cctally 1.92.0 → 1.92.2

package/CHANGELOG.md

@@ -5,6 +5,26 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.92.2] - 2026-08-06
+
+### Changed
+- Rebuilding the stats index now uses about half the memory it used to. On a 1.7 GB journal the rebuild's peak memory dropped from 9.0 GB to 4.6 GB, and the memory Python itself holds dropped from 6.5 GB to 2.1 GB. The rebuild used to read the whole journal twice — once to hold every raw line and once to hold every parsed record — and then read it a third time from the beginning to find one operator record; it now reads each byte at most once and keeps only the records it actually replays. Reading and decoding the journal got faster (12.2 s to 9.5 s), the separate search for that operator record disappeared entirely (6.3 s to none), and a whole rebuild finished in 62.9 s instead of 68.9 s. Nothing about the resulting index changed: the same records are selected, the same rows are written, and the same corrections win. One thing did get worse, and you may notice it: while a rebuild replays Codex quota history it now blocks other commands from writing the Codex cache for longer than before — about 38% longer on a run whose data is already in memory (16.7 s to 23.0 s) and about 18% longer on a cold one (41.6 s to 48.9 s) — because the quota records are now decoded while that lock is held instead of before it is taken (#496).
+
+### Fixed
+- A readable but structurally damaged stats index no longer traps an upgrade or recovery in an endless rebuild loop. Version 1.92.1 could copy a healthy rebuilt generation into a file that still contained unreferenced pages, preserve those pages because no schema object named them, fail its post-publication integrity check, and leave the dashboard at `server sync error`; CLI block reports then lost their authoritative reset anchors and marked every block approximate. Publication now checks the destination before mutating it and uses the validated replacement path when the existing file fails integrity, while healthy files keep the in-place transactional path (#496).
+
+## [1.92.1] - 2026-08-06
+
+### Changed
+- A rebuilt stats index is now published into the existing database file inside a single transaction, instead of being written to a scratch file that is then renamed over the live one. Reports and the dashboard keep working while a rebuild publishes, rather than being refused because a connection is open, and a reader that is mid-query keeps seeing the data it started with. Because nothing is destroyed, `cctally db rebuild --db stats` no longer leaves a quarantined copy of the previous index and no longer prints the line saying it did; use `cctally db backup --db stats` when you want a snapshot beforehand. If a published index then fails its own validation, the refusal explains that no copy of the previous index was kept, instead of directing you to a quarantine directory that was never created. A database the tool cannot open at all is still replaced the old way, with the previous copy preserved. This upgrade rebuilds the stats index once (#496).
+- Recovering a corrupt stats index no longer makes you wait for it. Previously the command that first met the damage — a status line render, a dashboard start, any report — replayed the whole journal on its own thread before returning. That recovery now runs in the background: the command that found the damage writes the evidence, schedules the rebuild, tells you where the evidence is and that a rebuild is running, and exits without replacing anything. The dashboard and the terminal dashboard show a "rebuilding" frame and fill in on a later refresh, and `cctally db rebuild --db stats` is still the command to run when you want to wait for it. Repeated detections while a rebuild is in flight collapse into that one rebuild rather than starting more. A recovery also no longer runs unless a second check confirms the index really is damaged, and every recovery is now recorded in a small private log of the last 50 events, so a fault that keeps coming back is visible instead of only being repaired. That log does not report whether any recorded value changed, because the rebuild has no way to know (#496).
+
+### Fixed
+- The Codex Current Cycle modal no longer presents its native-quota label as a second provider identity, keeping Codex on its single app-wide identity accent while preserving the modal's section and state colors (#498).
+- Account-filtered Codex conversation lists now retain each conversation's project grouping and badge instead of relabelling every scoped row as `(unassigned)` (#497).
+- Conversation permalinks now keep the selected conversation visible and marked current even when it falls beyond the rail's first 50 rows, without changing the saved search and filter behavior of browser history traversal (#501).
+- Conversation Viewer find now counts and reaches text inside Codex injected-context, skill, command, compaction, and notification bodies. Selecting a match opens only its owning disclosure and marks the exact visible text, including provider-tagged context prose and rendered context diffs; existing stores rebuild the disposable find projection in bounded resumable batches (#499).
+
 ## [1.92.0] - 2026-08-05
 
 ### Added
@@ -22,7 +42,7 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Stats damage characterization now detects a table or index whose root page holds the wrong kind of b-tree page. The previous check accepted any valid page type, so the damage shape that actually occurs — a table rooted at an index leaf — was reported as healthy (#496).
 - A detached Codex quota verification can no longer make the following hook tick acknowledge success without evaluating its budget alerts. If the verifier still owns the stats ingest lock, the tick remains due and retries as soon as that lock is released (#461).
 - Cache Report no longer warns that net cache spend is negative when savings and write costs cancel to an effectively zero floating-point residue (#471).
-- Fix `cctally setup` npm installs repeatedly adding duplicate Codex Stop/SubagentStop hooks instead of reconciling them (#458).
+- Fix `cctally setup` npm installs repeatedly adding duplicate Codex Stop/SubagentStop hooks instead of reconciling them (#458; reported independently by @darlingm, who also supplied a regression patch).
 - Cache Report charts now announce one consistent window size to screen readers and identify unobserved days as a measured subset (#469).
 - Codex quota rows restored from the journal or repaired during migration now invalidate cached dashboard and projection state immediately, instead of waiting for an unrelated later Codex mutation (#457).
 - Codex file-path search now indexes the dict-shaped patch events the provider actually records, and upgrades backfill retained history so existing conversations become searchable by touched file (#489).

package/README.md

@@ -30,9 +30,11 @@ Your Claude Code plan meters you with a percentage that creeps up all week. ccta
 </p>
 
 <!-- cctally:latest-stable:begin -->
-**Latest stable: v1.90.1** (2026-08-02)
+**Latest stable: v1.92.0** (2026-08-05)
 
-- Internal (maintainer-only): the public release snapshot no longer ships the issue-triage pytest modules without the private workflow implementation they import. Those tests now stay behind the same mirror boundary as their `.agent-workflows` dependencies, preventing collection failures across the public Python matrix.
+- Add per-run bearer authentication for non-loopback dashboards, with fragment-to-HttpOnly-cookie browser bootstrap and a restart-only Settings/CLI opt-out (#282).
+- Add account-scoped conversation browsing, search, reading, export, and permalinks to the dashboard and `cctally transcript`, while preserving the existing all-account and single-account output shapes (#347).
+- Long Codex conversations now open with two concurrent data requests instead of issuing a third detail request just to repeat totals already available from the outline. On the same 3,733-row conversation, the first painted row improved from 784 ms to 421, 429 ms while live-tail streaming remained connected (#477).
 <!-- cctally:latest-stable:end -->
 
 ## Quick start

package/bin/_cctally_cache.py

@@ -127,6 +127,7 @@ def _cctally():
 # for ``eprint`` is deleted.
 import _cctally_core
 from _cctally_core import eprint
+from _lib_codex_find_projection import CODEX_FIND_PROJECTION_VERSION
 from _lib_source_identity import source_root_key
 # #416 spec §4.2: the pure tolerance-anchored reset kernel. `_lib_quota` imports
 # only `_lib_accounts` (a stdlib leaf), so binding it here is circular-safe.
@@ -2076,7 +2077,8 @@ def run_codex_find_projection_backfill(
     if pending is None:
         complete = conn.execute(
             "SELECT 1 FROM cache_meta "
-            "WHERE key='codex_find_projection_complete_version' AND value='1'"
+            "WHERE key='codex_find_projection_complete_version' AND value=?",
+            (str(CODEX_FIND_PROJECTION_VERSION),),
         ).fetchone() is not None
         return {"processed": 0, "complete": complete}
     row = conn.execute(
@@ -2113,13 +2115,17 @@ def run_codex_find_projection_backfill(
     complete = remaining is None
     if complete:
         conn.execute(
-            "INSERT OR REPLACE INTO cache_meta(key,value) VALUES"
-            "('codex_find_projection_complete_version','1')"
+            "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
+            (
+                "codex_find_projection_complete_version",
+                str(CODEX_FIND_PROJECTION_VERSION),
+            ),
         )
         conn.execute(
             "DELETE FROM cache_meta WHERE key IN "
             "('codex_find_projection_backfill_pending',"
-            " 'codex_find_projection_backfill_cursor')"
+            " 'codex_find_projection_backfill_cursor',"
+            " 'codex_find_projection_backfill_version')"
         )
     conn.commit()
     return {"processed": len(selected), "complete": complete}
@@ -8699,7 +8705,41 @@ def scope_conversations_db_to_account(
         )
         if row[0]
     }
+    safe_project_attribution: dict[str, tuple[str | None, str | None]] = {}
+    for conversation_key in codex_keys:
+        persisted = conn.execute(
+            "SELECT project_key,project_label "
+            "FROM main.codex_conversation_rollups WHERE conversation_key=?",
+            (conversation_key,),
+        ).fetchone()
+        if persisted is not None:
+            safe_project_attribution[conversation_key] = persisted
+            continue
+        thread = conn.execute(
+            "SELECT source_root_key,cwd,git_json "
+            "FROM cache_db.codex_conversation_threads WHERE conversation_key=?",
+            (conversation_key,),
+        ).fetchone()
+        if thread is not None:
+            safe_project_attribution[conversation_key] = (
+                _codex_conversation_project_attribution(*thread)
+            )
     _recompute_codex_rollups(conn, codex_keys)
+    # Project identity is safe conversation-level enrichment: it is already
+    # visible on the unqualified rail and contains only an opaque key plus the
+    # derived display label. Preserve those two fields for conversations that
+    # survived the physical-row account predicate, without exposing the
+    # conversation-level cwd/git, source-root path, title, or thread topology
+    # that produced them (#497).
+    conn.executemany(
+        "UPDATE codex_conversation_rollups SET project_key=?,project_label=? "
+        "WHERE conversation_key=?",
+        [
+            (project_key, project_label, conversation_key)
+            for conversation_key, (project_key, project_label)
+            in safe_project_attribution.items()
+        ],
+    )
     # TEMP rollup writes open a transaction. Close it before a long-lived
     # account-scoped SSE reader starts watching so later provider-writer commits
     # are visible to the dynamic leaf views and never contend on this setup work.

package/bin/_cctally_core.py

@@ -367,7 +367,15 @@ STATS_WAL_SIZE_LIMIT_BYTES = 16 * 1024 * 1024  # 16777216
 # 1006 -> 1007 (#460): scheduled quota-alert ownership. Adds the per-root
 # future-capture schedule that lets a matured boundary widen to its owning root
 # instead of deferring forever on a quiet hook-only install.
-STATS_INDEX_EPOCH = 1007
+# 1007 -> 1008 (#496 S3): in-place transactional publication. Adds
+# `stats_publication_stamp`, the publication identity written inside the
+# publication transaction. It replaces the marker's `scratchPath` crash
+# discriminator, which an in-place publish inverts because it attaches the
+# scratch read-only and leaves it on disk whether the transaction committed or
+# rolled back. A stats schema change is an epoch bump and never a migration;
+# the 13-migration registry stays frozen. Each install pays one rebuild on
+# upgrade, deferred to the background worker by #453.
+STATS_INDEX_EPOCH = 1008
 LEGACY_STATS_HEAD = 13
 
 #: #496 S1 F1. A NEW branch, for a state that cannot occur before the
@@ -384,6 +392,21 @@ STATS_PUBLICATION_FAILED_MSG = (
     "logs/. Recovery: run `cctally db rebuild --db stats`."
 )
 
+#: #496 S3. The text above describes PHYSICAL replacement, which is now the
+#: fallback. In-place publication drops the live generation and installs the
+#: scratch's inside one transaction, so it preserves nothing and allocates no
+#: quarantine directory — and the sentence about a preserved predecessor would
+#: send a user whose index is already known bad to a directory that does not
+#: exist. Selected by the mechanism the publication marker records.
+STATS_PUBLICATION_FAILED_IN_PLACE_MSG = (
+    "stats.db published a rebuilt index that then FAILED validation, so the "
+    "live index is known bad and cctally refuses to use it. path: {path}. "
+    "The rebuild record naming the failing check is at {record}. This index "
+    "was published in place, so no copy of the previous index was kept; every "
+    "row it holds is derived from the append-only journal, which the "
+    "publication did not touch. Recovery: run `cctally db rebuild --db stats`."
+)
+
 
 # === Telemetry constants (non-path; see spec 2026-07-07) =============
 #
@@ -722,18 +745,27 @@ def ensure_dirs() -> None:
 # before returning does not, and must not — see `stats_open_guarded`):
 #   bin/_cctally_journal.py  _acquire_maintenance_{shared,exclusive} / _release
 #   bin/_cctally_store.py    _heal_flock_blocking, reached through
-#                            _acquire_stats_maintenance_reentrant by the heal
-#                            hook and the epoch resolver
+#                            _acquire_stats_maintenance_reentrant by the epoch
+#                            resolver
+#   bin/_cctally_store.py    _acquire_stats_maintenance_for_heal, the corruption
+#                            heal's ownership-first BOUNDED acquire (#496 S3)
 #   bin/_cctally_db.py       cmd_db_rebuild, _acquire_db_admin_writer_flocks
 #                            (db skip / db unskip), _cmd_db_repair_exclusive,
 #                            _vacuum_one_db
 #   bin/_cctally_rederive.py _rederive_locks
+#   bin/_cctally_store.py    stats_open_guarded's interrupted-rebuild-recovery
+#                            branch, which upgrades to EXCLUSIVE and then calls
+#                            rebuild_stats_index (#496 S3)
 # Adding another acquisition site without noting it here reintroduces the hang.
 #
-# The opener (`_cctally_store.stats_open_guarded`) takes the lock SHARED and
-# releases it before handing the connection back, so it deliberately does NOT
-# note a hold — but it DOES consult `holds_stats_maintenance()` to skip the
-# acquire entirely when this context already owns the exclusive side.
+# The opener (`_cctally_store.stats_open_guarded`) takes the lock SHARED around
+# an ordinary open and releases it before handing the connection back, so that
+# acquire deliberately does NOT note a hold — but it DOES consult
+# `holds_stats_maintenance()` to skip the acquire entirely when this context
+# already owns the exclusive side. Its interrupted-rebuild-recovery branch is
+# the exception: that one upgrades to EXCLUSIVE and holds it across a rebuild,
+# whose in-place publisher opens the destination through `stats_open_guarded`
+# again, so it notes the hold like every other exclusive site.
 
 _STATS_MAINTENANCE_HELD = contextvars.ContextVar(
     "cctally_stats_maintenance_held", default=0
@@ -2475,6 +2507,23 @@ def open_db(*, _target_path=None) -> sqlite3.Connection:
             "kind TEXT NOT NULL, "
             "violation_json TEXT NOT NULL)"
         )
+        # In-place publication identity (#496 S3 §5). An in-place publish
+        # attaches the scratch read-only and detaches it, so the scratch
+        # survives commit and rollback identically and the publication marker's
+        # `scratchPath` proxy inverts. This row is written INSIDE the
+        # publication transaction, so it commits atomically with the content
+        # and the `user_version` it describes and a crash before the commit
+        # rolls it back. The opener compares it against the marker's
+        # `recordPath` and knows without inference whether that publication
+        # committed. Holds at most one row; single-row-ness is deliberately not
+        # enforced structurally, because a duplicated row is one of the states
+        # that must resolve INDETERMINATE rather than be made impossible.
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS stats_publication_stamp ("
+            "record_path TEXT NOT NULL, "
+            "started_at_utc TEXT NOT NULL, "
+            "stamped_at_utc TEXT NOT NULL)"
+        )
 
         # §6.2 backfill gate (Task 8): stamp the one-shot marker AFTER the three
         # open-time backfills ran, so the next open skips them (and their probes)

package/bin/_cctally_dashboard.py

@@ -4353,12 +4353,40 @@ def _debug_source_state_wire(bundle, source: str) -> dict:
     }
 
 
-def _debug_source_counts(cache_conn, bundle) -> dict:
+def _debug_stats_fault(exc: BaseException, leg: str) -> dict:
+    """The wire form of a stats attribution these debug reads may report.
+
+    #496 S3 §8 records a DELIBERATE deviation from F16's literal wording. F16
+    asks that every path meeting a corrupt index produce a typed attribution
+    AND reach the heal. The two debug helpers deliver the attribution WITHOUT
+    the heal: they are short-lived diagnostic reads that bypass the corruption
+    boundary for cost, and making a debug endpoint able to trigger a rebuild is
+    a worse outcome than making it honest. The dashboard's main build path
+    already reaches the heal, so a fault attributed here is healed on the next
+    tick.
+
+    The shape is exactly the mapping `_sync_failure_envelope`'s attribution
+    reader already accepts, so this travels on the established vocabulary
+    rather than inventing a second one. No database probe is needed: the
+    connection these helpers were opening is the stats index by construction.
+    """
+    return {
+        "leg": leg,
+        "database": "stats",
+        "corruption": bool(_cctally()._is_sqlite_corruption_error(exc)),
+    }
+
+
+def _debug_source_counts(cache_conn, bundle, *, faults=None) -> dict:
     """Bounded, source-owned counts and opaque state for the debug endpoint.
 
     Every table and predicate is fixed here.  This deliberately reports no
     values from rows: roots, paths, logical limits, conversation IDs, and
     project labels never cross the diagnostic boundary.
+
+    ``faults`` collects `_debug_stats_fault` mappings for a stats read this
+    diagnostic could not complete, so the endpoint reports the fault instead of
+    silently degrading a stats failure into a missing count.
     """
     result = {
         source: _debug_source_state_wire(bundle, source)
@@ -4388,8 +4416,9 @@ def _debug_source_counts(cache_conn, bundle) -> dict:
                     result[source]["tables"][table] = int(row[0])
                 except sqlite3.Error:
                     pass
-    except sqlite3.Error:
-        pass
+    except sqlite3.Error as exc:
+        if faults is not None:
+            faults.append(_debug_stats_fault(exc, "debug-source-counts"))
     finally:
         if stats_conn is not None:
             stats_conn.close()
@@ -4419,7 +4448,7 @@ def _stats_ro_guarded():
     )
 
 
-def _debug_cache_state(cache_conn) -> dict:
+def _debug_cache_state(cache_conn, *, faults=None) -> dict:
     """On-demand signature legs + pending-reingest flags + generation.
 
     The signature legs are the canonical ``compute_signature`` fields (ints /
@@ -4433,8 +4462,10 @@ def _debug_cache_state(cache_conn) -> dict:
     stats_conn = None
     try:
         stats_conn = _stats_ro_guarded()
-    except sqlite3.Error:
+    except sqlite3.Error as exc:
         stats_conn = None
+        if faults is not None:
+            faults.append(_debug_stats_fault(exc, "debug-cache-state"))
     try:
         if stats_conn is not None:
             sig = sc.compute_signature(
@@ -5061,13 +5092,16 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             source_bundle = self.snapshot_ref.get().source_bundle
         except Exception:  # noqa: BLE001 -- diagnostics fail closed.
             source_bundle = None
-        sources = _debug_source_counts(None, source_bundle)
+        stats_faults: list[dict] = []
+        sources = _debug_source_counts(None, source_bundle, faults=stats_faults)
         try:
             conn = open_cache_db()
             try:
                 dataset = _debug_cache_table_counts(conn)
-                cache_state = _debug_cache_state(conn)
-                sources = _debug_source_counts(conn, source_bundle)
+                cache_state = _debug_cache_state(conn, faults=stats_faults)
+                sources = _debug_source_counts(
+                    conn, source_bundle, faults=stats_faults
+                )
             finally:
                 conn.close()
         except Exception:  # noqa: BLE001 -- a diagnostic must not expose raw errors.
@@ -5080,6 +5114,11 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             "phases": (last or {}).get("phases"),
             "cache_state": cache_state,
             "sources": sources,
+            # Additive, and named rather than folded into `cache_state`: a
+            # stats fault is not cache state, and #496 S3 §8 exists because a
+            # stats failure reported as a cache one sends the user to
+            # `cctally cache-sync --rebuild`.
+            "stats_faults": stats_faults,
         }
         if body["phases"] is None:
             body["note"] = "tracing_disabled"
@@ -7033,15 +7072,28 @@ def _dashboard_initial_snapshot(args, *, pinned_now, display_tz_pref_override):
             display_tz_pref_override=display_tz_pref_override,
             stats_heal_attempted=False,
         )
-    except c.StatsEpochRebuildDeferred as exc:
-        return _dashboard_stats_epoch_deferred_snapshot(
+    except c.StatsRebuildDeferred as exc:
+        return _dashboard_stats_deferred_snapshot(
             args,
             pinned_now=pinned_now,
             exc=exc,
         )
     except tui._StatsSnapshotCorruption as fault:
         # The once-builder's finally has closed the cheap-seed stats handle.
-        tui._tui_heal_post_query_stats(fault.cause)
+        #
+        # #496 S3 §6: this call is made from INSIDE an `except` handler, so a
+        # `BaseException` raised by the heal would escape past the sibling
+        # `except` above and fail dashboard startup instead of hydrating it.
+        # The shared deferral base is therefore caught AT the heal-call
+        # boundary, and the correctly typed degraded frame is built directly.
+        try:
+            tui._tui_heal_post_query_stats(fault.cause)
+        except c.StatsRebuildDeferred as deferred:
+            return _dashboard_stats_deferred_snapshot(
+                args,
+                pinned_now=pinned_now,
+                exc=deferred,
+            )
         return _dashboard_initial_snapshot_once(
             args,
             pinned_now=pinned_now,
@@ -7050,8 +7102,13 @@ def _dashboard_initial_snapshot(args, *, pinned_now, display_tz_pref_override):
         )
 
 
-def _dashboard_stats_epoch_deferred_snapshot(args, *, pinned_now, exc):
-    """Bind promptly with a typed degraded frame while replay runs detached."""
+def _dashboard_stats_deferred_snapshot(args, *, pinned_now, exc):
+    """Bind promptly with a typed degraded frame while a rebuild runs detached.
+
+    Serves both deferral classes and keeps them distinct: a wrong EPOCH is a
+    readable index, while a deferred corruption heal is an index that could not
+    be read, and the attribution must say which (#496 S3 §6).
+    """
 
     import time as _time
 
@@ -7085,7 +7142,7 @@ def _dashboard_stats_epoch_deferred_snapshot(args, *, pinned_now, exc):
             tui.SyncFailureAttribution(
                 leg="stats-open",
                 database="stats",
-                corruption=False,
+                corruption=isinstance(exc, c.StatsHealDeferred),
             ),
         ),
         "doctor_payload": doctor_payload,

package/bin/_cctally_dashboard_conversation.py

@@ -223,12 +223,12 @@ def _conversation_query_impl():
 # are deliberately absent — they are meaningless on a collection route, so they
 # fall to "genuinely unknown → ignored".
 _RECOGNIZED_CONVERSATION_PARAMS = (
-    "source", "account", "project_key", "model", "limit", "cursor", "q", "kind",
+    "source", "account", "project_key", "model", "limit", "cursor", "selected", "q", "kind",
     "sort", "offset", "date_from", "date_to", "projects",
     "cost_min", "cost_max", "rebuild_min", "models",
 )
 _QUALIFIED_BROWSE_ACCEPTED = (
-    "source", "account", "project_key", "model", "limit", "cursor")
+    "source", "account", "project_key", "model", "limit", "cursor", "selected")
 _QUALIFIED_SEARCH_ACCEPTED = (
     "source", "account", "q", "kind", "limit", "cursor")
 _QUALIFIED_FACETS_ACCEPTED = ("source", "account")
@@ -364,12 +364,14 @@ def _handle_qualified_browse(handler, qs_raw, source):
         return
     project_key = (parsed.get("project_key", [None])[0] or None)
     model = (parsed.get("model", [None])[0] or None)
+    selected = (parsed.get("selected", [None])[0] or None)
     speed = _resolve_effective_speed()
     disp = _conversation_dispatch()
     ok, body = handler._run_conversation_query(
         lambda conn: disp.neutral_browse(
             conn, source=source, effective_speed=speed,
-            project_key=project_key, model=model, limit=limit, cursor=cursor),
+            project_key=project_key, model=model, limit=limit, cursor=cursor,
+            selected=selected),
         "/api/conversations")
     if not ok:
         return
@@ -604,12 +606,14 @@ def _handle_get_conversations_impl(handler) -> None:
     sort = _qs_str(q, "sort", "recent")
     limit = _qs_int(q, "limit", 50)
     offset = _qs_int(q, "offset", 0)
+    selected = _qs_str(q, "selected", None)
     filters = handler._parse_conversation_filters(q)
     if filters is None:
         return  # a 400 has already been sent
     ok, body = handler._run_conversation_query(
         lambda conn: handler._conversation_query().list_conversations(
-            conn, sort=sort, limit=limit, offset=offset, **filters),
+            conn, sort=sort, limit=limit, offset=offset, selected=selected,
+            **filters),
         "/api/conversations")
     if not ok:
         return

package/bin/_cctally_db.py

@@ -99,6 +99,7 @@ from _cctally_core import (
 # the migration gate-defer diagnostic routes through _lib_log so
 # CCTALLY_DEBUG verbosity is decided in one place.
 import _lib_log
+from _lib_codex_find_projection import CODEX_FIND_PROJECTION_VERSION
 
 
 # Production cache dispatchers hold maintenance-exclusive + the global cache
@@ -312,31 +313,84 @@ class StatsEpochMismatchError(sqlite3.DatabaseError):
     DB failure; ``main()`` maps it to a staged exit 3."""
 
 
-class StatsEpochRebuildDeferred(BaseException):
-    """A readable wrong-epoch stats index is rebuilding out of process.
+class StatsRebuildDeferred(BaseException):
+    """A stats.db rebuild this caller must not perform inline runs detached.
+
+    The shared parent of both deferral signals (#496 S3 §6), so every catch
+    site is widened ONCE rather than growing a second name each time a rebuild
+    class is detached. ``outcome`` records whether this caller spawned the
+    worker, observed an existing attempt, or could not spawn it.
 
-    Ordinary callers must not read the schema-incompatible old index or pay
-    whole-journal replay latency inline. ``outcome`` records whether this
-    caller spawned the worker, observed an existing attempt, or could not
-    spawn it; ``main()`` maps every case to prompt retry guidance and exit 3.
     This deliberately derives directly from ``BaseException``: reporting
     kernels contain many broad ``Exception`` / ``sqlite3.DatabaseError``
     fallbacks that turn missing optional data into ``n/a``. Swallowing this
     control signal there would publish a misleading partial report. The CLI
     boundary, dashboard, and statusline catch it explicitly; ``finally``
     cleanup still runs normally.
+
+    The two subclasses are NOT interchangeable at the degrade sites: the epoch
+    path describes a readable index at the wrong version and reports
+    ``corruption=False``, while a deferred heal describes an index that could
+    not be read and must report ``corruption=True``. Flattening them makes the
+    dashboard name the wrong fault.
     """
 
-    def __init__(self, outcome: str) -> None:
+    def __init__(self, outcome: str, message: str) -> None:
         self.outcome = str(outcome)
+        super().__init__(message)
+
+
+class StatsEpochRebuildDeferred(StatsRebuildDeferred):
+    """A readable wrong-epoch stats index is rebuilding out of process.
+
+    Ordinary callers must not read the schema-incompatible old index or pay
+    whole-journal replay latency inline; ``main()`` maps every case to prompt
+    retry guidance and exit 3.
+    """
+
+    def __init__(self, outcome: str) -> None:
+        outcome = str(outcome)
         message = (
             "could not start the stats.db index epoch rebuild; retry this "
             "command shortly"
-            if self.outcome == "failed"
+            if outcome == "failed"
             else "stats.db index epoch rebuild is running in the background; "
                  "retry shortly"
         )
-        super().__init__(message)
+        super().__init__(outcome, message)
+
+
+class StatsHealDeferred(StatsRebuildDeferred):
+    """A corrupt stats index is being rebuilt by the detached heal worker.
+
+    Replaces the inline heal's return value on the path where it used to
+    quarantine and rebuild while the caller waited (#496 S3 §6). The caller
+    degrades where it already degrades; it never blocks on the rebuild.
+
+    ``heal_id`` correlates this signal with the durable heal event the hook
+    recorded at detection, and ``forensics_path`` is the absolute bundle the
+    user was told about. Both are attributes rather than message text so a
+    consumer can use them without parsing.
+    """
+
+    def __init__(
+        self,
+        outcome: str,
+        *,
+        heal_id: "str | None" = None,
+        forensics_path: "str | None" = None,
+    ) -> None:
+        outcome = str(outcome)
+        self.heal_id = heal_id
+        self.forensics_path = forensics_path
+        message = (
+            "could not start the stats.db corruption rebuild; retry this "
+            "command shortly"
+            if outcome == "failed"
+            else "stats.db corruption rebuild is running in the background; "
+                 "retry shortly"
+        )
+        super().__init__(outcome, message)
 
 
 _SQLITE_CORRUPTION_MESSAGES = (
@@ -4407,7 +4461,11 @@ def _apply_codex_find_projection_schema(conn: sqlite3.Connection) -> None:
     if has_state is None and conn.execute(
         "SELECT 1 FROM codex_conversation_messages LIMIT 1"
     ).fetchone() is None:
-        _set_cache_meta(conn, "codex_find_projection_complete_version", "1")
+        _set_cache_meta(
+            conn,
+            "codex_find_projection_complete_version",
+            str(CODEX_FIND_PROJECTION_VERSION),
+        )
         _set_cache_meta(conn, "codex_find_projection_generation", "0")
 
 
@@ -4561,7 +4619,8 @@ def _conv_004_codex_find_projection(conn: sqlite3.Connection) -> None:
         _apply_codex_find_projection_schema(conn)
         complete = conn.execute(
             "SELECT 1 FROM cache_meta "
-            "WHERE key='codex_find_projection_complete_version' AND value='1'"
+            "WHERE key='codex_find_projection_complete_version' AND value=?",
+            (str(CODEX_FIND_PROJECTION_VERSION),),
         ).fetchone()
         if complete is None:
             _set_cache_meta(conn, "codex_find_projection_backfill_pending", "1")
@@ -4569,6 +4628,11 @@ def _conv_004_codex_find_projection(conn: sqlite3.Connection) -> None:
                 "INSERT OR IGNORE INTO cache_meta(key,value) VALUES"
                 "('codex_find_projection_backfill_cursor','0')"
             )
+            _set_cache_meta(
+                conn,
+                "codex_find_projection_backfill_version",
+                str(CODEX_FIND_PROJECTION_VERSION),
+            )
             _set_cache_meta(conn, "codex_find_projection_generation", "0")
         conn.commit()
     finally:
@@ -4678,6 +4742,42 @@ def _conv_006_backfill_codex_file_touches(conn: sqlite3.Connection) -> None:
         _release_cache_db_writer_flocks(held)
 
 
+@conversations_migration("007_codex_find_projection_v2_meta")
+def _conv_007_codex_find_projection_v2_meta(conn: sqlite3.Connection) -> None:
+    """Arm a bounded v2 rebuild so retained visible meta bodies become findable.
+
+    The projection is disposable. Preserve a markerless retry's v2 cursor, but
+    restart a v1/incompletely-versioned backfill at zero so no conversation
+    already passed by that older walk keeps stale rows.
+    """
+    held = _acquire_conversations_db_codex_provider_flock(
+        conn, migration="conversations 007 Codex find projection v2 meta")
+    try:
+        target = str(CODEX_FIND_PROJECTION_VERSION)
+        complete = conn.execute(
+            "SELECT 1 FROM cache_meta "
+            "WHERE key='codex_find_projection_complete_version' AND value=?",
+            (target,),
+        ).fetchone()
+        if complete is not None:
+            return
+        pending_version = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_find_projection_backfill_version'"
+        ).fetchone()
+        _set_cache_meta(conn, "codex_find_projection_backfill_pending", "1")
+        if pending_version is None or pending_version[0] != target:
+            _set_cache_meta(conn, "codex_find_projection_backfill_cursor", "0")
+        _set_cache_meta(conn, "codex_find_projection_backfill_version", target)
+        conn.execute(
+            "DELETE FROM cache_meta "
+            "WHERE key='codex_find_projection_complete_version'"
+        )
+        conn.commit()
+    finally:
+        _release_cache_db_writer_flocks(held)
+
+
 # #177 S6: the consolidated multi-column external-content FTS5 table that
 # replaces the old conversation_fts(text) + conversation_fts_aux(search_aux)
 # pair. The three column names MUST match the conversation_messages columns BY