cctally 1.65.0 → 1.67.0

package/bin/_lib_conversation_anon.py

@@ -0,0 +1,254 @@
+"""Pure, I/O-free anonymization kernel for conversation sharing (#281 S4).
+
+The single scrub chokepoint for the "share this session" flow. Mirrors the
+``_lib_share.py`` / ``_lib_conversation_export.py`` purity contract: no DB, no
+filesystem, no env reads, no clock — every input is injected. The whole export
+(and every per-card copy) passes through :func:`scrub_text`, so no field can
+bypass the redaction, and one mechanism serves both the server exports and the
+client-side copies (the TS applier is a dumb executor of :func:`plan_to_wire`).
+
+Two passes, in order:
+
+1. **Identity** — a SINGLE pass over the original text. All identity tokens
+   (observed project roots → ``project-N``, their dash-encoded dirname variants
+   → ``-project-N``, home dirs → ``~``, usernames → ``user``, and project labels
+   → their root's ``project-N``) compile into ONE alternation regex; each match
+   is resolved through a lookup map. Because a replacement's output is never
+   re-scanned, generated tokens cannot be re-matched — this is what makes
+   ``scrub_text(scrub_text(x)) == scrub_text(x)`` structural, not aspirational.
+   Bounded tokens (labels, usernames) carry an explicit shared ASCII boundary
+   (``A-Za-z0-9_.-`` single-char lookarounds, deliberately NOT ``\\b``); the
+   trailing ``-`` in that class is what protects a generated ``project-N`` from
+   re-matching the bare ``project`` label. A lookup miss (impossible by
+   construction) yields the fixed sentinel ``ANON_SENTINEL`` — never passthrough.
+
+   **Trie compilation (perf, byte-identical).** The tokens are globally ordered
+   longest-text-first, so a flat ``t1|t2|…`` alternation is *longest-match-wins*
+   (Python ``re`` takes the first listed alternative that matches, and the first
+   that can match at any position is the longest, since two equal-length literals
+   cannot both match one position). A flat alternation over ~1300 tokens is
+   O(text × alternatives), though — every alternative is retried at every
+   position. So :func:`_build_identity_pattern` collapses each MAXIMAL
+   CONSECUTIVE RUN of same-boundedness tokens into a trie-structured subgroup
+   (shared prefixes fold into nested ``(?:…)`` groups; a node that is both
+   end-of-word and has children makes the children group optional-greedy so the
+   longest branch wins). An unbounded run is a bare trie; a bounded run — whose
+   members share the *same* lookarounds — is one trie wrapped in a single
+   ``(?<![B])(?:…)(?![B])`` guard (the trailing lookahead backtracks through the
+   trie's greedy optionals to the longest boundary-clearing member, exactly as
+   the per-singleton flat form would). Bounded runs merge too because real DB
+   plans are heavily bounded (~26% project-label tokens), so leaving them
+   singleton would keep the identity pass O(text × labels). This is
+   byte-identical to the flat alternation *by
+   construction*: within a chunk the trie yields the longest matching member;
+   across chunks/singletons the first alternative with any match wins, and
+   because every token in an earlier chunk is ≥ every later alternative in
+   length, "first chunk that matches" is exactly "longest flat alternative that
+   matches" (proof + equivalence property test in ``test_conversation_anon``).
+   ``plan_to_wire`` and the TS applier are UNTOUCHED (per-card texts are small).
+
+2. **Secrets** — a small documented, high-precision pattern set
+   (:data:`SECRET_PATTERNS`), applied AFTER identity. Each pattern is a
+   cross-language descriptor (valid in BOTH Python ``re`` and JS ``RegExp``): no
+   inline flags, no named groups, no lookbehind, no ``$n`` templates. The
+   effective replacement is ``(group 1 if keep_group_1 else "") + [REDACTED:<name>]``.
+
+**Honest guarantee (no over-claiming, #280 privacy):** the tested claim is
+"zero *known* identity tokens survive" — observed project roots/labels, home
+dirs, usernames, plus the documented secret patterns. NOT comprehensively
+detected or guaranteed removed in v1: emails, IPs, hostnames, remote URLs,
+session IDs, and any project identity absent from cctally's DB. Best-effort over
+known tokens; review before sharing. See ``docs/commands/transcript.md``.
+"""
+from __future__ import annotations
+
+import dataclasses
+import re
+
+ANON_SENTINEL = "(unknown)"
+# Shared Python/JS boundary class for bounded tokens (deliberately NOT `\b`,
+# whose Unicode behavior differs across runtimes). Single-char lookarounds are
+# fixed-width — legal in Python `re` and identical in JS.
+_BOUNDARY = "A-Za-z0-9_.-"
+
+
+@dataclasses.dataclass(frozen=True)
+class SecretPattern:
+    """A cross-language secret descriptor. ``source`` must compile in BOTH
+    Python ``re`` and JS ``RegExp`` (no inline flags / named groups / lookbehind).
+    ``ignore_case`` is a language-neutral boolean (``re.IGNORECASE`` / JS ``i``);
+    ``keep_group_1`` preserves capture group 1 (the key + separator) before the
+    ``[REDACTED:<name>]`` marker."""
+    name: str
+    source: str
+    ignore_case: bool
+    keep_group_1: bool
+
+
+@dataclasses.dataclass(frozen=True)
+class AnonPlan:
+    """An ordered identity token list (``(text, replacement, bounded)``,
+    longest-text-first, tie lexical) plus the secret-pattern tuple."""
+    tokens: tuple
+    patterns: tuple
+
+
+# Ordered: authorization-header BEFORE bearer-token (an ``Authorization: Bearer
+# …`` line must redact the whole value, not just the token after ``Bearer``);
+# anthropic-key BEFORE generic-sk-key (the specific ``sk-ant-…`` name wins).
+SECRET_PATTERNS = (
+    SecretPattern("authorization-header", r"(\bAuthorization:[ \t]*)\S[^\r\n]*", True, True),
+    SecretPattern("bearer-token", r"(\bBearer[ \t]+)[A-Za-z0-9._~+/=-]{16,}", True, True),
+    SecretPattern("anthropic-key", r"sk-ant-[A-Za-z0-9_-]{8,}", False, False),
+    SecretPattern("generic-sk-key", r"sk-[A-Za-z0-9_-]{20,}", False, False),
+    SecretPattern("github-token", r"(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{16,}", False, False),
+    SecretPattern("aws-access-key", r"AKIA[0-9A-Z]{16}", False, False),
+    SecretPattern("slack-token", r"xox[baprs]-[A-Za-z0-9-]{10,}", False, False),
+    SecretPattern(
+        "secret-assignment",
+        r"(\b(?:api[_-]?key|secret|token|passwd|password)\b[ \t]*[=:][ \t]*)"
+        r"(?:\"[^\"\r\n]{6,}\"|'[^'\r\n]{6,}'|[^\s\"']{6,})", True, True),
+)
+
+
+def _dash_encode(path: str) -> str:
+    """``/a/b`` -> ``-a-b`` — the Claude project-dir encoding (as it appears in
+    ``~/.claude/projects/<encoded>`` and scratchpad paths)."""
+    return path.replace("/", "-")
+
+
+def build_anon_plan(*, project_roots, home_dirs, usernames) -> AnonPlan:
+    """Build an :class:`AnonPlan` from injected identity sources.
+
+    ``project_roots`` maps root path -> label. Numbering is deterministic,
+    lexical by root path (``project-1..N``), so CLI and HTTP builds from the same
+    DB produce identical plans (byte-parity depends on this). Duplicate basenames
+    map the bare label to the LOWEST-numbered of their ``project-N`` targets
+    (``setdefault`` over the sorted roots).
+    """
+    tokens: dict = {}          # (text, bounded) -> replacement
+    label_target: dict = {}    # label -> project-N (lowest-N wins)
+    for n, root in enumerate(sorted(project_roots), 1):
+        if not root:
+            continue
+        rep = f"project-{n}"
+        tokens[(root, False)] = rep
+        tokens[(_dash_encode(root), False)] = f"-{rep}"
+        label = project_roots[root]
+        if label:
+            label_target.setdefault(label, rep)   # lowest-N claims the label
+    for label, rep in label_target.items():
+        tokens[(label, True)] = rep
+    for h in home_dirs:
+        if h:
+            tokens.setdefault((h, False), "~")     # a root already present wins
+    for u in usernames:
+        if u:
+            tokens.setdefault((u, True), "user")
+    ordered = tuple(sorted(
+        ((t, rep, b) for (t, b), rep in tokens.items()),
+        key=lambda x: (-len(x[0]), x[0])))
+    return AnonPlan(tokens=ordered, patterns=SECRET_PATTERNS)
+
+
+# End-of-word sentinel for the trie (no token is the empty string, so "" cannot
+# collide with a single-character child key).
+_WORD_END = ""
+
+
+def _trie_to_pattern(node: dict) -> str:
+    """Render one trie node to a regex fragment that matches the LONGEST word
+    branch reachable from it. Children are keyed by distinct next-characters, so
+    the branches of a ``(?:…|…)`` group are mutually exclusive and their order is
+    irrelevant. When the node is also end-of-word AND has children, the whole
+    descent is wrapped optional-greedy (``(?:…)?``) so the longest branch is tried
+    first and a diverging tail backtracks to the shorter complete word. The regex
+    therefore only ever matches a COMPLETE inserted word (every accept state is an
+    end-of-word node), so ``m.group(0)`` is always a live lookup key."""
+    end = _WORD_END in node
+    alts = [re.escape(ch) + _trie_to_pattern(node[ch])
+            for ch in node if ch != _WORD_END]
+    if not alts:
+        return ""                       # pure leaf: the word ends here
+    if end:
+        return "(?:" + "|".join(alts) + ")?"
+    if len(alts) == 1:
+        return alts[0]
+    return "(?:" + "|".join(alts) + ")"
+
+
+def _build_identity_pattern(tokens: tuple) -> str:
+    """Compile the ordered identity tokens to ONE alternation string. Each MAXIMAL
+    CONSECUTIVE RUN of same-boundedness tokens collapses into a trie subgroup
+    (:func:`_trie_to_pattern`); an unbounded run stays a bare trie, a bounded run
+    is wrapped once in the shared ``(?<![B])(?:…)(?![B])`` boundary guard. Matches
+    are byte-identical to a flat longest-first ``t1|t2|…`` alternation of the same
+    tokens (unbounded literal, bounded boundary-guarded singleton) — the
+    equivalence property test proves it against exactly that flat reference.
+
+    **Bounded runs merge too (byte-identical).** Every bounded token carries the
+    *same* ``_BOUNDARY`` lookarounds, so a run's members all start at the match
+    position and share one leading ``(?<![B])``; the trailing ``(?![B])`` sits
+    after the trie, and Python backtracks through the trie's greedy optionals to
+    the longest member whose trailing char clears the boundary — exactly the
+    member a flat ``…|(?<![B])bi(?![B])|…`` alternation (longest-first) would pick.
+    This matters on real data: an observed DB plan is ~26% bounded project-label
+    tokens (336 of 1286), and leaving those as singletons keeps the identity pass
+    O(text × labels) — the very blow-up the trie exists to remove."""
+    parts: list = []
+    run: list = []                      # texts of the current same-boundedness run
+    run_bounded = False                 # boundedness of the current run
+
+    def _flush():
+        if not run:
+            return
+        root: dict = {}
+        for word in run:
+            node = root
+            for ch in word:
+                node = node.setdefault(ch, {})
+            node[_WORD_END] = True
+        frag = _trie_to_pattern(root)
+        if run_bounded:
+            frag = f"(?<![{_BOUNDARY}])(?:{frag})(?![{_BOUNDARY}])"
+        parts.append(frag)
+        run.clear()
+
+    for t, _rep, bounded in tokens:
+        if run and bounded != run_bounded:
+            _flush()                    # boundary between an unbounded/bounded run
+        run_bounded = bounded
+        run.append(t)
+    _flush()
+    return "|".join(parts)
+
+
+def scrub_text(text: str, plan: AnonPlan) -> str:
+    """Identity single-pass, then secrets. Idempotent (tested)."""
+    if plan.tokens:
+        lookup = {t: rep for t, rep, _ in plan.tokens}
+        text = re.compile(_build_identity_pattern(plan.tokens)).sub(
+            lambda m: lookup.get(m.group(0), ANON_SENTINEL), text)
+    for sp in plan.patterns:
+        flags = re.IGNORECASE if sp.ignore_case else 0
+        rx = re.compile(sp.source, flags)
+
+        def _repl(m, _sp=sp):
+            prefix = m.group(1) if _sp.keep_group_1 else ""
+            return f"{prefix}[REDACTED:{_sp.name}]"
+
+        text = rx.sub(_repl, text)
+    return text
+
+
+def plan_to_wire(plan: AnonPlan) -> dict:
+    """Project an :class:`AnonPlan` to the JSON wire contract the TS applier
+    executes: ``{"tokens": [{"text","replacement","bounded"}...],
+    "patterns": [{"name","source","ignoreCase","keepGroup1"}...]}``."""
+    return {
+        "tokens": [{"text": t, "replacement": rep, "bounded": b}
+                   for t, rep, b in plan.tokens],
+        "patterns": [{"name": sp.name, "source": sp.source,
+                      "ignoreCase": sp.ignore_case, "keepGroup1": sp.keep_group_1}
+                     for sp in plan.patterns],
+    }

package/bin/_lib_conversation_query.py

@@ -2385,6 +2385,72 @@ def get_conversation_export(conn, session_id, scope):
                                    title=title, session_id=session_id)
 
 
+def conversation_exists(conn, session_id) -> bool:
+    """Cheap existence probe (#281 S4) — True iff any ``conversation_messages``
+    row carries ``session_id``. Mirrors ``_assemble_session``'s own existence
+    check; the ``/anon-map`` route uses it for the sibling-parity 404 on an
+    unknown id. An ``OperationalError`` (no table) reads as absent."""
+    try:
+        row = conn.execute(
+            "SELECT 1 FROM conversation_messages WHERE session_id=? LIMIT 1",
+            (session_id,)).fetchone()
+    except sqlite3.OperationalError:
+        return False
+    return row is not None
+
+
+def build_anon_plan_for_db(conn, *, home_dir):
+    """Assemble an :class:`_lib_conversation_anon.AnonPlan` from the DB's OBSERVED
+    identity (#281 S4, spec §4). Thin I/O glue: SELECTs + ``_project_label`` +
+    one ``build_anon_plan`` call — the ONE helper both the HTTP handlers and the
+    CLI route through, so CLI↔HTTP byte-parity is structural.
+
+    Sources: distinct non-empty ``conversation_messages.cwd`` (the conversation
+    layer's source of truth) UNION ``session_files.project_path`` (legacy/lossy
+    fallback only). Labels derive per root via ``_project_label`` (observed CWDs
+    — no git-root resolution in v1). Home-dir prefixes = the caller-supplied
+    ``home_dir`` (``os.path.expanduser('~')`` at the call site — the pure kernel
+    never reads env) plus ``/Users/<x>`` / ``/home/<x>`` prefixes derived from
+    observed CWDs; usernames are the basenames of those home dirs.
+    """
+    from _lib_conversation_anon import build_anon_plan
+    cwds: set = set()
+    try:
+        for (cwd,) in conn.execute(
+                "SELECT DISTINCT cwd FROM conversation_messages "
+                "WHERE cwd IS NOT NULL AND cwd != ''"):
+            if cwd:
+                cwds.add(cwd)
+    except sqlite3.OperationalError:
+        pass
+    try:
+        for (pp,) in conn.execute(
+                "SELECT DISTINCT project_path FROM session_files "
+                "WHERE project_path IS NOT NULL AND project_path != ''"):
+            if pp:
+                cwds.add(pp)
+    except sqlite3.OperationalError:
+        pass
+    project_roots = {c: _project_label(c) for c in cwds}
+    home_dirs: set = set()
+    usernames: set = set()
+    if home_dir:
+        home_dirs.add(home_dir)
+        u = os.path.basename(home_dir.rstrip("/"))
+        if u:
+            usernames.add(u)
+    for c in cwds:
+        for prefix in ("/Users/", "/home/"):
+            if c.startswith(prefix):
+                user = c[len(prefix):].split("/", 1)[0]
+                if user:
+                    home_dirs.add(prefix + user)
+                    usernames.add(user)
+    return build_anon_plan(
+        project_roots=project_roots,
+        home_dirs=sorted(home_dirs), usernames=sorted(usernames))
+
+
 _TASK_TRIO = ("TaskCreate", "TaskUpdate", "TaskList")
 
 

package/bin/_lib_credit.py

@@ -0,0 +1,133 @@
+"""Credit-plan decision kernel for cctally's record-credit path.
+
+Pure-fn layer (no I/O at import time): holds the percent-ingress
+sanitizer and the `record-credit` plan builder — values in, a frozen
+`CreditPlan` (or a `ValueError`) out. Every DB read, file write, and
+`eprint` for the in-place-credit machinery stays in the I/O sibling
+`bin/_cctally_record.py`; this module is imported by that sibling (and
+re-exported on the `cctally` namespace via `bin/cctally`), so the
+existing `ns["_build_credit_plan"]` / `ns["_normalize_percent"]` /
+`cctally.CreditPlan` read paths resolve unchanged.
+
+`_normalize_percent` is the single chokepoint that flushes IEEE 754 ULP
+noise out of ingress percents; `_build_credit_plan` validates the
+record-credit inputs and floors the effective moment to the hour. Both
+are pure and stdlib-only apart from two kernel imports
+(`parse_iso_datetime`, `_canonicalize_optional_iso` from `_cctally_core`)
+and the pure hour-floor from `_lib_blocks` — no cross-sibling I/O and no
+`cctally` back-import.
+
+Spec: docs/superpowers/specs/2026-07-09-279-s4-record-kernelization-design.md
+"""
+from __future__ import annotations
+
+import datetime as dt
+from dataclasses import dataclass
+
+from _cctally_core import parse_iso_datetime, _canonicalize_optional_iso
+from _lib_blocks import _floor_to_hour
+
+
+_PERCENT_NORMALIZE_DECIMALS = 10
+
+
+def _normalize_percent(value: "float | int | None") -> "float | None":
+    """Flush IEEE 754 ULP noise out of an ingress percent value.
+
+    Single chokepoint applied at every site where a raw percent enters
+    cctally's runtime path (OAuth fetch, hook-tick OAuth refresh, and
+    the cmd_record_usage CLI ingress). Downstream consumers — HWM
+    files, ``weekly_usage_snapshots.{weekly,five_hour}_percent`` REAL
+    columns, ``five_hour_blocks.final_five_hour_percent``, milestone
+    crossing values, and the SSE envelope's ``used_percent`` field —
+    all read the cleaned value, so a single round here stops
+    ``5h=7.000000000000001`` style strings from reaching any log or
+    serialized surface.
+
+    ``None`` is the canonical absent-percent sentinel; preserve it
+    unchanged so the optional-5h branches stay simple.
+    """
+    if value is None:
+        return None
+    return round(float(value), _PERCENT_NORMALIZE_DECIMALS)
+
+
+@dataclass(frozen=True)
+class CreditPlan:
+    week_start_date: str
+    week_start_at: str
+    week_end_at: str
+    cur_end_canon: str
+    from_pct: float
+    from_source: str          # "hwm" | "explicit" | "prior_credit"
+    to_pct: float
+    effective_iso: str        # weekly_credit_floors.effective_at_utc (floored to hour)
+    captured_iso: str         # synthetic snapshot captured_at_utc (un-floored), 'Z'
+
+
+def _parse_credit_at(value, now):
+    """Parse --at as an aware UTC datetime; default to `now`. Naive => UTC
+    (mirrors bin/_cctally_five_hour.py:88), NOT parse_iso_datetime (host-local)."""
+    if value is None:
+        return now
+    try:
+        parsed = dt.datetime.fromisoformat(value)
+    except ValueError as e:
+        raise ValueError(f"--at: {e}") from e
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=dt.timezone.utc)
+    return parsed.astimezone(dt.timezone.utc)
+
+
+def _build_credit_plan(*, week_start_date, week_start_at, week_end_at,
+                       from_pct, from_source, to_pct, at_dt, now,
+                       effective_override=None):
+    """Validate inputs and build a CreditPlan. Pure (no DB/file I/O).
+    Raises ValueError(msg) on any violation — caller maps to exit 2.
+
+    `effective_override` (an ISO string) is the completion-path reuse of an
+    EXISTING `weekly_credit_floors.effective_at_utc` (spec §4a): when present,
+    the plan's effective is that value rather than `floor_to_hour(at)`, so a
+    rerun of a half-applied credit at a later wall-clock keeps the original
+    floor moment and never leaks a stale pre-credit replay into the floored
+    MAX. The synthetic snapshot's captured timestamp stays the un-floored
+    `at` either way."""
+    to_pct = _normalize_percent(to_pct)
+    from_pct = _normalize_percent(from_pct)
+    # Defensive None-guard (issue #212 N3). `_normalize_percent` returns None
+    # for a None input. The CLI never reaches here with None (`--to` is
+    # required + type=float; `--from` always resolves to a float or the caller
+    # errors out first), but this is a public pure helper called directly by
+    # tests and any future non-CLI caller — surface a None as a clear ValueError
+    # (caller -> exit 2) instead of a TypeError from the `0.0 <= None` compare
+    # immediately below.
+    if to_pct is None or from_pct is None:
+        raise ValueError("--to/--from must be numeric")
+    if not (0.0 <= to_pct <= 100.0) or not (0.0 <= from_pct <= 100.0):
+        raise ValueError("--to/--from must be in [0, 100]")
+    if to_pct >= from_pct:
+        raise ValueError(f"not a credit: to >= from ({to_pct} >= {from_pct})")
+    ws = parse_iso_datetime(week_start_at, "week_start_at")
+    we = parse_iso_datetime(week_end_at, "week_end_at")
+    if not (ws <= at_dt < we):
+        raise ValueError(f"--at {at_dt.isoformat()} is outside the week window")
+    if at_dt > now:
+        raise ValueError("--at is in the future")
+    if effective_override is not None:
+        effective_iso = parse_iso_datetime(
+            effective_override, "effective_override"
+        ).astimezone(dt.timezone.utc).isoformat(timespec="seconds")
+    else:
+        effective_iso = _floor_to_hour(at_dt).isoformat(timespec="seconds")
+    cur_end_canon = _canonicalize_optional_iso(week_end_at, "record-credit.week_end")
+    return CreditPlan(
+        week_start_date=week_start_date,
+        week_start_at=week_start_at,
+        week_end_at=week_end_at,
+        cur_end_canon=cur_end_canon,
+        from_pct=from_pct,
+        from_source=from_source,
+        to_pct=to_pct,
+        effective_iso=effective_iso,
+        captured_iso=at_dt.isoformat(timespec="seconds").replace("+00:00", "Z"),
+    )

package/bin/_lib_diff_kernel.py

@@ -130,6 +130,7 @@ from _cctally_core import (
     open_db,
     _command_as_of,
     _canonicalize_optional_iso,
+    _floored_week_max,
     parse_iso_datetime,
 )
 
@@ -659,8 +660,9 @@ def _diff_resolve_used_pct(window: ParsedWindow) -> tuple:
 
     "avg" fires for windows spanning >= 2 full weeks (e.g., last-30d
     over 4-5 weeks): we average max(weekly_percent) across the weeks
-    that have snapshot rows. If any subscription week in [start, end)
-    lacks a snapshot, mode is downgraded to `n/a`.
+    that have snapshot rows — reset-aware floored per week (#290), so a
+    credited week contributes its post-credit value. If any subscription
+    week in [start, end) lacks a snapshot, mode is downgraded to `n/a`.
 
     The "exact" lookup is constrained to the target week's
     `week_start_date` so a window with no recorded snapshots correctly
@@ -693,14 +695,24 @@ def _diff_resolve_used_pct(window: ParsedWindow) -> tuple:
         except Exception:
             return None, "n/a"
         try:
-            rows = conn.execute(
-                "SELECT week_start_date, MAX(weekly_percent) "
+            # #290: reset-aware-floor each week's peak so a credited week
+            # contributes its post-credit value (not the stale pre-credit peak),
+            # consistent with the exact branch + every other used-% surface.
+            # Raw rows (NO NULL-bounds filter: legacy NULL rows still count via
+            # the helper's NULL tolerance); helper reduces to floored per-week
+            # max keyed on week_start_date.
+            raw = conn.execute(
+                "SELECT week_start_date, week_start_at, week_end_at, "
+                "       captured_at_utc, weekly_percent "
                 "FROM weekly_usage_snapshots "
-                "WHERE captured_at_utc >= ? AND captured_at_utc < ? "
-                "GROUP BY week_start_date",
+                "WHERE captured_at_utc >= ? AND captured_at_utc < ?",
                 (_iso_z(window.start_utc), _iso_z(window.end_utc)),
             ).fetchall()
-            vals = [r[1] for r in rows if r[1] is not None]
+            floored = _floored_week_max(
+                conn,
+                [(r[0], r[0], r[1], r[2], r[3], r[4]) for r in raw],
+            )
+            vals = list(floored.values())
             if len(vals) < window.full_weeks_count:
                 # Spec §9.3: missing-coverage weeks would skew the avg —
                 # downgrade to n/a instead of reporting a misleading number.