@knpkv/jira-clockify 1.4.1 → 1.6.0

package/dist/src/services/ReconcileService.js

@@ -21,36 +21,40 @@
  *
  * @module
  */
-import { ClockifyApi, make as makeClockifyApi } from "@knpkv/clockify-api-client";
-import { JiraApiClient, make as makeJiraApi } from "@knpkv/jira-api-client";
-import { JiraAuth } from "@knpkv/jira-cli/JiraAuth";
+import { ClockifyApi } from "@knpkv/clockify-api-client";
+import { JiraApiClient } from "@knpkv/jira-api-client";
 import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
-import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Predicate from "effect/Predicate";
-import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
-import { activeWindows, attributeSession, bothSides, buildSessionProposals, deterministicAttribution, expandHomePath, splitCredits } from "../agent/sessions.js";
+import { activeWindows, attributeSession, bothSides, buildSessionProposals, deterministicAttribution, expandHomePath, mergeSpansWithinDays, splitCredits, splitSessionAttribution } from "../agent/sessions.js";
 import * as SourceConsumption from "../agent/sourceConsumption.js";
 import * as WriterGuard from "../cli/writerGuard.js";
+import { CONNECT_JIRA_COMMAND, NOT_LOGGED_IN_HINT } from "../utils/hints.js";
 import { localDay, nextLocalMidnight, splitIntervalByLocalDay } from "../utils/time.js";
 import { AgentSessionReader } from "./AgentSessionReader.js";
-import { ClockifyAuth } from "./ClockifyAuth.js";
 import { ConfigService } from "./ConfigService.js";
 import { HomeDirectory } from "./HomeDirectory.js";
 import { postJiraWorklog } from "./internal/JiraWorklogPost.js";
+import { retryTransport } from "./internal/retryTransport.js";
+import { JiraAccess } from "./JiraAccess.js";
 import { readJiraDeletionEvidence } from "./ProviderDeletion.js";
+import { make as makeProviderSnapshots } from "./ProviderSnapshots.js";
 import { jiraWorklogDescription } from "./SavedEntries.js";
 import { SessionAttributor } from "./SessionAttributor.js";
 import { SourceLedger } from "./SourceLedger.js";
+import { candidateFact, readRankingFacts, ticketPriority } from "./TicketRanking.js";
 import { TimerService } from "./TimerService.js";
+/** Concurrent Jira worklog reads per tally. Bounded so a large week does not trip rate limits. */
+const JIRA_WORKLOG_READ_CONCURRENCY = 8;
 export { bothSides } from "../agent/sessions.js";
 const mergeIntervals = (intervals) => {
     const sorted = [...intervals].sort((left, right) => left.startMs - right.startMs || left.endMs - right.endMs);
@@ -137,6 +141,23 @@ const batchRequests = (requests) => {
         batches.push(current);
     return batches;
 };
+/** Raw ignored presence, unioned per ticket/day so parallel sessions on one key never duplicate it. */
+const ignoredCredits = (evidence, ignoredTickets) => {
+    const windowsByTicket = new Map();
+    for (const window of evidence) {
+        if (window.ticketKey === null || !ignoredTickets.has(window.ticketKey))
+            continue;
+        windowsByTicket.set(window.ticketKey, [...(windowsByTicket.get(window.ticketKey) ?? []), ...window.spans]);
+    }
+    return [...windowsByTicket].flatMap(([ticketKey, spans]) => {
+        const secondsByDay = new Map();
+        for (const span of mergeSpansWithinDays(spans)) {
+            const day = localDay(new Date(span.startMs));
+            secondsByDay.set(day, (secondsByDay.get(day) ?? 0) + (span.endMs - span.startMs) / 1000);
+        }
+        return [...secondsByDay].map(([day, seconds]) => ({ ticketKey, day, seconds: Math.floor(seconds) }));
+    }).sort((a, b) => a.ticketKey.localeCompare(b.ticketKey) || a.day.localeCompare(b.day));
+};
 /**
  * Provider totals that may size a write. Compatibility Jira rows remain visible, but cannot settle
  * an executable gap until the same credential and account have been verified.
@@ -307,10 +328,8 @@ const toRawWorklog = (value) => {
     };
 };
 export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
-    const clockifyAuth = yield* ClockifyAuth;
     const jira = yield* JiraApiClient;
-    const jiraAuth = yield* JiraAuth;
-    const httpClient = yield* HttpClient.HttpClient;
+    const jiraAccess = yield* JiraAccess;
     const config = yield* ConfigService;
     const fileSystem = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -320,68 +339,9 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
     const attributor = yield* SessionAttributor;
     const sourceLedger = yield* SourceLedger;
     const provideGuard = (effect) => effect.pipe(Effect.provideService(ConfigService, config), Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path.Path, path));
-    const getAuth = clockifyAuth.getConfig.pipe(Effect.mapError((e) => new ReconcileError({ message: e.message })));
-    /** One decoded credential and endpoint back every Clockify read and write in this operation. */
-    const clockifyWriteSnapshot = Effect.gen(function* () {
-        const auth = yield* getAuth;
-        const endpoint = yield* Effect.try({
-            try: () => new URL(auth.baseUrl),
-            catch: (cause) => new ReconcileError({ message: "Configured Clockify endpoint is invalid", cause })
-        });
-        if (!["https:", "http:"].includes(endpoint.protocol) || endpoint.username !== "" ||
-            endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "")
-            return yield* new ReconcileError({ message: "Configured Clockify endpoint is invalid" });
-        const canonicalEndpoint = `${endpoint.origin}${endpoint.pathname.replace(/\/+$/u, "")}`;
-        const pinnedAuth = { ...auth, baseUrl: canonicalEndpoint };
-        const client = makeClockifyApi(httpClient, pinnedAuth);
-        const user = yield* client.getLoggedUser(undefined).pipe(Effect.mapError((cause) => new ReconcileError({ message: "Cannot verify the Clockify account", cause })));
-        if (user.id === "" || auth.userId !== user.id || auth.workspaceId === "" || auth.baseUrl === "") {
-            return yield* new ReconcileError({ message: "Configured Clockify account does not match the credential" });
-        }
-        return {
-            auth: pinnedAuth,
-            client,
-            scope: JSON.stringify(["clockify-v3", canonicalEndpoint, auth.workspaceId, user.id]),
-            legacyScope: JSON.stringify([auth.workspaceId, user.id])
-        };
-    });
-    /** Bind verification and worklog POST to one OAuth credential and selected site. */
-    const jiraWriteState = Effect.gen(function* () {
-        const login = yield* Effect.result(jiraAuth.isLoggedIn());
-        if (login._tag === "Failure")
-            return { availability: "unverified", snapshot: null };
-        if (!login.success)
-            return { availability: "not-logged-in", snapshot: null };
-        const tokenResult = yield* Effect.result(jiraAuth.getAccessToken());
-        const profileResult = yield* Effect.result(jiraAuth.getActiveProfile());
-        if (tokenResult._tag === "Failure" || profileResult._tag === "Failure") {
-            return { availability: "unverified", snapshot: null };
-        }
-        const token = tokenResult.success;
-        const profile = profileResult.success;
-        if (profile === null || profile.token.cloud_id === "" || profile.token.site_url === "" ||
-            profile.token.access_token !== Redacted.value(token))
-            return { availability: "unverified", snapshot: null };
-        const client = makeJiraApi(httpClient, {
-            baseUrl: "",
-            auth: { type: "oauth2", accessToken: token, cloudId: profile.token.cloud_id }
-        });
-        const live = yield* client.getCurrentUser({}).pipe(Effect.orElseSucceed(() => null));
-        if (live?.accountId === undefined || live.accountId === "") {
-            return { availability: "unverified", snapshot: null };
-        }
-        return {
-            availability: "verified",
-            snapshot: {
-                client,
-                ledgerScope: JSON.stringify([profile.token.cloud_id, live.accountId]),
-                heldScope: JSON.stringify([profile.token.cloud_id, profile.token.site_url, live.accountId]),
-                accountId: live.accountId,
-                cloudId: profile.token.cloud_id,
-                siteUrl: profile.token.site_url
-            }
-        };
-    });
+    const providerSnapshots = yield* makeProviderSnapshots;
+    const clockifyWriteSnapshot = providerSnapshots.clockify.pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
+    const jiraWriteState = providerSnapshots.jira;
     const jiraWriteSnapshot = jiraWriteState.pipe(Effect.map((state) => state.snapshot));
     /**
      * How many entries to ask Clockify for at a time, and how many pages to accept.
@@ -472,9 +432,9 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         let nextStartAt = 0;
         let expectedTotal;
         for (;;) {
-            const page = yield* client.getIssueWorklog(issueKey, {
+            const page = yield* retryTransport(client.getIssueWorklog(issueKey, {
                 params: { startAt: nextStartAt, startedAfter, startedBefore }
-            }).pipe(Effect.mapError((cause) => new ReconcileError({ message: `Jira worklog fetch failed for ${issueKey}: ${String(cause)}`, cause })));
+            })).pipe(Effect.mapError((cause) => new ReconcileError({ message: `Jira worklog fetch failed for ${issueKey}: ${String(cause)}`, cause })));
             const { maxResults, startAt, total, worklogs: entries } = page;
             if (startAt !== nextStartAt ||
                 maxResults === undefined || !Number.isSafeInteger(maxResults) || maxResults < 0 ||
@@ -507,13 +467,21 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         }
     });
     // Tally the current user's Jira worklogs in the period by (ticket, day).
-    const jiraTally = (period, requiredIssueKeys = [], pinned = undefined) => Effect.gen(function* () {
+    const jiraTally = (period, requiredIssueKeys = [], pinned = undefined, 
+    /**
+     * `window` searches every issue I logged in the period and adds the required keys;
+     * `required-only` reads just the required keys, to top up a tally that already searched.
+     */
+    scope = "window") => Effect.gen(function* () {
         // A verified snapshot pins the account, site and credential-backed client for every page.
         // Falling back is only for a side without a usable write credential; that side cannot be
         // written because its source scope remains null, but independent providers may still proceed.
         const snapshot = pinned === undefined ? yield* jiraWriteSnapshot : pinned;
         const client = snapshot?.client ?? jira;
-        const cachedAccountId = (yield* jiraAuth.getCurrentUser().pipe(Effect.mapError((cause) => new ReconcileError({ message: "Could not read the Jira account", cause }))))?.account_id;
+        const connection = yield* jiraAccess.connection.pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
+        const cachedAccountId = Option.isSome(connection) && connection.value.accountId !== ""
+            ? connection.value.accountId
+            : undefined;
         if (snapshot !== null && snapshot !== undefined && cachedAccountId !== snapshot.accountId) {
             return yield* new ReconcileError({
                 message: "The cached Jira account does not match the verified credential"
@@ -522,7 +490,9 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         const accountId = snapshot?.accountId ?? cachedAccountId;
         if (accountId === undefined || accountId === "") {
             return yield* new ReconcileError({
-                message: "Jira account identity is unavailable; recorded time cannot be tallied"
+                message: Option.isNone(connection)
+                    ? NOT_LOGGED_IN_HINT
+                    : `Jira did not say which account is connected. Run ${CONNECT_JIRA_COMMAND} again.`
             });
         }
         const fromMs = period.from.getTime();
@@ -542,19 +512,19 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         // "Jira is short by the whole day" — which `watch` would then post on top of hours Jira
         // already holds. A window of more than a hundred distinct issues is an ordinary week.
         const jql = `worklogAuthor = currentUser() AND worklogDate >= "${fromDay}" AND worklogDate <= "${toDay}"`;
-        const searchPage = (pageToken) => client.searchIssuesUsingJql({
+        const searchPage = (pageToken) => retryTransport(client.searchIssuesUsingJql({
             params: {
                 jql,
                 maxResults: 100,
                 fields: ["key"],
                 ...((pageToken !== undefined) && { nextPageToken: pageToken })
             }
-        }).pipe(Effect.mapError((e) => new ReconcileError({ message: `Jira search failed: ${String(e)}`, cause: e })));
+        })).pipe(Effect.mapError((e) => new ReconcileError({ message: `Jira search failed: ${String(e)}`, cause: e })));
         const searched = [];
         let pageToken = undefined;
         // Bounded so a server that keeps handing back a token cannot spin here for ever; hitting the
         // bound fails the run rather than proceeding on a partial tally.
-        for (let page = 0; page < 50; page++) {
+        for (let page = 0; scope === "window" && page < 50; page++) {
             const result = yield* searchPage(pageToken);
             const issues = Predicate.isObject(result) ? result["issues"] : undefined;
             // A page with no `issues` at all is not an empty page. The generated success schema makes
@@ -601,8 +571,12 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         }
         const toMs = period.to.getTime();
         const tally = [];
-        for (const issueKey of issueKeys) {
-            const worklogs = yield* readJiraWorklogs(client, issueKey, lookupFromMs - 1, toMs);
+        // Every issue's worklogs are read before any is tallied, a few at a time: a week of forty
+        // tickets read one after another made every confirmation wait on forty round trips. Tallying
+        // stays in issue order, so the result is the same as a sequential read.
+        const worklogsByIssue = yield* Effect.forEach(issueKeys, (issueKey) => readJiraWorklogs(client, issueKey, lookupFromMs - 1, toMs), { concurrency: JIRA_WORKLOG_READ_CONCURRENCY });
+        for (const [issueIndex, issueKey] of issueKeys.entries()) {
+            const worklogs = worklogsByIssue[issueIndex] ?? [];
             for (const wl of worklogs) {
                 // Only this user's worklogs (the JQL narrows issues, not individual worklog authors).
                 const author = wl.author?.accountId;
@@ -641,9 +615,11 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         // A side that is out is not called at all. That is the point of the option for someone who
         // tracks in one system: no Clockify workspace to configure, no Jira login to keep alive, and
         // no request whose failure could stop a run that never needed it.
-        const jiraSideRead = sides.jira
-            ? jiraTally(period, options?.jiraIssueKeys, options?.jiraSnapshot)
-            : Effect.succeed([]);
+        const jiraSideRead = !sides.jira
+            ? Effect.succeed([])
+            : options?.jiraPreRead !== undefined
+                ? Effect.succeed(options.jiraPreRead)
+                : jiraTally(period, options?.jiraIssueKeys, options?.jiraSnapshot);
         const [clockifySide, jiraSide] = yield* Effect.all([
             sides.clockify
                 ? clockifyTally(period, options?.clockifySnapshot)
@@ -1118,7 +1094,7 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         // `attributeSession` remains the single place the precedence is actually applied.
         const needsAgent = options.mode === "deterministic" ?
             [] :
-            sessions.filter((session) => deterministicAttribution(session, { standingMap: options.standingMap }) === null &&
+            sessions.filter((session) => deterministicAttribution(session, options) === null &&
                 session.candidateKeys.length > 0);
         const batches = batchRequests(needsAgent);
         if (needsAgent.length > 0) {
@@ -1135,7 +1111,11 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         const batchResults = yield* Effect.all(batches.map((batch, batchIndex) => attributor.attribute(batch.map((session) => ({
             sessionId: session.sessionId,
             candidateKeys: session.candidateKeys,
-            digest: session.digest
+            digest: session.digest,
+            candidateFacts: new Map(session.candidateKeys.flatMap((key) => {
+                const fact = options.candidateFact?.(key);
+                return fact === undefined ? [] : [[key, fact]];
+            }))
         })), (activity) => options.onProgress({
             _tag: "AgentActivity",
             batch: batchIndex + 1,
@@ -1145,7 +1125,10 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
             const bySession = new Map(answers.map((answer) => [answer.sessionId, answer.choice]));
             return batch.map((session) => {
                 const declined = { _tag: "None" };
-                const choice = bySession.get(session.sessionId) ?? declined;
+                const answer = bySession.get(session.sessionId) ?? declined;
+                const choice = answer._tag === "Chosen" && options.ignoredTickets.has(answer.ticketKey)
+                    ? declined
+                    : answer;
                 return {
                     session,
                     choice,
@@ -1200,7 +1183,8 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         const attributions = sessions.map((session) => attributeSession(session, {
             standingMap: options.standingMap,
             agentChoice: chosen.get(session.sessionId) ?? null,
-            confidenceFloor: options.confidenceFloor
+            confidenceFloor: options.confidenceFloor,
+            ignoredTickets: options.ignoredTickets
         }));
         return { attributions, attributorAvailable, attributorCalls: batches.length };
     });
@@ -1224,15 +1208,40 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         return requests.map((request) => byId.get(request.id) ?? null);
     });
     /** Both first reads and post-write refreshes subtract live totals through the same path. */
-    const refreshRecordedTime = Effect.fn("ReconcileService.refreshRecordedTime")(function* (period, previous, options) {
+    const refreshRecordedTime = Effect.fn("ReconcileService.refreshRecordedTime")(function* (period, cached, options, 
+    /** A Jira write state the caller already resolved, so one read never verifies twice. */
+    pinnedJiraState, 
+    /**
+     * A Jira tally taken under `pinnedJiraState` earlier in the same read, with the issue keys it
+     * was required to cover. Reused only when it covers every key this refresh needs.
+     */
+    preReadJira) {
+        const ignoredTickets = new Set((yield* config.get).sessionIgnoredTickets);
+        const ignored = [...new Map([
+                ...ignoredCredits(cached.sessionEvidence ?? [], ignoredTickets),
+                ...cached.ignored.filter((entry) => ignoredTickets.has(entry.ticketKey))
+            ].map((entry) => [`${entry.ticketKey}:${entry.day}`, entry])).values()];
+        const previous = {
+            ...cached,
+            attributed: cached.attributed.filter((row) => !ignoredTickets.has(row.ticketKey)),
+            withheld: cached.withheld.filter((row) => !ignoredTickets.has(row.ticketKey)),
+            ignoredTickets: [...ignoredTickets].sort(),
+            ignored
+        };
         const { sides } = previous;
+        const writeBlocked = {};
         const stored = yield* sourceLedger.read.pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
         const clockifySnapshot = sides.clockify ? yield* clockifyWriteSnapshot : null;
         if (clockifySnapshot !== null) {
-            yield* sourceLedger.assertNoLegacyClockify(clockifySnapshot.legacyScope).pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
+            yield* sourceLedger.assertNoLegacyClockify(clockifySnapshot.legacyScope).pipe(Effect.catchTag("SourceLedgerError", (cause) => {
+                if (cause.reason !== "review-required")
+                    return Effect.fail(cause);
+                writeBlocked.clockify = cause.message;
+                return Effect.void;
+            }), Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
         }
         const clockifyScope = clockifySnapshot?.scope ?? null;
-        const jiraState = sides.jira ? yield* jiraWriteState : undefined;
+        const jiraState = sides.jira ? pinnedJiraState ?? (yield* jiraWriteState) : undefined;
         const jiraSnapshot = jiraState?.snapshot ?? null;
         // Compatibility reads may still render Jira totals, but only one verified snapshot may grant
         // durable source authority. Independent Clockify work remains executable while Jira is held.
@@ -1259,10 +1268,31 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
                 ...(options?.jiraIssueKeys ?? [])
             ])
         ];
+        // Covered means read directly or found holding my time; anything else is read fresh, so reuse
+        // is an optimization the result never depends on.
+        const covered = new Set([
+            ...(preReadJira?.requiredKeys ?? []),
+            ...(preReadJira?.tally ?? []).map((row) => row.ticketKey)
+        ]);
+        // Keys the pre-read did not cover — usually tickets the agent or a split chose — are read on
+        // their own and merged. They held none of my time in the pre-read's search, so their rows
+        // cannot duplicate it. If the top-up fails, the refresh falls back to a full read.
+        const missingKeys = jiraIssueKeys.filter((key) => !covered.has(key));
+        const topUp = preReadJira === undefined || pinnedJiraState === undefined || missingKeys.length === 0
+            ? undefined
+            : yield* Effect.result(jiraTally(period, missingKeys, jiraSnapshot, "required-only"));
+        const jiraPreRead = preReadJira === undefined || pinnedJiraState === undefined
+            ? undefined
+            : missingKeys.length === 0
+                ? preReadJira.tally
+                : topUp?._tag === "Success"
+                    ? [...preReadJira.tally, ...topUp.success]
+                    : undefined;
         const [{ recorded, unlinkedClockify }, excludedDays] = yield* Effect.all([
             readRecorded(period, {
                 sides,
                 jiraIssueKeys,
+                jiraPreRead,
                 clockifySnapshot: clockifySnapshot ?? undefined,
                 jiraSnapshot,
                 tolerateUnavailableJira: jiraState?.availability !== "verified"
@@ -1329,19 +1359,23 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
                 scope,
                 fromMs: period.from.getTime(),
                 toMs: period.to.getTime()
-            }, observed.map((entry) => ({ entryId: entry.id, startMs: entry.startMs })), verified, provider === "clockify" ? clockifySnapshot?.legacyScope : undefined).pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
+            }, observed.map((entry) => ({ entryId: entry.id, startMs: entry.startMs })), verified, provider === "clockify" ? clockifySnapshot?.legacyScope : undefined).pipe(Effect.catchTag("SourceLedgerError", (cause) => {
+                if (cause.reason !== "review-required")
+                    return Effect.fail(cause);
+                writeBlocked[provider] = cause.message;
+                return Effect.void;
+            }), Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
         }
         const verifiedLedger = yield* sourceLedger.read.pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
-        if (previous.attributed.length > 0 &&
-            entries.some((entry) => {
+        if (previous.attributed.length > 0) {
+            for (const entry of entries) {
                 const scope = entry.source === "clockify" ? clockifyScope : jiraScope;
-                return scope !== null && entry.description !== null &&
+                if (scope !== null && entry.description !== null &&
                     SourceConsumption.markers(entry.description).length > 0 &&
-                    !verifiedLedger.bindings.some((binding) => binding.provider === entry.source && binding.entryId === entry.id && binding.scope === scope);
-            })) {
-            return yield* new ReconcileError({
-                message: "An unlinked source marker needs private manual review before session writes"
-            });
+                    !verifiedLedger.bindings.some((binding) => binding.provider === entry.source && binding.entryId === entry.id && binding.scope === scope)) {
+                    writeBlocked[entry.source] = "An unlinked source marker needs private manual review before session writes";
+                }
+            }
         }
         const sourceEntries = verifiedLedger.bindings.filter((binding) => binding.provider === "clockify" ? binding.scope === clockifyScope : binding.scope === jiraScope).flatMap((binding) => {
             const entry = entries.find((candidate) => candidate.source === binding.provider && candidate.id === binding.entryId);
@@ -1357,6 +1391,7 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
         const executableRecorded = recordedForExecution(recorded, jiraState?.availability);
         return {
             ...previous,
+            writeBlocked,
             proposals: buildSessionProposals(previous.attributed, executableRecorded, {
                 minimumSeconds: MINIMUM_PROPOSAL_SECONDS,
                 excludedDays: excludedDays.map((excluded) => excluded.day),
@@ -1366,7 +1401,7 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
                     day: slice.day,
                     intervals: slice.entry === undefined ? [] : [{ entry: slice.entry }]
                 }))
-            }),
+            }).map((proposal) => ({ ...proposal, writeBlocked })),
             recorded,
             unlinkedClockify,
             sourceEntries,
@@ -1378,13 +1413,72 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
     const proposeFromSessions = (period, options) => Effect.gen(function* () {
         const onProgress = options?.onProgress ?? (() => Effect.void);
         const cfg = yield* config.get;
+        const ignoredTickets = new Set(cfg.sessionIgnoredTickets);
+        const standingMap = expandedStandingMap(cfg.sessionTicketMap, home);
         const sessions = yield* sessionReader.read(period).pipe(Effect.mapError((error) => new ReconcileError({ message: error.message, cause: error })));
         yield* onProgress({ _tag: "SessionsRead", count: sessions.length });
-        const { attributions, attributorAvailable, attributorCalls } = yield* attributeSessions(sessions, {
-            standingMap: expandedStandingMap(cfg.sessionTicketMap, home),
+        const sides = options?.sides ?? bothSides;
+        // Only a run about Jira reads Jira to rank: a Clockify-only week makes no Jira request. The
+        // verified profile's client, so a sprint is never read from a different account's site.
+        // Resolved once for the whole read: ranking and the first recorded refresh must see the
+        // same verified authority, and resolving twice can observe two different answers. The pin
+        // never outlives the read: every write path refreshes without it and verifies afresh.
+        const jiraState = sides.jira ? yield* jiraWriteState : undefined;
+        const rankingSnapshot = jiraState?.snapshot ?? undefined;
+        // The Jira tally is read before attribution, so ranking and the attribution prompt see who
+        // logged what, and the first refresh reuses it. Branch, path and standing targets and
+        // ledger-bound tickets are required reads; any other candidate the tally lacks is unlogged.
+        const preReadJira = rankingSnapshot === undefined ? undefined : yield* Effect.gen(function* () {
+            const stored = yield* sourceLedger.read.pipe(Effect.mapError((cause) => new ReconcileError({ message: cause.message, cause })));
+            const requiredKeys = [
+                ...new Set([
+                    ...sessions.flatMap((session) => {
+                        const target = deterministicAttribution(session, { standingMap });
+                        return target === null || ignoredTickets.has(target.ticketKey) ? [] : [target.ticketKey];
+                    }),
+                    ...stored.bindings.filter((binding) => binding.provider === "jira" && binding.scope === rankingSnapshot.ledgerScope).map((binding) => binding.ticketKey)
+                ])
+            ];
+            const tally = yield* Effect.result(jiraTally(period, requiredKeys, rankingSnapshot));
+            return tally._tag === "Success" ? { tally: tally.success, requiredKeys } : undefined;
+        });
+        const ranking = rankingSnapshot !== undefined
+            ? yield* readRankingFacts((jql, nextPageToken) => retryTransport(rankingSnapshot.client.searchIssuesUsingJql({
+                params: {
+                    jql,
+                    maxResults: 100,
+                    fields: ["key"],
+                    ...((nextPageToken !== undefined) && { nextPageToken })
+                }
+            })), preReadJira?.tally)
+            : {
+                _tag: "Unknown",
+                reason: sides.jira ? "Jira account is not verified" : "Jira is out of scope"
+            };
+        const ignoredBySession = new Map(sessions.flatMap((session) => {
+            const original = deterministicAttribution(session, { standingMap });
+            return original === null || !ignoredTickets.has(original.ticketKey)
+                ? []
+                : [[session.sessionId, original.ticketKey]];
+        }));
+        const { attributions: primaryAttributions, attributorAvailable, attributorCalls } = yield* attributeSessions(sessions.map((session) => ({
+            ...session,
+            candidateKeys: session.candidateKeys.filter((key) => !ignoredTickets.has(key))
+        })), {
+            standingMap,
+            ignoredTickets,
             confidenceFloor: cfg.sessionConfidenceFloor,
             mode: options?.attribution ?? "full",
-            onProgress
+            onProgress,
+            candidateFact: candidateFact(ranking)
+        });
+        // A split is a guess from mention counts: a deterministic read reports the session unplaced
+        // instead, so an unattended watch never downgrades a branch-placed row to `split`.
+        const attributions = primaryAttributions.map((attribution, index) => {
+            const session = sessions[index];
+            return session === undefined || options?.attribution === "deterministic" ?
+                attribution :
+                splitSessionAttribution(session, attribution, ranking._tag === "Known" && jiraState?.availability === "verified" ? ranking.sprint : undefined, ignoredTickets);
         });
         // Windows first, then attribution, then sharing — in that order, because time is divided
         // between distinct Issue Keys, not between sessions. Two sessions on one ticket must union
@@ -1397,27 +1491,43 @@ export const layer = Layer.effect(ReconcileService, Effect.gen(function* () {
             observedAtMs: Math.min(period.to.getTime(), nowMs),
             boundsBySession: new Map(sessions.flatMap((session) => session.boundedAtMs === null ? [] : [[session.sessionId, session.boundedAtMs]]))
         });
-        const split = splitCredits(windows, attributions, {
+        const attributionBySession = new Map(attributions.map((attribution) => [attribution.sessionId, attribution]));
+        const ignored = ignoredCredits(windows.map((window) => ({
+            ...window,
+            ticketKey: ignoredBySession.get(window.sessionId) ?? null
+        })), ignoredTickets);
+        const eligibleWindows = windows.filter((window) => {
+            const key = attributionBySession.get(window.sessionId)?.ticketKey;
+            return !ignoredBySession.has(window.sessionId) ||
+                (attributionBySession.get(window.sessionId)?.targets?.length ?? 0) > 0 ||
+                (key !== null && key !== undefined && !ignoredTickets.has(key));
+        });
+        const split = splitCredits(eligibleWindows, attributions, {
             cwdBySession: new Map(sessions.map((session) => [session.sessionId, session.cwd])),
-            dwellSeconds: cfg.sessionDwellSeconds
+            dwellSeconds: cfg.sessionDwellSeconds,
+            priority: ticketPriority(ranking),
+            ignoredTickets
         });
-        const sides = options?.sides ?? bothSides;
         yield* onProgress({ _tag: "ReadingRecordedTime", sides });
         return yield* refreshRecordedTime(period, {
             attributed: split.attributed,
-            sessionEvidence: windows.map((window) => ({
-                ...window,
-                ticketKey: attributions.find((attribution) => attribution.sessionId === window.sessionId)?.ticketKey ?? null
-            })),
+            sessionEvidence: windows.flatMap((window) => {
+                const attribution = attributionBySession.get(window.sessionId);
+                const keys = attribution?.targets?.map((target) => target.ticketKey) ??
+                    [attribution?.ticketKey ?? ignoredBySession.get(window.sessionId) ?? null];
+                return keys.map((ticketKey) => ({ ...window, ticketKey }));
+            }),
             sides,
             withheld: split.withheld,
             unattributed: split.unattributed,
+            ignored,
+            ignoredTickets: [...ignoredTickets].sort(),
             attributorAvailable,
             sessionCount: sessions.length,
             sessionRootCount: cfg.sessionRoots.length,
             attributorCalls,
             digests: new Map(sessions.map((session) => [session.sessionId, session.digest]))
-        });
+        }, undefined, jiraState, preReadJira);
     });
     return {
         compare,