cctally 1.80.3 → 1.81.0

package/bin/_cctally_reporting.py

@@ -45,19 +45,23 @@ def _cctally():
 # === moved verbatim from bin/cctally (Regions R1–R2) ===
 
 
-def _emit_daily_view_table_or_json(view, args):
+def _emit_daily_view_table_or_json(view, args, *, extra=None):
     """Order + emit a DailyView as the flat daily table or {daily} JSON.
 
     Shared by cmd_daily's default path and its -p-only (filter, no grouping)
     path so the two cannot drift. Body is exactly the default path's order +
     emit tail; callers keep their own --format share gate upstream of this.
+
+    ``extra`` (#341 R8): JSON decoration merged into the emitted payload under an
+    explicit ``--account`` invocation; ``None``/empty keeps the render byte-stable.
     """
     c = _cctally()
     days = list(reversed(view.aggregated))
     if args.order == "desc":
         days = list(reversed(days))
     if args.json:
-        print(c._bucket_to_json(days, list_key="daily", date_key="date"))
+        print(c._bucket_to_json(days, list_key="daily", date_key="date",
+                                extra=extra))
         return
     print(c._render_bucket_table(
         days,
@@ -91,6 +95,15 @@ def cmd_daily(args: argparse.Namespace) -> int:
         return range
     range_start, range_end = range
 
+    # #341 --account: resolve the render filter (provider=claude; the stamped-
+    # entry family fails closed with exit 3 when the entry cache is unavailable,
+    # since the direct-JSONL fallback carries no identity). None = merged
+    # (byte-identical). Threaded into every entry read below.
+    acct_key, acct_exit = c.resolve_account_filter(
+        args, "claude", needs_cache=True)
+    if acct_exit is not None:
+        return acct_exit
+
     # ── Project-axis path (issue #86 Session E / T1.11) ────────────────────
     # Gated by -i/--instances or -p/--project; the default path below is
     # untouched/byte-stable. Mirrors cmd_project's I/O-layer git-root
@@ -99,7 +112,8 @@ def cmd_daily(args: argparse.Namespace) -> int:
     project_patterns = [p.lower() for p in (getattr(args, "project", None) or [])]
 
     if getattr(args, "instances", False) or project_patterns:
-        joined = list(c.get_claude_session_entries(range_start, range_end))
+        joined = list(c.get_claude_session_entries(
+            range_start, range_end, account_key=acct_key))
         resolver_cache: dict = {}
         keyed: list = []              # [(ProjectKey, UsageEntry)] — for -i grouping
         filtered_uentries: list = []  # UsageEntry — for -p-only / --format / debug
@@ -176,7 +190,9 @@ def cmd_daily(args: argparse.Namespace) -> int:
                 json_groups.append((json_label, ordered))
                 table_groups.append((table_label, ordered))
             if args.json:
-                print(c._bucket_by_project_to_json(json_groups, date_key="date"))
+                print(c._bucket_by_project_to_json(
+                    json_groups, date_key="date",
+                    extra=c.account_json_fields(acct_key)))  # #341 R8
                 return 0
             print(c._render_bucket_table(
                 [], first_col_name="Date", title_suffix="Daily",
@@ -190,12 +206,13 @@ def cmd_daily(args: argparse.Namespace) -> int:
         # -p only (no -i): filter-only → normal date-aggregated daily output.
         view = c.build_daily_view(filtered_uentries, now_utc=_command_as_of(),
                                 display_tz=tz, mode=args.mode)
-        _emit_daily_view_table_or_json(view, args)
+        _emit_daily_view_table_or_json(
+            view, args, extra=c.account_json_fields(acct_key))  # #341 R8
         return 0
 
     # ── Default path (UNCHANGED) ───────────────────────────────────────────
     # Collect entries.
-    all_entries = c.get_entries(range_start, range_end)
+    all_entries = c.get_entries(range_start, range_end, account_key=acct_key)
 
     c._emit_debug_samples_if_set(
         args, all_entries, command_label="daily",
@@ -243,7 +260,8 @@ def cmd_daily(args: argparse.Namespace) -> int:
     # Order + emit the flat daily table / {daily} JSON. Extracted into
     # `_emit_daily_view_table_or_json` so this default path and the
     # -p-only (filter, no grouping) path above stay byte-identical.
-    _emit_daily_view_table_or_json(view, args)
+    _emit_daily_view_table_or_json(
+        view, args, extra=c.account_json_fields(acct_key))  # #341 R8
     return 0
 
 
@@ -265,7 +283,12 @@ def cmd_monthly(args: argparse.Namespace) -> int:
         return range
     range_start, range_end = range
 
-    all_entries = c.get_entries(range_start, range_end)
+    acct_key, acct_exit = c.resolve_account_filter(
+        args, "claude", needs_cache=True)  # #341 --account (see cmd_daily)
+    if acct_exit is not None:
+        return acct_exit
+
+    all_entries = c.get_entries(range_start, range_end, account_key=acct_key)
 
     c._emit_debug_samples_if_set(
         args, all_entries, command_label="monthly",
@@ -314,7 +337,9 @@ def cmd_monthly(args: argparse.Namespace) -> int:
         months = list(reversed(months))
 
     if args.json:
-        print(c._bucket_to_json(months, list_key="monthly", date_key="month"))
+        print(c._bucket_to_json(
+            months, list_key="monthly", date_key="month",
+            extra=c.account_json_fields(acct_key)))  # #341 R8
         return 0
 
     print(c._render_bucket_table(
@@ -336,6 +361,13 @@ def cmd_weekly(args: argparse.Namespace) -> int:
     c._bridge_z_into_tz(args, config)
     args._resolved_tz = c.resolve_display_tz(args, config)
 
+    # #341 --account: resolve the render filter (provider=claude; fail closed
+    # with exit 3 when the entry cache is unavailable, since weekly cost is
+    # recomputed from session_entries). None = merged / byte-stable.
+    acct_key, acct_exit = c.resolve_account_filter(args, "claude", needs_cache=True)
+    if acct_exit is not None:
+        return acct_exit
+
     now_utc = _command_as_of()
     range = c._parse_cli_date_range(args, now_utc=now_utc)
     if isinstance(range, int):
@@ -351,6 +383,7 @@ def cmd_weekly(args: argparse.Namespace) -> int:
     # calendar-week fallback uses the explicit override's `week_start`.
     weeks = c._compute_subscription_weeks(
         conn, range_start, range_end, config=config,
+        account_key=acct_key,  # #341: None = merged (all-accounts) read
     )
 
     # Fetch entries and aggregate.
@@ -368,7 +401,7 @@ def cmd_weekly(args: argparse.Namespace) -> int:
         )
     else:
         fetch_start = range_start
-    all_entries = c.get_entries(fetch_start, range_end)
+    all_entries = c.get_entries(fetch_start, range_end, account_key=acct_key)
 
     c._emit_debug_samples_if_set(
         args, all_entries, command_label="weekly",
@@ -399,6 +432,7 @@ def cmd_weekly(args: argparse.Namespace) -> int:
     view = c.build_weekly_view(
         conn, all_entries, weeks=weeks, now_utc=now_utc,
         display_tz=args._resolved_tz, as_of_utc=as_of_utc, mode=args.mode,
+        account_key=acct_key,
     )
     buckets = list(reversed(view.aggregated))
     overlay = list(reversed(view.overlay))
@@ -438,7 +472,10 @@ def cmd_weekly(args: argparse.Namespace) -> int:
         overlay = list(reversed(overlay))
 
     if args.json:
-        print(c._weekly_to_json(buckets, weeks, overlay))
+        print(c._weekly_to_json(
+            buckets, weeks, overlay,
+            extra=c.account_json_fields(acct_key),  # #341 R8 decoration
+        ))
         return 0
 
     if not buckets:
@@ -474,7 +511,13 @@ def cmd_session(args: argparse.Namespace) -> int:
         return range
     range_start, range_end = range
 
-    entries = c.get_claude_session_entries(range_start, range_end)
+    acct_key, acct_exit = c.resolve_account_filter(
+        args, "claude", needs_cache=True)  # #341 --account (see cmd_daily)
+    if acct_exit is not None:
+        return acct_exit
+
+    entries = c.get_claude_session_entries(
+        range_start, range_end, account_key=acct_key)
 
     # Issue #89: --debug report describes the joined-entry list filtered
     # by --id (post-fallback session_id resolution) when set, matching
@@ -581,7 +624,8 @@ def cmd_session(args: argparse.Namespace) -> int:
         sessions = list(reversed(sessions))
 
     if args.json:
-        print(c._claude_sessions_to_json(sessions))
+        print(c._claude_sessions_to_json(
+            sessions, extra=c.account_json_fields(acct_key)))  # #341 R8
         return 0
 
     if not sessions:
@@ -622,6 +666,11 @@ def cmd_range_cost(args: argparse.Namespace) -> int:
         eprint("Error: --end must be after --start")
         return 1
 
+    acct_key, acct_exit = c.resolve_account_filter(
+        args, "claude", needs_cache=True)  # #341 --account (see cmd_daily)
+    if acct_exit is not None:
+        return acct_exit
+
     total_cost = 0.0
     matched_entries = 0
     first_match: dt.datetime | None = None
@@ -633,7 +682,8 @@ def cmd_range_cost(args: argparse.Namespace) -> int:
     # applied at the loader (SELECT-time), so the scope is the same.
     # P2.2 (issue #89 review-loop): get_entries already returns
     # list[UsageEntry] per bin/_cctally_cache.py:1224 — no list() wrap.
-    entries_list = c.get_entries(start_dt, end_dt, project=args.project)
+    entries_list = c.get_entries(start_dt, end_dt, project=args.project,
+                                 account_key=acct_key)
     c._emit_debug_samples_if_set(
         args, entries_list, command_label="range-cost",
     )
@@ -702,6 +752,8 @@ def cmd_range_cost(args: argparse.Namespace) -> int:
             ),
             "modelBreakdowns": breakdowns,
         }
+        # #341 R8: conditional account decoration under an explicit --account.
+        output.update(c.account_json_fields(acct_key))
         payload = c.stamp_schema_version(output)
         sink = getattr(args, "_source_result_sink", None)
         if sink is not None:

package/bin/_cctally_setup.py

@@ -2726,7 +2726,15 @@ def _setup_install(args: argparse.Namespace) -> int:
             try:
                 cache_conn = c.open_cache_db()
                 try:
-                    stats = c.sync_cache(cache_conn, progress=progress.sync_callback)
+                    cache_mod = c._load_sibling("_cctally_cache")
+                    stats, cache_conn = (
+                        cache_mod._run_cache_operation_with_recovery(
+                            cache_conn,
+                            lambda active_conn: c.sync_cache(
+                                active_conn, progress=progress.sync_callback
+                            ),
+                        )
+                    )
                 finally:
                     try:
                         cache_conn.close()

package/bin/_cctally_source_analytics.py

@@ -20,6 +20,7 @@ from _cctally_core import (
     parse_iso_datetime,
 )
 from _cctally_cache import _codex_provider_roots
+import _lib_accounts
 from _lib_quota import build_blocks
 from _lib_pricing import _calculate_codex_entry_cost
 from _cctally_quota import load_codex_quota_observations
@@ -81,6 +82,10 @@ class RootedCodexAccountingEntry:
     reasoning_output_tokens: int
     total_tokens: int
     cost_usd: float
+    # #341 Task 4: the ingest-stamped account (NULL in cache.db reads as the
+    # reserved ``unattributed`` sentinel). Carried so the per-account hero cards
+    # can scope spend without a second query shape.
+    account_key: str = _lib_accounts.UNATTRIBUTED
 
 
 _OPAQUE_PROJECT_KEY_RE = re.compile(r"^project:[0-9a-f]{24}$")
@@ -131,14 +136,23 @@ _CODEX_ACCOUNTING_ENTRIES_SQL = """
 """
 
 
+# P3-4 (#341 Task 4 review): the `account_key` column is selected unguarded — it
+# is NOT behind a `has_columns(...)` check like some other account-aware reads.
+# This is safe by construction: `add_column_if_missing(conn, "codex_session_entries",
+# "account_key", ...)` runs on every cache.db open (the pure column-addition
+# schema-evolution path, spec §2), so the column is guaranteed present before any
+# reader can reach this SQL. Defense-in-depth note only; do NOT add a runtime
+# guard here (it would mask a genuinely broken/un-migrated cache instead of failing
+# loudly, and every production reader opens the cache through that migration path).
 _ROOTED_CODEX_ACCOUNTING_ENTRIES_SQL = """
     SELECT timestamp_utc, session_id, source_path, source_root_key, model,
            input_tokens, cached_input_tokens, output_tokens,
-           reasoning_output_tokens, total_tokens
+           reasoning_output_tokens, total_tokens, account_key
       FROM codex_session_entries INDEXED BY idx_codex_entries_ts_root_conversation
      WHERE timestamp_utc >= ?
        AND timestamp_utc < ?
      {root_predicate}
+     {account_predicate}
      ORDER BY timestamp_utc ASC, source_root_key ASC, conversation_key ASC, id ASC
 """
 
@@ -274,6 +288,7 @@ def load_cached_rooted_codex_accounting_entries(
     speed: str,
     cache_conn: sqlite3.Connection,
     source_root_keys: Iterable[str] | None = None,
+    account_key: str | None = None,
 ) -> tuple[RootedCodexAccountingEntry, ...]:
     """Read bounded accounting from one caller-owned cache snapshot only.
 
@@ -282,6 +297,11 @@ def load_cached_rooted_codex_accounting_entries(
     cached root key plus source path are the dashboard's file identity.  A
     caller can additionally constrain the read to roots that established one
     native cycle; root identities remain internal to this adapter.
+
+    ``account_key`` (#341 Task 4) optionally scopes the read to one account; the
+    reserved ``unattributed`` sentinel matches rows whose ``account_key`` is NULL
+    (``NULL ≡ unattributed`` — the cache-read rule). ``None`` reads every account
+    (byte-stable — the default merged read).
     """
     if start.tzinfo is None or start.utcoffset() is None:
         raise ValueError("start must be timezone-aware")
@@ -299,11 +319,22 @@ def load_cached_rooted_codex_accounting_entries(
         "AND source_root_key IN (" + ", ".join("?" for _ in root_keys) + ")"
         if source_root_keys is not None else ""
     )
+    account_params: tuple = ()
+    if account_key is None:
+        account_predicate = ""
+    elif account_key == _lib_accounts.UNATTRIBUTED:
+        account_predicate = "AND (account_key IS NULL OR account_key = ?)"
+        account_params = (_lib_accounts.UNATTRIBUTED,)
+    else:
+        account_predicate = "AND account_key = ?"
+        account_params = (account_key,)
     try:
         rows = tuple(cache_conn.execute(
-            _ROOTED_CODEX_ACCOUNTING_ENTRIES_SQL.format(root_predicate=root_predicate),
+            _ROOTED_CODEX_ACCOUNTING_ENTRIES_SQL.format(
+                root_predicate=root_predicate, account_predicate=account_predicate),
             (
-                start.astimezone(UTC).isoformat(), end.astimezone(UTC).isoformat(), *root_keys,
+                start.astimezone(UTC).isoformat(), end.astimezone(UTC).isoformat(),
+                *root_keys, *account_params,
             ),
         ))
     except sqlite3.Error as exc:
@@ -315,12 +346,16 @@ def load_cached_rooted_codex_accounting_entries(
             (
                 timestamp_raw, session_id_raw, source_path_raw, source_root_key_raw,
                 model_raw, input_raw, cached_input_raw, output_raw, reasoning_raw,
-                total_raw,
+                total_raw, account_key_raw,
             ) = row
             source_path = source_path_raw if isinstance(source_path_raw, str) else ""
             source_root_key = source_root_key_raw if isinstance(source_root_key_raw, str) else ""
             if not source_path or not source_root_key:
                 raise ValueError("rooted accounting identity is absent")
+            entry_account_key = (
+                account_key_raw if isinstance(account_key_raw, str) and account_key_raw
+                else _lib_accounts.UNATTRIBUTED
+            )
             model = str(model_raw)
             input_tokens = int(input_raw)
             cached_input_tokens = int(cached_input_raw)
@@ -349,6 +384,7 @@ def load_cached_rooted_codex_accounting_entries(
             reasoning_output_tokens=reasoning_output_tokens,
             total_tokens=total_tokens,
             cost_usd=cost_usd,
+            account_key=entry_account_key,
         ))
     return tuple(result)
 
@@ -451,7 +487,10 @@ def load_qualified_codex_entries(
     previous_row_factory = conn.row_factory
     try:
         if sync:
-            stats = c.sync_codex_cache(conn)
+            cache_mod = c._load_sibling("_cctally_cache")
+            stats, conn = cache_mod._run_cache_operation_with_recovery(
+                conn, lambda active_conn: c.sync_codex_cache(active_conn)
+            )
             if stats.lock_contended:
                 raise QualifiedMetadataUnavailable("Codex qualified project metadata is unavailable")
         conn.row_factory = sqlite3.Row
@@ -624,11 +663,15 @@ def load_codex_accounting_entries(
     return tuple(result)
 
 
-def _identity_sort_key(identity: object) -> tuple[str, str, str, str, int]:
+def _identity_sort_key(identity: object) -> tuple[str, str, str, str, int, str]:
+    # account_key (#341) is appended LAST so single-account ordering is
+    # byte-identical (the tiebreak is constant) while a multi-account install
+    # gets a deterministic tiebreak between two accounts' windows.
     return (
         str(identity.source), str(identity.source_root_key),
         str(identity.logical_limit_key), str(identity.observed_slot),
         int(identity.window_minutes),
+        str(getattr(identity, "account_key", "unattributed")),
     )
 
 
@@ -2286,7 +2329,13 @@ def cmd_source_report(args: object) -> int:
         try:
             cache = c.open_cache_db()
             try:
-                sync_stats = c.sync_codex_cache(cache)
+                cache_mod = c._load_sibling("_cctally_cache")
+                sync_stats, cache = (
+                    cache_mod._run_cache_operation_with_recovery(
+                        cache,
+                        lambda active_conn: c.sync_codex_cache(active_conn),
+                    )
+                )
             finally:
                 cache.close()
             c.reconcile_codex_quota_projection(now=as_of)

package/bin/_cctally_statusline.py

@@ -613,22 +613,59 @@ def _epoch_from_iso(value: object) -> int:
     return int(_cctally_core.parse_iso_datetime(str(value), "statusline projection").timestamp())
 
 
+def _statusline_active_account() -> "str | None":
+    """The active Claude ``account_key`` to scope the statusline projection to
+    (#341, spec §3 write-path semantics — statusline resolves the active account
+    once per read and scopes its reset-aware clamps to it).
+
+    Torn-handling (reviewer-specified): a TORN ``~/.claude.json`` read keeps the
+    merged (``None``) behavior — never mis-stamp against a half-written file;
+    *identified* returns the real key; *stably-absent* / api-key returns the
+    ``unattributed`` sentinel. For a <=1-real-account install every stats row
+    defaults to ``unattributed``, so the scoped clamp matches all of them and
+    the rendered output stays byte-frozen (R8). Best-effort / never-raise: any
+    failure falls back to the merged read."""
+    try:
+        ident = _cctally_core._resolve_active_claude_identity()
+        return None if ident.get("status") == "torn" else ident.get("account_key")
+    except Exception:
+        return None
+
+
 def _read_db_projection_once() -> "_candidates.DbProjection":
     conn = open_db()
+    _sl_account = _statusline_active_account()
+    # #341 (spec §3 write-path): the statusline resolves the active account once
+    # per read and scopes its ENTIRE projection to it — candidate selection AND
+    # grouping, not only the reset-aware clamps. Scoping the two candidate
+    # SELECTs here means one account's interleaved snapshots can never become
+    # another account's projection candidate. Same three-valued semantics as
+    # `_reset_aware_floor`: a real key / the `unattributed` sentinel scopes to
+    # `account_key = ?`; `None` (TORN read) keeps the merged/last-known set —
+    # never mis-scope against a half-written identity file. For a <=1-real-account
+    # install every stats row defaults to `unattributed` and the active read
+    # resolves to `unattributed`, so the predicate matches all rows and the
+    # rendered output stays byte-frozen (R8).
+    _acct_pred = "" if _sl_account is None else " AND account_key = ?"
+    _acct_params: tuple = () if _sl_account is None else (_sl_account,)
     try:
         weekly_rows = conn.execute(
             "SELECT id, weekly_percent, week_start_date, week_start_at, week_end_at, "
             "       captured_at_utc, source "
             "FROM weekly_usage_snapshots "
-            "WHERE weekly_percent IS NOT NULL AND week_end_at IS NOT NULL "
-            "ORDER BY unixepoch(captured_at_utc) DESC, id DESC"
+            "WHERE weekly_percent IS NOT NULL AND week_end_at IS NOT NULL"
+            + _acct_pred +
+            " ORDER BY unixepoch(captured_at_utc) DESC, id DESC",
+            _acct_params,
         ).fetchall()
         five_rows = conn.execute(
             "SELECT id, five_hour_percent, five_hour_resets_at, five_hour_window_key, "
             "       captured_at_utc, source "
             "FROM weekly_usage_snapshots "
-            "WHERE five_hour_percent IS NOT NULL AND five_hour_resets_at IS NOT NULL "
-            "ORDER BY unixepoch(captured_at_utc) DESC, id DESC"
+            "WHERE five_hour_percent IS NOT NULL AND five_hour_resets_at IS NOT NULL"
+            + _acct_pred +
+            " ORDER BY unixepoch(captured_at_utc) DESC, id DESC",
+            _acct_params,
         ).fetchall()
 
         weekly_groups: dict[int, list] = {}
@@ -660,6 +697,7 @@ def _read_db_projection_once() -> "_candidates.DbProjection":
                 str(reference["week_start_date"]),
                 str(week_start_at),
                 str(week_end_at),
+                account_key=_sl_account,
             )
             floor_epoch = _epoch_from_iso(floor) if floor else 0
             eligible = [
@@ -1573,6 +1611,14 @@ def _build_statusline_injections(warn_once):
         c = _cctally()
         five_hwm = None
         seven_hwm = None
+        # #341 (spec §3): scope the 7d reset-aware clamp to the active Claude
+        # account (torn -> merged None; identified -> real key; absent ->
+        # `unattributed`). Byte-frozen for <=1 real account (all rows default
+        # `unattributed`). `_resolve_active_claude_identity` is mtime-cached, so
+        # resolving here (as well as in `_read_db_projection_once`) is a cache hit.
+        _sl_account = _statusline_active_account()
+        _acct_pred = "" if _sl_account is None else " AND account_key = ?"
+        _acct_params = () if _sl_account is None else (_sl_account,)
         try:
             conn = open_db()
         except Exception:
@@ -1629,21 +1675,22 @@ def _build_statusline_injections(warn_once):
                     floor_iso = c._reset_aware_floor(
                         conn, week_start_date,
                         week_start_dt.isoformat(), week_end_dt.isoformat(),
+                        account_key=_sl_account,
                     )
                     if floor_iso is not None:
                         row = conn.execute(
                             "SELECT MAX(weekly_percent) "
                             "FROM weekly_usage_snapshots "
-                            "WHERE week_start_date = ? "
+                            "WHERE week_start_date = ?" + _acct_pred + " "
                             "  AND unixepoch(captured_at_utc) >= unixepoch(?)",
-                            (week_start_date, floor_iso),
+                            (week_start_date, *_acct_params, floor_iso),
                         ).fetchone()
                     else:
                         row = conn.execute(
                             "SELECT MAX(weekly_percent) "
                             "FROM weekly_usage_snapshots "
-                            "WHERE week_start_date = ?",
-                            (week_start_date,),
+                            "WHERE week_start_date = ?" + _acct_pred,
+                            (week_start_date, *_acct_params),
                         ).fetchone()
                     if row and row[0] is not None:
                         seven_hwm = float(row[0])

package/bin/_cctally_store.py

@@ -33,11 +33,11 @@ once ``user_version == registry head``. Add the column via a registered
 migration (which bumps the head and re-triggers the apply) instead.
 
 **Lock-order law** (spec §5.2 / §6.4; asserted here as documentation, exercised
-by the storm test): maintenance flocks → ``journal.ingest.lock`` → provider
-flocks (cache Claude → cache Codex → conversations Claude → conversations
-Codex) → SQLite transactions → ``journal.lock`` (leaf). Never acquire the
-ingest lock while holding a provider flock; no SQLite write transaction ever
-spans a flock acquisition.
+by the storm test): maintenance flocks → ``journal.ingest.lock`` → the global
+``cache.db.lock`` writer flock → the cache Codex provider flock → conversation
+provider flocks (Claude → Codex) → SQLite transactions → ``journal.lock``
+(leaf). Never acquire the ingest lock while holding a cache writer/provider
+flock; no SQLite write transaction ever spans a flock acquisition.
 
 **Raw-connect escape hatches stay OUT of this module by design** (spec §6.1):
 ``db checkpoint``'s ``mode=rw`` connect, ``db vacuum``'s exclusive connect, and
@@ -158,6 +158,12 @@ def apply_policy(conn: sqlite3.Connection, store: str) -> None:
     if policy.auto_vacuum is not None:
         conn.execute(f"PRAGMA auto_vacuum={policy.auto_vacuum}")
     conn.execute(f"PRAGMA journal_mode={policy.journal_mode}")
+    apply_connection_policy(conn, store)
+
+
+def apply_connection_policy(conn: sqlite3.Connection, store: str) -> None:
+    """Apply non-schema connection settings without changing journal mode."""
+    policy = STORE_POLICY[store]
     conn.execute(f"PRAGMA synchronous={policy.synchronous}")
     conn.execute(f"PRAGMA busy_timeout={policy.busy_timeout}")
     conn.execute(f"PRAGMA journal_size_limit={policy.journal_size_limit}")
@@ -497,10 +503,16 @@ def resolve_stats_epoch_mismatch():
                         "present to rebuild from. The journal/ directory is the "
                         "durable source — restore it from backup, then run "
                         "`cctally db rebuild --db stats`.")
-                # Preserve the version-ahead DB (nothing deleted), then rebuild a
-                # fresh epoch index into the now-absent destination.
+                # Preserve the version-ahead DB (nothing deleted), then run the
+                # #341 account epoch-transition coordinator into the now-absent
+                # destination: resolve the cutover identity (no stats.db open),
+                # append the canonical cutover op, then rebuild account-scoped
+                # (spec §2 — op strictly before the rebuild HW). A same-epoch or
+                # legacy DB never reaches here; a fresh cutover install stamps the
+                # epoch directly (run_cutover), so this path is the 1000->1001
+                # upgrade of an already-journaled install.
                 _cctally_db.quarantine_db_family(path)
-                _cctally_journal.rebuild_stats_index()
+                _cctally_journal.run_epoch_transition()
         finally:
             _heal_release_flock(maint_fd)
         return _cctally_core.open_db()

package/bin/_cctally_sync_week.py

@@ -44,12 +44,13 @@ from _cctally_core import (
     make_week_ref,
     get_latest_usage_for_week,
     now_utc_iso,
+    _resolve_active_claude_account,
 )
 
 
 def cmd_sync_week(
     args: argparse.Namespace, *, conn=None, as_of: "str | None" = None,
-    journal: "tuple | None" = None,
+    journal: "tuple | None" = None, account_key: str = "unattributed",
 ) -> int:
     """Compute + persist the week's cost snapshot.
 
@@ -103,6 +104,11 @@ def cmd_sync_week(
             project=args.project,
             start_iso_override=selection.start_iso_override,
             end_iso_override=selection.end_iso_override,
+            # #341 P2-CQ2: the cost VALUE is scoped to the same account the
+            # snapshot is stamped for (below), so a per-account snapshot no longer
+            # carries the merged cost of every account sharing the week. Default
+            # `unattributed` matches all-NULL legacy rows -> byte-stable.
+            account_key=account_key,
         )
         week_start_at = selection.start_iso_override or format_local_iso(week_start, end_of_day=False)
         week_end_at = selection.end_iso_override or format_local_iso(week_end, end_of_day=True)
@@ -120,6 +126,11 @@ def cmd_sync_week(
             commit=own_conn,
             as_of=as_of,
             journal=journal,
+            # Per-account cost materialization (#341 P2-1, spec §3): the snapshot
+            # lands under the active/crossing Claude account so the account-scoped
+            # milestone cost read + `_reset_aware_floor` see it. Default
+            # `unattributed` keeps single-account / legacy installs byte-stable.
+            account_key=account_key,
         )
 
         week_ref = make_week_ref(
@@ -178,19 +189,28 @@ def _cmd_sync_week_via_ingest(c, args: argparse.Namespace) -> int:
     dispatch maps it to the same exit code."""
     import _cctally_journal as _jr
     import _lib_journal as _lj
+    import _lib_accounts
 
+    # Per-account materialization (#341 P2-1, spec §3): resolve the active Claude
+    # account and carry it in the op payload so the fold stamps the cost snapshot
+    # under it (rebuild-deterministic). Byte-safe: the reserved sentinel OMITS
+    # the field, keeping a single-account / no-`~/.claude.json` op line identical.
+    _sync_account = _resolve_active_claude_account()
+    _sync_payload = {
+        "kind": "sync_week",
+        "week_start": args.week_start,
+        "week_end": args.week_end,
+        "week_start_name": args.week_start_name,
+        "mode": args.mode,
+        "offline": args.offline,
+        "project": args.project,
+    }
+    if _sync_account != _lib_accounts.UNATTRIBUTED:
+        _sync_payload["account_key"] = _sync_account
     op = _lj.make_op(
         at=now_utc_iso(),
         src="sync-week",
-        payload={
-            "kind": "sync_week",
-            "week_start": args.week_start,
-            "week_end": args.week_end,
-            "week_start_name": args.week_start_name,
-            "mode": args.mode,
-            "offline": args.offline,
-            "project": args.project,
-        },
+        payload=_sync_payload,
     )
     _jr.append_record(op)
     res = _jr.run_stats_ingest(mode="authoritative")