cctally 1.91.0 → 1.92.1

package/bin/_lib_codex_conversation_query.py

@@ -12,22 +12,44 @@ the caller at its I/O boundary, never here (§5.4).
 Public names imported verbatim by the S7 dispatch layer — do not rename:
 ``codex_normalization_authoritative``, ``codex_item_key``,
 ``get_codex_conversation``, ``get_codex_conversation_outline``,
-``list_codex_conversations``, ``search_codex_conversations``,
+``list_codex_conversations``, ``list_codex_conversation_facets``,
+``search_codex_conversations``,
 ``CODEX_SEARCH_KINDS``.
 """
 from __future__ import annotations
 
+import base64
+import binascii
+import collections
+import contextlib
 import hashlib
 import json
 import os
 import re
 import sqlite3
+import threading
+from collections import deque
 
 import _lib_codex_conversation as kern
+import _lib_codex_landmarks as landmarks
 import _lib_codex_segments as segkern
-from _lib_codex_reasoning_headings import decompose_reasoning_headings
+from _lib_codex_find_projection import (
+    CODEX_FIND_PROJECTION_VERSION,
+    ProjectedLeaf,
+    RenderLeaf,
+    iter_literal_ranges,
+    iter_regex_ranges,
+    literal_ranges,
+    project_context,
+    project_markdown,
+    project_plain,
+    regex_ranges,
+    slice_range_to_leaves,
+)
+from _lib_codex_title_clean import clean_codex_title
 from _lib_conversation import _strip_ansi
-from _lib_conversation_query import _FULL_PAYLOAD_CEILING, _first_nonblank_line
+from _lib_conversation_query import (
+    _FULL_PAYLOAD_CEILING, _first_nonblank_line, _parse_outline_ts)
 from _lib_pricing import _calculate_codex_entry_cost
 
 # ── constants ────────────────────────────────────────────────────────────────
@@ -389,6 +411,59 @@ def _load_rows_at_positions(
     return hydrated
 
 
+def _iter_row_payloads(
+    conn: sqlite3.Connection, conversation_key: str, positions=None,
+):
+    """Yield ``(position, record_type, payload)`` for retained physical payloads.
+
+    ONE copy of the event-table read: the per-source-path chunking, the bound
+    ``IN (…)`` construction, the defensive re-filter and the
+    ``{"payload": …}`` unwrap. ``_load_row_payloads`` collects this into a dict
+    and ``_derive_outline_events`` consumes it one row at a time, which is the
+    only difference between them — duplicating the read to get the streaming
+    form would mean a later correction to the unwrap or the chunking has to be
+    made twice, and the second is easy to miss.
+
+    ``positions`` scopes the read to a known set (#463 S1, Phase C). Passing
+    ``None`` reads the whole conversation, which the export path still wants and
+    which #463 S4 §4.1 forbids on the outline route.
+
+    A row whose ``payload_json`` does not parse, or whose ``payload`` member is
+    not an object, yields nothing — the caller therefore sees no entry for that
+    position rather than an empty one.
+    """
+    def _batches():
+        """One cursor per bound chunk, opened only when its turn comes."""
+        if positions is None:
+            yield conn.execute(
+                "SELECT source_path,line_offset,record_type,payload_json "
+                "FROM codex_conversation_events WHERE conversation_key = ?",
+                (conversation_key,)), None
+            return
+        scope = set(positions)
+        for path, chunks in _chunk_positions(scope).items():
+            for chunk in chunks:
+                yield conn.execute(
+                    "SELECT source_path,line_offset,record_type,payload_json "
+                    "FROM codex_conversation_events "
+                    "WHERE conversation_key = ? AND source_path = ? "
+                    f"AND line_offset IN ({','.join('?' for _ in chunk)})",
+                    (conversation_key, path, *chunk)), scope
+
+    for cursor, wanted in _batches():
+        for source_path, line_offset, record_type, payload_json in cursor:
+            position = (source_path, line_offset)
+            if wanted is not None and position not in wanted:
+                continue
+            try:
+                obj = json.loads(payload_json or "{}")
+            except (json.JSONDecodeError, TypeError):
+                continue
+            payload = obj.get("payload") if isinstance(obj, dict) else None
+            if isinstance(payload, dict):
+                yield position, record_type, payload
+
+
 def _load_row_payloads(
     conn: sqlite3.Connection, conversation_key: str, positions=None,
 ) -> dict[tuple[str, int], tuple[str | None, dict]]:
@@ -401,42 +476,198 @@ def _load_row_payloads(
     ``positions`` scopes the read to one page (#463 S1, Phase C). Passing None
     keeps the whole-conversation behaviour, which the export path still wants.
     """
-    result: dict[tuple[str, int], tuple[str | None, dict]] = {}
-    if positions is None:
-        cursor = conn.execute(
-            "SELECT source_path,line_offset,record_type,payload_json "
-            "FROM codex_conversation_events WHERE conversation_key = ?",
-            (conversation_key,))
-        rows = list(cursor)
-    else:
-        wanted = set(positions)
-        rows = []
-        for path, chunks in _chunk_positions(wanted).items():
-            for chunk in chunks:
-                marks = ",".join("?" for _ in chunk)
-                rows.extend(
-                    row for row in conn.execute(
-                        "SELECT source_path,line_offset,record_type,payload_json "
-                        "FROM codex_conversation_events "
-                        "WHERE conversation_key = ? AND source_path = ? "
-                        f"AND line_offset IN ({marks})",
-                        (conversation_key, path, *chunk))
-                    if (row[0], row[1]) in wanted)
-    for source_path, line_offset, record_type, payload_json in rows:
-        try:
-            obj = json.loads(payload_json or "{}")
-        except (json.JSONDecodeError, TypeError):
-            continue
-        payload = obj.get("payload") if isinstance(obj, dict) else None
-        if isinstance(payload, dict):
-            result[(source_path, line_offset)] = (record_type, payload)
-    return result
+    return {
+        position: (record_type, payload)
+        for position, record_type, payload
+        in _iter_row_payloads(conn, conversation_key, positions)
+    }
 
 
 def _row_payload(row, payloads: dict) -> tuple[str | None, dict] | None:
     return payloads.get((row.source_path, row.line_offset))
 
 
+# The three lifecycle events that carry an outcome the §6.4 classification reads.
+# A `tool_output` row is the fourth source and is selected by `kind`, not by
+# event type, because it is a response item rather than an event.
+_S4_OUTCOME_EVENTS = frozenset(
+    {"patch_apply_end", "web_search_end", "mcp_tool_call_end"})
+
+
+# ── the outline derivation cache (#463 S4, D2's fallback) ────────────────────
+#
+# Task 11's re-measurement breached §4.7's first ceiling. On the heaviest
+# production conversation the warm outline costs 332 ms, of which the event
+# payload pass is 242 ms, against 229 ms for the detail page that opens beside
+# it — so the outline HAD become the critical path on open, and the route is
+# refetched on every live-tail growth push. §4.7 says a breach escalates to D2's
+# fallback inside the session rather than deferring it, and this is that.
+#
+# **Why a position-keyed cache is sound.** A derivation entry is keyed by
+# ``(source_path, line_offset)`` — a byte offset into an append-only rollout
+# file. A line at a given offset is immutable, so the verdict for a position
+# cannot change while the row exists, and a re-ingest rewrites the same bytes at
+# the same offsets. The cache therefore EXTENDS on append rather than only
+# hitting or missing: a growth push decodes the newly-in-scope positions and
+# reuses every earlier one.
+#
+# **What the watermark is for.** Immutability covers append; it does not cover
+# DELETION, and a deleted event row is exactly the case where the outline must
+# stop reporting a verdict it can no longer support. The stored watermark is the
+# cached prefix's ``(row count, max id)``, and reuse requires the count of rows
+# still at ``id <= max id`` to equal it. Ids are ``AUTOINCREMENT`` and only
+# increase, so no later insert can land inside that prefix — a preserved count
+# therefore proves no row of the prefix was deleted. The check is one covering
+# index read, measured at 0.18 ms on a conversation with 5,950 event rows.
+#
+# **Absence stays absence.** A position that was in scope and produced no entry
+# — payload gone, unparseable, or a shape no decoder recognises — is recorded as
+# covered and is not retried. That is deliberate: ``_outline_error_count`` reads
+# absence as the third state "could not classify", and a payload does not appear
+# later at an offset it was missing from.
+#
+# In-process only, so no cross-version staleness is possible: the binary that
+# filled an entry is the binary that reads it.
+_OUTLINE_DERIVATION_CACHE_MAX = 4
+_outline_derivation_cache: "collections.OrderedDict[str, dict]" = (
+    collections.OrderedDict())
+_outline_derivation_lock = threading.Lock()
+
+
+def reset_outline_derivation_cache() -> None:
+    """Drop every cached derivation. For tests and for measurement runs."""
+    with _outline_derivation_lock:
+        _outline_derivation_cache.clear()
+
+
+def _outline_event_watermark(
+    conn: sqlite3.Connection, conversation_key: str, prefix_max_id: int | None,
+) -> tuple[int, int | None, int]:
+    """``(row count, max id, rows still at id <= prefix_max_id)`` in one read."""
+    count, max_id, prefix = conn.execute(
+        "SELECT COUNT(*), MAX(id), COALESCE(SUM(id <= ?), 0) "
+        "FROM codex_conversation_events WHERE conversation_key = ?",
+        (prefix_max_id if prefix_max_id is not None else -1, conversation_key),
+    ).fetchone()
+    return count, max_id, prefix
+
+
+def _derive_outline_events(
+    conn: sqlite3.Connection, conversation_key: str, rows: list,
+) -> landmarks.EventDerivation:
+    """The outline's read-time pass over the retained payloads (#463 S4, §4.1).
+
+    SCOPED and STREAMING, and Task 1 measured both halves of that on the
+    production store rather than assuming them.
+
+    *Scoped*: the position set comes from ``rows`` — the wide
+    ``codex_conversation_messages`` read the outline has already performed — so
+    the pass never selects an event row no landmark can come from. That is the
+    idiom ``get_codex_conversation`` already uses two call sites above.
+    ``positions=None`` would decode every event row of the conversation, which on
+    the heaviest one is 92.1 MB of JSON. Measured, scoping is worth 24% of that
+    read (109-122 ms and 183.1 MB of Python heap against 160 ms and 211.7 MB) —
+    real, but far less than the spec's framing implies, because 93.7% of that
+    conversation's payload bytes ARE the rows S4 needs. Do not treat scoping as
+    having solved the cost.
+
+    *Streaming*: each payload is decoded to the small fact the outline wants and
+    then dropped, rather than being retained in a dict the way
+    ``_load_row_payloads`` retains it. Both go through the one
+    ``_iter_row_payloads`` read; retaining is the only thing that differs.
+    Measured like for like — load AND decode,
+    to completion — the retaining form costs 254 ms and 182.9 MB of Python heap
+    on the heaviest conversation and this one costs 232 ms and 22.7 MB. That is
+    9% faster and 8x less memory, and peak RSS is in scope for §4.7's gate
+    precisely because this route is refetched on every live-tail growth push
+    rather than once per open.
+
+    Read-time only. Every decoder call takes ``for_storage=False`` and nothing
+    here is written back.
+    """
+    outcomes: dict[tuple[str, int], object] = {}
+    headings_wanted: dict[tuple[str, int], object] = {}
+    for row in rows:
+        position = (row.source_path, row.line_offset)
+        if row.kind == "tool_output":
+            outcomes[position] = "output"
+        elif row.kind == "event" and row.event_type in _S4_OUTCOME_EVENTS:
+            outcomes[position] = row.event_type
+        elif row.kind == "reasoning":
+            # The same stored-detail gate `_reasoning_headings` applies, so the
+            # outline's headings are the set the reader route publishes and not
+            # a second, wider one.
+            detail = _parse_detail(row.detail_json)
+            if isinstance(detail, dict) and isinstance(detail.get("reasoning"), dict):
+                headings_wanted[position] = True
+    wanted = set(outcomes) | set(headings_wanted)
+    derivation = landmarks.EventDerivation()
+    if not wanted:
+        return derivation
+
+    with _outline_derivation_lock:
+        entry = _outline_derivation_cache.get(conversation_key)
+    count, max_id, prefix = _outline_event_watermark(
+        conn, conversation_key, entry["max_id"] if entry else None)
+    reusable = (entry is not None
+                and entry["count"] == prefix
+                and count >= entry["count"])
+    covered: set = set()
+    if reusable:
+        covered = entry["covered"]
+        derivation.errors_by_position.update(entry["derivation"].errors_by_position)
+        derivation.patch_files_by_position.update(
+            entry["derivation"].patch_files_by_position)
+        derivation.headings_by_position.update(
+            entry["derivation"].headings_by_position)
+    missing = wanted - covered
+
+    for position, _record_type, payload in (
+            _iter_row_payloads(conn, conversation_key, missing) if missing else ()):
+        kind = outcomes.get(position)
+        if kind == "output":
+            decoded = kern.decode_tool_output_card(payload, for_storage=False)
+            if decoded is not None:
+                derivation.errors_by_position[position] = (
+                    landmarks.classify_tool_failure(
+                        {"terminal_output": decoded[0]}))
+        elif kind == "patch_apply_end":
+            card = kern.decode_patch_event_card(payload, for_storage=False)
+            if card is not None:
+                derivation.errors_by_position[position] = (
+                    landmarks.classify_tool_failure({"patch": card}))
+            # Counted from the UNBOUNDED raw `changes`, not off the card above,
+            # whose shared 16,000-character budget silently undercounts a large
+            # diff (§4.5).
+            derivation.patch_files_by_position[position] = (
+                landmarks.patch_file_touches(payload))
+        elif kind in _S4_OUTCOME_EVENTS:
+            card = kern.decode_secondary_event_card(payload)
+            if card is not None:
+                family = "web" if kind == "web_search_end" else "mcp"
+                derivation.errors_by_position[position] = (
+                    landmarks.classify_tool_failure(
+                        {family: {"completion": card}}))
+        if position in headings_wanted:
+            texts = landmarks.reasoning_heading_texts(payload)
+            if texts:
+                derivation.headings_by_position[position] = texts
+
+    # Stored AFTER the pass, so a raising derivation leaves the previous entry
+    # rather than a half-filled one. The value is the object just returned: it
+    # is never mutated again, because the next extension copies its three maps
+    # into a fresh `EventDerivation` above rather than adding to this one.
+    with _outline_derivation_lock:
+        _outline_derivation_cache[conversation_key] = {
+            "count": count, "max_id": max_id,
+            "covered": covered | wanted, "derivation": derivation,
+        }
+        _outline_derivation_cache.move_to_end(conversation_key)
+        while len(_outline_derivation_cache) > _OUTLINE_DERIVATION_CACHE_MAX:
+            _outline_derivation_cache.popitem(last=False)
+    return derivation
+
+
 def _row_display(row) -> str:
     """The row's display/search text from whichever column carries it."""
     return row.text or row.search_thinking or row.search_tool or ""
@@ -470,6 +701,50 @@ def _item_kind(item: dict) -> str:
     return item["anchor_row"].kind  # unturned: the row's own provider kind
 
 
+def _item_model(item: dict) -> str | None:
+    """The model a canonical tier-1 item states, or ``None`` (§4.2).
+
+    The anchor row first, then the item's own rows in order. Reading the anchor
+    row ALONE under-reported Codex model usage about sixfold: most Codex
+    response items anchor on a ``reasoning`` row, which carries no model, so a
+    conversation with 13 outline turns holding assistant rows and 82 assistant
+    rows in total rendered ``gpt-5.6-sol x2``, and 182 of 200 Codex
+    conversations in the production store reported a model total under a third
+    of their turn count. §4.2 defines the counting unit as the canonical tier-1
+    assistant TURN, mirroring the Claude side, whose histogram sums to exactly
+    ``stats.turns.assistant``; the anchor row is one row of that turn.
+    """
+    anchor = item["anchor_row"].model
+    if anchor:
+        return anchor
+    for row in item["rows"]:
+        if row.model:
+            return row.model
+    return None
+
+
+def _outline_outcome_positions(rows: list) -> set:
+    """Every position whose row could carry an outcome verdict this request."""
+    return {(row.source_path, row.line_offset) for row in rows
+            if row.kind == "tool_output"
+            or (row.kind == "event" and row.event_type in _S4_OUTCOME_EVENTS)}
+
+
+def _outline_failing_calls(derivation, outcome_positions: set,
+                           call_by_position: dict) -> set:
+    """The calls this request found failing, charged to the call they fold into.
+
+    Intersected with ``outcome_positions`` because ``errors_by_position`` is
+    CACHED: the derivation is retained per conversation and EXTENDED on a
+    growth push, so the map can hold verdicts for positions the current request
+    never read, while every other consumer indexes it by a current position.
+    Defensive rather than a reproduction of an observed miscount.
+    """
+    return {call_by_position.get(position, position)
+            for position in derivation.failing_positions()
+            if position in outcome_positions}
+
+
 def _item_meta(item: dict) -> dict | None:
     if item["klass"] != "meta":
         return None
@@ -518,37 +793,163 @@ def _reasoning_headings(detail, payload, block_key: str):
     returns ``None`` and the caller omits the field entirely, so the client falls
     back to today's ``title``/``summary`` rendering. Decomposition never fails the
     request and never partially populates.
+
+    #463 S4 — the summary parse itself moved to
+    ``_lib_codex_landmarks.reasoning_heading_texts``, so the reader route here
+    and the outline's landmark derivation decompose by ONE rule. This function
+    keeps the two things the outline does not want: the stored-detail gate, and
+    the ``<block_key>#<ordinal>`` identity, which the outline mints from its own
+    block keys rather than from the reader's.
     """
     if not isinstance(detail, dict) or not isinstance(detail.get("reasoning"), dict):
         return None
-    if not isinstance(payload, dict):
-        return None
-    summary = payload.get("summary")
-    if not isinstance(summary, list) or not summary:
-        return None
-    entries = []
-    for entry in summary:
-        if not isinstance(entry, dict):
-            return None
-        text = entry.get("text")
-        # Mirror `_join_content_texts`, which is what produced the stored
-        # summary: it keeps non-empty string `text` leaves and ignores the rest.
-        if text is None:
-            continue
-        if not isinstance(text, str):
-            return None
-        if text:
-            entries.append(text)
-    headings = decompose_reasoning_headings(entries)
+    headings = landmarks.reasoning_heading_texts(payload)
     if not headings:
         return None
     return [{"key": f"{block_key}#{ordinal}", "text": text}
             for ordinal, text in enumerate(headings)]
 
 
+# ── the conversation-level session index (#463 S3, spec section 3.2) ─────────
+#
+# Page-local adaptation cannot decide whether a session label is unique across
+# the conversation or whether an opener exists, because later pages adapt
+# independently and live-tail can append. So the server publishes a bounded
+# conversation-scoped index and the client never computes either fact itself.
+#
+# 870 sessions across 223 conversations, roughly four per conversation, so this
+# cap is generous. A conversation past it publishes what fits and marks itself
+# truncated rather than publishing a partial map that looks complete.
+_SESSION_INDEX_MAX = 64
+
+
+def _stored_write_stdin_session(detail) -> str | None:
+    """The session id a `write_stdin` call names, from its STORED arguments.
+
+    Phase A must not load event payloads, and it does not need to: `detail.args`
+    is in the narrow index, and it is the provider's own argument JSON.
+    """
+    if not isinstance(detail, dict) or detail.get("name") != "write_stdin":
+        return None
+    args = detail.get("args")
+    if not isinstance(args, str) or not args:
+        return None
+    try:
+        parsed = json.loads(args)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        return None
+    raw = parsed.get("session_id") if isinstance(parsed, dict) else None
+    if isinstance(raw, bool) or not isinstance(raw, (str, int)):
+        return None
+    return str(raw)
+
+
+def _stored_session_announcement(detail) -> str | None:
+    """The session id a tool output ANNOUNCES, from its stored card.
+
+    `Process running with session ID <id>` is the evidence linking a shell
+    session to the call that opened it — 698 of 870 sessions, 80.2%. The line is
+    read through the same anchored preamble reader the card path uses rather than
+    by searching the text, so a user's own output cannot be mistaken for one.
+
+    Spec section 3.2 names `search_tool` as the column this comes from. It is
+    read from the stored card in `detail_json` instead, which carries the same
+    bytes at the head of its first part and IS in the narrow index —
+    `_load_conversation_index_rows` excludes `search_tool` along with the other
+    two bulk columns, and adding it back would undo S1's Phase A saving.
+    """
+    card = detail.get("card") if isinstance(detail, dict) else None
+    if not isinstance(card, dict) or card.get("type") != "terminal_output":
+        return None
+    parts = card.get("parts")
+    if not isinstance(parts, list) or not parts:
+        return None
+    head = parts[0]
+    text = head.get("text") if isinstance(head, dict) else None
+    if not isinstance(text, str):
+        return None
+    parsed = kern.parse_harness_preamble(text)
+    return parsed[0]["session_announcement"] if parsed is not None else None
+
+
+def _build_session_index(rows) -> tuple[dict, dict[str, str]]:
+    """``(envelope, ordinal_by_provider_session_id)`` over the WHOLE conversation.
+
+    Ordinals are assigned in first-appearance order over the conversation's
+    physical row order, so they are stable across pages and live-tail appends and
+    no client-side uniqueness decision is made from a partial window.
+
+    The envelope's `sessions` map is keyed by the ordinal in decimal, which is
+    exactly what a `session_ref` card's `ref` carries, so the client's lookup is
+    direct. Nothing in the envelope is derived from the provider's own session
+    id — that token is removed rather than scrubbed (spec section 4.3).
+    """
+    owners: dict[str, list] = {}
+    for row in rows:
+        if row.kind == "tool_call" and row.call_id:
+            owners.setdefault(row.call_id, []).append(row)
+    ordinals: dict[str, int] = {}
+    openers: dict[str, str | None] = {}
+    truncated = False
+    for row in rows:
+        session = None
+        opener_row = None
+        detail = _parse_detail(row.detail_json)
+        if row.kind == "tool_call":
+            session = _stored_write_stdin_session(detail)
+        elif row.kind == "tool_output":
+            session = _stored_session_announcement(detail)
+            if session is not None:
+                # The opener is the CALL that owns the announcing output, not the
+                # output row: a uniquely-owned output folds into its call and has
+                # no block of its own, so its key would name nothing on the page.
+                owning = owners.get(row.call_id or "", [])
+                opener_row = owning[0] if len(owning) == 1 else row
+        if session is None:
+            continue
+        if session not in ordinals:
+            if len(ordinals) >= _SESSION_INDEX_MAX:
+                truncated = True
+                continue
+            ordinals[session] = len(ordinals) + 1
+            openers[session] = None
+        if opener_row is not None and openers.get(session) is None:
+            openers[session] = _block_key_for_row(opener_row)
+    envelope = {
+        "sessions": {
+            str(ordinal): {"ordinal": ordinal,
+                           "opener_block_key": openers.get(session)}
+            for session, ordinal in ordinals.items()
+        },
+        "truncated": truncated,
+    }
+    return envelope, {session: str(ordinal) for session, ordinal in ordinals.items()}
+
+
+def _apply_session_ordinals(card, ordinals: dict[str, str]) -> None:
+    """Replace every SHELL session reference with its conversation-local ordinal.
+
+    Fails closed: a reference the index does not know becomes ``None`` rather
+    than falling back to the provider's id. `cell` scope is left alone — a cell
+    id is a small per-conversation sandbox ordinal that identifies nothing
+    outside the sandbox, and it is never presented as a shell session.
+    """
+    if not isinstance(card, dict):
+        return
+    if card.get("type") == "session_ref" and card.get("scope") == "shell":
+        card["ref"] = ordinals.get(card.get("ref"))
+        return
+    if card.get("type") == "program":
+        for entry in card.get("invocations") or []:
+            if (isinstance(entry, dict) and entry.get("kind") == "session"
+                    and entry.get("scope") == "shell"):
+                entry["ref"] = ordinals.get(entry.get("ref"))
+
+
 def _item_blocks_with_rows(
     item: dict, payloads: dict | None = None, *, preserve_marker_text: bool = False,
     call_owner_count: dict | None = None, decompose_headings: bool = False,
+    session_ordinals: dict[str, str] | None = None,
 ) -> list[list]:
     """Assemble an item's blocks (the historical ``_build_item_blocks`` behaviour)
     AND expose each block's underlying rows, so the detail renderer and the payload
@@ -597,11 +998,28 @@ def _item_blocks_with_rows(
                 text = kern._join_content_texts(payload.get("content"))
             elif retained[0] == "event_msg":
                 text = kern._stringify(payload.get("message"))
+        if r.kind == "assistant":
+            # #463 S3 section 5.5. Read-time detection over the row's own stored
+            # text, so it reaches every historical marker with no payload load.
+            # It is written to `external_call` and never to `markers`, which
+            # selects export payload hydration.
+            external = kern._external_call_from_text(text)
+            # Fail closed on the span: it is published as offsets into the very
+            # string served as `block["text"]`, and a span that does not resolve
+            # would make the client hide the wrong run of prose. `text` is the
+            # same object the block below carries, including the
+            # `preserve_marker_text` replacement, so the check is against what is
+            # actually served rather than against what was read.
+            if external is not None and kern.external_call_span_resolves(
+                    text, external):
+                detail = dict(detail) if isinstance(detail, dict) else {}
+                detail["external_call"] = external
         if r.kind == "tool_call" and isinstance(payload, dict):
             card = kern.decode_tool_call_card(payload)
             if card is None:
                 card = kern.decode_secondary_tool_call_card(payload)
             if card is not None:
+                _apply_session_ordinals(card, session_ordinals or {})
                 detail = dict(detail) if isinstance(detail, dict) else {}
                 detail["card"] = card
         output_card = (kern.decode_tool_output_card(payload)
@@ -792,6 +1210,7 @@ def _item_blocks_with_rows(
 def _build_item_blocks(
     item: dict, payloads: dict | None = None, *, preserve_marker_text: bool = False,
     call_owner_count: dict | None = None, decompose_headings: bool = False,
+    session_ordinals: dict[str, str] | None = None,
 ) -> list[dict]:
     """Assemble an item's blocks, folding each ``tool_output`` into its
     ``tool_call`` block via ``call_id`` when that call_id has exactly one owner
@@ -800,7 +1219,8 @@ def _build_item_blocks(
     return [entry[0] for entry in _item_blocks_with_rows(
         item, payloads, preserve_marker_text=preserve_marker_text,
         call_owner_count=call_owner_count,
-        decompose_headings=decompose_headings)]
+        decompose_headings=decompose_headings,
+        session_ordinals=session_ordinals)]
 
 
 def _item_lifecycle(item: dict) -> dict | None:
@@ -912,9 +1332,32 @@ def _attribute_costs(conn: sqlite3.Connection, conversation_key: str, effective_
     return turn_cost, turn_tokens, unattr_cost, unattr_tokens, total, conv_tokens
 
 
+def _conversation_totals(
+    conn: sqlite3.Connection, conversation_key: str, effective_speed: str,
+) -> tuple[float, dict]:
+    """Lean priced and token totals over one conversation's accounting rows.
+
+    Unlike ``_attribute_costs``, this does not reconstruct the event-to-turn map:
+    callers that need only conversation totals (outline, browse, child summaries)
+    can sum the compact accounting rows directly.  The row order and pricing
+    primitive stay identical to the detail envelope's whole-conversation pass.
+    """
+    total = 0.0
+    tokens = _zero_tokens()
+    for model, inp, cin, out, rout in conn.execute(
+        "SELECT model, input_tokens, cached_input_tokens, output_tokens, "
+        "reasoning_output_tokens FROM codex_session_entries WHERE conversation_key = ? "
+        "ORDER BY source_path, line_offset",
+        (conversation_key,),
+    ):
+        total += _calculate_codex_entry_cost(
+            model or "", inp or 0, cin or 0, out or 0, rout or 0, speed=effective_speed)
+        _add_tokens(tokens, inp, out, cin, rout)
+    return total, _tokens_union(tokens)
+
+
 def _conversation_total_cost(conn: sqlite3.Connection, conversation_key: str, effective_speed: str) -> float:
-    """Lean priced total over a conversation's accounting rows (browse rows,
-    child summaries) — same primitive as ``_attribute_costs`` (§5.4)."""
+    """Lean priced total for browse rows and child summaries (§5.4)."""
     total = 0.0
     for model, inp, cin, out, rout in conn.execute(
         "SELECT model, input_tokens, cached_input_tokens, output_tokens, "
@@ -997,9 +1440,19 @@ def _short_native(native: str | None) -> str:
 
 def _display_chain(fields: dict) -> str:
     """Read-time display fallback (§4.3): stored title → project_label → short
-    native-thread-id prefix."""
-    return fields.get("title") or fields.get("project_label") or _short_native(
-        fields.get("native_thread_id")) or ""
+    native-thread-id prefix.
+
+    #463 S4 §5 — the stored title is cleaned of recognized harness markup here.
+    This is ONE of three read paths that need it, not the universal chokepoint
+    the first draft assumed: the outline turn label is built independently from
+    anchor-row text and the `kind=title` search path reads rollup titles
+    directly, so both clean through the same helper rather than through this
+    call. A construct that strips to nothing falls through the chain below on
+    its own, which is what makes `strip` expressible at read time at all.
+    """
+    return (clean_codex_title(fields.get("title"))
+            or fields.get("project_label")
+            or _short_native(fields.get("native_thread_id")) or "")
 
 
 def _conversation_display_title(conn: sqlite3.Connection, conversation_key: str, rows: list | None = None) -> str:
@@ -1538,6 +1991,7 @@ def _fold_groups_for_item(item: dict, call_owner_count: dict,
 def _build_segment_index(
     conversation_key: str, items: list[dict], detail_bytes: dict, *,
     segmented: bool, block_budget: int | None = None,
+    fold_groups: bool = False,
 ) -> list[dict]:
     """Phase A's output: an ordered index of segments, with no block content.
 
@@ -1554,6 +2008,12 @@ def _build_segment_index(
     when omitted, never as a default argument value: a default argument binds
     once at import, so a test that lowered the budget would silently keep the
     imported figure and pass vacuously.
+
+    ``fold_groups`` publishes the fold-group membership as ``_fold_groups``. Only
+    the outline reads it (#463 S4 — a ``tool_error`` landmark anchors on the call
+    a failure folds into); the detail route S1 bounded and the search position
+    map do not, and building it for them costs a tuple per row per request for a
+    value nobody reads.
     """
     index: list[dict] = []
     for item_index, item in enumerate(items):
@@ -1605,6 +2065,16 @@ def _build_segment_index(
                 "_turn_id": item["turn_id"],
                 "_anchor_row": anchor,
                 "_rows": segment_rows,
+                # #463 S4 — the fold-group membership, as physical positions.
+                # `_fold_groups_for_item` computes it payload-free and this
+                # index discarded it, so nothing downstream could say WHICH
+                # `tool_call` a failing `tool_output` belongs to — only that the
+                # segment contained one. A `tool_error` landmark anchors on the
+                # call, so the membership has to survive Phase A.
+                "_fold_groups": [
+                    [(row.source_path, row.line_offset) for row in group.rows]
+                    for group in segment.groups
+                ] if fold_groups else (),
                 "_call_owner_count": call_owner_count,
                 "_meta": _item_meta(item) if head else None,
                 "_lifecycle": _item_lifecycle(item) if head else None,
@@ -1690,6 +2160,11 @@ def get_codex_conversation(
     # byte-identical to what the export golden already pins.
     index = _build_segment_index(
         conversation_key, items, detail_bytes, segmented=not legacy_export)
+    # #463 S3 section 3.2. Built here, in Phase A, from the narrow index that is
+    # already loaded for the whole conversation: it needs no extra payload read
+    # and no extra column, and it must be whole-conversation because ordinals and
+    # opener presence are global facts a page cannot decide.
+    session_index, session_ordinals = _build_session_index(rows)
 
     # ── Phase B: paginate the index ──────────────────────────────────────────
     page_index, page = _paginate_items(
@@ -1761,7 +2236,8 @@ def get_codex_conversation(
                 # marker-bearing payloads, so populating `headings` there would
                 # force a whole-conversation payload read for a field the
                 # exporter never reads.
-                decompose_headings=not legacy_export),
+                decompose_headings=not legacy_export,
+                session_ordinals=session_ordinals),
             "cost_usd": cost,
             "tokens": tokens,
         }
@@ -1782,6 +2258,7 @@ def get_codex_conversation(
         "title": _conversation_display_title(conn, conversation_key),
         "items": page_items,
         "page": page,
+        "session_index": session_index,
         "children": _children_of(conn, conversation_key, effective_speed),
         "parent": _parent_of(conn, conversation_key),
         "total_cost_usd": total,
@@ -1793,15 +2270,299 @@ def get_codex_conversation(
 # ── outline assembly (§5.6) ───────────────────────────────────────────────────
 
 
-def _conversation_files(conn: sqlite3.Connection, conversation_key: str) -> list[dict]:
-    return [
-        {"file_path": fp, "tool": tool, "count": count}
-        for fp, tool, count in conn.execute(
-            "SELECT file_path, tool, COUNT(*) FROM codex_conversation_file_touches "
-            "WHERE conversation_key = ? GROUP BY file_path, tool ORDER BY file_path, tool",
-            (conversation_key,),
-        )
-    ]
+def _tool_call_name(row) -> str | None:
+    """The tool a ``tool_call`` row invoked, from its STORED detail.
+
+    Ingest writes ``{"name": payload["name"] or <record type>, …}`` for every
+    tool call, so this needs no payload and stays outside the scoped pass.
+    """
+    detail = _parse_detail(row.detail_json)
+    name = detail.get("name") if isinstance(detail, dict) else None
+    return name if isinstance(name, str) and name else None
+
+
+def _conversation_duration_seconds(rows) -> int | None:
+    """Wall span of the conversation, as MIN to MAX over row timestamps (§4.2).
+
+    Never last minus first. §3.4 records that ``timestamp_utc`` is monotone
+    within a turn only — item and segment emission is physical order, not
+    timestamp order — and Task 1 found five decreases across turns in the
+    corpus, on which the naive form returns a negative duration.
+
+    The outline's own caller cannot exhibit that today, because
+    ``_load_conversation_rows`` reads ``ORDER BY timestamp_utc, source_path,
+    line_offset`` and the two forms therefore coincide on the rows it passes.
+    The rule is stated for the next caller, which is much more likely to hand
+    over an item-anchor list.
+    """
+    stamps = [row.timestamp_utc for row in rows if row.timestamp_utc]
+    if not stamps:
+        return None
+    first = _parse_outline_ts(min(stamps))
+    last = _parse_outline_ts(max(stamps))
+    if first is None or last is None:
+        return None
+    return int((last - first).total_seconds())
+
+
+def _outline_error_count(
+    failed_calls: set, outcome_positions: set,
+    derivation: landmarks.EventDerivation,
+) -> int | None:
+    """How many calls failed, or ``None`` when that cannot be answered (D3).
+
+    Three states, because 0 and null are different claims. A conversation with
+    no outcome-bearing row at all reports 0: nothing failed because nothing ran,
+    and that is determinable. A conversation whose outcome rows produced no
+    verdict at all — every retained payload gone, unparseable, or of a shape no
+    decoder recognises — reports null, because the stored projection answers
+    nothing here (Task 1 measured stored ``is_error`` true for 0 of 63,150
+    production ``tool_output`` rows) and 0 would assert an absence nobody proved.
+
+    A PARTIAL read reports what it found rather than declining. The alternative
+    would suppress real failures the pass did see because of one unreadable
+    neighbour, which is the worse error of the two.
+    """
+    if not outcome_positions:
+        return 0
+    if not (outcome_positions & set(derivation.errors_by_position)):
+        return None
+    return len(failed_calls)
+
+
+# The Codex tool names that open the `plan` landmark family. Codex's decoded
+# plan card is named `update_plan`, and both existing CLIENT plan predicates
+# recognise only Claude's `ExitPlanMode` and `AskUserQuestion` — so publishing
+# raw Codex tool names into tier-1 `tools` would NOT have made the plan jump
+# work, it would have been a silent no-op (§3.2). The mapping is explicit here
+# and the outline target derivation reads landmark KINDS rather than inferring
+# from names.
+_S4_PLAN_TOOLS = frozenset({"update_plan"})
+
+
+def _landmark_label(row) -> str:
+    """What a landmark row says. Never a raw provider identifier (§8).
+
+    §3.6 enumerates exactly TWO sources for a landmark label — reasoning heading
+    text, or a tool name — and rests the decision not to scrub these labels on
+    that enumeration. So a row that is neither a named ``tool_call`` nor a typed
+    ``event`` falls back to its own KIND, which is normalizer vocabulary, and
+    never to the row's stored text.
+
+    That branch is reachable: a failing ``tool_output`` whose ``call_id`` is
+    owned by two or more ``tool_call`` rows in its turn does not fold, becomes
+    its own group head, and enters ``failed_calls`` directly. Its ``text`` column
+    is the harness preamble that ``decode_tool_output_card(for_storage=False)``
+    exists to remove, and ``test_s3_no_raw_session_id_reaches_any_served_route``
+    documents that preamble as carrying the provider ``session_id``.
+    """
+    if row.kind == "tool_call":
+        name = _tool_call_name(row)
+        if name is not None:
+            return name
+    elif row.kind == "event" and row.event_type:
+        return row.event_type
+    return row.kind or ""
+
+
+def _clean_outline_label(text: str) -> str:
+    """An outline turn label, cleaned, and never cleaned away to nothing (§5.1).
+
+    Unlike ``_display_chain``, which §5.3 leans on as "already a fallback chain"
+    when it justifies the ``strip`` disposition, this path has no chain: it
+    cleans the anchor row's first non-blank line and publishes the result. Two
+    allowlisted grammars can consume the whole string — ``<recommended_plugins>``
+    (6 of the census's 438 titles) and ``<command-name>`` with no sibling tag —
+    and the client's ``cleanQualifiedTitle(turn.label) ?? turn.label`` passes an
+    empty string straight through, so the reader would get a row with no text at
+    all. The uncleaned line is the pre-S4 label, which is legible.
+    """
+    cleaned = clean_codex_title(text)
+    return cleaned if cleaned.strip() else text
+
+
+def _build_landmarks(
+    index: list[dict], derivation: landmarks.EventDerivation,
+    failed_calls: set,
+) -> list[dict]:
+    """Tier 2 — the landmarks a jump can reach (§3.2).
+
+    Three kinds and deliberately NOT one entry per tool call: a 523-call turn
+    would contribute 523 rows, which is noise rather than navigation.
+
+    Emission is PHYSICAL order — the segment index in order, and each segment's
+    rows in order — because §3.4 records that ``timestamp_utc`` is monotone
+    within a turn only and no consumer sorts by it.
+
+    ``landmark_key`` is always COMPOUND — ``<block_key>#<discriminator>`` — and
+    unique across every kind. A reasoning heading discriminates by its zero-based
+    ordinal, which is the identity the reader route already mints for the same
+    heading, because one block yields several headings and ``block_key`` alone
+    would collide. Every other kind discriminates by the kind itself.
+
+    That is what lets one ``tool_call`` block carry BOTH a ``tool_error`` and a
+    ``plan`` landmark. It has to: §3.2 gives the plan kind one entry per plan
+    call, and a failed plan call is one, so filing it only as the error made the
+    jump cluster's plan family report zero — asserting no plan activity in a
+    conversation that has some, which is the claim the spec's own "0 is a claim,
+    hiding is not" rule forbids. The error is emitted first, because it is the
+    more urgent of the two claims about the same call.
+
+    A block carrying ``detail.external_call`` produces no landmark of any kind
+    (§3.2). That holds by construction rather than by a filter here: the marker
+    is published on ``assistant`` blocks only, and no kind below comes from an
+    assistant row. ``test_external_call_block_produces_no_landmark`` pins it.
+    """
+    out: list[dict] = []
+    for entry in index:
+        for row in entry["_rows"]:
+            position = (row.source_path, row.line_offset)
+            block_key = _block_key_for_row(row)
+            common = {
+                "block_key": block_key,
+                "item_key": entry["item_key"],
+                "parent_item_key": entry["turn_item_key"],
+                "timestamp_utc": row.timestamp_utc,
+            }
+            if row.kind == "reasoning":
+                for ordinal, text in enumerate(
+                        derivation.headings_by_position.get(position, ())):
+                    out.append({"landmark_key": f"{block_key}#{ordinal}",
+                                "kind": "reasoning", "label": text, **common})
+                continue
+            if position in failed_calls:
+                out.append({"landmark_key": f"{block_key}#tool_error",
+                            "kind": "tool_error",
+                            "label": _landmark_label(row), **common})
+            if (row.kind == "tool_call"
+                    and _tool_call_name(row) in _S4_PLAN_TOOLS):
+                out.append({"landmark_key": f"{block_key}#plan", "kind": "plan",
+                            "label": _landmark_label(row), **common})
+    return out
+
+
+# The literal ingest writes into `codex_conversation_file_touches.tool`, kept so
+# the outline wire field and the file-search projection mean the same thing.
+# Every touch S4 derives comes from a `patch_apply_end`, which is the completion
+# of an `apply_patch` call.
+_PATCH_TOUCH_TOOL = "apply_patch"
+
+
+def _conversation_files(
+    segment_index: list[dict], derivation: landmarks.EventDerivation,
+) -> list[dict]:
+    """The whole-conversation file list, DERIVED read-time (§1.2, §4.3).
+
+    The stored ``codex_conversation_file_touches`` table is the source for
+    cross-conversation ``kind=files`` search after #489 repaired dict-shaped
+    ingest and backfilled retained history. It is deliberately not the outline
+    source: this payload pass has the richer evidence the outline contract needs.
+
+    Deriving it instead buys three things the table could not have supplied: a
+    real segment anchor per touch, so a file row jumps to its change rather than
+    to the top of a turn; the true per-file count; and first-touch DOCUMENT
+    order, which is what ``OutlineFile`` has always promised while the SQL
+    ordered alphabetically by path.
+
+    ``added``/``removed`` are summed over the touches, and go ``None`` as soon as
+    ONE touch of that file cannot be counted. Summing only the countable touches
+    would publish a number for a file that changed more — a file edited once with
+    a real diff and then moved by a count-free ``update`` would report the first
+    figure — and nothing in ``touches[]`` marks such a total as partial. §4.5 is
+    explicit that an undeterminable count is null and the badge renders nothing
+    rather than an understated number; that rule has to reach the aggregate, not
+    only the individual touch. The per-touch counts themselves come from the
+    UNBOUNDED raw ``changes`` entry (§4.5) — see ``landmarks.patch_file_touches``.
+    """
+    files: dict[str, dict] = {}
+    undetermined: dict[str, set[str]] = {}
+    for entry in segment_index:
+        for row in entry["_rows"]:
+            position = (row.source_path, row.line_offset)
+            for touch in derivation.patch_files_by_position.get(position, ()):
+                record = files.get(touch["path"])
+                if record is None:
+                    record = files[touch["path"]] = {
+                        "file_path": touch["path"], "tool": _PATCH_TOUCH_TOOL,
+                        "count": 0, "touches": [],
+                        "added": None, "removed": None}
+                record["count"] += 1
+                record["touches"].append({
+                    "item_key": entry["item_key"],
+                    "timestamp_utc": row.timestamp_utc,
+                    # The raw change KIND — `add`/`delete`/`update` from the dict
+                    # shape, `modified` from the list one — never the tool name.
+                    "op": touch["op"],
+                })
+                for field in ("added", "removed"):
+                    if touch[field] is None:
+                        undetermined.setdefault(touch["path"], set()).add(field)
+                    else:
+                        record[field] = (record[field] or 0) + touch[field]
+    for path, fields in undetermined.items():
+        for field in fields:
+            files[path][field] = None
+    return list(files.values())
+
+
+# Connections whose read snapshot THIS module opened, by identity. A
+# ``sqlite3.Connection`` supports neither attribute assignment nor a weak
+# reference, so ownership cannot be recorded on the object; ``id`` is unique
+# among live objects and the connection is alive for the whole ``with`` body, so
+# the token cannot be confused with another connection's while it is registered.
+_OWNED_READ_SNAPSHOTS: set[int] = set()
+
+
+@contextlib.contextmanager
+def _read_snapshot(conn: sqlite3.Connection):
+    """One consistent read snapshot across a multi-query envelope (#463 S4 §4.1).
+
+    The outline route uses one connection but opened no explicit read
+    transaction, so its several queries each took their own snapshot. Concurrent
+    APPEND is benign there — extra raw event rows have no normalized mapping yet
+    — but a concurrent delete or truncation between the wide message read and the
+    payload read can expose a message row whose payload is already gone, and the
+    derivation would then report an absence that never existed.
+
+    A deferred ``BEGIN`` takes the snapshot on the first read and holds it for
+    every later one. It is released with ``rollback``, which is the honest end of
+    a transaction that wrote nothing.
+
+    **A transaction this module did not open is refused, not inherited.**
+    ``conn.in_transaction`` is true for an outer WRITE transaction exactly as it
+    is for an outer read snapshot, and Python's ``sqlite3`` exposes no
+    ``txn_state``, so the two cannot be told apart here. Only one of them is safe
+    to borrow: inside a write, the envelope would read that writer's uncommitted
+    and possibly half-applied state — a message row whose events are already
+    deleted — with no snapshot of its own and no way to notice. Treating both
+    alike is silent; refusing is not. A caller that wants several envelopes on
+    one snapshot opens it through this same helper, which nests without issuing
+    the second ``BEGIN`` SQLite would refuse.
+
+    The caller sweep behind that decision, pinned by
+    ``test_every_outline_caller_arrives_outside_a_transaction``: the three call
+    paths into ``get_codex_conversation_outline`` are
+    ``_lib_conversation_dispatch.neutral_outline`` (the dashboard route, on a
+    connection ``open_conversations_db`` returns fresh per request and closes
+    after), ``bin/build-codex-reader-fixtures.py``, and the tests. None holds a
+    transaction at the call.
+    """
+    token = id(conn)
+    if token in _OWNED_READ_SNAPSHOTS:
+        yield
+        return
+    if conn.in_transaction:
+        raise RuntimeError(
+            "this envelope needs its own read snapshot, and the connection is "
+            "already inside a transaction it did not open; wrap the outer "
+            "scope in _read_snapshot instead")
+    conn.execute("BEGIN")
+    _OWNED_READ_SNAPSHOTS.add(token)
+    try:
+        yield
+    finally:
+        _OWNED_READ_SNAPSHOTS.discard(token)
+        conn.rollback()
 
 
 def get_codex_conversation_outline(
@@ -1827,7 +2588,24 @@ def get_codex_conversation_outline(
     report true for a segment that has not been fetched, so the drain would never
     run and the jump would land nowhere. Membership for navigation and membership
     for "this item subsumes that key" are different relations.
+
+    #463 S4 — the route now makes TWO conversation reads under one snapshot: the
+    wide message read below, and a scoped read-time pass over the retained event
+    payloads (``_derive_outline_events``) whose position set comes from that
+    first read. The pass is what gives the outline a failure verdict per call,
+    the authored reasoning headings, and the per-file patch touches; §1.2 records
+    why the stored ``codex_conversation_file_touches`` search projection is not
+    the OUTLINE source, and Task 1 measured that the stored card carries 0 of the
+    corpus's 896 tool failures, so read-time is not a preference here.
     """
+    with _read_snapshot(conn):
+        return _outline_envelope(
+            conn, conversation_key, effective_speed=effective_speed)
+
+
+def _outline_envelope(
+    conn: sqlite3.Connection, conversation_key: str, *, effective_speed: str
+) -> dict:
     if not codex_normalization_authoritative(conn):
         return {"status": "normalization_pending", "conversation_key": conversation_key,
                 "turns": [], "files": [], "children": []}
@@ -1841,11 +2619,26 @@ def get_codex_conversation_outline(
     kept, _suppressed = kern.pair_mirrors(rows)
     items = kern.canonical_items(kept)
     segment_keys: dict[int, list[str]] = {}
-    for entry in _build_segment_index(
-            conversation_key, items, detail_bytes, segmented=True):
+    fold_groups: list[list[tuple[str, int]]] = []
+    segment_index = _build_segment_index(
+        conversation_key, items, detail_bytes, segmented=True, fold_groups=True)
+    for entry in segment_index:
         segment_keys.setdefault(entry["_item_index"], []).append(entry["item_key"])
+        fold_groups.extend(entry["_fold_groups"])
+    # `rows` here is the wide read directly above, and that is what makes the
+    # payload pass SCOPED rather than a second whole-conversation decode (§4.1).
+    derivation = _derive_outline_events(conn, conversation_key, rows)
+    call_by_position = landmarks.fold_owner_by_position(fold_groups)
+    outcome_positions = _outline_outcome_positions(rows)
+    # A failing outcome row is charged to the `tool_call` it folds into, so the
+    # same failure cannot be counted twice when a call and its output both carry
+    # one, and so a turn's `tools` entry can say WHICH call failed.
+    failed_calls = _outline_failing_calls(
+        derivation, outcome_positions, call_by_position)
     turns: list[dict] = []
     kind_totals: dict[str, int] = {}
+    tool_counts: dict[str, int] = {}
+    models: dict[str, int] = {}
     # Keyed on the ITEM index, which is what _build_segment_index records. Using
     # ``len(turns)`` would be correct only for as long as this loop appends a
     # turn for every item without exception; a later ``continue`` would misalign
@@ -1857,11 +2650,38 @@ def get_codex_conversation_outline(
         if meta is not None:
             label = _META_LABEL_TEXT.get(meta["meta_label"], "Harness context")
         else:
-            label = _first_nonblank_line(_strip_ansi(anchor_text)) if anchor_text else ""
+            # Built from anchor-row TEXT, which is why it does not reach
+            # `_display_chain` and has to clean through the shared helper here
+            # (§5.1). A label with no recognized markup passes through byte for
+            # byte, so this cannot move an ordinary prose label.
+            label = _clean_outline_label(
+                _first_nonblank_line(_strip_ansi(anchor_text))) if anchor_text else ""
         kinds: dict[str, int] = {}
+        tools: list[dict] = []
+        tool_slot: dict[str | None, int] = {}
+        tool_call_count = 0
+        first_failure_name: str | None = None
+        thinking: list[str] = []
         for r in it["rows"]:
             kinds[r.kind] = kinds.get(r.kind, 0) + 1
             kind_totals[r.kind] = kind_totals.get(r.kind, 0) + 1
+            position = (r.source_path, r.line_offset)
+            if r.kind == "tool_call":
+                tool_call_count += 1
+                name = _tool_call_name(r)
+                failed = position in failed_calls
+                if failed and first_failure_name is None:
+                    first_failure_name = name
+                if name is not None:
+                    tool_counts[name] = tool_counts.get(name, 0) + 1
+                slot = tool_slot.get(name)
+                if slot is None:
+                    tool_slot[name] = len(tools)
+                    tools.append({"name": name, "is_error": failed})
+                elif failed:
+                    tools[slot]["is_error"] = True
+            elif r.kind == "reasoning":
+                thinking.extend(derivation.headings_by_position.get(position, ()))
         item_key = _item_key_for_item(conversation_key, it)
         turn = {
             "item_key": item_key,
@@ -1871,15 +2691,43 @@ def get_codex_conversation_outline(
             "timestamp_utc": it["anchor_row"].timestamp_utc,
             "kinds": kinds,
         }
+        # Additive, and only where there is something to say: a turn with no
+        # calls publishes neither an empty array nor a zero count, matching how
+        # the Claude outline omits `tools` and `thinking`.
+        if tools:
+            turn["tools"] = tools
+            turn["tool_call_count"] = tool_call_count
+            turn["first_failure_name"] = first_failure_name
+        if thinking:
+            turn["thinking"] = thinking
+        item_model = _item_model(it) if _item_kind(it) == "assistant" else None
+        if item_model:
+            turn["model"] = item_model
+            models[item_model] = models.get(item_model, 0) + 1
         if meta is not None:
             turn.update(meta)
         turns.append(turn)
+    total_cost, tokens = _conversation_totals(
+        conn, conversation_key, effective_speed)
     return {
         "status": "ok",
         "conversation_key": conversation_key,
         "turns": turns,
-        "stats": {"items": len(items), "kinds": kind_totals},
-        "files": _conversation_files(conn, conversation_key),
+        # Tier 2, deliberately a SEPARATE array (§3.3): `adaptQualifiedOutline`
+        # derives `stats.turns.{human,assistant,tool_result,meta}` by filtering
+        # `turns[]` on kind, so putting landmarks there would inflate counts
+        # meant to describe the conversation's structure.
+        "landmarks": _build_landmarks(
+            segment_index, derivation, failed_calls),
+        "stats": {
+            "items": len(items), "kinds": kind_totals,
+            "cost_usd": total_cost, "tokens": tokens,
+            "tool_counts": tool_counts, "models": models,
+            "duration_seconds": _conversation_duration_seconds(rows),
+            "error_count": _outline_error_count(
+                failed_calls, outcome_positions, derivation),
+        },
+        "files": _conversation_files(segment_index, derivation),
         "children": _children_of(conn, conversation_key, effective_speed),
     }
 
@@ -1893,6 +2741,16 @@ def _is_fork(fields: dict) -> bool:
 
 
 def _browse_row(conn: sqlite3.Connection, conversation_key: str, effective_speed: str, fields: dict) -> dict:
+    return _browse_row_from_fields(
+        conversation_key, fields,
+        cost_usd=_conversation_total_cost(conn, conversation_key, effective_speed),
+        parent=_parent_of(conn, conversation_key),
+    )
+
+
+def _browse_row_from_fields(
+    conversation_key: str, fields: dict, *, cost_usd: float, parent,
+) -> dict:
     return {
         "conversation_key": conversation_key,
         "title": _display_chain(fields),
@@ -1901,9 +2759,9 @@ def _browse_row(conn: sqlite3.Connection, conversation_key: str, effective_speed
         "started_utc": fields["started"],
         "last_activity_utc": fields["last"],
         "count": fields["item_count"],
-        "cost_usd": _conversation_total_cost(conn, conversation_key, effective_speed),
+        "cost_usd": cost_usd,
         "models": list(fields["models"]),
-        "parent": _parent_of(conn, conversation_key),
+        "parent": parent,
         "is_fork": _is_fork(fields),
     }
 
@@ -1948,6 +2806,200 @@ def _paginate_rows(rows: list[dict], *, cursor: str | None, limit: int):
     return window, page
 
 
+def _stored_rollups_present(conn: sqlite3.Connection) -> bool:
+    """Whether the authoritative stored-rollup branch has been materialized.
+
+    Normal writes update normalized rows and their rollups in one transaction.
+    The only supported no-rollup state is the pre-first-recompute window, where
+    the live branch keeps the rail available.  This constant-time probe avoids
+    reintroducing the whole-message-table DISTINCT scan on every cold browse.
+    """
+    return conn.execute(
+        "SELECT 1 FROM codex_conversation_rollups LIMIT 1").fetchone() is not None
+
+
+def _live_browse_fields(conn: sqlite3.Connection) -> list[tuple[str, dict]]:
+    """Live-recompute fallback used only while no stored rollups exist."""
+    out = []
+    for (conversation_key,) in conn.execute(
+            "SELECT DISTINCT conversation_key FROM codex_conversation_messages"):
+        fields = _rollup_fields(conn, conversation_key)
+        if fields is not None:
+            out.append((conversation_key, fields))
+    return out
+
+
+def _facets_from_fields(fields_rows: list[tuple[str, dict]]) -> dict:
+    return _browse_facets([
+        {
+            "project_key": fields["project_key"],
+            "project_label": fields["project_label"],
+            "models": list(fields["models"]),
+        }
+        for _conversation_key, fields in fields_rows
+    ])
+
+
+def _stored_browse_facets(conn: sqlite3.Connection) -> dict:
+    fields_rows = []
+    for conversation_key, project_key, project_label, models_json in conn.execute(
+        "SELECT conversation_key, project_key, project_label, models_json "
+        "FROM codex_conversation_rollups"
+    ):
+        try:
+            parsed = json.loads(models_json) if models_json else []
+            models = parsed if isinstance(parsed, list) else []
+        except (TypeError, json.JSONDecodeError):
+            models = []
+        fields_rows.append((conversation_key, {
+            "project_key": project_key,
+            "project_label": project_label,
+            "models": models,
+        }))
+    return _facets_from_fields(fields_rows)
+
+
+def _stored_filter_sql(alias: str, project_key: str | None, model: str | None):
+    clauses = []
+    params = []
+    if project_key is not None:
+        clauses.append(f"{alias}.project_key = ?")
+        params.append(project_key)
+    if model is not None:
+        # models_json is the writer's canonical JSON array.  Searching for the
+        # complete JSON string literal is exact and does not require JSON1.
+        clauses.append(f"instr(COALESCE({alias}.models_json, ''), ?) > 0")
+        params.append(json.dumps(model))
+    return (" AND ".join(clauses) if clauses else "1"), params
+
+
+def _page_costs(
+    conn: sqlite3.Connection, conversation_keys: list[str], effective_speed: str,
+) -> dict[str, float]:
+    if not conversation_keys:
+        return {}
+    placeholders = ",".join("?" for _ in conversation_keys)
+    totals = {key: 0.0 for key in conversation_keys}
+    for ck, model, inp, cin, out, rout in conn.execute(
+        "SELECT conversation_key, model, input_tokens, cached_input_tokens, "
+        "output_tokens, reasoning_output_tokens FROM codex_session_entries "
+        f"WHERE conversation_key IN ({placeholders}) "
+        "ORDER BY conversation_key, id",
+        conversation_keys,
+    ):
+        totals[ck] += _calculate_codex_entry_cost(
+            model or "", inp or 0, cin or 0, out or 0, rout or 0,
+            speed=effective_speed)
+    return totals
+
+
+def _stored_browse_page(
+    conn: sqlite3.Connection, *, effective_speed: str,
+    project_key: str | None, model: str | None, limit: int,
+    cursor: str | None,
+):
+    where_sql, filter_params = _stored_filter_sql("r", project_key, model)
+    total = conn.execute(
+        f"SELECT COUNT(*) FROM codex_conversation_rollups r WHERE {where_sql}",
+        filter_params,
+    ).fetchone()[0]
+
+    cursor_row = None
+    if cursor is not None:
+        cursor_where, cursor_params = _stored_filter_sql("c", project_key, model)
+        cursor_row = conn.execute(
+            "SELECT COALESCE(c.last_activity_utc, ''), c.conversation_key "
+            "FROM codex_conversation_rollups c "
+            f"WHERE c.conversation_key = ? AND {cursor_where}",
+            [cursor, *cursor_params],
+        ).fetchone()
+
+    page_where = [where_sql]
+    page_params = list(filter_params)
+    if cursor_row is not None:
+        cursor_last, cursor_key = cursor_row
+        page_where.append(
+            "(COALESCE(r.last_activity_utc, '') < ? OR "
+            "(COALESCE(r.last_activity_utc, '') = ? AND r.conversation_key < ?))")
+        page_params.extend((cursor_last, cursor_last, cursor_key))
+
+    sql = (
+        "SELECT r.conversation_key, r.item_count, r.started_utc, "
+        "r.last_activity_utc, r.project_key, r.project_label, r.models_json, "
+        "r.title, r.parent_thread_id, r.source_root_key, t.native_thread_id, "
+        "pt.conversation_key, pr.title, pr.project_label, pt.native_thread_id "
+        "FROM codex_conversation_rollups r "
+        "LEFT JOIN codex_conversation_threads t "
+        "ON t.conversation_key = r.conversation_key "
+        "LEFT JOIN codex_conversation_threads pt "
+        "ON pt.source_root_key = r.source_root_key "
+        "AND pt.native_thread_id = r.parent_thread_id "
+        "AND pt.conversation_key != r.conversation_key "
+        "LEFT JOIN codex_conversation_rollups pr "
+        "ON pr.conversation_key = pt.conversation_key "
+        f"WHERE {' AND '.join(page_where)} "
+        "ORDER BY COALESCE(r.last_activity_utc, '') DESC, r.conversation_key DESC"
+    )
+    if limit:
+        sql += " LIMIT ?"
+        page_params.append(limit + 1)
+    raw_rows = list(conn.execute(sql, page_params))
+    has_more = bool(limit and len(raw_rows) > limit)
+    if has_more:
+        raw_rows = raw_rows[:limit]
+
+    keys = [row[0] for row in raw_rows]
+    costs = _page_costs(conn, keys, effective_speed)
+    rows = []
+    for row in raw_rows:
+        (conversation_key, item_count, started, last, row_project_key,
+         project_label, models_json, title, parent_thread_id, source_root_key,
+         native_thread_id, parent_key, parent_title, parent_project_label,
+         parent_native_thread_id) = row
+        try:
+            parsed = json.loads(models_json) if models_json else []
+            models = parsed if isinstance(parsed, list) else []
+        except (TypeError, json.JSONDecodeError):
+            models = []
+        fields = {
+            "item_count": item_count,
+            "started": started,
+            "last": last,
+            "project_key": row_project_key,
+            "project_label": project_label,
+            "models": models,
+            "title": title,
+            "parent_thread_id": parent_thread_id,
+            "source_root_key": source_root_key,
+            "native_thread_id": native_thread_id,
+        }
+        parent = None
+        if parent_key is not None:
+            parent = {
+                "conversation_key": parent_key,
+                "title": _display_chain({
+                    "title": parent_title,
+                    "project_label": parent_project_label,
+                    "native_thread_id": parent_native_thread_id,
+                }),
+            }
+        rows.append(_browse_row_from_fields(
+            conversation_key, fields, cost_usd=costs.get(conversation_key, 0.0),
+            parent=parent))
+    next_cursor = rows[-1]["conversation_key"] if (rows and has_more) else None
+    return rows, {"total": total, "returned": len(rows), "cursor": next_cursor}
+
+
+def list_codex_conversation_facets(conn: sqlite3.Connection) -> dict:
+    """Facet-only browse projection; never builds or prices a discarded page."""
+    if not codex_normalization_authoritative(conn):
+        return {"status": "normalization_pending",
+                "facets": {"projects": [], "models": []}}
+    facets = (_stored_browse_facets(conn) if _stored_rollups_present(conn)
+              else _facets_from_fields(_live_browse_fields(conn)))
+    return {"status": "ok", "facets": facets}
+
+
 def list_codex_conversations(
     conn: sqlite3.Connection,
     *,
@@ -1956,6 +3008,7 @@ def list_codex_conversations(
     model: str | None = None,
     limit: int = 50,
     cursor: str | None = None,
+    selected: str | None = None,
 ) -> dict:
     """Browse envelope (§5.6 / §6.1): a page of conversation rows ordered by last
     activity, with project/model facets. Dual-branch — the stored rollup fast
@@ -1966,23 +3019,37 @@ def list_codex_conversations(
     if not codex_normalization_authoritative(conn):
         return {"status": "normalization_pending", "rows": [],
                 "facets": {"projects": [], "models": []}, "page": {"total": 0}}
-    keys = [r[0] for r in conn.execute(
-        "SELECT DISTINCT conversation_key FROM codex_conversation_messages")]
-    rows: list[dict] = []
-    for conversation_key in keys:
-        fields = _rollup_fields(conn, conversation_key)
-        if fields is None:
-            continue
-        rows.append(_browse_row(conn, conversation_key, effective_speed, fields))
-    facets = _browse_facets(rows)
-    filtered = [
-        row for row in rows
-        if (project_key is None or row["project_key"] == project_key)
-        and (model is None or model in (row["models"] or []))
+    if _stored_rollups_present(conn):
+        facets = _stored_browse_facets(conn)
+        page_rows, page = _stored_browse_page(
+            conn, effective_speed=effective_speed, project_key=project_key,
+            model=model, limit=limit, cursor=cursor)
+        result = {"status": "ok", "rows": page_rows, "facets": facets, "page": page}
+        if selected is not None:
+            fields = _rollup_fields(conn, selected)
+            if fields is not None:
+                result["selected"] = _browse_row(
+                    conn, selected, effective_speed, fields)
+        return result
+
+    fields_rows = _live_browse_fields(conn)
+    rows = [
+        _browse_row(conn, conversation_key, effective_speed, fields)
+        for conversation_key, fields in fields_rows
     ]
+    facets = _facets_from_fields(fields_rows)
+    filtered = [row for row in rows
+                if (project_key is None or row["project_key"] == project_key)
+                and (model is None or model in (row["models"] or []))]
     filtered.sort(key=_recent_sort_key, reverse=True)
     page_rows, page = _paginate_rows(filtered, cursor=cursor, limit=limit)
-    return {"status": "ok", "rows": page_rows, "facets": facets, "page": page}
+    result = {"status": "ok", "rows": page_rows, "facets": facets, "page": page}
+    if selected is not None:
+        selected_row = next(
+            (row for row in rows if row["conversation_key"] == selected), None)
+        if selected_row is not None:
+            result["selected"] = selected_row
+    return result
 
 
 # ── search (§6.2) ─────────────────────────────────────────────────────────────
@@ -2057,6 +3124,405 @@ def _pos_to_item_key(conn: sqlite3.Connection, conversation_key: str) -> dict:
     return _pos_to_item_key_and_order(conn, conversation_key)[0]
 
 
+# ── #482 visible render-leaf projection ─────────────────────────────────────
+
+_COMPLETION_EVENT_TYPES = {
+    "patch_apply_end",
+    "web_search_end",
+    "mcp_tool_call_end",
+}
+
+
+def _find_surface(row) -> str | None:
+    if row.kind in {"user", "assistant", "reasoning", "meta"}:
+        return "body"
+    if row.kind == "tool_call":
+        return "call"
+    if row.kind == "tool_output":
+        return "output"
+    if row.kind == "event" and row.event_type in _COMPLETION_EVENT_TYPES:
+        return "completion"
+    return None
+
+
+def _project_plain_leaves(leaves: list[RenderLeaf]):
+    """Project structured-card leaves with a non-searchable visual boundary.
+
+    Native card fields render in separate block/inline containers.  A newline
+    between fields prevents a match from crossing that visual boundary while
+    keeping each leaf's offsets local to the exact string its React component
+    receives.
+    """
+    text_parts: list[str] = []
+    projected: list[ProjectedLeaf] = []
+    cursor = 0
+    for leaf in leaves:
+        if not leaf.text:
+            continue
+        if text_parts:
+            text_parts.append("\n")
+            cursor += 1
+        start = cursor
+        text_parts.append(leaf.text)
+        cursor += len(leaf.text)
+        projected.append(ProjectedLeaf(leaf.key, start, cursor))
+    return "".join(text_parts), tuple(projected)
+
+
+def _project_markdown_fields(fields: list[tuple[str, str]]):
+    text_parts: list[str] = []
+    leaves: list[ProjectedLeaf] = []
+    cursor = 0
+    for field, source in fields:
+        if not source:
+            continue
+        if text_parts:
+            text_parts.append("\n")
+            cursor += 1
+        projected_text, projected_leaves = project_markdown(source)
+        text_parts.append(projected_text)
+        leaves.extend(
+            ProjectedLeaf(f"{field}/{leaf.key}", cursor + leaf.start, cursor + leaf.end)
+            for leaf in projected_leaves
+        )
+        cursor += len(projected_text)
+    return "".join(text_parts), tuple(leaves)
+
+
+def _patch_diff_leaves(files) -> list[RenderLeaf]:
+    leaves: list[RenderLeaf] = []
+    for file_index, file in enumerate(files or []):
+        if not isinstance(file, dict):
+            continue
+        for field in ("path", "move_path"):
+            value = file.get(field)
+            if isinstance(value, str) and value:
+                leaves.append(RenderLeaf(f"files.{file_index}.{field}", value))
+        diff = file.get("unified_diff")
+        if not isinstance(diff, str):
+            continue
+        hunk_index = -1
+        row_index = 0
+        for line in diff.replace("\r\n", "\n").replace("\r", "\n").split("\n"):
+            if line.startswith("@@"):
+                hunk_index += 1
+                row_index = 0
+                continue
+            if hunk_index < 0 or not line or line.startswith(("--- ", "+++ ", "\\")):
+                continue
+            if line[0] not in {"+", "-", " "}:
+                continue
+            leaves.append(RenderLeaf(
+                f"files.{file_index}.diff.{hunk_index}.{row_index}", line[1:]))
+            row_index += 1
+    return leaves
+
+
+def _json_card_text(value) -> str:
+    return value if isinstance(value, str) else json.dumps(
+        value, ensure_ascii=False, indent=2, separators=(",", ": "))
+
+
+def _project_completion_payload(payload: dict):
+    patch = kern.decode_patch_event_card(payload)
+    if patch is not None:
+        leaves = _patch_diff_leaves(patch.get("files"))
+        for field in ("stdout", "stderr"):
+            value = patch.get(field)
+            if isinstance(value, str) and value:
+                leaves.append(RenderLeaf(field, _strip_ansi(value)))
+        return _project_plain_leaves(leaves) if leaves else None
+
+    completion = kern.decode_secondary_event_card(payload)
+    if completion is None:
+        return None
+    if completion.get("type") == "web_search_completion":
+        leaves: list[RenderLeaf] = []
+        for index, result in enumerate(completion.get("results") or []):
+            if not isinstance(result, dict):
+                continue
+            for field in ("title", "domain", "snippet", "ref_id"):
+                value = result.get(field)
+                if isinstance(value, str) and value:
+                    leaves.append(RenderLeaf(f"results.{index}.{field}", value))
+        error = completion.get("error")
+        if error is not None:
+            leaves.append(RenderLeaf("error", _json_card_text(error)))
+        return _project_plain_leaves(leaves) if leaves else None
+    if completion.get("type") == "mcp_completion":
+        leaves = [
+            RenderLeaf("arguments", _json_card_text(completion.get("arguments"))),
+            RenderLeaf("result", _json_card_text(completion.get("result"))),
+        ]
+        return _project_plain_leaves(leaves)
+    return None
+
+
+def _project_find_row(row, *, payload: dict | None = None, block: dict | None = None):
+    if row.kind == "event" and row.event_type in _COMPLETION_EVENT_TYPES and payload:
+        completion = _project_completion_payload(payload)
+        if completion is not None:
+            return completion
+    text = _row_display(row)
+    if not text:
+        return None
+    if row.kind == "meta":
+        try:
+            detail = json.loads(row.detail_json or "{}")
+        except (TypeError, json.JSONDecodeError):
+            detail = {}
+        meta_kind = detail.get("meta_kind") if isinstance(detail, dict) else None
+        if meta_kind == "command":
+            return project_plain((RenderLeaf("t0", text),))
+        if meta_kind == "context":
+            return project_context(text)
+        return project_markdown(text)
+    if row.kind == "reasoning" and isinstance(block, dict):
+        detail = block.get("detail")
+        reasoning = detail.get("reasoning") if isinstance(detail, dict) else None
+        if isinstance(reasoning, dict):
+            visible_headings = block.get("_find_visible_headings")
+            if isinstance(visible_headings, list):
+                leaves = [
+                    RenderLeaf(leaf_key, text)
+                    for leaf_key, text in visible_headings
+                    if isinstance(leaf_key, str) and isinstance(text, str) and text
+                ]
+                if leaves:
+                    return _project_plain_leaves(leaves)
+                if reasoning.get("body") is None:
+                    return None
+            fields = [
+                (field, reasoning[field])
+                for field in ("title", "summary", "body")
+                if isinstance(reasoning.get(field), str) and reasoning[field]
+            ]
+            if fields:
+                return _project_markdown_fields(fields)
+    if row.kind in {"user", "assistant", "reasoning"}:
+        return project_markdown(text)
+    if row.kind == "tool_output" and isinstance(block, dict):
+        detail = block.get("detail")
+        card = detail.get("card") if isinstance(detail, dict) else None
+        if isinstance(card, dict) and card.get("type") == "terminal":
+            output = card.get("output")
+            parts = output.get("parts") if isinstance(output, dict) else None
+            if isinstance(parts, list):
+                stdout = "".join(
+                    part.get("text", "") for part in parts
+                    if isinstance(part, dict) and part.get("type") == "text"
+                    and part.get("stream") != "stderr"
+                )
+                stderr = "".join(
+                    part.get("text", "") for part in parts
+                    if isinstance(part, dict) and part.get("type") == "text"
+                    and part.get("stream") == "stderr"
+                )
+                leaves = []
+                if stdout:
+                    leaves.append(RenderLeaf("stdout", _strip_ansi(stdout)))
+                if stderr:
+                    leaves.append(RenderLeaf("stderr", _strip_ansi(stderr)))
+                leaves.extend(
+                    RenderLeaf(f"raw.{index}", part["text"])
+                    for index, part in enumerate(parts)
+                    if isinstance(part, dict) and part.get("type") == "raw"
+                    and isinstance(part.get("text"), str) and part["text"]
+                )
+                if leaves:
+                    return _project_plain_leaves(leaves)
+    if row.kind == "tool_call" and isinstance(block, dict):
+        detail = block.get("detail")
+        detail = detail if isinstance(detail, dict) else {}
+        card = detail.get("card")
+        if isinstance(card, dict):
+            if card.get("type") == "patch":
+                return None
+            if card.get("type") == "web_search" and isinstance(card.get("query"), str):
+                return project_plain((RenderLeaf("query", card["query"]),))
+            if card.get("type") == "mcp":
+                return None
+            if card.get("type") == "terminal":
+                commands = [
+                    RenderLeaf(f"commands.{index}", entry["command"])
+                    for index, entry in enumerate(card.get("commands") or [])
+                    if isinstance(entry, dict) and isinstance(entry.get("command"), str)
+                ]
+                if commands:
+                    return _project_plain_leaves(commands)
+        args = detail.get("args")
+        if isinstance(args, str) and args:
+            return project_plain((RenderLeaf("t0", args),))
+    return project_plain((RenderLeaf("t0", text),))
+
+
+def materialize_codex_find_projection(
+    conn: sqlite3.Connection,
+    conversation_keys,
+) -> None:
+    """Replace #482 projection rows for the affected conversations.
+
+    The existing item/block builder is the only authority for native folds.
+    Every searchable physical row keeps its own block key; a folded output or
+    completion separately records the visual call block that owns it.
+    """
+    keys = sorted({key for key in conversation_keys if key})
+    if not keys:
+        return
+    for conversation_key in keys:
+        conn.execute(
+            "DELETE FROM codex_find_projection WHERE conversation_key=?",
+            (conversation_key,),
+        )
+        rows = [
+            kern.CodexNormalizedRow(*row)
+            for row in conn.execute(
+                "SELECT " + _ROW_COLS + " FROM codex_conversation_messages "
+                "WHERE conversation_key=? "
+                "ORDER BY timestamp_utc,source_path,line_offset",
+                (conversation_key,),
+            )
+        ]
+        if not rows:
+            continue
+        kept, _suppressed = kern.pair_mirrors(rows)
+        items = kern.canonical_items(kept)
+        payloads = _load_row_payloads(conn, conversation_key)
+        pos_to_item = _pos_to_item_key(conn, conversation_key)
+        row_ids = {
+            (source_path, line_offset): message_id
+            for message_id, source_path, line_offset in conn.execute(
+                "SELECT id,source_path,line_offset "
+                "FROM codex_conversation_messages WHERE conversation_key=?",
+                (conversation_key,),
+            )
+        }
+        render_order = 0
+        seen: set[tuple[str, int]] = set()
+        seen_reasoning_by_turn: dict[str, set[str]] = {}
+
+        def store(row, *, container_block_key: str, block: dict | None = None) -> None:
+            nonlocal render_order
+            position = (row.source_path, row.line_offset)
+            if position in seen:
+                return
+            surface = _find_surface(row)
+            retained = _row_payload(row, payloads)
+            payload = retained[1] if retained is not None else None
+            projected = _project_find_row(row, payload=payload, block=block)
+            message_id = row_ids.get(position)
+            if surface is None or projected is None or message_id is None:
+                return
+            text, leaves = projected
+            if not text:
+                return
+            physical_block_key = _block_key_for_row(row)
+            item_key = pos_to_item.get(position)
+            if item_key is None:
+                return
+            disclosure = (
+                [container_block_key]
+                if row.kind in {"reasoning", "meta"} or surface != "body"
+                else []
+            )
+            conn.execute(
+                "INSERT INTO codex_find_projection "
+                "(message_id,conversation_key,item_key,block_key,"
+                "container_block_key,surface,render_order,projected_text,"
+                "leaves_json,disclosure_json,projection_version) "
+                "VALUES (?,?,?,?,?,?,?,?,?,?,?)",
+                (
+                    message_id,
+                    conversation_key,
+                    item_key,
+                    physical_block_key,
+                    container_block_key,
+                    surface,
+                    render_order,
+                    text,
+                    json.dumps(
+                        [
+                            {"key": leaf.key, "start": leaf.start, "end": leaf.end}
+                            for leaf in leaves
+                        ],
+                        sort_keys=True,
+                        separators=(",", ":"),
+                    ),
+                    json.dumps(disclosure, separators=(",", ":")),
+                    CODEX_FIND_PROJECTION_VERSION,
+                ),
+            )
+            seen.add(position)
+            render_order += 1
+
+        for item in items:
+            built_entries = _item_blocks_with_rows(
+                item, payloads, decompose_headings=True,
+            )
+            completion_owner: dict[str, str] = {}
+            for candidate_block, _candidate_primary, _candidate_output in built_entries:
+                candidate_container = (
+                    candidate_block.get("block_key")
+                    or _block_key_for_row(_candidate_primary)
+                )
+                candidate_detail = candidate_block.get("detail")
+                candidate_card = (
+                    candidate_detail.get("card")
+                    if isinstance(candidate_detail, dict) else None
+                )
+                completion = (
+                    candidate_card.get("completion")
+                    if isinstance(candidate_card, dict) else None
+                )
+                event_key = (
+                    completion.get("event_block_key")
+                    if isinstance(completion, dict) else None
+                )
+                if isinstance(event_key, str):
+                    completion_owner[event_key] = candidate_container
+
+            for block, primary, output in built_entries:
+                container = block.get("block_key") or _block_key_for_row(primary)
+                container = completion_owner.get(_block_key_for_row(primary), container)
+                if primary.kind == "reasoning":
+                    detail = block.get("detail")
+                    reasoning = (
+                        detail.get("reasoning") if isinstance(detail, dict) else None
+                    )
+                    headings = (
+                        reasoning.get("headings")
+                        if isinstance(reasoning, dict) else None
+                    )
+                    if isinstance(headings, list):
+                        turn_key = primary.turn_id or item.get("turn_id") or ""
+                        prior = seen_reasoning_by_turn.setdefault(turn_key, set())
+                        visible = []
+                        for heading_index, heading in enumerate(headings):
+                            text = heading.get("text") if isinstance(heading, dict) else None
+                            if not isinstance(text, str) or text in prior:
+                                continue
+                            prior.add(text)
+                            visible.append((f"headings.{heading_index}", text))
+                        block["_find_visible_headings"] = visible
+                store(primary, container_block_key=container, block=block)
+                if output is not None:
+                    store(output, container_block_key=container, block=block)
+            # Completion folds that intentionally produce no standalone block
+            # still own a searchable physical surface and point at their call.
+            for row in item["rows"]:
+                if row.event_type not in _COMPLETION_EVENT_TYPES:
+                    continue
+                physical_key = _block_key_for_row(row)
+                container = completion_owner.get(physical_key, physical_key)
+                store(row, container_block_key=container)
+
+    conn.execute(
+        "INSERT INTO cache_meta(key,value) VALUES"
+        "('codex_find_projection_generation','1') "
+        "ON CONFLICT(key) DO UPDATE SET value=CAST(value AS INTEGER)+1"
+    )
+
+
 def _fts_query(query: str, column: str | None) -> str:
     """A safe FTS5 query: each whitespace term becomes a quoted phrase, joined by
     implicit AND (term-wise AND — the documented divergence from LIKE's single
@@ -2120,7 +3586,60 @@ def _excerpt(text: str | None) -> str:
     return collapsed[:200]
 
 
-def _collapse_message_hits(conn: sqlite3.Connection, matched_rows: list) -> list[dict]:
+def _search_display_text(text: str | None) -> str:
+    """Readable search projection for retained structured content arrays.
+
+    Tool outputs must retain their provider JSON in ``search_tool`` so every
+    leaf stays searchable.  The rail, however, needs the same ordered text
+    leaves a reader sees—not the serialized wrapper.  Unknown JSON and future
+    shapes fall back byte-for-byte to the retained string.
+    """
+    if not text:
+        return ""
+    raw = str(text)
+    if not raw.lstrip().startswith("["):
+        return raw
+    try:
+        parsed = json.loads(raw)
+    except (TypeError, json.JSONDecodeError):
+        # Search columns are capped.  A large content array can therefore end
+        # mid-string and cease to be valid JSON even though one or more leading
+        # text parts are complete.  `_canonical_json` sorts object keys, so a
+        # text-bearing part starts as `{\"text\":...}`. Decode only those
+        # complete JSON string literals; never regex-unescape provider bytes.
+        parts = []
+        for match in re.finditer(r'(?:\A\[\{|,\{)"text":', raw):
+            try:
+                value, _end = json.JSONDecoder().raw_decode(raw, match.end())
+            except (TypeError, json.JSONDecodeError):
+                continue
+            if isinstance(value, str) and value:
+                parts.append(value)
+        return "\n".join(parts) + ("\n…" if parts else "") or raw
+    joined = kern._join_content_texts(parsed)
+    return joined if joined else raw
+
+
+def _search_excerpt(text: str | None, query: str, width: int = 200) -> str:
+    """Whitespace-collapsed, match-centred excerpt from readable search text."""
+    collapsed = " ".join(_search_display_text(text).split())
+    if not collapsed:
+        return ""
+    needle = " ".join(query.split())
+    found = collapsed.casefold().find(needle.casefold()) if needle else -1
+    if found < 0 or len(collapsed) <= width:
+        return collapsed[:width]
+    start = max(0, found - (width // 3))
+    end = min(len(collapsed), start + width)
+    start = max(0, end - width)
+    excerpt = collapsed[start:end]
+    return (("… " if start else "") + excerpt
+            + (" …" if end < len(collapsed) else ""))
+
+
+def _collapse_message_hits(
+    conn: sqlite3.Connection, matched_rows: list, query: str,
+) -> list[dict]:
     """Collapse matched physical rows to canonical ``item_key`` BEFORE totals /
     badges (§6.2) — both members of a mirror pair map to one item_key, so mirror
     rows never double-count (turned or unturned)."""
@@ -2143,7 +3662,7 @@ def _collapse_message_hits(conn: sqlite3.Connection, matched_rows: list) -> list
                  "last_activity_utc": last_act, "project_label": project_label})
             hit["_badges"].add(_badge_for_kind(kind))
             if hit["snippet"] is None:
-                hit["snippet"] = _excerpt(disp)
+                hit["snippet"] = _search_excerpt(disp, query)
     return [
         {"conversation_key": h["conversation_key"], "item_key": h["item_key"],
          "title": h["title"], "snippet": h["snippet"], "badges": sorted(h["_badges"]),
@@ -2154,22 +3673,31 @@ def _collapse_message_hits(conn: sqlite3.Connection, matched_rows: list) -> list
 
 def _search_title(conn: sqlite3.Connection, query: str) -> list[dict]:
     """Title search over the rollup table — identical LIKE semantics in both FTS
-    and LIKE modes (§6.2). Conversation-level hits (no item anchor)."""
+    and LIKE modes (§6.2). Conversation-level hits (no item anchor).
+
+    #463 S4 §5.1 — the third read path that needs cleaning, and the one that is
+    user-facing on the CLI: `cctally transcript search --source codex
+    --kind title` prints this `snippet` and emits this `title` in its JSON. The
+    MATCH still runs against the stored value, so a query that names markup
+    still finds its conversation; only what is shown is cleaned.
+    """
     like = f"%{query}%"
     hits = []
     for ck, title, last_act, project_label in conn.execute(
             "SELECT conversation_key, title, last_activity_utc, project_label "
             "FROM codex_conversation_rollups WHERE title LIKE ?", (like,)):
+        cleaned = clean_codex_title(title)
         hits.append(
-            {"conversation_key": ck, "item_key": None, "title": title,
-             "snippet": _excerpt(title), "badges": ["title"],
+            {"conversation_key": ck, "item_key": None, "title": cleaned,
+             "snippet": _excerpt(cleaned), "badges": ["title"],
              "last_activity_utc": last_act, "project_label": project_label})
     return hits
 
 
 def _search_files(conn: sqlite3.Connection, query: str) -> list[dict]:
     """File-touch search — matches file paths, collapsed to the owning message's
-    canonical item_key (§6.2)."""
+    canonical item_key (§6.2). ``message_id`` is an application-level link, so
+    an orphan is skipped and cannot suppress valid rows."""
     like = f"%{query}%"
     pos_cache: dict[str, dict] = {}
     fields_cache: dict[str, tuple] = {}
@@ -2244,7 +3772,7 @@ def search_codex_conversations(
         hits = _search_files(conn, query)
     else:
         hits = _collapse_message_hits(
-            conn, _matched_message_rows(conn, query, kind, mode))
+            conn, _matched_message_rows(conn, query, kind, mode), query)
     hits.sort(key=lambda h: (h["conversation_key"], h["item_key"] or ""))
     total = len(hits)
     page_hits, page = _paginate_hits(hits, cursor=cursor, limit=limit)
@@ -2256,6 +3784,402 @@ def search_codex_conversations(
 
 # ── in-conversation find (§3.1) ───────────────────────────────────────────────
 
+_CODEX_EXACT_FIND_SCHEMA_VERSION = 2
+_CODEX_EXACT_FIND_DEFAULT_LIMIT = 100
+_CODEX_EXACT_FIND_MAX_LIMIT = 200
+_CODEX_EXACT_FIND_CURSOR_PREFIX = "ofc1."
+_CODEX_EXACT_FIND_QUERY_DOMAIN = b"cctally-codex-find-query-v1\0"
+_CODEX_EXACT_FIND_OCCURRENCE_DOMAIN = b"cctally-codex-find-occurrence-v1\0"
+
+
+class InvalidFindCursor(ValueError):
+    """The external exact-find cursor is malformed."""
+
+
+class StaleFindCursor(ValueError):
+    """The exact-find cursor belongs to another query or projection generation."""
+
+
+def _exact_find_query_id(
+    query: str, *, regex: bool, case_sensitive: bool, kind: str
+) -> str:
+    payload = json.dumps(
+        {
+            "case": case_sensitive,
+            "kind": kind,
+            "projection": CODEX_FIND_PROJECTION_VERSION,
+            "query": query,
+            "regex": regex,
+        },
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return hashlib.sha256(_CODEX_EXACT_FIND_QUERY_DOMAIN + payload).hexdigest()
+
+
+def _exact_find_occurrence_id(
+    query_id: str,
+    *,
+    block_key: str,
+    surface: str,
+    ordinal: int,
+    start: int,
+    end: int,
+) -> str:
+    payload = json.dumps(
+        [
+            CODEX_FIND_PROJECTION_VERSION,
+            query_id,
+            block_key,
+            surface,
+            ordinal,
+            start,
+            end,
+        ],
+        ensure_ascii=False,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    digest = hashlib.sha256(_CODEX_EXACT_FIND_OCCURRENCE_DOMAIN + payload).digest()
+    return "o1." + base64.urlsafe_b64encode(digest).decode("ascii").rstrip("=")
+
+
+def _encode_exact_find_cursor(
+    *,
+    query_id: str,
+    generation: int,
+    start_index: int,
+    direction: str,
+    boundary: tuple[int, int, str, int],
+) -> str:
+    payload = json.dumps(
+        {
+            "b": list(boundary),
+            "d": direction,
+            "g": generation,
+            "i": start_index,
+            "q": query_id,
+            "v": CODEX_FIND_PROJECTION_VERSION,
+        },
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return _CODEX_EXACT_FIND_CURSOR_PREFIX + base64.urlsafe_b64encode(
+        payload
+    ).decode("ascii").rstrip("=")
+
+
+def _decode_exact_find_cursor(cursor: str) -> dict[str, object]:
+    if not isinstance(cursor, str) or not cursor.startswith(
+        _CODEX_EXACT_FIND_CURSOR_PREFIX
+    ):
+        raise InvalidFindCursor(cursor)
+    encoded = cursor[len(_CODEX_EXACT_FIND_CURSOR_PREFIX):]
+    try:
+        raw = base64.urlsafe_b64decode(encoded + "=" * (-len(encoded) % 4))
+        canonical = base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+        if canonical != encoded:
+            raise InvalidFindCursor(cursor)
+        payload = json.loads(raw.decode("utf-8"))
+    except (binascii.Error, ValueError, TypeError, UnicodeDecodeError, json.JSONDecodeError):
+        raise InvalidFindCursor(cursor) from None
+    if not isinstance(payload, dict) or set(payload) != {"b", "d", "g", "i", "q", "v"}:
+        raise InvalidFindCursor(cursor)
+    boundary = payload.get("b")
+    if (
+        payload.get("d") not in {"next", "previous"}
+        or type(payload.get("g")) is not int
+        or type(payload.get("i")) is not int
+        or payload["i"] < 0
+        or not isinstance(payload.get("q"), str)
+        or payload.get("v") != CODEX_FIND_PROJECTION_VERSION
+        or not isinstance(boundary, list)
+        or len(boundary) != 4
+        or type(boundary[0]) is not int
+        or type(boundary[1]) is not int
+        or not isinstance(boundary[2], str)
+        or type(boundary[3]) is not int
+    ):
+        raise InvalidFindCursor(cursor)
+    return payload
+
+
+def _exact_find_base(
+    query_id: str,
+    *,
+    status: str,
+    regex: bool,
+    kind: str,
+) -> dict[str, object]:
+    return {
+        "schema_version": _CODEX_EXACT_FIND_SCHEMA_VERSION,
+        "semantics": "occurrence",
+        "status": status,
+        "query_id": query_id,
+        "selection_stale": False,
+        "mode": "regex" if regex else "literal",
+        "kind": kind,
+        "search_depth": "full",
+    }
+
+
+def find_occurrences_in_codex_conversation(
+    conn: sqlite3.Connection,
+    conversation_key: str,
+    query: str,
+    *,
+    regex: bool,
+    case_sensitive: bool,
+    kind: str,
+    limit: int = _CODEX_EXACT_FIND_DEFAULT_LIMIT,
+    cursor: str | None = None,
+    direction: str = "next",
+    around: str | None = None,
+) -> dict[str, object]:
+    """Return occurrence-exact matches over the materialized visible projection.
+
+    Matching never crosses a physical projection surface. Coordinates are
+    Unicode-scalar offsets into stable render leaves, while paging cursors are
+    bound to both query semantics and the current projection generation.
+    """
+    if kind not in CODEX_FIND_KINDS:
+        raise ValueError(f"unknown kind: {kind}")
+    if not isinstance(limit, int) or not 1 <= limit <= _CODEX_EXACT_FIND_MAX_LIMIT:
+        raise ValueError("find limit must be between 1 and 200")
+    if direction not in {"next", "previous"}:
+        raise ValueError("find direction must be next or previous")
+    if cursor is not None and around is not None:
+        raise ValueError("find cursor and around are mutually exclusive")
+    q = (query or "").strip()
+    query_id = _exact_find_query_id(
+        q, regex=regex, case_sensitive=case_sensitive, kind=kind
+    )
+    exists = conn.execute(
+        "SELECT 1 FROM codex_conversation_messages WHERE conversation_key=? LIMIT 1",
+        (conversation_key,),
+    ).fetchone()
+    if exists is None:
+        return {"status": "not_found", "conversation_key": conversation_key}
+    complete = conn.execute(
+        "SELECT 1 FROM cache_meta WHERE "
+        "key='codex_find_projection_complete_version' AND value=?",
+        (str(CODEX_FIND_PROJECTION_VERSION),),
+    ).fetchone()
+    base = _exact_find_base(query_id, status="ready", regex=regex, kind=kind)
+    empty_page = {
+        "start_index": 0,
+        "previous_cursor": None,
+        "next_cursor": None,
+        "occurrences": [],
+    }
+    if complete is None:
+        return {**base, "status": "indexing", "page": empty_page}
+    generation_row = conn.execute(
+        "SELECT value FROM cache_meta WHERE key='codex_find_projection_generation'"
+    ).fetchone()
+    try:
+        generation = int(generation_row[0]) if generation_row else 0
+    except (TypeError, ValueError):
+        generation = 0
+
+    decoded_cursor = None
+    if cursor is not None:
+        decoded_cursor = _decode_exact_find_cursor(cursor)
+        if (
+            decoded_cursor["q"] != query_id
+            or decoded_cursor["g"] != generation
+            or decoded_cursor["d"] != direction
+        ):
+            raise StaleFindCursor(cursor)
+
+    if not q or (regex and len(q) > _CODEX_FIND_REGEX_MAX_LEN):
+        return {**base, "total": 0, "page": empty_page}
+    pattern = re.compile(q, 0 if case_sensitive else re.IGNORECASE) if regex else None
+    kind_predicate = {
+        "all": "1=1",
+        "prompts": "m.kind='user'",
+        "assistant": "m.kind='assistant'",
+        "tools": "p.surface IN ('call','output','completion')",
+        "thinking": "m.kind='reasoning'",
+    }[kind]
+    rows = conn.execute(
+        "SELECT p.message_id,p.item_key,p.block_key,p.container_block_key,"
+        "p.surface,p.render_order,"
+        "p.projected_text,p.leaves_json,p.disclosure_json,m.kind "
+        "FROM codex_find_projection p "
+        "JOIN codex_conversation_messages m ON m.id=p.message_id "
+        "WHERE p.conversation_key=? AND p.projection_version=? AND "
+        + kind_predicate
+        + " ORDER BY p.render_order,p.message_id,p.surface",
+        (conversation_key, CODEX_FIND_PROJECTION_VERSION),
+    )
+    requested: list[tuple[dict[str, object], tuple[int, int, str, int]]] = []
+    around_page: list[tuple[dict[str, object], tuple[int, int, str, int]]] = []
+    head: list[tuple[dict[str, object], tuple[int, int, str, int]]] = []
+    tail: deque[tuple[dict[str, object], tuple[int, int, str, int]]] = deque(
+        maxlen=limit
+    )
+    head_next = None
+    requested_next = None
+    around_next = None
+    around_index = None
+    cursor_valid = decoded_cursor is None
+    cursor_index = int(decoded_cursor["i"]) if decoded_cursor is not None else None
+    requested_start = None
+    requested_end = None
+    if decoded_cursor is not None:
+        if direction == "previous":
+            requested_end = cursor_index
+            requested_start = max(0, cursor_index - limit)
+        else:
+            requested_start = cursor_index
+            requested_end = cursor_index + limit
+    total = 0
+    for (
+        message_id,
+        item_key,
+        block_key,
+        container_block_key,
+        surface,
+        render_order,
+        text,
+        leaves_json,
+        disclosure_json,
+        row_kind,
+    ) in rows:
+        try:
+            leaves = tuple(ProjectedLeaf(**leaf) for leaf in json.loads(leaves_json))
+            disclosure = json.loads(disclosure_json)
+        except (TypeError, ValueError, json.JSONDecodeError):
+            continue
+        ranges = (
+            iter_regex_ranges(text, pattern)
+            if pattern is not None
+            else iter_literal_ranges(text, q, case_sensitive=case_sensitive)
+        )
+        for ordinal, match in enumerate(ranges):
+            fragments = slice_range_to_leaves(match, leaves)
+            if not fragments:
+                continue
+            occurrence_id = _exact_find_occurrence_id(
+                query_id,
+                block_key=block_key,
+                surface=surface,
+                ordinal=ordinal,
+                start=match.start,
+                end=match.end,
+            )
+            match_kinds = []
+            if surface != "body":
+                match_kinds.append("tool")
+            if row_kind == "reasoning":
+                match_kinds.append("thinking")
+            occurrence = {
+                    "occurrence_id": occurrence_id,
+                    "item_key": item_key,
+                    "block_key": block_key,
+                    "container_block_key": container_block_key,
+                    "surface": surface,
+                    "match_kinds": match_kinds,
+                    "disclosure": disclosure if isinstance(disclosure, list) else [],
+                    "fragments": [
+                        {
+                            "leaf_key": fragment.leaf_key,
+                            "start": fragment.start,
+                            "end": fragment.end,
+                        }
+                        for fragment in fragments
+                    ],
+                }
+            boundary = (render_order, message_id, surface, ordinal)
+            pair = (occurrence, boundary)
+            index = total
+            if len(head) < limit:
+                head.append(pair)
+            elif index == limit:
+                head_next = pair
+            tail.append(pair)
+            if cursor_index == index:
+                if tuple(decoded_cursor["b"]) != boundary:
+                    raise StaleFindCursor(cursor)
+                cursor_valid = True
+            if (
+                requested_start is not None
+                and requested_end is not None
+                and requested_start <= index < requested_end
+            ):
+                requested.append(pair)
+            elif requested_end is not None and index == requested_end:
+                requested_next = pair
+            if around is not None and around_index is None:
+                if occurrence["occurrence_id"] == around:
+                    around_index = index
+                    around_page.append(pair)
+            elif around_index is not None:
+                if len(around_page) < limit:
+                    around_page.append(pair)
+                elif index == around_index + limit:
+                    around_next = pair
+            total += 1
+
+    if not cursor_valid:
+        raise StaleFindCursor(cursor)
+    selection_stale = around is not None and around_index is None
+    next_pair = None
+    if around is not None and around_index is not None:
+        start_index = around_index
+        page_pairs = around_page
+        next_pair = around_next
+    elif around is not None:
+        start_index = 0
+        page_pairs = head
+        next_pair = head_next
+    elif decoded_cursor is not None:
+        start_index = min(requested_start or 0, total)
+        page_pairs = requested
+        next_pair = requested_next
+    elif direction == "previous":
+        page_pairs = list(tail)
+        start_index = max(0, total - len(page_pairs))
+    else:
+        start_index = 0
+        page_pairs = head
+        next_pair = head_next
+    page_occurrences = [occurrence for occurrence, _boundary in page_pairs]
+
+    def cursor_for(
+        index: int,
+        cursor_direction: str,
+        pair: tuple[dict[str, object], tuple[int, int, str, int]] | None,
+    ) -> str | None:
+        if not 0 <= index < total or pair is None:
+            return None
+        return _encode_exact_find_cursor(
+            query_id=query_id,
+            generation=generation,
+            start_index=index,
+            direction=cursor_direction,
+            boundary=pair[1],
+        )
+
+    previous_cursor = (
+        cursor_for(start_index, "previous", page_pairs[0])
+        if start_index > 0 and page_pairs else None
+    )
+    next_index = start_index + len(page_occurrences)
+    next_cursor = cursor_for(next_index, "next", next_pair)
+    return {
+        **base,
+        "total": total,
+        "selection_stale": selection_stale,
+        "page": {
+            "start_index": start_index,
+            "previous_cursor": previous_cursor,
+            "next_cursor": next_cursor,
+            "occurrences": page_occurrences,
+        },
+    }
+
 # Claude cap parity: the anchor list caps at 500 (bin/_lib_conversation_query.py
 # ::_FIND_ANCHOR_CAP), with anchors_truncated when more anchors exist pre-cap.
 _CODEX_FIND_ANCHOR_CAP = 500
@@ -2607,6 +4531,17 @@ def read_codex_payload(
     response = {"status": "ok", "block_key": block_key, "which": which,
                 "content": content, "truncated": truncated}
     if card is not None:
+        # The SAME ordinal substitution the paged assembly applies (spec sections
+        # 4.3 and 6.5). Without it this route published the provider's own
+        # session id while the paged detail published the conversation-local
+        # ordinal, so one field carried two meanings depending on which route
+        # served it — and a client validator can only be written against one.
+        # A session the index does not know becomes `ref: null`, never the raw
+        # id, because `_apply_session_ordinals` fails closed.
+        index_rows, _detail_bytes = _load_conversation_index_rows(
+            conn, conversation_key)
+        _envelope, ordinals = _build_session_index(index_rows)
+        _apply_session_ordinals(card, ordinals)
         response["card"] = card
     return response