cctally 1.78.0 → 1.79.0

package/CHANGELOG.md

@@ -5,6 +5,19 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.79.0] - 2026-07-22
+
+### Added
+- The dashboard hero modal (Current Week / Current Cycle) now navigates history: the week/cycle chip's `‹`/`›` (or `ArrowUp`/`ArrowDown`) steps between previous 7-day billing cycles and a block navigator (or `ArrowLeft`/`ArrowRight`) scrolls a selected cycle's known 5-hour blocks, for both Claude subscription weeks and Codex native quota cycles; the default view stays on the current cycle with its active block. Weeks with a re-anchoring credit render the full chronological ledger with cumulative cost restarting per segment and a credit divider between segments, and empty weeks show an explicit empty state. A new `GET /api/milestones/<source>/week/<key>` route serves each selected week's complete milestone payload on demand, while a compact navigation index rides the live envelope (built only on non-idle snapshot rebuilds). Historic weeks are read-only; the Share action is hidden while a historic week is shown.
+- Qualified Codex reasoning now uses a provider-native title/summary/body treatment instead of Claude Thinking chrome, while empty reasoning stays absent and Claude Thinking is unchanged. Evidence-preserved lifecycle fallbacks render as concise Codex task states, and recognized Git/memory harness markers become privacy-safe system actions with on-demand raw payload access; authored lookalikes remain literal prose. (#334)
+- Qualified Codex conversation detail now preserves and renders plans, web searches, MCP completions, and agent-control operations as bounded provider-native cards with honest request/result/error state, safe web links, and on-demand raw payloads. Proven spawns gain a privacy-safe link to the exact retained child conversation only when same-root parent and canonical task-path evidence is unique; ambiguous, cross-root, malformed, and future shapes stay unlinked with the generic fallback. Local or placeholder Markdown image targets degrade to an explicit unavailable badge without a browser request or rendered path disclosure. (#332)
+- Qualified Codex conversation detail now exposes bounded native terminal, output, and patch cards, and the dashboard renders supported `exec` calls as clean terminals plus `apply_patch`/patch-completion records as faithful diff cards. Provider names remain visible, diff-less events stay honest, raw payloads remain available on demand, and unsupported future wrappers keep the generic fallback. (#331)
+- Beta release channel. Every release now ships to a beta channel first (npm `beta` dist-tag, GitHub prerelease); the maintainer later promotes chosen releases to stable (npm `latest`, GitHub "Latest", the Homebrew tap). Opt in with `cctally config set update.channel beta`: `cctally update` then tracks SemVer-max(beta, latest) and installs the exact resolved version (never a bare `@beta`), a `(beta)` marker appears on the CLI banner and the dashboard update badge/modal, the dashboard settings gain an Update-channel toggle, and `cctally doctor` reports the configured channel (warning on beta + Homebrew, which tracks stable only). Stable stays the default and flipping back to it never silently downgrades.
+
+### Fixed
+- The compact qualified conversation reader now keeps provider notification labels intact and the complete Codex input/output/cached-input/reasoning-output subtitle visible without clipping or horizontal overflow. Retained Codex world-state, inter-agent metadata, turn-context control fields, and unknown future record families stay replay-safe but no longer risk becoming fabricated transcript noise or exposing private harness state. (#335)
+- The dashboard's qualified conversation reader now keeps Codex reasoning, tool calls/results, injected metadata labels, and lifecycle events in their native semantic roles instead of collapsing them into generic background rows. Skill-invocation titles no longer expose local `SKILL.md` paths, the outline prioritizes real prompts, logical assistant responses, and compactions while retaining full detail payload, token, model, and cost data, and an overflow menu opened immediately after reader mount is no longer closed by delayed initialization. (#330)
+
 ## [1.78.0] - 2026-07-21
 
 ### Changed

package/README.md

@@ -49,6 +49,8 @@ cctally dashboard          # opens http://127.0.0.1:8789
 
 For status-line integration and tuning, see [docs/installation.md](docs/installation.md) and [docs/configuration.md](docs/configuration.md).
 
+**Beta channel (opt-in).** Every release ships to a beta channel first; the maintainer promotes the ones that prove out to stable, which is the default. To ride along with the newest builds as they land, opt in with `cctally config set update.channel beta` (npm or source installs — Homebrew tracks stable). `cctally update` then installs the exact latest beta version, and `cctally config set update.channel stable` flips you back cleanly with no silent downgrade. See [docs/commands/update.md](docs/commands/update.md#beta-channel).
+
 ## The live dashboard
 
 `cctally dashboard` serves a web app at `localhost:8789` that updates live as you work - no refresh, no polling. Eleven panels cover the whole picture: **current week**, **forecast**, **$/1% trend**, **recent sessions**, **weekly**, **monthly**, **5-hour blocks**, **daily heatmap**, **projects**, **cache report**, and **recent alerts**. Any panel expands into a focused view, sessions are filterable and searchable, and a settings drawer tunes alerts and display options on the fly. It runs only on your own machine by default; one flag opens it to the other devices on your network when you want that.

package/bin/_cctally_cache.py

@@ -1044,6 +1044,52 @@ def _replay_codex_normalization(conn: sqlite3.Connection) -> None:
     _recompute_codex_rollups(conn, affected)
 
 
+def _repair_codex_turn_ids_for_source(
+    conn: sqlite3.Connection, source_path: str,
+) -> set[str]:
+    """Reconcile stored normalized rows after a late native turn anchor arrives.
+
+    Active Codex streams can emit the response before a later completion, patch,
+    or abort record exposes its turn id. Run this bounded per-file repair only
+    when such a native proof arrives; ordinary append ticks remain delta-only.
+    The physical log stays authoritative.
+    """
+    events = [
+        _lib_jsonl.CodexPhysicalEvent(*row)
+        for row in conn.execute(
+            "SELECT source_path, line_offset, source_root_key, conversation_key, "
+            "native_thread_id, root_thread_id, parent_thread_id, timestamp_utc, "
+            "record_type, event_type, turn_id, call_id, payload_json "
+            "FROM codex_conversation_events WHERE source_path=? ORDER BY line_offset",
+            (source_path,),
+        )
+    ]
+    inferred, _terminal = _lib_codex_conversation.infer_codex_event_turns(events)
+    expected = {event.line_offset: turn for event, turn in zip(events, inferred)}
+    affected = {
+        row[0]
+        for row in conn.execute(
+            "SELECT DISTINCT conversation_key FROM codex_conversation_messages "
+            "WHERE source_path=?",
+            (source_path,),
+        )
+        if row[0]
+    }
+    for line_offset, stored_turn in conn.execute(
+        "SELECT line_offset, turn_id FROM codex_conversation_messages "
+        "WHERE source_path=?",
+        (source_path,),
+    ):
+        inferred_turn = expected.get(line_offset)
+        if stored_turn != inferred_turn:
+            conn.execute(
+                "UPDATE codex_conversation_messages SET turn_id=? "
+                "WHERE source_path=? AND line_offset=?",
+                (inferred_turn, source_path, line_offset),
+            )
+    return affected
+
+
 def _collect_inactive_codex_paths_and_roots(
     conn: sqlite3.Connection,
     current_file_identities: set[tuple[str, str]],
@@ -4849,6 +4895,7 @@ def open_conversations_db(*, attach_cache: bool = True) -> sqlite3.Connection:
         cache_uri = _cctally_core.CACHE_DB_PATH.resolve().as_uri() + "?mode=ro"
         conn.execute("ATTACH DATABASE ? AS cache_db", (cache_uri,))
         _import_legacy_conversation_rows(conn)
+        _ensure_codex_conversation_contract(conn)
     _harden_conversation_sidecars()
     return conn
 
@@ -4900,6 +4947,68 @@ def _import_legacy_conversation_rows(conn: sqlite3.Connection) -> None:
         conn.commit()
 
 
+def _ensure_codex_conversation_contract(conn: sqlite3.Connection) -> bool:
+    """Converge retained Codex events on first read after a contract bump.
+
+    Qualified CLI reads and ``dashboard --no-sync`` intentionally do not ingest
+    JSONL. They still must remain usable after an upgrade, so replay only the
+    already-retained physical events under the provider-local conversation lock.
+    Empty stores keep their existing rebuild marker for the next real sync.
+    """
+    current = _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
+
+    def needs_replay() -> bool:
+        version = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_conversation_contract_version'"
+        ).fetchone()
+        pending = conn.execute(
+            "SELECT 1 FROM cache_meta "
+            "WHERE key='conversation_rebuild_codex_pending'"
+        ).fetchone() is not None
+        has_events = conn.execute(
+            "SELECT 1 FROM codex_conversation_events LIMIT 1"
+        ).fetchone() is not None
+        return has_events and (pending or version is None or version[0] != current)
+
+    if not needs_replay():
+        return False
+
+    _cctally_core.CONVERSATIONS_LOCK_CODEX_PATH.touch()
+    lock_fh = open(_cctally_core.CONVERSATIONS_LOCK_CODEX_PATH, "w")
+    try:
+        if not _acquire_cache_flock(lock_fh, timeout=15.0):
+            return False
+        if not needs_replay():
+            return False
+        try:
+            conn.execute("BEGIN IMMEDIATE")
+            _codex_conversation_fts_full_clear(conn)
+            _replay_codex_normalization(conn)
+            conn.execute(
+                "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
+                ("codex_conversation_contract_version", current),
+            )
+            conn.execute(
+                "DELETE FROM cache_meta "
+                "WHERE key='conversation_rebuild_codex_pending'"
+            )
+            conn.commit()
+            return True
+        except (sqlite3.DatabaseError, OSError, ValueError) as exc:
+            conn.rollback()
+            eprint(
+                f"[codex-conversations] retained-event contract replay failed: {exc}"
+            )
+            return False
+    finally:
+        try:
+            fcntl.flock(lock_fh, fcntl.LOCK_UN)
+        except OSError:
+            pass
+        lock_fh.close()
+
+
 def _prepare_claude_conversation_maintenance(
     conn: sqlite3.Connection,
     *,
@@ -5240,10 +5349,25 @@ def sync_codex_conversations(
             "SELECT 1 FROM cache_meta "
             "WHERE key='conversation_rebuild_codex_pending'"
         ).fetchone() is not None
-        if pending_rebuild and targeted:
+        contract_row = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_conversation_contract_version'"
+        ).fetchone()
+        has_contract_state = conn.execute(
+            "SELECT 1 FROM codex_conversation_events LIMIT 1"
+        ).fetchone() is not None
+        contract_rebuild = (
+            has_contract_state
+            and (
+                contract_row is None
+                or contract_row[0]
+                != _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
+            )
+        )
+        if (pending_rebuild or contract_rebuild) and targeted:
             stats.deferred_reason = "rebuild_pending"
             return stats
-        rebuild = rebuild or pending_rebuild
+        rebuild = rebuild or pending_rebuild or contract_rebuild
         if rebuild:
             _clear_codex_conversation_store(conn)
             conn.commit()
@@ -5464,6 +5588,13 @@ def sync_codex_conversations(
                 affected_keys.update(
                     row.conversation_key for row in normalized.rows
                 )
+                if any(
+                    _lib_codex_conversation.codex_event_is_late_turn_anchor(event)
+                    for event in events
+                ):
+                    affected_keys.update(
+                        _repair_codex_turn_ids_for_source(conn, path_str)
+                    )
                 _recompute_codex_rollups(conn, affected_keys)
                 terminal = state.thread
                 conn.execute(
@@ -5511,6 +5642,13 @@ def sync_codex_conversations(
                 stats.files_failed += 1
 
         if only_paths is None and stats.files_failed == 0:
+            conn.execute(
+                "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
+                (
+                    "codex_conversation_contract_version",
+                    _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION,
+                ),
+            )
             conn.execute(
                 "DELETE FROM cache_meta "
                 "WHERE key='conversation_rebuild_codex_pending'"

package/bin/_cctally_config.py

@@ -309,6 +309,7 @@ ALLOWED_CONFIG_KEYS = (
     "dashboard.live_tail",
     "update.check.enabled",
     "update.check.ttl_hours",
+    "update.channel",
     "statusline.visual_burn_rate",
     "statusline.cost_source",
     "statusline.cctally_extensions",
@@ -883,6 +884,12 @@ def _config_known_value(config: dict, key: str) -> "object":
             return c._validate_update_check_ttl_hours_value(stored)
         except ValueError:
             return c.UPDATE_DEFAULT_TTL_HOURS
+    if key == "update.channel":
+        # Release channel opt-in (beta-channel, spec 2026-07-21 §3). Default
+        # "stable"; hand-edited junk surfaces the default — mirrors
+        # dashboard.bind / update.check.*. The single resolver keeps the CLI,
+        # check pipeline, doctor, and dashboard envelope in lockstep.
+        return c.resolve_update_channel(config)
     if key.startswith(_CODEX_BUDGET_LEAF_PREFIX):
         return _config_codex_leaf_value(config, key)
     if key in (
@@ -1564,6 +1571,35 @@ def _cmd_config_set(args: argparse.Namespace) -> int:
                 rendered = str(normalized)
             print(f"{key}={rendered}")
         return 0
+    if key == "update.channel":
+        # Release channel opt-in (beta-channel, spec 2026-07-21 §3). Enum
+        # {stable,beta}; validate first so rejection short-circuits before
+        # lock acquisition. Read-modify-write preserving the sibling
+        # `update.check` block (mirrors update.check.* preserving nothing it
+        # doesn't own).
+        try:
+            canonical = c._validate_update_channel_value(raw)
+        except ValueError as exc:
+            print(f"cctally config: {exc}", file=sys.stderr)
+            return 2
+        with config_writer_lock():
+            config = _load_config_unlocked()
+            existing_update = config.get("update")
+            if existing_update is not None and not isinstance(existing_update, dict):
+                print(
+                    "cctally: update config error: update must be an object",
+                    file=sys.stderr,
+                )
+                return 2
+            update_block = dict(existing_update or {})
+            update_block["channel"] = canonical
+            config["update"] = update_block
+            save_config(config)
+        if getattr(args, "emit_json", False):
+            print(json.dumps({"update": {"channel": canonical}}, indent=2))
+        else:
+            print(f"update.channel={canonical}")
+        return 0
     if key in (
         "budget.weekly_usd",
         "budget.alerts_enabled",
@@ -1990,6 +2026,20 @@ def _cmd_config_unset(args: argparse.Namespace) -> int:
                     save_config(config)
             # idempotent: silent on missing key
         return 0
+    if key == "update.channel":
+        # Drop the channel leaf; preserve a sibling update.check block, and
+        # prune an empty `update` so config.json stays tidy. Mirrors the
+        # update.check.* unset branch above.
+        with config_writer_lock():
+            config = _load_config_unlocked()
+            update_block = config.get("update")
+            if isinstance(update_block, dict) and "channel" in update_block:
+                del update_block["channel"]
+                if not update_block:
+                    config.pop("update", None)
+                save_config(config)
+            # idempotent: silent on missing key
+        return 0
     if key in (
         "budget.weekly_usd",
         "budget.alerts_enabled",

package/bin/_cctally_dashboard.py

@@ -4435,6 +4435,7 @@ _GET_ROUTES = (
     ("prefix", "/api/session/", "_handle_get_session_detail", None, True),
     ("prefix", "/api/project/", "_handle_get_project_detail", None, False),
     ("prefix", "/api/block/", "_handle_get_block_detail", None, True),
+    ("prefix", "/api/milestones/", "_handle_get_milestones_week", None, True),
     ("exact", "/api/update/status", "_handle_get_update_status", None, False),
     ("prefix", "/api/update/stream/", "_handle_get_update_stream", None, True),
     ("exact", "/api/share/templates", "_handle_share_templates_get", None, False),
@@ -5228,6 +5229,7 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # compatible. `enabled` must be a JSON bool; `ttl_hours` an int
         # (bools rejected — see _validate_update_check_ttl_hours_value).
         update_check_validated: "dict | None" = None
+        update_channel_validated: "str | None" = None
         if "update" in payload:
             update_in = payload["update"]
             if not isinstance(update_in, dict):
@@ -5236,13 +5238,28 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 )
                 return
             for inner in update_in.keys():
-                if inner != "check":
+                if inner not in ("check", "channel"):
                     self._respond_json(
                         400,
                         {"error": f"unknown update settings key: {inner}",
                          "field": f"update.{inner}"},
                     )
                     return
+            # Release channel opt-in (beta-channel, spec 2026-07-21 §3). Enum
+            # {stable,beta}; 400 on invalid. Mirrors the config-key validator.
+            if "channel" in update_in:
+                try:
+                    update_channel_validated = (
+                        _cctally()._validate_update_channel_value(
+                            update_in["channel"]
+                        )
+                    )
+                except ValueError as exc:
+                    self._respond_json(
+                        400,
+                        {"error": str(exc), "field": "update.channel"},
+                    )
+                    return
             check_in = update_in.get("check", {})
             if not isinstance(check_in, dict):
                 self._respond_json(
@@ -5398,7 +5415,10 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                     self._respond_json(400, {"error": str(exc)})
                     return
 
-            if update_check_validated is not None:
+            if (
+                update_check_validated is not None
+                or update_channel_validated is not None
+            ):
                 # Same hand-edited-junk guard as alerts: a non-dict
                 # `update` or `update.check` block in config.json should
                 # surface as a recoverable 400, not a 500.
@@ -5412,18 +5432,22 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                     )
                     return
                 merged_update = dict(existing_update or {})
-                existing_check = merged_update.get("check")
-                if existing_check is not None and not isinstance(
-                    existing_check, dict
-                ):
-                    self._respond_json(
-                        400, {"error": "update.check must be an object",
-                              "field": "update.check"}
-                    )
-                    return
-                merged_check = dict(existing_check or {})
-                merged_check.update(update_check_validated)
-                merged_update["check"] = merged_check
+                if update_check_validated is not None:
+                    existing_check = merged_update.get("check")
+                    if existing_check is not None and not isinstance(
+                        existing_check, dict
+                    ):
+                        self._respond_json(
+                            400, {"error": "update.check must be an object",
+                                  "field": "update.check"}
+                        )
+                        return
+                    merged_check = dict(existing_check or {})
+                    merged_check.update(update_check_validated)
+                    merged_update["check"] = merged_check
+                if update_channel_validated is not None:
+                    # Partial-PUT: preserve the sibling `update.check` block.
+                    merged_update["channel"] = update_channel_validated
                 merged["update"] = merged_update
 
             if cache_report_validated is not None:
@@ -5531,11 +5555,17 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 _cctally()._reconcile_codex_budget_on_config_write(
                     validated_budget
                 )
-        if update_check_validated is not None:
-            # Echo the full merged check block (cooked defaults included)
-            # so the SettingsOverlay can repaint without a follow-up GET.
-            out["update"] = {
-                "check": {
+        if (
+            update_check_validated is not None
+            or update_channel_validated is not None
+        ):
+            # Echo the touched update leaves (cooked defaults included) so the
+            # SettingsOverlay can repaint without a follow-up GET. The channel
+            # echo uses the read-surface name `configured_channel` (spec §3
+            # naming), mirrored from the merged config via the single resolver.
+            out_update: dict = {}
+            if update_check_validated is not None:
+                out_update["check"] = {
                     "enabled": _config_known_value(
                         merged, "update.check.enabled"
                     ),
@@ -5543,7 +5573,11 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                         merged, "update.check.ttl_hours"
                     ),
                 }
-            }
+            if update_channel_validated is not None:
+                out_update["configured_channel"] = (
+                    _cctally().resolve_update_channel(merged)
+                )
+            out["update"] = out_update
         if cache_report_validated is not None:
             # Echo the full cooked block (resolved defaults included) so
             # the dashboard composer can repaint without a follow-up GET
@@ -6272,6 +6306,117 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         self.end_headers()
         self.wfile.write(body)
 
+    def _send_milestones_json(self, status: int, body: dict) -> None:
+        payload = encode_dashboard_json_bytes(body, ensure_ascii=False)
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(payload)))
+        self.send_header("Cache-Control", "no-cache")
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def _handle_get_milestones_week(self, path: str) -> None:
+        """GET /api/milestones/<source>/week/<key> — one week's/cycle's
+        complete milestone-history payload (spec §2, hero-modal history).
+
+        Dedicated route (deliberately NOT the /api/source/ family, whose
+        not-found semantics are scoped to the current frozen bundle). Wire is
+        snake_case via ``encode_dashboard_json_bytes`` (the dashboard
+        convention — NOT the CLI camelCase envelope). Read-only, per-request
+        connections, no sync/migration writes from the assembly; the multi-read
+        assembly runs inside one transaction per DB. 400 malformed key/source;
+        404 ``{code: "unknown_key", reason}`` for keys that don't resolve.
+        """
+        import re as _re
+        import types as _types
+        import urllib.parse as _urlparse
+        from _cctally_cache import open_cache_db
+
+        tail = path[len("/api/milestones/"):]
+        parts = tail.split("/week/", 1)
+        if len(parts) != 2 or not parts[1]:
+            self._send_milestones_json(400, {"error": "invalid path"})
+            return
+        source, raw_key = parts[0], parts[1]
+        if source not in ("claude", "codex"):
+            self._send_milestones_json(400, {"error": "invalid source"})
+            return
+        key = _urlparse.unquote(raw_key)
+        c = sys.modules["cctally"]
+        try:
+            if source == "claude":
+                # Claude key is a week_start_date (YYYY-MM-DD).
+                if not _re.fullmatch(r"\d{4}-\d{2}-\d{2}", key):
+                    self._send_milestones_json(400, {"error": "invalid week key"})
+                    return
+                conn = open_db()
+                try:
+                    conn.execute("BEGIN")
+                    detail = c.build_claude_week_detail(conn, key)
+                    conn.commit()
+                finally:
+                    conn.close()
+                if detail is None:
+                    self._send_milestones_json(404, {
+                        "error": "unknown week", "code": "unknown_key",
+                        "reason": "unknown",
+                    })
+                    return
+                self._send_milestones_json(200, {**detail, "source": "claude", "key": key})
+                return
+
+            # Codex: opaque server-issued cycle key. Resolve across all codex
+            # roots (keys are unique per cycle, so a client-supplied index key
+            # matches its exact cycle without needing the hero-cycle identity —
+            # this also keeps a just-closed former-current cycle fetchable when
+            # the live hero cycle is momentarily unavailable, spec §2).
+            from _cctally_dashboard_sources import resolve_dashboard_source_semantics
+            speed = resolve_dashboard_source_semantics(
+                load_config(), display_tz_name="UTC",
+            ).speed
+            now_utc = _command_as_of()
+            stats_conn = open_db()
+            cache_conn = open_cache_db()
+            try:
+                # Stable read across BOTH DBs for a single response (spec §2):
+                # the cache conn supplies the physical cost correlation, so it
+                # gets the same BEGIN/commit envelope as the stats conn.
+                stats_conn.execute("BEGIN")
+                cache_conn.execute("BEGIN")
+                roots = tuple(sorted({
+                    str(r[0]) for r in stats_conn.execute(
+                        "SELECT DISTINCT source_root_key FROM quota_window_blocks "
+                        "WHERE source='codex'"
+                    )
+                }))
+                identity = _types.SimpleNamespace(source_root_keys=roots, resets_at=None)
+                result = c.build_codex_cycle_detail(
+                    stats_conn, cache_conn, identity=identity, key=key,
+                    speed=speed, now_utc=now_utc,
+                )
+                stats_conn.commit()
+                cache_conn.commit()
+            finally:
+                stats_conn.close()
+                cache_conn.close()
+            if isinstance(result, tuple):
+                _none, reason = result
+                self._send_milestones_json(404, {
+                    "error": "unknown cycle", "code": "unknown_key",
+                    "reason": reason,
+                })
+                return
+            if result is None:
+                self._send_milestones_json(404, {
+                    "error": "unknown cycle", "code": "unknown_key",
+                    "reason": "unknown",
+                })
+                return
+            self._send_milestones_json(200, {**result, "source": "codex", "key": key})
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("/api/milestones failed: %r", exc)
+            self.send_error(500, "milestones detail failed")
+
     def _serve_api_events(self) -> None:
         import queue as _queue
         self.send_response(200)
@@ -6496,9 +6641,19 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             _w.status() if _w is not None
             else {"current_run_id": None}
         )
+        # Beta-channel (spec 2026-07-21 §3): carry the configured release
+        # channel (from config, not cached state) so the badge/modal keep the
+        # `(beta)` marker + exact-version command after an execvp refresh, when
+        # the client polls /api/update/status instead of the SSE envelope.
+        try:
+            _c = _cctally()
+            configured_channel = _c.resolve_update_channel(_c.load_config())
+        except Exception:
+            configured_channel = "stable"
         body = {
             "state": state,
             "suppress": suppress,
+            "configured_channel": configured_channel,
             **worker_status,
         }
         self._respond_json(200, body)

package/bin/_cctally_dashboard_conversation.py

@@ -1057,7 +1057,7 @@ def _handle_get_conversation_payload_impl(handler, path: str) -> None:
     q = _u.parse_qs(handler.path.partition("?")[2])
     if session_id.startswith("v1."):
         # Qualified payload readback (§3.4): Codex uses block_key + which={call,
-        # output}; a v1.claude key keeps the tool_use_id + which={input,result}
+        # output,event}; a v1.claude key keeps the tool_use_id + which={input,result}
         # selector. neutral_payload picks per the resolved source; gone → 410.
         which_q = _qs_str(q, "which", "")
         tool_use_id_q = _qs_str(q, "tool_use_id", "") or None

package/bin/_cctally_dashboard_envelope.py

@@ -1287,6 +1287,12 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
     update_envelope = {
         "state":    _update_state_envelope,
         "suppress": _update_suppress_envelope,
+        # Beta-channel (spec 2026-07-21 §3): the configured release channel,
+        # derived DIRECTLY from config (never from cached state — a cached
+        # producer field can't seed the settings toggle after a failed fetch
+        # or on brew). The resolved-target fields (latest_version /
+        # resolved_dist_tag / latest_version_channel) ride inside `state`.
+        "configured_channel": sys.modules["cctally"].resolve_update_channel(config),
     }
 
     # Doctor aggregate block (spec §5.5). Only the small severity tree
@@ -1427,6 +1433,12 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                 # bound or the data source crashed during sync
                 # (recorded on ``last_sync_error``).
                 "five_hour_milestones":     getattr(snap, "five_hour_milestones", []) or [],
+                # Hero-modal historical-milestone navigation index (spec §3).
+                # Additive/optional: newest-first per-week entries built on the
+                # non-idle rebuild and stored on the snapshot; ``getattr``
+                # default keeps legacy/positional fixture snapshots serializing
+                # (they emit ``[]``). Historical rows never ride the envelope.
+                "week_index":               getattr(snap, "week_index", []) or [],
             },
 
         "forecast":

package/bin/_cctally_dashboard_sources.py

@@ -2080,7 +2080,21 @@ def build_codex_source_state(
         now_utc=context.now_utc,
         display_tz_name=context.display_tz_name,
     )
-    quota = {**quota, "blocks": quota_blocks}
+    # Hero-modal historical-milestone navigation index (spec §1c, §3). Built
+    # here on the non-idle codex source rebuild (idle ticks reuse the stored
+    # bundle) over the durable projection — a pure serializer never touches it.
+    # Guarded: an index failure must never fail the codex source build.
+    cycle_index: tuple = ()
+    if cycle is not None and not hero_failure:
+        try:
+            cycle_index = tuple(
+                sys.modules["cctally"].build_codex_cycle_index(
+                    context.stats_conn, identity=cycle, now_utc=context.now_utc,
+                )
+            )
+        except sqlite3.Error:
+            cycle_index = ()
+    quota = {**quota, "blocks": quota_blocks, "cycle_index": cycle_index}
     budget_rows = _budget_wire(context.stats_conn)
     projected_budget_rows = _projected_budget_wire(context.stats_conn)
     budget_cost_events = _codex_budget_cost_events(context, budget_entries)

package/bin/_cctally_doctor.py

@@ -800,14 +800,28 @@ def doctor_gather_state(
     # on corruption — both behaviors would hide diagnostic state
     # (codex H1).
     config_json_error = None
+    config_parsed: dict = {}
     try:
         if _cctally_core.CONFIG_PATH.exists():
-            json.loads(_cctally_core.CONFIG_PATH.read_text(encoding="utf-8"))
+            config_parsed = json.loads(
+                _cctally_core.CONFIG_PATH.read_text(encoding="utf-8")
+            )
     except json.JSONDecodeError as exc:
         config_json_error = f"{type(exc).__name__}: {exc}"
     except OSError as exc:
         config_json_error = f"OSError: {exc}"
 
+    # Configured update (release) channel (beta-channel, spec 2026-07-21 §3):
+    # derived from the SAME raw read (never load_config, which auto-creates on
+    # first run). Fail-soft to "stable" — resolve_update_channel already
+    # tolerates a non-dict block / junk value.
+    try:
+        update_channel = c.resolve_update_channel(
+            config_parsed if isinstance(config_parsed, dict) else {}
+        )
+    except Exception:
+        update_channel = "stable"
+
     update_state = None
     update_state_error = None
     try:
@@ -880,6 +894,7 @@ def doctor_gather_state(
         codex_jsonl_present=codex_jsonl_present,
         codex_project_metadata_health=codex_project_metadata_health,
         codex_project_metadata_error=codex_project_metadata_error,
+        update_channel=update_channel,
         dashboard_bind_stored=dashboard_bind_stored,
         runtime_bind=runtime_bind,
         # Conversation viewer (Plan 2, spec §5): only consulted on a LAN bind.