cctally 1.92.2 → 1.92.3

package/CHANGELOG.md

@@ -5,6 +5,14 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.92.3] - 2026-08-06
+
+### Changed
+- `cctally db journal-repair` and `cctally db rederive` now read the journal once per pass instead of two to four times, which lowers their memory use and start-up time on large journals. Their output is unchanged (#496).
+
+### Fixed
+- A crash while cctally was first converting its database to the journal format could leave a duplicate copy of the conversion file behind, and every later rebuild then read both copies. On one real install two such duplicates accounted for 366 MB, about a fifth of the journal. The conversion now reuses the most recent conversion file when that file is byte for byte what it was about to write, instead of writing a second copy; when the most recent file differs in any way it still writes its own. Existing duplicates are left untouched, because the journal is never rewritten (#496).
+
 ## [1.92.2] - 2026-08-06
 
 ### Changed

package/bin/_cctally_journal.py

@@ -243,7 +243,7 @@ def _load_quota_dedup_keys() -> None:
         _QUOTA_DEDUP_KEYS.clear()
 
     for name in list_segments():
-        with (journal_dir / name).open("rb") as fh:
+        with _open_segment_for_read(journal_dir / name) as fh:
             for raw in fh:
                 if not raw.endswith(b"\n"):
                     break
@@ -951,6 +951,24 @@ def _write_cursor(conn: sqlite3.Connection, segment: str, offset: int) -> None:
 _SEGMENT_READ_CHUNK = 256 * 1024
 
 
+def _open_segment_for_read(seg_path):
+    """The single physical read boundary for a journal segment.
+
+    Both read routes go through here — the streaming line reader and the
+    prefix hasher — so a test can observe the exact sequence of segment opens
+    a pass performs. A per-pass line or byte counter cannot: it stays correct
+    while an implementation reopens a segment behind it, which is precisely the
+    hidden re-read this session removes (#496 S5 §4.2).
+
+    The cutover's bootstrap-reuse digest and the quota dedupe-index rebuild are
+    the module's other two read-only segment scans, and they come through here
+    as well, so "every physical read of a segment" is a property a test can
+    check rather than a claim in prose. The append path is deliberately NOT
+    routed here: it holds a read-write handle of its own for the torn-tail scan.
+    """
+    return open(seg_path, "rb")
+
+
 def _iter_segment_lines(seg_path, lo: int, hi: int, *, on_bytes=None):
     """Stream `(basename, absolute-offset, raw-line-without-newline)` for every
     complete line in `[lo, hi)`, holding at most one chunk plus one partial line
@@ -964,7 +982,7 @@ def _iter_segment_lines(seg_path, lo: int, hi: int, *, on_bytes=None):
     including a torn trailing partial line that is never yielded.
     """
     name = seg_path.name
-    with open(seg_path, "rb") as fh:
+    with _open_segment_for_read(seg_path) as fh:
         fh.seek(lo)
         pos = lo
         buf = b""
@@ -1051,7 +1069,13 @@ def _read_range(cursor, hw) -> list[tuple[str, int, bytes]]:
 
 
 def journal_prefix_hash(high_water) -> "str | None":
-    """Hash exact raw segment bytes through one canonical high-water."""
+    """Hash exact raw segment bytes through one canonical high-water.
+
+    The framing is durable: per segment, the 4-byte big-endian name length, the
+    name, the 8-byte big-endian data length, then the data. These digests are
+    recorded inside `journal_protocol_resolution` payloads, so a change to the
+    framing invalidates every acknowledgement already written.
+    """
     if high_water is None:
         return None
     digest = hashlib.sha256()
@@ -1059,7 +1083,8 @@ def journal_prefix_hash(high_water) -> "str | None":
     for segment in list_segments():
         path = _cctally_core.JOURNAL_DIR / segment
         size = high_water[1] if segment == high_water[0] else path.stat().st_size
-        data = path.read_bytes()[:size]
+        with _open_segment_for_read(path) as handle:
+            data = handle.read(size)
         if len(data) != size:
             raise OSError(f"journal segment changed while reading: {segment}")
         name = segment.encode("utf-8")
@@ -6706,19 +6731,14 @@ def _cutover_segment_name(now_utc: dt.datetime) -> str:
     return f"{_lib_journal.BOOTSTRAP_PREFIX}{ts}.jsonl"
 
 
-def _write_bootstrap_segment(seg_name: str, lines: list) -> int:
-    """Materialize the bootstrap segment atomically (spec §8 rename-then-stamp):
-    encode all lines, write to a `.partial` sibling, fsync file + dir, verify the
-    line count, then `os.replace` into `seg_name`. Returns the final byte size.
-    Every line must fit the torn-tail window (append discipline)."""
-    journal_dir = _cctally_core.JOURNAL_DIR
-    dir_created = not journal_dir.exists()
-    journal_dir.mkdir(parents=True, exist_ok=True)
-    if dir_created:
-        try:
-            os.chmod(journal_dir, 0o700)
-        except OSError:
-            pass
+def _encode_bootstrap_lines(lines: list) -> bytes:
+    """The cutover export as one verified blob (spec §8 verify step).
+
+    Encoding is separated from writing because `run_cutover` digests the blob
+    before it decides whether a byte-identical segment already exists (#496 S5
+    §3). Encoding twice would compute the reuse digest over a different object
+    than the one written, so this is the single encode both uses.
+    """
     encoded = []
     for rec in lines:
         data = _lib_journal.encode_line(rec)
@@ -6731,6 +6751,81 @@ def _write_bootstrap_segment(seg_name: str, lines: list) -> int:
     if blob.count(b"\n") != len(lines):
         raise JournalError(
             "cutover export line count mismatch (spec §8 verify step)")
+    return blob
+
+
+def _reusable_bootstrap(candidate_digest: str, candidate_size: int):
+    """`(name, size)` of a published bootstrap identical to the candidate blob.
+
+    Every published bootstrap is REPORTED, because `reusable_bootstrap_name`
+    refuses a match that is not the canonically newest one; only segments whose
+    byte length already equals the candidate's are READ, so the comparison costs
+    one pass over the same-size candidates rather than one over the journal.
+    `list_segments` excludes `.partial` files, so a cutover that is still writing
+    can never be reused (#496 S5 §3). A segment whose length cannot be read is
+    reported with a `None` length rather than dropped, which refuses reuse
+    instead of promoting an older segment to canonically newest.
+    """
+    journal_dir = _cctally_core.JOURNAL_DIR
+    if not journal_dir.exists():
+        return None
+    existing = []
+    for name in list_segments():
+        if not name.startswith(_lib_journal.BOOTSTRAP_PREFIX):
+            continue
+        path = journal_dir / name
+        try:
+            size = os.path.getsize(path)
+        except OSError:
+            # Report it anyway. Dropping the entry would let an OLDER match
+            # look canonically newest, which is the reuse this scan refuses.
+            existing.append((name, None, None))
+            continue
+        if size != candidate_size:
+            existing.append((name, size, None))
+            continue
+        digest = hashlib.sha256()
+        with _open_segment_for_read(path) as handle:
+            while True:
+                chunk = handle.read(_SEGMENT_READ_CHUNK)
+                if not chunk:
+                    break
+                digest.update(chunk)
+        existing.append((name, size, digest.hexdigest()))
+    name = _lib_journal.reusable_bootstrap_name(
+        candidate_digest, candidate_size, existing)
+    return None if name is None else (name, candidate_size)
+
+
+def _fsync_published_segment(seg_name: str) -> None:
+    """Make an already-renamed segment and its directory entry durable.
+
+    `_write_bootstrap_segment` establishes this for a segment it writes itself.
+    A reused segment was published by a different attempt, which may have
+    crashed anywhere in that sequence, so the reuse path repeats the file and
+    directory fsyncs before anything durable is allowed to name the file.
+    """
+    journal_dir = _cctally_core.JOURNAL_DIR
+    fd = os.open(str(journal_dir / seg_name), os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+    _fsync_dir(journal_dir)
+
+
+def _write_bootstrap_segment(seg_name: str, blob: bytes) -> int:
+    """Materialize the bootstrap segment atomically (spec §8 rename-then-stamp):
+    write the verified blob to a `.partial` sibling, fsync file + dir, then
+    `os.replace` into `seg_name`. Returns the final byte size."""
+    journal_dir = _cctally_core.JOURNAL_DIR
+    dir_created = not journal_dir.exists()
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    if dir_created:
+        try:
+            os.chmod(journal_dir, 0o700)
+        except OSError:
+            pass
     partial = journal_dir / (seg_name + ".partial")
     fd = os.open(str(partial), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
     try:
@@ -6759,7 +6854,14 @@ def run_cutover(conn, *, now_utc: dt.datetime | None = None) -> "str | None":
     commit rolls the whole thing back (the legacy DB stays fully usable); the
     next open retries idempotently (stable bootstrap ids). A truly empty install
     (nothing to export) just stamps the epoch — no bootstrap file. Returns the
-    bootstrap segment basename, or None when nothing was exported."""
+    bootstrap segment basename, or None when nothing was exported.
+
+    A crash between the `os.replace` and the commit leaves a published segment
+    the rolled-back transaction never referenced. The retry re-exports the same
+    rows byte for byte, so it reuses that orphan rather than publishing a twin
+    (#496 S5 §3) — the retry is now idempotent on disk, not only on fold. When
+    the retry's export genuinely differs, no digest matches and a new segment is
+    written exactly as before."""
     if now_utc is None:
         now_utc = dt.datetime.now(dt.timezone.utc)
     epoch = _cctally_core.STATS_INDEX_EPOCH
@@ -6781,8 +6883,19 @@ def run_cutover(conn, *, now_utc: dt.datetime | None = None) -> "str | None":
             conn.commit()
             return None
 
-        seg_name = _cutover_segment_name(now_utc)
-        seg_size = _write_bootstrap_segment(seg_name, lines)
+        blob = _encode_bootstrap_lines(lines)
+        reuse = _reusable_bootstrap(
+            hashlib.sha256(blob).hexdigest(), len(blob))
+        if reuse is None:
+            seg_name = _cutover_segment_name(now_utc)
+            seg_size = _write_bootstrap_segment(seg_name, blob)
+        else:
+            seg_name, seg_size = reuse
+            # The adopted segment was renamed by ANOTHER attempt, whose rename
+            # may still be only in the page cache. The cursor stamped below is
+            # made durable by SQLite's own commit fsync, so without this the
+            # index could name a bootstrap that a power loss then leaves absent.
+            _fsync_published_segment(seg_name)
 
         for table, rowid in stamp:
             conn.execute(

package/bin/_cctally_journal_repair.py

@@ -10,13 +10,31 @@ import pathlib
 import signal
 import sqlite3
 import sys
+import typing
 
 import _cctally_core
 import _cctally_journal as _journal
+import _lib_accounts
 import _lib_journal
+import _lib_journal_router
 from _lib_json_envelope import stamp_schema_version
 
 
+class _PrefixSnapshot(typing.NamedTuple):
+    """One pinned prefix, read exactly once (#496 S5 §4).
+
+    `audit_ends` maps each `journal_protocol_resolution` op id to the end
+    coordinate of its line. The already-resolved recovery branch needs those
+    coordinates and used to re-read the whole prefix through `_audit_high_water`
+    to find them, even though this pass had them in hand.
+    """
+
+    high_water: "tuple[str, int] | None"
+    prefix_hash: "str | None"
+    selection: object
+    audit_ends: dict
+
+
 def _read_only_high_water() -> "tuple[str, int] | None":
     """Capture the append-only prefix without creating a lock or sidecar."""
     segments = _journal.list_segments()
@@ -27,37 +45,99 @@ def _read_only_high_water() -> "tuple[str, int] | None":
 
 
 def _read_prefix(high_water):
+    """Stream the pinned prefix once, producing everything derived from it.
+
+    Returns `(records, evidence, prefix_hash, audit_ends)`. The prefix hash
+    comes from a `PrefixHashAccumulator` fed by the same bytes this pass reads,
+    the protocol evidence is captured from that accumulator rather than by
+    re-reading the prefix per resolution op, and the cutover account is captured
+    inline exactly as `rebuild_stats_index` captures it. Before this, those were
+    four separate whole-prefix traversals on top of this one (#496 S5 §4).
+
+    Every record stays decoded. Unlike the rebuild, the selector here feeds an
+    acknowledgement the repair command may then mint, and unlike the rebuild's
+    filtered retention there is no placeholder scheme to keep the `enumerate`
+    numbering identical — so the list is unfiltered, exactly as before.
+    """
     if high_water is None:
-        return [], ()
+        return [], (), None, {}
+    segments = _journal.list_segments()
+    if high_water[0] not in segments:
+        raise OSError(
+            f"journal high-water segment is unavailable: {high_water[0]}"
+        )
     records = []
     evidence = []
+    audit_ends: dict = {}
     malformed = 0
     prior_high_water = None
-    for segment, offset, raw in _journal._read_range(None, high_water):
+    cutover_captured = _journal._CUTOVER_UNSEEN
+    hasher = _lib_journal_router.PrefixHashAccumulator()
+    for segment, offset, raw in _journal._iter_range_with_segments(
+        None,
+        high_water,
+        segments,
+        on_segment=lambda name: hasher.begin_segment(name, prior_high_water),
+        on_bytes=hasher.extend,
+    ):
         record = _lib_journal.decode_line(raw)
         if record is None:
             malformed += 1
             prior_high_water = (segment, offset + len(raw) + 1)
             continue
-        _journal._capture_protocol_prefix_evidence(
-            record,
-            prior_high_water,
-            evidence,
-        )
+        record_end = (segment, offset + len(raw) + 1)
+        if record.get("t") == "op":
+            _journal._capture_protocol_prefix_evidence(
+                record,
+                prior_high_water,
+                evidence,
+                hasher=hasher,
+            )
+            payload = record.get("payload")
+            if (
+                isinstance(payload, dict)
+                and payload.get("kind")
+                == _lib_journal._PROTOCOL_RESOLUTION_KIND
+            ):
+                audit_ends[record.get("id")] = record_end
+        # First cutover op wins, exactly as `find_accounts_cutover_op` scans.
+        if (
+            cutover_captured is _journal._CUTOVER_UNSEEN
+            and record.get("id") == _journal.CUTOVER_OP_ID
+        ):
+            cutover_captured = _journal._cutover_value_of(record)
         records.append(record)
-        prior_high_water = (segment, offset + len(raw) + 1)
+        prior_high_water = record_end
+    prefix_hash = hasher.digest_at(high_water)
+    # The accumulator buffers the segment it is reading — 410 MB on the
+    # maintainer's journal — so it is dropped the moment its pass ends, before
+    # the normalization loop below, exactly as `rebuild_stats_index` drops it.
+    # It is dropped before the raise too, so a malformed prefix does not pin the
+    # buffer on the traceback while the exception unwinds.
+    hasher = None
     if malformed:
         raise _lib_journal.JournalProtocolError(
             f"journal prefix contains {malformed} malformed line(s)"
         )
-    cutover_claude = _journal.resolve_cutover_claude_account()
+    # No suffix fallback, deliberately. `_read_only_high_water` pins the
+    # canonically-last segment at its full size, so this prefix IS the whole
+    # journal and an op the prefix does not contain is not in the journal at
+    # all — which is exactly what `resolve_cutover_claude_account` used to
+    # answer by re-reading every segment. An op appended in the window between
+    # that pin and this loop is therefore NOT seen, where the whole-journal scan
+    # would have found it; that divergence is accepted, because the account then
+    # matches the prefix the fingerprints are computed over and `_apply`'s
+    # conflict check catches a preview that has gone stale. The rebuild's
+    # `_resolve_cutover_for_rebuild` cannot be reused here: its fallback calls
+    # `journal_high_water`, which takes the leaf lock and so CREATES
+    # `journal.lock`, and the preview must leave no sidecar behind.
+    if cutover_captured is _journal._CUTOVER_UNSEEN or cutover_captured is None:
+        cutover_claude = _lib_accounts.UNATTRIBUTED
+    else:
+        cutover_claude = cutover_captured
     for record in records:
         _journal._normalize_legacy_account_stamp(record, cutover_claude)
-    return records, tuple(evidence)
-
-
-def _prefix_hash(high_water) -> "str | None":
-    return _journal.journal_prefix_hash(high_water)
+    return records, tuple(evidence), prefix_hash, audit_ends
 
 
 def _high_water_dict(high_water):
@@ -66,18 +146,21 @@ def _high_water_dict(high_water):
     return {"segment": high_water[0], "offset": high_water[1]}
 
 
-def _selection_snapshot():
+def _selection_snapshot() -> _PrefixSnapshot:
     high_water = _read_only_high_water()
-    records, evidence = _read_prefix(high_water)
+    records, evidence, prefix_hash, audit_ends = _read_prefix(high_water)
     selection = _lib_journal.resolve_effective_events(
         records,
         protocol_prefix_evidence=evidence,
     )
-    return high_water, _prefix_hash(high_water), selection
+    return _PrefixSnapshot(high_water, prefix_hash, selection, audit_ends)
 
 
 def _preview_payload(requested=()):
-    high_water, prefix_hash, selection = _selection_snapshot()
+    snapshot = _selection_snapshot()
+    high_water = snapshot.high_water
+    prefix_hash = snapshot.prefix_hash
+    selection = snapshot.selection
     unacknowledged = {
         violation.fingerprint: violation
         for violation in selection.protocol_violations
@@ -115,7 +198,7 @@ def _preview_payload(requested=()):
         "rebuild": None,
         "errors": errors,
     }
-    return stamp_schema_version(body, version=1), selection
+    return stamp_schema_version(body, version=1), snapshot
 
 
 def _rebuild_dict(result):
@@ -230,7 +313,7 @@ def _repair_failure_guidance(exc: Exception) -> str:
 
 def _post_audit_failure(requested, audit_ids, exc):
     """Report durable acknowledgement truth when index publication declined."""
-    payload, _selection = _preview_payload(requested)
+    payload, _snapshot = _preview_payload(requested)
     payload["status"] = "failed"
     payload["errors"] = [_repair_failure_guidance(exc)]
     if len(audit_ids) == 1:
@@ -261,12 +344,19 @@ def _stats_has_acknowledgements(fingerprints) -> bool:
         return False
 
 
-def _audit_high_water(audit_ids, high_water):
-    found = {}
-    for segment, offset, raw in _journal._read_range(None, high_water):
-        record = _lib_journal.decode_line(raw)
-        if record is not None and record.get("id") in audit_ids:
-            found[record["id"]] = (segment, offset + len(raw) + 1)
+def _recovery_high_water(audit_ids, audit_ends):
+    """The last acknowledged audit record's end coordinate.
+
+    `audit_ends` is produced by the same streaming pass that produced the
+    selection, so an already-resolved recovery no longer re-reads the whole
+    prefix to find coordinates that pass already held (#496 S5 §4.1). The
+    ordering rule is the pre-change one: canonical segment order, then offset.
+    """
+    found = {
+        audit_id: audit_ends[audit_id]
+        for audit_id in audit_ids
+        if audit_id in audit_ends
+    }
     if set(found) != set(audit_ids):
         raise _journal.JournalError(
             "acknowledged protocol audit record is missing from the journal"
@@ -279,7 +369,8 @@ def _audit_high_water(audit_ids, high_water):
 def _apply(requested, initial_preview):
     _call_pause_hook("before-lock")
     with _repair_locks():
-        preview, selection = _preview_payload(requested)
+        preview, snapshot = _preview_payload(requested)
+        selection = snapshot.selection
         if preview["errors"]:
             preview["status"] = "conflict"
             return preview, 2
@@ -347,7 +438,7 @@ def _apply(requested, initial_preview):
                     {audit["id"]},
                     exc,
                 )
-            final_payload, _final_selection = _preview_payload(requested)
+            final_payload, _final_snapshot = _preview_payload(requested)
             final_payload["status"] = "applied"
             final_payload["selectedViolations"] = [
                 violation.to_dict() for violation in to_acknowledge
@@ -374,8 +465,8 @@ def _apply(requested, initial_preview):
         if len(audit_ids) == 1:
             preview["auditId"] = next(iter(audit_ids))
         if not _stats_has_acknowledgements(requested):
-            recovery_high_water = _audit_high_water(
-                audit_ids, reviewed_high_water
+            recovery_high_water = _recovery_high_water(
+                audit_ids, snapshot.audit_ends
             )
             try:
                 _call_rebuild_error_hook()
@@ -395,7 +486,7 @@ def _apply(requested, initial_preview):
                     audit_ids,
                     exc,
                 )
-            final_payload, _final_selection = _preview_payload(requested)
+            final_payload, _final_snapshot = _preview_payload(requested)
             final_payload["status"] = "recovered"
             if len(audit_ids) == 1:
                 final_payload["auditId"] = next(iter(audit_ids))
@@ -408,7 +499,7 @@ def cmd_db_journal_repair(args) -> int:
     """Preview structural violations without mutating the journal or indexes."""
     try:
         requested = list(getattr(args, "violation", ()) or ())
-        payload, _selection = _preview_payload(requested)
+        payload, _snapshot = _preview_payload(requested)
     except (OSError, _lib_journal.JournalProtocolError) as exc:
         if bool(getattr(args, "json", False)):
             try:

package/bin/_cctally_rederive.py

@@ -27,6 +27,7 @@ import _cctally_core
 import _cctally_journal as _journal
 import _cctally_record as _record
 import _lib_journal
+import _lib_journal_router
 import _lib_json_envelope
 import _lib_rederive
 
@@ -441,40 +442,74 @@ def owned_conflicted_event_ids(selection) -> frozenset:
 
 def read_rederive_journal_prefix(
     high_water: "tuple[str, int] | None" = None,
-) -> tuple[list[dict], "tuple[str, int] | None", list[tuple[str, int]]]:
-    """Read and strictly decode one canonical journal prefix."""
+):
+    """Stream and strictly decode one canonical journal prefix.
+
+    Returns `(records, high_water, record_ends, protocol_prefix_evidence)`.
+    The evidence digests come from a `PrefixHashAccumulator` fed by the bytes
+    this pass is already reading. Before this, the prefix was materialized as
+    raw lines, materialized again as decoded records while the first form was
+    still referenced, walked a third time to produce the evidence, and re-read
+    from byte zero by `journal_prefix_hash` once per
+    `journal_protocol_resolution` op (#496 S5 §4).
+
+    Retention is DELIBERATELY unfiltered, unlike the rebuild's. The rebuild
+    keeps only the decision records and substitutes `None` placeholders for
+    everything else; the planner here reads every observation for cache
+    validation, desired-event derivation and preservation decisions, and walks
+    `records` in parallel with `record_ends`. Both lists stay complete and
+    aligned, so the win in this file is the removed double materialization and
+    the removed hash traversals, not reduced retention.
+    """
     if high_water is None:
         high_water = _journal.journal_high_water()
     if high_water is None:
-        return [], None, []
+        return [], None, [], ()
+    segments = _journal.list_segments()
+    if high_water[0] not in segments:
+        raise OSError(
+            f"journal high-water segment is unavailable: {high_water[0]}"
+        )
     records: list[dict] = []
     record_ends: list[tuple[str, int]] = []
+    evidence: list = []
     malformed = 0
-    for segment, offset, raw in _journal._read_range(None, high_water):
+    prior_high_water = None
+    hasher = _lib_journal_router.PrefixHashAccumulator()
+    for segment, offset, raw in _journal._iter_range_with_segments(
+        None,
+        high_water,
+        segments,
+        on_segment=lambda name: hasher.begin_segment(name, prior_high_water),
+        on_bytes=hasher.extend,
+    ):
         record = _lib_journal.decode_line(raw)
+        record_end = (segment, offset + len(raw) + 1)
         if record is None:
             malformed += 1
+            prior_high_water = record_end
             continue
+        if record.get("t") == "op":
+            _journal._capture_protocol_prefix_evidence(
+                record,
+                prior_high_water,
+                evidence,
+                hasher=hasher,
+            )
         records.append(record)
-        record_ends.append((segment, offset + len(raw) + 1))
+        record_ends.append(record_end)
+        prior_high_water = record_end
+    # Released before the raise below, so a malformed prefix does not pin the
+    # accumulator's buffered segment — 410 MB on the maintainer's journal — on
+    # the traceback while the exception unwinds. On the success path the frame
+    # dies two statements later, so this mirrors the repair reader, where the
+    # release genuinely precedes a loop over every decoded record.
+    hasher = None
     if malformed:
         raise _lib_rederive.RederiveConflict(
             f"journal prefix contains {malformed} malformed line(s)"
         )
-    return records, high_water, record_ends
-
-
-def _protocol_prefix_evidence(records, record_ends):
-    evidence = []
-    prior_high_water = None
-    for record, record_end in zip(records, record_ends):
-        _journal._capture_protocol_prefix_evidence(
-            record,
-            prior_high_water,
-            evidence,
-        )
-        prior_high_water = record_end
-    return tuple(evidence)
+    return records, high_water, record_ends, tuple(evidence)
 
 
 def _read_only_journal_high_water() -> "tuple[str, int] | None":
@@ -603,12 +638,11 @@ def _preview_from_snapshot(
     if journal_high_water is None:
         journal_high_water = _read_only_journal_high_water()
     if journal_high_water is None:
-        records, high_water, record_ends = [], None, []
+        records, high_water, record_ends, protocol_evidence = [], None, [], ()
     else:
-        records, high_water, record_ends = read_rederive_journal_prefix(
-            journal_high_water
+        records, high_water, record_ends, protocol_evidence = (
+            read_rederive_journal_prefix(journal_high_water)
         )
-    protocol_evidence = _protocol_prefix_evidence(records, record_ends)
     with _open_cache_read_view() as cache:
         plan = plan_claude_usage(
             records,

package/bin/_lib_journal.py

@@ -242,6 +242,46 @@ def bootstrap_id(table: str, rowid: int) -> str:
     return f"b:{table}:{rowid}"
 
 
+def reusable_bootstrap_name(candidate_digest, candidate_size, existing):
+    """The already-published bootstrap segment a cutover may reuse verbatim.
+
+    `existing` is `(name, byte_length_or_None, sha256_hex_or_None)` for EVERY
+    published segment the caller found. A `None` digest means the caller did not
+    read that segment, which it does only when the length already differs; a
+    `None` length means it could not stat the file at all. Neither can match, and
+    reporting the segment anyway is required — see the ordering rule below.
+
+    Reuse requires the CANONICALLY NEWEST bootstrap to be the exact match, on
+    both length and digest. A crash-after-rename retry re-exports byte-identical
+    lines, so reusing that orphan makes the retry idempotent on disk instead of
+    only idempotent on fold (#496 S5 §3), and timestamps increase monotonically,
+    so the orphan an immediately-prior attempt left IS the newest bootstrap.
+
+    Reusing an older match instead would stamp the cursor behind a bootstrap the
+    cursor does not cover, and the next ingest would fold that stale bootstrap's
+    records into stats.db. Writing a fresh segment is the pre-reuse behaviour and
+    restores the pre-reuse invariant, because a minted name always sorts last.
+
+    Returns None when the newest bootstrap does not match, which covers the
+    ordinary first-cutover path, the genuinely-differing-export path, and the
+    stale-match path alike.
+    """
+    bootstraps = [
+        (name, size, digest)
+        for name, size, digest in existing
+        if name.startswith(BOOTSTRAP_PREFIX)
+    ]
+    if not bootstraps:
+        return None
+    name, size, digest = max(
+        bootstraps, key=lambda entry: segment_sort_key(entry[0]))
+    if size is None or digest is None:
+        return None
+    if size == candidate_size and digest == candidate_digest:
+        return name
+    return None
+
+
 def evt_id(kind: str, *parts: object) -> str:
     """Natural-key id for an evt line: ``"<kind>:" + ":".join(str(p) …)``.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cctally",
-  "version": "1.92.2",
+  "version": "1.92.3",
   "description": "Claude Code usage tracker and local dashboard for Pro/Max subscription limits - weekly cost-per-percent trend, quota forecasts, threshold alerts. ccusage-compatible.",
   "homepage": "https://github.com/omrikais/cctally",
   "repository": {