@ainyc/canonry 4.138.0 → 4.139.1

package/dist/{chunk-3KGJ7BXW.js → chunk-YLHZQ7HQ.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-R3GAWKHM.js";
+} from "./chunk-IYTHIAAE.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -50,8 +50,10 @@ import {
   deliverWebhook,
   determineCitationState,
   discoverySessions,
+  doctorHealthState,
   downloadFile,
   dropLegacyCredentialColumns,
+  ensureCurrentQueryBasketRevision,
   executeDiscovery,
   extractLegacyCredentials,
   extractRecommendedCompetitors,
@@ -70,11 +72,9 @@ import {
   gbpPlaceDetails,
   getAttributes,
   getCrawlIssues,
-  getLinkCounts,
   getLodging,
   getPlaceDetails,
   getUrlInfo,
-  getUrlLinks,
   groupRunsByCreatedAt,
   gscCoverageSnapshots,
   gscDailyTotals,
@@ -89,6 +89,7 @@ import {
   installDuckdb,
   isDuckdbInstalled,
   isValidReleaseId,
+  latestQueryBasketRevision,
   listCachedReleases,
   listLocations,
   listMonthlyKeywords,
@@ -113,13 +114,16 @@ import {
   refreshAccessToken,
   researchRunQueries,
   researchRuns,
+  resolveDestination,
+  resolveVercelSyncDeadlineMs,
   resolveWebhookTarget,
   runs,
   schedules,
   siteAuditPages,
   siteAuditSnapshots,
+  toAlertView,
   usageCounters
-} from "./chunk-GO24URVP.js";
+} from "./chunk-DJHSOPMU.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -206,7 +210,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-RJ7OW6W6.js";
+} from "./chunk-OA2EGCUS.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -537,11 +541,11 @@ function checkLatestVersionForServer(opts) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto23 from "crypto";
+import crypto22 from "crypto";
 import fs8 from "fs";
 import path9 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { and as and16, eq as eq22 } from "drizzle-orm";
+import { and as and15, eq as eq21 } from "drizzle-orm";
 import Fastify from "fastify";
 import os5 from "os";
 
@@ -958,7 +962,14 @@ var geminiAdapter = {
       model: raw.model,
       servedModel: raw.servedModel,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      // Retrieval detection is not implemented for this provider. Its candidate
+      // marker is present on 100% of stored rows, so it has never been shown to
+      // discriminate a non-retrieving answer and wiring it up would hardcode
+      // `used`. `unknown` states what we actually know. The contract is a
+      // declaration about how we build the request, so it is always knowable.
+      retrievalStatus: "unknown",
+      retrievalContract: "native-auto-v1"
     };
   },
   normalizeResult(raw) {
@@ -975,7 +986,8 @@ var geminiAdapter = {
       answerText: normalized.answerText,
       citedDomains: normalized.citedDomains,
       groundingSources: normalized.groundingSources,
-      searchQueries: normalized.searchQueries
+      searchQueries: normalized.searchQueries,
+      retrievalStatus: "unknown"
     };
   },
   async generateText(prompt, config) {
@@ -1300,7 +1312,14 @@ var openaiAdapter = {
       model: raw.model,
       servedModel: raw.servedModel,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      // Retrieval detection is not implemented for this provider. Its candidate
+      // marker is present on 100% of stored rows, so it has never been shown to
+      // discriminate a non-retrieving answer and wiring it up would hardcode
+      // `used`. `unknown` states what we actually know. The contract is a
+      // declaration about how we build the request, so it is always knowable.
+      retrievalStatus: "unknown",
+      retrievalContract: "native-auto-v1"
     };
   },
   normalizeResult(raw) {
@@ -1317,7 +1336,8 @@ var openaiAdapter = {
       answerText: normalized.answerText,
       citedDomains: normalized.citedDomains,
       groundingSources: normalized.groundingSources,
-      searchQueries: normalized.searchQueries
+      searchQueries: normalized.searchQueries,
+      retrievalStatus: "unknown"
     };
   },
   async generateText(prompt, config) {
@@ -1350,6 +1370,7 @@ async function withRetry4(fn, options = {}) {
 // ../provider-claude/src/normalize.ts
 var DEFAULT_MODEL3 = "claude-sonnet-4-6";
 var VALIDATION_PATTERN = /^claude-/;
+var CLAUDE_RETRIEVAL_CONTRACT = "search-required-v1";
 function resolveModel2(config) {
   const m = config.model;
   if (!m) return DEFAULT_MODEL3;
@@ -1424,6 +1445,9 @@ async function executeTrackedQuery3(input) {
         model,
         max_tokens: 4096,
         tools: [webSearchTool],
+        // search-required-v1: retrieval is guaranteed by the API control, so the
+        // query text and answer substance stay untouched. See the contract note.
+        tool_choice: { type: "tool", name: "web_search" },
         messages: [{ role: "user", content: input.query }]
       })
     );
@@ -1438,7 +1462,9 @@ async function executeTrackedQuery3(input) {
       model,
       servedModel: extractServedModel3(rawResponse),
       groundingSources: parsed.groundingSources,
-      searchQueries: parsed.searchQueries
+      searchQueries: parsed.searchQueries,
+      retrievalStatus: parsed.retrievalStatus,
+      retrievalContract: CLAUDE_RETRIEVAL_CONTRACT
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1456,7 +1482,8 @@ function normalizeResult3(raw) {
     answerText: parsed.answerText,
     citedDomains,
     groundingSources,
-    searchQueries
+    searchQueries,
+    retrievalStatus: useParsed ? parsed.retrievalStatus : raw.retrievalStatus
   };
 }
 function hasParsedResponseContent3(rawResponse) {
@@ -1475,6 +1502,7 @@ function reparseStoredResult3(rawResponse) {
     citedDomains: extractCitedDomainsFromSources3(groundingSources),
     groundingSources,
     searchQueries,
+    retrievalStatus: extractRetrievalStatusFromRaw(rawResponse),
     ...providerErrors.length > 0 ? { providerError: `web_search tool error: ${providerErrors.join(", ")}` } : {}
   };
 }
@@ -1514,6 +1542,17 @@ function extractGroundingSourcesFromRaw2(rawResponse) {
   }
   return sources;
 }
+function extractRetrievalStatusFromRaw(rawResponse) {
+  try {
+    const content = rawResponse.content;
+    if (!Array.isArray(content) || content.length === 0) return "unknown";
+    return content.some(
+      (block) => block.type === "server_tool_use" && block.name === "web_search"
+    ) ? "used" : "not-used";
+  } catch {
+    return "unknown";
+  }
+}
 function extractSearchQueriesFromRaw3(rawResponse) {
   const queries2 = /* @__PURE__ */ new Set();
   try {
@@ -1661,7 +1700,9 @@ var claudeAdapter = {
       model: raw.model,
       servedModel: raw.servedModel,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      retrievalStatus: raw.retrievalStatus,
+      retrievalContract: raw.retrievalContract
     };
   },
   normalizeResult(raw) {
@@ -1670,7 +1711,12 @@ var claudeAdapter = {
       rawResponse: raw.rawResponse,
       model: raw.model,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      // The shared RawQueryResult now carries retrieval, so nothing is lost
+      // across this boundary. A reconstruction that predates the field falls
+      // back to `unknown` rather than asserting an absence.
+      retrievalStatus: raw.retrievalStatus ?? "unknown",
+      retrievalContract: raw.retrievalContract ?? CLAUDE_RETRIEVAL_CONTRACT
     };
     const normalized = normalizeResult3(claudeRaw);
     return {
@@ -1678,7 +1724,8 @@ var claudeAdapter = {
       answerText: normalized.answerText,
       citedDomains: normalized.citedDomains,
       groundingSources: normalized.groundingSources,
-      searchQueries: normalized.searchQueries
+      searchQueries: normalized.searchQueries,
+      retrievalStatus: normalized.retrievalStatus
     };
   },
   async generateText(prompt, config) {
@@ -1894,7 +1941,11 @@ var localAdapter = {
       model: raw.model,
       servedModel: raw.servedModel,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      // A plain chat completion with no web access: there is no retrieval step
+      // to report, which is what `not-applicable` means.
+      retrievalStatus: "not-applicable",
+      retrievalContract: "native-auto-v1"
     };
   },
   normalizeResult(raw) {
@@ -1911,7 +1962,8 @@ var localAdapter = {
       answerText: normalized.answerText,
       citedDomains: normalized.citedDomains,
       groundingSources: normalized.groundingSources,
-      searchQueries: normalized.searchQueries
+      searchQueries: normalized.searchQueries,
+      retrievalStatus: "not-applicable"
     };
   },
   async generateText(prompt, config) {
@@ -2360,7 +2412,8 @@ function normalizeResult5(raw) {
     answerText,
     citedDomains: extractCitedDomains(raw.groundingSources),
     groundingSources: raw.groundingSources,
-    searchQueries: raw.searchQueries
+    searchQueries: raw.searchQueries,
+    retrievalStatus: raw.retrievalStatus ?? "unknown"
   };
 }
 
@@ -2470,6 +2523,12 @@ var cdpChatgptAdapter = {
         model: "chatgpt-web",
         groundingSources,
         searchQueries: [input.query],
+        // This surface is scraped from the rendered web UI, which exposes no
+        // reliable signal for whether a retrieval step ran behind the answer.
+        // `searchQueries` here is the query we submitted, not evidence of a
+        // search the product performed.
+        retrievalStatus: "unknown",
+        retrievalContract: "native-auto-v1",
         screenshotPath: capturedScreenshotPath
       };
     } catch (err) {
@@ -2784,7 +2843,14 @@ var perplexityAdapter = {
       model: raw.model,
       servedModel: raw.servedModel,
       groundingSources: raw.groundingSources,
-      searchQueries: raw.searchQueries
+      searchQueries: raw.searchQueries,
+      // Retrieval detection is not implemented for this provider. Its candidate
+      // marker is present on 100% of stored rows, so it has never been shown to
+      // discriminate a non-retrieving answer and wiring it up would hardcode
+      // `used`. `unknown` states what we actually know. The contract is a
+      // declaration about how we build the request, so it is always knowable.
+      retrievalStatus: "unknown",
+      retrievalContract: "native-auto-v1"
     };
   },
   normalizeResult(raw) {
@@ -2801,7 +2867,8 @@ var perplexityAdapter = {
       answerText: normalized.answerText,
       citedDomains: normalized.citedDomains,
       groundingSources: normalized.groundingSources,
-      searchQueries: normalized.searchQueries
+      searchQueries: normalized.searchQueries,
+      retrievalStatus: "unknown"
     };
   },
   async generateText(prompt, config) {
@@ -3620,6 +3687,11 @@ var JobRunner = class {
                 sourceCount: citedUrlCapture.sourceCount,
                 resolvedCount: citedUrlCapture.resolvedCount,
                 captureVersion: citedUrlCapture.captureVersion,
+                // Retrieval is the adapter's own observation, never inferred
+                // from citation counts. Both branches record it so no snapshot
+                // can be written unmarked.
+                retrievalStatus: normalized.retrievalStatus,
+                retrievalContract: raw.retrievalContract,
                 competitorOverlap: overlap,
                 recommendedCompetitors: extractedCompetitors,
                 location: runLocation?.label ?? null,
@@ -3651,6 +3723,11 @@ var JobRunner = class {
                 sourceCount: citedUrlCapture.sourceCount,
                 resolvedCount: citedUrlCapture.resolvedCount,
                 captureVersion: citedUrlCapture.captureVersion,
+                // Retrieval is the adapter's own observation, never inferred
+                // from citation counts. Both branches record it so no snapshot
+                // can be written unmarked.
+                retrievalStatus: normalized.retrievalStatus,
+                retrievalContract: raw.retrievalContract,
                 competitorOverlap: overlap,
                 recommendedCompetitors: extractedCompetitors,
                 location: runLocation?.label ?? null,
@@ -6087,155 +6164,10 @@ function computeSummary2(rows) {
   return computeBacklinkSummaryMetrics(rows);
 }
 
-// src/bing-backlinks-sync.ts
+// src/discovery-run.ts
 import crypto13 from "crypto";
 import { and as and9, eq as eq11 } from "drizzle-orm";
-var log11 = createLogger("BingBacklinkSync");
-var DEFAULT_MAX_PAGES = 200;
-var LINK_COUNTS_MAX_PAGES = 50;
-var URL_LINKS_MAX_PAGES = 20;
-function bingReleaseId(date) {
-  return `bing-${date.toISOString().slice(0, 10)}`;
-}
-function aggregateInboundLinksByDomain(links, targetDomain) {
-  const target = hostOf(targetDomain);
-  const byHost = /* @__PURE__ */ new Map();
-  for (const link of links) {
-    const host = hostOf(link.Url);
-    if (!host) continue;
-    if (target && hostMatchesDomain(host, target)) continue;
-    let urls = byHost.get(host);
-    if (!urls) {
-      urls = /* @__PURE__ */ new Set();
-      byHost.set(host, urls);
-    }
-    urls.add(link.Url);
-  }
-  return [...byHost.entries()].map(([linkingDomain, urls]) => ({ linkingDomain, numHosts: urls.size })).sort((a, b) => b.numHosts - a.numHosts || a.linkingDomain.localeCompare(b.linkingDomain));
-}
-function computeBingSummary(rows) {
-  return computeBacklinkSummaryMetrics(rows);
-}
-function defaultDeps4() {
-  return { getLinkCounts, getUrlLinks, now: () => /* @__PURE__ */ new Date() };
-}
-async function executeBingBacklinkSync(db, runId, projectId, opts) {
-  const deps = { ...defaultDeps4(), ...opts.deps };
-  const startedAt = deps.now().toISOString();
-  db.update(runs).set({ status: RunStatuses.running, startedAt }).where(eq11(runs.id, runId)).run();
-  try {
-    const project = db.select().from(projects).where(eq11(projects.id, projectId)).get();
-    if (!project) throw new Error(`Project not found: ${projectId}`);
-    const conn = opts.resolveConnection(project.canonicalDomain);
-    if (!conn) throw new Error(`No Bing Webmaster connection for ${project.canonicalDomain}`);
-    const siteUrl = conn.siteUrl;
-    if (!siteUrl) {
-      throw new Error(`Bing connection for ${project.canonicalDomain} has no verified site selected`);
-    }
-    const pages = await deps.getLinkCounts(conn.apiKey, siteUrl, { maxPages: LINK_COUNTS_MAX_PAGES });
-    const maxPages = Math.max(1, opts.maxPages ?? DEFAULT_MAX_PAGES);
-    const targetPages = [...pages].sort((a, b) => b.Count - a.Count).slice(0, maxPages);
-    if (pages.length > targetPages.length) {
-      log11.info("bing-sync.pages-capped", {
-        runId,
-        projectId,
-        sitePagesFound: pages.length,
-        sitePagesPulled: targetPages.length
-      });
-    }
-    const allLinks = [];
-    let pageFailures = 0;
-    for (const page of targetPages) {
-      try {
-        const links = await deps.getUrlLinks(conn.apiKey, siteUrl, page.Url, { maxPages: URL_LINKS_MAX_PAGES });
-        allLinks.push(...links);
-      } catch (err) {
-        pageFailures++;
-        log11.warn("bing-sync.page-failed", {
-          runId,
-          projectId,
-          page: page.Url,
-          error: err instanceof Error ? err.message : String(err)
-        });
-      }
-    }
-    if (targetPages.length > 0 && pageFailures === targetPages.length) {
-      throw new Error(`All ${targetPages.length} Bing inbound-link page fetch(es) failed`);
-    }
-    const rows = aggregateInboundLinksByDomain(allLinks, project.canonicalDomain);
-    const summary = computeBingSummary(rows);
-    const queriedAt = deps.now().toISOString();
-    const release = bingReleaseId(deps.now());
-    const targetDomain = project.canonicalDomain;
-    const source = BacklinkSources["bing-webmaster"];
-    const existing = db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and9(
-      eq11(backlinkSummaries.projectId, projectId),
-      eq11(backlinkSummaries.source, source),
-      eq11(backlinkSummaries.release, release)
-    )).get();
-    const preserveExisting = pageFailures > 0 && !!existing;
-    if (!preserveExisting) {
-      db.transaction((tx) => {
-        tx.delete(backlinkDomains).where(and9(
-          eq11(backlinkDomains.projectId, projectId),
-          eq11(backlinkDomains.source, source),
-          eq11(backlinkDomains.release, release)
-        )).run();
-        if (rows.length > 0) {
-          tx.insert(backlinkDomains).values(rows.map((r) => ({
-            id: crypto13.randomUUID(),
-            projectId,
-            releaseSyncId: null,
-            source,
-            release,
-            targetDomain,
-            linkingDomain: r.linkingDomain,
-            numHosts: r.numHosts,
-            createdAt: queriedAt
-          }))).run();
-        }
-        tx.insert(backlinkSummaries).values({
-          id: crypto13.randomUUID(),
-          projectId,
-          releaseSyncId: null,
-          source,
-          release,
-          targetDomain,
-          totalLinkingDomains: summary.totalLinkingDomains,
-          totalHosts: summary.totalHosts,
-          top10HostsShare: summary.top10HostsShare,
-          queriedAt,
-          createdAt: queriedAt
-        }).onConflictDoUpdate({
-          target: [backlinkSummaries.projectId, backlinkSummaries.source, backlinkSummaries.release],
-          set: {
-            targetDomain,
-            totalLinkingDomains: summary.totalLinkingDomains,
-            totalHosts: summary.totalHosts,
-            top10HostsShare: summary.top10HostsShare,
-            queriedAt
-          }
-        }).run();
-      });
-    }
-    const finishedAt = deps.now().toISOString();
-    const status = pageFailures > 0 ? RunStatuses.partial : RunStatuses.completed;
-    const error = preserveExisting ? `Kept existing ${release} snapshot; ${pageFailures} of ${targetPages.length} inbound-link page fetches failed` : pageFailures > 0 ? `${pageFailures} of ${targetPages.length} inbound-link page fetches failed` : null;
-    db.update(runs).set({ status, error, finishedAt }).where(eq11(runs.id, runId)).run();
-    log11.info("bing-sync.completed", { runId, projectId, release, rows: rows.length, status, pageFailures, preserveExisting });
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
-    const finishedAt = deps.now().toISOString();
-    db.update(runs).set({ status: RunStatuses.failed, error: errorMsg, finishedAt }).where(eq11(runs.id, runId)).run();
-    log11.error("bing-sync.failed", { runId, projectId, error: errorMsg });
-    throw err;
-  }
-}
-
-// src/discovery-run.ts
-import crypto14 from "crypto";
-import { and as and10, eq as eq12 } from "drizzle-orm";
-var log12 = createLogger("DiscoveryRun");
+var log11 = createLogger("DiscoveryRun");
 var DEFAULT_SEED_COUNT = 30;
 var EMBED_RETRY_MAX_RETRIES = 3;
 var EMBED_RETRY_MAX_DELAY_MS = 1e4;
@@ -6268,7 +6200,7 @@ async function embedWithRetry(fn, opts = {}) {
       maxDelayMs: EMBED_RETRY_MAX_DELAY_MS,
       sleep: opts.sleep,
       onRetry: opts.onRetry ?? (({ attempt, delayMs }) => {
-        log12.warn("discovery.embed.retry", { attempt, delayMs });
+        log11.warn("discovery.embed.retry", { attempt, delayMs });
       })
     }
   );
@@ -6276,11 +6208,11 @@ async function embedWithRetry(fn, opts = {}) {
 var QUERIES_PER_INTENT_BUCKET = 6;
 async function executeDiscoveryRun(opts) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  opts.db.update(runs).set({ status: RunStatuses.running, startedAt }).where(eq12(runs.id, opts.runId)).run();
+  opts.db.update(runs).set({ status: RunStatuses.running, startedAt }).where(eq11(runs.id, opts.runId)).run();
   try {
-    const projectRow = opts.db.select().from(projects).where(eq12(projects.id, opts.projectId)).get();
+    const projectRow = opts.db.select().from(projects).where(eq11(projects.id, opts.projectId)).get();
     if (!projectRow) throw new Error(`Project ${opts.projectId} not found`);
-    const projectCompetitors = opts.db.select({ domain: competitors.domain }).from(competitors).where(eq12(competitors.projectId, opts.projectId)).all().map((r) => r.domain.toLowerCase());
+    const projectCompetitors = opts.db.select({ domain: competitors.domain }).from(competitors).where(eq11(competitors.projectId, opts.projectId)).all().map((r) => r.domain.toLowerCase());
     const canonicalDomains = effectiveDomains({
       canonicalDomain: projectRow.canonicalDomain,
       ownedDomains: projectRow.ownedDomains
@@ -6318,8 +6250,8 @@ async function executeDiscoveryRun(opts) {
       seedProvider: result.seedProvider,
       result
     });
-    opts.db.update(runs).set({ status: RunStatuses.completed, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq12(runs.id, opts.runId)).run();
-    log12.info("discovery.completed", {
+    opts.db.update(runs).set({ status: RunStatuses.completed, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq11(runs.id, opts.runId)).run();
+    log11.info("discovery.completed", {
       runId: opts.runId,
       sessionId: opts.sessionId,
       buckets: result.buckets,
@@ -6327,13 +6259,13 @@ async function executeDiscoveryRun(opts) {
     });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    log12.error("discovery.failed", { runId: opts.runId, sessionId: opts.sessionId, error: errorMsg });
+    log11.error("discovery.failed", { runId: opts.runId, sessionId: opts.sessionId, error: errorMsg });
     markSessionFailed(opts.db, opts.sessionId, errorMsg);
     opts.db.update(runs).set({
       status: RunStatuses.failed,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
       error: errorMsg
-    }).where(eq12(runs.id, opts.runId)).run();
+    }).where(eq11(runs.id, opts.runId)).run();
   }
 }
 function buildDefaultDeps(registry) {
@@ -6582,13 +6514,13 @@ function writeDiscoveryInsight(db, input) {
     totalProbes
   });
   db.transaction((tx) => {
-    tx.update(insights).set({ dismissed: true }).where(and10(
-      eq12(insights.projectId, input.projectId),
-      eq12(insights.type, "discovery.basket-divergence"),
-      eq12(insights.dismissed, false)
+    tx.update(insights).set({ dismissed: true }).where(and9(
+      eq11(insights.projectId, input.projectId),
+      eq11(insights.type, "discovery.basket-divergence"),
+      eq11(insights.dismissed, false)
     )).run();
     tx.insert(insights).values({
-      id: crypto14.randomUUID(),
+      id: crypto13.randomUUID(),
       projectId: input.projectId,
       runId: input.runId,
       type: "discovery.basket-divergence",
@@ -6624,10 +6556,10 @@ function buildDiscoveryInsightTitle(input) {
 }
 
 // src/execute-site-audit.ts
-import crypto15 from "crypto";
-import { eq as eq13 } from "drizzle-orm";
+import crypto14 from "crypto";
+import { eq as eq12 } from "drizzle-orm";
 import { runSitemapAudit } from "@ainyc/aeo-audit";
-var log13 = createLogger("SiteAudit");
+var log12 = createLogger("SiteAudit");
 var SITE_AUDIT_DEFAULT_PAGE_LIMIT = 500;
 var SITE_AUDIT_MAX_PAGE_LIMIT = 2e3;
 function toHomepageUrl(canonicalDomain) {
@@ -6688,15 +6620,15 @@ function computeFactorAverages(pages) {
 }
 async function executeSiteAudit(db, runId, projectId, opts = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  db.update(runs).set({ status: "running", startedAt }).where(eq13(runs.id, runId)).run();
+  db.update(runs).set({ status: "running", startedAt }).where(eq12(runs.id, runId)).run();
   try {
-    const project = db.select().from(projects).where(eq13(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq12(projects.id, projectId)).get();
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
     const homepageUrl = toHomepageUrl(project.canonicalDomain);
     const limit = clampSiteAuditLimit(opts.limit);
-    log13.info("start", { runId, projectId, homepageUrl, sitemapUrl: opts.sitemapUrl ?? null, limit });
+    log12.info("start", { runId, projectId, homepageUrl, sitemapUrl: opts.sitemapUrl ?? null, limit });
     await assertSiteAuditUrlAllowed(homepageUrl, "canonicalDomain");
     if (opts.sitemapUrl) await assertSiteAuditUrlAllowed(opts.sitemapUrl, "sitemapUrl");
     const report = await runSitemapAudit(homepageUrl, { sitemapUrl: opts.sitemapUrl, limit });
@@ -6704,7 +6636,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     const pagesErrored = report.pages.filter((page) => page.status === "error").length;
     const auditable = report.pagesDiscovered - report.pagesSkipped;
     if (auditable > report.pagesAudited) {
-      log13.info("truncated", {
+      log12.info("truncated", {
         runId,
         projectId,
         auditable,
@@ -6723,7 +6655,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
     db.transaction((tx) => {
       tx.insert(siteAuditSnapshots).values({
-        id: crypto15.randomUUID(),
+        id: crypto14.randomUUID(),
         projectId,
         runId,
         sitemapUrl: report.sitemapUrl,
@@ -6752,7 +6684,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       }).run();
       for (const page of report.pages) {
         tx.insert(siteAuditPages).values({
-          id: crypto15.randomUUID(),
+          id: crypto14.randomUUID(),
           projectId,
           runId,
           url: page.url,
@@ -6763,9 +6695,9 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
           createdAt: finishedAt
         }).run();
       }
-      tx.update(runs).set({ status, finishedAt }).where(eq13(runs.id, runId)).run();
+      tx.update(runs).set({ status, finishedAt }).where(eq12(runs.id, runId)).run();
     });
-    log13.info("completed", {
+    log12.info("completed", {
       runId,
       projectId,
       status,
@@ -6775,14 +6707,14 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq13(runs.id, runId)).run();
-    log13.error("failed", { runId, projectId, error: errorMsg });
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq12(runs.id, runId)).run();
+    log12.error("failed", { runId, projectId, error: errorMsg });
     throw err;
   }
 }
 
 // src/commands/backfill.ts
-import { and as and11, eq as eq14, inArray as inArray4, isNull, sql as sql5 } from "drizzle-orm";
+import { and as and10, eq as eq13, inArray as inArray4, isNull, sql as sql5 } from "drizzle-orm";
 var SNAPSHOT_BATCH_SIZE = 500;
 async function backfillAnswerVisibilityCommand(opts) {
   const config = loadConfig();
@@ -6790,7 +6722,7 @@ async function backfillAnswerVisibilityCommand(opts) {
   migrate(db);
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq14(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq13(projects.name, projectFilter)).all() : db.select().from(projects).all();
   let examined = 0;
   let updated = 0;
   let wouldUpdate = 0;
@@ -6798,10 +6730,10 @@ async function backfillAnswerVisibilityCommand(opts) {
   let reparsed = 0;
   let providerErrors = 0;
   if (scopedProjects.length > 0) {
-    const runRows = projectFilter ? db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(and11(
-      eq14(runs.kind, RunKinds["answer-visibility"]),
+    const runRows = projectFilter ? db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(and10(
+      eq13(runs.kind, RunKinds["answer-visibility"]),
       inArray4(runs.projectId, scopedProjects.map((project) => project.id))
-    )).all() : db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(eq14(runs.kind, RunKinds["answer-visibility"])).all();
+    )).all() : db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(eq13(runs.kind, RunKinds["answer-visibility"])).all();
     const runIdsByProject = /* @__PURE__ */ new Map();
     for (const run of runRows) {
       const existing = runIdsByProject.get(run.projectId);
@@ -6809,7 +6741,7 @@ async function backfillAnswerVisibilityCommand(opts) {
       else runIdsByProject.set(run.projectId, [run.id]);
     }
     for (const project of scopedProjects) {
-      const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq14(competitors.projectId, project.id)).all().map((row) => row.domain);
+      const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq13(competitors.projectId, project.id)).all().map((row) => row.domain);
       const runIds = runIdsByProject.get(project.id) ?? [];
       if (runIds.length === 0) continue;
       const projectDomains = effectiveDomains({
@@ -6855,7 +6787,12 @@ async function backfillAnswerVisibilityCommand(opts) {
               answerText,
               citedDomains: reparsedResult.citedDomains,
               groundingSources: reparsedResult.groundingSources,
-              searchQueries: reparsedResult.searchQueries
+              searchQueries: reparsedResult.searchQueries,
+              // Backfill recomputes mention and citation state from stored
+              // rows; it never observes retrieval and never writes it back
+              // (nextPatch carries no retrieval field). `unknown` keeps this
+              // reconstruction from asserting anything about a search.
+              retrievalStatus: "unknown"
             };
             const nextCitationState = determineCitationState(normalized, projectDomains);
             const nextCitedDomains = reparsedResult.citedDomains;
@@ -6897,7 +6834,7 @@ async function backfillAnswerVisibilityCommand(opts) {
           } else {
             db.transaction((tx) => {
               for (const update of pendingUpdates) {
-                tx.update(querySnapshots).set(update.patch).where(eq14(querySnapshots.id, update.id)).run();
+                tx.update(querySnapshots).set(update.patch).where(eq13(querySnapshots.id, update.id)).run();
               }
             });
             updated += pendingUpdates.length;
@@ -6946,13 +6883,13 @@ No DB writes performed. Re-run without --dry-run to apply.`);
 function backfillNormalizedPaths(db, opts) {
   const baseConditions = [];
   if (opts?.projectId) {
-    baseConditions.push(eq14(gaTrafficSnapshots.projectId, opts.projectId));
+    baseConditions.push(eq13(gaTrafficSnapshots.projectId, opts.projectId));
   }
   const rows = db.select({
     id: gaTrafficSnapshots.id,
     landingPage: gaTrafficSnapshots.landingPage,
     landingPageNormalized: gaTrafficSnapshots.landingPageNormalized
-  }).from(gaTrafficSnapshots).where(baseConditions.length > 0 ? and11(...baseConditions) : void 0).all();
+  }).from(gaTrafficSnapshots).where(baseConditions.length > 0 ? and10(...baseConditions) : void 0).all();
   let updated = 0;
   let unchanged = 0;
   if (rows.length > 0) {
@@ -6967,7 +6904,7 @@ function backfillNormalizedPaths(db, opts) {
           unchanged++;
           continue;
         }
-        tx.update(gaTrafficSnapshots).set({ landingPageNormalized: next }).where(eq14(gaTrafficSnapshots.id, row.id)).run();
+        tx.update(gaTrafficSnapshots).set({ landingPageNormalized: next }).where(eq13(gaTrafficSnapshots.id, row.id)).run();
         updated++;
       }
     });
@@ -6981,7 +6918,7 @@ async function backfillNormalizedPathsCommand(opts) {
   const projectFilter = opts?.project?.trim();
   let projectId;
   if (projectFilter) {
-    const project = db.select({ id: projects.id }).from(projects).where(eq14(projects.name, projectFilter)).get();
+    const project = db.select({ id: projects.id }).from(projects).where(eq13(projects.name, projectFilter)).get();
     if (!project) {
       const result2 = {
         project: projectFilter,
@@ -7018,13 +6955,13 @@ async function backfillNormalizedPathsCommand(opts) {
 function backfillAiReferralPaths(db, opts) {
   const baseConditions = [];
   if (opts?.projectId) {
-    baseConditions.push(eq14(gaAiReferrals.projectId, opts.projectId));
+    baseConditions.push(eq13(gaAiReferrals.projectId, opts.projectId));
   }
   const rows = db.select({
     id: gaAiReferrals.id,
     landingPage: gaAiReferrals.landingPage,
     landingPageNormalized: gaAiReferrals.landingPageNormalized
-  }).from(gaAiReferrals).where(baseConditions.length > 0 ? and11(...baseConditions) : void 0).all();
+  }).from(gaAiReferrals).where(baseConditions.length > 0 ? and10(...baseConditions) : void 0).all();
   let updated = 0;
   let unchanged = 0;
   if (rows.length > 0) {
@@ -7039,7 +6976,7 @@ function backfillAiReferralPaths(db, opts) {
           unchanged++;
           continue;
         }
-        tx.update(gaAiReferrals).set({ landingPageNormalized: next }).where(eq14(gaAiReferrals.id, row.id)).run();
+        tx.update(gaAiReferrals).set({ landingPageNormalized: next }).where(eq13(gaAiReferrals.id, row.id)).run();
         updated++;
       }
     });
@@ -7053,7 +6990,7 @@ async function backfillAiReferralPathsCommand(opts) {
   const projectFilter = opts?.project?.trim();
   let projectId;
   if (projectFilter) {
-    const project = db.select({ id: projects.id }).from(projects).where(eq14(projects.name, projectFilter)).get();
+    const project = db.select({ id: projects.id }).from(projects).where(eq13(projects.name, projectFilter)).get();
     if (!project) {
       const result2 = {
         project: projectFilter,
@@ -7089,10 +7026,10 @@ async function backfillAiReferralPathsCommand(opts) {
 }
 function backfillProjectAnswerMentions(db, projectId, opts) {
   const isDryRun = opts?.dryRun === true;
-  const project = db.select().from(projects).where(eq14(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq13(projects.id, projectId)).get();
   if (!project) return { examined: 0, updated: 0, mentioned: 0 };
-  const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq14(competitors.projectId, projectId)).all().map((row) => row.domain);
-  const runRows = db.select({ id: runs.id }).from(runs).where(and11(eq14(runs.kind, RunKinds["answer-visibility"]), eq14(runs.projectId, projectId))).all();
+  const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq13(competitors.projectId, projectId)).all().map((row) => row.domain);
+  const runRows = db.select({ id: runs.id }).from(runs).where(and10(eq13(runs.kind, RunKinds["answer-visibility"]), eq13(runs.projectId, projectId))).all();
   const runIds = runRows.map((r) => r.id);
   let examined = 0;
   let updated = 0;
@@ -7134,6 +7071,8 @@ function backfillProjectAnswerMentions(db, projectId, opts) {
         answerText,
         citedDomains,
         groundingSources,
+        // See the note above: retrieval is not observed or written here.
+        retrievalStatus: "unknown",
         searchQueries: []
       };
       const nextCompetitorOverlap = computeCompetitorOverlap(normalized, competitorDomains);
@@ -7164,7 +7103,7 @@ function backfillProjectAnswerMentions(db, projectId, opts) {
       } else {
         db.transaction((tx) => {
           for (const update of pendingUpdates) {
-            tx.update(querySnapshots).set(update.patch).where(eq14(querySnapshots.id, update.id)).run();
+            tx.update(querySnapshots).set(update.patch).where(eq13(querySnapshots.id, update.id)).run();
           }
         });
         updated += pendingUpdates.length;
@@ -7179,7 +7118,7 @@ async function backfillAnswerMentionsCommand(opts) {
   migrate(db);
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq14(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq13(projects.name, projectFilter)).all() : db.select().from(projects).all();
   let examined = 0;
   let updated = 0;
   let wouldUpdate = 0;
@@ -7239,7 +7178,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-5RJHJLYA.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-BGH2MGHB.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -7398,7 +7337,7 @@ async function backfillSnapshotAttributionCommand(opts) {
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
-  const project = db.select().from(projects).where(eq14(projects.name, opts.project)).get();
+  const project = db.select().from(projects).where(eq13(projects.name, opts.project)).get();
   if (!project) {
     throw new Error(`Project "${opts.project}" not found`);
   }
@@ -7409,8 +7348,8 @@ async function backfillSnapshotAttributionCommand(opts) {
     process.stderr.write(`Recovering orphan snapshot attribution for "${project.name}"${mode}...
 `);
   }
-  const events = db.select({ createdAt: auditLog.createdAt, action: auditLog.action, diff: auditLog.diff }).from(auditLog).where(and11(
-    eq14(auditLog.projectId, project.id),
+  const events = db.select({ createdAt: auditLog.createdAt, action: auditLog.action, diff: auditLog.diff }).from(auditLog).where(and10(
+    eq13(auditLog.projectId, project.id),
     inArray4(auditLog.action, ["keywords.appended", "keywords.deleted", "queries.appended", "queries.deleted", "queries.replaced"])
   )).orderBy(auditLog.createdAt).all();
   const history = replayQueryAuditLog(events);
@@ -7418,8 +7357,8 @@ async function backfillSnapshotAttributionCommand(opts) {
     runId: runs.id,
     createdAt: runs.createdAt,
     location: runs.location
-  }).from(runs).innerJoin(querySnapshots, eq14(querySnapshots.runId, runs.id)).where(and11(
-    eq14(runs.projectId, project.id),
+  }).from(runs).innerJoin(querySnapshots, eq13(querySnapshots.runId, runs.id)).where(and10(
+    eq13(runs.projectId, project.id),
     isNull(querySnapshots.queryId),
     isNull(querySnapshots.queryText)
   )).groupBy(runs.id).orderBy(runs.createdAt).all();
@@ -7441,8 +7380,8 @@ async function backfillSnapshotAttributionCommand(opts) {
       provider: querySnapshots.provider,
       createdAt: querySnapshots.createdAt,
       answerText: querySnapshots.answerText
-    }).from(querySnapshots).where(and11(
-      eq14(querySnapshots.runId, run.runId),
+    }).from(querySnapshots).where(and10(
+      eq13(querySnapshots.runId, run.runId),
       isNull(querySnapshots.queryId),
       isNull(querySnapshots.queryText)
     )).orderBy(querySnapshots.provider, querySnapshots.createdAt).all();
@@ -7508,7 +7447,7 @@ async function backfillSnapshotAttributionCommand(opts) {
   if (!isDryRun && updates.length > 0) {
     db.transaction((tx) => {
       for (const u of updates) {
-        tx.update(querySnapshots).set({ queryText: u.queryText }).where(eq14(querySnapshots.id, u.id)).run();
+        tx.update(querySnapshots).set({ queryText: u.queryText }).where(eq13(querySnapshots.id, u.id)).run();
       }
     });
   }
@@ -7582,7 +7521,7 @@ async function backfillTrafficClassificationCommand(opts) {
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
   const isJson = isMachineFormat(opts?.format);
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq14(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq13(projects.name, projectFilter)).all() : db.select().from(projects).all();
   if (scopedProjects.length === 0) {
     if (projectFilter && !isJson) {
       process.stderr.write(`No project named "${projectFilter}".
@@ -7607,8 +7546,8 @@ async function backfillTrafficClassificationCommand(opts) {
     dryRun: isDryRun,
     byBot: {}
   };
-  const unknownCountRow = db.select({ n: sql5`count(*)` }).from(rawEventSamples).where(and11(
-    eq14(rawEventSamples.eventType, "unknown"),
+  const unknownCountRow = db.select({ n: sql5`count(*)` }).from(rawEventSamples).where(and10(
+    eq13(rawEventSamples.eventType, "unknown"),
     inArray4(rawEventSamples.projectId, projectIds)
   )).get();
   result.unknownBefore = Number(unknownCountRow?.n ?? 0);
@@ -7620,8 +7559,8 @@ async function backfillTrafficClassificationCommand(opts) {
     userAgent: rawEventSamples.userAgent,
     pathNormalized: rawEventSamples.pathNormalized,
     status: rawEventSamples.status
-  }).from(rawEventSamples).where(and11(
-    eq14(rawEventSamples.eventType, "unknown"),
+  }).from(rawEventSamples).where(and10(
+    eq13(rawEventSamples.eventType, "unknown"),
     inArray4(rawEventSamples.projectId, projectIds)
   )).all();
   result.examined = unknownSamples.length;
@@ -7660,7 +7599,7 @@ async function backfillTrafficClassificationCommand(opts) {
     result.reclassified++;
     result.byBot[classified.botId] = (result.byBot[classified.botId] ?? 0) + 1;
     if (isDryRun) continue;
-    db.update(rawEventSamples).set({ eventType: userFetch ? TrafficEventKinds["ai-user-fetch"] : TrafficEventKinds.crawler }).where(eq14(rawEventSamples.id, snap.id)).run();
+    db.update(rawEventSamples).set({ eventType: userFetch ? TrafficEventKinds["ai-user-fetch"] : TrafficEventKinds.crawler }).where(eq13(rawEventSamples.id, snap.id)).run();
     const tsHour = new Date(snap.ts);
     tsHour.setUTCMinutes(0, 0, 0);
     if (userFetch) {
@@ -7724,8 +7663,8 @@ async function backfillTrafficClassificationCommand(opts) {
     }
   }
   if (!isDryRun) {
-    const afterRow = db.select({ n: sql5`count(*)` }).from(rawEventSamples).where(and11(
-      eq14(rawEventSamples.eventType, "unknown"),
+    const afterRow = db.select({ n: sql5`count(*)` }).from(rawEventSamples).where(and10(
+      eq13(rawEventSamples.eventType, "unknown"),
       inArray4(rawEventSamples.projectId, projectIds)
     )).get();
     result.unknownAfter = Number(afterRow?.n ?? 0);
@@ -7760,7 +7699,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
 }
 
 // src/commands/skills.ts
-import crypto16 from "crypto";
+import crypto15 from "crypto";
 import fs4 from "fs";
 import os4 from "os";
 import path5 from "path";
@@ -7815,7 +7754,7 @@ function walkRelative(dir, prefix = "") {
   return out.sort();
 }
 function sha256File(filePath) {
-  return crypto16.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
+  return crypto15.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
 }
 function readSkillManifest(skillDir) {
   try {
@@ -8157,10 +8096,11 @@ var ProviderRegistry = class {
 };
 
 // src/scheduler.ts
-import crypto17 from "crypto";
+import crypto16 from "crypto";
 import cron from "node-cron";
-import { and as and12, eq as eq15, inArray as inArray5 } from "drizzle-orm";
-var log14 = createLogger("Scheduler");
+import { and as and11, eq as eq14, inArray as inArray5, notExists, sql as sql6 } from "drizzle-orm";
+var log13 = createLogger("Scheduler");
+var DEFAULT_HEALTH_CRON = "0 */6 * * *";
 function taskKey(projectId, kind) {
   return `${projectId}::${kind}`;
 }
@@ -8172,18 +8112,87 @@ var Scheduler = class {
     this.db = db;
     this.callbacks = callbacks;
   }
+  /**
+   * Give every project a health schedule if it has never had one.
+   *
+   * Ships the schedule with the feature. The six checks that existed before
+   * this had never run on a live instance because nothing scheduled them, and
+   * a health check nobody enables is indistinguishable from no health check.
+   *
+   * Keyed on the row EXISTING, not on it being enabled, so an operator who
+   * deliberately turns this off keeps it off across restarts. Seeded here
+   * rather than in a migration because migrations must stay additive to remain
+   * downgrade-safe, and inserting rows is a data mutation.
+   *
+   * Every 6h, not daily: the cadence has to be shorter than the time-to-damage
+   * it guards. A Vercel source begins discarding traffic once it is 24h behind,
+   * so a daily pass could only ever observe the loss after it started.
+   */
+  ensureHealthSchedules() {
+    const projectsWithoutHealth = this.db.select({ id: projects.id }).from(projects).where(notExists(
+      this.db.select({ one: sql6`1` }).from(schedules).where(and11(
+        eq14(schedules.projectId, projects.id),
+        eq14(schedules.kind, SchedulableRunKinds.doctor)
+      ))
+    )).all();
+    if (projectsWithoutHealth.length === 0) return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const project of projectsWithoutHealth) {
+      this.db.insert(schedules).values({
+        id: crypto16.randomUUID(),
+        projectId: project.id,
+        kind: SchedulableRunKinds.doctor,
+        cronExpr: DEFAULT_HEALTH_CRON,
+        timezone: "UTC",
+        enabled: true,
+        providers: [],
+        nextRunAt: nextRunFromCron(DEFAULT_HEALTH_CRON, "UTC"),
+        createdAt: now,
+        updatedAt: now
+      }).run();
+    }
+    log13.info("health-schedule.seeded", { projectCount: projectsWithoutHealth.length, cron: DEFAULT_HEALTH_CRON });
+  }
+  /**
+   * Record each project's current query set as basket revision 1 if it has
+   * never been recorded. Minting normally happens when a sweep is queued, but a
+   * project whose sweeps are manual (the common cadence: twice a month) would
+   * otherwise keep its analytics on the pre-basket date heuristic for weeks
+   * after the feature ships — with the chart still hiding exactly the history
+   * the basket exists to recover. Boot is the moment the current set is known
+   * and nothing has to be guessed, and ensureCurrentQueryBasketRevision is
+   * idempotent, so restarts are no-ops and an unchanged set never churns
+   * revisions. Runs are NOT stamped retroactively: the revision describes the
+   * set as of now, and historical runs keep their null stamp.
+   */
+  ensureQueryBaskets() {
+    const allProjects = this.db.select({ id: projects.id }).from(projects).all();
+    let minted = 0;
+    for (const project of allProjects) {
+      try {
+        const previous = latestQueryBasketRevision(this.db, project.id)?.revision ?? null;
+        const current = ensureCurrentQueryBasketRevision(this.db, project.id);
+        if (current !== null && current.revision !== previous) minted += 1;
+      } catch (err) {
+        log13.warn("query-basket.mint-failed", { projectId: project.id, err: String(err) });
+      }
+    }
+    if (minted > 0) log13.info("query-basket.ensured", { projectCount: minted });
+  }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq15(schedules.enabled, true)).all();
+    this.ensureHealthSchedules();
+    this.ensureQueryBaskets();
+    const allSchedules = this.db.select().from(schedules).where(eq14(schedules.enabled, true)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
       if (missedRunAt && new Date(missedRunAt) < /* @__PURE__ */ new Date()) {
-        log14.info("run.catch-up", { projectId: schedule.projectId, kind: schedule.kind, missedRunAt });
+        log13.info("run.catch-up", { projectId: schedule.projectId, kind: schedule.kind, missedRunAt });
         this.triggerRun(schedule.id, schedule.projectId, schedule.kind);
       }
     }
-    log14.info("started", { scheduleCount: allSchedules.length });
+    log13.info("started", { scheduleCount: allSchedules.length });
   }
   /** Stop all cron tasks for graceful shutdown. */
   stop() {
@@ -8204,7 +8213,7 @@ var Scheduler = class {
       this.stopTask(key, existing, "Stopped");
       this.tasks.delete(key);
     }
-    const schedule = this.db.select().from(schedules).where(and12(eq15(schedules.projectId, projectId), eq15(schedules.kind, kind))).get();
+    const schedule = this.db.select().from(schedules).where(and11(eq14(schedules.projectId, projectId), eq14(schedules.kind, kind))).get();
     if (schedule && schedule.enabled) {
       this.registerCronTask(schedule);
     }
@@ -8227,13 +8236,13 @@ var Scheduler = class {
   stopTask(key, task, verb) {
     void task.stop();
     void task.destroy();
-    log14.info(`task.${verb.toLowerCase()}`, { key });
+    log13.info(`task.${verb.toLowerCase()}`, { key });
   }
   registerCronTask(schedule) {
     const { id: scheduleId, projectId, cronExpr, timezone } = schedule;
     const kind = schedule.kind;
     if (!cron.validate(cronExpr)) {
-      log14.error("cron.invalid", { projectId, kind, cronExpr });
+      log13.error("cron.invalid", { projectId, kind, cronExpr });
       return;
     }
     const task = cron.schedule(cronExpr, () => {
@@ -8245,51 +8254,51 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: nextRunFromCron(cronExpr, timezone),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq15(schedules.id, scheduleId)).run();
+    }).where(eq14(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
-    log14.info("cron.registered", { projectId, kind, schedule: label, timezone });
+    log13.info("cron.registered", { projectId, kind, schedule: label, timezone });
   }
   triggerRun(scheduleId, projectId, kind) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const currentSchedule = this.db.select().from(schedules).where(eq15(schedules.id, scheduleId)).get();
+      const currentSchedule = this.db.select().from(schedules).where(eq14(schedules.id, scheduleId)).get();
       if (!currentSchedule || !currentSchedule.enabled) {
-        log14.warn("schedule.stale", { scheduleId, projectId, kind, msg: "schedule no longer exists or is disabled" });
+        log13.warn("schedule.stale", { scheduleId, projectId, kind, msg: "schedule no longer exists or is disabled" });
         this.remove(projectId, kind);
         return;
       }
       const nextRunAt = nextRunFromCron(currentSchedule.cronExpr, currentSchedule.timezone);
-      const project = this.db.select().from(projects).where(eq15(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq14(projects.id, projectId)).get();
       if (!project) {
-        log14.error("project.not-found", { projectId, kind, msg: "skipping scheduled run" });
+        log13.error("project.not-found", { projectId, kind, msg: "skipping scheduled run" });
         this.remove(projectId, kind);
         return;
       }
       if (kind === SchedulableRunKinds["traffic-sync"]) {
         const sourceId = currentSchedule.sourceId;
         if (!sourceId) {
-          log14.warn("traffic-sync.missing-source", { scheduleId, projectId });
+          log13.warn("traffic-sync.missing-source", { scheduleId, projectId });
           return;
         }
         if (!this.callbacks.onTrafficSyncRequested) {
-          log14.warn("traffic-sync.no-callback", { scheduleId, projectId, msg: "host did not register onTrafficSyncRequested" });
+          log13.warn("traffic-sync.no-callback", { scheduleId, projectId, msg: "host did not register onTrafficSyncRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("traffic-sync.triggered", { projectName: project.name, sourceId });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("traffic-sync.triggered", { projectName: project.name, sourceId });
         this.callbacks.onTrafficSyncRequested(project.name, sourceId);
         return;
       }
       if (kind === SchedulableRunKinds["gbp-sync"]) {
         if (!this.callbacks.onGbpSyncRequested) {
-          log14.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
+          log13.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto16.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8302,27 +8311,27 @@ var Scheduler = class {
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("gbp-sync.triggered", { runId: runId2, projectName: project.name });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("gbp-sync.triggered", { runId: runId2, projectName: project.name });
         this.callbacks.onGbpSyncRequested(runId2, projectId);
         return;
       }
       if (kind === SchedulableRunKinds["ads-sync"]) {
         if (!this.callbacks.onAdsSyncRequested) {
-          log14.warn("ads-sync.no-callback", { scheduleId, projectId, msg: "host did not register onAdsSyncRequested" });
+          log13.warn("ads-sync.no-callback", { scheduleId, projectId, msg: "host did not register onAdsSyncRequested" });
           return;
         }
-        const activeAdsRun = this.db.select({ id: runs.id }).from(runs).where(and12(
-          eq15(runs.projectId, projectId),
-          eq15(runs.kind, RunKinds["ads-sync"]),
+        const activeAdsRun = this.db.select({ id: runs.id }).from(runs).where(and11(
+          eq14(runs.projectId, projectId),
+          eq14(runs.kind, RunKinds["ads-sync"]),
           inArray5(runs.status, [RunStatuses.queued, RunStatuses.running])
         )).get();
         if (activeAdsRun) {
-          log14.info("ads-sync.skipped-active", { projectName: project.name, activeRunId: activeAdsRun.id });
-          this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq15(schedules.id, currentSchedule.id)).run();
+          log13.info("ads-sync.skipped-active", { projectName: project.name, activeRunId: activeAdsRun.id });
+          this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq14(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto16.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8335,55 +8344,69 @@ var Scheduler = class {
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("ads-sync.triggered", { runId: runId2, projectName: project.name });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("ads-sync.triggered", { runId: runId2, projectName: project.name });
         this.callbacks.onAdsSyncRequested(runId2, projectId);
         return;
       }
       if (kind === SchedulableRunKinds["data-refresh"]) {
         if (!this.callbacks.onDataRefreshRequested) {
-          log14.warn("data-refresh.no-callback", { scheduleId, projectId, msg: "host did not register onDataRefreshRequested" });
+          log13.warn("data-refresh.no-callback", { scheduleId, projectId, msg: "host did not register onDataRefreshRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("data-refresh.triggered", { projectName: project.name });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("data-refresh.triggered", { projectName: project.name });
         this.callbacks.onDataRefreshRequested(project.name);
         return;
       }
+      if (kind === SchedulableRunKinds.doctor) {
+        if (!this.callbacks.onDoctorRequested) {
+          log13.warn("doctor.no-callback", { scheduleId, projectId, msg: "host did not register onDoctorRequested" });
+          return;
+        }
+        this.db.update(schedules).set({
+          lastRunAt: now,
+          nextRunAt,
+          updatedAt: now
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("doctor.triggered", { projectName: project.name });
+        this.callbacks.onDoctorRequested(project.name);
+        return;
+      }
       if (kind === SchedulableRunKinds["backlinks-sync"]) {
         if (!this.callbacks.onBacklinksSyncRequested) {
-          log14.warn("backlinks-sync.no-callback", { scheduleId, projectId, msg: "host did not register onBacklinksSyncRequested" });
+          log13.warn("backlinks-sync.no-callback", { scheduleId, projectId, msg: "host did not register onBacklinksSyncRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("backlinks-sync.triggered", { projectName: project.name });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("backlinks-sync.triggered", { projectName: project.name });
         this.callbacks.onBacklinksSyncRequested(project.name);
         return;
       }
       if (kind === SchedulableRunKinds["site-audit"]) {
         if (!this.callbacks.onSiteAuditRequested) {
-          log14.warn("site-audit.no-callback", { scheduleId, projectId, msg: "host did not register onSiteAuditRequested" });
+          log13.warn("site-audit.no-callback", { scheduleId, projectId, msg: "host did not register onSiteAuditRequested" });
           return;
         }
-        const active = this.db.select({ id: runs.id }).from(runs).where(and12(
-          eq15(runs.projectId, projectId),
-          eq15(runs.kind, RunKinds["site-audit"]),
+        const active = this.db.select({ id: runs.id }).from(runs).where(and11(
+          eq14(runs.projectId, projectId),
+          eq14(runs.kind, RunKinds["site-audit"]),
           inArray5(runs.status, [RunStatuses.queued, RunStatuses.running])
         )).get();
         if (active) {
-          log14.info("site-audit.skipped-active", { projectName: project.name, activeRunId: active.id });
-          this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq15(schedules.id, currentSchedule.id)).run();
+          log13.info("site-audit.skipped-active", { projectName: project.name, activeRunId: active.id });
+          this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq14(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto16.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8396,8 +8419,8 @@ var Scheduler = class {
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
-        log14.info("site-audit.triggered", { runId: runId2, projectName: project.name });
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
+        log13.info("site-audit.triggered", { runId: runId2, projectName: project.name });
         this.callbacks.onSiteAuditRequested(runId2, projectId);
         return;
       }
@@ -8406,7 +8429,7 @@ var Scheduler = class {
       if (project.defaultLocation) {
         const loc = projectLocations.find((l) => l.label === project.defaultLocation);
         if (!loc) {
-          log14.warn("default-location.stale", { scheduleId, projectId, label: project.defaultLocation });
+          log13.warn("default-location.stale", { scheduleId, projectId, label: project.defaultLocation });
           return;
         }
         resolvedLocation = loc;
@@ -8420,11 +8443,11 @@ var Scheduler = class {
         location: locationLabel
       });
       if (queueResult.conflict) {
-        log14.info("run.skipped-active", { projectName: project.name, activeRunId: queueResult.activeRunId });
+        log13.info("run.skipped-active", { projectName: project.name, activeRunId: queueResult.activeRunId });
         this.db.update(schedules).set({
           nextRunAt,
           updatedAt: now
-        }).where(eq15(schedules.id, currentSchedule.id)).run();
+        }).where(eq14(schedules.id, currentSchedule.id)).run();
         return;
       }
       const runId = queueResult.runId;
@@ -8432,19 +8455,19 @@ var Scheduler = class {
         lastRunAt: now,
         nextRunAt,
         updatedAt: now
-      }).where(eq15(schedules.id, currentSchedule.id)).run();
+      }).where(eq14(schedules.id, currentSchedule.id)).run();
       const scheduleProviders = currentSchedule.providers;
       const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
-      log14.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
+      log13.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
       this.callbacks.onRunCreated(runId, projectId, providers, resolvedLocation);
     } catch (err) {
-      log14.error("trigger.error", { scheduleId, projectId, kind, error: err instanceof Error ? err.message : String(err) });
+      log13.error("trigger.error", { scheduleId, projectId, kind, error: err instanceof Error ? err.message : String(err) });
     }
   }
 };
 
 // src/data-refresh.ts
-var log15 = createLogger("DataRefresh");
+var log14 = createLogger("DataRefresh");
 async function refreshAllIntegrations(client, projectName) {
   const integrations = [
     { name: "gsc", run: () => client.gscSync(projectName, {}) },
@@ -8457,19 +8480,19 @@ async function refreshAllIntegrations(client, projectName) {
   results.forEach((result, idx) => {
     const integration = integrations[idx].name;
     if (result.status === "fulfilled") {
-      log15.info("integration.refreshed", { projectName, integration });
+      log14.info("integration.refreshed", { projectName, integration });
     } else {
       const reason = result.reason;
       const message = reason instanceof Error ? reason.message : String(reason);
-      log15.warn("integration.refresh-failed", { projectName, integration, error: message });
+      log14.warn("integration.refresh-failed", { projectName, integration, error: message });
     }
   });
 }
 
 // src/notifier.ts
-import { eq as eq16, desc as desc5, and as and13, inArray as inArray6, or } from "drizzle-orm";
-import crypto18 from "crypto";
-var log16 = createLogger("Notifier");
+import { eq as eq15, desc as desc5, and as and12, inArray as inArray6, or } from "drizzle-orm";
+import crypto17 from "crypto";
+var log15 = createLogger("Notifier");
 var Notifier = class {
   db;
   serverUrl;
@@ -8479,26 +8502,26 @@ var Notifier = class {
   }
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
-    log16.info("run.completed", { runId, projectId });
-    const notifs = this.db.select().from(notifications).where(eq16(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    log15.info("run.completed", { runId, projectId });
+    const notifs = this.db.select().from(notifications).where(eq15(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) {
-      log16.info("notifications.none-enabled", { projectId });
+      log15.info("notifications.none-enabled", { projectId });
       return;
     }
-    log16.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq16(runs.id, runId)).get();
+    log15.info("notifications.found", { projectId, count: notifs.length });
+    const run = this.db.select().from(runs).where(eq15(runs.id, runId)).get();
     if (!run) {
-      log16.error("run.not-found", { runId, msg: "skipping notification dispatch" });
+      log15.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq16(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq15(projects.id, projectId)).get();
     if (!project) {
-      log16.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
+      log15.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
     }
     const transitions = this.computeTransitions(runId, projectId);
     const events = [];
-    log16.info("run.status", { runId: run.id, status: run.status, projectId });
+    log15.info("run.status", { runId: run.id, status: run.status, projectId });
     if (run.status === "completed" || run.status === "partial") {
       events.push("run.completed");
     }
@@ -8514,7 +8537,7 @@ var Notifier = class {
       if (!config.url) continue;
       const subscribedEvents = config.events;
       const matchingEvents = events.filter((e) => subscribedEvents.includes(e));
-      log16.info("notification.match", { notificationId: notif.id, subscribedEvents, matchedEvents: matchingEvents });
+      log15.info("notification.match", { notificationId: notif.id, subscribedEvents, matchedEvents: matchingEvents });
       if (matchingEvents.length === 0) continue;
       for (const event of matchingEvents) {
         const relevantTransitions = event === "citation.lost" ? lostTransitions : event === "citation.gained" ? gainedTransitions : transitions;
@@ -8530,6 +8553,101 @@ var Notifier = class {
       }
     }
   }
+  /**
+   * Record the outcome of a scheduled health pass and notify on transitions.
+   *
+   * Edge-triggered on `(status, code)`. A pass that finds the same problem as
+   * last time is stored but not re-sent: an operator who receives the same
+   * warning every day stops reading the channel, which is how a real
+   * degradation goes unnoticed. A pass whose worst code CHANGES does notify,
+   * even at the same severity, because a different cause is different news.
+   *
+   * Returns the event emitted, or null when nothing changed — the return value
+   * is what tests assert against, so "stayed quiet" is observable rather than
+   * inferred from the absence of a webhook.
+   */
+  async onHealthChecked(projectId, report) {
+    const project = this.db.select().from(projects).where(eq15(projects.id, projectId)).get();
+    if (!project) {
+      log15.error("project.not-found", { projectId, msg: "skipping health notification" });
+      return null;
+    }
+    const rank = (status2) => status2 === "fail" ? 2 : status2 === "warn" ? 1 : 0;
+    const categoryRank = (category) => {
+      switch (category) {
+        case "database":
+          return 6;
+        case "integrations":
+          return 5;
+        case "providers":
+          return 4;
+        case "auth":
+          return 3;
+        case "schedules":
+          return 2;
+        case "config":
+          return 1;
+        default:
+          return 0;
+      }
+    };
+    const graded = report.checks.filter((c) => c.status === "fail" || c.status === "warn" || c.status === "ok");
+    const failing = graded.filter((c) => c.status !== "ok").sort((a, b) => rank(b.status) - rank(a.status) || categoryRank(b.category) - categoryRank(a.category) || a.id.localeCompare(b.id));
+    const worst = failing.at(0) ?? null;
+    const noSignal = graded.length === 0;
+    const status = noSignal ? "warn" : worst ? worst.status : "ok";
+    const code = noSignal ? "health.no-signal" : worst?.code ?? "health.ok";
+    const summary = noSignal ? `No health check produced a result (${report.checks.length} skipped) \u2014 health is unknown, not confirmed.` : worst?.summary ?? `All ${graded.length} health check(s) passing.`;
+    const previous = this.db.select().from(doctorHealthState).where(eq15(doctorHealthState.projectId, projectId)).get();
+    const previousStatus = previous?.status ?? null;
+    let event = null;
+    if (previous === void 0) {
+      if (status !== "ok") event = "health.degraded";
+    } else if (status === "ok" && previousStatus !== "ok") {
+      event = "health.recovered";
+    } else if (status !== "ok" && (previousStatus === "ok" || previous.code !== code)) {
+      event = "health.degraded";
+    }
+    const now = report.checkedAt;
+    const observation = { projectId, status, code, summary, checkedAt: now };
+    if (previous === void 0) {
+      this.db.insert(doctorHealthState).values({ ...observation, notifiedAt: null }).run();
+    } else {
+      this.db.update(doctorHealthState).set(observation).where(eq15(doctorHealthState.projectId, projectId)).run();
+    }
+    if (!event) {
+      log15.info("health.unchanged", { projectId, status, code });
+      return null;
+    }
+    const notifs = this.db.select().from(notifications).where(eq15(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    const payload = {
+      source: "canonry",
+      event,
+      project: { name: project.name, canonicalDomain: project.canonicalDomain },
+      health: {
+        status,
+        code,
+        summary,
+        remediation: worst?.remediation ?? null,
+        checkedAt: now,
+        previousStatus,
+        failing: failing.map((c) => ({ id: c.id, status: c.status, code: c.code, summary: c.summary }))
+      },
+      dashboardUrl: `${this.serverUrl}/projects/${project.name}`
+    };
+    let delivered = 0;
+    for (const notif of notifs) {
+      const config = notif.config;
+      if (!config.url) continue;
+      await this.sendWebhook(config.url, payload, notif.id, projectId, notif.webhookSecret ?? null);
+      delivered += 1;
+    }
+    if (delivered > 0) {
+      this.db.update(doctorHealthState).set({ notifiedAt: now }).where(eq15(doctorHealthState.projectId, projectId)).run();
+    }
+    log15.info("health.notified", { projectId, event, status, code, subscribers: notifs.length, delivered });
+    return event;
+  }
   /** Dispatch insight webhooks for critical/high severity insights after a run. */
   async dispatchInsightWebhooks(runId, projectId, result) {
     const insightEvents = [];
@@ -8538,11 +8656,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq16(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    const notifs = this.db.select().from(notifications).where(eq15(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq16(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq15(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq16(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq15(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = notif.config;
@@ -8572,12 +8690,12 @@ var Notifier = class {
     }
   }
   computeTransitions(runId, projectId) {
-    const thisRun = this.db.select().from(runs).where(eq16(runs.id, runId)).get();
+    const thisRun = this.db.select().from(runs).where(eq15(runs.id, runId)).get();
     if (!thisRun) return [];
-    const groupSiblings = this.db.select().from(runs).where(and13(
-      eq16(runs.projectId, projectId),
-      eq16(runs.kind, thisRun.kind),
-      eq16(runs.createdAt, thisRun.createdAt)
+    const groupSiblings = this.db.select().from(runs).where(and12(
+      eq15(runs.projectId, projectId),
+      eq15(runs.kind, thisRun.kind),
+      eq15(runs.createdAt, thisRun.createdAt)
     )).all();
     const stillPending = groupSiblings.some((r) => r.status === "queued" || r.status === "running");
     if (stillPending) return [];
@@ -8593,17 +8711,17 @@ var Notifier = class {
       return candidate.id > best.id ? candidate : best;
     });
     if (winner.id !== runId) return [];
-    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq16(projects.id, projectId)).get();
+    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq15(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectLocations?.locations ?? []).length
     );
     const RECENT_FETCH_LIMIT = Math.max(8, locationCount * 4);
     const recentRuns = this.db.select().from(runs).where(
-      and13(
-        eq16(runs.projectId, projectId),
-        eq16(runs.kind, thisRun.kind),
-        or(eq16(runs.status, "completed"), eq16(runs.status, "partial"))
+      and12(
+        eq15(runs.projectId, projectId),
+        eq15(runs.kind, thisRun.kind),
+        or(eq15(runs.status, "completed"), eq15(runs.status, "partial"))
       )
     ).orderBy(desc5(runs.createdAt), desc5(runs.id)).limit(RECENT_FETCH_LIMIT).all();
     const groups = groupRunsByCreatedAt(recentRuns);
@@ -8620,7 +8738,7 @@ var Notifier = class {
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(queries, eq16(querySnapshots.queryId, queries.id)).where(inArray6(querySnapshots.runId, currentRunIds)).all();
+    }).from(querySnapshots).leftJoin(queries, eq15(querySnapshots.queryId, queries.id)).where(inArray6(querySnapshots.runId, currentRunIds)).all();
     const previousSnapshots = this.db.select({
       queryId: querySnapshots.queryId,
       provider: querySnapshots.provider,
@@ -8650,26 +8768,29 @@ var Notifier = class {
     return transitions;
   }
   async sendWebhook(url, payload, notificationId, projectId, webhookSecret) {
+    const destination = resolveDestination(url);
+    const body = destination.render ? destination.render(toAlertView(payload)) : payload;
+    const signingSecret = destination.signed ? webhookSecret : null;
     const targetLabel = redactNotificationUrl(url).urlDisplay;
     const targetCheck = await resolveWebhookTarget(url);
     if (!targetCheck.ok) {
-      log16.error("webhook.ssrf-blocked", { url: targetLabel, reason: targetCheck.message });
+      log15.error("webhook.ssrf-blocked", { url: targetLabel, reason: targetCheck.message });
       this.logDelivery(projectId, notificationId, payload.event, "failed", `SSRF: ${targetCheck.message}`);
       return;
     }
-    log16.info("webhook.send", { event: payload.event, url: targetLabel });
+    log15.info("webhook.send", { event: payload.event, url: targetLabel });
     const maxRetries = 3;
     const delays = [1e3, 4e3, 16e3];
     for (let attempt = 0; attempt < maxRetries; attempt++) {
       try {
-        const response = await deliverWebhook(targetCheck.target, payload, webhookSecret);
+        const response = await deliverWebhook(targetCheck.target, body, signingSecret);
         if (response.status >= 200 && response.status < 300) {
-          log16.info("webhook.delivered", { event: payload.event, url: targetLabel, httpStatus: response.status });
+          log15.info("webhook.delivered", { event: payload.event, url: targetLabel, httpStatus: response.status });
           this.logDelivery(projectId, notificationId, payload.event, "sent", null);
           return;
         }
         const errorDetail = response.error ?? `HTTP ${response.status}`;
-        log16.warn("webhook.attempt-failed", { event: payload.event, url: targetLabel, attempt: attempt + 1, maxRetries, httpStatus: response.status, error: errorDetail });
+        log15.warn("webhook.attempt-failed", { event: payload.event, url: targetLabel, attempt: attempt + 1, maxRetries, httpStatus: response.status, error: errorDetail });
         if (attempt === maxRetries - 1) {
           this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
         }
@@ -8677,7 +8798,7 @@ var Notifier = class {
         const errorDetail = err instanceof Error ? err.message : String(err);
         if (attempt === maxRetries - 1) {
           this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
-          log16.error("webhook.exhausted", { event: payload.event, url: targetLabel, maxRetries, error: errorDetail });
+          log15.error("webhook.exhausted", { event: payload.event, url: targetLabel, maxRetries, error: errorDetail });
         }
       }
       if (attempt < maxRetries - 1) {
@@ -8687,7 +8808,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto18.randomUUID(),
+      id: crypto17.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -8700,8 +8821,8 @@ var Notifier = class {
 };
 
 // src/run-coordinator.ts
-import { eq as eq17 } from "drizzle-orm";
-var log17 = createLogger("RunCoordinator");
+import { eq as eq16 } from "drizzle-orm";
+var log16 = createLogger("RunCoordinator");
 var RunCoordinator = class {
   constructor(db, notifier, intelligenceService, onInsightsGenerated, onAeroEvent) {
     this.db = db;
@@ -8716,10 +8837,10 @@ var RunCoordinator = class {
   onInsightsGenerated;
   onAeroEvent;
   async onRunCompleted(runId, projectId) {
-    const runRow = this.db.select().from(runs).where(eq17(runs.id, runId)).get();
+    const runRow = this.db.select().from(runs).where(eq16(runs.id, runId)).get();
     const kind = runRow?.kind ?? RunKinds["answer-visibility"];
     if (runRow?.trigger === RunTriggers.probe) {
-      log17.info("probe.skip-side-effects", { runId, projectId, kind });
+      log16.info("probe.skip-side-effects", { runId, projectId, kind });
       return;
     }
     let insightCount = 0;
@@ -8736,12 +8857,12 @@ var RunCoordinator = class {
             try {
               await this.onInsightsGenerated(runId, projectId, result);
             } catch (err) {
-              log17.error("insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+              log16.error("insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
             }
           }
         }
       } catch (err) {
-        log17.error("intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log16.error("intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     } else if (kind === RunKinds["gbp-sync"]) {
       try {
@@ -8754,17 +8875,17 @@ var RunCoordinator = class {
           try {
             await this.onInsightsGenerated(runId, projectId, analysisResultFromInsights(gbpInsights));
           } catch (err) {
-            log17.error("gbp-insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+            log16.error("gbp-insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
           }
         }
       } catch (err) {
-        log17.error("gbp-intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log16.error("gbp-intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     }
     try {
       await this.notifier.onRunCompleted(runId, projectId);
     } catch (err) {
-      log17.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+      log16.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
     }
     if (this.onAeroEvent) {
       try {
@@ -8777,7 +8898,7 @@ var RunCoordinator = class {
         };
         await this.onAeroEvent(ctx);
       } catch (err) {
-        log17.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log16.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     }
   }
@@ -8792,7 +8913,7 @@ var RunCoordinator = class {
    * so the Aero queue is never starved of a follow-up.
    */
   buildDiscoveryAeroContext(runId, projectId, status, error) {
-    const session = this.db.select().from(discoverySessions).where(eq17(discoverySessions.runId, runId)).get();
+    const session = this.db.select().from(discoverySessions).where(eq16(discoverySessions.runId, runId)).get();
     const competitorMap = session ? session.competitorMap : [];
     return {
       kind: RunKinds["aeo-discover-probe"],
@@ -8834,8 +8955,8 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto22 from "crypto";
-import { eq as eq19 } from "drizzle-orm";
+import crypto21 from "crypto";
+import { eq as eq18 } from "drizzle-orm";
 
 // src/agent/session.ts
 import fs7 from "fs";
@@ -9578,7 +9699,7 @@ function buildAeroStateTools(ctx, opts = {}) {
 }
 
 // src/agent/llm-usage.ts
-import crypto19 from "crypto";
+import crypto18 from "crypto";
 var AeroLlmUsageFeatures = {
   turn: "aero.turn"
 };
@@ -9597,7 +9718,7 @@ function recordLlmUsageEvent(args) {
     const usage = args.message.usage;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     args.db.insert(llmUsageEvents).values({
-      id: crypto19.randomUUID(),
+      id: crypto18.randomUUID(),
       projectId: args.projectId,
       runId: args.runId,
       agentSessionId: args.agentSessionId,
@@ -9673,7 +9794,7 @@ function splitAeroAnthropicSystemCachePayload(payload, model) {
 }
 
 // src/agent/tool-usage.ts
-import crypto20 from "crypto";
+import crypto19 from "crypto";
 var AeroToolEventStatuses = {
   success: "success",
   error: "error"
@@ -9736,7 +9857,7 @@ function createAeroToolUsageHooks(args) {
 function recordAgentToolEvent(args) {
   try {
     args.db.insert(agentToolEvents).values({
-      id: crypto20.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId: args.projectId,
       agentSessionId: args.agentSessionId,
       toolCallId: args.toolCallId,
@@ -9879,7 +10000,7 @@ function resolveSessionProviderAndModel(config, opts) {
 import { Type as Type4 } from "@sinclair/typebox";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-var log18 = createLogger("RemoteMcp");
+var log17 = createLogger("RemoteMcp");
 var AERO_EXCLUDED_MCP_TOOLS2 = /* @__PURE__ */ new Set([]);
 var MAX_TOOL_RESULT_CHARS2 = 2e4;
 function truncate(text) {
@@ -9932,7 +10053,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
     try {
       client = await connect(server);
     } catch (err) {
-      log18.error("external-mcp.connect-failed", {
+      log17.error("external-mcp.connect-failed", {
         label,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9942,7 +10063,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
     try {
       listed = await client.listTools();
     } catch (err) {
-      log18.error("external-mcp.list-failed", {
+      log17.error("external-mcp.list-failed", {
         label,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9953,7 +10074,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
       if (!isReadOnly(tool)) continue;
       tools.push(adaptRemoteTool(client, tool));
     }
-    log18.info("external-mcp.loaded", {
+    log17.info("external-mcp.loaded", {
       label,
       discovered: listed.tools.length,
       adopted: tools.length
@@ -9963,8 +10084,8 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto21 from "crypto";
-import { and as and14, desc as desc6, eq as eq18, like, sql as sql6 } from "drizzle-orm";
+import crypto20 from "crypto";
+import { and as and13, desc as desc6, eq as eq17, like, sql as sql7 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto(row) {
@@ -9978,7 +10099,7 @@ function rowToDto(row) {
   };
 }
 function listMemoryEntries(db, projectId, opts = {}) {
-  const query = db.select().from(agentMemory).where(eq18(agentMemory.projectId, projectId)).orderBy(desc6(agentMemory.updatedAt));
+  const query = db.select().from(agentMemory).where(eq17(agentMemory.projectId, projectId)).orderBy(desc6(agentMemory.updatedAt));
   const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
   return rows.map(rowToDto);
 }
@@ -9992,7 +10113,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto21.randomUUID();
+  const id = crypto20.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -10009,12 +10130,12 @@ function upsertMemoryEntry(db, args) {
       updatedAt: now
     }
   }).run();
-  const row = db.select().from(agentMemory).where(and14(eq18(agentMemory.projectId, args.projectId), eq18(agentMemory.key, args.key))).get();
+  const row = db.select().from(agentMemory).where(and13(eq17(agentMemory.projectId, args.projectId), eq17(agentMemory.key, args.key))).get();
   if (!row) throw new Error("memory upsert produced no row");
   return rowToDto(row);
 }
 function deleteMemoryEntry(db, projectId, key) {
-  const result = db.delete(agentMemory).where(and14(eq18(agentMemory.projectId, projectId), eq18(agentMemory.key, key))).run();
+  const result = db.delete(agentMemory).where(and13(eq17(agentMemory.projectId, projectId), eq17(agentMemory.key, key))).run();
   const changes = result.changes ?? 0;
   return changes > 0;
 }
@@ -10029,7 +10150,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto21.randomUUID();
+  const id = crypto20.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -10043,16 +10164,16 @@ function writeCompactionNote(db, args) {
     }).run();
     const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
     const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
-      and14(
-        eq18(agentMemory.projectId, args.projectId),
+      and13(
+        eq17(agentMemory.projectId, args.projectId),
         like(agentMemory.key, `${sessionPrefix}%`)
       )
     ).orderBy(desc6(agentMemory.updatedAt)).all();
     const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
     if (stale.length > 0) {
-      tx.delete(agentMemory).where(sql6`${agentMemory.id} IN (${sql6.join(stale.map((s) => sql6`${s}`), sql6`, `)})`).run();
+      tx.delete(agentMemory).where(sql7`${agentMemory.id} IN (${sql7.join(stale.map((s) => sql7`${s}`), sql7`, `)})`).run();
     }
-    const row = tx.select().from(agentMemory).where(and14(eq18(agentMemory.projectId, args.projectId), eq18(agentMemory.key, key))).get();
+    const row = tx.select().from(agentMemory).where(and13(eq17(agentMemory.projectId, args.projectId), eq17(agentMemory.key, key))).get();
     if (row) inserted = rowToDto(row);
   });
   if (!inserted) throw new Error("compaction note write produced no row");
@@ -10185,7 +10306,7 @@ async function compactMessages(args) {
 }
 
 // src/agent/session-registry.ts
-var log19 = createLogger("SessionRegistry");
+var log18 = createLogger("SessionRegistry");
 var MAX_HYDRATE_NOTES = 20;
 var MAX_HYDRATE_BYTES = 32 * 1024;
 function escapeMemoryFragment(value) {
@@ -10229,7 +10350,7 @@ var SessionRegistry = class {
     if (!this.externalToolsPromise) {
       this.externalToolsPromise = loadExternalMcpTools(this.opts.config.externalMcpServers).catch(
         (err) => {
-          log19.error("external-mcp.load-failed", {
+          log18.error("external-mcp.load-failed", {
             error: err instanceof Error ? err.message : String(err)
           });
           return [];
@@ -10279,7 +10400,7 @@ var SessionRegistry = class {
           modelProvider: effectiveProvider,
           modelId: effectiveModelId,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(eq19(agentSessions.projectId, projectId)).run();
+        }).where(eq18(agentSessions.projectId, projectId)).run();
       }
       const agent2 = createAeroSession({
         projectName,
@@ -10308,7 +10429,7 @@ var SessionRegistry = class {
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
     const systemPrompt = loadAeroSystemPrompt();
-    const sessionId = crypto22.randomUUID();
+    const sessionId = crypto21.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -10474,13 +10595,13 @@ ${lines.join("\n")}
       agent.state.messages = result.messages;
       agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
       this.save(projectName);
-      log19.info("compaction.completed", {
+      log18.info("compaction.completed", {
         projectName,
         removedCount: result.removedCount,
         summaryBytes: Buffer.byteLength(result.summary, "utf8")
       });
     } catch (err) {
-      log19.error("compaction.failed", {
+      log18.error("compaction.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -10513,7 +10634,7 @@ ${lines.join("\n")}
       modelProvider: nextProvider,
       modelId: nextModelId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq19(agentSessions.projectId, projectId)).run();
+    }).where(eq18(agentSessions.projectId, projectId)).run();
   }
   /** Persist a session's transcript back to the DB. Call after any run settles. */
   save(projectName) {
@@ -10581,7 +10702,7 @@ ${lines.join("\n")}
       await agent.prompt(msgs);
       this.save(projectName);
     } catch (err) {
-      log19.error("drain.failed", {
+      log18.error("drain.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -10677,17 +10798,17 @@ ${lines.join("\n")}
     return id;
   }
   tryResolveProjectId(projectName) {
-    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq19(projects.name, projectName)).get();
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq18(projects.name, projectName)).get();
     return row?.id;
   }
   loadRow(projectId) {
-    const row = this.opts.db.select().from(agentSessions).where(eq19(agentSessions.projectId, projectId)).get();
+    const row = this.opts.db.select().from(agentSessions).where(eq18(agentSessions.projectId, projectId)).get();
     return row ?? null;
   }
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: params.id ?? crypto22.randomUUID(),
+      id: params.id ?? crypto21.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -10700,14 +10821,14 @@ ${lines.join("\n")}
   }
   updateRow(projectId, patch) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq19(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq18(agentSessions.projectId, projectId)).run();
   }
 };
 
 // src/agent/agent-routes.ts
-import { eq as eq20 } from "drizzle-orm";
+import { eq as eq19 } from "drizzle-orm";
 function resolveProject(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq20(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq19(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -10716,7 +10837,7 @@ function registerAgentRoutes(app, opts) {
     "/projects/:name/agent/transcript",
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq20(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq19(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -10740,7 +10861,7 @@ function registerAgentRoutes(app, opts) {
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -11174,7 +11295,7 @@ function formatAuditFactorScore(factor) {
 }
 
 // src/snapshot-service.ts
-var log20 = createLogger("Snapshot");
+var log19 = createLogger("Snapshot");
 var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
 var SNAPSHOT_QUERY_COUNT = 6;
 var ProviderExecutionGate2 = class {
@@ -11320,7 +11441,7 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log20.warn("audit.failed", { homepageUrl, error: message });
+      log19.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
@@ -11349,7 +11470,7 @@ var SnapshotService = class {
           queries: parsedQueries
         };
       } catch (err) {
-        log20.warn("profile.generation-failed", {
+        log19.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -11491,7 +11612,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log20.warn("response.analysis-failed", {
+      log19.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -11746,20 +11867,20 @@ function clipText(value, length) {
 }
 
 // src/research-runner.ts
-import { and as and15, eq as eq21, inArray as inArray7, sql as sql7 } from "drizzle-orm";
+import { and as and14, eq as eq20, inArray as inArray7, sql as sql8 } from "drizzle-orm";
 var unfinishedResearchQueryStatuses = [ResearchQueryStatuses.queued, ResearchQueryStatuses.running];
 function finalResearchRunStatus(completed, failed) {
   if (failed === 0) return ResearchRunStatuses.completed;
   return completed > 0 ? ResearchRunStatuses.partial : ResearchRunStatuses.failed;
 }
 async function executeResearchRun(db, registry, runId, projectId) {
-  const run = db.select().from(researchRuns).where(and15(eq21(researchRuns.id, runId), eq21(researchRuns.projectId, projectId))).get();
+  const run = db.select().from(researchRuns).where(and14(eq20(researchRuns.id, runId), eq20(researchRuns.projectId, projectId))).get();
   if (!run || run.status !== ResearchRunStatuses.queued) return;
-  const project = db.select().from(projects).where(eq21(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq20(projects.id, projectId)).get();
   if (!project) return;
   const provider = registry.get(run.provider);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and15(eq21(researchRuns.id, runId), eq21(researchRuns.status, ResearchRunStatuses.queued))).run();
+  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and14(eq20(researchRuns.id, runId), eq20(researchRuns.status, ResearchRunStatuses.queued))).run();
   if (claim.changes !== 1) return;
   let reserved = 0;
   let dispatched = 0;
@@ -11783,8 +11904,8 @@ async function executeResearchRun(db, registry, runId, projectId) {
     }
     reserved = run.totalQueries;
     reservation = { scope, period };
-    const rows = db.select().from(researchRunQueries).where(eq21(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
-    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq21(competitors.projectId, projectId)).all().map((row) => row.domain);
+    const rows = db.select().from(researchRunQueries).where(eq20(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
+    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq20(competitors.projectId, projectId)).all().map((row) => row.domain);
     const domains = effectiveDomains(project);
     const brands = effectiveBrandNames(project);
     const config = { ...provider.config, model: run.resolvedModel };
@@ -11792,7 +11913,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and15(eq21(researchRunQueries.id, row.id), eq21(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
+        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and14(eq20(researchRunQueries.id, row.id), eq20(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
         const raw = await gate.run(async () => {
           dispatched++;
           return provider.adapter.executeTrackedQuery({ query: row.queryText, canonicalDomains: domains, competitorDomains, ...run.location ? { location: run.location } : {} }, config);
@@ -11819,7 +11940,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
           citationState: determineCitationState(normalized, domains),
           rawResponse: raw.rawResponse,
           finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(and15(eq21(researchRunQueries.id, row.id), eq21(researchRunQueries.status, ResearchQueryStatuses.running))).run();
+        }).where(and14(eq20(researchRunQueries.id, row.id), eq20(researchRunQueries.status, ResearchQueryStatuses.running))).run();
         if (completed.changes === 1) incrementResearchProgress(db, runId, "completedQueries");
       } catch (error) {
         try {
@@ -11843,18 +11964,18 @@ async function executeResearchRun(db, registry, runId, projectId) {
   }
 }
 function incrementResearchProgress(db, runId, column) {
-  db.update(researchRuns).set({ [column]: sql7`${researchRuns[column]} + 1` }).where(eq21(researchRuns.id, runId)).run();
+  db.update(researchRuns).set({ [column]: sql8`${researchRuns[column]} + 1` }).where(eq20(researchRuns.id, runId)).run();
 }
 function markResearchQueryFailed(db, runId, queryId, error) {
   const message = error instanceof Error ? error.message : String(error);
-  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and15(eq21(researchRunQueries.id, queryId), inArray7(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and14(eq20(researchRunQueries.id, queryId), inArray7(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
   if (failed.changes === 1) incrementResearchProgress(db, runId, "failedQueries");
 }
 function markUnfinishedResearchQueriesFailed(db, runId, error) {
-  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and15(eq21(researchRunQueries.researchRunId, runId), inArray7(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and14(eq20(researchRunQueries.researchRunId, runId), inArray7(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
 }
 function finalizeResearchRun(db, runId, fatalError) {
-  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq21(researchRunQueries.researchRunId, runId)).all();
+  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq20(researchRunQueries.researchRunId, runId)).all();
   const completed = rows.filter((row) => row.status === ResearchQueryStatuses.completed).length;
   const failed = rows.filter((row) => row.status === ResearchQueryStatuses.failed).length;
   db.update(researchRuns).set({
@@ -11863,13 +11984,13 @@ function finalizeResearchRun(db, runId, fatalError) {
     failedQueries: failed,
     error: fatalError ?? (failed === rows.length ? "Every research query failed." : null),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq21(researchRuns.id, runId)).run();
+  }).where(eq20(researchRuns.id, runId)).run();
 }
 
 // src/server.ts
 var _require3 = createRequire3(import.meta.url);
 var { version: PKG_VERSION2 } = _require3("../package.json");
-var log21 = createLogger("Server");
+var log20 = createLogger("Server");
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
   maxRequestsPerMinute: 10,
@@ -11887,6 +12008,9 @@ function parseBooleanEnv(value) {
 function resolveDashboardRequirePassword(env, config) {
   return parseBooleanEnv(env.CANONRY_DASHBOARD_REQUIRE_PASSWORD) ?? config.dashboard?.requirePassword ?? true;
 }
+function resolveDashboardShowResourceLinks(env, config) {
+  return parseBooleanEnv(env.CANONRY_DASHBOARD_SHOW_RESOURCE_LINKS) ?? config.dashboard?.showResourceLinks ?? true;
+}
 var API_ADAPTERS = [
   geminiAdapter,
   openaiAdapter,
@@ -11912,14 +12036,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey(key) {
-  return crypto23.createHash("sha256").update(key).digest("hex");
+  return crypto22.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto23.randomBytes(16);
-  const derived = crypto23.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto22.randomBytes(16);
+  const derived = crypto22.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -11940,14 +12064,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto23.scryptSync(password, salt, expected.length, {
+    const derived = crypto22.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto23.timingSafeEqual(derived, expected),
+      ok: crypto22.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -11956,7 +12080,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto23.timingSafeEqual(candidate, expected);
+    const ok = crypto22.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -12019,7 +12143,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGoogle > 0) {
     saveConfigPatch({ google: config.google });
-    log21.info("credentials.migrated", { type: "google", count: migratedGoogle });
+    log20.info("credentials.migrated", { type: "google", count: migratedGoogle });
   }
   let migratedGa4 = 0;
   for (const row of rows.ga4) {
@@ -12037,7 +12161,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGa4 > 0) {
     saveConfigPatch({ ga4: config.ga4 });
-    log21.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
+    log20.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
   }
 }
 function isLoopbackBindHost(host) {
@@ -12094,11 +12218,11 @@ async function createServer(opts) {
     applyLegacyCredentials(legacyRows, opts.config);
     dropLegacyCredentialColumns(opts.db);
   } catch (err) {
-    log21.warn("credentials.migration.failed", {
+    log20.warn("credentials.migration.failed", {
       error: err instanceof Error ? err.message : String(err)
     });
   }
-  log21.info("providers.configured", {
+  log20.info("providers.configured", {
     providers: Object.keys(providers).filter((k) => {
       const p = providers[k];
       return p?.apiKey || p?.baseUrl || p?.vertexProject;
@@ -12162,7 +12286,7 @@ async function createServer(opts) {
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
       if (!sessionRegistry) return;
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq22(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq21(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -12497,6 +12621,24 @@ async function createServer(opts) {
     onAdsSyncRequested: (runId, projectId) => {
       runAdsSync(runId, projectId);
     },
+    onDoctorRequested: (projectName) => {
+      void (async () => {
+        try {
+          const report = await aeroClient.runDoctor({ project: projectName });
+          const project = opts.db.select().from(projects).where(eq21(projects.name, projectName)).get();
+          if (!project) {
+            app.log.warn({ projectName }, "doctor schedule fired for an unknown project");
+            return;
+          }
+          await notifier.onHealthChecked(project.id, {
+            checks: report.checks,
+            checkedAt: report.generatedAt
+          });
+        } catch (err) {
+          app.log.warn({ projectName, err }, "scheduled doctor pass failed");
+        }
+      })();
+    },
     onDataRefreshRequested: (projectName) => {
       void refreshAllIntegrations(aeroClient, projectName);
     },
@@ -12511,9 +12653,9 @@ async function createServer(opts) {
         });
         if (!probed) return;
         const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(
-          and16(
-            eq22(ccReleaseSyncs.release, probed.release),
-            eq22(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+          and15(
+            eq21(ccReleaseSyncs.release, probed.release),
+            eq21(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
           )
         ).limit(1).get();
         if (alreadySynced) {
@@ -12534,18 +12676,6 @@ async function createServer(opts) {
           );
         });
       })();
-      const project = opts.db.select().from(projects).where(eq22(projects.name, projectName)).get();
-      if (project && bingConnectionStore.getConnection(project.canonicalDomain)) {
-        aeroClient.backlinksBingSync(projectName).catch((err) => {
-          app.log.error(
-            {
-              projectName,
-              err: err instanceof Error ? err.message : String(err)
-            },
-            "Scheduled Bing backlinks sync failed"
-          );
-        });
-      }
     },
     onSiteAuditRequested: (runId, projectId) => {
       runSiteAudit(runId, projectId);
@@ -12680,7 +12810,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto23.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto22.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -12745,6 +12875,7 @@ async function createServer(opts) {
     );
   }
   const dashboardRequirePassword = resolveDashboardRequirePassword(process.env, opts.config);
+  const dashboardShowResourceLinks = resolveDashboardShowResourceLinks(process.env, opts.config);
   app.log.info(
     { dashboardRequirePassword },
     "Dashboard password gate resolved"
@@ -12753,11 +12884,11 @@ async function createServer(opts) {
   const googlePublicUrl = resolveGooglePublicUrl(opts.config, basePath);
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq22(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq21(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto23.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto22.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -12781,7 +12912,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto23.randomBytes(32).toString("hex");
+    const sessionId = crypto22.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -12805,7 +12936,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq22(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq21(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -12829,7 +12960,7 @@ async function createServer(opts) {
     if (!header) return false;
     const parts = header.split(" ");
     if (parts.length !== 2 || parts[0] !== "Bearer") return false;
-    const key = opts.db.select().from(apiKeys).where(eq22(apiKeys.keyHash, hashApiKey(parts[1]))).get();
+    const key = opts.db.select().from(apiKeys).where(eq21(apiKeys.keyHash, hashApiKey(parts[1]))).get();
     return Boolean(key && !key.revokedAt);
   };
   app.get(apiPrefix + "/session", async (request, reply) => {
@@ -12906,12 +13037,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq22(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq21(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header(
         "set-cookie",
@@ -13022,6 +13153,11 @@ async function createServer(opts) {
     // installer; cloud deployments inherit the secure default of `false` by
     // not passing this option. Override with CANONRY_ALLOW_LOOPBACK_WEBHOOKS=0.
     allowLoopbackWebhooks: process.env.CANONRY_ALLOW_LOOPBACK_WEBHOOKS !== "0",
+    // Wall-clock budget for one incremental Vercel drain. This is the only lever
+    // that decides whether a source catches up or falls further behind, and it
+    // was previously reachable only from tests, so a source losing ground could
+    // not be rescued without shipping code. Unset keeps the built-in default.
+    vercelSyncDeadlineMs: resolveVercelSyncDeadlineMs(process.env),
     // Local-only Aero agent routes. Registered here so they inherit api-routes'
     // auth plugin — bare `registerAgentRoutes(app, ...)` would skip auth.
     registerAuthenticatedRoutes: async (scope) => {
@@ -13104,7 +13240,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto23.randomUUID();
+            const runId = crypto22.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -13134,13 +13270,6 @@ async function createServer(opts) {
         }
       );
     },
-    onBingBacklinkSyncRequested: (runId, projectId) => {
-      executeBingBacklinkSync(opts.db, runId, projectId, {
-        resolveConnection: (domain) => bingConnectionStore.getConnection(domain)
-      }).catch((err) => {
-        app.log.error({ runId, err }, "Bing backlink sync failed");
-      });
-    },
     onDiscoveryRunRequested: (input) => {
       executeDiscoveryRun({
         db: opts.db,
@@ -13236,7 +13365,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq22(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq21(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(opts.db, opts.config, projectId);
         }
@@ -13330,7 +13459,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto23.randomUUID(),
+            id: crypto22.randomUUID(),
             projectId,
             actor: "api",
             action: existing ? "provider.updated" : "provider.created",
@@ -13496,6 +13625,9 @@ async function createServer(opts) {
     const injectConfig = (html, projectTabsOverride, themeOverride, renderTokenOverride) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
+      if (!dashboardShowResourceLinks) {
+        clientConfig.dashboard = { showResourceLinks: false };
+      }
       if (embed.enabled) {
         const embedClient = embedClientConfigForRequest(embed, projectTabsOverride, themeOverride, renderTokenOverride);
         if (embedClient) clientConfig.embed = embedClient;
@@ -13585,7 +13717,7 @@ async function createServer(opts) {
   }
   checkLatestVersionForServer();
   scheduler.start();
-  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq22(researchRuns.status, ResearchRunStatuses.queued)).all()) {
+  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq21(researchRuns.status, ResearchRunStatuses.queued)).all()) {
     dispatchResearchRun(run.id, run.projectId);
   }
   app.addHook("onClose", async () => {