@adcp/sdk 16.0.0-beta.3 → 16.0.0-beta.5

package/dist/lib/reporting/ledger/postgres.mjs

@@ -1,4462 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { canonicalize } from "../../utils/jcs.mjs";
-import { DEFAULT_UNKNOWN_ERROR_RECOVERY, getErrorRecovery } from "../../types/error-codes.mjs";
-import { canonicalJsonV1 } from "../source/index.mjs";
-import { isWellFormedUnicodeString } from "../../utils/well-formed-unicode.mjs";
-import {
-  evaluateReportingLedgerCoverageV1,
-  reportingLedgerEffectivePeriod,
-  reportingLedgerScopeClosed
-} from "./coverage.mjs";
-import {
-  assertReportingConsumerMismatchEscalation,
-  projectReportingConsumerStatusMismatchV1,
-  projectReportingObligationHealthV1,
-  projectReportingUnreadableRevisionHealthV1,
-  ReportingLedgerIssueIntegrityError
-} from "./health.mjs";
-import { compareReportingInstants } from "./instant.mjs";
-import {
-  REPORTING_CONSUMER_STATUS_BATCH_RESULT_MAX_BYTES,
-  REPORTING_CONSUMER_STATUS_ERROR_FIELD_MAX_BYTES,
-  REPORTING_CONSUMER_STATUS_ERROR_MESSAGE_MAX_BYTES,
-  REPORTING_CONSUMER_STATUS_MAX_BYTES,
-  REPORTING_LEDGER_AUTHORITY,
-  ReportingLedgerSnapshotUnavailableError
-} from "./types.mjs";
-import { ReportingConsumerStatusConflictError } from "./types.mjs";
-import { moreSevereReportingHealthV1, projectManagedDelivery } from "./handler.mjs";
-import { reportingCanonicalAdjustmentSha256V1 } from "./producer.mjs";
-import {
-  ReportingChangeCursorExpiredError,
-  decodeReportingChangeCursorV1,
-  encodeReportingChangeCursorV1
-} from "./change-feed.mjs";
-import {
-  ReportingRowStorageV1,
-  ReportingRowStoreError,
-  isReportingRowStoreError,
-  reportingRowWriteIntentIdV1
-} from "./row-storage.mjs";
-import { isFrozenCalendarRulesMismatch, reportingPeriodSchedule } from "./schedule.mjs";
-import {
-  normalizeReportingConsumerStatusIdsV1,
-  reportingConsumerStatusChainKeyFromIdentityV1,
-  reportingConsumerStatusChainKeyV1,
-  reportingConsumerStatusFingerprintV1
-} from "./consumer-status-identity.mjs";
-const REPORTING_LEDGER_MIGRATION = `
-CREATE TABLE IF NOT EXISTS adcp_reporting_configurations (
-  configuration_id TEXT PRIMARY KEY,
-  account_id TEXT NOT NULL,
-  delivery_config_id TEXT NOT NULL,
-  delivery_config_version INTEGER NOT NULL,
-  semantic_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  UNIQUE (account_id, delivery_config_id, delivery_config_version)
-);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_obligations (
-  obligation_id TEXT PRIMARY KEY,
-  configuration_id TEXT NOT NULL REFERENCES adcp_reporting_configurations(configuration_id),
-  account_id TEXT NOT NULL,
-  period_ordinal BIGINT NOT NULL,
-  period_start TIMESTAMPTZ NOT NULL,
-  period_end TIMESTAMPTZ NOT NULL,
-  next_attempt_at TIMESTAMPTZ NOT NULL,
-  state TEXT NOT NULL,
-  semantic_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  lease_owner TEXT,
-  lease_generation BIGINT NOT NULL DEFAULT 0,
-  lease_expires_at TIMESTAMPTZ,
-  UNIQUE (configuration_id, period_ordinal),
-  CHECK (period_start < period_end),
-  CHECK (state IN ('pending', 'terminal'))
-);
-
-ALTER TABLE adcp_reporting_obligations ADD COLUMN IF NOT EXISTS period_ordinal BIGINT;
-UPDATE adcp_reporting_obligations
-  SET period_ordinal = (data->>'periodOrdinal')::bigint
-  WHERE period_ordinal IS NULL AND data->>'periodOrdinal' ~ '^-?[0-9]+$';
-ALTER TABLE adcp_reporting_obligations ALTER COLUMN period_ordinal SET NOT NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_obligations_configuration_ordinal
-  ON adcp_reporting_obligations (configuration_id, period_ordinal);
-
-CREATE INDEX IF NOT EXISTS adcp_reporting_obligations_due
-  ON adcp_reporting_obligations (next_attempt_at, obligation_id)
-  WHERE state = 'pending';
-CREATE INDEX IF NOT EXISTS adcp_reporting_obligations_account_due
-  ON adcp_reporting_obligations (account_id, next_attempt_at, obligation_id)
-  WHERE state = 'pending';
-CREATE INDEX IF NOT EXISTS adcp_reporting_obligations_account_period
-  ON adcp_reporting_obligations (account_id, period_start, obligation_id);
-CREATE INDEX IF NOT EXISTS adcp_reporting_obligations_changed
-  ON adcp_reporting_obligations (account_id, changed_at);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_revisions (
-  revision_id TEXT PRIMARY KEY,
-  obligation_id TEXT NOT NULL REFERENCES adcp_reporting_obligations(obligation_id),
-  revision_number INTEGER NOT NULL,
-  finality TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  supersedes_revision_id TEXT REFERENCES adcp_reporting_revisions(revision_id),
-  content_sha256 TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  UNIQUE (obligation_id, revision_number),
-  CHECK (finality IN ('snapshot', 'official')),
-  CHECK (kind IN ('snapshot', 'official'))
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_revisions_obligation
-  ON adcp_reporting_revisions (obligation_id, revision_number);
-CREATE INDEX IF NOT EXISTS adcp_reporting_revisions_created
-  ON adcp_reporting_revisions (obligation_id, recorded_at);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_adjustments (
-  adjustment_id TEXT PRIMARY KEY,
-  obligation_id TEXT NOT NULL REFERENCES adcp_reporting_obligations(obligation_id),
-  adjusts_revision_id TEXT NOT NULL REFERENCES adcp_reporting_revisions(revision_id),
-  adjustment_number INTEGER NOT NULL,
-  content_sha256 TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  UNIQUE (obligation_id, adjustment_number)
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_adjustments_obligation
-  ON adcp_reporting_adjustments (obligation_id, adjustment_number);
-CREATE INDEX IF NOT EXISTS adcp_reporting_adjustments_created
-  ON adcp_reporting_adjustments (obligation_id, recorded_at);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_consumer_statuses (
-  account_id TEXT NOT NULL,
-  consumer_id TEXT NOT NULL,
-  consumer_status_id TEXT NOT NULL,
-  chain_key TEXT NOT NULL,
-  revision_id TEXT REFERENCES adcp_reporting_revisions(revision_id),
-  obligation_id TEXT REFERENCES adcp_reporting_obligations(obligation_id),
-  supersedes_consumer_status_id TEXT,
-  is_current BOOLEAN NOT NULL DEFAULT true,
-  semantic_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  PRIMARY KEY (account_id, consumer_id, consumer_status_id)
-);
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN revision_id DROP NOT NULL;
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN obligation_id DROP NOT NULL;
-ALTER TABLE adcp_reporting_consumer_statuses ADD COLUMN IF NOT EXISTS account_id TEXT;
-ALTER TABLE adcp_reporting_consumer_statuses ADD COLUMN IF NOT EXISTS consumer_id TEXT;
-ALTER TABLE adcp_reporting_consumer_statuses ADD COLUMN IF NOT EXISTS chain_key TEXT;
-ALTER TABLE adcp_reporting_consumer_statuses ADD COLUMN IF NOT EXISTS is_current BOOLEAN NOT NULL DEFAULT true;
-ALTER TABLE adcp_reporting_consumer_statuses ADD COLUMN IF NOT EXISTS semantic_fingerprint TEXT;
--- Preserve predecessor API rows under a reserved compatibility principal;
--- putConsumerStatus/listConsumerStatuses continue to serve this namespace.
-UPDATE adcp_reporting_consumer_statuses AS status
-SET account_id = COALESCE(
-      status.account_id,
-      obligation.data->'account'->>'account_id',
-      '__legacy_unscoped_account__'
-    ),
-    consumer_id = COALESCE(status.consumer_id, '__legacy_unscoped_consumer__'),
-    chain_key = COALESCE(status.chain_key, 'legacy:' || status.consumer_status_id),
-    semantic_fingerprint = COALESCE(status.semantic_fingerprint, 'legacy:' || status.consumer_status_id)
-FROM adcp_reporting_obligations AS obligation
-WHERE status.obligation_id = obligation.obligation_id
-  AND (status.account_id IS NULL OR status.consumer_id IS NULL OR status.chain_key IS NULL
-       OR status.semantic_fingerprint IS NULL);
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN account_id SET NOT NULL;
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN consumer_id SET NOT NULL;
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN chain_key SET NOT NULL;
-ALTER TABLE adcp_reporting_consumer_statuses ALTER COLUMN semantic_fingerprint SET NOT NULL;
-DO $migration$
-DECLARE self_fk RECORD;
-BEGIN
-  FOR self_fk IN
-    SELECT conname
-    FROM pg_constraint
-    WHERE conrelid = 'adcp_reporting_consumer_statuses'::regclass
-      AND confrelid = 'adcp_reporting_consumer_statuses'::regclass
-      AND contype = 'f'
-  LOOP
-    EXECUTE format(
-      'ALTER TABLE adcp_reporting_consumer_statuses DROP CONSTRAINT %I',
-      self_fk.conname
-    );
-  END LOOP;
-END
-$migration$;
-ALTER TABLE adcp_reporting_consumer_statuses DROP CONSTRAINT IF EXISTS adcp_reporting_consumer_statuses_pkey;
-ALTER TABLE adcp_reporting_consumer_statuses
-  ADD CONSTRAINT adcp_reporting_consumer_statuses_pkey PRIMARY KEY (account_id, consumer_id, consumer_status_id);
-CREATE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_revision
-  ON adcp_reporting_consumer_statuses (revision_id, created_at, consumer_status_id);
-CREATE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_scope
-  ON adcp_reporting_consumer_statuses (account_id, consumer_id, created_at, consumer_status_id);
-CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_current
-  ON adcp_reporting_consumer_statuses (account_id, consumer_id, chain_key) WHERE is_current;
--- The managed state digest is read inside the apply transaction, under the
--- account lock. Filtering this table by obligation alone matched no index, so
--- every apply scanned every consumer status in the deployment while holding
--- that lock and pushed concurrent Core writes past their lock timeout.
-CREATE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_obligation
-  ON adcp_reporting_consumer_statuses (obligation_id, created_at, consumer_status_id);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_consumer_status_batches (
-  account_id TEXT NOT NULL,
-  consumer_id TEXT NOT NULL,
-  idempotency_key TEXT NOT NULL,
-  request_fingerprint TEXT NOT NULL,
-  status_ids JSONB NOT NULL,
-  results JSONB NOT NULL DEFAULT '[]'::jsonb,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  PRIMARY KEY (account_id, consumer_id, idempotency_key)
-);
-ALTER TABLE adcp_reporting_consumer_status_batches ADD COLUMN IF NOT EXISTS results JSONB NOT NULL DEFAULT '[]'::jsonb;
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_issues (
-  issue_id TEXT PRIMARY KEY,
-  obligation_id TEXT NOT NULL REFERENCES adcp_reporting_obligations(obligation_id),
-  data JSONB NOT NULL,
-  observed_at TIMESTAMPTZ NOT NULL,
-  resolved_at TIMESTAMPTZ,
-  changed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_issues_obligation
-  ON adcp_reporting_issues (obligation_id, observed_at, issue_id);
-
--- Per-obligation reconciliation watermark. A reconcile that changes nothing
--- still has to record that it looked, or a change with no health effect stays
--- a candidate forever and starves newer work behind it. Core, not managed:
--- the lifecycle sweep is a Core concern and must not depend on the add-on.
-CREATE TABLE IF NOT EXISTS adcp_reporting_lifecycle_state (
-  obligation_id TEXT PRIMARY KEY REFERENCES adcp_reporting_obligations(obligation_id),
-  processed_state_version TEXT,
-  processed_roster_version TEXT,
-  processed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_lifecycle_state_processed
-  ON adcp_reporting_lifecycle_state (processed_at, obligation_id);
-ALTER TABLE adcp_reporting_lifecycle_state
-  ADD COLUMN IF NOT EXISTS current_roster_version TEXT;
-ALTER TABLE adcp_reporting_lifecycle_state
-  ADD COLUMN IF NOT EXISTS failure_count INTEGER NOT NULL DEFAULT 0;
-ALTER TABLE adcp_reporting_lifecycle_state
-  ADD COLUMN IF NOT EXISTS next_attempt_at TIMESTAMPTZ;
-ALTER TABLE adcp_reporting_lifecycle_state
-  ADD COLUMN IF NOT EXISTS roster_refreshed_at TIMESTAMPTZ;
-CREATE INDEX IF NOT EXISTS adcp_reporting_lifecycle_state_roster_refreshed
-  ON adcp_reporting_lifecycle_state (roster_refreshed_at, obligation_id);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_transitions (
-  transition_id TEXT PRIMARY KEY,
-  transition_sequence BIGSERIAL NOT NULL UNIQUE,
-  obligation_id TEXT NOT NULL REFERENCES adcp_reporting_obligations(obligation_id),
-  data JSONB NOT NULL,
-  occurred_at TIMESTAMPTZ NOT NULL,
-  recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_transitions_obligation
-  ON adcp_reporting_transitions (obligation_id, occurred_at, transition_id);
-CREATE INDEX IF NOT EXISTS adcp_reporting_transitions_pending
-  ON adcp_reporting_transitions (recorded_at, transition_id)
-  WHERE NOT (data ? 'notifiedAt');
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_snapshots (
-  snapshot_id UUID PRIMARY KEY,
-  account_id TEXT NOT NULL,
-  query_fingerprint TEXT NOT NULL,
-  data JSONB NOT NULL,
-  byte_count BIGINT NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  expires_at TIMESTAMPTZ NOT NULL
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_snapshots_created
-  ON adcp_reporting_snapshots (created_at);
-CREATE INDEX IF NOT EXISTS adcp_reporting_snapshots_expiry
-  ON adcp_reporting_snapshots (expires_at);
-
-CREATE TABLE IF NOT EXISTS adcp_reporting_checkpoints (
-  checkpoint_id UUID PRIMARY KEY,
-  account_id TEXT NOT NULL,
-  scope_fingerprint TEXT NOT NULL,
-  ledger_as_of TIMESTAMPTZ NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  expires_at TIMESTAMPTZ NOT NULL
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_checkpoints_expiry
-  ON adcp_reporting_checkpoints (expires_at);
-
--- A retired period keeps one compact record: it refuses replays that would
--- resurrect the period and preserves the audit conclusion after the period's
--- ledger records are deleted.
-CREATE TABLE IF NOT EXISTS adcp_reporting_obligation_tombstones (
-  obligation_id TEXT PRIMARY KEY,
-  account_id TEXT NOT NULL,
-  configuration_id TEXT NOT NULL,
-  period_ordinal BIGINT NOT NULL,
-  period_start TIMESTAMPTZ NOT NULL,
-  period_end TIMESTAMPTZ NOT NULL,
-  state TEXT NOT NULL CHECK (state IN ('retiring', 'retired')),
-  final_revision_id TEXT,
-  final_content_sha256 TEXT,
-  revision_count INTEGER NOT NULL CHECK (revision_count >= 0),
-  adjustment_count INTEGER NOT NULL CHECK (adjustment_count >= 0),
-  retiring_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
-  retired_at TIMESTAMPTZ,
-  UNIQUE (configuration_id, period_ordinal),
-  CHECK ((state = 'retired') = (retired_at IS NOT NULL))
-);
-CREATE INDEX IF NOT EXISTS adcp_reporting_obligation_tombstones_account
-  ON adcp_reporting_obligation_tombstones (account_id, configuration_id, period_ordinal);
--- Retirement retry state. A period whose external deletes fail on every pass
--- backs off instead of holding a slot at the head of every pass. Guarded on the
--- catalog because ADD COLUMN IF NOT EXISTS takes ACCESS EXCLUSIVE even when the
--- column exists, which would block a rerun behind ordinary traffic.
-DO $tombstone_retry$
-DECLARE
-  tombstones regclass := to_regclass('adcp_reporting_obligation_tombstones');
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_attribute WHERE attrelid = tombstones AND attname = 'attempts' AND NOT attisdropped) THEN
-    ALTER TABLE adcp_reporting_obligation_tombstones ADD COLUMN attempts INTEGER NOT NULL DEFAULT 0;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_attribute WHERE attrelid = tombstones AND attname = 'next_attempt_at' AND NOT attisdropped) THEN
-    ALTER TABLE adcp_reporting_obligation_tombstones ADD COLUMN next_attempt_at TIMESTAMPTZ;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_attribute WHERE attrelid = tombstones AND attname = 'last_failure' AND NOT attisdropped) THEN
-    ALTER TABLE adcp_reporting_obligation_tombstones ADD COLUMN last_failure TEXT;
-  END IF;
-END
-$tombstone_retry$;
-`.trim();
-const REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT = "adcp_reporting_transitions_finality_recorded";
-const REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION = `
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint
-     WHERE conrelid = 'adcp_reporting_transitions'::regclass
-       AND conname = '${REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT}'
-  ) THEN
-    ALTER TABLE adcp_reporting_transitions
-      ADD CONSTRAINT ${REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT}
-      CHECK (data ? 'finality') NOT VALID;
-  END IF;
-END $$;
-`.trim();
-const MAX_SNAPSHOT_ITEMS = 1e4;
-const MAX_LIFECYCLE_RECEIPT_LEAVES = 1e5;
-const MAX_SNAPSHOT_BYTES = 8 * 1024 * 1024;
-const MAX_ACTIVE_SNAPSHOTS_PER_ACCOUNT = 32;
-const MAX_ACTIVE_SNAPSHOT_BYTES_PER_ACCOUNT = 128 * 1024 * 1024;
-const MAX_CONSUMER_STATUS_BATCHES = 1e4;
-const MAX_CONSUMER_STATUS_STATEMENTS = 1e5;
-const SNAPSHOT_RETENTION_MS = 15 * 60 * 1e3;
-const CHECKPOINT_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-class ReportingLedgerLeaseLostError extends Error {
-  constructor(message = "Reporting ledger lease was lost before commit") {
-    super(message);
-    this.name = "ReportingLedgerLeaseLostError";
-  }
-}
-class ReportingLedgerPeriodRetiredError extends Error {
-  constructor(message = "Reporting obligation period was retired by retention") {
-    super(message);
-    this.name = "ReportingLedgerPeriodRetiredError";
-  }
-}
-class ReportingLedgerContinuityError extends Error {
-  constructor(message = "Reporting ledger revision continuity invariant failed") {
-    super(message);
-    this.name = "ReportingLedgerContinuityError";
-  }
-}
-const REPORTING_PERSISTENT_FAILURE_ATTEMPTS = 5;
-function backoffIntervalSql(attemptsExpr) {
-  return `(LEAST(21600, 60 * power(2, LEAST(${attemptsExpr} - 1, 12))) * INTERVAL '1 second')`;
-}
-async function sweepExpiredReportingLedgerState(pool, limit = 1e3) {
-  positiveInteger(limit, "limit");
-  if (limit > 1e4) throw new RangeError("limit must not exceed 10000");
-  try {
-    const snapshots = await pool.query(
-      `WITH expired AS (
-         SELECT snapshot_id FROM adcp_reporting_snapshots
-          WHERE expires_at <= clock_timestamp()
-          ORDER BY expires_at, snapshot_id
-          FOR UPDATE SKIP LOCKED LIMIT $1
-       )
-       DELETE FROM adcp_reporting_snapshots target
-        USING expired WHERE target.snapshot_id = expired.snapshot_id`,
-      [limit]
-    );
-    const checkpoints = await pool.query(
-      `WITH expired AS (
-         SELECT checkpoint_id FROM adcp_reporting_checkpoints
-          WHERE expires_at <= clock_timestamp()
-          ORDER BY expires_at, checkpoint_id
-          FOR UPDATE SKIP LOCKED LIMIT $1
-       )
-       DELETE FROM adcp_reporting_checkpoints target
-        USING expired WHERE target.checkpoint_id = expired.checkpoint_id`,
-      [limit]
-    );
-    return { snapshotsDeleted: snapshots.rowCount ?? 0, checkpointsDeleted: checkpoints.rowCount ?? 0 };
-  } catch (cause) {
-    throw new Error("Reporting ledger expiry cleanup failed", { cause });
-  }
-}
-class PostgresReportingLedgerStore {
-  constructor(pool, options = {}) {
-    this.pool = pool;
-    this.managedDelivery = options.managedDelivery === true;
-    this.obligatedConsumers = options.obligatedConsumers;
-    this[REPORTING_LEDGER_AUTHORITY] = { substrate: pool, managedDelivery: this.managedDelivery };
-    const development = process.env.NODE_ENV === "test" || process.env.NODE_ENV === "development";
-    if (!development && !options.acknowledgeIsolatedDatabase) {
-      throw new Error(
-        "PostgresReportingLedgerStore requires an isolated database/schema or acknowledgeIsolatedDatabase: true"
-      );
-    }
-    this.consumerMismatchEscalation = assertReportingConsumerMismatchEscalation(options.consumerMismatchEscalation);
-    this.notificationActivityPort = options.notificationActivityPort;
-    this.transactionalNotificationActivity = options.notificationActivityPort !== void 0;
-    this.rowStorage = new ReportingRowStorageV1(pool, typeof options.rowStorage === "object" ? options.rowStorage : {});
-    this.rowStorageWrites = options.rowStorage !== void 0 && options.rowStorage !== false;
-    this.changeFeed = options.changeFeed === true;
-  }
-  pool;
-  /**
-   * Exposed so `createReportingStatusHandler` can inherit it and refuse a
-   * disagreement. The store applies `health` while building the snapshot and
-   * the handler projects severity afterwards, so two independently configured
-   * copies of the escalation window would let a filtered periods read
-   * contradict the summary.
-   */
-  consumerMismatchEscalation;
-  [REPORTING_LEDGER_AUTHORITY];
-  managedDelivery;
-  obligatedConsumers;
-  transactionalNotificationActivity;
-  notificationActivityPort;
-  rowStorage;
-  rowStorageWrites;
-  changeFeed;
-  /** Whether this store writes the host change feed (`changeFeed: true`). */
-  get changeFeedEnabled() {
-    return this.changeFeed;
-  }
-  /**
-   * Delete expired cursor snapshots and changes checkpoints, a bounded batch
-   * at a time. The store-bound form of `sweepExpiredReportingLedgerState`, for
-   * hosts that hold the store but not the pool.
-   */
-  async sweepExpiredState(limit = 1e3) {
-    return sweepExpiredReportingLedgerState(this.pool, limit);
-  }
-  /** Append one host change-feed row inside the caller's account-locked transaction. */
-  async appendChange(client, kind, accountId, recordId, obligationId) {
-    if (!this.changeFeed) return;
-    await client.query(
-      `INSERT INTO adcp_reporting_changes (account_id, record_kind, record_id, obligation_id) VALUES ($1, $2, $3, $4)`,
-      [accountId, kind, recordId, obligationId]
-    );
-  }
-  /**
-   * Defense in depth for snapshot compaction (see `compactSupersededSnapshots`): throws `INVALID_INPUT`
-   * if a writable object row binding's key template omits `{revision_key}`. Every such binding is
-   * already refused when the store is configured, so this only guards a configuration changed after
-   * construction; `readOnly` bindings are skipped. Called by `compactSupersededSnapshots` and by
-   * service construction when compaction is enabled.
-   */
-  assertCompactionSafeRowBindings() {
-    this.rowStorage.assertCompactionSafeKeyTemplates();
-  }
-  /** Probe and register row storage when enabled. Safe to call repeatedly. */
-  async readyRowStorage() {
-    if (this.rowStorageWrites) await this.rowStorage.ready();
-  }
-  /**
-   * Move legacy inline revision and adjustment rows into row storage, a
-   * bounded batch at a time. Each row set is re-encoded, proven to reproduce
-   * its committed binding, written, and only then removed from the ledger
-   * document, in one transaction under the account lock. A document whose
-   * rows do not reproduce its binding is never rewritten: it is reported in
-   * `quarantined` and left inline. Pass the returned `cursor` back to resume
-   * after the last examined document; it is absent once every candidate has
-   * been examined. Reclaiming the freed space needs `VACUUM FULL` or an online
-   * repack.
-   */
-  async migrateInlineRows(input = {}) {
-    if (!this.rowStorageWrites) throw new Error("migrateInlineRows requires rowStorage");
-    const limit = input.limit ?? 100;
-    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e4) {
-      throw new RangeError("migrateInlineRows limit must be between 1 and 10000");
-    }
-    let after;
-    if (input.cursor !== void 0) {
-      try {
-        const parsed = JSON.parse(Buffer.from(input.cursor, "base64url").toString("utf8"));
-        if (typeof parsed.at !== "string" || typeof parsed.id !== "string") throw new Error("invalid");
-        after = { at: parsed.at, id: parsed.id };
-      } catch {
-        throw new RangeError("migrateInlineRows cursor is invalid");
-      }
-    }
-    await this.rowStorage.ready();
-    const candidates = await this.query(
-      `SELECT kind, id, account_id, to_char(recorded_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS at
-         FROM (
-           SELECT 'revision' AS kind, revision.revision_id AS id, obligation.account_id, revision.recorded_at
-             FROM adcp_reporting_revisions revision
-             JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-            WHERE revision.data ? 'rows' AND ($2::text IS NULL OR obligation.account_id = $2)
-           UNION ALL
-           SELECT 'adjustment', adjustment.adjustment_id, obligation.account_id, adjustment.recorded_at
-             FROM adcp_reporting_adjustments adjustment
-             JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = adjustment.obligation_id
-            WHERE adjustment.data ? 'rows' AND ($2::text IS NULL OR obligation.account_id = $2)
-         ) inline_rows
-        WHERE $3::timestamptz IS NULL OR (recorded_at, id) > ($3::timestamptz, $4::text)
-        ORDER BY recorded_at, id
-        LIMIT $1`,
-      [limit + 1, input.account_id ?? null, after?.at ?? null, after?.id ?? null]
-    );
-    let migrated = 0;
-    const quarantined = [];
-    for (const candidate of candidates.rows.slice(0, limit)) {
-      input.signal?.throwIfAborted();
-      const table = candidate.kind === "revision" ? "adcp_reporting_revisions" : "adcp_reporting_adjustments";
-      const idColumn = candidate.kind === "revision" ? "revision_id" : "adjustment_id";
-      const outcome = await this.transaction(
-        async (client) => {
-          const locked = await client.query(
-            `SELECT data FROM ${table} WHERE ${idColumn} = $1 AND data ? 'rows' FOR UPDATE`,
-            [candidate.id]
-          );
-          const document = locked.rows[0]?.data;
-          if (!document) return "skipped";
-          let prepared;
-          try {
-            prepared = await this.rowStorage.prepare({
-              rowSetId: candidate.id,
-              rowSetKind: candidate.kind,
-              accountId: candidate.account_id,
-              obligationId: document.reporting_obligation_id,
-              rows: document.rows,
-              ...candidate.kind === "revision" ? { finality: document.finality, controlTotals: document.wireRevision.control_totals } : {},
-              binding: document.binding,
-              ...input.bindingId ? { bindingId: input.bindingId } : {}
-            });
-          } catch (error) {
-            if (isReportingRowStoreError(error) && error.code === "INVALID_INPUT") return "quarantined";
-            throw error;
-          }
-          if (prepared.binding.kind !== "postgres") {
-            throw new ReportingRowStoreError(
-              "INVALID_INPUT",
-              "migrateInlineRows writes PostgreSQL-kind row sets; select a postgres binding for migrated rows"
-            );
-          }
-          await this.rowStorage.writeInTransaction(client, prepared);
-          await client.query(`UPDATE ${table} SET data = data - 'rows' WHERE ${idColumn} = $1`, [candidate.id]);
-          return "migrated";
-        },
-        { preBeginAdvisoryLock: accountLock(candidate.account_id) }
-      );
-      if (outcome === "migrated") migrated += 1;
-      if (outcome === "quarantined") quarantined.push(candidate.id);
-    }
-    const last = candidates.rows.length > limit ? candidates.rows[limit - 1] : void 0;
-    return {
-      migrated,
-      quarantined,
-      ...last ? { cursor: Buffer.from(JSON.stringify({ at: last.at, id: last.id }), "utf8").toString("base64url") } : {}
-    };
-  }
-  async putConfiguration(configuration) {
-    return this.transaction(
-      async (client) => {
-        await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
-          `adcp-reporting-config:${configuration.account.account_id}:${configuration.delivery_config_id}`
-        ]);
-        const newer = await client.query(
-          `SELECT MAX(delivery_config_version)::integer AS highest
-           FROM adcp_reporting_configurations WHERE account_id = $1 AND delivery_config_id = $2`,
-          [configuration.account.account_id, configuration.delivery_config_id]
-        );
-        if ((newer.rows[0]?.highest ?? -1) > configuration.delivery_config_version) {
-          throw new Error("Reporting configuration version cannot regress");
-        }
-        const inserted = await client.query(
-          `INSERT INTO adcp_reporting_configurations
-           (configuration_id, account_id, delivery_config_id, delivery_config_version,
-            semantic_fingerprint, data, created_at)
-         VALUES ($1, $2, $3, $4, $5, $6::jsonb, clock_timestamp())
-         ON CONFLICT DO NOTHING RETURNING data`,
-          [
-            configuration.configurationId,
-            configuration.account.account_id,
-            configuration.delivery_config_id,
-            configuration.delivery_config_version,
-            configuration.semanticFingerprint,
-            JSON.stringify(configuration)
-          ]
-        );
-        const value = inserted.rows[0]?.data ?? (await client.query(
-          `SELECT data FROM adcp_reporting_configurations
-              WHERE account_id = $1 AND delivery_config_id = $2 AND delivery_config_version = $3`,
-          [
-            configuration.account.account_id,
-            configuration.delivery_config_id,
-            configuration.delivery_config_version
-          ]
-        )).rows[0]?.data;
-        if (!value || value.semanticFingerprint !== configuration.semanticFingerprint) {
-          throw new Error("Immutable reporting configuration identity names different content");
-        }
-        return { inserted: inserted.rowCount === 1, value: clone(value) };
-      },
-      { preBeginAdvisoryLock: accountLock(configuration.account.account_id) }
-    );
-  }
-  async listConfigurations(account_id) {
-    const result = await this.query(
-      `SELECT data FROM adcp_reporting_configurations
-        WHERE ($1::text IS NULL OR account_id = $1)
-        ORDER BY created_at, configuration_id`,
-      [account_id ?? null]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async putObligation(obligation) {
-    const retired = await this.query(
-      `SELECT 1 FROM adcp_reporting_obligation_tombstones WHERE configuration_id = $1 AND period_ordinal = $2`,
-      [obligation.configurationId, obligation.periodOrdinal]
-    );
-    if (retired.rows.length > 0) throw new ReportingLedgerPeriodRetiredError();
-    return this.putImmutable(
-      `INSERT INTO adcp_reporting_obligations
-         (obligation_id, configuration_id, account_id, period_ordinal, period_start, period_end,
-          next_attempt_at, state, semantic_fingerprint, data, created_at)
-       SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb, clock_timestamp()
-        WHERE NOT EXISTS (
-          SELECT 1 FROM adcp_reporting_obligation_tombstones
-           WHERE configuration_id = $2 AND period_ordinal = $4
-        )
-       ON CONFLICT DO NOTHING RETURNING data`,
-      [
-        obligation.reporting_obligation_id,
-        obligation.configurationId,
-        obligation.account.account_id,
-        obligation.periodOrdinal,
-        obligation.period.start,
-        obligation.period.end,
-        obligation.nextAttemptAt,
-        obligation.state,
-        obligation.semanticFingerprint,
-        JSON.stringify(obligation)
-      ],
-      `SELECT data FROM adcp_reporting_obligations
-        WHERE configuration_id = $1 AND period_ordinal = $2`,
-      [obligation.configurationId, obligation.periodOrdinal],
-      obligation,
-      (value) => value.semanticFingerprint,
-      accountLock(obligation.account.account_id),
-      void 0,
-      void 0,
-      this.changeFeed ? (client) => this.appendChange(
-        client,
-        "obligation",
-        obligation.account.account_id,
-        obligation.reporting_obligation_id,
-        obligation.reporting_obligation_id
-      ) : void 0
-    );
-  }
-  async getObligation(id, account_id) {
-    return this.one(
-      `SELECT data FROM adcp_reporting_obligations
-        WHERE obligation_id = $1 AND ($2::text IS NULL OR account_id = $2)`,
-      [id, account_id ?? null]
-    );
-  }
-  /** Periods retired by retention; planners treat them as already covered. */
-  async listRetiredObligationOrdinals(account_id) {
-    const result = await this.query(
-      `SELECT configuration_id, period_ordinal FROM adcp_reporting_obligation_tombstones
-        WHERE ($1::text IS NULL OR account_id = $1) ORDER BY configuration_id, period_ordinal`,
-      [account_id ?? null]
-    );
-    return result.rows.map((row) => ({
-      configurationId: row.configuration_id,
-      periodOrdinal: Number(row.period_ordinal)
-    }));
-  }
-  async listObligations(account_id) {
-    const result = await this.query(
-      `SELECT data FROM adcp_reporting_obligations
-        WHERE ($1::text IS NULL OR account_id = $1) ORDER BY period_start, obligation_id`,
-      [account_id ?? null]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async listLifecycleDueObligations(input) {
-    positiveInteger(input.limit, "limit");
-    if (input.limit > 1e3) throw new RangeError("limit must not exceed 1000");
-    if (!Number.isFinite(Date.parse(input.ledgerAsOf))) throw new TypeError("ledgerAsOf must be an RFC 3339 instant");
-    const managedDueArm = await this.managedDueTablesReady() ? MANAGED_DUE_ARM : "";
-    const result = await this.query(
-      `SELECT obligation.data FROM adcp_reporting_obligations obligation
-       LEFT JOIN LATERAL (
-         SELECT transition.data->>'health' AS health, transition.occurred_at
-           FROM adcp_reporting_transitions transition
-          WHERE transition.obligation_id = obligation.obligation_id
-          ORDER BY transition.transition_sequence DESC LIMIT 1
-       ) latest ON TRUE
-       LEFT JOIN adcp_reporting_lifecycle_state state
-              ON state.obligation_id = obligation.obligation_id
-       CROSS JOIN LATERAL (
-         -- A reconcile that changed no health still has to count as work done,
-         -- or a managed change with no health effect keeps the obligation due
-         -- forever and, at small page sizes, starves everything behind it.
-         SELECT GREATEST(
-                  COALESCE(state.processed_at, obligation.created_at),
-                  COALESCE(latest.occurred_at, obligation.created_at)
-                ) AS since
-       ) watermark
-       WHERE ($1::text IS NULL OR obligation.account_id = $1)
-         AND ((COALESCE(latest.health, 'waiting') = 'waiting'
-               AND (obligation.data->>'expectedAt')::timestamptz <= $2)
-           OR (latest.health = 'delayed'
-               AND (obligation.data->>'recoveryDeadlineAt')::timestamptz <= $2)
-           OR (obligation.state = 'terminal'
-               AND COALESCE(latest.health, 'waiting') <> 'complete'
-               AND EXISTS (
-                 SELECT 1 FROM adcp_reporting_revisions revision
-                  WHERE revision.obligation_id = obligation.obligation_id
-               ))
-${managedDueArm}       )
-         -- A tenant that keeps failing must not monopolise every sweep. Its
-         -- backoff cursor holds it out of selection until it is due again,
-         -- while processed_at ordering still favours whoever has waited
-         -- longest among the eligible.
-         AND (state.next_attempt_at IS NULL OR state.next_attempt_at <= $2)
-       ORDER BY watermark.since, LEAST(
-         (obligation.data->>'expectedAt')::timestamptz,
-         (obligation.data->>'recoveryDeadlineAt')::timestamptz
-       ), obligation.obligation_id
-       LIMIT $3`,
-      [input.account_id ?? null, input.ledgerAsOf, input.limit]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async updateObligation(obligation, lease, issue) {
-    assertLeaseTarget(obligation.reporting_obligation_id, lease);
-    await this.transaction(
-      async (client) => {
-        const result = await client.query(
-          `UPDATE adcp_reporting_obligations
-          SET next_attempt_at = $2, state = $3, data = $4::jsonb, changed_at = clock_timestamp()
-        WHERE obligation_id = $1 AND semantic_fingerprint = $5
-          AND lease_owner = $6 AND lease_generation = $7 AND lease_expires_at > clock_timestamp()`,
-          [
-            obligation.reporting_obligation_id,
-            obligation.nextAttemptAt,
-            obligation.state,
-            JSON.stringify(obligation),
-            obligation.semanticFingerprint,
-            lease.owner,
-            lease.generation
-          ]
-        );
-        if (result.rowCount !== 1) throw new ReportingLedgerLeaseLostError();
-        await this.appendChange(
-          client,
-          "obligation",
-          lease.obligation.account.account_id,
-          obligation.reporting_obligation_id,
-          obligation.reporting_obligation_id
-        );
-        if (issue) {
-          if (issue.reporting_obligation_id !== obligation.reporting_obligation_id) {
-            throw new Error("Reporting issue must belong to the leased obligation");
-          }
-          const issueResult = await client.query(
-            `INSERT INTO adcp_reporting_issues (issue_id, obligation_id, data, observed_at, resolved_at)
-             VALUES ($1, $2, $3::jsonb, $4, $5)
-             -- rc.3 fixes opened_at at first emission: it MUST NOT advance while
-             -- the same issue_id is re-emitted, including across the delayed ->
-             -- action_required severity change that re-upserts this row. Keep the
-             -- stored anchor and let every other field advance.
-             ON CONFLICT (issue_id) DO UPDATE SET
-               data = jsonb_set(EXCLUDED.data, '{openedAt}', COALESCE(adcp_reporting_issues.data -> 'openedAt', EXCLUDED.data -> 'openedAt')),
-               observed_at = EXCLUDED.observed_at,
-               resolved_at = EXCLUDED.resolved_at,
-               changed_at = clock_timestamp()
-             WHERE adcp_reporting_issues.obligation_id = EXCLUDED.obligation_id`,
-            [
-              issue.issueId,
-              issue.reporting_obligation_id,
-              JSON.stringify(issue),
-              issue.observedAt,
-              issue.resolvedAt ?? null
-            ]
-          );
-          if (issueResult.rowCount !== 1) throw new Error("Reporting issue identity belongs to another obligation");
-        }
-      },
-      { preBeginAdvisoryLock: accountLock(obligation.account.account_id) }
-    );
-  }
-  async claimObligation(input) {
-    positiveInteger(input.leaseMilliseconds, "leaseMilliseconds");
-    if (!Number.isFinite(Date.parse(input.now))) throw new TypeError("now must be an RFC 3339 instant");
-    const result = await this.query(
-      `WITH candidate AS (
-         SELECT obligation_id FROM adcp_reporting_obligations
-          WHERE state = 'pending' AND next_attempt_at <= $2
-            AND ($4::text IS NULL OR account_id = $4)
-            AND (lease_expires_at IS NULL OR lease_expires_at <= clock_timestamp())
-          ORDER BY next_attempt_at, obligation_id
-          FOR UPDATE SKIP LOCKED LIMIT 1
-       )
-       UPDATE adcp_reporting_obligations obligation
-          SET lease_owner = $1, lease_generation = lease_generation + 1,
-              lease_expires_at = clock_timestamp() + ($3::bigint * INTERVAL '1 millisecond')
-         FROM candidate WHERE obligation.obligation_id = candidate.obligation_id
-       RETURNING obligation.data, obligation.lease_generation::text, obligation.lease_expires_at`,
-      [input.owner, input.now, input.leaseMilliseconds, input.account_id ?? null]
-    );
-    const row = result.rows[0];
-    return row ? {
-      obligation: clone(row.data),
-      owner: input.owner,
-      generation: Number(row.lease_generation),
-      expiresAt: row.lease_expires_at.toISOString()
-    } : null;
-  }
-  async releaseObligationLease(lease) {
-    await this.query(
-      `UPDATE adcp_reporting_obligations SET lease_owner = NULL, lease_expires_at = NULL
-        WHERE obligation_id = $1 AND lease_owner = $2 AND lease_generation = $3`,
-      [lease.obligation.reporting_obligation_id, lease.owner, lease.generation]
-    );
-  }
-  async commitRevision(revision, lease) {
-    assertLeaseTarget(revision.reporting_obligation_id, lease);
-    validateRevisionBinding(revision);
-    const prepared = this.rowStorageWrites ? await this.rowStorage.prepare({
-      rowSetId: revision.reporting_revision_id,
-      rowSetKind: "revision",
-      accountId: lease.obligation.account.account_id,
-      obligationId: revision.reporting_obligation_id,
-      rows: revision.rows,
-      finality: revision.finality,
-      periodStart: lease.obligation.period.start,
-      sourceTimezone: lease.obligation.period.sourceTimezone,
-      binding: revision.binding,
-      controlTotals: revision.wireRevision.control_totals
-    }) : void 0;
-    const upload = prepared?.binding.kind === "object" ? await this.uploadRowSetUnlessCommitted(prepared, lease, "adcp_reporting_revisions", "revision_id") : void 0;
-    const port = this.notificationActivityPort?.recordLedgerChanged ? this.notificationActivityPort : void 0;
-    const result = await this.putImmutable(
-      `WITH leased_obligation AS (
-         SELECT * FROM adcp_reporting_obligations obligation
-          WHERE obligation.obligation_id = $2
-            AND obligation.lease_owner = $9 AND obligation.lease_generation = $10
-            AND obligation.lease_expires_at > clock_timestamp()
-          FOR UPDATE
-       )
-       INSERT INTO adcp_reporting_revisions
-         (revision_id, obligation_id, revision_number, finality, kind,
-          supersedes_revision_id, content_sha256, data, created_at)
-       SELECT $1, $2, $3, $4, $5, $6, $7, $8::jsonb, clock_timestamp()
-         FROM leased_obligation obligation
-        WHERE NOT EXISTS (
-            SELECT 1 FROM adcp_reporting_revisions terminal_revision
-             WHERE terminal_revision.obligation_id = obligation.obligation_id
-               AND terminal_revision.finality = 'official'
-          )
-          AND $3 = COALESCE((
-            SELECT MAX(sequence_revision.revision_number) + 1
-              FROM adcp_reporting_revisions sequence_revision
-             WHERE sequence_revision.obligation_id = obligation.obligation_id
-          ), 1)
-          AND (($3 = 1 AND $6::text IS NULL) OR $6 = (
-            SELECT predecessor.revision_id FROM adcp_reporting_revisions predecessor
-             WHERE predecessor.obligation_id = obligation.obligation_id
-               AND predecessor.revision_number = $3 - 1
-          ))
-       ON CONFLICT DO NOTHING RETURNING data`,
-      [
-        revision.reporting_revision_id,
-        revision.reporting_obligation_id,
-        revision.revisionNumber,
-        revision.finality,
-        revision.kind,
-        revision.supersedes_reporting_revision_id ?? null,
-        revision.binding.sha256,
-        JSON.stringify(prepared ? withoutRows(revision) : revision),
-        lease.owner,
-        lease.generation
-      ],
-      "SELECT data FROM adcp_reporting_revisions WHERE obligation_id = $1 AND revision_number = $2",
-      [revision.reporting_obligation_id, revision.revisionNumber],
-      revision,
-      revisionIdentityFingerprint,
-      accountLock(lease.obligation.account.account_id),
-      {
-        obligationId: revision.reporting_obligation_id,
-        owner: lease.owner,
-        generation: lease.generation
-      },
-      revisionLegacyCanonicalDigestReplay,
-      prepared || port || this.changeFeed ? async (client, committed) => {
-        if (prepared) await this.writePreparedRowSet(client, prepared, upload);
-        await this.appendChange(
-          client,
-          "revision",
-          lease.obligation.account.account_id,
-          revision.reporting_revision_id,
-          revision.reporting_obligation_id
-        );
-        await port?.recordLedgerChanged(
-          { obligation: lease.obligation, revision: withRows(committed, revision.rows) },
-          client
-        );
-      } : void 0
-    );
-    return { inserted: result.inserted, value: withRows(result.value, revision.rows) };
-  }
-  async getRevision(id, accountId) {
-    const revision = await this.one(
-      `SELECT revision.data FROM adcp_reporting_revisions revision
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-        WHERE revision.revision_id = $1 AND obligation.account_id = $2`,
-      [id, accountId]
-    );
-    return revision ? this.hydrateRevision(revision, accountId) : null;
-  }
-  async getRevisionMetadata(id, accountId) {
-    return this.one(
-      `SELECT revision.data - 'rows' AS data FROM adcp_reporting_revisions revision
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-        WHERE revision.revision_id = $1 AND obligation.account_id = $2`,
-      [id, accountId]
-    );
-  }
-  async readRevisionRows(input) {
-    if (!Number.isSafeInteger(input.offset) || input.offset < 0 || !Number.isSafeInteger(input.limit) || input.limit < 1) {
-      throw new RangeError("Reporting row page bounds are invalid");
-    }
-    const result = await this.query(
-      `SELECT revision.data ? 'rows' AS inline,
-              CASE WHEN revision.data ? 'rows' THEN jsonb_array_length(revision.data->'rows') END AS total,
-              CASE WHEN revision.data ? 'rows' THEN jsonb_path_query_array(
-                revision.data->'rows',
-                '$[$from to $to]',
-                jsonb_build_object('from', $3::bigint, 'to', $3::bigint + $4::bigint - 1)
-              ) END AS rows
-         FROM adcp_reporting_revisions revision
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-        WHERE revision.revision_id = $1 AND obligation.account_id = $2`,
-      [input.reporting_revision_id, input.account_id, input.offset, input.limit]
-    );
-    const row = result.rows[0];
-    if (!row) return null;
-    if (row.inline) return { rows: clone(row.rows ?? []), total: Number(row.total) };
-    const handle = await this.rowStorage.find(input.reporting_revision_id, input.account_id);
-    if (!handle) throw new ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "revision rows are not recorded");
-    if (input.offset >= handle.rowCount) return { rows: [], total: handle.rowCount };
-    return {
-      rows: await this.rowStorage.readPage(handle, input.offset, input.limit, input.signal),
-      total: handle.rowCount
-    };
-  }
-  async listRevisions(obligationId) {
-    const result = await this.query(
-      `SELECT revision.data, obligation.account_id FROM adcp_reporting_revisions revision
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-        WHERE revision.obligation_id = $1
-        ORDER BY revision.revision_number, revision.revision_id`,
-      [obligationId]
-    );
-    const revisions = [];
-    for (const row of result.rows) {
-      try {
-        revisions.push(await this.hydrateRevision(clone(row.data), row.account_id));
-      } catch (error) {
-        if (isReportingRowStoreError(error) && error.code === "ROWS_EXPIRED") continue;
-        throw error;
-      }
-    }
-    return revisions;
-  }
-  async listRevisionMetadata(obligationId, accountId) {
-    const result = await this.query(
-      `SELECT revision.data - 'rows' AS data FROM adcp_reporting_revisions revision
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-        WHERE revision.obligation_id = $1 AND ($2::text IS NULL OR obligation.account_id = $2)
-        ORDER BY revision.revision_number, revision.revision_id`,
-      [obligationId, accountId ?? null]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async commitAdjustment(adjustment, lease) {
-    assertLeaseTarget(adjustment.reporting_obligation_id, lease);
-    validateBoundRows(adjustment);
-    const prepared = this.rowStorageWrites ? await this.rowStorage.prepare({
-      rowSetId: adjustment.reporting_adjustment_id,
-      rowSetKind: "adjustment",
-      accountId: lease.obligation.account.account_id,
-      obligationId: adjustment.reporting_obligation_id,
-      rows: adjustment.rows,
-      periodStart: lease.obligation.period.start,
-      sourceTimezone: lease.obligation.period.sourceTimezone,
-      binding: adjustment.binding
-    }) : void 0;
-    const upload = prepared?.binding.kind === "object" ? await this.uploadRowSetUnlessCommitted(prepared, lease, "adcp_reporting_adjustments", "adjustment_id") : void 0;
-    const port = this.notificationActivityPort?.recordLedgerChanged ? this.notificationActivityPort : void 0;
-    const result = await this.putImmutable(
-      `WITH leased_obligation AS (
-         SELECT * FROM adcp_reporting_obligations obligation
-          WHERE obligation.obligation_id = $2
-            AND obligation.lease_owner = $7 AND obligation.lease_generation = $8
-            AND obligation.lease_expires_at > clock_timestamp()
-          FOR UPDATE
-       )
-       INSERT INTO adcp_reporting_adjustments
-         (adjustment_id, obligation_id, adjusts_revision_id, adjustment_number,
-          content_sha256, data, created_at)
-       SELECT $1, $2, $3, $4, $5, $6::jsonb, clock_timestamp()
-         FROM leased_obligation obligation
-        WHERE EXISTS (
-            SELECT 1 FROM adcp_reporting_revisions official_revision
-             WHERE official_revision.obligation_id = obligation.obligation_id
-               AND official_revision.revision_id = $3
-               AND official_revision.finality = 'official'
-          )
-          AND $4 = COALESCE((
-            SELECT MAX(sequence_adjustment.adjustment_number) + 1
-              FROM adcp_reporting_adjustments sequence_adjustment
-             WHERE sequence_adjustment.obligation_id = obligation.obligation_id
-          ), 1)
-       ON CONFLICT DO NOTHING RETURNING data`,
-      [
-        adjustment.reporting_adjustment_id,
-        adjustment.reporting_obligation_id,
-        adjustment.adjusts_reporting_revision_id,
-        adjustment.adjustmentNumber,
-        adjustment.binding.sha256,
-        JSON.stringify(prepared ? withoutRows(adjustment) : adjustment),
-        lease.owner,
-        lease.generation
-      ],
-      "SELECT data FROM adcp_reporting_adjustments WHERE obligation_id = $1 AND adjustment_number = $2",
-      [adjustment.reporting_obligation_id, adjustment.adjustmentNumber],
-      adjustment,
-      adjustmentIdentityFingerprint,
-      accountLock(lease.obligation.account.account_id),
-      {
-        obligationId: adjustment.reporting_obligation_id,
-        owner: lease.owner,
-        generation: lease.generation
-      },
-      adjustmentLegacyCanonicalDigestReplay,
-      prepared || port || this.changeFeed ? async (client, committed) => {
-        if (prepared) await this.writePreparedRowSet(client, prepared, upload);
-        await this.appendChange(
-          client,
-          "adjustment",
-          lease.obligation.account.account_id,
-          adjustment.reporting_adjustment_id,
-          adjustment.reporting_obligation_id
-        );
-        await port?.recordLedgerChanged(
-          { obligation: lease.obligation, adjustment: withRows(committed, adjustment.rows) },
-          client
-        );
-      } : void 0
-    );
-    return { inserted: result.inserted, value: withRows(result.value, adjustment.rows) };
-  }
-  async listAdjustments(obligationId) {
-    const result = await this.query(
-      `SELECT adjustment.data, obligation.account_id FROM adcp_reporting_adjustments adjustment
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = adjustment.obligation_id
-        WHERE adjustment.obligation_id = $1
-        ORDER BY adjustment.adjustment_number, adjustment.adjustment_id`,
-      [obligationId]
-    );
-    const adjustments = [];
-    for (const row of result.rows) {
-      const adjustment = clone(row.data);
-      if (Array.isArray(adjustment.rows)) {
-        adjustments.push(adjustment);
-        continue;
-      }
-      const handle = await this.rowStorage.find(adjustment.reporting_adjustment_id, row.account_id);
-      if (!handle) throw new ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "adjustment rows are not recorded");
-      adjustments.push({ ...adjustment, rows: await this.rowStorage.readAll(handle) });
-    }
-    return adjustments;
-  }
-  /**
-   * The obligation's current revision header: its official revision if one
-   * exists, otherwise its highest-numbered snapshot. An official revision is
-   * terminal, so this is always the highest revision number — one index
-   * lookup. Rows are read separately through `readRevisionRows`.
-   */
-  async getCurrentRevision(input) {
-    return this.one(
-      `SELECT revision.data - 'rows' AS data
-         FROM adcp_reporting_obligations obligation
-         JOIN LATERAL (
-           SELECT data FROM adcp_reporting_revisions current_revision
-            WHERE current_revision.obligation_id = obligation.obligation_id
-            ORDER BY current_revision.revision_number DESC LIMIT 1
-         ) revision ON TRUE
-        WHERE obligation.obligation_id = $1 AND obligation.account_id = $2`,
-      [input.reporting_obligation_id, input.account_id]
-    );
-  }
-  /**
-   * Current revision headers for an account's obligations whose period starts
-   * in `[period_start_from, period_start_to)`, ordered by period start.
-   * Obligations without a revision yet are omitted. Page with `cursor`.
-   */
-  async listCurrentRevisions(input) {
-    const limit = input.limit ?? 100;
-    positiveInteger(limit, "limit");
-    if (limit > 1e3) throw new RangeError("listCurrentRevisions limit must not exceed 1000");
-    let after;
-    if (input.cursor !== void 0) {
-      try {
-        const parsed = JSON.parse(Buffer.from(input.cursor, "base64url").toString("utf8"));
-        if (typeof parsed.start !== "string" || typeof parsed.id !== "string") throw new Error("invalid");
-        after = { start: parsed.start, id: parsed.id };
-      } catch {
-        throw new RangeError("listCurrentRevisions cursor is invalid");
-      }
-    }
-    const result = await this.query(
-      `SELECT revision.data - 'rows' AS data,
-              to_char(obligation.period_start AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS start,
-              obligation.obligation_id AS id
-         FROM adcp_reporting_obligations obligation
-         JOIN LATERAL (
-           SELECT data FROM adcp_reporting_revisions current_revision
-            WHERE current_revision.obligation_id = obligation.obligation_id
-            ORDER BY current_revision.revision_number DESC LIMIT 1
-         ) revision ON TRUE
-        WHERE obligation.account_id = $1
-          AND obligation.period_start >= $2::timestamptz AND obligation.period_start < $3::timestamptz
-          AND ($4::text IS NULL OR obligation.data->>'delivery_config_id' = $4)
-          AND ($5::timestamptz IS NULL
-               OR (obligation.period_start, obligation.obligation_id) > ($5::timestamptz, $6::text))
-        ORDER BY obligation.period_start, obligation.obligation_id
-        LIMIT $7`,
-      [
-        input.account_id,
-        input.period_start_from,
-        input.period_start_to,
-        input.delivery_config_id ?? null,
-        after?.start ?? null,
-        after?.id ?? null,
-        limit + 1
-      ]
-    );
-    const page = result.rows.slice(0, limit);
-    const last = result.rows.length > limit ? page.at(-1) : void 0;
-    return {
-      revisions: page.map((row) => clone(row.data)),
-      ...last ? { cursor: Buffer.from(JSON.stringify({ start: last.start, id: last.id }), "utf8").toString("base64url") } : {}
-    };
-  }
-  /**
-   * Host change feed. Omit `cursor` to start from the oldest retained change.
-   * Account-scoped feeds order by sequence; the deployment-wide feed orders by
-   * `(xid, seq)` and returns only changes whose transaction precedes every
-   * transaction still in flight, so no commit is ever skipped. An account page
-   * also ends before the first change whose transaction has not finished, as
-   * defense in depth against a change that commits late. An empty page can
-   * therefore mean either caught up or held back by an older open transaction.
-   * A ledger database must have exactly one writer SDK; see
-   * `docs/guides/REPORTING-LEDGER.md`. A cursor older
-   * than the retained history throws `ReportingChangeCursorExpiredError`;
-   * resynchronize from `listCurrentRevisions`.
-   *
-   * A read without a `cursor` can throw `ReportingChangeCursorExpiredError`
-   * (`code === 'CURSOR_EXPIRED'`) too. The horizon is re-read after the page,
-   * so a prune that commits mid-read rejects the page instead of returning one
-   * that silently skips the pruned changes. Retrying the read starts from the
-   * new, later horizon. Match on `error.code` rather than `instanceof`, which
-   * fails when the error crosses a CJS/ESM module boundary.
-   */
-  async changesAfter(input = {}) {
-    if (!this.changeFeed) throw new Error("changesAfter requires the store changeFeed option");
-    const limit = input.limit ?? 500;
-    positiveInteger(limit, "limit");
-    if (limit > 1e4) throw new RangeError("changesAfter limit must not exceed 10000");
-    const account = input.account_id ?? null;
-    const cursor = input.cursor === void 0 ? void 0 : decodeReportingChangeCursorV1(input.cursor, account);
-    const readHorizon = async () => account !== null ? {
-      seq: (await this.query(
-        `SELECT pruned_through_seq::text AS seq FROM adcp_reporting_change_account_horizon
-                    WHERE account_id = $1`,
-        [account]
-      )).rows[0]?.seq ?? "0"
-    } : (await this.query(
-      `SELECT pruned_through_xid::text AS xid, pruned_through_seq::text AS seq
-                 FROM adcp_reporting_change_horizon WHERE singleton`
-    )).rows[0] ?? { xid: "0", seq: "0" };
-    const assertRetained = (position2, horizon2) => {
-      const behind = account !== null ? BigInt(horizon2.seq) > BigInt(position2.seq) : BigInt(horizon2.xid) > BigInt(position2.xid) || BigInt(horizon2.xid) === BigInt(position2.xid) && BigInt(horizon2.seq) > BigInt(position2.seq);
-      if (behind) {
-        throw new ReportingChangeCursorExpiredError(
-          encodeReportingChangeCursorV1({
-            v: 1,
-            account,
-            seq: position2.seq,
-            ...account === null ? { xid: position2.xid } : {}
-          })
-        );
-      }
-    };
-    const horizon = await readHorizon();
-    if (cursor) assertRetained(cursor, horizon);
-    const position = cursor ?? {
-      v: 1,
-      account,
-      seq: horizon.seq,
-      ...account === null ? { xid: horizon.xid } : {}
-    };
-    const kinds = input.kinds?.length ? [...input.kinds] : null;
-    const columns = `seq::text AS seq, xid::text AS xid, account_id, record_kind, record_id, obligation_id,
-      to_char(recorded_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS recorded_at`;
-    const result = account !== null ? await this.query(
-      `SELECT ${columns}, xid >= pg_snapshot_xmin(pg_current_snapshot()) AS in_flight
-               FROM adcp_reporting_changes
-              WHERE account_id = $1 AND seq > $2::bigint AND ($3::text[] IS NULL OR record_kind = ANY($3))
-              ORDER BY adcp_reporting_changes.seq LIMIT $4`,
-      [account, position.seq, kinds, limit]
-    ) : await this.query(
-      `SELECT ${columns} FROM adcp_reporting_changes
-              WHERE (xid, seq) > ($1::text::xid8, $2::bigint)
-                AND xid < pg_snapshot_xmin(pg_current_snapshot())
-                AND ($3::text[] IS NULL OR record_kind = ANY($3))
-              ORDER BY adcp_reporting_changes.xid, adcp_reporting_changes.seq LIMIT $4`,
-      [position.xid ?? "0", position.seq, kinds, limit]
-    );
-    if (account !== null) {
-      const blocked = result.rows.findIndex((row) => row.in_flight);
-      if (blocked !== -1) result.rows.length = blocked;
-    }
-    assertRetained(position, await readHorizon());
-    const last = result.rows.at(-1);
-    const next = last ? encodeReportingChangeCursorV1({ v: 1, account, seq: last.seq, ...account === null ? { xid: last.xid } : {} }) : input.cursor ?? encodeReportingChangeCursorV1(position);
-    return {
-      records: result.rows.map((row) => ({
-        kind: row.record_kind,
-        record_id: row.record_id,
-        reporting_obligation_id: row.obligation_id,
-        account_id: row.account_id,
-        recorded_at: row.recorded_at
-      })),
-      cursor: next
-    };
-  }
-  /**
-   * Record a named durable consumer's position. Registered consumers hold
-   * back change-table pruning until `maxFeedHoldDays` after their last update.
-   *
-   * Checkpoints are forward-only within a feed scope: a cursor behind the
-   * saved one is ignored, so a delayed or stale acknowledgment cannot pull the
-   * retention hold back. Resolves `true` when the checkpoint was written and
-   * `false` when it was ignored (behind the saved position, or equal with
-   * `refreshUnchanged: false`). To rewind a consumer deliberately, for example
-   * to replay changes, pass `rewind: true`; the saved position and retention
-   * hold then move to `cursor` and the write always applies, even with
-   * `refreshUnchanged: false`. The cursor is not checked against the
-   * retention horizon: it must still be inside the retained history or the
-   * next read throws `ReportingChangeCursorExpiredError`. Any change of
-   * `account_id` (account to deployment, deployment to account, or between
-   * accounts) always replaces the position. The feed scope is read from the
-   * cursor itself, so only pass cursors your own code obtained from
-   * `changesAfter`, never ones supplied by an untrusted caller.
-   *
-   * Set `refreshUnchanged: false` to recover an acknowledgment without
-   * renewing the retention hold when its position has not advanced.
-   */
-  async saveFeedConsumerCursor(name, cursor, options = {}) {
-    if (!this.changeFeed) throw new Error("saveFeedConsumerCursor requires the store changeFeed option");
-    let account;
-    try {
-      const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-      account = typeof parsed.account === "string" ? parsed.account : null;
-    } catch {
-      throw new RangeError("feed consumer cursor is invalid");
-    }
-    const decoded = decodeReportingChangeCursorV1(cursor, account);
-    const result = await this.query(
-      `INSERT INTO adcp_reporting_feed_consumers (consumer_name, account_id, cursor_xid, cursor_seq)
-       VALUES ($1, $2, $3::text::xid8, $4::bigint)
-       ON CONFLICT (consumer_name) DO UPDATE
-          SET account_id = EXCLUDED.account_id, cursor_xid = EXCLUDED.cursor_xid,
-              cursor_seq = EXCLUDED.cursor_seq, updated_at = clock_timestamp()
-        WHERE $6::boolean
-           OR adcp_reporting_feed_consumers.account_id IS DISTINCT FROM EXCLUDED.account_id
-           OR CASE WHEN EXCLUDED.account_id IS NULL
-              THEN (adcp_reporting_feed_consumers.cursor_xid, adcp_reporting_feed_consumers.cursor_seq)
-                   < (EXCLUDED.cursor_xid, EXCLUDED.cursor_seq)
-                OR ($5::boolean AND (adcp_reporting_feed_consumers.cursor_xid, adcp_reporting_feed_consumers.cursor_seq)
-                   = (EXCLUDED.cursor_xid, EXCLUDED.cursor_seq))
-              ELSE adcp_reporting_feed_consumers.cursor_seq < EXCLUDED.cursor_seq
-                OR ($5::boolean AND adcp_reporting_feed_consumers.cursor_seq = EXCLUDED.cursor_seq) END
-       RETURNING consumer_name`,
-      [
-        name,
-        account,
-        account === null ? decoded.xid : null,
-        decoded.seq,
-        options.refreshUnchanged !== false,
-        options.rewind === true
-      ]
-    );
-    return result.rows.length > 0;
-  }
-  /**
-   * Unregister a durable consumer so it stops holding back change-table
-   * pruning and period retention. Resolves `true` when a registration was
-   * removed. Saving a cursor under the same name registers it again.
-   */
-  async removeFeedConsumer(name) {
-    if (!this.changeFeed) throw new Error("removeFeedConsumer requires the store changeFeed option");
-    const result = await this.query(
-      `DELETE FROM adcp_reporting_feed_consumers WHERE consumer_name = $1 RETURNING consumer_name`,
-      [name]
-    );
-    return result.rows.length > 0;
-  }
-  /**
-   * Delete change rows older than `changeRetentionDays` that every consumer
-   * updated within `maxFeedHoldDays` has passed, and advance the expiry
-   * horizon so older cursors fail closed.
-   */
-  async pruneChanges(input = {}) {
-    if (!this.changeFeed) return { deleted: 0 };
-    const retentionDays = input.changeRetentionDays ?? 30;
-    const holdDays = input.maxFeedHoldDays ?? 7;
-    positiveInteger(retentionDays, "changeRetentionDays");
-    positiveInteger(holdDays, "maxFeedHoldDays");
-    const limit = input.limit ?? 1e4;
-    positiveInteger(limit, "limit");
-    const deleted = await this.transaction(async (client) => {
-      const victims = await client.query(
-        `WITH victims AS (
-           SELECT change.seq FROM adcp_reporting_changes change
-            WHERE change.recorded_at < clock_timestamp() - ($1::integer * INTERVAL '1 day')
-              AND NOT EXISTS (
-                SELECT 1 FROM adcp_reporting_feed_consumers consumer
-                 WHERE consumer.updated_at > clock_timestamp() - ($2::integer * INTERVAL '1 day')
-                   AND ((consumer.account_id IS NULL
-                         AND (change.xid, change.seq) > (consumer.cursor_xid, consumer.cursor_seq))
-                     OR (consumer.account_id = change.account_id AND change.seq > consumer.cursor_seq))
-              )
-            ORDER BY change.seq LIMIT $3
-         )
-         DELETE FROM adcp_reporting_changes change USING victims
-          WHERE change.seq = victims.seq
-         RETURNING change.seq::text AS seq, change.xid::text AS xid, change.account_id`,
-        [retentionDays, holdDays, limit]
-      );
-      if (victims.rows.length === 0) return 0;
-      const highest = victims.rows.reduce(
-        (max, row) => BigInt(row.xid) > BigInt(max.xid) || row.xid === max.xid && BigInt(row.seq) > BigInt(max.seq) ? row : max
-      );
-      await client.query(
-        `UPDATE adcp_reporting_change_horizon
-            SET (pruned_through_xid, pruned_through_seq) = ($1::text::xid8, $2::bigint)
-          WHERE singleton AND ($1::text::xid8, $2::bigint) > (pruned_through_xid, pruned_through_seq)`,
-        [highest.xid, highest.seq]
-      );
-      const perAccount = /* @__PURE__ */ new Map();
-      for (const row of victims.rows) {
-        const seq = BigInt(row.seq);
-        if (seq > (perAccount.get(row.account_id) ?? 0n)) perAccount.set(row.account_id, seq);
-      }
-      for (const [accountId, seq] of perAccount) {
-        await client.query(
-          `INSERT INTO adcp_reporting_change_account_horizon (account_id, pruned_through_seq) VALUES ($1, $2::bigint)
-           ON CONFLICT (account_id) DO UPDATE
-              SET pruned_through_seq = GREATEST(adcp_reporting_change_account_horizon.pruned_through_seq,
-                                                EXCLUDED.pruned_through_seq)`,
-          [accountId, seq.toString()]
-        );
-      }
-      return victims.rows.length;
-    });
-    return { deleted };
-  }
-  /**
-   * Retire whole reporting periods whose retention has elapsed (shared SDK
-   * persistence spec §4). A period is eligible once both its end and its
-   * latest publication are older than `max(statusRetentionDays,
-   * recordRetentionDays)`, no worker holds its lease, and no Managed Delivery
-   * materialization still references it. Retirement is period-aligned and
-   * resumable:
-   *
-   * 1. under the account lock, record a `retiring` tombstone and mark the
-   *    period's row sets `pruning`, so exact reads answer as expired;
-   * 2. delete the period's external row objects at their recorded versions;
-   * 3. under the account lock, delete the period's ledger records (rows,
-   *    revisions, adjustments, consumer statuses, issues, transitions,
-   *    lifecycle state, obligation) and mark the tombstone `retired`.
-   *
-   * Planners skip retired periods, and `ledger_retained_from` advances past
-   * them because their obligations no longer exist.
-   *
-   * When the change-feed tables exist, a period that is not yet retiring is
-   * also held while any live registered feed consumer (updated within
-   * `maxFeedHoldDays`, default 7) has not passed that period's change rows in
-   * the consumer's own feed order, the same rule `pruneChanges` applies. A
-   * held period is simply not a candidate this pass. A consumer that stays
-   * silent past `maxFeedHoldDays` stops holding, so retention is never
-   * blocked forever; it then falls behind retention and a sink sees the
-   * retired revisions as missing.
-   */
-  async retireExpiredPeriods(input) {
-    if (!Number.isSafeInteger(input.statusRetentionDays) || input.statusRetentionDays < 1) {
-      throw new RangeError("statusRetentionDays must be a positive integer");
-    }
-    const recordDays = input.recordRetentionDays ?? input.statusRetentionDays;
-    if (!Number.isSafeInteger(recordDays) || recordDays < input.statusRetentionDays) {
-      throw new RangeError("recordRetentionDays must be an integer no shorter than statusRetentionDays");
-    }
-    const limit = input.limit ?? 100;
-    positiveInteger(limit, "limit");
-    const holdDays = input.maxFeedHoldDays ?? 7;
-    positiveInteger(holdDays, "maxFeedHoldDays");
-    const tables = await this.optionalTables();
-    const materializationHold = tables.has("adcp_reporting_materializations") ? `AND NOT EXISTS (SELECT 1 FROM adcp_reporting_materializations hold WHERE hold.obligation_id = obligation.obligation_id)` : "";
-    const feedHold = tables.has("adcp_reporting_changes") && tables.has("adcp_reporting_feed_consumers") ? `AND NOT EXISTS (
-                  SELECT 1 FROM adcp_reporting_changes change
-                    JOIN adcp_reporting_feed_consumers consumer
-                      ON consumer.updated_at > clock_timestamp() - ($4::integer * INTERVAL '1 day')
-                   WHERE change.obligation_id = obligation.obligation_id
-                     AND ((consumer.account_id IS NULL
-                           AND (change.xid, change.seq) > (consumer.cursor_xid, consumer.cursor_seq))
-                       OR (consumer.account_id = change.account_id AND change.seq > consumer.cursor_seq)))` : "";
-    const candidates = await this.query(
-      `SELECT obligation_id, account_id FROM (
-         SELECT tombstone.obligation_id, tombstone.account_id, 0 AS resume, tombstone.attempts, tombstone.period_end,
-                CASE WHEN row_number() OVER (ORDER BY tombstone.attempts, tombstone.period_end, tombstone.obligation_id)
-                          <= (($1::integer + 1) / 2) THEN 0 ELSE 1 END AS tier
-           FROM adcp_reporting_obligation_tombstones tombstone
-          WHERE tombstone.state = 'retiring' AND ($2::text IS NULL OR tombstone.account_id = $2)
-            AND (tombstone.next_attempt_at IS NULL OR tombstone.next_attempt_at <= clock_timestamp())
-         UNION ALL
-         (SELECT obligation.obligation_id, obligation.account_id, 1, 0, obligation.period_end, 0
-           FROM adcp_reporting_obligations obligation
-          WHERE ($2::text IS NULL OR obligation.account_id = $2)
-            AND obligation.period_end + ($3::integer * INTERVAL '1 day') <= clock_timestamp()
-            AND (obligation.lease_expires_at IS NULL OR obligation.lease_expires_at <= clock_timestamp())
-            AND COALESCE((SELECT MAX(revision.recorded_at) FROM adcp_reporting_revisions revision
-                           WHERE revision.obligation_id = obligation.obligation_id), obligation.created_at)
-                + ($3::integer * INTERVAL '1 day') <= clock_timestamp()
-            AND COALESCE((SELECT MAX(adjustment.recorded_at) FROM adcp_reporting_adjustments adjustment
-                           WHERE adjustment.obligation_id = obligation.obligation_id), '-infinity'::timestamptz)
-                + ($3::integer * INTERVAL '1 day') <= clock_timestamp()
-            AND NOT EXISTS (SELECT 1 FROM adcp_reporting_obligation_tombstones tombstone
-                             WHERE tombstone.obligation_id = obligation.obligation_id)
-            ${materializationHold}
-            ${feedHold}
-          ORDER BY obligation.period_end, obligation.obligation_id
-          LIMIT $1)
-       ) candidate
-       ORDER BY tier, resume, attempts, period_end, obligation_id
-       LIMIT $1`,
-      feedHold ? [limit, input.account_id ?? null, recordDays, holdDays] : [limit, input.account_id ?? null, recordDays]
-    );
-    let retired = 0;
-    const failed = [];
-    const failures = [];
-    for (const candidate of candidates.rows) {
-      input.signal?.throwIfAborted();
-      try {
-        await this.retirePeriod(candidate.obligation_id, candidate.account_id, tables, input.signal);
-        retired += 1;
-      } catch (error) {
-        if (error instanceof ReportingLedgerPeriodRetiredError) continue;
-        const cause = isReportingRowStoreError(error) ? error.code : error instanceof Error ? error.name : "Error";
-        failed.push(candidate.obligation_id);
-        failures.push({ reporting_obligation_id: candidate.obligation_id, cause });
-        if (!input.signal?.aborted) await this.recordRetirementFailure(candidate.obligation_id, cause);
-      }
-    }
-    const scope = input.account_id ?? null;
-    const deferred = Number(
-      (await this.query(
-        `SELECT count(*) AS n FROM adcp_reporting_obligation_tombstones
-            WHERE state = 'retiring' AND next_attempt_at > clock_timestamp()
-              AND ($1::text IS NULL OR account_id = $1)`,
-        [scope]
-      )).rows[0].n
-    );
-    const stuck = (await this.query(
-      `SELECT obligation_id, attempts, last_failure FROM adcp_reporting_obligation_tombstones
-          WHERE state = 'retiring' AND attempts >= $2 AND ($1::text IS NULL OR account_id = $1)
-          ORDER BY attempts DESC, retiring_at, obligation_id LIMIT 20`,
-      [scope, REPORTING_PERSISTENT_FAILURE_ATTEMPTS]
-    )).rows.map((row) => ({
-      reporting_obligation_id: row.obligation_id,
-      attempts: row.attempts,
-      cause: row.last_failure ?? "Error"
-    }));
-    return { retired, failed, failures, deferred, stuck };
-  }
-  /**
-   * Record a failed retirement attempt on the period's tombstone and push its next
-   * attempt out by an exponential backoff. Best effort: a failure to record only
-   * means the period is retried on the next pass.
-   */
-  async recordRetirementFailure(obligationId, cause) {
-    try {
-      await this.query(
-        `UPDATE adcp_reporting_obligation_tombstones
-            SET attempts = attempts + 1, last_failure = $2,
-                next_attempt_at = clock_timestamp() + ${backoffIntervalSql("attempts + 1")}
-          WHERE obligation_id = $1 AND state = 'retiring'`,
-        [obligationId, cause]
-      );
-    } catch {
-    }
-  }
-  async retirePeriod(obligationId, accountId, tables, signal) {
-    const rowStorage = tables.has("adcp_reporting_row_sets");
-    await this.transaction(
-      async (client) => {
-        await client.query(
-          `INSERT INTO adcp_reporting_obligation_tombstones
-             (obligation_id, account_id, configuration_id, period_ordinal, period_start, period_end, state,
-              final_revision_id, final_content_sha256, revision_count, adjustment_count)
-           SELECT obligation.obligation_id, obligation.account_id, obligation.configuration_id,
-                  obligation.period_ordinal, obligation.period_start, obligation.period_end, 'retiring',
-                  latest.revision_id, latest.content_sha256,
-                  (SELECT count(*) FROM adcp_reporting_revisions revision WHERE revision.obligation_id = obligation.obligation_id),
-                  (SELECT count(*) FROM adcp_reporting_adjustments adjustment WHERE adjustment.obligation_id = obligation.obligation_id)
-             FROM adcp_reporting_obligations obligation
-             LEFT JOIN LATERAL (
-               SELECT revision.revision_id, revision.content_sha256 FROM adcp_reporting_revisions revision
-                WHERE revision.obligation_id = obligation.obligation_id
-                ORDER BY revision.revision_number DESC LIMIT 1
-             ) latest ON TRUE
-            WHERE obligation.obligation_id = $1
-           ON CONFLICT (obligation_id) DO NOTHING`,
-          [obligationId]
-        );
-        if (rowStorage) {
-          await client.query(
-            `UPDATE adcp_reporting_row_sets SET rows_state = 'pruning', rows_state_changed_at = clock_timestamp()
-              WHERE obligation_id = $1 AND rows_state IN ('live', 'unavailable')`,
-            [obligationId]
-          );
-        }
-      },
-      { preBeginAdvisoryLock: accountLock(accountId) }
-    );
-    if (rowStorage) {
-      const objects = await this.query(
-        `SELECT DISTINCT row_set.row_binding_id, chunk.object_ref, chunk.native_version_ref
-           FROM adcp_reporting_row_chunks chunk
-           JOIN adcp_reporting_row_sets row_set ON row_set.row_set_id = chunk.row_set_id
-          WHERE chunk.obligation_id = $1 AND chunk.object_ref IS NOT NULL`,
-        [obligationId]
-      );
-      const byBinding = /* @__PURE__ */ new Map();
-      for (const row of objects.rows) {
-        const list = byBinding.get(row.row_binding_id) ?? [];
-        list.push({ objectRef: row.object_ref, nativeVersionRef: row.native_version_ref });
-        byBinding.set(row.row_binding_id, list);
-      }
-      for (const [bindingId, list] of byBinding) {
-        await this.deleteUnreferencedObjects(bindingId, list, { obligationId }, signal);
-      }
-    }
-    await this.transaction(
-      async (client) => {
-        const revisionIds = `SELECT revision_id FROM adcp_reporting_revisions WHERE obligation_id = $1`;
-        if (rowStorage) {
-          await client.query(`DELETE FROM adcp_reporting_row_chunks WHERE obligation_id = $1`, [obligationId]);
-          await client.query(`DELETE FROM adcp_reporting_row_sets WHERE obligation_id = $1`, [obligationId]);
-          await client.query(`DELETE FROM adcp_reporting_chunk_bodies WHERE account_id = $2 AND obligation_id = $1`, [
-            obligationId,
-            accountId
-          ]);
-        }
-        await client.query(
-          `DELETE FROM adcp_reporting_consumer_statuses
-            WHERE obligation_id = $1 OR revision_id IN (${revisionIds})`,
-          [obligationId]
-        );
-        await client.query(`DELETE FROM adcp_reporting_adjustments WHERE obligation_id = $1`, [obligationId]);
-        await client.query(`DELETE FROM adcp_reporting_revisions WHERE obligation_id = $1`, [obligationId]);
-        await client.query(`DELETE FROM adcp_reporting_issues WHERE obligation_id = $1`, [obligationId]);
-        await client.query(`DELETE FROM adcp_reporting_transitions WHERE obligation_id = $1`, [obligationId]);
-        await client.query(`DELETE FROM adcp_reporting_lifecycle_state WHERE obligation_id = $1`, [obligationId]);
-        await client.query(`DELETE FROM adcp_reporting_obligations WHERE obligation_id = $1`, [obligationId]);
-        const retiredNow = await client.query(
-          `UPDATE adcp_reporting_obligation_tombstones SET state = 'retired', retired_at = clock_timestamp()
-            WHERE obligation_id = $1 AND state = 'retiring'`,
-          [obligationId]
-        );
-        if (retiredNow.rowCount === 1) {
-          await this.appendChange(client, "retirement", accountId, obligationId, obligationId);
-        }
-      },
-      { preBeginAdvisoryLock: accountLock(accountId) }
-    );
-  }
-  /**
-   * Compact superseded snapshot revisions to metadata only, as adcontextprotocol/adcp#8100
-   * permits (`reporting-revision.json` `content_retention`). Opt-in: nothing calls this
-   * unless the host enables `compaction` in maintenance, and it must not be enabled in
-   * production before the AdCP release that takes compaction into effect (the next
-   * eligible minor after November 20, 2026).
-   *
-   * A snapshot revision is compacted only when every one of these holds:
-   *
-   * - it is superseded: a later revision names it in `supersedes_reporting_revision_id`
-   *   (so a current revision, and every official revision, is never compacted);
-   * - it is not the revision the current, unsuperseded revision names;
-   * - its recovery grace has passed: `max(automatedRecoveryWindowSeconds, 3600)` seconds
-   *   since its successor's `created_at`;
-   * - while its window is open (`statusRetentionDays` since its successor's `created_at`),
-   *   no caller's reporting receipt (any status) names it and no caller's current consumer
-   *   status statement of `received`, `unreadable` or `content_mismatch` names it. The
-   *   check spans every caller, so content any caller is entitled to is kept;
-   * - it has rows (nothing to reclaim otherwise, and an empty exact read is still correct);
-   * - no live obligation lease, no pending materialization of it, and no live change-feed
-   *   consumer that has not yet passed its change row (the holds retirement applies,
-   *   narrowed to this revision).
-   *
-   * Only row content is dropped: the revision header, its manifest and every metadata
-   * listing stay. The row set is marked `pruned`, so an exact read answers
-   * `ROWS_EXPIRED`, which the handlers surface as the same nondisclosing
-   * `REFERENCE_NOT_FOUND` as an unknown ID. No change-feed row is recorded: the revision's
-   * metadata is unchanged, and a sink still catching up holds compaction back.
-   *
-   * Compaction is resumable and runs in the same three phases as retirement, under the
-   * account lock where eligibility is decided:
-   *
-   * 1. re-check eligibility and mark the row set `pruning`, so reads answer as expired and
-   *    no new revision can share its chunks;
-   * 2. delete external objects at their recorded versions, skipping any object another
-   *    row set that is not being pruned still references (chunk sharing);
-   * 3. delete the chunk manifest rows and any PostgreSQL chunk body nothing else
-   *    references, and mark the row set `pruned`.
-   *
-   * A crash after phase 1 leaves a `pruning` row set that the next pass resumes.
-   */
-  async compactSupersededSnapshots(input) {
-    this.assertCompactionSafeRowBindings();
-    positiveInteger(input.statusRetentionDays, "statusRetentionDays");
-    positiveInteger(input.automatedRecoveryWindowSeconds, "automatedRecoveryWindowSeconds");
-    const limit = input.limit ?? 100;
-    positiveInteger(limit, "limit");
-    const holdDays = input.maxFeedHoldDays ?? 7;
-    positiveInteger(holdDays, "maxFeedHoldDays");
-    const tables = await this.optionalTables();
-    if (!tables.has("adcp_reporting_row_sets")) return { compacted: 0, failed: [], failures: [] };
-    const graceSeconds = Math.max(input.automatedRecoveryWindowSeconds, 3600);
-    const eligible = `
-      FROM adcp_reporting_revisions revision
-      JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = revision.obligation_id
-      JOIN adcp_reporting_row_sets row_set
-        ON row_set.row_set_id = revision.revision_id AND row_set.row_set_kind = 'revision'
-      JOIN LATERAL (
-        SELECT MAX(later.created_at) AS created_at FROM adcp_reporting_revisions later
-         WHERE later.supersedes_revision_id = revision.revision_id
-      ) successor ON successor.created_at IS NOT NULL
-      WHERE revision.finality = 'snapshot' AND revision.kind = 'snapshot'
-        AND ($4::text IS NULL OR obligation.account_id = $4)
-        AND ($5::text IS NULL OR revision.revision_id = $5)
-        AND $3::integer > 0
-        AND row_set.row_count > 0
-        AND row_set.rows_state IN ('live', 'unavailable')
-        AND successor.created_at + ($2::bigint * INTERVAL '1 second') <= clock_timestamp()
-        AND NOT EXISTS (
-          SELECT 1 FROM adcp_reporting_revisions current_revision
-           WHERE current_revision.supersedes_revision_id = revision.revision_id
-             AND NOT EXISTS (
-               SELECT 1 FROM adcp_reporting_revisions next_revision
-                WHERE next_revision.supersedes_revision_id = current_revision.revision_id
-             )
-        )
-        AND (obligation.lease_expires_at IS NULL OR obligation.lease_expires_at <= clock_timestamp())
-        AND NOT EXISTS (SELECT 1 FROM adcp_reporting_obligation_tombstones tombstone
-                         WHERE tombstone.obligation_id = obligation.obligation_id)
-        AND (
-          successor.created_at + ($1::integer * INTERVAL '1 day') <= clock_timestamp()
-          OR (
-            NOT EXISTS (
-              SELECT 1 FROM adcp_reporting_consumer_statuses statement
-               WHERE statement.revision_id = revision.revision_id AND statement.is_current
-                 AND COALESCE(statement.data->>'consumer_status', statement.data->'status'->>'consumer_status')
-                     IN ('received', 'unreadable', 'content_mismatch')
-            )
-            ${tables.has("adcp_reporting_receipts") ? `AND NOT EXISTS (
-                     SELECT 1 FROM adcp_reporting_receipts receipt
-                      WHERE receipt.receipt_kind = 'revision' AND receipt.subject_id = revision.revision_id
-                   )` : ""}
-          )
-        )
-        ${tables.has("adcp_reporting_materializations") ? `AND NOT EXISTS (
-                 SELECT 1 FROM adcp_reporting_materializations hold
-                  WHERE hold.revision_id = revision.revision_id AND hold.status = 'pending'
-               )` : ""}
-        ${tables.has("adcp_reporting_changes") && tables.has("adcp_reporting_feed_consumers") ? `AND NOT EXISTS (
-                 SELECT 1 FROM adcp_reporting_changes change
-                   JOIN adcp_reporting_feed_consumers consumer
-                     ON consumer.updated_at > clock_timestamp() - ($3::integer * INTERVAL '1 day')
-                  WHERE change.record_kind = 'revision' AND change.record_id = revision.revision_id
-                    AND ((consumer.account_id IS NULL
-                          AND (change.xid, change.seq) > (consumer.cursor_xid, consumer.cursor_seq))
-                      OR (consumer.account_id = change.account_id AND change.seq > consumer.cursor_seq)))` : ""}`;
-    const baseValues = [input.statusRetentionDays, graceSeconds, holdDays, input.account_id ?? null];
-    const candidates = await this.query(
-      `SELECT revision_id, obligation_id, account_id FROM (
-         SELECT row_set.row_set_id AS revision_id, row_set.obligation_id, row_set.account_id, 0 AS resume,
-                row_set.recorded_at
-           FROM adcp_reporting_row_sets row_set
-          WHERE row_set.row_set_kind = 'revision' AND row_set.rows_state = 'pruning'
-            AND ($4::text IS NULL OR row_set.account_id = $4)
-            AND EXISTS (SELECT 1 FROM adcp_reporting_revisions revision
-                         WHERE revision.revision_id = row_set.row_set_id)
-            AND NOT EXISTS (SELECT 1 FROM adcp_reporting_obligation_tombstones tombstone
-                             WHERE tombstone.obligation_id = row_set.obligation_id)
-         UNION ALL
-         SELECT revision.revision_id, revision.obligation_id, obligation.account_id, 1, row_set.recorded_at
-           ${eligible}
-       ) candidate
-       ORDER BY resume, recorded_at, revision_id
-       LIMIT $6`,
-      [...baseValues, null, limit]
-    );
-    let compacted = 0;
-    const failed = [];
-    const failures = [];
-    for (const candidate of candidates.rows) {
-      input.signal?.throwIfAborted();
-      try {
-        const done = await this.compactSnapshot(
-          candidate.revision_id,
-          candidate.obligation_id,
-          candidate.account_id,
-          eligible,
-          baseValues,
-          input.signal
-        );
-        if (done) compacted += 1;
-      } catch (error) {
-        failed.push(candidate.revision_id);
-        failures.push({
-          reporting_obligation_id: candidate.obligation_id,
-          reporting_revision_id: candidate.revision_id,
-          cause: isReportingRowStoreError(error) ? error.code : error instanceof Error ? error.name : "Error"
-        });
-      }
-    }
-    return { compacted, failed, failures };
-  }
-  async compactSnapshot(revisionId, obligationId, accountId, eligible, baseValues, signal) {
-    const claimed = await this.transaction(
-      async (client) => {
-        const marked = await client.query(
-          `UPDATE adcp_reporting_row_sets SET rows_state = 'pruning', rows_state_changed_at = clock_timestamp()
-            WHERE row_set_id = $5 AND rows_state IN ('live', 'unavailable')
-              AND row_set_id IN (SELECT revision.revision_id ${eligible})`,
-          [...baseValues, revisionId]
-        );
-        if (marked.rowCount === 1) return true;
-        const resumed = await client.query(
-          `SELECT 1 FROM adcp_reporting_row_sets row_set
-            WHERE row_set.row_set_id = $1 AND row_set.rows_state = 'pruning'
-              AND NOT EXISTS (SELECT 1 FROM adcp_reporting_obligation_tombstones tombstone
-                               WHERE tombstone.obligation_id = row_set.obligation_id)`,
-          [revisionId]
-        );
-        return resumed.rows.length === 1;
-      },
-      { preBeginAdvisoryLock: accountLock(accountId) }
-    );
-    if (!claimed) return false;
-    const binding = await this.query(
-      `SELECT row_binding_id FROM adcp_reporting_row_sets WHERE row_set_id = $1`,
-      [revisionId]
-    );
-    if (binding.rows.length === 0) return false;
-    const objects = await this.query(
-      `SELECT DISTINCT chunk.object_ref, chunk.native_version_ref
-         FROM adcp_reporting_row_chunks chunk
-        WHERE chunk.row_set_id = $1 AND chunk.object_ref IS NOT NULL`,
-      [revisionId]
-    );
-    if (objects.rows.length > 0) {
-      await this.deleteUnreferencedObjects(
-        binding.rows[0].row_binding_id,
-        objects.rows.map((row) => ({ objectRef: row.object_ref, nativeVersionRef: row.native_version_ref })),
-        { rowSetId: revisionId },
-        signal
-      );
-    }
-    await this.transaction(
-      async (client) => {
-        const dropped = await client.query(
-          `DELETE FROM adcp_reporting_row_chunks WHERE row_set_id = $1 RETURNING sha256, object_ref`,
-          [revisionId]
-        );
-        const bodies = [...new Set(dropped.rows.filter((row) => row.object_ref === null).map((row) => row.sha256))];
-        if (bodies.length > 0) {
-          await client.query(
-            `DELETE FROM adcp_reporting_chunk_bodies body
-              WHERE body.account_id = $1 AND body.obligation_id = $2 AND body.sha256 = ANY($3::text[])
-                AND NOT EXISTS (
-                  SELECT 1 FROM adcp_reporting_row_chunks other
-                   WHERE other.account_id = body.account_id AND other.obligation_id = body.obligation_id
-                     AND other.sha256 = body.sha256 AND other.object_ref IS NULL
-                )`,
-            [accountId, obligationId, bodies]
-          );
-        }
-        await client.query(
-          `UPDATE adcp_reporting_row_sets SET rows_state = 'pruned', rows_state_changed_at = clock_timestamp()
-            WHERE row_set_id = $1 AND rows_state = 'pruning'`,
-          [revisionId]
-        );
-      },
-      { preBeginAdvisoryLock: accountLock(accountId) }
-    );
-    return true;
-  }
-  /**
-   * Resolve abandoned object uploads (spec §4.3). An expired `open` write
-   * intent whose ledger commit never happened is moved to `sweeping` under
-   * the account lock, so no writer can commit against it, then only the
-   * objects that upload created — never adopted ones, never any object a
-   * committed chunk references — are deleted at their recorded versions.
-   * Interrupted sweeps resume.
-   */
-  async sweepRowWriteIntents(input = {}) {
-    const limit = input.limit ?? 100;
-    positiveInteger(limit, "limit");
-    const overdueAfter = input.overdueAfterSeconds ?? 24 * 3600;
-    positiveInteger(overdueAfter, "overdueAfterSeconds");
-    const tables = await this.optionalTables();
-    if (!tables.has("adcp_reporting_row_write_intents")) {
-      return { swept: 0, objectsDeleted: 0, failed: 0, skippedUnconfigured: 0, deferred: 0, overdue: 0 };
-    }
-    const configured = this.rowStorage.objectBindingIds();
-    const due = `($1::text IS NULL OR account_id = $1) AND (state = 'sweeping' OR expires_at <= clock_timestamp())`;
-    const expired = await this.query(
-      `SELECT row_binding_id, account_id, row_set_id, content_sha256 FROM adcp_reporting_row_write_intents
-        WHERE ${due}
-          AND (next_sweep_at IS NULL OR next_sweep_at <= clock_timestamp())
-          AND (row_binding_id = ANY($2::text[]) OR created_objects = '[]'::jsonb)
-        ORDER BY sweep_attempts, expires_at LIMIT $3`,
-      [input.account_id ?? null, configured, limit]
-    );
-    let swept = 0;
-    let objectsDeleted = 0;
-    let failed = 0;
-    for (const intent of expired.rows) {
-      input.signal?.throwIfAborted();
-      const key = [intent.row_binding_id, intent.row_set_id, intent.content_sha256];
-      try {
-        const claimed = await this.transaction(
-          async (client) => {
-            const updated = await client.query(
-              `UPDATE adcp_reporting_row_write_intents SET state = 'sweeping'
-                WHERE row_binding_id = $1 AND row_set_id = $2 AND content_sha256 = $3
-                  AND (state = 'sweeping' OR expires_at <= clock_timestamp())
-                RETURNING created_objects`,
-              key
-            );
-            return updated.rows[0]?.created_objects.map((object) => ({
-              objectRef: object.object_ref ?? object.objectKey,
-              nativeVersionRef: object.native_version_ref ?? object.nativeVersion
-            })).filter(
-              (object) => typeof object.objectRef === "string" && typeof object.nativeVersionRef === "string"
-            );
-          },
-          { preBeginAdvisoryLock: accountLock(intent.account_id) }
-        );
-        if (!claimed) continue;
-        const deleted = await this.deleteUnreferencedObjects(intent.row_binding_id, claimed, {}, input.signal);
-        await this.query(
-          `DELETE FROM adcp_reporting_row_write_intents
-            WHERE row_binding_id = $1 AND row_set_id = $2 AND content_sha256 = $3 AND state = 'sweeping'`,
-          key
-        );
-        swept += 1;
-        objectsDeleted += deleted;
-      } catch {
-        failed += 1;
-        if (!input.signal?.aborted) {
-          await this.query(
-            `UPDATE adcp_reporting_row_write_intents
-                SET sweep_attempts = sweep_attempts + 1,
-                    next_sweep_at = clock_timestamp() + ${backoffIntervalSql("sweep_attempts + 1")}
-              WHERE row_binding_id = $1 AND row_set_id = $2 AND content_sha256 = $3`,
-            key
-          ).catch(() => void 0);
-        }
-      }
-    }
-    const backlog = (await this.query(
-      `SELECT count(*) FILTER (WHERE row_binding_id <> ALL($2::text[]) AND created_objects <> '[]'::jsonb) AS skipped,
-                count(*) FILTER (WHERE (row_binding_id = ANY($2::text[]) OR created_objects = '[]'::jsonb)
-                                   AND next_sweep_at > clock_timestamp()) AS deferred,
-                count(*) FILTER (WHERE expires_at <= clock_timestamp() - ($3::integer * INTERVAL '1 second')) AS overdue
-           FROM adcp_reporting_row_write_intents
-          WHERE ${due}`,
-      [input.account_id ?? null, configured, overdueAfter]
-    )).rows[0];
-    return {
-      swept,
-      objectsDeleted,
-      failed,
-      skippedUnconfigured: Number(backlog.skipped),
-      deferred: Number(backlog.deferred),
-      overdue: Number(backlog.overdue)
-    };
-  }
-  /**
-   * Delete external row objects, skipping any object another row set still references.
-   *
-   * Object keys are unique per row set (every writable template includes `{revision_key}`), but header-only
-   * revisions share chunks within an obligation and rows written under an older template can name one
-   * object from several row sets. An object is therefore deleted only when no
-   * chunk of a live (or unavailable) row set outside this operation references the same binding,
-   * key and native version, and no other open write intent created it. Row sets already `pruning`
-   * or `pruned` do not count: their own operation deletes the object, and counting them would let
-   * two concurrent retirements each skip the object and leak it. `scope` names what this
-   * operation is deleting: an obligation (retirement) or a row set (compaction).
-   *
-   * The check and the provider delete run in one transaction under a per-object advisory lock.
-   * A commit that adopts an existing object takes the same lock before it inserts its chunk rows
-   * and re-verifies the object under it (`writePreparedRowSet`), and holds it until commit. So
-   * either the delete wins the lock and the adopting commit then fails cleanly, or the commit wins
-   * and the delete sees its chunk rows and skips. A skipped object stays for the row set that owns
-   * it: that row set's own retirement, compaction or sweep deletes it, because by then nothing
-   * else references it. Locks are taken one object at a time, never while waiting on the account
-   * lock, so commits (account lock, then object locks) cannot deadlock with these deletes.
-   */
-  async deleteUnreferencedObjects(bindingId, objects, scope, signal) {
-    let deleted = 0;
-    for (const object of objects) {
-      signal?.throwIfAborted();
-      const removed = await this.transaction(async (client) => {
-        await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
-          objectLock(bindingId, object.objectRef)
-        ]);
-        const referenced = await client.query(
-          `(SELECT 1 FROM adcp_reporting_row_chunks chunk
-              JOIN adcp_reporting_row_sets row_set ON row_set.row_set_id = chunk.row_set_id
-             WHERE row_set.row_binding_id = $1 AND chunk.object_ref = $2 AND chunk.native_version_ref = $3
-               AND row_set.rows_state IN ('live', 'unavailable')
-               AND ($4::text IS NULL OR chunk.obligation_id <> $4)
-               AND ($5::text IS NULL OR chunk.row_set_id <> $5)
-             LIMIT 1)
-           UNION ALL
-           (SELECT 1 FROM adcp_reporting_row_write_intents intent
-             WHERE intent.row_binding_id = $1 AND intent.state = 'open'
-               AND (intent.created_objects @> $6::jsonb OR intent.created_objects @> $7::jsonb)
-             LIMIT 1)`,
-          [
-            bindingId,
-            object.objectRef,
-            object.nativeVersionRef,
-            scope.obligationId ?? null,
-            scope.rowSetId ?? null,
-            JSON.stringify([{ object_ref: object.objectRef, native_version_ref: object.nativeVersionRef }]),
-            // An older writer still running during a rolling upgrade records the pre-alignment keys.
-            JSON.stringify([{ objectKey: object.objectRef, nativeVersion: object.nativeVersionRef }])
-          ]
-        );
-        if (referenced.rows.length > 0) return false;
-        await this.rowStorage.deleteObjects(bindingId, [object], signal);
-        return true;
-      });
-      if (removed) deleted += 1;
-    }
-    return deleted;
-  }
-  async optionalTables() {
-    const result = await this.query(
-      `SELECT table_name AS name FROM information_schema.tables
-        WHERE table_schema = current_schema()
-          AND table_name IN ('adcp_reporting_row_sets', 'adcp_reporting_row_write_intents',
-                             'adcp_reporting_materializations', 'adcp_reporting_changes',
-                             'adcp_reporting_feed_consumers', 'adcp_reporting_receipts')`
-    );
-    return new Set(result.rows.map((row) => row.name));
-  }
-  /**
-   * Upload an object-kind row set before its ledger commit (spec §3.5):
-   * skip when the document already exists (replay), refuse unless the lease
-   * still covers the upload deadline, open or take over an expired write
-   * intent under the account lock, then write every chunk create-only,
-   * recording each object this upload created in the intent first.
-   */
-  async uploadRowSetUnlessCommitted(prepared, lease, table, idColumn) {
-    const { input } = prepared;
-    const committed = await this.query(`SELECT 1 FROM ${table} WHERE ${idColumn} = $1`, [input.rowSetId]);
-    if (committed.rows.length > 0) return void 0;
-    const shared = await this.rowStorage.findShareable(this.pool, prepared);
-    if (shared) return { locators: shared.locators, sharedFrom: shared.rowSetId };
-    const ownerToken = reportingRowWriteIntentIdV1();
-    const budget = this.rowStorage.writeDeadlineMilliseconds;
-    const intentKey = [prepared.bindingId, input.rowSetId, input.binding.sha256];
-    await this.transaction(
-      async (client) => {
-        const opened = await client.query(
-          `INSERT INTO adcp_reporting_row_write_intents
-             (row_binding_id, account_id, row_set_id, content_sha256, state, owner_token, expires_at)
-           SELECT $1, $2, $3, $4, 'open', $5, obligation.lease_expires_at + ($6::bigint * INTERVAL '1 millisecond')
-             FROM adcp_reporting_obligations obligation
-            WHERE obligation.obligation_id = $7 AND obligation.lease_owner = $8
-              AND obligation.lease_generation = $9
-              AND obligation.lease_expires_at - clock_timestamp() >= (($6::bigint + 5000) * INTERVAL '1 millisecond')
-           ON CONFLICT (row_binding_id, row_set_id, content_sha256) DO UPDATE
-              SET owner_token = EXCLUDED.owner_token, expires_at = EXCLUDED.expires_at
-            WHERE adcp_reporting_row_write_intents.state = 'open'
-              AND adcp_reporting_row_write_intents.expires_at <= clock_timestamp()
-           RETURNING owner_token`,
-          [
-            prepared.bindingId,
-            input.accountId,
-            input.rowSetId,
-            input.binding.sha256,
-            ownerToken,
-            budget,
-            input.obligationId,
-            lease.owner,
-            lease.generation
-          ]
-        );
-        if (opened.rows.length === 1) return;
-        const held = await client.query(
-          `SELECT lease_expires_at - clock_timestamp() >= (($4::bigint + 5000) * INTERVAL '1 millisecond') AS budget
-             FROM adcp_reporting_obligations
-            WHERE obligation_id = $1 AND lease_owner = $2 AND lease_generation = $3
-              AND lease_expires_at > clock_timestamp()`,
-          [input.obligationId, lease.owner, lease.generation, budget]
-        );
-        if (held.rows.length === 0) throw new ReportingLedgerLeaseLostError();
-        if (!held.rows[0].budget) {
-          throw new ReportingRowStoreError("DEADLINE_EXCEEDED", "the lease does not cover the row upload deadline");
-        }
-        throw new ReportingRowStoreError("STATE_UNAVAILABLE", "another writer holds this row upload");
-      },
-      { preBeginAdvisoryLock: accountLock(input.accountId) }
-    );
-    const locators = await this.rowStorage.upload(prepared, ownerToken, async (object) => {
-      const recorded = await this.query(
-        `UPDATE adcp_reporting_row_write_intents
-            SET created_objects = created_objects || $5::jsonb
-          WHERE row_binding_id = $1 AND row_set_id = $2 AND content_sha256 = $3
-            AND owner_token = $4 AND state = 'open'`,
-        [
-          ...intentKey,
-          ownerToken,
-          JSON.stringify([{ object_ref: object.objectRef, native_version_ref: object.nativeVersionRef }])
-        ]
-      );
-      if (recorded.rowCount !== 1) {
-        throw new ReportingRowStoreError("STATE_UNAVAILABLE", "the row upload intent was taken over or swept");
-      }
-    });
-    return { locators, ownerToken };
-  }
-  /** Persist a prepared row set and close its upload intent in the ledger commit transaction. */
-  async writePreparedRowSet(client, prepared, upload) {
-    if (prepared.binding.kind === "postgres") {
-      const shared = await this.rowStorage.findShareable(client, prepared);
-      await this.rowStorage.writeInTransaction(client, prepared, void 0, shared?.rowSetId);
-      return;
-    }
-    if (!upload) throw new ReportingRowStoreError("STATE_UNAVAILABLE", "object rows were not uploaded");
-    if (upload.sharedFrom) {
-      const live = await client.query(
-        `SELECT 1 FROM adcp_reporting_row_sets WHERE row_set_id = $1 AND rows_state = 'live' FOR SHARE`,
-        [upload.sharedFrom]
-      );
-      if (live.rows.length !== 1) {
-        throw new ReportingRowStoreError("STATE_UNAVAILABLE", "the shared row set is no longer live");
-      }
-    } else {
-      const closed = await client.query(
-        `DELETE FROM adcp_reporting_row_write_intents
-          WHERE row_binding_id = $1 AND row_set_id = $2 AND content_sha256 = $3
-            AND owner_token = $4 AND state = 'open'`,
-        [prepared.bindingId, prepared.input.rowSetId, prepared.input.binding.sha256, upload.ownerToken]
-      );
-      if (closed.rowCount !== 1) {
-        throw new ReportingRowStoreError("STATE_UNAVAILABLE", "the row upload intent was taken over or swept");
-      }
-    }
-    if (!upload.sharedFrom) {
-      const adopted = upload.locators.filter((locator) => !locator.created).sort((left, right) => left.objectRef < right.objectRef ? -1 : left.objectRef > right.objectRef ? 1 : 0);
-      for (const locator of adopted) {
-        await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
-          objectLock(prepared.bindingId, locator.objectRef)
-        ]);
-      }
-      if (adopted.length > 0) await this.rowStorage.assertObjectsPresent(prepared.bindingId, adopted);
-    }
-    await this.rowStorage.writeInTransaction(client, prepared, upload.locators, upload.sharedFrom);
-  }
-  /** Attach verified rows to a revision document whose rows live in row storage. */
-  async hydrateRevision(revision, accountId) {
-    if (Array.isArray(revision.rows)) return revision;
-    const handle = await this.rowStorage.find(revision.reporting_revision_id, accountId);
-    if (!handle) throw new ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "revision rows are not recorded");
-    if (handle.contentSha256 !== revision.binding.sha256 || handle.rowCount !== revision.binding.rowCount) {
-      throw new ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "row set does not match the revision binding");
-    }
-    return { ...revision, rows: await this.rowStorage.readAll(handle, revision.wireRevision.control_totals) };
-  }
-  async listAdjustmentMetadata(obligationId) {
-    const result = await this.query(
-      `SELECT data - 'rows' AS data FROM adcp_reporting_adjustments WHERE obligation_id = $1
-        ORDER BY adjustment_number, adjustment_id`,
-      [obligationId]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async putConsumerStatus(status) {
-    const obligation = await this.getObligation(status.reporting_obligation_id);
-    if (!obligation) throw new Error("Reporting consumer status obligation is unavailable");
-    return this.putImmutable(
-      `INSERT INTO adcp_reporting_consumer_statuses
-         (account_id, consumer_id, consumer_status_id, chain_key, revision_id, obligation_id,
-          supersedes_consumer_status_id, is_current, semantic_fingerprint, data, created_at)
-       SELECT $1, '__legacy_unscoped_consumer__', $2, $3, $4, $5, $6, true, $7, $8::jsonb, $9
-       WHERE NOT EXISTS (
-         SELECT 1 FROM adcp_reporting_consumer_statuses
-          WHERE consumer_id = '__legacy_unscoped_consumer__' AND consumer_status_id = $2
-       )
-       ON CONFLICT DO NOTHING RETURNING data`,
-      [
-        obligation.account.account_id,
-        status.consumerStatusId,
-        `legacy:${status.consumerStatusId}`,
-        status.reporting_revision_id,
-        status.reporting_obligation_id,
-        status.supersedesConsumerStatusId ?? null,
-        digest(status),
-        JSON.stringify(status),
-        status.createdAt
-      ],
-      `SELECT data FROM adcp_reporting_consumer_statuses
-        WHERE consumer_id = '__legacy_unscoped_consumer__' AND consumer_status_id = $1
-        ORDER BY created_at LIMIT 1`,
-      [status.consumerStatusId],
-      status,
-      (value) => digest(value),
-      `adcp-reporting-legacy-consumer-status:${status.consumerStatusId}`
-    );
-  }
-  async getConsumerStatusBatchReplay(input) {
-    const batch = await this.query(
-      `SELECT request_fingerprint, results FROM adcp_reporting_consumer_status_batches
-       WHERE account_id = $1 AND consumer_id = $2 AND idempotency_key = $3`,
-      [input.account_id, input.consumerId, input.idempotencyKey]
-    );
-    if (!batch.rows[0]) return null;
-    if (batch.rows[0].request_fingerprint !== input.requestFingerprint) {
-      throw new ReportingConsumerStatusConflictError("Reporting status idempotency key was reused");
-    }
-    const replay = [];
-    for (const result of batch.rows[0].results) {
-      if (result.kind === "failed") {
-        replay.push({
-          inserted: false,
-          reporting_status_id: result.id,
-          errorCode: result.errorCode ?? "VALIDATION_ERROR",
-          recovery: result.recovery,
-          retryAfterSeconds: result.retryAfterSeconds,
-          safeMessage: boundedConsumerStatusSafeMessage(result.safeMessage ?? "Reporting consumer status was rejected"),
-          ...boundedConsumerStatusErrorField(result.errorField),
-          ...boundedConsumerStatusErrorKeyword(result.errorKeyword)
-        });
-        continue;
-      }
-      const row = await this.query(
-        `SELECT data FROM adcp_reporting_consumer_statuses
-         WHERE consumer_status_id = $1 AND account_id = $2 AND consumer_id = $3`,
-        [result.id, input.account_id, input.consumerId]
-      );
-      if (!row.rows[0]) throw new ReportingConsumerStatusConflictError("Reporting status replay is unavailable");
-      replay.push({ inserted: result.kind === "recorded", value: clone(row.rows[0].data) });
-    }
-    return replay;
-  }
-  async syncConsumerStatusBatch(input) {
-    return this.transaction(
-      async (client) => {
-        const priorBatch = await client.query(
-          `SELECT request_fingerprint, results FROM adcp_reporting_consumer_status_batches
-           WHERE account_id = $1 AND consumer_id = $2 AND idempotency_key = $3`,
-          [input.account_id, input.consumerId, input.idempotencyKey]
-        );
-        if (priorBatch.rows[0]) {
-          if (priorBatch.rows[0].request_fingerprint !== input.requestFingerprint) {
-            throw new ReportingConsumerStatusConflictError("Reporting status idempotency key was reused");
-          }
-          const replay = [];
-          for (const result of priorBatch.rows[0].results) {
-            if (result.kind === "failed") {
-              replay.push({
-                inserted: false,
-                reporting_status_id: result.id,
-                errorCode: result.errorCode ?? "VALIDATION_ERROR",
-                recovery: result.recovery,
-                retryAfterSeconds: result.retryAfterSeconds,
-                safeMessage: boundedConsumerStatusSafeMessage(
-                  result.safeMessage ?? "Reporting consumer status was rejected"
-                ),
-                ...boundedConsumerStatusErrorField(result.errorField),
-                ...boundedConsumerStatusErrorKeyword(result.errorKeyword)
-              });
-              continue;
-            }
-            const row = await client.query(
-              `SELECT data FROM adcp_reporting_consumer_statuses
-               WHERE consumer_status_id = $1 AND account_id = $2 AND consumer_id = $3`,
-              [result.id, input.account_id, input.consumerId]
-            );
-            if (!row.rows[0]) throw new ReportingConsumerStatusConflictError("Reporting status replay is unavailable");
-            replay.push({
-              inserted: input.replayOriginalResults !== false && result.kind === "recorded",
-              value: clone(row.rows[0].data)
-            });
-          }
-          return replay;
-        }
-        const normalizedIds = normalizeReportingConsumerStatusIdsV1(input.entries);
-        const chainKeys = input.entries.map(
-          (entry) => "status" in entry ? reportingConsumerStatusChainKeyV1(entry.status) : entry.chainIdentity ? reportingConsumerStatusChainKeyFromIdentityV1(entry.chainIdentity) : null
-        );
-        const duplicateChains = new Set(
-          chainKeys.filter(
-            (value, index) => value !== null && (chainKeys.indexOf(value) !== index || chainKeys.lastIndexOf(value) !== index)
-          )
-        );
-        const duplicateStatusIds = new Set(
-          normalizedIds.values.filter((_, index) => !normalizedIds.invalidIndexes.has(index)).filter((value, index, values) => values.indexOf(value) !== index || values.lastIndexOf(value) !== index)
-        );
-        const capacity = await client.query(
-          `SELECT
-             (SELECT COUNT(*) FROM adcp_reporting_consumer_status_batches
-               WHERE account_id = $1 AND consumer_id = $2)::text AS batches,
-             (SELECT COUNT(*) FROM adcp_reporting_consumer_statuses
-               WHERE account_id = $1 AND consumer_id = $2)::text AS statuses`,
-          [input.account_id, input.consumerId]
-        );
-        const batchCapacityExhausted = Number(capacity.rows[0]?.batches ?? 0) >= MAX_CONSUMER_STATUS_BATCHES;
-        let remainingStatements = MAX_CONSUMER_STATUS_STATEMENTS - Number(capacity.rows[0]?.statuses ?? 0);
-        const results = [];
-        const storedResults = [];
-        const fail = (statusId, errorCode, safeMessage, errorField, recovery = getErrorRecovery(errorCode) ?? DEFAULT_UNKNOWN_ERROR_RECOVERY, errorKeyword, retryAfterSeconds) => {
-          const boundedErrorField = boundedConsumerStatusErrorField(errorField);
-          const boundedErrorKeyword = boundedConsumerStatusErrorKeyword(errorKeyword);
-          const boundedSafeMessage = boundedConsumerStatusSafeMessage(safeMessage);
-          results.push({
-            inserted: false,
-            reporting_status_id: statusId,
-            errorCode,
-            recovery,
-            retryAfterSeconds,
-            safeMessage: boundedSafeMessage,
-            ...boundedErrorField,
-            ...boundedErrorKeyword
-          });
-          storedResults.push({
-            kind: "failed",
-            id: statusId,
-            errorCode,
-            recovery,
-            retryAfterSeconds,
-            safeMessage: boundedSafeMessage,
-            ...boundedErrorField,
-            ...boundedErrorKeyword
-          });
-        };
-        for (const [index, entry] of input.entries.entries()) {
-          const statusId = normalizedIds.values[index];
-          if (normalizedIds.invalidIndexes.has(index)) {
-            fail(statusId, "VALIDATION_ERROR", "reporting_status_id is invalid", void 0, "correctable", "pattern");
-            continue;
-          }
-          if (duplicateStatusIds.has(statusId)) {
-            fail(statusId, "VALIDATION_ERROR", "reporting_status_id must be unique in a batch");
-            continue;
-          }
-          if (!("status" in entry)) {
-            fail(
-              statusId,
-              "VALIDATION_ERROR",
-              entry.validationError,
-              entry.validationField,
-              "correctable",
-              entry.validationKeyword
-            );
-            continue;
-          }
-          const status = entry.status;
-          if (duplicateChains.has(chainKeys[index])) {
-            fail(status.reporting_status_id, "VALIDATION_ERROR", "A batch may update each status chain only once");
-            continue;
-          }
-          if (status.account_id !== input.account_id || status.consumerId !== input.consumerId) {
-            fail(status.reporting_status_id, "PERMISSION_DENIED", "Reporting status scope is unavailable");
-            continue;
-          }
-          const fingerprint = reportingConsumerStatusFingerprintV1(status);
-          const existing = await client.query(
-            `SELECT data, semantic_fingerprint, account_id, consumer_id FROM adcp_reporting_consumer_statuses
-             WHERE consumer_status_id = $1 AND account_id = $2 AND consumer_id = $3 FOR UPDATE`,
-            [status.reporting_status_id, input.account_id, input.consumerId]
-          );
-          if (existing.rows[0]) {
-            if (existing.rows[0].semantic_fingerprint !== fingerprint) {
-              fail(status.reporting_status_id, "IDEMPOTENCY_CONFLICT", "reporting_status_id is unavailable");
-              continue;
-            }
-            results.push({ inserted: false, value: clone(existing.rows[0].data) });
-            storedResults.push({ kind: "unchanged", id: status.reporting_status_id });
-            continue;
-          }
-          const prevalidation = entry.validationError;
-          if (prevalidation) {
-            fail(
-              status.reporting_status_id,
-              "VALIDATION_ERROR",
-              prevalidation,
-              entry.validationField,
-              "correctable",
-              entry.validationKeyword
-            );
-            continue;
-          }
-          if (Buffer.byteLength(JSON.stringify(status), "utf8") > REPORTING_CONSUMER_STATUS_MAX_BYTES) {
-            fail(
-              status.reporting_status_id,
-              "REPORTING_STATUS_TOO_LARGE",
-              "Reporting consumer status exceeds 64 KiB",
-              void 0,
-              "correctable"
-            );
-            continue;
-          }
-          if (batchCapacityExhausted || remainingStatements <= 0) {
-            fail(
-              status.reporting_status_id,
-              "REPORTING_STATUS_CAPACITY_EXHAUSTED",
-              "Reporting consumer status capacity is exhausted",
-              void 0,
-              "terminal"
-            );
-            continue;
-          }
-          const chainKey = chainKeys[index];
-          const current = await client.query(
-            `SELECT data FROM adcp_reporting_consumer_statuses
-             WHERE account_id = $1 AND consumer_id = $2 AND chain_key = $3 AND is_current
-             FOR UPDATE`,
-            [input.account_id, input.consumerId, chainKey]
-          );
-          const leaf = current.rows[0]?.data;
-          if ((leaf?.reporting_status_id ?? void 0) !== status.supersedes_reporting_status_id) {
-            fail(status.reporting_status_id, "IDEMPOTENCY_CONFLICT", "Status must supersede the exact current leaf");
-            continue;
-          }
-          if (leaf && compareReportingInstants(status.status_as_of, leaf.status_as_of) < 0) {
-            fail(status.reporting_status_id, "VALIDATION_ERROR", "Status time cannot regress");
-            continue;
-          }
-          if (leaf) {
-            await client.query(
-              `UPDATE adcp_reporting_consumer_statuses SET is_current = false
-               WHERE consumer_status_id = $1 AND account_id = $2 AND consumer_id = $3`,
-              [leaf.reporting_status_id, input.account_id, input.consumerId]
-            );
-          }
-          const recorded = await client.query(
-            `SELECT GREATEST(
-               clock_timestamp(),
-               COALESCE((
-                 SELECT MAX(ledger_as_of) + INTERVAL '1 millisecond'
-                 FROM adcp_reporting_checkpoints
-                 WHERE account_id = $1
-               ), '-infinity'::timestamptz)
-             ) AS recorded_at`,
-            [input.account_id]
-          );
-          const value = {
-            ...status,
-            recorded_at: recorded.rows[0].recorded_at.toISOString()
-          };
-          await client.query(
-            `INSERT INTO adcp_reporting_consumer_statuses
-             (consumer_status_id, account_id, consumer_id, chain_key, revision_id, obligation_id,
-              supersedes_consumer_status_id, is_current, semantic_fingerprint, data, created_at, recorded_at)
-             VALUES ($1, $2, $3, $4, $5, $6, $7, true, $8, $9::jsonb, $10, $10)`,
-            [
-              status.reporting_status_id,
-              input.account_id,
-              input.consumerId,
-              chainKey,
-              status.reporting_revision_id ?? null,
-              status.reporting_obligation_id ?? null,
-              status.supersedes_reporting_status_id ?? null,
-              fingerprint,
-              JSON.stringify(value),
-              value.recorded_at
-            ]
-          );
-          results.push({ inserted: true, value: clone(value) });
-          storedResults.push({ kind: "recorded", id: status.reporting_status_id });
-          remainingStatements -= 1;
-        }
-        boundStoredConsumerStatusResults(storedResults, results);
-        if (!batchCapacityExhausted) {
-          await client.query(
-            `INSERT INTO adcp_reporting_consumer_status_batches
-           (account_id, consumer_id, idempotency_key, request_fingerprint, status_ids, results)
-           VALUES ($1, $2, $3, $4, $5::jsonb, $6::jsonb)`,
-            [
-              input.account_id,
-              input.consumerId,
-              input.idempotencyKey,
-              input.requestFingerprint,
-              JSON.stringify(
-                results.map((value) => "value" in value ? value.value.reporting_status_id : value.reporting_status_id)
-              ),
-              JSON.stringify(storedResults)
-            ]
-          );
-        }
-        return results;
-      },
-      { preBeginAdvisoryLock: accountLock(input.account_id) }
-    );
-  }
-  async listConsumerStatuses(revisionId) {
-    const result = await this.query(
-      `SELECT data FROM adcp_reporting_consumer_statuses WHERE revision_id = $1
-        AND consumer_id = '__legacy_unscoped_consumer__'
-        ORDER BY recorded_at, consumer_status_id`,
-      [revisionId]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async putIssue(issue) {
-    const lock = await this.accountLockForObligation(issue.reporting_obligation_id);
-    await this.transaction(
-      async (client) => {
-        const result = await client.query(
-          `INSERT INTO adcp_reporting_issues (issue_id, obligation_id, data, observed_at, resolved_at)
-       VALUES ($1, $2, $3::jsonb, $4, $5)
-       -- opened_at is fixed at first emission; see recordIssue.
-       ON CONFLICT (issue_id) DO UPDATE SET
-         data = jsonb_set(EXCLUDED.data, '{openedAt}', COALESCE(adcp_reporting_issues.data -> 'openedAt', EXCLUDED.data -> 'openedAt')),
-         observed_at = EXCLUDED.observed_at,
-         resolved_at = EXCLUDED.resolved_at,
-         changed_at = clock_timestamp()
-       WHERE adcp_reporting_issues.obligation_id = EXCLUDED.obligation_id`,
-          [
-            issue.issueId,
-            issue.reporting_obligation_id,
-            JSON.stringify(issue),
-            issue.observedAt,
-            issue.resolvedAt ?? null
-          ]
-        );
-        if (result.rowCount !== 1) throw new Error("Reporting issue identity belongs to another obligation");
-      },
-      { preBeginAdvisoryLock: lock }
-    );
-  }
-  async resolveIssue(issueId, resolvedAt) {
-    const lock = await this.accountLockForIssue(issueId);
-    if (!lock) return;
-    await this.transaction(
-      async (client) => {
-        await client.query(
-          `UPDATE adcp_reporting_issues
-          SET resolved_at = $2::text::timestamptz,
-              data = data || jsonb_build_object('resolvedAt', $2::text),
-              changed_at = clock_timestamp()
-        WHERE issue_id = $1 AND resolved_at IS NULL`,
-          [issueId, resolvedAt]
-        );
-      },
-      { preBeginAdvisoryLock: lock }
-    );
-  }
-  async listIssues(obligationId) {
-    const result = await this.query(
-      `SELECT data FROM adcp_reporting_issues WHERE obligation_id = $1
-        ORDER BY observed_at, issue_id`,
-      [obligationId]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  /**
-   * Resolves — and for pre-SDK-14 rows persists — the observed finality baseline
-   * of the obligation's latest transition, so the lifecycle decision and this
-   * store's compare-and-set read one committed value.
-   */
-  async resolveTransitionFinalityBaseline(obligationId) {
-    const lock = await this.accountLockForObligation(obligationId);
-    return this.transaction((client) => resolveStoredFinalityBaseline(client, obligationId), {
-      preBeginAdvisoryLock: lock
-    });
-  }
-  async appendTransition(transition) {
-    const lock = await this.accountLockForObligation(transition.reporting_obligation_id);
-    return assertFinalityWriterFence(() => this.appendTransitionWithinLock(transition, lock));
-  }
-  async appendTransitionWithinLock(transition, lock) {
-    return this.transaction(
-      async (client) => {
-        if (this.notificationActivityPort) {
-          await assertNoLegacyPendingTransitions(client, transition.reporting_obligation_id);
-        }
-        const previousFinality = await resolveStoredFinalityBaseline(client, transition.reporting_obligation_id);
-        const latest = await client.query(
-          `SELECT data->>'health' AS health FROM adcp_reporting_transitions
-            WHERE obligation_id = $1 ORDER BY transition_sequence DESC LIMIT 1`,
-          [transition.reporting_obligation_id]
-        );
-        if ((latest.rows[0]?.health ?? "waiting") !== transition.previousHealth || transition.previousFinality !== void 0 && previousFinality !== transition.previousFinality) {
-          return { inserted: false };
-        }
-        const storedTransition = this.notificationActivityPort ? { ...transition, notifiedAt: transition.occurredAt } : transition;
-        const result = await client.query(
-          `INSERT INTO adcp_reporting_transitions (transition_id, obligation_id, data, occurred_at)
-           VALUES ($1, $2, $3::jsonb, $4)
-           ON CONFLICT DO NOTHING RETURNING transition_id`,
-          [
-            transition.transitionId,
-            transition.reporting_obligation_id,
-            JSON.stringify(storedTransition),
-            transition.occurredAt
-          ]
-        );
-        if (result.rowCount === 1 && this.notificationActivityPort) {
-          const obligation = await client.query(
-            "SELECT data FROM adcp_reporting_obligations WHERE obligation_id = $1",
-            [transition.reporting_obligation_id]
-          );
-          if (!obligation.rows[0]) throw new Error("Reporting obligation is unavailable");
-          await this.notificationActivityPort.recordTransition(
-            { transition, obligation: obligation.rows[0].data },
-            client
-          );
-        }
-        return { inserted: result.rowCount === 1 };
-      },
-      { preBeginAdvisoryLock: lock }
-    );
-  }
-  async applyLifecycleProjection(input) {
-    const lock = await this.accountLockForObligation(input.reporting_obligation_id);
-    return assertFinalityWriterFence(() => this.applyLifecycleProjectionWithinLock(input, lock));
-  }
-  async applyLifecycleProjectionWithinLock(input, lock) {
-    return this.transaction(
-      async (client) => {
-        const obligations = await client.query(
-          `SELECT data FROM adcp_reporting_obligations WHERE obligation_id = $1 FOR UPDATE`,
-          [input.reporting_obligation_id]
-        );
-        if (this.notificationActivityPort) {
-          await assertNoLegacyPendingTransitions(client, input.reporting_obligation_id);
-        }
-        const previousFinality = await resolveStoredFinalityBaseline(client, input.reporting_obligation_id);
-        const revisions = await client.query(
-          `SELECT revision_id FROM adcp_reporting_revisions
-            WHERE obligation_id = $1 ORDER BY revision_number, revision_id`,
-          [input.reporting_obligation_id]
-        );
-        const latest = await client.query(
-          `SELECT data->>'health' AS health FROM adcp_reporting_transitions
-            WHERE obligation_id = $1 ORDER BY transition_sequence DESC LIMIT 1`,
-          [input.reporting_obligation_id]
-        );
-        const revisionIds = revisions.rows.map((value) => value.revision_id);
-        const previousHealth = latest.rows[0]?.health ?? "waiting";
-        const obligation = obligations.rows[0]?.data;
-        if (!obligation || obligation.state !== input.expectedObligationState || obligation.attemptCount !== input.expectedAttemptCount || canonicalJsonV1(revisionIds) !== canonicalJsonV1(input.expectedRevisionIds) || previousHealth !== input.expectedPreviousHealth || input.expectedPreviousFinality !== void 0 && previousFinality !== input.expectedPreviousFinality) {
-          return { applied: false, transitionInserted: false };
-        }
-        if (input.expectedManagedStateVersion !== void 0 && await this.readManagedStateVersion(client, input.reporting_obligation_id) !== input.expectedManagedStateVersion) {
-          return { applied: false, transitionInserted: false };
-        }
-        if (input.expectedObligatedConsumerRosterVersion !== void 0) {
-          const state = await client.query(
-            `SELECT current_roster_version FROM adcp_reporting_lifecycle_state
-              WHERE obligation_id = $1 FOR UPDATE`,
-            [input.reporting_obligation_id]
-          );
-          const observed = state.rows[0]?.current_roster_version;
-          if (observed !== void 0 && observed !== input.expectedObligatedConsumerRosterVersion) {
-            return { applied: false, transitionInserted: false };
-          }
-        }
-        let transitionInserted = false;
-        if (input.transition) {
-          const storedTransition = this.notificationActivityPort ? { ...input.transition, notifiedAt: input.ledgerAsOf } : input.transition;
-          const inserted = await client.query(
-            `INSERT INTO adcp_reporting_transitions (transition_id, obligation_id, data, occurred_at)
-             VALUES ($1, $2, $3::jsonb, $4)
-             ON CONFLICT DO NOTHING RETURNING transition_id`,
-            [
-              input.transition.transitionId,
-              input.reporting_obligation_id,
-              JSON.stringify(storedTransition),
-              input.transition.occurredAt
-            ]
-          );
-          if (inserted.rowCount !== 1) return { applied: false, transitionInserted: false };
-          transitionInserted = true;
-          if (this.notificationActivityPort) {
-            await this.notificationActivityPort.recordTransition({ transition: input.transition, obligation }, client);
-          }
-        }
-        {
-          await client.query(
-            `INSERT INTO adcp_reporting_lifecycle_state
-               (obligation_id, processed_state_version, processed_roster_version,
-                current_roster_version, processed_at)
-             VALUES ($1, $2, $3, $3, LEAST($4::timestamptz, clock_timestamp()))
-             ON CONFLICT (obligation_id) DO UPDATE SET
-               processed_state_version = EXCLUDED.processed_state_version,
-               processed_roster_version = EXCLUDED.processed_roster_version,
-               -- Reconciling also observes the roster, so the current version
-               -- moves with the processed one. A later external change
-               -- publishes a different current version and re-arms; without
-               -- this the two never matched and the obligation stayed due.
-               -- Never over a version this reconcile did not observe: if the
-               -- row was created or advanced after the check above, that
-               -- newer observation is what has to survive, or its re-arm is
-               -- silently dropped.
-               current_roster_version = CASE
-                 WHEN $5::text IS NOT NULL
-                  AND adcp_reporting_lifecycle_state.current_roster_version IS DISTINCT FROM $5::text
-                 THEN adcp_reporting_lifecycle_state.current_roster_version
-                 ELSE EXCLUDED.processed_roster_version END,
-               processed_at = EXCLUDED.processed_at,
-               failure_count = 0,
-               next_attempt_at = NULL`,
-            [
-              input.reporting_obligation_id,
-              input.processedManagedStateVersion ?? null,
-              // Empty string, not null: null means "never reconciled", which
-              // is a due condition. A deployment with no roster source would
-              // otherwise stay due forever.
-              input.processedObligatedConsumerRosterVersion ?? "",
-              // The cutoff the projection actually read at, never the commit
-              // instant. Watermarking at commit time swallowed everything
-              // that landed between the two: excluded from the projection,
-              // and then behind the watermark forever, so it never became
-              // due again. It is clamped to this database's clock in SQL
-              // below, because a cutoff ahead of the ledger buries
-              // database-timestamped work the same way for the opposite
-              // reason.
-              input.ledgerAsOf,
-              input.expectedObligatedConsumerRosterVersion ?? null
-            ]
-          );
-        }
-        const projectedIds = input.projectedIssues.map((issue) => issue.issueId);
-        for (const issue of input.projectedIssues) {
-          await client.query(
-            `INSERT INTO adcp_reporting_issues (issue_id, obligation_id, data, observed_at, resolved_at)
-             VALUES ($1, $2, $3::jsonb, $4, NULL)
-             -- opened_at is fixed at first emission; see recordIssue. A reopened
-             -- issue keeps the anchor because it is the same issue_id.
-             ON CONFLICT (issue_id) DO UPDATE SET
-               data = jsonb_set(EXCLUDED.data, '{openedAt}', COALESCE(adcp_reporting_issues.data -> 'openedAt', EXCLUDED.data -> 'openedAt')),
-               observed_at = EXCLUDED.observed_at,
-               resolved_at = NULL, changed_at = clock_timestamp()
-             WHERE adcp_reporting_issues.obligation_id = EXCLUDED.obligation_id`,
-            [issue.issueId, input.reporting_obligation_id, JSON.stringify(issue), issue.observedAt]
-          );
-        }
-        await client.query(
-          `UPDATE adcp_reporting_issues
-              SET resolved_at = $2::timestamptz,
-                  data = data || jsonb_build_object('resolvedAt', $2::text),
-                  changed_at = clock_timestamp()
-            WHERE obligation_id = $1 AND resolved_at IS NULL
-              -- Every code this projection can emit, not only the Core two.
-              -- A managed DELIVERY_FAILED persisted by an earlier reconcile
-              -- was never cleared, so after a successful redelivery the
-              -- status kept publishing a stale delivery failure for as long
-              -- as Core stayed degraded for some unrelated reason.
-              AND data->>'code' IN (
-                'REPORT_OVERDUE', 'REPORTING_COVERAGE_INCOMPLETE',
-                'DELIVERY_FAILED', 'RESOURCE_EXPIRED',
-                'RECEIPT_REQUIRED', 'RECEIPT_REJECTED',
-                'ADJUSTMENT_RECEIPT_REQUIRED', 'ADJUSTMENT_RECEIPT_REJECTED'
-              )
-              AND NOT (issue_id = ANY($3::text[]))`,
-          [input.reporting_obligation_id, input.ledgerAsOf, projectedIds]
-        );
-        return { applied: true, transitionInserted };
-      },
-      { preBeginAdvisoryLock: lock }
-    );
-  }
-  async markTransitionNotified(transitionId, notifiedAt) {
-    const lock = await this.accountLockForTransition(transitionId);
-    if (!lock) return;
-    await this.transaction(
-      async (client) => {
-        await client.query(
-          `UPDATE adcp_reporting_transitions
-          SET data = data || jsonb_build_object('notifiedAt', $2::text)
-              || CASE WHEN data ? 'finality' THEN '{}'::jsonb ELSE jsonb_build_object('finality', 'none') END
-        WHERE transition_id = $1 AND NOT (data ? 'notifiedAt')`,
-          [transitionId, notifiedAt]
-        );
-      },
-      { preBeginAdvisoryLock: lock }
-    );
-  }
-  async listTransitions(obligationId) {
-    const result = await this.query(
-      `SELECT data FROM adcp_reporting_transitions WHERE obligation_id = $1
-        ORDER BY transition_sequence`,
-      [obligationId]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async listPendingTransitions(input = {}) {
-    const limit = input.limit ?? 100;
-    positiveInteger(limit, "limit");
-    if (limit > 1e3) throw new RangeError("limit must not exceed 1000");
-    const result = await this.query(
-      `SELECT transition.data FROM adcp_reporting_transitions transition
-         JOIN adcp_reporting_obligations obligation ON obligation.obligation_id = transition.obligation_id
-        WHERE NOT (transition.data ? 'notifiedAt')
-          AND ($1::text IS NULL OR obligation.account_id = $1)
-        ORDER BY transition.recorded_at, transition.transition_id
-        LIMIT $2`,
-      [input.account_id ?? null, limit]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async createSnapshot(query) {
-    return this.transaction(
-      async (client) => {
-        const clock = await client.query(
-          "SELECT statement_timestamp() AS ledger_as_of"
-        );
-        const ledgerAsOf = clock.rows[0].ledger_as_of.toISOString();
-        await client.query(
-          "DELETE FROM adcp_reporting_snapshots WHERE account_id = $1 AND expires_at <= clock_timestamp()",
-          [query.account_id]
-        );
-        if (query.view === "periods") {
-          await client.query(
-            "DELETE FROM adcp_reporting_checkpoints WHERE account_id = $1 AND expires_at <= clock_timestamp()",
-            [query.account_id]
-          );
-        }
-        const active = await client.query(
-          `SELECT COUNT(*)::text AS count, COALESCE(SUM(byte_count), 0)::text AS bytes
-             FROM adcp_reporting_snapshots WHERE account_id = $1`,
-          [query.account_id]
-        );
-        if (Number(active.rows[0]?.count ?? 0) >= MAX_ACTIVE_SNAPSHOTS_PER_ACCOUNT) {
-          throw new Error("Reporting ledger snapshot capacity is exhausted");
-        }
-        const activeSnapshotBytes = Number(active.rows[0]?.bytes ?? 0);
-        const changesAfter = query.changes_after ? await this.resolveChangesCheckpoint(client, query, query.changes_after) : void 0;
-        const managedInstalled = this.managedDelivery && await this.managedTablesInstalled(client);
-        const configurations = await this.listSnapshotConfigurations(client, query, ledgerAsOf);
-        if (configurations.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the configuration limit");
-        }
-        let obligations = await this.listSnapshotObligations(client, query, ledgerAsOf, changesAfter);
-        if (managedInstalled && changesAfter) {
-          const managedChangedIds = await this.listManagedChangedObligationIds(client, query, ledgerAsOf, changesAfter);
-          if (managedChangedIds.size) {
-            const fullScope = await this.listSnapshotObligations(
-              client,
-              { ...query, changes_after: void 0, health: void 0 },
-              ledgerAsOf
-            );
-            const byId = new Map(obligations.map((value) => [value.reporting_obligation_id, value]));
-            for (const obligation of fullScope) {
-              if (managedChangedIds.has(obligation.reporting_obligation_id)) {
-                byId.set(obligation.reporting_obligation_id, obligation);
-              }
-            }
-            obligations = [...byId.values()].sort(
-              (left, right) => left.period.start.localeCompare(right.period.start) || left.reporting_obligation_id.localeCompare(right.reporting_obligation_id)
-            );
-          }
-        }
-        if (obligations.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the item limit");
-        }
-        const frozenCalendarProofRequired = configurations.some((configuration) => {
-          try {
-            reportingPeriodSchedule(configuration);
-            return false;
-          } catch (error) {
-            if (isFrozenCalendarRulesMismatch(error)) return true;
-            throw error;
-          }
-        });
-        const coverageObligations = changesAfter || frozenCalendarProofRequired ? await this.listSnapshotObligations(
-          client,
-          {
-            ...query,
-            changes_after: void 0,
-            health: void 0,
-            finality: void 0,
-            ...frozenCalendarProofRequired ? {
-              // The current host cannot derive the predecessor's edge
-              // ordinals. Fetch its full closed range so coverage can
-              // prove the handoff exclusively from frozen obligations.
-              period: {
-                start: configurations.map((configuration) => configuration.installedAt).sort(compareReportingInstants)[0],
-                end: ledgerAsOf
-              }
-            } : {}
-          },
-          ledgerAsOf
-        ) : obligations;
-        if (coverageObligations.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the coverage item limit");
-        }
-        const ledgerCoverage = evaluateReportingLedgerCoverageV1(
-          query,
-          configurations,
-          coverageObligations.map((value) => ({
-            configurationId: value.configurationId,
-            periodOrdinal: value.periodOrdinal,
-            period: { start: value.period.start, end: value.period.end }
-          })),
-          ledgerAsOf
-        );
-        let consumerStatuses = query.consumer_id ? await this.listSnapshotConsumerStatuses(client, query, ledgerAsOf, changesAfter, MAX_SNAPSHOT_ITEMS + 1) : [];
-        if (consumerStatuses.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the consumer status limit");
-        }
-        const consumerStatusProjection = query.consumer_id ? await this.listSnapshotConsumerStatuses(client, query, ledgerAsOf, void 0, MAX_SNAPSHOT_ITEMS + 1) : [];
-        if (consumerStatusProjection.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the consumer status projection limit");
-        }
-        const supersededConsumerStatusIds = new Set(
-          consumerStatusProjection.map((value) => value.supersedes_reporting_status_id).filter((value) => Boolean(value))
-        );
-        const exposesMissingObligationStatus = query.view === "periods" && consumerStatusProjection.some(
-          (value) => value.consumer_status === "obligation_missing" && !supersededConsumerStatusIds.has(value.reporting_status_id)
-        );
-        if (query.view !== "revision" && !ledgerCoverage.complete && !exposesMissingObligationStatus) {
-          throw new ReportingLedgerContinuityError("Reporting ledger is missing an elapsed obligation");
-        }
-        const obligationIds = obligations.map((value) => value.reporting_obligation_id);
-        const remaining = MAX_SNAPSHOT_ITEMS - obligations.length;
-        let revisions = await this.listSnapshotRevisions(client, obligationIds, query, ledgerAsOf, remaining + 1);
-        if (revisions.length > remaining) throw new Error("Reporting ledger snapshot exceeds the item limit");
-        const adjustmentCapacity = remaining - revisions.length;
-        let adjustments = await this.listSnapshotAdjustments(client, obligationIds, ledgerAsOf, adjustmentCapacity + 1);
-        if (adjustments.length > adjustmentCapacity) {
-          throw new Error("Reporting ledger snapshot exceeds the item limit");
-        }
-        const consumerStatusCapacity = adjustmentCapacity - adjustments.length;
-        if (consumerStatuses.length > consumerStatusCapacity) {
-          throw new Error("Reporting ledger snapshot exceeds the item limit");
-        }
-        let issues = await this.listSnapshotIssues(client, obligationIds, MAX_SNAPSHOT_ITEMS + 1);
-        const managedBindings = managedInstalled ? await this.listSnapshotManagedBindings(
-          client,
-          configurations.map((value) => value.configurationId)
-        ) : [];
-        let materializations = managedInstalled ? await this.listSnapshotMaterializations(client, obligationIds, ledgerAsOf, changesAfter) : [];
-        let receipts = managedInstalled && query.consumer_id ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, "revision") : [];
-        let adjustmentReceipts = managedInstalled && query.consumer_id ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, "adjustment") : [];
-        const tombstonedAcceptedSubjects = managedInstalled ? (await this.listTombstonedAcceptedSubjects(client, query, obligationIds, false, ledgerAsOf)).subjects : [];
-        const tombstonedDeliveredRevisionIds = managedInstalled ? (await client.query(
-          `SELECT revision_id FROM adcp_reporting_materialization_tombstones
-                  WHERE obligation_id = ANY($1::text[]) AND reached_success
-                    AND COALESCE(reached_success_at, pruned_at) <= $3::timestamptz LIMIT $2`,
-          [obligationIds, MAX_SNAPSHOT_ITEMS + 1, ledgerAsOf]
-        )).rows.map((row) => row.revision_id) : [];
-        const materializationProjection = managedInstalled ? await this.listSnapshotMaterializationProjection(client, obligationIds, ledgerAsOf) : [];
-        const materializationHistoryProjection = managedInstalled && changesAfter ? await this.listSnapshotMaterializations(client, obligationIds, ledgerAsOf) : materializations;
-        const receiptProjection = managedInstalled && query.consumer_id && changesAfter ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, void 0, "revision") : receipts;
-        const adjustmentReceiptProjection = managedInstalled && query.consumer_id && changesAfter ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, void 0, "adjustment") : adjustmentReceipts;
-        if (materializationProjection.length > MAX_SNAPSHOT_ITEMS || materializationHistoryProjection.length > MAX_SNAPSHOT_ITEMS || receiptProjection.length > MAX_SNAPSHOT_ITEMS || adjustmentReceiptProjection.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the managed projection limit");
-        }
-        if (obligations.length + revisions.length + adjustments.length + consumerStatuses.length + materializations.length + receipts.length + adjustmentReceipts.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting ledger snapshot exceeds the item limit");
-        }
-        if (issues.length > MAX_SNAPSHOT_ITEMS) throw new Error("Reporting ledger snapshot exceeds the issue limit");
-        if (query.view === "periods" && query.health) {
-          const scopedObligations = obligations;
-          const accepted = new Set(
-            scopedObligations.filter((value) => {
-              const obligationRevisions = revisions.filter(
-                (item) => item.reporting_obligation_id === value.reporting_obligation_id
-              );
-              const coreProjection = projectReportingObligationHealthV1(
-                value,
-                obligationRevisions,
-                ledgerAsOf,
-                reportingLedgerScopeClosed(query, ledgerAsOf, ledgerCoverage.complete)
-              );
-              const sellerHealth = projectReportingUnreadableRevisionHealthV1(
-                value,
-                obligationRevisions,
-                issues,
-                coreProjection.health
-              );
-              const statuses = consumerStatusProjection.filter((status) => statusMatchesObligation(status, value));
-              const leaf = currentConsumerStatus(statuses);
-              const mismatch = projectReportingConsumerStatusMismatchV1(
-                value,
-                leaf,
-                obligationRevisions,
-                sellerHealth,
-                ledgerAsOf,
-                this.consumerMismatchEscalation
-              );
-              const baseProjection = { ...coreProjection, health: sellerHealth };
-              const managed = projectManagedDelivery({
-                obligation: value,
-                binding: managedBindings.find((binding) => binding.configurationId === value.configurationId),
-                revisions: obligationRevisions,
-                adjustments: adjustments.filter(
-                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
-                ),
-                materializations: materializationProjection.filter(
-                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
-                ),
-                materializationHistory: materializationHistoryProjection.filter(
-                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
-                ),
-                receipts: receiptProjection,
-                adjustmentReceipts: adjustmentReceiptProjection,
-                base: baseProjection,
-                ledgerAsOf,
-                tombstonedAcceptedSubjects,
-                tombstonedDeliveredRevisionIds
-              });
-              const health = mismatch ? moreSevereReportingHealthV1(managed?.projection.health ?? sellerHealth, mismatch.health) : managed?.projection.health ?? sellerHealth;
-              return query.health.includes(health);
-            }).map((value) => value.reporting_obligation_id)
-          );
-          const obligationsByConsumerStatusChain = new Map(
-            scopedObligations.map((value) => [consumerStatusChainKeyForObligation(value), value])
-          );
-          const projectedStatusesByChain = /* @__PURE__ */ new Map();
-          for (const status of consumerStatusProjection) {
-            const key = reportingConsumerStatusChainKeyV1(status);
-            const statuses = projectedStatusesByChain.get(key) ?? [];
-            statuses.push(status);
-            projectedStatusesByChain.set(key, statuses);
-          }
-          obligations = obligations.filter((value) => accepted.has(value.reporting_obligation_id));
-          revisions = revisions.filter((value) => accepted.has(value.reporting_obligation_id));
-          adjustments = adjustments.filter((value) => accepted.has(value.reporting_obligation_id));
-          materializations = materializations.filter((value) => accepted.has(value.reporting_obligation_id));
-          const acceptedRevisionIds = new Set(revisions.map((value) => value.reporting_revision_id));
-          const acceptedAdjustmentIds = new Set(adjustments.map((value) => value.reporting_adjustment_id));
-          receipts = receipts.filter((value) => acceptedRevisionIds.has(value.reporting_revision_id));
-          adjustmentReceipts = adjustmentReceipts.filter(
-            (value) => acceptedAdjustmentIds.has(value.reporting_adjustment_id)
-          );
-          consumerStatuses = consumerStatuses.filter((value) => {
-            const key = reportingConsumerStatusChainKeyV1(value);
-            const matchingObligation = obligationsByConsumerStatusChain.get(key);
-            if (matchingObligation) return accepted.has(matchingObligation.reporting_obligation_id);
-            const leaf = currentConsumerStatus(projectedStatusesByChain.get(key) ?? []);
-            return query.health.includes("action_required") && leaf?.consumer_status === "obligation_missing";
-          });
-          issues = issues.filter((value) => accepted.has(value.reporting_obligation_id));
-        }
-        const changesCheckpoint = randomUUID();
-        const snapshot = {
-          snapshotId: randomUUID(),
-          ledgerAsOf,
-          changesCheckpoint,
-          queryFingerprint: digest(query),
-          query: clone(query),
-          configurations,
-          coverageOrdinals: coverageObligations.map((value) => ({
-            configurationId: value.configurationId,
-            periodOrdinal: value.periodOrdinal,
-            period: { start: value.period.start, end: value.period.end }
-          })),
-          obligations,
-          revisions,
-          adjustments,
-          ...managedInstalled ? {
-            tombstonedAcceptedSubjects,
-            tombstonedDeliveredRevisionIds,
-            managedBindings,
-            materializations,
-            materializationHistoryProjection,
-            materializationProjection,
-            receipts,
-            receiptProjection,
-            adjustmentReceipts,
-            adjustmentReceiptProjection
-          } : {},
-          consumerStatuses,
-          consumerStatusProjection,
-          issues
-        };
-        const snapshotJson = JSON.stringify(snapshot);
-        const snapshotBytes = Buffer.byteLength(snapshotJson, "utf8");
-        if (snapshotBytes > MAX_SNAPSHOT_BYTES) {
-          throw new Error("Reporting ledger snapshot exceeds the byte limit");
-        }
-        if (activeSnapshotBytes + snapshotBytes > MAX_ACTIVE_SNAPSHOT_BYTES_PER_ACCOUNT) {
-          throw new Error("Reporting ledger snapshot byte capacity is exhausted");
-        }
-        await client.query(
-          `INSERT INTO adcp_reporting_snapshots
-           (snapshot_id, account_id, query_fingerprint, data, byte_count, created_at, expires_at)
-         VALUES ($1, $2, $3, $4::jsonb, $5, $6,
-                 $6::timestamptz + ($7::bigint * INTERVAL '1 millisecond'))`,
-          [
-            snapshot.snapshotId,
-            query.account_id,
-            snapshot.queryFingerprint,
-            snapshotJson,
-            snapshotBytes,
-            ledgerAsOf,
-            SNAPSHOT_RETENTION_MS
-          ]
-        );
-        if (query.view === "periods") {
-          await client.query(
-            `INSERT INTO adcp_reporting_checkpoints
-           (checkpoint_id, account_id, scope_fingerprint, ledger_as_of, expires_at)
-         VALUES ($1, $2, $3, $4,
-                 $4::timestamptz + ($5::bigint * INTERVAL '1 millisecond'))`,
-            [
-              changesCheckpoint,
-              query.account_id,
-              checkpointScopeFingerprint(query),
-              ledgerAsOf,
-              CHECKPOINT_RETENTION_MS
-            ]
-          );
-        }
-        return clone(snapshot);
-      },
-      {
-        isolation: "REPEATABLE READ",
-        preBeginAdvisoryLock: `adcp-reporting-account:${query.account_id}`
-      }
-    );
-  }
-  async readSnapshotPage(snapshotId, account_id, cursor, limit) {
-    positiveInteger(limit, "limit");
-    if (limit > 500) throw new RangeError("limit must not exceed 500");
-    if (!UUID_PATTERN.test(snapshotId)) throw new ReportingLedgerSnapshotUnavailableError();
-    const snapshot = await this.one(
-      `SELECT data FROM adcp_reporting_snapshots
-        WHERE snapshot_id = $1 AND account_id = $2 AND expires_at > clock_timestamp()`,
-      [snapshotId, account_id]
-    );
-    if (!snapshot) throw new ReportingLedgerSnapshotUnavailableError();
-    const offset = cursor ? decodeCursor(cursor, snapshot) : 0;
-    const items = snapshotItems(snapshot);
-    const selected = items.slice(offset, offset + limit);
-    const obligations = selected.filter((value) => value.kind === "obligation").map((value) => value.value);
-    const revisions = selected.filter((value) => value.kind === "revision").map((value) => value.value);
-    const adjustments = selected.filter((value) => value.kind === "adjustment").map((value) => value.value);
-    const consumerStatuses = selected.filter(
-      (value) => value.kind === "consumer_status"
-    ).map((value) => value.value);
-    const materializations = selected.filter(
-      (value) => value.kind === "materialization"
-    ).map((value) => value.value);
-    const receipts = selected.filter((value) => value.kind === "receipt").map((value) => value.value);
-    const adjustmentReceipts = selected.filter(
-      (value) => value.kind === "adjustment_receipt"
-    ).map((value) => value.value);
-    const nextOffset = offset + selected.length;
-    const hasMore = nextOffset < items.length;
-    return {
-      snapshot,
-      obligations,
-      revisions,
-      adjustments,
-      materializations,
-      receipts,
-      adjustmentReceipts,
-      consumerStatuses,
-      totalCount: items.length,
-      offset,
-      limit,
-      hasMore,
-      ...hasMore ? { nextCursor: encodeCursor(snapshot, nextOffset) } : {}
-    };
-  }
-  async listSnapshotConsumerStatuses(client, query, ledgerAsOf, changesAfter, limit, currentOnly = false) {
-    const period = reportingLedgerEffectivePeriod(query, ledgerAsOf);
-    const result = await client.query(
-      `SELECT status.data FROM adcp_reporting_consumer_statuses status
-        JOIN adcp_reporting_configurations configuration
-          ON configuration.account_id = status.account_id
-         AND configuration.delivery_config_id = status.data->>'delivery_config_id'
-         AND configuration.delivery_config_version = (status.data->>'delivery_config_version')::integer
-       WHERE status.account_id = $1 AND status.consumer_id = $2
-         AND status.recorded_at <= $3
-         AND ($4::timestamptz IS NULL OR status.recorded_at > $4)
-         AND ($5::text[] IS NULL OR status.data->>'delivery_config_id' = ANY($5))
-         AND ($10::text IS NOT NULL OR (status.data->'period'->>'end')::timestamptz > $6)
-         AND ($10::text IS NOT NULL OR (status.data->'period'->>'start')::timestamptz < $7)
-         AND ($8::text[] IS NULL OR configuration.data->>'feedPurpose' = ANY($8))
-         AND ($9::text[] IS NULL OR configuration.data->'mediaBuyIds' ?| $9::text[])
-         AND ($10::text IS NULL OR status.data->>'reporting_revision_id' = $10)
-         AND (NOT $11::boolean OR status.is_current)
-       ORDER BY status.recorded_at, status.consumer_status_id
-       LIMIT $12`,
-      [
-        query.account_id,
-        query.consumer_id,
-        ledgerAsOf,
-        changesAfter ?? null,
-        query.delivery_config_ids ?? null,
-        period.start,
-        period.end,
-        query.feed_purposes ?? null,
-        query.media_buy_ids ?? null,
-        query.reporting_revision_id ?? null,
-        currentOnly,
-        limit
-      ]
-    );
-    return result.rows.map((row) => clone(row.data));
-  }
-  async listSnapshotObligations(client, query, ledgerAsOf, changesAfter) {
-    const defaultPeriod = query.view === "revision" ? { start: null, end: null } : {
-      start: new Date(Date.parse(ledgerAsOf) - 24 * 60 * 60 * 1e3).toISOString(),
-      end: ledgerAsOf
-    };
-    const result = await client.query(
-      `SELECT data FROM adcp_reporting_obligations
-        WHERE account_id = $1 AND created_at <= $2
-          AND ($3::timestamptz IS NULL OR changed_at > $3 OR EXISTS (
-            SELECT 1 FROM adcp_reporting_revisions revision
-             WHERE revision.obligation_id = adcp_reporting_obligations.obligation_id
-               AND revision.recorded_at > $3 AND revision.recorded_at <= $2
-          ) OR EXISTS (
-            SELECT 1 FROM adcp_reporting_adjustments adjustment
-             WHERE adjustment.obligation_id = adcp_reporting_obligations.obligation_id
-               AND adjustment.recorded_at > $3 AND adjustment.recorded_at <= $2
-          ) OR EXISTS (
-            SELECT 1 FROM adcp_reporting_consumer_statuses status
-             WHERE status.account_id = $1
-               AND status.consumer_id = $10
-               AND (
-                 status.obligation_id = adcp_reporting_obligations.obligation_id
-                 OR (
-                   status.data->>'delivery_config_id' = adcp_reporting_obligations.data->>'delivery_config_id'
-                   AND (status.data->>'delivery_config_version')::bigint =
-                     (adcp_reporting_obligations.data->>'delivery_config_version')::bigint
-                   AND status.data->>'report_definition_id' = adcp_reporting_obligations.data->>'report_definition_id'
-                   AND (status.data->'period'->>'start')::timestamptz = period_start
-                   AND (status.data->'period'->>'end')::timestamptz = period_end
-                   AND status.data->'period'->>'source_timezone' =
-                     adcp_reporting_obligations.data->'period'->>'sourceTimezone'
-                 )
-               )
-               AND status.recorded_at > $3 AND status.recorded_at <= $2
-          ) OR EXISTS (
-            SELECT 1 FROM adcp_reporting_issues issue
-             WHERE issue.obligation_id = adcp_reporting_obligations.obligation_id
-               AND issue.changed_at > $3 AND issue.changed_at <= $2
-          ) OR EXISTS (
-            SELECT 1 FROM adcp_reporting_transitions transition
-             WHERE transition.obligation_id = adcp_reporting_obligations.obligation_id
-               AND transition.recorded_at > $3 AND transition.recorded_at <= $2
-          ) OR ((data->>'expectedAt')::timestamptz > $3 AND (data->>'expectedAt')::timestamptz <= $2)
-            OR ((data->>'recoveryDeadlineAt')::timestamptz > $3
-              AND (data->>'recoveryDeadlineAt')::timestamptz <= $2)
-          )
-          AND ($4::text[] IS NULL OR data->>'delivery_config_id' = ANY($4))
-          AND ($5::text[] IS NULL OR data->>'feedPurpose' = ANY($5))
-          AND ($6::text[] IS NULL OR EXISTS (
-            SELECT 1 FROM jsonb_array_elements_text(data->'mediaBuyIds') value WHERE value = ANY($6)
-          ))
-          AND ($7::timestamptz IS NULL OR period_end > $7)
-          AND ($8::timestamptz IS NULL OR period_start < $8)
-          AND ($9::text IS NOT NULL OR period_end <= $2)
-          AND ($9::text IS NULL OR EXISTS (
-            SELECT 1 FROM adcp_reporting_revisions exact_revision
-             WHERE exact_revision.obligation_id = adcp_reporting_obligations.obligation_id
-               AND exact_revision.revision_id = $9 AND exact_revision.recorded_at <= $2
-          ))
-        ORDER BY period_start, obligation_id
-        LIMIT $11`,
-      [
-        query.account_id,
-        ledgerAsOf,
-        changesAfter ?? null,
-        query.delivery_config_ids ?? null,
-        query.feed_purposes ?? null,
-        query.media_buy_ids ?? null,
-        query.period?.start ?? defaultPeriod.start,
-        query.period?.end ?? defaultPeriod.end,
-        query.reporting_revision_id ?? null,
-        query.consumer_id ?? null,
-        MAX_SNAPSHOT_ITEMS + 1
-      ]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async listSnapshotConfigurations(client, query, ledgerAsOf) {
-    const result = await client.query(
-      `SELECT data FROM adcp_reporting_configurations
-        WHERE account_id = $1 AND created_at <= $2
-          AND ($3::text[] IS NULL OR delivery_config_id = ANY($3))
-        ORDER BY delivery_config_id, delivery_config_version
-        LIMIT $4`,
-      [query.account_id, ledgerAsOf, query.delivery_config_ids ?? null, MAX_SNAPSHOT_ITEMS + 1]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async resolveChangesCheckpoint(client, query, checkpointId) {
-    if (!UUID_PATTERN.test(checkpointId)) throw new ReportingLedgerSnapshotUnavailableError();
-    const result = await client.query(
-      `SELECT ledger_as_of FROM adcp_reporting_checkpoints
-        WHERE checkpoint_id = $1 AND account_id = $2 AND scope_fingerprint = $3
-          AND expires_at > clock_timestamp()`,
-      [checkpointId, query.account_id, checkpointScopeFingerprint(query)]
-    );
-    const value = result.rows[0]?.ledger_as_of;
-    if (!value) throw new ReportingLedgerSnapshotUnavailableError();
-    return value.toISOString();
-  }
-  async listSnapshotRevisions(client, obligationIds, query, ledgerAsOf, limit) {
-    if (!obligationIds.length) return [];
-    const result = await client.query(
-      `SELECT data - 'rows' AS data FROM adcp_reporting_revisions
-        WHERE obligation_id = ANY($1::text[]) AND recorded_at <= $2
-          AND ($3::text IS NULL OR revision_id = $3)
-        ORDER BY obligation_id, revision_number
-        LIMIT $4`,
-      [obligationIds, ledgerAsOf, query.reporting_revision_id ?? null, limit]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async listSnapshotIssues(client, obligationIds, limit) {
-    if (!obligationIds.length) return [];
-    const result = await client.query(
-      `SELECT data FROM adcp_reporting_issues
-        WHERE obligation_id = ANY($1::text[])
-        ORDER BY obligation_id, observed_at, issue_id
-        LIMIT $2`,
-      [obligationIds, limit]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async listSnapshotAdjustments(client, obligationIds, ledgerAsOf, limit) {
-    if (!obligationIds.length) return [];
-    const result = await client.query(
-      `SELECT data - 'rows' AS data FROM adcp_reporting_adjustments
-        WHERE obligation_id = ANY($1::text[]) AND recorded_at <= $2
-        ORDER BY obligation_id, adjustment_number
-        LIMIT $3`,
-      [obligationIds, ledgerAsOf, limit]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  /**
-   * Managed Delivery projection inputs for one obligation, grouped per consumer.
-   *
-   * The lifecycle reconciler folds these through the same
-   * `projectManagedDelivery` the read path uses, so a persisted transition and
-   * its webhook report the health a read of the same obligation would return.
-   * Returns `null` when Managed Delivery is not installed or the obligation's
-   * configuration has no binding, which keeps a Core-only ledger unchanged.
-   */
-  async getManagedLifecycleProjection(input) {
-    if (!this.managedDelivery) return null;
-    const base = await this.transaction(
-      async (client) => {
-        if (!await this.managedTablesInstalled(client)) return null;
-        const obligation = await client.query(
-          "SELECT configuration_id FROM adcp_reporting_obligations WHERE obligation_id = $1",
-          [input.reporting_obligation_id]
-        );
-        const configurationId = obligation.rows[0]?.configuration_id;
-        if (!configurationId) return null;
-        const [binding] = await this.listSnapshotManagedBindings(client, [configurationId]);
-        if (!binding) return null;
-        const resolvedLedgerAsOf = (await client.query(
-          // RFC 3339 with microseconds. PostgreSQL's own ::text rendering
-          // uses a space separator and a two-digit offset, which the SDK's
-          // instant parser rejects, and round-tripping through a JS Date
-          // would truncate the microseconds this exists to preserve.
-          `SELECT ${rfc3339Microseconds("COALESCE($1::timestamptz, clock_timestamp())")} AS instant`,
-          [input.ledgerAsOf ?? null]
-        )).rows[0].instant;
-        const rows = await client.query(
-          `SELECT materialization.data,
-                  materialization.changed_at > $2::timestamptz AS settled_after_cutoff,
-                  CASE WHEN authz.revoked_at <= $2::timestamptz THEN authz.revoked_at END AS revoked_at
-             FROM adcp_reporting_materializations materialization
-             JOIN adcp_reporting_destination_authorizations authz
-               ON authz.account_id = materialization.account_id
-              AND authz.destination_ref = materialization.destination_ref
-              AND authz.generation = materialization.authorization_generation
-            WHERE materialization.obligation_id = $1
-              AND materialization.recorded_at <= $2::timestamptz
-            ORDER BY materialization.attempt, materialization.materialization_id
-            LIMIT $3`,
-          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
-        );
-        if (rows.rows.length > MAX_SNAPSHOT_ITEMS) {
-          throw new Error("Reporting lifecycle projection exceeds the managed materialization limit");
-        }
-        const placed = rows.rows.map((row) => ({
-          atAsOf: row.settled_after_cutoff ? pendingAtCutoff(row.data) : clone(row.data),
-          revokedAt: row.revoked_at
-        }));
-        const materializationHistory = placed.map((value) => value.atAsOf);
-        const materializations = placed.map(
-          ({ atAsOf, revokedAt }) => revokedAt && (atAsOf.status === "available" || atAsOf.status === "delivered") ? {
-            ...atAsOf,
-            status: "failed",
-            failed_at: revokedAt.toISOString(),
-            failure_code: "AUTHORIZATION_REVOKED"
-          } : atAsOf
-        );
-        const receipts = await client.query(
-          `WITH subject AS (
-             -- Drive from this obligation's own subjects. Asking the global
-             -- receipt table "which of your rows belong to this obligation"
-             -- matched no index \u2014 they lead with account and consumer, and
-             -- this question supplies neither \u2014 so every due obligation
-             -- re-scanned the whole receipt history.
-             SELECT revision_id AS subject_id, 'revision' AS receipt_kind
-               FROM adcp_reporting_revisions WHERE obligation_id = $1
-             UNION ALL
-             SELECT adjustment_id, 'adjustment'
-               FROM adcp_reporting_adjustments WHERE obligation_id = $1
-           )
-           SELECT receipt.consumer_id, receipt.receipt_kind, receipt.data
-           FROM subject
-           JOIN adcp_reporting_receipts receipt
-             ON receipt.subject_id = subject.subject_id
-            AND receipt.receipt_kind = subject.receipt_kind
-          -- Ordered and cut off by the database clock, exactly as every other
-          -- receipt read path is, so a skewed host cannot make the lifecycle
-          -- projection see a different receipt set than get_reporting_status.
-          --
-          -- One leaf per chain, resolved AS OF the cutoff. The fold reads
-          -- exactly one thing from each chain, and walking the whole history
-          -- to find it pushed this read past its bound for a subject repaired
-          -- often enough. But is_current is today's answer: at a cutoff
-          -- before an acceptance superseded a rejection, the rejection was no
-          -- longer current and the acceptance was not yet in scope, so the
-          -- projection saw neither and persisted RECEIPT_REQUIRED over a
-          -- rejection the buyer had already filed. The leaf at the cutoff is
-          -- the receipt that nothing recorded by then supersedes. Wire
-          -- counters are computed on the read path, which still sees every
-          -- row.
-          WHERE receipt.recorded_at <= $2
-            AND NOT EXISTS (
-              SELECT 1 FROM adcp_reporting_receipts successor
-               WHERE successor.account_id = receipt.account_id
-                 AND successor.consumer_id = receipt.consumer_id
-                 AND successor.supersedes_receipt_id = receipt.reporting_receipt_id
-                 AND successor.recorded_at <= $2
-            )
-            -- A successor whose body has been pruned still superseded this
-            -- row. Counting only live successors let retention resurrect the
-            -- rejected predecessor of a pruned acceptance as the live leaf,
-            -- which overrode that acceptance's own tombstone and reopened a
-            -- settled subject the write path then refused to repair.
-            AND NOT EXISTS (
-              SELECT 1 FROM adcp_reporting_receipt_tombstones gone
-               WHERE gone.account_id = receipt.account_id
-                 AND gone.consumer_id = receipt.consumer_id
-                 AND gone.supersedes_receipt_id = receipt.reporting_receipt_id
-                 AND COALESCE(gone.subject_recorded_at, gone.pruned_at) <= $2
-            )
-          ORDER BY receipt.consumer_id, receipt.subject_id, receipt.recorded_at, receipt.reporting_receipt_id
-          LIMIT $3`,
-          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_LIFECYCLE_RECEIPT_LEAVES + 1]
-        );
-        let receiptEvidenceComplete = true;
-        let leaves = receipts.rows;
-        if (leaves.length > MAX_LIFECYCLE_RECEIPT_LEAVES) {
-          receiptEvidenceComplete = false;
-          const partial = leaves[MAX_LIFECYCLE_RECEIPT_LEAVES].consumer_id;
-          leaves = leaves.slice(0, MAX_LIFECYCLE_RECEIPT_LEAVES).filter((row) => row.consumer_id !== partial);
-        }
-        const byConsumer = /* @__PURE__ */ new Map();
-        for (const row of leaves) {
-          const consumer = byConsumer.get(row.consumer_id) ?? {
-            consumer_id: row.consumer_id,
-            receipts: [],
-            adjustmentReceipts: []
-          };
-          if (row.receipt_kind === "revision") consumer.receipts.push(clone(row.data));
-          else consumer.adjustmentReceipts.push(clone(row.data));
-          byConsumer.set(row.consumer_id, consumer);
-        }
-        const engaged = await client.query(
-          `SELECT DISTINCT consumer_id FROM adcp_reporting_consumer_statuses
-          WHERE obligation_id = $1 AND consumer_id <> '__legacy_unscoped_consumer__'
-          ORDER BY consumer_id LIMIT $2`,
-          [input.reporting_obligation_id, MAX_SNAPSHOT_ITEMS + 1]
-        );
-        if (engaged.rows.length > MAX_SNAPSHOT_ITEMS) {
-          receiptEvidenceComplete = false;
-          engaged.rows = engaged.rows.slice(0, MAX_SNAPSHOT_ITEMS);
-        }
-        const observed = [.../* @__PURE__ */ new Set([...byConsumer.keys(), ...engaged.rows.map((row) => row.consumer_id)])].sort();
-        const tombstoned = await this.listTombstonedAcceptedSubjects(
-          client,
-          { account_id: binding.account_id, consumer_id: void 0, view: "periods" },
-          [input.reporting_obligation_id],
-          true,
-          resolvedLedgerAsOf
-        );
-        if (!tombstoned.complete) receiptEvidenceComplete = false;
-        const visible = await client.query(
-          `SELECT adjustment_id FROM adcp_reporting_adjustments
-            WHERE obligation_id = $1 AND recorded_at <= $2::timestamptz
-            ORDER BY adjustment_number, adjustment_id LIMIT $3`,
-          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
-        );
-        if (visible.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
-        const visibleAdjustmentIds = visible.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.adjustment_id);
-        const visibleRevisions = await client.query(
-          `SELECT revision_id FROM adcp_reporting_revisions
-            WHERE obligation_id = $1 AND recorded_at <= $2::timestamptz
-            ORDER BY revision_number, revision_id LIMIT $3`,
-          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
-        );
-        if (visibleRevisions.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
-        const visibleRevisionIds = visibleRevisions.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.revision_id);
-        const tombstonedAcceptedSubjects = tombstoned.subjects;
-        const delivered = await client.query(
-          `SELECT revision_id FROM adcp_reporting_materialization_tombstones
-            WHERE obligation_id = $1 AND reached_success
-              AND COALESCE(reached_success_at, pruned_at) <= $3::timestamptz LIMIT $2`,
-          [input.reporting_obligation_id, MAX_SNAPSHOT_ITEMS + 1, resolvedLedgerAsOf]
-        );
-        if (delivered.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
-        const tombstonedDeliveredRevisionIds = delivered.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.revision_id);
-        const managedStateVersion = await this.readManagedStateVersion(client, input.reporting_obligation_id);
-        return {
-          binding,
-          materializations,
-          materializationHistory,
-          consumers: [...byConsumer.values()],
-          obligatedConsumerIds: observed,
-          obligatedConsumerRosterComplete: false,
-          receiptEvidenceComplete,
-          visibleAdjustmentIds,
-          visibleRevisionIds,
-          managedStateVersion,
-          resolvedLedgerAsOf,
-          tombstonedAcceptedSubjects,
-          tombstonedDeliveredRevisionIds
-        };
-      },
-      { isolation: "REPEATABLE READ" }
-    );
-    if (!base || !this.obligatedConsumers) return base;
-    const supplied = await withReportingCallbackDeadline(
-      this.obligatedConsumers({
-        reporting_obligation_id: input.reporting_obligation_id,
-        account_id: base.binding.account_id
-      }),
-      OBLIGATED_CONSUMERS_DEADLINE_MS,
-      "Reporting obligated-consumer lookup deadline elapsed"
-    );
-    const all = obligatedConsumerIdsFor(supplied, base.obligatedConsumerIds ?? []);
-    const identityIds = supplied.version === void 0 && supplied.complete !== true ? obligatedConsumerIdsFor(supplied, await this.observedConsumerIds(input.reporting_obligation_id)) : all;
-    const ids = all.slice(0, MAX_SNAPSHOT_ITEMS);
-    const rosterComplete = supplied.complete === true && all.length === ids.length;
-    return {
-      ...base,
-      obligatedConsumerIds: ids,
-      obligatedConsumerRosterComplete: rosterComplete,
-      ...all.length === ids.length ? {} : { receiptEvidenceComplete: false },
-      obligatedConsumerRosterVersion: obligatedConsumerRosterVersionFor(supplied, identityIds)
-    };
-  }
-  /**
-   * Digest over every managed row that can change this obligation's projected
-   * health: materialization status, receipt existence and current-leaf flag,
-   * adjustments, and the destination authorization's revocation/cleanup state.
-   *
-   * `is_current` is included because superseding a receipt flips it with no
-   * timestamp of its own, and the authorization's `cleanup_completed_at` is
-   * included because `completeRevocation` does not touch `changed_at`.
-   */
-  async readManagedStateVersion(client, obligationId) {
-    const result = await client.query(
-      `SELECT md5(COALESCE(string_agg(marker, '|' ORDER BY marker), '')) AS version FROM (
-         SELECT 'm:' || materialization_id || ':' || status || ':'
-                || EXTRACT(EPOCH FROM changed_at)::text AS marker
-           FROM adcp_reporting_materializations WHERE obligation_id = $1
-         UNION ALL
-         -- Driven from this obligation's subjects into the receipt subject
-         -- index. This digest is read while the apply holds the account
-         -- lock, so asking the global receipt table which of its rows belong
-         -- to an obligation -- a question supplying neither account nor
-         -- consumer -- turned every apply into a full scan with that lock
-         -- held, and concurrent Core writes failed with 55P03.
-         SELECT 'r:' || receipt.reporting_receipt_id || ':' || receipt.is_current::text || ':'
-                || EXTRACT(EPOCH FROM receipt.recorded_at)::text
-           FROM adcp_reporting_revisions revision
-           JOIN adcp_reporting_receipts receipt
-             ON receipt.receipt_kind = 'revision' AND receipt.subject_id = revision.revision_id
-          WHERE revision.obligation_id = $1
-         UNION ALL
-         SELECT 'r:' || receipt.reporting_receipt_id || ':' || receipt.is_current::text || ':'
-                || EXTRACT(EPOCH FROM receipt.recorded_at)::text
-           FROM adcp_reporting_adjustments adjustment
-           JOIN adcp_reporting_receipts receipt
-             ON receipt.receipt_kind = 'adjustment' AND receipt.subject_id = adjustment.adjustment_id
-          WHERE adjustment.obligation_id = $1
-         UNION ALL
-         SELECT 'a:' || adjustment_id || ':' || EXTRACT(EPOCH FROM recorded_at)::text
-           FROM adcp_reporting_adjustments WHERE obligation_id = $1
-         UNION ALL
-         -- Consumer statuses are a health input through the mismatch
-         -- projection and they widen the observed roster, so a status landing
-         -- between projection and apply has to move the token too.
-         SELECT 'c:' || status.consumer_id || ':' || status.consumer_status_id || ':'
-                || status.is_current::text || ':' || EXTRACT(EPOCH FROM status.created_at)::text
-           FROM adcp_reporting_consumer_statuses status
-          WHERE status.obligation_id = $1
-         UNION ALL
-         SELECT 'z:' || authz.generation::text
-                || ':' || COALESCE(EXTRACT(EPOCH FROM authz.revoked_at)::text, '')
-                || ':' || COALESCE(EXTRACT(EPOCH FROM authz.cleanup_completed_at)::text, '')
-                || ':' || EXTRACT(EPOCH FROM authz.changed_at)::text
-           FROM adcp_reporting_destination_authorizations authz
-           JOIN adcp_reporting_managed_bindings binding
-             ON binding.account_id = authz.account_id AND binding.destination_ref = authz.destination_ref
-           JOIN adcp_reporting_obligations obligation
-             ON obligation.configuration_id = binding.configuration_id
-          WHERE obligation.obligation_id = $1
-       ) markers`,
-      [obligationId]
-    );
-    return result.rows[0]?.version ?? "";
-  }
-  /**
-   * Current external roster version, read outside any transaction so the
-   * reconciler can re-check it immediately before an apply.
-   */
-  /**
-   * Publishes the roster version currently observed for an obligation.
-   *
-   * The roster is external, so nothing in this database changes when it does.
-   * Recording what a reader saw is what lets the due query notice drift from
-   * the version last reconciled. Never lowers a watermark; it only reports.
-   */
-  async recordObligatedConsumerRosterVersion(input) {
-    await this.query(
-      `INSERT INTO adcp_reporting_lifecycle_state
-         (obligation_id, current_roster_version, roster_refreshed_at, processed_at)
-       VALUES ($1, $2, clock_timestamp(), clock_timestamp())
-       ON CONFLICT (obligation_id) DO UPDATE SET
-         current_roster_version = EXCLUDED.current_roster_version,
-         -- Advances the refresh cursor, never the reconciliation watermark:
-         -- observing a roster is not reconciling an obligation.
-         roster_refreshed_at = clock_timestamp()`,
-      [input.reporting_obligation_id, input.version]
-    );
-  }
-  /**
-   * Re-reads the external roster for managed obligations and publishes what
-   * it saw, so a change made while nothing was scheduled can re-arm.
-   *
-   * Ordered by least-recently-refreshed and bounded, so a large account is
-   * swept over successive passes rather than in one burst of callbacks.
-   */
-  async refreshObligatedConsumerRosterVersions(input) {
-    if (!this.managedDelivery || !this.obligatedConsumers) return 0;
-    positiveInteger(input.limit, "limit");
-    if (!await this.managedDueTablesReady()) return 0;
-    const budget = Math.min(input.limit, MAX_ROSTER_REFRESH_PER_SWEEP);
-    const candidates = await this.query(
-      `SELECT obligation.obligation_id
-         FROM adcp_reporting_obligations obligation
-         JOIN adcp_reporting_managed_bindings binding
-           ON binding.configuration_id = obligation.configuration_id
-         LEFT JOIN adcp_reporting_lifecycle_state state
-           ON state.obligation_id = obligation.obligation_id
-        WHERE ($1::text IS NULL OR obligation.account_id = $1)
-        -- Its own cursor, advanced by the refresh itself. Ordering by the
-        -- reconciliation watermark, which a refresh never moves, meant every
-        -- sweep re-read the same first page and nothing beyond one page of quiet
-        -- obligations was ever refreshed, so their roster changes could never
-        -- re-arm.
-        ORDER BY state.roster_refreshed_at NULLS FIRST, obligation.obligation_id
-        LIMIT $2`,
-      [input.account_id ?? null, budget]
-    );
-    let refreshed = 0;
-    for (const row of candidates.rows) {
-      try {
-        await this.readObligatedConsumerRosterVersion({ reporting_obligation_id: row.obligation_id });
-        refreshed += 1;
-      } catch {
-        await this.query(
-          `INSERT INTO adcp_reporting_lifecycle_state (obligation_id, roster_refreshed_at, processed_at)
-           VALUES ($1, clock_timestamp(), clock_timestamp())
-           ON CONFLICT (obligation_id) DO UPDATE SET roster_refreshed_at = clock_timestamp()`,
-          [row.obligation_id]
-        ).catch(() => void 0);
-      }
-    }
-    return refreshed;
-  }
-  /**
-   * Records a failed reconcile so the obligation backs off instead of
-   * re-occupying the head of every sweep, without ever hiding it: the
-   * watermark is untouched, so it stays unresolved work.
-   */
-  async recordLifecycleFailure(input) {
-    await this.query(
-      `INSERT INTO adcp_reporting_lifecycle_state (obligation_id, failure_count, next_attempt_at, processed_at)
-       VALUES ($1, 1, clock_timestamp() + INTERVAL '30 seconds', clock_timestamp())
-       ON CONFLICT (obligation_id) DO UPDATE SET
-         failure_count = adcp_reporting_lifecycle_state.failure_count + 1,
-         next_attempt_at = clock_timestamp() + (LEAST(
-           ${MAX_LIFECYCLE_BACKOFF_SECONDS}, 30 * POWER(2, LEAST(6, adcp_reporting_lifecycle_state.failure_count))
-         ) * INTERVAL '1 second')`,
-      [input.reporting_obligation_id]
-    );
-  }
-  /** Authoritative instant from the database clock, at microsecond precision. */
-  async readLedgerInstant() {
-    const result = await this.query(
-      `SELECT ${rfc3339Microseconds("clock_timestamp()")} AS instant`
-    );
-    return result.rows[0].instant;
-  }
-  async readObligatedConsumerRosterVersion(input) {
-    if (!this.managedDelivery || !this.obligatedConsumers) return void 0;
-    const accountId = await this.query(
-      "SELECT account_id FROM adcp_reporting_obligations WHERE obligation_id = $1",
-      [input.reporting_obligation_id]
-    );
-    const account_id = accountId.rows[0]?.account_id;
-    if (!account_id) return void 0;
-    const supplied = await withReportingCallbackDeadline(
-      this.obligatedConsumers({ reporting_obligation_id: input.reporting_obligation_id, account_id }),
-      OBLIGATED_CONSUMERS_DEADLINE_MS,
-      "Reporting obligated-consumer lookup deadline elapsed"
-    );
-    const observed = await this.observedConsumerIds(input.reporting_obligation_id);
-    const version = obligatedConsumerRosterVersionFor(supplied, obligatedConsumerIdsFor(supplied, observed));
-    await this.recordObligatedConsumerRosterVersion({
-      reporting_obligation_id: input.reporting_obligation_id,
-      version
-    });
-    return version;
-  }
-  /** Principals that have engaged with this obligation, as the projection sees them. */
-  async observedConsumerIds(obligationId) {
-    const result = await this.query(
-      `SELECT DISTINCT consumer_id FROM (
-         -- Driven from this obligation's subjects into the receipt subject
-         -- index, like every other obligation-scoped receipt read. Asking the
-         -- global receipt table which of its rows belong to an obligation
-         -- supplies neither account nor consumer, so the roster read scanned
-         -- the whole receipt history once per reconcile and once per
-         -- pre-apply re-check.
-         SELECT receipt.consumer_id
-           FROM adcp_reporting_revisions revision
-           JOIN adcp_reporting_receipts receipt
-             ON receipt.receipt_kind = 'revision' AND receipt.subject_id = revision.revision_id
-          WHERE revision.obligation_id = $1
-         UNION
-         SELECT receipt.consumer_id
-           FROM adcp_reporting_adjustments adjustment
-           JOIN adcp_reporting_receipts receipt
-             ON receipt.receipt_kind = 'adjustment' AND receipt.subject_id = adjustment.adjustment_id
-          WHERE adjustment.obligation_id = $1
-         UNION
-         SELECT status.consumer_id FROM adcp_reporting_consumer_statuses status
-          WHERE status.obligation_id = $1 AND status.consumer_id <> '__legacy_unscoped_consumer__'
-       ) engaged ORDER BY consumer_id`,
-      [obligationId]
-    );
-    return result.rows.map((row) => row.consumer_id);
-  }
-  managedDueTablesReadyCache;
-  /** Whether the managed schema exists, resolved once per store instance. */
-  managedDueTablesReady() {
-    if (!this.managedDelivery) return Promise.resolve(false);
-    this.managedDueTablesReadyCache ??= this.query(
-      `SELECT to_regclass('adcp_reporting_managed_bindings') IS NOT NULL
-          AND to_regclass('adcp_reporting_materializations') IS NOT NULL
-          AND to_regclass('adcp_reporting_receipts') IS NOT NULL AS ready`
-    ).then((result) => result.rows[0]?.ready === true).catch((cause) => {
-      this.managedDueTablesReadyCache = void 0;
-      throw cause;
-    });
-    return this.managedDueTablesReadyCache;
-  }
-  /**
-   * Terminal receipt subjects whose bodies have been pruned.
-   *
-   * The projection decides reconciliation from the receipt rows it can see,
-   * so once an accepted leaf ages out the subject looks unreconciled again
-   * and a settled billing period reopens. The tombstone is the only remaining
-   * proof, so the projection has to consult it.
-   */
-  async listTombstonedAcceptedSubjects(client, query, obligationIds, allConsumers = false, ledgerAsOf) {
-    if (!obligationIds.length || !query.consumer_id && !allConsumers) return { subjects: [], complete: true };
-    const result = await client.query(
-      `SELECT tombstone.receipt_kind, tombstone.subject_id, tombstone.consumer_id
-         FROM adcp_reporting_receipt_tombstones tombstone
-        WHERE tombstone.account_id = $1 AND ($2::text IS NULL OR tombstone.consumer_id = $2)
-          AND tombstone.status = 'accepted' AND tombstone.was_current
-          -- A conclusion still has a place in time. Applying every accepted
-          -- tombstone regardless of when its receipt was filed let a
-          -- historical projection settle a subject on an acceptance that had
-          -- not happened yet at its cutoff. Rows written before the column
-          -- existed fall back to pruned_at, which is never earlier, so the
-          -- fallback can only withhold a conclusion, never invent one.
-          AND ($5::timestamptz IS NULL
-               OR COALESCE(tombstone.subject_recorded_at, tombstone.pruned_at) <= $5::timestamptz)
-          AND ((tombstone.receipt_kind = 'revision' AND EXISTS (
-                  SELECT 1 FROM adcp_reporting_revisions revision
-                   WHERE revision.revision_id = tombstone.subject_id
-                     AND revision.obligation_id = ANY($3::text[])))
-            OR (tombstone.receipt_kind = 'adjustment' AND EXISTS (
-                  SELECT 1 FROM adcp_reporting_adjustments adjustment
-                   WHERE adjustment.adjustment_id = tombstone.subject_id
-                     AND adjustment.obligation_id = ANY($3::text[]))))
-        LIMIT $4`,
-      [
-        query.account_id,
-        allConsumers ? null : query.consumer_id,
-        obligationIds,
-        MAX_SNAPSHOT_ITEMS + 1,
-        ledgerAsOf ?? null
-      ]
-    );
-    const complete = result.rows.length <= MAX_SNAPSHOT_ITEMS;
-    return {
-      complete,
-      subjects: result.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => ({
-        kind: row.receipt_kind === "adjustment" ? "adjustment" : "revision",
-        subjectId: row.subject_id,
-        // Carried through deliberately. An acceptance belongs to the consumer
-        // that gave it, so a lifecycle fold that runs per consumer must not
-        // let A's pruned acceptance settle the obligation on B's behalf.
-        consumerId: row.consumer_id
-      }))
-    };
-  }
-  async managedTablesInstalled(client) {
-    const result = await client.query(
-      `SELECT to_regclass('adcp_reporting_managed_bindings') IS NOT NULL
-          AND to_regclass('adcp_reporting_materializations') IS NOT NULL
-          AND to_regclass('adcp_reporting_receipts') IS NOT NULL AS ready`
-    );
-    return result.rows[0]?.ready === true;
-  }
-  async listManagedChangedObligationIds(client, query, ledgerAsOf, changesAfter) {
-    const result = await client.query(
-      `SELECT DISTINCT changed.obligation_id FROM (
-         SELECT materialization.obligation_id
-           FROM adcp_reporting_materializations materialization
-          WHERE materialization.account_id = $1
-            AND GREATEST(materialization.recorded_at, materialization.changed_at) > $3
-            AND GREATEST(materialization.recorded_at, materialization.changed_at) <= $2
-         UNION ALL
-         SELECT COALESCE(revision.obligation_id, adjustment.obligation_id) AS obligation_id
-           FROM adcp_reporting_receipts receipt
-      LEFT JOIN adcp_reporting_revisions revision
-             ON receipt.receipt_kind = 'revision' AND revision.revision_id = receipt.subject_id
-      LEFT JOIN adcp_reporting_adjustments adjustment
-             ON receipt.receipt_kind = 'adjustment' AND adjustment.adjustment_id = receipt.subject_id
-          WHERE receipt.account_id = $1 AND receipt.consumer_id = $4
-            AND receipt.recorded_at > $3 AND receipt.recorded_at <= $2
-         UNION ALL
-         SELECT obligation.obligation_id
-           FROM adcp_reporting_destination_authorizations authz
-           JOIN adcp_reporting_managed_bindings binding
-             ON binding.account_id = authz.account_id
-            AND binding.destination_ref = authz.destination_ref
-            AND binding.authorization_generation = authz.generation
-           JOIN adcp_reporting_obligations obligation ON obligation.configuration_id = binding.configuration_id
-          WHERE authz.account_id = $1 AND authz.revoked_at IS NOT NULL
-            AND authz.changed_at > $3 AND authz.changed_at <= $2
-       ) changed WHERE changed.obligation_id IS NOT NULL`,
-      [query.account_id, ledgerAsOf, changesAfter, query.consumer_id ?? null]
-    );
-    return new Set(result.rows.map((row) => row.obligation_id));
-  }
-  async listSnapshotManagedBindings(client, configurationIds) {
-    if (!configurationIds.length) return [];
-    const result = await client.query(
-      `SELECT data FROM adcp_reporting_managed_bindings
-        WHERE configuration_id = ANY($1::text[]) ORDER BY configuration_id`,
-      [configurationIds]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async listSnapshotMaterializations(client, obligationIds, ledgerAsOf, changesAfter) {
-    if (!obligationIds.length) return [];
-    const result = await client.query(
-      `SELECT data FROM adcp_reporting_materializations
-        WHERE obligation_id = ANY($1::text[])
-          AND recorded_at <= $2
-          AND ($3::timestamptz IS NULL OR GREATEST(recorded_at, changed_at) > $3)
-        ORDER BY obligation_id, attempt, materialization_id
-        LIMIT $4`,
-      [obligationIds, ledgerAsOf, changesAfter ?? null, MAX_SNAPSHOT_ITEMS + 1]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async listSnapshotMaterializationProjection(client, obligationIds, ledgerAsOf) {
-    if (!obligationIds.length) return [];
-    const result = await client.query(
-      `SELECT materialization.data, authz.revoked_at
-         FROM adcp_reporting_materializations materialization
-         JOIN adcp_reporting_destination_authorizations authz
-           ON authz.account_id = materialization.account_id
-          AND authz.destination_ref = materialization.destination_ref
-          AND authz.generation = materialization.authorization_generation
-        WHERE materialization.obligation_id = ANY($1::text[])
-          AND materialization.recorded_at <= $2
-        ORDER BY materialization.obligation_id, materialization.attempt, materialization.materialization_id
-        LIMIT $3`,
-      [obligationIds, ledgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
-    );
-    return result.rows.map((row) => {
-      if (!row.revoked_at || row.data.status !== "available" && row.data.status !== "delivered") return row.data;
-      return {
-        ...row.data,
-        status: "failed",
-        failed_at: row.revoked_at.toISOString(),
-        failure_code: "AUTHORIZATION_REVOKED"
-      };
-    });
-  }
-  async listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, kind) {
-    if (!obligationIds.length || !query.consumer_id) return [];
-    const join = kind === "revision" ? "JOIN adcp_reporting_revisions subject ON subject.revision_id = receipt.subject_id" : "JOIN adcp_reporting_adjustments subject ON subject.adjustment_id = receipt.subject_id";
-    const result = await client.query(
-      `SELECT receipt.data FROM adcp_reporting_receipts receipt
-        ${join}
-        WHERE receipt.account_id = $1 AND receipt.consumer_id = $2
-          AND receipt.receipt_kind = $3 AND subject.obligation_id = ANY($4::text[])
-          AND receipt.recorded_at <= $5
-          AND ($6::timestamptz IS NULL OR receipt.recorded_at > $6)
-        ORDER BY subject.obligation_id, receipt.recorded_at, receipt.reporting_receipt_id
-        LIMIT $7`,
-      [
-        query.account_id,
-        query.consumer_id,
-        kind,
-        obligationIds,
-        ledgerAsOf,
-        changesAfter ?? null,
-        MAX_SNAPSHOT_ITEMS + 1
-      ]
-    );
-    return result.rows.map((row) => row.data);
-  }
-  async one(sql, params) {
-    const result = await this.query(sql, params);
-    return result.rows[0] ? clone(result.rows[0].data) : null;
-  }
-  async putImmutable(insertSql, insertParams, readSql, readParams, proposed, fingerprint, advisoryLock, leaseFence, legacyReplayEquivalent, onInserted) {
-    return this.transaction(
-      async (client) => {
-        const inserted = await client.query(insertSql, insertParams);
-        const value = inserted.rows[0]?.data ?? (await client.query(readSql, readParams)).rows[0]?.data;
-        if (!value) {
-          if (leaseFence) {
-            const lease = await client.query(
-              `SELECT 1 FROM adcp_reporting_obligations
-                WHERE obligation_id = $1 AND lease_owner = $2 AND lease_generation = $3
-                  AND lease_expires_at > clock_timestamp()`,
-              [leaseFence.obligationId, leaseFence.owner, leaseFence.generation]
-            );
-            if (lease.rowCount === 1) throw new ReportingLedgerContinuityError();
-            throw new ReportingLedgerLeaseLostError();
-          }
-          throw new Error("Immutable reporting ledger replay could not be resolved");
-        }
-        if (fingerprint(value) !== fingerprint(proposed) && !legacyReplayEquivalent?.(value, proposed)) {
-          throw new Error("Immutable reporting ledger identity names different content");
-        }
-        if (inserted.rowCount === 1) await onInserted?.(client, clone(value));
-        return { inserted: inserted.rowCount === 1, value: clone(value) };
-      },
-      { preBeginAdvisoryLock: advisoryLock }
-    );
-  }
-  async accountLockForObligation(obligationId) {
-    const result = await this.query(
-      "SELECT account_id FROM adcp_reporting_obligations WHERE obligation_id = $1",
-      [obligationId]
-    );
-    const accountId = result.rows[0]?.account_id;
-    if (!accountId) throw new Error("Reporting obligation is unavailable");
-    return accountLock(accountId);
-  }
-  async accountLockForIssue(issueId) {
-    const result = await this.query(
-      "SELECT obligation_id FROM adcp_reporting_issues WHERE issue_id = $1",
-      [issueId]
-    );
-    return result.rows[0]?.obligation_id ? this.accountLockForObligation(result.rows[0].obligation_id) : null;
-  }
-  async accountLockForTransition(transitionId) {
-    const result = await this.query(
-      "SELECT obligation_id FROM adcp_reporting_transitions WHERE transition_id = $1",
-      [transitionId]
-    );
-    return result.rows[0]?.obligation_id ? this.accountLockForObligation(result.rows[0].obligation_id) : null;
-  }
-  async transaction(work, options = {}) {
-    let client;
-    try {
-      client = await this.pool.connect();
-    } catch (cause) {
-      throw new Error("PostgresReportingLedgerStore database connection failed", { cause });
-    }
-    let releaseError;
-    let transactionStarted = false;
-    let advisoryLockAcquired = false;
-    let lockTimeoutSet = false;
-    try {
-      if (options.preBeginAdvisoryLock) {
-        await client.query("SET lock_timeout = '5s'");
-        lockTimeoutSet = true;
-        await client.query("SELECT pg_advisory_lock(hashtextextended($1, 0))", [options.preBeginAdvisoryLock]);
-        advisoryLockAcquired = true;
-        await client.query("RESET lock_timeout");
-        lockTimeoutSet = false;
-      }
-      await client.query(`BEGIN ISOLATION LEVEL ${options.isolation ?? "READ COMMITTED"}`);
-      transactionStarted = true;
-      const result = await work(client);
-      await client.query("COMMIT");
-      transactionStarted = false;
-      return result;
-    } catch (error) {
-      if (transactionStarted) {
-        try {
-          await client.query("ROLLBACK");
-          transactionStarted = false;
-        } catch (rollbackCause) {
-          releaseError = rollbackCause instanceof Error ? rollbackCause : new Error("Reporting ledger rollback failed");
-        }
-      }
-      if (error instanceof ReportingLedgerLeaseLostError || error instanceof ReportingLedgerContinuityError || error instanceof ReportingLedgerIssueIntegrityError || error instanceof ReportingLedgerPeriodRetiredError || error instanceof ReportingLedgerSnapshotUnavailableError || error instanceof ReportingConsumerStatusConflictError || isReportingRowStoreError(error)) {
-        throw error;
-      }
-      throw new Error("PostgresReportingLedgerStore transaction failed", { cause: error });
-    } finally {
-      if (lockTimeoutSet) {
-        try {
-          await client.query("RESET lock_timeout");
-        } catch (resetCause) {
-          releaseError = resetCause instanceof Error ? resetCause : new Error("Reporting ledger lock timeout reset failed");
-        }
-      }
-      if (options.preBeginAdvisoryLock && advisoryLockAcquired) {
-        try {
-          await client.query("SELECT pg_advisory_unlock(hashtextextended($1, 0))", [options.preBeginAdvisoryLock]);
-        } catch (unlockCause) {
-          releaseError = unlockCause instanceof Error ? unlockCause : new Error("Reporting ledger unlock failed");
-        }
-      }
-      client.release(releaseError);
-    }
-  }
-  async query(sql, params) {
-    try {
-      return await this.pool.query(sql, params);
-    } catch (cause) {
-      throw new Error("PostgresReportingLedgerStore database operation failed", { cause });
-    }
-  }
-}
-function snapshotItems(snapshot) {
-  const visibleRevisions = snapshot.query.finality ? snapshot.revisions.filter((value) => snapshot.query.finality.includes(value.finality)) : snapshot.revisions;
-  const visibleRevisionIds = new Set(visibleRevisions.map((value) => value.reporting_revision_id));
-  const revisions = /* @__PURE__ */ new Map();
-  for (const revision of visibleRevisions) {
-    const values = revisions.get(revision.reporting_obligation_id) ?? [];
-    values.push(revision);
-    revisions.set(revision.reporting_obligation_id, values);
-  }
-  const adjustments = /* @__PURE__ */ new Map();
-  for (const adjustment of snapshot.adjustments) {
-    if (snapshot.query.finality && !visibleRevisionIds.has(adjustment.adjusts_reporting_revision_id)) continue;
-    const values = adjustments.get(adjustment.reporting_obligation_id) ?? [];
-    values.push(adjustment);
-    adjustments.set(adjustment.reporting_obligation_id, values);
-  }
-  const obligationByRevision = new Map(
-    snapshot.revisions.map((value) => [value.reporting_revision_id, value.reporting_obligation_id])
-  );
-  const obligationByAdjustment = new Map(
-    snapshot.adjustments.map((value) => [value.reporting_adjustment_id, value.reporting_obligation_id])
-  );
-  const materializations = /* @__PURE__ */ new Map();
-  for (const materialization of snapshot.materializations ?? []) {
-    if (snapshot.query.finality && !visibleRevisionIds.has(materialization.reporting_revision_id)) continue;
-    const values = materializations.get(materialization.reporting_obligation_id) ?? [];
-    values.push(materialization);
-    materializations.set(materialization.reporting_obligation_id, values);
-  }
-  const receipts = /* @__PURE__ */ new Map();
-  for (const receipt of snapshot.receipts ?? []) {
-    if (snapshot.query.finality && !visibleRevisionIds.has(receipt.reporting_revision_id)) continue;
-    const obligationId = obligationByRevision.get(receipt.reporting_revision_id);
-    if (!obligationId) continue;
-    const values = receipts.get(obligationId) ?? [];
-    values.push(receipt);
-    receipts.set(obligationId, values);
-  }
-  const adjustmentReceipts = /* @__PURE__ */ new Map();
-  const visibleAdjustmentIds = new Set([...adjustments.values()].flat().map((value) => value.reporting_adjustment_id));
-  for (const receipt of snapshot.adjustmentReceipts ?? []) {
-    if (snapshot.query.finality && !visibleAdjustmentIds.has(receipt.reporting_adjustment_id)) continue;
-    const obligationId = obligationByAdjustment.get(receipt.reporting_adjustment_id);
-    if (!obligationId) continue;
-    const values = adjustmentReceipts.get(obligationId) ?? [];
-    values.push(receipt);
-    adjustmentReceipts.set(obligationId, values);
-  }
-  return [
-    ...snapshot.obligations.flatMap((obligation) => [
-      ...snapshot.query.view === "revision" ? [] : [{ kind: "obligation", value: obligation }],
-      ...(revisions.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
-        kind: "revision",
-        value
-      })),
-      ...(adjustments.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
-        kind: "adjustment",
-        value
-      })),
-      ...(materializations.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
-        kind: "materialization",
-        value
-      })),
-      ...(receipts.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
-        kind: "receipt",
-        value
-      })),
-      ...(adjustmentReceipts.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
-        kind: "adjustment_receipt",
-        value
-      }))
-    ]),
-    ...snapshot.query.view === "periods" || snapshot.query.view === "revision" ? (snapshot.consumerStatuses ?? []).map((value) => ({ kind: "consumer_status", value })) : []
-  ];
-}
-function validateRevisionBinding(revision) {
-  const bytes = Buffer.from(
-    canonicalize({
-      reporting_revision_id: revision.reporting_revision_id,
-      row_count: revision.rows.length,
-      control_totals: revision.wireRevision.control_totals,
-      reporting_rows: revision.rows
-    }),
-    "utf8"
-  );
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  if (revision.binding.algorithm !== "rfc8785_jcs_v1" || revision.binding.sha256 !== sha256 || revision.binding.byteCount !== bytes.byteLength || revision.binding.rowCount !== revision.rows.length || revision.wireRevision.revision_content_sha256 !== sha256) {
-    throw new Error("Reporting revision rows do not match their canonical binding");
-  }
-}
-function statusMatchesObligation(status, obligation) {
-  return status.delivery_config_id === obligation.delivery_config_id && status.delivery_config_version === obligation.delivery_config_version && status.report_definition_id === obligation.report_definition_id && compareReportingInstants(status.period.start, obligation.period.start) === 0 && compareReportingInstants(status.period.end, obligation.period.end) === 0 && status.period.source_timezone === obligation.period.sourceTimezone;
-}
-function currentConsumerStatus(statuses) {
-  const superseded = new Set(
-    statuses.map((value) => value.supersedes_reporting_status_id).filter((value) => Boolean(value))
-  );
-  return statuses.find((value) => !superseded.has(value.reporting_status_id));
-}
-function validateBoundRows(value) {
-  const bytes = Buffer.from(canonicalize(value.rows), "utf8");
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  if (value.binding.algorithm !== "rfc8785_jcs_v1" || value.binding.sha256 !== sha256 || value.binding.byteCount !== bytes.byteLength || value.binding.rowCount !== value.rows.length) {
-    throw new Error("Reporting revision rows do not match their canonical binding");
-  }
-}
-function assertLeaseTarget(reportingObligationId, lease) {
-  if (lease.obligation.reporting_obligation_id !== reportingObligationId) {
-    throw new ReportingLedgerLeaseLostError();
-  }
-}
-function encodeCursor(snapshot, offset) {
-  const payload = { snapshotId: snapshot.snapshotId, offset, queryFingerprint: snapshot.queryFingerprint };
-  return Buffer.from(canonicalJsonV1({ ...payload, digest: digest(payload) }), "utf8").toString("base64url");
-}
-function decodeCursor(cursor, snapshot) {
-  let parsed;
-  try {
-    const decoded = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-    if (!isRecord(decoded)) throw new ReportingLedgerSnapshotUnavailableError();
-    parsed = decoded;
-  } catch {
-    throw new ReportingLedgerSnapshotUnavailableError();
-  }
-  const payload = {
-    snapshotId: parsed.snapshotId,
-    offset: parsed.offset,
-    queryFingerprint: parsed.queryFingerprint
-  };
-  if (parsed.snapshotId !== snapshot.snapshotId || parsed.queryFingerprint !== snapshot.queryFingerprint || !Number.isSafeInteger(parsed.offset) || parsed.offset < 0 || parsed.digest !== digest(payload)) {
-    throw new ReportingLedgerSnapshotUnavailableError();
-  }
-  return parsed.offset;
-}
-function digest(value) {
-  return createHash("sha256").update(canonicalJsonV1(value)).digest("hex");
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function revisionIdentityFingerprint(value) {
-  const { rows: _rows, createdAt: _createdAt, wireRevision, ...identity } = value;
-  const { created_at: _wireCreatedAt, ...stableWireRevision } = wireRevision;
-  return digest(JSON.parse(JSON.stringify({ ...identity, wireRevision: stableWireRevision })));
-}
-function adjustmentIdentityFingerprint(value) {
-  const { rows: _rows, createdAt: _createdAt, wireAdjustment, ...identity } = value;
-  const { created_at: _wireCreatedAt, ...stableWireAdjustment } = wireAdjustment;
-  return digest(JSON.parse(JSON.stringify({ ...identity, wireAdjustment: stableWireAdjustment })));
-}
-function revisionLegacyCanonicalDigestReplay(stored, proposed) {
-  if (stored.wireRevision.canonical_content_digest !== void 0) return false;
-  if (proposed.wireRevision.canonical_content_digest === void 0) return false;
-  const { canonical_content_digest: _digest, ...withoutDigest } = proposed.wireRevision;
-  return revisionIdentityFingerprint({
-    ...proposed,
-    wireRevision: withoutDigest
-  }) === revisionIdentityFingerprint(stored);
-}
-function adjustmentLegacyCanonicalDigestReplay(stored, proposed) {
-  if (stored.wireAdjustment.canonical_adjustment_sha256 !== void 0) return false;
-  const proposedDigest = proposed.wireAdjustment.canonical_adjustment_sha256;
-  if (proposedDigest === void 0) return false;
-  const { canonical_adjustment_sha256: _digest, ...withoutDigest } = proposed.wireAdjustment;
-  if (reportingCanonicalAdjustmentSha256V1(withoutDigest) !== proposedDigest) return false;
-  return adjustmentIdentityFingerprint({
-    ...proposed,
-    wireAdjustment: withoutDigest
-  }) === adjustmentIdentityFingerprint(stored);
-}
-const OBLIGATED_CONSUMERS_DEADLINE_MS = 1e4;
-async function withReportingCallbackDeadline(value, milliseconds, message) {
-  let timer;
-  try {
-    return await Promise.race([
-      value,
-      new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new Error(message)), milliseconds);
-      })
-    ]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-function pendingAtCutoff(value) {
-  const {
-    ready_at: _readyAt,
-    resource: _resource,
-    verification: _verification,
-    failed_at: _failedAt,
-    failure_code: _failureCode,
-    ...pending
-  } = clone(value);
-  return { ...pending, status: "pending" };
-}
-const MANAGED_DUE_ARM = `           OR (EXISTS (
-                 SELECT 1 FROM adcp_reporting_managed_bindings binding
-                  WHERE binding.configuration_id = obligation.configuration_id
-                    AND (
-                      -- A managed change after the last transition. Health is
-                      -- composed from managed state, but only Core evidence
-                      -- and the clock used to schedule a reconcile \u2014 so a
-                      -- settlement, revocation, receipt, consumer status or
-                      -- roster-visible change arriving after a complete left
-                      -- that complete persisted and webhooked forever while
-                      -- a live read of the same obligation degraded.
-                      EXISTS (
-                        SELECT 1 FROM adcp_reporting_materializations m
-                         WHERE m.obligation_id = obligation.obligation_id
-                           AND m.changed_at > watermark.since
-                           AND m.changed_at <= $2)
-                      OR EXISTS (
-                        -- Adjustments are managed health inputs too: after an
-                        -- accepted billing receipt, a correction makes the live
-                        -- read action_required while the persisted health and
-                        -- its webhook stayed complete.
-                        SELECT 1 FROM adcp_reporting_adjustments adj
-                         WHERE adj.obligation_id = obligation.obligation_id
-                           AND adj.recorded_at > watermark.since
-                           AND adj.recorded_at <= $2)
-                      OR EXISTS (
-                        SELECT 1 FROM adcp_reporting_destination_authorizations authz
-                         WHERE authz.account_id = binding.account_id
-                           AND authz.destination_ref = binding.destination_ref
-                           AND GREATEST(authz.changed_at, COALESCE(authz.cleanup_completed_at, authz.changed_at))
-                               > watermark.since
-                           AND authz.changed_at <= $2)
-                      -- Driven from this obligation's subjects into the
-                      -- receipt table's subject index. Asking the global
-                      -- receipt table which of its rows belong to this
-                      -- obligation supplied neither account nor consumer, so
-                      -- every candidate obligation in every sweep re-scanned
-                      -- the whole receipt history.
-                      OR EXISTS (
-                        SELECT 1 FROM adcp_reporting_revisions rv
-                          JOIN adcp_reporting_receipts receipt
-                            ON receipt.receipt_kind = 'revision'
-                           AND receipt.subject_id = rv.revision_id
-                         WHERE rv.obligation_id = obligation.obligation_id
-                           AND receipt.recorded_at > watermark.since
-                           AND receipt.recorded_at <= $2)
-                      OR EXISTS (
-                        SELECT 1 FROM adcp_reporting_adjustments aj
-                          JOIN adcp_reporting_receipts receipt
-                            ON receipt.receipt_kind = 'adjustment'
-                           AND receipt.subject_id = aj.adjustment_id
-                         WHERE aj.obligation_id = obligation.obligation_id
-                           AND receipt.recorded_at > watermark.since
-                           AND receipt.recorded_at <= $2)
-                      OR EXISTS (
-                        SELECT 1 FROM adcp_reporting_consumer_statuses status
-                         WHERE status.obligation_id = obligation.obligation_id
-                           AND status.created_at > watermark.since
-                           AND status.created_at <= $2)
-                      -- An external roster change writes nothing here at all,
-                      -- so the only durable trace is the version recorded at
-                      -- the last reconcile. A null one means never reconciled.
-                      OR state.processed_roster_version IS NULL
-                      -- A roster lives outside this database, so the only way
-                      -- a change can re-arm anything is if someone records
-                      -- it. Every read of the roster publishes the version it
-                      -- saw; a difference from what was last reconciled is a
-                      -- due condition. Without this the first reconcile made
-                      -- processed_roster_version non-null and no later roster
-                      -- change could ever schedule work again.
-                      OR state.current_roster_version IS DISTINCT FROM state.processed_roster_version
-                      -- A retained resource expiring is a health change with
-                      -- no row written anywhere, so nothing else can notice it.
-                      OR EXISTS (
-                        SELECT 1 FROM adcp_reporting_materializations m
-                         WHERE m.obligation_id = obligation.obligation_id
-                           AND m.status IN ('available', 'delivered')
-                           AND (m.data -> 'resource' ->> 'expires_at')::timestamptz <= $2
-                           AND (m.data -> 'resource' ->> 'expires_at')::timestamptz
-                               > watermark.since)
-                    )
-               ))
-`;
-function obligatedConsumerIdsFor(supplied, observed) {
-  return supplied.complete === true ? [...new Set(supplied.ids)].sort() : [.../* @__PURE__ */ new Set([...supplied.ids, ...observed])].sort();
-}
-function obligatedConsumerRosterVersionFor(supplied, ids) {
-  return supplied.version ?? digest({ ids, complete: supplied.complete === true });
-}
-const MAX_ROSTER_REFRESH_PER_SWEEP = 25;
-const MAX_LIFECYCLE_BACKOFF_SECONDS = 900;
-function rfc3339Microseconds(expression) {
-  return `to_char(${expression} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')`;
-}
-function accountLock(accountId) {
-  return `adcp-reporting-account:${accountId}`;
-}
-function objectLock(bindingId, objectRef) {
-  return `adcp-reporting-object:${bindingId}:${objectRef}`;
-}
-async function resolveStoredFinalityBaseline(transaction, obligationId) {
-  const latest = await transaction.query(
-    `SELECT transition_id, data->>'finality' AS finality
-       FROM adcp_reporting_transitions
-      WHERE obligation_id = $1 ORDER BY transition_sequence DESC LIMIT 1
-      FOR UPDATE`,
-    [obligationId]
-  );
-  const previous = latest.rows[0];
-  if (!previous) return "none";
-  if (previous.finality) return previous.finality;
-  await transaction.query(
-    `UPDATE adcp_reporting_transitions
-        SET data = data || jsonb_build_object('finality', 'none')
-      WHERE transition_id = $1 AND NOT (data ? 'finality')`,
-    [previous.transition_id]
-  );
-  return "none";
-}
-async function assertNoLegacyPendingTransitions(transaction, obligationId) {
-  const pending = await transaction.query(
-    `SELECT transition_id FROM adcp_reporting_transitions
-      WHERE obligation_id = $1 AND data->>'notifiedAt' IS NULL
-      LIMIT 1`,
-    [obligationId]
-  );
-  if (pending.rowCount !== 0) {
-    throw new Error(
-      "Drain or explicitly resolve legacy pending reporting transitions before enabling transactional notification activity"
-    );
-  }
-}
-async function assertFinalityWriterFence(work) {
-  try {
-    return await work();
-  } catch (error) {
-    if (isFinalityWriterFenceViolation(error)) {
-      throw new Error(
-        "Reporting transition rejected by the finality writer fence: every transition written after REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION must record an observed finality. Drain pre-SDK-14 writers before installing the fence.",
-        { cause: error }
-      );
-    }
-    throw error;
-  }
-}
-function isFinalityWriterFenceViolation(error) {
-  for (let current = error; current instanceof Error; current = current.cause) {
-    const candidate = current;
-    if (candidate.code === "23514" && candidate.constraint === REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT) return true;
-  }
-  return false;
-}
-function consumerStatusChainKeyForObligation(obligation) {
-  return reportingConsumerStatusChainKeyFromIdentityV1({
-    delivery_config_id: obligation.delivery_config_id,
-    delivery_config_version: obligation.delivery_config_version,
-    report_definition_id: obligation.report_definition_id,
-    periodStart: obligation.period.start,
-    periodEnd: obligation.period.end,
-    sourceTimezone: obligation.period.sourceTimezone
-  });
-}
-function boundedConsumerStatusErrorField(errorField) {
-  return errorField && !errorField.includes("\0") && isWellFormedUnicodeString(errorField) && Buffer.byteLength(errorField, "utf8") <= REPORTING_CONSUMER_STATUS_ERROR_FIELD_MAX_BYTES ? { errorField } : {};
-}
-function boundedConsumerStatusErrorKeyword(errorKeyword) {
-  return errorKeyword && /^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(errorKeyword) ? { errorKeyword } : {};
-}
-function boundedConsumerStatusSafeMessage(safeMessage) {
-  const wellFormed = Buffer.from(safeMessage, "utf8").toString("utf8").replace(/\u0000/g, "\uFFFD");
-  if (Buffer.byteLength(wellFormed, "utf8") <= REPORTING_CONSUMER_STATUS_ERROR_MESSAGE_MAX_BYTES) {
-    return wellFormed || "Reporting consumer status was rejected";
-  }
-  let bounded = "";
-  let bytes = 0;
-  for (const character of wellFormed) {
-    const characterBytes = Buffer.byteLength(character, "utf8");
-    if (bytes + characterBytes > REPORTING_CONSUMER_STATUS_ERROR_MESSAGE_MAX_BYTES) break;
-    bounded += character;
-    bytes += characterBytes;
-  }
-  return bounded || "Reporting consumer status was rejected";
-}
-function storedResultsJsonBytes(results) {
-  return Buffer.byteLength(JSON.stringify(results), "utf8");
-}
-function boundStoredConsumerStatusResults(storedResults, results) {
-  if (storedResultsJsonBytes(storedResults) <= REPORTING_CONSUMER_STATUS_BATCH_RESULT_MAX_BYTES) return;
-  for (let index = storedResults.length - 1; index >= 0; index -= 1) {
-    const stored = storedResults[index];
-    const result = results[index];
-    if (stored?.errorField !== void 0) {
-      delete stored.errorField;
-      if (result && !("value" in result)) delete result.errorField;
-      if (storedResultsJsonBytes(storedResults) <= REPORTING_CONSUMER_STATUS_BATCH_RESULT_MAX_BYTES) return;
-    }
-  }
-  const fallback = "Reporting consumer status was rejected";
-  for (let index = storedResults.length - 1; index >= 0; index -= 1) {
-    const stored = storedResults[index];
-    const result = results[index];
-    if (stored?.kind === "failed" && stored.safeMessage !== fallback) {
-      stored.safeMessage = fallback;
-      if (result && !("value" in result)) result.safeMessage = fallback;
-      if (storedResultsJsonBytes(storedResults) <= REPORTING_CONSUMER_STATUS_BATCH_RESULT_MAX_BYTES) return;
-    }
-  }
-  throw new RangeError("Reporting consumer status replay metadata exceeds 64 KiB");
-}
-function checkpointScopeFingerprint(query) {
-  const sorted = (value) => [...value].sort();
-  return digest({
-    account_id: query.account_id,
-    ...query.consumer_id ? { consumer_id: query.consumer_id } : {},
-    ...query.media_buy_ids ? { media_buy_ids: sorted(query.media_buy_ids) } : {},
-    ...query.delivery_config_ids ? { delivery_config_ids: sorted(query.delivery_config_ids) } : {},
-    ...query.feed_purposes ? { feed_purposes: sorted(query.feed_purposes) } : {},
-    ...query.health ? { health: sorted(query.health) } : {},
-    ...query.finality ? { finality: sorted(query.finality) } : {},
-    ...query.reporting_revision_id ? { reporting_revision_id: query.reporting_revision_id } : {},
-    ...query.period ? { period: query.period } : {}
-  });
-}
-function clone(value) {
-  return structuredClone(value);
-}
-function positiveInteger(value, name) {
-  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be a positive safe integer`);
-}
-function withoutRows(value) {
-  const { rows: _rows, ...rest } = value;
-  return rest;
-}
-function withRows(value, rows) {
-  return Array.isArray(value.rows) ? value : { ...value, rows: clone(rows) };
-}
-export {
-  PostgresReportingLedgerStore,
-  REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT,
-  REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION,
-  REPORTING_LEDGER_MIGRATION,
-  ReportingLedgerContinuityError,
-  ReportingLedgerLeaseLostError,
-  ReportingLedgerPeriodRetiredError,
-  sweepExpiredReportingLedgerState
-};