cctally 1.85.0 → 1.86.0

package/CHANGELOG.md

@@ -5,6 +5,22 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.86.0] - 2026-07-30
+
+### Fixed
+- Each Claude, Codex, or future-provider logical model release now receives a distinct, accessible dashboard color that stays consistent across cards and modals, while dated and capacity-qualified variants of the same release share one color.
+- Codex quota windows whose reported reset drifts through a chain of nearby values now converge into one physical window. The original upgrade grouped each sample only against already-settled anchors, so real history could leave one connected window split across multiple percentages, forecasts, milestone ladders and alert identities even though every adjacent reset remained within the intended ten-minute tolerance. A follow-up cache migration repairs already-upgraded history without changing the raw provider evidence, live ingest applies the same transitive rule, and terminal alert evidence follows exact retained members even when an endpoint is more than ten minutes from the winning first observation. Release cuts now also refuse every newly registered migration until a dated real-production-copy verification is tracked; `--ack-migrations` cannot bypass that gate. (#425)
+- Pooled Codex weekly rows now name every account whose near-identical reset boundary contributed to the row. The Weekly and Trend panels and their expanded tables no longer show one account's maximum percentage without disclosing the other account blended into it; focused and single-account views remain unchanged. Three dashboard tests also now reject malformed trailing text instead of checking only a correct-looking prefix. (#424)
+- The dashboard now keeps account focus consistent across every account-sensitive surface. Claude's merged and All-provider headlines no longer borrow one account's quota, while a focused Claude account uses only the percentage, reset and spend fields its own card actually provides. Focused keyboard shortcuts open scoped sessions and blocks, merged Codex block rows always expose their account in visible and accessible text, and shared-root quota forecasts no longer join through the account-blind parent. Account selection announcements now name the selected state correctly, long account labels remain identifiable on 320px screens, and small non-zero dollar values retain their cents instead of rounding to `$0`. (#423)
+- A weekly percent milestone is no longer recorded carrying the cost of an earlier crossing. Recording a crossing first refreshes the week's cost, but when a concurrent cache ingest made that account-scoped refresh fail closed, cctally kept going and stamped the last stored cost onto the new percentage — so the Current Week per-percent ladder showed two consecutive percentages at an identical cumulative dollar figure, a `$0.00` marginal and a `$/1%` that never happened. Because milestone rows are written once, that was permanent. The crossing is now skipped instead and recorded by the next observation with its real cost, so nothing is lost; the same fail-closed condition on a reset-affected week also no longer aborts the whole ingest cycle over a transient lock.
+- Codex quota percentages now appear only for windows the server still marks live. The Current Cycle modal no longer turns a retained, already-reset history row into a current percentage or `$ / 1%`; the All-accounts cycle table derives each live percentage and reset from that account's own quota window, including a live unattributed bucket whose totals-only card intentionally blanks those fields. Decorated parent envelopes also stop exposing one representative account's cycle-history index, and Forecast panels now preserve the same one-decimal percentage shown by their expanded views. (#422)
+- Codex cache sync now stops before reading rollout files when its durable account-attribution decisions cannot be replayed, preventing a transient journal/cache failure from reassigning usage to the account currently signed in. Doctor also reports retained quota rows that lack their canonical reset anchor and points to the safe Codex cache rebuild. (#421)
+
+## [1.85.1] - 2026-07-29
+
+### Fixed
+- Internal (maintainer-only): the daily project-filter fixture now selects its target by a unique path segment while deliberately placing the same basename in the shared scratch ancestor, preventing a random temporary-directory collision from failing one Linux release matrix lane.
+
 ## [1.85.0] - 2026-07-29
 
 ### Fixed

package/bin/_cctally_cache.py

@@ -1054,7 +1054,11 @@ class CodexResetAnchorResolver:
 
     def __init__(self, conn: sqlite3.Connection):
         self._conn = conn
-        self._groups: "dict[tuple[str, str, str, object], _lib_quota.ResetAnchorIndex]" = {}
+        self._groups: "dict[tuple[str, str, str, object], _lib_quota.ResetAnchorComponents]" = {}
+        self._pending_merges: list[
+            tuple[tuple[str, str, str, object], str, dt.datetime,
+                  tuple[dt.datetime, ...]]
+        ] = []
         self._seed_failed = False
 
     @staticmethod
@@ -1068,34 +1072,31 @@ class CodexResetAnchorResolver:
             _lib_jsonl.snap_codex_window_minutes(window_minutes),
         )
 
-    def _anchors_for(
+    def _components_for(
         self, group, logical_limit_key: str,
-    ) -> "_lib_quota.ResetAnchorIndex":
-        """The group's established anchors, as an O(1)-lookup index.
-
-        A bucketed index rather than a list because this seed is UNBOUNDED — it
-        is every distinct anchor the group ever carried — and the resolver is
-        driven over the whole table by cache migration 032 and over the whole
-        walk by `cache-sync --rebuild`. A linear scan per observation makes both
-        quadratic in the group's anchor count (~1,750 a year for a 5h window).
+    ) -> "_lib_quota.ResetAnchorComponents":
+        """The group's raw-reset components, ordered by deterministic ingest.
+
+        Raw values, not only stored anchors, are required to recover transitive
+        chain membership. Ordering by rollout byte identity preserves the
+        original first-sight winner while making a rebuild reproducible.
         """
-        anchors = self._groups.get(group)
-        if anchors is not None:
-            return anchors
-        anchors = _lib_quota.ResetAnchorIndex()
+        components = self._groups.get(group)
+        if components is not None:
+            return components
+        components = _lib_quota.ResetAnchorComponents()
         if not self._seed_failed:
             candidates = _lib_jsonl.codex_snap_equivalent_limit_keys(
                 str(logical_limit_key))
             placeholders = ",".join("?" for _ in candidates)
             try:
                 rows = self._conn.execute(
-                    "SELECT DISTINCT canonical_resets_at_utc "
+                    "SELECT source_path, line_offset, id, resets_at_utc "
                     "FROM quota_window_snapshots "
                     "WHERE source = 'codex' AND source_root_key = ? "
                     "  AND observed_slot = ? "
                     f"  AND logical_limit_key IN ({placeholders}) "
-                    "  AND canonical_resets_at_utc IS NOT NULL "
-                    "ORDER BY canonical_resets_at_utc",
+                    "ORDER BY source_path, line_offset, id",
                     (group[0], group[1], *candidates),
                 ).fetchall()
             except sqlite3.DatabaseError:
@@ -1105,15 +1106,66 @@ class CodexResetAnchorResolver:
                 self._seed_failed = True
                 rows = []
             for row in rows:
-                parsed = _parse_anchor_iso(row[0])
+                parsed = _parse_anchor_iso(row[3])
                 if parsed is not None:
-                    anchors.add(parsed)
-        self._groups[group] = anchors
-        return anchors
+                    components.add(
+                        parsed,
+                        order_key=(
+                            str(row[0]), int(row[1]), int(row[2])),
+                    )
+        self._groups[group] = components
+        return components
+
+    def _merge_stored_anchors(
+        self, group, logical_limit_key: str, winner: dt.datetime,
+        retired: tuple[dt.datetime, ...],
+    ) -> None:
+        if not retired:
+            return
+        self._pending_merges.append(
+            (group, str(logical_limit_key), winner, retired))
+
+    def apply_pending_merges(self) -> None:
+        """Apply queued component merges inside the caller's transaction.
+
+        Resolution happens while the direct walk is still buffering a file.
+        Deferring DML until `_write_codex_file_batch` keeps retired-anchor
+        updates atomic with that file's rows and cursor; its one rollback/retry
+        can safely reapply the unchanged queue.
+        """
+        for group, logical_limit_key, winner, retired in self._pending_merges:
+            candidates = _lib_jsonl.codex_snap_equivalent_limit_keys(
+                logical_limit_key)
+            key_placeholders = ",".join("?" for _ in candidates)
+            retired_text = tuple(
+                _codex_anchor_iso(value) for value in retired)
+            retired_placeholders = ",".join("?" for _ in retired_text)
+            self._conn.execute(
+                "UPDATE quota_window_snapshots "
+                "SET canonical_resets_at_utc = ? "
+                "WHERE source = 'codex' AND source_root_key = ? "
+                "  AND observed_slot = ? "
+                f"  AND logical_limit_key IN ({key_placeholders}) "
+                f"  AND canonical_resets_at_utc IN ({retired_placeholders})",
+                (
+                    _codex_anchor_iso(winner), group[0], group[1],
+                    *candidates, *retired_text,
+                ),
+            )
+
+    def mark_file_committed(self) -> None:
+        self._pending_merges.clear()
+
+    def discard_uncommitted_file(self) -> None:
+        """Forget buffered evidence after its file did not commit."""
+        self._groups.clear()
+        self._pending_merges.clear()
 
     def resolve(
         self, *, source_root_key: str, observed_slot: str,
         logical_limit_key: str, window_minutes: object, resets_at_utc: object,
+        source_path: "str | None" = None,
+        line_offset: "int | None" = None,
     ) -> "str | None":
         """The canonical anchor for one observation, as stored TEXT.
 
@@ -1126,10 +1178,17 @@ class CodexResetAnchorResolver:
             return None
         group = self.group_key(
             source_root_key, observed_slot, logical_limit_key, window_minutes)
-        anchors = self._anchors_for(group, logical_limit_key)
-        chosen = _lib_quota.resolve_reset_anchor(anchors, raw)
-        if chosen == raw:
-            anchors.add(raw)
+        components = self._components_for(group, logical_limit_key)
+        order_key = None
+        if (
+            isinstance(source_path, str)
+            and isinstance(line_offset, int)
+            and not isinstance(line_offset, bool)
+        ):
+            order_key = (source_path, line_offset, -1)
+        chosen, retired = components.add(raw, order_key=order_key)
+        self._merge_stored_anchors(
+            group, logical_limit_key, chosen, retired)
         # ALWAYS re-serialized through the canonical UTC form, established or
         # joined alike: two spellings of one instant ("…Z" vs "…+00:00") must
         # never mint two anchors for one cluster, and a row seeded by anything
@@ -1137,6 +1196,25 @@ class CodexResetAnchorResolver:
         # spell it either way.
         return _codex_anchor_iso(chosen)
 
+    def normalize_quota_rows(self, quota_rows: list[tuple[Any, ...]]) -> None:
+        """Converge buffered direct-walk rows after a later bridge observation.
+
+        The journal applier inserts one row immediately after resolution, so a
+        component merge can update earlier rows in SQLite. The direct rollout
+        walk buffers a whole file before its first DML; this final pass applies
+        the same union result to those not-yet-inserted tuples.
+        """
+        for index, row in enumerate(quota_rows):
+            raw = _parse_anchor_iso(row[11])
+            if raw is None:
+                continue
+            group = self.group_key(row[1], row[5], row[6], row[9])
+            components = self._groups.get(group)
+            if components is None:
+                continue
+            quota_rows[index] = row[:-1] + (
+                _codex_anchor_iso(components.canonical(raw)),)
+
 
 def _codex_anchor_iso(value: dt.datetime) -> str:
     return value.astimezone(dt.timezone.utc).isoformat().replace("+00:00", "Z")
@@ -1272,7 +1350,9 @@ def _discover_codex_files_with_roots() -> list[CodexDiscoveredFile]:
     discovered: list[CodexDiscoveredFile] = []
     seen: set[pathlib.Path] = set()
     for root in _codex_provider_roots():
-        for candidate in root.walk_root.glob("**/*.jsonl"):
+        for candidate in sorted(
+            root.walk_root.glob("**/*.jsonl"), key=lambda path: str(path)
+        ):
             if not candidate.is_file():
                 continue
             physical_path = _canonical_codex_path(candidate)
@@ -1905,6 +1985,7 @@ def _write_codex_file_batch(
     file_identity: "str | None" = None,
     incarnation: "int | None" = None,
     file_account_decision: "tuple[int, str | None] | None" = None,
+    anchor_resolver: "CodexResetAnchorResolver | None" = None,
 ) -> int:
     """Write one fully-buffered Codex file atomically and return entry changes.
 
@@ -1960,6 +2041,8 @@ def _write_codex_file_batch(
         )
         rows_changed = conn.total_changes - before
     if quota_rows:
+        if anchor_resolver is not None:
+            anchor_resolver.apply_pending_merges()
         conn.executemany(
             """INSERT OR IGNORE INTO quota_window_snapshots
                (source, source_root_key, source_path, line_offset,
@@ -2027,7 +2110,7 @@ def _iter_codex_jsonl_paths(roots: list[pathlib.Path]) -> Iterator[pathlib.Path]
     """
     seen: set[pathlib.Path] = set()
     for root in roots:
-        for jp in root.glob("**/*.jsonl"):
+        for jp in sorted(root.glob("**/*.jsonl"), key=lambda path: str(path)):
             # Dedup on the RESOLVED path, not the raw spelling. A symlinked
             # $CODEX_HOME root or an alias entry (`.../.codex`,
             # `.../sub/../.codex`) can glob the same physical file under
@@ -4845,10 +4928,13 @@ def sync_codex_cache(
             conn.commit()
             eprint("[cache-sync] rebuild: cleared Codex cached entries")
         # #416 spec §3.4: rehydrate the attribution map from the journal BEFORE
-        # the walk. The ordinary journal-to-cache replay lives inside
-        # `rebuild_stats_index`; this path clears (on --rebuild) and walks on its
-        # own with no applier in front of it, so a cache.db whose map cannot
-        # answer would send every file back to the live auth.json.
+        # the walk. This cursor is intentionally distinct from the stats ingest
+        # cursor that drives `_cache_applier`: a recreated/rebuilt cache.db may
+        # have an empty map while stats is already at journal high-water, and
+        # invoking stats ingest here would either reverse the total lock order
+        # (inside the cache flocks) or leave an append-before-lock race (outside
+        # them). The private cache-map cursor is therefore the only safe witness
+        # that every durable decision visible to this locked walk was replayed.
         #
         # Deliberately NOT rebuild-only. Every production Codex call site syncs
         # with rebuild=False, and the corruption auto-heal recreates the cache.db
@@ -4921,9 +5007,11 @@ def sync_codex_cache(
             _jr._report_file_account_conflicts(_declined)
         except Exception as exc:
             conn.rollback()
+            stats.deferred_reason = "attribution_rehydration"
             eprint(
                 "[cache-sync] could not rehydrate Codex attribution "
-                f"decisions: {exc}; undecided history stays unattributed")
+                f"decisions: {exc}; deferring the Codex walk")
+            return stats
 
         # Pure read (glob + is_file only); safe to run before the SELECT and
         # the per-file loop, where no cache.db write lock may be held. Targeted
@@ -5186,9 +5274,14 @@ def sync_codex_cache(
                 # The guard is the whole safety argument: `delta_append` means
                 # `start_offset` is this file's ingest watermark, and the second
                 # condition means the new range starts strictly beyond every
-                # decided range. So auth.json can only ever mint a range for
-                # bytes NOBODY has attributed yet; it can never re-decide bytes
-                # a decision already covers, which is the original defect.
+                # decided range. Today the term is algebraically redundant:
+                # every non-delta branch sets `start_offset = 0`, while every
+                # decided range starts at a non-negative offset, so the strict
+                # comparison alone implies a delta append. Keep the explicit
+                # term as belt-and-suspenders: it pins the semantic permission
+                # to consult auth.json if a future branch changes the offsets.
+                # Auth can therefore mint a range only for bytes NOBODY has
+                # attributed yet; it never re-decides covered bytes.
                 if delta_append and start_offset > account_ranges[-1][0]:
                     root_account = _live_root_account()
                     if root_account.status == "torn":
@@ -5345,6 +5438,8 @@ def sync_codex_cache(
                                     logical_limit_key=quota.logical_limit_key,
                                     window_minutes=quota.window_minutes,
                                     resets_at_utc=quota.resets_at_utc,
+                                    source_path=quota.source_path,
+                                    line_offset=quota.line_offset,
                                 ),
                             ))
                         if (thread := emission.thread) is not None and (
@@ -5394,6 +5489,7 @@ def sync_codex_cache(
                         stats.skip_reasons[_r] = stats.skip_reasons.get(_r, 0) + _n
             except OSError as exc:
                 eprint(f"[codex-cache] could not read {jp}: {exc}")
+                anchor_resolver.discard_uncommitted_file()
                 if targeted:
                     stats.files_failed += 1  # §5.1 I/O decline → call dirty
                 continue
@@ -5468,6 +5564,7 @@ def sync_codex_cache(
                         f"[codex-cache] attribution decision journal append "
                         f"failed for {jp}: {exc}; deferring the file")
                     stats.files_failed += 1
+                    anchor_resolver.discard_uncommitted_file()
                     continue
 
             # Task 7 Item 1: journal the Codex quota observations BEFORE the cache
@@ -5477,6 +5574,7 @@ def sync_codex_cache(
             # (idempotent at the QUOTA_APPLIER natural key) rather than losing the
             # observation. Appended once here, not inside the retry loop, so a DB
             # retry never double-journals.
+            anchor_resolver.normalize_quota_rows(quota_rows)
             _append_codex_quota_obs(quota_rows)
 
             # Every derived row above was buffered before the first DML. A
@@ -5514,6 +5612,7 @@ def sync_codex_cache(
                         file_identity=file_identity,
                         incarnation=incarnation,
                         file_account_decision=pending_decision,
+                        anchor_resolver=anchor_resolver,
                     )
                 except sqlite3.DatabaseError as exc:
                     conn.rollback()
@@ -5543,7 +5642,9 @@ def sync_codex_cache(
                 # walk count.  Targeted mode already depended on this signal;
                 # explicit rebuild now uses it to reject partial success too.
                 stats.files_failed += 1
+                anchor_resolver.discard_uncommitted_file()
                 continue
+            anchor_resolver.mark_file_committed()
 
             # Private test seam (§5.1 post-preflight late-shrink race): fires
             # after each file's successful commit, so a race test can shrink a

package/bin/_cctally_dashboard_sources.py

@@ -162,6 +162,7 @@ class CodexWeeklyPeriod:
     end_at: dt.datetime
     source_root_keys: tuple[str, ...]
     used_percent: float | None = None
+    account_keys: tuple[str, ...] = ()
 
 
 def _codex_history_row_is_model_scoped(row: object) -> bool:
@@ -506,8 +507,9 @@ def _codex_weekly_periods(
     ``max(...)`` hands the focused account the OTHER account's percentage —
     the never-combine violation D6 forbids — while ``end_at = min(resets_at,
     next_start)`` clips one account's week at the other's start. ``None`` keeps
-    the merged "All accounts" read, which is byte-stable and is what the parent
-    still uses.
+    the merged "All accounts" read used by the parent. Every merged boundary
+    retains the account-key set that contributed its percentage; the parent
+    publishes that set only under the existing multi-account decoration gate.
 
     The predicate is strict equality, deliberately NOT the one-directional
     ``(account, unattributed)`` widening ``_codex_five_hour_rows`` uses: that
@@ -528,8 +530,8 @@ def _codex_weekly_periods(
     account_params: tuple = () if account_key is None else (account_key,)
     try:
         rows = stats_conn.execute(
-            "SELECT source_root_key, logical_limit_key, limit_name, resets_at_utc, "
-            "nominal_start_at_utc, current_percent "
+            "SELECT source_root_key, account_key, logical_limit_key, limit_name, "
+            "resets_at_utc, nominal_start_at_utc, current_percent "
             "FROM quota_window_blocks "
             "WHERE source='codex' AND window_minutes=10080 "
             f"AND source_root_key IN ({placeholders}) AND orphaned_at IS NULL "
@@ -547,10 +549,10 @@ def _codex_weekly_periods(
     # live boundary together with its own durable row, so the flag is OR-ed on
     # merge rather than taken from either side.
     raw_boundaries: list[
-        tuple[dt.datetime, dt.datetime, set[str], list[float], bool]
+        tuple[dt.datetime, dt.datetime, set[str], list[float], set[str], bool]
     ] = []
 
-    for (root_key, logical_limit_key, limit_name, resets_at_raw,
+    for (root_key, row_account_key, logical_limit_key, limit_name, resets_at_raw,
          start_at_raw, current_percent) in rows:
         if is_model_scoped_codex_quota(logical_limit_key, limit_name):
             continue
@@ -568,7 +570,14 @@ def _codex_weekly_periods(
         used_values = []
         if isinstance(current_percent, (int, float)) and not isinstance(current_percent, bool):
             used_values.append(float(current_percent))
-        raw_boundaries.append((start_at, resets_at, {str(root_key)}, used_values, False))
+        raw_boundaries.append((
+            start_at,
+            resets_at,
+            {str(root_key)},
+            used_values,
+            {str(row_account_key or _lib_accounts.UNATTRIBUTED)},
+            False,
+        ))
 
     # `active_cycle is None` is the case §7.4 calls out explicitly: no boundary
     # is live, so nothing is exempt and every period clips exactly as before.
@@ -578,13 +587,18 @@ def _codex_weekly_periods(
             active_cycle.resets_at.astimezone(UTC),
             set(active_cycle.source_root_keys),
             [active_cycle.used_percent] if active_cycle.used_percent is not None else [],
+            {
+                active_cycle.quota_identity.account_key
+                if active_cycle.quota_identity is not None
+                else _lib_accounts.UNATTRIBUTED
+            },
             True,
         ))
 
     ordered: list[
-        tuple[dt.datetime, dt.datetime, set[str], list[float], bool]
+        tuple[dt.datetime, dt.datetime, set[str], list[float], set[str], bool]
     ] = []
-    for start_at, resets_at, period_roots, used_values, is_live in sorted(
+    for start_at, resets_at, period_roots, used_values, period_accounts, is_live in sorted(
         raw_boundaries, key=lambda item: (item[0], item[1]),
     ):
         if (
@@ -592,19 +606,26 @@ def _codex_weekly_periods(
             and (start_at - ordered[-1][0]).total_seconds()
             < _FIVE_HOUR_JITTER_FLOOR_SECONDS
         ):
-            first_start, latest_reset, existing_roots, existing_used, existing_live = ordered[-1]
+            (
+                first_start, latest_reset, existing_roots, existing_used,
+                existing_accounts, existing_live,
+            ) = ordered[-1]
             existing_roots.update(period_roots)
             existing_used.extend(used_values)
+            existing_accounts.update(period_accounts)
             ordered[-1] = (
                 first_start, max(latest_reset, resets_at), existing_roots, existing_used,
-                existing_live or is_live,
+                existing_accounts, existing_live or is_live,
             )
         else:
             ordered.append((
-                start_at, resets_at, set(period_roots), list(used_values), is_live,
+                start_at, resets_at, set(period_roots), list(used_values),
+                set(period_accounts), is_live,
             ))
     periods: list[CodexWeeklyPeriod] = []
-    for index, (start_at, resets_at, period_roots, used_values, is_live) in enumerate(ordered):
+    for index, (
+        start_at, resets_at, period_roots, used_values, period_accounts, is_live,
+    ) in enumerate(ordered):
         next_start = ordered[index + 1][0] if index + 1 < len(ordered) else None
         # The live cycle always ends at its own reset (#373 §7.4).
         if is_live:
@@ -617,6 +638,7 @@ def _codex_weekly_periods(
             end_at=end_at,
             source_root_keys=tuple(sorted(period_roots)),
             used_percent=max(used_values) if used_values else None,
+            account_keys=tuple(sorted(period_accounts)),
         ))
     return tuple(periods)
 
@@ -929,6 +951,9 @@ def _bucket_wire(bucket: Any) -> dict[str, object]:
         value = getattr(bucket, name, None)
         if value is not None:
             result[name] = value
+    account_keys = getattr(bucket, "account_keys", ())
+    if account_keys:
+        result["account_keys"] = tuple(account_keys)
     return result
 
 
@@ -2474,11 +2499,13 @@ def _build_codex_native_weekly_view(
     display_tz_name: str | None,
     speed: str,
     account_key: str | None = None,
+    include_account_keys: bool = False,
 ) -> CodexWeeklyView:
     """Aggregate Codex cost into observed native quota-cycle segments.
 
     ``account_key`` scopes the durable boundary read to one account (#416
-    Slice 3A review B1); ``None`` is the merged parent read and is byte-stable.
+    Slice 3A review B1); ``None`` is the merged parent read. The additive
+    ownership axis is emitted only when ``include_account_keys`` is true.
     """
     periods = _codex_weekly_periods(
         stats_conn,
@@ -2532,6 +2559,10 @@ def _build_codex_native_weekly_view(
                 and periods_by_bucket[row.bucket].used_percent > 0
                 else None
             ),
+            account_keys=(
+                periods_by_bucket[row.bucket].account_keys
+                if include_account_keys else ()
+            ),
         )
         for row in rows
     )
@@ -2802,14 +2833,11 @@ def _codex_account_scopes_wire(
             context, account_observations, accounting_entries=rows,
             account_key=key,
         )
-        # #416 Slice 3A review B3. The parent sets `quota.cycle_index` and the
-        # client reads `codex.quota.cycle_index`, so a child without the key
-        # forces the client into a fallback — and the tempting one (reuse the
-        # parent's) would render account A's milestone HISTORY on account B's
-        # hero. The index is derivable per account from what the child already
-        # has (its own `CodexCycleBoundary` plus `stats_conn`), so it is built
-        # genuinely rather than declared parent-only. No cycle => `()`, an
-        # honest empty state, never another account's ledger.
+        # Each decorated child owns the only honest cycle index for that
+        # account. Reusing a merged parent index here would render account A's
+        # milestone HISTORY on account B's hero. The index is derivable from
+        # the child's own `CodexCycleBoundary` plus `stats_conn`; no cycle =>
+        # `()`, an honest empty state, never another account's ledger.
         cycle_index: tuple = ()
         if cycle is not None and not hero_failure:
             try:
@@ -3166,6 +3194,15 @@ def build_codex_source_state(
     monthly = build_codex_monthly_view(
         entries, now_utc=context.now_utc, tz_name=context.display_tz_name, speed=context.speed,
     )
+    # R8 gate, resolved once before the parent weekly projection so that only
+    # a decorated merged row gains the additive account axis. Focused children
+    # and <=1-real-account providers remain byte-identical.
+    try:
+        import _cctally_account
+        _codex_decorated = _cctally_account.provider_is_decorated(
+            context.stats_conn, "codex")
+    except Exception:
+        _codex_decorated = False
     weekly = _build_codex_native_weekly_view(
         context.stats_conn,
         visible_accounting_entries,
@@ -3174,6 +3211,7 @@ def build_codex_source_state(
         now_utc=context.now_utc,
         display_tz_name=context.display_tz_name,
         speed=context.speed,
+        include_account_keys=_codex_decorated,
     )
     sessions = (
         build_rooted_codex_session_view(
@@ -3196,12 +3234,6 @@ def build_codex_source_state(
     # `accounts[]` cards, `hero.cycles[]`, and the `account_scopes` children —
     # hangs off this single boolean, so a <=1-real-account install is provably
     # byte-identical by construction rather than by golden observation.
-    try:
-        import _cctally_account
-        _codex_decorated = _cctally_account.provider_is_decorated(
-            context.stats_conn, "codex")
-    except Exception:
-        _codex_decorated = False
     quota_blocks = _quota_wire(
         context.stats_conn,
         accounting_entries=visible_accounting_entries,
@@ -3210,12 +3242,13 @@ def build_codex_source_state(
         display_tz_name=context.display_tz_name,
         decorated=_codex_decorated,
     )
-    # Hero-modal historical-milestone navigation index (spec §1c, §3). Built
-    # here on the non-idle codex source rebuild (idle ticks reuse the stored
-    # bundle) over the durable projection — a pure serializer never touches it.
-    # Guarded: an index failure must never fail the codex source build.
+    # Hero-modal historical-milestone navigation index (spec §1c, §3). A
+    # decorated parent has no single cycle history: its representative
+    # `cycle` belongs to one account, while every child builds its own index
+    # above. Preserve the parent index only for the byte-stable undecorated
+    # shape. Guarded: an index failure must never fail the codex source build.
     cycle_index: tuple = ()
-    if cycle is not None and not hero_failure:
+    if not _codex_decorated and cycle is not None and not hero_failure:
         try:
             cycle_index = tuple(
                 sys.modules["cctally"].build_codex_cycle_index(

package/bin/_cctally_db.py

@@ -5997,7 +5997,7 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
     updates: list[tuple[str, int]] = []
     for row in conn.execute(
         "SELECT id, source_root_key, observed_slot, logical_limit_key, "
-        "       window_minutes, resets_at_utc "
+        "       window_minutes, resets_at_utc, source_path, line_offset "
         "  FROM quota_window_snapshots "
         " WHERE source = 'codex' AND canonical_resets_at_utc IS NULL "
         "   AND source_root_key IS NOT NULL AND observed_slot IS NOT NULL "
@@ -6007,6 +6007,7 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
             source_root_key=row[1], observed_slot=row[2],
             logical_limit_key=row[3], window_minutes=row[4],
             resets_at_utc=row[5],
+            source_path=row[6], line_offset=row[7],
         )
         if anchor is not None:
             updates.append((anchor, int(row[0])))
@@ -6019,6 +6020,71 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
     conn.commit()
 
 
+@cache_migration("033_codex_reset_anchor_component_closure")
+def _033_codex_reset_anchor_component_closure(
+    conn: sqlite3.Connection,
+) -> None:
+    """#425: converge migration-032 chain-of-neighbours splits.
+
+    Migration 032 compared each raw reset only with established anchors. Real
+    production history contains tolerance-connected chains whose endpoints are
+    more than 600 seconds apart, leaving one physical window under multiple
+    anchors. Rebuild the component closure over the complete population while
+    retaining the deterministic first observation as the winning anchor.
+
+    Raw ``resets_at_utc`` evidence is never rewritten. Re-running computes the
+    same full-population mapping and therefore changes no rows.
+    """
+    import _cctally_cache as cache_mod
+    import _lib_quota
+
+    cols = {
+        str(row[1]) for row in conn.execute(
+            "PRAGMA table_info(quota_window_snapshots)")
+    }
+    if "canonical_resets_at_utc" not in cols:
+        return
+
+    groups: dict[tuple, _lib_quota.ResetAnchorComponents] = {}
+    evidence: list[
+        tuple[int, dt.datetime, _lib_quota.ResetAnchorComponents, str | None]
+    ] = []
+    for row in conn.execute(
+        "SELECT id, source_root_key, observed_slot, logical_limit_key, "
+        "       window_minutes, resets_at_utc, canonical_resets_at_utc, "
+        "       source_path, line_offset "
+        "  FROM quota_window_snapshots "
+        " WHERE source = 'codex' "
+        "   AND source_root_key IS NOT NULL AND observed_slot IS NOT NULL "
+        " ORDER BY source_path, line_offset, id"
+    ).fetchall():
+        raw = cache_mod._parse_anchor_iso(row[5])
+        if raw is None:
+            continue
+        group = cache_mod.CodexResetAnchorResolver.group_key(
+            row[1], row[2], row[3], row[4])
+        components = groups.setdefault(
+            group, _lib_quota.ResetAnchorComponents())
+        components.add(
+            raw,
+            order_key=(str(row[7]), int(row[8]), int(row[0])),
+        )
+        evidence.append((int(row[0]), raw, components, row[6]))
+
+    updates: list[tuple[str, int]] = []
+    for row_id, raw, components, stored in evidence:
+        canonical = cache_mod._codex_anchor_iso(components.canonical(raw))
+        if canonical != stored:
+            updates.append((canonical, row_id))
+    if updates:
+        conn.executemany(
+            "UPDATE quota_window_snapshots SET canonical_resets_at_utc = ? "
+            "WHERE id = ?",
+            updates,
+        )
+    conn.commit()
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")