cctally 1.96.2 → 1.98.0

package/bin/_cctally_dashboard_envelope.py

@@ -55,6 +55,8 @@ from _cctally_core import (
 )
 from _lib_dashboard_sources import (
     SOURCE_SCHEMA_VERSION,
+    canonical_alerted_at as _canonical_alerted_at,
+    canonical_alerted_at_sql as _canonical_alerted_at_sql,
     dashboard_resource_key as _dashboard_resource_key,
 )
 from _lib_display_tz import _compute_display_block, format_display_dt
@@ -361,6 +363,16 @@ def _alert_account_resolver(conn: sqlite3.Connection):
     return fields
 
 
+# #556 S3 §2.3. Every per-axis mapper orders by the CANONICAL firing instant
+# before its ``LIMIT``, because that limit decides which rows exist downstream
+# and a row excluded there is unrecoverable. Two spellings of one instant
+# compare equal here; a nonzero offset — which the ``all-combined`` fixture
+# stores deliberately — orders by its true instant rather than by its
+# local-time text.
+_CANON_ALERTED_AT = _canonical_alerted_at_sql()
+_CANON_ALERTED_AT_M = _canonical_alerted_at_sql("m.alerted_at")
+
+
 def _envelope_rows_weekly(
     conn, descriptor, limit, severity_for, account_fields,
 ) -> list[dict]:
@@ -377,7 +389,7 @@ def _envelope_rows_weekly(
                alerted_at, cumulative_cost_usd, reset_event_id, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
-        ORDER BY alerted_at DESC
+        ORDER BY {_CANON_ALERTED_AT} DESC
         LIMIT ?
         """,
         (limit,),
@@ -431,7 +443,7 @@ def _envelope_rows_five_hour(
           ON b.five_hour_window_key = m.five_hour_window_key
          AND b.account_key = m.account_key
         WHERE m.alerted_at IS NOT NULL
-        ORDER BY m.alerted_at DESC
+        ORDER BY {_CANON_ALERTED_AT_M} DESC
         LIMIT ?
         """,
         (limit,),
@@ -506,7 +518,7 @@ def _envelope_rows_budget_family(
                budget_usd, spent_usd, consumption_pct, account_key
         FROM {descriptor.milestone_table}
         WHERE vendor = ? AND alerted_at IS NOT NULL
-        ORDER BY alerted_at DESC
+        ORDER BY {_CANON_ALERTED_AT} DESC
         LIMIT ?
         """,
         (default_noun, vendor, limit),
@@ -572,7 +584,7 @@ def _envelope_rows_projected(
                denominator, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
-        ORDER BY alerted_at DESC
+        ORDER BY {_CANON_ALERTED_AT} DESC
         LIMIT ?
         """,
         (limit,),
@@ -629,7 +641,7 @@ def _envelope_rows_project_budget(
                consumption_pct, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
-        ORDER BY alerted_at DESC
+        ORDER BY {_CANON_ALERTED_AT} DESC
         LIMIT ?
         """,
         (limit,),
@@ -858,11 +870,29 @@ def _build_alerts_envelope_array(
         ))
 
     # Python's list.sort is stable. When two alerts share the same
-    # `alerted_at` ISO string (rare; multiple axes firing within the same
-    # millisecond), the union order (weekly, then 5h, then budget, then
+    # `alerted_at` instant (rare; multiple axes firing within the same
+    # second), the union order (weekly, then 5h, then budget, then
     # projected) determines the tiebreaker — no extra deterministic key is
     # added because the spec doesn't require one.
-    out.sort(key=lambda a: a["alerted_at"], reverse=True)
+    #
+    # #556 S3 §2.3: the slice below is a truncation, so this re-sort compares
+    # instants rather than spellings. Each axis reaches here already ordered by
+    # its own canonical SQL expression, but the axes are merged raw, so two
+    # differently-spelled instants meet for the first time right here.
+    def _order_key(alert):
+        # A raise here empties the whole legacy array AND the Claude projection
+        # derived from it, so the diagnostic must name the offending row the way
+        # `_combined_alert_rows` does — otherwise the operator sees an empty
+        # panel and a message that identifies nothing.
+        try:
+            return _canonical_alerted_at(alert["alerted_at"])
+        except (KeyError, ValueError) as exc:
+            identity = alert.get("key") or alert.get("id")
+            raise ValueError(
+                f"alert row {identity!r} (axis {alert.get('axis')!r}): {exc}"
+            ) from exc
+
+    out.sort(key=_order_key, reverse=True)
     return out[:limit]
 
 
@@ -1188,6 +1218,7 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
 
     week_lbl: "str | None" = None
     reset_at_utc: "dt.datetime | None" = None
+    week_start_at_utc: "dt.datetime | None" = None
     if cw is not None:
         ws = getattr(cw, "week_start_at", None)
         we = getattr(cw, "week_end_at", None)
@@ -1203,6 +1234,7 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
         elif ws is not None:
             week_lbl = format_display_dt(ws, resolved_tz_obj, fmt='%b %d', suffix=False)
         reset_at_utc = we
+        week_start_at_utc = ws
 
     # Header forecast_pct should match the projection that drove the
     # verdict pill next to it. The View (issue #57) carries the
@@ -1268,21 +1300,11 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
         }
 
     def _daily_row_to_dict(r: "DailyPanelRow") -> dict:
-        return {
-            "date":             r.date,
-            "label":            r.label,
-            "cost_usd":         r.cost_usd,
-            "is_today":         r.is_today,
-            "intensity_bucket": r.intensity_bucket,
-            "models":           list(r.models),
-            # ---- v2.3 additions ----
-            "input_tokens":          r.input_tokens,
-            "output_tokens":         r.output_tokens,
-            "cache_creation_tokens": r.cache_creation_tokens,
-            "cache_read_tokens":     r.cache_read_tokens,
-            "total_tokens":          r.total_tokens,
-            "cache_hit_pct":         r.cache_hit_pct,
-        }
+        # #556 S2 §6.3a: one owner for the daily row wire shape. The All-only
+        # `periods.daily_aggregate.rows` sibling publishes the same shape, and
+        # the client reads one shape whichever sibling produced it, so the
+        # dict is built in `_cctally_dashboard` and this renderer delegates.
+        return sys.modules["_cctally_dashboard"].daily_panel_row_to_wire(r)
 
     # Spec §2.7: empty state is `weekly.rows === []`, not `weekly === null`.
     # Always emit a `{rows: [...]}` envelope (possibly empty) so the panel
@@ -1616,7 +1638,19 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                     None if cw.five_hour_resets_at is None
                     else max(0, int((cw.five_hour_resets_at - now_utc).total_seconds())),
                 "spent_usd":                cw.spent_usd,
+                # #556 S1 §3.3 — the token half of the same accumulation pass
+                # that produced `spent_usd`. `getattr` keeps legacy fixture
+                # modules that construct `TuiCurrentWeek` without the field
+                # serializing, the same way `five_hour_block` does.
+                "total_tokens":             getattr(cw, "total_tokens", 0),
                 "dollar_per_pct":           cw.dollars_per_percent,
+                # #556 S1 §3.5 — the effective cycle start, the companion of
+                # the already-published `reset_at_utc` end. Composition needs
+                # BOTH bounds to label the Claude leg's period, and the source
+                # version needs them to detect a nominal rollover (§3.6).
+                # Effective, not nominal: `_tui_build_current_week` stores this
+                # AFTER `_apply_midweek_reset_override`.
+                "week_start_at":            _iso_z(week_start_at_utc),
                 "reset_at_utc":             _iso_z(reset_at_utc),
                 "reset_in_sec":
                     None if reset_at_utc is None

package/bin/_cctally_dashboard_share.py

@@ -50,7 +50,6 @@ from _cctally_config import save_config, _load_config_unlocked
 from _lib_fmt import stable_sum
 from _lib_pricing import _calculate_entry_cost, claude_usage_dict
 from _lib_five_hour import _canonical_5h_window_key
-from _lib_dashboard_sources import source_domain_freshness
 from _lib_display_tz import _resolve_tz, resolve_display_tz_name
 
 
@@ -1783,12 +1782,33 @@ def _build_codex_source_share_snapshot(ls, *, state, panel: str,
     )
 
 
+def _share_current_week_evidence_is_stale(state) -> bool:
+    """Whether ONE provider's own current-cycle evidence is stale (#556 §4.7).
+
+    This used to read the shared ``domain_freshness.hero`` axis, which #556 S1
+    repointed to accounting resolvability. The aggregate ``quota`` axis is not
+    the substitute: a stale five-hour row stales it independently of the weekly
+    cycle this note describes. So each provider is read on its own field —
+    Claude's percent-observation label under ``hero.current_week.freshness``,
+    Codex's additive ``hero.cycle_freshness``, which is omitted while fresh.
+    """
+    data = getattr(state, "data", None)
+    hero = data.get("hero") if isinstance(data, Mapping) else None
+    if not isinstance(hero, Mapping):
+        return False
+    if getattr(state, "source", None) == "claude":
+        current_week = hero.get("current_week")
+        freshness = (
+            current_week.get("freshness")
+            if isinstance(current_week, Mapping) else None
+        )
+        return isinstance(freshness, Mapping) and freshness.get("label") == "stale"
+    return hero.get("cycle_freshness") == "stale"
+
+
 def _share_apply_current_week_freshness(snapshot, state, panel: str):
     """Qualify retained current-week actuals with provider-local evidence age."""
-    if (
-        panel != "current-week"
-        or source_domain_freshness(state, "hero") != "stale"
-    ):
+    if panel != "current-week" or not _share_current_week_evidence_is_stale(state):
         return snapshot
     provider = "Claude" if state.source == "claude" else "Codex"
     note = (

package/bin/_cctally_dashboard_sources.py

@@ -37,6 +37,8 @@ from _lib_dashboard_sources import (
     SourceDashboardState,
     SourceDashboardWarning,
     assess_codex_projection_coherence,
+    canonical_alerted_at,
+    canonical_alerted_at_sql,
     dashboard_resource_key,
 )
 from _lib_quota import (
@@ -860,6 +862,33 @@ _RESOURCE_ROWS = {
     "block": ("quota", "blocks"),
 }
 
+# #556 S2: additional collections a resource may ALSO be routed through.
+#
+# The primary above stays the capability gate — its absence is still
+# `SourceCapabilityUnavailable`. These are searched only after the primary
+# misses, and their own absence is an ordinary not-found rather than a
+# capability failure, because a provider legitimately need not publish them (a
+# Codex source has no aggregate sibling, and a Claude source whose bounded fold
+# failed publishes none either).
+#
+# Projects needs one because `projects.rows` is the current SUBSCRIPTION WEEK
+# while `projects.aggregate.rows` is folded over the thirty-day shared range.
+# Without this the aggregate ranking would publish rows the drill-down route
+# answers 404 for — in the committed `all-combined` fixture, four of six.
+_RESOURCE_EXTRA_ROWS: Mapping[str, tuple[tuple[str, ...], ...]] = MappingProxyType({
+    "project": (("projects", "aggregate", "rows"),),
+})
+
+
+def _rows_at(data: Mapping, path: "tuple[str, ...]") -> "list | tuple":
+    """Read one optional nested rows collection, or an empty tuple."""
+    node: object = data
+    for step in path:
+        if not isinstance(node, Mapping):
+            return ()
+        node = node.get(step)
+    return node if isinstance(node, (list, tuple)) else ()
+
 
 def _public_copy(value: object) -> object:
     """Detach a bounded source row from its immutable published state."""
@@ -910,6 +939,21 @@ def source_detail_lookup(
         row for row in rows
         if isinstance(row, Mapping) and row.get("key") == key
     ]
+    if not key_matches:
+        # Only after the primary collection misses, so every key that resolves
+        # today keeps resolving to the same row. The account-ownership branch
+        # below does NOT see an unchanged candidate set — a key that resolves
+        # only here reaches it as a row the primary collection never carried.
+        # That leaks nothing, because an aggregate row carries no
+        # `account_key` and the ownership check refuses a row it cannot
+        # attribute, but the set is genuinely wider than it was.
+        for path in _RESOURCE_EXTRA_ROWS.get(resource, ()):
+            key_matches = [
+                row for row in _rows_at(data, path)
+                if isinstance(row, Mapping) and row.get("key") == key
+            ]
+            if key_matches:
+                break
     if not key_matches:
         raise SourceResourceNotFound()
     if account is not None:
@@ -1261,6 +1305,24 @@ def _codex_cache_report_wire(
     )
 
 
+#: Per-file terminal thread aliases, joined to their first accounting entry.
+#: The ``(source_root_key, source_path)`` join predicate needs the composite
+#: ``idx_codex_entries_root_path`` to stay linear: a single-column root index
+#: cannot discriminate when every rollout resolves to one provider root, so the
+#: join degenerates to files x entries. Module-level so the query-plan
+#: regression asserts THIS text rather than a copy that can drift from it.
+_CODEX_FILE_ALIAS_SQL = (
+    "SELECT f.source_root_key, f.path, f.last_native_thread_id, "
+    "f.last_session_id, MIN(e.timestamp_utc) "
+    "FROM codex_session_files AS f "
+    "LEFT JOIN codex_session_entries AS e "
+    "ON e.source_root_key=f.source_root_key AND e.source_path=f.path "
+    "WHERE f.last_native_thread_id IS NOT NULL AND f.last_native_thread_id != '' "
+    "GROUP BY f.source_root_key, f.path, f.last_native_thread_id, f.last_session_id "
+    "ORDER BY f.last_ingested_at DESC, f.path DESC"
+)
+
+
 def _codex_conversation_metadata(
     cache_conn: sqlite3.Connection,
 ) -> dict[tuple[str, str], dict[str, object]]:
@@ -1302,16 +1364,7 @@ def _codex_conversation_metadata(
                 cwd, git_json, first_seen_at, _last_seen_at,
             ) in core_rows
         )
-        file_aliases = tuple(cache_conn.execute(
-            "SELECT f.source_root_key, f.path, f.last_native_thread_id, "
-            "f.last_session_id, MIN(e.timestamp_utc) "
-            "FROM codex_session_files AS f "
-            "LEFT JOIN codex_session_entries AS e "
-            "ON e.source_root_key=f.source_root_key AND e.source_path=f.path "
-            "WHERE f.last_native_thread_id IS NOT NULL AND f.last_native_thread_id != '' "
-            "GROUP BY f.source_root_key, f.path, f.last_native_thread_id, f.last_session_id "
-            "ORDER BY f.last_ingested_at DESC, f.path DESC"
-        ))
+        file_aliases = tuple(cache_conn.execute(_CODEX_FILE_ALIAS_SQL))
         native_ids = tuple(sorted({
             str(native_thread_id) for _, _, native_thread_id, *_ in rows
             if isinstance(native_thread_id, str) and native_thread_id
@@ -2393,6 +2446,11 @@ def refresh_codex_source_clock(
                 "hero",
             ),)
             availability = "partial"
+            # #556 S1 §4.1: an EXPIRED boundary is exactly the state the
+            # accounting axis reports as stale. Build time can never see it
+            # (`_resolve_codex_weekly_cycle` retains only `resets_at > now`),
+            # so this clock is the only writer of that value.
+            domain_freshness["hero"] = "stale"
             cycle_changed = True
         # 3. budget last
         if refreshed_budget is not None:
@@ -2411,7 +2469,17 @@ def refresh_codex_source_clock(
         data=data,
         domain_freshness=domain_freshness,
         clock_data=state.clock_data,
+        # #556 S1 §3.8: this constructor lists every field explicitly, so an
+        # omission silently drops the authoritative account count and makes the
+        # combined figure fail closed on an idle tick that changed nothing else.
+        account_scope=state.account_scope,
         private_session_labels=state.private_session_labels,
+        # #556 S2 §3.6: the aggregate carrier travels with the rows it
+        # describes. This clock refreshes presentation axes only and publishes
+        # the SAME rows, so it must carry the range that bounded them —
+        # dropping it here would withhold the aggregate on any idle tick whose
+        # clock moved.
+        aggregate_scope=state.aggregate_scope,
     )
     return state if refreshed_state == state else refreshed_state
 
@@ -2457,39 +2525,55 @@ def _alerts_wire(
             "accountLabel": label,
         }
 
+    # #556 S3 §2.1/§2.4: the firing instant is what this wire filters on, what
+    # the panel orders by and what it prints, so it is what every leg selects,
+    # orders by and publishes. Two legs previously ordered, truncated and
+    # published the CROSSING instant instead, which is a different moment: a
+    # row that fired most recently but crossed longest ago was dropped at the
+    # LIMIT and never reached the panel at all. `created_at` stays as an
+    # equal-valued compatibility alias for a client reading a pre-v7 envelope.
+    canon = canonical_alerted_at_sql()
+
+    def _instants(raw: object) -> dict[str, str]:
+        value = canonical_alerted_at(raw)
+        return {"alerted_at": value, "created_at": value}
+
     try:
-        for period, threshold, consumption_pct, crossed_at, account_key in stats_conn.execute(
-            "SELECT period, threshold, consumption_pct, crossed_at_utc, account_key "
+        for period, threshold, consumption_pct, crossed_at, alerted_at, account_key in stats_conn.execute(
+            "SELECT period, threshold, consumption_pct, crossed_at_utc, alerted_at, account_key "
             "FROM budget_milestones WHERE vendor='codex' AND alerted_at IS NOT NULL "
-            "ORDER BY crossed_at_utc DESC, threshold DESC LIMIT ?",
+            f"ORDER BY {canon} DESC, threshold DESC LIMIT ?",
             (SOURCE_HISTORY_LIMIT,),
         ):
             rows.append({
+                # The resource key keeps the crossing instant it has always
+                # carried: it is an opaque identity, and re-keying every
+                # historical Codex alert row is not this session's change.
                 "key": dashboard_resource_key("alert", "codex", "codex_budget", period, threshold, crossed_at),
                 "source": "codex",
                 "axis": "codex_budget", "period": period, "threshold": threshold,
-                "value": consumption_pct, "created_at": crossed_at,
+                "value": consumption_pct, **_instants(alerted_at),
                 **_account(account_key),
             })
-        for period, threshold, projected_value, crossed_at, account_key in stats_conn.execute(
-            "SELECT period, threshold, projected_value, crossed_at_utc, account_key "
+        for period, threshold, projected_value, crossed_at, alerted_at, account_key in stats_conn.execute(
+            "SELECT period, threshold, projected_value, crossed_at_utc, alerted_at, account_key "
             "FROM projected_milestones WHERE metric='codex_budget_usd' AND alerted_at IS NOT NULL "
-            "ORDER BY crossed_at_utc DESC, threshold DESC LIMIT ?",
+            f"ORDER BY {canon} DESC, threshold DESC LIMIT ?",
             (SOURCE_HISTORY_LIMIT,),
         ):
             rows.append({
                 "key": dashboard_resource_key("alert", "codex", "projected", period, threshold, crossed_at),
                 "source": "codex",
                 "axis": "projected", "period": period, "threshold": threshold,
-                "value": projected_value, "created_at": crossed_at,
+                "value": projected_value, **_instants(alerted_at),
                 **_account(account_key),
             })
         for (root_key, logical_key, observed_slot, window_minutes, resets_at,
-             threshold, severity, created_at, account_key) in stats_conn.execute(
+             threshold, severity, created_at, alerted_at, account_key) in stats_conn.execute(
             "SELECT source_root_key, logical_limit_key, observed_slot, window_minutes, resets_at_utc, "
-            "threshold, severity, created_at_utc, account_key FROM quota_threshold_events "
+            "threshold, severity, created_at_utc, alerted_at, account_key FROM quota_threshold_events "
             "WHERE source='codex' AND disposition='alerted' AND orphaned_at IS NULL "
-            "ORDER BY created_at_utc DESC, source_root_key, logical_limit_key, observed_slot, threshold "
+            f"ORDER BY {canon} DESC, source_root_key, logical_limit_key, observed_slot, threshold "
             "LIMIT ?",
             (SOURCE_HISTORY_LIMIT,),
         ):
@@ -2500,14 +2584,14 @@ def _alerts_wire(
                 ),
                 "source": "codex",
                 "axis": "quota", "threshold": threshold, "severity": severity,
-                "created_at": created_at,
+                **_instants(alerted_at),
                 **_account(account_key),
             })
     except sqlite3.Error:
         return ()
     return tuple(sorted(
         rows,
-        key=lambda item: str(item.get("created_at") or ""),
+        key=lambda item: canonical_alerted_at(item["alerted_at"]),
         reverse=True,
     )[:SOURCE_HISTORY_LIMIT])
 
@@ -3408,7 +3492,6 @@ def build_codex_source_state(
             cache_conn=context.cache_conn,
         )
     budget_entries = _codex_entries_from_accounting(accounting_entries)
-    cycle_reason: str | None = None
     cycles_all: list[CodexCycleBoundary] = []
     try:
         # Per-account list (#341 Task 2). ``cycles_all`` drives the per-account
@@ -3419,9 +3502,12 @@ def build_codex_source_state(
         # `conflicting`.
         cycles_all = _resolve_codex_weekly_cycle(quota_observations, context.now_utc)
         cycle = cycles_all[0] if cycles_all else None
-    except CodexCycleUnavailable as exc:
+    except CodexCycleUnavailable:
+        # #556 S1 §4.1: the reason no longer moves a freshness axis. A
+        # `stale` reason is observation AGE, which `quota` owns; every reason
+        # here leaves `cycle` unresolved, which `cycle_failure` below turns
+        # into the hero failure the accounting axis actually reports.
         cycle = None
-        cycle_reason = exc.reason
     cycle_failure = cycle is None and has_cached_codex_accounting_entries(
         cache_conn=context.cache_conn,
     )
@@ -3826,16 +3912,17 @@ def build_codex_source_state(
                if ingest_backlog is not None else {}),
         },
         domain_freshness={
-            "hero": (
-                "stale"
-                if cycle_reason == "stale"
-                or (
-                    cycle is not None
-                    and not hero_failure
-                    and cycle.evidence_stale
-                )
-                else "fresh"
-            ),
+            # #556 S1 §4.1: `hero` means current-cycle ACCOUNTING
+            # resolvability, not observation age. A stale-but-still-future
+            # boundary stays RESOLVED — the spend it bounds is correct, and
+            # Codex has no background quota poll, so `stale_after_seconds`
+            # (3600) makes an idle weekly observation stale within the hour
+            # while nothing about the accounting changed. The percent age is
+            # already carried by `quota` below and by the additive hero-local
+            # `cycle_freshness` field. `_resolve_codex_weekly_cycle` retains
+            # only boundaries with `resets_at > now`, so a resolved cycle is
+            # never expired at build time; the idle clock owns expiry.
+            "hero": "stale" if hero_failure else "fresh",
             "quota": (
                 "stale"
                 if quota["summary"]["freshness"] == "stale"

package/bin/_cctally_db.py

@@ -4310,6 +4310,16 @@ def _apply_cache_schema(conn: sqlite3.Connection) -> None:
         "CREATE INDEX IF NOT EXISTS idx_codex_entries_ts_root_conversation "
         "ON codex_session_entries(timestamp_utc, source_root_key, conversation_key)"
     )
+    # The per-file alias join in `_codex_conversation_metadata` matches on
+    # (source_root_key, source_path). `idx_codex_entries_source_root` cannot
+    # serve it: a machine normally has ONE provider root, so a root-only search
+    # visits every entry row for every file and the join costs files x entries
+    # on every dashboard snapshot build. Re-derivable, so it belongs on the
+    # unconditional path with the S3 index above rather than in a migration.
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_codex_entries_root_path "
+        "ON codex_session_entries(source_root_key, source_path)"
+    )
     # The per-file terminal thread facts seed a later append without rereading
     # the prefix. They are nullable for old cache rows; migration 024 never
     # fabricates these source facts and instead clears/rederives them.

package/bin/_cctally_doctor.py

@@ -38,6 +38,7 @@ import sys
 
 import _cctally_core
 import _lib_changelog
+import _lib_journal_router
 from _cctally_core import _now_utc, eprint, now_utc_iso, parse_iso_datetime
 from _lib_dashboard_json import encode_dashboard_json
 
@@ -46,10 +47,10 @@ from _lib_dashboard_json import encode_dashboard_json
 #: (`_lib_journal.resolve_effective_events`) reads only `evt`, `correction` and
 #: `correction_batch`; `op` is kept because the rebuild-equivalent account
 #: normalization is defined over evt/op records. Everything else — above all the
-#: `obs` lines, ~97% of a real journal — is dropped as it is decoded, so the deep
-#: gather's peak RSS tracks the decision history rather than the whole journal.
-_CONFLICT_SCAN_RECORD_TYPES = frozenset(
-    {"evt", "correction", "correction_batch", "op"})
+#: `obs` lines, ~97% of a real journal — becomes a `None` positional slot as it
+#: is decoded, so peak RSS tracks decision dictionaries plus one pointer per
+#: decoded line rather than the whole decoded journal.
+_CONFLICT_SCAN_RECORD_TYPES = _lib_journal_router.RETAINED_RECORD_TYPES
 
 #: Doctor needs only recent evidence for this diagnostic. Bound both line count
 #: and bytes so a corrupt single-line file cannot defeat the tail limit.
@@ -1798,10 +1799,13 @@ def _doctor_gather_state_impl(
                         # RETAIN ONLY what the selector consumes. `obs` lines are
                         # ~97% of a real journal (984k of 1.02M) and
                         # `resolve_effective_events` ignores them entirely —
-                        # keeping them cost 4.3 GB of peak RSS for an identical
-                        # result (#374 review).
-                        if record.get("t") in _CONFLICT_SCAN_RECORD_TYPES:
-                            decoded_records.append(record)
+                        # keeping their dictionaries cost 4.3 GB of peak RSS for
+                        # an identical result (#374 review). They still consume a
+                        # lightweight slot because their physical sequence is
+                        # part of three durable violation fingerprints (#508).
+                        decoded_records.append(
+                            _lib_journal_router.selector_slot(record)
+                        )
                         prior_high_water = (
                             seg,
                             offset + len(raw) + 1,
@@ -1821,8 +1825,9 @@ def _doctor_gather_state_impl(
                         else _jr.resolve_cutover_claude_account()
                     )
                     for record in decoded_records:
-                        _jr._normalize_legacy_account_stamp(
-                            record, cutover_claude)
+                        if record is not None:
+                            _jr._normalize_legacy_account_stamp(
+                                record, cutover_claude)
                     selection = _jl.resolve_effective_events(
                         decoded_records,
                         protocol_prefix_evidence=protocol_evidence,

package/bin/_cctally_journal_repair.py

@@ -54,10 +54,10 @@ def _read_prefix(high_water):
     inline exactly as `rebuild_stats_index` captures it. Before this, those were
     four separate whole-prefix traversals on top of this one (#496 S5 §4).
 
-    Every record stays decoded. Unlike the rebuild, the selector here feeds an
-    acknowledgement the repair command may then mint, and unlike the rebuild's
-    filtered retention there is no placeholder scheme to keep the `enumerate`
-    numbering identical — so the list is unfiltered, exactly as before.
+    Every decoded line contributes one selector slot. Decision records stay
+    decoded; observations and other irrelevant records become ``None``
+    placeholders, preserving the `enumerate` numbering that durable violation
+    fingerprints hash without retaining whole-prefix decoded history.
     """
     if high_water is None:
         return [], (), None, {}
@@ -106,7 +106,7 @@ def _read_prefix(high_water):
             and record.get("id") == _journal.CUTOVER_OP_ID
         ):
             cutover_captured = _journal._cutover_value_of(record)
-        records.append(record)
+        records.append(_lib_journal_router.selector_slot(record))
         prior_high_water = record_end
     prefix_hash = hasher.digest_at(high_water)
     # The accumulator buffers the segment it is reading — 410 MB on the
@@ -136,7 +136,8 @@ def _read_prefix(high_water):
     else:
         cutover_claude = cutover_captured
     for record in records:
-        _journal._normalize_legacy_account_stamp(record, cutover_claude)
+        if record is not None:
+            _journal._normalize_legacy_account_stamp(record, cutover_claude)
     return records, tuple(evidence), prefix_hash, audit_ends