cctally 1.92.2 → 1.93.0

package/bin/_cctally_share.py

@@ -1024,10 +1024,12 @@ def _build_project_snapshot(
     Privacy invariant (Section 8.4 / Section 5.3): the builder populates
     `ProjectCell.label` AND `ChartPoint.project_label` (and `x_label`,
     which is the project axis on a HorizontalBarChart) with the REAL
-    `display_key`. The `_share_render_and_emit` wrapper then runs
-    `_lib_share._scrub` BEFORE rendering — that's the single chokepoint
-    that rewrites every project label to `project-1` / `project-2` /
-    ... unless `--reveal-projects` is passed. The Section 8.4 canary
+    `display_key`. `_lib_share.render()` is the chokepoint: it prepares
+    the RAW snapshot it is handed, rewriting every project label to
+    `project-1` / `project-2` / ... unless `--reveal-projects` is
+    passed. (It is NOT `_scrub()`: that function is retained for
+    backward compatibility and no production path calls it.) The
+    Section 8.4 canary
     test (`test_anonymized_output_contains_zero_original_tokens`) and
     the wrapper-level regression
     (`test_share_render_and_emit_scrubs_project_labels`) both anchor
@@ -1133,6 +1135,7 @@ def _build_project_snapshot(
             x_value=cost,
             y_value=cost,
             project_label=proj_label,
+            x_label_kind="project",
         ))
     chart = (
         _lib_share.HorizontalBarChart(
@@ -1377,27 +1380,43 @@ def _session_disambiguate_labels(
 
     Sessions without collisions are absent from the returned dict;
     callers fall back to the bare basename.
+
+    #503 S1: the algorithm itself now lives in the share kernel as
+    ``_lib_share.disambiguate_basenames``, because the kernel's reveal-mode
+    preparation needs the same resolution on the dashboard path. This is the
+    delegating wrapper, so "the kernel matches the CLI" is one implementation
+    rather than two that agree by inspection. The kernel additionally widens
+    the qualifier when the parents also repeat, where this function used to
+    emit the same colliding label twice.
+
+    The kernel's input contract is one entry per DISTINCT identity, so this
+    wrapper deduplicates by path before delegating and fans the resulting
+    label back out to every session sharing that path. A session list
+    normally carries one project across several rows, and handing those
+    duplicates to the kernel makes its ordinal fallback invent
+    ``repo (parent) (1)`` / ``(2)`` / ``(3)`` for what is one project — which
+    also splits that project's cost across three alias slots, because a
+    session-derived ``ProjectCell`` carries no ``identity`` and the alias key
+    is therefore the label itself.
     """
-    basenames: list[str] = []
-    for s in sessions:
-        path = s.project_path or ""
-        basenames.append(os.path.basename(path) or path or "(unknown)")
-    counts: dict[str, int] = {}
-    for bn in basenames:
-        counts[bn] = counts.get(bn, 0) + 1
-    augmented: dict[int, str] = {}
-    for idx, s in enumerate(sessions):
-        bn = basenames[idx]
-        # Skip suffixing the literal "(unknown)" bare label even on
-        # collision: `_build_anon_mapping` literal-passthrough-protects
-        # exact "(unknown)" only — a suffixed form like "(unknown) (/)"
-        # would be mapped to a regular `project-N` slot, losing the
-        # (unknown) semantic in the anonymized output.
-        if counts[bn] > 1 and bn != "(unknown)":
-            path = s.project_path or ""
-            parent = os.path.basename(os.path.dirname(path)) or "/"
-            augmented[idx] = f"{bn} ({parent})"
-    return augmented
+    _lib_share = _share_load_lib()
+    paths = [(s.project_path or "") for s in sessions]
+    distinct: list[str] = []
+    index_of: dict[str, int] = {}
+    for p in paths:
+        if p not in index_of:
+            index_of[p] = len(distinct)
+            distinct.append(p)
+    resolved = _lib_share.disambiguate_basenames(distinct)
+    bare = [
+        (os.path.basename(p) or p or "(unknown)") for p in paths
+    ]
+    out: dict[int, str] = {}
+    for idx, p in enumerate(paths):
+        label = resolved[index_of[p]]
+        if label != bare[idx]:
+            out[idx] = label
+    return out
 
 
 def _build_session_snapshot(
@@ -1428,11 +1447,12 @@ def _build_session_snapshot(
 
     Privacy invariant (Section 8.4 / Section 5.3): the builder populates
     `ProjectCell.label`, `ChartPoint.project_label`, and
-    `ChartPoint.x_label` with the REAL `project_path` basename. The
-    `_share_render_and_emit` wrapper runs `_lib_share._scrub` BEFORE
-    rendering — that's the single chokepoint that rewrites every
-    project label to `project-1` / `project-2` / ... unless
-    `--reveal-projects` is passed.
+    `ChartPoint.x_label` with the REAL `project_path` basename.
+    `_lib_share.render()` is the chokepoint: it prepares the RAW
+    snapshot it is handed, rewriting every project label to
+    `project-1` / `project-2` / ... unless `--reveal-projects` is
+    passed. (It is NOT `_scrub()`: that function is retained for
+    backward compatibility and no production path calls it.)
 
     Deviations from the plan sketch (which assumed dict rows with keys
     `session_id` / `started_at` / `project_path` / `cost_usd` /
@@ -1530,6 +1550,7 @@ def _build_session_snapshot(
             x_value=cost_usd,
             y_value=cost_usd,
             project_label=proj_label,
+            x_label_kind="project",
         ))
     chart = (
         _lib_share.HorizontalBarChart(
@@ -1651,7 +1672,7 @@ def _share_iso(value) -> "str | None":
 # control.
 
 def _share_render_and_emit(snap, args) -> None:
-    """End-to-end: scrub -> render -> emit -> optional open.
+    """End-to-end: render -> emit -> optional open.
 
     Lazy-imports `_lib_share` so non-share invocations don't pay the import
     cost. The kernel module stays I/O-pure; this wrapper does all the
@@ -1680,13 +1701,29 @@ def _share_render_and_emit(snap, args) -> None:
     # class-identity invariant this enforces.
     _lib_share = _share_load_lib()
 
-    scrubbed = _lib_share._scrub(snap, reveal_projects=args.reveal_projects)
-    rendered = _lib_share.render(
-        scrubbed,
-        format=args.format,
-        theme=args.theme,
-        branding=not args.no_branding,
-    )
+    # No pre-scrub. `render()` owns the privacy contract and must receive the
+    # RAW snapshot: a second aliasing pass over an already-aliased legacy
+    # label (identity None) renumbers it by re-ranking (#503 S1).
+    #
+    # A privacy refusal is a MESSAGE, not a traceback. `render()` raises
+    # `SharePrivacyViolation` rather than redacting, so this is a reachable
+    # user-facing outcome and the CLI owes the user a sentence naming what it
+    # found. Exit 3 per `docs/cli-contract.md`: the share surface's staged
+    # family already uses 2 for a flag-combo error and 3 for a stage that
+    # failed after the flags validated, which is exactly what this is. The
+    # refusal precedes destination resolution, so nothing is written.
+    try:
+        rendered = _lib_share.render(
+            snap,
+            format=args.format,
+            theme=args.theme,
+            branding=not args.no_branding,
+            reveal_projects=args.reveal_projects,
+        )
+    except _lib_share.SharePrivacyViolation as exc:
+        print(f"cctally: refused to write a share artifact — {exc}",
+              file=sys.stderr)
+        sys.exit(3)
 
     utc_date = snap.generated_at.astimezone(dt.timezone.utc).strftime("%Y-%m-%d")
     kind, value = _resolve_destination(args, cmd=snap.cmd, generated_at_utc_date=utc_date)

package/bin/_cctally_source_analytics.py

@@ -1919,15 +1919,13 @@ def _emit_source_share(
         claude_snap = build_source_share_snapshot(
             command, claude, reveal_projects=reveal_projects,
         )
+        # RAW sections (#503 S1): `compose()` prepares them together under one
+        # merged alias namespace, so `project-1` denotes the same project in
+        # the Claude and the Codex section. A per-section pre-scrub gave each
+        # section its own numbering.
         sections = (
-            lib.ComposedSection(
-                snap=lib._scrub(claude_snap, reveal_projects=reveal_projects),
-                drift_detected=False,
-            ),
-            lib.ComposedSection(
-                snap=lib._scrub(codex_snap, reveal_projects=reveal_projects),
-                drift_detected=False,
-            ),
+            lib.ComposedSection(snap=claude_snap, drift_detected=False),
+            lib.ComposedSection(snap=codex_snap, drift_detected=False),
         )
         content = lib.compose(
             sections,

package/bin/_cctally_store.py

@@ -638,9 +638,17 @@ _STATS_OPEN_TIME_MAINTENANCE_WAIT_S = 30.0
 
 
 @contextlib.contextmanager
-def stats_open_time_guard(*, live: bool = True):
+def stats_open_time_guard(
+    *, live: bool = True, wait_seconds: "float | None" = None,
+):
     """Hold maintenance-exclusive + the sanctioned scope across open-time DDL.
 
+    ``wait_seconds`` overrides the generous default wait. #496 S5b's
+    quota-projection reconciliation passes ``0.0``: that path is optional work
+    on the open path, and waiting thirty seconds for a competitor to finish its
+    own maintenance is strictly worse than leaving the flag set for the next
+    armed open, which is the fail-closed direction anyway.
+
     ``live=False`` marks a ``_target_path`` (scratch) build: it enters the
     sanctioned scope but takes NO flock, mirroring the divergence
     ``stats_open_guarded`` already documents. Two reasons, both concrete:
@@ -668,7 +676,10 @@ def stats_open_time_guard(*, live: bool = True):
     )
     acquired = False
     try:
-        deadline = time.monotonic() + _STATS_OPEN_TIME_MAINTENANCE_WAIT_S
+        deadline = time.monotonic() + (
+            _STATS_OPEN_TIME_MAINTENANCE_WAIT_S if wait_seconds is None
+            else float(wait_seconds)
+        )
         while True:
             try:
                 fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)

package/bin/_cctally_tui.py

@@ -270,6 +270,11 @@ from _cctally_dashboard_sources import (
     refresh_codex_source_clock,
     resolve_dashboard_source_semantics,
 )
+# #496 S5b §4.7. Module level rather than lazy, unlike this module's other
+# `_cctally_quota` uses: an `except` clause needs the name bound before the
+# `try`, and `_cctally_dashboard_sources` above already imports that module at
+# ITS module level, so this adds no edge to the import graph.
+from _cctally_quota import QuotaProjectionIncomplete
 from _lib_dashboard_sources import (
     SOURCE_SCHEMA_VERSION,
     CapabilityRecord,
@@ -2607,6 +2612,23 @@ def _tui_build_source_bundle(
             raw_config if raw_config is not None else c.load_config(),
             display_tz_name=display_tz_name,
         )
+        # `codex_stats_digest`'s relation table reads `quota_projection_state`
+        # and `quota_window_blocks` from a pure kernel that may not import
+        # `_cctally_quota`, so its callers gate it (#496 S5b section 4.7).
+        #
+        # This ONE call covers the second `codex_stats_digest` below as well,
+        # and the reason is not that the gate is a property of the connection:
+        # this connection's statement-scoped autocommit reads may see mixed
+        # generations, which is exactly what `stats_generation_moved` exists to
+        # catch, so the post-build read CAN see a generation this gate never
+        # checked. It is safe because that digest is never rendered — it is only
+        # compared against this one. A generation carrying an incomplete
+        # projection produces a different digest, `stats_generation_moved` is
+        # then true, and the build returns the prior bundle or raises. An EQUAL
+        # digest means the relations did not move, so the post-build read saw
+        # the generation this gate did check.
+        from _cctally_quota import assert_projection_readable
+        assert_projection_readable(stats_conn)
         stats_digest = codex_stats_digest(stats_conn)
         # #341 finding 9: the account registry/active-identity digest. Empty for
         # every <=1-account install (byte-neutral — appended only when non-empty),
@@ -3254,6 +3276,13 @@ def _tui_build_snapshot_once(
             with _perf.phase("signature"):
                 try:
                     dispatch_sig = _tui_compute_dispatch_signature(conn)
+                except QuotaProjectionIncomplete as exc:
+                    # #496 S5b §4.7: ahead of the generic handler on purpose.
+                    # Below it the refusal is sanitized into a generic
+                    # stats-or-cache failure, which names no cause and no
+                    # remedy; the message this leg records carries both.
+                    capture_failure("quota-projection", "other", exc)
+                    dispatch_sig = None
                 except Exception as exc:
                     capture_failure("dispatch-signature", "stats_or_cache", exc)
                     dispatch_sig = None
@@ -3886,6 +3915,15 @@ def _tui_build_snapshot_once(
                 )
                 if source_bundle is None:
                     raise RuntimeError("source bundle builder returned no bundle")
+            except QuotaProjectionIncomplete as exc:
+                # #496 S5b §4.7: ahead of the generic handler on purpose. Below
+                # it the refusal was sanitized into a generic stats-or-cache
+                # failure and the bundle fell back to `prior_source_bundle`,
+                # which is `None` on a cold start — a permanently blank Codex
+                # source panel with no cause and no remedy stated. The message
+                # this leg records carries both.
+                capture_failure("quota-projection", "other", exc)
+                source_bundle = prior_source_bundle
             except Exception as exc:
                 # Public source warnings are stable/sanitized; the detailed
                 # exception remains only on the internal rebuild-error string.
@@ -4012,6 +4050,11 @@ def _tui_compute_dispatch_signature(stats_conn):
     """
     c = _cctally()
     sc = c._load_sibling("_lib_snapshot_cache")
+    # Same gate as `_tui_build_source_bundle`, for the same reason: this is the
+    # second caller of `codex_stats_digest`, whose relation table reads the two
+    # projection tables from a pure kernel (#496 S5b section 4.7).
+    from _cctally_quota import assert_projection_readable
+    assert_projection_readable(stats_conn)
     cache_conn = c.open_cache_db()
     try:
         return sc.compute_signature(
@@ -4202,6 +4245,16 @@ def _tui_build_idle_snapshot(prior, *, now_utc, precompute_envelope,
                 )
         except _StatsSnapshotCorruption:
             raise
+        except QuotaProjectionIncomplete as exc:
+            # #496 S5b §4.7, same reason as the two handlers in
+            # `_tui_build_snapshot_once`: the branch below classifies against
+            # the connection that faulted and would report a stats-or-cache
+            # fault, which is the wrong cause and the wrong remedy.
+            errors.append(f"quota-projection: {exc}")
+            idle_failures.append(SyncFailureAttribution(
+                leg="quota-projection", database="other", corruption=False,
+            ))
+            source_bundle = prior.source_bundle
         except Exception as exc:  # noqa: BLE001 — retain prior complete bundle
             # #496 S3 §8 (F16). This branch read stats through
             # `source_stats_conn` and swallowed the failure into a plain