cctally 1.89.2 → 1.90.0

package/CHANGELOG.md

@@ -5,6 +5,26 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.90.0] - 2026-08-02
+
+### Added
+- Internal (maintainer-only): the complete open GitHub issue backlog can now be normalized by a registered Luna worker, adjudicated by the Sol primary agent, and reconciled into a marker-owned Project and tracker through a preview-first, checksum-resumable workflow. The reconciler preserves user-owned metadata, resumes partial applies without improvising a new plan, records dependencies and evidence, requires current-main proof before closure, and verifies completion by recollecting GitHub plus a zero-mutation second preview (#475).
+
+### Fixed
+- The first interactive command after a `stats.db` index-epoch upgrade no longer waits for the entire journal replay. A readable post-cutover index with the wrong epoch now starts one dedicated background rebuild: statusline output remains available, the dashboard binds with an explicit hydrating/degraded snapshot, and other stats-backed commands return retry guidance instead of blocking. The worker retains the existing maintenance locks and journal-truth rebuild path, retries failures safely, and lets the next invocation read the rebuilt index (#453).
+- Sharing a Codex panel while focused on one account now keeps that account scope through the live preview, every export action, recent-share history, the report basket, section refreshes, and composed reports. Switching the dashboard's account selector while the share dialog is open no longer changes the captured scope, and account-agnostic shares keep their existing request and storage shape. Claude panels remain honestly account-agnostic because their dashboard rows are not yet account-filtered (#346).
+- Internal (maintainer-only): managed issue-triage comments now lead with the human action summary and keep their lossless normalized record in a collapsed disclosure instead of filling the issue discussion with raw JSON. Existing marker-first v1 comments are read unchanged and migrate through exact-marker reconciliation; unmarked user comments remain untouched (#476).
+- `cache-report --json` now identifies anomaly predicates that were not evaluated, so consumers can distinguish an evaluated-clean row from a check skipped for a thin baseline or because anomaly detection was disabled. This is an additive field and keeps `schemaVersion: 1` (#474).
+- Cache Report charts now share one day-slot axis, so the sparkline's Today marker lines up with the Today net bar in both the card and modal, including one-day and no-activity windows. The card's net bars keep a compact 60px height, every card state carries the standard header icon, and an empty report is visually and accessibly distinct from a failed build. The expanded report keeps its labeled table through the 641–719px transition band, switches to labeled cards at 640px, and preserves its title and subtitle without horizontal overflow down to 320px (#452).
+- The Cache Report's anomaly threshold now means the same thing everywhere. If `cache_report.anomaly_threshold_pp` in your config file held something other than a whole number between 1 and 100 — a quoted `"20"` after a hand edit, say — the Claude panel quietly coerced it while the Codex panel fell back to the default, so one setting produced two different verdicts side by side. A value that isn't a whole number in range now falls back to the documented default of 15 on every surface, matching what the settings dialog has always refused to save (#443).
+- Cache Report no longer drops a day from the baseline when the clocks change. The baseline window was measured in elapsed hours while each day is anchored to its own local midnight, so across a daylight-saving transition a day exactly 14 days old fell an hour outside the 14-day window and was silently excluded — which could leave the baseline one sample short and suppress the comparison entirely. The window is now counted in calendar days, and the "Building baseline · N/5 days" count is taken from the very rows the comparison used, so the number you see and the number the check needs can no longer disagree (#443).
+- Cache Report cache-dollar totals no longer depend on the order entries happen to be read in. Sums are now computed so the result is the correctly-rounded total regardless of ordering. On a day whose savings and cache-write costs cancel almost exactly this could previously flip the "net spend went negative" warning on or off between runs of the same data; it is now stable. One rendered cent can shift at a rounding boundary, always toward the more accurate value (#443).
+- On a machine whose timezone isn't UTC, with no `display.tz` set, Cache Report no longer mixes up which day is today. The days were grouped in your local timezone while "today" was worked out in UTC, so for part of each day the report highlighted the wrong row, and the Codex per-project and per-model breakdowns could be built from a different set of days than the ones listed above them. Both now use the same timezone as the rows themselves (#443).
+- The Codex Cache Report no longer labels an older day "Today" and no longer publishes a fabricated 0% for a day with no Codex activity yet — an idle day is now marked unmeasured, as it already was for Claude (#443).
+- The Codex Cache Report no longer reports "net spend went negative" as a permanently unevaluated check. OpenAI charges no cache-write premium, so that check does not apply to Codex at all, and an ordinary Codex day now reads as clean rather than partially checked (#443).
+- The Codex Cache Report now publishes its figures under Codex's own vocabulary — "cached input" rather than Claude's "cache hit" — and states which figures do not apply to Codex, and why (#443).
+- The dashboard no longer invents a Codex Cache Report when the server published none. The card and the modal each built their own stand-in from raw daily rows, disagreeing with each other about whether the window was empty, presenting a row count as a 14-day window, and showing a confident verdict against a median taken from as few as two days — below the five-day floor the real report enforces. Worse, the modal's stand-in seeded the settings gear with a 5pp anomaly threshold the server never set, so saving from that screen silently rewrote the global threshold from 15 to 5 and changed Claude's verdicts too. Both surfaces now render what the server actually sent, and say plainly when there is nothing to render — distinguishing "this source has no cache activity yet" (including a focused account with no Codex activity) from "the snapshot could not be built" (#443).
+
 ## [1.89.2] - 2026-07-31
 
 ### Fixed

package/bin/_cctally_cache_report.py

@@ -464,7 +464,6 @@ def _render_cache_day_rows(
             raw_rows.append((bd_cells, ROW_BREAKDOWN))
 
     tot_inp = sum(row.input_tokens for row in rows)
-    tot_out = sum(row.output_tokens for row in rows)
     tot_cc = sum(row.cache_creation_tokens for row in rows)
     tot_cr = sum(row.cache_read_tokens for row in rows)
     tot_tokens = sum(row.total_tokens for row in rows)
@@ -613,7 +612,6 @@ def _render_cache_session_rows(
             raw_rows.append((bd_cells, ROW_BREAKDOWN))
 
     tot_inp = sum(r.input_tokens for r in rows)
-    tot_out = sum(r.output_tokens for r in rows)
     tot_cc = sum(r.cache_creation_tokens for r in rows)
     tot_cr = sum(r.cache_read_tokens for r in rows)
     tot_tokens = sum(r.total_tokens for r in rows)
@@ -934,8 +932,11 @@ def _cache_report_json_payload(
     Daily mode keeps the top-level `days` key and per-row `totalCost` /
     totals.totalCost aliases for backward compat. Session mode uses
     `sessions` and adds sessionId / projectPath / lastActivity /
-    sourcePaths per row. Anomaly object is always emitted with
-    triggered=false / reasons=[] until Task 5 populates it.
+    sourcePaths per row. The anomaly object is always emitted: it
+    carries `triggered` / `reasons` from `_classify_anomalies` plus
+    `unevaluated` (the predicates the classifier declined to run for that
+    row), so a consumer can tell "evaluated, clean" from "never
+    evaluated".
     """
     top_key = "sessions" if mode == "session" else "days"
 
@@ -954,6 +955,7 @@ def _cache_report_json_payload(
             "anomaly": {
                 "triggered": r.anomaly_triggered,
                 "reasons": list(r.anomaly_reasons),
+                "unevaluated": list(r.anomaly_unevaluated),
             },
             "modelBreakdowns": [
                 {
@@ -1065,7 +1067,10 @@ def _sort_cache_rows(
         if anchor is None and r.date:
             # Use .astimezone() (OS tzdb) rather than .replace(tzinfo=...) so
             # DST-straddling dates resolve to the correct offset — same idiom
-            # as _annotate_anomalies._row_anchor.
+            # as `_row_anchor`, which is a module-level function in
+            # bin/_lib_cache_report.py — NOT an attribute of this file's
+            # `_annotate_anomalies` shim, which is what the old citation
+            # implied.
             # internal fallback: host-local intentional
             anchor = dt.datetime.strptime(r.date, "%Y-%m-%d").astimezone()
         # Use tz-aware sentinel to avoid naive-vs-aware comparison errors.

package/bin/_cctally_core.py

@@ -1489,6 +1489,21 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
     _cctally_store = importlib.import_module("_cctally_store")
 
     ensure_dirs()
+    # #453: probe the live index before the maintenance-shared opener. During
+    # a large detached rebuild that opener can wait for its bounded 5-second
+    # guard; a statusline arriving mid-replay would otherwise pay that delay
+    # (and can reach more than one stats opener in a single render). The raw
+    # probe is read-only and deliberately recognizes only a readable,
+    # post-legacy wrong epoch. Missing/unreadable/legacy indexes retain their
+    # established guarded-open paths. The post-open epoch gate below remains a
+    # race-closing defense if the version changes after this probe.
+    if (
+        _target_path is None
+        and _cctally_store.stats_epoch_enabled()
+        and _cctally_store.stats_epoch_rebuild_pending(db_path)
+    ):
+        outcome = _cctally_store.defer_stats_epoch_rebuild()
+        raise c.StatsEpochRebuildDeferred(outcome)
     # #386: the opener half of the physical-replacement protocol. This replaces
     # three bare `repair_marker.exists()` checks around an unguarded connect —
     # which observed no quarantine-pending record and held no maintenance lock,
@@ -1589,11 +1604,14 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
         if _target_path is None:
             if _uv > LEGACY_STATS_HEAD:
                 # Neither legacy (<=13) nor the current epoch — a future epoch or
-                # a stray value. Resolve by journal REBUILD (spec §7.1), never by
-                # the corruption heal path (disjoint); a mismatch with no journal
-                # is a hard error, never a silent rebuild-to-empty.
+                # a stray value. Ordinary live callers must not pay whole-journal
+                # replay inline or read the schema-incompatible old index. Hand
+                # the existing synchronous resolver to its dedicated worker and
+                # fail promptly; explicit maintenance and the worker itself call
+                # that resolver directly. Corruption/legacy paths stay disjoint.
                 conn.close()
-                return _cctally_store.resolve_stats_epoch_mismatch()
+                outcome = _cctally_store.defer_stats_epoch_rebuild()
+                raise c.StatsEpochRebuildDeferred(outcome)
             # _uv <= LEGACY_STATS_HEAD → a pre-journal install: cut over below. A
             # dev/worktree binary must REFUSE to cut over a DB in the real prod
             # dir (mirrors #146 — the epoch stamp would brick the installed

package/bin/_cctally_dashboard.py

@@ -5644,7 +5644,13 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             # documented default when neither the request nor the
             # persisted config carries an explicit value.
             persisted_cr = merged.get("cache_report") or {}
-            stored_threshold = persisted_cr.get("anomaly_threshold_pp", 15)
+            # #443 S3 F17: the echo is a fifth reader of this setting. It used
+            # to carry its own hard-coded 15, so a hand-edited non-integer in
+            # config.json would be echoed verbatim to the settings composer
+            # while both read paths classified at the default.
+            stored_threshold = _cache_report_load_kernel().resolve_cache_report_threshold(
+                persisted_cr.get("anomaly_threshold_pp")
+            )
             out["cache_report"] = {
                 "anomaly_threshold_pp": stored_threshold,
             }
@@ -6912,6 +6918,12 @@ def _dashboard_initial_snapshot(args, *, pinned_now, display_tz_pref_override):
             display_tz_pref_override=display_tz_pref_override,
             stats_heal_attempted=False,
         )
+    except c.StatsEpochRebuildDeferred as exc:
+        return _dashboard_stats_epoch_deferred_snapshot(
+            args,
+            pinned_now=pinned_now,
+            exc=exc,
+        )
     except tui._StatsSnapshotCorruption as fault:
         # The once-builder's finally has closed the cheap-seed stats handle.
         tui._tui_heal_post_query_stats(fault.cause)
@@ -6923,6 +6935,53 @@ def _dashboard_initial_snapshot(args, *, pinned_now, display_tz_pref_override):
         )
 
 
+def _dashboard_stats_epoch_deferred_snapshot(args, *, pinned_now, exc):
+    """Bind promptly with a typed degraded frame while replay runs detached."""
+
+    import time as _time
+
+    c = _cctally()
+    tui = c._cctally_tui
+    now_utc = pinned_now or dt.datetime.now(dt.timezone.utc)
+    hydrating = not getattr(args, "no_sync", False)
+    errors = [f"stats-open: {exc}"]
+    envelope_precompute = None
+    try:
+        envelope_precompute = tui._tui_precompute_envelope_config(load_config())
+    except Exception as precompute_exc:  # noqa: BLE001 — bind must continue
+        errors.append(f"envelope-precompute: {precompute_exc}")
+    # The real doctor shallow gather opens stats repeatedly. Once the detached
+    # worker owns maintenance-exclusive, doing that before HTTP bind reintroduces
+    # the exact multi-second startup stall this path exists to remove. Supply a
+    # schema-valid, privacy-safe warning block; the first successful background
+    # snapshot replaces it with a real doctor payload.
+    doctor_payload = {
+        "severity": "warn",
+        "counts": {"ok": 0, "warn": 1, "fail": 0},
+        "generated_at": now_utc.astimezone(dt.timezone.utc).strftime(
+            "%Y-%m-%dT%H:%M:%SZ"
+        ),
+        "fingerprint": "sha1:" + ("0" * 40),
+    }
+    replacements = {
+        "last_sync_at": _time.monotonic(),
+        "last_sync_error": "; ".join(errors),
+        "sync_failures": (
+            tui.SyncFailureAttribution(
+                leg="stats-open",
+                database="stats",
+                corruption=False,
+            ),
+        ),
+        "doctor_payload": doctor_payload,
+        "envelope_precompute": envelope_precompute,
+        "hydrating": hydrating,
+    }
+    if hydrating:
+        replacements["source_bundle"] = tui._tui_hydrating_source_bundle()
+    return dataclasses.replace(tui._tui_empty_snapshot(now_utc), **replacements)
+
+
 def _dashboard_initial_snapshot_once(
     args,
     *,
@@ -7058,6 +7117,103 @@ def _dashboard_initial_snapshot_once(
     )
 
 
+_DASHBOARD_QA_STATES = frozenset({
+    "hydrating", "failed", "forensics-degraded",
+})
+
+
+def _dashboard_qa_state_from_env() -> str | None:
+    """Resolve the explicit, test-only Cache Report server state.
+
+    The master switch is intentionally separate from the requested state so a
+    stray environment variable cannot alter a normal dashboard. These states
+    transform a real server snapshot after its production builders run; they
+    never replace endpoint payloads in the browser and never affect CLI data.
+    """
+    requested = os.environ.get("CCTALLY_DASHBOARD_QA_STATE", "").strip()
+    if (
+        not requested
+        or os.environ.get("CCTALLY_DASHBOARD_QA") != "1"
+        or not _cctally()._is_dev_checkout()
+    ):
+        return None
+    if requested not in _DASHBOARD_QA_STATES:
+        raise ValueError(
+            "CCTALLY_DASHBOARD_QA_STATE must be one of: "
+            + ", ".join(sorted(_DASHBOARD_QA_STATES))
+        )
+    return requested
+
+
+def _dashboard_apply_qa_state(snapshot, state: str | None):
+    """Apply one guarded QA state to a real dashboard snapshot."""
+    if state is None:
+        return snapshot
+    if state not in _DASHBOARD_QA_STATES:
+        raise ValueError("unsupported dashboard QA state")
+    tui = _cctally()._cctally_tui
+    if state == "hydrating":
+        return dataclasses.replace(
+            snapshot,
+            hydrating=True,
+            cache_report=None,
+            source_bundle=tui._tui_hydrating_source_bundle(),
+        )
+    bundle = getattr(snapshot, "source_bundle", None)
+    if bundle is None:
+        raise ValueError("dashboard QA state requires a built source bundle")
+
+    physical = {}
+    for source in ("claude", "codex"):
+        current = bundle.sources[source]
+        capabilities = dict(current.capabilities)
+        capabilities["forensics"] = tui.CapabilityRecord(
+            "unavailable", f"qa-{state}",
+        )
+        warning = tui.SourceDashboardWarning(
+            f"qa_{state.replace('-', '_')}",
+            (
+                "Cache forensics are degraded for deterministic QA."
+                if state == "forensics-degraded"
+                else "Cache forensics failed for deterministic QA."
+            ),
+            "forensics",
+        )
+        if state == "forensics-degraded":
+            physical[source] = dataclasses.replace(
+                current,
+                availability="partial",
+                warnings=tuple(current.warnings) + (warning,),
+                capabilities=capabilities,
+                data_version=f"{current.data_version}:qa-degraded",
+            )
+        else:
+            physical[source] = dataclasses.replace(
+                current,
+                availability="unavailable",
+                freshness="stale",
+                warnings=(warning,),
+                capabilities=capabilities,
+                data=None,
+                last_success_at=None,
+                domain_freshness={
+                    "hero": "stale", "quota": "stale", "sessions": "stale",
+                },
+                data_version=f"{current.data_version}:qa-failed",
+            )
+    physical["all"] = tui.compose_all_state(
+        physical["claude"], physical["codex"],
+    )
+    return dataclasses.replace(
+        snapshot,
+        hydrating=False,
+        cache_report=(
+            None if state == "failed" else getattr(snapshot, "cache_report", None)
+        ),
+        source_bundle=dataclasses.replace(bundle, sources=physical),
+    )
+
+
 def cmd_dashboard(args: argparse.Namespace) -> int:
     """Launch the live web dashboard."""
     import signal as _signal
@@ -7165,6 +7321,7 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
         # stamp so the envelope emits sync_age_s=None and the JS client
         # renders the documented `sync paused` state.
         initial = dataclasses.replace(initial, last_sync_at=None)
+    initial = _dashboard_apply_qa_state(initial, _dashboard_qa_state_from_env())
 
     ref = _SnapshotRef(initial)
     hub = SSEHub()

package/bin/_cctally_dashboard_cache_report.py

@@ -90,16 +90,24 @@ def _validate_cache_report_settings(block: dict) -> dict:
     validated: dict = {}
     if "anomaly_threshold_pp" in block:
         threshold = block["anomaly_threshold_pp"]
-        # bool is an int subclass — reject it explicitly (mirrors the
+        # #443 S3 F17: the type-and-range rule is the kernel's
+        # ``cache_report_threshold_is_valid`` — the same predicate the two
+        # read paths resolve through, so the gate and the readers cannot
+        # disagree about what a valid setting is. The two-branch split
+        # survives only to keep the distinct messages: bool is an int
+        # subclass and is rejected explicitly (mirrors the
         # update.check.ttl_hours precedent).
+        crk = _cache_report_load_kernel()
         if isinstance(threshold, bool) or not isinstance(threshold, int):
             raise _CacheReportConfigError(
                 "anomaly_threshold_pp must be an integer",
                 field="anomaly_threshold_pp",
             )
-        if threshold < 1 or threshold > 100:
+        if not crk.cache_report_threshold_is_valid(threshold):
             raise _CacheReportConfigError(
-                "anomaly_threshold_pp must be in [1, 100]",
+                "anomaly_threshold_pp must be in "
+                f"[{crk.CACHE_REPORT_THRESHOLD_MIN_PP}, "
+                f"{crk.CACHE_REPORT_THRESHOLD_MAX_PP}]",
                 field="anomaly_threshold_pp",
             )
         validated["anomaly_threshold_pp"] = threshold
@@ -183,11 +191,13 @@ def _cache_report_snapshot_to_dict(cr: "CacheReportSnapshot | None") -> "dict |
     """
     if cr is None:
         return None
-    return {
-        "window_days": cr.window_days,
-        "anomaly_threshold_pp": cr.anomaly_threshold_pp,
-        "anomaly_window_days": cr.anomaly_window_days,
-        "today": {
+    wire = _cache_report_load_wire()
+    return wire.build_cache_report_wire(
+        provider="claude",
+        window_days=cr.window_days,
+        anomaly_threshold_pp=cr.anomaly_threshold_pp,
+        anomaly_window_days=cr.anomaly_window_days,
+        today={
             "date": cr.today.date,
             "cache_hit_percent": cr.today.cache_hit_percent,
             "baseline_median_percent": cr.today.baseline_median_percent,
@@ -196,51 +206,40 @@ def _cache_report_snapshot_to_dict(cr: "CacheReportSnapshot | None") -> "dict |
             "saved_usd": cr.today.saved_usd,
             "wasted_usd": cr.today.wasted_usd,
             "anomaly_triggered": cr.today.anomaly_triggered,
-            "anomaly_reasons": list(cr.today.anomaly_reasons),
+            "anomaly_reasons": cr.today.anomaly_reasons,
             "baseline_daily_row_count": cr.today.baseline_daily_row_count,
-            "anomaly_unevaluated": list(cr.today.anomaly_unevaluated),
+            "anomaly_unevaluated": cr.today.anomaly_unevaluated,
             "observed": cr.today.observed,
         },
-        "days": [
+        days=[
             {
-                "date": d.date,
-                "cache_hit_percent": d.cache_hit_percent,
-                "input_tokens": d.input_tokens,
-                "output_tokens": d.output_tokens,
+                "date": d.date, "cache_hit_percent": d.cache_hit_percent,
+                "input_tokens": d.input_tokens, "output_tokens": d.output_tokens,
                 "cache_creation_tokens": d.cache_creation_tokens,
                 "cache_read_tokens": d.cache_read_tokens,
-                "saved_usd": d.saved_usd,
-                "wasted_usd": d.wasted_usd,
+                "saved_usd": d.saved_usd, "wasted_usd": d.wasted_usd,
                 "net_usd": d.net_usd,
                 "anomaly_triggered": d.anomaly_triggered,
-                "anomaly_reasons": list(d.anomaly_reasons),
-                "anomaly_unevaluated": list(d.anomaly_unevaluated),
+                "anomaly_reasons": d.anomaly_reasons,
+                "anomaly_unevaluated": d.anomaly_unevaluated,
                 "observed": d.observed,
             }
             for d in cr.days
         ],
-        "by_project": [
-            {
-                "key": b.key,
-                "cache_hit_percent": b.cache_hit_percent,
-                "net_usd": b.net_usd,
-            }
+        by_project=[
+            {"key": b.key, "cache_hit_percent": b.cache_hit_percent, "net_usd": b.net_usd}
             for b in cr.by_project
         ],
-        "by_model": [
-            {
-                "key": b.key,
-                "cache_hit_percent": b.cache_hit_percent,
-                "net_usd": b.net_usd,
-            }
+        by_model=[
+            {"key": b.key, "cache_hit_percent": b.cache_hit_percent, "net_usd": b.net_usd}
             for b in cr.by_model
         ],
-        "seven_day_net_usd": cr.seven_day_net_usd,
-        "seven_day_anomaly_count": cr.seven_day_anomaly_count,
-        "fourteen_day_counterfactual_usd": cr.fourteen_day_counterfactual_usd,
-        "fourteen_day_efficiency_ratio": cr.fourteen_day_efficiency_ratio,
-        "is_empty": cr.is_empty,
-    }
+        seven_day_net_usd=cr.seven_day_net_usd,
+        seven_day_anomaly_count=cr.seven_day_anomaly_count,
+        fourteen_day_counterfactual_usd=cr.fourteen_day_counterfactual_usd,
+        fourteen_day_efficiency_ratio=cr.fourteen_day_efficiency_ratio,
+        is_empty=cr.is_empty,
+    )
 
 
 @dataclass(frozen=True)
@@ -285,6 +284,14 @@ def _cache_report_load_kernel():
     return sys.modules["cctally"]._load_sibling("_lib_cache_report")
 
 
+def _cache_report_load_wire():
+    """Lazy-load ``_lib_cache_report_wire`` through the same bridge.
+
+    The wire builder is the single serializer shared with the Codex
+    producer in ``_cctally_dashboard_sources.py`` (#443 S2 F18)."""
+    return sys.modules["cctally"]._load_sibling("_lib_cache_report_wire")
+
+
 def _cache_report_needed_closed_dates(since, now_utc, bucket_tz):
     """The CLOSED display-tz dates a full-window cache-report build needs (#272 §6).
 
@@ -406,16 +413,16 @@ def build_cache_report_snapshot(
     since = now_utc - dt.timedelta(days=window_days)
     pricing = cctally_ns.CLAUDE_MODEL_PRICING
 
-    # Cache mechanics key on the BUCKETING tz (``_resolve_bucket_tz`` — the same
+    # One current day per invocation (#443 S3 F23). Cache mechanics and the
+    # spotlight both key on the BUCKETING tz (``_resolve_bucket_tz`` — the same
     # tz ``_aggregate_cache_by_day`` buckets by), so ``today_key`` / the closed-
-    # day keys line up with ``CacheRow.date``. The spotlight's ``today_iso``
-    # keeps its own UTC-fallback derivation unchanged (byte-identity); the two
-    # agree whenever ``display_tz`` is set — always, on the dashboard.
+    # day keys / ``today_iso`` line up with ``CacheRow.date`` and cannot
+    # disagree. ``today_iso`` previously kept a separate UTC fallback,
+    # justified by the caller-side assumption that ``display_tz`` is always
+    # set on the dashboard rather than by an invariant.
     bucket_tz = crk._resolve_bucket_tz(display_tz)
     today_key = now_utc.astimezone(bucket_tz).strftime("%Y-%m-%d")
-    today_iso = now_utc.astimezone(
-        display_tz if display_tz is not None else dt.timezone.utc
-    ).strftime("%Y-%m-%d")
+    today_iso = today_key
 
     def _wrap_day_entries(raw):
         # Day-mode kernel expects entries with a ``usage`` dict (matches
@@ -550,10 +557,13 @@ def build_cache_report_snapshot(
     # alongside the anomaly classifier so we don't re-walk the same
     # row set here).
     today_row = next((r for r in result.rows if r.date == today_iso), None)
-    other_rows = [r for r in result.rows if r.date != today_iso]
     baseline_median = result.today_baseline_median
 
-    baseline_daily_row_count = len(other_rows)
+    # #443 S3 F22: the rows the median was actually taken over, not every
+    # non-today row. The old count was unbounded by the baseline window,
+    # so the panel could read "baseline sufficient" from it while
+    # `baseline_median_percent` was None.
+    baseline_daily_row_count = result.today_baseline_sample_count
 
     # ``delta_pp`` sign convention (spec §4.2): "signed; negative = today
     # below median" → ``delta = today − baseline``. The empty-day branch

package/bin/_cctally_dashboard_envelope.py

@@ -846,6 +846,14 @@ def _sync_failure_envelope(
             "action": "cctally db repair --db stats --yes",
         }
 
+    if attributed("stats"):
+        return {
+            "kind": "maintenance_active",
+            "label": "stats index rebuilding",
+            "detail": "The dashboard statistics index is rebuilding in the background.",
+            "action": None,
+        }
+
     # conversations.db is intentionally outside core dashboard generations.
     # Typed transcript ownership therefore degrades through the generic server
     # contract: Doctor owns integrity diagnosis, and raw SQLite wording must

package/bin/_cctally_dashboard_share.py

@@ -2590,6 +2590,7 @@ def _handle_share_history_post_impl(handler) -> None:
     destination = req.get("destination")
     try:
         source, _ = _share_source_selection(req)
+        account = _share_account_selection(req)
     except ValueError:
         handler._respond_json(400, {
             "code": "source_capability_unavailable",
@@ -2661,6 +2662,7 @@ def _handle_share_history_post_impl(handler) -> None:
         "template_id": template_id,
         "options": options,
         "source": source,
+        **({"account": account} if account is not None else {}),
         "format": fmt,
         "destination": destination,
         "exported_at": _share_now_utc_iso(),