cctally 1.85.1 → 1.87.0

package/bin/_cctally_dashboard_sources.py

@@ -162,6 +162,7 @@ class CodexWeeklyPeriod:
     end_at: dt.datetime
     source_root_keys: tuple[str, ...]
     used_percent: float | None = None
+    account_keys: tuple[str, ...] = ()
 
 
 def _codex_history_row_is_model_scoped(row: object) -> bool:
@@ -506,8 +507,9 @@ def _codex_weekly_periods(
     ``max(...)`` hands the focused account the OTHER account's percentage —
     the never-combine violation D6 forbids — while ``end_at = min(resets_at,
     next_start)`` clips one account's week at the other's start. ``None`` keeps
-    the merged "All accounts" read, which is byte-stable and is what the parent
-    still uses.
+    the merged "All accounts" read used by the parent. Every merged boundary
+    retains the account-key set that contributed its percentage; the parent
+    publishes that set only under the existing multi-account decoration gate.
 
     The predicate is strict equality, deliberately NOT the one-directional
     ``(account, unattributed)`` widening ``_codex_five_hour_rows`` uses: that
@@ -528,8 +530,8 @@ def _codex_weekly_periods(
     account_params: tuple = () if account_key is None else (account_key,)
     try:
         rows = stats_conn.execute(
-            "SELECT source_root_key, logical_limit_key, limit_name, resets_at_utc, "
-            "nominal_start_at_utc, current_percent "
+            "SELECT source_root_key, account_key, logical_limit_key, limit_name, "
+            "resets_at_utc, nominal_start_at_utc, current_percent "
             "FROM quota_window_blocks "
             "WHERE source='codex' AND window_minutes=10080 "
             f"AND source_root_key IN ({placeholders}) AND orphaned_at IS NULL "
@@ -547,10 +549,10 @@ def _codex_weekly_periods(
     # live boundary together with its own durable row, so the flag is OR-ed on
     # merge rather than taken from either side.
     raw_boundaries: list[
-        tuple[dt.datetime, dt.datetime, set[str], list[float], bool]
+        tuple[dt.datetime, dt.datetime, set[str], list[float], set[str], bool]
     ] = []
 
-    for (root_key, logical_limit_key, limit_name, resets_at_raw,
+    for (root_key, row_account_key, logical_limit_key, limit_name, resets_at_raw,
          start_at_raw, current_percent) in rows:
         if is_model_scoped_codex_quota(logical_limit_key, limit_name):
             continue
@@ -568,7 +570,14 @@ def _codex_weekly_periods(
         used_values = []
         if isinstance(current_percent, (int, float)) and not isinstance(current_percent, bool):
             used_values.append(float(current_percent))
-        raw_boundaries.append((start_at, resets_at, {str(root_key)}, used_values, False))
+        raw_boundaries.append((
+            start_at,
+            resets_at,
+            {str(root_key)},
+            used_values,
+            {str(row_account_key or _lib_accounts.UNATTRIBUTED)},
+            False,
+        ))
 
     # `active_cycle is None` is the case §7.4 calls out explicitly: no boundary
     # is live, so nothing is exempt and every period clips exactly as before.
@@ -578,13 +587,18 @@ def _codex_weekly_periods(
             active_cycle.resets_at.astimezone(UTC),
             set(active_cycle.source_root_keys),
             [active_cycle.used_percent] if active_cycle.used_percent is not None else [],
+            {
+                active_cycle.quota_identity.account_key
+                if active_cycle.quota_identity is not None
+                else _lib_accounts.UNATTRIBUTED
+            },
             True,
         ))
 
     ordered: list[
-        tuple[dt.datetime, dt.datetime, set[str], list[float], bool]
+        tuple[dt.datetime, dt.datetime, set[str], list[float], set[str], bool]
     ] = []
-    for start_at, resets_at, period_roots, used_values, is_live in sorted(
+    for start_at, resets_at, period_roots, used_values, period_accounts, is_live in sorted(
         raw_boundaries, key=lambda item: (item[0], item[1]),
     ):
         if (
@@ -592,19 +606,26 @@ def _codex_weekly_periods(
             and (start_at - ordered[-1][0]).total_seconds()
             < _FIVE_HOUR_JITTER_FLOOR_SECONDS
         ):
-            first_start, latest_reset, existing_roots, existing_used, existing_live = ordered[-1]
+            (
+                first_start, latest_reset, existing_roots, existing_used,
+                existing_accounts, existing_live,
+            ) = ordered[-1]
             existing_roots.update(period_roots)
             existing_used.extend(used_values)
+            existing_accounts.update(period_accounts)
             ordered[-1] = (
                 first_start, max(latest_reset, resets_at), existing_roots, existing_used,
-                existing_live or is_live,
+                existing_accounts, existing_live or is_live,
             )
         else:
             ordered.append((
-                start_at, resets_at, set(period_roots), list(used_values), is_live,
+                start_at, resets_at, set(period_roots), list(used_values),
+                set(period_accounts), is_live,
             ))
     periods: list[CodexWeeklyPeriod] = []
-    for index, (start_at, resets_at, period_roots, used_values, is_live) in enumerate(ordered):
+    for index, (
+        start_at, resets_at, period_roots, used_values, period_accounts, is_live,
+    ) in enumerate(ordered):
         next_start = ordered[index + 1][0] if index + 1 < len(ordered) else None
         # The live cycle always ends at its own reset (#373 §7.4).
         if is_live:
@@ -617,6 +638,7 @@ def _codex_weekly_periods(
             end_at=end_at,
             source_root_keys=tuple(sorted(period_roots)),
             used_percent=max(used_values) if used_values else None,
+            account_keys=tuple(sorted(period_accounts)),
         ))
     return tuple(periods)
 
@@ -929,6 +951,9 @@ def _bucket_wire(bucket: Any) -> dict[str, object]:
         value = getattr(bucket, name, None)
         if value is not None:
             result[name] = value
+    account_keys = getattr(bucket, "account_keys", ())
+    if account_keys:
+        result["account_keys"] = tuple(account_keys)
     return result
 
 
@@ -2474,11 +2499,13 @@ def _build_codex_native_weekly_view(
     display_tz_name: str | None,
     speed: str,
     account_key: str | None = None,
+    include_account_keys: bool = False,
 ) -> CodexWeeklyView:
     """Aggregate Codex cost into observed native quota-cycle segments.
 
     ``account_key`` scopes the durable boundary read to one account (#416
-    Slice 3A review B1); ``None`` is the merged parent read and is byte-stable.
+    Slice 3A review B1); ``None`` is the merged parent read. The additive
+    ownership axis is emitted only when ``include_account_keys`` is true.
     """
     periods = _codex_weekly_periods(
         stats_conn,
@@ -2532,6 +2559,10 @@ def _build_codex_native_weekly_view(
                 and periods_by_bucket[row.bucket].used_percent > 0
                 else None
             ),
+            account_keys=(
+                periods_by_bucket[row.bucket].account_keys
+                if include_account_keys else ()
+            ),
         )
         for row in rows
     )
@@ -2802,14 +2833,11 @@ def _codex_account_scopes_wire(
             context, account_observations, accounting_entries=rows,
             account_key=key,
         )
-        # #416 Slice 3A review B3. The parent sets `quota.cycle_index` and the
-        # client reads `codex.quota.cycle_index`, so a child without the key
-        # forces the client into a fallback — and the tempting one (reuse the
-        # parent's) would render account A's milestone HISTORY on account B's
-        # hero. The index is derivable per account from what the child already
-        # has (its own `CodexCycleBoundary` plus `stats_conn`), so it is built
-        # genuinely rather than declared parent-only. No cycle => `()`, an
-        # honest empty state, never another account's ledger.
+        # Each decorated child owns the only honest cycle index for that
+        # account. Reusing a merged parent index here would render account A's
+        # milestone HISTORY on account B's hero. The index is derivable from
+        # the child's own `CodexCycleBoundary` plus `stats_conn`; no cycle =>
+        # `()`, an honest empty state, never another account's ledger.
         cycle_index: tuple = ()
         if cycle is not None and not hero_failure:
             try:
@@ -3166,6 +3194,15 @@ def build_codex_source_state(
     monthly = build_codex_monthly_view(
         entries, now_utc=context.now_utc, tz_name=context.display_tz_name, speed=context.speed,
     )
+    # R8 gate, resolved once before the parent weekly projection so that only
+    # a decorated merged row gains the additive account axis. Focused children
+    # and <=1-real-account providers remain byte-identical.
+    try:
+        import _cctally_account
+        _codex_decorated = _cctally_account.provider_is_decorated(
+            context.stats_conn, "codex")
+    except Exception:
+        _codex_decorated = False
     weekly = _build_codex_native_weekly_view(
         context.stats_conn,
         visible_accounting_entries,
@@ -3174,6 +3211,7 @@ def build_codex_source_state(
         now_utc=context.now_utc,
         display_tz_name=context.display_tz_name,
         speed=context.speed,
+        include_account_keys=_codex_decorated,
     )
     sessions = (
         build_rooted_codex_session_view(
@@ -3196,12 +3234,6 @@ def build_codex_source_state(
     # `accounts[]` cards, `hero.cycles[]`, and the `account_scopes` children —
     # hangs off this single boolean, so a <=1-real-account install is provably
     # byte-identical by construction rather than by golden observation.
-    try:
-        import _cctally_account
-        _codex_decorated = _cctally_account.provider_is_decorated(
-            context.stats_conn, "codex")
-    except Exception:
-        _codex_decorated = False
     quota_blocks = _quota_wire(
         context.stats_conn,
         accounting_entries=visible_accounting_entries,
@@ -3210,12 +3242,13 @@ def build_codex_source_state(
         display_tz_name=context.display_tz_name,
         decorated=_codex_decorated,
     )
-    # Hero-modal historical-milestone navigation index (spec §1c, §3). Built
-    # here on the non-idle codex source rebuild (idle ticks reuse the stored
-    # bundle) over the durable projection — a pure serializer never touches it.
-    # Guarded: an index failure must never fail the codex source build.
+    # Hero-modal historical-milestone navigation index (spec §1c, §3). A
+    # decorated parent has no single cycle history: its representative
+    # `cycle` belongs to one account, while every child builds its own index
+    # above. Preserve the parent index only for the byte-stable undecorated
+    # shape. Guarded: an index failure must never fail the codex source build.
     cycle_index: tuple = ()
-    if cycle is not None and not hero_failure:
+    if not _codex_decorated and cycle is not None and not hero_failure:
         try:
             cycle_index = tuple(
                 sys.modules["cctally"].build_codex_cycle_index(

package/bin/_cctally_db.py

@@ -5997,7 +5997,7 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
     updates: list[tuple[str, int]] = []
     for row in conn.execute(
         "SELECT id, source_root_key, observed_slot, logical_limit_key, "
-        "       window_minutes, resets_at_utc "
+        "       window_minutes, resets_at_utc, source_path, line_offset "
         "  FROM quota_window_snapshots "
         " WHERE source = 'codex' AND canonical_resets_at_utc IS NULL "
         "   AND source_root_key IS NOT NULL AND observed_slot IS NOT NULL "
@@ -6007,6 +6007,7 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
             source_root_key=row[1], observed_slot=row[2],
             logical_limit_key=row[3], window_minutes=row[4],
             resets_at_utc=row[5],
+            source_path=row[6], line_offset=row[7],
         )
         if anchor is not None:
             updates.append((anchor, int(row[0])))
@@ -6019,6 +6020,121 @@ def _032_codex_canonical_reset_anchor(conn: sqlite3.Connection) -> None:
     conn.commit()
 
 
+@cache_migration("033_codex_reset_anchor_component_closure")
+def _033_codex_reset_anchor_component_closure(
+    conn: sqlite3.Connection,
+) -> None:
+    """#425: converge migration-032 chain-of-neighbours splits.
+
+    Migration 032 compared each raw reset only with established anchors. Real
+    production history contains tolerance-connected chains whose endpoints are
+    more than 600 seconds apart, leaving one physical window under multiple
+    anchors. Rebuild the component closure over the complete population while
+    retaining the deterministic first observation as the winning anchor.
+
+    Raw ``resets_at_utc`` evidence is never rewritten. Re-running computes the
+    same full-population mapping and therefore changes no rows.
+    """
+    import _cctally_cache as cache_mod
+    import _lib_quota
+
+    cols = {
+        str(row[1]) for row in conn.execute(
+            "PRAGMA table_info(quota_window_snapshots)")
+    }
+    if "canonical_resets_at_utc" not in cols:
+        return
+
+    groups: dict[tuple, _lib_quota.ResetAnchorComponents] = {}
+    evidence: list[
+        tuple[int, dt.datetime, _lib_quota.ResetAnchorComponents, str | None]
+    ] = []
+    for row in conn.execute(
+        "SELECT id, source_root_key, observed_slot, logical_limit_key, "
+        "       window_minutes, resets_at_utc, canonical_resets_at_utc, "
+        "       source_path, line_offset "
+        "  FROM quota_window_snapshots "
+        " WHERE source = 'codex' "
+        "   AND source_root_key IS NOT NULL AND observed_slot IS NOT NULL "
+        " ORDER BY source_path, line_offset, id"
+    ).fetchall():
+        raw = cache_mod._parse_anchor_iso(row[5])
+        if raw is None:
+            continue
+        group = cache_mod.CodexResetAnchorResolver.group_key(
+            row[1], row[2], row[3], row[4])
+        components = groups.setdefault(
+            group, _lib_quota.ResetAnchorComponents())
+        components.add(
+            raw,
+            order_key=(str(row[7]), int(row[8]), int(row[0])),
+        )
+        evidence.append((int(row[0]), raw, components, row[6]))
+
+    updates: list[tuple[str, int]] = []
+    for row_id, raw, components, stored in evidence:
+        canonical = cache_mod._codex_anchor_iso(components.canonical(raw))
+        if canonical != stored:
+            updates.append((canonical, row_id))
+    if updates:
+        conn.executemany(
+            "UPDATE quota_window_snapshots SET canonical_resets_at_utc = ? "
+            "WHERE id = ?",
+            updates,
+        )
+    conn.commit()
+
+
+@cache_migration("034_codex_window_spend_adoption")
+def _034_codex_window_spend_adoption(conn: sqlite3.Connection) -> None:
+    """One-time window-scoped spend adoption over existing Codex history.
+
+    Spec:
+    ``docs/superpowers/specs/2026-07-30-codex-window-scoped-spend-adoption.md``.
+
+    Ingest stamps every window forward from here, but rollout bytes that were
+    already walked keep whatever per-file attribution decided for them — and for
+    history predating the durable attribution map that is nothing at all (#416
+    spec D1). A cycle's milestone ladder then renders ``$0.00`` for a crossing
+    whose spend is real, because the crossing came from the folded observation
+    axis and the dollars from the per-file axis. This handler runs the SAME pass
+    ingest now runs, unbounded, so existing history converges in one pass.
+
+    The whole decision lives in ``_lib_codex_account_adoption`` and the read/write
+    in ``_cctally_cache.apply_codex_window_spend_adoption``; re-implementing the
+    rule here would let the migration and ingest drift.
+
+    Idempotent by construction: only rows whose ``account_key`` is ``NULL`` or
+    empty are candidates, so a re-run over its own output writes nothing. NO
+    self-stamp — the dispatcher central-stamps on a clean return (#140).
+
+    Takes the Codex provider flock like handlers 024-027: this writes a
+    Codex-derived table, so a mid-walk ``sync_codex_cache`` must not interleave.
+    On contention it DEFERS (``MigrationGateNotMet``) before touching any data —
+    the safe side, and free here because that same sync runs the identical pass
+    at its own end anyway.
+
+    ``BEGIN IMMEDIATE`` before the read, like handler 024: the pass reads the
+    folded window evidence and then writes back a plan derived from it, so it
+    must hold the write lock for the whole read-then-write rather than upgrade
+    part way through it.
+    """
+    import _cctally_cache as cache_mod
+
+    held = _acquire_cache_db_codex_provider_flock(
+        conn, migration="034 window spend adoption")
+    try:
+        conn.execute("BEGIN IMMEDIATE")
+        try:
+            cache_mod.apply_codex_window_spend_adoption(conn)
+            conn.commit()
+        except Exception:
+            conn.rollback()
+            raise
+    finally:
+        _release_cache_db_writer_flocks(held)
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")

package/bin/_cctally_doctor.py

@@ -995,6 +995,7 @@ def _doctor_gather_state_impl(
     codex_last_entry_at = None
     codex_project_metadata_health = None
     codex_project_metadata_error = None
+    codex_null_reset_anchors = 0
     try:
         if _cache_probe_allowed and _cctally_core.CACHE_DB_PATH.exists():
             conn = sqlite3.connect(str(_cctally_core.CACHE_DB_PATH))
@@ -1008,6 +1009,18 @@ def _doctor_gather_state_impl(
                         codex_last_entry_at = parse_iso_datetime(
                             row[1], "codex_session_entries.timestamp_utc",
                         ).astimezone(dt.timezone.utc)
+                try:
+                    row = conn.execute(
+                        "SELECT COUNT(*) FROM quota_window_snapshots "
+                        "WHERE source = 'codex' "
+                        "AND canonical_resets_at_utc IS NULL"
+                    ).fetchone()
+                    if row and row[0] is not None:
+                        codex_null_reset_anchors = int(row[0])
+                except sqlite3.OperationalError:
+                    # Pre-anchor cache shapes have no column to inspect. Their
+                    # pending migration is reported by the DB checks instead.
+                    pass
                 # Keep the health probe on the existing read-only cache
                 # connection.  A failed probe is health evidence, not an
                 # empty corpus: the kernel renders it as a distinct FAIL.
@@ -1645,6 +1658,8 @@ def _doctor_gather_state_impl(
     cctally_version = (
         cctally_version_tuple[0] if cctally_version_tuple else "unknown"
     )
+    accounts_state = _gather_accounts_state(now_utc)
+    accounts_state["codex_null_reset_anchors"] = codex_null_reset_anchors
 
     return _lib_doctor.DoctorState(
         symlink_state=symlink_state,
@@ -1742,7 +1757,7 @@ def _doctor_gather_state_impl(
         journal_heal_incidents=journal_heal_incidents,
         journal_writer_guard=journal_writer_guard,
         # Multi-account attribution legs (#341).
-        accounts_state=_gather_accounts_state(now_utc),
+        accounts_state=accounts_state,
         cache_repair_marker=cache_repair_marker,
         backup_sync_state=backup_sync_state,
     )

package/bin/_cctally_journal.py

@@ -1489,6 +1489,8 @@ def _resolve_obs_anchor(resolver, rec: dict) -> "str | None":
             source_root_key=root, observed_slot=slot, logical_limit_key=key,
             window_minutes=p.get("window_minutes"),
             resets_at_utc=p.get("resets_at_utc"),
+            source_path=p.get("source_path"),
+            line_offset=p.get("line_offset"),
         )
     except Exception:  # pragma: no cover — never fail an ingest over a label
         return None
@@ -1523,6 +1525,9 @@ def _apply_quota_records(cache, records) -> None:
     for rec in records:
         covered, decided = oracle.resolve(rec)
         anchor = _resolve_obs_anchor(anchors, rec)
+        if anchors is not None:
+            anchors.apply_pending_merges()
+            anchors.mark_file_committed()
         row_values = _quota_snapshot_values(rec, anchor)
         if not has_anchor:
             row_values = row_values[:-1]

package/bin/_cctally_quota.py

@@ -240,6 +240,7 @@ def load_codex_quota_observations(
     active_at: dt.datetime | None = None,
     max_rows: int | None = None,
     physical_signatures: dict[str, str] | None = None,
+    canonical_resets_between: "tuple[dt.datetime, dt.datetime] | None" = None,
 ) -> tuple[QuotaObservation, ...]:
     """Load only valid root-qualified S1 physical quota rows.
 
@@ -258,6 +259,14 @@ def load_codex_quota_observations(
     supplied, exact S2 signatures are accumulated from the same cursor before
     presentation bounds are applied, so coherence validation does not require
     a second unbounded observation load.
+
+    ``canonical_resets_between`` is an INCLUSIVE ``(low, high)`` bound on the
+    window's CANONICAL reset, applied in SQL.  Unlike ``captured_at_or_after``
+    it is a window-IDENTITY bound, so it never fractures a window group: every
+    observation of one physical window shares one canonical anchor, and the
+    continuity fold below therefore still sees each retained window whole.  That
+    is what lets the ingest-side spend-adoption pass bound itself to the windows
+    one sync touched instead of materializing all history every hook tick.
     """
     for name, value in (
         ("captured_at_or_after", captured_at_or_after), ("active_at", active_at),
@@ -269,6 +278,19 @@ def load_codex_quota_observations(
                 captured_at_or_after = value.astimezone(UTC)
             else:
                 active_at = value.astimezone(UTC)
+    if canonical_resets_between is not None:
+        if len(canonical_resets_between) != 2:
+            raise ValueError(
+                "canonical_resets_between must be a (low, high) pair")
+        bounds = []
+        for value in canonical_resets_between:
+            if value.tzinfo is None or value.utcoffset() is None:
+                raise ValueError(
+                    "canonical_resets_between must be timezone-aware")
+            bounds.append(value.astimezone(UTC))
+        if bounds[0] > bounds[1]:
+            raise ValueError("canonical_resets_between must be ordered")
+        canonical_resets_between = (bounds[0], bounds[1])
     if max_rows is not None:
         if not isinstance(max_rows, int) or isinstance(max_rows, bool) or max_rows <= 0:
             raise ValueError("max_rows must be a positive integer or None")
@@ -352,6 +374,23 @@ def load_codex_quota_observations(
                 return ()
             sql += " AND source_root_key IN (" + ",".join("?" for _ in requested) + ")"
             params.extend(sorted(requested))
+        if canonical_resets_between is not None:
+            # COALESCE, not the bare column: a pre-032 row (or one the backfill
+            # never reached) carries NULL there and the reader falls back to the
+            # raw reset, so the bound has to fall back with it or the row would
+            # silently drop out of its own window.
+            reset_expr = (
+                "COALESCE(canonical_resets_at_utc, resets_at_utc)"
+                if has_anchor else "resets_at_utc"
+            )
+            sql += (
+                f" AND unixepoch({reset_expr}) >= unixepoch(?)"
+                f" AND unixepoch({reset_expr}) <= unixepoch(?)"
+            )
+            params.extend((
+                _utc_iso(canonical_resets_between[0]),
+                _utc_iso(canonical_resets_between[1]),
+            ))
         # When exact signatures are requested this first cursor must cover the
         # complete root history.  Otherwise apply dashboard presentation bounds
         # in SQL so only the capped evidence crosses the SQLite/Python boundary.
@@ -494,6 +533,7 @@ def load_codex_quota_observations(
                     captured_at_or_after=captured_at_or_after,
                     active_at=active_at,
                     max_rows=max_rows,
+                    canonical_resets_between=canonical_resets_between,
                 )
         if max_rows is not None and len(result) > max_rows:
             result = sorted(
@@ -966,7 +1006,9 @@ def _evaluate_quota_alerts(
     return queued
 
 
-def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
+def _reanchor_terminal_events_sql(
+    key_slots: int, minute_slots: int, reset_slots: int,
+) -> str:
     # `UPDATE OR IGNORE`, not a plain UPDATE: if this identity already carries an
     # anchored row at the same threshold, moving the jittered twin onto it would
     # violate the UNIQUE key. OR IGNORE SKIPS that move (it does not delete the
@@ -978,6 +1020,11 @@ def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
     # transaction.
     keys = ",".join(f":key{i}" for i in range(key_slots))
     minutes = ",".join(f":min{i}" for i in range(minute_slots))
+    member_epochs = ",".join(f":reset{i}" for i in range(reset_slots))
+    member_clause = (
+        f" OR unixepoch(resets_at_utc) IN ({member_epochs})"
+        if member_epochs else ""
+    )
     return (
         "UPDATE OR IGNORE quota_threshold_events "
         "   SET resets_at_utc = :anchor, "
@@ -989,7 +1036,9 @@ def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
         f"   AND observed_slot = :slot AND window_minutes IN ({minutes}) "
         "   AND (resets_at_utc <> :anchor OR logical_limit_key <> :limit_key "
         "        OR window_minutes <> :minutes) "
-        "   AND abs(unixepoch(resets_at_utc) - unixepoch(:anchor)) <= :tolerance"
+        "   AND ("
+        "       abs(unixepoch(resets_at_utc) - unixepoch(:anchor)) <= :tolerance"
+        f"{member_clause})"
     )
 
 
@@ -1020,15 +1069,24 @@ def _reanchor_terminal_events(conn: sqlite3.Connection, block) -> None:
     re-materialization (they share this body), and is idempotent: a row already
     on the canonical identity is excluded by the three-way `<>` guard.
 
-    Bounded on both axes by the tolerances that produced the canonical identity —
-    600s on the reset, ±1 minute on the length — so it can only ever collapse
-    rows the canonicalization itself merged. Two genuinely different cycles are
-    five hours or seven days apart, and a `10200` window is a different window,
-    not jitter.
+    The reset match accepts either the original 600-second anchor neighbourhood
+    or an exact raw reset retained by this block. The latter is required by
+    #425's transitive component closure: an endpoint can be farther than 600s
+    from the first-sight anchor while still joining it through retained bridge
+    observations. Exact membership keeps the widened reach evidence-bound; a
+    genuinely different cycle is never inferred from distance alone. The length
+    axis remains bounded by its ±1 minute snap.
     """
     identity = block.identity
     keys = codex_snap_equivalent_limit_keys(identity.logical_limit_key)
     minutes = codex_snap_equivalent_window_minutes(identity.window_minutes)
+    membership_evidence = (
+        block.physical_observations or block.observations
+    )
+    reset_epochs = sorted({
+        int(observation.resets_at.timestamp())
+        for observation in membership_evidence
+    })
     params: dict[str, object] = {
         "anchor": _utc_iso(block.resets_at),
         "source": identity.source,
@@ -1041,8 +1099,13 @@ def _reanchor_terminal_events(conn: sqlite3.Connection, block) -> None:
     }
     params.update({f"key{i}": value for i, value in enumerate(keys)})
     params.update({f"min{i}": value for i, value in enumerate(minutes)})
+    params.update({
+        f"reset{i}": value for i, value in enumerate(reset_epochs)})
     conn.execute(
-        _reanchor_terminal_events_sql(len(keys), len(minutes)), params)
+        _reanchor_terminal_events_sql(
+            len(keys), len(minutes), len(reset_epochs)),
+        params,
+    )
 
 
 def _apply_quota_projection_rows(
@@ -1441,13 +1504,30 @@ def _codex_cache_account_predicate(
       dollars are these" — widening it IS attribution, which D1 forbids, and it
       puts one row in two scopes.
 
-    Three stamping mechanisms exist and must never be conflated: the
+    FOUR stamping mechanisms exist and must never be conflated: the
     quota-observation fold (``adopt_unidentified_observations``, per physical-
     window group, landing post-fold in ``quota_window_blocks`` /
     ``quota_percent_milestones`` and NEVER written back to
     ``quota_window_snapshots``); per-file-range attribution
     (``codex_file_accounts`` -> ``codex_session_entries.account_key``,
-    ``stably_absent`` -> NULL); and the stats ``accounts`` registry.
+    ``stably_absent`` -> NULL); WINDOW-SCOPED SPEND ADOPTION (the 2026-07-30
+    spec — ``_lib_codex_account_adoption`` +
+    ``_cctally_cache.apply_codex_window_spend_adoption``, which stamps that same
+    ``codex_session_entries.account_key`` column at ingest from the window's
+    single identified account); and the stats ``accounts`` registry.
+
+    So ``codex_session_entries.account_key`` now carries window-derived
+    attribution IN ADDITION to per-file decisions, and that is precisely what
+    keeps the cost read strict rather than forcing it to widen. The rule above
+    genuinely pointed both ways for that read: the scope key comes from the
+    observation fold while the rows came from per-file attribution — DIFFERENT
+    mechanisms, which reads as "widen" — yet widening a cost read is attribution
+    D1 forbids and puts one row in two scopes. The resolution is to make the ROW
+    carry the window's answer durably, so scope key and row now agree by
+    construction and the strict flavour is correct rather than merely safe. A
+    row the adoption pass declined to stamp (zero or ambiguous identified
+    accounts, an overlap whose windows disagree) is genuinely nobody's and
+    stays in the ``unattributed`` scope, which is the honest answer.
     """
     if account_key is None:
         return "", ()
@@ -1575,7 +1655,19 @@ def codex_quota_breakdown(
       renders an honest ``$0.00``; the dollars stay visible in the
       ``unattributed`` scope, which owns them.
 
-    The full rule, and the three stamping mechanisms it turns on, are in
+    That honest ``$0.00`` used to fire for spend that was NOT nobody's. The
+    crossing carries the window's account (the observation fold put it there)
+    while the rows behind it carried none, because per-file attribution had no
+    decision covering those bytes. ``codex_session_entries.account_key`` now also
+    carries WINDOW-DERIVED attribution — stamped durably at ingest by
+    ``apply_codex_window_spend_adoption`` under the same window key and the same
+    single-identified-account guard the fold uses — so the ladder and the
+    dollars agree by construction. The read stays strict on top of it precisely
+    BECAUSE the inference is now durable: doing it here instead would re-file one
+    row under two scopes on every read, while doing it once at ingest moves the
+    row out of ``unattributed`` and into exactly one owner.
+
+    The full rule, and the four stamping mechanisms it turns on, are in
     ``_codex_cache_account_predicate``.
     """
     reset = _parse_utc(resets_at, "resets_at") if isinstance(resets_at, str) else resets_at