cctally 1.114.0 → 1.115.0

package/bin/_lib_codex_conversation_query.py

@@ -27,11 +27,13 @@ import json
 import os
 import re
 import sqlite3
+import stat
 import threading
 from collections import deque
 from types import MappingProxyType
 
 import _lib_codex_conversation as kern
+import _lib_codex_rollout_container as _rc
 import _lib_codex_landmarks as landmarks
 import _lib_codex_segments as segkern
 from _lib_codex_find_projection import (
@@ -1863,6 +1865,29 @@ def codex_conversation_exists(conn: sqlite3.Connection, conversation_key: str) -
     return row is not None
 
 
+def codex_publication_pending(
+    conn: sqlite3.Connection, conversation_key: str,
+) -> bool:
+    """A barrier-population conversation with no publication yet (#968 5.11).
+
+    Such a conversation stays in the existing pending-state handling until it
+    has an eligible publication: it answers ``normalization_pending``, never
+    ``not_found``. Any store error answers False (the caller's ``not_found``).
+    """
+    try:
+        if conn.execute(
+                "SELECT 1 FROM cache_db.codex_barrier_population "
+                "WHERE conversation_key=?", (conversation_key,)).fetchone() is None:
+            return False
+        row = conn.execute(
+            "SELECT published_revision, legacy_uncertified "
+            "FROM main.codex_conversation_publications WHERE conversation_key=?",
+            (conversation_key,)).fetchone()
+    except sqlite3.Error:
+        return False
+    return row is None or (int(row[0] or 0) == 0 and not row[1])
+
+
 def codex_conversation_source_paths(
     conn: sqlite3.Connection, conversation_key: str
 ) -> list[str]:
@@ -2345,6 +2370,9 @@ def get_codex_conversation(
     # ── Phase A: the narrow index pass ───────────────────────────────────────
     rows, detail_bytes = _load_conversation_index_rows(conn, conversation_key)
     if not rows:
+        if codex_publication_pending(conn, conversation_key):
+            return {"status": "normalization_pending",
+                    "conversation_key": conversation_key, "items": [], "children": []}
         return {"status": "not_found", "conversation_key": conversation_key}
     undecodable_keys = undecodable_codex_conversation_keys(conn)
     kept, _suppressed = kern.pair_mirrors(rows)
@@ -3035,6 +3063,9 @@ def _outline_envelope(
     # The outline is not the route F3 bounds, and it stays turn-granular.
     rows = _load_conversation_rows(conn, conversation_key)
     if not rows:
+        if codex_publication_pending(conn, conversation_key):
+            return {"status": "normalization_pending",
+                    "conversation_key": conversation_key, "turns": [], "files": [], "children": []}
         return {"status": "not_found", "conversation_key": conversation_key}
     detail_bytes = _detail_bytes_of(rows)
     kept, _suppressed = kern.pair_mirrors(rows)
@@ -3421,20 +3452,26 @@ def _stored_browse_page_queries(
             "(COALESCE(r.last_activity_utc, '') = ? AND r.conversation_key < ?))")
         page_params.extend((cursor_last, cursor_last, cursor_key))
 
+    # Keep native/parent enrichment inside the page statement. A LEFT JOIN
+    # against the compound last-good view materializes retained history;
+    # correlated probes push these predicates into its indexed branches.
+    # The scalar parent lookup follows the detail reader's same-root lookup.
+    parent_key_sql = (
+        "(SELECT pt.conversation_key FROM codex_conversation_threads pt "
+        "WHERE pt.source_root_key = r.source_root_key "
+        "AND pt.native_thread_id = r.parent_thread_id "
+        "AND pt.conversation_key != r.conversation_key LIMIT 1)"
+    )
     sql = (
         "SELECT r.conversation_key, r.item_count, r.started_utc, "
         "r.last_activity_utc, r.project_key, r.project_label, r.models_json, "
-        "r.title, r.parent_thread_id, r.source_root_key, t.native_thread_id, "
-        "pt.conversation_key, pr.title, pr.project_label, pt.native_thread_id "
+        "r.title, r.parent_thread_id, r.source_root_key, "
+        "(SELECT t.native_thread_id FROM codex_conversation_threads t "
+        "WHERE t.conversation_key = r.conversation_key), "
+        f"{parent_key_sql}, pr.title, pr.project_label, r.parent_thread_id "
         "FROM codex_conversation_rollups r "
-        "LEFT JOIN codex_conversation_threads t "
-        "ON t.conversation_key = r.conversation_key "
-        "LEFT JOIN codex_conversation_threads pt "
-        "ON pt.source_root_key = r.source_root_key "
-        "AND pt.native_thread_id = r.parent_thread_id "
-        "AND pt.conversation_key != r.conversation_key "
         "LEFT JOIN codex_conversation_rollups pr "
-        "ON pr.conversation_key = pt.conversation_key "
+        f"ON pr.conversation_key = {parent_key_sql} "
         f"WHERE {' AND '.join(page_where)} "
         "ORDER BY COALESCE(r.last_activity_utc, '') DESC, r.conversation_key DESC"
     )
@@ -4962,6 +4999,8 @@ def find_in_codex_conversation(
         return {**base, "status": "normalization_pending"}
     rows = _load_conversation_rows(conn, conversation_key)
     if not rows:
+        if codex_publication_pending(conn, conversation_key):
+            return {**base, "status": "normalization_pending"}
         return {"status": "not_found", "conversation_key": conversation_key}
     q = (query or "").strip()
     if not q:
@@ -5021,6 +5060,9 @@ def codex_conversation_prompts(conn: sqlite3.Connection, conversation_key: str)
                 "conversation_key": conversation_key, "prompts": []}
     rows = _load_conversation_rows(conn, conversation_key)
     if not rows:
+        if codex_publication_pending(conn, conversation_key):
+            return {"status": "normalization_pending",
+                    "conversation_key": conversation_key, "prompts": []}
         return {"status": "not_found", "conversation_key": conversation_key}
     kept, _suppressed = kern.pair_mirrors(rows)
     items = kern.canonical_items(kept)
@@ -5061,7 +5103,40 @@ def _within_root(source_path: str | None, root_path: str | None) -> bool:
         return False
 
 
-def _reread_codex_full_content(conn: sqlite3.Connection, row):
+class CodexContainerReadError(RuntimeError):
+    """A present rollout failed to read; the query envelope reports HTTP 500."""
+
+    def __init__(self, category: str, logical: str) -> None:
+        super().__init__(f"Codex rollout could not be read ({category})")
+        self.category = category
+        self.logical = logical
+
+
+class _CodexPayloadContainmentError(RuntimeError):
+    """Internal 404 signal: the selected physical container escaped its root."""
+
+
+def _select_codex_payload_container(logical):
+    # The discovery leaf deliberately treats stat failures as absent. A payload
+    # request must distinguish a missing container (410) from inaccessible data
+    # (500), including an inaccessible plain file beside a readable zstd twin.
+    for candidate in (logical, _rc.zstd_twin(logical)):
+        try:
+            info = os.stat(candidate)
+        except (FileNotFoundError, NotADirectoryError):
+            continue
+        except OSError as exc:
+            raise CodexContainerReadError("read-error", str(logical)) from exc
+        if not stat.S_ISREG(info.st_mode):
+            raise CodexContainerReadError("read-error", str(logical))
+        selected = _rc.select_container(logical)
+        if selected is not None:
+            return selected
+        # It disappeared between the strict stat and selection; try the twin.
+    return None
+
+
+def _reread_codex_full_content(conn: sqlite3.Connection, row, *, streams: "dict | None" = None):
     """Re-read the physical line at ``(row.source_path, row.line_offset)``, validate
     it against the stored ``codex_conversation_events.payload_json`` for that exact
     position (§3.4 structural gone-check — the canonical FULL record, not
@@ -5073,19 +5148,49 @@ def _reread_codex_full_content(conn: sqlite3.Connection, row):
     The full pre-cap content is re-derived through the SAME ``_extract`` the
     normalizer uses — which is how payload serves content beyond the normalized
     ``CODEX_TEXT_CAP``. Truncation/``truncated`` is against ``_FULL_PAYLOAD_CEILING``
-    (1,000,000 Python characters), the same ceiling the Claude payload path uses."""
+    (1,000,000 Python characters), the same ceiling the Claude payload path uses.
+
+    #968: select plain first, else zstd, and seek in decoded offsets. Streams are
+    request-local and reusable; no decoded copies persist. Present unreadable
+    containers raise CodexContainerReadError, never a false gone result."""
     stored = conn.execute(
         "SELECT payload_json FROM codex_conversation_events "
         "WHERE source_path = ? AND line_offset = ?",
         (row.source_path, row.line_offset)).fetchone()
     if stored is None:
         return None
-    try:
-        with open(row.source_path, "rb") as fh:
-            fh.seek(row.line_offset)
-            line = fh.readline()
-    except OSError:
-        return None
+    for attempt in range(2):
+        selected = _select_codex_payload_container(row.source_path)
+        if selected is None:
+            return None
+        # Validate exactly the descriptor we open, including after a compression
+        # race. The caller has already checked the logical path and known root.
+        root_path = _codex_source_root_path(conn, row.source_root_key)
+        if not _within_root(str(selected.path), root_path):
+            raise _CodexPayloadContainmentError()
+        try:
+            fh = None if streams is None else streams.get(str(selected.path))
+            if fh is None:
+                fh = _rc.open_decoded(selected)
+                if streams is not None:
+                    streams[str(selected.path)] = fh
+            try:
+                fh.seek(row.line_offset)
+                line = fh.readline()
+            finally:
+                if streams is None:
+                    fh.close()
+            break
+        except OSError as exc:
+            # ContainerError subclasses OSError; preserve its approved leaf
+            # category instead of flattening decoder/integrity errors.
+            replacement = _select_codex_payload_container(row.source_path)
+            if replacement is None:
+                return None
+            if replacement.path != selected.path and attempt == 0:
+                continue  # plain vanished during Codex's compression window
+            category = exc.category if isinstance(exc, _rc.ContainerError) else "read-error"
+            raise CodexContainerReadError(category, str(row.source_path)) from exc
     try:
         obj = json.loads(line.decode("utf-8"))
     except (UnicodeDecodeError, ValueError, TypeError):
@@ -5172,7 +5277,9 @@ def read_codex_payload(
     full bounded ``card``, and ``truncated`` reflects ``_FULL_PAYLOAD_CEILING``.
     ``gone`` (→ HTTP 410) means the physical
     record moved/mutated; ``not_found`` (→ 404) means no such block, no output
-    partner, or a containment miss (a read is never attempted outside the root)."""
+    partner, or a containment miss (a read is never attempted outside the root).
+    A present container that cannot be read raises CodexContainerReadError through
+    the existing query-error envelope, including plain-file read failures."""
     miss = {"status": "not_found", "block_key": block_key, "which": which}
     if which not in ("call", "output", "event"):
         return miss
@@ -5187,7 +5294,14 @@ def read_codex_payload(
     root_path = _codex_source_root_path(conn, target.source_root_key)
     if not _within_root(target.source_path, root_path):
         return miss
-    outcome = _reread_codex_full_content(conn, target)
+    streams: dict = {}
+    try:
+        outcome = _reread_codex_full_content(conn, target, streams=streams)
+    except _CodexPayloadContainmentError:
+        return miss
+    finally:
+        for stream in streams.values():
+            stream.close()
     if outcome is None:
         return {"status": "gone", "block_key": block_key, "which": which}
     content, truncated, card = outcome

package/bin/_lib_codex_conversation_watch.py

@@ -43,15 +43,16 @@ All six §5.4 bullets are contract:
    its first ingest attempt (so a discovered file is never lost even if its
    first ingest is dirty/lock-contended and leaves no cursor row). A path is
    retried while unclassified: with no committed cursor it is surfaced every
-   time it is visited; with a committed cursor it is surfaced only when its size
-   exceeds that cursor (an incomplete-``session_meta`` tail completing without
-   any directory-mtime change). A path leaves the set when the driver ``reap``s
+   time it is visited; with a committed cursor it is surfaced only when its
+   signature advances beyond that cursor (an incomplete-``session_meta`` tail
+   completing without any directory-mtime change). A path leaves the set when the driver ``reap``s
    it (it gained a thread row — child or non-child), when it vanishes, or on a
    bounded per-candidate expiry (handed to the next full sync).
 """
 from __future__ import annotations
 
 import os
+import _lib_codex_rollout_container as _rc
 
 
 # ── production-default injected callables ─────────────────────────────────────
@@ -101,6 +102,48 @@ def default_file_size(filepath):
     return st.st_size
 
 
+def default_file_sig(filepath):
+    """The selected container's live-tail signature (#968 spec 5.9).
+
+    Plain keeps today's size (as ``("plain", size)``); a compressed-only
+    rollout reports its container fingerprint instead of vanishing.
+    """
+    return _rc.observe_watch_sig(filepath)
+
+
+def _as_sig(value):
+    if value is None or isinstance(value, tuple):
+        return value
+    return (_rc.PLAIN, int(value))
+
+
+def codex_sig_advanced(observed, committed) -> bool:
+    """Whether an observed signature is ahead of the committed one.
+
+    Plain grows (append-only, size decides); any other change of a compressed
+    container, or of the container kind, is a change. A bare int on either
+    side is a legacy plain size.
+    """
+    obs, com = _as_sig(observed), _as_sig(committed)
+    if obs is None:
+        return False
+    if com is None:
+        return True
+    if obs[0] == com[0] == _rc.PLAIN:
+        return obs[1] > com[1]
+    return obs != com
+
+
+def committed_watch_sig(kind, size_bytes, container_size_bytes, mtime_ns,
+                        device, inode):
+    """The signature a cursor row's ACCEPTED container would observe: the
+    leaf's ``ContainerFingerprint.watch_sig`` shape, device included."""
+    if kind in (None, _rc.PLAIN):
+        return (_rc.PLAIN, int(size_bytes or 0))
+    return (_rc.ZSTD, int(container_size_bytes or 0), int(mtime_ns or 0),
+            int(device or 0), int(inode or 0))
+
+
 _SENTINEL = object()
 
 
@@ -118,7 +161,7 @@ class CodexChildFrontier:
         pending_expiry_cycles: int = 50,
         scandir_fn=default_scandir,
         dir_mtime_fn=default_dir_mtime,
-        file_size_fn=default_file_size,
+        file_size_fn=default_file_sig,
         clock_fn=None,
     ):
         self._walk_root = str(walk_root)
@@ -175,7 +218,7 @@ class CodexChildFrontier:
 
         ``known_paths`` — every path already tracked in ``codex_session_files``,
         so a newly enumerated file already known to some table is not
-        re-registered. ``committed_sizes`` — ``{path: size_bytes}`` committed
+        re-registered. ``committed_sizes`` — ``{path: signature}`` committed
         cursors, for the pending-growth check.
 
         Returns the set of candidate paths to targeted-ingest this cycle (new
@@ -251,8 +294,8 @@ class CodexChildFrontier:
         mtime as the dir's baseline (so a create landing during the enumeration
         is re-examined next rotation), skips symlinked descendants (the
         ``follow_symlinks=False`` boundary), adds real subdirectories to the
-        frontier, and registers brand-new ``*.jsonl`` files in ``pending`` BEFORE
-        their first ingest — surfacing each for that first ingest attempt in the
+        frontier, and registers brand-new logical rollout files in ``pending``
+        BEFORE their first ingest — surfacing each for that first ingest attempt in the
         SAME cycle it is discovered (the pending sweep then owns the retries).
         Returns True iff it consumed a filesystem op."""
         if not self._enum_queue:
@@ -267,10 +310,12 @@ class CodexChildFrontier:
                 if path not in self._dir_set:
                     self._dir_set.add(path)
                     self._dirs.append(path)           # new subdir joins frontier
-            elif path.endswith(".jsonl"):
-                if path not in self._known and path not in self._pending:
-                    self._pending[path] = 0           # register BEFORE first ingest
-                    ingest.add(path)                  # first ingest attempt now
+            elif _rc.is_container_name(name):
+                # Both spellings enumerate one logical identity.
+                logical = os.fspath(_rc.logical_path(path))
+                if logical not in self._known and logical not in self._pending:
+                    self._pending[logical] = 0        # register BEFORE first ingest
+                    ingest.add(logical)               # first ingest attempt now
         return True
 
     def _op_pending(self, ingest: set) -> bool:
@@ -286,12 +331,12 @@ class CodexChildFrontier:
             p = keys[idx]
             if p not in self._pending:                # reaped/dropped mid-cycle
                 continue
-            size = self._file_size(p)                 # 1 fs op
-            if size is None:
+            sig = self._file_size(p)                  # 1 signature probe
+            if sig is None:
                 self._pending.pop(p, None)            # vanished → drop
             else:
                 committed = self._committed.get(p)
-                if committed is None or size > committed:
+                if codex_sig_advanced(sig, committed):
                     ingest.add(p)
             return True
         return False

package/bin/_lib_codex_drain_admission.py

@@ -0,0 +1,214 @@
+"""Waiting requests and the drain-admission gate (#968 spec 5.7, 5.12).
+
+A Codex hook never waits for a lock. When it meets cache contention it
+publishes a uniquely named, immutable request record under the data
+directory (outside every SQLite store, because a contended hook cannot write
+cache.db). Drain workers — the prune executor and the container-verification
+executor — admit one identity at a time through ONE global gate and yield
+while any request is fresh:
+
+1. check for fresh requests;
+2. acquire the drain gate (non-blocking), then check again;
+3. try the store's complete lock domain without blocking, then check again;
+4. a fresh request at any check releases everything acquired and yields;
+5. otherwise the caller executes one identity, commits, releases every store
+   lock and the gate (``finish``), and starts again at step 1.
+
+Requests end only by expiry: 60 s after publication on a cross-process
+monotonic clock. A worker observing a request, or restarting, never renews it;
+a wall-clock jump cannot extend it (the wall age only shortens freshness, and
+a NEGATIVE wall age — an mtime ahead of the wall clock after a backward step —
+counts as fresh, bounded by the monotonic lifetime); a malformed record or one
+from an incompatible clock is expired and removed. Stdlib only; no cctally
+imports.
+"""
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import pathlib
+import time
+import uuid
+from typing import Callable, NamedTuple, Optional
+
+REQUEST_DIR_NAME = "codex-drain-requests"
+REQUEST_TTL_NS = 60_000_000_000
+WALL_GUARD_SECONDS = 120.0
+GATE_FILE_NAME = "codex-drain-admission.lock"
+POLL_SECONDS = 5.0
+_RECORD_VERSION = 1
+
+# Module attributes so tests can drive a deterministic schedule.
+_monotonic_ns: Callable[[], int] = time.monotonic_ns
+_sleep: Callable[[float], None] = time.sleep
+#: Post-release seam: called by ``finish`` after the store locks AND the gate
+#: are released. Production leaves it None; the fairness test synchronizes on
+#: it instead of sleeping (review P2-7).
+_after_finish: Optional[Callable[[], None]] = None
+
+
+def _request_dir(app_dir) -> pathlib.Path:
+    return pathlib.Path(app_dir) / REQUEST_DIR_NAME
+
+
+def publish_waiting_request(app_dir, *, root_keys) -> "str | None":
+    """Atomically publish one immutable request; return its id or None.
+
+    ``None`` is a protocol failure the hook records; it is never fairness
+    evidence and never raises.
+    """
+    try:
+        directory = _request_dir(app_dir)
+        directory.mkdir(parents=True, exist_ok=True)
+        mono = int(_monotonic_ns())
+        request_id = f"{mono}-{os.getpid()}-{uuid.uuid4().hex}"
+        final = directory / f"req-{request_id}.json"
+        tmp = directory / f".tmp-{request_id}"
+        payload = json.dumps({
+            "v": _RECORD_VERSION, "id": request_id,
+            "roots": sorted(str(k) for k in root_keys), "mono_ns": mono,
+        }, separators=(",", ":"))
+        with open(tmp, "x", encoding="utf-8") as fh:
+            fh.write(payload)
+            fh.flush()
+            os.fsync(fh.fileno())
+        os.rename(tmp, final)
+        return request_id
+    except OSError:
+        return None
+
+
+def _is_fresh(path: pathlib.Path, now_mono: int, now_wall: float) -> bool:
+    try:
+        record = json.loads(path.read_text(encoding="utf-8"))
+        mono = int(record["mono_ns"])
+        if record.get("v") != _RECORD_VERSION:
+            return False
+        wall_age = now_wall - path.stat().st_mtime
+    except (OSError, ValueError, TypeError, KeyError):
+        return False
+    age = now_mono - mono
+    # A negative monotonic age is an incompatible clock: expired. A negative
+    # WALL age is only an mtime ahead of the wall clock, which is not evidence
+    # of staleness: it stays fresh, and the monotonic bound still ends it
+    # within the single 60 s lifetime (review P3-5).
+    return 0 <= age < REQUEST_TTL_NS and wall_age < WALL_GUARD_SECONDS
+
+
+def fresh_requests(app_dir) -> "list[str]":
+    """Ids of fresh requests; expired or malformed records are removed one by one."""
+    directory = _request_dir(app_dir)
+    try:
+        entries = sorted(directory.iterdir())
+    except OSError:
+        return []
+    now_mono = int(_monotonic_ns())
+    now_wall = time.time()
+    fresh: list[str] = []
+    for path in entries:
+        name = path.name
+        if name.startswith(".tmp-"):
+            try:
+                if now_wall - path.stat().st_mtime >= WALL_GUARD_SECONDS:
+                    path.unlink()
+            except OSError:
+                pass
+            continue
+        if not (name.startswith("req-") and name.endswith(".json")):
+            continue
+        if _is_fresh(path, now_mono, now_wall):
+            fresh.append(name[len("req-"):-len(".json")])
+        else:
+            try:
+                path.unlink()
+            except OSError:
+                pass
+    return fresh
+
+
+class DrainGate:
+    """The one global, non-blocking drain-admission flock."""
+
+    def __init__(self, app_dir):
+        self._path = pathlib.Path(app_dir) / GATE_FILE_NAME
+        self._fd: "int | None" = None
+
+    def try_acquire(self) -> bool:
+        if self._fd is not None:
+            return True
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        fd = os.open(self._path, os.O_RDWR | os.O_CREAT, 0o600)
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError:
+            os.close(fd)
+            return False
+        self._fd = fd
+        return True
+
+    def release(self) -> None:
+        if self._fd is None:
+            return
+        try:
+            fcntl.flock(self._fd, fcntl.LOCK_UN)
+        finally:
+            os.close(self._fd)
+            self._fd = None
+
+
+class Admission(NamedTuple):
+    admitted: bool
+    store_locks: object
+    gate: "DrainGate | None"
+
+
+def admit(app_dir, try_store_locks: Callable[[], object],
+          release_store_locks: Callable[[object], None], *,
+          on_check: Optional[Callable[[str], None]] = None) -> Admission:
+    """Steps 1-4 of the protocol. ``try_store_locks`` must never block and
+    returns a token, or None on contention."""
+    def check(stage: str) -> bool:
+        if on_check is not None:
+            on_check(stage)
+        return bool(fresh_requests(app_dir))
+
+    if check("before-gate"):
+        return Admission(False, None, None)
+    gate = DrainGate(app_dir)
+    if not gate.try_acquire():
+        return Admission(False, None, None)
+    if check("after-gate"):
+        gate.release()
+        return Admission(False, None, None)
+    token = try_store_locks()
+    if token is None:
+        gate.release()
+        return Admission(False, None, None)
+    if check("after-store-locks"):
+        release_store_locks(token)
+        gate.release()
+        return Admission(False, None, None)
+    return Admission(True, token, gate)
+
+
+def finish(admission: Admission,
+           release_store_locks: Callable[[object], None]) -> None:
+    """Step 5: release every store lock, then the gate."""
+    try:
+        if admission.store_locks is not None:
+            release_store_locks(admission.store_locks)
+    finally:
+        if admission.gate is not None:
+            admission.gate.release()
+    if _after_finish is not None:
+        _after_finish()
+
+
+def wait_until_no_fresh_requests(
+        app_dir, *, should_continue: Optional[Callable[[], bool]] = None) -> None:
+    """Sleep in bounded steps until no request is fresh (requests expire)."""
+    while fresh_requests(app_dir):
+        if should_continue is not None and not should_continue():
+            return
+        _sleep(POLL_SECONDS)

package/bin/_lib_codex_metadata.py

@@ -26,6 +26,8 @@ import sqlite3
 import threading
 from collections import OrderedDict
 
+from _lib_codex_publication_barrier import LAST_GOOD_THREADS_VIEW
+
 
 #: The physical name of the raw threads table. ``resolve_codex_threads_table``
 #: returns it qualified by whichever schema actually holds it.
@@ -185,6 +187,8 @@ def _schema_holds_threads_table(conn: sqlite3.Connection, schema: str) -> bool:
 def resolve_codex_threads_table(conn: sqlite3.Connection) -> str:
     """The RAW threads table reference for this connection.
 
+    A conversations connection carrying the #968 last-good view resolves to it.
+
     A bare cache connection (``open_cache_db()``) holds the table in its own
     ``main`` schema; a conversations connection
     (``open_conversations_db``/``open_conversations_db_readonly``) reaches it
@@ -222,8 +226,21 @@ def resolve_codex_threads_table(conn: sqlite3.Connection) -> str:
             _threads_table_resolution_cache.move_to_end(conn)
             return cached
 
+    # One metadata SELECT preserves last-good priority without adding a
+    # fifth query to the bounded accounting/metadata-health read contracts.
+    schema = conn.execute(
+        "SELECT CASE "
+        "WHEN EXISTS (SELECT 1 FROM sqlite_temp_master "
+        "WHERE type='view' AND name=?) THEN 'temp' "
+        "WHEN EXISTS (SELECT 1 FROM main.sqlite_master "
+        "WHERE type='table' AND name=?) THEN 'main' END",
+        (LAST_GOOD_THREADS_VIEW, CODEX_THREADS_TABLE),
+    ).fetchone()[0]
     resolved = None
-    if _schema_holds_threads_table(conn, "main"):
+    if schema == "temp":
+        # #968 spec 5.11: unpublished metadata never overrides last-good.
+        resolved = f"temp.{LAST_GOOD_THREADS_VIEW}"
+    elif schema == "main":
         resolved = f"main.{CODEX_THREADS_TABLE}"
     else:
         attached = tuple(conn.execute("PRAGMA database_list"))