classifyre-cli 0.4.46__tar.gz → 0.4.47__tar.gz

classifyre_cli-0.4.47/.turbo/turbo-build.log

@@ -0,0 +1,3 @@
+$ uv sync
+Resolved 276 packages in 193ms
+Checked 51 packages in 1ms

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: classifyre-cli
-Version: 0.4.46
+Version: 0.4.47
 Summary: Classifyre CLI — scan and classify unstructured data sources
 License: MIT
 Keywords: data,ingestion,metadata,pii,secrets,unstructured

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classifyre/cli",
-  "version": "0.4.46",
+  "version": "0.4.47",
   "private": true,
   "scripts": {
     "build": "uv sync",

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "classifyre-cli"
-version = "0.4.46"
+version = "0.4.47"
 description = "Classifyre CLI — scan and classify unstructured data sources"
 readme = "README.md"
 requires-python = ">=3.12"

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/azure_blob_storage/source.py

@@ -111,12 +111,28 @@ class AzureBlobStorageSource(ObjectStorageSourceBase):
 
     def _download_object(self, ref: ObjectRef) -> tuple[bytes, str | None]:
         blob_service_client = self._client()
-        container_client = blob_service_client.get_container_client(self._required_container())
+        container = self._required_container()
+        container_client = blob_service_client.get_container_client(container)
         blob_client = container_client.get_blob_client(ref.key)
 
         timeout = self._request_timeout_seconds()
-        downloader = blob_client.download_blob(offset=0, length=None, timeout=timeout)
+        max_bytes = self._max_object_bytes()
+        # Ranged download: fetch only the capped prefix instead of the whole blob.
+        downloader = blob_client.download_blob(offset=0, length=max_bytes, timeout=timeout)
         file_bytes = downloader.readall()
+
+        if len(file_bytes) > max_bytes:
+            file_bytes = file_bytes[:max_bytes]
+        if ref.size > max_bytes:
+            logger.warning(
+                "Truncated %s/%s/%s to %d of %d bytes for content extraction",
+                self._required_account_url(),
+                container,
+                ref.key,
+                max_bytes,
+                ref.size,
+            )
+
         return file_bytes, ref.content_type_hint
 
     def _external_url(self, key: str) -> str:

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/google_cloud_storage/source.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import logging
 from collections.abc import Iterator
 from typing import Any
 
@@ -8,6 +9,8 @@ from ...models.generated_input import GoogleCloudStorageInput
 from ..dependencies import require_module
 from ..object_storage.base import ObjectRef, ObjectStorageSourceBase
 
+logger = logging.getLogger(__name__)
+
 
 class GoogleCloudStorageSource(ObjectStorageSourceBase):
     source_type = "google_cloud_storage"
@@ -97,11 +100,26 @@ class GoogleCloudStorageSource(ObjectStorageSourceBase):
 
     def _download_object(self, ref: ObjectRef) -> tuple[bytes, str | None]:
         client = self._client()
-        bucket = client.bucket(self._required_bucket())
+        bucket_name = self._required_bucket()
+        bucket = client.bucket(bucket_name)
         blob = bucket.blob(ref.key)
 
         timeout = self._request_timeout_seconds()
-        file_bytes = blob.download_as_bytes(timeout=timeout)
+        max_bytes = self._max_object_bytes()
+        # Ranged download: fetch only the capped prefix instead of the whole blob.
+        file_bytes = blob.download_as_bytes(start=0, end=max_bytes - 1, timeout=timeout)
+
+        if len(file_bytes) > max_bytes:
+            file_bytes = file_bytes[:max_bytes]
+        if ref.size > max_bytes:
+            logger.warning(
+                "Truncated gs://%s/%s to %d of %d bytes for content extraction",
+                bucket_name,
+                ref.key,
+                max_bytes,
+                ref.size,
+            )
+
         return file_bytes, ref.content_type_hint
 
     def _external_url(self, key: str) -> str:

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/kafka/source.py

@@ -8,7 +8,11 @@ Sampling strategies map to consumer positioning:
 
 * ``LATEST``    — start near the tail of each partition (newest messages).
 * ``RANDOM``    — start at a random offset within each partition.
-* ``AUTOMATIC`` / ``ALL`` — start at the earliest retained offset.
+* ``ALL``       — start at the earliest retained offset.
+* ``AUTOMATIC`` — resume each partition from a saved per-partition cursor
+  (keyed ``"{topic}:{partition}"``), advancing it each run. Once a
+  partition's cursor catches up to the high watermark it wraps back to the
+  low watermark so the next run re-ingests from the start.
 
 All strategies read up to ``sampling.rows_per_page`` messages per topic.
 """
@@ -302,14 +306,56 @@ class KafkaSource(BaseSource):
             return max(low, high - per)
         if strategy == SamplingStrategy.RANDOM:
             return random.randint(low, max(low, high - per))
-        # AUTOMATIC / ALL: read from the earliest retained offset.
+        # ALL: read from the earliest retained offset.
         return low
 
+    def _automatic_start_offset(self, key: str, low: int, high: int) -> int:
+        """Resume offset for AUTOMATIC sampling, clamped to the retained range.
+
+        Retention may have deleted the previously saved offset (or this may be
+        the first run), in which case we fall back to the earliest retained
+        offset.
+        """
+        saved = self.automatic_offset(key)
+        if saved < low or saved > high:
+            return low
+        return saved
+
+    def _record_automatic_cursors(
+        self,
+        topic: str,
+        messages: list[dict[str, Any]],
+        starts: dict[int, int],
+        watermarks: dict[int, tuple[int, int]],
+    ) -> None:
+        """Advance the per-partition AUTOMATIC cursor after a consume pass.
+
+        Partitions that yielded messages resume from one past the highest
+        offset consumed; partitions that were assigned but yielded nothing
+        keep their (already-clamped) start offset. A partition that has
+        caught up to its high watermark wraps back to the low watermark so
+        the next run re-ingests from the start instead of stalling forever.
+        """
+        consumed_next: dict[int, int] = {}
+        for message in messages:
+            partition_id = int(message["partition"])
+            next_offset = int(message["offset"]) + 1
+            if next_offset > consumed_next.get(partition_id, -1):
+                consumed_next[partition_id] = next_offset
+
+        for partition_id, (low, high) in watermarks.items():
+            next_offset = consumed_next.get(partition_id, starts[partition_id])
+            if next_offset >= high:
+                next_offset = low  # fully caught up: wrap for the next run
+            self._record_cursor_key(f"{topic}:{partition_id}", next_offset)
+
     def _consume(self, topic: str, max_count: int) -> list[dict[str, Any]]:
         strategy = self._sampling().strategy
         consumer = self._make_consumer()
         timeout = self._request_timeout_seconds()
         out: list[dict[str, Any]] = []
+        starts: dict[int, int] = {}
+        watermarks: dict[int, tuple[int, int]] = {}
         try:
             metadata = self._cluster_metadata(consumer, topic)
             topic_meta = metadata.topics.get(topic)
@@ -325,9 +371,17 @@ class KafkaSource(BaseSource):
                 except Exception as exc:
                     logger.debug("Watermark lookup failed for %s[%s]: %s", topic, partition_id, exc)
                     continue
+                low, high = int(low), int(high)
                 if high <= low:
                     continue  # empty partition
-                tp.offset = self._start_offset(strategy, int(low), int(high), per)
+                if strategy == SamplingStrategy.AUTOMATIC:
+                    key = f"{topic}:{partition_id}"
+                    start = self._automatic_start_offset(key, low, high)
+                    starts[partition_id] = start
+                    watermarks[partition_id] = (low, high)
+                else:
+                    start = self._start_offset(strategy, low, high, per)
+                tp.offset = start
                 assignments.append(tp)
             if not assignments:
                 return out
@@ -357,6 +411,10 @@ class KafkaSource(BaseSource):
                         break
         finally:
             consumer.close()
+
+        if strategy == SamplingStrategy.AUTOMATIC and watermarks:
+            self._record_automatic_cursors(topic, out, starts, watermarks)
+
         return out
 
     def _format_messages(

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/object_storage/base.py

@@ -211,6 +211,20 @@ class ObjectStorageSourceBase(BaseSource, ABC):
     def _include_content_preview(self) -> bool:
         return bool(self._scope_option("include_content_preview", True))
 
+    # Shared cap across the object-storage family (S3-compatible, GCS, Azure Blob)
+    # so a single huge object can't OOM the scan pod. Mirrors local_folder's
+    # DEFAULT_MAX_FILE_BYTES guard, but sourced from each provider's own
+    # optional.connection.max_object_bytes field (schema default 5MB) when set.
+    DEFAULT_MAX_OBJECT_BYTES = 5 * 1024 * 1024
+
+    def _max_object_bytes(self) -> int:
+        value = self._connection_option("max_object_bytes", self.DEFAULT_MAX_OBJECT_BYTES)
+        try:
+            parsed = int(value)
+        except (TypeError, ValueError):
+            return self.DEFAULT_MAX_OBJECT_BYTES
+        return max(parsed, 1024)
+
     def _normalized_extension_filters(self, key: str) -> list[str]:
         values = self._scope_option(key, [])
         if not isinstance(values, list):

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/s3_compatible_storage/source.py

@@ -87,17 +87,30 @@ class S3CompatibleStorageSource(ObjectStorageSourceBase):
     def _download_object(self, ref: ObjectRef) -> tuple[bytes, str | None]:
         client = self._client()
         bucket = self._required_bucket()
+        max_bytes = self._max_object_bytes()
 
         response = client.get_object(Bucket=bucket, Key=ref.key)
         body = response["Body"]
         try:
-            file_bytes = body.read()
+            # Read one byte past the cap so we can detect truncation without
+            # ever materializing the full (potentially huge) object body.
+            file_bytes = body.read(max_bytes + 1)
         finally:
             try:
                 body.close()
             except Exception:
                 logger.debug("Failed to close S3 response body")
 
+        if len(file_bytes) > max_bytes:
+            file_bytes = file_bytes[:max_bytes]
+            logger.warning(
+                "Truncated s3://%s/%s to %d of %d bytes for content extraction",
+                bucket,
+                ref.key,
+                max_bytes,
+                ref.size,
+            )
+
         content_type = response.get("ContentType")
         return file_bytes, str(content_type) if content_type else None
 

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/slack/source.py

@@ -322,10 +322,9 @@ class SlackSource(BaseSource):
         is_automatic = strategy == SamplingStrategy.AUTOMATIC
         if strategy == SamplingStrategy.ALL:
             max_total: int | None = None
-        elif is_automatic:
-            max_total = int(sampling.rows_per_page or 100)
         else:
-            max_total = 100
+            # AUTOMATIC / LATEST / RANDOM all honor the configured window size.
+            max_total = int(sampling.rows_per_page or 100)
         oldest = self._normalize_ts(time_range_options.oldest)
         latest = self._normalize_ts(time_range_options.latest)
         batch_size = min(int(ingestion_options.batch_size or 200), 200)

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/src/sources/youtube/source.py

@@ -461,11 +461,11 @@ class YouTubeSource(BaseSource):
             if transcript.available_languages:
                 asset_metadata["caption_tracks"] = transcript.available_languages
 
+        # Checksum must only reflect content changes: view/like counters move on
+        # every re-scan and would flip UNCHANGED assets to UPDATED spuriously.
         checksum_data = {
             "video_id": video_id,
             "title": title,
-            "view_count": asset_metadata.get("view_count"),
-            "like_count": asset_metadata.get("like_count"),
             "transcript_available": asset_metadata["transcript_available"],
         }
 

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/tests/test_azure_blob_storage_source.py

@@ -80,3 +80,74 @@ def test_azure_blob_storage_external_url():
         source._external_url("folder/report.csv")
         == "https://acme.blob.core.windows.net/documents/folder/report.csv"
     )
+
+
+class _FakeDownloader:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def readall(self) -> bytes:
+        return self._data
+
+
+class _FakeBlobClient:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def download_blob(
+        self, offset: int = 0, length: int | None = None, timeout: float | None = None
+    ) -> _FakeDownloader:
+        start = offset or 0
+        end = len(self._data) if length is None else start + length
+        return _FakeDownloader(self._data[start:end])
+
+
+class _FakeContainerClient:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def get_blob_client(self, key: str) -> _FakeBlobClient:
+        return _FakeBlobClient(self._data)
+
+
+class _FakeAzureClient:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def get_container_client(self, container: str) -> _FakeContainerClient:
+        return _FakeContainerClient(self._data)
+
+
+def test_azure_blob_storage_download_object_truncates_oversized_blob(monkeypatch, caplog):
+    source = AzureBlobStorageSource(
+        {
+            **_recipe(),
+            "optional": {
+                "connection": {"max_object_bytes": 1024},
+                "scope": {"include_content_preview": True},
+            },
+        }
+    )
+    big_bytes = b"z" * 3000
+    monkeypatch.setattr(source, "_client", lambda: _FakeAzureClient(big_bytes))
+    ref = _ref("exports/big.bin", size=len(big_bytes))
+
+    with caplog.at_level("WARNING"):
+        file_bytes, _content_type = source._download_object(ref)
+
+    assert len(file_bytes) == 1024
+    assert any("Truncated" in record.message for record in caplog.records)
+
+
+def test_azure_blob_storage_download_object_leaves_normal_blob_unchanged(monkeypatch, caplog):
+    source = AzureBlobStorageSource(_recipe())
+    small_bytes = b"hello azure"
+    monkeypatch.setattr(source, "_client", lambda: _FakeAzureClient(small_bytes))
+    ref = _ref("exports/small.txt", size=len(small_bytes))
+
+    with caplog.at_level("WARNING"):
+        file_bytes, content_type = source._download_object(ref)
+
+    assert file_bytes == small_bytes
+    assert content_type == "text/plain"
+    assert not any("Truncated" in record.message for record in caplog.records)

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/tests/test_google_cloud_storage_source.py

@@ -71,3 +71,68 @@ async def test_google_cloud_storage_extract_uses_all_sampling(monkeypatch):
     assert [asset.name for asset in assets] == ["new.txt", "data.parquet"]
     assert assets[0].asset_type == OutputAssetType.TXT
     assert assets[1].asset_type == OutputAssetType.TABLE
+
+
+class _FakeBlob:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def download_as_bytes(
+        self, start: int | None = None, end: int | None = None, timeout: float | None = None
+    ) -> bytes:
+        if start is None and end is None:
+            return self._data
+        range_start = start or 0
+        range_end = len(self._data) - 1 if end is None else end
+        return self._data[range_start : range_end + 1]
+
+
+class _FakeBucket:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def blob(self, key: str) -> _FakeBlob:
+        return _FakeBlob(self._data)
+
+
+class _FakeGcsClient:
+    def __init__(self, data: bytes) -> None:
+        self._data = data
+
+    def bucket(self, name: str) -> _FakeBucket:
+        return _FakeBucket(self._data)
+
+
+def test_google_cloud_storage_download_object_truncates_oversized_blob(monkeypatch, caplog):
+    source = GoogleCloudStorageSource(
+        {
+            **_recipe(),
+            "optional": {
+                "connection": {"max_object_bytes": 1024},
+                "scope": {"include_content_preview": True},
+            },
+        }
+    )
+    big_bytes = b"y" * 3000
+    monkeypatch.setattr(source, "_client", lambda: _FakeGcsClient(big_bytes))
+    ref = _ref("exports/big.bin", days_ago=0, size=len(big_bytes))
+
+    with caplog.at_level("WARNING"):
+        file_bytes, _content_type = source._download_object(ref)
+
+    assert len(file_bytes) == 1024
+    assert any("Truncated" in record.message for record in caplog.records)
+
+
+def test_google_cloud_storage_download_object_leaves_normal_blob_unchanged(monkeypatch, caplog):
+    source = GoogleCloudStorageSource(_recipe())
+    small_bytes = b"hello gcs"
+    monkeypatch.setattr(source, "_client", lambda: _FakeGcsClient(small_bytes))
+    ref = _ref("exports/small.txt", days_ago=0, size=len(small_bytes))
+
+    with caplog.at_level("WARNING"):
+        file_bytes, content_type = source._download_object(ref)
+
+    assert file_bytes == small_bytes
+    assert content_type == "text/plain"
+    assert not any("Truncated" in record.message for record in caplog.records)

{classifyre_cli-0.4.46 → classifyre_cli-0.4.47}/tests/test_kafka_source.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import base64
+import json
 from typing import Any
 
 import pytest
@@ -7,6 +9,12 @@ import pytest
 from src.models.generated_input import SamplingStrategy
 from src.sources.kafka.source import KafkaSource
 
+CURSOR_ENV = "CLASSIFYRE_SAMPLING_CURSOR"
+
+
+def _encode_cursor(cursor: dict[str, Any]) -> str:
+    return base64.b64encode(json.dumps(cursor).encode()).decode()
+
 # ── confluent-kafka fakes ────────────────────────────────────────────────
 
 
@@ -64,25 +72,33 @@ class _FakeConsumer:
         self._module = module
         self.conf = conf
         self.assigned: list[_TopicPartition] = []
-        self._consumed = False
+        self._assigned_offsets: dict[int, int] = {}
+        self._pointer = 0
 
     def list_topics(self, topic: str | None = None, timeout: float = 0) -> _ClusterMetadata:
         if topic is not None:
             return _ClusterMetadata([topic] if topic in self._module.topic_names else [])
         return _ClusterMetadata(self._module.topic_names)
 
-    def get_watermark_offsets(self, _tp: _TopicPartition, timeout: float = 0) -> tuple[int, int]:
-        return (0, 100)
+    def get_watermark_offsets(self, tp: _TopicPartition, timeout: float = 0) -> tuple[int, int]:
+        return self._module.watermarks.get((tp.topic, tp.partition), (0, 100))
 
     def assign(self, tps: list[_TopicPartition]) -> None:
         self.assigned = tps
         self._module.last_assigned = tps
+        self._assigned_offsets = {tp.partition: tp.offset for tp in tps}
 
     def consume(self, num_messages: int, timeout: float = 0) -> list[_FakeMessage]:
-        if self._consumed:
-            return []
-        self._consumed = True
-        return self._module.messages[:num_messages]
+        assigned_partitions = set(self._assigned_offsets)
+        available = [
+            m
+            for m in self._module.messages
+            if m.partition() in assigned_partitions
+            and m.offset() >= self._assigned_offsets[m.partition()]
+        ]
+        batch = available[self._pointer : self._pointer + num_messages]
+        self._pointer += len(batch)
+        return batch
 
     def close(self) -> None:
         pass
@@ -126,6 +142,8 @@ class _FakeKafkaModule:
         self.ConfigResource = _ConfigResource
         self.last_consumer_conf: dict[str, Any] | None = None
         self.last_assigned: list[_TopicPartition] = []
+        # Optional per-(topic, partition) watermark override; defaults to (0, 100).
+        self.watermarks: dict[tuple[str, int], tuple[int, int]] = {}
 
     def Consumer(self, conf: dict[str, Any]) -> _FakeConsumer:  # noqa: N802
         self.last_consumer_conf = conf
@@ -146,8 +164,11 @@ def _recipe(**overrides: Any) -> dict[str, Any]:
     return base
 
 
-def _messages(count: int) -> list[_FakeMessage]:
-    return [_FakeMessage(0, i, f"k{i}".encode(), f"value-{i}".encode()) for i in range(count)]
+def _messages(count: int, *, start: int = 0, partition: int = 0) -> list[_FakeMessage]:
+    return [
+        _FakeMessage(partition, start + i, f"k{start + i}".encode(), f"value-{start + i}".encode())
+        for i in range(count)
+    ]
 
 
 @pytest.fixture
@@ -186,7 +207,13 @@ async def test_kafka_extract_emits_topic_assets(_patch_kafka: _FakeKafkaModule)
     assert meta["cleanup_policy"] == "delete"
 
 
-async def test_kafka_fetch_content_samples_messages(_patch_kafka: _FakeKafkaModule) -> None:
+async def test_kafka_fetch_content_samples_messages(
+    _patch_kafka: _FakeKafkaModule, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    # Keep the random start offset within the range of fake messages available (0-11),
+    # and pin it deterministically so the sampled window is known.
+    _patch_kafka.watermarks[("payments", 0)] = (0, 12)
+    monkeypatch.setattr("src.sources.kafka.source.random.randint", lambda _a, _b: 0)
     src = KafkaSource(_recipe(sampling={"strategy": "RANDOM", "rows_per_page": 10}))
     assets = [a async for batch in src.extract_raw() for a in batch]
     result = await src.fetch_content(assets[0].hash)
@@ -249,3 +276,74 @@ def test_kafka_latest_strategy_assigns_tail_offsets(_patch_kafka: _FakeKafkaModu
     src._consume("payments", 10)
     assert len(module.last_assigned) == 1
     assert module.last_assigned[0].offset == 90
+
+
+# ── AUTOMATIC sampling ───────────────────────────────────────────────────
+
+
+def test_kafka_automatic_first_run_starts_at_low_and_records_cursor(
+    _patch_kafka: _FakeKafkaModule, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv(CURSOR_ENV, raising=False)
+    module = _patch_kafka
+    module.watermarks[("payments", 0)] = (0, 100)
+    module.messages = _messages(12, start=0)
+
+    src = KafkaSource(_recipe(sampling={"strategy": "AUTOMATIC", "rows_per_page": 10}))
+    out = src._consume("payments", 5)
+
+    assert module.last_assigned[0].offset == 0  # first run: start at low
+    assert [m["offset"] for m in out] == [0, 1, 2, 3, 4]
+    # advanced past the highest offset consumed
+    assert src.current_sampling_cursor() == {"payments:0": 5}
+
+
+def test_kafka_automatic_second_run_resumes_from_saved_cursor(
+    _patch_kafka: _FakeKafkaModule, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    module = _patch_kafka
+    module.watermarks[("payments", 0)] = (0, 100)
+    module.messages = _messages(12, start=0)
+    monkeypatch.setenv(CURSOR_ENV, _encode_cursor({"payments:0": 5}))
+
+    src = KafkaSource(_recipe(sampling={"strategy": "AUTOMATIC", "rows_per_page": 10}))
+    out = src._consume("payments", 5)
+
+    assert module.last_assigned[0].offset == 5
+    assert [m["offset"] for m in out] == [5, 6, 7, 8, 9]
+    assert src.current_sampling_cursor() == {"payments:0": 10}
+
+
+def test_kafka_automatic_wraps_to_low_when_caught_up(
+    _patch_kafka: _FakeKafkaModule, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    module = _patch_kafka
+    module.watermarks[("payments", 0)] = (0, 10)
+    # Only two messages left before the high watermark.
+    module.messages = _messages(2, start=8)
+    monkeypatch.setenv(CURSOR_ENV, _encode_cursor({"payments:0": 8}))
+
+    src = KafkaSource(_recipe(sampling={"strategy": "AUTOMATIC", "rows_per_page": 10}))
+    out = src._consume("payments", 5)
+
+    assert module.last_assigned[0].offset == 8
+    assert [m["offset"] for m in out] == [8, 9]
+    # 9 + 1 == 10 == high watermark → wraps back to low (0) for the next run
+    assert src.current_sampling_cursor() == {"payments:0": 0}
+
+
+def test_kafka_automatic_stale_cursor_below_low_clamps_to_low(
+    _patch_kafka: _FakeKafkaModule, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    module = _patch_kafka
+    # Retention has advanced: earliest retained offset is now 20.
+    module.watermarks[("payments", 0)] = (20, 100)
+    module.messages = _messages(5, start=20)
+    monkeypatch.setenv(CURSOR_ENV, _encode_cursor({"payments:0": 5}))
+
+    src = KafkaSource(_recipe(sampling={"strategy": "AUTOMATIC", "rows_per_page": 10}))
+    out = src._consume("payments", 5)
+
+    assert module.last_assigned[0].offset == 20  # clamped up to low, not the stale 5
+    assert [m["offset"] for m in out] == [20, 21, 22, 23, 24]
+    assert src.current_sampling_cursor() == {"payments:0": 25}