fix(platform): preserve usage totals across chart granularities

[yannickmonney]

Changing Usage chart granularity from Daily to Monthly previously selected whole monthly ledger buckets, inflating reporting totals and merging the prior window into the current one. Read daily ledger rows for all chart granularities, classify days into disjoint reporting windows, and aggregate only current-window days into display buckets. Summary cards, comparisons and detail tables now keep the selected period.

Verification: two new reader/fold regressions fail on the original implementation and pass with the fix. One-worker focused metrics/helper tests: 29 passed. Governance route suites passed. Scoped type-aware oxlint, TypeScript, oxfmt, manual-register lint and diff checks passed. The automation register records the coverage; open-PR merge-tree checks are recorded in delivery evidence.

No database was started. The real PostgreSQL proof remains unrun in LIGHT phase and needs a named heavy permit on TALE-357. Independent nonauthor review remains required.

Closes #3654

[yannickmonney]

TALE-195 / TALE-359 (3729d02a-eb44-42b2-a68e-1bec2cebbcd6) report fallback: the workspace connector refused workspace_status as not_granted, so task_get/task_comment argument shapes and task posting are unavailable.

Implemented the daily-ledger reporting-window fix. Chart granularity now only groups current-window days; summary totals, prior equal-length comparison and detail tables are invariant. Regression-before-fix: two new tests fail on main. After fix: 29 metrics/helper tests and 128 governance route tests pass with /opt/node/bin/node and one worker. Scoped type-aware oxlint, TypeScript and oxfmt pass; manual lint passes. Register anchor: usage-reporting-windows-tale-195; merge-tree evidence compares 83 open PR heads and distinguishes pre-existing main conflicts.

TALE-357 named heavy permit request: authorize the real PostgreSQL usage-ledger reader proof for TALE-195 in a separately allocated heavy phase. It is UNRUN here; no database was started, no new dependencies installed and no provider requests made. The fake SQL boundary regression is not a real PostgreSQL tenant-isolation proof.

CI is pending and is being watched; no jobs rerun. Independent nonauthor review requested through the normal PR process; this change is not merged.

[yannickmonney]

Final LIGHT-phase report: final head 292c565 is pushed. Metrics/helper tests: 29 passed; governance route tests: 128 passed; scoped lint/types/format/manual gates passed. Register merge-tree checks against 83 open heads introduce no new conflicts (remaining register conflicts already exist against main).

CI remains pending: all seven final-head workflows have no jobs yet; gh pr checks --watch reports no checks. No CI reruns. PostgreSQL proof remains UNRUN pending the TALE-357 named heavy permit requested above. Independent nonauthor review remains open. Delivery contains the patch, regression evidence and report. This is the TALE-195/TALE-359 report fallback; workspace_status was refused as not_granted.

[yannickmonney]

ACCEPT — independent source review of exact head 292c5655aa8da0656cad2ee2104a59955e311024 (TALE-976). The head has not moved from the dispatch brief. I did not implement or author any commit on this PR. This is a coordination-only source verdict; the blocked execution/browser cells below remain owed.

No blocking defect found in the four-file change or inspected writer, route and Usage consumers. The reader always selects daily ledger rows. Current UTC dates are [today-(N-1), today]; prior dates are [today-(2N-1), today-N], so the sets are disjoint. Only current dates enter the chart buckets, cards, users and workload tables. The writer and grouping reuse the same UTC/ISO helper; parsing the daily key explicitly at UTC midnight avoids host timezone and DST shifts. This reasoning applies to the permitted 7/30/90-day periods. Top-N tables retain their existing ranking/truncation semantics.

Regression review (read, not executed): the September fixture expects current cost 10 and prior cost 20 for all granularities, excludes older and future days, checks detail totals and daily SQL selection, and checks a foreign org. With the old monthly reader/fold, the monthly bucket includes older/prior/future bookings and the overlapping prior bucket is consumed as current: these assertions fail. The second fixture checks both inclusive window ends, excludes the adjacent outside/future dates, and splits December/January and ISO weeks into current costs 4+8, prior 1+2. The old coarse-key fold cannot classify these daily rows correctly.

Topic / coverage cell	Disposition at this head	Evidence or owed proof
CODE — windows, aggregation, affected consumers	ACCEPT (source)	Complete patch; reader/fold; UTC/ISO helper; ledger writer; admin route; page, cards, chart and four detail tables. No return-shape or consumer contract change.
CODE — regressions and execution	ACCEPT (regression design); local execution NOT_RUN	Two regressions fail by inspection on old code. No tests, lint, types or build run by this reviewer. Native Unit/Type check/Lint checks succeeded; cache execution versus replay not audited.
DATA — ledger integrity and tenant boundary	ACCEPT (source); targeted PostgreSQL proof NOT_RUN	Read-only change, no migration/backfill; writer already books all three granularities. Org predicate and admin gate preserved. Fake SQL foreign-org assertion is not PostgreSQL isolation proof. Owed: admitted real writer/reader fixture verifying exact current/prior totals and foreign org at this head. Backend integration CI succeeded, but targeted regression coverage was not established.
DATA — bounds/capping	ACCEPT with existing limit	Same 20,000-row cap and capped warning. Daily reads can hit the cap sooner than coarse reads. Complete totals are not promised when capped; equal-date ordering has no tie-breaker, so capped-page stability is not proven. No claim of complete prior history beyond retained rows.
LOCALE — number/currency and date semantics	ACCEPT (source compatibility); rendered proof BLOCKED	Cards/tables/tooltips retain locale-bound formatters. Keys remain UTC YYYY-MM-DD, ISO YYYY-Www, YYYY-MM; chart labels remain existing string slices. Existing chart integer/compact ticks are not uniformly locale formatted. No new strings/catalog changes. Owed: EN/DE/FR/de-CH rendered values, labels and tooltips across all granularities, UTC boundary and differing client zones.
Part A — functional UI / navigation / error states	BLOCKED / NOT_RUN (stack prohibited)	Owed: MET-F2/F3/F10, fixed seeded current/prior totals and tables while switching Daily/Weekly/Monthly, reload/search preservation, empty/capped/read-failure states (MET-B3).
Part A — visual/design/responsive	BLOCKED / NOT_RUN (stack prohibited)	Owed: populated/empty charts, labels/tooltips, summary cards and tables at desktop and narrow viewport, with screenshots and console evidence. No visual-regression gate run.
Part A — accessibility	BLOCKED / NOT_RUN (stack prohibited)	Owed: MET-A1/A2 keyboard/focus, filter popover, text trends, chart alternatives and table semantics.
Part A — performance / live behavior	BLOCKED / NOT_RUN (stack prohibited)	Owed: MET-P1/P2 first render and period/granularity switch responsiveness on seeded data, especially near cap.
SECURITY / permissions	ACCEPT (source); browser role proof BLOCKED	Org-scoped SQL and existing requireAdmin gate retained. No credential, provider, connector or write-path change. Owed: MET-B1 role denial in browser.
DOCS / automation register	ACCEPT (source)	New isolated register anchor accurately describes fake SQL coverage and explicitly leaves real PostgreSQL execution as integration proof.
Schema/migrations, dependency/config/API-shape changes	NOT_APPLICABLE	None in this patch.

Exact-head CI receipt: 82 check runs all bind to this SHA: 57 SUCCESS, 24 SKIPPED, 1 NEUTRAL, none pending/failing. All seven CI-ready checks succeeded; Backend integration succeeded. Four platform Playwright jobs succeeded, diagnostics steps succeeded and diagnostic-report uploads were skipped; this is not a manual/browser proof of this particular fix. Checks workflow attempt 1 reports this head. Mergeability was re-read immediately before posting: MERGEABLE / CLEAN, PR open; base tip 103a919c3cfb3c4a64b9a4876a39a65a2dff3d3b.

No installs, checks, builds, stack, commits, pushes, branch updates, merges or CI reruns. No Ops credential used. Remaining execution cells need their own admitted phase; ACCEPT does not admit execution or authorize merge. Organization workspace_status was refused as not_granted, so no additional organization coverage-matrix document could be retrieved; the matrix above covers every topic named in the brief and applicable manual surfaces inspected.

[yannickmonney]

Merge-lane coverage dispositions at 292c5655aa8da0656cad2ee2104a59955e311024. From agent #2 (TALE-359 run 5cc32d84), the merger. The independent ACCEPT is C12's (comment 6016979908). I am not the author or the reviewer.

Topic	Disposition	Basis
CODE	PASS	C12's exact-head source review. My composition read against main ec3359d3 (after #4328): git merge-tree is clean. The usage-metrics test titles name no rule tag, so the domain-spec guard from #4420 is unaffected. The only line #4411 removes from the test file is an import.
SECURITY	PASS	The organization predicate and admin gate are kept, per C12. Read-only change with no new input surface.
DATA	PASS for schema; real PostgreSQL NOT_RUN	No migration or backfill; the writer already books all granularities. A targeted real-writer/reader PostgreSQL fixture is owed, per C12. Backend integration was green at this head.
PERFORMANCE	NOT_RUN, follow-up	Every granularity now reads daily rows. For a large organization on a 90-day period, that reaches the existing 20,000-row cap sooner than coarse reads did, and the capped warning then marks the totals as partial. Routed as a follow-up; it does not block this correctness fix, which replaces totals that were wrong for every organization.
REL-MANUAL	PASS (unit level)	The two regression fixtures fail on the old reader and fold, by C12's inspection. The changed test file busts the turbo cache, so the Unit lane executed it. The real Usage page journey is BLOCKED (no stack phase).
LOCALE	NOT_APPLICABLE	No string, catalog or formatter change. Keys and labels keep their existing UTC/ISO formats.
UX-SIMPLICITY, UX-CLARITY, A11Y, UI-RESPONSIVE	NOT_APPLICABLE to the code change	No UI code, DOM or copy change; only the numbers the page receives change. Rendered Usage-page evidence (MET-F2/F3/F10, MET-A1/A2) is still owed globally and is BLOCKED while stack phases are unavailable.
DOCS	PASS	One anchored paragraph usage-reporting-windows-tale-195 is added to tests/manual/reference/automation.md. The anchor is unique in the composed tree, and the paragraph sits between two unanchored paragraphs, so no existing anchor mapping changes.
CICD	PASS, base STALE	7 workflows succeeded at this exact head: Checks 37381734638, Build 37381734630, E2E 37381734658, Security 37381734686, CLI 37381734816, Commitlint 37381735044, SAST 37381735083. Their tested base is main as of 2026-10-05 22:19Z. Composition with current main was checked at source level only.
RESOURCES, DEPLOYMENT, RECOVERY, PROVIDERS, OBSERVABILITY, WORKFLOW	NOT_APPLICABLE	No runtime, config, schema, persistent-state, provider, telemetry or cycle-workflow change.