cctally 1.115.0 → 1.116.0

package/CHANGELOG.md

@@ -5,6 +5,22 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.116.0] - 2026-10-28
+
+### Added
+- `cctally doctor`, `cctally db status` and the dashboard's Doctor chip now say when a stats.db upgrade rebuild or auto-heal is running, has stalled, failed or died, or used more memory than its bound.
+
+### Changed
+- The stats.db upgrade rebuild that runs after an update, `cctally db rebuild` and `cctally db rederive` use far less memory and disk, and the upgrade rebuild finishes faster.
+
+### Fixed
+- After a usage credit, `cctally statusline` refuses an idle session's cached usage once it is proven stale, and five-hour views stop hiding genuine weekly values. `cctally db rederive` adds `retract`; stats.db rebuilds once after upgrading.
+- Under Python 3.11, `cctally quota --json` no longer reports a mix-support radius that differs in its last digits from one run to the next.
+- `cctally quota --json` reports the same `eligibilityFence` on Linux as on macOS; on Linux it could differ in its last digits.
+- A sync with nothing new to read no longer rewrites the compressed Codex rollout status in `cache.db` and `conversations.db`, so an idle `cctally dashboard` writes less to disk.
+- `cctally cache-sync --rebuild` rebuilds transcripts again on a filesystem without copy-on-write clones, such as ext4 on Linux, instead of failing every time.
+- On Python 3.11, the upgrade that moves transcripts out of `cache.db` now shrinks the file as intended. If you already upgraded on Python 3.11, run `cctally db vacuum --db cache` to reclaim the space.
+
 ## [1.115.0] - 2026-10-21
 
 ### Added

package/bin/_cctally_cache.py

@@ -102,6 +102,7 @@ import bisect
 import collections
 import contextlib
 import datetime as dt
+import errno
 import fcntl
 import json
 import os
@@ -9268,6 +9269,18 @@ def _record_codex_container_status(conn, stats, *, census_complete: bool,
                     if cursor_table == "codex_session_files"
                     else prior.get("barrier", {})),
     }
+    # #901 W8: a pass that observes the status already recorded writes
+    # nothing. Every caller runs this at finalization, the idle tick and the
+    # idle conversation pass included, and stamping `observedAt` alone wrote a
+    # WAL frame in each store on every pass more than a second after the last.
+    # `observedAt` therefore keeps the time this status was first recorded;
+    # the other timestamps already change only with the state they date.
+    def _content(status):
+        return json.dumps({k: v for k, v in status.items() if k != "observedAt"},
+                          sort_keys=True)
+
+    if prior and "observedAt" in prior and _content(prior) == _content(record):
+        return
     _set_cache_meta(conn, CODEX_CONTAINER_STATUS_KEY,
                     json.dumps(record, sort_keys=True))
 
@@ -15496,6 +15509,54 @@ def _conversation_probe_snapshot(path: pathlib.Path):
         yield snapshot
 
 
+class ConversationProbeCloneUnavailable(OSError):
+    """The filesystem or platform cannot clone the transcript family.
+
+    The clone helper raises it when `cp` is missing, the platform has no
+    clone command, or `cp` reports that the filesystem refused the clone (see
+    :func:`_cp_refused_clone`). The pre-rebuild quick-check catches it, skips
+    and lets the rebuild continue; recovery still declines without a snapshot.
+    Every other clone failure stays a plain OSError and fails the rebuild.
+    """
+
+
+# errno values that mean "this filesystem cannot clone these files", as
+# opposed to a failure while cloning them. Linux ioctl_ficlone(2) documents
+# EOPNOTSUPP (the filesystem cannot reflink, e.g. ext4), EXDEV (the paths are
+# on different mounts, e.g. a bind mount) and EINVAL (the filesystem cannot
+# reflink these files); ioctl(2) returns ENOTTY where the kernel or filesystem
+# has no FICLONE at all. macOS clonefile(2) documents ENOTSUP and EXDEV. Each
+# is a permanent property of where the store lives. Anything else (ENOSPC,
+# EDQUOT, EACCES, EPERM, ENOENT, EIO, or a failure to open, stat or create
+# before the clone) is a real failure and must fail the rebuild: an I/O error
+# reading a damaged store is the very signal the probe exists to catch.
+_CLONE_REFUSAL_ERRNOS = frozenset(
+    getattr(errno, name)
+    for name in ("EOPNOTSUPP", "ENOTSUP", "EXDEV", "EINVAL", "ENOTTY")
+    if hasattr(errno, name)
+)
+
+
+def _cp_refused_clone(stderr: str) -> bool:
+    """Whether `cp` reported a clone refused for one of those errno values.
+
+    `cp` runs under ``LC_ALL=C``, so its strerror text is the C locale's, the
+    same text :func:`os.strerror` returns. GNU `cp --reflink=always` reports a
+    failed FICLONE as ``failed to clone DST from SRC: <strerror>``. macOS
+    `cp -c` falls back to copyfile(2), a full copy, when the target cannot
+    clone, so it rarely reports a refusal at all; when clonefile(2) does fail
+    it warns ``DST: clonefile failed: <strerror>``.
+    """
+    reasons = tuple(f": {os.strerror(code)}" for code in _CLONE_REFUSAL_ERRNOS)
+    for line in stderr.splitlines():
+        line = line.strip()
+        if "failed to clone " not in line and ": clonefile failed: " not in line:
+            continue
+        if line.endswith(reasons):
+            return True
+    return False
+
+
 def _clone_conversation_probe_member(
     source: pathlib.Path,
     destination: pathlib.Path,
@@ -15513,7 +15574,7 @@ def _clone_conversation_probe_member(
         return
     cp = shutil.which("cp")
     if cp is None:
-        raise OSError(
+        raise ConversationProbeCloneUnavailable(
             "copy-on-write transcript probe unavailable: `cp` was not found"
         )
     if sys.platform == "darwin":
@@ -15523,7 +15584,7 @@ def _clone_conversation_probe_member(
             cp, "--reflink=always", "--", str(source), str(destination),
         ]
     else:
-        raise OSError(
+        raise ConversationProbeCloneUnavailable(
             "copy-on-write transcript probe is unsupported on "
             f"{sys.platform}"
         )
@@ -15535,6 +15596,7 @@ def _clone_conversation_probe_member(
             text=True,
             timeout=_CONVERSATION_PROBE_CLONE_TIMEOUT_SECONDS,
             check=False,
+            env={**os.environ, "LC_ALL": "C"},
         )
     except (OSError, subprocess.TimeoutExpired) as exc:
         raise OSError(
@@ -15544,9 +15606,14 @@ def _clone_conversation_probe_member(
         reason = (result.stderr or "").strip() or (
             f"cp exited {result.returncode}"
         )
+        if _cp_refused_clone(result.stderr or ""):
+            raise ConversationProbeCloneUnavailable(
+                "copy-on-write transcript probe unavailable for "
+                f"{source.name}: {reason}"
+            )
         raise OSError(
-            "copy-on-write transcript probe unavailable for "
-            f"{source.name}: {reason}"
+            f"copy-on-write transcript probe failed for {source.name}: "
+            f"{reason}"
         )
 
 
@@ -15622,6 +15689,20 @@ def _probe_conversation_rebuild(
                         probe.close()
         except sqlite3.DatabaseError as exc:
             return exc
+        except ConversationProbeCloneUnavailable as exc:
+            # The clone helper raised this because the filesystem cannot
+            # clone, which never changes: failing here failed every explicit
+            # rebuild over an existing store on such a filesystem. Skip the
+            # check (never a byte copy) and rebuild. Corruption quick_check
+            # would have found may then go unnoticed, or surface later in a
+            # rebuild worker; recovery declines without a snapshot either
+            # way, so nothing is quarantined.
+            eprint(
+                "[cache-sync] conversations.db integrity check skipped "
+                f"before the transcript rebuild ({exc}); continuing without "
+                "automatic corruption recovery"
+            )
+            return None
     finally:
         keeper_yield.close()
         if provider_locks is not None:

package/bin/_cctally_completion.py

@@ -114,6 +114,7 @@ import _lib_account_protocol
 import _lib_accounts
 import _lib_journal
 import _lib_journal_router
+import _lib_rebuild_progress
 import _lib_rederive
 
 #: The correction-batch family this step (and the live collision check)
@@ -152,7 +153,7 @@ def is_deriving_input(record) -> bool:
         return False
     if record.get("t") == "obs":
         import _cctally_rederive
-        return bool(_cctally_rederive._rederivable_raw_records([record]))
+        return _cctally_rederive._is_rederivable_raw(record)
     if record.get("t") == "op":
         return (record.get("payload") or {}).get("kind") in _DERIVING_OP_KINDS
     return False
@@ -800,6 +801,9 @@ def _complete(context, trusted, target, boundary):
     with tempfile.TemporaryDirectory(
             prefix="cctally-completion-", dir=str(_cctally_core.APP_DIR)) as tmp:
         base = pathlib.Path(tmp) / "predecessor.db"
+        # #997 D9: progress for a detached worker's state file (a no-op
+        # unless one installed a sink).
+        _lib_rebuild_progress.phase("completion:predecessor")
         _journal.rebuild_stats_index(
             context=_journal.RebuildContext(trigger=context.trigger),
             target_path=str(base), high_water=start,
@@ -847,6 +851,7 @@ def _apply_owed_outputs(base, start, output_end, boundary) -> frozenset:
     revision through that output end, in the rebuild's fold order (structural
     folds, the open 5h block projection, then milestones). Returns the ids
     applied, which the predecessor then holds."""
+    _lib_rebuild_progress.phase("completion:owed-outputs")
     prefix = _read_prefix(start, output_end, boundary)
     if prefix.cutover_claude is _journal._CUTOVER_UNSEEN:
         prefix.cutover_claude = _journal._resolve_cutover_for_rebuild(
@@ -873,6 +878,9 @@ def _apply_owed_outputs(base, start, output_end, boundary) -> frozenset:
         _journal._fold_order(item[1]), item[0]))
     conn = _cctally_core.open_db(_target_path=str(base))
     try:
+        # #997 (spec D1): the predecessor is a disposable scratch too.
+        import _cctally_store
+        _cctally_store.apply_disposable_scratch_policy(conn)
         for phase in ("structural", "tail"):
             if phase == "tail":
                 import sys
@@ -917,6 +925,10 @@ class _Prefix:
         self.excluded_revisions: dict = {}
         self.inert_revisions: dict = {}
         self.begin_at: dict = {}
+        #: #797/#823/#840 spec 4.6 B1: the begin markers per batch id, so a
+        #: retry of a batch an earlier writer began without the revision-2
+        #: stamp is authored under a derived id instead of restamped.
+        self.begins: dict = {}
         self.batch_family: dict = {}
         self.cutover_claude = _journal._CUTOVER_UNSEEN
         # Admitted decision ids before the window (the predecessor holds
@@ -933,25 +945,57 @@ def _bump(table: dict, record) -> None:
         table[event_id] = max(rev, table.get(event_id, rev))
 
 
+def _window_omits(record) -> bool:
+    """#997 spec D3: whether an ADMITTED record is left out of the window —
+    an observation the replay provably ignores: not a rederivable raw input
+    and not a Claude reading, so it yields no candidate and the quarantine
+    fold returns before touching state (`reading_from_record` requires
+    `is_claude_reading`). Codex quota observations, 85 % of a production
+    journal, are the population. Its line still feeds the prefix hasher and
+    its `None` slot, and `window_has_derivable_inputs` still scans it; an
+    EXCLUDED observation keeps its placeholder, which the fold's exclusion
+    trigger needs. Every window consumer reads the same compacted window
+    within one `_complete_window` call, so indexing stays consistent."""
+    if record.get("t") != "obs":
+        return False
+    import _cctally_quarantine
+    import _cctally_rederive
+    return (not _cctally_rederive._is_rederivable_raw(record)
+            and not _cctally_quarantine.is_claude_reading(record))
+
+
 def _read_prefix(start, target, boundary) -> _Prefix:
     out = _Prefix()
     segments = _journal.list_segments()
-    hasher = _lib_journal_router.PrefixHashAccumulator()
+    hasher = _journal._new_prefix_hasher()
     prior = {"hw": None}
     placeholder = _lib_account_protocol.excluded_placeholder()
     start_key = _order(start)
+    lines = 0
     for segment, offset, raw in _journal._iter_range_with_segments(
         None, target, segments,
-        on_segment=lambda name: hasher.begin_segment(name, prior["hw"]),
+        on_segment=lambda name, size: hasher.begin_segment(
+            name, prior["hw"], size=size),
         on_bytes=hasher.extend,
     ):
+        lines += 1
+        if not lines & 4095:
+            _lib_rebuild_progress.tick(lines=lines)
         end = (segment, offset + len(raw) + 1)
         record = _lib_journal.decode_line(raw)
         if record is None:
             prior["hw"] = end
             continue
         in_window = _order((segment, offset)) >= start_key
-        if not _journal._is_admitted(record, segment, offset, boundary):
+        admitted = _journal._is_admitted(record, segment, offset, boundary)
+        t = record.get("t")
+        omitted = admitted and in_window and _window_omits(record)
+        if (in_window and not omitted) or (
+                admitted and t in _lib_journal_router.RETAINED_RECORD_TYPES):
+            # #997 D15: a record the window or the selector slots keep is
+            # compacted before anything holds a reference to it.
+            record = _lib_journal.compact_retained(record)
+        if not admitted:
             out.slots.append(None)
             if record.get("t") in ("evt", "correction"):
                 _bump(out.excluded_revisions, record)
@@ -961,7 +1005,6 @@ def _read_prefix(start, target, boundary) -> _Prefix:
                 out.coordinates.append((segment, offset))
             prior["hw"] = end
             continue
-        t = record.get("t")
         if t == "op":
             _journal._capture_protocol_prefix_evidence(
                 record, prior["hw"], out.evidence, hasher=hasher)
@@ -976,10 +1019,11 @@ def _read_prefix(start, target, boundary) -> _Prefix:
                 out.legacy_origin_ids.add(record["id"])
         if t == "correction_batch" and record.get("phase") == "begin":
             out.begin_at.setdefault(record.get("id"), record.get("at"))
+            out.begins.setdefault(record.get("id"), []).append(record)
             out.batch_family.setdefault(record.get("id"), record.get("family"))
         out.slots.append(
             record if t in _lib_journal_router.RETAINED_RECORD_TYPES else None)
-        if in_window:
+        if in_window and not omitted:
             out.window.append(record)
             out.coordinates.append((segment, offset))
         prior["hw"] = end
@@ -1055,6 +1099,17 @@ def _no_cache_read_adapters():
             setattr(cctally, name, value)
 
 
+def _normalized_copy(record, cutover_claude):
+    """One window record as a replay sees it: a private deep copy, its legacy
+    account stamp normalized under ``cutover_claude`` (an excluded placeholder
+    is only copied). Reads only this record and the journal-wide cutover
+    value (#997 spec D5)."""
+    out = copy.deepcopy(record)
+    if out.get("t") != _lib_account_protocol.EXCLUDED_PLACEHOLDER_TYPE:
+        _journal._normalize_legacy_account_stamp(out, cutover_claude)
+    return out
+
+
 def _replay(base, tmp, name, prefix, held_ids, cache_conn, *, retention,
             skip=frozenset()):
     """One scratch replay of the window from the predecessor state, the
@@ -1065,17 +1120,19 @@ def _replay(base, tmp, name, prefix, held_ids, cache_conn, *, retention,
     import _cctally_rederive
     copy_path = tmp / name
     shutil.copyfile(base, copy_path)
-    records = copy.deepcopy(prefix.window)
-    for record in records:
-        if record.get("t") != _lib_account_protocol.EXCLUDED_PLACEHOLDER_TYPE:
-            _journal._normalize_legacy_account_stamp(
-                record, prefix.cutover_claude)
+    cutover_claude = prefix.cutover_claude
     by_input: dict = {}
     conn = _cctally_core.open_db(_target_path=str(copy_path))
     try:
+        # #997 (spec D1): a disposable replay copy, never published.
+        import _cctally_store
+        _cctally_store.apply_disposable_scratch_policy(conn)
         fold = _cctally_quarantine.QuarantineFold.load(conn, held_ids=held_ids)
+        # #997 spec D5: each record is copied and normalized as it is
+        # offered, never the whole window up front.
         events = _cctally_rederive.replay_scratch_records(
-            conn, records, cache_conn, fold=fold, held_ids=held_ids,
+            conn, prefix.window, cache_conn, fold=fold, held_ids=held_ids,
+            prepare=lambda record: _normalized_copy(record, cutover_claude),
             coordinates=prefix.coordinates, skip_indexes=skip,
             on_input=lambda index, derived: by_input.__setitem__(
                 index, list(derived)),
@@ -1177,6 +1234,7 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
     holds the fresh candidate only where it differs from the reference, so a
     gap's effect reaches its descendants while every unaffected decision
     stays the retained one. Their difference is the causal suffix."""
+    _lib_rebuild_progress.phase("completion:read", round=round_index)
     prefix = _read_prefix(start, target, boundary)
     if prefix.cutover_claude is _journal._CUTOVER_UNSEEN:
         prefix.cutover_claude = _journal._resolve_cutover_for_rebuild(
@@ -1203,6 +1261,7 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
     legacy = _legacy_decided_inputs(prefix)
 
     with _cache_read_view() as cache_conn:
+        _lib_rebuild_progress.phase("completion:replay-all", round=round_index)
         _events, by_input = _replay(
             base, tmp, f"all-{round_index}.db", prefix, held_ids, cache_conn,
             retention=_retention(effective, prefix, owed, legacy=legacy))
@@ -1210,6 +1269,8 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
         gap = _gap_inputs(by_input, selection, legacy)
         if not gap:
             return False
+        _lib_rebuild_progress.phase(
+            "completion:replay-without", round=round_index)
         events_a, _ = _replay(
             base, tmp, f"without-{round_index}.db", prefix, held_ids,
             cache_conn, skip=gap,
@@ -1218,6 +1279,8 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
         for event in events_a:
             reference.setdefault(
                 event["id"], _lib_journal.event_content_hash(event))
+        _lib_rebuild_progress.phase(
+            "completion:replay-with", round=round_index)
         events_b, _ = _replay(
             base, tmp, f"with-{round_index}.db", prefix, held_ids, cache_conn,
             retention=_retention(effective, prefix, owed, legacy=legacy,
@@ -1271,6 +1334,9 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
             actions, sort_keys=True, separators=(",", ":"),
             ensure_ascii=False).encode("utf-8")).hexdigest()
         batch_id = f"{FAMILY}:{digest}"
+        if batch_id not in selection.completed_batches:
+            batch_id = _lib_journal.revision_batch_id(
+                batch_id, prefix.begins.get(batch_id, ()))
         if batch_id not in selection.completed_batches:
             records.extend(_lib_journal.make_correction_batch(
                 batch_id=batch_id, family=FAMILY,
@@ -1283,5 +1349,7 @@ def _complete_window(base, tmp, start, target, boundary, round_index, *,
     records.extend(plain)
     if not records:
         return False
+    _lib_rebuild_progress.phase(
+        "completion:append", round=round_index, records=len(records))
     _journal.append_records(records)
     return True

package/bin/_cctally_core.py

@@ -78,6 +78,7 @@ def _init_paths_from_env() -> None:
     global STATUSLINE_AUTHORITATIVE_7D_PATH, STATUSLINE_AUTHORITATIVE_5H_PATH
     global STATUSLINE_ACCOUNT_BOUND_DIR, LEGACY_SPOOL_BASELINE_PATH
     global ACCOUNT_BOUND_CUTOVER_CACHE_PATH, LEGACY_WRITER_EVIDENCE_PATH
+    global STATUSLINE_ACCOUNT_BOUND_V1_DIR, ACCOUNT_BOUND_REVISION_CACHE_PATH
     global OAUTH_BACKOFF_MARKER_PATH, OAUTH_BACKOFF_COUNT_PATH
     global UPDATE_STATE_PATH, UPDATE_SUPPRESS_PATH
     global UPDATE_LOCK_PATH, UPDATE_LOG_PATH, UPDATE_LOG_ROTATED_PATH
@@ -192,11 +193,25 @@ def _init_paths_from_env() -> None:
     # the journal-anchored legacy spool baseline. The coordinate cache only
     # accelerates locating the cutover op and never confers authority; the
     # legacy-writer evidence sidecar is diagnostic only (spec section 8).
-    STATUSLINE_ACCOUNT_BOUND_DIR = APP_DIR / "statusline-account-bound-v1"
+    #
+    # #797/#823/#840 (spec 4.6 B4): revision 2 of the fence moves every
+    # current coordination file — candidates, intake, evaluations, control,
+    # pending and retry state, acknowledgements, tombstones, frozen plans,
+    # locks, transition and recovery metadata, and the protocol files below
+    # — to the v2 root. No v1 state is imported. The v1 root is retired: its
+    # `accounts/` tree and `transport.last` join the legacy spool inventory
+    # (`_cctally_journal._legacy_spool_paths`), and this binary never writes,
+    # prunes or deletes anything under it.
+    STATUSLINE_ACCOUNT_BOUND_V1_DIR = APP_DIR / "statusline-account-bound-v1"
+    STATUSLINE_ACCOUNT_BOUND_DIR = APP_DIR / "statusline-account-bound-v2"
     LEGACY_SPOOL_BASELINE_PATH = (
         STATUSLINE_ACCOUNT_BOUND_DIR / "legacy-spool-baseline.json")
     ACCOUNT_BOUND_CUTOVER_CACHE_PATH = (
         STATUSLINE_ACCOUNT_BOUND_DIR / "cutover-coordinate.json")
+    #: The revision boundary's coordinate cache; like the cutover's, it only
+    #: accelerates the lookup and never confers authority.
+    ACCOUNT_BOUND_REVISION_CACHE_PATH = (
+        STATUSLINE_ACCOUNT_BOUND_DIR / "revision-coordinate.json")
     LEGACY_WRITER_EVIDENCE_PATH = (
         STATUSLINE_ACCOUNT_BOUND_DIR / "legacy-writer-evidence.json")
     OAUTH_BACKOFF_MARKER_PATH = APP_DIR / "oauth-backoff.until"
@@ -523,7 +538,23 @@ _init_paths_from_env()
 # `_cctally_store.validated_read_snapshot` checks inside each decision
 # scope's own snapshot. An epoch transition, not a numbered migration: the
 # registry stays frozen at 13.
-STATS_INDEX_EPOCH = 1018
+# 1018 -> 1019 (#797/#823/#840 spec 4.6 B6): revision 2 of the fence changes
+# the authoritative interpretation of retained journal records again — after
+# the `account_bound_revision` boundary a Claude-scoped record without
+# `wpr == 2` is excluded — so an index, a derivation-completeness proof or a
+# selector continuation produced under revision 1 is not current. The #825
+# section 6 precedent; still no numbered migration and no accounting column.
+# The same epoch carries the provider-sample index state of stage 1 (#797
+# Task 2, spec 4.3 D8 and D11), so 1019 is introduced once: the
+# `claude_oauth_samples` projection of raw api observations carrying
+# `oauth_request_started_at`, the `claude_weekly_observation_decisions`
+# projection of reviewed weekly decision ops that resolves a sample's weekly
+# eligibility at read time, and four NULLABLE identity columns on
+# `five_hour_credit_confirmation_state` (`baseline_observation_id`,
+# `baseline_generation`, `pending_generation`, `pending_position`) that the
+# five-hour credit generation (Task 5) writes. Both projections are rebuilt
+# from the journal; the confirmation state stays disposable.
+STATS_INDEX_EPOCH = 1019
 LEGACY_STATS_HEAD = 13
 
 
@@ -2691,20 +2722,86 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         # above: a rebuild legitimately loses it, and the cold-start
         # consequence is stated at `_read_five_hour_source_state` in
         # `bin/_cctally_record.py`.
+        #
+        # #797/#823/#840 epoch 1019 (spec 4.9 D11): the four identity columns
+        # the five-hour credit generation writes, all NULL until it does.
+        # `baseline_observation_id` names the observation that set the
+        # baseline; `baseline_generation` / `pending_generation` are the
+        # effective five-hour credit generation the baseline and the armed
+        # descent were observed under, encoded `"<event_id>@<revision>"` with
+        # the no-credit sentinel `"none"`; `pending_position` is the arming
+        # observation's logical position. Columns of the CREATE, not an
+        # `add_column_if_missing`: an epoch-current open returns before any
+        # schema work, so only the epoch's fresh CREATE can carry them.
         conn.execute(
             """
             CREATE TABLE IF NOT EXISTS five_hour_credit_confirmation_state (
-                account_key            TEXT NOT NULL,
-                five_hour_window_key   INTEGER NOT NULL,
-                source                 TEXT NOT NULL,
-                baseline_pct           REAL NOT NULL,
-                pending_low_pct        REAL,
-                pending_at_utc         TEXT,
-                pending_observation_id TEXT,
+                account_key             TEXT NOT NULL,
+                five_hour_window_key    INTEGER NOT NULL,
+                source                  TEXT NOT NULL,
+                baseline_pct            REAL NOT NULL,
+                pending_low_pct         REAL,
+                pending_at_utc          TEXT,
+                pending_observation_id  TEXT,
+                baseline_observation_id TEXT,
+                baseline_generation     TEXT,
+                pending_generation      TEXT,
+                pending_position        TEXT,
                 PRIMARY KEY (account_key, five_hour_window_key, source)
             )
             """
         )
+        # #797/#823/#840 epoch 1019 (spec 4.3 D8, D9): provider samples. One
+        # row per ADMITTED Claude api observation carrying a valid
+        # `oauth_request_started_at` (`requested_at_utc`, canonical
+        # full-precision UTC, so text order is time order), projected from
+        # the RAW record by `_cctally_oauth_samples.project_sample` on every
+        # derivation path, independently of the snapshot fold, the five-hour
+        # adjustment and credit suppression or retirement. Values are the raw
+        # readings, never the MAX-clamped stored ones; `weekly_resets_at_utc`
+        # is nearest-hour normalized and `five_hour_window_key` is the
+        # authoritative canonical key. Journal truth (rebuilt, never pruned),
+        # indexed by account, axis window and `q` for the exact-window read.
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS claude_oauth_samples (
+                account_key             TEXT NOT NULL,
+                observation_id          TEXT NOT NULL,
+                requested_at_utc        TEXT NOT NULL,
+                captured_at_utc         TEXT NOT NULL,
+                weekly_percent          REAL,
+                weekly_resets_at_utc    TEXT,
+                five_hour_percent       REAL,
+                five_hour_resets_at_utc TEXT,
+                five_hour_window_key    INTEGER,
+                PRIMARY KEY (account_key, observation_id)
+            )
+            """
+        )
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_claude_oauth_samples_weekly "
+            "ON claude_oauth_samples "
+            "(account_key, weekly_resets_at_utc, requested_at_utc)"
+        )
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_claude_oauth_samples_five_hour "
+            "ON claude_oauth_samples "
+            "(account_key, five_hour_window_key, requested_at_utc)"
+        )
+        # The effective reviewed weekly decision per observation (latest
+        # `claude_weekly_observation_decision[_v2]` op wins, journal order),
+        # projected by that op's fold applier so a sample's weekly
+        # eligibility is resolved at read time: `hold` excludes the weekly
+        # sample only, a later `accept` restores it.
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS claude_weekly_observation_decisions (
+                observation_id TEXT PRIMARY KEY,
+                disposition    TEXT NOT NULL,
+                decision_op_id TEXT NOT NULL
+            )
+            """
+        )
         _backfill_week_reset_events(conn)
 
         # ── five_hour_reset_events (Anthropic-issued in-place 5h credits) ──

package/bin/_cctally_dashboard.py

@@ -11999,15 +11999,12 @@ def _dashboard_stats_deferred_snapshot(args, *, pinned_now, exc):
     # worker owns maintenance-exclusive, doing that before HTTP bind reintroduces
     # the exact multi-second startup stall this path exists to remove. Supply a
     # schema-valid, privacy-safe warning block; the first successful background
-    # snapshot replaces it with a real doctor payload.
-    doctor_payload = {
-        "severity": "warn",
-        "counts": {"ok": 0, "warn": 1, "fail": 0},
-        "generated_at": now_utc.astimezone(dt.timezone.utc).strftime(
-            "%Y-%m-%dT%H:%M:%SZ"
-        ),
-        "fingerprint": "sha1:" + ("0" * 40),
-    }
+    # snapshot replaces it with a real doctor payload. #997 D10: the block still
+    # carries the rebuild-worker aggregate, from the worker snapshots alone
+    # (lock-free, never opens stats), so the chip names the running or dead
+    # rebuild from the first frame.
+    doctor_payload = tui._deferred_doctor_placeholder(now_utc)
+    doctor_payload["rebuild_worker"] = tui._tui_rebuild_worker_value(now_utc)
     replacements = {
         # #583 S2 §6.1: this frame is degraded by construction — it carries a
         # `stats-open` error and no successful build ran, so it must not stamp