cctally 1.114.0 → 1.115.0

package/bin/_lib_rederive.py

@@ -144,6 +144,24 @@ _OP_CLASSIFICATIONS = {
         "retained", "operator Codex window attribution is outside claude-usage"),
     "codex_window_attribution_retract": KindClassification(
         "retained", "operator Codex window retraction is outside claude-usage"),
+    # #825/#832 spec 5.1. The versioned reviewed decision is replayed into
+    # scratch exactly like its previous-release twin.
+    "claude_weekly_observation_decision_v2": KindClassification(
+        "retained_input",
+        "reviewed weekly-axis decisions are replayed into scratch"),
+    # The account-bound protocol ops are fence metadata: they decide what is
+    # admitted and anchor the legacy spool baseline, and nothing in the
+    # claude-usage family derives them.
+    "account_bound_cutover": KindClassification(
+        "retained", "the account-bound journal fence is replayed, never "
+        "re-derived"),
+    "legacy_spool_activity": KindClassification(
+        "retained", "legacy spool evidence is replayed, never re-derived"),
+    # The versioned journal-repair acknowledgement is an audit record over the
+    # raw prefix, outside claude-usage (its previous-release twin is consumed
+    # by the selector directly and never registered).
+    "journal_protocol_resolution_v2": KindClassification(
+        "retained", "journal-repair acknowledgements are audit records"),
 }
 
 
@@ -1310,6 +1328,45 @@ def _reconcile_snapshot_identities(
         )
 
 
+def _suppression_deletes_snapshot(record: Mapping, *, weekly: bool,
+                                  five_hour: bool) -> bool:
+    """Whether the stale-replica suppressions naming one snapshot delete it
+    (#825/#832 spec 4.7 revisions 6 and 7), as the journal appliers
+    materialize them. A five-hour credit retires an unheld row's five-hour
+    reading in place and deletes a held row; a weekly suppression makes a row
+    that carries its own five-hour reading weekly-held and deletes a row that
+    keeps no evidence on either axis. Both retirements together delete the
+    row, in either order."""
+    payload = record.get("payload") or {}
+    held = payload.get("weekly_observation_held") == 1
+    carries_five_hour = (
+        payload.get("five_hour_percent") is not None
+        and payload.get("five_hour_resets_at") is not None
+        and payload.get("source") != "record-credit"
+    )
+    if weekly and five_hour:
+        return True
+    if five_hour:
+        return held
+    if weekly:
+        return not carries_five_hour
+    return False
+
+
+def _without_snapshot_suppression(payload: Mapping) -> Mapping:
+    """``payload`` without its `weekly_usage_snapshots` stale-replica
+    suppression list. Since spec 4.7 revision 7 (fix round K16b) a
+    suppression that names a reviewed-held snapshot can leave it
+    materialized (a weekly credit keeps a row carrying its own five-hour
+    reading weekly-held), and that list is then a retirement effect on the
+    snapshot, not a reference that depends on it."""
+    if ("suppression" not in payload
+            or payload.get("suppression_table", "weekly_usage_snapshots")
+            != "weekly_usage_snapshots"):
+        return payload
+    return {key: value for key, value in payload.items() if key != "suppression"}
+
+
 def _preserve_reviewed_hold_dependencies(
     current: Mapping[str, Mapping], desired: dict[str, Mapping],
     reviewed_weekly_hold_ids=(), historical_close_markers=None,
@@ -1334,9 +1391,11 @@ def _preserve_reviewed_hold_dependencies(
     }
     if not snapshot_ids:
         return
-    suppressed_snapshot_ids = set()
+    weekly_named: set = set()
+    five_hour_named: set = set()
     for record in (*current.values(), *desired.values()):
-        suppression = (record.get("payload") or {}).get("suppression")
+        payload = record.get("payload") or {}
+        suppression = payload.get("suppression")
         if suppression is None:
             continue
         if not isinstance(suppression, list) or any(
@@ -1346,7 +1405,26 @@ def _preserve_reviewed_hold_dependencies(
                 "reviewed weekly hold suppression has an unfamiliar shape: "
                 + str(record.get("id"))
             )
-        suppressed_snapshot_ids.update(snapshot_ids & set(suppression))
+        named = snapshot_ids & set(suppression)
+        if (payload.get("suppression_table", "weekly_usage_snapshots")
+                != "weekly_usage_snapshots"):
+            continue
+        if payload.get("kind") == "five_hour_credit":
+            five_hour_named.update(named)
+        else:
+            weekly_named.update(named)
+    # #825/#832 spec 4.7 revision 7 (*Versioning and replay*, fix round
+    # K16b): suppression-list membership no longer implies whole-snapshot
+    # deletion. Each axis's stale-replica suppression retires its own axis
+    # (`_cctally_journal._apply_reset_with_suppression`), so a snapshot is
+    # deleted only where the materialization deletes it.
+    suppressed_snapshot_ids = {
+        snapshot_id for snapshot_id in weekly_named | five_hour_named
+        if _suppression_deletes_snapshot(
+            (desired.get(snapshot_id) or current.get(snapshot_id) or {}),
+            weekly=snapshot_id in weekly_named,
+            five_hour=snapshot_id in five_hour_named)
+    }
     if suppressed_snapshot_ids:
         for event_id, record in (*current.items(), *desired.items()):
             payload = record.get("payload") or {}
@@ -1368,7 +1446,8 @@ def _preserve_reviewed_hold_dependencies(
         payload = record.get("payload") or {}
         usage_ref = payload.get("usage_snapshot_ref")
         if usage_ref not in snapshot_ids:
-            if _contains_any_value(payload, snapshot_ids):
+            if _contains_any_value(_without_snapshot_suppression(payload),
+                                   snapshot_ids):
                 raise RederiveConflict(
                     "reviewed weekly hold dependency has an unfamiliar shape: "
                     + event_id
@@ -1413,7 +1492,8 @@ def _preserve_reviewed_hold_dependencies(
         payload = record.get("payload") or {}
         usage_ref = payload.get("usage_snapshot_ref")
         if usage_ref not in snapshot_ids:
-            if _contains_any_value(payload, snapshot_ids):
+            if _contains_any_value(_without_snapshot_suppression(payload),
+                                   snapshot_ids):
                 raise RederiveConflict(
                     "reviewed weekly hold dependency has an unfamiliar shape: "
                     + event_id
@@ -1625,6 +1705,7 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
                             reviewed_weekly_hold_ids=(),
                             uncertain_cost_fact_ids=(),
                             historical_close_markers=None,
+                            physical_revisions=None,
                             enforce_guard=True) -> RederivePlan:
     """Diff current effective events against one scratch-derived desired set.
 
@@ -1660,6 +1741,11 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
     the same way closes are decided before milestones."""
     conflicted_event_ids = frozenset(conflicted_event_ids or ())
     historical_close_markers = dict(historical_close_markers or {})
+    # #825/#832 fix round A (Codex fix-round-1 Q2): the highest revision of
+    # every physical record admission hides (an excluded legacy event or
+    # correction action). A new revision is allocated above it, so the
+    # previous release never reads a same-revision conflict.
+    physical_revisions = dict(physical_revisions or {})
     desired = _desired_by_id(desired_events)
     current = {
         event_id: selected.record
@@ -1824,6 +1910,9 @@ def build_claude_usage_plan(*, selection, desired_events: Iterable[Mapping],
             disposition = "add"
             at = str(desired_record["at"])
             payload = dict(desired_record.get("payload") or {})
+        floor = physical_revisions.get(event_id)
+        if floor is not None and revision <= floor:
+            revision = floor + 1
         counts[disposition] += 1
         kind_record = (
             current_record if disposition == "tombstone"

package/bin/_lib_segment_summary.py

@@ -84,7 +84,7 @@ SIDECAR_NAME = ".segment-summaries"
 #: Bumped by hand when a summary's FIELD SET or the meaning of one of its
 #: numbers changes. It is only one of the three inputs to `summary_version`; the
 #: other two are derived, for the reason that function's docstring gives.
-SUMMARY_SHAPE_VERSION = 3
+SUMMARY_SHAPE_VERSION = 4
 
 #: The refusal reasons `summary_is_elidable` returns. They are stable, because
 #: the rebuild record reports them (spec section 6.3, "recorded, not silent").
@@ -121,6 +121,14 @@ class SegmentSummary:
     malformed: int = 0
     #: True when the segment holds ZERO records of a retained type.
     quota_only: bool = True
+    #: #825/#832 fix round A (Codex fix-round-1 Q4): True only when EVERY
+    #: decoded record in the summarized extent is a positively identified
+    #: Codex quota observation — no Claude, administrative, protocol or
+    #: unknown record. The one proof that lets a segment past the account-bound
+    #: cutover's frozen extents be elided: a summary describes its lines
+    #: WITHOUT admission, and `quota_only` alone still admits a stamped Claude
+    #: observation that feeds the quarantine and the derivation completion.
+    codex_quota_only: bool = False
     #: Elements the segment contributed to the rebuild's `decoded` list —
     #: retained records plus placeholders, and never a malformed line. `None`
     #: means the summary predates the field and cannot be elided against.
@@ -227,7 +235,8 @@ def summary_is_elidable(
 _FIELDS = (
     "segment_name", "st_dev", "st_ino", "summarized_size",
     "complete_line_covered_offset", "lines", "bytes", "decodes", "malformed",
-    "quota_only", "decoded_entry_count", "complete_prefix_sha256",
+    "quota_only", "codex_quota_only", "decoded_entry_count",
+    "complete_prefix_sha256",
     "last_seen_stamped",
     "last_seen_legacy_claude_at", "last_seen_legacy_codex_at",
 )
@@ -285,6 +294,7 @@ def to_wire(summary) -> dict:
         "decodes": int(summary.decodes),
         "malformed": int(summary.malformed),
         "quota_only": bool(summary.quota_only),
+        "codex_quota_only": bool(summary.codex_quota_only),
         "decoded_entry_count": (
             None if summary.decoded_entry_count is None
             else int(summary.decoded_entry_count)),
@@ -326,6 +336,7 @@ def from_wire(item) -> SegmentSummary:
         decodes=int(item["decodes"]),
         malformed=int(item["malformed"]),
         quota_only=bool(item["quota_only"]),
+        codex_quota_only=bool(item["codex_quota_only"]),
         decoded_entry_count=None if count is None else int(count),
         complete_prefix_sha256=(
             None if item["complete_prefix_sha256"] is None
@@ -427,6 +438,28 @@ def read_sidecar(path):
         return None
 
 
+def admission_permits_elision(boundary, name, pinned_raw_extent,
+                              summary) -> bool:
+    """Whether the account-bound admission fence lets segment ``name`` be
+    elided at all (#825/#832 fix round A, Codex fix-round-1 Q4). The rebuild
+    and the prefix validation share it; every other elision condition is
+    still `summary_is_elidable`'s.
+
+    A summary describes its lines without admission. A wholly historical
+    extent (inside the cutover's frozen extent for that segment) needs no
+    admission. Past it, only a summary proving every decoded record a Codex
+    quota observation — always admitted, never a quarantine or completion
+    input — may stand in for reading the segment; anything unproven (no
+    summary, an older shape, a mixed segment) is scanned.
+    """
+    if boundary is None:
+        return True
+    extent = boundary.frozen_extents.get(name)
+    if extent is not None and int(pinned_raw_extent) <= int(extent):
+        return True
+    return summary is not None and bool(summary.codex_quota_only)
+
+
 def with_identity(summary, *, st_dev, st_ino) -> SegmentSummary:
     """``summary`` restamped with the inode identity of the file just read."""
     return replace(summary, st_dev=int(st_dev), st_ino=int(st_ino))