cctally 1.86.0 → 1.87.1

package/CHANGELOG.md

@@ -5,6 +5,16 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.87.1] - 2026-07-30
+
+### Fixed
+- Codex session names now remain visible in Recent Sessions when an individual account is selected, whenever transcript visibility is enabled. Selecting an account no longer replaces every session name with an em dash; disabling transcript visibility still hides names in both the all-accounts and focused-account views.
+
+## [1.87.0] - 2026-07-30
+
+### Fixed
+- A Codex cycle's per-percent milestone ladder no longer reports `$0.00` for a crossing whose spend is real. cctally already recognised which account a quota window belongs to even when individual samples arrived unlabelled, but the dollars behind those percentages were attributed separately, per rollout file — and for usage recorded before cctally began keeping durable per-file attribution there was no decision to apply, so that spend belonged to nobody. The crossing was confidently the account's while its cost read as zero, the cycle hero under-reported spend by the same amount, and roughly a seventh of one Pro account's weekly Codex spend sat in the `unattributed` bucket instead of on its own card. Codex spend recorded inside an account-level weekly window is now attributed to that window's account whenever the window names exactly one, so the ladder, the cycle hero, the per-account cards, the Codex budget and the CLI all agree. Nothing is guessed: spend that no window can name is left alone, so is spend claimed by two windows naming different accounts, and separate model pools such as GPT-5.3-Codex-Spark are never treated as account quota. Existing history is repaired once on upgrade, and no usage is ever counted twice.
+
 ## [1.86.0] - 2026-07-30
 
 ### Fixed

package/bin/_cctally_cache.py

@@ -192,6 +192,11 @@ _iter_message_rows = _lib_conversation.iter_message_rows
 # so it loads at module-load time alongside _lib_conversation.
 _lib_codex_conversation = _load_lib("_lib_codex_conversation")
 
+# Window-scoped spend adoption's decision kernel (2026-07-30 spec). Pure
+# stdlib leaf, same shape as `_lib_codex_pools`, so it loads here rather than
+# through a bare import that would depend on ``bin/`` being on ``sys.path``.
+_lib_codex_account_adoption = _load_lib("_lib_codex_account_adoption")
+
 # Opt-in backend phase-instrumentation collector (issue #276, Session A). Pure
 # stdlib leaf; near-noop when CCTALLY_PERF_TRACE is unset (phase() returns a
 # shared no-op singleton), so the sync_cache seam wraps below cost nothing on
@@ -4812,6 +4817,22 @@ def _progress_codex_stderr(stats: CodexIngestStats, *, force: bool = False) -> N
     )
 
 
+def _extend_codex_touched_span(
+    spans: "dict[str, tuple[dt.datetime, dt.datetime]]",
+    source_root_key: object,
+    moment: "dt.datetime | None",
+) -> None:
+    """Widen one root's touched instant span in place."""
+    if not source_root_key or moment is None:
+        return
+    key = str(source_root_key)
+    current = spans.get(key)
+    if current is None:
+        spans[key] = (moment, moment)
+    else:
+        spans[key] = (min(current[0], moment), max(current[1], moment))
+
+
 def sync_codex_cache(
     conn: sqlite3.Connection,
     *,
@@ -4836,6 +4857,13 @@ def sync_codex_cache(
     """
     stats = CodexIngestStats()
     project_after_unlock = False
+    # Per-root instant span this sync wrote — accounting-row timestamps AND
+    # canonical window resets. It bounds the end-of-sync spend-adoption pass to
+    # the windows this sync could have changed; an unchanged tree leaves it empty
+    # and the pass does no SQL at all. A rebuild deliberately passes ``None``
+    # instead (full re-derivation restores the unattributed state, so the repair
+    # has to re-run over everything).
+    adoption_spans: "dict[str, tuple[dt.datetime, dt.datetime]]" = {}
     # #313 P1 review (F4/F1): when the CACHE certificate is current we cannot
     # yet decide whether to skip the reconcile — reconcile's own short-circuit
     # ALSO requires the stats-side quota_projection_state signatures to match
@@ -5646,6 +5674,23 @@ def sync_codex_cache(
                 continue
             anchor_resolver.mark_file_committed()
 
+            if not rebuild:
+                # Accounting timestamps share one producer spelling, so the
+                # lexicographic extremes ARE the chronological ones and only two
+                # rows need parsing. Quota anchors are few per file, so they are
+                # parsed individually.
+                if accounting_rows:
+                    for _extreme in (
+                        min(_r[2] for _r in accounting_rows),
+                        max(_r[2] for _r in accounting_rows),
+                    ):
+                        _extend_codex_touched_span(
+                            adoption_spans, discovered.source_root_key,
+                            _parse_anchor_iso(_extreme))
+                for _qrow in quota_rows:
+                    _extend_codex_touched_span(
+                        adoption_spans, _qrow[1], _parse_anchor_iso(_qrow[17]))
+
             # Private test seam (§5.1 post-preflight late-shrink race): fires
             # after each file's successful commit, so a race test can shrink a
             # not-yet-written target and assert the earlier commit stands.
@@ -5698,6 +5743,31 @@ def sync_codex_cache(
                 conn.execute("DELETE FROM cache_meta WHERE key = ?",
                              ("codex_torn_auth_deferred",))
             conn.commit()
+        # Window-scoped spend adoption (spec
+        # docs/superpowers/specs/2026-07-30-codex-window-scoped-spend-adoption.md).
+        # Runs AFTER the walk committed and while both cache writer flocks are
+        # still held, so the observation evidence and the accounting rows it
+        # stamps are the same committed generation. Cache-only — no stats.db read
+        # — so the lock-order law is untouched. A failure here is never fatal:
+        # the stamp is fully re-derivable, so the next sync (or the migration)
+        # repeats it.
+        try:
+            adopted = apply_codex_window_spend_adoption(
+                conn, touched=None if rebuild else adoption_spans)
+            conn.commit()
+            # Terse, and silent on zero: a rebuild re-derives every row and so
+            # legitimately re-stamps the same population each time, which would
+            # otherwise read as a recurring anomaly rather than convergence.
+            if adopted:
+                eprint(f"[cache-sync] attributed {adopted} Codex row(s) "
+                       "from quota windows")
+        except sqlite3.DatabaseError as exc:
+            conn.rollback()
+            if _cctally_db_sib._is_sqlite_corruption_error(exc):
+                # Classified family corruption belongs to the shared recovery
+                # boundary, never to a best-effort local except.
+                raise
+            eprint(f"[cache-sync] could not adopt Codex window spend: {exc}")
         # Codex creates/extends cache.db sidecars independently of Claude's
         # sync path. Harden them while both cache flocks are still held and
         # after all Codex writes, before the optional checkpoint can rotate a
@@ -5794,6 +5864,188 @@ def sync_codex_cache(
     return stats
 
 
+_CODEX_ACCOUNT_WEEK = dt.timedelta(
+    minutes=_lib_codex_account_adoption.ACCOUNT_WEEKLY_WINDOW_MINUTES)
+
+
+def apply_codex_window_spend_adoption(
+    conn: sqlite3.Connection,
+    *,
+    touched: "dict[str, tuple[dt.datetime, dt.datetime]] | None" = None,
+) -> int:
+    """Stamp window-derived attribution onto unattributed Codex spend.
+
+    The I/O half of ``_lib_codex_account_adoption``: read the folded window
+    evidence and the candidate rows, hand both to the pure kernel, write back the
+    plan it returns.  Cache-only by construction — the window's identified
+    accounts come from ``load_codex_quota_observations`` (which already runs
+    ``adopt_unidentified_observations``) and the nominal range is derived from
+    the canonical reset, so no stats.db read is involved and the lock-order law
+    is untouched.  The caller owns the transaction and the commit.
+
+    ``touched`` maps ``source_root_key`` to the ``(low, high)`` instant span this
+    sync wrote — the timestamps of the accounting rows AND the canonical resets
+    of the quota rows.  ``None`` runs the pass over all history (``cache-sync
+    --rebuild`` and the one-time migration); an EMPTY map is a no-op that issues
+    NO SQL AT ALL, which is what keeps a quiescent hook tick free.
+
+    A bounded pass must reach the SAME verdict the unbounded one would, because
+    the stamp is one-way (``NULL`` -> key, never back) and an incremental sync
+    followed by a later rebuild would otherwise disagree.  That needs the loaded
+    window set to be a SUPERSET of the windows that can claim any candidate the
+    scan offers, so the two bounds are derived together: windows are loaded for
+    resets in ``[low - 7d, high + 7d]``, and candidates are clamped to
+    ``[low - 7d, high]``.  Every window claiming an instant ``t`` in that
+    candidate span has its reset in ``(t, t + 7d]``, which the window bound
+    contains — so no window can claim a scanned row unseen.  The candidate span
+    still covers everything this sync could have changed: the rows it wrote lie
+    in ``[low, high]``, and a window whose reset it wrote lies in ``[low, high]``
+    too, so that window's whole nominal range lies in ``[low - 7d, high)``.
+
+    Idempotent and re-runnable: ``codex_session_entries`` is fully re-derived on
+    every rebuild, so the pass must re-stamp afterwards, and re-running over an
+    already-stamped cache writes nothing because an identified row is never a
+    candidate.  Returns the number of rows actually stamped.
+    """
+    roots: "set[str] | None" = None
+    reset_bounds: "tuple[dt.datetime, dt.datetime] | None" = None
+    candidate_bounds: "tuple[dt.datetime, dt.datetime] | None" = None
+    if touched is not None:
+        spans = {
+            str(root): span for root, span in touched.items()
+            if root and span is not None
+        }
+        # Before any SQL: an unchanged tree must cost this pass nothing.
+        if not spans:
+            return 0
+        roots = set(spans)
+        low = min(span[0] for span in spans.values())
+        high = max(span[1] for span in spans.values())
+        reset_bounds = (low - _CODEX_ACCOUNT_WEEK, high + _CODEX_ACCOUNT_WEEK)
+        candidate_bounds = (low - _CODEX_ACCOUNT_WEEK, high)
+
+    from _cctally_quota import load_codex_quota_observations
+
+    # `_load_lib`, not a bare import: this module is loadable in isolation, where
+    # `bin/` may not be on `sys.path` (see the module docstring).
+    _lib_accounts = _load_lib("_lib_accounts")
+    is_model_scoped_codex_quota = _load_lib(
+        "_lib_codex_pools").is_model_scoped_codex_quota
+    adopt = _lib_codex_account_adoption
+    try:
+        columns = {
+            str(row[1]) for row in conn.execute(
+                "PRAGMA table_info(codex_session_entries)")
+        }
+    except sqlite3.DatabaseError:
+        return 0
+    if not {"account_key", "source_root_key", "timestamp_utc"} <= columns:
+        return 0
+
+    try:
+        observations = load_codex_quota_observations(
+            source_root_keys=roots, cache_conn=conn,
+            canonical_resets_between=reset_bounds,
+        )
+    except sqlite3.DatabaseError:
+        return 0
+
+    # Group on the SAME key the observation fold groups on
+    # (`_lib_quota._physical_window_key`) — the account is deliberately excluded
+    # from it, which is precisely what makes a window able to name an account for
+    # rows that carry none.
+    buckets: "dict[tuple, dict]" = {}
+    for observation in observations:
+        identity = observation.identity
+        bucket = buckets.get(key := _lib_quota._physical_window_key(observation))
+        if bucket is None:
+            bucket = buckets[key] = {
+                "root": identity.source_root_key,
+                "minutes": identity.window_minutes,
+                "reset": observation.canonical_resets_at,
+                "accounts": set(),
+                "model_scoped": False,
+            }
+        if identity.account_key != _lib_accounts.UNATTRIBUTED:
+            bucket["accounts"].add(identity.account_key)
+        # `limit_name` is compare=False on the identity, so the label can differ
+        # across one group's observations; ANY Spark evidence demotes the whole
+        # window out of account weekly quota (#373). That direction only ever
+        # withholds a stamp, never invents one.
+        if is_model_scoped_codex_quota(
+                identity.logical_limit_key, identity.limit_name):
+            bucket["model_scoped"] = True
+
+    windows: "list[object]" = []
+    root_ranges: "dict[str, list[tuple[dt.datetime, dt.datetime]]]" = {}
+    for bucket in buckets.values():
+        window = adopt.SpendAdoptionWindow(
+            source_root_key=bucket["root"],
+            window_minutes=bucket["minutes"],
+            canonical_resets_at=bucket["reset"],
+            identified_accounts=frozenset(bucket["accounts"]),
+            model_scoped=bucket["model_scoped"],
+        )
+        if not window.in_scope:
+            continue
+        windows.append(window)
+        root_ranges.setdefault(window.source_root_key, []).append(
+            (window.nominal_start_at, window.canonical_resets_at))
+    if not windows:
+        return 0
+
+    # SQL bounds the scan to a coarse per-root union of the candidate windows,
+    # clamped to the span the loaded window set provably covers (see the
+    # docstring); exact half-open containment stays in the kernel. `unixepoch`
+    # deliberately accepts both retained spellings (`Z` and `+00:00`) — the
+    # accounting rows are written with the offset form, the quota rows with `Z`.
+    # Both comparisons are INCLUSIVE on the truncated second: `unixepoch` drops
+    # any sub-second fraction, so an exclusive upper bound would discard rows in
+    # the reset's final second if a canonical anchor ever carried one. Admitting
+    # that second here is free — the kernel re-tests containment exactly.
+    candidates = []
+    for root, spans_for_root in root_ranges.items():
+        window_low = min(span[0] for span in spans_for_root)
+        window_high = max(span[1] for span in spans_for_root)
+        if candidate_bounds is not None:
+            window_low = max(window_low, candidate_bounds[0])
+            window_high = min(window_high, candidate_bounds[1])
+            if window_low > window_high:
+                continue
+        for row in conn.execute(
+            "SELECT id, timestamp_utc FROM codex_session_entries "
+            " WHERE source_root_key = ? "
+            "   AND (account_key IS NULL OR account_key = '' "
+            "        OR account_key = ?) "
+            "   AND unixepoch(timestamp_utc) >= unixepoch(?) "
+            "   AND unixepoch(timestamp_utc) <= unixepoch(?)",
+            (root, _lib_accounts.UNATTRIBUTED,
+             _codex_anchor_iso(window_low), _codex_anchor_iso(window_high)),
+        ):
+            timestamp = _parse_anchor_iso(row[1])
+            if timestamp is None:
+                continue
+            candidates.append(adopt.SpendAdoptionCandidate(
+                entry_id=int(row[0]), source_root_key=root,
+                timestamp=timestamp, account_key=None,
+            ))
+    if not candidates:
+        return 0
+
+    plan = adopt.build_spend_adoption_plan(windows, candidates)
+    if not plan:
+        return 0
+    before = conn.total_changes
+    conn.executemany(
+        "UPDATE codex_session_entries SET account_key = ? "
+        " WHERE id = ? AND (account_key IS NULL OR account_key = '' "
+        "                   OR account_key = ?)",
+        [(stamp.account_key, stamp.entry_id, _lib_accounts.UNATTRIBUTED)
+         for stamp in plan],
+    )
+    return conn.total_changes - before
+
+
 def iter_codex_entries(
     conn: sqlite3.Connection,
     range_start: dt.datetime,

package/bin/_cctally_dashboard_envelope.py

@@ -1787,11 +1787,39 @@ def _overlay_claude_source_session_titles(
 
 
 def _codex_source_session_rows(envelope: dict) -> list:
-    """Return direct-Codex and All-tab Codex session row lists."""
+    """Return every request-local Codex session row list.
+
+    Besides the merged parent used by ``All accounts``, decorated Codex data
+    carries one ``account_scopes[*].sessions`` child per account. The client
+    swaps that child into view when an account chip is focused, so the private
+    label overlay must cover it under the same per-request transcript gate.
+    """
     sources = envelope.get("sources")
     if not isinstance(sources, Mapping):
         return []
     out = []
+
+    def append_rows(data) -> None:
+        if not isinstance(data, Mapping):
+            return
+        sessions = data.get("sessions")
+        if isinstance(sessions, Mapping):
+            rows = sessions.get("rows")
+            if isinstance(rows, list):
+                out.append(rows)
+        account_scopes = data.get("account_scopes")
+        if not isinstance(account_scopes, Mapping):
+            return
+        for child in account_scopes.values():
+            if not isinstance(child, Mapping):
+                continue
+            sessions = child.get("sessions")
+            if not isinstance(sessions, Mapping):
+                continue
+            rows = sessions.get("rows")
+            if isinstance(rows, list):
+                out.append(rows)
+
     candidates = [(sources.get("codex") or {}).get("data")]
     all_data = (sources.get("all") or {}).get("data")
     if isinstance(all_data, Mapping):
@@ -1799,14 +1827,7 @@ def _codex_source_session_rows(envelope: dict) -> list:
         if isinstance(providers, Mapping):
             candidates.append(providers.get("codex"))
     for data in candidates:
-        if not isinstance(data, Mapping):
-            continue
-        sessions = data.get("sessions")
-        if not isinstance(sessions, Mapping):
-            continue
-        rows = sessions.get("rows")
-        if isinstance(rows, list):
-            out.append(rows)
+        append_rows(data)
     return out
 
 
@@ -1818,8 +1839,9 @@ def _overlay_codex_source_session_labels(
     ``state_5.sqlite.threads.title`` is derived from transcript prompt content.
     The frozen source state therefore retains it only in a server-private key
     map, outside the published ``data`` tree. Closed requests return before
-    consulting that map; open requests match labels to direct and All rows by
-    their opaque resource keys. A missed call fails closed.
+    consulting that map; open requests match labels to merged-parent,
+    account-scoped, and All rows by their opaque resource keys. A missed call
+    fails closed.
     """
     if not transcripts_visible:
         return

package/bin/_cctally_db.py

@@ -6085,6 +6085,56 @@ def _033_codex_reset_anchor_component_closure(
     conn.commit()
 
 
+@cache_migration("034_codex_window_spend_adoption")
+def _034_codex_window_spend_adoption(conn: sqlite3.Connection) -> None:
+    """One-time window-scoped spend adoption over existing Codex history.
+
+    Spec:
+    ``docs/superpowers/specs/2026-07-30-codex-window-scoped-spend-adoption.md``.
+
+    Ingest stamps every window forward from here, but rollout bytes that were
+    already walked keep whatever per-file attribution decided for them — and for
+    history predating the durable attribution map that is nothing at all (#416
+    spec D1). A cycle's milestone ladder then renders ``$0.00`` for a crossing
+    whose spend is real, because the crossing came from the folded observation
+    axis and the dollars from the per-file axis. This handler runs the SAME pass
+    ingest now runs, unbounded, so existing history converges in one pass.
+
+    The whole decision lives in ``_lib_codex_account_adoption`` and the read/write
+    in ``_cctally_cache.apply_codex_window_spend_adoption``; re-implementing the
+    rule here would let the migration and ingest drift.
+
+    Idempotent by construction: only rows whose ``account_key`` is ``NULL`` or
+    empty are candidates, so a re-run over its own output writes nothing. NO
+    self-stamp — the dispatcher central-stamps on a clean return (#140).
+
+    Takes the Codex provider flock like handlers 024-027: this writes a
+    Codex-derived table, so a mid-walk ``sync_codex_cache`` must not interleave.
+    On contention it DEFERS (``MigrationGateNotMet``) before touching any data —
+    the safe side, and free here because that same sync runs the identical pass
+    at its own end anyway.
+
+    ``BEGIN IMMEDIATE`` before the read, like handler 024: the pass reads the
+    folded window evidence and then writes back a plan derived from it, so it
+    must hold the write lock for the whole read-then-write rather than upgrade
+    part way through it.
+    """
+    import _cctally_cache as cache_mod
+
+    held = _acquire_cache_db_codex_provider_flock(
+        conn, migration="034 window spend adoption")
+    try:
+        conn.execute("BEGIN IMMEDIATE")
+        try:
+            cache_mod.apply_codex_window_spend_adoption(conn)
+            conn.commit()
+        except Exception:
+            conn.rollback()
+            raise
+    finally:
+        _release_cache_db_writer_flocks(held)
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")

package/bin/_cctally_quota.py

@@ -240,6 +240,7 @@ def load_codex_quota_observations(
     active_at: dt.datetime | None = None,
     max_rows: int | None = None,
     physical_signatures: dict[str, str] | None = None,
+    canonical_resets_between: "tuple[dt.datetime, dt.datetime] | None" = None,
 ) -> tuple[QuotaObservation, ...]:
     """Load only valid root-qualified S1 physical quota rows.
 
@@ -258,6 +259,14 @@ def load_codex_quota_observations(
     supplied, exact S2 signatures are accumulated from the same cursor before
     presentation bounds are applied, so coherence validation does not require
     a second unbounded observation load.
+
+    ``canonical_resets_between`` is an INCLUSIVE ``(low, high)`` bound on the
+    window's CANONICAL reset, applied in SQL.  Unlike ``captured_at_or_after``
+    it is a window-IDENTITY bound, so it never fractures a window group: every
+    observation of one physical window shares one canonical anchor, and the
+    continuity fold below therefore still sees each retained window whole.  That
+    is what lets the ingest-side spend-adoption pass bound itself to the windows
+    one sync touched instead of materializing all history every hook tick.
     """
     for name, value in (
         ("captured_at_or_after", captured_at_or_after), ("active_at", active_at),
@@ -269,6 +278,19 @@ def load_codex_quota_observations(
                 captured_at_or_after = value.astimezone(UTC)
             else:
                 active_at = value.astimezone(UTC)
+    if canonical_resets_between is not None:
+        if len(canonical_resets_between) != 2:
+            raise ValueError(
+                "canonical_resets_between must be a (low, high) pair")
+        bounds = []
+        for value in canonical_resets_between:
+            if value.tzinfo is None or value.utcoffset() is None:
+                raise ValueError(
+                    "canonical_resets_between must be timezone-aware")
+            bounds.append(value.astimezone(UTC))
+        if bounds[0] > bounds[1]:
+            raise ValueError("canonical_resets_between must be ordered")
+        canonical_resets_between = (bounds[0], bounds[1])
     if max_rows is not None:
         if not isinstance(max_rows, int) or isinstance(max_rows, bool) or max_rows <= 0:
             raise ValueError("max_rows must be a positive integer or None")
@@ -352,6 +374,23 @@ def load_codex_quota_observations(
                 return ()
             sql += " AND source_root_key IN (" + ",".join("?" for _ in requested) + ")"
             params.extend(sorted(requested))
+        if canonical_resets_between is not None:
+            # COALESCE, not the bare column: a pre-032 row (or one the backfill
+            # never reached) carries NULL there and the reader falls back to the
+            # raw reset, so the bound has to fall back with it or the row would
+            # silently drop out of its own window.
+            reset_expr = (
+                "COALESCE(canonical_resets_at_utc, resets_at_utc)"
+                if has_anchor else "resets_at_utc"
+            )
+            sql += (
+                f" AND unixepoch({reset_expr}) >= unixepoch(?)"
+                f" AND unixepoch({reset_expr}) <= unixepoch(?)"
+            )
+            params.extend((
+                _utc_iso(canonical_resets_between[0]),
+                _utc_iso(canonical_resets_between[1]),
+            ))
         # When exact signatures are requested this first cursor must cover the
         # complete root history.  Otherwise apply dashboard presentation bounds
         # in SQL so only the capped evidence crosses the SQLite/Python boundary.
@@ -494,6 +533,7 @@ def load_codex_quota_observations(
                     captured_at_or_after=captured_at_or_after,
                     active_at=active_at,
                     max_rows=max_rows,
+                    canonical_resets_between=canonical_resets_between,
                 )
         if max_rows is not None and len(result) > max_rows:
             result = sorted(
@@ -1464,13 +1504,30 @@ def _codex_cache_account_predicate(
       dollars are these" — widening it IS attribution, which D1 forbids, and it
       puts one row in two scopes.
 
-    Three stamping mechanisms exist and must never be conflated: the
+    FOUR stamping mechanisms exist and must never be conflated: the
     quota-observation fold (``adopt_unidentified_observations``, per physical-
     window group, landing post-fold in ``quota_window_blocks`` /
     ``quota_percent_milestones`` and NEVER written back to
     ``quota_window_snapshots``); per-file-range attribution
     (``codex_file_accounts`` -> ``codex_session_entries.account_key``,
-    ``stably_absent`` -> NULL); and the stats ``accounts`` registry.
+    ``stably_absent`` -> NULL); WINDOW-SCOPED SPEND ADOPTION (the 2026-07-30
+    spec — ``_lib_codex_account_adoption`` +
+    ``_cctally_cache.apply_codex_window_spend_adoption``, which stamps that same
+    ``codex_session_entries.account_key`` column at ingest from the window's
+    single identified account); and the stats ``accounts`` registry.
+
+    So ``codex_session_entries.account_key`` now carries window-derived
+    attribution IN ADDITION to per-file decisions, and that is precisely what
+    keeps the cost read strict rather than forcing it to widen. The rule above
+    genuinely pointed both ways for that read: the scope key comes from the
+    observation fold while the rows came from per-file attribution — DIFFERENT
+    mechanisms, which reads as "widen" — yet widening a cost read is attribution
+    D1 forbids and puts one row in two scopes. The resolution is to make the ROW
+    carry the window's answer durably, so scope key and row now agree by
+    construction and the strict flavour is correct rather than merely safe. A
+    row the adoption pass declined to stamp (zero or ambiguous identified
+    accounts, an overlap whose windows disagree) is genuinely nobody's and
+    stays in the ``unattributed`` scope, which is the honest answer.
     """
     if account_key is None:
         return "", ()
@@ -1598,7 +1655,19 @@ def codex_quota_breakdown(
       renders an honest ``$0.00``; the dollars stay visible in the
       ``unattributed`` scope, which owns them.
 
-    The full rule, and the three stamping mechanisms it turns on, are in
+    That honest ``$0.00`` used to fire for spend that was NOT nobody's. The
+    crossing carries the window's account (the observation fold put it there)
+    while the rows behind it carried none, because per-file attribution had no
+    decision covering those bytes. ``codex_session_entries.account_key`` now also
+    carries WINDOW-DERIVED attribution — stamped durably at ingest by
+    ``apply_codex_window_spend_adoption`` under the same window key and the same
+    single-identified-account guard the fold uses — so the ladder and the
+    dollars agree by construction. The read stays strict on top of it precisely
+    BECAUSE the inference is now durable: doing it here instead would re-file one
+    row under two scopes on every read, while doing it once at ingest moves the
+    row out of ``unattributed`` and into exactly one owner.
+
+    The full rule, and the four stamping mechanisms it turns on, are in
     ``_codex_cache_account_predicate``.
     """
     reset = _parse_utc(resets_at, "resets_at") if isinstance(resets_at, str) else resets_at

package/bin/_lib_codex_account_adoption.py

@@ -0,0 +1,173 @@
+"""Codex window-scoped spend adoption (pure kernel).
+
+Spec: ``docs/superpowers/specs/2026-07-30-codex-window-scoped-spend-adoption.md``
+
+``adopt_unidentified_observations`` (``bin/_lib_quota.py``) applies the #341 §2
+window-account continuity rule to the OBSERVATION axis: inside one physical
+quota window, unidentified observations are adopted by the window's account iff
+exactly one identified account is ever observed for that window key.  This
+kernel applies the same inference, with the same grouping key and the same
+guard, to the SPEND axis — ``codex_session_entries.account_key``.
+
+A pure leaf module: stdlib only, no cctally imports.  The caller supplies window
+descriptors (already grouped on ``_lib_quota._physical_window_key`` and already
+folded, so ``identified_accounts`` is the window's post-fold identified set) and
+candidate entries; this kernel decides, and only decides.  Every SQL read and
+every write stays in the glue layer.
+"""
+from __future__ import annotations
+
+import datetime as dt
+from dataclasses import dataclass
+from typing import Iterable
+
+
+#: Native length of the account-level Codex weekly quota window, in minutes.
+ACCOUNT_WEEKLY_WINDOW_MINUTES = 10_080
+
+
+#: The reserved "account could not be determined" sentinel
+#: (``_lib_accounts.UNATTRIBUTED``), spelled here so this leaf stays import-free.
+UNATTRIBUTED_SENTINEL = "unattributed"
+
+
+def entry_is_unattributed(account_key: object) -> bool:
+    """Whether a ``codex_session_entries`` row is still up for adoption.
+
+    ``NULL`` is the stamp every never-decided row carries (#416 spec D1:
+    ``stably_absent`` -> ``NULL``), and the empty string is its degenerate
+    spelling.  The literal ``unattributed`` sentinel is admitted too: no producer
+    writes it to this column today, but ``_codex_cache_account_predicate`` counts
+    it in the ``unattributed`` BUCKET, so excluding it here would make such a row
+    permanently unadoptable — visible as nobody's money and ineligible for the
+    only mechanism that could give it an owner.
+    """
+    return (
+        account_key is None
+        or account_key == ""
+        or account_key == UNATTRIBUTED_SENTINEL
+    )
+
+
+@dataclass(frozen=True)
+class SpendAdoptionWindow:
+    """One physical Codex quota window, as the fold left it.
+
+    ``canonical_resets_at`` is the tolerance-anchored reset (#416 §4.1), never a
+    raw jittered provider value — the same anchor
+    ``_lib_quota._physical_window_key`` groups on.  ``identified_accounts`` is
+    the set of non-``unattributed`` account keys observed for that key.
+    """
+
+    source_root_key: str
+    window_minutes: int
+    canonical_resets_at: dt.datetime
+    identified_accounts: frozenset[str] = frozenset()
+    model_scoped: bool = False
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.source_root_key, str) or not self.source_root_key:
+            raise ValueError("source_root_key must be a non-empty string")
+        if (not isinstance(self.window_minutes, int)
+                or isinstance(self.window_minutes, bool)
+                or self.window_minutes <= 0):
+            raise ValueError("window_minutes must be a positive integer")
+        reset = self.canonical_resets_at
+        if reset.tzinfo is None or reset.utcoffset() is None:
+            raise ValueError("canonical_resets_at must be timezone-aware")
+        object.__setattr__(
+            self, "identified_accounts", frozenset(self.identified_accounts))
+
+    @property
+    def nominal_start_at(self) -> dt.datetime:
+        return self.canonical_resets_at - dt.timedelta(
+            minutes=self.window_minutes)
+
+    @property
+    def in_scope(self) -> bool:
+        """Account-level weekly windows only.
+
+        A 5h window nests inside the weekly one and adds no evidence; a
+        model-scoped pool such as GPT-5.3-Codex-Spark is never account weekly
+        quota (#373).  Both are excluded from candidacy entirely, so neither
+        stamps nor blocks.
+        """
+        return (
+            self.window_minutes == ACCOUNT_WEEKLY_WINDOW_MINUTES
+            and not self.model_scoped
+        )
+
+    def covers(self, timestamp: dt.datetime) -> bool:
+        """Whether ``timestamp`` falls in the NOMINAL ``[start, reset)`` range.
+
+        Nominal rather than first-observation: spend before the window's first
+        retained observation is still spend inside the cycle.
+        """
+        return self.nominal_start_at <= timestamp < self.canonical_resets_at
+
+
+@dataclass(frozen=True)
+class SpendAdoptionCandidate:
+    """One ``codex_session_entries`` row offered to the pass."""
+
+    entry_id: int
+    source_root_key: str
+    timestamp: dt.datetime
+    account_key: "str | None" = None
+
+
+@dataclass(frozen=True)
+class SpendAdoptionStamp:
+    """One decided write: give ``entry_id`` this account."""
+
+    entry_id: int
+    account_key: str
+
+
+def build_spend_adoption_plan(
+    windows: Iterable[SpendAdoptionWindow],
+    candidates: Iterable[SpendAdoptionCandidate],
+) -> tuple[SpendAdoptionStamp, ...]:
+    """Return the stamping plan, ordered by ``entry_id``.
+
+    An in-scope window CLAIMS every candidate its nominal range covers on its own
+    root.  A candidate is stamped iff the UNION of identified accounts across
+    every claiming window is exactly one.
+
+    A claiming window that identifies no account contributes nothing to that
+    union and therefore does NOT block: absence of evidence is not evidence of
+    ambiguity.  That is the same shape ``adopt_unidentified_observations`` uses on
+    the observation axis, which likewise resolves a window from its *identified*
+    observations only and treats an unidentified population as no evidence.  The
+    first implementation blocked on any claiming window that resolved to nothing
+    and measured ZERO stamped rows on a real store: weekly resets move by days,
+    so one cycle overlaps many neighbours and pre-attribution history is
+    unidentified by construction — one such neighbour was always enough to veto.
+
+    Two claiming windows naming DIFFERENT accounts still leave the entry alone
+    (union of two), and so does a single window that itself saw two accounts
+    (#341 never-combine).  An already-identified row is never re-stamped, so
+    re-running over this kernel's own output returns an empty plan.
+    """
+    by_root: dict[str, list[SpendAdoptionWindow]] = {}
+    for window in windows:
+        if window.in_scope:
+            by_root.setdefault(window.source_root_key, []).append(window)
+
+    stamps: list[SpendAdoptionStamp] = []
+    for candidate in candidates:
+        if not entry_is_unattributed(candidate.account_key):
+            continue
+        identified: set[str] = set()
+        for window in by_root.get(candidate.source_root_key, ()):
+            if window.covers(candidate.timestamp):
+                identified |= window.identified_accounts
+                if len(identified) > 1:
+                    break
+        if len(identified) != 1:
+            continue
+        account = next(iter(identified))
+        stamps.append(SpendAdoptionStamp(
+            entry_id=candidate.entry_id, account_key=account))
+    stamps.sort(key=lambda stamp: (stamp.entry_id, stamp.account_key))
+    return tuple(stamps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cctally",
-  "version": "1.86.0",
+  "version": "1.87.1",
   "description": "Claude Code usage tracker and local dashboard for Pro/Max subscription limits - weekly cost-per-percent trend, quota forecasts, threshold alerts. ccusage-compatible.",
   "homepage": "https://github.com/omrikais/cctally",
   "repository": {
@@ -69,6 +69,7 @@
     "bin/_lib_cache_report.py",
     "bin/_lib_cache_writer_lock.py",
     "bin/_lib_changelog.py",
+    "bin/_lib_codex_account_adoption.py",
     "bin/_lib_codex_conversation.py",
     "bin/_lib_codex_conversation_export.py",
     "bin/_lib_codex_conversation_query.py",