From 64e543f463fb957fa5d61033924af93dd7ed22e7 Mon Sep 17 00:00:00 2001
From: camy-x <209573702+camy-x@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:52:28 +0800
Subject: [PATCH 01/16] fix(config): read client API keys from CPA v8 layout

---
 .../config/ConfigPage.persistence.test.tsx    | 124 ++++++++++++++---
 apps/web/src/hooks/useVisualConfig.test.ts    | 126 ++++++++++++++++++
 apps/web/src/hooks/useVisualConfig.ts         |  14 +-
 3 files changed, 247 insertions(+), 17 deletions(-)

diff --git a/apps/web/src/features/config/ConfigPage.persistence.test.tsx b/apps/web/src/features/config/ConfigPage.persistence.test.tsx
index 54963c756..92e6f2e19 100644
--- a/apps/web/src/features/config/ConfigPage.persistence.test.tsx
+++ b/apps/web/src/features/config/ConfigPage.persistence.test.tsx
@@ -3,6 +3,8 @@ import type { ReactNode } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ApiKeyMutation } from '@/components/config/ApiKeysCardEditor';
 import type { ManagerConfigResponse } from '@/services/api/usageService';
+import type { VisualConfigValues } from '@/types/visualConfig';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 
 vi.mock('react-dom', () => ({
   createPortal: (children: ReactNode) => children,
@@ -32,6 +34,7 @@ const mocks = vi.hoisted(() => ({
   capturedApiKeyOperationStart: null as (() => void) | null,
   capturedApiKeyOperationEnd: null as (() => void) | null,
   translate: (key: string) => key,
+  useRealVisualConfig: false,
   visualState: {
     apiKeysText: 'sk-old',
     dirty: false,
@@ -54,10 +57,14 @@ vi.mock('@/hooks/useMediaQuery', () => ({
 
 vi.mock('@/components/config/VisualConfigEditor', () => ({
   VisualConfigEditor: ({
+    values,
+    onChange,
     onPersistApiKeyMutation,
     onApiKeyOperationStart,
     onApiKeyOperationEnd,
   }: {
+    values: VisualConfigValues;
+    onChange: (values: Partial<VisualConfigValues>) => void;
     onPersistApiKeyMutation: (mutation: ApiKeyMutation) => Promise<string[]>;
     onApiKeyOperationStart: () => void;
     onApiKeyOperationEnd: () => void;
@@ -78,6 +85,8 @@ vi.mock('@/components/config/VisualConfigEditor', () => ({
 
     return (
       <div data-test="visual-editor">
+        <output data-test="api-keys">{values.apiKeysText}</output>
+        <button type="button" data-test="enable-debug" onClick={() => onChange({ debug: true })} />
         <button
           type="button"
           data-test="create-key"
@@ -134,7 +143,8 @@ vi.mock('./components/ManagerConfigPanel', () => ({
 }));
 
 vi.mock('@/components/config/DiffModal', () => ({
-  DiffModal: () => null,
+  DiffModal: ({ open, onConfirm }: { open: boolean; onConfirm: () => Promise<void> }) =>
+    open ? <button type="button" data-test="confirm-save" onClick={onConfirm} /> : null,
 }));
 
 vi.mock('@/components/config/ConfigSourceEditor', () => ({
@@ -210,22 +220,29 @@ vi.mock('@/stores', () => ({
   ) => selector({ setUsageServiceConfig: mocks.setUsageServiceConfig }),
 }));
 
-vi.mock('@/hooks/useVisualConfig', () => ({
-  useVisualConfig: () => ({
-    visualValues: {
-      apiKeysText: mocks.visualState.apiKeysText,
-      redisUsageQueueRetentionSeconds: '60',
+vi.mock('@/hooks/useVisualConfig', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/hooks/useVisualConfig')>();
+  return {
+    useVisualConfig: () => {
+      const realConfig = actual.useVisualConfig();
+      if (mocks.useRealVisualConfig) return realConfig;
+      return {
+        visualValues: {
+          apiKeysText: mocks.visualState.apiKeysText,
+          redisUsageQueueRetentionSeconds: '60',
+        },
+        visualDirty: mocks.visualState.dirty,
+        visualParseError: null,
+        visualValidationErrors: {},
+        visualHasPayloadValidationErrors: false,
+        loadVisualValuesFromYaml: mocks.loadVisualValuesFromYaml,
+        applyVisualChangesToYaml: mocks.applyVisualChangesToYaml,
+        setVisualValues: mocks.setVisualValues,
+        commitApiKeysText: mocks.commitApiKeysText,
+      };
     },
-    visualDirty: mocks.visualState.dirty,
-    visualParseError: null,
-    visualValidationErrors: {},
-    visualHasPayloadValidationErrors: false,
-    loadVisualValuesFromYaml: mocks.loadVisualValuesFromYaml,
-    applyVisualChangesToYaml: mocks.applyVisualChangesToYaml,
-    setVisualValues: mocks.setVisualValues,
-    commitApiKeysText: mocks.commitApiKeysText,
-  }),
-}));
+  };
+});
 
 vi.mock('@/services/api/configFile', () => ({
   configFileApi: {
@@ -391,6 +408,7 @@ const configureManagerMode = () => {
 
 beforeEach(() => {
   vi.clearAllMocks();
+  mocks.useRealVisualConfig = false;
   Object.defineProperty(globalThis, 'localStorage', {
     configurable: true,
     value: {
@@ -449,6 +467,80 @@ afterEach(() => {
   }
 });
 
+describe('ConfigPage v8 API-key persistence with the real visual config hook', () => {
+  it.each([
+    { operation: 'create', expectedKeys: ['sk-old', 'sk-new'] },
+    { operation: 'replace', expectedKeys: ['sk-new'] },
+    { operation: 'delete', expectedKeys: [] },
+  ])(
+    'keeps client and upstream keys separate across $operation, reload, and save',
+    async ({ operation, expectedKeys }) => {
+      mocks.useRealVisualConfig = true;
+      const initialConfig = {
+        debug: false,
+        access: { 'api-keys': ['sk-old'] },
+        'api-keys': {
+          gemini: [{ keys: [{ 'api-key': 'upstream-gemini' }] }],
+        },
+      };
+      let serverConfig = structuredClone(initialConfig);
+      mocks.fetchConfigYaml.mockImplementation(async () => stringifyYaml(serverConfig));
+      mocks.saveConfigYaml.mockImplementation(async (yaml: string) => {
+        serverConfig = parseYaml(yaml);
+      });
+      mocks.apiKeysList.mockImplementation(async () => [...serverConfig.access['api-keys']]);
+      mocks.apiKeysReplace.mockImplementation(async (keys: string[]) => {
+        serverConfig.access['api-keys'] = [...keys];
+      });
+      mocks.apiKeysReplaceValue.mockImplementation(async (oldKey: string, newKey: string) => {
+        serverConfig.access['api-keys'] = serverConfig.access['api-keys'].map((key) =>
+          key === oldKey ? newKey : key
+        );
+      });
+      mocks.apiKeysDeleteValue.mockImplementation(async (key: string) => {
+        serverConfig.access['api-keys'] = serverConfig.access['api-keys'].filter(
+          (existing) => existing !== key
+        );
+      });
+      const displayedKeys = () =>
+        renderer?.root.findByProps({ 'data-test': 'api-keys' }).children.join('');
+
+      await mountPage();
+      expect(displayedKeys()).toBe('sk-old');
+      expect(mocks.apiKeysList).not.toHaveBeenCalled();
+
+      await click(`${operation}-key`);
+      expect(mocks.apiKeyMutationErrors).toEqual([]);
+      expect(displayedKeys()).toBe(expectedKeys.join('\n'));
+      expect(mocks.saveConfigYaml).not.toHaveBeenCalled();
+      if (operation === 'create') {
+        expect(mocks.apiKeysReplace).toHaveBeenCalledWith(['sk-old', 'sk-new']);
+      } else if (operation === 'replace') {
+        expect(mocks.apiKeysReplaceValue).toHaveBeenCalledWith('sk-old', 'sk-new');
+      } else {
+        expect(mocks.apiKeysDeleteValue).toHaveBeenCalledWith('sk-old');
+      }
+
+      // A fresh mount must get the same list from YAML, not the canonical API response in memory.
+      act(() => renderer?.unmount());
+      await mountPage();
+      expect(displayedKeys()).toBe(expectedKeys.join('\n'));
+
+      await click('enable-debug');
+      await clickSave();
+      await click('confirm-save');
+
+      expect(mocks.saveConfigYaml).toHaveBeenCalledTimes(1);
+      expect(serverConfig).toEqual({
+        ...initialConfig,
+        debug: true,
+        access: { 'api-keys': expectedKeys },
+      });
+      expect(displayedKeys()).toBe(expectedKeys.join('\n'));
+    }
+  );
+});
+
 describe('ConfigPage API-key source snapshot safety', () => {
   it('marks Source stale and reports an unknown outcome when create PUT rejects', async () => {
     mocks.apiKeysList.mockResolvedValueOnce([]);
diff --git a/apps/web/src/hooks/useVisualConfig.test.ts b/apps/web/src/hooks/useVisualConfig.test.ts
index 2103d1ff2..d475b6d8a 100644
--- a/apps/web/src/hooks/useVisualConfig.test.ts
+++ b/apps/web/src/hooks/useVisualConfig.test.ts
@@ -42,6 +42,132 @@ const mountUseVisualConfig = (): UseVisualConfigHarness => {
 };
 
 describe('useVisualConfig', () => {
+  it('loads v8 client API keys separately from upstream provider credentials', () => {
+    const harness = mountUseVisualConfig();
+    const yaml = [
+      'config-version: 8',
+      'access:',
+      '  api-keys: [sk-client-a, sk-client-b]',
+      'api-keys:',
+      '  gemini:',
+      '    - keys:',
+      '        - api-key: upstream-only',
+      '',
+    ].join('\n');
+
+    act(() => {
+      expect(harness.getCurrent().loadVisualValuesFromYaml(yaml).ok).toBe(true);
+    });
+
+    expect(harness.getCurrent().visualValues.apiKeysText).toBe('sk-client-a\nsk-client-b');
+    expect(harness.getCurrent().visualDirty).toBe(false);
+    expect(parseYaml(harness.getCurrent().applyVisualChangesToYaml(yaml))).toEqual(parseYaml(yaml));
+    harness.unmount();
+  });
+
+  it.each([
+    { value: '[sk-current]', expected: 'sk-current' },
+    { value: '[]', expected: '' },
+    { value: 'null', expected: '' },
+  ])('treats access.api-keys: $value as authoritative over legacy keys', ({ value, expected }) => {
+    const harness = mountUseVisualConfig();
+    const yaml = [
+      'access:',
+      `  api-keys: ${value}`,
+      'api-keys: [sk-stale]',
+      'auth:',
+      '  providers:',
+      '    config-api-key:',
+      '      api-key-entries: [sk-legacy]',
+      '',
+    ].join('\n');
+
+    act(() => {
+      expect(harness.getCurrent().loadVisualValuesFromYaml(yaml).ok).toBe(true);
+    });
+
+    expect(harness.getCurrent().visualValues.apiKeysText).toBe(expected);
+    harness.unmount();
+  });
+
+  it('keeps the legacy client-key fallback when a v8 document omits access.api-keys', () => {
+    const harness = mountUseVisualConfig();
+    act(() => {
+      expect(
+        harness.getCurrent().loadVisualValuesFromYaml('config-version: 8\napi-keys: [sk-old]\n').ok
+      ).toBe(true);
+    });
+    expect(harness.getCurrent().visualValues.apiKeysText).toBe('sk-old');
+    harness.unmount();
+  });
+
+  it.each(['sk-replacement', ''])(
+    'writes v8 client keys without replacing upstream groups: %s',
+    (keys) => {
+      const harness = mountUseVisualConfig();
+      const yaml = [
+        'config-version: 8',
+        'access:',
+        '  api-keys: [sk-old]',
+        '  custom-setting: preserve-me',
+        'api-keys:',
+        '  gemini:',
+        '    - keys:',
+        '        - api-key: upstream-only',
+        '',
+      ].join('\n');
+
+      act(() => {
+        expect(harness.getCurrent().loadVisualValuesFromYaml(yaml).ok).toBe(true);
+        harness.getCurrent().setVisualValues({ apiKeysText: keys });
+      });
+
+      const updated = harness.getCurrent().applyVisualChangesToYaml(yaml);
+      const parsed = parseYaml(updated);
+      expect(parsed.access).toEqual({
+        'api-keys': keys ? [keys] : [],
+        'custom-setting': 'preserve-me',
+      });
+      expect(parsed['api-keys']).toEqual({ gemini: [{ keys: [{ 'api-key': 'upstream-only' }] }] });
+      act(() => {
+        expect(harness.getCurrent().loadVisualValuesFromYaml(updated).ok).toBe(true);
+      });
+      expect(harness.getCurrent().visualValues.apiKeysText).toBe(keys);
+      harness.unmount();
+    }
+  );
+
+  it('creates the v8 client-key path when only upstream API-key groups exist', () => {
+    const harness = mountUseVisualConfig();
+    const yaml = 'api-keys:\n  gemini:\n    - keys:\n        - api-key: upstream-only\n';
+    act(() => {
+      expect(harness.getCurrent().loadVisualValuesFromYaml(yaml).ok).toBe(true);
+      harness.getCurrent().setVisualValues({ apiKeysText: 'sk-new' });
+    });
+    const parsed = parseYaml(harness.getCurrent().applyVisualChangesToYaml(yaml));
+    expect(parsed.access?.['api-keys']).toEqual(['sk-new']);
+    expect(parsed['api-keys']).toEqual({ gemini: [{ keys: [{ 'api-key': 'upstream-only' }] }] });
+    harness.unmount();
+  });
+
+  it('clears canonical client keys without reviving stale legacy keys', () => {
+    const harness = mountUseVisualConfig();
+    const yaml = 'config-version: 8\naccess:\n  api-keys: [sk-current]\napi-keys: [sk-stale]\n';
+    act(() => {
+      expect(harness.getCurrent().loadVisualValuesFromYaml(yaml).ok).toBe(true);
+      harness.getCurrent().setVisualValues({ apiKeysText: '' });
+    });
+    const updated = harness.getCurrent().applyVisualChangesToYaml(yaml);
+    const parsed = parseYaml(updated);
+    expect(parsed.access['api-keys']).toEqual([]);
+    expect(parsed['api-keys']).toBeUndefined();
+    act(() => {
+      harness.getCurrent().loadVisualValuesFromYaml(updated);
+    });
+    expect(harness.getCurrent().visualValues.apiKeysText).toBe('');
+    harness.unmount();
+  });
+
   it('clears the page dirty state when API keys are the only changed field', () => {
     const harness = mountUseVisualConfig();
     const initialYaml = ['proxy-url: http://proxy.local:8080', 'api-keys:', '  - old-key', ''].join(
diff --git a/apps/web/src/hooks/useVisualConfig.ts b/apps/web/src/hooks/useVisualConfig.ts
index 27fc2b1a0..9a3ec11dc 100644
--- a/apps/web/src/hooks/useVisualConfig.ts
+++ b/apps/web/src/hooks/useVisualConfig.ts
@@ -138,6 +138,11 @@ function parsePluginStoreAuthRules(raw: unknown): PluginStoreAuthRule[] {
 }
 
 function resolveApiKeysText(parsed: Record<string, unknown>): string {
+  const access = asRecord(parsed.access);
+  if (access && Object.prototype.hasOwnProperty.call(access, 'api-keys')) {
+    return parseApiKeysText(access['api-keys']);
+  }
+
   if (Object.prototype.hasOwnProperty.call(parsed, 'api-keys')) {
     return parseApiKeysText(parsed['api-keys']);
   }
@@ -1002,7 +1007,14 @@ export function useVisualConfig() {
             .split('\n')
             .map((key) => key.trim())
             .filter(Boolean);
-          if (apiKeys.length > 0) {
+          // In v8 the root mapping holds upstream credentials, not client keys.
+          const hasUpstreamKeyGroups = isMap(doc.getIn(['api-keys'], true));
+          if (docHas(doc, ['access', 'api-keys']) || hasUpstreamKeyGroups) {
+            ensureMapInDoc(doc, ['access']);
+            // Keep an explicit empty list authoritative over any legacy keys.
+            doc.setIn(['access', 'api-keys'], apiKeys);
+            if (!hasUpstreamKeyGroups) doc.deleteIn(['api-keys']);
+          } else if (apiKeys.length > 0) {
             doc.setIn(['api-keys'], apiKeys);
           } else if (docHas(doc, ['api-keys'])) {
             doc.deleteIn(['api-keys']);

From 3428c191fbb40a6de3fbb2c51422720e9d8866d4 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:18:33 +0800
Subject: [PATCH 02/16] fix(usage): verify retained pricing rebuild source

---
 .../usagepricing/projection_read.go           | 110 ++++++++++++++++--
 1 file changed, 99 insertions(+), 11 deletions(-)

diff --git a/apps/manager-server/internal/repository/usagepricing/projection_read.go b/apps/manager-server/internal/repository/usagepricing/projection_read.go
index fd25e47ec..7b32a0b8e 100644
--- a/apps/manager-server/internal/repository/usagepricing/projection_read.go
+++ b/apps/manager-server/internal/repository/usagepricing/projection_read.go
@@ -11,6 +11,14 @@ import (
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/usageidentity"
 )
 
+var retainedPricingColumns = []string{
+	"timestamp_ms", "model", "requested_model", "resolved_model", "service_tier", "failed",
+	"input_tokens", "output_tokens", "reasoning_tokens", "cached_tokens", "cache_tokens",
+	"cache_read_tokens", "cache_creation_tokens", "normalized_total_input_tokens", "total_tokens", "latency_ms",
+	"provider", "auth_index", "source", "source_hash", "account_snapshot", "auth_label_snapshot",
+	"auth_file_snapshot", "auth_provider_snapshot", "auth_project_id_snapshot", "auth_account_id_snapshot",
+}
+
 // LoadHourlyRowsFromEventsTx bypasses a deficient pricing cache without writing
 // to it. A compatible retained projection supplies archived events; raw events
 // after its watermark supply the tail, with no overlapping IDs.
@@ -52,6 +60,95 @@ func (r *repository) LoadAccountRowsFromEventsTx(ctx context.Context, tx *sql.Tx
 	return sortedAccountRows(grouped), nil
 }
 
+// VerifyRetainedPricingRebuildSourceTx proves that every raw event removed by
+// the supported archive flow is still available from the compatible monitoring
+// projection. Structural model-price mutations call this before commit so an
+// unrecoverable pricing revision can never become active.
+func VerifyRetainedPricingRebuildSourceTx(ctx context.Context, tx *sql.Tx) error {
+	_, _, err := retainedPricingRebuildSourceTx(ctx, tx)
+	return err
+}
+
+// retainedPricingRebuildSourceTx returns the exact event source and target ID
+// used only for full pricing rebuilds. Live raw rows are authoritative when
+// present; the projection contributes only events whose raw rows were deleted.
+// This keeps the rebuild source duplicate-free while preserving original event
+// IDs for the existing checkpoint state machine.
+func retainedPricingRebuildSourceTx(ctx context.Context, tx *sql.Tx) (string, int64, error) {
+	var hasDeletedRaw bool
+	if err := tx.QueryRowContext(ctx, `select exists (
+		select 1 from usage_archive_event_refs where raw_deleted_at_ms is not null
+	)`).Scan(&hasDeletedRaw); err != nil {
+		return "", 0, err
+	}
+	if !hasDeletedRaw {
+		latestID, err := latestEventID(ctx, tx)
+		return "usage_events", latestID, err
+	}
+
+	var schemaVersion int
+	var revision, status string
+	var coverageID int64
+	if err := tx.QueryRowContext(ctx, `select schema_version, structure_revision, status, coverage_event_id
+		from usage_monitoring_rollup_state where rollup_name = 'projection_v1'`).Scan(
+		&schemaVersion, &revision, &status, &coverageID,
+	); err != nil {
+		return "", 0, fmt.Errorf("retained usage projection state is unavailable: %w", err)
+	}
+	if schemaVersion != 1 ||
+		revision != usageidentity.MonitoringProjectionStructureRevision() ||
+		status == "clearing" {
+		return "", 0, fmt.Errorf("retained usage projection is incompatible or rebuilding")
+	}
+
+	var incomplete bool
+	if err := tx.QueryRowContext(ctx, `select exists (
+		select 1
+		from usage_archive_event_refs archived
+		left join usage_monitoring_event_projection_v1 p
+			on p.event_id = archived.raw_event_id
+		where archived.raw_deleted_at_ms is not null
+			and not exists (
+				select 1 from usage_events live where live.event_hash = archived.event_hash
+			)
+			and (archived.raw_event_id > ? or p.event_id is null)
+	)`, coverageID).Scan(&incomplete); err != nil {
+		return "", 0, err
+	}
+	if incomplete {
+		return "", 0, fmt.Errorf("retained usage projection is missing a deleted pricing event")
+	}
+
+	var latestID int64
+	if err := tx.QueryRowContext(ctx, `select coalesce(max(event_id), 0) from (
+		select id as event_id from usage_events
+		union all
+		select archived.raw_event_id as event_id
+		from usage_archive_event_refs archived
+		where archived.raw_deleted_at_ms is not null
+			and not exists (
+				select 1 from usage_events live where live.event_hash = archived.event_hash
+			)
+	)`).Scan(&latestID); err != nil {
+		return "", 0, err
+	}
+
+	source := fmt.Sprintf(`(select e.id, e.%s from usage_events e
+		union all
+		select p.event_id as id, p.%s
+		from usage_archive_event_refs archived
+		join %s p on p.event_id = archived.raw_event_id
+		where archived.raw_deleted_at_ms is not null
+			and not exists (
+				select 1 from usage_events live where live.event_hash = archived.event_hash
+			))`,
+		strings.Join(retainedPricingColumns, ", e."),
+		strings.Join(retainedPricingColumns, ", p."),
+		usageprojection.EventTable,
+	)
+	return source, latestID, nil
+}
+
 func retainedEventSourceTx(ctx context.Context, tx *sql.Tx) (string, error) {
 	source := "usage_events"
 	var schemaVersion int
@@ -66,19 +163,10 @@ func retainedEventSourceTx(ctx context.Context, tx *sql.Tx) (string, error) {
 	}
 	if err == nil && schemaVersion == 1 && coverageID > 0 &&
 		revision == usageidentity.MonitoringProjectionStructureRevision() && status != "clearing" {
-		// These are the inputs used by the existing pricing-band query. Do not
-		// synthesize request details or trust an obsolete projection identity.
-		columns := []string{
-			"timestamp_ms", "model", "requested_model", "resolved_model", "service_tier", "failed",
-			"input_tokens", "output_tokens", "reasoning_tokens", "cached_tokens", "cache_tokens",
-			"cache_read_tokens", "cache_creation_tokens", "normalized_total_input_tokens", "total_tokens", "latency_ms",
-			"provider", "auth_index", "source", "source_hash", "account_snapshot", "auth_label_snapshot",
-			"auth_file_snapshot", "auth_provider_snapshot", "auth_project_id_snapshot", "auth_account_id_snapshot",
-		}
 		source = fmt.Sprintf(`(select p.event_id as id, p.%s from %s p where p.event_id <= %d
 			union all select e.id, e.%s from usage_events e where e.id > %d)`,
-			strings.Join(columns, ", p."), usageprojection.EventTable, coverageID,
-			strings.Join(columns, ", e."), coverageID,
+			strings.Join(retainedPricingColumns, ", p."), usageprojection.EventTable, coverageID,
+			strings.Join(retainedPricingColumns, ", e."), coverageID,
 		)
 	}
 	return source, nil

From c86a0defc8be5a7c21c5ec76e6738bb703ce1a73 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:18:51 +0800
Subject: [PATCH 03/16] fix(model-price): gate structure changes on retained
 coverage

---
 .../repository/modelprice/repository.go        | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/apps/manager-server/internal/repository/modelprice/repository.go b/apps/manager-server/internal/repository/modelprice/repository.go
index bafbe7de4..33c136ea1 100644
--- a/apps/manager-server/internal/repository/modelprice/repository.go
+++ b/apps/manager-server/internal/repository/modelprice/repository.go
@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/model"
-	sqliterepo "github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/sqlite"
+	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/usagepricing"
 )
 
 var ErrStructureChangeAfterRawDeletion = errors.New("model price structure cannot change after archived raw usage has been deleted")
@@ -251,12 +251,8 @@ func (r *repository) ReplaceAll(ctx context.Context, prices map[string]model.Mod
 	beforeRevision := model.ModelPriceStructureRevision(beforePrices)
 	afterRevision := model.ModelPriceStructureRevision(normalizedPrices)
 	if beforeRevision != afterRevision {
-		hasDeletedRaw, err := sqliterepo.HistoricalRawDeletionExists(tx)
-		if err != nil {
-			return err
-		}
-		if hasDeletedRaw {
-			return ErrStructureChangeAfterRawDeletion
+		if err := usagepricing.VerifyRetainedPricingRebuildSourceTx(ctx, tx); err != nil {
+			return fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
 		}
 	}
 
@@ -463,12 +459,8 @@ func (r *repository) UpsertSynced(ctx context.Context, prices map[string]model.M
 	beforeRevision := model.ModelPriceStructureRevision(beforePrices)
 	afterRevision := model.ModelPriceStructureRevision(afterPrices)
 	if beforeRevision != afterRevision {
-		hasDeletedRaw, err := sqliterepo.HistoricalRawDeletionExists(tx)
-		if err != nil {
-			return model.ModelPriceSyncResult{}, err
-		}
-		if hasDeletedRaw {
-			return model.ModelPriceSyncResult{}, ErrStructureChangeAfterRawDeletion
+		if err := usagepricing.VerifyRetainedPricingRebuildSourceTx(ctx, tx); err != nil {
+			return model.ModelPriceSyncResult{}, fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
 		}
 	}
 	sort.Strings(result.Preserved)

From 74c7efa9bf3ae88e542ddfe15239368983f1548d Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:19:37 +0800
Subject: [PATCH 04/16] fix(usage): rebuild pricing from retained events

---
 .../repository/usagepricing/repository.go     | 47 ++++++++++---------
 1 file changed, 24 insertions(+), 23 deletions(-)

diff --git a/apps/manager-server/internal/repository/usagepricing/repository.go b/apps/manager-server/internal/repository/usagepricing/repository.go
index df81a917e..2a5ef82ed 100644
--- a/apps/manager-server/internal/repository/usagepricing/repository.go
+++ b/apps/manager-server/internal/repository/usagepricing/repository.go
@@ -184,23 +184,21 @@ func (r *repository) CatchUp(ctx context.Context, limit int, nowMS int64) (Catch
 	if err != nil {
 		return CatchUpResult{}, err
 	}
+	rebuildMode := state.StructureRevision != revision ||
+		state.Status == "clearing" || state.Status == "rebuilding" || state.Status == "pending"
 	latestID, err := latestEventID(ctx, tx)
 	if err != nil {
 		return CatchUpResult{}, err
 	}
-	rebuilt := (state.Status == "pending" || state.Status == "rebuilding" || state.Status == "clearing") &&
-		state.CoverageEventID < state.TargetEventID
-	if state.StructureRevision != revision || state.Status == "clearing" || state.Status == "rebuilding" || state.Status == "pending" {
-		var hasDeletedRaw bool
-		if err := tx.QueryRowContext(ctx, `select exists (
-			select 1 from usage_archive_event_refs where raw_deleted_at_ms is not null
-		)`).Scan(&hasDeletedRaw); err != nil {
-			return CatchUpResult{}, err
-		}
-		if hasDeletedRaw {
-			return CatchUpResult{}, errors.New("cannot rebuild pricing rollups from incomplete raw usage history")
+	eventSource := "usage_events"
+	if rebuildMode {
+		eventSource, latestID, err = retainedPricingRebuildSourceTx(ctx, tx)
+		if err != nil {
+			return CatchUpResult{}, fmt.Errorf("cannot rebuild pricing rollups from retained usage history: %w", err)
 		}
 	}
+	rebuilt := (state.Status == "pending" || state.Status == "rebuilding" || state.Status == "clearing") &&
+		state.CoverageEventID < state.TargetEventID
 	if state.StructureRevision != revision {
 		if err := resetForRevision(ctx, tx, revision, latestID, nowMS); err != nil {
 			return CatchUpResult{}, err
@@ -252,7 +250,7 @@ func (r *repository) CatchUp(ctx context.Context, limit int, nowMS int64) (Catch
 			return CatchUpResult{}, err
 		}
 	}
-	ids, err := eventIDsThrough(ctx, tx, state.BackfillLastEventID, targetEventID, limit)
+	ids, err := eventIDsThrough(ctx, tx, eventSource, state.BackfillLastEventID, targetEventID, limit)
 	if err != nil {
 		return CatchUpResult{}, err
 	}
@@ -296,13 +294,13 @@ func (r *repository) CatchUp(ctx context.Context, limit int, nowMS int64) (Catch
 	}
 
 	lastEventID := ids[len(ids)-1]
-	if err := upsertHourlyBatch(ctx, tx, revision, state.BackfillLastEventID, lastEventID, nowMS); err != nil {
+	if err := upsertHourlyBatch(ctx, tx, eventSource, revision, state.BackfillLastEventID, lastEventID, nowMS); err != nil {
 		return CatchUpResult{}, err
 	}
-	if err := upsertAccountBatch(ctx, tx, revision, state.BackfillLastEventID, lastEventID, nowMS); err != nil {
+	if err := upsertAccountBatch(ctx, tx, eventSource, revision, state.BackfillLastEventID, lastEventID, nowMS); err != nil {
 		return CatchUpResult{}, err
 	}
-	minBucket, maxBucket, err := batchBucketRange(ctx, tx, state.BackfillLastEventID, lastEventID)
+	minBucket, maxBucket, err := batchBucketRange(ctx, tx, eventSource, state.BackfillLastEventID, lastEventID)
 	if err != nil {
 		return CatchUpResult{}, err
 	}
@@ -509,11 +507,14 @@ func latestEventID(ctx context.Context, tx *sql.Tx) (int64, error) {
 	return id, nil
 }
 
-func eventIDsThrough(ctx context.Context, tx *sql.Tx, lastEventID, targetEventID int64, limit int) ([]int64, error) {
+func eventIDsThrough(ctx context.Context, tx *sql.Tx, source string, lastEventID, targetEventID int64, limit int) ([]int64, error) {
 	if targetEventID <= lastEventID {
 		return []int64{}, nil
 	}
-	rows, err := tx.QueryContext(ctx, `select id from usage_events where id > ? and id <= ? order by id limit ?`, lastEventID, targetEventID, limit)
+	rows, err := tx.QueryContext(ctx, fmt.Sprintf(
+		`select id from %s where id > ? and id <= ? order by id limit ?`,
+		source,
+	), lastEventID, targetEventID, limit)
 	if err != nil {
 		return nil, err
 	}
@@ -529,12 +530,12 @@ func eventIDsThrough(ctx context.Context, tx *sql.Tx, lastEventID, targetEventID
 	return ids, rows.Err()
 }
 
-func batchBucketRange(ctx context.Context, tx *sql.Tx, afterID, throughID int64) (sql.NullInt64, sql.NullInt64, error) {
+func batchBucketRange(ctx context.Context, tx *sql.Tx, source string, afterID, throughID int64) (sql.NullInt64, sql.NullInt64, error) {
 	var minBucket, maxBucket sql.NullInt64
 	err := tx.QueryRowContext(ctx, fmt.Sprintf(`select
 		min(timestamp_ms - (timestamp_ms %% %d)),
 		max(timestamp_ms - (timestamp_ms %% %d))
-		from usage_events where id > ? and id <= ?`, hourMS, hourMS), afterID, throughID).Scan(&minBucket, &maxBucket)
+		from %s where id > ? and id <= ?`, hourMS, hourMS, source), afterID, throughID).Scan(&minBucket, &maxBucket)
 	return minBucket, maxBucket, err
 }
 
@@ -588,8 +589,8 @@ func bandedEventsFromSourceCTE(whereClause, source string) string {
 		)`, requestedModelExpression, analyticsModelExpression, analyticsModelExpression, accountKeyExpression, source, whereClause, model.ModelPriceBaseContextThreshold)
 }
 
-func upsertHourlyBatch(ctx context.Context, tx *sql.Tx, revision string, afterID, throughID, nowMS int64) error {
-	query := bandedEventsCTE("e.id > ? and e.id <= ?") + fmt.Sprintf(`
+func upsertHourlyBatch(ctx context.Context, tx *sql.Tx, source, revision string, afterID, throughID, nowMS int64) error {
+	query := bandedEventsFromSourceCTE("e.id > ? and e.id <= ?", source) + fmt.Sprintf(`
 	insert into usage_pricing_hourly_rollups_v1 (
 		structure_revision, bucket_ms, model, billing_model, pricing_model,
 		service_tier, context_threshold_tokens, failed, calls,
@@ -659,8 +660,8 @@ func upsertHourlyBatch(ctx context.Context, tx *sql.Tx, revision string, afterID
 	return err
 }
 
-func upsertAccountBatch(ctx context.Context, tx *sql.Tx, revision string, afterID, throughID, nowMS int64) error {
-	query := bandedEventsCTE("e.id > ? and e.id <= ?") + fmt.Sprintf(`
+func upsertAccountBatch(ctx context.Context, tx *sql.Tx, source, revision string, afterID, throughID, nowMS int64) error {
+	query := bandedEventsFromSourceCTE("e.id > ? and e.id <= ?", source) + fmt.Sprintf(`
 	insert into usage_pricing_account_rollups_v1 (
 		structure_revision, account_key, account_snapshot, auth_label_snapshot,
 		auth_provider_snapshot, auth_index, source, source_hash, model,

From 39f680dccc0df76880a9d288f255ca3b24b87de7 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:22:17 +0800
Subject: [PATCH 05/16] test(model-price): allow retained structural changes

---
 .../repository/modelprice/repository_test.go  | 88 +++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/apps/manager-server/internal/repository/modelprice/repository_test.go b/apps/manager-server/internal/repository/modelprice/repository_test.go
index 9b331aee8..4e5ad65ff 100644
--- a/apps/manager-server/internal/repository/modelprice/repository_test.go
+++ b/apps/manager-server/internal/repository/modelprice/repository_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/model"
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/modelprice"
 	sqliterepo "github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/sqlite"
+	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/usagemonitoring"
 )
 
 func openTestDB(t *testing.T) (*sql.DB, modelprice.Repository) {
@@ -43,6 +44,36 @@ func markRawDeleted(t *testing.T, db *sql.DB) {
 	insertArchiveRef(t, db, 2000)
 }
 
+func markRawDeletedWithRetainedProjection(t *testing.T, db *sql.DB) {
+	t.Helper()
+	ctx := context.Background()
+	const eventHash = "hash-retained"
+	if _, err := db.Exec(`insert into usage_events(
+		id, event_hash, timestamp_ms, timestamp, model, created_at_ms
+	) values(1, ?, 1000, '1970-01-01T00:00:01Z', 'model-a', 1000)`, eventHash); err != nil {
+		t.Fatalf("insert retained raw event: %v", err)
+	}
+	projection := usagemonitoring.New(db)
+	result, err := projection.CatchUpProjection(ctx, 10, 1500)
+	if err != nil {
+		t.Fatalf("build retained projection: %v", err)
+	}
+	if result.CoverageEventID != 1 || result.Pending {
+		t.Fatalf("unexpected retained projection result: %#v", result)
+	}
+	if _, err := db.Exec(`pragma foreign_keys = off`); err != nil {
+		t.Fatalf("disable foreign keys: %v", err)
+	}
+	if _, err := db.Exec(`insert into usage_archive_event_refs(
+		event_hash, run_id, segment_sequence, raw_event_id, timestamp_ms, archived_at_ms, raw_deleted_at_ms
+	) values(?, 'run-retained', 1, 1, 1000, 1600, 1700)`, eventHash); err != nil {
+		t.Fatalf("insert retained archive ref: %v", err)
+	}
+	if _, err := db.Exec(`delete from usage_events where id = 1`); err != nil {
+		t.Fatalf("delete retained raw event: %v", err)
+	}
+}
+
 // Test P1-1：没有 raw deletion，structure change 允许
 func TestModelPriceStructureChangeAllowedWithoutRawDeletion(t *testing.T) {
 	ctx := context.Background()
@@ -514,3 +545,60 @@ func TestModelPriceUpsertSyncedManualPriceAndNewModelRejectedWithRawDeletion(t *
 		t.Fatalf("model-b should not exist after rollback")
 	}
 }
+
+
+func TestModelPriceStructureChangeAllowedAfterRawDeletionWithRetainedProjection(t *testing.T) {
+	ctx := context.Background()
+	db, repo := openTestDB(t)
+
+	if err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+	}); err != nil {
+		t.Fatalf("initial ReplaceAll: %v", err)
+	}
+	markRawDeletedWithRetainedProjection(t, db)
+
+	if err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+		"model-b": {Prompt: 3.0, Completion: 4.0},
+	}); err != nil {
+		t.Fatalf("structure change with retained projection: %v", err)
+	}
+
+	persisted, err := repo.LoadAll(ctx)
+	if err != nil {
+		t.Fatalf("LoadAll: %v", err)
+	}
+	if _, ok := persisted["model-b"]; !ok {
+		t.Fatalf("expected model-b to be persisted")
+	}
+}
+
+func TestModelPriceUpsertSyncedStructureChangeAllowedAfterRawDeletionWithRetainedProjection(t *testing.T) {
+	ctx := context.Background()
+	db, repo := openTestDB(t)
+
+	if err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+	}); err != nil {
+		t.Fatalf("initial ReplaceAll: %v", err)
+	}
+	markRawDeletedWithRetainedProjection(t, db)
+
+	result, err := repo.UpsertSynced(ctx, map[string]model.ModelPrice{
+		"model-b": {Prompt: 3.0, Completion: 4.0, Source: "sync"},
+	})
+	if err != nil {
+		t.Fatalf("UpsertSynced with retained projection: %v", err)
+	}
+	if result.Imported != 1 {
+		t.Fatalf("unexpected sync result: %+v", result)
+	}
+	persisted, err := repo.LoadAll(ctx)
+	if err != nil {
+		t.Fatalf("LoadAll: %v", err)
+	}
+	if _, ok := persisted["model-b"]; !ok {
+		t.Fatalf("expected model-b to be persisted")
+	}
+}

From a0f112a808e1b8cd71cf9cea9f29ea4e525060d7 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:23:06 +0800
Subject: [PATCH 06/16] test(usage): cover retained pricing rebuild

---
 .../usagepricing/repository_test.go           | 105 ++++++++++++++++++
 1 file changed, 105 insertions(+)

diff --git a/apps/manager-server/internal/repository/usagepricing/repository_test.go b/apps/manager-server/internal/repository/usagepricing/repository_test.go
index cce4b620d..5d746ab75 100644
--- a/apps/manager-server/internal/repository/usagepricing/repository_test.go
+++ b/apps/manager-server/internal/repository/usagepricing/repository_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/model"
+	sqliterepo "github.com/seakee/cpa-manager-plus/apps/manager-server/internal/repository/sqlite"
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/store"
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/testutil"
 	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/usage"
@@ -78,6 +79,110 @@ func TestPricingRollupBandsStrictThresholdsAndMergesRawDelta(t *testing.T) {
 	}
 }
 
+func TestPricingRollupRebuildsFromRetainedProjectionAfterRawDeletion(t *testing.T) {
+	ctx := context.Background()
+	cfg := testutil.NewConfig(t)
+	st := testutil.NewStore(t, cfg)
+	price := store.ModelPrice{
+		Prompt: 1,
+		ContextTiers: []store.ModelPriceContextTier{{
+			ThresholdTokens: 100,
+			Prompt:          2,
+			PromptConfigured: true,
+		}},
+	}
+	if err := st.SaveModelPrices(ctx, map[string]store.ModelPrice{"resolved-model": price}); err != nil {
+		t.Fatalf("save initial prices: %v", err)
+	}
+	events := []usage.Event{
+		pricingEvent("retained-live", 3_600_001, 150),
+		pricingEvent("retained-deleted-highest", 3_600_002, 250),
+	}
+	if _, err := st.UsageEvents.InsertBatch(ctx, events); err != nil {
+		t.Fatalf("insert retained rebuild events: %v", err)
+	}
+	projection, err := st.CatchUpUsageMonitoringProjection(ctx, 10, 9_000)
+	if err != nil {
+		t.Fatalf("build monitoring projection: %v", err)
+	}
+	if projection.CoverageEventID != 2 || projection.Pending {
+		t.Fatalf("projection result = %#v", projection)
+	}
+	if _, err := st.CatchUpUsagePricing(ctx, 10, 10_000); err != nil {
+		t.Fatalf("build initial pricing rollup: %v", err)
+	}
+
+	db, err := sqliterepo.Open(cfg.DBPath)
+	if err != nil {
+		t.Fatalf("open raw sqlite handle: %v", err)
+	}
+	defer db.Close()
+	var deletedID, deletedTimestamp int64
+	if err := db.QueryRowContext(ctx, `select id, timestamp_ms from usage_events where event_hash = ?`,
+		events[1].EventHash).Scan(&deletedID, &deletedTimestamp); err != nil {
+		t.Fatalf("resolve deleted event: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `pragma foreign_keys = off`); err != nil {
+		t.Fatalf("disable foreign keys: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `insert into usage_archive_event_refs(
+		event_hash, run_id, segment_sequence, raw_event_id, timestamp_ms, archived_at_ms, raw_deleted_at_ms
+	) values(?, 'retained-pricing-run', 1, ?, ?, 11000, 12000)`,
+		events[1].EventHash, deletedID, deletedTimestamp); err != nil {
+		t.Fatalf("insert retained archive ref: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `delete from usage_events where id = ?`, deletedID); err != nil {
+		t.Fatalf("delete highest raw event: %v", err)
+	}
+
+	price.ContextTiers[0].ThresholdTokens = 200
+	if err := st.SaveModelPrices(ctx, map[string]store.ModelPrice{"resolved-model": price}); err != nil {
+		t.Fatalf("save structural price change with retained history: %v", err)
+	}
+	result, err := st.CatchUpUsagePricing(ctx, 10, 13_000)
+	if err != nil {
+		t.Fatalf("rebuild pricing from retained history: %v", err)
+	}
+	if !result.Rebuilt || result.Pending || result.TargetEventID != deletedID || result.CoverageEventID != deletedID {
+		t.Fatalf("retained rebuild result = %#v, deletedID=%d", result, deletedID)
+	}
+
+	rows, _, available, err := st.UsagePricingHourlyRows(ctx, store.UsagePricingHourlyFilter{
+		FromMS:        3_600_000,
+		ToMS:          7_200_000,
+		IncludeFailed: true,
+	})
+	if err != nil || !available {
+		t.Fatalf("load retained pricing rows: available=%v err=%v", available, err)
+	}
+	var calls int64
+	byThreshold := map[int64]int64{}
+	for _, row := range rows {
+		calls += row.Calls
+		byThreshold[row.ContextThresholdTokens] += row.Calls
+	}
+	if calls != 2 {
+		t.Fatalf("retained rebuild calls=%d rows=%#v", calls, rows)
+	}
+	if byThreshold[model.ModelPriceBaseContextThreshold] != 1 || byThreshold[200] != 1 {
+		t.Fatalf("retained rebuild threshold rows=%#v", byThreshold)
+	}
+
+	accountRows, _, accountAvailable, err := st.UsagePricingAccountRows(ctx, []string{
+		pricingAccountKey("team-a.json", "auth-team-a"),
+	})
+	if err != nil || !accountAvailable {
+		t.Fatalf("load retained account rows: available=%v err=%v", accountAvailable, err)
+	}
+	var accountCalls int64
+	for _, row := range accountRows {
+		accountCalls += row.Calls
+	}
+	if accountCalls != 2 {
+		t.Fatalf("retained account calls=%d rows=%#v", accountCalls, accountRows)
+	}
+}
+
 func TestPricingRollupDoesNotClassifyIncrementalBacklogAsRebuild(t *testing.T) {
 	ctx := context.Background()
 	cfg := testutil.NewConfig(t)

From 5bd89d4dc69728a9034f712a30177857b9b88439 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:28:50 +0800
Subject: [PATCH 07/16] test(monitoring): expect retained pricing rebuild

---
 .../service/monitoring/pricing_coverage_test.go | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
index 6874d1dd8..4267a7b15 100644
--- a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
+++ b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
@@ -133,7 +133,7 @@ func TestAnalyticsPricingRecoveryPreservesFiltersAndCollapsedBuckets(t *testing.
 	}
 }
 
-func TestPricingCatchUpPreservesArchivedHistoryDuringRebuild(t *testing.T) {
+func TestPricingCatchUpRebuildsArchivedHistoryFromRetainedProjection(t *testing.T) {
 	for _, test := range []struct {
 		name string
 		sql  string
@@ -149,19 +149,22 @@ func TestPricingCatchUpPreservesArchivedHistoryDuringRebuild(t *testing.T) {
 				t.Fatal(err)
 			}
 			before := pricingCoverageCounts(t, sqlDB)
-			stateBefore, err := db.UsagePricingState(ctx)
+			result, err := db.CatchUpUsagePricing(ctx, 100, time.Now().UnixMilli())
 			if err != nil {
-				t.Fatal(err)
+				t.Fatalf("rebuild from retained projection: %v", err)
 			}
-			if _, err := db.CatchUpUsagePricing(ctx, 100, time.Now().UnixMilli()); err == nil {
-				t.Fatal("rebuild from deleted raw history unexpectedly succeeded")
+			if !result.Rebuilt || result.Pending || result.CoverageEventID < result.TargetEventID {
+				t.Fatalf("unexpected retained rebuild result: %#v", result)
 			}
 			stateAfter, err := db.UsagePricingState(ctx)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if after := pricingCoverageCounts(t, sqlDB); after != before || !reflect.DeepEqual(stateAfter, stateBefore) {
-				t.Fatalf("rebuild changed retained history: before=%v after=%v states=%#v / %#v", before, after, stateBefore, stateAfter)
+			if stateAfter.Status != "ready" || stateAfter.CoverageEventID < stateAfter.TargetEventID {
+				t.Fatalf("retained rebuild state = %#v", stateAfter)
+			}
+			if after := pricingCoverageCounts(t, sqlDB); after != before {
+				t.Fatalf("retained rebuild changed historical coverage: before=%v after=%v", before, after)
 			}
 		})
 	}

From 38acf244f8de94ab9d2a55909a4fb205951d3d75 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 15:31:53 +0800
Subject: [PATCH 08/16] test(monitoring): model valid retained rebuild resume

---
 .../internal/service/monitoring/pricing_coverage_test.go    | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
index 4267a7b15..f0958a1a9 100644
--- a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
+++ b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
@@ -140,15 +140,17 @@ func TestPricingCatchUpRebuildsArchivedHistoryFromRetainedProjection(t *testing.
 	}{
 		{"revision change", `update usage_pricing_rollup_state set structure_revision = 'obsolete'`},
 		{"resumed clearing", `update usage_pricing_rollup_state set status = 'clearing', coverage_event_id = 0, backfill_last_event_id = 0`},
-		{"resumed rebuilding", `update usage_pricing_rollup_state set status = 'rebuilding', coverage_event_id = 0, backfill_last_event_id = 0`},
+		{"resumed rebuilding", `delete from usage_pricing_hourly_rollups_v1;
+			delete from usage_pricing_account_rollups_v1;
+			update usage_pricing_rollup_state set status = 'rebuilding', coverage_event_id = 0, backfill_last_event_id = 0`},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			db, sqlDB, _, _ := pricingCoverageFixture(t)
 			ctx := context.Background()
+			before := pricingCoverageCounts(t, sqlDB)
 			if _, err := sqlDB.ExecContext(ctx, test.sql); err != nil {
 				t.Fatal(err)
 			}
-			before := pricingCoverageCounts(t, sqlDB)
 			result, err := db.CatchUpUsagePricing(ctx, 100, time.Now().UnixMilli())
 			if err != nil {
 				t.Fatalf("rebuild from retained projection: %v", err)

From 597318c677dede694d8075a7f7ef18e5b8ee1b7d Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 16:46:53 +0800
Subject: [PATCH 09/16] fix(usage): classify retained coverage errors

---
 .../repository/usagepricing/projection_read.go        | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/apps/manager-server/internal/repository/usagepricing/projection_read.go b/apps/manager-server/internal/repository/usagepricing/projection_read.go
index 7b32a0b8e..5a992a8e4 100644
--- a/apps/manager-server/internal/repository/usagepricing/projection_read.go
+++ b/apps/manager-server/internal/repository/usagepricing/projection_read.go
@@ -19,6 +19,8 @@ var retainedPricingColumns = []string{
 	"auth_file_snapshot", "auth_provider_snapshot", "auth_project_id_snapshot", "auth_account_id_snapshot",
 }
 
+var ErrRetainedPricingHistoryIncomplete = errors.New("retained pricing history is incomplete")
+
 // LoadHourlyRowsFromEventsTx bypasses a deficient pricing cache without writing
 // to it. A compatible retained projection supplies archived events; raw events
 // after its watermark supply the tail, with no overlapping IDs.
@@ -93,12 +95,15 @@ func retainedPricingRebuildSourceTx(ctx context.Context, tx *sql.Tx) (string, in
 		from usage_monitoring_rollup_state where rollup_name = 'projection_v1'`).Scan(
 		&schemaVersion, &revision, &status, &coverageID,
 	); err != nil {
-		return "", 0, fmt.Errorf("retained usage projection state is unavailable: %w", err)
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", 0, fmt.Errorf("%w: retained usage projection state is unavailable", ErrRetainedPricingHistoryIncomplete)
+		}
+		return "", 0, err
 	}
 	if schemaVersion != 1 ||
 		revision != usageidentity.MonitoringProjectionStructureRevision() ||
 		status == "clearing" {
-		return "", 0, fmt.Errorf("retained usage projection is incompatible or rebuilding")
+		return "", 0, fmt.Errorf("%w: retained usage projection is incompatible or rebuilding", ErrRetainedPricingHistoryIncomplete)
 	}
 
 	var incomplete bool
@@ -116,7 +121,7 @@ func retainedPricingRebuildSourceTx(ctx context.Context, tx *sql.Tx) (string, in
 		return "", 0, err
 	}
 	if incomplete {
-		return "", 0, fmt.Errorf("retained usage projection is missing a deleted pricing event")
+		return "", 0, fmt.Errorf("%w: retained usage projection is missing a deleted pricing event", ErrRetainedPricingHistoryIncomplete)
 	}
 
 	var latestID int64

From b762f1ba36b2a39acbd8a81f95fc37fd3cbe514f Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 16:47:20 +0800
Subject: [PATCH 10/16] fix(model-price): preserve verifier system errors

---
 .../internal/repository/modelprice/repository.go       | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/apps/manager-server/internal/repository/modelprice/repository.go b/apps/manager-server/internal/repository/modelprice/repository.go
index 33c136ea1..cf6feb0fe 100644
--- a/apps/manager-server/internal/repository/modelprice/repository.go
+++ b/apps/manager-server/internal/repository/modelprice/repository.go
@@ -252,7 +252,10 @@ func (r *repository) ReplaceAll(ctx context.Context, prices map[string]model.Mod
 	afterRevision := model.ModelPriceStructureRevision(normalizedPrices)
 	if beforeRevision != afterRevision {
 		if err := usagepricing.VerifyRetainedPricingRebuildSourceTx(ctx, tx); err != nil {
-			return fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
+			if errors.Is(err, usagepricing.ErrRetainedPricingHistoryIncomplete) {
+				return fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
+			}
+			return err
 		}
 	}
 
@@ -460,7 +463,10 @@ func (r *repository) UpsertSynced(ctx context.Context, prices map[string]model.M
 	afterRevision := model.ModelPriceStructureRevision(afterPrices)
 	if beforeRevision != afterRevision {
 		if err := usagepricing.VerifyRetainedPricingRebuildSourceTx(ctx, tx); err != nil {
-			return model.ModelPriceSyncResult{}, fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
+			if errors.Is(err, usagepricing.ErrRetainedPricingHistoryIncomplete) {
+				return model.ModelPriceSyncResult{}, fmt.Errorf("%w: %v", ErrStructureChangeAfterRawDeletion, err)
+			}
+			return model.ModelPriceSyncResult{}, err
 		}
 	}
 	sort.Strings(result.Preserved)

From 20e5ba416a5835ca309d0888e4a77f3a3dec8f19 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 16:47:45 +0800
Subject: [PATCH 11/16] test(model-price): preserve verifier system errors

---
 .../repository/modelprice/repository_test.go  | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/apps/manager-server/internal/repository/modelprice/repository_test.go b/apps/manager-server/internal/repository/modelprice/repository_test.go
index 4e5ad65ff..c3de6ff90 100644
--- a/apps/manager-server/internal/repository/modelprice/repository_test.go
+++ b/apps/manager-server/internal/repository/modelprice/repository_test.go
@@ -602,3 +602,77 @@ func TestModelPriceUpsertSyncedStructureChangeAllowedAfterRawDeletionWithRetaine
 		t.Fatalf("expected model-b to be persisted")
 	}
 }
+
+
+func TestModelPriceStructureChangePreservesRetainedVerifierSystemError(t *testing.T) {
+	ctx := context.Background()
+	db, repo := openTestDB(t)
+
+	if err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+	}); err != nil {
+		t.Fatalf("initial ReplaceAll: %v", err)
+	}
+	markRawDeleted(t, db)
+	if _, err := db.Exec(`drop table usage_monitoring_rollup_state`); err != nil {
+		t.Fatalf("drop monitoring rollup state: %v", err)
+	}
+
+	err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+		"model-b": {Prompt: 3.0, Completion: 4.0},
+	})
+	if err == nil {
+		t.Fatal("expected retained verifier system error")
+	}
+	if errors.Is(err, modelprice.ErrStructureChangeAfterRawDeletion) {
+		t.Fatalf("system error was misclassified as structure conflict: %v", err)
+	}
+
+	persisted, loadErr := repo.LoadAll(ctx)
+	if loadErr != nil {
+		t.Fatalf("LoadAll: %v", loadErr)
+	}
+	if len(persisted) != 1 {
+		t.Fatalf("expected mutation rollback, got %d models", len(persisted))
+	}
+	if _, ok := persisted["model-b"]; ok {
+		t.Fatal("model-b should not exist after verifier system error")
+	}
+}
+
+func TestModelPriceUpsertSyncedPreservesRetainedVerifierSystemError(t *testing.T) {
+	ctx := context.Background()
+	db, repo := openTestDB(t)
+
+	if err := repo.ReplaceAll(ctx, map[string]model.ModelPrice{
+		"model-a": {Prompt: 1.0, Completion: 2.0},
+	}); err != nil {
+		t.Fatalf("initial ReplaceAll: %v", err)
+	}
+	markRawDeleted(t, db)
+	if _, err := db.Exec(`drop table usage_monitoring_rollup_state`); err != nil {
+		t.Fatalf("drop monitoring rollup state: %v", err)
+	}
+
+	result, err := repo.UpsertSynced(ctx, map[string]model.ModelPrice{
+		"model-b": {Prompt: 3.0, Completion: 4.0, Source: "sync"},
+	})
+	if err == nil {
+		t.Fatalf("expected retained verifier system error, got result=%+v", result)
+	}
+	if errors.Is(err, modelprice.ErrStructureChangeAfterRawDeletion) {
+		t.Fatalf("system error was misclassified as structure conflict: %v", err)
+	}
+
+	persisted, loadErr := repo.LoadAll(ctx)
+	if loadErr != nil {
+		t.Fatalf("LoadAll: %v", loadErr)
+	}
+	if len(persisted) != 1 {
+		t.Fatalf("expected sync rollback, got %d models", len(persisted))
+	}
+	if _, ok := persisted["model-b"]; ok {
+		t.Fatal("model-b should not exist after verifier system error")
+	}
+}

From f22cf8826530d6456d0c401500e11fdf55d23812 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 17:47:59 +0800
Subject: [PATCH 12/16] fix(usage): degrade account history when pricing is
 unrecoverable

---
 .../monitoring/pricing_coverage_test.go       | 65 ++++++++++++++++--
 .../internal/service/monitoring/service.go    | 66 +++++++++++++++----
 .../service/monitoring/service_test.go        |  4 +-
 apps/manager-server/internal/store/store.go   |  7 +-
 .../accountDetail/AccountQuotaTab.tsx         |  2 +-
 .../model/accountDetailViewModel.test.ts      | 13 ++++
 .../accounts/model/accountDetailViewModel.ts  |  2 +-
 .../model/accountsPagePresentation.test.ts    |  1 +
 .../model/accountsPagePresentation.ts         |  3 +-
 apps/web/src/features/demo/DemoPage.test.tsx  |  2 +-
 apps/web/src/services/api/usageService.ts     |  2 +-
 11 files changed, 139 insertions(+), 28 deletions(-)

diff --git a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
index f0958a1a9..443a263ce 100644
--- a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
+++ b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
@@ -195,7 +195,10 @@ func TestAccountHistoryRecoversIncompleteArchivedPricing(t *testing.T) {
 				t.Fatalf("baseline history calls = %d, want 8", calls)
 			}
 			wantCost := analytics.Summary.TotalCost + analytics.SummaryComparison.TotalCost
-			if delta := want.Items[0].TotalCost + want.Items[1].TotalCost - wantCost; delta < -0.000001 || delta > 0.000001 {
+			if want.Items[0].TotalCost == nil || want.Items[1].TotalCost == nil {
+				t.Fatalf("baseline account costs unavailable: %#v", want.Items)
+			}
+			if delta := *want.Items[0].TotalCost + *want.Items[1].TotalCost - wantCost; delta < -0.000001 || delta > 0.000001 {
 				t.Fatalf("baseline account costs differ from hourly costs: %v", delta)
 			}
 			if _, err := sqlDB.ExecContext(ctx, test.sql); err != nil {
@@ -213,16 +216,64 @@ func TestAccountHistoryRecoversIncompleteArchivedPricing(t *testing.T) {
 	}
 }
 
-func TestAccountHistoryIncompleteArchivedPricingFailsClosed(t *testing.T) {
+func TestAccountHistoryDegradesWhenArchivedPricingCannotBeRecovered(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		catchUp bool
+		sql     string
+	}{
+		{name: "read", sql: `delete from usage_pricing_account_rollups_v1;
+			delete from usage_monitoring_event_projection_v1 where event_id not in (select id from usage_events)`},
+		{name: "catch up", catchUp: true, sql: `delete from usage_pricing_account_rollups_v1;
+			delete from usage_monitoring_event_projection_v1 where event_id not in (select id from usage_events);
+			update usage_pricing_rollup_state set structure_revision = 'obsolete'`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			db, sqlDB, _, _ := pricingCoverageFixture(t)
+			ctx := context.Background()
+			request := pricingCoverageAccountRequest()
+			want, err := New(db).AccountHistory(ctx, request)
+			if err != nil || len(want.Items) != 2 {
+				t.Fatalf("baseline account history = %#v, %v", want, err)
+			}
+			if _, err := sqlDB.ExecContext(ctx, test.sql); err != nil {
+				t.Fatal(err)
+			}
+			request.CatchUp = test.catchUp
+			got, err := New(db).AccountHistory(ctx, request)
+			if err != nil || len(got.Items) != len(want.Items) {
+				t.Fatalf("degraded account history = %#v, %v", got, err)
+			}
+			for index := range got.Items {
+				item, baseline := got.Items[index], want.Items[index]
+				if !item.Matched || item.TotalCost != nil {
+					t.Fatalf("degraded item availability = %#v", item)
+				}
+				if item.TotalRequests != baseline.TotalRequests || item.SuccessCalls != baseline.SuccessCalls ||
+					item.FailureCalls != baseline.FailureCalls || item.TotalTokens != baseline.TotalTokens ||
+					!reflect.DeepEqual(item.SuccessRate, baseline.SuccessRate) ||
+					!reflect.DeepEqual(item.FirstSeenMS, baseline.FirstSeenMS) ||
+					!reflect.DeepEqual(item.LastSeenMS, baseline.LastSeenMS) {
+					t.Fatalf("degraded core history differs: got=%#v want=%#v", item, baseline)
+				}
+				if !reflect.DeepEqual(item.LatestRequest, baseline.LatestRequest) ||
+					!reflect.DeepEqual(item.RecentRequests, baseline.RecentRequests) {
+					t.Fatalf("degraded recent requests differ: got=%#v want=%#v", item, baseline)
+				}
+			}
+		})
+	}
+}
+
+func TestAccountHistoryDoesNotHideCoreHistoryReadErrors(t *testing.T) {
 	db, sqlDB, _, _ := pricingCoverageFixture(t)
 	ctx := context.Background()
-	if _, err := sqlDB.ExecContext(ctx, `delete from usage_pricing_account_rollups_v1;
-		delete from usage_monitoring_event_projection_v1 where event_id not in (select id from usage_events)`); err != nil {
+	if _, err := sqlDB.ExecContext(ctx, `alter table usage_account_model_rollups rename column total_tokens to unavailable_tokens`); err != nil {
 		t.Fatal(err)
 	}
-	got, err := New(db).AccountHistory(ctx, pricingCoverageAccountRequest())
-	if !errors.Is(err, store.ErrUsagePricingCoverageIncomplete) || len(got.Items) != 0 {
-		t.Fatalf("incomplete account history returned success: %#v error=%v", got.Items, err)
+	_, err := New(db).AccountHistory(ctx, pricingCoverageAccountRequest())
+	if err == nil || errors.Is(err, store.ErrUsagePricingCoverageIncomplete) {
+		t.Fatalf("core history read error was hidden: %v", err)
 	}
 }
 
diff --git a/apps/manager-server/internal/service/monitoring/service.go b/apps/manager-server/internal/service/monitoring/service.go
index 91b62ef1c..6867be6ed 100644
--- a/apps/manager-server/internal/service/monitoring/service.go
+++ b/apps/manager-server/internal/service/monitoring/service.go
@@ -289,7 +289,7 @@ type AccountHistoryItem struct {
 	SuccessCalls   int64                  `json:"success_calls"`
 	FailureCalls   int64                  `json:"failure_calls"`
 	TotalTokens    int64                  `json:"total_tokens"`
-	TotalCost      float64                `json:"total_cost"`
+	TotalCost      *float64               `json:"total_cost"`
 	SuccessRate    *float64               `json:"success_rate"`
 	FirstSeenMS    *int64                 `json:"first_seen_ms"`
 	LastSeenMS     *int64                 `json:"last_seen_ms"`
@@ -1773,7 +1773,8 @@ func (s *Service) accountHistory(ctx context.Context, req AccountHistoryRequest)
 			return AccountHistoryResponse{}, err
 		}
 		processed = result.Processed
-		if _, err := s.store.CatchUpUsagePricing(ctx, accountHistoryCatchUpLimit, generatedAtMS); err != nil {
+		if _, err := s.store.CatchUpUsagePricing(ctx, accountHistoryCatchUpLimit, generatedAtMS); err != nil &&
+			!errors.Is(err, store.ErrUsagePricingCoverageIncomplete) {
 			return AccountHistoryResponse{}, err
 		}
 	}
@@ -1836,7 +1837,14 @@ func (s *Service) accountHistory(ctx context.Context, req AccountHistoryRequest)
 	loadTotals := func(readKeys []string) (map[string]*accountHistoryTotal, error) {
 		pricingSnapshot, err := s.store.LoadUsagePricingAccountSnapshot(ctx, readKeys)
 		if err != nil {
-			return nil, err
+			if !errors.Is(err, store.ErrUsagePricingCoverageIncomplete) {
+				return nil, err
+			}
+			rows, rollupErr := s.store.AccountHistoryRollupRows(ctx, readKeys)
+			if rollupErr != nil {
+				return nil, rollupErr
+			}
+			return buildUnpricedAccountHistoryTotals(rows), nil
 		}
 		prices := pricingSnapshot.Prices
 		if pricingSnapshot.Available {
@@ -1935,7 +1943,7 @@ func (s *Service) accountHistory(ctx context.Context, req AccountHistoryRequest)
 			SuccessCalls:   total.successCalls,
 			FailureCalls:   total.failureCalls,
 			TotalTokens:    total.totalTokens,
-			TotalCost:      total.cost,
+			TotalCost:      accountHistoryCostPointer(total),
 			SuccessRate:    successRate,
 			FirstSeenMS:    nullableMSPointer(total.firstSeenMS),
 			LastSeenMS:     nullableMSPointer(total.lastSeenMS),
@@ -4072,13 +4080,14 @@ func buildHeaderSnapshots(items []store.HeaderSnapshot) []HeaderSnapshot {
 }
 
 type accountHistoryTotal struct {
-	requests     int64
-	successCalls int64
-	failureCalls int64
-	totalTokens  int64
-	cost         float64
-	firstSeenMS  int64
-	lastSeenMS   int64
+	requests      int64
+	successCalls  int64
+	failureCalls  int64
+	totalTokens   int64
+	cost          float64
+	costAvailable bool
+	firstSeenMS   int64
+	lastSeenMS    int64
 }
 
 func accountHistoryTargetKey(target AccountHistoryTarget) (string, bool) {
@@ -4181,7 +4190,7 @@ func accountLatestRequestFromStore(request store.LatestAccountRequest) *AccountL
 	}
 }
 
-func buildAccountHistoryTotals(rows []store.AccountHistoryRollupRow, prices map[string]store.ModelPrice) map[string]*accountHistoryTotal {
+func buildUnpricedAccountHistoryTotals(rows []store.AccountHistoryRollupRow) map[string]*accountHistoryTotal {
 	totals := map[string]*accountHistoryTotal{}
 	for _, row := range rows {
 		total := totals[row.AccountKey]
@@ -4193,6 +4202,28 @@ func buildAccountHistoryTotals(rows []store.AccountHistoryRollupRow, prices map[
 		total.successCalls += row.SuccessCalls
 		total.failureCalls += row.FailureCalls
 		total.totalTokens += row.TotalTokens
+		if total.firstSeenMS == 0 || (row.FirstSeenMS > 0 && row.FirstSeenMS < total.firstSeenMS) {
+			total.firstSeenMS = row.FirstSeenMS
+		}
+		if row.LastSeenMS > total.lastSeenMS {
+			total.lastSeenMS = row.LastSeenMS
+		}
+	}
+	return totals
+}
+
+func buildAccountHistoryTotals(rows []store.AccountHistoryRollupRow, prices map[string]store.ModelPrice) map[string]*accountHistoryTotal {
+	totals := map[string]*accountHistoryTotal{}
+	for _, row := range rows {
+		total := totals[row.AccountKey]
+		if total == nil {
+			total = &accountHistoryTotal{costAvailable: true}
+			totals[row.AccountKey] = total
+		}
+		total.requests += row.Calls
+		total.successCalls += row.SuccessCalls
+		total.failureCalls += row.FailureCalls
+		total.totalTokens += row.TotalTokens
 		total.cost += pricing.CostForModelCandidatesWithServiceTier(
 			[]string{row.BillingModel, row.Model},
 			row.ServiceTier,
@@ -4225,7 +4256,7 @@ func buildPricingAccountHistoryTotals(rows []store.UsagePricingAccountRow, price
 	for _, row := range rows {
 		total := totals[row.AccountKey]
 		if total == nil {
-			total = &accountHistoryTotal{}
+			total = &accountHistoryTotal{costAvailable: true}
 			totals[row.AccountKey] = total
 		}
 		total.requests += row.Calls
@@ -4278,6 +4309,7 @@ func mergeAliasedAccountHistoryTotals(totals map[string]*accountHistoryTotal, al
 		primary.failureCalls += legacy.failureCalls
 		primary.totalTokens += legacy.totalTokens
 		primary.cost += legacy.cost
+		primary.costAvailable = primary.costAvailable && legacy.costAvailable
 		if primary.firstSeenMS == 0 || (legacy.firstSeenMS > 0 && legacy.firstSeenMS < primary.firstSeenMS) {
 			primary.firstSeenMS = legacy.firstSeenMS
 		}
@@ -4288,6 +4320,14 @@ func mergeAliasedAccountHistoryTotals(totals map[string]*accountHistoryTotal, al
 	}
 }
 
+func accountHistoryCostPointer(total *accountHistoryTotal) *float64 {
+	if total == nil || !total.costAvailable {
+		return nil
+	}
+	value := total.cost
+	return &value
+}
+
 func accountWindowUsageTargetKey(target AccountWindowUsageTarget) (string, bool) {
 	if !AccountWindowUsageTargetHasCredentialIdentity(target) {
 		return "", false
diff --git a/apps/manager-server/internal/service/monitoring/service_test.go b/apps/manager-server/internal/service/monitoring/service_test.go
index 7ecea05cd..9c842cf9c 100644
--- a/apps/manager-server/internal/service/monitoring/service_test.go
+++ b/apps/manager-server/internal/service/monitoring/service_test.go
@@ -2249,7 +2249,7 @@ func TestAccountHistoryReturnsRollupTotalsAndCost(t *testing.T) {
 	if history.SuccessRate == nil || math.Abs(*history.SuccessRate-0.5) > 0.000001 {
 		t.Fatalf("success rate = %#v", history.SuccessRate)
 	}
-	if math.Abs(history.TotalCost-2.055) > 0.000001 {
+	if history.TotalCost == nil || math.Abs(*history.TotalCost-2.055) > 0.000001 {
 		t.Fatalf("total cost = %v", history.TotalCost)
 	}
 	if history.FirstSeenMS == nil || *history.FirstSeenMS != baseMS+1_000 || history.LastSeenMS == nil || *history.LastSeenMS != baseMS+2_000 {
@@ -2477,7 +2477,7 @@ func TestAccountHistoryPricesContextTierBands(t *testing.T) {
 		t.Fatalf("history item = %#v", resp.Items)
 	}
 	const wantCost = 4.60002
-	if math.Abs(resp.Items[0].TotalCost-wantCost) > 0.000001 {
+	if resp.Items[0].TotalCost == nil || math.Abs(*resp.Items[0].TotalCost-wantCost) > 0.000001 {
 		t.Fatalf("history cost = %v, want %v", resp.Items[0].TotalCost, wantCost)
 	}
 }
diff --git a/apps/manager-server/internal/store/store.go b/apps/manager-server/internal/store/store.go
index a5e1a32a9..62449ed41 100644
--- a/apps/manager-server/internal/store/store.go
+++ b/apps/manager-server/internal/store/store.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"io"
 	"sync"
@@ -547,7 +548,11 @@ func (s *Store) CatchUpUsagePricing(ctx context.Context, limit int, nowMS int64)
 	if !ready {
 		return UsagePricingCatchUpResult{Pending: true}, nil
 	}
-	return s.UsagePricing.CatchUp(ctx, limit, nowMS)
+	result, err := s.UsagePricing.CatchUp(ctx, limit, nowMS)
+	if err != nil && errors.Is(err, usagepricing.ErrRetainedPricingHistoryIncomplete) {
+		return result, fmt.Errorf("%w: %w", ErrUsagePricingCoverageIncomplete, err)
+	}
+	return result, err
 }
 
 func (s *Store) RecordUsagePricingFailure(ctx context.Context, rollupErr error, nowMS int64) error {
diff --git a/apps/web/src/features/accounts/components/accountDetail/AccountQuotaTab.tsx b/apps/web/src/features/accounts/components/accountDetail/AccountQuotaTab.tsx
index 6ff2f3bab..0698eaaa3 100644
--- a/apps/web/src/features/accounts/components/accountDetail/AccountQuotaTab.tsx
+++ b/apps/web/src/features/accounts/components/accountDetail/AccountQuotaTab.tsx
@@ -229,7 +229,7 @@ export function AccountQuotaTab({
             icon={<IconDollarSign size={20} />}
             tone="amber"
             label={t('accounts.detail_total_cost')}
-            value={history ? formatUsd(history.totalCost) : '-'}
+            value={history?.totalCost != null ? formatUsd(history.totalCost) : '-'}
           />
           <MetricCell
             icon={<IconCheck size={20} />}
diff --git a/apps/web/src/features/accounts/model/accountDetailViewModel.test.ts b/apps/web/src/features/accounts/model/accountDetailViewModel.test.ts
index fcc757d55..15922fa45 100644
--- a/apps/web/src/features/accounts/model/accountDetailViewModel.test.ts
+++ b/apps/web/src/features/accounts/model/accountDetailViewModel.test.ts
@@ -244,6 +244,19 @@ const makeMonitoringValue = (
 });
 
 describe('accountDetailViewModel', () => {
+  it('preserves unavailable historical cost without dropping core history', () => {
+    const viewModel = buildAccountDetailViewModel(makeRow(), {
+      history: makeHistory({ total_cost: null }),
+    });
+
+    expect(viewModel.history).toMatchObject({
+      matched: true,
+      totalRequests: 12,
+      totalTokens: 2400,
+      totalCost: null,
+    });
+  });
+
   it('uses the full unified plan label for credential details', () => {
     const viewModel = buildAccountDetailViewModel(
       makeRow({
diff --git a/apps/web/src/features/accounts/model/accountDetailViewModel.ts b/apps/web/src/features/accounts/model/accountDetailViewModel.ts
index 7e4035ce4..09459512c 100644
--- a/apps/web/src/features/accounts/model/accountDetailViewModel.ts
+++ b/apps/web/src/features/accounts/model/accountDetailViewModel.ts
@@ -208,7 +208,7 @@ export interface AccountDetailHistorySummary {
   successCalls: number;
   failureCalls: number;
   totalTokens: number;
-  totalCost: number;
+  totalCost: number | null;
   successRate: number | null;
   firstSeenMs: number | null;
   lastSeenMs: number | null;
diff --git a/apps/web/src/features/accounts/model/accountsPagePresentation.test.ts b/apps/web/src/features/accounts/model/accountsPagePresentation.test.ts
index 34194b677..ead014aca 100644
--- a/apps/web/src/features/accounts/model/accountsPagePresentation.test.ts
+++ b/apps/web/src/features/accounts/model/accountsPagePresentation.test.ts
@@ -57,6 +57,7 @@ describe('accountsPagePresentation', () => {
     expect(parsePriorityValue('1.2')).toBeNull();
     expect(formatHistorySuccessRate(0.975)).toBe('97.5%');
     expect(formatMoney(12.34)).toBe('$12.34');
+    expect(formatMoney(null)).toBe('-');
     expect(quotaStatusLabelKey('exhausted')).toBe('accounts.quota_status_exhausted');
   });
 
diff --git a/apps/web/src/features/accounts/model/accountsPagePresentation.ts b/apps/web/src/features/accounts/model/accountsPagePresentation.ts
index 37f605521..0505a9753 100644
--- a/apps/web/src/features/accounts/model/accountsPagePresentation.ts
+++ b/apps/web/src/features/accounts/model/accountsPagePresentation.ts
@@ -111,7 +111,8 @@ export const getProviderLabel = (provider: string, t: TFunction) => {
 export const formatPercent = (value: number | null | undefined, digits = 0) =>
   typeof value === 'number' && Number.isFinite(value) ? `${value.toFixed(digits)}%` : '-';
 
-export const formatMoney = (value: number) => formatUsd(value);
+export const formatMoney = (value: number | null | undefined) =>
+  typeof value === 'number' && Number.isFinite(value) ? formatUsd(value) : '-';
 
 export const formatHistoryNumber = (value: number, locale: string) => {
   const numberValue = Number(value);
diff --git a/apps/web/src/features/demo/DemoPage.test.tsx b/apps/web/src/features/demo/DemoPage.test.tsx
index 9c3c9825a..0318e24a3 100644
--- a/apps/web/src/features/demo/DemoPage.test.tsx
+++ b/apps/web/src/features/demo/DemoPage.test.tsx
@@ -371,7 +371,7 @@ describe('DemoPage', () => {
         (item) =>
           item.total_requests > 0 &&
           item.total_tokens > 0 &&
-          item.total_cost > 0 &&
+          (item.total_cost ?? 0) > 0 &&
           item.success_rate !== null &&
           item.sync_status === 'ready'
       )
diff --git a/apps/web/src/services/api/usageService.ts b/apps/web/src/services/api/usageService.ts
index 0b712db70..018af3b6f 100644
--- a/apps/web/src/services/api/usageService.ts
+++ b/apps/web/src/services/api/usageService.ts
@@ -1104,7 +1104,7 @@ export interface MonitoringAccountHistoryItem {
   success_calls: number;
   failure_calls: number;
   total_tokens: number;
-  total_cost: number;
+  total_cost: number | null;
   success_rate: number | null;
   first_seen_ms: number | null;
   last_seen_ms: number | null;

From 5a44237345979108e81d117e9b77e04ce83baee5 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 17:51:22 +0800
Subject: [PATCH 13/16] fix(web): handle unavailable account history cost

---
 apps/web/src/features/accounts/AccountsPage.tsx | 8 ++++++--
 apps/web/src/features/demo/demoFixtures.ts      | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/features/accounts/AccountsPage.tsx b/apps/web/src/features/accounts/AccountsPage.tsx
index 7c3d6678f..962c153ba 100644
--- a/apps/web/src/features/accounts/AccountsPage.tsx
+++ b/apps/web/src/features/accounts/AccountsPage.tsx
@@ -8820,8 +8820,12 @@ export function AccountsPage() {
         key: 'cost',
         icon: <IconDollarSign size={13} />,
         className: styles.accountHistoryMetricCost,
-        value: matched ? formatCompactUsd(accountHistory.total_cost) : '-',
-        exact: matched ? formatUsd(accountHistory.total_cost) : '-',
+        value:
+          matched && accountHistory.total_cost !== null
+            ? formatCompactUsd(accountHistory.total_cost)
+            : '-',
+        exact:
+          matched && accountHistory.total_cost !== null ? formatUsd(accountHistory.total_cost) : '-',
       },
       {
         key: 'success',
diff --git a/apps/web/src/features/demo/demoFixtures.ts b/apps/web/src/features/demo/demoFixtures.ts
index c4575af7d..4f5bd86d8 100644
--- a/apps/web/src/features/demo/demoFixtures.ts
+++ b/apps/web/src/features/demo/demoFixtures.ts
@@ -6067,7 +6067,7 @@ export const getDemoAccountWindowUsage = (
         success_calls: successCalls,
         failure_calls: failureCalls,
         total_tokens: Math.max(1, Math.round(history.total_tokens * ratio)),
-        total_cost: round2(history.total_cost * ratio),
+        total_cost: round2((history.total_cost ?? 0) * ratio),
         success_rate: totalRequests > 0 ? successCalls / totalRequests : null,
         last_seen_ms: resolvedLastSeenMs,
         sync_status: 'ready',

From 921bcbb422c7007a8387fce2a80d477fd5245973 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 18:40:08 +0800
Subject: [PATCH 14/16] fix(usage): isolate account pricing coverage failures

---
 .../monitoring/pricing_coverage_test.go       | 43 ++++++++++++
 .../internal/service/monitoring/service.go    | 67 ++++--------------
 apps/manager-server/internal/store/store.go   | 68 ++++++++++++++-----
 .../internal/store/usage_pricing_coverage.go  | 19 ++++--
 4 files changed, 121 insertions(+), 76 deletions(-)

diff --git a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
index 443a263ce..1b20f4fcd 100644
--- a/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
+++ b/apps/manager-server/internal/service/monitoring/pricing_coverage_test.go
@@ -265,6 +265,49 @@ func TestAccountHistoryDegradesWhenArchivedPricingCannotBeRecovered(t *testing.T
 	}
 }
 
+func TestAccountHistoryIsolatesUnrecoverablePricingByAccount(t *testing.T) {
+	db, sqlDB, _, _ := pricingCoverageFixture(t)
+	ctx := context.Background()
+	request := pricingCoverageAccountRequest()
+	want, err := New(db).AccountHistory(ctx, request)
+	if err != nil || len(want.Items) != 2 || want.Items[0].TotalCost == nil || want.Items[1].TotalCost == nil {
+		t.Fatalf("baseline account history = %#v, %v", want.Items, err)
+	}
+
+	if _, err := sqlDB.ExecContext(ctx, `delete from usage_pricing_account_rollups_v1 where auth_index = 'a';
+		delete from usage_monitoring_event_projection_v1
+		where auth_index = 'a' and event_id not in (select id from usage_events)`); err != nil {
+		t.Fatal(err)
+	}
+	got, err := New(db).AccountHistory(ctx, request)
+	if err != nil || len(got.Items) != len(want.Items) {
+		t.Fatalf("isolated account history = %#v, %v", got.Items, err)
+	}
+
+	wantA := want.Items[0]
+	wantA.TotalCost = nil
+	if !reflect.DeepEqual(got.Items[0], wantA) {
+		t.Fatalf("incomplete account was not isolated: got=%#v want=%#v", got.Items[0], wantA)
+	}
+	if !reflect.DeepEqual(got.Items[1], want.Items[1]) {
+		t.Fatalf("complete account pricing was degraded: got=%#v want=%#v", got.Items[1], want.Items[1])
+	}
+}
+
+func TestAccountHistoryDoesNotHidePricingRecoveryQueryErrors(t *testing.T) {
+	db, sqlDB, _, _ := pricingCoverageFixture(t)
+	ctx := context.Background()
+	if _, err := sqlDB.ExecContext(ctx, `delete from usage_pricing_account_rollups_v1 where auth_index = 'a';
+		alter table usage_monitoring_event_projection_v1
+		rename column normalized_total_input_tokens to unavailable_tokens`); err != nil {
+		t.Fatal(err)
+	}
+	_, err := New(db).AccountHistory(ctx, pricingCoverageAccountRequest())
+	if err == nil || errors.Is(err, store.ErrUsagePricingCoverageIncomplete) {
+		t.Fatalf("pricing recovery query error was hidden: %v", err)
+	}
+}
+
 func TestAccountHistoryDoesNotHideCoreHistoryReadErrors(t *testing.T) {
 	db, sqlDB, _, _ := pricingCoverageFixture(t)
 	ctx := context.Background()
diff --git a/apps/manager-server/internal/service/monitoring/service.go b/apps/manager-server/internal/service/monitoring/service.go
index 6867be6ed..2433040ae 100644
--- a/apps/manager-server/internal/service/monitoring/service.go
+++ b/apps/manager-server/internal/service/monitoring/service.go
@@ -1837,24 +1837,22 @@ func (s *Service) accountHistory(ctx context.Context, req AccountHistoryRequest)
 	loadTotals := func(readKeys []string) (map[string]*accountHistoryTotal, error) {
 		pricingSnapshot, err := s.store.LoadUsagePricingAccountSnapshot(ctx, readKeys)
 		if err != nil {
-			if !errors.Is(err, store.ErrUsagePricingCoverageIncomplete) {
-				return nil, err
-			}
-			rows, rollupErr := s.store.AccountHistoryRollupRows(ctx, readKeys)
-			if rollupErr != nil {
-				return nil, rollupErr
-			}
-			return buildUnpricedAccountHistoryTotals(rows), nil
+			return nil, err
 		}
-		prices := pricingSnapshot.Prices
-		if pricingSnapshot.Available {
-			return buildPricingAccountHistoryTotals(pricingSnapshot.Rows, prices), nil
+		totals := buildPricingAccountHistoryTotals(pricingSnapshot.Rows, pricingSnapshot.Prices)
+		if len(pricingSnapshot.PricingIncompleteAccountKeys) == 0 {
+			return totals, nil
 		}
-		rows, err := s.store.AccountHistoryRollupRows(ctx, readKeys)
-		if err != nil {
-			return nil, err
+		unpricedRows := make([]store.AccountHistoryRollupRow, 0, len(pricingSnapshot.CoreRows))
+		for _, row := range pricingSnapshot.CoreRows {
+			if _, incomplete := pricingSnapshot.PricingIncompleteAccountKeys[row.AccountKey]; incomplete {
+				unpricedRows = append(unpricedRows, row)
+			}
 		}
-		return buildAccountHistoryTotals(rows, prices), nil
+		for key, total := range buildUnpricedAccountHistoryTotals(unpricedRows) {
+			totals[key] = total
+		}
+		return totals, nil
 	}
 	totals, err := loadTotals(keys)
 	if err != nil {
@@ -4212,45 +4210,6 @@ func buildUnpricedAccountHistoryTotals(rows []store.AccountHistoryRollupRow) map
 	return totals
 }
 
-func buildAccountHistoryTotals(rows []store.AccountHistoryRollupRow, prices map[string]store.ModelPrice) map[string]*accountHistoryTotal {
-	totals := map[string]*accountHistoryTotal{}
-	for _, row := range rows {
-		total := totals[row.AccountKey]
-		if total == nil {
-			total = &accountHistoryTotal{costAvailable: true}
-			totals[row.AccountKey] = total
-		}
-		total.requests += row.Calls
-		total.successCalls += row.SuccessCalls
-		total.failureCalls += row.FailureCalls
-		total.totalTokens += row.TotalTokens
-		total.cost += pricing.CostForModelCandidatesWithServiceTier(
-			[]string{row.BillingModel, row.Model},
-			row.ServiceTier,
-			pricing.ModelTokens{
-				InputTokens:             row.InputTokens,
-				OutputTokens:            row.OutputTokens,
-				CachedTokens:            row.CachedTokens,
-				CacheReadTokens:         row.CacheReadTokens,
-				CacheCreationTokens:     row.CacheCreationTokens,
-				LongInputTokens:         row.LongInputTokens,
-				LongOutputTokens:        row.LongOutputTokens,
-				LongCachedTokens:        row.LongCachedTokens,
-				LongCacheReadTokens:     row.LongCacheReadTokens,
-				LongCacheCreationTokens: row.LongCacheCreationTokens,
-			},
-			prices,
-		)
-		if total.firstSeenMS == 0 || (row.FirstSeenMS > 0 && row.FirstSeenMS < total.firstSeenMS) {
-			total.firstSeenMS = row.FirstSeenMS
-		}
-		if row.LastSeenMS > total.lastSeenMS {
-			total.lastSeenMS = row.LastSeenMS
-		}
-	}
-	return totals
-}
-
 func buildPricingAccountHistoryTotals(rows []store.UsagePricingAccountRow, prices map[string]store.ModelPrice) map[string]*accountHistoryTotal {
 	totals := map[string]*accountHistoryTotal{}
 	for _, row := range rows {
diff --git a/apps/manager-server/internal/store/store.go b/apps/manager-server/internal/store/store.go
index 62449ed41..3c9e4ff17 100644
--- a/apps/manager-server/internal/store/store.go
+++ b/apps/manager-server/internal/store/store.go
@@ -133,10 +133,12 @@ type UsageHourlyPricingSnapshot struct {
 }
 
 type UsagePricingAccountSnapshot struct {
-	Rows      []UsagePricingAccountRow
-	State     UsagePricingState
-	Available bool
-	Prices    map[string]ModelPrice
+	CoreRows                     []AccountHistoryRollupRow
+	Rows                         []UsagePricingAccountRow
+	State                        UsagePricingState
+	Available                    bool
+	PricingIncompleteAccountKeys map[string]struct{}
+	Prices                       map[string]ModelPrice
 }
 
 type Store struct {
@@ -720,17 +722,49 @@ func (s *Store) LoadUsagePricingAccountSnapshot(ctx context.Context, accountKeys
 	if err != nil {
 		return UsagePricingAccountSnapshot{}, err
 	}
-	rows, state, available, pricingErr := s.UsagePricing.LoadAccountRowsTx(ctx, tx, accountKeys)
-	if pricingErr != nil || !available || !accountPricingCoverageMatches(coreRows, rows) {
-		rows, err = s.UsagePricing.LoadAccountRowsFromEventsTx(ctx, tx, accountKeys)
-		if err != nil {
-			return UsagePricingAccountSnapshot{}, fmt.Errorf("%w: retained account event query: %w", ErrUsagePricingCoverageIncomplete, err)
+	rows, state, available, err := s.UsagePricing.LoadAccountRowsTx(ctx, tx, accountKeys)
+	if err != nil {
+		return UsagePricingAccountSnapshot{}, err
+	}
+	if !available {
+		rows = nil
+	}
+
+	incomplete := accountPricingCoverageIncompleteKeys(coreRows, rows)
+	if len(incomplete) > 0 {
+		recoveryKeys := make([]string, 0, len(incomplete))
+		for key := range incomplete {
+			recoveryKeys = append(recoveryKeys, key)
 		}
-		if !accountPricingCoverageMatches(coreRows, rows) {
-			return UsagePricingAccountSnapshot{}, ErrUsagePricingCoverageIncomplete
+		recoveredRows, recoveryErr := s.UsagePricing.LoadAccountRowsFromEventsTx(ctx, tx, recoveryKeys)
+		if recoveryErr != nil {
+			return UsagePricingAccountSnapshot{}, recoveryErr
 		}
-		available = true
+
+		recoveryCoreRows := make([]AccountHistoryRollupRow, 0, len(coreRows))
+		for _, row := range coreRows {
+			if _, needsRecovery := incomplete[row.AccountKey]; needsRecovery {
+				recoveryCoreRows = append(recoveryCoreRows, row)
+			}
+		}
+		stillIncomplete := accountPricingCoverageIncompleteKeys(recoveryCoreRows, recoveredRows)
+
+		completeRows := make([]UsagePricingAccountRow, 0, len(rows)+len(recoveredRows))
+		for _, row := range rows {
+			if _, needsRecovery := incomplete[row.AccountKey]; !needsRecovery {
+				completeRows = append(completeRows, row)
+			}
+		}
+		for _, row := range recoveredRows {
+			if _, unresolved := stillIncomplete[row.AccountKey]; !unresolved {
+				completeRows = append(completeRows, row)
+			}
+		}
+		rows = completeRows
+		incomplete = stillIncomplete
 	}
+	available = len(incomplete) == 0
+
 	prices, err := s.ModelPrices.LoadAllTx(ctx, tx)
 	if err != nil {
 		return UsagePricingAccountSnapshot{}, err
@@ -739,10 +773,12 @@ func (s *Store) LoadUsagePricingAccountSnapshot(ctx context.Context, accountKeys
 		return UsagePricingAccountSnapshot{}, err
 	}
 	return UsagePricingAccountSnapshot{
-		Rows:      rows,
-		State:     state,
-		Available: available,
-		Prices:    prices,
+		CoreRows:                     coreRows,
+		Rows:                         rows,
+		State:                        state,
+		Available:                    available,
+		PricingIncompleteAccountKeys: incomplete,
+		Prices:                       prices,
 	}, nil
 }
 
diff --git a/apps/manager-server/internal/store/usage_pricing_coverage.go b/apps/manager-server/internal/store/usage_pricing_coverage.go
index 94b3cf021..209cb744d 100644
--- a/apps/manager-server/internal/store/usage_pricing_coverage.go
+++ b/apps/manager-server/internal/store/usage_pricing_coverage.go
@@ -85,7 +85,7 @@ func addAccountPricingCoverage(grouped map[accountPricingCoverageKey]accountPric
 	grouped[key] = entry
 }
 
-func accountPricingCoverageMatches(core []AccountHistoryRollupRow, prices []UsagePricingAccountRow) bool {
+func accountPricingCoverageIncompleteKeys(core []AccountHistoryRollupRow, prices []UsagePricingAccountRow) map[string]struct{} {
 	coreTotals := make(map[accountPricingCoverageKey]accountPricingCoverage, len(core))
 	priceTotals := make(map[accountPricingCoverageKey]accountPricingCoverage, len(prices))
 	for _, row := range core {
@@ -110,13 +110,20 @@ func accountPricingCoverageMatches(core []AccountHistoryRollupRow, prices []Usag
 				row.LongCacheReadTokens, row.LongCacheCreationTokens, row.TotalTokens,
 			}, row.FirstSeenMS, row.LastSeenMS)
 	}
-	if len(coreTotals) != len(priceTotals) {
-		return false
-	}
+	incomplete := make(map[string]struct{})
 	for key, expected := range coreTotals {
 		if actual, exists := priceTotals[key]; !exists || actual != expected {
-			return false
+			incomplete[key.accountKey] = struct{}{}
 		}
 	}
-	return true
+	for key := range priceTotals {
+		if _, exists := coreTotals[key]; !exists {
+			incomplete[key.accountKey] = struct{}{}
+		}
+	}
+	return incomplete
+}
+
+func accountPricingCoverageMatches(core []AccountHistoryRollupRow, prices []UsagePricingAccountRow) bool {
+	return len(accountPricingCoverageIncompleteKeys(core, prices)) == 0
 }

From 11eb207c830867b5a4ce11951c1950d324154c5d Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 19:33:21 +0800
Subject: [PATCH 15/16] perf(usage): scope retained pricing recovery by account

---
 .../usagepricing/projection_read.go           | 66 +++++++++++---
 .../usagepricing/projection_read_test.go      | 91 +++++++++++++++++++
 .../repository/usagepricing/repository.go     | 15 ++-
 3 files changed, 156 insertions(+), 16 deletions(-)
 create mode 100644 apps/manager-server/internal/repository/usagepricing/projection_read_test.go

diff --git a/apps/manager-server/internal/repository/usagepricing/projection_read.go b/apps/manager-server/internal/repository/usagepricing/projection_read.go
index 5a992a8e4..b1c62bbee 100644
--- a/apps/manager-server/internal/repository/usagepricing/projection_read.go
+++ b/apps/manager-server/internal/repository/usagepricing/projection_read.go
@@ -45,18 +45,21 @@ func (r *repository) LoadHourlyRowsFromEventsTx(ctx context.Context, tx *sql.Tx,
 }
 
 // LoadAccountRowsFromEventsTx uses the same retained event source and exact
-// pricing bands as hourly recovery. The caller must verify core coverage.
+// pricing bands as hourly recovery. The retained projection arm is scoped by
+// account_key before entering the pricing CTE so degraded account-history reads
+// can use the projection's account index instead of scanning retained history.
+// The caller must verify core coverage.
 func (r *repository) LoadAccountRowsFromEventsTx(ctx context.Context, tx *sql.Tx, accountKeys []string) ([]AccountRow, error) {
 	keys := normalizeValues(accountKeys)
 	if len(keys) == 0 {
 		return []AccountRow{}, nil
 	}
-	source, err := retainedEventSourceTx(ctx, tx)
+	source, sourceArgs, err := retainedAccountEventSourceTx(ctx, tx, keys)
 	if err != nil {
 		return nil, err
 	}
 	grouped := map[accountKey]*AccountRow{}
-	if err := mergeAccountRowsFromSource(ctx, tx, 0, keys, grouped, source); err != nil {
+	if err := mergeAccountRowsFromSourceArgs(ctx, tx, 0, keys, grouped, source, sourceArgs); err != nil {
 		return nil, err
 	}
 	return sortedAccountRows(grouped), nil
@@ -155,7 +158,42 @@ func retainedPricingRebuildSourceTx(ctx context.Context, tx *sql.Tx) (string, in
 }
 
 func retainedEventSourceTx(ctx context.Context, tx *sql.Tx) (string, error) {
-	source := "usage_events"
+	coverageID, compatible, err := retainedProjectionCoverageTx(ctx, tx)
+	if err != nil {
+		return "", err
+	}
+	if !compatible || coverageID <= 0 {
+		return "usage_events", nil
+	}
+	return fmt.Sprintf(`(select p.event_id as id, p.%s from %s p where p.event_id <= %d
+		union all select e.id, e.%s from usage_events e where e.id > %d)`,
+		strings.Join(retainedPricingColumns, ", p."), usageprojection.EventTable, coverageID,
+		strings.Join(retainedPricingColumns, ", e."), coverageID,
+	), nil
+}
+
+func retainedAccountEventSourceTx(ctx context.Context, tx *sql.Tx, accountKeys []string) (string, []any, error) {
+	coverageID, compatible, err := retainedProjectionCoverageTx(ctx, tx)
+	if err != nil {
+		return "", nil, err
+	}
+	if !compatible || coverageID <= 0 {
+		return "usage_events", nil, nil
+	}
+	placeholders := strings.TrimRight(strings.Repeat("?,", len(accountKeys)), ",")
+	args := make([]any, 0, len(accountKeys))
+	for _, key := range accountKeys {
+		args = append(args, key)
+	}
+	return fmt.Sprintf(`(select p.event_id as id, p.%s from %s p
+		where p.account_key in (%s) and p.event_id <= %d
+		union all select e.id, e.%s from usage_events e where e.id > %d)`,
+		strings.Join(retainedPricingColumns, ", p."), usageprojection.EventTable, placeholders, coverageID,
+		strings.Join(retainedPricingColumns, ", e."), coverageID,
+	), args, nil
+}
+
+func retainedProjectionCoverageTx(ctx context.Context, tx *sql.Tx) (int64, bool, error) {
 	var schemaVersion int
 	var revision, status string
 	var coverageID int64
@@ -163,16 +201,14 @@ func retainedEventSourceTx(ctx context.Context, tx *sql.Tx) (string, error) {
 		from usage_monitoring_rollup_state where rollup_name = 'projection_v1'`).Scan(
 		&schemaVersion, &revision, &status, &coverageID,
 	)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return "", err
-	}
-	if err == nil && schemaVersion == 1 && coverageID > 0 &&
-		revision == usageidentity.MonitoringProjectionStructureRevision() && status != "clearing" {
-		source = fmt.Sprintf(`(select p.event_id as id, p.%s from %s p where p.event_id <= %d
-			union all select e.id, e.%s from usage_events e where e.id > %d)`,
-			strings.Join(retainedPricingColumns, ", p."), usageprojection.EventTable, coverageID,
-			strings.Join(retainedPricingColumns, ", e."), coverageID,
-		)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return 0, false, nil
+		}
+		return 0, false, err
 	}
-	return source, nil
+	compatible := schemaVersion == 1 &&
+		revision == usageidentity.MonitoringProjectionStructureRevision() &&
+		status != "clearing"
+	return coverageID, compatible, nil
 }
diff --git a/apps/manager-server/internal/repository/usagepricing/projection_read_test.go b/apps/manager-server/internal/repository/usagepricing/projection_read_test.go
new file mode 100644
index 000000000..e4d7078fa
--- /dev/null
+++ b/apps/manager-server/internal/repository/usagepricing/projection_read_test.go
@@ -0,0 +1,91 @@
+package usagepricing
+
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"testing"
+
+	"github.com/seakee/cpa-manager-plus/apps/manager-server/internal/usageidentity"
+	_ "modernc.org/sqlite"
+)
+
+func TestRetainedAccountEventSourceUsesProjectionAccountIndex(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	columns := make([]string, 0, len(retainedPricingColumns)+2)
+	columns = append(columns, "event_id integer primary key", "account_key text not null")
+	for _, column := range retainedPricingColumns {
+		columns = append(columns, column+" text")
+	}
+	if _, err := db.Exec("create table usage_monitoring_event_projection_v1 (" + strings.Join(columns, ",") + ")"); err != nil {
+		t.Fatal(err)
+	}
+	rawColumns := make([]string, 0, len(retainedPricingColumns)+1)
+	rawColumns = append(rawColumns, "id integer primary key")
+	for _, column := range retainedPricingColumns {
+		rawColumns = append(rawColumns, column+" text")
+	}
+	if _, err := db.Exec("create table usage_events (" + strings.Join(rawColumns, ",") + ")"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`create index idx_usage_monitoring_event_projection_account_window
+		on usage_monitoring_event_projection_v1(account_key, timestamp_ms, event_id)`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`create table usage_monitoring_rollup_state (
+		rollup_name text primary key,
+		schema_version integer not null,
+		structure_revision text not null,
+		status text not null,
+		coverage_event_id integer not null
+	)`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`insert into usage_monitoring_rollup_state(
+		rollup_name, schema_version, structure_revision, status, coverage_event_id
+	) values('projection_v1', 1, ?, 'ready', 100)`,
+		usageidentity.MonitoringProjectionStructureRevision()); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	tx, err := db.BeginTx(ctx, &sql.TxOptions{ReadOnly: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tx.Rollback()
+	source, args, err := retainedAccountEventSourceTx(ctx, tx, []string{"account-a", "account-b"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(source, "p.account_key in (?,?)") {
+		t.Fatalf("retained account source is not account-scoped: %s", source)
+	}
+
+	rows, err := tx.QueryContext(ctx, "explain query plan select id from "+source+" retained", args...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var details []string
+	for rows.Next() {
+		var id, parent, unused int
+		var detail string
+		if err := rows.Scan(&id, &parent, &unused, &detail); err != nil {
+			t.Fatal(err)
+		}
+		details = append(details, detail)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	plan := strings.Join(details, "\n")
+	if !strings.Contains(plan, "idx_usage_monitoring_event_projection_account_window") {
+		t.Fatalf("retained account projection plan does not use account index: %s", plan)
+	}
+}
diff --git a/apps/manager-server/internal/repository/usagepricing/repository.go b/apps/manager-server/internal/repository/usagepricing/repository.go
index 2a5ef82ed..8de5232d7 100644
--- a/apps/manager-server/internal/repository/usagepricing/repository.go
+++ b/apps/manager-server/internal/repository/usagepricing/repository.go
@@ -1155,6 +1155,18 @@ func mergeAccountRowsFromSource(
 	accountKeys []string,
 	grouped map[accountKey]*AccountRow,
 	source string,
+) error {
+	return mergeAccountRowsFromSourceArgs(ctx, tx, afterID, accountKeys, grouped, source, nil)
+}
+
+func mergeAccountRowsFromSourceArgs(
+	ctx context.Context,
+	tx *sql.Tx,
+	afterID int64,
+	accountKeys []string,
+	grouped map[accountKey]*AccountRow,
+	source string,
+	sourceArgs []any,
 ) error {
 	placeholders := strings.TrimRight(strings.Repeat("?,", len(accountKeys)), ",")
 	query := bandedEventsFromSourceCTE("e.id > ?", source) + fmt.Sprintf(`
@@ -1195,7 +1207,8 @@ func mergeAccountRowsFromSource(
 		usage.LongContextInputTokenThreshold,
 		placeholders,
 	)
-	args := make([]any, 0, len(accountKeys)+1)
+	args := make([]any, 0, len(sourceArgs)+len(accountKeys)+1)
+	args = append(args, sourceArgs...)
 	args = append(args, afterID)
 	for _, key := range accountKeys {
 		args = append(args, key)

From 66151fcf138c2beecdaeb9eec0999da3b0e3f480 Mon Sep 17 00:00:00 2001
From: seakee <seakee23@gmail.com>
Date: Wed, 30 Sep 2026 20:03:40 +0800
Subject: [PATCH 16/16] chore(release): prepare v1.14.2

---
 docs/release-notes/v1.14.2-en.md         | 38 ++++++++++++++++
 docs/release-notes/v1.14.2-zh.md         | 56 ++++++++++++++++++++++++
 docs/release-posts/v1.14.2-telegram.html | 17 +++++++
 3 files changed, 111 insertions(+)
 create mode 100644 docs/release-notes/v1.14.2-en.md
 create mode 100644 docs/release-notes/v1.14.2-zh.md
 create mode 100644 docs/release-posts/v1.14.2-telegram.html

diff --git a/docs/release-notes/v1.14.2-en.md b/docs/release-notes/v1.14.2-en.md
new file mode 100644
index 000000000..7284b5c1f
--- /dev/null
+++ b/docs/release-notes/v1.14.2-en.md
@@ -0,0 +1,38 @@
+# CPA Manager Plus v1.14.2
+
+> 21 commits · 25 files changed · +1096 / -171
+
+> [中文 ->](https://github.com/seakee/CPA-Manager-Plus/blob/v1.14.2/docs/release-notes/v1.14.2-zh.md)
+
+## Overview
+
+v1.14.2 is a stability patch for v1.14.1 focused on CPA v8 configuration compatibility and the model-pricing/account-history failures exposed after Usage Maintenance archives raw history.
+
+After CPA v8 moved client API keys to `access.api-keys`, the legacy read path could show an empty API Key list when Settings was opened for the first time. This release reads the effective v8 field while retaining compatibility with older configurations. For databases that already ran supported usage archive cleanup, model-price structural changes can now rebuild pricing when the retained monitoring projection proves the deleted history completely. If exact historical pricing for an individual account can no longer be recovered, account history no longer fails the whole request with HTTP 500: only that account's estimated cost becomes unavailable while trusted request, token, success/failure, seen-range, and recent-request metrics remain available.
+
+## Highlights
+
+### Fixes
+
+- Fix client API keys appearing empty on initial Settings load or reload after CPA v8 moved them to `access.api-keys`; an explicitly present v8 field takes precedence while older layouts keep their compatibility fallback. (Web / CPA compatibility)
+- Fix model-price structural sync becoming permanently blocked after supported Usage Maintenance archive cleanup; pricing rebuilds can reuse retained monitoring history when deleted coverage is fully provable, while genuinely incomplete legacy history remains fail-closed. (Manager Server)
+- Fix account-history requests failing completely when historical pricing cannot be reconstructed exactly; only affected accounts now return `total_cost: null` and render `-`, while healthy accounts keep exact cost and the remaining trusted historical metrics stay available. (Manager Server / Web)
+
+### CI
+
+- Add bounded retries for idempotent GitHub API reads and PATCH updates in update-index publication, reducing the chance that transient transport failures leave GitHub Latest or the update channel on an older version; non-idempotent POST Git-object writes remain non-retryable. (Release)
+
+## Upgrade Notes
+
+- No database migration or configuration change is required.
+- Instances that already ran supported Usage Maintenance cleanup do not need to restore deleted raw usage; only history that can be proven exactly from the retained projection participates in pricing rebuilds.
+- Accounts whose historical prices cannot be recovered exactly show `-` for cost rather than a synthesized estimate; other trusted history metrics remain available.
+- The full Muse / Meta compatibility baseline remains **CPA v7.3.4+**; this release does not raise the minimum CPA compatibility baseline.
+
+## Acknowledgements
+
+- @camy-x - Fixed initial CPA v8 client API key loading compatibility (#887).
+
+---
+
+**Full Changelog**: https://github.com/seakee/CPA-Manager-Plus/compare/v1.14.1...v1.14.2
diff --git a/docs/release-notes/v1.14.2-zh.md b/docs/release-notes/v1.14.2-zh.md
new file mode 100644
index 000000000..3d89dff6c
--- /dev/null
+++ b/docs/release-notes/v1.14.2-zh.md
@@ -0,0 +1,56 @@
+# CPA Manager Plus v1.14.2
+
+> 21 commits · 25 files changed · +1096 / -171
+
+> [English ->](https://github.com/seakee/CPA-Manager-Plus/blob/v1.14.2/docs/release-notes/v1.14.2-en.md)
+
+<!-- cpamp-update
+{
+  "summary": {
+    "zh": "修复 CPA v8 客户端 API Key 初始读取，并恢复用量清理后的模型定价同步与账号历史降级能力。",
+    "en": "Fixes initial CPA v8 client API key loading and restores model-pricing sync plus graceful account-history degradation after usage cleanup."
+  },
+  "update": {
+    "breaking": false,
+    "migration_required": false,
+    "minimum_direct_upgrade_version": null,
+    "upgrade_guide_url": "https://github.com/seakee/CPA-Manager-Plus/releases/tag/v1.14.2"
+  },
+  "compatibility": {
+    "minimum_cpa_version": "v7.3.4"
+  }
+}
+-->
+
+## Overview
+
+v1.14.2 是 v1.14.1 的稳定性补丁版本，集中修复 CPA v8 配置兼容和 Usage Maintenance 清理历史数据后暴露出的模型定价、账号历史查询问题。
+
+CPA v8 将客户端 API Key 移到 `access.api-keys` 后，旧读取路径会让设置页在首次打开时显示空列表；本版本按 v8 有效字段读取，同时保留旧配置兼容。对于已经执行过受支持用量归档清理的数据库，模型价格结构变更现在可以在保留的 monitoring projection 足够完整时重建定价；若个别账号的历史定价已经无法精确恢复，账号历史不再整体返回 500，而是只将该账号的预估费用降级为不可用，同时保留请求数、Token、成功率、时间范围和最近请求等可信指标。
+
+## Highlights
+
+### Fixes
+
+- 修复 CPA v8 使用 `access.api-keys` 后，设置页首次打开或重新加载时客户端 API Key 列表为空的问题；显式存在的 v8 字段优先，旧配置继续使用兼容回退。（Web / CPA compatibility）
+- 修复执行受支持的 Usage Maintenance 归档清理后，模型价格结构同步可能被永久阻止的问题；当已删除历史可由保留的 monitoring projection 完整证明时，定价重建会复用保留历史，真正不完整的旧数据仍保持 fail-closed。（Manager Server）
+- 修复历史定价无法完整恢复时账号历史接口整体失败的问题；现在只对受影响账号返回 `total_cost: null`，前端显示为 `-`，同批次健康账号继续保留精确费用，其余永久历史指标仍可用。（Manager Server / Web）
+
+### CI
+
+- 发布链路的 update-index GitHub API 读取与 PATCH 更新增加有限重试，降低瞬时网络错误导致 GitHub Latest / 更新通道停留在旧版本的概率；非幂等 POST Git 对象写入仍不自动重试。（Release）
+
+## Upgrade Notes
+
+- 无需数据库迁移或配置变更。
+- 已执行受支持 Usage Maintenance 清理的实例无需恢复已删除原始用量；只有能由现有保留 projection 精确证明的历史才会参与定价重建。
+- 对无法精确恢复历史价格的账号，费用会显示为 `-`，不会合成或猜测金额；其他可信历史指标继续显示。
+- 完整 Muse / Meta 功能的 CPA 基线继续为 **v7.3.4+**；本版本没有提高最低兼容基线。
+
+## Acknowledgements
+
+- @camy-x - 修复 CPA v8 客户端 API Key 初始读取兼容问题（#887）。
+
+---
+
+**Full Changelog**: https://github.com/seakee/CPA-Manager-Plus/compare/v1.14.1...v1.14.2
diff --git a/docs/release-posts/v1.14.2-telegram.html b/docs/release-posts/v1.14.2-telegram.html
new file mode 100644
index 000000000..3b1aa9de1
--- /dev/null
+++ b/docs/release-posts/v1.14.2-telegram.html
@@ -0,0 +1,17 @@
+🚀 <b>9 月 30 日 · v1.14.2</b>
+
+🛠 <b>CPA v8 配置与清理后历史定价修复</b>
+
+• 修复 CPA v8 使用 <code>access.api-keys</code> 后，设置页首次打开或重新加载时客户端 API Key 列表为空的问题。
+• 修复执行受支持 Usage Maintenance 清理后，模型价格结构同步可能被永久阻止的问题；保留历史完整时可继续安全重建定价。
+• 当个别账号的历史价格已经无法精确恢复时，不再让整批账号历史查询失败；仅该账号费用显示为 <code>-</code>，其他可信历史指标和健康账号的精确费用继续可用。
+
+⚠️ <b>升级说明</b>
+
+• 无需数据库迁移或配置变更。
+• 已清理的原始用量不会被恢复或猜测；只有可由现有保留数据完整证明的历史才参与定价重建。
+• 完整 Muse / Meta 功能的 CPA 基线继续为 <code>v7.3.4+</code>。
+
+🙏 <b>致谢</b>
+
+• <a href="https://github.com/camy-x">@camy-x</a> - 修复 CPA v8 客户端 API Key 初始读取兼容问题。