Derive cohort grouping labels; do not echo free-form intake keys
Derive cohort grouping labels; do not echo free-form intake keys A privacy-minimized cohort can still leak caller content through aggregate dictionary keys. If an intake row supplies an unconstrained stratum, copying it into a manifest or count receipt turns an apparently numeri…