cctally 1.90.1 → 1.91.0

package/CHANGELOG.md

@@ -5,6 +5,41 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.91.0] - 2026-08-03
+
+### Added
+- The Codex conversation reader now shows an indicator inside the transcript while a further page is loading, so a scroll-up or a jump that has to fetch is visibly in progress rather than silently pending. When a jump cannot reach its target the reader now says so instead of falling silent (#463).
+- Internal (maintainer-only): the whole frontend test estate now runs inside `bin/cctally-test-all` through a new `bin/cctally-frontend-test` harness, with a two-sided golden pinning the Codex reader path on both the server envelope and the adapted client model. Every CI lane that runs the bundle now provisions it (#463).
+- Internal (maintainer-only): the React client now runs ESLint's hook-order rule in both its normal build and the authoritative test bundle, so a conditional hook fails statically instead of surviving until a mounted component changes branches at runtime (#468).
+- Codex reasoning now lists every heading the model actually wrote, one readable line each, instead of a single clipped line that hid the rest. Press `h` and `H` to step forward and back through them, including into a part of the conversation that has not loaded yet. Codex re-states earlier headings as a turn goes on, so a heading a turn has already shown is listed once rather than again each time (#463).
+- Internal (maintainer-only): `bin/cctally-frontend-test` now typechecks the React client, so a TypeScript error fails the authoritative local and remote suite instead of only the CI build (#463).
+
+### Changed
+- A long Codex conversation now opens without downloading the whole thing: the server serves a bounded page and the reader loads the rest as you scroll. The heaviest conversation in a real store went from 13.2 MB in a single response to 2.5 MB (#463).
+- A very long Codex turn is now split into several bounded reading units instead of one enormous message, so the reader can scroll it smoothly. Deep links, bookmarks and saved reading positions issued before this change still resolve (#463).
+- A Codex message that is not the one its turn's cost is attributed to now reports no cost at all rather than a zero, so a consumer of the JSON can tell "this message carries no cost of its own" apart from "this cost nothing". No displayed figure changes: every rendering site already showed a cost only when there was a positive one (#463).
+- Consecutive Codex messages now read as the separate messages they were, instead of being run together into one block of prose (#463).
+- The dashboard's Codex Cache Report wire now publishes only `cached_input_percent`, reports structurally inapplicable wasted-cost and efficiency values as `null`, and identifies the coordinated contract change as source schema version 4 (#465).
+
+### Fixed
+- Internal (maintainer-only): generated cache fixtures now store UTC timestamps in the same `+00:00` form as production, so rows exactly at a reader's upper boundary are exercised instead of being silently excluded by lexical ordering (#467).
+- Internal (maintainer-only): the remote-test harness's synthetic lock holders now acknowledge that their lock path is gone before a fixture continues, and wrapper cleanup no longer strands an owned lock when its secondary process-start probe is transiently unavailable under load (#464).
+- The Codex hero's transient ingest-backlog note now stays to one compact line on phone-width screens instead of wrapping into two to four lines. The full `+N sessions still loading` wording remains on wider screens, and the complete explanation remains available to assistive technology at every width (#459).
+- Multi-account Codex quota labels now stay attached to the account they came from when two accounts share one `$CODEX_HOME` root. The dashboard no longer borrows another account's label or window duration from an otherwise-identical active quota key, while single-account dashboards keep their existing undecorated join (#437).
+- The dashboard's All tab now keeps its combined spend and token total when one provider's quota evidence is stale. The retained actuals carry a visible `Stale quota` marker in both the hero and current-usage modal, while forward-looking projections remain paused (#359).
+- Multi-account Codex dashboard cards now mark stale quota evidence on the account it belongs to. A fresh sibling no longer hides another account's staleness, and the stale card keeps showing its retained percentage, reset, and spend; after reset its quota fields still clear while historical spend remains (#416, #360).
+- The dashboard's Recent Alerts card and modal now identify which account each alert belongs to and honor the selected account filter, while retaining vendor-wide crossings as `All accounts`. Simultaneous same-threshold alerts from different accounts no longer collapse into one toast, and single-account dashboards keep their previous undecorated shape (#345).
+- The dashboard now marks incomplete Codex totals everywhere they are shown: the Combined spend hero carries the same visible `+N sessions still loading` caveat as the Codex hero, and the Codex current-cycle modal explains that its totals will rise as bounded ingest finishes. The disclosure also reaches the Codex section embedded in the All-sources modal, while account-scoped stale-cycle notes keep their existing scope (#456).
+- A deep link, bookmark or saved reading position pointing into a long Codex turn now loads the message it names. Because the reader's outline omits some turns from its navigation list, any position inside one of those turns resolved to nothing at all and the reader stayed on the last page it had, showing no error. On the heaviest conversation in a real store this affected every position inside a split turn. The same omission applies to Claude conversations for a position inside a system or lifecycle turn, and those now load as well (#463).
+- Find in a Codex conversation now reports and reaches every match. Matches inside a long turn, past its first reading unit, were dropped from the result list — on the heaviest conversation in a real store one query reported 2 matches where there are 16 — and none of the dropped ones could be navigated to (#463).
+- Paging up through a Codex conversation now returns the page immediately before your cursor. It previously returned the conversation's opening messages instead, which made scrolling up appear to jump to the beginning (#463).
+- `cctally transcript export` and the dashboard export no longer repeat each Codex reasoning heading, so an exported Codex transcript reads once through rather than twice (#463).
+- The transcript paging indicator no longer sits under the "↓ N new" pill on a narrow screen (#463).
+- A long Codex reasoning heading is now readable in full: it wraps instead of being cut off mid-sentence with no way to see the rest (#463).
+- A Codex message that opened a code block and never closed it no longer swallows the messages that follow it into that code block (#463).
+- Internal (maintainer-only): the issue-triage tracker now keeps its reconciler ledger in a collapsed disclosure, matching the managed issue comments instead of rendering raw machine-state JSON below the human execution plan (#475).
+- Concurrent first-time commands no longer misclassify a freshly initialized `stats.db` as a database written by a newer cctally. A waiting opener now rechecks the index epoch after acquiring the initialization lock, so it accepts the winner's completed index instead of sending epoch `1006` through the frozen legacy migration dispatcher.
+
 ## [1.90.1] - 2026-08-02
 
 ### Fixed

package/README.md

@@ -30,9 +30,9 @@ Your Claude Code plan meters you with a percentage that creeps up all week. ccta
 </p>
 
 <!-- cctally:latest-stable:begin -->
-**Latest stable: v1.87.1** (2026-07-30)
+**Latest stable: v1.90.1** (2026-08-02)
 
-- Codex session names now remain visible in Recent Sessions when an individual account is selected, whenever transcript visibility is enabled. Selecting an account no longer replaces every session name with an em dash; disabling transcript visibility still hides names in both the all-accounts and focused-account views.
+- Internal (maintainer-only): the public release snapshot no longer ships the issue-triage pytest modules without the private workflow implementation they import. Those tests now stay behind the same mirror boundary as their `.agent-workflows` dependencies, preventing collection failures across the public Python matrix.
 <!-- cctally:latest-stable:end -->
 
 ## Quick start

package/bin/_cctally_core.py

@@ -1648,6 +1648,20 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
     # at `_uv == STATS_INDEX_EPOCH` above and never reaches here, so the hot
     # path takes no exclusive lock at all.
     with _cctally_store.stats_open_time_guard(live=_target_path is None):
+        # Another opener can win the exclusive guard after this connection's
+        # pre-lock epoch read, initialize/cut over the index, and stamp the
+        # current epoch while this opener waits. Recheck under the guard before
+        # acting on that stale legacy/fresh decision; otherwise the loser enters
+        # the frozen migration dispatcher with user_version=1006 and reports a
+        # false downgrade against legacy head 13.
+        if _epoch_engaged and conn.execute(
+            "PRAGMA user_version"
+        ).fetchone()[0] == STATS_INDEX_EPOCH:
+            if _target_path is None:
+                _reconcile_durable_applied_migration_errors(
+                    conn, _STATS_MIGRATIONS, "stats.db"
+                )
+            return conn
         _fixups_current = _cctally_store.stats_open_fixups_current(conn)
         conn.execute(
             """

package/bin/_cctally_dashboard_envelope.py

@@ -41,6 +41,7 @@ import bisect
 import datetime as dt
 import importlib.util as _ilu
 import os
+import sqlite3
 import sys
 from collections.abc import Mapping
 from zoneinfo import ZoneInfo
@@ -329,7 +330,40 @@ def _select_current_block_for_envelope(
 # ``FROM`` clause so the table name lives in the registry, not inlined here.
 
 
-def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
+def _alert_account_resolver(conn: sqlite3.Connection):
+    """Build one snapshot-scoped #345 resolver without per-row DB reads."""
+    import _cctally_account
+
+    decorated = {
+        provider: _cctally_account.provider_is_decorated(conn, provider)
+        for provider in ("claude", "codex")
+    }
+    labels = {
+        provider: _cctally_account.display_label_map(conn, provider)
+        for provider, enabled in decorated.items()
+        if enabled
+    }
+    for provider_labels in labels.values():
+        provider_labels.update({"*": "All accounts", "unattributed": "Unattributed"})
+
+    def fields(provider: str, account_key: object) -> dict[str, str]:
+        if not decorated.get(provider, False):
+            return {}
+        key = str(account_key or "*")
+        label = labels[provider].get(key)
+        if label is None:
+            label = _cctally_account.account_label(conn, key)
+        return {
+            "accountKey": key,
+            "accountLabel": label,
+        }
+
+    return fields
+
+
+def _envelope_rows_weekly(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # ``reset_event_id`` (v1.7.2) segments the same (week, threshold)
     # across pre-credit (0) and post-credit (event.id) cohorts, both
     # of which can be alerted. The envelope id must include the
@@ -340,7 +374,7 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
     rows = conn.execute(
         f"""
         SELECT week_start_date, percent_threshold, captured_at_utc,
-               alerted_at, cumulative_cost_usd, reset_event_id
+               alerted_at, cumulative_cost_usd, reset_event_id, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -360,6 +394,7 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
             "severity": severity_for(threshold),
             "crossed_at": r["captured_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "week_start_date":     r["week_start_date"],
                 "cumulative_cost_usd": cumulative,
@@ -377,7 +412,9 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
     return out
 
 
-def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_five_hour(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Site F (spec §3.2 bucket C / §3.3): widen the row identity to
     # include ``reset_event_id`` so post-credit (seg=event.id) crossings
     # of the same (window_key, threshold) don't collide with pre-credit
@@ -387,10 +424,12 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
     rows = conn.execute(
         f"""
         SELECT m.five_hour_window_key, m.percent_threshold, m.captured_at_utc,
-               m.alerted_at, m.block_cost_usd, m.reset_event_id,
+               m.alerted_at, m.block_cost_usd, m.reset_event_id, m.account_key,
                b.block_start_at
         FROM {descriptor.milestone_table} m
-        LEFT JOIN five_hour_blocks b ON b.five_hour_window_key = m.five_hour_window_key
+        LEFT JOIN five_hour_blocks b
+          ON b.five_hour_window_key = m.five_hour_window_key
+         AND b.account_key = m.account_key
         WHERE m.alerted_at IS NOT NULL
         ORDER BY m.alerted_at DESC
         LIMIT ?
@@ -410,6 +449,7 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
             "severity":    severity_for(threshold),
             "crossed_at":  r["captured_at_utc"],
             "alerted_at":  r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "five_hour_window_key": int(r["five_hour_window_key"]),
                 "block_start_at":       r["block_start_at"] or "",
@@ -420,7 +460,9 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
     return out
 
 
-def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_budget_family(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Unified vendor-tagged budget axis (#143). ONE mapper backs BOTH the
     # ``budget`` (``vendor='claude'``, issue #19) and ``codex_budget``
     # (``vendor='codex'``, calendar-period-codex-budgets spec §6) axes —
@@ -461,7 +503,7 @@ def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[
         SELECT period_start_at,
                COALESCE(period, ?) AS period,
                threshold, crossed_at_utc, alerted_at,
-               budget_usd, spent_usd, consumption_pct
+               budget_usd, spent_usd, consumption_pct, account_key
         FROM {descriptor.milestone_table}
         WHERE vendor = ? AND alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -498,12 +540,15 @@ def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields(str(vendor), r["account_key"]),
             "context":    ctx,
         })
     return out
 
 
-def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_projected(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Fourth axis (issue #121): projected-pace threshold crossings. Like
     # budget, projected alerts re-anchor ``week_start_at`` on a mid-week
     # reset, so there is NO ``reset_event_id`` segment — the new window gets
@@ -524,7 +569,7 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
         SELECT week_start_at,
                COALESCE(period, 'subscription-week') AS period,
                metric, threshold, projected_value,
-               denominator, crossed_at_utc, alerted_at
+               denominator, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -547,6 +592,10 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields(
+                "codex" if metric == "codex_budget_usd" else "claude",
+                r["account_key"],
+            ),
             "context": {
                 "week_start_at":   r["week_start_at"],
                 "metric":          metric,
@@ -557,7 +606,9 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
     return out
 
 
-def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_project_budget(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Fifth axis (issue #19 / #121): PER-PROJECT equiv-$ budget threshold
     # crossings. Like the global budget axis, project-budget alerts re-anchor
     # ``week_start_at`` on a mid-week reset, so there is NO ``reset_event_id``
@@ -575,7 +626,7 @@ def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list
     rows = conn.execute(
         f"""
         SELECT week_start_at, project_key, threshold, budget_usd, spent_usd,
-               consumption_pct, crossed_at_utc, alerted_at
+               consumption_pct, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -605,6 +656,7 @@ def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "week_start_at":   r["week_start_at"],
                 "project":         label_by_key.get(project_key, project_key),
@@ -795,12 +847,15 @@ def _build_alerts_envelope_array(
     c = sys.modules["cctally"]
     registry = c.AXIS_REGISTRY
     severity_for = c.severity_for
+    account_fields = _alert_account_resolver(conn)
     out: list[dict] = []
     for descriptor in registry:
         mapper = _ENVELOPE_AXIS_MAPPERS.get(descriptor.id)
         if mapper is None:  # pragma: no cover - registry/mapper drift guard
             continue
-        out.extend(mapper(conn, descriptor, limit, severity_for))
+        out.extend(mapper(
+            conn, descriptor, limit, severity_for, account_fields,
+        ))
 
     # Python's list.sort is stable. When two alerts share the same
     # `alerted_at` ISO string (rare; multiple axes firing within the same

package/bin/_cctally_dashboard_sources.py

@@ -2422,9 +2422,29 @@ def _alerts_wire(
     so it stays visible under focus and the client labels it as vendor-wide.
     """
     rows: list[dict[str, object]] = []
+    if decorated:
+        import _cctally_account
+
+        account_labels = _cctally_account.display_label_map(stats_conn, "codex")
+        account_labels.update({"*": "All accounts", "unattributed": "Unattributed"})
+    else:
+        account_labels = {}
 
     def _account(value: object) -> dict[str, object]:
-        return {"account_key": str(value or _CODEX_VENDOR_WIDE_ACCOUNT)} if decorated else {}
+        if not decorated:
+            return {}
+
+        key = str(value or _CODEX_VENDOR_WIDE_ACCOUNT)
+        label = account_labels.get(key)
+        if label is None:
+            label = _cctally_account.account_label(stats_conn, key)
+        return {
+            # Retained as the internal account-scope selector used by the
+            # source-state builder; the camel fields are the public #345 wire.
+            "account_key": key,
+            "accountKey": key,
+            "accountLabel": label,
+        }
 
     try:
         for period, threshold, consumption_pct, crossed_at, account_key in stats_conn.execute(
@@ -2880,6 +2900,12 @@ def _codex_accounts_wire(
         }
         if is_unattributed:
             card["unattributed"] = True
+        elif cyc is not None and cyc.evidence_stale:
+            # #360 / #416 closeout: freshness belongs to the account whose
+            # resolved cycle supplied the card. The aggregate hero marker
+            # cannot speak for a fresh sibling, and staleness is disclosure
+            # only — the retained percentage, reset and spend remain useful.
+            card["cycleFreshness"] = "stale"
         accounts_wire.append(card)
         if cyc is not None and not is_unattributed:
             hero_cycles_wire.append({

package/bin/_lib_cache_report_wire.py

@@ -6,7 +6,7 @@ shared key set, which is how the Codex empty return and its populated
 return drifted apart (#443 F18).
 
 Provider parameterization resolves exactly four things and nothing else:
-the percent key(s), whether the not-applicable metadata is emitted, the
+the percent key, whether the not-applicable metadata is emitted, the
 applicable predicate set, and the reason text. Everything else is
 provider-independent by construction.
 
@@ -31,15 +31,8 @@ ALL_PREDICATES = tuple(
 
 # Codex figures that are structurally absent rather than unmeasured.
 # OpenAI charges no cache-write premium, so there is nothing to waste and
-# therefore no ratio of saved to wasted. The VALUES stay numeric through
-# the transition release (a pre-S2 tab calls .toFixed on the first and
-# Math.round on the second); this map is the authoritative signal a
-# current client renders from.
-#
-# Switching these to None, removing the transitional `cache_hit_percent`
-# in _percent, and bumping SOURCE_SCHEMA_VERSION to 4 are ONE release's
-# work, tracked in cctally-dev#465. Doing any of them alone reintroduces
-# the stale-tab crash this retention exists to avoid.
+# therefore no ratio of saved to wasted. Their values are None on the Codex
+# wire; this map remains the authoritative user-facing reason.
 CODEX_NOT_APPLICABLE = {
     "wasted_usd": "OpenAI charges no cache-write premium, so Codex has no wasted-cache figure.",
     "fourteen_day_efficiency_ratio": "Efficiency compares saved against wasted, and Codex has no wasted-cache figure.",
@@ -82,16 +75,10 @@ def filter_inapplicable(provider, row):
 
 
 def _percent(provider, row):
-    """Emit the percent key(s) for one row-shaped mapping.
-
-    Codex dual-publishes: `cached_input_percent` is authoritative and
-    `cache_hit_percent` carries the identical value for one release, so a
-    tab that spans a `cctally update` keeps reading a true number instead
-    of `Math.floor(NaN)`.
-    """
+    """Emit the provider-authoritative percent key for one row mapping."""
     value = row["cache_hit_percent"]
     if provider == "codex":
-        return {"cached_input_percent": value, "cache_hit_percent": value}
+        return {"cached_input_percent": value}
     return {"cache_hit_percent": value}
 
 
@@ -104,7 +91,7 @@ def _today_block(provider, today):
         "delta_pp": today["delta_pp"],
         "net_usd": today["net_usd"],
         "saved_usd": today["saved_usd"],
-        "wasted_usd": today["wasted_usd"],
+        "wasted_usd": None if provider == "codex" else today["wasted_usd"],
         "anomaly_triggered": today["anomaly_triggered"],
         "anomaly_reasons": list(today["anomaly_reasons"]),
         "baseline_daily_row_count": today["baseline_daily_row_count"],
@@ -124,7 +111,7 @@ def _day_block(provider, d):
         "cache_creation_tokens": d["cache_creation_tokens"],
         "cache_read_tokens": d["cache_read_tokens"],
         "saved_usd": d["saved_usd"],
-        "wasted_usd": d["wasted_usd"],
+        "wasted_usd": None if provider == "codex" else d["wasted_usd"],
         "net_usd": d["net_usd"],
         "anomaly_triggered": d["anomaly_triggered"],
         "anomaly_reasons": list(d["anomaly_reasons"]),
@@ -171,6 +158,7 @@ def build_cache_report_wire(
         "is_empty": is_empty,
     }
     if provider == "codex":
+        out["fourteen_day_efficiency_ratio"] = None
         out["not_applicable"] = dict(CODEX_NOT_APPLICABLE)
         out["anomaly_predicates"] = list(CODEX_PREDICATES)
         # The caller counted anomalies BEFORE inapplicable predicates were

package/bin/_lib_codex_conversation.py

@@ -1498,6 +1498,38 @@ def normalize_codex_events(
 # ── mirror pairing + canonical items (§5.3 / §5.2) ────────────────────────────
 
 
+_REASONING_WS_RE = re.compile(r"\s+")
+
+
+def _reasoning_projected_text(row: CodexNormalizedRow) -> str:
+    """Normalized projected text of one reasoning row, or ``""``.
+
+    Read from the STORED projection in ``detail_json``, never from
+    ``search_thinking``: that column is capped at 16,000 characters and a
+    response item stores ``summary + "\\n" + body`` in it, so it cannot
+    distinguish a title from a title-plus-body.
+
+    Normalization drops the bold wrapper and collapses whitespace, because the
+    two extraction paths disagree about both. A ``response_item`` aggregate
+    keeps its parts' ``**`` wrappers inside one ``summary`` string, while an
+    ``event_msg`` part whose text matches the title pattern has already had its
+    wrapper stripped into ``title``.
+    """
+    if not row.detail_json:
+        return ""
+    try:
+        detail = json.loads(row.detail_json)
+    except (json.JSONDecodeError, TypeError):
+        return ""
+    reasoning = detail.get("reasoning") if isinstance(detail, dict) else None
+    if not isinstance(reasoning, dict):
+        return ""
+    head = reasoning.get("title") or reasoning.get("summary") or ""
+    body = reasoning.get("body") or ""
+    joined = "\n".join(part for part in (head, body) if part)
+    return _REASONING_WS_RE.sub(" ", joined.replace("**", "")).strip()
+
+
 def _pair_mirrors_impl(
     rows: list[CodexNormalizedRow],
 ) -> tuple[set[int], dict[int, int]]:
@@ -1544,6 +1576,82 @@ def _pair_mirrors_impl(
                 paired_response.add(prev_idx)
         last_prose_by_kind[row.kind] = j
 
+    # Reasoning containment (#463 S1 / F5). Exact-digest pairing structurally
+    # cannot collapse the general reasoning case: a response_item reasoning
+    # row's identity is `"\n".join([summary, body])` while an event_msg
+    # agent_reasoning row's is the raw single string, and the two coincide only
+    # when the body is empty and the raw text equals the summary exactly. The
+    # real relation is containment — one aggregate carries the parts that each
+    # arrived earlier as their own event.
+    #
+    # Measured against the production store on 2026-08-02: of 17,149 turned
+    # event_msg reasoning rows, 4,883 already pair by exact digest and ALL
+    # 12,266 that survive are contained in exactly one same-turn aggregate, with
+    # no orphans and nothing present-but-not-contained.
+    #
+    # This runs BESIDE the exact-digest passes rather than replacing them, so no
+    # other mirror kind's behaviour changes. Three properties make it safe, and
+    # each answers a concrete way a simpler rule would delete real content:
+    #
+    #   * Per-aggregate, never concatenated. Concatenating a turn's aggregates
+    #     admits a match spanning the boundary between two unrelated ones, which
+    #     would suppress a part no aggregate actually contains.
+    #   * Multiset, not set. An aggregate covers each occurrence of a part once.
+    #     Two identical events must not both fold onto an aggregate that carries
+    #     that text once — and an aggregate already claimed by the exact-digest
+    #     pass above has that occurrence spent, which is why `used` is seeded
+    #     from `partners`.
+    #   * An explicit partner. `pair_mirror_partners` is the contract search and
+    #     find rely on to map a suppressed row to its canonical survivor, so a
+    #     containment match names WHICH aggregate owns it — something a
+    #     concatenated match could not do.
+    #
+    # A turn with no aggregate loses nothing, and a part genuinely contained in
+    # none is retained.
+    reasoning_turns: dict[str, dict[str, list[int]]] = {}
+    for i, row in enumerate(rows):
+        if row.kind != "reasoning" or row.turn_id is None:
+            continue
+        group = reasoning_turns.setdefault(row.turn_id, {"R": [], "E": []})
+        group["E" if row.record_family == "event_msg" else "R"].append(i)
+    for group in reasoning_turns.values():
+        if not group["R"]:
+            continue
+        aggregates = [(index, _reasoning_projected_text(rows[index]), {})
+                      for index in group["R"]]
+        # An aggregate the exact-digest pass already paired has spent one
+        # occurrence of its own text; seed that so the two passes share one
+        # budget instead of each spending it independently.
+        spent = {index for index in partners.values()}
+        for index, text, used in aggregates:
+            if index in spent and text:
+                used[text] = used.get(text, 0) + 1
+        for event_index in group["E"]:
+            if event_index in suppressed:
+                continue
+            part = _reasoning_projected_text(rows[event_index])
+            if not part:
+                continue
+            # Physical order decides, so the earliest aggregate that still has
+            # capacity for this part owns it. An aggregate whose whole text IS
+            # the part is preferred over one that merely contains it, because it
+            # is the more accurate survivor for a search hit to land on.
+            owner = None
+            for index, text, used in aggregates:
+                if text.count(part) <= used.get(part, 0):
+                    continue
+                if owner is None:
+                    owner = (index, text, used)
+                if text == part:
+                    owner = (index, text, used)
+                    break
+            if owner is None:
+                continue
+            index, _text, used = owner
+            used[part] = used.get(part, 0) + 1
+            suppressed.add(event_index)
+            partners[event_index] = index
+
     return suppressed, partners