cctally 1.99.1 → 1.101.0

package/bin/_cctally_dashboard.py

@@ -191,11 +191,10 @@ What stays in bin/cctally:
 ``ns["_build_current_week_share_panel_data"]``,
 ``ns["_build_daily_share_panel_data"]``,
 ``ns["_build_monthly_share_panel_data"]``,
-``ns["_build_blocks_share_panel_data"]``, ``ns["STATIC_DIR"]``,
-``ns["_DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS"]``, plus
+``ns["_build_blocks_share_panel_data"]``, ``ns["STATIC_DIR"]``, plus
 ``monkeypatch.setitem`` mutations on
-``_dashboard_build_weekly_periods``, ``_dashboard_build_blocks_panel``,
-and ``_DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS``). Forces the **eager
+``_dashboard_build_weekly_periods`` and
+``_dashboard_build_blocks_panel``). Forces the **eager
 re-export** carve-out per spec §4.8 (same precedent as Phase E
 #19/#20 + Phase F #21):
 
@@ -266,6 +265,7 @@ import copy
 import contextlib
 import dataclasses
 import datetime as dt
+import gzip
 import hmac
 import io
 import json
@@ -285,6 +285,7 @@ import urllib.error
 import urllib.parse
 import urllib.request
 import webbrowser as _wb
+import zlib
 from dataclasses import dataclass, field, replace
 from collections.abc import Mapping
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -419,7 +420,8 @@ from _lib_dashboard_settings_contract import (
 from _cctally_config import save_config, _load_config_unlocked
 from _cctally_db import _render_migration_error_banner
 from _cctally_cache import (
-    get_entries, iter_entries, iter_entries_with_id, open_cache_db,
+    get_entries, iter_entries, iter_entries_with_id,
+    open_cache_db as _raw_open_cache_db,
     open_conversations_db, sync_cache, sync_claude_conversations,
     sync_codex_conversations,
     _prune_orphaned_cache_entries,
@@ -439,6 +441,65 @@ from _lib_snapshot_cache import (
     _max_id as _snapshot_max_id,
     _reset_sig as _snapshot_reset_sig,
 )
+import _lib_tick_stats
+
+
+# === F22a: count the silent Group A cache-open failures (#583 S1 §1.6) =====
+# `_group_a_daily_buckets`, `_group_a_weekly_buckets` and
+# `_group_a_monthly_buckets` each wrap their `open_cache_db()` in
+# `try: … except Exception: return None`, where `None` means "fall back to the
+# wide from-scratch fetch". Output stays byte-identical, so no golden moves and
+# nothing surfaces — the failure is invisible even to `doctor`.
+#
+# The count is taken from OUTSIDE those three functions, for two reasons. From
+# outside them a `None` return cannot distinguish a disabled cache, an open
+# failure and a later fallback, so this wrapper is the only place the open
+# failure is observable as itself. And session S5 owns those three helpers, so
+# counting here leaves all three byte-for-byte unchanged and leaves no
+# overlapping hunk to merge.
+
+_GROUP_A_CACHE_OPENERS = (
+    ("_group_a_daily_buckets", "daily"),
+    ("_group_a_weekly_buckets", "weekly"),
+    ("_group_a_monthly_buckets", "monthly"),
+)
+
+
+def _group_a_cache_failure_kind(code):
+    """Which Group A bucket builder owns this code object, or None.
+
+    Matched by ``__code__`` IDENTITY, never by ``co_name``: a name match can be
+    satisfied by an unrelated function of the same name, and a diagnostic that
+    credits the wrong counter is worse than one that credits none. Resolved
+    against the live module globals rather than a memo so it cannot go stale.
+    """
+    for name, kind in _GROUP_A_CACHE_OPENERS:
+        if getattr(globals().get(name), "__code__", None) is code:
+            return kind
+    return None
+
+
+def open_cache_db(*args, **kwargs):
+    """``_cctally_cache.open_cache_db``, plus the Group A failure count.
+
+    Behaviour-preserving. On an exception it identifies the caller, increments
+    the matching fixed counter, and re-raises the ORIGINAL exception unchanged.
+
+    It fails open in both directions: on no caller match, or on any failure of
+    the frame introspection itself, it increments nothing and still re-raises.
+    A diagnostic must never replace the error it was observing. Introspection
+    runs only on the already-exceptional path, so the steady-state cost is nil.
+    """
+    try:
+        return _raw_open_cache_db(*args, **kwargs)
+    except Exception:
+        try:
+            kind = _group_a_cache_failure_kind(sys._getframe(1).f_code)
+            if kind is not None:
+                _lib_tick_stats.note_cache_open_failure(kind)
+        except Exception:  # noqa: BLE001 — never mask the original failure
+            pass
+        raise
 
 
 # === #279 S5: consumer-only dashboard siblings ============================
@@ -921,6 +982,8 @@ def _source_safe_claude_project_detail(
         "key": key,
         "label": label,
         "window_weeks": detail.get("window_weeks"),
+        "window_start_at": detail.get("window_start_at"),
+        "window_end_at": detail.get("window_end_at"),
         "window_cost_usd": detail.get("window_cost_usd"),
         "window_attributed_pct": detail.get("window_attributed_pct"),
         "models": detail.get("models", []),
@@ -1477,33 +1540,222 @@ def _next_deadline(t0: float, interval: float, work: float) -> float:
     return (t0 + work) + max(interval, work)
 
 
+def _conversation_next_deadline(
+    t0: float, interval: float, work: float
+) -> float:
+    """Monotonic deadline for the next conversation sync pass (#583 S4 / F5).
+
+    Same algebra as `_next_deadline`, and deliberately a SEPARATE function. The
+    two loops' bounds are independent regressions: sharing one helper would let
+    a later change to the main loop's scheduling silently remove this thread's
+    duty bound, which is the defect F5 exists to fix. A test asserts the two
+    currently agree, so a divergence has to be a deliberate act.
+
+    work >= interval -> period = 2*work -> duty capped at 50% of one core,
+    scale-independently. work < interval -> period = work + interval, which is
+    the fixed-sleep cadence this replaced, so a small install sees no
+    behavioural change.
+    """
+    return (t0 + work) + max(interval, work)
+
+
+def _log_sync_iteration_failure() -> None:
+    """Route an escaped sync-iteration exception through the log chokepoint.
+
+    The traceback is the operator signal; the loop deliberately continues, so
+    without this the failure would be entirely silent.
+    """
+    import traceback
+    try:
+        _lib_log.get_logger("dashboard").error(
+            "sync iteration failed:\n%s", traceback.format_exc(),
+        )
+    except Exception:  # noqa: BLE001 — logging must never kill the drainer
+        pass
+
+
+def _make_dashboard_run_iteration(
+    *, sync_lock, run_sync_now, run_sync_now_locked, skip_sync,
+    monotonic=time.monotonic, heal_interval_seconds=60.0,
+):
+    """Return the dashboard sync thread's whole-iteration callable.
+
+    Module-level for the same reason ``_make_run_sync_now_locked`` is: the
+    body is the only place the #583 S2 §4 contract "one OAuth refresh
+    immediately before one rebuild, holding ``sync_lock`` across both" exists,
+    and as a closure inside ``cmd_dashboard`` no test could reach it.
+
+    ``run_iteration`` performs one WHOLE iteration — the rebuild plus the
+    orphan self-heal maintenance — so the loop's measured duration drives the
+    cooldown deadline (#313 P2 / F10), not just the rebuild.
+
+    The refresh leg runs only for a batch carrying the refresh bit, and never
+    under ``skip_sync``: ``--no-sync`` freezes the data and performs no network
+    calls. Preserve 9's rule applies here rather than in the handler, so the
+    periodic path cannot fire a redundant rebuild between the two steps, and
+    many queued ``refresh=1`` requests collapse to one OAuth call because
+    ``capture_batch`` ORs their intents.
+
+    ``_refresh_usage_inproc`` and ``_dashboard_self_heal_orphans`` are called
+    by bare name on purpose, so a test patching either on this module (or on
+    the ``cctally`` namespace the shim delegates to) reaches this body.
+    """
+    last_heal = [monotonic()]
+
+    def run_iteration(batch=None) -> dict:
+        warnings: list = []
+        if batch is not None and batch[1] and not skip_sync:
+            with sync_lock:
+                result = _refresh_usage_inproc()
+                if result.status != "ok":
+                    warnings.append({"code": result.status})
+                run_sync_now_locked(skip_sync=skip_sync)
+        else:
+            run_sync_now(skip_sync=skip_sync)
+        # Self-heal removed-worktree orphans on a ~60s cadence (far rarer than
+        # the sync tick — a deleted worktree is not urgent). Non-blocking on
+        # the flock, so a contended tick just retries next cadence; gated off
+        # under --no-sync.
+        if (not skip_sync
+                and monotonic() - last_heal[0] >= heal_interval_seconds):
+            last_heal[0] = monotonic()
+            _dashboard_self_heal_orphans(skip_sync=skip_sync)
+        # A queued request has no HTTP response, so a deferred refresh's
+        # warnings ride the settlement frame instead.
+        return {"warnings": warnings}
+
+    return run_iteration
+
+
+def _make_sync_loop_collaborators(*, ref, hub) -> dict:
+    """Bind a `_SnapshotRef` to an `SSEHub` for `_dashboard_sync_loop`.
+
+    Returns the loop's collaborator keyword arguments, which are the three
+    publication points of #583 S2 spec §6.2 that the loop owns: point 2
+    (``rebuilding=true`` with ``started_id`` advanced, immediately before work
+    begins), point 4 (``rebuilding=false`` plus the settled fields), and the
+    batchless equivalent of both. The reference re-stamps its held snapshot on
+    every mutation, so ``ref.get()`` already carries the new counters.
+
+    Extracted to module level so a test can drive the loop through the SAME
+    wiring the dashboard's sync thread uses. A test that rebuilt these three
+    closures itself would assert only that its own copy publishes.
+    """
+    def capture_batch():
+        batch = ref.capture_batch()
+        hub.publish(ref.get())
+        return batch
+
+    def settle(batch_id, status, warnings=()) -> None:
+        ref.settle(batch_id, status, warnings)
+        hub.publish(ref.get())
+
+    def mark_rebuilding(value) -> None:
+        # Publish only on a real transition. A requested tick has already
+        # published through capture_batch/settle, which set the same flag.
+        if ref.mark_rebuilding(value):
+            hub.publish(ref.get())
+
+    return {
+        "pending_request": ref.pending_request,
+        "capture_batch": capture_batch,
+        "settle": settle,
+        "mark_rebuilding": mark_rebuilding,
+    }
+
+
 def _dashboard_sync_loop(
     *,
     stop,
     interval: float,
     run_iteration,
-    take_sync_request,
+    take_sync_request=None,
     monotonic=time.monotonic,
     sleep=time.sleep,
+    pending_request=None,
+    capture_batch=None,
+    settle=None,
+    mark_rebuilding=None,
 ) -> None:
-    """Run the dashboard's automatic sync loop with a work-proportional cooldown.
+    """Periodic rebuild loop with a #313-preserving request floor (#583 S2).
 
     ``run_iteration`` performs one whole automatic iteration (rebuild plus any
     orphan self-heal / retention maintenance the thread does), so its measured
-    duration — not just the rebuild — drives the deadline (F10). The manual
-    ``POST /api/sync`` refresh is a separate synchronous path under ``sync_lock``
-    and is unaffected; ``take_sync_request`` is the TUI force-refresh flag that
-    breaks the cooldown early.
+    duration — not just the rebuild — drives the deadline (F10).
+
+    Automatic cadence is unchanged: ``_next_deadline(t0, interval, work)``. A
+    queued request may start a batch earlier, but never before ``t0 + 2*work``,
+    which is exactly the ``period >= 2*work`` that caps CPU duty at 50% of one
+    core, scale-independently. When ``work >= interval`` the automatic deadline
+    already equals ``t0 + 2*work``, so the floor coincides with it and a request
+    changes nothing; the floor binds only when ``work < interval``, where it
+    turns a 5.5 s wait into a 1.0 s one for a 0.5 s rebuild.
+
+    The floor is never later than the deadline, so a pending request is always
+    serviced at or before the automatic tick it would otherwise wait for.
+
+    ``pending_request`` PEEKS and never consumes: a poll firing before the floor
+    is met must not discard the request (spec §5.2). ``capture_batch`` claims
+    every outstanding request atomically at the moment work starts, and
+    ``settle`` records the batch's terminal state. ``take_sync_request`` is the
+    legacy test-and-clear flag and is left injectable for callers that still
+    drive the loop that way.
+
+    ``mark_rebuilding`` publishes the in-flight flag for EVERY iteration,
+    requested or automatic, and clears it on every exit path. It is separate
+    from ``capture_batch``/``settle`` on purpose: those two also move the
+    settlement counters, which must not advance for a batch that never existed.
     """
     while not stop.is_set():
+        batch = None
+        if (pending_request is not None and capture_batch is not None
+                and pending_request()):
+            batch = capture_batch()
+        if mark_rebuilding is not None:
+            # BEFORE t0: the publish is a non-blocking queue put, and keeping
+            # it outside the measured span leaves the #313 bound's algebra
+            # exactly as it is. An automatic tick reaches this with no batch
+            # captured, which is the whole point — `rebuilding` describes the
+            # iteration, not the request that may or may not have started it.
+            mark_rebuilding(True)
         t0 = monotonic()
-        run_iteration()
-        work = monotonic() - t0
+        status, warnings = "ok", ()
+        try:
+            result = (run_iteration(batch=batch) if batch is not None
+                      else run_iteration())
+            if isinstance(result, dict):
+                warnings = tuple(result.get("warnings") or ())
+        except Exception:  # noqa: BLE001 — see below
+            # An escaped exception must not kill the only drainer: an accepted
+            # 202 would then never reach a terminal state, and the client would
+            # hold `queued…` forever waiting for a settlement no surviving
+            # thread can publish.
+            status = "failed"
+            _log_sync_iteration_failure()
+        finally:
+            # Failure time is charged to the cooldown exactly like success
+            # time, so a crash loop cannot busy-spin.
+            work = monotonic() - t0
+            if batch is not None and settle is not None:
+                settle(batch[0], status, warnings)
+            if mark_rebuilding is not None:
+                # Every exit path, including an escaped exception: a flag left
+                # set would pin the client's chip at `syncing…` for the life of
+                # the process. `settle` has already cleared it on a requested
+                # tick, so this publishes nothing extra there.
+                mark_rebuilding(False)
+
         deadline = _next_deadline(t0, interval, work)
-        while not stop.is_set() and monotonic() < deadline:
-            if take_sync_request():
+        floor = t0 + 2.0 * work
+        while not stop.is_set():
+            now = monotonic()
+            ready = (pending_request is not None and capture_batch is not None
+                     and now >= floor and pending_request())
+            if ready or now >= deadline:
                 break
-            sleep(min(0.1, max(0.0, deadline - monotonic())))
+            if take_sync_request is not None and take_sync_request():
+                break            # legacy test-and-clear path, unchanged
+            sleep(min(0.1, max(0.0, deadline - now)))
 
 
 def _dashboard_maybe_prune_retention() -> None:
@@ -1532,6 +1784,147 @@ def _dashboard_maybe_prune_retention() -> None:
         pass
 
 
+def _conversation_sync_pass() -> str:
+    """One WHOLE transcript-ingest pass (#583 S4 / F5).
+
+    Store open, both provider syncs, the retention prune and the close. The
+    loop measures this callable's duration as `work`, so anything left outside
+    it would be work outside the duty denominator — exactly the F5 defect.
+
+    Returns a status from `_lib_tick_stats.CONVERSATION_STATUSES`. The prune is
+    attempted whenever the store OPENED, including after a failing sync: the
+    documented contract is a throttled prune driven by this thread, not a prune
+    conditional on a successful ingest.
+
+    The returned status describes the OPEN and the two SYNCS, and nothing else.
+    `_dashboard_maybe_prune_retention`'s outcome is discarded here and that
+    function ends in `except Exception: pass`, so a pass that ingested cleanly
+    and then failed only in the prune reports `ok`. Widening the status to
+    cover the prune would mean widening `CONVERSATION_STATUSES`, which is a
+    closed set by design.
+
+    When the primary open FAILS the pass must not prune, and this is a
+    constraint rather than a detail. `_dashboard_maybe_prune_retention` opens
+    its own conversations connection and reaches the retention due/throttle
+    check only after that open, so an unconditional prune would attempt a
+    second open of the same unopenable store on every pass, swallow the
+    failure, and repeat. The duty bound would cap CPU share while doing nothing
+    about the duplicated migration, recovery and I/O pressure. The invariant is
+    therefore NO SECOND OPEN ATTEMPT AFTER A FAILED OPEN — stated that narrowly
+    because a successful pass opens the store twice by design, once here and
+    once inside the prune.
+    """
+    try:
+        conn = open_conversations_db()
+    except (OSError, sqlite3.DatabaseError) as exc:
+        eprint(f"[conversations] background sync unavailable: {exc}")
+        return "store_unavailable"
+    status = "ok"
+    try:
+        sync_claude_conversations(conn)
+        sync_codex_conversations(conn)
+    except (OSError, sqlite3.DatabaseError) as exc:
+        eprint(f"[conversations] background sync unavailable: {exc}")
+        status = "store_unavailable"
+    except Exception as exc:  # noqa: BLE001
+        # Transcript parsing/normalization is deliberately outside the core
+        # freshness loop. Keep this worker alive so a later clean tick can
+        # self-heal instead of permanently stopping after one malformed
+        # provider record.
+        eprint(
+            "[conversations] background sync failed: "
+            f"{type(exc).__name__}: {exc}"
+        )
+        status = "error"
+    finally:
+        try:
+            conn.close()
+        except Exception:  # noqa: BLE001
+            pass
+    _dashboard_maybe_prune_retention()
+    return status
+
+
+def _conversation_sync_loop(
+    *,
+    stop,
+    interval: float,
+    run_iteration,
+    monotonic=time.monotonic,
+    thread_time_ns=None,
+    wait=None,
+    record=None,
+) -> None:
+    """Transcript ingest loop, bounded like the main one (#583 S4 / F5).
+
+    Extracted from a closure inside `cmd_dashboard` so the duty property can be
+    driven by a virtual clock rather than merely asserted. `run_iteration`
+    performs one WHOLE pass, so its measured duration is what drives the
+    deadline.
+
+    The previous fixed `wait(interval)` prevented literal 100% duty for finite
+    work but provided no scale-independent ceiling below it: a 30 s pass ran
+    30-on/5-off, about 86% duty, and nothing bounded that as the store grew.
+    """
+    if thread_time_ns is None:
+        thread_time_ns = time.thread_time_ns
+    if wait is None:
+        wait = stop.wait
+    seq = 0
+    while not stop.is_set():
+        t0 = monotonic()
+        cpu0 = thread_time_ns()
+        try:
+            status = run_iteration() or "ok"
+        except Exception:  # noqa: BLE001 — the worker must outlive one bad pass
+            _log_sync_iteration_failure()
+            status = "error"
+        work = max(0.0, monotonic() - t0)
+        cpu_ns = max(0, thread_time_ns() - cpu0)
+        seq += 1
+        if record is not None:
+            record(
+                seq=seq,
+                started_ns=int(t0 * 1e9),
+                ended_ns=int((t0 + work) * 1e9),
+                duration_ns=int(work * 1e9),
+                cpu_ns=cpu_ns,
+                # No period is passed: `period_ns` is the FORWARD interval, so
+                # the recorder stamps it onto the PREVIOUS record when this
+                # pass's start closes it. Pairing a pass's CPU with the
+                # interval that preceded it would shift the denominator by one
+                # pass and publish a share with no upper bound.
+                status=status,
+            )
+        deadline = _conversation_next_deadline(t0, interval, work)
+        remaining = deadline - monotonic()
+        if remaining > 0:
+            wait(remaining)
+
+
+def _make_conversation_sync_thread(*, stop, sync_interval, no_sync):
+    """Build the bounded conversation-sync thread, or None under --no-sync.
+
+    #320: transcript/search ingestion runs on its own thread and SQLite file, so
+    a multi-GB first rebuild or a contended conversations.db cannot delay
+    `_run_sync_now`, its `last_sync_at` stamp, or core SSE publication. #583 S4
+    gives that thread the main loop's 50%-duty bound and publishes each pass
+    into the second `_lib_tick_stats` ring.
+    """
+    if no_sync:
+        return None
+    return threading.Thread(
+        target=lambda: _conversation_sync_loop(
+            stop=stop,
+            interval=max(5.0, float(sync_interval)),
+            run_iteration=_conversation_sync_pass,
+            record=_lib_tick_stats.record_conversation_pass,
+        ),
+        daemon=True,
+        name="dashboard-conversations-sync",
+    )
+
+
 def _make_run_sync_now(*args, **kwargs):
     return sys.modules["cctally"]._make_run_sync_now(*args, **kwargs)
 
@@ -1626,6 +2019,10 @@ def _build_alert_payload_weekly(*args, **kwargs):
     return sys.modules["cctally"]._build_alert_payload_weekly(*args, **kwargs)
 
 
+def synthetic_preview_week_start(*args, **kwargs):
+    return sys.modules["cctally"].synthetic_preview_week_start(*args, **kwargs)
+
+
 def _build_alert_payload_five_hour(*args, **kwargs):
     return sys.modules["cctally"]._build_alert_payload_five_hour(*args, **kwargs)
 
@@ -1897,10 +2294,9 @@ def __getattr__(name):  # pylint: disable=invalid-name
 # are pure constants / read-only objects whose identity is stable across
 # the process lifetime; binding them once at load time keeps bare-name
 # reads in moved bodies working without per-call attribute lookups.
-# Path constants and tunables that tests monkeypatch (STATIC_DIR,
-# _DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS) are eager-re-exported FROM the
-# sibling at bin/cctally so monkeypatches propagate; this block carries
-# things that are NEVER patched at runtime.
+# Path constants and tunables that tests monkeypatch (STATIC_DIR) are
+# eager-re-exported FROM the sibling at bin/cctally so monkeypatches
+# propagate; this block carries things that are NEVER patched at runtime.
 BLOCK_DURATION = sys.modules["cctally"].BLOCK_DURATION
 
 
@@ -1958,25 +2354,177 @@ def _resolve_dashboard_bind_for_runtime(stored: str) -> str:
 # Pre-extract location: bin/cctally L16265.
 
 class _SnapshotRef:
-    """Thread-safe holder for the current DataSnapshot."""
+    """Thread-safe holder for the current DataSnapshot and the sync queue.
+
+    #583 S2. This object is the SINGLE authority for queue and activity
+    state. Builders must never construct activity counters themselves: A2
+    and the final publish both replace the snapshot wholesale, so a request
+    accepted mid-build would otherwise have its counter overwritten by the
+    older snapshot the builder had already assembled. Every mutator below
+    re-stamps the held snapshot, and ``set()`` merges the authoritative
+    activity in and RETURNS the merged object so a publish site can send
+    exactly what the reference now holds.
+
+    The legacy ``_sync_requested`` flag and ``take_sync_request()`` are the
+    TUI's mechanism (bin/_cctally_tui.py:5581 and :5832) and keep their
+    exact test-and-clear semantics. The dashboard uses the counters.
+    """
 
     def __init__(self, initial: DataSnapshot) -> None:
         import threading
+        import uuid
         self._lock = threading.Lock()
-        self._snap = initial
         self._sync_requested = False
+        # Fixed 16 chars: the envelope's byte count must stay deterministic
+        # for bench/baselines/envelope-oracle.json to remain comparable.
+        self.server_epoch = uuid.uuid4().hex[:16]
+        self._requested_id = 0
+        self._requested_refresh = False
+        self._started_id = 0
+        self._settled_id = 0
+        self._settled_status = None
+        self._settled_warnings = ()
+        # OWNER-SCOPED, not a single process-wide boolean. Two independent
+        # rebuilders write this state — the periodic sync loop and any HTTP
+        # handler thread that wins the non-blocking `sync_lock` acquire — and a
+        # boolean gives neither of them a way to know who set it. A clear must
+        # therefore remove only the clearing thread's own claim; `rebuilding`
+        # is then true exactly while at least one rebuilder holds one.
+        #
+        # Owner scoping made a LEAKED CLAIM strictly worse than the boolean it
+        # replaced, so do not record the opposite. Under the boolean a leaked
+        # `True` was cleared by whichever rebuilder next reached `set_final`, so
+        # it self-healed on the following rebuild. Every clear site here discards
+        # `threading.get_ident()`, so a claim left behind by a thread that has
+        # exited can be discarded by NO other thread, and `rebuilding` would stay
+        # true — pinning every client's chip at `syncing…` for the life of the
+        # process.
+        #
+        # No leak is reachable today, but the argument splits by CALLER, not by
+        # add site. `mark_rebuilding` below is reached from both routes — the
+        # sync loop through `_make_sync_loop_collaborators` and an HTTP handler
+        # thread through `DashboardHTTPHandler.mark_rebuilding` — so reading one
+        # add site answers for neither. Four callers add a claim.
+        #
+        # Two of the four are bracketed: `_handle_post_sync` and
+        # `_handle_post_settings` each mark inside a `try` whose `finally`
+        # clears, so nothing between the two can leak the claim.
+        #
+        # The other two are the sync loop's `capture_batch()` and its
+        # `mark_rebuilding(True)`, and they are NOT bracketed. Both run before
+        # `t0` and therefore before the `try:` whose `finally` clears them; the
+        # loop's own comment at `mark_rebuilding(True)` gives the #313
+        # duty-algebra reason for that one's placement. `_dashboard_sync_loop`'s
+        # `while` has no outer handler, so a raise in that gap would kill the
+        # drainer and leak the claim together. The gap is safe because nothing
+        # in it raises: the `_restamp_locked()` each add performs is a
+        # `dataclasses.replace` over `DataSnapshot`, a plain dataclass with no
+        # `__post_init__`, no `init=False` field and no `InitVar`;
+        # `SSEHub.publish` holds its own lock and swallows
+        # `queue.Full`/`queue.Empty`; `ref.get()` is a lock-and-return; and what
+        # remains is a clock read and two local assignments.
+        #
+        # A new `add` must therefore satisfy one of the two: a same-thread
+        # `finally` that clears it, or a proven non-raising path to one. There
+        # is no self-healing path behind either.
+        self._rebuilding_owners: set[int] = set()
+        self._snap = self._stamped_locked(initial)
+
+    def _activity_locked(self) -> dict:
+        return {
+            "server_epoch": self.server_epoch,
+            "rebuilding": bool(self._rebuilding_owners),
+            "requested_id": self._requested_id,
+            "started_id": self._started_id,
+            "settled_id": self._settled_id,
+            "settled_status": self._settled_status,
+            "settled_warnings": self._settled_warnings,
+        }
+
+    def _stamped_locked(self, snap: DataSnapshot) -> DataSnapshot:
+        import dataclasses
+        return dataclasses.replace(snap, sync_activity=self._activity_locked())
+
+    def _restamp_locked(self) -> None:
+        self._snap = self._stamped_locked(self._snap)
+
+    def activity(self) -> dict:
+        with self._lock:
+            return self._activity_locked()
 
     def get(self) -> DataSnapshot:
         with self._lock:
             return self._snap
 
-    def set(self, snap: DataSnapshot) -> None:
+    def set(self, snap: DataSnapshot) -> DataSnapshot:
+        """Store ``snap`` with the authoritative activity merged in.
+
+        Returns the merged object. Publish sites must send the RETURN value,
+        not their local build result, or a request accepted mid-build has its
+        counter erased by the older snapshot the builder assembled.
+        """
+        with self._lock:
+            self._snap = self._stamped_locked(snap)
+            return self._snap
+
+    def replace_fields(self, **changes) -> DataSnapshot:
+        """Atomically apply narrow field changes to the latest snapshot.
+
+        Out-of-band publishers compute small derived fields independently of
+        the main snapshot builder. They must not read a whole snapshot, do
+        that work, then call ``set()``: a sync can publish in between and the
+        stale whole-object write would erase its newer data. This method keeps
+        the read/replace/write sequence under the reference lock and re-stamps
+        the authoritative activity state before returning the publishable
+        object.
+        """
+        import dataclasses
+        with self._lock:
+            self._snap = self._stamped_locked(
+                dataclasses.replace(self._snap, **changes)
+            )
+            return self._snap
+
+    def set_final(self, snap: DataSnapshot) -> DataSnapshot:
+        """Store ``snap`` as the iteration's TERMINAL state: the merge of
+        ``set()`` plus dropping THIS thread's claim on ``_rebuilding_owners``,
+        under one lock acquisition.
+
+        Without this a rebuild costs three published frames — the flag going
+        up, the build's own final publish, and the flag coming back down — and
+        the third exists only because the loop clears the flag after the
+        rebuild has already published. Each extra frame is one shared
+        ``snapshot_to_envelope`` plus one byte-ready JSON frame per variant,
+        and one whole-store replacement in each connected browser, which is
+        the opposite of what a dashboard-performance session is for.
+
+        Storing and clearing through two calls would not help: the frame
+        published between them would carry ``rebuilding: true`` and the third
+        frame would come back. The clear has to be part of the same store.
+
+        The clear drops THIS thread's claim only. Clearing outright would end
+        one rebuilder's build by declaring every rebuilder idle: a handler
+        thread that finished first would publish ``rebuilding: false`` over a
+        periodic rebuild that had already marked itself and was still blocked on
+        ``sync_lock``, and nothing would correct that until the next tick.
+        """
         with self._lock:
-            self._snap = snap
+            self._rebuilding_owners.discard(threading.get_ident())
+            self._snap = self._stamped_locked(snap)
+            return self._snap
 
-    def request_sync(self) -> None:
+    def request_sync(self, refresh: bool = False) -> int:
+        """Enqueue a coalescing sync request; returns its identifier.
+
+        ``refresh`` defaults False so the TUI's argument-less call site is
+        unchanged.
+        """
         with self._lock:
             self._sync_requested = True
+            self._requested_id += 1
+            self._requested_refresh = self._requested_refresh or bool(refresh)
+            self._restamp_locked()
+            return self._requested_id
 
     def take_sync_request(self) -> bool:
         # Atomic test-and-clear — threading.Event's is_set()/clear() pair
@@ -1985,6 +2533,261 @@ class _SnapshotRef:
             taken, self._sync_requested = self._sync_requested, False
             return taken
 
+    def pending_request(self) -> bool:
+        """Peek, never consume. A poll firing before the service floor must
+        not clear the request (#583 S2 spec 5.2)."""
+        with self._lock:
+            return self._requested_id > self._started_id
+
+    def capture_batch(self) -> tuple:
+        """Atomically claim every outstanding request as one batch."""
+        with self._lock:
+            self._started_id = self._requested_id
+            refresh = self._requested_refresh
+            self._requested_refresh = False
+            self._rebuilding_owners.add(threading.get_ident())
+            self._restamp_locked()
+            return (self._started_id, refresh)
+
+    def mark_rebuilding(self, value: bool) -> bool:
+        """Set the in-flight flag alone; return True iff it CHANGED.
+
+        Deliberately narrow. ``rebuilding`` must be true for the duration of
+        every sync iteration, but ``capture_batch``/``settle`` run only when a
+        request is pending, so an automatic tick — the normal case on a
+        dashboard nobody is clicking — left the flag permanently false.
+        Widening those two to batchless ticks is the wrong fix: ``settle``
+        would advance ``settled_id``/``settled_status``/``settled_warnings``
+        for a batch that never existed, and spec §6.2 says those three
+        describe the most recently SETTLED batch.
+
+        The changed/unchanged return lets the loop's collaborator publish
+        exactly once per transition: on a requested tick ``capture_batch`` has
+        already set the flag and published, so this reports no change and adds
+        no duplicate frame.
+
+        A mark adds or drops the CALLING thread's claim, and the transition is
+        the emptiness of the owner set changing. Publish-on-transition is
+        preserved exactly, because a transition is now empty-to-nonempty or
+        nonempty-to-empty. The set is not a counter, so a claim is idempotent
+        per thread and one thread cannot hold two nested claims.
+        """
+        with self._lock:
+            ident = threading.get_ident()
+            before = bool(self._rebuilding_owners)
+            if value:
+                self._rebuilding_owners.add(ident)
+            else:
+                self._rebuilding_owners.discard(ident)
+            after = bool(self._rebuilding_owners)
+            if before == after:
+                return False
+            self._restamp_locked()
+            return True
+
+    def settle(self, batch_id: int, status: str, warnings=()) -> None:
+        """Record a batch's terminal state.
+
+        ``settled_status`` and ``settled_warnings`` describe the most recently
+        settled batch and are retained across subsequent automatic frames:
+        clearing them on the next ordinary tick would tell a client its request
+        settled while destroying the warnings explaining how, and the queued
+        contract removed the HTTP response that used to carry them.
+        """
+        with self._lock:
+            self._settled_id = max(self._settled_id, int(batch_id))
+            self._settled_status = status
+            self._settled_warnings = tuple(warnings)
+            # This thread's claim only — `capture_batch` added it, and another
+            # rebuilder's concurrent claim is not this batch's to end.
+            self._rebuilding_owners.discard(threading.get_ident())
+            self._restamp_locked()
+
+
+class _SSEDelivery:
+    """One publication, projected and encoded at most once per variant.
+
+    #583 S3 §5. ``_serve_api_events`` used to call ``snapshot_to_envelope`` plus
+    ``encode_dashboard_json`` inside its per-connection loop, so N connected
+    clients projected and encoded the same data N times per tick — about
+    3.4 MB each on a production-scale store.
+
+    The clock is pinned HERE, once, so every client served from this delivery
+    agrees on the age fields instead of differing by the fan-out latency.
+    ``SSEHub.subscribe`` deliberately builds a FRESH delivery for its seed
+    rather than handing out a stored one, because a client connecting between
+    ticks would otherwise render an age frozen at the previous publication.
+
+    The cache lock is PER DELIVERY. The hub's own lock must never be held
+    across a multi-megabyte projection.
+
+    Sharing is only sound when the projection is a function of the snapshot
+    plus the variant key. ``_serve_api_events`` therefore refuses to share a
+    snapshot that carries no ``envelope_precompute``: ``snapshot_to_envelope``
+    then reads configuration inline and runs the real doctor gather per call,
+    neither of which is keyed. It also captures ``_channel_env_fragment``'s
+    preview-channel process state, which is process-global rather than
+    connection-specific — stated so the "function of its key" claim is
+    complete.
+    """
+
+    __slots__ = ("snapshot", "pinned_now_utc", "pinned_monotonic",
+                 "_cache", "_lock")
+
+    def __init__(self, snapshot, pinned_now_utc, pinned_monotonic) -> None:
+        self.snapshot = snapshot
+        self.pinned_now_utc = pinned_now_utc
+        self.pinned_monotonic = pinned_monotonic
+        self._cache: dict = {}
+        self._lock = threading.Lock()
+
+    def encoded(self, variant_key, project_fn) -> bytes:
+        """Return complete SSE frame bytes for ``variant_key``, building once.
+
+        Double-checked: the fast path is a lock-free dict read, and the slow
+        path re-checks under the lock so two threads racing on the same missing
+        variant produce one projection, JSON encoding and frame assembly. The
+        cached value is byte-ready so fan-out never repeats UTF-8 encoding for
+        each connection. A MISS for any valid variant computes that variant —
+        normalizing an INVALID privacy input to False is the CALLER's job, done
+        before the key is built. Those are different situations and conflating
+        them either leaks or breaks the gate.
+        """
+        hit = self._cache.get(variant_key)
+        if hit is not None:
+            return hit
+        with self._lock:
+            hit = self._cache.get(variant_key)
+            if hit is not None:
+                return hit
+            built = project_fn(variant_key)
+            self._cache[variant_key] = built
+            return built
+
+
+# #583 S3 §5. A distinct slot for "no oauth_usage configuration at all", so it
+# cannot collide with an EMPTY configuration. Both used to canonicalize to `()`.
+_OAUTH_CFG_ABSENT = ("\x00cctally:oauth-usage-absent",)
+
+
+def _canonical_oauth_key(cfg):
+    """A hashable canonical form of the oauth_usage config block.
+
+    #583 S3 §5. The delivery cache is keyed by a tuple, and the resolved
+    ``oauth_usage`` config is a dict, which is unhashable. Sorted items give a
+    stable key for two connections that resolved the same configuration, which
+    is the normal case — every connection reads the same file.
+
+    An ABSENT configuration and an EMPTY one are different configurations and
+    get different keys. Collapsing them is unreachable today, because
+    ``_get_oauth_usage_config`` is defaults-filled and never returns an empty
+    mapping — which is precisely why it would go unnoticed if a later change
+    made it reachable, inside a key whose entire job is keeping two
+    configurations apart. Callers pass a mapping or ``None``.
+    """
+    if cfg is None:
+        return _OAUTH_CFG_ABSENT
+    return tuple(sorted((str(k), repr(v)) for k, v in cfg.items()))
+
+
+# #583 S3 §6. The SSE keep-alive interval, as a module constant so a test can
+# drive the keep-alive path without waiting fifteen seconds. It matters that
+# the path is testable: under compression a raw `wfile.write` of the keep-alive
+# comment corrupts everything after it, and the failure is silent for one
+# interval and then permanent for that connection.
+_SSE_KEEPALIVE_SECONDS = 15
+
+
+def _accepts_gzip(header_value: "str | None") -> bool:
+    """Whether this client accepts gzip, parsed on token boundaries.
+
+    #583 S3 §6. A substring test for "gzip" compresses for a client sending
+    ``gzip;q=0``, which is an explicit refusal, and for an unrelated token such
+    as ``notgzip`` or ``x-gzip``. A malformed quality value falls back to
+    identity rather than raising, because this runs on the publish path and
+    must never take a connection down.
+
+    ``*`` is honoured as a wildcard, but an explicit ``gzip`` entry wins over
+    it in either direction: ``gzip;q=0, *`` is a refusal even though the
+    wildcard would otherwise accept.
+    """
+    if not header_value:
+        return False
+    wildcard = None
+    for part in header_value.split(","):
+        token, _, params = part.strip().partition(";")
+        token = token.strip().lower()
+        if token not in ("gzip", "*"):
+            continue
+        q = 1.0
+        malformed = False
+        for param in params.split(";"):
+            name, _, value = param.strip().partition("=")
+            if name.strip().lower() != "q":
+                continue
+            try:
+                q = float(value.strip())
+            except ValueError:
+                malformed = True
+                break
+        if malformed:
+            return False
+        if token == "gzip":
+            return q > 0.0
+        if wildcard is None:
+            wildcard = q
+    return bool(wildcard is not None and wildcard > 0.0)
+
+
+def _delivery_is_shareable(snapshot) -> bool:
+    """Whether one projection of ``snapshot`` may be shared across clients.
+
+    #583 S3 §5. Sharing is sound only when the projection is a function of the
+    snapshot plus the stated variant key. The gate keys on ONE field,
+    ``envelope_precompute``: without it ``snapshot_to_envelope`` reads
+    ``config.json`` inline (``bin/_cctally_dashboard_envelope.py:1194``), so two
+    calls with the same key can differ and the result is not cacheable. Those
+    snapshots are fixtures, the initial empty snapshot and positionally-
+    constructed ones — never a live tick.
+
+    The doctor block is NOT part of this gate, and saying it was would misstate
+    what the predicate reads. It is guarded separately by ``doctor_payload``
+    (``:1627``), which is set independently of ``envelope_precompute`` because
+    each catches its own failure, so a snapshot can carry the precompute and
+    still run the real gather. That is sound to share anyway: the gather is
+    process-global rather than connection-specific, and both of its inputs —
+    ``now_utc`` and ``runtime_bind`` — are already fixed by the delivery's pin
+    and by the variant key.
+    """
+    return getattr(snapshot, "envelope_precompute", None) is not None
+
+
+def _drain_to_newest(q, first):
+    """Return the newest delivery queued on ``q``, discarding older ones.
+
+    #583 S3 §5. ``SSEHub`` uses a four-slot queue and ``publish`` discards only
+    ONE oldest entry when full, so a client that falls behind holds a backlog
+    of up to four deliveries. Each delivery pins its clock at publication, so
+    replaying that backlog would render ages several publish periods stale — a
+    regression against the present behaviour, where each frame is projected at
+    consumption time and its ages are therefore current.
+
+    The fix is on the CONSUMER side deliberately: ``SSEHub.publish`` is
+    governed by Preserve 4 and the A2 publication tests depend on its
+    behaviour, so it is not modified. Draining here is the latest-wins
+    behaviour the hub's own docstring already describes.
+
+    ``first`` is the item the caller already took off the queue with its own
+    blocking ``get``, so the ``queue.Empty`` keep-alive path stays where it is.
+    """
+    import queue as _queue
+    newest = first
+    while True:
+        try:
+            newest = q.get_nowait()
+        except _queue.Empty:
+            return newest
+
 
 class SSEHub:
     """Thread-safe fan-out hub for SSE clients.
@@ -1993,6 +2796,12 @@ class SSEHub:
     client queues so a slow browser cannot back-pressure the sync thread.
     Consumers call `subscribe()` to obtain a `queue.Queue`, then read
     with a timeout; call `unsubscribe()` on disconnect or at teardown.
+
+    #583 S3 §5: what the queues carry is a `_SSEDelivery` wrapping the
+    published snapshot, not the snapshot itself, so one tick projects and
+    encodes once per variant instead of once per connected client. The
+    queueing behaviour below — size, latest-wins discard, lock discipline — is
+    unchanged and is governed by Preserve 4.
     """
 
     def __init__(self, maxsize: int = 4) -> None:
@@ -2012,12 +2821,32 @@ class SSEHub:
             self._queues.append(q)
             if self._last is not None:
                 # Seed the new subscriber so it renders immediately.
+                # #583 S3 §5: a FRESH delivery over the same snapshot, with the
+                # clock sampled NOW. Handing out `self._last` would render this
+                # client's ages frozen at the previous publication, which for a
+                # tab opened late in a publish period is visibly wrong.
+                seed = _SSEDelivery(
+                    snapshot=self._last.snapshot,
+                    pinned_now_utc=dt.datetime.now(dt.timezone.utc),
+                    pinned_monotonic=time.monotonic(),
+                )
                 try:
-                    q.put_nowait(self._last)
+                    q.put_nowait(seed)
                 except _queue.Full:
                     pass
         return q
 
+    def latest(self):
+        """The most recently published delivery, or None before the first.
+
+        #583 S3 §7: `/api/data` serves the most recently PUBLISHED state. The
+        snapshot reference is mutated by four operations that publish
+        separately, so reading the reference could report a `hydrating` flag no
+        client was ever sent (#600).
+        """
+        with self._lock:
+            return self._last
+
     def unsubscribe(self, q) -> None:
         with self._lock:
             try:
@@ -2027,8 +2856,16 @@ class SSEHub:
 
     def publish(self, snapshot) -> None:
         import queue as _queue
+        # #583 S3 §5: wrap ONCE, outside the hub lock, so every queue and
+        # `_last` share one projection cache for this tick. Built before the
+        # lock because construction must not run under it.
+        delivery = _SSEDelivery(
+            snapshot=snapshot,
+            pinned_now_utc=dt.datetime.now(dt.timezone.utc),
+            pinned_monotonic=time.monotonic(),
+        )
         with self._lock:
-            self._last = snapshot
+            self._last = delivery
             # Latest-wins coalescing (#278 §2.6): every published snapshot is a
             # COMPLETE state replacement, so a client only ever needs the
             # newest. On a full queue drop the STALE queued frame and enqueue
@@ -2045,14 +2882,14 @@ class SSEHub:
             # re-put cannot lose to it.
             for q in self._queues:
                 try:
-                    q.put_nowait(snapshot)
+                    q.put_nowait(delivery)
                 except _queue.Full:
                     try:
                         q.get_nowait()  # discard the oldest, stale frame
                     except _queue.Empty:
                         pass
                     try:
-                        q.put_nowait(snapshot)
+                        q.put_nowait(delivery)
                     except _queue.Full:
                         # Defensive: a consumer racing between our get and put
                         # could only have removed items, so this is unreachable
@@ -2939,7 +3776,22 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
        recorded-windows-widening trick (loads reset windows from
        ``[start - BLOCK_DURATION, end + BLOCK_DURATION]`` so a recorded
        reset just outside the visible window can still anchor blocks
-       inside it) and the strict-window entry filter.
+       inside it) and the post-group block-overlap filter.
+
+    #620 S1 D8: the entry set is grouped into native blocks FIRST and the
+    week filter is then applied to whole blocks, retaining every block whose
+    interval overlaps ``[week_start_at, week_end_at)`` with its full native
+    totals. It used to filter ENTRIES to the week before grouping, so a
+    block straddling a week boundary was folded from only the part of itself
+    that fell inside the week — while ``/api/block/<iso>`` fetches the
+    block's own native window and applies no week clip, so the panel and its
+    own drilldown reported different totals for the same ``start_at`` and
+    the panel's was permanently short. Selecting a block that overlaps the
+    week is the deliberate part of the contract and stays; clipping a
+    selected block's contents was the defect.
+
+    The fetch already read one block duration on each side, so this needs no
+    additional query.
 
     Returning the full ``BlocksView`` (rows + totals) lets the sync
     thread populate ``DataSnapshot.blocks_total_cost_usd`` /
@@ -2950,13 +3802,12 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
     fetch_start = week_start_at - BLOCK_DURATION
     fetch_end = week_end_at + BLOCK_DURATION
     entries = get_entries(fetch_start, fetch_end, skip_sync=skip_sync)
-    entries = [e for e in entries if week_start_at <= e.timestamp < week_end_at]
 
     recorded_windows, block_start_overrides, canonical_intervals = (
         _load_recorded_five_hour_windows(fetch_start, fetch_end)
     )
     c = _cctally()
-    return c.build_blocks_view(
+    view = c.build_blocks_view(
         entries,
         now_utc=now_utc,
         recorded_windows=recorded_windows,
@@ -2967,6 +3818,60 @@ def _dashboard_build_blocks_view(conn: "sqlite3.Connection",
         display_tz=display_tz,
         mode="auto",
     )
+    return _blocks_view_overlapping_week(
+        view, week_start_at=week_start_at, week_end_at=week_end_at,
+    )
+
+
+def _blocks_view_overlapping_week(view, *, week_start_at, week_end_at):
+    """Retain only the blocks whose interval overlaps
+    ``[week_start_at, week_end_at)``, keeping each retained block's FULL
+    native totals (#620 S1 D8).
+
+    Overlap is the standard half-open test ``start < week_end and end >
+    week_start``: a block that merely touches a bound (its end exactly at
+    ``week_start_at``, or its start exactly at ``week_end_at``) shares no
+    instant with the week and is not retained.
+
+    Totals are re-derived from the retained non-gap blocks so the React
+    panel's ``footer total == sum(visible rows)`` invariant still holds, and
+    ``aggregated`` is filtered in lockstep so no consumer can read a block
+    set that disagrees with ``rows``.
+    """
+    kept_blocks = []
+    total_cost = 0.0
+    total_tokens = 0
+    kept_starts = set()
+    for b in view.aggregated:
+        start = getattr(b, "start_time", None)
+        end = getattr(b, "end_time", None)
+        if start is None or end is None:
+            # API-anchored views carry dicts, not Blocks. This adapter only
+            # ever sees the heuristic path, but degrade by retaining rather
+            # than silently dropping a shape we cannot classify.
+            kept_blocks.append(b)
+            continue
+        if not (start < week_end_at and end > week_start_at):
+            continue
+        kept_blocks.append(b)
+        if getattr(b, "is_gap", False):
+            continue
+        # Plain `+=` rather than `stable_sum`, deliberately: this mirrors
+        # `build_blocks_view`'s own accumulation (`bin/_lib_view_models.py`),
+        # and this function exists to publish the SAME totals that view
+        # publishes. A different fold here could disagree with it in the last
+        # ULP, which is the divergence the function was written to remove.
+        total_cost += b.cost_usd
+        total_tokens += b.total_tokens
+        kept_starts.add(start.astimezone(dt.timezone.utc).isoformat())
+    rows = tuple(r for r in view.rows if r.start_at in kept_starts)
+    return dataclasses.replace(
+        view,
+        rows=rows,
+        aggregated=tuple(kept_blocks),
+        total_cost_usd=total_cost,
+        total_tokens=total_tokens,
+    )
 
 
 def _dashboard_build_blocks_panel(conn: "sqlite3.Connection",
@@ -3321,6 +4226,158 @@ def _projects_week_start_monday_utc(ts: "dt.datetime") -> "dt.datetime":
     )
 
 
+class _ProjectsWeekGrid:
+    """The ordered half-open subscription intervals the Projects panel
+    attributes cost into (#620 S1 D1).
+
+    ``_projects_week_start_monday_utc`` above is the fallback used when no
+    snapshot anchor is available; this is what replaces it when one IS
+    available. Intervals come from ``_compute_subscription_weeks``, the same
+    kernel ``cmd_project`` buckets by, so the panel and the CLI describe one
+    set of weeks rather than two.
+
+    Intervals are half-open ``[start, end)`` and are NOT assumed to be seven
+    days long: Anthropic's reset day drifts, and a drifted cycle produces a
+    genuinely short week. ``end_for`` therefore returns the interval's own
+    end, never ``start + 7d``.
+    """
+
+    __slots__ = ("starts", "ends", "_end_by_start", "_start_by_date")
+
+    def __init__(self, bounds: "list[tuple[dt.datetime, dt.datetime]]"):
+        ordered = sorted(bounds, key=lambda b: b[0])
+        self.starts = [b[0] for b in ordered]
+        self.ends = [b[1] for b in ordered]
+        self._end_by_start = {s: e for s, e in ordered}
+        # `weekly_usage_snapshots.week_start_date` is the date-only lookup
+        # key a legacy row carries when it has no `week_start_at`. Later
+        # intervals win a collision, matching the "last capture per week
+        # wins" rule the percentage read already applies.
+        self._start_by_date = {s.date(): s for s in self.starts}
+
+    def __bool__(self) -> bool:
+        return bool(self.starts)
+
+    def week_for(self, ts: "dt.datetime") -> "dt.datetime | None":
+        """The start of the interval containing ``ts``, or None when ``ts``
+        falls outside every interval.
+
+        First-match-wins on the reset-day-drift overlap the clamp can leave
+        behind — the same walk-back `cmd_project._week_start_for` performs,
+        so an entry near a drifted boundary lands in the same week on both
+        surfaces.
+        """
+        ts_utc = ts.astimezone(dt.timezone.utc)
+        idx = bisect.bisect_right(self.starts, ts_utc) - 1
+        if idx < 0:
+            return None
+        while idx > 0 and self.starts[idx - 1] <= ts_utc < self.ends[idx - 1]:
+            idx -= 1
+        if self.starts[idx] <= ts_utc < self.ends[idx]:
+            return self.starts[idx]
+        return None
+
+    def start_for_date(self, day: "dt.date") -> "dt.datetime | None":
+        """The interval start whose own date is ``day``, for a legacy
+        snapshot row that carries ``week_start_date`` but no
+        ``week_start_at``."""
+        return self._start_by_date.get(day)
+
+    def end_for(self, start: "dt.datetime") -> "dt.datetime":
+        """The interval's real end. Falls back to ``start + 7d`` only for a
+        start this grid does not know, which the padding below produces."""
+        return self._end_by_start.get(start, start + dt.timedelta(days=7))
+
+    def window_ending_at(
+        self, cw_start: "dt.datetime", weeks_back: int,
+    ) -> "list[tuple[dt.datetime, dt.datetime]]":
+        """The last ``weeks_back`` intervals up to and including the one
+        starting at ``cw_start``, oldest first.
+
+        When the grid holds fewer than ``weeks_back`` intervals at or before
+        ``cw_start``, the head is padded backwards in seven-day steps. The
+        padding is a genuine no-anchor tail — history older than any snapshot
+        — so the seven-day assumption is the right one there.
+
+        The walk itself lives in ``_lib_subscription_weeks`` because
+        ``cmd_project`` performs the same one; a copy here is how the two
+        surfaces drifted apart in the first place.
+        """
+        return _cctally().subscription_window_ending_at(
+            list(zip(self.starts, self.ends)), cw_start, weeks_back,
+        )
+
+
+def _projects_week_grid(
+    conn: "sqlite3.Connection",
+    *,
+    anchor_utc: "dt.datetime",
+    weeks_back: int,
+    account_key: "str | None" = None,
+) -> "_ProjectsWeekGrid | None":
+    """Build the panel's subscription-week grid, or None when no snapshot
+    row carries an anchor.
+
+    Returning None is the deliberate no-anchor path: the caller then keeps
+    ``_projects_week_start_monday_utc`` throughout, which is what that
+    function was written for and what every anchorless fixture already
+    exercises byte-identically.
+
+    Cost: one grouped read of ``weekly_usage_snapshots`` plus the reset-event
+    join `_compute_subscription_weeks` already performs. It adds no walk over
+    ``session_entries`` and nothing per entry, so this does not re-open the
+    per-tick rescan #583 owns.
+    """
+    acct_pred = "" if account_key is None else " AND account_key = ?"
+    acct_params: tuple = () if account_key is None else (account_key,)
+    try:
+        row = conn.execute(
+            "SELECT COUNT(*) FROM weekly_usage_snapshots "
+            "WHERE week_start_at IS NOT NULL "
+            "  AND week_end_at IS NOT NULL "
+            "  AND week_start_date IS NOT NULL"
+            f"{acct_pred}",
+            acct_params,
+        ).fetchone()
+    except sqlite3.OperationalError:
+        return None
+    if not row or not row[0]:
+        return None
+
+    # A generous provisional range, defined once in `_lib_subscription_weeks`
+    # because `cmd_project` needs the identical range: the extrapolation
+    # anchor `_compute_subscription_weeks` picks is relative to `range_start`,
+    # so two callers asking the same question over different ranges can be
+    # handed differently-phased intervals for the same history.
+    range_start, range_end = _cctally().subscription_window_probe_range(
+        anchor_utc, weeks_back,
+    )
+    try:
+        subweeks = _cctally()._compute_subscription_weeks(
+            conn, range_start, range_end, account_key=account_key,
+        )
+    except Exception:
+        # A malformed anchor must not take the panel down; the Monday
+        # fallback still renders a coherent (if approximate) window.
+        return None
+    bounds: "list[tuple[dt.datetime, dt.datetime]]" = []
+    for sw in subweeks:
+        try:
+            s = parse_iso_datetime(
+                sw.start_ts, "projects week.start_ts",
+            ).astimezone(dt.timezone.utc)
+            e = parse_iso_datetime(
+                sw.end_ts, "projects week.end_ts",
+            ).astimezone(dt.timezone.utc)
+        except (TypeError, ValueError):
+            continue
+        if e > s:
+            bounds.append((s, e))
+    if not bounds:
+        return None
+    return _ProjectsWeekGrid(bounds)
+
+
 def _projects_week_label(week_start: "dt.datetime") -> str:
     """Render a `wk Mon DD` label for the trend chart x-axis.
 
@@ -3369,9 +4426,25 @@ def _projects_iter_session_entries(conn: "sqlite3.Connection",
     downstream. An ``EXPLAIN QUERY PLAN`` regression asserts the mutation_seq
     index seek (``tests/test_projects_envelope.py``).
     """
-    since_iso = since.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
+    # The SQL bounds are an outward-widened CANDIDATE filter; the real
+    # membership test is the Python one every caller applies
+    # (`_fold_projects_entry`'s interval gate, `_week_for`, or
+    # `_fetch_delta_rows`' own pre-filter). #620 S1: the lower bound is
+    # widened by one second because ingestion stores
+    # `timestamp.astimezone(utc).isoformat()`, which keeps a `+00:00`
+    # offset, while this predicate spells its bound `Z` — and SQLite
+    # compares the column lexically, where `+` (0x2B) sorts BELOW `Z`
+    # (0x5A). An entry stored at exactly `since`, or in the first second
+    # after it, therefore sorts below the bound and is dropped before any
+    # Python gate runs. That was unreachable while a week always started at
+    # Monday 00:00 UTC, which carries no entries; a real subscription week
+    # starts at the reset instant, and an entry lands on it routinely. The
+    # widening admits at most one extra second of candidates, which the
+    # Python gate then rejects, so no caller's result changes except the one
+    # that was silently losing the boundary entry.
+    since_iso = (
+        since.astimezone(dt.timezone.utc) - dt.timedelta(seconds=1)
+    ).strftime("%Y-%m-%dT%H:%M:%SZ")
     until_iso = until.astimezone(dt.timezone.utc).strftime(
         "%Y-%m-%dT%H:%M:%SZ"
     )
@@ -3562,6 +4635,25 @@ def _shared_range_row_to_usage_entry(row):
     )
 
 
+def _shared_range_row_to_priced_usage_entry(row):
+    """Prepare one shared row's effective cost once for both range folds."""
+    entry = _shared_range_row_to_usage_entry(row)
+    if entry.model == "<synthetic>":
+        return entry
+    return _cctally().UsageEntry(
+        timestamp=entry.timestamp,
+        model=entry.model,
+        usage=entry.usage,
+        cost_usd=_calculate_entry_cost(
+            entry.model,
+            entry.usage,
+            mode="auto",
+            cost_usd=entry.cost_usd,
+        ),
+        source_path=entry.source_path,
+    )
+
+
 def _fold_prepared_daily_entries(
     accumulators, entries, *, display_tz=None, mode: str = "auto",
 ):
@@ -3681,7 +4773,9 @@ def _fold_projects_entry(
     *,
     resolver_cache: dict,
     week_start: "dt.datetime | None",
+    week_end: "dt.datetime | None" = None,
     prepared_daily_entries: "list | None" = None,
+    priced_entry=None,
 ) -> "float | None":
     """Fold ONE ``_projects_iter_session_entries`` row onto ``mut`` (the shared
     per-row body, #271 §20 Codex-P1a).
@@ -3693,6 +4787,15 @@ def _fold_projects_entry(
     row is filtered out (``<synthetic>`` model, or its Monday-anchored week ≠
     ``week_start``) — the caller then skips ``week_total`` / ``tail`` advance.
 
+    The membership gate is the half-open interval ``[week_start, week_end)``
+    (#620 S1 D1). It was a ``_projects_week_start_monday_utc(ts) ==
+    week_start`` equality, which is the SAME predicate whenever ``week_start``
+    is a Monday 00:00 UTC and ``week_end`` is ``week_start + 7d`` — so every
+    Monday-anchored caller is byte-unchanged — but the interval form also
+    admits a real subscription week that neither starts on a Monday nor runs
+    a full seven days. ``week_end`` defaults to ``week_start + 7d`` for a
+    caller that has not been threaded through yet.
+
     ``mut[bp]`` is the running mutable dict ``{"cost_usd": float,
     "sessions": set, "first_seen": dt, "last_seen": dt, "first_order": ts_iso,
     "first_id": int, "first_key": ProjectKey}``. The first row seen for a
@@ -3715,32 +4818,43 @@ def _fold_projects_entry(
     if model == "<synthetic>":
         return None
     ts = parse_iso_datetime(ts_iso, "session_entries.timestamp_utc")
-    if week_start is not None and _projects_week_start_monday_utc(ts) != week_start:
-        return None
-    usage = claude_usage_dict(   # #195 chokepoint
-        input_tokens=input_tok,
-        output_tokens=output_tok,
-        cache_creation_tokens=cache_create,
-        cache_read_tokens=cache_read,
-        cache_1h_tokens=cache_1h,
-        speed=speed,
-    )
-    entry_cost = _calculate_entry_cost(
-        model,
-        usage,
-        mode="auto",
-        cost_usd=cost_raw,
-    )
+    if week_start is not None:
+        w_end = (
+            week_end if week_end is not None
+            else week_start + dt.timedelta(days=7)
+        )
+        if not (week_start <= ts < w_end):
+            return None
+    if priced_entry is None:
+        usage = claude_usage_dict(   # #195 chokepoint
+            input_tokens=input_tok,
+            output_tokens=output_tok,
+            cache_creation_tokens=cache_create,
+            cache_read_tokens=cache_read,
+            cache_1h_tokens=cache_1h,
+            speed=speed,
+        )
+        entry_cost = _calculate_entry_cost(
+            model,
+            usage,
+            mode="auto",
+            cost_usd=cost_raw,
+        )
+    else:
+        usage = priced_entry.usage
+        entry_cost = priced_entry.cost_usd
     if prepared_daily_entries is not None:
         # #567: preserve the canonical daily entry and aggregator while
         # handing off the effective cost this pass already computed.
-        prepared_daily_entries.append(c.UsageEntry(
-            timestamp=dt.datetime.fromisoformat(ts_iso),
-            model=model,
-            usage=usage,
-            cost_usd=entry_cost,
-            source_path=source_path,
-        ))
+        prepared_daily_entries.append(
+            priced_entry if priced_entry is not None else c.UsageEntry(
+                timestamp=dt.datetime.fromisoformat(ts_iso),
+                model=model,
+                usage=usage,
+                cost_usd=entry_cost,
+                source_path=source_path,
+            )
+        )
     pkey = c._resolve_project_key(project_path, "git-root", resolver_cache)
     bp = pkey.bucket_path
     a = mut.get(bp)
@@ -3769,6 +4883,7 @@ def _fold_projects_entry(
 
 def fold_projects_over_range(
     rows, *, resolver_cache=None, prepared_daily_entries=None,
+    priced_entries=None,
 ) -> "dict[str, dict]":
     """Fold an ALREADY-MATERIALISED candidate stream into per-bucket totals.
 
@@ -3791,13 +4906,17 @@ def fold_projects_over_range(
     """
     mut: "dict[str, dict]" = {}
     cache = {} if resolver_cache is None else resolver_cache
-    for row in rows:
+    if priced_entries is not None and len(priced_entries) != len(rows):
+        raise ValueError("priced shared-range entries do not match source rows")
+    for index, row in enumerate(rows):
         _fold_projects_entry(
             mut,
             row,
             resolver_cache=cache,
             week_start=None,
             prepared_daily_entries=prepared_daily_entries,
+            priced_entry=(
+                priced_entries[index] if priced_entries is not None else None),
         )
     return mut
 
@@ -4069,25 +5188,35 @@ def _shared_range_cache_payload(
     }
 
 
-def build_cached_claude_range_aggregates(
+@dataclass(frozen=True)
+class ClaudeRangeAggregateCapture:
+    """Cache-owned inputs for one post-transaction Claude range fold."""
+
+    base: tuple
+    max_entry_id: int
+    entry_mutation_seq: int
+    shared_end_exclusive: object
+    prior: object
+    delta_rows: tuple
+    full_rows: tuple | None
+
+
+def capture_cached_claude_range_aggregates(
     conn,
     *,
     shared_start,
     shared_end_exclusive,
-    now_utc,
     display_tz,
-    legacy_labels,
     max_entry_id: "int | None" = None,
     entry_mutation_seq: "int | None" = None,
     generation: int = 0,
 ):
-    """Build or increment the one-snapshot Claude range folds (#567).
+    """Capture only cache-backed inputs for the #567 append accumulator.
 
-    Pure appends are folded onto the cached raw accumulators.  A shifted range
-    floor, backwards clock, generation or session-file identity change,
-    non-monotone signature, or an id-stable mutation of an already-folded row
-    falls back to one full ordered pass.  The cache stores no public labels, so
-    the current legacy population is reapplied on every publication.
+    This half may run under `_tui_build_source_bundle`'s pinned transaction. It
+    performs no deepcopy, pricing, project fold, daily fold, payload assembly,
+    or memo mutation. The returned rows are ordinary immutable SQLite tuples,
+    so the caller can end the read transaction before consuming them.
     """
     if max_entry_id is None or entry_mutation_seq is None:
         observed_id, observed_seq = _shared_range_entry_signature(conn)
@@ -4104,7 +5233,8 @@ def build_cached_claude_range_aggregates(
         generation=generation,
     )
     prior = _CLAUDE_RANGE_AGGREGATE_MEMO.get("state")
-    state = None
+    delta_rows: tuple = ()
+    full_rows: tuple | None = None
     if isinstance(prior, dict) and prior.get("base") == base:
         monotone = (
             max_entry_id >= prior["max_entry_id"]
@@ -4120,9 +5250,6 @@ def build_cached_claude_range_aggregates(
             )
         )
         if monotone and not old_row_changed:
-            project_mut = copy.deepcopy(prior["project_mut"])
-            daily_accumulators = copy.deepcopy(prior["daily_accumulators"])
-            resolver_cache = dict(prior["resolver_cache"])
             delta_by_id = {}
             for row in _shared_range_entries_after_id(
                 conn, prior["max_entry_id"],
@@ -4140,85 +5267,198 @@ def build_cached_claude_range_aggregates(
                 ):
                     if row[0] <= prior["max_entry_id"]:
                         delta_by_id[row[0]] = row
-            delta_rows = sorted(
+            delta_rows = tuple(sorted(
                 delta_by_id.values(),
                 key=lambda row: (row[1], row[0]),
-            )
+            ))
             prior_tail = prior["tail"]
-            if prior_tail is None or all(
+            if not (prior_tail is None or all(
                 (row[1], row[0]) > prior_tail
                 for row in delta_rows
                 if row[2] != "<synthetic>"
-            ):
-                prepared = []
-                for row in delta_rows:
-                    _fold_projects_entry(
-                        project_mut,
-                        row,
-                        resolver_cache=resolver_cache,
-                        week_start=None,
-                        prepared_daily_entries=prepared,
-                    )
-                _fold_prepared_daily_entries(
-                    daily_accumulators,
-                    prepared,
-                    display_tz=display_tz,
-                )
-                tail = prior_tail
-                real_delta = [
-                    row for row in delta_rows if row[2] != "<synthetic>"
-                ]
-                if real_delta:
-                    last = real_delta[-1]
-                    tail = (last[1], last[0])
-                state = {
-                    "base": base,
-                    "max_entry_id": max_entry_id,
-                    "entry_mutation_seq": entry_mutation_seq,
-                    "end_exclusive": shared_end_exclusive,
-                    "tail": tail,
-                    "project_mut": project_mut,
-                    "daily_accumulators": daily_accumulators,
-                    "resolver_cache": resolver_cache,
-                }
-    if state is None:
-        rows = tuple(iter_shared_range_entries(
+            )):
+                # An out-of-order append cannot be folded onto the accumulator.
+                # Capture the cold carrier while the same snapshot is pinned;
+                # discovering this after rollback would require a second read
+                # generation.
+                full_rows = tuple(iter_shared_range_entries(
+                    conn, start=shared_start,
+                    end_exclusive=shared_end_exclusive,
+                ))
+                delta_rows = ()
+        else:
+            full_rows = tuple(iter_shared_range_entries(
+                conn, start=shared_start,
+                end_exclusive=shared_end_exclusive,
+            ))
+    else:
+        full_rows = tuple(iter_shared_range_entries(
             conn, start=shared_start, end_exclusive=shared_end_exclusive,
         ))
-        prepared = []
-        resolver_cache = {}
-        project_mut = fold_projects_over_range(
-            rows,
-            resolver_cache=resolver_cache,
-            prepared_daily_entries=prepared,
+    return ClaudeRangeAggregateCapture(
+        base=base,
+        max_entry_id=max_entry_id,
+        entry_mutation_seq=entry_mutation_seq,
+        shared_end_exclusive=shared_end_exclusive,
+        prior=prior,
+        delta_rows=delta_rows,
+        full_rows=full_rows,
+    )
+
+
+def build_cached_claude_range_aggregates_from_capture(
+    capture: ClaudeRangeAggregateCapture,
+    *,
+    now_utc,
+    display_tz,
+    legacy_labels,
+    tolerate_leg_failures: bool = False,
+):
+    """Fold and publish one captured Claude range accumulator outside the pin.
+
+    ``tolerate_leg_failures`` is the source-bundle path's typed degradation
+    seam. Project identity resolution and the daily calendar are independent
+    folds over the same captured rows, so a project-only fault must not discard
+    a valid daily result. The one-shot compatibility wrapper keeps the legacy
+    raise-on-any-fault contract by leaving it false.
+    """
+    prior = capture.prior
+    incremental = capture.full_rows is None and isinstance(prior, dict)
+    rows = capture.delta_rows if incremental else (capture.full_rows or ())
+    payload: dict[str, object] = {}
+    outcomes = {
+        "projects": {"state": "ok"},
+        "daily": {"state": "ok"},
+    }
+    failures: dict[str, Exception] = {}
+    project_mut = None
+    resolver_cache = None
+    daily_accumulators = None
+
+    try:
+        prepared = tuple(
+            _shared_range_row_to_priced_usage_entry(row) for row in rows)
+    except Exception as exc:
+        prepared = ()
+        failures["projects"] = exc
+        failures["daily"] = exc
+        outcomes["projects"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+        outcomes["daily"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    try:
+        if "projects" in failures:
+            raise failures["projects"]
+        if incremental:
+            project_mut = copy.deepcopy(prior["project_mut"])
+            resolver_cache = dict(prior["resolver_cache"])
+            for row, priced_entry in zip(rows, prepared):
+                _fold_projects_entry(
+                    project_mut,
+                    row,
+                    resolver_cache=resolver_cache,
+                    week_start=None,
+                    priced_entry=priced_entry,
+                )
+        else:
+            resolver_cache = {}
+            project_mut = fold_projects_over_range(
+                rows,
+                resolver_cache=resolver_cache,
+                priced_entries=prepared,
+            )
+        payload["projects"] = _project_aggregate_rows_from_folded(
+            project_mut, legacy_labels)
+    except Exception as exc:
+        failures["projects"] = exc
+        outcomes["projects"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    try:
+        if "daily" in failures:
+            raise failures["daily"]
+        daily_accumulators = (
+            copy.deepcopy(prior["daily_accumulators"])
+            if incremental else {}
         )
-        daily_accumulators = {}
         _fold_prepared_daily_entries(
-            daily_accumulators, prepared, display_tz=display_tz,
-        )
+            daily_accumulators, prepared, display_tz=display_tz)
+        daily_buckets = _finalize_daily_accumulators(daily_accumulators)
+        daily_rows = _build_daily_aggregate_rows_from_buckets(
+            daily_buckets, now_utc=now_utc, display_tz=display_tz)
+        c = _cctally()
+        payload["daily"] = [
+            c.daily_panel_row_to_wire(row) for row in daily_rows]
+    except Exception as exc:
+        failures["daily"] = exc
+        outcomes["daily"] = {
+            "state": "failed", "code": "claude_fold_failed"}
+
+    if incremental:
+        tail = prior["tail"]
+        real_delta = [
+            row for row in capture.delta_rows if row[2] != "<synthetic>"
+        ]
+        if real_delta:
+            last = real_delta[-1]
+            tail = (last[1], last[0])
+    else:
         real_rows = [row for row in rows if row[2] != "<synthetic>"]
         tail = None
         if real_rows:
             last = real_rows[-1]
             tail = (last[1], last[0])
+
+    if not failures:
         state = {
-            "base": base,
-            "max_entry_id": max_entry_id,
-            "entry_mutation_seq": entry_mutation_seq,
-            "end_exclusive": shared_end_exclusive,
+            "base": capture.base,
+            "max_entry_id": capture.max_entry_id,
+            "entry_mutation_seq": capture.entry_mutation_seq,
+            "end_exclusive": capture.shared_end_exclusive,
             "tail": tail,
             "project_mut": project_mut,
             "daily_accumulators": daily_accumulators,
             "resolver_cache": resolver_cache,
         }
-    payload = _shared_range_cache_payload(
-        state,
-        legacy_labels=legacy_labels,
+        _cctally()._load_sibling("_lib_snapshot_cache")._assert_owner()
+        _CLAUDE_RANGE_AGGREGATE_MEMO["state"] = state
+
+    if failures and not tolerate_leg_failures:
+        raise next(iter(failures.values()))
+    if tolerate_leg_failures:
+        return payload, outcomes
+    return payload
+
+
+def build_cached_claude_range_aggregates(
+    conn,
+    *,
+    shared_start,
+    shared_end_exclusive,
+    now_utc,
+    display_tz,
+    legacy_labels,
+    max_entry_id: "int | None" = None,
+    entry_mutation_seq: "int | None" = None,
+    generation: int = 0,
+):
+    """One-shot compatibility wrapper for non-pinned focused callers."""
+    capture = capture_cached_claude_range_aggregates(
+        conn,
+        shared_start=shared_start,
+        shared_end_exclusive=shared_end_exclusive,
+        display_tz=display_tz,
+        max_entry_id=max_entry_id,
+        entry_mutation_seq=entry_mutation_seq,
+        generation=generation,
+    )
+    return build_cached_claude_range_aggregates_from_capture(
+        capture,
         now_utc=now_utc,
         display_tz=display_tz,
+        legacy_labels=legacy_labels,
     )
-    _CLAUDE_RANGE_AGGREGATE_MEMO["state"] = state
-    return payload
 
 
 def _aggregate_projects_week_raw(
@@ -4249,7 +5489,8 @@ def _aggregate_projects_week_raw(
         conn, since=week_start, until=week_end,
     ):
         entry_cost = _fold_projects_entry(
-            mut, row, resolver_cache=resolver_cache, week_start=week_start,
+            mut, row, resolver_cache=resolver_cache,
+            week_start=week_start, week_end=week_end,
         )
         if entry_cost is None:
             continue
@@ -4312,7 +5553,7 @@ def _aggregate_projects_week(
 def _assemble_projects_via_cache(
     conn: "sqlite3.Connection",
     *,
-    weeks_full: "list[dt.datetime]",
+    week_bounds: "list[tuple[dt.datetime, dt.datetime]]",
     cw_start: "dt.datetime",
     cw_end: "dt.datetime",
     cur_max_id: int,
@@ -4387,33 +5628,47 @@ def _assemble_projects_via_cache(
             if r[2] == "<synthetic>":  # r[2] = model
                 continue
             ts = parse_iso_datetime(r[1], "session_entries.timestamp_utc")
-            if _projects_week_start_monday_utc(ts) != cw_start:
+            if not (cw_start <= ts < cw_end):
                 continue
             out.append(r)
         out.sort(key=lambda r: (r[1], r[0]))  # (ts_iso, id)
         return out
 
-    for w in weeks_full:
+    # The cache identity below is `(start, end)`, while the spec named
+    # "account, exact start, exact end". The account axis is omitted
+    # deliberately, not by oversight: this panel always folds merged
+    # (`_projects_week_grid` is called here with `account_key=None`), so
+    # every entry in this cache was produced by the one merged read and two
+    # scopes cannot collide in it. Adding a constant third component would
+    # be a key that never varies. If the panel ever gains an account scope,
+    # the axis has to be added at the same time — an account-scoped fold
+    # served from a merged slot is a wrong answer, not a stale one.
+    for w, w_end in week_bounds:
         if w == cw_start:
             week_buckets, week_total = sc.accumulate_projects_current_week(
-                week_key=sc.projects_env_week_key(cw_start),
+                # #620 S1: the accumulator's identity is the INTERVAL. An
+                # early reset that moves the current week's bounds must
+                # cold-refold the slot rather than keep appending to a
+                # running aggregate folded over the old window.
+                week_key=sc.projects_env_week_key(cw_start, cw_end),
                 cur_max_id=cur_max_id,
                 cur_max_seq=cur_max_seq,
                 fetch_all_raw=_fetch_all_raw,
                 fetch_delta_rows=_fetch_delta_rows,
                 finalize=_finalize_projects_mut,
                 fold=lambda mut, row: _fold_projects_entry(
-                    mut, row, resolver_cache=resolver_cache, week_start=cw_start,
+                    mut, row, resolver_cache=resolver_cache,
+                    week_start=cw_start, week_end=cw_end,
                 ),
             )
         else:
-            week_iso = sc.projects_env_week_key(w)
+            week_iso = sc.projects_env_week_key(w, w_end)
             hit = sc.projects_env_week_get(week_iso)
             if hit is not None:
                 week_buckets, week_total = hit
             else:
                 week_buckets, week_total = _aggregate_projects_week(
-                    conn, week_start=w, week_end=w + dt.timedelta(days=7),
+                    conn, week_start=w, week_end=w_end,
                     resolver_cache=resolver_cache,
                 )
                 sc.projects_env_week_put(week_iso, week_buckets, week_total)
@@ -4437,14 +5692,21 @@ def _build_projects_envelope(
     shape from spec §5.2 (no per-model breakdowns, no first/last seen
     per session, no per-row $/1%; just cost / attributed_pct / sessions).
 
-    Week boundaries follow ``cmd_project``'s Monday-anchored UTC
-    fallback (``bin/cctally:4711``); ``weekly_usage_snapshots`` rows are
-    matched by ``week_start_date`` (date-only) for ``attributed_pct``.
-
-    ``current_week`` is passed through opaquely — if non-None and
-    carrying a ``.week_start_at`` UTC datetime, that boundary supplants
-    the Monday fallback for the current week's bucket. None (the
-    default) preserves the fallback.
+    Week boundaries are the real subscription intervals (#620 S1 D1):
+    ``_projects_week_grid`` derives them from ``_compute_subscription_weeks``,
+    the same kernel ``cmd_project`` buckets by, so the two surfaces attribute
+    the same projects over the same weeks. A ``weekly_usage_snapshots`` row
+    is matched onto an interval by its ``week_start_at`` anchor, falling back
+    to ``week_start_date`` for a legacy row that carries no anchor; a row
+    that matches no interval contributes nothing, leaving ``attributed_pct``
+    None rather than attributing over a mismatched population. Only a store
+    with no anchored snapshot at all falls back to
+    ``_projects_week_start_monday_utc``, which is what that function was
+    written for.
+
+    ``current_week`` is passed through opaquely — if non-None and carrying a
+    ``.week_start_at`` UTC datetime, that instant selects which interval is
+    the current week. None (the default) uses ``now_utc``.
 
     Determinism: same conn + same ``now_utc`` ⇒ byte-identical JSON
     (R-PROJ5 invariant). Per-tick memoized on
@@ -4499,33 +5761,51 @@ def _build_projects_envelope(
         return cached
 
     # ---- Week-start anchor (current subscription week) ------------------
-    # ``TuiCurrentWeek.week_start_at`` is NOT a valid Monday lookup key
-    # after ``_apply_midweek_reset_override`` — it is shifted to the
-    # in-week reset instant (e.g. Friday 13:00 UTC) while the bucket
-    # aggregator below snaps every entry to its containing ISO-Monday
-    # via ``_week_for``. Using ``cw_key`` directly as the bucket-lookup
-    # key strands all current-week activity in an empty bucket and emits
-    # ``rows: []`` with ``total_cost_usd: 0.0``. Snap to the canonical
-    # Monday-UTC week anchor here so the lookup keys align — same
-    # invariant the weekly handling notes call out for
-    # ``weekly_usage_snapshots``/``percent_milestones`` cross-table
-    # joins. Regression: ``tests/fixtures/dashboard/reset-week/`` +
+    # #620 S1 D1. The panel buckets cost into the REAL subscription
+    # intervals — the ones `_compute_subscription_weeks` derives from the
+    # retained reset anchors, and the ones `cmd_project` already buckets by.
+    # `_projects_week_start_monday_utc` remains what its own docstring says
+    # it is: the fallback for when no anchor is available. It used to be
+    # applied to the anchor itself, which discarded the very thing it was
+    # written to defer to, so the cost window and the quota window described
+    # different intervals for every account whose reset is not exactly
+    # Monday midnight UTC — in practice almost all of them.
+    #
+    # ``TuiCurrentWeek.week_start_at`` after ``_apply_midweek_reset_override``
+    # is the in-week reset instant rather than the week's start. It is used
+    # here only to locate the containing interval, never as a bucket key, so
+    # a shifted value resolves to the same week the entry walk uses and no
+    # activity is stranded. Regression:
+    # ``tests/fixtures/dashboard/reset-week/`` +
     # ``test_current_week_rows_populated_after_midweek_reset``.
-    if cw_key is not None:
-        cw_start = _projects_week_start_monday_utc(cw_key)
+    anchor_instant = cw_key if cw_key is not None else now_utc
+    grid = _projects_week_grid(
+        conn, anchor_utc=anchor_instant, weeks_back=weeks_back,
+    )
+    cw_start = grid.week_for(anchor_instant) if grid is not None else None
+    if cw_start is None:
+        # No anchor covers `now` — the genuine fallback path, byte-identical
+        # to the pre-#620 behaviour for a store with no anchored snapshots.
+        grid = None
+        cw_start = _projects_week_start_monday_utc(anchor_instant)
+        cw_end = cw_start + dt.timedelta(days=7)
+        week_bounds = [
+            (
+                cw_start - dt.timedelta(days=7 * (weeks_back - 1 - i)),
+                cw_start - dt.timedelta(days=7 * (weeks_back - 2 - i)),
+            )
+            for i in range(weeks_back)
+        ]
     else:
-        cw_start = _projects_week_start_monday_utc(now_utc)
+        cw_end = grid.end_for(cw_start)
+        week_bounds = grid.window_ending_at(cw_start, weeks_back)
 
-    # Build a list of canonical Monday-anchored week starts ending with
-    # cw_start, oldest → newest, of length ``weeks_back``. Clamping to
+    # Week starts, oldest → newest, of length ``weeks_back``. Clamping to
     # actual history happens after the entry walk reveals what weeks
     # have any activity.
-    weeks_full = [
-        cw_start - dt.timedelta(days=7 * (weeks_back - 1 - i))
-        for i in range(weeks_back)
-    ]
-    cw_end = cw_start + dt.timedelta(days=7)
-    since_dt = weeks_full[0]
+    weeks_full = [b[0] for b in week_bounds]
+    end_by_week = {s: e for s, e in week_bounds}
+    since_dt = week_bounds[0][0]
     until_dt = cw_end  # exclusive end; SQL is `>= since AND <= until`
 
     # ---- Bucket entries per (ProjectKey, week_start) --------------------
@@ -4540,7 +5820,7 @@ def _build_projects_envelope(
     # HTTP-drill): the original single full-window walk, byte-unchanged.
     if use_projects_env_cache:
         buckets, total_cost_by_week, key_by_bucket = _assemble_projects_via_cache(
-            conn, weeks_full=weeks_full, cw_start=cw_start, cw_end=cw_end,
+            conn, week_bounds=week_bounds, cw_start=cw_start, cw_end=cw_end,
             cur_max_id=max_id, cur_max_seq=entry_mutation_seq,
         )
     else:
@@ -4556,8 +5836,13 @@ def _build_projects_envelope(
         key_by_bucket = {}
 
         def _week_for(ts: dt.datetime) -> "dt.datetime | None":
-            wstart = _projects_week_start_monday_utc(ts)
-            if wstart < weeks_full[0] or wstart > weeks_full[-1]:
+            if grid is not None:
+                wstart = grid.week_for(ts)
+                if wstart is None:
+                    return None
+            else:
+                wstart = _projects_week_start_monday_utc(ts)
+            if wstart not in end_by_week:
                 return None
             return wstart
 
@@ -4653,7 +5938,7 @@ def _build_projects_envelope(
     weekly_pct_by_week: dict[dt.datetime, float] = {}
     try:
         cur = conn.execute(
-            "SELECT week_start_date, weekly_percent "
+            "SELECT week_start_date, week_start_at, weekly_percent "
             "FROM weekly_usage_snapshots "
             "ORDER BY captured_at_utc ASC, id ASC"
         )
@@ -4662,19 +5947,40 @@ def _build_projects_envelope(
         # No weekly_usage_snapshots table — leaves attributed_pct = None
         # throughout (acceptable per spec §2.7).
         rows = []
-    for week_date_str, weekly_pct in rows:
+    for week_date_str, week_start_at, weekly_pct in rows:
         try:
             wd = dt.date.fromisoformat(week_date_str)
         except (TypeError, ValueError):
             continue
-        # Snap the date to UTC Monday 00:00 (matches the bucketing key).
-        wstart = dt.datetime.combine(
-            wd, dt.time(0, 0, 0), tzinfo=dt.timezone.utc,
-        )
-        # Snap to Monday (snapshot rows that captured a non-Monday week
-        # boundary still align to the same canonical bucket as the entry
-        # walk, since the bucketing is Monday-anchored).
-        wstart = _projects_week_start_monday_utc(wstart)
+        wstart: "dt.datetime | None" = None
+        if grid is not None:
+            # #620 S1 D1. Resolve the row onto the SAME interval the entry
+            # walk buckets into, so the numerator, the denominator and this
+            # percentage are all taken from one half-open window before the
+            # multiplication below.
+            if week_start_at:
+                try:
+                    anchor = parse_iso_datetime(
+                        week_start_at, "weekly_usage_snapshots.week_start_at",
+                    ).astimezone(dt.timezone.utc)
+                except (TypeError, ValueError):
+                    anchor = None
+                if anchor is not None:
+                    wstart = grid.week_for(anchor)
+            if wstart is None:
+                # A legacy row carrying only the date-only boundary. One
+                # shared interval still serves both the cost and the
+                # percentage; taking them from different intervals is never
+                # acceptable, so an unresolvable row contributes nothing and
+                # `attributed_pct` stays None (#620 S1 A3).
+                wstart = grid.start_for_date(wd)
+            if wstart is None:
+                continue
+        else:
+            # No anchor anywhere in the store: the genuine Monday fallback.
+            wstart = _projects_week_start_monday_utc(dt.datetime.combine(
+                wd, dt.time(0, 0, 0), tzinfo=dt.timezone.utc,
+            ))
         if weekly_pct is not None:
             weekly_pct_by_week[wstart] = float(weekly_pct)
 
@@ -4701,12 +6007,11 @@ def _build_projects_envelope(
     if weeks_with_activity:
         # Window = inclusive [oldest_active_week, cw_start]. Always emits
         # cw_start (panel + trend share the same current_week column).
+        # Keyed by the SAME rule as the current week (#620 S1 D1) — the
+        # subscription intervals themselves, not a seven-day walk, because
+        # a mixed keying inside one panel is the defect restated.
         oldest = min(weeks_with_activity[0], cw_start)
-        trend_weeks = []
-        w = oldest
-        while w <= cw_start:
-            trend_weeks.append(w)
-            w += dt.timedelta(days=7)
+        trend_weeks = [w for w in weeks_full if oldest <= w <= cw_start]
     else:
         trend_weeks = [cw_start]
 
@@ -4898,13 +6203,74 @@ def _project_detail_for_window(
     if bucket_path is None:
         return None
 
-    # ---- Window bounds (Monday-anchored UTC fallback, like the builder) -
+    # ---- Window bounds, from the envelope's own current-week anchor ----
+    # That anchor is the account's real subscription week start; the
+    # Monday-midnight snap is only the no-anchor fallback (#620).
     cw_start = parse_iso_datetime(
         env["current_week"]["week_start_at"],
         "projects.current_week.week_start_at",
+    ).astimezone(dt.timezone.utc)
+
+    # The drill resolves the SAME interval its panel resolved, by rebuilding
+    # the panel's grid rather than stepping back in seven-day multiples.
+    # `_ProjectsWeekGrid` exists because a drifted reset day produces a
+    # genuinely short week: on `non-monday-anchor` at `weeks_back=4` the grid
+    # starts the window at 2026-03-27T09:00Z while a seven-day walk yields
+    # 2026-03-26T09:00Z, and an early reset that shortens the current week
+    # would likewise leave a `cw_start + 7d` end counting cost past the
+    # week's real end. `window_start_at` / `window_end_at` publish these
+    # bounds to the client as authoritative, so a divergence here renders a
+    # window the panel never computed.
+    #
+    # The grid is rebuilt from the PANEL'S OWN anchor, not from `cw_start`.
+    # `_projects_week_grid` derives its provisional range from an ISO-Monday
+    # snap of whatever anchor it is handed, and `cw_start` is the interval
+    # START while the panel anchors on `current_week.week_start_at` — which
+    # after `_apply_midweek_reset_override` is the in-week reset instant and
+    # can sit up to a week later. The two therefore snap to different Mondays
+    # and `_compute_subscription_weeks` can pick a different extrapolation
+    # anchor for each, so window equality would rest on a coincidence rather
+    # than on the two surfaces asking the same question. `cw_start` remains
+    # the anchor `window_ending_at` walks back from, because that walk needs
+    # an interval start.
+    panel_anchor = getattr(current_week, "week_start_at", None)
+    if not isinstance(panel_anchor, dt.datetime):
+        panel_anchor = now_utc
+    detail_grid = _projects_week_grid(
+        conn, anchor_utc=panel_anchor, weeks_back=weeks_back,
+    )
+    detail_bounds = (
+        detail_grid.window_ending_at(cw_start, weeks_back)
+        if detail_grid is not None else []
+    )
+    if detail_bounds:
+        since_dt = detail_bounds[0][0]
+        until_dt = detail_bounds[-1][1]
+    else:
+        # No anchor covers this start — the same no-anchor tail the panel
+        # falls back to, where the seven-day assumption is the right one.
+        since_dt = cw_start - dt.timedelta(days=7 * (weeks_back - 1))
+        until_dt = cw_start + dt.timedelta(days=7)
+    since_iso = since_dt.astimezone(dt.timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    until_iso = until_dt.astimezone(dt.timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
     )
-    since_dt = cw_start - dt.timedelta(days=7 * (weeks_back - 1))
-    until_dt = cw_start + dt.timedelta(days=7)
+    # SQL candidate bound, NOT the published one. Ingestion stores
+    # `timestamp_utc` as `…+00:00` while these bounds are spelled `…Z`, and
+    # SQLite compares that column lexically with `+` (0x2B) below `Z` (0x5A).
+    # So the lower bound drops an entry sitting exactly on it and the upper
+    # bound admits one sitting exactly on it — an asymmetry in both
+    # directions. Widening the lower bound by a second makes SQL an outward
+    # candidate filter at both ends; the half-open membership test is then
+    # enforced on the PARSED datetime in the entry loop, which is the only
+    # place it can be stated honestly.
+    since_sql_iso = (
+        since_dt.astimezone(dt.timezone.utc) - dt.timedelta(seconds=1)
+    ).strftime("%Y-%m-%dT%H:%M:%SZ")
+    until_dt_utc = until_dt.astimezone(dt.timezone.utc)
+    since_dt_utc = since_dt.astimezone(dt.timezone.utc)
 
     # ---- Build bucket → source_paths map for SQL-side scoping ----------
     # Walk session_files (~8k rows) once instead of session_entries
@@ -4956,6 +6322,8 @@ def _project_detail_for_window(
             "key":                    project_key,
             "bucket_path":            bucket_path,
             "window_weeks":           weeks_back,
+            "window_start_at":        since_iso,
+            "window_end_at":          until_iso,
             "window_cost_usd":        0.0,
             "window_attributed_pct":  None,
             "models":                 [],
@@ -4979,13 +6347,6 @@ def _project_detail_for_window(
         [(p,) for p in bucket_source_paths],
     )
 
-    since_iso = since_dt.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
-    until_iso = until_dt.astimezone(dt.timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
-
     # ---- Walk session_entries (project-scoped) once -------------------
     # INNER JOIN to _drill_paths drops every row whose source_path
     # doesn't belong to this bucket. The Python-side filter that
@@ -5001,7 +6362,7 @@ def _project_detail_for_window(
         "LEFT JOIN session_files sf ON sf.path = e.source_path "
         "WHERE e.timestamp_utc >= ? AND e.timestamp_utc <= ? "
         "ORDER BY e.timestamp_utc ASC, e.id ASC",
-        (since_iso, until_iso),
+        (since_sql_iso, until_iso),
     )
 
     # Per-model rollup: {model -> {cost_usd, sessions, in, out, cache_*}}
@@ -5024,6 +6385,14 @@ def _project_detail_for_window(
         # on _drill_paths already restricted the result set to entries
         # whose source_path belongs to this bucket.
         ts = parse_iso_datetime(ts_iso, "session_entries.timestamp_utc")
+        # The half-open membership test. The SQL bounds above are a widened
+        # candidate filter that admits a second on each side, because the
+        # column's stored offset spelling and the bound's spelling do not
+        # compare the way the interval means; this is where the interval is
+        # actually decided.
+        ts_utc = ts.astimezone(dt.timezone.utc)
+        if not (since_dt_utc <= ts_utc < until_dt_utc):
+            continue
         entry_cost = _calculate_entry_cost(
             model,
             claude_usage_dict(   # #195 chokepoint
@@ -5146,6 +6515,8 @@ def _project_detail_for_window(
         "key":                    project_key,
         "bucket_path":            bucket_path,
         "window_weeks":           weeks_back,
+        "window_start_at":        since_iso,
+        "window_end_at":          until_iso,
         "window_cost_usd":        window_cost,
         "window_attributed_pct":  win_pct,
         "models":                 models_out,
@@ -5301,14 +6672,31 @@ def _channel_env_fragment() -> dict:
     return {}
 
 
-# Bounded wait for /api/sync's lock acquisition. The periodic background
-# sync thread holds sync_lock during sync_cache + snapshot build (often
-# 100-1500ms under active CC sessions); a non-blocking try_acquire would
-# 503 the user's click whenever it lands inside that window, silently
-# dropping their refresh-usage intent. 2s is generous enough to span a
-# normal periodic tick yet short enough to surface a stuck rebuild as
-# 503 instead of hanging the request indefinitely.
-_DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS = 2.0
+
+# Upper bound on the ONE blocking `sync_lock` acquire left in the tree: a
+# manual `POST /api/sync` under `--no-sync`. Every other path either acquires
+# non-blocking or enqueues. #583 S2 removed the old bounded acquire along with
+# its 503, which left this one bare — and a bare acquire pins an HTTP handler
+# thread forever when a rebuild wedges (a `cache.db` read that never returns, a
+# hung builder), with no diagnostic at all.
+#
+# 30s rather than the old 2s because the holder in this mode is a whole
+# synchronous rebuild (measured 1.9-6.3 s), not a periodic tick, so the bound
+# has to be a wedge detector rather than a contention timeout. On expiry the
+# endpoint answers 200 with a `sync_busy` warning: that stays inside its
+# declared status vocabulary, does NOT reintroduce 503, and does not strand the
+# client the way a 202 would in a mode where nothing drains the queue.
+#
+# Recorded, not resolved: 30 s also outlives any plausible browser fetch
+# timeout, so on a real wedge the client aborts first and this handler writes
+# its 200 to a socket nobody is reading — broken-pipe noise in the dashboard's
+# terminal. That interaction is exactly why the earlier 2.0 s bound was chosen
+# against a 3.0 s client timeout
+# (docs/superpowers/specs/2026-06-13-refresh-usage-dashboard-nudge-design.md,
+# the "Timeout chosen above the server's lock-wait" bullet). Deciding between
+# the two needs the client-side timeout in view as well, which is out of scope
+# here; a later session should pick one with both numbers in front of it.
+_DASHBOARD_NO_SYNC_LOCK_TIMEOUT_SECONDS = 30.0
 
 
 # === DashboardHTTPHandler (the /api/* + static surface) ===================
@@ -5671,6 +7059,8 @@ _POST_ROUTES = (
     ("exact", "/api/share/presets/rename", "_handle_share_presets_rename_post",
      None, False),
     ("exact", "/api/share/history", "_handle_share_history_post", None, False),
+    ("exact", "/api/debug/backend/trace", "_handle_post_debug_backend_trace",
+     None, False),
 )
 
 _DELETE_ROUTES = (
@@ -5950,15 +7340,54 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         )
         self.end_headers()
 
+    @classmethod
+    def publish_activity(cls) -> None:
+        """Republish the held snapshot so a new counter reaches clients now.
+
+        #583 S2 spec 6.2 publication point 1: acknowledge an accepted request
+        without waiting for a rebuild. The reference re-stamps its held
+        snapshot on every mutation, so ``get()`` already carries the new
+        ``requested_id``.
+        """
+        ref = getattr(cls, "snapshot_ref", None)
+        hub = getattr(cls, "hub", None)
+        if ref is None or hub is None:
+            return
+        hub.publish(ref.get())
+
+    @classmethod
+    def mark_rebuilding(cls, value: bool) -> None:
+        """Publish the in-flight flag for a HANDLER-driven rebuild.
+
+        #583 S2 §6.3. `rebuilding` describes the rebuild, not the thread that
+        started it, and an UNCONTENDED manual refresh rebuilds synchronously
+        right here — `202 queued` is only the contended branch. Without this
+        pair a user clicking the sync chip ran a multi-second rebuild during
+        which every other connected tab published `rebuilding: false` and could
+        not tell a busy dashboard from a wedged one.
+
+        Publishes only on a real transition, exactly like the sync loop's
+        collaborator, so the rebuild's own terminal publish (`set_final`) leaves
+        the trailing mark with nothing to say.
+        """
+        ref = getattr(cls, "snapshot_ref", None)
+        hub = getattr(cls, "hub", None)
+        if ref is None or hub is None:
+            return
+        if ref.mark_rebuilding(value):
+            hub.publish(ref.get())
+
     def _handle_post_sync(self) -> None:
         """Trigger refresh-usage + snapshot rebuild on user demand.
 
         Flow:
           1. Origin/Host CSRF check.
-          2. acquire(timeout=_DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS) -> 503
-             only on truly degenerate contention beyond the timeout.
-          3. With lock held: under --no-sync skip refresh; otherwise call
-             _refresh_usage_inproc(); always call run_sync_now_locked.
+          2. Non-blocking acquire. A machine nudge, or a held lock, enqueues
+             on ``_SnapshotRef`` and answers 202 with the request identifier
+             and this process's server epoch.
+          3. Lock free, human click: exactly the pre-#583 path — under
+             --no-sync skip refresh; otherwise call ``_refresh_usage_inproc()``;
+             always call run_sync_now_locked.
           4. Return 204 on clean success, 200 + JSON warnings on
              non-ok refresh status, 500 on unexpected exception.
 
@@ -5967,17 +7396,36 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         run_sync_now_locked assumes the caller holds sync_lock - that's the
         whole point of the Task 0 lock split.
 
-        Bounded wait (vs. earlier non-blocking try_acquire): the periodic
-        background thread holds the lock for hundreds of ms each tick, and
-        a non-blocking acquire would 503 any click that landed inside that
-        window — silently dropping the user's force-refresh intent (the
-        periodic thread doesn't run refresh-usage). Waiting up to ~2s lets
-        the click span a normal periodic tick while still 503-ing on
-        truly stuck contention.
+        #583 S2. The bounded acquire and its 503 are gone. A click landing
+        inside the periodic thread's lock-hold used to wait up to ~2s and then
+        503 on stuck contention, which silently dropped the user's intent; it
+        now queues, is serviced by the sync loop under the duty floor, and its
+        settlement arrives on the published frame. This endpoint's status
+        vocabulary is 403 / 202 / 200 / 204 / 500. The two other 503 sites
+        (quota_projection_incomplete) are untouched.
+
+        A MACHINE NUDGE always queues, even when the lock is free. This is
+        load-bearing: cmd_record_usage fires at Claude Code's status-line
+        cadence, so a nudge taking the synchronous path would rebuild at that
+        frequency and reopen the #313 peg, bypassing the loop's floor. The
+        nudge is identified by an explicit ``queue=1``; an older refresh-usage
+        binary posting without it takes the synchronous path, which is today's
+        behaviour.
 
         --no-sync mode: refresh skipped (frozen mode preserves "no network
         calls"), rebuild still runs with skip_sync=True (the wired
-        staticmethod closes over args.no_sync, so the no-arg call DTRT).
+        staticmethod closes over args.no_sync, so the no-arg call DTRT). A
+        manual request there acquires sync_lock BLOCKING rather than
+        non-blocking, because nothing would drain a queue in that mode —
+        bounded by ``_DASHBOARD_NO_SYNC_LOCK_TIMEOUT_SECONDS``, past which it
+        answers 200 with a ``sync_busy`` warning rather than pinning the
+        handler thread on a wedged rebuild. A
+        machine nudge is REFUSED there with 204 and enqueues nothing: the
+        documented contract freezes data to the startup snapshot, and a queued
+        nudge serviced by a skip_sync rebuild would read newly persisted rows
+        and unfreeze it. A manual refresh=1 states the skip with a
+        ``refresh_skipped_no_sync`` warning instead of performing no refresh
+        silently.
 
         Refresh failures DO NOT cause 500 - they surface as warnings in the
         200 envelope and the rebuild still runs so the snapshot stays
@@ -5985,28 +7433,87 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         """
         if not self._check_origin_csrf():
             return
-        sync_lock = type(self).sync_lock
-        if not sync_lock.acquire(
-                timeout=sys.modules["cctally"]._DASHBOARD_SYNC_LOCK_TIMEOUT_SECONDS):
-            self.send_error(503, "sync in progress")
+        cls = type(self)
+        sync_lock = cls.sync_lock
+        query = urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
+        do_refresh = query.get("refresh", ["1"])[0] != "0"
+        is_machine_nudge = query.get("queue", ["0"])[0] == "1"
+
+        if is_machine_nudge and cls.no_sync:
+            self.send_response(204)
+            self.end_headers()
             return
-        try:
-            do_refresh = (
-                urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
-                .get("refresh", ["1"])[0] != "0"
+
+        # Under --no-sync a manual request WAITS for the lock rather than
+        # queueing. Nothing drains a queue in that mode (`sync_thread` is None),
+        # and the lock is not always free there: POST /api/settings calls
+        # `run_sync_now()`, which takes it blocking precisely so a config change
+        # propagates in a mode whose periodic thread never runs. A click landing
+        # inside that hold used to answer 202 for a batch nobody could capture,
+        # leaving `requested_id > started_id` true forever. The holder in that
+        # mode is always another short synchronous rebuild, so the wait is
+        # bounded. The machine-nudge refusal above is unaffected.
+        if cls.no_sync and not is_machine_nudge:
+            if not sync_lock.acquire(
+                    timeout=_DASHBOARD_NO_SYNC_LOCK_TIMEOUT_SECONDS):
+                # A wedged rebuild, not ordinary contention: the holder in this
+                # mode is one short synchronous rebuild. Say so instead of
+                # pinning this thread for the life of the process.
+                self._respond_json(200, {
+                    "status": "ok",
+                    "warnings": [{"code": "sync_busy"}],
+                })
+                return
+            acquired = True
+        else:
+            acquired = not is_machine_nudge and sync_lock.acquire(blocking=False)
+        if not acquired:
+            # `cls.no_sync` is UNREACHABLE-false here today, so the guard never
+            # subtracts anything: a manual request under --no-sync took the
+            # bounded blocking acquire above and either holds the lock or has
+            # already answered, and a machine nudge under --no-sync answered 204
+            # before either branch. The guard is kept because it states the
+            # invariant the queue depends on — nothing drains a queue under
+            # --no-sync, so a queued batch there must never carry an OAuth
+            # intent — and a future queueing path in that mode would silently
+            # violate it if this were dropped as dead code.
+            request_id = cls.snapshot_ref.request_sync(
+                refresh=do_refresh and not cls.no_sync
             )
+            cls.publish_activity()          # acknowledge before responding
+            self._respond_json(202, {
+                "status": "queued",
+                "request_id": request_id,
+                "server_epoch": cls.snapshot_ref.server_epoch,
+            })
+            return
+        try:
+            # The locked section is a REBUILD, and this is the path an
+            # uncontended manual refresh actually takes, so it reports itself
+            # like every other rebuild does.
+            cls.mark_rebuilding(True)
             warnings: list = []
-            if do_refresh and not type(self).no_sync:
-                result = _refresh_usage_inproc()
-                if result.status != "ok":
-                    warnings.append({"code": result.status})
+            if do_refresh:
+                if cls.no_sync:
+                    warnings.append({"code": "refresh_skipped_no_sync"})
+                else:
+                    result = _refresh_usage_inproc()
+                    if result.status != "ok":
+                        warnings.append({"code": result.status})
             try:
-                type(self).run_sync_now_locked()
+                cls.run_sync_now_locked()
             except Exception as exc:
                 self.log_error("/api/sync rebuild failed: %r", exc)
                 self.send_error(500, "sync failed")
                 return
         finally:
+            # Drops THIS thread's claim only, so the ordering against the lock
+            # release is not what makes it safe: a concurrent rebuilder's claim
+            # is a different set member and this call cannot touch it, whichever
+            # side of the release it runs on. On the success path the rebuild's
+            # terminal publish has already dropped this thread's claim and this
+            # adds no frame; the exception path is what needs it.
+            cls.mark_rebuilding(False)
             sync_lock.release()
 
         if warnings:
@@ -6177,12 +7684,44 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 conn.close()
         except Exception:  # noqa: BLE001 -- a diagnostic must not expose raw errors.
             cache_state = {"status": "unavailable"}
+        perf = self._perf_gate()
+        tick_state = _lib_tick_stats.snapshot()
+        requested, applied = perf.pending_state()
         body = {
             "schemaVersion": 1,
             "version": _debug_tool_version(),
             "generated_at": (last or {}).get("generated_at"),
             "dataset": dataset,
             "phases": (last or {}).get("phases"),
+            # #583 S1 §3.1 asked for the stored tree's instant beside
+            # `phases`, so a GET after `--trace off` cannot present an old tree
+            # as current — disabling tracing does not clear the stored tree.
+            # It was already there: the top-level `generated_at` above IS the
+            # tree's instant, read from the same slot. A `phases_generated_at`
+            # key was added and measured byte-identical to it on a live
+            # endpoint, so it is not repeated here.
+            "tick": {
+                "dispatch_counts": dict(tick_state.dispatch_counts),
+                "cache_open_failures": dict(tick_state.cache_open_failures),
+                "tick_seq": tick_state.tick_seq,
+                "records": [r.as_wire() for r in tick_state.records],
+                "standalone": (
+                    tick_state.standalone.as_wire()
+                    if tick_state.standalone is not None else None
+                ),
+                # #583 S4: the SECOND work loop's ring, published under the
+                # same object and behind the same loopback gate. An empty list
+                # is a reachable steady state (`--no-sync` never starts the
+                # thread), so the key is always present.
+                "conversation_sync": [
+                    r.as_wire() for r in tick_state.conversation_records
+                ],
+            },
+            "tracing": {
+                "requested": requested,
+                "applied": applied,
+                "applies_at": perf.applies_at(),
+            },
             "cache_state": cache_state,
             "sources": sources,
             # Additive, and named rather than folded into `cache_state`: a
@@ -6195,6 +7734,60 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             body["note"] = "tracing_disabled"
         self._respond_json(200, body)
 
+    def _handle_post_debug_backend_trace(self) -> None:
+        """POST ``/api/debug/backend/trace`` — arm the deep phase trace (§3.2).
+
+        Body ``{"enabled": true|false}``; any other shape is 400.
+
+        Gated in three layers, in this order. ``_require_api_auth`` runs first,
+        automatically for any ``/api/*`` path in ``do_POST``, and enforces the
+        bearer whenever the dashboard minted a token. ``_require_debug_backend_
+        allowed`` then applies the loopback TCP peer plus the IP-literal
+        ``Host``. ``_check_origin_csrf`` applies Origin/Host parity last.
+
+        Retaining the CSRF layer matters even though the peer is already known
+        to be loopback: the loopback and anti-rebinding checks do not stop a
+        malicious page aiming a simple form POST straight at
+        ``http://127.0.0.1:8789``. It is also why a command-line client must
+        send an ``Origin`` matching the ``Host`` it calls — `_check_origin_csrf`
+        rejects a request with none. That is not a weakening, because a
+        non-browser client can set arbitrary headers regardless; the check
+        exists to stop a page making the BROWSER issue the request.
+
+        The flip itself happens at the rebuild boundary in `_lib_perf.
+        apply_pending`, not here, which is why the response reports `applied`
+        as it is now and `applies_at` names when the request takes effect.
+        """
+        if not self._require_debug_backend_allowed():
+            return
+        if not self._check_origin_csrf():
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0") or "0")
+        except ValueError:
+            length = 0
+        if length <= 0 or length > 4096:
+            self._respond_json(400, {"error": "body required (<=4 KB)"})
+            return
+        try:
+            body = json.loads(self.rfile.read(length).decode("utf-8"))
+        except (ValueError, UnicodeDecodeError):
+            self._respond_json(400, {"error": "malformed JSON body"})
+            return
+        if (not isinstance(body, dict) or set(body) != {"enabled"}
+                or not isinstance(body.get("enabled"), bool)):
+            self._respond_json(
+                400, {"error": 'body must be {"enabled": true|false}'})
+            return
+        perf = self._perf_gate()
+        perf.request_enabled(body["enabled"])
+        requested, applied = perf.pending_state()
+        self._respond_json(200, {
+            "requested": requested,
+            "applied": applied,
+            "applies_at": perf.applies_at(),
+        })
+
     def _handle_post_settings(self) -> None:
         """Persist a settings update and trigger an immediate SSE broadcast.
 
@@ -6933,10 +8526,18 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # under --no-sync). run_sync_now is the same path POST /api/sync
         # uses; under skip_sync=True it still rebuilds + publishes via
         # hub.publish, which is what each SSE listener pulls.
+        #
+        # #583 S2 §6.3: this rebuild is the same multi-second locked rebuild
+        # POST /api/sync runs, so it reports itself the same way. The mark is
+        # outside the acquire because `run_sync_now` takes `sync_lock` itself;
+        # a wait for a rebuild already in flight is honestly in-flight too.
         try:
+            type(self).mark_rebuilding(True)
             type(self).run_sync_now()
         except Exception as exc:
             eprint(f"warning: settings broadcast failed: {exc!r}")
+        finally:
+            type(self).mark_rebuilding(False)
 
         self._respond_json(200, out)
 
@@ -7037,10 +8638,17 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             return
 
         if axis == "weekly":
+            # Mirrors the CLI `alerts test --axis weekly` branch: the preview
+            # carries the reset INSTANT a real crossing carries, so it renders
+            # the instant form rather than the day-granularity fallback.
+            preview_week_start = synthetic_preview_week_start()
             payload = _build_alert_payload_weekly(
                 threshold=threshold,
                 crossed_at_utc=now_utc_iso(),
-                week_start_date=dt.date.today().isoformat(),
+                week_start_date=preview_week_start.date().isoformat(),
+                week_start_at=preview_week_start.isoformat().replace(
+                    "+00:00", "Z"
+                ),
                 cumulative_cost_usd=1.23,
                 dollars_per_percent=0.01,
             )
@@ -7206,8 +8814,41 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         self.wfile.write(body)
 
     def _serve_api_data(self) -> None:
+        # #583 S3 §6/§7. TWO phases. Preparation may answer a JSON 500 because
+        # nothing has been sent yet. Commit may NOT: once `send_response` has
+        # run, a second `_respond_json` writes another HTTP response onto an
+        # already-committed stream. The old handler wrapped both in one `try`
+        # and did exactly that on any partial write.
+        # #600 / §7: the LAST PUBLISHED state, not the reference. The dashboard
+        # mutates the reference through four operations — `set`,
+        # `capture_batch`, `settle`, `mark_rebuilding` — and publication is a
+        # separate call in every case, so reading the reference can report a
+        # `hydrating` flag no client was ever sent. There is no atomic boundary
+        # to read instead, and creating one would mean editing `_SnapshotRef`
+        # and the sync loop, so this endpoint is DEFINED as serving the most
+        # recently published state. Deliberately no silent fallback to the
+        # reference: that fallback is the disagreement this fixes.
+        #
+        # #583 S3 §6: `hub.latest()` gets its own guard, and the 503 is answered
+        # OUTSIDE the preparation `try` below. Writing the 503 inside that `try`
+        # meant a failure part-way through it was caught by the same `except`
+        # that answers a JSON 500, appending a SECOND HTTP response onto a
+        # stream this handler had already committed — the very defect the
+        # prepare/commit split exists to remove, on the one path it did not
+        # cover. The duplicated 500 arm below is the price of that separation.
         try:
-            snap = self.snapshot_ref.get()
+            delivery = self.hub.latest()
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("api/data failed before commit: %r", exc)
+            self._respond_json(500, {"error": "internal error"})
+            return
+        if delivery is None:
+            self._respond_json(503, {"error": "no snapshot published yet"})
+            return
+
+        try:
+            # ---- preparation ---------------------------------------------
+            snap = delivery.snapshot
             # Resolve oauth_usage cfg out here so snapshot_to_envelope stays
             # pure (no per-request FS read on the dashboard hot path).
             # Tolerate user config typos -- fall back to defaults rather than
@@ -7243,18 +8884,34 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             # finding) — one predicate, two consumers, desync impossible.
             env["transcriptsEnabled"] = visible
             body = encode_dashboard_json_bytes(env, ensure_ascii=False)
+            gzip_on = _accepts_gzip(self.headers.get("Accept-Encoding"))
+            if gzip_on:
+                body = gzip.compress(body, 6)
+        except Exception as exc:  # noqa: BLE001
+            # #279 S5 F6.1 (spec §8): a snapshot/envelope/dumps failure used to
+            # escape to _QuietThreadingHTTPServer.handle_error (stdlib traceback +
+            # dropped socket, no 500). Mirror _handle_get_doctor: log + JSON 500.
+            self.log_error("api/data failed before commit: %r", exc)
+            self._respond_json(500, {"error": "internal error"})
+            return
+
+        # ---- commit ------------------------------------------------------
+        try:
             self.send_response(200)
             self.send_header("Content-Type", "application/json; charset=utf-8")
+            if gzip_on:
+                self.send_header("Content-Encoding", "gzip")
+            self.send_header("Vary", "Accept-Encoding")
             self.send_header("Content-Length", str(len(body)))
             self.send_header("Cache-Control", "no-cache")
             self.end_headers()
             self.wfile.write(body)
         except Exception as exc:  # noqa: BLE001
-            # #279 S5 F6.1 (spec §8): a snapshot/envelope/dumps failure used to
-            # escape to _QuietThreadingHTTPServer.handle_error (stdlib traceback +
-            # dropped socket, no 500). Mirror _handle_get_doctor: log + JSON 500.
-            self.log_error("api/data failed: %r", exc)
-            self._respond_json(500, {"error": "internal error"})
+            # Headers are committed, so no status code is available. Log and
+            # close; NEVER `_respond_json` here — that appends a second HTTP
+            # response onto a stream the client is already reading as one.
+            self.log_error("api/data failed after commit: %r", exc)
+            self.close_connection = True
 
     def _handle_get_doctor(self) -> None:
         """`GET /api/doctor` — full kernel-serialized doctor report (spec §5.6).
@@ -7271,6 +8928,9 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         dashboard's default bind; no CSRF gating here (mirrors
         `/api/data`, `/api/session/:id`, `/api/block/:start_at`).
         """
+        # Preparation and commit are separate. Before headers, a failure can
+        # still become a JSON 500. After headers, another response would
+        # corrupt the stream, so the only valid recovery is log + close.
         try:
             _ld = sys.modules["cctally"]._load_sibling("_lib_doctor")
             state = doctor_gather_state(
@@ -7280,6 +8940,12 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             body = encode_dashboard_json_bytes(
                 _ld.serialize_json(report), ensure_ascii=False,
             )
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("/api/doctor failed before commit: %r", exc)
+            self._respond_json(500, {"error": f"{type(exc).__name__}: {exc}"})
+            return
+
+        try:
             self.send_response(200)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.send_header("Content-Length", str(len(body)))
@@ -7287,8 +8953,8 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(body)
         except Exception as exc:  # noqa: BLE001
-            self.log_error("/api/doctor failed: %r", exc)
-            self._respond_json(500, {"error": f"{type(exc).__name__}: {exc}"})
+            self.log_error("/api/doctor failed after commit: %r", exc)
+            self.close_connection = True
 
     def _handle_get_session_detail(self, path: str) -> None:
         """Return TuiSessionDetail JSON for the given session id (spec §3.2).
@@ -7621,43 +9287,46 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 None,
             )
             if target is None:
+                status = 404
                 body = encode_dashboard_json_bytes({"error": "block not found"})
-                self.send_response(404)
-                self.send_header("Content-Type", "application/json; charset=utf-8")
-                self.send_header("Content-Length", str(len(body)))
-                self.end_headers()
-                self.wfile.write(body)
-                return
-            block_entries = [
-                e for e in entries_in_window
-                if target.start_time <= e.timestamp < target.end_time
-            ]
-            # Resolve display tz once per request so the block detail's
-            # `label` matches the snapshot envelope's blocks panel.
-            # Shared resolver -- same warn-once semantics as
-            # `_compute_display_block` and `_tui_build_snapshot`. F3:
-            # honor the dashboard's `--tz` override (set as a class attr
-            # by cmd_dashboard) so the block-detail label speaks the
-            # same zone the rest of the envelope speaks.
-            _detail_tz = _resolve_display_tz_obj(
-                _apply_display_tz_override(
-                    load_config(), type(self).display_tz_pref_override
+            else:
+                block_entries = [
+                    e for e in entries_in_window
+                    if target.start_time <= e.timestamp < target.end_time
+                ]
+                # Resolve display tz once per request so the block detail's
+                # `label` matches the snapshot envelope's blocks panel.
+                # Shared resolver -- same warn-once semantics as
+                # `_compute_display_block` and `_tui_build_snapshot`. F3:
+                # honor the dashboard's `--tz` override (set as a class attr
+                # by cmd_dashboard) so the block-detail label speaks the
+                # same zone the rest of the envelope speaks.
+                _detail_tz = _resolve_display_tz_obj(
+                    _apply_display_tz_override(
+                        load_config(), type(self).display_tz_pref_override
+                    )
                 )
-            )
-            detail = _build_block_detail(
-                target, block_entries, display_tz=_detail_tz,
-            )
+                detail = _build_block_detail(
+                    target, block_entries, display_tz=_detail_tz,
+                )
+                status = 200
+                body = encode_dashboard_json_bytes(detail, ensure_ascii=False)
         except Exception as exc:
-            self.log_error("/api/block failed: %r", exc)
+            self.log_error("/api/block failed before commit: %r", exc)
             self.send_error(500, "block detail failed")
             return
-        body = encode_dashboard_json_bytes(detail, ensure_ascii=False)
-        self.send_response(200)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Content-Length", str(len(body)))
-        self.send_header("Cache-Control", "no-cache")
-        self.end_headers()
-        self.wfile.write(body)
+
+        try:
+            self.send_response(status)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            if status == 200:
+                self.send_header("Cache-Control", "no-cache")
+            self.end_headers()
+            self.wfile.write(body)
+        except Exception as exc:  # noqa: BLE001
+            self.log_error("/api/block failed after commit: %r", exc)
+            self.close_connection = True
 
     def _send_milestones_json(self, status: int, body: dict) -> None:
         payload = encode_dashboard_json_bytes(body, ensure_ascii=False)
@@ -7786,7 +9455,7 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 # reset and never resolves as current.
                 identity = resolve_codex_cycle_detail_identity(
                     cache_conn, source_root_keys=roots, now_utc=now_utc,
-                    account_key=account_key,
+                    account_key=account_key, stats_conn=stats_conn,
                 )
                 result = c.build_codex_cycle_detail(
                     stats_conn, cache_conn, identity=identity, key=key,
@@ -7827,14 +9496,46 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
 
     def _serve_api_events(self) -> None:
         import queue as _queue
+        gzip_on = _accepts_gzip(self.headers.get("Accept-Encoding"))
         self.send_response(200)
         self.send_header("Content-Type", "text/event-stream; charset=utf-8")
         self.send_header("Cache-Control", "no-cache")
         self.send_header("Connection", "keep-alive")
         # Nginx/proxies: disable buffering so events flow immediately.
+        # #583 S3 §6: this STAYS under compression. It addresses an
+        # intermediary proxy, not our own buffering, and is orthogonal.
         self.send_header("X-Accel-Buffering", "no")
+        self.send_header("Vary", "Accept-Encoding")
+        if gzip_on:
+            self.send_header("Content-Encoding", "gzip")
         self.end_headers()
 
+        # #583 S3 §6. ONE stateful compressor per connection. EVERY byte after
+        # the headers goes through it — updates AND the keep-alive comment. A
+        # raw write of even two bytes corrupts the whole remainder of the
+        # stream, and the failure is silent until the next frame.
+        #
+        # One compressor per CONNECTION rather than one per tick, deliberately:
+        # sharing compressed bytes across clients requires each frame to be an
+        # independent gzip member, and cross-browser support for incrementally
+        # decoding a concatenated multi-member stream under `Content-Encoding`
+        # is not established. The saving would be proportional to connected
+        # clients minus one — exactly zero at one open tab. Filed as a residual.
+        _comp = (zlib.compressobj(6, zlib.DEFLATED, 16 + zlib.MAX_WBITS)
+                 if gzip_on else None)
+
+        def _emit(raw: bytes) -> None:
+            if _comp is None:
+                self.wfile.write(raw)
+            else:
+                # Z_SYNC_FLUSH, not a bare compress(): zlib buffers a small
+                # frame entirely, so without the flush the client receives
+                # nothing at all until some later write happens to spill it.
+                chunk = _comp.compress(raw) + _comp.flush(zlib.Z_SYNC_FLUSH)
+                if chunk:
+                    self.wfile.write(chunk)
+            self.wfile.flush()
+
         # Resolve oauth_usage cfg once per SSE connection so the per-tick
         # envelope build stays free of FS reads. A config edit during the
         # connection's lifetime won't take effect until the client
@@ -7854,37 +9555,74 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         # ~15s after bootstrap). Mirrors `/api/data`'s per-request injection.
         transcripts_enabled = self._transcripts_visible_to_request()
 
+        # #583 S3 §5. Normalize the privacy input BEFORE it becomes a cache
+        # key: an unresolvable value is the RESTRICTIVE one. An ordinary cache
+        # MISS for the `true` variant still computes `true` — that is a
+        # different situation, and conflating the two either leaks transcript
+        # content or breaks the gate.
+        visible = bool(transcripts_enabled)
+        # Only `visible` and the oauth config can differ between two
+        # connections in this process today. The two process constants stay in
+        # the key so a later change making either per-connection cannot
+        # silently serve one client another client's payload.
+        variant = (
+            visible,
+            _canonical_oauth_key(cfg_oauth),
+            type(self).display_tz_pref_override,
+            type(self).cctally_host,
+        )
+
         q = self.hub.subscribe()
         try:
             while True:
                 try:
-                    snap = q.get(timeout=15)
+                    delivery = q.get(timeout=_SSE_KEEPALIVE_SECONDS)
                 except _queue.Empty:
                     # Keep-alive. Comment lines are ignored by EventSource
-                    # but stop idle-proxy timeouts.
-                    self.wfile.write(b": keep-alive\n\n")
-                    self.wfile.flush()
+                    # but stop idle-proxy timeouts. #583 S3 §6: through
+                    # `_emit`, never a raw `wfile.write` — under compression a
+                    # raw write here corrupts every byte after it.
+                    _emit(b": keep-alive\n\n")
                     continue
-                env = snapshot_to_envelope(
-                    snap,
-                    now_utc=dt.datetime.now(dt.timezone.utc),
-                    monotonic_now=time.monotonic(),
-                    oauth_usage_cfg=cfg_oauth,
-                    display_tz_pref_override=type(self).display_tz_pref_override,
-                    runtime_bind=type(self).cctally_host,
-                    # #264 S3: gate the in-envelope session `title` on the same
-                    # connection-scoped predicate that drives transcriptsEnabled.
-                    transcripts_visible=transcripts_enabled,
-                )
-                env["transcriptsEnabled"] = transcripts_enabled
-                msg = (
-                    "event: update\n"
-                    + "data: "
-                    + encode_dashboard_json(env, ensure_ascii=False)
-                    + "\n\n"
-                )
-                self.wfile.write(msg.encode("utf-8"))
-                self.wfile.flush()
+                # #583 S3 §5: skip to the newest queued delivery. The queue
+                # holds four and `publish` discards only one oldest, so a
+                # lagging client would otherwise replay a backlog whose clocks
+                # were pinned several publish periods ago. The blocking `get`
+                # above keeps its own `queue.Empty` keep-alive path.
+                delivery = _drain_to_newest(q, delivery)
+
+                def _project(_key, _d=delivery, _v=visible):
+                    env = snapshot_to_envelope(
+                        _d.snapshot,
+                        now_utc=_d.pinned_now_utc,
+                        monotonic_now=_d.pinned_monotonic,
+                        oauth_usage_cfg=cfg_oauth,
+                        display_tz_pref_override=type(self).display_tz_pref_override,
+                        runtime_bind=type(self).cctally_host,
+                        # #264 S3: gate the in-envelope session `title` on the
+                        # same connection-scoped predicate that drives
+                        # transcriptsEnabled.
+                        transcripts_visible=_v,
+                    )
+                    # Part of the CACHED variant, not a post-projection
+                    # mutation: the payload is shared across every client
+                    # holding this delivery, so mutating it here would apply
+                    # to all of them.
+                    env["transcriptsEnabled"] = _v
+                    payload = encode_dashboard_json_bytes(
+                        env, ensure_ascii=False,
+                    )
+                    return b"event: update\ndata: " + payload + b"\n\n"
+
+                if _delivery_is_shareable(delivery.snapshot):
+                    frame = delivery.encoded(variant, _project)
+                else:
+                    # #583 S3 §5: this snapshot's projection is NOT a function
+                    # of the snapshot plus the key — `snapshot_to_envelope`
+                    # reads configuration inline and runs the real doctor
+                    # gather per call — so it must not be cached and shared.
+                    frame = _project(variant)
+                _emit(frame)
         except (BrokenPipeError, ConnectionResetError,
                 ConnectionAbortedError, socket.timeout):
             # #279 S1 F3: a stalled send past the handler timeout raises
@@ -7898,7 +9636,17 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             # traceback. Headers are already committed — no 500 is possible; the
             # win is routing the operator signal through the _lib_log chokepoint
             # (self.log_error) + a deliberate clean close via the finally below.
+            #
+            # #583 S3 §6: under compression this path must add NOTHING to the
+            # stream. Do not append plaintext, another gzip member, or a
+            # trailer to a truncated stream; do not call `Z_FINISH` here,
+            # because the stateful compressor may have advanced even though its
+            # output was not fully written; and do not skip the frame and carry
+            # on, for the same reason. The browser's own EventSource reconnect
+            # opens a fresh response with a fresh compressor, which is the
+            # correct recovery.
             self.log_error("api/events stream failed: %r", exc)
+            self.close_connection = True
         finally:
             self.hub.unsubscribe(q)
 
@@ -8269,7 +10017,10 @@ def _dashboard_stats_deferred_snapshot(args, *, pinned_now, exc):
         "fingerprint": "sha1:" + ("0" * 40),
     }
     replacements = {
-        "last_sync_at": _time.monotonic(),
+        # #583 S2 §6.1: this frame is degraded by construction — it carries a
+        # `stats-open` error and no successful build ran, so it must not stamp
+        # a fresh success. There is no earlier success to preserve either.
+        "last_sync_at": None,
         "last_sync_error": "; ".join(errors),
         "sync_failures": (
             tui.SyncFailureAttribution(
@@ -8412,7 +10163,10 @@ def _dashboard_initial_snapshot_once(
         current_week=cw,
         forecast=fc,
         forecast_view=fc_view,
-        last_sync_at=_time.monotonic(),
+        # #583 S2 §6.1: a build that failed does not stamp a success. This is
+        # the FIRST build, so a failure retains None rather than becoming
+        # freshly successful — there is no earlier success to preserve.
+        last_sync_at=(None if errors else _time.monotonic()),
         last_sync_error=("; ".join(errors) if errors else None),
         sync_failures=tuple(sync_failures),
         doctor_payload=doctor_payload,
@@ -8640,16 +10394,23 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
 
     ref = _SnapshotRef(initial)
     hub = SSEHub()
-    hub.publish(initial)  # seed for early subscribers
+    # #583 S2: seed for early subscribers, published from the reference so the
+    # very first frame already carries the process's `server_epoch`. A seed
+    # published without it would make the client discard its (empty) outstanding
+    # set on the next frame's epoch change — harmless, but it would also mean
+    # the first frame a client ever sees disagrees with every later one.
+    hub.publish(ref.get())
 
     # sync_lock serializes sync-work between the periodic sync thread and
     # the POST /api/sync handler. Held only around _tui_build_snapshot +
     # ref.set + hub.publish — NOT around the handler's response path.
-    # The handler uses acquire(timeout=…) so a click that lands inside
-    # the periodic thread's lock-hold waits briefly rather than 503-ing
-    # and silently dropping the user's force-refresh intent; only stuck
-    # contention beyond the timeout produces 503. The lock inside
-    # _run_sync_now is what actually prevents overlap.
+    # The handler acquires it NON-BLOCKING (#583 S2): a click that lands
+    # inside the periodic thread's lock-hold is queued on _SnapshotRef and
+    # answered 202, and the sync loop services it under the duty floor. The
+    # bounded acquire and its 503 are gone. The one exception is --no-sync,
+    # where nothing would drain that queue, so a manual request there waits on
+    # a blocking acquire instead. The lock inside _run_sync_now is what
+    # actually prevents overlap.
     sync_lock = threading.Lock()
 
     # Build the two variants up front. The locked variant is exposed on the
@@ -8706,32 +10467,27 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
 
     class _DashboardSyncThread(_c_for_subclass._TuiSyncThread):
         def _run(self) -> None:
-            last_heal = [_time.monotonic()]
-
-            def run_iteration() -> None:
-                _run_sync_now(skip_sync=self._skip_sync)
-                # Self-heal removed-worktree orphans on a ~60s cadence (far
-                # rarer than the sync tick — a deleted worktree is not urgent).
-                # Non-blocking on the flock, so a contended tick just retries
-                # next cadence; gated off under --no-sync. Runs INSIDE the
-                # measured iteration so its cost counts toward the cooldown
-                # deadline (#313 P2 / F10).
-                if (not self._skip_sync
-                        and _time.monotonic() - last_heal[0] >= 60.0):
-                    last_heal[0] = _time.monotonic()
-                    _dashboard_self_heal_orphans(skip_sync=self._skip_sync)
+            run_iteration = _make_dashboard_run_iteration(
+                sync_lock=sync_lock,
+                run_sync_now=_run_sync_now,
+                run_sync_now_locked=_run_sync_now_locked,
+                skip_sync=self._skip_sync,
+                monotonic=_time.monotonic,
+            )
 
             # Work-proportional cooldown (F10): sleep to t0 + max(interval, work)
-            # so a slow rebuild cannot peg a full core. The manual POST /api/sync
-            # refresh runs synchronously under sync_lock, independent of this
-            # cooldown, so a user force-refresh is always immediate.
+            # so a slow rebuild cannot peg a full core. #583 S2 adds the
+            # request-driven start, floored at t0 + 2*work so a queued refresh
+            # cannot drive the duty above the same #313 bound. The dashboard no
+            # longer passes the legacy test-and-clear flag: under a floor a poll
+            # firing early would clear the request and discard it.
             _dashboard_sync_loop(
                 stop=self._stop,
                 interval=self._interval,
                 run_iteration=run_iteration,
-                take_sync_request=self._ref.take_sync_request,
                 monotonic=_time.monotonic,
                 sleep=_time.sleep,
+                **_make_sync_loop_collaborators(ref=ref, hub=hub),
             )
 
     sync_thread = (
@@ -8743,43 +10499,14 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     if sync_thread is not None:
         sync_thread.start()
 
-    # #320: transcript/search ingestion runs on its own thread and SQLite file.
-    # A multi-GB first rebuild or a contended conversations.db therefore cannot
-    # delay `_run_sync_now`, its `last_sync_at` stamp, or core SSE publication.
+    # The loop, the pass and this thread's construction are module-level (see
+    # `_conversation_sync_loop`): the extraction is what lets the duty bound be
+    # proven on a virtual clock instead of asserted.
     conversation_sync_stop = threading.Event()
-
-    def _conversation_sync_loop() -> None:
-        interval = max(5.0, float(args.sync_interval))
-        while not conversation_sync_stop.is_set():
-            conn = None
-            try:
-                conn = open_conversations_db()
-                sync_claude_conversations(conn)
-                sync_codex_conversations(conn)
-                _dashboard_maybe_prune_retention()
-            except (OSError, sqlite3.DatabaseError) as exc:
-                eprint(f"[conversations] background sync unavailable: {exc}")
-            except Exception as exc:  # noqa: BLE001
-                # Transcript parsing/normalization is deliberately outside the
-                # core freshness loop. Keep this worker alive so a later clean
-                # tick can self-heal instead of permanently stopping after one
-                # malformed provider record.
-                eprint(
-                    "[conversations] background sync failed: "
-                    f"{type(exc).__name__}: {exc}"
-                )
-            finally:
-                if conn is not None:
-                    conn.close()
-            conversation_sync_stop.wait(interval)
-
-    conversation_sync_thread = (
-        None if args.no_sync
-        else threading.Thread(
-            target=_conversation_sync_loop,
-            daemon=True,
-            name="dashboard-conversations-sync",
-        )
+    conversation_sync_thread = _make_conversation_sync_thread(
+        stop=conversation_sync_stop,
+        sync_interval=args.sync_interval,
+        no_sync=args.no_sync,
     )
     if conversation_sync_thread is not None:
         conversation_sync_thread.start()
@@ -8790,7 +10517,7 @@ def cmd_dashboard(args: argparse.Namespace) -> int:
     # relying on the data-sync thread's lifecycle.
     update_check_stop = threading.Event()
     update_check_thread = _DashboardUpdateCheckThread(
-        update_check_stop, hub=hub, snapshot_ref=ref,
+        update_check_stop, hub=hub, snapshot_ref=ref, runtime_bind=args.host,
     )
     update_check_thread.start()