cctally 1.85.1 → 1.86.0

package/bin/_cctally_doctor.py

@@ -995,6 +995,7 @@ def _doctor_gather_state_impl(
     codex_last_entry_at = None
     codex_project_metadata_health = None
     codex_project_metadata_error = None
+    codex_null_reset_anchors = 0
     try:
         if _cache_probe_allowed and _cctally_core.CACHE_DB_PATH.exists():
             conn = sqlite3.connect(str(_cctally_core.CACHE_DB_PATH))
@@ -1008,6 +1009,18 @@ def _doctor_gather_state_impl(
                         codex_last_entry_at = parse_iso_datetime(
                             row[1], "codex_session_entries.timestamp_utc",
                         ).astimezone(dt.timezone.utc)
+                try:
+                    row = conn.execute(
+                        "SELECT COUNT(*) FROM quota_window_snapshots "
+                        "WHERE source = 'codex' "
+                        "AND canonical_resets_at_utc IS NULL"
+                    ).fetchone()
+                    if row and row[0] is not None:
+                        codex_null_reset_anchors = int(row[0])
+                except sqlite3.OperationalError:
+                    # Pre-anchor cache shapes have no column to inspect. Their
+                    # pending migration is reported by the DB checks instead.
+                    pass
                 # Keep the health probe on the existing read-only cache
                 # connection.  A failed probe is health evidence, not an
                 # empty corpus: the kernel renders it as a distinct FAIL.
@@ -1645,6 +1658,8 @@ def _doctor_gather_state_impl(
     cctally_version = (
         cctally_version_tuple[0] if cctally_version_tuple else "unknown"
     )
+    accounts_state = _gather_accounts_state(now_utc)
+    accounts_state["codex_null_reset_anchors"] = codex_null_reset_anchors
 
     return _lib_doctor.DoctorState(
         symlink_state=symlink_state,
@@ -1742,7 +1757,7 @@ def _doctor_gather_state_impl(
         journal_heal_incidents=journal_heal_incidents,
         journal_writer_guard=journal_writer_guard,
         # Multi-account attribution legs (#341).
-        accounts_state=_gather_accounts_state(now_utc),
+        accounts_state=accounts_state,
         cache_repair_marker=cache_repair_marker,
         backup_sync_state=backup_sync_state,
     )

package/bin/_cctally_journal.py

@@ -1489,6 +1489,8 @@ def _resolve_obs_anchor(resolver, rec: dict) -> "str | None":
             source_root_key=root, observed_slot=slot, logical_limit_key=key,
             window_minutes=p.get("window_minutes"),
             resets_at_utc=p.get("resets_at_utc"),
+            source_path=p.get("source_path"),
+            line_offset=p.get("line_offset"),
         )
     except Exception:  # pragma: no cover — never fail an ingest over a label
         return None
@@ -1523,6 +1525,9 @@ def _apply_quota_records(cache, records) -> None:
     for rec in records:
         covered, decided = oracle.resolve(rec)
         anchor = _resolve_obs_anchor(anchors, rec)
+        if anchors is not None:
+            anchors.apply_pending_merges()
+            anchors.mark_file_committed()
         row_values = _quota_snapshot_values(rec, anchor)
         if not has_anchor:
             row_values = row_values[:-1]

package/bin/_cctally_quota.py

@@ -966,7 +966,9 @@ def _evaluate_quota_alerts(
     return queued
 
 
-def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
+def _reanchor_terminal_events_sql(
+    key_slots: int, minute_slots: int, reset_slots: int,
+) -> str:
     # `UPDATE OR IGNORE`, not a plain UPDATE: if this identity already carries an
     # anchored row at the same threshold, moving the jittered twin onto it would
     # violate the UNIQUE key. OR IGNORE SKIPS that move (it does not delete the
@@ -978,6 +980,11 @@ def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
     # transaction.
     keys = ",".join(f":key{i}" for i in range(key_slots))
     minutes = ",".join(f":min{i}" for i in range(minute_slots))
+    member_epochs = ",".join(f":reset{i}" for i in range(reset_slots))
+    member_clause = (
+        f" OR unixepoch(resets_at_utc) IN ({member_epochs})"
+        if member_epochs else ""
+    )
     return (
         "UPDATE OR IGNORE quota_threshold_events "
         "   SET resets_at_utc = :anchor, "
@@ -989,7 +996,9 @@ def _reanchor_terminal_events_sql(key_slots: int, minute_slots: int) -> str:
         f"   AND observed_slot = :slot AND window_minutes IN ({minutes}) "
         "   AND (resets_at_utc <> :anchor OR logical_limit_key <> :limit_key "
         "        OR window_minutes <> :minutes) "
-        "   AND abs(unixepoch(resets_at_utc) - unixepoch(:anchor)) <= :tolerance"
+        "   AND ("
+        "       abs(unixepoch(resets_at_utc) - unixepoch(:anchor)) <= :tolerance"
+        f"{member_clause})"
     )
 
 
@@ -1020,15 +1029,24 @@ def _reanchor_terminal_events(conn: sqlite3.Connection, block) -> None:
     re-materialization (they share this body), and is idempotent: a row already
     on the canonical identity is excluded by the three-way `<>` guard.
 
-    Bounded on both axes by the tolerances that produced the canonical identity —
-    600s on the reset, ±1 minute on the length — so it can only ever collapse
-    rows the canonicalization itself merged. Two genuinely different cycles are
-    five hours or seven days apart, and a `10200` window is a different window,
-    not jitter.
+    The reset match accepts either the original 600-second anchor neighbourhood
+    or an exact raw reset retained by this block. The latter is required by
+    #425's transitive component closure: an endpoint can be farther than 600s
+    from the first-sight anchor while still joining it through retained bridge
+    observations. Exact membership keeps the widened reach evidence-bound; a
+    genuinely different cycle is never inferred from distance alone. The length
+    axis remains bounded by its ±1 minute snap.
     """
     identity = block.identity
     keys = codex_snap_equivalent_limit_keys(identity.logical_limit_key)
     minutes = codex_snap_equivalent_window_minutes(identity.window_minutes)
+    membership_evidence = (
+        block.physical_observations or block.observations
+    )
+    reset_epochs = sorted({
+        int(observation.resets_at.timestamp())
+        for observation in membership_evidence
+    })
     params: dict[str, object] = {
         "anchor": _utc_iso(block.resets_at),
         "source": identity.source,
@@ -1041,8 +1059,13 @@ def _reanchor_terminal_events(conn: sqlite3.Connection, block) -> None:
     }
     params.update({f"key{i}": value for i, value in enumerate(keys)})
     params.update({f"min{i}": value for i, value in enumerate(minutes)})
+    params.update({
+        f"reset{i}": value for i, value in enumerate(reset_epochs)})
     conn.execute(
-        _reanchor_terminal_events_sql(len(keys), len(minutes)), params)
+        _reanchor_terminal_events_sql(
+            len(keys), len(minutes), len(reset_epochs)),
+        params,
+    )
 
 
 def _apply_quota_projection_rows(

package/bin/_cctally_record.py

@@ -702,6 +702,7 @@ def maybe_record_milestone(
 
         # Threshold crossed — sync cost before recording so the milestone
         # captures up-to-date cumulative cost, not a stale snapshot.
+        cost_synced = True
         try:
             if retained_selection is None:
                 retained_selection = _cctally().WeekSelection(
@@ -740,7 +741,13 @@ def maybe_record_milestone(
                 retained_selection=retained_selection,
             )
         except Exception as exc:
-            eprint(f"[milestone] cost sync failed, using latest available: {exc}")
+            # The snapshot read below would now return a row from an EARLIER
+            # crossing, so recording here stamps that older cumulative onto
+            # this threshold — a write-once row with a $0.00 marginal and a
+            # fabricated $/1%. Fall through only far enough to reach the
+            # skip guard on the snapshot branch.
+            cost_synced = False
+            eprint(f"[milestone] cost sync failed: {exc}")
 
         week_start = dt.date.fromisoformat(week_start_date)
         week_end = dt.date.fromisoformat(week_end_date)
@@ -762,17 +769,36 @@ def maybe_record_milestone(
             effective_ref = adjusted[0]
 
         if _week_ref_has_reset_event(conn, effective_ref):
-            live_cost = _compute_cost_for_weekref(
-                effective_ref,
-                account_key=account_key,
-                as_of=as_of,
-            )
+            import _cctally_cache  # fail-closed attribution guard (#341)
+            try:
+                live_cost = _compute_cost_for_weekref(
+                    effective_ref,
+                    account_key=account_key,
+                    as_of=as_of,
+                )
+            except _cctally_cache.AccountAttributionUnavailable as exc:
+                # Same contract the budget ladder already holds (#341 Task 4):
+                # an account-scoped read that fell into the fail-closed guard
+                # SKIPS this tick and fires on the next healthy one. Never
+                # re-raised — on the passed-conn (ingest) path a bare raise
+                # would abort the whole cycle over a transient lock.
+                eprint("[milestone] account attribution unavailable, "
+                       f"skipping this crossing: {exc}")
+                return
             if live_cost is None:
                 eprint("[milestone] could not compute effective-range cost, skipping")
                 return
             cumulative_cost = live_cost
             cost_snapshot_id = 0  # no snapshot row to anchor against
         else:
+            if not cost_synced:
+                # The latest snapshot predates this crossing. Milestones are
+                # write-once, so a stale cumulative here is permanent; skip
+                # instead. The next observation still sees current_floor >
+                # max_existing and records the crossing with a real cost.
+                eprint("[milestone] skipping this crossing — its cost would "
+                       "come from a snapshot taken before the crossing")
+                return
             # Account-scoped read (#341 P2-1): the cost snapshot was just
             # materialized under `account_key`, so scope the read to it — the
             # merged (account-blind) read would return another account's row on

package/bin/_lib_aggregators.py

@@ -387,6 +387,9 @@ class CodexBucketUsage:
     period_end_at: dt.datetime | None = None
     used_pct: float | None = None
     dollar_per_pct: float | None = None
+    # #424: owning accounts for a pooled native weekly period. Empty for
+    # calendar buckets, focused account children, and undecorated providers.
+    account_keys: tuple[str, ...] = ()
 
 
 @dataclass

package/bin/_lib_doctor.py

@@ -2607,6 +2607,33 @@ def _check_accounts_attribution(s: DoctorState) -> CheckResult:
     )
 
 
+def _check_accounts_codex_reset_anchors(s: DoctorState) -> CheckResult:
+    """Surface Codex quota rows that landed after migration 032 with no anchor."""
+    st = s.accounts_state or {}
+    try:
+        null_rows = int(st.get("codex_null_reset_anchors") or 0)
+    except (TypeError, ValueError):
+        null_rows = 0
+    details = {"null_anchor_rows": null_rows}
+    if null_rows > 0:
+        return CheckResult(
+            id="accounts.codex_reset_anchors",
+            title="Codex reset anchors",
+            severity="warn",
+            summary=f"{null_rows} Codex quota observation(s) lack a canonical reset anchor",
+            remediation="Run `cctally cache-sync --source codex --rebuild`",
+            details=details,
+        )
+    return CheckResult(
+        id="accounts.codex_reset_anchors",
+        title="Codex reset anchors",
+        severity="ok",
+        summary="Codex reset anchors complete",
+        remediation=None,
+        details=details,
+    )
+
+
 _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...] = (
     ("install", "Install", (
         ("install.mode", "_check_install_dev_mode"),
@@ -2667,6 +2694,7 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         ("accounts.registry", "_check_accounts_registry"),
         ("accounts.freshness", "_check_accounts_freshness"),
         ("accounts.attribution", "_check_accounts_attribution"),
+        ("accounts.codex_reset_anchors", "_check_accounts_codex_reset_anchors"),
     )),
     ("pricing", "Pricing", (
         ("pricing.coverage", "_check_pricing_coverage"),

package/bin/_lib_quota.py

@@ -78,11 +78,11 @@ def resolve_reset_anchor(
     anchor already in ``anchors`` or the observation's own raw value, never a
     recomputed centroid. Assignment picks the NEAREST anchor within tolerance,
     breaking a tie on the earlier anchor, so for a given anchor set the answer
-    does not depend on the order the anchors were established in. (The anchor
-    SET can still depend on arrival order in the pathological case of a chain of
-    observations each within tolerance of its neighbour but not of the first;
-    real jitter is seconds wide, so a real cluster collapses to one anchor under
-    every order.)
+    does not depend on the order the anchors were established in. The anchor
+    SET can still depend on arrival order in the chain-of-neighbours case. This
+    is retained as migration 032's reference rule; production ingest uses
+    :class:`ResetAnchorComponents` after #425 real-data evidence proved those
+    chains occur.
     """
     _require_aware(raw_reset, "raw_reset")
     if (isinstance(anchors, ResetAnchorIndex)
@@ -121,7 +121,9 @@ class ResetAnchorIndex:
     nearest within tolerance, ties broken on the earlier anchor, first sight
     wins, the anchor never moves, and the pathological chain-of-neighbours
     order-dependence that docstring documents is preserved exactly, because the
-    anchor SET is still whatever the caller established in whatever order.
+    anchor SET is still whatever the caller established in whatever order. This
+    class remains the exact migration-032 oracle; current ingest uses
+    ``ResetAnchorComponents``.
 
     Only the LOOKUP changes. The linear scan did a full ``datetime`` subtraction
     against every established anchor, and a 5h group accumulates ~1,750 anchors
@@ -204,6 +206,156 @@ class ResetAnchorIndex:
         return len(self._order)
 
 
+class ResetAnchorComponents:
+    """Tolerance-connected raw-reset components with first-sight anchors.
+
+    ``ResetAnchorIndex`` intentionally preserves the original migration-032
+    rule: compare a raw reset only with already-established anchors. Real data
+    proved that rule can split a chain whose adjacent members are all within
+    tolerance. This index retains every distinct raw reset as evidence and
+    unions adjacent members transitively. The member with the smallest stable
+    physical ``order_key`` remains the completed component's canonical anchor,
+    independent of filesystem traversal or journal batch arrival. Callers that
+    omit an order key retain insertion-order behavior for compatibility.
+
+    ``add`` returns both the winning anchor and any formerly independent
+    component anchors retired by the union. Writers use the retired set to
+    converge rows materialized before a later bridge observation arrived.
+    """
+
+    __slots__ = (
+        "_tolerance", "_buckets", "_parent", "_rank",
+        "_anchor", "_first_order", "_member_order", "_next_order",
+    )
+
+    def __init__(
+        self, raws: Iterable[dt.datetime] = (),
+        *, tolerance_seconds: int = CODEX_RESET_ANCHOR_TOLERANCE_SECONDS,
+    ) -> None:
+        if not isinstance(tolerance_seconds, int) or isinstance(
+                tolerance_seconds, bool):
+            raise ValueError("tolerance_seconds must be an int")
+        if tolerance_seconds <= 0:
+            raise ValueError("tolerance_seconds must be positive")
+        self._tolerance = tolerance_seconds
+        self._buckets: dict[int, list[dt.datetime]] = {}
+        self._parent: dict[dt.datetime, dt.datetime] = {}
+        self._rank: dict[dt.datetime, int] = {}
+        self._anchor: dict[dt.datetime, dt.datetime] = {}
+        self._first_order: dict[
+            dt.datetime, tuple[str, int, int]
+        ] = {}
+        self._member_order: dict[
+            dt.datetime, tuple[str, int, int]
+        ] = {}
+        self._next_order = 0
+        for raw in raws:
+            self.add(raw)
+
+    @property
+    def tolerance_seconds(self) -> int:
+        return self._tolerance
+
+    def _bucket(self, value: dt.datetime) -> int:
+        return int(value.timestamp() // self._tolerance)
+
+    def _find(self, value: dt.datetime) -> dt.datetime:
+        parent = self._parent[value]
+        if parent != value:
+            self._parent[value] = self._find(parent)
+        return self._parent[value]
+
+    def _union(
+        self, left: dt.datetime, right: dt.datetime,
+    ) -> dt.datetime:
+        left_root = self._find(left)
+        right_root = self._find(right)
+        if left_root == right_root:
+            return left_root
+        if self._rank[left_root] < self._rank[right_root]:
+            left_root, right_root = right_root, left_root
+        self._parent[right_root] = left_root
+        if self._rank[left_root] == self._rank[right_root]:
+            self._rank[left_root] += 1
+        if self._first_order[right_root] < self._first_order[left_root]:
+            self._anchor[left_root] = self._anchor[right_root]
+            self._first_order[left_root] = self._first_order[right_root]
+        del self._anchor[right_root]
+        del self._first_order[right_root]
+        return left_root
+
+    def add(
+        self, raw_reset: dt.datetime,
+        *, order_key: "tuple[str, int, int] | None" = None,
+    ) -> tuple[dt.datetime, tuple[dt.datetime, ...]]:
+        """Add one raw reset and return ``(anchor, retired_anchors)``."""
+        _require_aware(raw_reset, "raw_reset")
+        if order_key is None:
+            order_key = ("", self._next_order, 0)
+        if (
+            not isinstance(order_key, tuple) or len(order_key) != 3
+            or not isinstance(order_key[0], str)
+            or not isinstance(order_key[1], int)
+            or isinstance(order_key[1], bool)
+            or not isinstance(order_key[2], int)
+            or isinstance(order_key[2], bool)
+        ):
+            raise ValueError(
+                "order_key must be a (source_path, line_offset, row_id) tuple")
+        self._next_order += 1
+        if raw_reset in self._parent:
+            root = self._find(raw_reset)
+            previous = self._anchor[root]
+            if order_key < self._member_order[raw_reset]:
+                self._member_order[raw_reset] = order_key
+                if order_key < self._first_order[root]:
+                    self._first_order[root] = order_key
+                    self._anchor[root] = raw_reset
+            winner = self._anchor[root]
+            retired = (previous,) if previous != winner else ()
+            return winner, retired
+
+        probe = self._bucket(raw_reset)
+        neighbours: list[dt.datetime] = []
+        for bucket_id in (probe - 1, probe, probe + 1):
+            for candidate in self._buckets.get(bucket_id, ()):
+                if abs((raw_reset - candidate).total_seconds()) <= self._tolerance:
+                    neighbours.append(candidate)
+
+        self._parent[raw_reset] = raw_reset
+        self._rank[raw_reset] = 0
+        self._anchor[raw_reset] = raw_reset
+        self._first_order[raw_reset] = order_key
+        self._member_order[raw_reset] = order_key
+        self._buckets.setdefault(probe, []).append(raw_reset)
+
+        prior_anchors = {raw_reset}
+        prior_anchors.update(
+            self._anchor[self._find(candidate)] for candidate in neighbours)
+        root = raw_reset
+        for candidate in neighbours:
+            root = self._union(root, candidate)
+        winner = self._anchor[self._find(root)]
+        return winner, tuple(sorted(prior_anchors - {winner}))
+
+    def canonical(self, raw_reset: dt.datetime) -> dt.datetime:
+        """Return the completed component's first-sight anchor."""
+        _require_aware(raw_reset, "raw_reset")
+        return self._anchor[self._find(raw_reset)]
+
+    def __contains__(self, anchor: object) -> bool:
+        if not isinstance(anchor, dt.datetime):
+            return False
+        return anchor in self._buckets.get(self._bucket(anchor), ())
+
+    def __iter__(self):
+        """Distinct raw-reset evidence in insertion order."""
+        return iter(self._parent)
+
+    def __len__(self) -> int:
+        return len(self._parent)
+
+
 @dataclass(frozen=True)
 class QuotaWindowIdentity:
     """One root-qualified native quota window identity.
@@ -313,6 +465,7 @@ class QuotaBlock:
     last_observed_at: dt.datetime
     first_percent: float
     current_percent: float
+    physical_observations: tuple[QuotaObservation, ...] = ()
 
 
 @dataclass(frozen=True)
@@ -577,7 +730,14 @@ def build_blocks(observations: Iterable[QuotaObservation]) -> tuple[QuotaBlock,
     ``QuotaBlock.resets_at``, which every renderer shows, is that same anchor.
     """
     by_block: dict[tuple[QuotaWindowIdentity, dt.datetime], list[QuotaObservation]] = {}
+    physical_by_block: dict[
+        tuple[QuotaWindowIdentity, dt.datetime], list[QuotaObservation]
+    ] = {}
     for history in build_history(observations):
+        for observation in history.physical_observations:
+            physical_by_block.setdefault(
+                (history.identity, observation.canonical_resets_at), []
+            ).append(observation)
         for observation in history.observations:
             by_block.setdefault(
                 (history.identity, observation.canonical_resets_at), []
@@ -599,6 +759,10 @@ def build_blocks(observations: Iterable[QuotaObservation]) -> tuple[QuotaBlock,
             last_observed_at=last.captured_at,
             first_percent=first.used_percent,
             current_percent=last.used_percent,
+            physical_observations=tuple(sorted(
+                physical_by_block[(identity, resets_at)],
+                key=physical_order_key,
+            )),
         ))
     return tuple(blocks)