cctally 1.75.1 → 1.77.0

package/bin/_cctally_db.py

@@ -2648,6 +2648,7 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
             plan_type             TEXT,
             individual_limit_json TEXT,
             reached_type          TEXT,
+            observed_model        TEXT,
             UNIQUE(source, source_path, line_offset, logical_limit_key),
             CHECK(source != 'codex' OR source_root_key IS NOT NULL)
         );
@@ -2893,6 +2894,12 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
     add_column_if_missing(conn, "conversation_sessions", "git_branch", "TEXT")
     add_column_if_missing(conn, "conversation_sessions", "models_json", "TEXT")
     add_column_if_missing(conn, "conversation_sessions", "title", "TEXT")
+    # #320: quota pool identity cannot depend on transcript events after the
+    # store split. Stamp the active model directly on each compact physical
+    # quota observation. Existing caches receive the nullable column here; 028
+    # backfills it from the still-present legacy event corpus before dropping
+    # that corpus.
+    add_column_if_missing(conn, "quota_window_snapshots", "observed_model", "TEXT")
     conn.execute(
         "CREATE INDEX IF NOT EXISTS idx_session_files_session_id "
         "ON session_files(session_id)"
@@ -3014,6 +3021,72 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
     conn.commit()
 
 
+def _apply_conversations_schema(conn: sqlite3.Connection) -> None:
+    """Create the #320 transcript/search database schema.
+
+    The historical cache schema remains the migration-fixture source of truth.
+    Reuse it here, then remove the compact accounting families so conversation
+    queries can resolve those names through the read-only ``cache_db``
+    attachment. Empty compatibility tables may still exist in cache.db for old
+    migration handlers, but all live transcript rows belong here.
+    """
+    # The first open projects the historical monolithic schema into the new
+    # store. Avoid repeating that create-then-drop work on every conversation
+    # endpoint: it writes sqlite_schema and WAL pages even when no transcript
+    # data changed. Future conversation schema revisions must bump this marker.
+    try:
+        current = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='conversation_schema_version'"
+        ).fetchone()
+    except sqlite3.OperationalError:
+        current = None
+    if current is not None and current[0] == "1":
+        return
+
+    _apply_cache_schema(conn)
+    conn.executescript(
+        """
+        DROP TABLE IF EXISTS session_entries;
+        DROP TABLE IF EXISTS session_files;
+        DROP TABLE IF EXISTS codex_session_entries;
+        DROP TABLE IF EXISTS codex_session_files;
+        DROP TABLE IF EXISTS quota_window_snapshots;
+        DROP TABLE IF EXISTS codex_conversation_threads;
+        DROP TABLE IF EXISTS codex_source_roots;
+
+        CREATE TABLE IF NOT EXISTS conversation_source_files (
+            path             TEXT PRIMARY KEY,
+            size_bytes       INTEGER NOT NULL,
+            mtime_ns         INTEGER NOT NULL,
+            last_byte_offset INTEGER NOT NULL,
+            last_ingested_at TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS codex_conversation_source_files (
+            path                         TEXT PRIMARY KEY,
+            size_bytes                   INTEGER NOT NULL,
+            mtime_ns                     INTEGER NOT NULL,
+            last_byte_offset             INTEGER NOT NULL,
+            last_ingested_at             TEXT NOT NULL,
+            source_root_key              TEXT,
+            last_session_id              TEXT,
+            last_model                   TEXT,
+            last_total_tokens            INTEGER,
+            last_native_thread_id        TEXT,
+            last_root_thread_id          TEXT,
+            last_parent_thread_id        TEXT,
+            last_conversation_key        TEXT,
+            last_turn_id                 TEXT
+        );
+        """
+    )
+    conn.execute(
+        "INSERT INTO cache_meta(key,value) VALUES "
+        "('conversation_schema_version','1') "
+        "ON CONFLICT(key) DO UPDATE SET value=excluded.value"
+    )
+
+
 def _fts5_available(conn: sqlite3.Connection) -> bool:
     """True if this sqlite build can create an FTS5 table. Cheap probe on a
     temp table that is created then dropped. Hidden test seam: tests monkeypatch
@@ -4730,6 +4803,118 @@ def _027_codex_fork_preamble_rebuild(conn: sqlite3.Connection) -> None:
             lock_fh.close()
 
 
+@cache_migration("028_split_conversation_store")
+def _028_split_conversation_store(conn: sqlite3.Connection) -> None:
+    """Move the re-derivable transcript corpus out of cache.db (#320).
+
+    The upgrade deliberately does not copy gigabytes of prose/events. It creates
+    the independent current-schema store, arms provider-local byte-zero replay,
+    then drops the legacy transcript tables from the hot cache. Compact Codex
+    thread metadata stays in cache.db because accounting/project attribution
+    joins it directly.
+    """
+    core = _cctally_core
+    lock_paths = (
+        core.CACHE_LOCK_MAINTENANCE_PATH,
+        core.CACHE_LOCK_PATH,
+        core.CACHE_LOCK_CODEX_PATH,
+        core.CONVERSATIONS_LOCK_MAINTENANCE_PATH,
+        core.CONVERSATIONS_LOCK_PATH,
+        core.CONVERSATIONS_LOCK_CODEX_PATH,
+    )
+    held = []
+    try:
+        core.APP_DIR.mkdir(parents=True, exist_ok=True)
+        for path in lock_paths:
+            fh = open(path, "w")
+            try:
+                fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                fh.close()
+                raise MigrationGateNotMet(
+                    "cache/conversation sync lock held; deferring cache 028 split"
+                )
+            held.append(fh)
+
+        conv = sqlite3.connect(core.CONVERSATIONS_DB_PATH)
+        try:
+            conv.execute("PRAGMA auto_vacuum=INCREMENTAL")
+            conv.execute("PRAGMA journal_mode=WAL")
+            _apply_conversations_schema(conv)
+            _set_cache_meta(conv, "conversation_rebuild_claude_pending", "1")
+            _set_cache_meta(conv, "conversation_rebuild_codex_pending", "1")
+            conv.commit()
+        finally:
+            conv.close()
+
+        conn.execute("BEGIN IMMEDIATE")
+        try:
+            # Preserve exact model-scoped quota-pool identity before discarding
+            # the legacy physical event corpus. The correlated lookup is the
+            # same nearest-prior context rule the quota reader used pre-split.
+            if conn.execute(
+                "SELECT 1 FROM sqlite_master "
+                "WHERE type='table' AND name='codex_conversation_events'"
+            ).fetchone() is not None:
+                conn.execute(
+                    "UPDATE quota_window_snapshots AS q SET observed_model=("
+                    " SELECT json_extract(e.payload_json, '$.payload.model')"
+                    " FROM codex_conversation_events AS e"
+                    " WHERE e.source_path=q.source_path"
+                    "   AND e.line_offset<=q.line_offset"
+                    "   AND e.record_type IN ('turn_context','session_meta')"
+                    "   AND json_valid(e.payload_json)"
+                    "   AND json_type(e.payload_json, '$.payload.model')='text'"
+                    " ORDER BY e.line_offset DESC LIMIT 1)"
+                    " WHERE q.source='codex' AND q.observed_model IS NULL"
+                )
+            for drop in (
+                "DROP TRIGGER IF EXISTS conv_fts_ai",
+                "DROP TRIGGER IF EXISTS conv_fts_ad",
+                "DROP TRIGGER IF EXISTS conv_fts_au",
+                "DROP TRIGGER IF EXISTS conv_fts_aux_ai",
+                "DROP TRIGGER IF EXISTS conv_fts_aux_ad",
+                "DROP TRIGGER IF EXISTS conv_fts_aux_au",
+                "DROP TRIGGER IF EXISTS conv_title_fts_ai",
+                "DROP TRIGGER IF EXISTS conv_title_fts_ad",
+                "DROP TRIGGER IF EXISTS conv_title_fts_au",
+                "DROP TRIGGER IF EXISTS codex_conv_fts_ai",
+                "DROP TRIGGER IF EXISTS codex_conv_fts_ad",
+                "DROP TRIGGER IF EXISTS codex_conv_fts_au",
+                "DROP TABLE IF EXISTS conversation_fts_aux",
+                "DROP TABLE IF EXISTS conversation_fts",
+                "DROP TABLE IF EXISTS conversation_title_fts",
+                "DROP TABLE IF EXISTS codex_conversation_fts",
+                "DROP TABLE IF EXISTS conversation_file_touches",
+                "DROP TABLE IF EXISTS conversation_sessions",
+                "DROP TABLE IF EXISTS conversation_ai_titles",
+                "DROP TABLE IF EXISTS conversation_messages",
+                "DROP TABLE IF EXISTS codex_conversation_file_touches",
+                "DROP TABLE IF EXISTS codex_conversation_rollups",
+                "DROP TABLE IF EXISTS codex_conversation_messages",
+                "DROP TABLE IF EXISTS codex_conversation_events",
+            ):
+                conn.execute(drop)
+            conn.commit()
+        except Exception:
+            conn.rollback()
+            raise
+        try:
+            if conn.execute("PRAGMA auto_vacuum").fetchone()[0] == 2:
+                # Python 3.11/Linux may defer this zero-column PRAGMA until the
+                # cursor is exhausted; fetchall drives it to completion.
+                conn.execute("PRAGMA incremental_vacuum").fetchall()
+        except sqlite3.DatabaseError:
+            pass
+    finally:
+        for fh in reversed(held):
+            try:
+                fcntl.flock(fh, fcntl.LOCK_UN)
+            except OSError:
+                pass
+            fh.close()
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")
@@ -7006,7 +7191,12 @@ def _vacuum_one_db(path, label: str, provider_locked: bool) -> int:
     # Serialize against the retention prune and concurrent vacuums via the
     # dedicated maintenance flock (F13/F7), then the provider flocks for
     # cache.db. All non-blocking: fail promptly rather than hang.
-    maint_fh = open(core.CACHE_LOCK_MAINTENANCE_PATH, "w")
+    conversation_store = path == core.CONVERSATIONS_DB_PATH
+    maintenance_path = (
+        core.CONVERSATIONS_LOCK_MAINTENANCE_PATH
+        if conversation_store else core.CACHE_LOCK_MAINTENANCE_PATH
+    )
+    maint_fh = open(maintenance_path, "w")
     try:
         try:
             fcntl.flock(maint_fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
@@ -7019,10 +7209,18 @@ def _vacuum_one_db(path, label: str, provider_locked: bool) -> int:
         held = []
         try:
             if provider_locked:
-                for lock_path, lname in (
-                    (core.CACHE_LOCK_PATH, "claude"),
-                    (core.CACHE_LOCK_CODEX_PATH, "codex"),
-                ):
+                provider_locks = (
+                    (
+                        (core.CONVERSATIONS_LOCK_PATH, "claude conversations"),
+                        (core.CONVERSATIONS_LOCK_CODEX_PATH, "codex conversations"),
+                    )
+                    if conversation_store else
+                    (
+                        (core.CACHE_LOCK_PATH, "claude"),
+                        (core.CACHE_LOCK_CODEX_PATH, "codex"),
+                    )
+                )
+                for lock_path, lname in provider_locks:
                     fh = open(lock_path, "w")
                     try:
                         fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
@@ -7063,6 +7261,10 @@ def cmd_db_vacuum(args: argparse.Namespace) -> int:
     targets = []
     if which in ("cache", "all"):
         targets.append((_cctally_core.CACHE_DB_PATH, "cache.db", True))
+    if which in ("conversations", "all"):
+        targets.append((
+            _cctally_core.CONVERSATIONS_DB_PATH, "conversations.db", True,
+        ))
     if which in ("stats", "all"):
         targets.append((_cctally_core.DB_PATH, "stats.db", False))
     overall = 0

package/bin/_cctally_doctor.py

@@ -385,10 +385,21 @@ def doctor_gather_state(
 
     cache_entries_count = None
     cache_last_entry_at = None
+    cache_db_page_count = None
+    cache_db_freelist_count = None
     try:
         if _cctally_core.CACHE_DB_PATH.exists():
             conn = sqlite3.connect(str(_cctally_core.CACHE_DB_PATH))
             try:
+                try:
+                    row = conn.execute("PRAGMA page_count").fetchone()
+                    if row and row[0] is not None:
+                        cache_db_page_count = int(row[0])
+                    row = conn.execute("PRAGMA freelist_count").fetchone()
+                    if row and row[0] is not None:
+                        cache_db_freelist_count = int(row[0])
+                except sqlite3.Error:
+                    pass
                 row = conn.execute(
                     "SELECT COUNT(*), MAX(timestamp_utc) FROM session_entries"
                 ).fetchone()
@@ -418,16 +429,35 @@ def doctor_gather_state(
     # Conversation-sessions rollup consistency (#217 S1 / U9). Two cheap COUNTs
     # (graceful None on a missing table / unreadable DB) + an in-progress signal
     # so a transient mid-sync mismatch never WARNs. The in-progress signal is a
-    # NON-BLOCKING cache.db.lock flock probe (a writer mid-walk holds it) OR the
+    # NON-BLOCKING conversations flock probe (a writer mid-walk holds it) OR the
     # presence of any pending reingest/split/backfill cache_meta flag — doctor
     # stays read-only and never blocks on the lock.
     conv_sessions_rollup_count = None
     conv_messages_distinct_sessions = None
     conv_rollup_sync_in_progress = False
-    try:
-        if _cctally_core.CACHE_DB_PATH.exists():
-            conn = sqlite3.connect(str(_cctally_core.CACHE_DB_PATH))
+    conversations_db_page_count = None
+    conversations_db_freelist_count = None
+    try:
+        if _cctally_core.CONVERSATIONS_DB_PATH.exists():
+            # This gather also runs inside dashboard snapshot precompute. A
+            # transcript writer may hold an exclusive SQLite lock, so use a
+            # read-only zero-timeout probe: conversation health can degrade,
+            # but it must never delay core snapshot freshness (#320).
+            conv_uri = (
+                _cctally_core.CONVERSATIONS_DB_PATH.resolve().as_uri()
+                + "?mode=ro"
+            )
+            conn = sqlite3.connect(conv_uri, uri=True, timeout=0.0)
             try:
+                try:
+                    row = conn.execute("PRAGMA page_count").fetchone()
+                    if row and row[0] is not None:
+                        conversations_db_page_count = int(row[0])
+                    row = conn.execute("PRAGMA freelist_count").fetchone()
+                    if row and row[0] is not None:
+                        conversations_db_freelist_count = int(row[0])
+                except sqlite3.Error:
+                    pass
                 try:
                     row = conn.execute(
                         "SELECT COUNT(*) FROM conversation_sessions"
@@ -461,12 +491,12 @@ def doctor_gather_state(
                     pass
             finally:
                 conn.close()
-        # Non-blocking flock probe: if a writer (sync_cache / a reingest) holds
-        # the cache.db.lock, the rollup may be mid-recompute → in progress. We
+        # Non-blocking flock probe: if a transcript writer/reingest holds the
+        # conversations.db lock, the rollup may be mid-recompute → in progress. We
         # acquire LOCK_EX|LOCK_NB and immediately release; failure (held) is the
         # signal. Never blocks (LOCK_NB), so doctor stays read-only + prompt.
         if not conv_rollup_sync_in_progress:
-            lock_path = _cctally_core.CACHE_LOCK_PATH
+            lock_path = _cctally_core.CONVERSATIONS_LOCK_PATH
             if lock_path is not None and pathlib.Path(lock_path).exists():
                 import fcntl as _fcntl
                 lock_fh = open(str(lock_path), "w")
@@ -658,6 +688,15 @@ def doctor_gather_state(
         for _name, _lp in (
             ("cache.db.lock", _cctally_core.CACHE_LOCK_PATH),
             ("cache.db.codex.lock", _cctally_core.CACHE_LOCK_CODEX_PATH),
+            ("conversations.db.lock", _cctally_core.CONVERSATIONS_LOCK_PATH),
+            (
+                "conversations.db.codex.lock",
+                _cctally_core.CONVERSATIONS_LOCK_CODEX_PATH,
+            ),
+            (
+                "conversations.db.maintenance.lock",
+                _cctally_core.CONVERSATIONS_LOCK_MAINTENANCE_PATH,
+            ),
         ):
             if not _lp.exists():
                 locks_held[_name] = False
@@ -863,6 +902,11 @@ def doctor_gather_state(
         locks_held=locks_held,
         # #297: cache.db WAL size backstop (gathered outside the deep branch).
         cache_db_wal_bytes=cache_db_wal_bytes,
+        # #315: read-only cache free-page evidence for the reclaim hint.
+        cache_db_page_count=cache_db_page_count,
+        cache_db_freelist_count=cache_db_freelist_count,
+        conversations_db_page_count=conversations_db_page_count,
+        conversations_db_freelist_count=conversations_db_freelist_count,
         codex_quota_windows=codex_quota_windows,
         codex_hook_roots=codex_hook_roots,
         codex_lifecycle_activity_24h=codex_lifecycle_activity_24h,

package/bin/_cctally_parser.py

@@ -2924,7 +2924,7 @@ def _build_db_parser(subparsers, name, *, help_text, xref=None):
     )
     db_vacuum.add_argument(
         "--db",
-        choices=("cache", "stats", "all"),
+        choices=("cache", "conversations", "stats", "all"),
         default="cache",
         help="Which DB to VACUUM (default: cache)",
     )

package/bin/_cctally_quota.py

@@ -41,10 +41,12 @@ from _lib_quota import (
     source_path_key,
 )
 from _lib_json_envelope import stamp_schema_version
+from _lib_jsonl import _codex_logical_limit_key, codex_model_scoped_quota_pool
 
 
 UTC = dt.timezone.utc
 _DASHBOARD_PROJECTION_CERTIFICATE_KEY = "codex_quota_projection_certificate"
+_CODEX_QUOTA_INTERPRETATION_VERSION = 2
 
 
 @dataclass(frozen=True)
@@ -134,6 +136,11 @@ def load_codex_quota_projection_certificate(
         if row is None:
             return None
         payload = json.loads(str(row[0]))
+        if (
+            int(payload["interpretationVersion"])
+            != _CODEX_QUOTA_INTERPRETATION_VERSION
+        ):
+            return None
         sequence = int(payload["sequence"])
         signatures = {
             str(root_key): str(signature)
@@ -169,6 +176,7 @@ def _store_codex_quota_projection_certificate(
                 conn.rollback()
                 return
             payload = json.dumps({
+                "interpretationVersion": _CODEX_QUOTA_INTERPRETATION_VERSION,
                 "sequence": sequence,
                 "signatures": dict(sorted(signatures.items())),
             }, sort_keys=True, separators=(",", ":"))
@@ -262,14 +270,50 @@ def load_codex_quota_observations(
     previous_row_factory = conn.row_factory
     try:
         conn.row_factory = sqlite3.Row
+
+        def has_columns(table: str, required: set[str]) -> bool:
+            columns = {
+                str(row[1]) for row in conn.execute(
+                    f"PRAGMA table_info({table})"
+                )
+            }
+            return required <= columns
+
+        has_session_entries = has_columns(
+            "codex_session_entries", {"source_path", "line_offset", "model"},
+        )
+        has_observed_model = has_columns(
+            "quota_window_snapshots", {"observed_model"},
+        )
+        entry_lookup = (
+            "(SELECT entries.model FROM codex_session_entries AS entries "
+            "WHERE entries.source_path=quota_window_snapshots.source_path "
+            "AND entries.line_offset<=quota_window_snapshots.line_offset "
+            "ORDER BY entries.line_offset DESC LIMIT 1)"
+        )
+        # A file's terminal model is not evidence for an earlier quota sample:
+        # the model may change later in the rollout. Prefer the compact stamp,
+        # then only a nearest-prior accounting context for legacy rows. If
+        # neither exists, leave the pool unscoped rather than fabricating it.
+        fallback_model = entry_lookup if has_session_entries else "NULL"
+        selected_model = (
+            f"COALESCE(quota_window_snapshots.observed_model,{fallback_model})"
+            if has_observed_model and fallback_model != "NULL"
+            else (
+                "quota_window_snapshots.observed_model"
+                if has_observed_model else fallback_model
+            )
+        )
+        model_expr = f"{selected_model} AS observed_model"
         sql = """
             SELECT source, source_root_key, source_path, line_offset,
                    captured_at_utc, observed_slot, logical_limit_key, limit_id,
                    limit_name, window_minutes, used_percent, resets_at_utc,
-                   plan_type, individual_limit_json, reached_type
+                   plan_type, individual_limit_json, reached_type,
+                   {model_expr}
               FROM quota_window_snapshots
              WHERE source='codex' AND source_root_key IS NOT NULL
-        """
+        """.format(model_expr=model_expr)
         params: list[object] = []
         if requested is not None:
             if not requested:
@@ -317,10 +361,17 @@ def load_codex_quota_observations(
             if any(row[name] is None or not str(row[name]).strip() for name in required_text):
                 continue
             try:
+                logical_limit_key = str(row["logical_limit_key"])
+                if codex_model_scoped_quota_pool(row["observed_model"]) is not None:
+                    logical_limit_key = _codex_logical_limit_key(
+                        str(row["source_root_key"]), row["limit_id"],
+                        str(row["observed_slot"]), int(row["window_minutes"]),
+                        str(row["observed_model"]),
+                    )
                 identity = QuotaWindowIdentity(
                     source=str(row["source"]),
                     source_root_key=str(row["source_root_key"]),
-                    logical_limit_key=str(row["logical_limit_key"]),
+                    logical_limit_key=logical_limit_key,
                     observed_slot=str(row["observed_slot"]),
                     window_minutes=int(row["window_minutes"]),
                     limit_id=row["limit_id"],

package/bin/_cctally_statusline.py

@@ -1205,8 +1205,6 @@ def _fork_persist(parent_lock_fd: int) -> None:
 
 def _statusline_persist(parsed, *, sync_for_test: bool = False) -> None:
     """Spool an eligible session candidate then reduce it opportunistically."""
-    if _lib_statusline.is_alternate_pool_model_id(parsed.model_id):
-        return
     candidate = _candidate_from_input(parsed, received_at=int(time.time()))
     if candidate is None:
         return

package/bin/_cctally_transcript.py

@@ -86,7 +86,7 @@ def _cmd_transcript_export(args) -> int:
         eprint(_SPEED_ONLY_CODEX_MSG)
         return 2
 
-    conn = c.open_cache_db()
+    conn = c.open_conversations_db()
     try:
         cq = c._load_sibling("_lib_conversation_query")
         md = cq.get_conversation_export(conn, session_id, scope)
@@ -118,7 +118,7 @@ def _cmd_transcript_export_qualified(
         return 2
     speed = c._resolve_codex_speed(speed_arg or "auto")
 
-    conn = c.open_cache_db()
+    conn = c.open_conversations_db()
     try:
         env = disp.neutral_export(
             conn, session_id, scope=scope, effective_speed=speed)
@@ -189,7 +189,7 @@ def _cmd_transcript_search_claude(args) -> int:
             eprint(f"transcript: {exc}")
             return 2
 
-    conn = c.open_cache_db()
+    conn = c.open_conversations_db()
     try:
         cq = c._load_sibling("_lib_conversation_query")
         try:
@@ -264,7 +264,7 @@ def _cmd_transcript_search_codex(args) -> int:
             eprint("transcript: invalid --cursor")
             return 2
 
-    conn = c.open_cache_db()
+    conn = c.open_conversations_db()
     try:
         result = disp.neutral_search(
             conn, query, source="codex", kind=kind,

package/bin/_cctally_tui.py

@@ -1772,40 +1772,12 @@ def _tui_build_sessions(
             (), now_utc=now_utc, limit=limit, display_tz=None,
             aggregated_override=aggregated_override,
         )
-    rows = list(view.rows)
-    # Attach human-readable titles for the dashboard/TUI Sessions surface.
-    # Reuses the conversation viewer's title derivation (AI title wins, else
-    # first non-marker human line), which reads the CACHE db
-    # (conversation_messages / conversation_ai_titles). Fail-soft: any cache
-    # failure leaves titles ``None`` -> the client renders an em-dash. One
-    # bounded indexed query (<= `limit` session ids, rides idx_conv_session_ts)
-    # per snapshot build. Titles are stashed unconditionally on this
-    # server-internal row; the privacy gate is applied later, at envelope
-    # serialization (``snapshot_to_envelope(transcripts_visible=...)``).
-    if rows:
-        session_ids = [r.session_id for r in rows if r.session_id]
-        try:
-            conn = c.open_cache_db()
-        except (sqlite3.DatabaseError, OSError):
-            conn = None
-        if conn is not None:
-            try:
-                titles = c._load_sibling(
-                    "_lib_conversation_query"
-                )._session_titles_map(conn, session_ids)
-                rows = [
-                    dataclasses.replace(r, title=titles.get(r.session_id))
-                    if r.session_id in titles else r
-                    for r in rows
-                ]
-            except (sqlite3.DatabaseError, OSError):
-                pass  # fail-soft: leave titles None
-            finally:
-                try:
-                    conn.close()
-                except sqlite3.Error:
-                    pass
-    return rows
+    # #320: transcript-derived titles are optional decoration. The core
+    # dashboard/TUI snapshot must never open conversations.db, because even a
+    # fail-soft read pays SQLite's lock timeout before it can fail. Conversation
+    # routes retain title derivation; the accounting Sessions panel renders its
+    # existing em-dash fallback when the independent store is unavailable.
+    return list(view.rows)
 
 
 def _tui_sessions_cached(

package/bin/_lib_codex_conversation_query.py

@@ -71,9 +71,25 @@ _SEARCH_BADGE = {
 
 
 def codex_normalization_authoritative(conn: sqlite3.Connection) -> bool:
-    """True iff migration 025 is stamped applied — i.e. the normalized corpus is
-    authoritative (§3.5). A missing ``schema_migrations`` table (bare
-    ``_apply_cache_schema`` conn, or a pre-migration cache) reads as pending."""
+    """True iff the normalized Codex corpus is authoritative (§3.5).
+
+    Split stores use their provider-local rebuild marker: current schema alone
+    is not authority while migration 028's byte-zero replay is pending. Legacy
+    monolithic/bare connections retain the migration-025 stamp contract.
+    """
+    try:
+        split = conn.execute(
+            "SELECT 1 FROM cache_meta "
+            "WHERE key='conversation_schema_version'"
+        ).fetchone() is not None
+        if split:
+            pending = conn.execute(
+                "SELECT 1 FROM cache_meta "
+                "WHERE key='conversation_rebuild_codex_pending'"
+            ).fetchone() is not None
+            return not pending
+    except sqlite3.OperationalError:
+        pass
     try:
         row = conn.execute(
             "SELECT 1 FROM schema_migrations WHERE name = ?",

package/bin/_lib_conversation_query.py

@@ -2048,7 +2048,9 @@ def _assemble_memo_clear() -> None:
 def _assemble_memo_key(conn, session_id):
     """Return (session_id, msg_count, last_activity_utc, entry_mutation_seq), or
     None to signal 'bypass the memo' — a missing rollup row or an unreadable
-    cache_meta (bare/path-less conn). The caller has already confirmed the
+    accounting ``cache_meta``. Split-store connections read that watermark
+    from the read-only ``cache_db`` attachment; legacy/bare test connections
+    retain the main-schema fallback. The caller has already confirmed the
     rollup is authoritative."""
     try:
         row = conn.execute(
@@ -2059,9 +2061,12 @@ def _assemble_memo_key(conn, session_id):
     if row is None:
         return None
     try:
+        schemas = {row[1] for row in conn.execute("PRAGMA database_list")}
+        meta_schema = "cache_db" if "cache_db" in schemas else "main"
         seq_row = conn.execute(
-            "SELECT value FROM cache_meta "
-            "WHERE key='session_entries_mutation_seq'").fetchone()
+            f"SELECT value FROM {meta_schema}.cache_meta "
+            "WHERE key='session_entries_mutation_seq'"
+        ).fetchone()
     except sqlite3.OperationalError:
         return None
     seq = int(seq_row[0]) if seq_row and seq_row[0] is not None else 0