombstone"
-                    or dependency.kind != expected_kind
-                    or (dependency.payload or {}).get("kind") != expected_kind
-                ):
-                    raise RederiveConflict(
-                        "causal milestone dependency is missing: "
-                        + action.event_id
-                    )
-                actions.append(dependency)
-                target_events[reference] = {
-                    "payload": dependency.payload or {},
-                }
+    # Close block, monetary and explicit-reference edges to a fixed point.
+    # A dependency introduced by one phase must be seen by every other phase.
+    while True:
+        previous_ids = {action.event_id for action in actions}
+        actions = _replaced_block_closure(
+            actions, reviewed.actions, current_events)
+        actions = _monetary_chain_closure(
+            actions, reviewed.actions, current_events)
+        actions = _causal_snapshot_closure(
+            actions, reviewed_by_id, current_events)
+        if {action.event_id for action in actions} == previous_ids:
+            break
     included_ids = {action.event_id for action in actions}
     actions = tuple(
         action for action in reviewed.actions

package/bin/_lib_segment_summary.py

@@ -84,7 +84,7 @@ SIDECAR_NAME = ".segment-summaries"
 #: Bumped by hand when a summary's FIELD SET or the meaning of one of its
 #: numbers changes. It is only one of the three inputs to `summary_version`; the
 #: other two are derived, for the reason that function's docstring gives.
-SUMMARY_SHAPE_VERSION = 3
+SUMMARY_SHAPE_VERSION = 4
 
 #: The refusal reasons `summary_is_elidable` returns. They are stable, because
 #: the rebuild record reports them (spec section 6.3, "recorded, not silent").
@@ -121,6 +121,14 @@ class SegmentSummary:
     malformed: int = 0
     #: True when the segment holds ZERO records of a retained type.
     quota_only: bool = True
+    #: #825/#832 fix round A (Codex fix-round-1 Q4): True only when EVERY
+    #: decoded record in the summarized extent is a positively identified
+    #: Codex quota observation — no Claude, administrative, protocol or
+    #: unknown record. The one proof that lets a segment past the account-bound
+    #: cutover's frozen extents be elided: a summary describes its lines
+    #: WITHOUT admission, and `quota_only` alone still admits a stamped Claude
+    #: observation that feeds the quarantine and the derivation completion.
+    codex_quota_only: bool = False
     #: Elements the segment contributed to the rebuild's `decoded` list —
     #: retained records plus placeholders, and never a malformed line. `None`
     #: means the summary predates the field and cannot be elided against.
@@ -227,7 +235,8 @@ def summary_is_elidable(
 _FIELDS = (
     "segment_name", "st_dev", "st_ino", "summarized_size",
     "complete_line_covered_offset", "lines", "bytes", "decodes", "malformed",
-    "quota_only", "decoded_entry_count", "complete_prefix_sha256",
+    "quota_only", "codex_quota_only", "decoded_entry_count",
+    "complete_prefix_sha256",
     "last_seen_stamped",
     "last_seen_legacy_claude_at", "last_seen_legacy_codex_at",
 )
@@ -285,6 +294,7 @@ def to_wire(summary) -> dict:
         "decodes": int(summary.decodes),
         "malformed": int(summary.malformed),
         "quota_only": bool(summary.quota_only),
+        "codex_quota_only": bool(summary.codex_quota_only),
         "decoded_entry_count": (
             None if summary.decoded_entry_count is None
             else int(summary.decoded_entry_count)),
@@ -326,6 +336,7 @@ def from_wire(item) -> SegmentSummary:
         decodes=int(item["decodes"]),
         malformed=int(item["malformed"]),
         quota_only=bool(item["quota_only"]),
+        codex_quota_only=bool(item["codex_quota_only"]),
         decoded_entry_count=None if count is None else int(count),
         complete_prefix_sha256=(
             None if item["complete_prefix_sha256"] is None
@@ -427,6 +438,28 @@ def read_sidecar(path):
         return None
 
 
+def admission_permits_elision(boundary, name, pinned_raw_extent,
+                              summary) -> bool:
+    """Whether the account-bound admission fence lets segment ``name`` be
+    elided at all (#825/#832 fix round A, Codex fix-round-1 Q4). The rebuild
+    and the prefix validation share it; every other elision condition is
+    still `summary_is_elidable`'s.
+
+    A summary describes its lines without admission. A wholly historical
+    extent (inside the cutover's frozen extent for that segment) needs no
+    admission. Past it, only a summary proving every decoded record a Codex
+    quota observation — always admitted, never a quarantine or completion
+    input — may stand in for reading the segment; anything unproven (no
+    summary, an older shape, a mixed segment) is scanned.
+    """
+    if boundary is None:
+        return True
+    extent = boundary.frozen_extents.get(name)
+    if extent is not None and int(pinned_raw_extent) <= int(extent):
+        return True
+    return summary is not None and bool(summary.codex_quota_only)
+
+
 def with_identity(summary, *, st_dev, st_ino) -> SegmentSummary:
     """``summary`` restamped with the inode identity of the file just read."""
     return replace(summary, st_dev=int(st_dev), st_ino=int(st_ino))

package/bin/_lib_snapshot_cache.py

@@ -1315,6 +1315,15 @@ class CodexAccountingCacheResult:
     #: the generation this capture builds and admits a retained generation
     #: only while its stamp equals `codex_accounting_consumed_provenance()`.
     provenance_token: int | None = None
+    #: #872: the NAME of the population `changed_old` / `changed_new` are
+    #: relative to — the prior state's `population_signature` and provenance
+    #: token, read before this call mutated the state. `None` on every COLD
+    #: result: a cold delta replaces the whole population relative to nothing
+    #: a consumer can name (an empty state, a reset, an overflow clear, or a
+    #: semantic/start/end/sequence/overflow cold trigger), so a consumer must
+    #: derive from the full population instead of advancing retained state.
+    base_population_signature: tuple | None = None
+    base_provenance_token: int | None = None
 
 
 _CODEX_ACCOUNTING_CACHE_STATE: dict[str, object] = _ObservedSnapshotDict()
@@ -1551,6 +1560,14 @@ def build_cached_codex_accounting(
     attribution_revision = _codex_window_attribution_revision(cache_conn)
     state = _CODEX_ACCOUNTING_CACHE_STATE
     prior_cached_entries = tuple(state.get("entries", ())) if state else ()
+    # #872: the delta's base, read before any branch below mutates the state.
+    prior_signature = state.get("population_signature") if state else None
+    if not isinstance(prior_signature, tuple):
+        prior_signature = None
+    prior_token = (
+        state.get(_CODEX_ACCOUNTING_PROVENANCE_STATE_KEY) if state else None)
+    if not isinstance(prior_token, int):
+        prior_token = None
 
     def signature(generation: int) -> tuple | None:
         """The exact identity of the population this call is returning.
@@ -1683,6 +1700,8 @@ def build_cached_codex_accounting(
             population_signature=population_signature,
             provenance_token=_consume_codex_accounting_provenance(
                 provenance_token),
+            base_population_signature=prior_signature,
+            base_provenance_token=prior_token,
         )
 
     dirty_paths = tuple(sorted(dirty))
@@ -1736,6 +1755,8 @@ def build_cached_codex_accounting(
         entries, dirty_paths, dirty_accounts, False, changed_old, changed_new,
         population_signature=population_signature,
         provenance_token=_consume_codex_accounting_provenance(provenance_token),
+        base_population_signature=prior_signature,
+        base_provenance_token=prior_token,
     )