cctally 1.99.0 → 1.100.0

package/bin/_cctally_parser.py

@@ -57,6 +57,22 @@ class CLIHelpFormatter(
         kwargs.setdefault("max_help_position", 30)
         super().__init__(prog, **kwargs)  # type: ignore[arg-type]
 
+    def _get_help_string(self, action: argparse.Action) -> "str | None":
+        """Never state a default for a required argument.
+
+        CPython 3.13 stopped appending ``(default: ...)`` to a required
+        argument's help; 3.11 and 3.12 still append it. Without this the same
+        parser prints two different help texts depending on the interpreter,
+        so `cctally account attribute --help` renders a meaningless
+        ``(default: None)`` under `--since` on the two older versions and the
+        goldened help diverges on every lane that is not 3.13. Pinning the
+        3.13 rule for every supported version is what makes `--help` a
+        property of this program rather than of the interpreter running it.
+        """
+        if action.required:
+            return action.help
+        return super()._get_help_string(action)
+
 
 _PHYSICAL_PROVIDER_SOURCES = ("claude", "codex")
 
@@ -3197,7 +3213,7 @@ def _build_db_parser(subparsers, name, *, help_text, xref=None):
     )
     db_checkpoint.add_argument(
         "--db",
-        choices=("cache", "stats"),
+        choices=("cache", "conversations", "stats"),
         default="cache",
         help="Which DB to checkpoint (default: cache)",
     )
@@ -3227,6 +3243,74 @@ def _build_db_parser(subparsers, name, *, help_text, xref=None):
     )
     db_vacuum.set_defaults(func=c.cmd_db_vacuum)
 
+
+def _build_dashboard_perf_parser(subparsers, name, *, help_text, xref=None):
+    """Build the `dashboard-perf` parser (#583 S1 §3.3).
+
+    Follows the `_build_doctor_parser` shape: `c = _cctally()` is resolved
+    INSIDE the function, and the parser finishes with `set_defaults`.
+    """
+    c = _cctally()
+    p = subparsers.add_parser(
+        name,
+        help=help_text,
+        formatter_class=CLIHelpFormatter,
+        description=textwrap.dedent(
+            """\
+            Read a running dashboard's tick cost, and arm its phase trace.
+
+            Reports the publish period SEPARATELY for the Codex-active and
+            Codex-idle regimes (median plus the observed range, with an
+            explicit "no samples yet" for a regime that has none), the
+            tick-cost breakdown with the mutually exclusive ingest and builder
+            halves named, the dispatch mix, any silent Group A cache-open
+            failures, and the trace state.
+
+            --trace on/off arms or disarms the deep phase trace on the running
+            process. The flip takes effect at the dashboard's next
+            authoritative build, which is why the report states the requested
+            and the applied state separately.
+
+            Connects only to an IP-literal loopback host and never to a LAN
+            address. A hostname is refused, `localhost` included, which is
+            stricter than the endpoint itself: the server treats `localhost`
+            as a loopback name and would serve it. The client refuses a name
+            because it cannot verify that the resolver's answer is this
+            machine.
+
+            Exit codes: 0 on a decoded HTTP 200, 2 on argument validation
+            including a non-loopback target or an out-of-range port, 3 on a
+            connection, HTTP, authentication, timeout or malformed-response
+            failure — including "no dashboard is running".
+
+            See docs/commands/dashboard-perf.md.
+            """
+        ),
+    )
+    p.add_argument(
+        "--host", default="127.0.0.1",
+        help="Loopback IP literal of the running dashboard (default 127.0.0.1)",
+    )
+    p.add_argument(
+        "--port", type=int, default=None,
+        help="Dashboard port (default: the same default `cctally dashboard` uses)",
+    )
+    p.add_argument(
+        "--token", default=None,
+        help="Bearer token, when the dashboard minted one for LAN access",
+    )
+    p.add_argument(
+        "--trace", choices=("on", "off"), default=None,
+        help="Arm or disarm the deep phase trace on the running process",
+    )
+    p.add_argument(
+        "--json", action="store_true",
+        help="Emit machine-readable JSON to stdout (schemaVersion: 1)",
+    )
+    p.set_defaults(func=c.cmd_dashboard_perf)
+    return p
+
+
 def _build_doctor_parser(subparsers, name, *, help_text, xref=None):
     """Build the `doctor` parser (registered via _REGISTRATION; #279 S6 W3).
 
@@ -3660,6 +3744,7 @@ _REGISTRATION = (
     _Reg('setup', _build_setup_parser, "Install provider hooks/handlers + symlinks", None, None),
     _Reg('db', _build_db_parser, "Migration / DB management (status, skip, unskip)", None, None),
     _Reg('doctor', _build_doctor_parser, "Diagnose data freshness and install state", None, None),
+    _Reg('dashboard-perf', _build_dashboard_perf_parser, "Read a running dashboard's tick cost; arm its phase trace", None, None),
     _Reg('pricing-check', _build_pricing_check_parser, "Detect stale or missing embedded model pricing", None, None),
     _Reg('hook-tick', _build_hook_tick_parser, argparse.SUPPRESS, None, None),
     _Reg('__preview', _build_preview_parser, argparse.SUPPRESS, None, lambda c: getattr(c, "cmd_preview", None) is not None),

package/bin/_cctally_quota.py

@@ -253,14 +253,26 @@ PROJECTION_READ_SITE_ACTIONS: "dict[str, str]" = {
 #: an unnamed caller reduces `gate_at_caller` to an assertion nothing tests, and
 #: that is how the first version of this map came to claim a gating caller that
 #: neither called the kernel nor called the gate.
+#:
+#: `_cctally_dashboard_sources.py::_codex_quota_reuse_identity` joined the list
+#: with #583 S5. It derives `codex_stats_digest` when its caller cannot supply
+#: one, which is the share path and the per-request cycle-detail route — neither
+#: of which computes a build signature, so neither had already gated. It gates
+#: and, uniquely among the named callers, returns `None` on
+#: `QuotaProjectionIncomplete` rather than propagating: it produces a cache KEY,
+#: and the fail-safe for an identity that cannot be established is a cold read.
+#: The retry signal is not lost, because its callers reach a `gate`-classified
+#: projection read within a few statements.
 PROJECTION_GATE_CALLERS: "dict[str, tuple[str, ...]]" = {
     "_lib_dashboard_sources.py::<module>::quota_projection_state": (
         "_cctally_tui.py::_tui_build_source_bundle",
         "_cctally_tui.py::_tui_compute_dispatch_signature",
+        "_cctally_dashboard_sources.py::_codex_quota_reuse_identity",
     ),
     "_lib_dashboard_sources.py::<module>::quota_window_blocks": (
         "_cctally_tui.py::_tui_build_source_bundle",
         "_cctally_tui.py::_tui_compute_dispatch_signature",
+        "_cctally_dashboard_sources.py::_codex_quota_reuse_identity",
     ),
 }
 
@@ -1908,13 +1920,14 @@ def load_codex_quota_observations(
     because SQL compares seconds while ``physical_order_key`` compares full
     datetimes and then breaks ties on the reset anchor and physical position.
 
-    The residual difference is a malformed row. Rows whose required text is
-    blank, or whose capture or reset instant SQLite cannot read as a time, are
-    excluded in SQL exactly as the loop below excludes them; a row that survives
-    those predicates but still fails a Python parse can, on this path, hide an
-    older valid capture of the same window that the full load would have
-    reported. That trade is confined to a store already carrying corrupt quota
-    rows, and it is the only behavioural difference between the two paths.
+    The residual differences are malformed or non-canonical instants. A row
+    that survives SQLite's predicates but still fails Python parsing can hide
+    an older valid capture of the same window. In the reverse direction,
+    ``datetime.fromisoformat`` accepts basic-format ISO instants such as
+    ``20260814T120000Z`` that SQLite's ``unixepoch`` rejects, so the SQL path
+    drops that row and may let an older capture win. Neither shape is emitted
+    by ``_utc_iso``; both are confined to a store carrying hand-written or
+    corrupt quota rows.
     """
     for name, value in (
         ("captured_at_or_after", captured_at_or_after), ("active_at", active_at),
@@ -2079,23 +2092,29 @@ def load_codex_quota_observations(
             else:
                 sql += " AND unixepoch(captured_at_utc) >= unixepoch(?)"
                 params.append(_utc_iso(captured_at_or_after))
-        if sql_bounded and max_rows is not None:
-            if active_at is not None:
-                sql += (
-                    " ORDER BY (unixepoch(resets_at_utc) > unixepoch(?)) DESC, "
-                    "unixepoch(captured_at_utc) DESC, unixepoch(resets_at_utc) DESC, "
-                    "source_path DESC, line_offset DESC"
-                )
-                params.append(_utc_iso(active_at))
+        # ``latest_per_identity`` replaces the base query wholesale below, so
+        # assembling its ORDER BY here would be dead work.
+        if not latest_per_identity:
+            if sql_bounded and max_rows is not None:
+                if active_at is not None:
+                    sql += (
+                        " ORDER BY (unixepoch(resets_at_utc) > unixepoch(?)) DESC, "
+                        "unixepoch(captured_at_utc) DESC, unixepoch(resets_at_utc) DESC, "
+                        "source_path DESC, line_offset DESC"
+                    )
+                    params.append(_utc_iso(active_at))
+                else:
+                    sql += (
+                        " ORDER BY unixepoch(captured_at_utc) DESC, "
+                        "unixepoch(resets_at_utc) DESC, source_path DESC, line_offset DESC"
+                    )
+                sql += " LIMIT ?"
+                params.append(max_rows)
             else:
                 sql += (
-                    " ORDER BY unixepoch(captured_at_utc) DESC, "
-                    "unixepoch(resets_at_utc) DESC, source_path DESC, line_offset DESC"
+                    " ORDER BY source_root_key, captured_at_utc, resets_at_utc, "
+                    "source_path, line_offset"
                 )
-            sql += " LIMIT ?"
-            params.append(max_rows)
-        else:
-            sql += " ORDER BY source_root_key, captured_at_utc, resets_at_utc, source_path, line_offset"
         # ONE SHARD PER GROUP (public #5), not one disjunction over all of them.
         # Measured on a 211K-row / 608-group store: an OR over the five-member
         # equality gives up and SCANs the table (2 groups 45.7ms, 3 groups

package/bin/_cctally_record.py

@@ -4172,6 +4172,8 @@ def cmd_record_usage(
     args: argparse.Namespace, *,
     ingest_mode: str = "authoritative",
     writer: str = "record-usage",
+    nudge_dashboard: bool = True,
+    nudge_sink=None,
 ) -> int:
     """Record usage from the Claude Code status line rate_limits — DB journal
     redesign reroute (Appendix A).
@@ -4187,7 +4189,23 @@ def cmd_record_usage(
     observes its own write synchronously; "opportunistic" (hook-tick OAuth /
     dedup ticks) skips a busy ingest lock and lets the winner consume the line.
     ``writer`` is the obs line ``src``. Returns 0 on a recorded/deduped tick, 2
-    on an implausible weekly resets_at."""
+    on an implausible weekly resets_at.
+
+    ``nudge_dashboard`` (#583 S2 §5.3) enqueues a rebuild on a locally running
+    dashboard when — and only when — the ingest emitted events. Pass False
+    from `_refresh_usage_inproc`, which runs inside the dashboard's own
+    ``sync_lock`` while servicing a ``refresh=1`` and whose caller
+    ``cmd_refresh_usage`` already nudges once itself.
+
+    ``nudge_sink`` is for callers that hold a cross-process lock across this
+    call. When supplied it is invoked INSTEAD of the nudge, and that caller
+    fires the real nudge once its critical section has ended. The nudge is a
+    loopback POST with a multi-second timeout, so a stalled nudge inside such a
+    section stalls every other process contending on the same lock. There are
+    two such locks and both supply a sink: ``_selected_state_lock`` (the OAuth
+    refresh and the authoritative statusline publication) and the statusline
+    persist flock (``_statusline_reduce_and_publish``, reached from the forked
+    persist child and from the ``sync_for_test`` foreground path)."""
 
     # ULP-noise sanitization is applied at the cmd_record_usage ingress
     # boundary so every downstream consumer (HWM files, DB rows,
@@ -4310,7 +4328,24 @@ def cmd_record_usage(
         account=obs_account))
     # authoritative observes its own write synchronously; opportunistic skips a
     # busy ingest lock and lets the current holder consume the appended line.
-    _jr.run_stats_ingest(mode=ingest_mode)
+    result = _jr.run_stats_ingest(mode=ingest_mode)
+    # #583 S2 §5.3. Nudge only on a MATERIAL change. This runs at Claude
+    # Code's status-line cadence, so an unconditional nudge would queue a
+    # rebuild for work that changed nothing displayed. `consumed` is the wrong
+    # signal — unchanged observations advance ingestion without changing
+    # anything the dashboard shows — and `alerts` is the wrong signal, because
+    # it covers only a subset of material events: a new 5-hour window changes
+    # the dashboard without necessarily firing an alert. The nudge happens
+    # after `run_stats_ingest` returns, which is already after post-commit
+    # alert dispatch, so the alerts ordering is untouched.
+    if (nudge_dashboard
+            and getattr(result, "ran", False)
+            and getattr(result, "error", None) is None
+            and int(getattr(result, "events_emitted", 0)) > 0):
+        # A caller holding the selected-state lock supplies a sink and fires
+        # the real nudge after releasing it — a network call has no business
+        # inside that critical section.
+        (nudge_sink or _cctally()._nudge_dashboard_repaint)()
     return 0
 
 

package/bin/_cctally_refresh.py

@@ -716,6 +716,11 @@ def _refresh_usage_inproc_locked(
             *({"fiveHour"} if five_pct is not None else set()),
         },
         lock_held=True,
+        # #583 S2 §5.3: the dashboard calls this INSIDE its own `sync_lock`
+        # while servicing a `refresh=1`, so an inner nudge would enqueue a
+        # second rebuild for work already underway. `cmd_refresh_usage`
+        # already nudges once on its own after this returns.
+        nudge_dashboard=False,
     )
     if authoritative.status != "ok":
         return _RefreshUsageResult(
@@ -761,6 +766,25 @@ def _refresh_usage_inproc_locked(
     return _RefreshUsageResult(status="ok", payload=payload, warnings=warnings)
 
 
+def _resolve_dashboard_api_token() -> "str | None":
+    """Return the bearer token a running dashboard would require, if known.
+
+    #583 S2 §4. `_require_api_auth` admits an unauthenticated `/api/*` request
+    only when `cctally_api_token` is None, and the dashboard mints that token
+    with `secrets.token_urlsafe(32)` at startup for a non-loopback bind. It is
+    printed once ("dashboard: LAN access token: …") and placed in the startup
+    URL's fragment; it is never written to `config.json` and never persisted.
+    So there is NO configured token for a separate `refresh-usage` process to
+    read, and this environment variable is the only mechanism available today:
+    export the printed token and the nudge authenticates. Without it a
+    LAN-bound, token-configured dashboard answers 401 and the helper's
+    swallow-everything contract discards the nudge, which is a pre-existing
+    defect rather than a regression.
+    """
+    token = (os.environ.get("CCTALLY_DASHBOARD_API_TOKEN") or "").strip()
+    return token or None
+
+
 def _nudge_dashboard_repaint(port: int = 8789, timeout_seconds: float = 3.0) -> None:
     """Best-effort: tell a locally-running dashboard to rebuild+broadcast NOW.
 
@@ -776,20 +800,28 @@ def _nudge_dashboard_repaint(port: int = 8789, timeout_seconds: float = 3.0) ->
 
     CSRF: the dashboard's _check_origin_csrf requires Origin/Host authority
     parity. urllib auto-sets Host from the URL; we set Origin to the
-    byte-identical authority so the POST is accepted (not 403). The timeout
-    is 3.0s — comfortably above the server's _DASHBOARD_SYNC_LOCK_TIMEOUT_
-    SECONDS (2.0s) bounded lock-wait — so the client stays connected until
-    the 204 lands and never leaves a broken-pipe log line in the dashboard's
-    terminal. In the common case (lock free) it returns in single-digit ms.
+    byte-identical authority so the POST is accepted (not 403).
+
+    #583 S2 §4. The URL carries `queue=1`, which marks this as a MACHINE
+    NUDGE: the handler enqueues it even when `sync_lock` is free, because this
+    fires at Claude Code's status-line cadence and a synchronous rebuild at
+    that frequency would reopen the #313 peg. The response is therefore a
+    202 that arrives as soon as the request is queued, not a 204 that waits
+    for a rebuild — the 3.0s timeout is now generous rather than tuned to a
+    server-side lock-wait. A bearer header is sent when a token is
+    resolvable; see `_resolve_dashboard_api_token`.
     """
     # Whole body (incl. Request construction) inside the try so the
     # "swallows EVERY error" contract holds structurally, not just because
     # Request() happens to be total for the hardcoded loopback URL.
     try:
-        url = f"http://127.0.0.1:{port}/api/sync?refresh=0"
+        url = f"http://127.0.0.1:{port}/api/sync?refresh=0&queue=1"
+        headers = {"Origin": f"http://127.0.0.1:{port}"}
+        token = _cctally()._resolve_dashboard_api_token()
+        if token:
+            headers["Authorization"] = f"Bearer {token}"
         req = urllib.request.Request(
-            url, data=b"", method="POST",
-            headers={"Origin": f"http://127.0.0.1:{port}"},
+            url, data=b"", method="POST", headers=headers,
         )
         with urllib.request.urlopen(req, timeout=timeout_seconds) as resp:
             resp.read()
@@ -922,16 +954,28 @@ def _hook_tick_oauth_refresh(
     # its suppression conditions.  A concurrent publisher can otherwise make
     # this tick issue an unnecessary OAuth request between the initial gate
     # and the request itself.
+    # #583 S2: the nudge is deferred out of the critical section. This frame
+    # owns the lock across the OAuth fetch AND the authoritative record, so
+    # `_authoritative_record_usage` cannot release it — the deferral has to
+    # reach the frame that acquired it. The nudge is a loopback POST with a
+    # multi-second timeout and this lock is an `fcntl.flock` every cctally
+    # process contends on, so one unresponsive listener would otherwise stall
+    # every other process's selected-state writes at status-line cadence.
+    deferred = []
     try:
         with c._selected_state_lock():
-            return _hook_tick_oauth_refresh_locked(
+            out = _hook_tick_oauth_refresh_locked(
                 c,
                 token=token,
                 timeout_seconds=timeout_seconds,
                 throttle_seconds=throttle_seconds,
+                nudge_sink=lambda: deferred.append(1),
             )
     except OSError:
         return "err(record-usage=exc)", None
+    if deferred:
+        c._nudge_dashboard_repaint()
+    return out
 
 
 def _hook_tick_oauth_refresh_locked(
@@ -940,8 +984,13 @@ def _hook_tick_oauth_refresh_locked(
     token: str,
     timeout_seconds: float,
     throttle_seconds: float,
+    nudge_sink=None,
 ) -> tuple[str, dict | None]:
-    """Automatic OAuth path with the selected-state lock already held."""
+    """Automatic OAuth path with the selected-state lock already held.
+
+    ``nudge_sink`` records that a dashboard nudge is warranted; the caller
+    fires it after releasing the lock (#583 S2).
+    """
     # Backfill gate: an inflight/invalid tombstone bypasses only selected-age
     # suppression so a later authoritative result can repair it.  The normal
     # throttle and 429 deadline continue to bound OAuth traffic.
@@ -997,6 +1046,7 @@ def _hook_tick_oauth_refresh_locked(
         record_args,
         {"sevenDay", *({"fiveHour"} if five_pct is not None else set())},
         lock_held=True,
+        nudge_sink=nudge_sink,
     )
     if authoritative.status != "ok":
         reason = authoritative.reason or ""

package/bin/_cctally_statusline.py

@@ -988,21 +988,42 @@ def _authoritative_record_usage(
     observed_axes,
     *,
     lock_held: bool = False,
+    nudge_dashboard: bool = True,
+    nudge_sink=None,
 ) -> _AuthoritativeRecordResult:
     """Record OAuth authority under write-ahead tombstones and reconcile it.
 
     ``lock_held`` is for OAuth refresh callers that already hold the selected
     lock across their fetch, authoritative publication, and matching backoff
     transition. All other callers acquire the same blocking lock here.
+
+    ``nudge_dashboard`` (#583 S2 §5.3) is passed straight through to
+    ``cmd_record_usage``. It defaults on, so the statusline / hook path keeps
+    nudging; ``_refresh_usage_inproc`` passes False.
+
+    ``nudge_sink`` defers the nudge out of the selected-state critical section.
+    The nudge is a loopback POST with a multi-second timeout, and this lock is
+    an ``fcntl.flock`` every cctally process contends on, so firing it here
+    would let one unresponsive listener stall every other process's
+    selected-state writes. This frame owns the lock only on the
+    ``lock_held=False`` path, so that is the only path that can fire the
+    deferred nudge itself; a caller passing ``lock_held=True`` owns the lock
+    and must supply its own sink, or the nudge stays inside its section.
     """
     if not lock_held:
+        deferred = []
         try:
             with _selected_state_lock():
-                return _authoritative_record_usage(
-                    args, observed_axes, lock_held=True
+                result = _authoritative_record_usage(
+                    args, observed_axes, lock_held=True,
+                    nudge_dashboard=nudge_dashboard,
+                    nudge_sink=(nudge_sink or (lambda: deferred.append(1))),
                 )
         except OSError as exc:
             return _AuthoritativeRecordResult("record_failed", str(exc))
+        if deferred:
+            _cctally()._nudge_dashboard_repaint()
+        return result
 
     now_epoch = int(time.time())
     try:
@@ -1011,7 +1032,8 @@ def _authoritative_record_usage(
         return _AuthoritativeRecordResult("record_failed", str(exc))
 
     try:
-        rc = _cctally().cmd_record_usage(args)
+        rc = _cctally().cmd_record_usage(
+            args, nudge_dashboard=nudge_dashboard, nudge_sink=nudge_sink)
     except _cctally().StatsRebuildDeferred as exc:
         return _AuthoritativeRecordResult("record_failed", str(exc))
     except Exception as exc:
@@ -1109,7 +1131,18 @@ def _projection_changed(before: "_candidates.DbProjection", after: "_candidates.
     return before.five_hour != after.five_hour or before.seven_day != after.seven_day
 
 
-def _statusline_reduce_and_publish() -> "_candidates.ReductionDecision | None":
+def _statusline_reduce_and_publish(
+        *, nudge_sink=None) -> "_candidates.ReductionDecision | None":
+    """Reduce the candidate spool and publish the winner.
+
+    ``nudge_sink`` (#583 S2) is threaded to ``cmd_record_usage``. EVERY caller
+    of this function runs it inside the statusline persist flock — the forked
+    child takes it blocking, and the ``sync_for_test`` path runs under the
+    parent's hold — and the dashboard nudge is a loopback POST with a
+    multi-second timeout. Firing it in here would let one unresponsive listener
+    stall every statusline render on this machine, at status-line cadence. The
+    caller that acquired the lock fires the real nudge once it has released.
+    """
     now_epoch = int(time.time())
     candidates = _load_candidate_spool(now_epoch=now_epoch)
     if not candidates:
@@ -1170,7 +1203,7 @@ def _statusline_reduce_and_publish() -> "_candidates.ReductionDecision | None":
     # "record_failed".
     try:
         record_rc = _cctally().cmd_record_usage(
-            args, ingest_mode="opportunistic"
+            args, ingest_mode="opportunistic", nudge_sink=nudge_sink
         )
     except _cctally().StatsRebuildDeferred:
         return decision
@@ -1255,9 +1288,14 @@ def _fork_persist(parent_lock_fd: int) -> None:
             fcntl.flock(child_fd, fcntl.LOCK_EX)
         except OSError:
             child_fd = -1
+        # #583 S2: the dashboard nudge fires AFTER this lock is released. This
+        # is the path a real statusline render takes, and the nudge is a
+        # loopback POST with a multi-second timeout.
+        deferred = []
         try:
             if child_fd >= 0:
-                _statusline_reduce_and_publish()
+                _statusline_reduce_and_publish(
+                    nudge_sink=lambda: deferred.append(1))
         finally:
             if child_fd >= 0:
                 try:
@@ -1268,6 +1306,8 @@ def _fork_persist(parent_lock_fd: int) -> None:
                     os.close(child_fd)
                 except OSError:
                     pass
+            if deferred:
+                _cctally()._nudge_dashboard_repaint()
     except BaseException:
         pass
     finally:
@@ -1288,16 +1328,22 @@ def _statusline_persist(parsed, *, sync_for_test: bool = False) -> None:
     lock_fd = c._try_acquire_persist_lock()
     if lock_fd is None:
         return
+    # #583 S2: same deferral as the forked child. This frame owns the lock, so
+    # it is the frame that must fire the nudge once it has released it.
+    deferred = []
     try:
         preliminary = _preliminary_decision()
         if preliminary is None or preliminary.action == "NOOP":
             return
         if sync_for_test:
-            _statusline_reduce_and_publish()
+            _statusline_reduce_and_publish(
+                nudge_sink=lambda: deferred.append(1))
             return
         _fork_persist(lock_fd)
     finally:
         c._release_persist_lock(lock_fd)
+        if deferred:
+            c._nudge_dashboard_repaint()
 
 
 def _try_acquire_statusline_oauth_lock() -> "int | None":