cctally 1.87.2 → 1.88.1

package/bin/_cctally_db.py

@@ -3925,6 +3925,54 @@ def _conv_001_adopt_schema_version_marker(conn: sqlite3.Connection) -> None:
     conn.commit()
 
 
+@conversations_migration("002_codex_thread_source_inference_replay")
+def _conv_002_codex_thread_source_inference_replay(
+    conn: sqlite3.Connection,
+) -> None:
+    """Arm the conversations half of the byte-zero Codex replay.
+
+    Spec:
+    ``docs/superpowers/specs/2026-07-30-codex-thread-source-inference-design.md``
+    §4.3.
+
+    Writes a marker ONLY; it clears no table. ``sync_codex_conversations``
+    consumes it, and DEFERS while the cache-side marker is still pending —
+    ``_recompute_codex_rollups`` resolves project attribution from the cache-side
+    thread row, and a missing one stamps a materialized ``"(unassigned)"`` the
+    read path then prefers permanently.
+
+    The key is DISTINCT from ``conversation_rebuild_codex_pending`` on purpose.
+    ``_ensure_codex_conversation_contract`` consumes that one by replaying
+    normalization over already-retained events — which preserves their NULL
+    conversation keys — and then deletes it, so a ``dashboard --no-sync`` or
+    qualified CLI read between this migration and the next real sync would
+    silently discard the repair.
+
+    Takes the Codex conversations provider flock first, the way cache migration
+    ``028_split_conversation_store`` does, and DEFERS on contention. The
+    conversations dispatcher runs inside ``_conversations_open_guarded``, which
+    holds ``CONVERSATIONS_LOCK_MAINTENANCE_PATH`` only SHARED, while
+    ``sync_codex_conversations`` serializes on ``CONVERSATIONS_LOCK_CODEX_PATH``
+    — so without this lock the marker can be armed in the middle of a walk that
+    already read it as absent, and that walk's finalize would clear a replay it
+    never performed. Deferring leaves the migration pending, so it arms cleanly
+    at the next open.
+
+    Idempotent: re-running rewrites the same marker. NO self-stamp — the
+    dispatcher central-stamps on a clean return (#140).
+    """
+    import _cctally_cache
+
+    held = _acquire_conversations_db_codex_provider_flock(
+        conn, migration="conversations 002 thread_source replay")
+    try:
+        _set_cache_meta(
+            conn, _cctally_cache.CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY, "1")
+        conn.commit()
+    finally:
+        _release_cache_db_writer_flocks(held)
+
+
 # #177 S6: the consolidated multi-column external-content FTS5 table that
 # replaces the old conversation_fts(text) + conversation_fts_aux(search_aux)
 # pair. The three column names MUST match the conversation_messages columns BY
@@ -4683,6 +4731,44 @@ def _acquire_cache_db_codex_provider_flock(
     return held
 
 
+def _acquire_conversations_db_codex_provider_flock(
+    conn: sqlite3.Connection,
+    *,
+    migration: str,
+) -> list[int]:
+    """Take the ``<conversations.db>.codex.lock`` sibling, or DEFER.
+
+    The conversations dispatcher runs under a SHARED maintenance flock, so —
+    unlike the cache dispatcher — it does not exclude the provider sync that
+    owns the marker lifecycle. A conversations handler that writes a marker
+    ``sync_codex_conversations`` consumes must therefore hold the same
+    provider lock that sync holds, or it can arm mid-walk and have its marker
+    swallowed by a walk that already read it as absent.
+
+    Derived from the connection (the lock-path helper is store-agnostic: main DB
+    file + ``.codex.lock``), so a migration test never contends on the caller's
+    real conversations lock.
+    """
+    provider_path = _cache_db_codex_lock_path_for_conn(conn)
+    if provider_path is None:
+        return []
+
+    from _lib_cache_writer_lock import acquire_ordered_flocks
+
+    try:
+        held = acquire_ordered_flocks([(provider_path, fcntl.LOCK_EX)])
+    except OSError as exc:
+        raise MigrationGateNotMet(
+            f"conversations.db Codex lock unavailable; deferring {migration}"
+        ) from exc
+    if held is None:
+        raise MigrationGateNotMet(
+            f"conversations.db Codex lock held by a concurrent Codex "
+            f"conversation sync; deferring {migration}"
+        )
+    return held
+
+
 def _release_cache_db_writer_flocks(held: list[int]) -> None:
     from _lib_cache_writer_lock import release_cache_writer_flocks
 
@@ -6135,6 +6221,42 @@ def _034_codex_window_spend_adoption(conn: sqlite3.Connection) -> None:
         _release_cache_db_writer_flocks(held)
 
 
+@cache_migration("035_codex_thread_source_inference_replay")
+def _035_codex_thread_source_inference_replay(conn: sqlite3.Connection) -> None:
+    """Arm a byte-zero Codex replay so rollouts whose ``session_meta`` omits
+    ``thread_source`` gain a conversation identity.
+
+    Spec:
+    ``docs/superpowers/specs/2026-07-30-codex-thread-source-inference-design.md``
+    §4.3.
+
+    The repair must re-read the rollout bytes: the retained events carry NULL
+    conversation keys and the in-place normalization replay preserves them.
+
+    Writes a marker ONLY. ``sync_codex_cache`` consumes it and ORs it into its
+    own ``rebuild``, which is what makes the rebuild path capture
+    ``rebuild_known_identities`` BEFORE the clear. Clearing here instead would
+    delete ``codex_session_files`` out of band, leaving the next ordinary sync
+    with an empty snapshot — every re-read rollout would fall through to the
+    live-``auth.json`` branch and pre-mechanism Codex spend would be
+    re-attributed to whoever is authenticated now (#416 spec D1). Migrations 026
+    and 027 predate that snapshot and are already stamped, so this would be the
+    first migration to hit it live.
+
+    No provider flock: unlike handlers 024-027 and 034 this writes one
+    ``cache_meta`` row and touches no Codex-derived table, so a concurrent
+    ``sync_codex_cache`` has nothing to interleave with — and if one is mid-walk,
+    arming the marker simply defers the replay to the following sync.
+
+    Idempotent: re-running rewrites the same marker. NO self-stamp — the
+    dispatcher central-stamps on a clean return (#140).
+    """
+    import _cctally_cache
+
+    _set_cache_meta(conn, _cctally_cache.CODEX_REPLAY_FROM_ZERO_KEY, "1")
+    conn.commit()
+
+
 # === Region 7d: Stats migration 008_recompute_weekly_cost_snapshots_dedup_fix ===
 
 @stats_migration("008_recompute_weekly_cost_snapshots_dedup_fix")

package/bin/_cctally_doctor.py

@@ -1125,12 +1125,25 @@ def _doctor_gather_state_impl(
     # #416 review B4: the durable record that a torn Codex `auth.json` halted
     # ingest. Same cache_meta read, same degrade-to-None-on-anything contract.
     codex_torn_deferred = None
+    # The byte-zero Codex replay stall signal. The marker itself is a bare "1";
+    # the sibling `blocked` record is the JSON one, so it is read through the
+    # same loop while the marker gets a plain existence probe. Key names come
+    # from the kernel constants, never inline literals.
+    codex_replay_pending = None
+    codex_replay_blocked = None
+    try:
+        import _lib_codex_conversation as _codex_kern
+        _blocked_key = _codex_kern.CODEX_REPLAY_BLOCKED_KEY
+        _pending_key = _codex_kern.CODEX_REPLAY_FROM_ZERO_KEY
+    except Exception:
+        _blocked_key = "codex_replay_from_zero_blocked"
+        _pending_key = "codex_replay_from_zero_pending"
     try:
         if _cache_probe_allowed and _cctally_core.CACHE_DB_PATH.exists():
             conn = sqlite3.connect(str(_cctally_core.CACHE_DB_PATH))
             try:
                 for _key in ("parse_health_claude", "parse_health_codex",
-                             "codex_torn_auth_deferred"):
+                             "codex_torn_auth_deferred", _blocked_key):
                     try:
                         row = conn.execute(
                             "SELECT value FROM cache_meta WHERE key = ?",
@@ -1143,10 +1156,19 @@ def _doctor_gather_state_impl(
                                     parse_health_claude = _parsed
                                 elif _key == "parse_health_codex":
                                     parse_health_codex = _parsed
+                                elif _key == _blocked_key:
+                                    codex_replay_blocked = _parsed
                                 else:
                                     codex_torn_deferred = _parsed
                     except (sqlite3.OperationalError, ValueError):
                         pass
+                try:
+                    codex_replay_pending = conn.execute(
+                        "SELECT 1 FROM cache_meta WHERE key = ?",
+                        (_pending_key,),
+                    ).fetchone() is not None
+                except sqlite3.OperationalError:
+                    pass
             finally:
                 conn.close()
     except Exception:
@@ -1722,6 +1744,8 @@ def _doctor_gather_state_impl(
         parse_health_claude=parse_health_claude,
         parse_health_codex=parse_health_codex,
         codex_torn_deferred=codex_torn_deferred,
+        codex_replay_pending=codex_replay_pending,
+        codex_replay_blocked=codex_replay_blocked,
         stats_db_quick_check=stats_db_quick_check,
         cache_db_quick_check=cache_db_quick_check,
         conversations_db_quick_check=conversations_db_quick_check,

package/bin/_cctally_transcript.py

@@ -49,9 +49,13 @@ def cmd_transcript(args) -> int:
 # ---- export ----------------------------------------------------------------
 
 _SPEED_ONLY_CODEX_MSG = "transcript: --speed applies only to Codex conversations"
+# Deliberately generic about WHAT is pending. Three distinct conditions reach
+# this branch — a cache predating migration 025, a store with the contract
+# rebuild marker armed, and a store with a byte-zero Codex replay marker armed —
+# and naming the migration told users to wait for work applied long ago.
 _PENDING_EXPORT_MSG = (
     "transcript: Codex conversation is not yet normalized "
-    "(migration 025 runs on the next cache open) — retry shortly")
+    "(the pending work runs on the next cache open) — retry shortly")
 
 
 def _emit_export(md: str, output) -> None:
@@ -213,9 +217,10 @@ def _cmd_transcript_search_claude(args) -> int:
 
 # ---- search (Codex) --------------------------------------------------------
 
+# Same generic wording as `_PENDING_EXPORT_MSG`, for the same reason.
 _CODEX_SEARCH_PENDING_MSG = (
     "transcript: Codex conversations are not yet normalized "
-    "(migration 025 runs on the next cache open); no results yet")
+    "(the pending work runs on the next cache open); no results yet")
 
 
 def _cmd_transcript_search_codex(args) -> int:

package/bin/_cctally_tui.py

@@ -271,6 +271,7 @@ from _cctally_dashboard_sources import (
     resolve_dashboard_source_semantics,
 )
 from _lib_dashboard_sources import (
+    SOURCE_SCHEMA_VERSION,
     CapabilityRecord,
     SourceDashboardBundle,
     SourceDashboardState,
@@ -2803,7 +2804,7 @@ def _tui_build_source_bundle(
         codex = refresh_codex_source_clock(codex, now_utc=now_utc)
         combined = compose_all_state(claude, codex)
         bundle = SourceDashboardBundle(
-            source_schema_version=1,
+            source_schema_version=SOURCE_SCHEMA_VERSION,
             default_source="claude",
             source_order=("claude", "codex", "all"),
             sources={"claude": claude, "codex": codex, "all": combined},
@@ -2877,7 +2878,7 @@ def _tui_hydrating_source_bundle() -> SourceDashboardBundle:
         domain_freshness={"hero": "stale", "quota": "stale", "sessions": "stale"},
     )
     return SourceDashboardBundle(
-        source_schema_version=1,
+        source_schema_version=SOURCE_SCHEMA_VERSION,
         default_source="claude",
         source_order=("claude", "codex", "all"),
         sources={"claude": claude, "codex": codex, "all": compose_all_state(claude, codex)},

package/bin/_lib_codex_conversation.py

@@ -74,6 +74,23 @@ CODEX_TITLE_MAX = _TITLE_MAX
 # migration (the store is wholly re-derivable).
 CODEX_CONVERSATION_CONTRACT_VERSION = "5"
 
+# Byte-zero Codex replay markers (spec
+# docs/superpowers/specs/2026-07-30-codex-thread-source-inference-design.md
+# §4.3). One `cache_meta` key per store, armed by cache migration 035 /
+# conversations migration 002 and consumed inside the sync function that owns
+# the correct replay semantics. They live in this kernel because three layers
+# read them — the cache glue that consumes them, the read-side authority probe,
+# and the doctor I/O shell — and a SQL string literal in any one of them would
+# silently outlive a rename of the others.
+CODEX_REPLAY_FROM_ZERO_KEY = "codex_replay_from_zero_pending"
+CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY = (
+    "codex_conversation_replay_from_zero_pending"
+)
+# Written when a whole-tree Codex sync completed and still could NOT consume
+# `CODEX_REPLAY_FROM_ZERO_KEY` — the replay is stalled, not merely pending, and
+# Codex transcript ingest is deferred behind it. Read by `doctor`.
+CODEX_REPLAY_BLOCKED_KEY = "codex_replay_from_zero_blocked"
+
 # Structural wrapper prefixes skipped during title selection (§4.3), pinned from
 # the corpus (title-wrapper-window). Prefix-structural, never content heuristics.
 CODEX_TITLE_SKIP_PREFIXES: tuple[str, ...] = (

package/bin/_lib_codex_conversation_query.py

@@ -35,6 +35,13 @@ from _lib_pricing import _calculate_codex_entry_cost
 # authoritative; a held-lock deferral leaves it pending.
 CODEX_NORMALIZATION_MIGRATION = "025_codex_conversation_normalization"
 
+# The provider-local rebuild marker migration 028's byte-zero replay arms. Its
+# sibling — the thread_source-inference replay marker — is
+# ``kern.CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY``; both are named, never
+# inlined as SQL literals, so a rename cannot leave this probe testing a key
+# nothing writes any more.
+CODEX_CONTRACT_REBUILD_MARKER = "conversation_rebuild_codex_pending"
+
 # Domain separations for the opaque item-key encoding (§5.2). The source-path
 # fingerprint is a domain-separated hash, NEVER a raw path (privacy-safe).
 CODEX_ITEM_KEY_DOMAIN = b"cctally-codex-item-key-v1\0"
@@ -93,6 +100,12 @@ def codex_normalization_authoritative(conn: sqlite3.Connection) -> bool:
     Split stores use their provider-local rebuild marker: current schema alone
     is not authority while migration 028's byte-zero replay is pending. Legacy
     monolithic/bare connections retain the migration-025 stamp contract.
+
+    EITHER pending marker withholds authority. The thread_source-inference
+    replay (conversations migration 002) is armed by its own key precisely
+    because the contract replay must not consume it, so a probe that tested only
+    the contract marker would report a not-yet-repaired store as authoritative
+    to every ``--no-sync`` read.
     """
     try:
         split = conn.execute(
@@ -101,8 +114,9 @@ def codex_normalization_authoritative(conn: sqlite3.Connection) -> bool:
         ).fetchone() is not None
         if split:
             pending = conn.execute(
-                "SELECT 1 FROM cache_meta "
-                "WHERE key='conversation_rebuild_codex_pending'"
+                "SELECT 1 FROM cache_meta WHERE key IN (?,?) LIMIT 1",
+                (CODEX_CONTRACT_REBUILD_MARKER,
+                 kern.CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY),
             ).fetchone() is not None
             version = conn.execute(
                 "SELECT value FROM cache_meta "

package/bin/_lib_conversation_retention.py

@@ -255,7 +255,11 @@ def _maybe_prune_conversation_retention(
     skipped (retention disabled, throttled within 24h, or a lock contended).
 
     Concurrency (F7): a dedicated non-blocking MAINTENANCE flock serializes prune
-    attempts across processes (a second dashboard skips cleanly). Under it, the
+    attempts across processes (a second dashboard skips cleanly). It is claimed
+    EXCLUSIVE and then downgraded to SHARED for the pass proper, so a long prune
+    cannot starve the fail-closed panel readers that sample it
+    ``LOCK_SH | LOCK_NB``; a rival ``LOCK_EX | LOCK_NB`` claim still fails
+    against the held SHARED, so the serialization is unchanged. Under it, the
     two provider flocks are taken in a FIXED order (Claude then Codex),
     non-blocking, so a rebuild/reingest mid-flight makes the prune skip this
     cycle rather than race between candidate selection and deletion. The prune of
@@ -297,6 +301,26 @@ def _maybe_prune_conversation_retention(
                     fcntl.flock(codex_fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
                 except (BlockingIOError, OSError):
                     return None  # a Codex sync is mid-flight; retry next cycle
+                # Downgrade the maintenance flock to SHARED for the pass proper.
+                # The EXCLUSIVE acquire above is what wins the race; holding it
+                # exclusive for the whole pass additionally locked out the
+                # fail-CLOSED panel readers, which take this flock
+                # `LOCK_SH | LOCK_NB` and blank their column on any contention
+                # (`read_session_titles_bounded` -> every Claude session title in
+                # the Recent Sessions card, for the minutes a large prune runs).
+                # A prune is a writer, not a family replacement: concurrent
+                # writes are already excluded by the two provider flocks, and
+                # the replacement paths readers guard against take this flock
+                # EXCLUSIVE, which a held SHARED still blocks. Rival prunes and
+                # `db vacuum` claim `LOCK_EX | LOCK_NB`, which also still fails.
+                # MUST stay after both provider flocks: a flock conversion is
+                # not atomic, so a rival can slip into the downgrade window —
+                # the provider flocks it then fails to claim are what make that
+                # harmless.
+                try:
+                    fcntl.flock(maint_fh, fcntl.LOCK_SH)
+                except OSError:
+                    pass  # keep the exclusive hold; correctness is unchanged
                 cutoff = now_utc - dt.timedelta(days=int(retention_days))
                 conn.execute("BEGIN IMMEDIATE")
                 try:

package/bin/_lib_dashboard_sources.py

@@ -22,7 +22,14 @@ CapabilityStatus = Literal[
     "supported", "derived", "unavailable", "deferred", "not_applicable",
 ]
 
-SOURCE_SCHEMA_VERSION = 1
+# #429 §3.2 — bumped to 2 because `active[].captured_at` changed MEANING (the
+# newest physical observation, not the interpreted baseline). The in-place
+# update flow `execvp`s the server while the already-loaded client reconnects
+# over its existing EventSource without reloading its JS
+# (`UpdateRunningModal.tsx`, `store/sse.ts`), so an old client demonstrably
+# does meet a new server; `docs/cli-contract.md` calls changing a value's
+# meaning breaking. Version-aware client reaction is deliberately deferred.
+SOURCE_SCHEMA_VERSION = 2
 DEFAULT_SOURCE = "claude"
 SOURCE_ORDER = ("claude", "codex", "all")
 SOURCE_FRESHNESS_DOMAINS = ("hero", "quota", "sessions")

package/bin/_lib_doctor.py

@@ -189,6 +189,14 @@ class DoctorState:
     # by the next whole-tree sync that defers none. None = key absent (the
     # normal state) or cache unreadable — the check degrades OK.
     codex_torn_deferred: Optional[dict] = None
+    # The byte-zero Codex replay's stall signal. `codex_replay_pending` mirrors
+    # the `codex_replay_from_zero_pending` cache_meta marker; `codex_replay_blocked`
+    # is `{"at": iso, "files_failed": N, "files_deferred_torn": N}`, written by a
+    # whole-tree Codex sync that RAN and still could not consume it, and deleted
+    # by the next clean whole-tree sync. Both None = key absent (the normal
+    # state) or cache unreadable — the check degrades OK.
+    codex_replay_pending: Optional[bool] = None
+    codex_replay_blocked: Optional[dict] = None
     # #279 S2 (F5b): PRAGMA quick_check(1) results, gathered ONLY under
     # doctor_gather_state(deep=True) (CLI cmd_doctor) — the dashboard
     # rebuild loop calls the gather every rebuild and quick_check on a
@@ -1107,6 +1115,50 @@ def _check_data_codex_cache(s: DoctorState) -> CheckResult:
     )
 
 
+def _check_data_codex_replay(s: DoctorState) -> CheckResult:
+    """WARN while a byte-zero Codex replay is STALLED rather than merely pending.
+
+    `sync_codex_conversations` defers on the cache-side replay marker, so as long
+    as that marker stands no Codex transcript is ingested at all. The deferral is
+    protective — running ahead of the replayed thread rows stamps a materialized
+    `"(unassigned)"` project the read path then prefers permanently — so the fix
+    is never to drop it. But a whole-tree sync that runs and still cannot consume
+    the marker (a persistently torn `auth.json`, a repeated per-file DB error)
+    holds that deferral open indefinitely, and `cache-sync` still exits 0. This
+    leg is the only standing signal that Codex transcript ingest has stopped.
+
+    A marker that is merely pending is NOT reported: it is the ordinary state
+    between the migration and the next sync, and it clears on its own. The WARN
+    needs the durable `blocked` record, which only a completed-but-unsuccessful
+    whole-tree walk writes.
+    """
+    blocked = s.codex_replay_blocked or {}
+    at = blocked.get("at")
+    details = {
+        "pending": bool(s.codex_replay_pending),
+        "blocked_at": at,
+        "files_failed": blocked.get("files_failed"),
+        "files_deferred_torn": blocked.get("files_deferred_torn"),
+    }
+    if s.codex_replay_pending and isinstance(at, str) and at:
+        return CheckResult(
+            id="data.codex_replay", title="Codex transcript replay",
+            severity="warn",
+            summary=(f"stalled since {at} — Codex transcript ingest is "
+                     "deferred until it completes"),
+            remediation=("Check the Codex auth.json (re-run `codex login` if it "
+                         "is truncated), then `cctally cache-sync --source codex`"),
+            details=details,
+        )
+    return CheckResult(
+        id="data.codex_replay", title="Codex transcript replay",
+        severity="ok",
+        summary="pending (clears on the next Codex sync)"
+                if s.codex_replay_pending else "none pending",
+        remediation=None, details=details,
+    )
+
+
 def _check_data_codex_project_metadata(s: DoctorState) -> CheckResult:
     """Report the identity-safe all-history Codex metadata partition."""
     if s.codex_project_metadata_error is not None:
@@ -2680,7 +2732,12 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         ("data.statusline_pipeline", "_check_statusline_pipeline"),
         ("data.cache_sync_state", "_check_data_cache_sync_state"),
         ("data.codex_cache", "_check_data_codex_cache"),
+        # `data.codex_project_metadata` must stay IMMEDIATELY after
+        # `data.codex_cache` (pinned by
+        # tests/test_doctor_codex_project_metadata.py), so the replay leg goes
+        # after the pair rather than between them.
         ("data.codex_project_metadata", "_check_data_codex_project_metadata"),
+        ("data.codex_replay", "_check_data_codex_replay"),
         ("data.codex_quota", "_check_data_codex_quota"),
         ("data.parse_health", "_check_data_parse_health"),
         ("data.forked_buckets", "_check_data_forked_buckets"),

package/bin/_lib_jsonl.py

@@ -549,15 +549,48 @@ def _canonical_container(value: object) -> str | None:
     return _codex_canonical_json(value)
 
 
+# Codex is mid-rollout on `thread_source`: Desktop 0.146.0-alpha.3.1 emits it,
+# the CLI 0.146.0 behind the MCP server does not. Abandoning the identity when
+# it is absent costs the rollout its thread row AND every normalized message,
+# so infer the category the provider would most likely emit instead. Inferring
+# rather than minting a null parent keeps one identity across the release that
+# starts emitting the field.
+_CODEX_DEFAULT_THREAD_SOURCE = "user"
+
+
+def _inferred_codex_thread_source(payload: dict[str, Any]) -> str:
+    """The thread-origin category for one ``session_meta`` payload.
+
+    Per-record and stateless: a later ``session_meta`` never inherits an earlier
+    one's category, so a file's key sequence is a function of its own bytes.
+    The string form of ``source`` is deliberately never used — ``source:
+    "vscode"`` co-occurs with ``thread_source: "user"``, so the client name and
+    the origin category are orthogonal vocabularies.
+    """
+    explicit = _codex_string(payload.get("thread_source"))
+    if explicit is not None:
+        return explicit
+    source = payload.get("source")
+    if isinstance(source, dict) and len(source) == 1:
+        # A single-key object is the shape Codex uses for `{"subagent": {...}}`.
+        # Guard every malformed variant: the identity encoder REJECTS an empty
+        # parent key, so an unguarded rule turns bad metadata into an ingest
+        # exception rather than a degraded-but-working ingest.
+        only_key = _codex_string(next(iter(source)))
+        if only_key is not None:
+            return only_key
+    return _CODEX_DEFAULT_THREAD_SOURCE
+
+
 def _thread_metadata_from_session_meta(
     payload: dict[str, Any], path_str: str, source_root_key: str | None,
 ) -> CodexThreadMetadata:
     accounting_id = _codex_string(payload.get("id"))
     native_thread_id = _codex_string(payload.get("session_id")) or accounting_id
-    root_thread_id = _codex_string(payload.get("thread_source"))
+    root_thread_id = _inferred_codex_thread_source(payload)
     parent_thread_id = _codex_string(payload.get("forked_from_id"))
     conversation_key = None
-    if native_thread_id is not None and root_thread_id is not None:
+    if native_thread_id is not None:
         conversation_key = canonical_identity_from_root_key(
             "codex", "conversation", source_root_key, native_thread_id, root_thread_id
         )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cctally",
-  "version": "1.87.2",
+  "version": "1.88.1",
   "description": "Claude Code usage tracker and local dashboard for Pro/Max subscription limits - weekly cost-per-percent trend, quota forecasts, threshold alerts. ccusage-compatible.",
   "homepage": "https://github.com/omrikais/cctally",
   "repository": {