@adcp/sdk 16.0.0-beta.3 → 16.0.0-beta.4

package/dist/lib/reporting/ledger/managed-postgres.mjs

@@ -1,2332 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { canonicalize } from "../../utils/jcs.mjs";
-import { isReportingAdjustmentReceiptEvidence, isReportingReceiptEvidence } from "../evidence.mjs";
-import { REPORTING_LEDGER_AUTHORITY } from "./types.mjs";
-import { ReportingRowStorageV1, isReportingRowStoreError } from "./row-storage.mjs";
-import {
-  assertReportingObjectWriteScope,
-  reportingObjectWritePlanFingerprint,
-  ReportingObjectWriteConflictError,
-  ReportingObjectWriteNotRevokedError
-} from "./object-writes.mjs";
-import {
-  adjustmentReceiptEvidenceMatches,
-  assertMaterializationOutcome,
-  receiptEvidenceMatches,
-  REPORTING_DESTINATION_PATTERNS_V1,
-  REPORTING_DESTINATION_TRANSPORT_PATTERN_V1
-} from "./managed.mjs";
-const REPORTING_MANAGED_DELIVERY_MIGRATION = `
-CREATE TABLE IF NOT EXISTS adcp_reporting_destination_authorizations (
-  account_id TEXT NOT NULL,
-  destination_ref TEXT NOT NULL,
-  generation BIGINT NOT NULL,
-  authorized_at TIMESTAMPTZ NOT NULL,
-  revoked_at TIMESTAMPTZ,
-  cleanup_completed_at TIMESTAMPTZ,
-  cleanup_lease_owner TEXT,
-  cleanup_lease_generation BIGINT NOT NULL DEFAULT 0,
-  cleanup_lease_expires_at TIMESTAMPTZ,
-  changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  data JSONB NOT NULL,
-  PRIMARY KEY (account_id, destination_ref, generation),
-  CHECK (generation > 0),
-  CHECK (revoked_at IS NULL OR revoked_at >= authorized_at)
-);
-ALTER TABLE adcp_reporting_destination_authorizations
-  ADD COLUMN IF NOT EXISTS changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp();
-CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_destination_authorizations_current
-  ON adcp_reporting_destination_authorizations (account_id, destination_ref)
-  WHERE revoked_at IS NULL;
-CREATE INDEX IF NOT EXISTS adcp_reporting_destination_authorizations_cleanup
-  ON adcp_reporting_destination_authorizations (revoked_at, account_id, destination_ref)
-  WHERE revoked_at IS NOT NULL AND cleanup_completed_at IS NULL;
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_managed_bindings (
-  configuration_id TEXT PRIMARY KEY REFERENCES adcp_reporting_configurations(configuration_id),
-  account_id TEXT NOT NULL,
-  delivery_config_id TEXT NOT NULL,
-  delivery_config_version INTEGER NOT NULL,
-  destination_ref TEXT NOT NULL,
-  authorization_generation BIGINT NOT NULL,
-  semantic_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  FOREIGN KEY (account_id, destination_ref, authorization_generation)
-    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation),
-  UNIQUE (account_id, delivery_config_id, delivery_config_version)
-);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_materializations (
-  materialization_id TEXT PRIMARY KEY,
-  account_id TEXT NOT NULL,
-  configuration_id TEXT NOT NULL REFERENCES adcp_reporting_managed_bindings(configuration_id),
-  obligation_id TEXT NOT NULL REFERENCES adcp_reporting_obligations(obligation_id),
-  revision_id TEXT NOT NULL REFERENCES adcp_reporting_revisions(revision_id),
-  destination_ref TEXT NOT NULL,
-  authorization_generation BIGINT NOT NULL,
-  attempt INTEGER NOT NULL,
-  status TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  lease_owner TEXT,
-  lease_generation BIGINT NOT NULL DEFAULT 0,
-  lease_expires_at TIMESTAMPTZ,
-  UNIQUE (configuration_id, revision_id, attempt),
-  CHECK (attempt > 0),
-  CHECK (status IN ('pending', 'available', 'delivered', 'failed'))
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_materializations_claim
-  ON adcp_reporting_materializations (created_at, materialization_id) WHERE status = 'pending';
-CREATE INDEX IF NOT EXISTS adcp_reporting_materializations_obligation
-  ON adcp_reporting_materializations (obligation_id, recorded_at, materialization_id);
-CREATE INDEX IF NOT EXISTS adcp_reporting_materializations_account_retention
-  ON adcp_reporting_materializations (account_id, recorded_at);
-CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_materializations_success
-  ON adcp_reporting_materializations (configuration_id, revision_id)
-  WHERE status IN ('available', 'delivered');
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_receipts (
-  account_id TEXT NOT NULL,
-  consumer_id TEXT NOT NULL,
-  reporting_receipt_id TEXT NOT NULL,
-  receipt_kind TEXT NOT NULL,
-  subject_id TEXT NOT NULL,
-  supersedes_receipt_id TEXT,
-  is_current BOOLEAN NOT NULL,
-  semantic_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  received_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  PRIMARY KEY (account_id, consumer_id, reporting_receipt_id),
-  CHECK (receipt_kind IN ('revision', 'adjustment'))
-);
-CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_receipts_current
-  ON adcp_reporting_receipts (account_id, consumer_id, receipt_kind, subject_id) WHERE is_current;
-CREATE INDEX IF NOT EXISTS adcp_reporting_receipts_readback
-  ON adcp_reporting_receipts (account_id, consumer_id, recorded_at, reporting_receipt_id);
--- The as-of-cutoff leaf asks, per candidate, whether anything recorded by the
--- cutoff supersedes it. Without this that question is a scan of the caller's
--- whole receipt history.
-CREATE INDEX IF NOT EXISTS adcp_reporting_receipts_supersedes
-  ON adcp_reporting_receipts (account_id, consumer_id, supersedes_receipt_id)
-  WHERE supersedes_receipt_id IS NOT NULL;
--- Every lifecycle read is "the receipts for this obligation's subjects". The
--- receipt table is global and its other indexes lead with account and
--- consumer, neither of which that question supplies, so each due obligation
--- re-scanned the whole receipt history.
-CREATE INDEX IF NOT EXISTS adcp_reporting_receipts_subject
-  ON adcp_reporting_receipts (subject_id, receipt_kind, recorded_at);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_receipt_batches (
-  account_id TEXT NOT NULL,
-  consumer_id TEXT NOT NULL,
-  idempotency_key TEXT NOT NULL,
-  request_fingerprint TEXT NOT NULL,
-  results JSONB NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  PRIMARY KEY (account_id, consumer_id, idempotency_key)
-);
--- Pruning used to ask "does any live replay row contain this receipt id" per
--- candidate, which no index could serve for a correlated operand. It now
--- expands the account's replay rows once instead, so no GIN index is needed
--- and the batches table is not burdened with maintaining one.
-
--- Agent-wide promises, durable and shared by every store instance and process
--- that talks to this database. An in-memory bound only constrains the process
--- that set it, so two replicas could each believe they were authoritative and
--- publish different windows over the same bindings.
-CREATE TABLE IF NOT EXISTS adcp_reporting_managed_policy (
-  policy_key TEXT PRIMARY KEY,
-  advertised_recovery_window_seconds BIGINT,
-  advertised_status_retention_days BIGINT,
-  advertised_resource_retention_days BIGINT,
-  advertised_authorization_revocation_seconds BIGINT,
-  materialization_planning_cursor TEXT,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
-);
--- Upgrade registries installed by earlier Managed Delivery release candidates.
-ALTER TABLE adcp_reporting_managed_policy
-  ADD COLUMN IF NOT EXISTS advertised_resource_retention_days BIGINT;
-ALTER TABLE adcp_reporting_managed_policy
-  ADD COLUMN IF NOT EXISTS advertised_authorization_revocation_seconds BIGINT;
--- Durable round-robin position for deployment-wide materialization planning.
--- A process-local cursor restarts at the lexically first tenant after every
--- deploy; without a durable position a continuously busy first account can
--- consume every bounded planning page and a later account never progresses.
-ALTER TABLE adcp_reporting_managed_policy
-  ADD COLUMN IF NOT EXISTS materialization_planning_cursor TEXT;
--- Every policy read or adoption locks this durable row. Creating it in the
--- migration avoids a missing-row predicate gap on a fresh registry.
-INSERT INTO adcp_reporting_managed_policy (policy_key)
-VALUES ('agent')
-ON CONFLICT (policy_key) DO NOTHING;
-
--- Permanent, compact identity for a receipt whose body has aged out.
--- Bodies are retained only through the advertised horizon, but identity is
--- forever: a pruned receipt_id must never bind different content later, and a
--- subject that reached a terminal accepted leaf must never reopen because the
--- row proving it was terminal has expired.
-CREATE TABLE IF NOT EXISTS adcp_reporting_receipt_tombstones (
-  account_id TEXT NOT NULL,
-  consumer_id TEXT NOT NULL,
-  reporting_receipt_id TEXT NOT NULL,
-  receipt_kind TEXT NOT NULL,
-  subject_id TEXT NOT NULL,
-  status TEXT NOT NULL,
-  was_current BOOLEAN NOT NULL,
-  semantic_fingerprint TEXT NOT NULL,
-  pruned_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  PRIMARY KEY (account_id, consumer_id, reporting_receipt_id)
-);
--- When the pruned receipt itself was recorded, and what it superseded. A
--- tombstone without them is a conclusion with no place in time: a historical
--- projection applied an acceptance that had not happened yet at its cutoff,
--- and a chain whose successor was pruned let the predecessor it superseded
--- come back as the live leaf. Nullable for rows written before this column
--- existed; readers fall back to pruned_at, which is never earlier.
-ALTER TABLE adcp_reporting_receipt_tombstones
-  ADD COLUMN IF NOT EXISTS subject_recorded_at TIMESTAMPTZ;
-ALTER TABLE adcp_reporting_receipt_tombstones
-  ADD COLUMN IF NOT EXISTS supersedes_receipt_id TEXT;
-CREATE INDEX IF NOT EXISTS adcp_reporting_receipt_tombstones_supersedes
-  ON adcp_reporting_receipt_tombstones (account_id, consumer_id, supersedes_receipt_id)
-  WHERE supersedes_receipt_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS adcp_reporting_receipt_tombstones_subject
-  ON adcp_reporting_receipt_tombstones (account_id, consumer_id, receipt_kind, subject_id);
-
--- Compact terminal state for a materialization whose row has been pruned.
--- Attempt history is control state, not evidence: without it a revision whose
--- attempts were exhausted, or which already succeeded, restarts at attempt 1
--- the moment its rows age out.
-CREATE TABLE IF NOT EXISTS adcp_reporting_materialization_tombstones (
-  configuration_id TEXT NOT NULL,
-  revision_id TEXT NOT NULL,
-  account_id TEXT NOT NULL,
-  obligation_id TEXT NOT NULL,
-  highest_attempt INTEGER NOT NULL,
-  reached_success BOOLEAN NOT NULL,
-  pruned_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  -- When the delivery this records actually succeeded, so a projection at an
-  -- earlier cutoff does not read it as already delivered.
-  reached_success_at TIMESTAMPTZ,
-  PRIMARY KEY (configuration_id, revision_id)
-);
--- These rows are permanent and every lifecycle projection reads them by
--- obligation and success. The primary key leads with configuration, which
--- that question does not supply, so the scan grew without bound for the life
--- of the deployment.
-CREATE INDEX IF NOT EXISTS adcp_reporting_materialization_tombstones_obligation
-  ON adcp_reporting_materialization_tombstones (obligation_id, reached_success, reached_success_at);
-
-
-ALTER TABLE adcp_reporting_destination_authorizations
-  ADD COLUMN IF NOT EXISTS cleanup_lease_issued_at TIMESTAMPTZ;
-
--- Delivery pattern and transport recorded on the authorization generation, so
--- a revocation can be routed to the transport that holds the provider grant.
--- Both are immutable for a generation (a new delivery contract mints a new
--- destination_ref generation) and NULL for a generation whose contract is not
--- known. The block runs once, in the same statement batch that adds the
--- columns: it backfills a row only when every binding on that exact
--- (account_id, destination_ref, generation) agrees on the method and carries
--- the same transport, and otherwise leaves the row NULL. A later re-run finds
--- the columns present and does nothing, so a generation that was left NULL
--- stays NULL rather than being re-decided by whichever binding arrived since.
-DO $pattern_transport$
-DECLARE
-  unresolved BIGINT;
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM information_schema.columns
-     WHERE table_schema = current_schema()
-       AND table_name = 'adcp_reporting_destination_authorizations'
-       AND column_name = 'transport'
-  ) THEN
-    ALTER TABLE adcp_reporting_destination_authorizations ADD COLUMN IF NOT EXISTS pattern TEXT;
-    ALTER TABLE adcp_reporting_destination_authorizations ADD COLUMN IF NOT EXISTS transport TEXT;
-    WITH agreed AS (
-      SELECT authz.account_id, authz.destination_ref, authz.generation,
-             MIN(binding.data->>'method') AS pattern,
-             MIN(binding.data->>'transport') AS transport
-        FROM adcp_reporting_destination_authorizations authz
-        JOIN adcp_reporting_managed_bindings binding
-          ON binding.account_id = authz.account_id
-         AND binding.destination_ref = authz.destination_ref
-         AND binding.authorization_generation = authz.generation
-       WHERE authz.pattern IS NULL AND authz.transport IS NULL
-       GROUP BY authz.account_id, authz.destination_ref, authz.generation
-      HAVING COUNT(*) = COUNT(binding.data->>'method')
-         AND COUNT(DISTINCT binding.data->>'method') = 1
-         AND COUNT(*) = COUNT(binding.data->>'transport')
-         AND COUNT(DISTINCT binding.data->>'transport') = 1
-    )
-    UPDATE adcp_reporting_destination_authorizations authz
-       SET pattern = agreed.pattern,
-           transport = agreed.transport,
-           data = authz.data || jsonb_build_object('pattern', agreed.pattern, 'transport', agreed.transport)
-      FROM agreed
-     WHERE authz.account_id = agreed.account_id
-       AND authz.destination_ref = agreed.destination_ref
-       AND authz.generation = agreed.generation;
-    SELECT COUNT(*) INTO unresolved FROM adcp_reporting_destination_authorizations WHERE transport IS NULL;
-    IF unresolved > 0 THEN
-      RAISE NOTICE 'adcp_reporting_destination_authorizations: % generation(s) left without pattern/transport; list them with PostgresReportingManagedDeliveryStore.listDestinationAuthorizationsWithoutContract()', unresolved;
-    END IF;
-  END IF;
-END
-$pattern_transport$;
-`.trim();
-const GENERIC_RECEIPT_MESSAGE = "Receipt does not match authorized current reporting evidence";
-const MAX_PLAN = 1e3;
-const MAX_MATERIALIZATIONS_PER_ACCOUNT = 1e5;
-const MAX_RECEIPT_BATCHES_PER_CONSUMER = 1e4;
-const MAX_RECEIPTS_PER_CONSUMER = 1e5;
-const MAX_RECEIPTS_PER_ARRAY = 100;
-const MAX_RECEIPT_RESULTS = 100;
-const MAX_MATERIALIZATION_ATTEMPTS = 5;
-const REVOCATION_RETRY_BACKOFF_MS = 5e3;
-const RECEIPT_BATCH_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
-const MAX_RECEIPT_BATCH_RESULT_BYTES = 64 * 1024;
-class PostgresReportingManagedDeliveryStore {
-  constructor(pool, options = {}) {
-    this.pool = pool;
-    this.rowStorage = new ReportingRowStorageV1(pool);
-    if (options.statusRetentionDays !== void 0) positiveInteger(options.statusRetentionDays, "statusRetentionDays");
-    if (options.evidenceRetentionDays !== void 0) {
-      positiveInteger(options.evidenceRetentionDays, "evidenceRetentionDays");
-      const replayFloorDays = Math.ceil(RECEIPT_BATCH_RETENTION_MS / 864e5);
-      if (options.evidenceRetentionDays < replayFloorDays) {
-        throw new RangeError(
-          `evidenceRetentionDays must be at least the ${replayFloorDays}-day receipt replay retention`
-        );
-      }
-      if (options.statusRetentionDays !== void 0 && options.evidenceRetentionDays < options.statusRetentionDays) {
-        throw new RangeError(
-          `evidenceRetentionDays must be at least the advertised statusRetentionDays (${options.statusRetentionDays}); pruning inside an advertised horizon breaks it`
-        );
-      }
-    }
-    if (options.advertisedRecoveryWindowSeconds !== void 0) {
-      nonnegativeSafeInteger(options.advertisedRecoveryWindowSeconds, "advertisedRecoveryWindowSeconds");
-    }
-    this.pendingRecoveryWindowSeconds = options.advertisedRecoveryWindowSeconds;
-    this.statusRetentionDays = options.statusRetentionDays;
-    this.evidenceRetentionDays = options.evidenceRetentionDays;
-    this.notificationActivityPort = options.notificationActivityPort;
-  }
-  pool;
-  evidenceRetentionDays;
-  statusRetentionDays;
-  pendingRecoveryWindowSeconds;
-  policyRegistered = false;
-  bindingAdmission;
-  notificationActivityPort;
-  /**
-   * Durably records the agent-wide advertised recovery window.
-   *
-   * Written to the database, not held in memory: the promise is agent-wide,
-   * so a second store instance — in this process or another replica — must be
-   * held to the same value, and `installBinding` must read it inside its own
-   * transaction rather than trusting whatever the local object happens to
-   * know. Multiple replicas monotonically retain the smallest registered
-   * maximum: a shorter recovery promise is stronger and can never be widened
-   * by a later runtime.
-   */
-  async adoptAdvertisedRecoveryWindowSeconds(seconds) {
-    nonnegativeSafeInteger(seconds, "automatedRecoveryWindowSeconds");
-    await this.upsertPolicy("advertised_recovery_window_seconds", seconds, {
-      strongest: Math.min,
-      // Checked inside the same transaction that would persist it. Writing
-      // first and validating afterwards poisoned the registry: a rejected
-      // 60s startup against an installed 900s binding still left a durable
-      // 60, and the correct 900s restart was then refused as a conflict.
-      validate: (client, effective) => this.validateRecoveryWindow(client, effective.advertised_recovery_window_seconds)
-    });
-  }
-  /**
-   * Durably records the advertised `status_retention_days`.
-   *
-   * Retention is enforced against the widest promise any runtime registered
-   * over this database, so a store configured with a short evidence retention
-   * cannot prune inside a horizon a differently configured runtime published.
-   */
-  async adoptAdvertisedStatusRetentionDays(days) {
-    positiveInteger(days, "statusRetentionDays");
-    await this.upsertPolicy("advertised_status_retention_days", days, {
-      strongest: Math.max
-    });
-  }
-  /** Registers the complete capability policy under one lock and transaction. */
-  async adoptAdvertisedPolicies(policy) {
-    nonnegativeSafeInteger(policy.automatedRecoveryWindowSeconds, "automatedRecoveryWindowSeconds");
-    positiveInteger(policy.statusRetentionDays, "statusRetentionDays");
-    positiveInteger(policy.resourceRetentionDays, "resourceRetentionDays");
-    nonnegativeSafeInteger(policy.authorizationRevocationSeconds, "authorizationRevocationSeconds");
-    const adopted = await this.upsertPolicies(
-      [
-        {
-          column: "advertised_recovery_window_seconds",
-          value: policy.automatedRecoveryWindowSeconds,
-          strongest: Math.min
-        },
-        {
-          column: "advertised_status_retention_days",
-          value: policy.statusRetentionDays,
-          strongest: Math.max
-        },
-        {
-          column: "advertised_resource_retention_days",
-          value: policy.resourceRetentionDays,
-          strongest: Math.max
-        },
-        {
-          column: "advertised_authorization_revocation_seconds",
-          value: policy.authorizationRevocationSeconds,
-          strongest: Math.min
-        }
-      ],
-      (client, effective) => this.validateRecoveryWindow(client, effective.advertised_recovery_window_seconds)
-    );
-    return {
-      automatedRecoveryWindowSeconds: adopted.advertised_recovery_window_seconds,
-      statusRetentionDays: adopted.advertised_status_retention_days,
-      resourceRetentionDays: adopted.advertised_resource_retention_days,
-      authorizationRevocationSeconds: adopted.advertised_authorization_revocation_seconds
-    };
-  }
-  /**
-   * Flushes constructor-supplied promises into the durable registry.
-   *
-   * Called from every entry point that depends on them, so a store built with
-   * options behaves identically to one a runtime adopted into.
-   */
-  async ensurePolicyRegistered() {
-    if (this.policyRegistered) return;
-    if (this.pendingRecoveryWindowSeconds !== void 0 && this.statusRetentionDays !== void 0) {
-      await this.upsertPolicies(
-        [
-          {
-            column: "advertised_recovery_window_seconds",
-            value: this.pendingRecoveryWindowSeconds,
-            strongest: Math.min
-          },
-          {
-            column: "advertised_status_retention_days",
-            value: this.statusRetentionDays,
-            strongest: Math.max
-          }
-        ],
-        (client, effective) => this.validateRecoveryWindow(client, effective.advertised_recovery_window_seconds)
-      );
-    } else if (this.pendingRecoveryWindowSeconds !== void 0) {
-      await this.adoptAdvertisedRecoveryWindowSeconds(this.pendingRecoveryWindowSeconds);
-    } else if (this.statusRetentionDays !== void 0) {
-      await this.adoptAdvertisedStatusRetentionDays(this.statusRetentionDays);
-    }
-    this.policyRegistered = true;
-  }
-  async upsertPolicy(column, value, options) {
-    await this.upsertPolicies([{ column, value, strongest: options.strongest }], options.validate);
-  }
-  async upsertPolicies(policies, validate) {
-    return this.transaction(async (client) => {
-      const current = await this.readPolicyRow(client, "update");
-      const effective = { ...current };
-      for (const policy of policies) {
-        const existing = current[policy.column];
-        effective[policy.column] = existing === null ? policy.value : policy.strongest(existing, policy.value);
-      }
-      await validate?.(client, effective);
-      for (const policy of policies) {
-        await client.query(
-          `UPDATE adcp_reporting_managed_policy SET ${policy.column} = $1,
-             changed_at = clock_timestamp() WHERE policy_key = 'agent'`,
-          [effective[policy.column]]
-        );
-      }
-      return effective;
-    });
-  }
-  async validateRecoveryWindow(client, seconds) {
-    const widest = await client.query(
-      `WITH installed AS (
-         SELECT configuration.data->'schedule'->>'recoveryWindowMilliseconds' AS milliseconds
-           FROM adcp_reporting_managed_bindings binding
-           JOIN adcp_reporting_configurations configuration
-             ON configuration.configuration_id = binding.configuration_id
-       )
-       SELECT COUNT(*)::text AS installed,
-              COUNT(*) FILTER (WHERE milliseconds ~ '^[0-9]+$')::text AS valid,
-              MAX(CASE WHEN milliseconds ~ '^[0-9]+$'
-                       THEN CEIL(milliseconds::numeric / 1000) END)::text AS widest
-         FROM installed`
-    );
-    const row = widest.rows[0];
-    if (row?.installed !== row?.valid) {
-      throw new Error("Every installed managed Core configuration must have a usable non-negative recovery window");
-    }
-    const widestInstalled = Number(row?.widest ?? 0);
-    if (!Number.isSafeInteger(widestInstalled)) {
-      throw new Error("Installed managed Core recovery windows exceed the supported safe-integer range");
-    }
-    if (seconds < widestInstalled) {
-      throw new Error(
-        `automatedRecoveryWindowSeconds must be at least the widest installed managed Core recovery window (${widestInstalled}s); advertising ${seconds}s would promise a recovery bound this deployment does not keep for every tenant`
-      );
-    }
-  }
-  async readPolicyRow(client, lock) {
-    const lockClause = lock === "share" ? " FOR SHARE" : lock === "update" ? " FOR UPDATE" : "";
-    const result = await client.query(
-      `SELECT advertised_recovery_window_seconds::text AS recovery,
-              advertised_status_retention_days::text AS status,
-              advertised_resource_retention_days::text AS resource,
-              advertised_authorization_revocation_seconds::text AS revocation
-         FROM adcp_reporting_managed_policy WHERE policy_key = 'agent'${lockClause}`
-    );
-    const row = result.rows[0];
-    if (!row) {
-      throw new Error(
-        "Managed reporting policy sentinel is missing; apply REPORTING_MANAGED_DELIVERY_MIGRATION before use"
-      );
-    }
-    return {
-      advertised_recovery_window_seconds: policyNumber(row?.recovery),
-      advertised_status_retention_days: policyNumber(row?.status),
-      advertised_resource_retention_days: policyNumber(row?.resource),
-      advertised_authorization_revocation_seconds: policyNumber(row?.revocation)
-    };
-  }
-  async readPolicy(client, lock) {
-    const policy = await this.readPolicyRow(client, lock);
-    return {
-      recoveryWindowSeconds: policy.advertised_recovery_window_seconds,
-      statusRetentionDays: policy.advertised_status_retention_days,
-      resourceRetentionDays: policy.advertised_resource_retention_days,
-      authorizationRevocationSeconds: policy.advertised_authorization_revocation_seconds
-    };
-  }
-  /** Read-only access to PostgreSQL row chunks for claim hydration. */
-  rowStorage;
-  /** SQL fragment scoping a count to the active retention window, if one is set. */
-  activeScope(column) {
-    return this.evidenceRetentionDays === void 0 ? "" : ` AND ${column} >= clock_timestamp() - (${this.evidenceRetentionDays}::bigint * INTERVAL '1 day')`;
-  }
-  /**
-   * Deletes managed evidence that has aged out of `evidenceRetentionDays`.
-   *
-   * Only ever removes evidence the deployment no longer promises: nothing
-   * inside the retention window, nothing still `pending` or leased, and no
-   * receipt batch inside its own replay retention. Immutable evidence stays
-   * immutable while it is retained — this frees capacity at the far end of the
-   * window rather than rewriting anything. Returns what it removed so a
-   * scheduler can page through with `limit`.
-   */
-  async pruneExpiredEvidence(input) {
-    if (this.evidenceRetentionDays === void 0) {
-      throw new Error("pruneExpiredEvidence requires PostgresReportingManagedDeliveryStore({ evidenceRetentionDays })");
-    }
-    await this.ensurePolicyRegistered();
-    const limit = input.limit ?? 1e3;
-    positiveInteger(limit, "limit");
-    const days = this.evidenceRetentionDays;
-    return this.transaction(async (client) => {
-      const registered = await this.readPolicy(client, "share");
-      const retentionFloor = Math.max(registered.statusRetentionDays ?? 0, registered.resourceRetentionDays ?? 0);
-      if (days < retentionFloor) {
-        throw new Error(
-          `evidenceRetentionDays ${days} is shorter than the strongest advertised status/resource retention of ${retentionFloor} days registered for this database; pruning would cut inside an advertised horizon`
-        );
-      }
-      const cutoff = (await client.query(
-        `SELECT (clock_timestamp() - ($1::bigint * INTERVAL '1 day'))::text AS cutoff`,
-        [days]
-      )).rows[0].cutoff;
-      const doomedReceipts = await client.query(
-        `WITH live_referenced AS (
-           SELECT DISTINCT batch.consumer_id,
-                  COALESCE(
-                    elem ->> 'id',
-                    elem ->> 'reporting_receipt_id',
-                    elem -> 'receipt' ->> 'reporting_receipt_id',
-                    elem -> 'adjustment_receipt' ->> 'reporting_receipt_id'
-                  ) AS reporting_receipt_id
-             FROM adcp_reporting_receipt_batches batch,
-                  LATERAL jsonb_array_elements(batch.results) elem
-            -- Only a replay row still inside its own retention pins anything.
-            -- Selection now runs before the batch delete, so without this an
-            -- already-expired row kept holding its receipts alive forever.
-            WHERE batch.account_id = $1
-              AND batch.recorded_at >= clock_timestamp() - ($4::bigint * INTERVAL '1 millisecond')
-         )
-         SELECT receipt.consumer_id, receipt.reporting_receipt_id
-           FROM adcp_reporting_receipts receipt
-          WHERE receipt.account_id = $1
-            AND receipt.recorded_at < $3::timestamptz
-            AND NOT EXISTS (
-              SELECT 1 FROM live_referenced
-               WHERE live_referenced.consumer_id = receipt.consumer_id
-                 AND live_referenced.reporting_receipt_id = receipt.reporting_receipt_id
-            )
-            -- An acceptance outlives its own age while the resource it
-            -- accepts is still readable. Pruning it sooner produced a period
-            -- that reads complete with no receipt to show for it.
-            --
-            -- An adjustment receipt names no materialization at all: it
-            -- names the revision it adjusts. Matching only on
-            -- reporting_materialization_id therefore held every revision
-            -- acceptance and no adjustment acceptance, so a period whose
-            -- revision resource was still readable lost the adjustment
-            -- evidence behind its own complete.
-            AND NOT EXISTS (
-              SELECT 1 FROM adcp_reporting_materializations live
-               WHERE live.account_id = receipt.account_id
-                 AND (
-                   live.materialization_id = receipt.data ->> 'reporting_materialization_id'
-                   OR live.revision_id = receipt.data ->> 'adjusts_reporting_revision_id'
-                 )
-                 AND (live.data -> 'resource' ->> 'expires_at')::timestamptz > clock_timestamp()
-            )
-          ORDER BY receipt.recorded_at
-          LIMIT $2`,
-        [input.account_id, limit, cutoff, RECEIPT_BATCH_RETENTION_MS]
-      );
-      const doomedMaterializations = await client.query(
-        `SELECT materialization.materialization_id
-           FROM adcp_reporting_materializations materialization
-          WHERE materialization.account_id = $1
-            AND materialization.recorded_at < $3::timestamptz
-            AND materialization.status <> 'pending'
-            AND materialization.lease_owner IS NULL
-            AND COALESCE(
-                  (materialization.data -> 'resource' ->> 'expires_at')::timestamptz <= clock_timestamp(),
-                  true)
-            -- No SURVIVING receipt may still name it. Selection runs before
-            -- the receipt delete now, so a receipt already doomed in this
-            -- same pass must not keep its materialization alive forever.
-            AND NOT EXISTS (
-              SELECT 1 FROM adcp_reporting_receipts receipt
-               WHERE receipt.account_id = materialization.account_id
-                 AND receipt.data ->> 'reporting_materialization_id' = materialization.materialization_id
-                 AND NOT EXISTS (
-                   SELECT 1 FROM unnest($4::text[], $5::text[]) AS doomed(consumer_id, reporting_receipt_id)
-                    WHERE doomed.consumer_id = receipt.consumer_id
-                      AND doomed.reporting_receipt_id = receipt.reporting_receipt_id
-                 )
-            )
-          ORDER BY materialization.recorded_at
-          LIMIT $2`,
-        [
-          input.account_id,
-          limit,
-          cutoff,
-          doomedReceipts.rows.map((row) => row.consumer_id),
-          doomedReceipts.rows.map((row) => row.reporting_receipt_id)
-        ]
-      );
-      await advisoryLock(client, accountLock(input.account_id));
-      const batches = await client.query(
-        `DELETE FROM adcp_reporting_receipt_batches
-          WHERE account_id = $1
-            AND recorded_at < clock_timestamp() - ($2::bigint * INTERVAL '1 millisecond')`,
-        [input.account_id, RECEIPT_BATCH_RETENTION_MS]
-      );
-      const doomedConsumerIds = doomedReceipts.rows.map((row) => row.consumer_id);
-      const doomedReceiptIds = doomedReceipts.rows.map((row) => row.reporting_receipt_id);
-      const receipts = await client.query(
-        `WITH doomed_keys AS (
-           SELECT * FROM unnest($2::text[], $3::text[]) AS pair(consumer_id, reporting_receipt_id)
-         ), live_referenced AS (
-           -- Selection ran unlocked, so its answer is a proposal, not a
-           -- verdict: a replay could commit against a candidate between the
-           -- select and this delete, and the delete then removed the receipt
-           -- that replay had just promised to reproduce. Re-expanding the
-           -- live replay rows under the lock is one pass, and it is narrowed
-           -- to the candidates consumers rather than the whole account, so
-           -- the lock still holds no per-candidate join filter.
-           SELECT DISTINCT batch.consumer_id,
-                  COALESCE(
-                    elem ->> 'id',
-                    elem ->> 'reporting_receipt_id',
-                    elem -> 'receipt' ->> 'reporting_receipt_id',
-                    elem -> 'adjustment_receipt' ->> 'reporting_receipt_id'
-                  ) AS reporting_receipt_id
-             FROM adcp_reporting_receipt_batches batch,
-                  LATERAL jsonb_array_elements(batch.results) elem
-            WHERE batch.account_id = $1
-              AND batch.consumer_id = ANY($2::text[])
-              AND batch.recorded_at >= clock_timestamp() - ($4::bigint * INTERVAL '1 millisecond')
-         ), doomed AS (
-           SELECT receipt.* FROM adcp_reporting_receipts receipt
-             JOIN doomed_keys ON doomed_keys.consumer_id = receipt.consumer_id
-              AND doomed_keys.reporting_receipt_id = receipt.reporting_receipt_id
-            WHERE receipt.account_id = $1
-              AND receipt.recorded_at < $5::timestamptz
-              AND NOT EXISTS (
-                SELECT 1 FROM live_referenced
-                 WHERE live_referenced.consumer_id = receipt.consumer_id
-                   AND live_referenced.reporting_receipt_id = receipt.reporting_receipt_id
-              )
-              AND NOT EXISTS (
-                SELECT 1 FROM adcp_reporting_materializations live
-                 WHERE live.account_id = receipt.account_id
-                   AND (
-                     live.materialization_id = receipt.data ->> 'reporting_materialization_id'
-                     OR live.revision_id = receipt.data ->> 'adjusts_reporting_revision_id'
-                   )
-                   AND (live.data -> 'resource' ->> 'expires_at')::timestamptz > clock_timestamp()
-              )
-         ), superseded AS (
-           -- Successive prunes each tombstoned whatever was current at the
-           -- time, so a subject accumulated several current-leaf tombstones:
-           -- prune R1 while current, record R2 over it, prune R2. Reading
-           -- back, whichever the planner returned first answered for the
-           -- chain, and picking R1 rejected R3's legitimate succession to
-           -- R2. A subject has exactly one leaf, so demote the older
-           -- tombstones the moment a newer leaf is recorded.
-           UPDATE adcp_reporting_receipt_tombstones prior
-              SET was_current = false
-             FROM doomed
-            WHERE doomed.is_current
-              AND prior.account_id = doomed.account_id
-              AND prior.consumer_id = doomed.consumer_id
-              AND prior.receipt_kind = doomed.receipt_kind
-              AND prior.subject_id = doomed.subject_id
-              AND prior.reporting_receipt_id <> doomed.reporting_receipt_id
-              AND prior.was_current
-         ), tombstoned AS (
-           INSERT INTO adcp_reporting_receipt_tombstones
-             (account_id, consumer_id, reporting_receipt_id, receipt_kind, subject_id,
-              status, was_current, semantic_fingerprint, subject_recorded_at, supersedes_receipt_id)
-           SELECT account_id, consumer_id, reporting_receipt_id, receipt_kind, subject_id,
-                  COALESCE(data ->> 'status', 'unknown'), is_current, semantic_fingerprint,
-                  recorded_at, supersedes_receipt_id
-             FROM doomed
-           ON CONFLICT (account_id, consumer_id, reporting_receipt_id) DO NOTHING
-         )
-         DELETE FROM adcp_reporting_receipts target USING doomed
-          WHERE target.account_id = doomed.account_id
-            AND target.consumer_id = doomed.consumer_id
-            AND target.reporting_receipt_id = doomed.reporting_receipt_id`,
-        [input.account_id, doomedConsumerIds, doomedReceiptIds, RECEIPT_BATCH_RETENTION_MS, cutoff]
-      );
-      const materializations = await client.query(
-        `WITH referenced AS (
-           -- Doomed receipts are already gone above, so a hit here is a
-           -- survivor: either one this pass never selected, or one a
-           -- concurrent sync recorded after selection read the table.
-           SELECT DISTINCT receipt.data ->> 'reporting_materialization_id' AS materialization_id
-             FROM adcp_reporting_receipts receipt
-            WHERE receipt.account_id = $2
-              AND receipt.data ->> 'reporting_materialization_id' = ANY($1::text[])
-         ), doomed AS (
-           SELECT materialization.* FROM adcp_reporting_materializations materialization
-            WHERE materialization.materialization_id = ANY($1::text[])
-              AND materialization.account_id = $2
-              -- Every selection predicate re-asserted under the lock. A
-              -- claim, a settle or a re-record between the select and here
-              -- makes the row live again.
-              AND materialization.recorded_at < $3::timestamptz
-              AND materialization.status <> 'pending'
-              AND materialization.lease_owner IS NULL
-              AND COALESCE(
-                    (materialization.data -> 'resource' ->> 'expires_at')::timestamptz <= clock_timestamp(),
-                    true)
-              AND NOT EXISTS (
-                SELECT 1 FROM referenced
-                 WHERE referenced.materialization_id = materialization.materialization_id
-              )
-         ), tombstoned AS (
-           INSERT INTO adcp_reporting_materialization_tombstones
-             (configuration_id, revision_id, account_id, obligation_id, highest_attempt, reached_success,
-              reached_success_at)
-           SELECT configuration_id, revision_id, account_id, obligation_id,
-                  MAX(attempt), BOOL_OR(status IN ('available', 'delivered')),
-                  MIN(changed_at) FILTER (WHERE status IN ('available', 'delivered'))
-             FROM doomed GROUP BY configuration_id, revision_id, account_id, obligation_id
-           ON CONFLICT (configuration_id, revision_id) DO UPDATE SET
-             highest_attempt = GREATEST(
-               adcp_reporting_materialization_tombstones.highest_attempt, EXCLUDED.highest_attempt),
-             reached_success =
-               adcp_reporting_materialization_tombstones.reached_success OR EXCLUDED.reached_success,
-             -- The earliest success is what a historical cutoff must compare
-             -- against: a later one does not make the delivery newer.
-             reached_success_at = LEAST(
-               adcp_reporting_materialization_tombstones.reached_success_at, EXCLUDED.reached_success_at)
-         )
-         DELETE FROM adcp_reporting_materializations target USING doomed
-          WHERE target.materialization_id = doomed.materialization_id`,
-        [doomedMaterializations.rows.map((row) => row.materialization_id), input.account_id, cutoff]
-      );
-      return {
-        materializations: materializations.rowCount ?? 0,
-        receipts: receipts.rowCount ?? 0,
-        batches: batches.rowCount ?? 0
-      };
-    });
-  }
-  async probe(coreStore) {
-    const authority = coreStore[REPORTING_LEDGER_AUTHORITY];
-    if (!authority) {
-      throw new Error("Managed reporting requires a Core store that exposes REPORTING_LEDGER_AUTHORITY");
-    }
-    if (authority.substrate !== this.pool) {
-      throw new Error("Managed reporting Core and add-on stores must share the same PostgreSQL pool");
-    }
-    if (authority.managedDelivery !== true) {
-      throw new Error("Managed reporting requires PostgresReportingLedgerStore({ managedDelivery: true })");
-    }
-    await this.ensurePolicyRegistered();
-    const result = await this.query(
-      `SELECT to_regclass('adcp_reporting_managed_bindings') IS NOT NULL
-          AND to_regclass('adcp_reporting_materializations') IS NOT NULL
-          AND to_regclass('adcp_reporting_receipts') IS NOT NULL
-          AND EXISTS (
-                SELECT 1 FROM information_schema.columns
-                 WHERE table_schema = current_schema()
-                   AND table_name = 'adcp_reporting_managed_policy'
-                   AND column_name = 'materialization_planning_cursor'
-              ) AS ready`
-    );
-    if (result.rows[0]?.ready !== true) {
-      throw new Error(
-        "Managed reporting schema is unavailable; apply REPORTING_MANAGED_DELIVERY_MIGRATION after REPORTING_LEDGER_MIGRATION"
-      );
-    }
-    return true;
-  }
-  async listInstalledRecoveryWindowSeconds() {
-    const result = await this.query(
-      `SELECT DISTINCT configuration.data->'schedule'->>'recoveryWindowMilliseconds' AS milliseconds
-         FROM adcp_reporting_managed_bindings binding
-         JOIN adcp_reporting_configurations configuration
-           ON configuration.configuration_id = binding.configuration_id
-        ORDER BY milliseconds`
-    );
-    return result.rows.map((row) => {
-      const milliseconds = Number(row.milliseconds);
-      if (!Number.isSafeInteger(milliseconds) || milliseconds < 0) {
-        throw new Error("Installed managed Core recovery windows must be non-negative");
-      }
-      return Math.ceil(milliseconds / 1e3);
-    });
-  }
-  async authorizeDestination(input) {
-    positiveInteger(input.generation, "generation");
-    const pattern = input.pattern ?? null;
-    const transport = input.transport ?? null;
-    if (pattern !== null && !REPORTING_DESTINATION_PATTERNS_V1.includes(pattern)) {
-      throw new TypeError(
-        "Destination authorization pattern must be file_transfer, dataset_share, or warehouse_materialization"
-      );
-    }
-    if (transport !== null) {
-      if (pattern === null) throw new TypeError("Destination authorization transport requires its pattern");
-      if (typeof transport !== "string" || !REPORTING_DESTINATION_TRANSPORT_PATTERN_V1.test(transport)) {
-        throw new TypeError("Destination authorization transport must match ^[a-z][a-z0-9_.-]{0,63}$");
-      }
-    }
-    await this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(input.account_id));
-      await advisoryLock(client, authLock(input.account_id, input.destination_ref));
-      const current = await client.query(
-        `SELECT generation::text, pattern, transport FROM adcp_reporting_destination_authorizations
-          WHERE account_id = $1 AND destination_ref = $2 AND revoked_at IS NULL`,
-        [input.account_id, input.destination_ref]
-      );
-      if (current.rowCount) {
-        if (Number(current.rows[0].generation) === input.generation) {
-          const recorded2 = current.rows[0];
-          if (pattern !== null && pattern !== recorded2.pattern || transport !== null && transport !== recorded2.transport) {
-            throw new Error("Destination authorization pattern and transport are immutable for a generation");
-          }
-          return;
-        }
-        throw new Error("A destination authorization generation is already current");
-      }
-      const latest = await client.query(
-        `SELECT MAX(generation)::text AS generation FROM adcp_reporting_destination_authorizations
-          WHERE account_id = $1 AND destination_ref = $2`,
-        [input.account_id, input.destination_ref]
-      );
-      if (input.generation <= Number(latest.rows[0]?.generation ?? 0)) {
-        throw new Error("Destination authorization generation must increase after revocation");
-      }
-      await client.query(
-        // Both ends of the authorization window come from the committing
-        // database. Mixing a caller's `authorized_at` with a DB-clock
-        // `revoked_at` also violates the table's own ordering check whenever
-        // the caller's clock runs ahead.
-        `INSERT INTO adcp_reporting_destination_authorizations
-          (account_id, destination_ref, generation, authorized_at, pattern, transport, data)
-         VALUES ($1, $2, $3, clock_timestamp(), $6::text, $7::text,
-                 $4::jsonb || jsonb_build_object(
-                   'authorized_at', ${rfc3339Micro("clock_timestamp()")},
-                   'requested_authorized_at', $5::text))`,
-        [
-          input.account_id,
-          input.destination_ref,
-          input.generation,
-          JSON.stringify(input),
-          input.authorized_at,
-          pattern,
-          transport
-        ]
-      );
-    });
-  }
-  async revokeDestination(input) {
-    return this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(input.account_id));
-      await advisoryLock(client, authLock(input.account_id, input.destination_ref));
-      const updated = await client.query(
-        // The SLA is measured from this instant and evaluated against
-        // clock_timestamp() everywhere else, so recording a caller's host
-        // clock let a fast host shorten the promised window and a slow one
-        // extend it. The caller's value is kept only as stated intent.
-        `UPDATE adcp_reporting_destination_authorizations
-            SET revoked_at = clock_timestamp(),
-                changed_at = clock_timestamp(),
-                data = data || jsonb_build_object(
-                  'revoked_at', ${rfc3339Micro("clock_timestamp()")},
-                  'requested_revoked_at', $4::text
-                )
-          WHERE account_id = $1 AND destination_ref = $2 AND generation = $3
-            AND revoked_at IS NULL`,
-        [input.account_id, input.destination_ref, input.generation, input.revoked_at]
-      );
-      await client.query(
-        `UPDATE adcp_reporting_materializations SET
-            status = 'failed',
-            data = data || jsonb_build_object(
-              'status', 'failed',
-              'failed_at', ${rfc3339Micro("clock_timestamp()")},
-              'failure_code', 'AUTHORIZATION_REVOKED'
-            ),
-            changed_at = clock_timestamp(), lease_owner = NULL, lease_expires_at = NULL
-          WHERE account_id = $1 AND destination_ref = $2 AND authorization_generation = $3
-            AND status = 'pending'`,
-        [input.account_id, input.destination_ref, input.generation]
-      );
-      return updated.rowCount === 1;
-    });
-  }
-  setBindingAdmission(admit) {
-    this.bindingAdmission = admit;
-  }
-  async installBinding(binding) {
-    positiveInteger(binding.resource_retention_days, "resource_retention_days");
-    if (binding.reconciliation_mode === "consumer_receipt" && binding.verification_profile !== "canonical_digest") {
-      throw new Error("Reconciled Billing bindings require canonical-digest verification");
-    }
-    const expectedFingerprint = managedBindingFingerprint(binding);
-    if (binding.semantic_fingerprint !== expectedFingerprint) {
-      throw new Error("Managed binding semantic fingerprint does not match its immutable content");
-    }
-    this.bindingAdmission?.(binding);
-    await this.ensurePolicyRegistered();
-    return this.transaction(async (client) => {
-      const registeredPolicy = await this.readPolicy(client, "update");
-      await advisoryLock(client, accountLock(binding.account_id));
-      await advisoryLock(client, `adcp-reporting-binding:${binding.account_id}:${binding.delivery_config_id}`);
-      const existing = await client.query(
-        "SELECT semantic_fingerprint FROM adcp_reporting_managed_bindings WHERE configuration_id = $1",
-        [binding.configurationId]
-      );
-      if (existing.rowCount) {
-        if (existing.rows[0]?.semantic_fingerprint !== expectedFingerprint) {
-          throw new Error("Immutable managed binding identity names different content");
-        }
-        return { inserted: false };
-      }
-      const eligible = await client.query(
-        `SELECT configuration.data AS configuration,
-                authz.pattern AS authz_pattern, authz.transport AS authz_transport
-           FROM adcp_reporting_configurations configuration
-          JOIN adcp_reporting_destination_authorizations authz
-            ON authz.account_id = $2 AND authz.destination_ref = $5
-           AND authz.generation = $6 AND authz.revoked_at IS NULL
-         WHERE configuration.configuration_id = $1 AND configuration.account_id = $2
-           AND configuration.delivery_config_id = $3 AND configuration.delivery_config_version = $4
-           AND NOT EXISTS (
-             SELECT 1 FROM adcp_reporting_obligations obligation
-              WHERE obligation.configuration_id = configuration.configuration_id
-           )`,
-        [
-          binding.configurationId,
-          binding.account_id,
-          binding.delivery_config_id,
-          binding.delivery_config_version,
-          binding.destination_ref,
-          binding.authorization_generation
-        ]
-      );
-      if (!eligible.rowCount) throw new Error("Managed binding is not authorized for the exact Core configuration");
-      const configuration = eligible.rows[0].configuration;
-      const recordedContract = eligible.rows[0];
-      if (recordedContract.authz_pattern !== null && binding.method !== recordedContract.authz_pattern) {
-        throw new Error("Managed binding method differs from the pattern recorded on its destination authorization");
-      }
-      if (recordedContract.authz_transport !== null && binding.transport !== recordedContract.authz_transport) {
-        throw new Error(
-          "Managed binding transport differs from the transport recorded on its destination authorization"
-        );
-      }
-      const advertisedRecoveryWindowSeconds = registeredPolicy.recoveryWindowSeconds;
-      if (advertisedRecoveryWindowSeconds !== null) {
-        const windowMilliseconds = Number(configuration.schedule?.recoveryWindowMilliseconds);
-        if (!Number.isFinite(windowMilliseconds) || windowMilliseconds < 0) {
-          throw new Error("Managed binding Core configuration has no usable recovery window");
-        }
-        const windowSeconds = Math.ceil(windowMilliseconds / 1e3);
-        if (windowSeconds > advertisedRecoveryWindowSeconds) {
-          throw new Error(
-            `Managed binding Core recovery window is ${windowSeconds}s but this agent advertises automated_recovery_window_seconds ${advertisedRecoveryWindowSeconds}s; installing it would publish a recovery bound the deployment does not keep`
-          );
-        }
-      }
-      if (binding.feed_purpose === "billing" && binding.reconciliation_mode !== "consumer_receipt") {
-        throw new Error("Billing managed bindings require consumer-receipt reconciliation");
-      }
-      if (binding.feed_purpose === "billing" && configuration.requiredFinality !== "official") {
-        throw new Error("Billing managed bindings require a Core configuration with official finality");
-      }
-      if (configuration.feedPurpose !== binding.feed_purpose) {
-        throw new Error("Managed binding feed purpose differs from the exact Core configuration");
-      }
-      if (binding.reconciliation_mode === "consumer_receipt" && !configuration.canonicalization) {
-        throw new Error("Reconciled Billing requires a Core configuration with pinned canonicalization");
-      }
-      const inserted = await client.query(
-        `INSERT INTO adcp_reporting_managed_bindings
-          (configuration_id, account_id, delivery_config_id, delivery_config_version,
-           destination_ref, authorization_generation, semantic_fingerprint, data, created_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9)
-         ON CONFLICT DO NOTHING RETURNING semantic_fingerprint`,
-        [
-          binding.configurationId,
-          binding.account_id,
-          binding.delivery_config_id,
-          binding.delivery_config_version,
-          binding.destination_ref,
-          binding.authorization_generation,
-          binding.semantic_fingerprint,
-          JSON.stringify(binding),
-          binding.created_at
-        ]
-      );
-      if (!inserted.rowCount) {
-        const raced = await client.query(
-          "SELECT semantic_fingerprint FROM adcp_reporting_managed_bindings WHERE configuration_id = $1",
-          [binding.configurationId]
-        );
-        if (raced.rows[0]?.semantic_fingerprint !== binding.semantic_fingerprint) {
-          throw new Error("Immutable managed binding identity names different content");
-        }
-      }
-      return { inserted: inserted.rowCount === 1 };
-    });
-  }
-  async planMaterializations(input = {}) {
-    const limit = input.limit ?? MAX_PLAN;
-    positiveInteger(limit, "limit");
-    if (limit > MAX_PLAN) throw new RangeError(`limit must not exceed ${MAX_PLAN}`);
-    if (!input.account_id) {
-      const accounts = await this.claimMaterializationPlanningAccounts(limit);
-      let planned = 0;
-      let firstPass = true;
-      while (planned < limit) {
-        let progressed = 0;
-        for (let index = 0; index < accounts.length && planned < limit; index += 1) {
-          const accountsRemaining = accounts.length - index;
-          const accountLimit = firstPass ? Math.max(1, Math.floor((limit - planned) / accountsRemaining)) : limit - planned;
-          const accountPlanned = await this.planMaterializations({
-            account_id: accounts[index],
-            limit: accountLimit
-          });
-          planned += accountPlanned;
-          progressed += accountPlanned;
-        }
-        if (progressed === 0) break;
-        firstPass = false;
-      }
-      return planned;
-    }
-    return this.transaction(async (client) => {
-      const accounts = await client.query(
-        `SELECT DISTINCT account_id FROM adcp_reporting_managed_bindings
-          WHERE ($1::text IS NULL OR account_id = $1) ORDER BY account_id`,
-        [input.account_id ?? null]
-      );
-      for (const { account_id } of accounts.rows) await advisoryLock(client, accountLock(account_id));
-      const capacity = await client.query(
-        `SELECT account_id, COUNT(*)::text AS count FROM adcp_reporting_materializations
-          WHERE ($1::text IS NULL OR account_id = $1)${this.activeScope("recorded_at")} GROUP BY account_id`,
-        [input.account_id ?? null]
-      );
-      const remainingByAccount = new Map(
-        accounts.rows.map(({ account_id }) => [
-          account_id,
-          MAX_MATERIALIZATIONS_PER_ACCOUNT - Number(capacity.rows.find((value) => value.account_id === account_id)?.count ?? 0)
-        ])
-      );
-      const candidates = await client.query(
-        `SELECT binding.data AS binding, obligation.data AS obligation, revision.revision_id AS revision_id,
-                GREATEST(COALESCE(MAX(existing.attempt), 0), COALESCE(MAX(tomb.highest_attempt), 0))::integer + 1
-                  AS attempt
-           FROM adcp_reporting_managed_bindings binding
-           JOIN adcp_reporting_destination_authorizations authz
-             ON authz.account_id = binding.account_id
-            AND authz.destination_ref = binding.destination_ref
-            AND authz.generation = binding.authorization_generation
-            AND authz.revoked_at IS NULL
-           JOIN adcp_reporting_obligations obligation ON obligation.configuration_id = binding.configuration_id
-           JOIN adcp_reporting_revisions revision ON revision.obligation_id = obligation.obligation_id
-      LEFT JOIN adcp_reporting_materializations existing
-             ON existing.configuration_id = binding.configuration_id AND existing.revision_id = revision.revision_id
-      -- Pruned attempts still count. Without this a revision that exhausted
-      -- its attempts, or already succeeded, restarts at attempt 1 as soon as
-      -- its rows age out of retention.
-      LEFT JOIN adcp_reporting_materialization_tombstones tomb
-             ON tomb.configuration_id = binding.configuration_id AND tomb.revision_id = revision.revision_id
-          WHERE ($1::text IS NULL OR binding.account_id = $1)
-          GROUP BY binding.configuration_id, binding.data, obligation.obligation_id, obligation.data,
-                   revision.revision_id
-         HAVING NOT COALESCE(BOOL_OR(existing.status IN ('pending','available','delivered')), false)
-            AND NOT COALESCE(BOOL_OR(tomb.reached_success), false)
-            AND GREATEST(COALESCE(MAX(existing.attempt), 0), COALESCE(MAX(tomb.highest_attempt), 0))
-                < ${MAX_MATERIALIZATION_ATTEMPTS}
-          ORDER BY MIN(revision.recorded_at), revision.revision_id
-          LIMIT $2`,
-        [input.account_id ?? null, limit]
-      );
-      let planned = 0;
-      for (const candidate of candidates.rows) {
-        const binding = candidate.binding;
-        const remaining = remainingByAccount.get(binding.account_id) ?? 0;
-        if (remaining <= 0) continue;
-        const obligation = candidate.obligation;
-        const revisionId = candidate.revision_id;
-        const created_at = (/* @__PURE__ */ new Date()).toISOString();
-        const materialization = {
-          reporting_materialization_id: `rmat_${randomUUID()}`,
-          reporting_revision_id: revisionId,
-          reporting_obligation_id: obligation.reporting_obligation_id,
-          delivery_config_id: binding.delivery_config_id,
-          delivery_config_version: binding.delivery_config_version,
-          destination_ref: binding.destination_ref,
-          feed_purpose: binding.feed_purpose,
-          method: binding.method,
-          ...binding.transport ? { transport: binding.transport } : {},
-          attempt: candidate.attempt,
-          status: "pending",
-          created_at
-        };
-        const inserted = await client.query(
-          `INSERT INTO adcp_reporting_materializations
-            (materialization_id, account_id, configuration_id, obligation_id, revision_id,
-             destination_ref, authorization_generation, attempt, status, data, created_at)
-           VALUES ($1,$2,$3,$4,$5,$6,$7,$8,'pending',$9::jsonb,$10)
-           ON CONFLICT DO NOTHING`,
-          [
-            materialization.reporting_materialization_id,
-            binding.account_id,
-            binding.configurationId,
-            obligation.reporting_obligation_id,
-            revisionId,
-            binding.destination_ref,
-            binding.authorization_generation,
-            candidate.attempt,
-            JSON.stringify(materialization),
-            created_at
-          ]
-        );
-        planned += inserted.rowCount ?? 0;
-        if (inserted.rowCount) remainingByAccount.set(binding.account_id, remaining - 1);
-      }
-      return planned;
-    });
-  }
-  /**
-   * Claims a bounded, durable round-robin page of accounts that currently
-   * have at least one materialization candidate.
-   *
-   * The policy row serializes only the final cursor compare-and-set. Eligible
-   * account discovery runs without that global lock so retained revision
-   * history cannot block materialization settlement or revocation. The cursor
-   * advances before provider work; a crash may defer a selected account until
-   * the ring wraps, but can never pin every future sweep behind it.
-   */
-  async claimMaterializationPlanningAccounts(limit) {
-    for (let contentionAttempt = 0; contentionAttempt < 4; contentionAttempt += 1) {
-      const policy = await this.query(
-        `SELECT materialization_planning_cursor
-           FROM adcp_reporting_managed_policy
-          WHERE policy_key = 'agent'`
-      );
-      if (!policy.rows[0]) {
-        throw new Error(
-          "Managed reporting policy sentinel is missing; apply REPORTING_MANAGED_DELIVERY_MIGRATION before use"
-        );
-      }
-      const eligiblePageSql = `SELECT DISTINCT binding.account_id
-           FROM adcp_reporting_managed_bindings binding
-           JOIN adcp_reporting_destination_authorizations authz
-             ON authz.account_id = binding.account_id
-            AND authz.destination_ref = binding.destination_ref
-            AND authz.generation = binding.authorization_generation
-            AND authz.revoked_at IS NULL
-           JOIN adcp_reporting_obligations obligation
-             ON obligation.configuration_id = binding.configuration_id
-           JOIN adcp_reporting_revisions revision
-             ON revision.obligation_id = obligation.obligation_id
-          WHERE ($1::text IS NULL OR CASE WHEN $3::boolean
-                    THEN binding.account_id > $1
-                    ELSE binding.account_id <= $1
-                 END)
-            AND NOT EXISTS (
-                  SELECT 1 FROM adcp_reporting_materializations existing
-                   WHERE existing.configuration_id = binding.configuration_id
-                     AND existing.revision_id = revision.revision_id
-                     AND existing.status IN ('pending', 'available', 'delivered')
-                )
-            AND NOT EXISTS (
-                  SELECT 1 FROM adcp_reporting_materialization_tombstones tomb
-                   WHERE tomb.configuration_id = binding.configuration_id
-                     AND tomb.revision_id = revision.revision_id
-                     AND tomb.reached_success
-                )
-            AND GREATEST(
-                  COALESCE((
-                    SELECT MAX(existing.attempt)
-                      FROM adcp_reporting_materializations existing
-                     WHERE existing.configuration_id = binding.configuration_id
-                       AND existing.revision_id = revision.revision_id
-                  ), 0),
-                  COALESCE((
-                    SELECT tomb.highest_attempt
-                      FROM adcp_reporting_materialization_tombstones tomb
-                     WHERE tomb.configuration_id = binding.configuration_id
-                       AND tomb.revision_id = revision.revision_id
-                  ), 0)
-                ) < ${MAX_MATERIALIZATION_ATTEMPTS}
-            AND (
-                  SELECT COUNT(*) FROM adcp_reporting_materializations capacity
-                   WHERE capacity.account_id = binding.account_id${this.activeScope("capacity.recorded_at")}
-                ) < ${MAX_MATERIALIZATIONS_PER_ACCOUNT}
-          ORDER BY binding.account_id
-          LIMIT $2`;
-      const cursor = policy.rows[0].materialization_planning_cursor;
-      const after = await this.query(eligiblePageSql, [cursor, limit, true]);
-      const selected = after.rows.map((row) => row.account_id);
-      if (cursor !== null && selected.length < limit) {
-        const wrapped = await this.query(eligiblePageSql, [
-          cursor,
-          limit - selected.length,
-          false
-        ]);
-        selected.push(...wrapped.rows.map((row) => row.account_id));
-      }
-      if (selected.length === 0) return [];
-      const advanced = await this.transaction(async (client) => {
-        const current = await client.query(
-          `SELECT materialization_planning_cursor
-             FROM adcp_reporting_managed_policy
-            WHERE policy_key = 'agent'
-            FOR UPDATE`
-        );
-        if (!current.rows[0]) {
-          throw new Error(
-            "Managed reporting policy sentinel is missing; apply REPORTING_MANAGED_DELIVERY_MIGRATION before use"
-          );
-        }
-        if (current.rows[0].materialization_planning_cursor !== cursor) return false;
-        await client.query(
-          `UPDATE adcp_reporting_managed_policy
-              SET materialization_planning_cursor = $1, changed_at = clock_timestamp()
-            WHERE policy_key = 'agent'`,
-          [selected[selected.length - 1]]
-        );
-        return true;
-      });
-      if (advanced) return selected;
-    }
-    return [];
-  }
-  async claimMaterialization(input) {
-    positiveInteger(input.lease_milliseconds, "lease_milliseconds");
-    const lease = await this.transaction(async (client) => {
-      const selected = await client.query(
-        `WITH candidate AS (
-           SELECT materialization.materialization_id
-             FROM adcp_reporting_materializations materialization
-             JOIN adcp_reporting_destination_authorizations authz
-               ON authz.account_id = materialization.account_id
-              AND authz.destination_ref = materialization.destination_ref
-              AND authz.generation = materialization.authorization_generation
-              AND authz.revoked_at IS NULL
-            WHERE materialization.status = 'pending'
-              AND ($1::text IS NULL OR materialization.account_id = $1)
-              -- Every claim of a pending row is a delivery attempt, settled
-              -- or not. The attempt column only advances in the planner, so a
-              -- row whose settle kept losing its lease was reclaimed without
-              -- bound and re-delivered each time. Lease generation is the
-              -- durable count of those attempts.
-              AND materialization.lease_generation < ${MAX_MATERIALIZATION_ATTEMPTS}
-              -- One authoritative clock. settleMaterialization fences on
-              -- clock_timestamp(), so issuing the lease from the caller's clock
-              -- made ordinary NTP drift fatal: the claim succeeded, the settle
-              -- matched zero rows, and the row stayed 'pending' at attempt 1
-              -- where the planner's HAVING cannot see it \u2014 so the attempt cap
-              -- never engaged and the adapter was asked to deliver again, and
-              -- again, with no bound.
-              AND (materialization.lease_expires_at IS NULL OR materialization.lease_expires_at <= clock_timestamp())
-            ORDER BY materialization.created_at, materialization.materialization_id
-            FOR UPDATE OF materialization SKIP LOCKED LIMIT 1
-         ), claimed AS (
-           UPDATE adcp_reporting_materializations materialization
-              SET lease_owner = $2, lease_generation = lease_generation + 1,
-                  lease_expires_at = clock_timestamp() + ($3::bigint * INTERVAL '1 millisecond')
-             FROM candidate WHERE materialization.materialization_id = candidate.materialization_id
-         RETURNING materialization.*
-         )
-         SELECT claimed.materialization_id, claimed.lease_generation::text AS generation,
-                claimed.lease_expires_at AS expires_at, claimed.data AS materialization,
-                binding.data AS binding, obligation.data AS obligation, revision.data AS revision
-           FROM claimed
-           JOIN adcp_reporting_managed_bindings binding ON binding.configuration_id = claimed.configuration_id
-           JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = claimed.obligation_id
-           JOIN adcp_reporting_revisions revision ON revision.revision_id = claimed.revision_id`,
-        [input.account_id ?? null, input.owner, input.lease_milliseconds]
-      );
-      const row = selected.rows[0];
-      if (!row) return null;
-      return {
-        materialization: structuredClone(row.materialization),
-        binding: structuredClone(row.binding),
-        obligation: structuredClone(row.obligation),
-        revision: structuredClone(row.revision),
-        owner: input.owner,
-        generation: Number(row.generation),
-        expires_at: row.expires_at.toISOString()
-      };
-    });
-    if (!lease || Array.isArray(lease.revision.rows)) return lease;
-    try {
-      const handle = await this.rowStorage.find(
-        lease.revision.reporting_revision_id,
-        lease.obligation.account.account_id
-      );
-      if (handle?.kind === "postgres") {
-        lease.revision = {
-          ...lease.revision,
-          rows: await this.rowStorage.readAll(handle, lease.revision.wireRevision.control_totals)
-        };
-      }
-    } catch (error) {
-      if (!isReportingRowStoreError(error)) throw error;
-    }
-    return lease;
-  }
-  /**
-   * Fails materializations that have used every delivery attempt.
-   *
-   * The claim predicate stops handing them out, so without this they would
-   * stay `pending` — invisible to the planner, which skips an obligation with
-   * any pending row, and so never retried or replanned.
-   */
-  async failExhaustedMaterializations(input) {
-    const limit = input?.limit ?? 1e3;
-    positiveInteger(limit, "limit");
-    return this.transaction(async (client) => {
-      const accounts = await client.query(
-        `SELECT DISTINCT account_id FROM adcp_reporting_materializations
-          WHERE status = 'pending'
-            AND lease_generation >= ${MAX_MATERIALIZATION_ATTEMPTS}
-            AND (lease_expires_at IS NULL OR lease_expires_at <= clock_timestamp())
-            AND ($1::text IS NULL OR account_id = $1)
-          ORDER BY account_id`,
-        [input?.account_id ?? null]
-      );
-      for (const { account_id } of accounts.rows) await advisoryLock(client, accountLock(account_id));
-      const lockedAccounts = accounts.rows.map((row) => row.account_id);
-      const result = await client.query(
-        `UPDATE adcp_reporting_materializations SET status = 'failed',
-          data = data || jsonb_build_object(
-            'status', 'failed',
-            'failed_at', ${rfc3339Micro("clock_timestamp()")},
-            'failure_code', 'DELIVERY_ATTEMPTS_EXHAUSTED'
-          ),
-          changed_at = clock_timestamp(), lease_owner = NULL, lease_expires_at = NULL
-        WHERE
-          -- Re-evaluated after the row lock, not only as a subquery. The
-          -- subquery runs against the statement's snapshot, so a settle that
-          -- committed while this UPDATE waited on the row was overwritten:
-          -- a delivered materialization became failed /
-          -- DELIVERY_ATTEMPTS_EXHAUSTED. Repeating the predicates here makes
-          -- PostgreSQL recheck them against the committed row.
-          status = 'pending'
-          AND lease_generation >= ${MAX_MATERIALIZATION_ATTEMPTS}
-          AND (lease_expires_at IS NULL OR lease_expires_at <= clock_timestamp())
-          AND account_id = ANY($2::text[])
-          AND materialization_id IN (
-            SELECT materialization_id FROM adcp_reporting_materializations
-             WHERE status = 'pending'
-               AND lease_generation >= ${MAX_MATERIALIZATION_ATTEMPTS}
-               AND (lease_expires_at IS NULL OR lease_expires_at <= clock_timestamp())
-               AND account_id = ANY($2::text[])
-             ORDER BY created_at LIMIT $1)`,
-        [limit, lockedAccounts]
-      );
-      return result.rowCount ?? 0;
-    });
-  }
-  async settleMaterialization(input) {
-    const requested = input.minimum_resource_retention_days;
-    if (requested !== void 0 && (!Number.isSafeInteger(requested) || requested < 0)) {
-      throw new RangeError("minimum_resource_retention_days must be a non-negative safe integer");
-    }
-    if (input.outcome.status !== "failed" && input.outcome.resource.expires_at !== void 0) {
-      assertMaterializationOutcome(
-        input.lease,
-        input.outcome,
-        input.now,
-        Math.max(requested ?? 0, input.lease.binding.resource_retention_days)
-      );
-    }
-    return this.transaction(async (client) => {
-      const { lease } = input;
-      const registeredPolicy = await this.readPolicy(client, "share");
-      await advisoryLock(client, accountLock(lease.binding.account_id));
-      const minimumRetentionDays = Math.max(
-        requested ?? 0,
-        lease.binding.resource_retention_days,
-        registeredPolicy.resourceRetentionDays ?? 0
-      );
-      const authorized = await client.query(
-        `SELECT 1 FROM adcp_reporting_destination_authorizations
-          WHERE account_id = $1 AND destination_ref = $2 AND generation = $3 AND revoked_at IS NULL`,
-        [lease.binding.account_id, lease.binding.destination_ref, lease.binding.authorization_generation]
-      );
-      const outcome = authorized.rowCount ? input.outcome : { status: "failed", failure_code: "AUTHORIZATION_REVOKED" };
-      const materialization = {
-        ...lease.materialization,
-        status: outcome.status,
-        ...outcome.status === "failed" ? { failed_at: input.now, failure_code: outcome.failure_code } : { ready_at: input.now, resource: outcome.resource, verification: outcome.verification }
-      };
-      const updated = await client.query(
-        `UPDATE adcp_reporting_materializations SET status = $5, data = $6::jsonb,
-             changed_at = clock_timestamp(), lease_owner = NULL, lease_expires_at = NULL
-          WHERE materialization_id = $1 AND lease_owner = $2 AND lease_generation = $3
-            AND lease_expires_at > clock_timestamp() AND status = 'pending' AND authorization_generation = $4
-            -- Retention is judged entirely by the clock that stores it. A
-            -- worker running behind could otherwise satisfy the window on its
-            -- own clock and publish a resource the database already considers
-            -- expired, or under-retain one \u2014 leaving a delivered
-            -- materialization whose bytes no reader can fetch.
-            -- Exempt only a failed outcome, which retains nothing. Treating
-            -- a NULL expiry as exempt let a direct caller settle a
-            -- successful materialization with no expiry at all: permanently
-            -- readable to the projection, permanently unreadable in fact,
-            -- and never revisited because it is not pending.
-            AND ($5 = 'failed'
-                 OR ($7::timestamptz IS NOT NULL
-                     AND $7::timestamptz >= clock_timestamp() + ($8::bigint * INTERVAL '1 day')))`,
-        [
-          lease.materialization.reporting_materialization_id,
-          lease.owner,
-          lease.generation,
-          lease.binding.authorization_generation,
-          outcome.status,
-          JSON.stringify(materialization),
-          outcome.status === "failed" ? null : outcome.resource.expires_at,
-          minimumRetentionDays
-        ]
-      );
-      if (updated.rowCount === 1 && authorized.rowCount === 1 && outcome.status !== "failed" && this.notificationActivityPort?.recordDeliveryReady) {
-        await this.notificationActivityPort.recordDeliveryReady(
-          {
-            obligation: lease.obligation,
-            revision: lease.revision,
-            materialization
-          },
-          client
-        );
-      }
-      if (updated.rowCount === 0 && outcome.status !== "failed") {
-        await client.query(
-          `UPDATE adcp_reporting_materializations SET status = 'failed',
-              data = data || jsonb_build_object(
-                'status', 'failed',
-                'failed_at', ${rfc3339Micro("clock_timestamp()")},
-                'failure_code', 'RESOURCE_RETENTION_INSUFFICIENT'
-              ),
-              changed_at = clock_timestamp(), lease_owner = NULL, lease_expires_at = NULL
-            -- Deliberately not fenced on an unexpired lease. If the settle
-            -- waited on the account lock until the lease expired, both it and
-            -- this terminalizer rejected, leaving the row pending \u2014
-            -- reclaimable forever, and re-delivered each time. Owner and
-            -- generation still fence it against a newer holder.
-            WHERE materialization_id = $1 AND lease_owner = $2 AND lease_generation = $3
-              AND status = 'pending'`,
-          [lease.materialization.reporting_materialization_id, lease.owner, lease.generation]
-        );
-      }
-      return updated.rowCount === 1 && authorized.rowCount === 1 && outcome.status !== "failed";
-    });
-  }
-  async claimRevocation(input) {
-    positiveInteger(input.lease_milliseconds, "lease_milliseconds");
-    if (input.authorization_revocation_seconds !== void 0) {
-      nonnegativeSafeInteger(input.authorization_revocation_seconds, "authorization_revocation_seconds");
-    }
-    return this.transaction(async (client) => {
-      const registeredPolicy = await this.readPolicy(client, "share");
-      const revocationSeconds = registeredPolicy.authorizationRevocationSeconds === null ? input.authorization_revocation_seconds : Math.min(
-        registeredPolicy.authorizationRevocationSeconds,
-        input.authorization_revocation_seconds ?? registeredPolicy.authorizationRevocationSeconds
-      );
-      const result = await client.query(
-        `WITH candidate AS (
-           SELECT account_id, destination_ref, generation
-             FROM adcp_reporting_destination_authorizations
-            WHERE revoked_at IS NOT NULL AND cleanup_completed_at IS NULL
-              -- Same single-clock rule as claimMaterialization: completeRevocation
-              -- fences on clock_timestamp(), so the lease must be issued from it
-              -- too or cleanup can never commit and the grant is never torn down.
-              --
-              -- The last arm reclaims at the SLA boundary. A worker that
-              -- crashed holding a long lease would otherwise make the grant
-              -- unreclaimable for the rest of that lease while the advertised
-              -- window elapsed. Lease generation fences the old holder, so its
-              -- late completion cannot commit over the new one.
-              -- One stable policy. Reclaiming purely because the SLA had
-              -- elapsed let every worker steal from every other on an already
-              -- late grant: generations bumped each pass and each holder's
-              -- completion was invalidated by the next, so cleanup never
-              -- committed at all. A holder is displaced only once it has had a
-              -- full attempt's worth of time and still not finished, which
-              -- recovers a crashed worker without disturbing a live one.
-              AND (cleanup_lease_expires_at IS NULL
-                   OR cleanup_lease_expires_at <= clock_timestamp()
-                   OR ($4::bigint IS NOT NULL
-                       AND revoked_at + ($4::bigint * INTERVAL '1 second') <= clock_timestamp()
-                       AND cleanup_lease_issued_at IS NOT NULL
-                       AND cleanup_lease_issued_at + ($5::bigint * INTERVAL '1 millisecond')
-                           <= clock_timestamp()))
-              AND ($3::text IS NULL OR account_id = $3)
-            ORDER BY cleanup_lease_generation, revoked_at, account_id, destination_ref
-            FOR UPDATE SKIP LOCKED LIMIT 1
-         )
-         UPDATE adcp_reporting_destination_authorizations target SET
-           cleanup_lease_owner = $1, cleanup_lease_generation = target.cleanup_lease_generation + 1,
-           cleanup_lease_issued_at = clock_timestamp(),
-           cleanup_lease_expires_at = clock_timestamp() + ($2::bigint * INTERVAL '1 millisecond')
-          FROM candidate
-         WHERE target.account_id = candidate.account_id AND target.destination_ref = candidate.destination_ref
-           AND target.generation = candidate.generation
-         RETURNING target.data || jsonb_strip_nulls(
-                     jsonb_build_object('pattern', target.pattern, 'transport', target.transport)
-                   ) AS data,
-                   target.cleanup_lease_generation::text AS generation,
-                   target.cleanup_lease_expires_at AS expires_at,
-                   target.revoked_at AS revoked_at,
-                   CASE WHEN $4::bigint IS NULL THEN NULL
-                        ELSE target.revoked_at + ($4::bigint * INTERVAL '1 second') <= clock_timestamp()
-                   END AS overdue,
-                   CASE WHEN $4::bigint IS NULL THEN NULL
-                        ELSE EXTRACT(EPOCH FROM (target.revoked_at
-                             + ($4::bigint * INTERVAL '1 second') - clock_timestamp())) * 1000
-                   END AS remaining_milliseconds`,
-        [
-          input.owner,
-          input.lease_milliseconds,
-          input.account_id ?? null,
-          revocationSeconds ?? null,
-          input.steal_after_milliseconds ?? input.lease_milliseconds
-        ]
-      );
-      const row = result.rows[0];
-      if (!row) return null;
-      return {
-        authorization: structuredClone(row.data),
-        owner: input.owner,
-        generation: Number(row.generation),
-        expires_at: row.expires_at.toISOString(),
-        // Every SLA fact comes from the database that committed the
-        // revocation, never from the worker host: a skewed worker must not be
-        // able to decide a grant is still inside its promised window.
-        revoked_at: row.revoked_at.toISOString(),
-        ...row.overdue === null ? {} : { overdue: row.overdue },
-        ...row.remaining_milliseconds === null ? {} : { remaining_milliseconds: Number(row.remaining_milliseconds) }
-      };
-    });
-  }
-  async completeRevocation(input) {
-    const result = await this.query(
-      `UPDATE adcp_reporting_destination_authorizations SET cleanup_completed_at = $6::timestamptz,
-          cleanup_lease_owner = NULL, cleanup_lease_expires_at = NULL,
-          data = data || jsonb_build_object('cleanup_completed_at', $6::text)
-        WHERE account_id = $1 AND destination_ref = $2 AND generation = $3
-          AND cleanup_lease_owner = $4 AND cleanup_lease_generation = $5
-          AND cleanup_lease_expires_at > clock_timestamp()
-          AND revoked_at IS NOT NULL AND cleanup_completed_at IS NULL`,
-      [
-        input.lease.authorization.account_id,
-        input.lease.authorization.destination_ref,
-        input.lease.authorization.generation,
-        input.lease.owner,
-        input.lease.generation,
-        input.completed_at
-      ]
-    );
-    return result.rowCount === 1;
-  }
-  async releaseRevocation(input) {
-    const result = await this.query(
-      `UPDATE adcp_reporting_destination_authorizations
-          -- Release enables a later recovery, not an immediate one. Clearing
-          -- the lease outright let the very next iteration of the same worker
-          -- tick reclaim the same grant, so one broken provider consumed
-          -- every iteration and nothing else was ever cleaned up. Holding a
-          -- short backoff keeps the grant reclaimable soon without that
-          -- tight loop; the generation bump still fences the failed holder.
-          SET cleanup_lease_owner = NULL, cleanup_lease_issued_at = NULL,
-              cleanup_lease_expires_at = clock_timestamp() + ($6::bigint * INTERVAL '1 millisecond')
-        WHERE account_id = $1 AND destination_ref = $2 AND generation = $3
-          AND cleanup_lease_owner = $4 AND cleanup_lease_generation = $5
-          AND cleanup_completed_at IS NULL`,
-      [
-        input.lease.authorization.account_id,
-        input.lease.authorization.destination_ref,
-        input.lease.authorization.generation,
-        input.lease.owner,
-        input.lease.generation,
-        input.backoff_milliseconds ?? REVOCATION_RETRY_BACKOFF_MS
-      ]
-    );
-    return result.rowCount === 1;
-  }
-  async getReadableResource(input) {
-    const result = await this.query(
-      `SELECT materialization.data AS materialization, binding.data AS binding
-         FROM adcp_reporting_materializations materialization
-         JOIN adcp_reporting_managed_bindings binding ON binding.configuration_id = materialization.configuration_id
-         JOIN adcp_reporting_destination_authorizations authz
-           ON authz.account_id = materialization.account_id
-          AND authz.destination_ref = materialization.destination_ref
-          AND authz.generation = materialization.authorization_generation
-          AND authz.revoked_at IS NULL
-        WHERE materialization.account_id = $1
-          AND materialization.status IN ('available','delivered')
-          AND materialization.data->'resource'->>'resource_ref' = $2
-          AND (materialization.data->'resource'->>'expires_at')::timestamptz > clock_timestamp()`,
-      [input.account_id, input.resource_ref]
-    );
-    const row = result.rows[0];
-    return row ? { materialization: structuredClone(row.materialization), binding: structuredClone(row.binding) } : null;
-  }
-  /** Freeze all writable names under the same locks as revokeDestination. */
-  async registerObjectWritePlan(input, context = {}) {
-    const plan = structuredClone(input);
-    const fingerprint = reportingObjectWritePlanFingerprint(plan);
-    return this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(plan.account_id));
-      await advisoryLock(client, authLock(plan.account_id, plan.destination_ref));
-      const authorized = await client.query(
-        `SELECT 1 FROM adcp_reporting_destination_authorizations
-         WHERE account_id = $1 AND destination_ref = $2 AND generation = $3 AND revoked_at IS NULL`,
-        [plan.account_id, plan.destination_ref, plan.generation]
-      );
-      if (!authorized.rowCount) return "revoked";
-      await client.query(
-        `INSERT INTO adcp_reporting_object_write_bindings (account_id,destination_ref,generation,bucket,namespace_key)
-         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
-        [plan.account_id, plan.destination_ref, plan.generation, plan.provider.bucket, plan.provider.namespace_key]
-      );
-      const binding = await client.query(
-        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
-        [plan.account_id, plan.destination_ref, plan.generation]
-      );
-      if (binding.rows[0]?.bucket !== plan.provider.bucket || binding.rows[0]?.namespace_key !== plan.provider.namespace_key)
-        throw new ReportingObjectWriteConflictError();
-      const inserted = await client.query(
-        `INSERT INTO adcp_reporting_object_write_plans (account_id, destination_ref, generation, plan_id, fingerprint)
-         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
-        [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id, fingerprint]
-      );
-      if (!inserted.rowCount) {
-        const existing = await client.query(
-          `SELECT fingerprint FROM adcp_reporting_object_write_plans
-           WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4`,
-          [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id]
-        );
-        if (existing.rows[0]?.fingerprint !== fingerprint) throw new ReportingObjectWriteConflictError();
-        return "unchanged";
-      }
-      await client.query(
-        `INSERT INTO adcp_reporting_object_writes
-         (account_id,destination_ref,generation,plan_id,object_index,bucket,object_name,sha256,size_bytes)
-         SELECT $1,$2,$3,$4,(ordinality-1)::integer,value->>'bucket',value->>'object_name',value->>'sha256',
-           (value->>'size_bytes')::bigint FROM jsonb_array_elements($5::jsonb) WITH ORDINALITY`,
-        [
-          plan.account_id,
-          plan.destination_ref,
-          plan.generation,
-          plan.plan_id,
-          JSON.stringify(
-            plan.objects.map(({ bucket, object_name, sha256, size_bytes }) => ({
-              bucket,
-              object_name,
-              sha256,
-              size_bytes
-            }))
-          )
-        ]
-      );
-      return "registered";
-    }, context.signal);
-  }
-  async listRevokedObjectWrites(inputScope, inputOptions = {}, context = {}) {
-    const scope = structuredClone(inputScope);
-    const options = structuredClone(inputOptions);
-    assertReportingObjectWriteScope(scope);
-    const limit = options.limit ?? 100;
-    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3 || options.after && (!/^[a-f0-9]{64}$/.test(options.after.plan_id) || !Number.isSafeInteger(options.after.object_index) || options.after.object_index < 0 || options.after.object_index >= 128)) {
-      throw new Error("Invalid reporting object-write page");
-    }
-    return this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(scope.account_id));
-      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
-      const revoked = await client.query(
-        `SELECT 1 FROM adcp_reporting_destination_authorizations
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
-        [scope.account_id, scope.destination_ref, scope.generation]
-      );
-      if (!revoked.rowCount) throw new ReportingObjectWriteNotRevokedError();
-      const rows = await client.query(
-        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes::float8 AS size_bytes
-         FROM adcp_reporting_object_writes WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND fenced_at IS NULL
-         AND ($4::text IS NULL OR (plan_id,object_index) > ($4,$5::integer))
-         ORDER BY plan_id,object_index LIMIT $6`,
-        [
-          scope.account_id,
-          scope.destination_ref,
-          scope.generation,
-          options.after?.plan_id ?? null,
-          options.after?.object_index ?? null,
-          limit
-        ]
-      );
-      return rows.rows;
-    }, context.signal);
-  }
-  async markObjectWriteFenced(input, context = {}) {
-    const frozen = structuredClone(input);
-    assertReportingObjectWriteScope(frozen);
-    if (!/^[a-f0-9]{64}$/.test(frozen.plan_id) || !Number.isSafeInteger(frozen.object_index) || frozen.object_index < 0 || frozen.object_index >= 128 || !/^[1-9][0-9]{0,39}$/.test(frozen.tombstone_generation)) {
-      throw new Error("Invalid reporting object-write fence");
-    }
-    await this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(frozen.account_id));
-      await advisoryLock(client, authLock(frozen.account_id, frozen.destination_ref));
-      const updated = await client.query(
-        `UPDATE adcp_reporting_object_writes object SET fenced_at=COALESCE(fenced_at,clock_timestamp()), tombstone_generation=$6
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 AND object_index=$5
-         AND (tombstone_generation IS NULL OR tombstone_generation=$6)
-         AND EXISTS (SELECT 1 FROM adcp_reporting_destination_authorizations authz
-           WHERE authz.account_id=object.account_id AND authz.destination_ref=object.destination_ref
-           AND authz.generation=object.generation AND authz.revoked_at IS NOT NULL)`,
-        [
-          frozen.account_id,
-          frozen.destination_ref,
-          frozen.generation,
-          frozen.plan_id,
-          frozen.object_index,
-          frozen.tombstone_generation
-        ]
-      );
-      if (updated.rowCount !== 1) throw new Error("Reporting object-write fence is not eligible");
-    }, context.signal);
-  }
-  async getObjectWriteBinding(input, context = {}) {
-    const scope = structuredClone(input);
-    assertReportingObjectWriteScope(scope);
-    return this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(scope.account_id));
-      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
-      const revoked = await client.query(
-        `SELECT 1 FROM adcp_reporting_destination_authorizations
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
-        [scope.account_id, scope.destination_ref, scope.generation]
-      );
-      if (!revoked.rowCount) throw new ReportingObjectWriteNotRevokedError();
-      const binding = await client.query(
-        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
-        [scope.account_id, scope.destination_ref, scope.generation]
-      );
-      return binding.rows[0] ?? null;
-    }, context.signal);
-  }
-  async probeObjectWriteAuthority(context = {}) {
-    await this.transaction(async (client) => {
-      await client.query(
-        `SELECT installation_id,schema_version FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
-      );
-      await client.query(
-        `SELECT account_id,destination_ref,generation,bucket,namespace_key FROM adcp_reporting_object_write_bindings LIMIT 0`
-      );
-      await client.query(
-        `SELECT account_id,destination_ref,generation,plan_id,fingerprint FROM adcp_reporting_object_write_plans LIMIT 0`
-      );
-      await client.query(
-        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes,fenced_at,tombstone_generation FROM adcp_reporting_object_writes LIMIT 0`
-      );
-    }, context.signal);
-    await this.getObjectWriteAuthorityId(context);
-    return true;
-  }
-  async getObjectWriteAuthorityId(context = {}) {
-    return this.transaction(async (client) => {
-      const result = await client.query(
-        `SELECT installation_id::text FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
-      );
-      const id = result.rows[0]?.installation_id;
-      if (result.rowCount !== 1 || !id || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(id))
-        throw new Error("Reporting object-write authority migration is unavailable");
-      return id;
-    }, context.signal);
-  }
-  async getAuthorizedObjectWriteBinding(input, context = {}) {
-    const scope = {
-      account_id: input.account_id,
-      destination_ref: input.destination_ref,
-      generation: input.generation
-    };
-    assertReportingObjectWriteScope(scope);
-    return this.transaction(async (client) => {
-      const result = await client.query(
-        `SELECT binding.bucket,binding.namespace_key FROM adcp_reporting_object_write_bindings binding
-         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
-         WHERE binding.account_id=$1 AND binding.destination_ref=$2 AND binding.generation=$3 AND authz.revoked_at IS NULL`,
-        [scope.account_id, scope.destination_ref, scope.generation]
-      );
-      return result.rows[0] ?? null;
-    }, context.signal);
-  }
-  async getObjectWritePlan(input, planId, context = {}) {
-    const scope = {
-      account_id: input.account_id,
-      destination_ref: input.destination_ref,
-      generation: input.generation
-    };
-    assertReportingObjectWriteScope(scope);
-    if (typeof planId !== "string" || !/^[a-f0-9]{64}$/.test(planId))
-      throw new Error("Invalid reporting object-write plan identity");
-    return this.transaction(async (client) => {
-      const selected = await client.query(
-        `SELECT binding.bucket,binding.namespace_key,plan.fingerprint FROM adcp_reporting_object_write_plans plan
-         JOIN adcp_reporting_object_write_bindings binding USING (account_id,destination_ref,generation)
-         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
-         WHERE plan.account_id=$1 AND plan.destination_ref=$2 AND plan.generation=$3 AND plan.plan_id=$4 AND authz.revoked_at IS NULL`,
-        [scope.account_id, scope.destination_ref, scope.generation, planId]
-      );
-      if (!selected.rows[0]) return null;
-      const selectedBinding = selected.rows[0];
-      const objects = await client.query(
-        `SELECT bucket,object_name,sha256,size_bytes::float8 AS size_bytes FROM adcp_reporting_object_writes
-         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 ORDER BY object_index`,
-        [scope.account_id, scope.destination_ref, scope.generation, planId]
-      );
-      const plan = {
-        ...scope,
-        plan_id: planId,
-        provider: { bucket: selectedBinding.bucket, namespace_key: selectedBinding.namespace_key },
-        objects: objects.rows
-      };
-      if (reportingObjectWritePlanFingerprint(plan) !== selectedBinding.fingerprint)
-        throw new ReportingObjectWriteConflictError();
-      return plan;
-    }, context.signal);
-  }
-  /**
-   * Generations that carry no recorded pattern/transport, with why the
-   * migration backfill could not infer them. These are routed to a router's
-   * `legacyDefault` (or fail revocation with a typed error) until the host
-   * supplies the contract. Read-only; it never edits a row.
-   *
-   * `no_binding`: nothing to infer from. `binding_without_transport`: at least
-   * one binding names no transport. `bindings_disagree`: the bindings name
-   * different methods or transports. `not_recorded`: the bindings agree, but
-   * the generation was created without a contract after the one-time backfill
-   * ran, so nothing records it.
-   */
-  async listDestinationAuthorizationsWithoutContract(input = {}) {
-    const limit = input.limit ?? 1e3;
-    positiveInteger(limit, "limit");
-    if (limit > MAX_PLAN) throw new RangeError(`limit must not exceed ${MAX_PLAN}`);
-    const result = await this.query(
-      `SELECT authz.account_id, authz.destination_ref, authz.generation::text AS generation,
-              COUNT(binding.configuration_id)::text AS bindings,
-              COUNT(DISTINCT binding.data->>'method')::text AS methods,
-              COUNT(DISTINCT binding.data->>'transport')::text AS transports,
-              COUNT(binding.data->>'transport')::text AS with_transport
-         FROM adcp_reporting_destination_authorizations authz
-         LEFT JOIN adcp_reporting_managed_bindings binding
-           ON binding.account_id = authz.account_id
-          AND binding.destination_ref = authz.destination_ref
-          AND binding.authorization_generation = authz.generation
-        WHERE (authz.pattern IS NULL OR authz.transport IS NULL)
-          AND ($1::text IS NULL OR authz.account_id = $1)
-        GROUP BY authz.account_id, authz.destination_ref, authz.generation
-        ORDER BY authz.account_id, authz.destination_ref, authz.generation
-        LIMIT $2`,
-      [input.account_id ?? null, limit]
-    );
-    return result.rows.map((row) => {
-      const bindings = Number(row.bindings);
-      const reason = bindings === 0 ? "no_binding" : Number(row.with_transport) < bindings ? "binding_without_transport" : Number(row.methods) > 1 || Number(row.transports) > 1 ? "bindings_disagree" : "not_recorded";
-      return {
-        account_id: row.account_id,
-        destination_ref: row.destination_ref,
-        generation: Number(row.generation),
-        reason
-      };
-    });
-  }
-  async isAuthorizationCurrent(input) {
-    const result = await this.query(
-      `SELECT 1 FROM adcp_reporting_destination_authorizations
-        WHERE account_id = $1 AND destination_ref = $2 AND generation = $3 AND revoked_at IS NULL`,
-      [input.account_id, input.destination_ref, input.generation]
-    );
-    return result.rowCount === 1;
-  }
-  async syncReceiptBatch(input) {
-    const revisionCount = input.entries.filter((entry) => entry.kind === "revision").length;
-    if (!/^[A-Za-z0-9_.:-]{16,255}$/.test(input.idempotency_key) || input.entries.length < 1 || input.entries.length > MAX_RECEIPT_RESULTS || revisionCount > MAX_RECEIPTS_PER_ARRAY || input.entries.length - revisionCount > MAX_RECEIPTS_PER_ARRAY || input.entries.some(
-      (entry) => (entry.kind === "revision" ? !isReportingReceiptEvidence(entry.receipt) : !isReportingAdjustmentReceiptEvidence(entry.receipt)) || Buffer.byteLength(JSON.stringify(entry.receipt), "utf8") > 64 * 1024
-    )) {
-      throw new Error("Reporting receipt transaction failed");
-    }
-    return this.transaction(async (client) => {
-      await advisoryLock(client, accountLock(input.account_id));
-      await advisoryLock(client, `adcp-reporting-receipts:${input.account_id}:${input.consumer_id}`);
-      const receivedAt = (await client.query(`SELECT ${rfc3339Micro("clock_timestamp()")} AS now`)).rows[0].now;
-      const prior = await client.query(
-        `SELECT request_fingerprint, results FROM adcp_reporting_receipt_batches
-          WHERE account_id = $1 AND consumer_id = $2 AND idempotency_key = $3`,
-        [input.account_id, input.consumer_id, input.idempotency_key]
-      );
-      if (prior.rows[0]) {
-        if (prior.rows[0].request_fingerprint !== input.request_fingerprint) {
-          return input.entries.map((entry) => idempotencyConflict(entry.receipt.reporting_receipt_id));
-        }
-        return this.replayReceiptBatch(client, input, prior.rows[0].results);
-      }
-      await client.query(
-        `DELETE FROM adcp_reporting_receipt_batches
-          WHERE account_id = $1 AND consumer_id = $2
-            AND recorded_at < clock_timestamp() - ($3::bigint * INTERVAL '1 millisecond')`,
-        [input.account_id, input.consumer_id, RECEIPT_BATCH_RETENTION_MS]
-      );
-      const capacity = await client.query(
-        `SELECT
-           (SELECT COUNT(*) FROM adcp_reporting_receipt_batches
-             WHERE account_id = $1 AND consumer_id = $2)::text AS batches,
-           (SELECT COUNT(*) FROM adcp_reporting_receipts
-             WHERE account_id = $1 AND consumer_id = $2${this.activeScope("recorded_at")})::text AS receipts`,
-        [input.account_id, input.consumer_id]
-      );
-      if (Number(capacity.rows[0]?.batches ?? 0) >= MAX_RECEIPT_BATCHES_PER_CONSUMER) {
-        return input.entries.map((entry) => failed(entry.receipt.reporting_receipt_id));
-      }
-      let remainingReceipts = MAX_RECEIPTS_PER_CONSUMER - Number(capacity.rows[0]?.receipts ?? 0);
-      const duplicateIds = duplicates(input.entries.map((entry) => entry.receipt.reporting_receipt_id));
-      const alreadyStored = await client.query(
-        `SELECT reporting_receipt_id, semantic_fingerprint FROM adcp_reporting_receipts
-          WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = ANY($3::text[])`,
-        [input.account_id, input.consumer_id, input.entries.map((entry) => entry.receipt.reporting_receipt_id)]
-      );
-      const storedFingerprints = new Map(
-        alreadyStored.rows.map((row) => [row.reporting_receipt_id, row.semantic_fingerprint])
-      );
-      const buried = await client.query(
-        `SELECT reporting_receipt_id, semantic_fingerprint FROM adcp_reporting_receipt_tombstones
-          WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = ANY($3::text[])`,
-        [input.account_id, input.consumer_id, input.entries.map((entry) => entry.receipt.reporting_receipt_id)]
-      );
-      for (const row of buried.rows) storedFingerprints.set(row.reporting_receipt_id, row.semantic_fingerprint);
-      const resolvesToStored = input.entries.map(
-        (entry) => storedFingerprints.get(entry.receipt.reporting_receipt_id) === digest(entry.receipt)
-      );
-      const duplicateSubjects = duplicates(
-        input.entries.filter((_entry, index) => !resolvesToStored[index]).map((entry) => subjectKey(entry))
-      );
-      const results = [];
-      for (const [index, entry] of input.entries.entries()) {
-        if (duplicateIds.has(entry.receipt.reporting_receipt_id) || !resolvesToStored[index] && duplicateSubjects.has(subjectKey(entry))) {
-          results.push(failed(entry.receipt.reporting_receipt_id));
-          continue;
-        }
-        const result = await this.recordReceipt(client, input, entry, receivedAt, remainingReceipts);
-        results.push(result);
-        if (result.result === "recorded") remainingReceipts -= 1;
-      }
-      const stored = results.map((result, index) => ({
-        kind: result.result,
-        id: receiptResultId(result, input.entries[index]),
-        entry: input.entries[index].kind,
-        ...result.result === "failed" ? { errorCode: "INVALID_REQUEST" } : {}
-      }));
-      const storedJson = JSON.stringify(stored);
-      if (Buffer.byteLength(storedJson, "utf8") > MAX_RECEIPT_BATCH_RESULT_BYTES) {
-        throw new Error("Reporting receipt batch replay record exceeds its byte budget");
-      }
-      await client.query(
-        `INSERT INTO adcp_reporting_receipt_batches
-          (account_id, consumer_id, idempotency_key, request_fingerprint, results)
-         VALUES ($1,$2,$3,$4,$5::jsonb)`,
-        [input.account_id, input.consumer_id, input.idempotency_key, input.request_fingerprint, storedJson]
-      );
-      return results;
-    });
-  }
-  /**
-   * Rebuilds a prior batch response from the compact replay record plus the
-   * append-only receipt rows, re-checking authorization exactly as the first
-   * call did so a revoked destination cannot be replayed back into disclosure.
-   */
-  /**
-   * Replays a prior batch response exactly.
-   *
-   * An exact same-key replay is side-effect free and returns the caller its own
-   * previously recorded verdict, so later revocation of the destination does
-   * not change it. Downgrading a replay to `failed` once authorization ended
-   * broke the protocol-wide rule that a replayed idempotency key returns the
-   * same response, and bought nothing: the body is the caller's own receipt
-   * echoed back with the verdict it already received, so a revoked caller
-   * learns nothing it did not already hold. Fail-closed still governs every
-   * path that *accepts* new evidence — `loadReceiptEvidence` joins
-   * `revoked_at IS NULL` — and nothing here reads another consumer's rows.
-   */
-  async replayReceiptBatch(client, input, stored) {
-    const replay = [];
-    for (const [index, entry] of input.entries.entries()) {
-      const result = stored[index];
-      const legacy = legacyReceiptBatchResult(result);
-      if (legacy) {
-        replay.push(structuredClone(legacy));
-        continue;
-      }
-      if (!result || result.kind === "failed") {
-        replay.push(failed(entry.receipt.reporting_receipt_id));
-        continue;
-      }
-      const row = await client.query(
-        `SELECT data FROM adcp_reporting_receipts
-          WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = $3`,
-        [input.account_id, input.consumer_id, result.id]
-      );
-      let data = row.rows[0]?.data;
-      if (!data) {
-        const tombstone = await client.query(
-          `SELECT ${rfc3339Micro("COALESCE(subject_recorded_at, pruned_at)")} AS recorded_at, semantic_fingerprint
-             FROM adcp_reporting_receipt_tombstones
-            WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = $3`,
-          [input.account_id, input.consumer_id, result.id]
-        );
-        const buried = tombstone.rows[0];
-        if (buried && result.id === entry.receipt.reporting_receipt_id && buried.semantic_fingerprint === digest(entry.receipt)) {
-          data = { ...entry.receipt, received_at: buried.recorded_at };
-        }
-      }
-      if (!data) {
-        replay.push(failed(entry.receipt.reporting_receipt_id));
-        continue;
-      }
-      replay.push(
-        result.kind === "recorded" ? recorded(result.entry, structuredClone(data)) : unchanged(result.entry, structuredClone(data))
-      );
-    }
-    return replay;
-  }
-  async recordReceipt(client, batch, entry, receivedAt, remainingReceipts) {
-    const fingerprint = digest(entry.receipt);
-    const existing = await client.query(
-      `SELECT semantic_fingerprint, data FROM adcp_reporting_receipts
-        WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = $3`,
-      [batch.account_id, batch.consumer_id, entry.receipt.reporting_receipt_id]
-    );
-    if (existing.rows[0]) {
-      if (existing.rows[0].semantic_fingerprint !== fingerprint) return failed(entry.receipt.reporting_receipt_id);
-      return unchanged(entry.kind, existing.rows[0].data);
-    }
-    const tombstones = await client.query(
-      `SELECT reporting_receipt_id, subject_id, status, was_current, semantic_fingerprint,
-              ${rfc3339Micro("COALESCE(subject_recorded_at, pruned_at)")} AS recorded_at
-         FROM adcp_reporting_receipt_tombstones
-        WHERE account_id = $1 AND consumer_id = $2
-          AND (reporting_receipt_id = $3 OR (receipt_kind = $4 AND subject_id = $5))
-        -- Newest leaf first. The demotion above keeps at most one current
-        -- tombstone per subject, but rows written before it existed, and any
-        -- future shape that tombstones two leaves at once, must still resolve
-        -- to one deterministic answer rather than to whatever the planner
-        -- emitted first.
-        ORDER BY was_current DESC, pruned_at DESC, reporting_receipt_id DESC`,
-      [batch.account_id, batch.consumer_id, entry.receipt.reporting_receipt_id, entry.kind, subjectIdFor(entry)]
-    );
-    const ownTombstone = tombstones.rows.find(
-      (tombstone) => tombstone.reporting_receipt_id === entry.receipt.reporting_receipt_id
-    );
-    if (ownTombstone) {
-      if (ownTombstone.semantic_fingerprint !== fingerprint) return failed(entry.receipt.reporting_receipt_id);
-      return unchanged(entry.kind, { ...entry.receipt, received_at: ownTombstone.recorded_at });
-    }
-    for (const tombstone of tombstones.rows) {
-      if (tombstone.status === "accepted" && tombstone.was_current) {
-        return failed(entry.receipt.reporting_receipt_id);
-      }
-    }
-    const tombstonedLeafId = tombstones.rows.find(
-      (tombstone) => tombstone.was_current && tombstone.subject_id === subjectIdFor(entry) && tombstone.reporting_receipt_id !== entry.receipt.reporting_receipt_id
-    )?.reporting_receipt_id;
-    const evidence = await this.loadReceiptEvidence(client, batch.account_id, entry);
-    if (!evidence) return failed(entry.receipt.reporting_receipt_id);
-    const matches = entry.kind === "revision" ? receiptEvidenceMatches(entry.receipt, evidence.materialization) : adjustmentReceiptEvidenceMatches(entry.receipt, evidence.adjustment);
-    const wellFormed = entry.receipt.status === "accepted" ? matches : Boolean(entry.receipt.rejection_codes?.length);
-    if (!wellFormed) {
-      return failed(entry.receipt.reporting_receipt_id);
-    }
-    const current = await client.query(
-      `SELECT reporting_receipt_id, data FROM adcp_reporting_receipts
-        WHERE account_id = $1 AND consumer_id = $2 AND receipt_kind = $3 AND subject_id = $4 AND is_current`,
-      [batch.account_id, batch.consumer_id, entry.kind, evidence.subjectId]
-    );
-    const leaf = current.rows[0];
-    const supersedes = entry.receipt.supersedes_reporting_receipt_id;
-    if (leaf && (leaf.data.status === "accepted" || supersedes !== leaf.reporting_receipt_id) || // The pruned leaf answers for the chain exactly as a live one would:
-    // only its own successor may extend the subject. Re-presenting the
-    // tombstoned leaf itself is not a succession and is handled above, so
-    // it never reaches here.
-    !leaf && tombstonedLeafId !== void 0 && supersedes !== tombstonedLeafId || !leaf && tombstonedLeafId === void 0 && supersedes !== void 0) {
-      return failed(entry.receipt.reporting_receipt_id);
-    }
-    if (remainingReceipts <= 0) return failed(entry.receipt.reporting_receipt_id);
-    if (leaf) {
-      await client.query(
-        `UPDATE adcp_reporting_receipts SET is_current = false
-          WHERE account_id = $1 AND consumer_id = $2 AND reporting_receipt_id = $3 AND is_current`,
-        [batch.account_id, batch.consumer_id, leaf.reporting_receipt_id]
-      );
-    }
-    const stored = { ...entry.receipt, received_at: receivedAt };
-    await client.query(
-      `INSERT INTO adcp_reporting_receipts
-        (account_id, consumer_id, reporting_receipt_id, receipt_kind, subject_id,
-         supersedes_receipt_id, is_current, semantic_fingerprint, data, received_at, recorded_at)
-       VALUES ($1,$2,$3,$4,$5,$6,true,$7,$8::jsonb,$9::timestamptz,$9::timestamptz)`,
-      [
-        batch.account_id,
-        batch.consumer_id,
-        entry.receipt.reporting_receipt_id,
-        entry.kind,
-        evidence.subjectId,
-        supersedes ?? null,
-        fingerprint,
-        JSON.stringify(stored),
-        receivedAt
-      ]
-    );
-    return recorded(entry.kind, stored);
-  }
-  async loadReceiptEvidence(client, accountId, entry) {
-    if (entry.kind === "revision") {
-      const receipt2 = entry.receipt;
-      const result2 = await client.query(
-        `SELECT materialization.data AS materialization
-           FROM adcp_reporting_materializations materialization
-           JOIN adcp_reporting_managed_bindings binding ON binding.configuration_id = materialization.configuration_id
-           JOIN adcp_reporting_destination_authorizations authz
-             ON authz.account_id = materialization.account_id
-            AND authz.destination_ref = materialization.destination_ref
-            AND authz.generation = materialization.authorization_generation
-            AND authz.revoked_at IS NULL
-           JOIN adcp_reporting_revisions revision ON revision.revision_id = materialization.revision_id
-           JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = materialization.obligation_id
-          WHERE materialization.account_id = $1 AND materialization.materialization_id = $2
-            AND materialization.revision_id = $3 AND materialization.obligation_id = $4
-            AND materialization.status IN ('available','delivered')
-            -- RC3 ties the receiptable revision to the obligation's own
-            -- required_finality, exactly as the read projection does when it
-            -- picks the required revision. Hard-coding 'official' made every
-            -- snapshot-finality consumer_receipt configuration unreconcilable:
-            -- the projection asked for a receipt the store always refused.
-            AND (obligation.data->>'requiredFinality' <> 'official' OR revision.finality = 'official')
-            AND binding.data->>'reconciliation_mode' = 'consumer_receipt'`,
-        [
-          accountId,
-          receipt2.reporting_materialization_id,
-          receipt2.reporting_revision_id,
-          receipt2.reporting_obligation_id
-        ]
-      );
-      return result2.rows[0] ? { subjectId: receipt2.reporting_revision_id, materialization: result2.rows[0].materialization } : null;
-    }
-    const receipt = entry.receipt;
-    const result = await client.query(
-      `SELECT adjustment.data AS adjustment
-         FROM adcp_reporting_adjustments adjustment
-         JOIN adcp_reporting_revisions revision ON revision.revision_id = adjustment.adjusts_revision_id
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = adjustment.obligation_id
-         JOIN adcp_reporting_managed_bindings binding ON binding.configuration_id = obligation.configuration_id
-         JOIN adcp_reporting_destination_authorizations authz
-           ON authz.account_id = binding.account_id AND authz.destination_ref = binding.destination_ref
-          AND authz.generation = binding.authorization_generation AND authz.revoked_at IS NULL
-        WHERE binding.account_id = $1 AND adjustment.adjustment_id = $2
-          AND adjustment.adjusts_revision_id = $3
-          -- Unlike a revision receipt this arm stays pinned to 'official': an
-          -- adjustment only ever corrects an already-official revision, which
-          -- commitAdjustment enforces at write time.
-          AND revision.finality = 'official'
-          AND binding.data->>'reconciliation_mode' = 'consumer_receipt'`,
-      [accountId, receipt.reporting_adjustment_id, receipt.adjusts_reporting_revision_id]
-    );
-    return result.rows[0] ? { subjectId: receipt.reporting_adjustment_id, adjustment: result.rows[0].adjustment } : null;
-  }
-  async transaction(body, signal) {
-    signal?.throwIfAborted();
-    let client;
-    try {
-      client = await this.pool.connect();
-    } catch (cause) {
-      throw new Error("PostgresReportingManagedDeliveryStore database connection failed", { cause });
-    }
-    let releaseError;
-    let transactionStarted = false;
-    try {
-      signal?.throwIfAborted();
-      await client.query("BEGIN");
-      transactionStarted = true;
-      if (signal) await client.query("SET LOCAL lock_timeout = '5s'; SET LOCAL statement_timeout = '10s'");
-      const guarded = signal ? {
-        query: async (sql, values) => {
-          signal.throwIfAborted();
-          const result = await client.query(sql, values);
-          signal.throwIfAborted();
-          return result;
-        },
-        release: () => {
-          throw new Error("Transaction body cannot release connection");
-        }
-      } : client;
-      const value = await body(guarded);
-      signal?.throwIfAborted();
-      await client.query("COMMIT");
-      return value;
-    } catch (cause) {
-      if (transactionStarted) {
-        try {
-          await client.query("ROLLBACK");
-        } catch (rollbackCause) {
-          releaseError = rollbackCause instanceof Error ? rollbackCause : new Error("Managed reporting rollback failed");
-        }
-      }
-      throw new Error("PostgresReportingManagedDeliveryStore transaction failed", { cause });
-    } finally {
-      client.release(releaseError);
-    }
-  }
-  async query(sql, values) {
-    try {
-      return await this.pool.query(sql, values);
-    } catch (cause) {
-      throw new Error("PostgresReportingManagedDeliveryStore database operation failed", { cause });
-    }
-  }
-}
-function recorded(kind, data) {
-  return kind === "revision" ? { result: "recorded", receipt: data } : { result: "recorded", adjustment_receipt: data };
-}
-function unchanged(kind, data) {
-  return kind === "revision" ? { result: "unchanged", receipt: data } : { result: "unchanged", adjustment_receipt: data };
-}
-function failed(reporting_receipt_id) {
-  return {
-    result: "failed",
-    reporting_receipt_id,
-    errors: [{ code: "INVALID_REQUEST", message: GENERIC_RECEIPT_MESSAGE, recovery: "correctable" }]
-  };
-}
-function idempotencyConflict(reporting_receipt_id) {
-  return {
-    result: "failed",
-    reporting_receipt_id,
-    errors: [
-      {
-        code: "IDEMPOTENCY_CONFLICT",
-        message: "Idempotency key was reused with different receipt content",
-        recovery: "correctable"
-      }
-    ]
-  };
-}
-function receiptResultId(result, entry) {
-  if (result.result === "failed") return result.reporting_receipt_id;
-  const body = "receipt" in result ? result.receipt : result.adjustment_receipt;
-  return body?.reporting_receipt_id ?? entry.receipt.reporting_receipt_id;
-}
-function legacyReceiptBatchResult(value) {
-  if (!value || typeof value !== "object" || !("result" in value)) return void 0;
-  return value;
-}
-function subjectIdFor(entry) {
-  return entry.kind === "revision" ? entry.receipt.reporting_revision_id : entry.receipt.reporting_adjustment_id;
-}
-function subjectKey(entry) {
-  return entry.kind === "revision" ? `revision:${entry.receipt.reporting_revision_id}` : `adjustment:${entry.receipt.reporting_adjustment_id}`;
-}
-function duplicates(values) {
-  const seen = /* @__PURE__ */ new Set();
-  const duplicate = /* @__PURE__ */ new Set();
-  for (const value of values) (seen.has(value) ? duplicate : seen).add(value);
-  return duplicate;
-}
-function digest(value) {
-  return createHash("sha256").update(canonicalize(value)).digest("hex");
-}
-function managedBindingFingerprint(binding) {
-  const { created_at: _createdAt, semantic_fingerprint: _fingerprint, ...semantic } = binding;
-  return digest(semantic);
-}
-function nonnegativeSafeInteger(value, name) {
-  if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer`);
-}
-function positiveInteger(value, name) {
-  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be a positive safe integer`);
-}
-function policyNumber(value) {
-  return value === null || value === void 0 ? null : Number(value);
-}
-async function advisoryLock(client, key) {
-  await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key]);
-}
-function authLock(accountId, destinationRef) {
-  return `adcp-reporting-auth:${accountId}:${destinationRef}`;
-}
-function rfc3339Micro(expression) {
-  return `to_char(${expression} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')`;
-}
-function accountLock(accountId) {
-  return `adcp-reporting-account:${accountId}`;
-}
-export {
-  PostgresReportingManagedDeliveryStore,
-  REPORTING_MANAGED_DELIVERY_MIGRATION
-};