cctally 1.48.0 → 1.50.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.50.0] - 2026-06-18
+
+### Fixed
+- **Dashboard conversation viewer — mobile transcripts no longer shear sideways, and the session outline is no longer an interaction trap.** On a narrow (≤640px) viewport the reader's pinned controls toolbar overflowed the viewport, so any automatic scroll (jump-to-latest on open, an outline/landmark jump, or a focus-filter switch) could drift the whole transcript sideways and clip every line off the left edge; the toolbar and focus control are now constrained to the viewport, all reader content is width-clamped, and the reader is locked against a stray horizontal scroll, so transcripts read fully at 320/360/390px. The session outline — previously a persisted, default-on slide-over that buried the transcript the moment you opened a conversation, dismissable only by tapping an unlabeled backdrop strip — now defaults closed on mobile, opens on an ephemeral per-conversation flag, and carries a titled header with a visible ✕ close (the backdrop stays a second dismiss path), raised above the sticky topbar so the close control is always tappable (#205).
+- **Dashboard conversation viewer — find-in-conversation is reachable on mobile, and text inputs no longer trigger iOS auto-zoom.** A `🔍 Find` toggle now sits in the reader controls row on both breakpoints (the `/` shortcut still works on desktop), so the in-conversation find bar is no longer unreachable by touch; switching to a different conversation clears an open find state, so navigating back and reselecting no longer auto-reopens the bar and pops the keyboard. All seven viewer text inputs (rail search, find bar, and the date/cost/cache-rebuild filter fields) now render at 16px on mobile, so focusing one no longer makes iOS Safari zoom the page. Desktop styling is unchanged (#205).
+- **Dashboard conversation viewer — a more compact mobile reader header, a readable subagent-card title, and a recoverable list-fetch error.** On mobile the reader header now shows de-duplicated, abbreviated model names (the `claude-` prefix and a trailing `-YYYYMMDD` date stamp are stripped) on a single line and clamps the title to two lines, putting more transcript above the fold; subagent cards swap the one-line `Impl…` ellipsis for a two-line clamped title with the same abbreviated models; and a failed conversation-list fetch now shows a working **Retry** button instead of a dead error state. Desktop output is byte-identical (#205).
+- **Dashboard conversation viewer — every interactive control now meets the 44×44px mobile touch-target minimum, and the reader's `← Back` is no longer hidden behind the sticky topbar.** Roughly 32 controls across the reader header, find bar, filters popover, browse rail, outline, and transcript body (disclosure chips, the jump-to-top FAB, the corner copy buttons, and more) now have a ≥44×44px effective hit area at the mobile breakpoint — the absolute-positioned copy buttons get an invisible centered hit area so a literal box never covers code/diff/terminal content, and inline content links keep the documented WCAG 2.5.5 inline exception. A height-calculation bug that let the page scroll roughly 64px behind the `z-index:50` sticky topbar — hiding the reader's `← Back` — is fixed by switching the mobile conversation view to `100dvh` and correcting its height budget, so `← Back` is reachable at every width, at rest and after a forced scroll. The outline backdrop and ✕ now carry distinct accessibility labels. Desktop runtime is byte-identical (#205).
+
+## [1.49.0] - 2026-06-17
+
+### Added
+- **Dashboard conversation viewer — Browse-list filters.** The Browse rail gains a compact `Filters ▾` popover that narrows the conversation list by four axes: date (This month / Last month / Last 7d presets, or an arbitrary from→to range), project (a multi-select matching any of the chosen projects, with per-project conversation counts), cost (an optional minimum and/or maximum USD with quick `≥$1` / `≥$5` / `≥$10` presets), and number of cache rebuilds (a `≥1` / `≥3` / `≥5` or custom threshold). Axes combine with AND, active filters show as removable chips under the search box, and filtering is server-side so pagination and counts stay correct. The date filter matches each session's last activity — the same instant the rail now sorts and groups by — so the date sections, the recent order, and the filter all agree. When a filter set matches nothing the rail shows a distinct "No conversations match these filters." message with a one-click "Clear filters" button (separate from the generic "No conversations." copy for an empty install). Filters apply to Browse only (disabled while a full-text search is active, which also dismisses the popover so the reader's keyboard navigation stays live) and are session-only (reset on reload). Each row's displayed cost is the live, pricing-immediate recompute (consistent with the detail and report views), while the cost filter compares the stored per-session rollup — the two agree except in the brief window after a pricing-table edit, before the next sync re-derives the stored value.
+- **Dashboard conversation viewer — jump to the latest turn.** A `Latest ↓` action in the reader header (and the `End` key) pages the open conversation forward to its end and lands on the most recent turn with the usual flash, reusing the existing jump pipeline with an uncapped pager so it reaches the last turn even in very long conversations — and now correctly waits out a page-load that happens to be in flight when you trigger it, rather than stopping short. Landing at the bottom parks the reader in its stick-to-bottom position, so a live session keeps following new turns automatically.
+
 ## [1.48.0] - 2026-06-16
 
 ### Fixed

package/bin/_cctally_cache.py

@@ -1637,6 +1637,7 @@ def _recompute_conversation_sessions(conn, session_ids=None) -> None:
             "(session_id, msg_count, started_utc, last_activity_utc) "
             + _CONV_SESSIONS_SELECT + " GROUP BY session_id"
         )
+        _fill_conversation_sessions_filter_columns(conn, None)
         return
     ids = [s for s in session_ids if s is not None]
     for i in range(0, len(ids), 400):
@@ -1653,6 +1654,49 @@ def _recompute_conversation_sessions(conn, session_ids=None) -> None:
             + f" AND session_id IN ({placeholders}) GROUP BY session_id",
             chunk,
         )
+    _fill_conversation_sessions_filter_columns(conn, ids)
+
+
+def _fill_conversation_sessions_filter_columns(conn, session_ids):
+    """Fill the rollup's browse-FILTER columns (project_label / cost_usd /
+    cache_rebuild_count, migration 015) for the given sessions, or ALL when
+    ``session_ids is None``. The structural COUNT/MIN/MAX columns are filled by
+    the INSERT in _recompute_conversation_sessions; this is the second pass that
+    materializes the three filter axes so the rail's date/project/cost/rebuild
+    filters are pure-SQL predicates.
+
+    project_label + cost reuse the query kernel's batch maps (the SAME
+    _project_label / _session_cost_map the rail's per-page Python path used), so
+    a filtered/displayed value equals what the live rail produced. cost is
+    rounded to 6dp to match list_conversations' per-row rounding.
+    cache_rebuild_count is a per-session assemble via the query kernel's
+    single-source-of-truth helper (whole-session property — recompute, never
+    increment).
+
+    No-op when the columns are absent (a pre-migration-015 cache.db being
+    re-derived before its 015 ALTER lands), so an early/partial sync never
+    raises ``no such column``. The CALLER owns the commit (this never commits)."""
+    cols = {r[1] for r in conn.execute("PRAGMA table_info(conversation_sessions)")}
+    if "cache_rebuild_count" not in cols:
+        return
+    lq = _load_lib("_lib_conversation_query")
+    if session_ids is None:
+        ids = [r[0] for r in conn.execute(
+            "SELECT session_id FROM conversation_sessions")]
+    else:
+        ids = [s for s in session_ids if s is not None]
+    if not ids:
+        return
+    cost = lq._session_cost_map(conn, ids)
+    meta = lq._session_latest_meta_map(conn, ids)
+    for sid in ids:
+        proj = lq._project_label(meta.get(sid, (None, None))[0])
+        rebuilds = lq.session_cache_rebuild_count(conn, sid)
+        conn.execute(
+            "UPDATE conversation_sessions SET project_label=?, cost_usd=?, "
+            "cache_rebuild_count=? WHERE session_id=?",
+            (proj, round(cost.get(sid, 0.0), 6), rebuilds, sid),
+        )
 
 
 def _consume_search_split(conn) -> None:

package/bin/_cctally_dashboard.py

@@ -5276,6 +5276,13 @@ def _qs_str(q: dict, key: str, default: str | None) -> str | None:
 _CONV_SEARCH_KINDS = ("all", "prompts", "assistant", "tools", "thinking")
 
 
+class _BadConversationFilter(Exception):
+    """Internal sentinel: a browse-filter query param failed validation. The
+    parse helper has ALREADY sent the 400 response when this is raised, so the
+    caller just unwinds and returns (the conversation routes all 400 on bad
+    input, consistent with the search ``kind`` facet). Module-private."""
+
+
 def _cached_file_sigs(conn, paths):
     """{path: size_bytes} from session_files for the given paths — the cache's
     own view of how far each file is ingested. Size-only by design, matching the
@@ -5419,6 +5426,8 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             self._handle_share_history_get()
         elif path == "/api/doctor":
             self._handle_get_doctor()
+        elif path == "/api/conversations/facets":
+            self._handle_get_conversations_facets()
         elif path == "/api/conversations":
             self._handle_get_conversations()
         elif path == "/api/conversation/search":
@@ -7462,12 +7471,90 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             conn.close()
         return True, body
 
+    def _parse_conversation_filters(self, q):
+        """Parse the browse-list filter params (spec §2) from a ``parse_qs``
+        mapping. On any malformed value this sends a **400** and returns
+        ``None`` — the caller just ``return``s (the conversation routes all 400
+        on bad input). On success returns a dict of ``list_conversations``
+        kwargs: ``date_from``/``date_to`` (UTC-ISO bounds), ``projects``
+        (list[str] | None), ``cost_min``/``cost_max`` (float | None),
+        ``rebuild_min`` (int | None). Empty/blank params drop to ``None``.
+
+        Numeric axes validate strictly (a non-numeric cost / non-integer
+        rebuild threshold is a hard 400). Date bounds route through the pure
+        ``_lib_dashboard_dates.parse_filter_date_range`` helper, which resolves
+        naive date-only bounds in ``display.tz`` and raises ``ValueError`` (→
+        400) on a malformed date. Projects accept BOTH repeated
+        ``?projects=a&projects=b`` and a single comma-joined ``?projects=a,b``.
+        """
+        def _float(name):
+            v = _qs_str(q, name, "")
+            if v is None or v == "":
+                return None
+            try:
+                return float(v)
+            except ValueError:
+                self._respond_json(400, {"error": f"bad {name}: {v}"})
+                raise _BadConversationFilter
+
+        def _int(name):
+            v = _qs_str(q, name, "")
+            if v is None or v == "":
+                return None
+            try:
+                return int(v)
+            except ValueError:
+                self._respond_json(400, {"error": f"bad {name}: {v}"})
+                raise _BadConversationFilter
+
+        try:
+            cost_min = _float("cost_min")
+            cost_max = _float("cost_max")
+            rebuild_min = _int("rebuild_min")
+        except _BadConversationFilter:
+            return None  # 400 already sent
+
+        projects = [p for p in q.get("projects", []) if p] or None
+        # Single comma-joined value -> split (the client may send either form).
+        if projects and len(projects) == 1 and "," in projects[0]:
+            projects = [s for s in projects[0].split(",") if s] or None
+
+        date_from = _qs_str(q, "date_from", "") or None
+        date_to = _qs_str(q, "date_to", "") or None
+        if date_from or date_to:
+            from importlib import import_module
+            tz = _resolve_display_tz_obj(
+                _apply_display_tz_override(
+                    load_config(), type(self).display_tz_pref_override
+                )
+            ).key
+            try:
+                df, dtt = import_module(
+                    "_lib_dashboard_dates"
+                ).parse_filter_date_range(date_from, date_to, tz_name=tz)
+            except ValueError as exc:
+                self._respond_json(400, {"error": str(exc)})
+                return None
+        else:
+            df = dtt = None
+
+        return {
+            "date_from": df,
+            "date_to": dtt,
+            "projects": projects,
+            "cost_min": cost_min,
+            "cost_max": cost_max,
+            "rebuild_min": rebuild_min,
+        }
+
     def _handle_get_conversations(self) -> None:
         """``GET /api/conversations`` — the browse rail (spec §3.1).
 
         Gated first (loopback / Host allowlist). ``sort``/``limit``/``offset``
-        are read from the query string; the kernel clamps bounds. Cache-open
-        failures are 500s, never 5xx-with-stacktrace.
+        are read from the query string; the kernel clamps bounds. The browse
+        filters (date/project/cost/rebuild — spec §2) are parsed/validated here
+        (malformed → 400) and threaded into the kernel. Cache-open failures are
+        500s, never 5xx-with-stacktrace.
         """
         if not self._require_transcripts_allowed():
             return
@@ -7476,14 +7563,33 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         sort = _qs_str(q, "sort", "recent")
         limit = _qs_int(q, "limit", 50)
         offset = _qs_int(q, "offset", 0)
+        filters = self._parse_conversation_filters(q)
+        if filters is None:
+            return  # a 400 has already been sent
         ok, body = self._run_conversation_query(
             lambda conn: self._conversation_query().list_conversations(
-                conn, sort=sort, limit=limit, offset=offset),
+                conn, sort=sort, limit=limit, offset=offset, **filters),
             "/api/conversations")
         if not ok:
             return
         self._respond_json(200, body)
 
+    def _handle_get_conversations_facets(self) -> None:
+        """``GET /api/conversations/facets`` — distinct project labels + their
+        conversation counts, for the browse filter's project multi-select (spec
+        §2). Behind the SAME loopback/Host privacy gate as the list route; a
+        cheap indexed GROUP BY over the rollup. The popover loads its options
+        once from here (deriving from a paginated page would be incomplete).
+        """
+        if not self._require_transcripts_allowed():
+            return
+        ok, body = self._run_conversation_query(
+            lambda conn: self._conversation_query().list_conversation_facets(conn),
+            "/api/conversations/facets")
+        if not ok:
+            return
+        self._respond_json(200, body)
+
     def _handle_get_conversation_detail(self, path: str) -> None:
         """``GET /api/conversation/<session-id>`` — the reader (spec §3.2).
 

package/bin/_cctally_db.py

@@ -2360,11 +2360,18 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
             byte_offset INTEGER NOT NULL
         );
 
-        -- Browse-rail rollup (conversation_sessions). Materializes exactly the
-        -- four structural aggregates the rail's old live GROUP BY produced
+        -- Browse-rail rollup (conversation_sessions). Materializes the four
+        -- structural aggregates the rail's old live GROUP BY produced
         -- (COUNT/MIN/MAX over conversation_messages per session_id) so
         -- GET /api/conversations no longer scans the whole message table to
-        -- render a 50-row page. The explicit NOT NULL on the non-INTEGER PK
+        -- render a 50-row page, PLUS three filter columns
+        -- (project_label/cost_usd/cache_rebuild_count, migration 015) so the
+        -- Browse list's date/project/cost/cache-rebuild filters are pure-SQL
+        -- predicates. The structural columns are recomputed by a COUNT/MIN/MAX
+        -- GROUP BY; the filter columns are filled per-session by
+        -- _fill_conversation_sessions_filter_columns in the same flock-held
+        -- recompute (cost via the query kernel's batch maps, cache_rebuild_count
+        -- via a per-session assemble). The explicit NOT NULL on the non-INTEGER PK
         -- matters (SQLite's legacy NULL-in-PK bug); the rail keys on a concrete
         -- session_id and the recompute's GROUP BY already filters nulls. The
         -- index lets the only paginated ordering (recent) early-terminate at
@@ -2373,10 +2380,13 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
         -- flag-gated full recompute) — migration 013 arms the one-time
         -- history backfill.
         CREATE TABLE IF NOT EXISTS conversation_sessions (
-            session_id        TEXT NOT NULL PRIMARY KEY,
-            msg_count         INTEGER NOT NULL DEFAULT 0,
-            started_utc       TEXT,
-            last_activity_utc TEXT
+            session_id          TEXT NOT NULL PRIMARY KEY,
+            msg_count           INTEGER NOT NULL DEFAULT 0,
+            started_utc         TEXT,
+            last_activity_utc   TEXT,
+            project_label       TEXT,
+            cost_usd            REAL NOT NULL DEFAULT 0,
+            cache_rebuild_count INTEGER NOT NULL DEFAULT 0
         );
         CREATE INDEX IF NOT EXISTS idx_conv_sessions_recent
             ON conversation_sessions(last_activity_utc DESC, session_id DESC);
@@ -3463,6 +3473,35 @@ def _014_conversation_queued_prompt_reingest(conn: sqlite3.Connection) -> None:
     conn.commit()
 
 
+@cache_migration("015_conversation_sessions_filter_columns")
+def _015_conversation_sessions_filter_columns(conn: sqlite3.Connection) -> None:
+    """Add the browse-filter columns to the conversation_sessions rollup
+    (project_label, cost_usd, cache_rebuild_count) so the rail's date/project/
+    cost/cache-rebuild filters are pure-SQL predicates (spec §1). ALTERs are
+    idempotent (duplicate-column tolerated). Arms the SHARED
+    conversation_sessions_backfill_pending flag so the next sync_cache full
+    recompute fills the new columns via the augmented
+    _recompute_conversation_sessions — keeping the heavy per-session assemble
+    (cache_rebuild_count) off the migration's critical path, mirroring 013.
+    Central stamp via the dispatcher (#140); handler does NOT self-stamp.
+
+    A fresh install gets the three columns from _apply_cache_schema's CREATE
+    TABLE and stamps 015 WITHOUT running this handler — the ALTERs no-op there
+    (already present), and the empty rollup needs no backfill (the incremental
+    DELETE+INSERT re-derive fills all columns in lockstep). Mirrors 013."""
+    for ddl in (
+        "ALTER TABLE conversation_sessions ADD COLUMN project_label TEXT",
+        "ALTER TABLE conversation_sessions ADD COLUMN cost_usd REAL NOT NULL DEFAULT 0",
+        "ALTER TABLE conversation_sessions ADD COLUMN cache_rebuild_count INTEGER NOT NULL DEFAULT 0",
+    ):
+        try:
+            conn.execute(ddl)
+        except sqlite3.OperationalError:
+            pass  # idempotent: column already present
+    _set_cache_meta(conn, "conversation_sessions_backfill_pending", "1")
+    conn.commit()
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")

package/bin/_lib_conversation_query.py

@@ -445,6 +445,30 @@ def _stamp_cache_failures(items):
         running_max[key] = max(rm, cr)
 
 
+def session_cache_rebuild_count(conn, session_id) -> int:
+    """Per-session count of cache-rebuild (cache-failure) turns.
+
+    Single source of truth: assembles the session via the SAME pipeline the
+    reader/outline use and runs the SAME _stamp_cache_failures kernel, then
+    counts flagged items. /outline omits stats.cache_failures when the count is
+    0, so "no flagged items" -> 0 (byte-identical to outline). Stored on the
+    conversation_sessions rollup by _recompute_conversation_sessions; filtered
+    by list_conversations(rebuild_min=...).
+
+    _assemble_session already runs _stamp_cache_failures internally before
+    returning, so the items carry the flag on entry; re-running the kernel here
+    is an idempotent recompute (it only ADDS the key on a flagged turn, never
+    clears one, and the predicate is deterministic over the same items) that
+    keeps the helper correct even if assembly ever stops stamping.
+    """
+    asm = _assemble_session(conn, session_id)
+    if asm is None:
+        return 0
+    items = asm["items"]
+    _stamp_cache_failures(items)
+    return sum(1 for it in items if "cache_failure" in it)
+
+
 def _session_cost_map(conn, session_ids):
     """{session_id: total_cost_usd} for the given sessions. Joins
     conversation_messages turn keys to the single deduped session_entries row
@@ -570,40 +594,135 @@ def _rollup_authoritative(conn) -> bool:
     return not pending
 
 
-def _list_session_rows_rollup(conn, order, limit, offset):
+# --- Browse-list filter predicates (spec §2) ------------------------------
+# The rail filters on four axes (date / project / cost / cache-rebuilds). All
+# four are STORED columns on the conversation_sessions rollup, so the rollup
+# fast path expresses every axis as a parameterized WHERE pushed BEFORE
+# LIMIT/OFFSET (pagination stays correct over the filtered set). The live
+# GROUP BY fallback has no cost/project/rebuild columns, so it expresses ONLY
+# the date axis (via HAVING over MAX(timestamp_utc)) — the rollup-only axes
+# degrade in that brief, self-correcting non-authoritative window (spec §1
+# dual-branch parity). The date predicate compares against the stored
+# last_activity_utc string, so the caller MUST pass UTC-ISO bounds in the same
+# format (...Z) — see bin/_lib_dashboard_dates.parse_filter_date_range.
+_FILTER_KEYS = ("date_from", "date_to", "projects",
+                "cost_min", "cost_max", "rebuild_min")
+# The rollup-only axes — the ones the live fallback cannot express. Used to set
+# the page's filter_degraded flag when one is requested under the live branch.
+_ROLLUP_ONLY_FILTER_KEYS = ("projects", "cost_min", "cost_max", "rebuild_min")
+
+
+def _empty_filters() -> dict:
+    """A no-op filter dict (every axis None) — the unfiltered default and the
+    shape the row-source helpers expect."""
+    return {k: None for k in _FILTER_KEYS}
+
+
+def _rollup_where(filters):
+    """(sql_fragment, params) for the ROLLUP branch — all four axes are stored
+    columns. Returns (" WHERE ...", [params]) or ("", []) when no axis is set.
+    Project IN-list naturally excludes empty/NULL project_label (neither the ''
+    no-cwd sentinel nor a NULL not-yet-filled row matches a real label).
+
+    The date axis is HALF-OPEN: ``date_from`` is an inclusive start-of-day lower
+    bound (``>=``) and ``date_to`` is the EXCLUSIVE start-of-next-day upper bound
+    (``<``) emitted by ``_lib_dashboard_dates.parse_filter_date_range``. The
+    strict ``<`` is load-bearing: it makes the lex compare against the stored
+    mixed-precision ``last_activity_utc`` (whole-second AND millisecond ``...Z``)
+    chronologically correct at the day edge (review Finding 1)."""
+    clauses, params = [], []
+    if filters["date_from"] is not None:
+        clauses.append("last_activity_utc >= ?"); params.append(filters["date_from"])
+    if filters["date_to"] is not None:
+        clauses.append("last_activity_utc < ?"); params.append(filters["date_to"])
+    if filters["projects"]:
+        ph = ",".join("?" for _ in filters["projects"])
+        clauses.append("project_label IN (%s)" % ph); params.extend(filters["projects"])
+    if filters["cost_min"] is not None:
+        clauses.append("cost_usd >= ?"); params.append(filters["cost_min"])
+    if filters["cost_max"] is not None:
+        clauses.append("cost_usd <= ?"); params.append(filters["cost_max"])
+    if filters["rebuild_min"] is not None:
+        clauses.append("cache_rebuild_count >= ?"); params.append(filters["rebuild_min"])
+    return (" WHERE " + " AND ".join(clauses)) if clauses else "", params
+
+
+def _live_having(filters):
+    """(sql_fragment, params) for the LIVE fallback — only the DATE axis is
+    expressible (no cost/project/rebuild columns exist on the raw messages).
+    The rollup's last_activity_utc IS MAX(timestamp_utc), so the date predicate
+    is the same HALF-OPEN bound applied via HAVING over the aggregate: inclusive
+    ``>=`` lower, EXCLUSIVE strict-``<`` upper — kept byte-for-byte in lockstep
+    with ``_rollup_where``'s date axis so both branches agree at the day edge
+    over mixed-precision timestamps (review Finding 1)."""
+    having, params = [], []
+    if filters["date_from"] is not None:
+        having.append("MAX(timestamp_utc) >= ?"); params.append(filters["date_from"])
+    if filters["date_to"] is not None:
+        having.append("MAX(timestamp_utc) < ?"); params.append(filters["date_to"])
+    return (" HAVING " + " AND ".join(having)) if having else "", params
+
+
+def _list_session_rows_rollup(conn, order, limit, offset, filters=None):
     """FAST path: read the pre-aggregated rail rows straight from the
     conversation_sessions rollup (spec §3). No GROUP BY, no temp B-tree for the
     ``recent`` sort. Returns (session_id, msg_count, started, last_activity)
     tuples — the same shape the live aggregate yields, so the downstream
-    assembly is identical. No WHERE is needed: the rollup is non-null by
-    construction (PK NOT NULL; the recompute's GROUP BY already drops NULLs)."""
+    assembly is identical. The optional ``filters`` dict pushes the four-axis
+    browse predicate (date/project/cost/rebuild — all stored columns) into the
+    WHERE BEFORE LIMIT/OFFSET, so ``has_more``/``next_offset`` stay correct over
+    the filtered set."""
+    where, params = _rollup_where(filters or _empty_filters())
     return conn.execute(
         "SELECT session_id, msg_count, "
         "       started_utc AS started, last_activity_utc AS last_activity "
-        "FROM conversation_sessions "
-        "ORDER BY " + order + " LIMIT ? OFFSET ?",
-        (limit + 1, offset),
+        "FROM conversation_sessions"
+        + where +
+        " ORDER BY " + order + " LIMIT ? OFFSET ?",
+        (*params, limit + 1, offset),
     ).fetchall()
 
 
-def _list_session_rows_live(conn, order, limit, offset):
+def _list_session_rows_live(conn, order, limit, offset, filters=None):
     """RETAINED fallback (Codex gate BLOCKER 2): the original live GROUP BY over
     conversation_messages, used while the rollup is not authoritative (the flag
     is set — e.g. an existing install before its first sync, or permanently
     under ``--no-sync``). Byte-identical output to the rollup branch by
-    construction; ``order`` here is the _SORTS_LIVE aggregate expression."""
+    construction; ``order`` here is the _SORTS_LIVE aggregate expression. The
+    optional ``filters`` dict applies ONLY the date axis (via HAVING over
+    MAX(timestamp_utc)); the rollup-only axes (project/cost/rebuild) cannot be
+    expressed here and are dropped — the caller flags filter_degraded."""
+    having, hparams = _live_having(filters or _empty_filters())
     return conn.execute(
         "SELECT session_id, COUNT(*) AS msg_count, "
         "       MIN(timestamp_utc) AS started, MAX(timestamp_utc) AS last_activity "
         "FROM conversation_messages "
         "WHERE session_id IS NOT NULL "
-        "GROUP BY session_id "
-        "ORDER BY " + order + " LIMIT ? OFFSET ?",
-        (limit + 1, offset),
+        "GROUP BY session_id"
+        + having +
+        " ORDER BY " + order + " LIMIT ? OFFSET ?",
+        (*hparams, limit + 1, offset),
     ).fetchall()
 
 
-def list_conversations(conn, *, sort="recent", limit=50, offset=0) -> dict:
+def list_conversation_facets(conn) -> dict:
+    """Distinct projects (+ conversation counts) for the browse filter
+    multi-select (spec §2). Reads the rollup; cheap GROUP BY. Empty/NULL
+    project labels are dropped (a no-cwd session stores '' and a not-yet-filled
+    row stores NULL — neither is a real selectable project). Sorted ascending
+    by label so the popover renders a stable list. Returns
+    ``{"projects": [{"project_label": str, "count": int}, ...]}``."""
+    rows = conn.execute(
+        "SELECT project_label, COUNT(*) FROM conversation_sessions "
+        "WHERE project_label IS NOT NULL AND project_label != '' "
+        "GROUP BY project_label ORDER BY project_label"
+    ).fetchall()
+    return {"projects": [{"project_label": p, "count": n} for p, n in rows]}
+
+
+def list_conversations(conn, *, sort="recent", limit=50, offset=0,
+                       date_from=None, date_to=None, projects=None,
+                       cost_min=None, cost_max=None, rebuild_min=None) -> dict:
     """All-history per-session browse rows (spec §3.1). NOT 365-day bounded.
 
     Reads the conversation_sessions rollup (Task A) when it is authoritative —
@@ -622,12 +741,27 @@ def list_conversations(conn, *, sort="recent", limit=50, offset=0) -> dict:
     revalidates every visible tick anyway."""
     limit = max(1, min(int(limit), 200))
     offset = max(0, int(offset))
+    # Browse-list filters (spec §2). The rollup branch expresses all four axes
+    # as column predicates; the live fallback only the date axis, so when a
+    # rollup-only axis is requested under the live branch we flag the page
+    # filter_degraded (a brief, self-correcting non-authoritative window).
+    filters = {
+        "date_from": date_from,
+        "date_to": date_to,
+        "projects": list(projects) if projects else None,
+        "cost_min": cost_min,
+        "cost_max": cost_max,
+        "rebuild_min": rebuild_min,
+    }
+    degraded = False
     if _rollup_authoritative(conn):
         order = _SORTS.get(sort, _SORTS["recent"])
-        rows = _list_session_rows_rollup(conn, order, limit, offset)
+        rows = _list_session_rows_rollup(conn, order, limit, offset, filters)
     else:
         order = _SORTS_LIVE.get(sort, _SORTS_LIVE["recent"])
-        rows = _list_session_rows_live(conn, order, limit, offset)
+        degraded = any(
+            filters[k] is not None for k in _ROLLUP_ONLY_FILTER_KEYS)
+        rows = _list_session_rows_live(conn, order, limit, offset, filters)
     has_more = len(rows) > limit
     rows = rows[:limit]
     session_ids = [r[0] for r in rows]
@@ -650,12 +784,17 @@ def list_conversations(conn, *, sort="recent", limit=50, offset=0) -> dict:
         }
         for (sid, msg_count, started, last_activity) in rows
     ]
+    page = {
+        "next_offset": offset + len(conversations) if has_more else None,
+        "has_more": has_more,
+    }
+    if degraded:
+        # The rail surfaces this: project/cost/rebuild filters apply once the
+        # rollup finishes indexing; only the date axis held this page.
+        page["filter_degraded"] = True
     return {
         "conversations": conversations,
-        "page": {
-            "next_offset": offset + len(conversations) if has_more else None,
-            "has_more": has_more,
-        },
+        "page": page,
     }
 
 
@@ -1169,6 +1308,20 @@ def get_conversation(conn, session_id, *, after=None, limit=500):
     _pl = _project_label(_latest(logical, 10))
     _title = _session_titles_map(conn, [session_id]).get(session_id) or _pl or session_id
 
+    # Jump-to-latest target (spec §3): the {session_id, uuid, id} of the
+    # conversation's FINAL rendered turn, sourced from the tail of the
+    # whole-session assembled item list (so it lands on a real grouped item, not
+    # a folded fragment). Codex P2 #4: assembled anchors carry session_id=None
+    # (only the returned PAGE's anchors are patched), so build it EXPLICITLY with
+    # the request session_id rather than copying items[-1]["anchor"] verbatim.
+    # None only for a genuinely empty conversation (an existing session always
+    # has >=1 item, so this stays non-None for any non-None return). Computed on
+    # the unsliced list so it is the SAME regardless of which page was requested.
+    last_anchor = None
+    if items:
+        _la = items[-1]["anchor"]
+        last_anchor = {"session_id": session_id, "uuid": _la["uuid"], "id": _la["id"]}
+
     # Cursor pagination over the item list (anchored to each item's canonical id).
     # A non-None `after` that matches no item's anchor (stale/deleted cursor)
     # yields an EMPTY page — never silently re-serves the head (M1).
@@ -1189,6 +1342,7 @@ def get_conversation(conn, session_id, *, after=None, limit=500):
                 "last_activity_utc": logical[-1][2],
                 "cost_usd": header_cost,
                 "models": sorted({r[6] for r in logical if r[6]}),
+                "last_anchor": last_anchor,
                 "items": [],
                 "subagent_meta": subagent_meta,
                 "page": {"next_after": None, "has_more": False},
@@ -1224,6 +1378,7 @@ def get_conversation(conn, session_id, *, after=None, limit=500):
         "last_activity_utc": last[2],
         "cost_usd": header_cost,
         "models": models,
+        "last_anchor": last_anchor,
         "items": page,
         "subagent_meta": subagent_meta,
         "page": {"next_after": next_after, "has_more": has_more},