@aitne/daemon 0.1.9 → 0.1.11

package/dist/core/notification-gate.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Outbound-notification gate — QUIET_HOURS_HARDENING_PLAN.md Phase 1.
+ *
+ * Single decision function for the API-deps `sendNotification` chokepoint
+ * (`bootstrap/api.ts`), closing finding F1: `POST /api/notify` used to
+ * bypass quiet hours AND rate limits without the explicit-user-intent
+ * justification the other delivery paths encode. The intent rule —
+ * "explicit user-chosen time → deliver regardless of quiet hours; ambient
+ * autonomous output → suppress/defer" — now holds here too:
+ *
+ *   1. safety / critical → send immediately (mirrors NotificationManager);
+ *   2. inside quiet hours → defer to a `task_type='dm'` agent_schedule row
+ *      at the quiet-hours edge (durable, coalesced per origin — see
+ *      `db/deferred-dm.ts`), never silently dropped;
+ *   3. outside quiet hours → enforce the same hourly/daily rate limits the
+ *      proactive path enforces; the live session gets a `rate_limit`
+ *      verdict it can adapt to (write to today.md instead) rather than a
+ *      silent queue.
+ *
+ * Pure composition over covered helpers — keep glue out of bootstrap.
+ */
+import type Database from "better-sqlite3";
+/** Safety categories bypass quiet hours and user preferences. Owned here
+ *  so the NotificationManager and this gate share one list. */
+export declare const SAFETY_CATEGORIES: readonly ["security", "deadline", "error", "critical"];
+export interface OutboundGateConfig {
+    quietHoursStart: string;
+    quietHoursEnd: string;
+    /** IANA tz; empty string falls back to system timezone. */
+    timezone: string;
+    maxNotificationsPerHour: number;
+    maxNotificationsPerDay: number;
+    dayBoundaryHour: number;
+}
+export interface OutboundGateParams {
+    message: string;
+    platforms?: string[] | undefined;
+    priority?: string | undefined;
+    notificationType?: string | undefined;
+    originSessionId?: number | undefined;
+    agentId?: string | null | undefined;
+    /** Origin marker stamped into the deferred row, e.g. `"api.notify"`. */
+    deferredFrom: string;
+}
+export type OutboundGateResult = {
+    action: "send";
+} | {
+    action: "defer";
+    scheduleId: string;
+    /** SQLite-format UTC datetime the deferred DM fires at. */
+    deliverAfter: string;
+    coalesced: boolean;
+} | {
+    action: "rate_limit";
+    retryAfter: string | null;
+};
+/**
+ * Critical priority and safety-tagged notification types deliver
+ * immediately — same bypass set as `NotificationManager.isSafetyCategory`
+ * ("urgent" accepted defensively; the notify schema only emits
+ * critical/high/normal/low).
+ */
+export declare function bypassesOutboundGate(priority: string | undefined, notificationType: string | undefined): boolean;
+export declare function gateOutboundNotification(db: Database.Database, config: OutboundGateConfig, params: OutboundGateParams, now?: Date): OutboundGateResult;

package/dist/core/notification-gate.js

@@ -0,0 +1,51 @@
+import { deferDmToQuietHoursEnd } from "../db/deferred-dm.js";
+import { evaluateNotificationRateLimit, } from "./notification-rate-limit.js";
+/** Safety categories bypass quiet hours and user preferences. Owned here
+ *  so the NotificationManager and this gate share one list. */
+export const SAFETY_CATEGORIES = [
+    "security",
+    "deadline",
+    "error",
+    "critical",
+];
+/**
+ * Critical priority and safety-tagged notification types deliver
+ * immediately — same bypass set as `NotificationManager.isSafetyCategory`
+ * ("urgent" accepted defensively; the notify schema only emits
+ * critical/high/normal/low).
+ */
+export function bypassesOutboundGate(priority, notificationType) {
+    if (priority === "critical" || priority === "urgent")
+        return true;
+    return (notificationType !== undefined &&
+        SAFETY_CATEGORIES.includes(notificationType));
+}
+export function gateOutboundNotification(db, config, params, now = new Date()) {
+    if (bypassesOutboundGate(params.priority, params.notificationType)) {
+        return { action: "send" };
+    }
+    const deferred = deferDmToQuietHoursEnd(db, {
+        start: config.quietHoursStart,
+        end: config.quietHoursEnd,
+        timezone: config.timezone || undefined,
+    }, {
+        message: params.message,
+        platforms: params.platforms,
+        deferredFrom: params.deferredFrom,
+        originSessionId: params.originSessionId,
+        agentId: params.agentId,
+    }, now);
+    if (deferred !== null) {
+        return { action: "defer", ...deferred };
+    }
+    const rateLimit = evaluateNotificationRateLimit(db, {
+        maxNotificationsPerHour: config.maxNotificationsPerHour,
+        maxNotificationsPerDay: config.maxNotificationsPerDay,
+        timezone: config.timezone,
+        dayBoundaryHour: config.dayBoundaryHour,
+    }, now);
+    if (rateLimit.limited) {
+        return { action: "rate_limit", retryAfter: rateLimit.retryAfter };
+    }
+    return { action: "send" };
+}

package/dist/core/notification-rate-limit.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Outbound-notification rate-limit evaluation — pure(ish) helper shared by
+ * NotificationManager (proactive suppression) and the `/api/notify` gate
+ * (QUIET_HOURS_HARDENING_PLAN.md Phase 1). Extracted so the two call sites
+ * cannot drift on the counting semantics: distinct dispatches, delivered
+ * only, `message.received` replies excluded, hourly window + agent-day
+ * window both enforced.
+ *
+ * 100% covered. NotificationManager itself stays excluded from the
+ * coverage gate as I/O-heavy; this helper is the pure leg it shares with
+ * the notify-route gate.
+ */
+import type Database from "better-sqlite3";
+export interface NotificationRateLimitOptions {
+    maxNotificationsPerHour: number;
+    maxNotificationsPerDay: number;
+    /** IANA tz; empty/undefined falls back to system timezone. */
+    timezone?: string | undefined;
+    /** Agent day boundary hour (default config: 4). */
+    dayBoundaryHour: number;
+}
+export interface NotificationRateLimitState {
+    limited: boolean;
+    /**
+     * SQLite-format UTC datetime (`YYYY-MM-DD HH:MM:SS`) when a retry could
+     * succeed, or `null` when not limited. Hourly limit → the moment the
+     * oldest delivery in the trailing hour ages out of the window; daily
+     * limit → the agent-day end boundary. Advisory — the caller's retry can
+     * still lose to a concurrent delivery.
+     */
+    retryAfter: string | null;
+}
+/**
+ * Count semantics mirror the pre-extraction `NotificationManager`
+ * implementation byte-for-byte: a multi-channel dispatch counts once
+ * (DISTINCT on dispatch_id, falling back to the row id for legacy rows
+ * with an empty dispatch_id), only `delivered` rows count, and
+ * `message.received` reply forwards never count against proactive budget.
+ */
+export declare function evaluateNotificationRateLimit(db: Database.Database, opts: NotificationRateLimitOptions, now?: Date): NotificationRateLimitState;

package/dist/core/notification-rate-limit.js

@@ -0,0 +1,50 @@
+import { formatSqliteDatetime, getAgentDayBoundsUtc } from "@aitne/shared";
+const HOUR_MS = 60 * 60 * 1000;
+/**
+ * Count semantics mirror the pre-extraction `NotificationManager`
+ * implementation byte-for-byte: a multi-channel dispatch counts once
+ * (DISTINCT on dispatch_id, falling back to the row id for legacy rows
+ * with an empty dispatch_id), only `delivered` rows count, and
+ * `message.received` reply forwards never count against proactive budget.
+ */
+export function evaluateNotificationRateLimit(db, opts, now = new Date()) {
+    const hourFloor = formatSqliteDatetime(new Date(now.getTime() - HOUR_MS));
+    const hourly = db
+        .prepare(`SELECT COUNT(DISTINCT CASE
+           WHEN dispatch_id != '' THEN dispatch_id
+           ELSE CAST(id AS TEXT)
+         END) as cnt,
+         MIN(created_at) as oldest
+       FROM notification_log
+       WHERE status = 'delivered'
+         AND COALESCE(notification_type, '') != 'message.received'
+         AND created_at > ?`)
+        .get(hourFloor);
+    if (hourly.cnt >= opts.maxNotificationsPerHour) {
+        // The window opens when the oldest in-window delivery ages past 1 h.
+        // `oldest` is non-null whenever cnt > 0; the cnt===0 ∧ limit<=0 corner
+        // (a zero/negative configured cap) degrades to "retry at now + 1 h".
+        const oldestMs = hourly.oldest
+            ? new Date(`${hourly.oldest.replace(" ", "T")}Z`).getTime()
+            : now.getTime();
+        return {
+            limited: true,
+            retryAfter: formatSqliteDatetime(new Date(oldestMs + HOUR_MS)),
+        };
+    }
+    const bounds = getAgentDayBoundsUtc(opts.timezone || undefined, opts.dayBoundaryHour, now);
+    const daily = db
+        .prepare(`SELECT COUNT(DISTINCT CASE
+           WHEN dispatch_id != '' THEN dispatch_id
+           ELSE CAST(id AS TEXT)
+         END) as cnt
+       FROM notification_log
+       WHERE status = 'delivered'
+         AND COALESCE(notification_type, '') != 'message.received'
+         AND created_at >= ? AND created_at < ?`)
+        .get(bounds.start, bounds.end);
+    if (daily.cnt >= opts.maxNotificationsPerDay) {
+        return { limited: true, retryAfter: bounds.end };
+    }
+    return { limited: false, retryAfter: null };
+}

package/dist/core/policy-files.d.ts

@@ -31,7 +31,7 @@ export declare function createPromptInjectionBudget(maxBytes?: number): PromptIn
  *   - `policies/mcp.md` — MCP usage rules (B-003; inject when any MCP enabled)
  *   - `policies/journal-format.md` — daily journal format (morning routine)
  *   - `policies/redaction.md` — secret patterns (all flows)
- *   - `policies/routines/hourly.md` — hourly check list
+ *   - `policies/routines/activity-scan.md` — activity scan list
  *   - `policies/routines/morning.md` — 04:00 checks (morning routine)
  *   - `policies/routines/custom/<slug>.md` — per-custom-routine check list
  *

package/dist/core/policy-files.js

@@ -51,8 +51,8 @@ export const POLICY_FILE_REGISTRY = {
             injectIf: (ctx) => ctx.flags?.mcpEnabled === true,
         },
     ],
-    "routine.hourly_check": [
-        { path: CONTEXT_RELATIVE_PATHS.routines.hourly, label: "Hourly checks" },
+    "routine.activity_scan": [
+        { path: CONTEXT_RELATIVE_PATHS.routines.activityScan, label: "Activity scans" },
     ],
     "routine.morning_routine": [
         {

package/dist/core/pre-pass-freshness.d.ts

@@ -1,17 +1,17 @@
 /**
- * Freshness-window helpers for the hourly_check pre-pass harvester
+ * Freshness-window helpers for the activity_scan pre-pass harvester
  * (HOURLY_CHECK_GATE_REDESIGN_PLAN.md §3.4).
  *
  * The pre-pass fetcher writes a `runtime_state` row keyed by integration
- * after every successful per-integration completion. The hourly_check
+ * after every successful per-integration completion. The activity_scan
  * coordinator's `harvestForGate` reads the row to decide whether the
  * window is fresh enough to skip pre-pass on this tick.
  *
  * The key prefix is intentionally shared across every routine that
- * spawns `routine.fetch_window` (morning_routine, hourly_check,
+ * spawns `routine.fetch_window` (morning_routine, activity_scan,
  * evening_review, weekly_review, today_refresh). Sharing means a
  * morning_routine that just ran at 04:00 suppresses the 05:00
- * hourly_check pre-pass — exactly what we want to avoid double-fetching.
+ * activity_scan pre-pass — exactly what we want to avoid double-fetching.
  *
  * Module is intentionally trivial — separated so both the runner (writer)
  * and the coordinator (reader) can depend on a single string-builder

package/dist/core/retention.d.ts

@@ -90,6 +90,11 @@ export interface RetentionResult {
      * rows are never counted here; boot-recovery owns them.
      */
     browserTask: number;
+    /**
+     * BACKGROUND_TASK_RUNNER_DESIGN.md §6 — terminal `background_task` rows
+     * pruned during this sweep (children cascade via FK).
+     */
+    backgroundTask: number;
     /**
      * BROWSER_TASK_REDESIGN_PLAN.md §5 — pending lite-final-confirm
      * tokens past their 5-min TTL flipped to `expired` during this sweep

package/dist/core/retention.js

@@ -6,6 +6,7 @@ import { expireStalePurchaseTokens, scrubRotatedPurchaseTokens, sweepOrphanedCon
 import { deletePurchaseRepliesOlderThan } from "../db/browser-automation-purchase-replies-store.js";
 import { deleteWorkflowRunsOlderThan } from "../db/browser-automation-store.js";
 import { deleteTerminalBrowserTasksOlderThan } from "../db/browser-task-store.js";
+import { deleteTerminalBackgroundTasksOlderThan } from "../db/background-task-store.js";
 import { expireStaleLiteFinalConfirmTokens, scrubRotatedLiteFinalConfirmTokens, } from "../db/browser-task-final-confirm-tokens-store.js";
 import { cleanupConsumedObservations, getStalePendingObservationStats, } from "../db/observations.js";
 import { pruneOldMcpToolCalls } from "../services/mcp/tool-audit.js";
@@ -61,6 +62,16 @@ const RETENTION_DAYS = {
      * sweep itself is broken and we should not paper over it.
      */
     browserTask: TRACE_RETENTION_DAYS,
+    /**
+     * BACKGROUND_TASK_RUNNER_DESIGN.md §6 — terminal `background_task` rows
+     * age out at 30 days. Unlike browser_task there are no trace
+     * screenshots to keep in sync; 30 days keeps a month of completed-task
+     * history so a late "what did that find?" follow-up can still
+     * `GET /api/background-task/:id`. Children
+     * (`background_task_clarifications`) cascade via FK. Non-terminal rows
+     * are NEVER deleted — boot re-dispatch owns them.
+     */
+    backgroundTask: 30,
     /**
      * BROWSER_TASK_REDESIGN_PLAN.md §14.11 Q#6 — lite-final-confirm tokens
      * carry the same `!~xxxxxxxx` shape as B-4 purchase tokens. Mirror the
@@ -79,7 +90,7 @@ const RETENTION_DAYS = {
     skillCurationRunningMaxHours: 24,
     tempFiles: 1,
     /**
-     * Pending observations are NEVER deleted by retention (the hourly_check
+     * Pending observations are NEVER deleted by retention (the activity_scan
      * dispatcher owns consumption). After this many days unconsumed, retention
      * logs a warning so the operator notices a stalled pipeline.
      */
@@ -193,6 +204,7 @@ export function runRetentionCleanup(db, config) {
         browserAutomationPurchaseTokensScrubbed: 0,
         browserAutomationPurchaseRepliesDeleted: 0,
         browserTask: 0,
+        backgroundTask: 0,
         browserTaskFinalConfirmTokensExpired: 0,
         browserTaskFinalConfirmTokensScrubbed: 0,
         ftsOptimized: false,
@@ -232,6 +244,7 @@ export function runRetentionCleanup(db, config) {
         browserAutomationPurchaseTokensScrubbed: 0,
         browserAutomationPurchaseRepliesDeleted: 0,
         browserTask: 0,
+        backgroundTask: 0,
         browserTaskFinalConfirmTokensExpired: 0,
         browserTaskFinalConfirmTokensScrubbed: 0,
     };
@@ -380,10 +393,12 @@ export function runRetentionCleanup(db, config) {
                 scrubRotatedLiteFinalConfirmTokens(db, tokenScrubCutoff);
             const browserTaskCutoff = now - RETENTION_DAYS.browserTask * 86_400_000;
             counts.browserTask = deleteTerminalBrowserTasksOlderThan(db, browserTaskCutoff);
+            const backgroundTaskCutoff = now - RETENTION_DAYS.backgroundTask * 86_400_000;
+            counts.backgroundTask = deleteTerminalBackgroundTasksOlderThan(db, backgroundTaskCutoff);
         }
         catch (err) {
             /* c8 ignore next 5 */
-            logger.warn({ err }, "browser_task retention sweep skipped (tables missing)");
+            logger.warn({ err }, "browser_task / background_task retention sweep skipped (tables missing)");
         }
     })();
     // Transaction committed — safe to copy counts into result.
@@ -416,6 +431,7 @@ export function runRetentionCleanup(db, config) {
     result.imminentEventNotifications = counts.imminentEventNotifications;
     result.browserAutomationWorkflows = counts.browserAutomationWorkflows;
     result.browserTask = counts.browserTask;
+    result.backgroundTask = counts.backgroundTask;
     result.browserTaskFinalConfirmTokensExpired =
         counts.browserTaskFinalConfirmTokensExpired;
     result.browserTaskFinalConfirmTokensScrubbed =
@@ -433,7 +449,7 @@ export function runRetentionCleanup(db, config) {
     result.attachmentOrphanRows = attachmentCleanup.orphanRows;
     result.attachmentDanglingRows = attachmentCleanup.danglingRows;
     result.attachmentUntrackedDirs = attachmentCleanup.untrackedDirs;
-    // Surface stale pending observations so a stalled hourly_check pipeline
+    // Surface stale pending observations so a stalled activity_scan pipeline
     // becomes visible in daemon logs. Pending rows are intentionally not
     // deleted (see RETENTION_DAYS.stalePendingObservationsWarn comment).
     const stalePending = getStalePendingObservationStats(db, RETENTION_DAYS.stalePendingObservationsWarn);
@@ -442,7 +458,7 @@ export function runRetentionCleanup(db, config) {
             stalePendingCount: stalePending.count,
             oldestObservedAt: stalePending.oldestObservedAt,
             thresholdDays: RETENTION_DAYS.stalePendingObservationsWarn,
-        }, "Stale pending observations detected — hourly_check may be skipping or stalled");
+        }, "Stale pending observations detected — activity_scan may be skipping or stalled");
     }
     // ── FTS5 segment optimization ──
     //

package/dist/core/review-context.d.ts

@@ -1,5 +1,5 @@
 import { type PromptInjectionBudget } from "./policy-files.js";
-export type ReviewFlowSlug = "hourly" | "morning" | "evening" | "weekly" | "monthly" | "roadmap";
+export type ReviewFlowSlug = "activity-scan" | "morning" | "evening" | "weekly" | "monthly" | "roadmap";
 interface ReviewFlowConfig {
     flow: ReviewFlowSlug;
     dossierPath: string;

package/dist/core/review-context.js

@@ -6,10 +6,10 @@ import { POLICY_FILE_MAX_BYTES, createPromptInjectionBudget, } from "./policy-fi
 import { createLogger } from "../logging.js";
 const logger = createLogger("review-context");
 const REVIEW_FLOW_BY_PROCESS_KEY = {
-    "routine.hourly_check": {
-        flow: "hourly",
-        dossierPath: dossierPath("hourly"),
-        dossierLabel: "Hourly dossier",
+    "routine.activity_scan": {
+        flow: "activity-scan",
+        dossierPath: dossierPath("activity-scan"),
+        dossierLabel: "Activity scan dossier",
     },
     "routine.morning_routine": {
         flow: "morning",
@@ -295,7 +295,12 @@ function reviewFlowsMatch(raw, flow) {
         .split(/[,;/\s]+/)
         .map((token) => token.trim())
         .filter(Boolean);
-    return tokens.includes(flow);
+    if (tokens.includes(flow))
+        return true;
+    // v0.1.10 → v0.1.11 rename: user-vault `_index.md` rows written before the
+    // rename tag the activity-scan flow as "hourly". Accept the legacy token
+    // until the index reconciler has naturally rewritten those rows.
+    return flow === "activity-scan" && tokens.includes("hourly");
 }
 function sanitizeContextIndexPath(rawPath) {
     const path = rawPath.trim().replace(/^\.\//, "");

package/dist/core/roadmap-write-lock.d.ts

@@ -31,8 +31,9 @@ export interface RoadmapWriteLockManager {
 export declare class InMemoryRoadmapWriteLockManager implements RoadmapWriteLockManager {
     private readonly timeoutMs;
     private holder;
-    private timer;
+    private expiresAtMs;
     constructor(timeoutMs: number);
+    private expireIfStale;
     acquire(): {
         ok: true;
         lockId: string;

package/dist/core/roadmap-write-lock.js

@@ -4,44 +4,49 @@ const logger = createLogger("roadmap-write-lock");
 export class InMemoryRoadmapWriteLockManager {
     timeoutMs;
     holder = null;
-    timer = null;
+    expiresAtMs = 0;
     constructor(timeoutMs) {
         this.timeoutMs = timeoutMs;
     }
+    // Wall-clock lazy expiry — mirrors today-write-lock.ts. A setTimeout
+    // here would freeze across machine sleep (monotonic clock) and hold
+    // the lock long past its TTL after wake.
+    expireIfStale() {
+        if (this.holder && Date.now() >= this.expiresAtMs) {
+            logger.warn({ lockId: this.holder }, "Roadmap write lock expired by timeout");
+            this.holder = null;
+        }
+    }
     acquire() {
+        this.expireIfStale();
         if (this.holder) {
             logger.debug({ existingHolder: this.holder }, "Lock acquire rejected — already held");
             return { ok: false, holder: this.holder };
         }
         const lockId = randomUUID();
         this.holder = lockId;
-        this.timer = setTimeout(() => {
-            logger.warn({ lockId: this.holder }, "Roadmap write lock expired by timeout");
-            this.holder = null;
-            this.timer = null;
-        }, this.timeoutMs);
+        this.expiresAtMs = Date.now() + this.timeoutMs;
         logger.debug({ lockId }, "Roadmap write lock acquired");
         return { ok: true, lockId };
     }
     release(lockId) {
+        this.expireIfStale();
         if (!this.holder || this.holder !== lockId) {
             return false;
         }
         this.holder = null;
-        if (this.timer) {
-            clearTimeout(this.timer);
-            this.timer = null;
-        }
         logger.debug({ lockId }, "Roadmap write lock released");
         return true;
     }
     isHeldBy(lockId) {
+        this.expireIfStale();
         if (!this.holder) {
             return false;
         }
         return this.holder === lockId;
     }
     getHolder() {
+        this.expireIfStale();
         return this.holder;
     }
 }

package/dist/core/routine-acquisition-plan.d.ts

@@ -27,12 +27,45 @@
  * ```
  */
 import { type BackendId, type IntegrationKey, type IntegrationState } from "@aitne/shared";
-import { type RoutineWindowKey } from "./routine-windows.js";
+import { type RoutineWindowKey, type WindowSymbol } from "./routine-windows.js";
 /**
  * Per-mode predicate string the partial filters on. Matches the predicate
  * names used by `applyIntegrationModeFilter` in `@aitne/shared`.
  */
 export type AcquisitionFetchMode = "direct" | "delegated-same" | "delegated-cross" | "native";
+/**
+ * Why a (window × integration) cell was dropped at plan-assembly time —
+ * PREPASS_COST_REDUCTION_PLAN.md N3. Before N3 these drops vanished
+ * without a trace; the runner now writes one `skipped` audit row per
+ * (integration × reason) group so the deferred no-surface streak skip
+ * (R5) and the empty-window backoff (R4) can be sized from data.
+ *
+ *  - `no_state` — integration absent from the `readIntegrations` snapshot.
+ *  - `no_binding` — delegated/native mode with a null backend binding.
+ *  - `disabled` — integration mode is explicitly `disabled`.
+ *  - `unknown_mode` — unrecognized mode string (forward-compat guard).
+ *  - `no_window_query` — `WINDOW_QUERIES` has no cell for the
+ *    (window, integration, mode) tuple where one was expected — a
+ *    genuine catalog hole.
+ *  - `no_accounts` — direct-mode per-account fan-out with zero active
+ *    accounts for the integration.
+ *  - `no_fetch_targets` — Notion routine fetches require an explicit
+ *    user allowlist so the pre-pass cannot scan the whole workspace.
+ *  - `direct_inline_prefetch` — the catalog *deliberately* omits the
+ *    `direct` cell because the daemon serves that data inline
+ *    (ContextBuilder pre-fetch / REST route) and a pre-pass row would
+ *    double-fetch (cf. `cal_morning_7d` in routine-windows.ts). Working
+ *    as designed, so the runner does NOT write an audit row for it —
+ *    counting it as a drop would pollute the R4/R5 sizing data the N3
+ *    audit stream exists to provide.
+ */
+export type AcquisitionPlanDropReason = "no_state" | "no_binding" | "disabled" | "unknown_mode" | "no_window_query" | "no_accounts" | "no_fetch_targets" | "direct_inline_prefetch";
+/** One dropped (window × integration) cell. */
+export interface AcquisitionPlanDrop {
+    integration: IntegrationKey;
+    window: WindowSymbol;
+    reason: AcquisitionPlanDropReason;
+}
 export interface AcquisitionAccount {
     /**
      * Integration key the account belongs to. Today only `gmail` and
@@ -215,3 +248,16 @@ export interface AcquisitionSubPlan {
  * `scoped="<key>"` attribute and the partition itself.
  */
 export declare function splitAcquisitionPlanByIntegration(input: BuildAcquisitionPlanInput): readonly AcquisitionSubPlan[];
+/**
+ * `splitAcquisitionPlanByIntegration` + the drop trace —
+ * PREPASS_COST_REDUCTION_PLAN.md N3. The fan-out runner consumes this
+ * variant so every (window × integration) cell dropped at plan-assembly
+ * time can be surfaced as a `skipped` audit row instead of vanishing.
+ * Same purity / ordering / row-preservation contract as the wrapper
+ * above.
+ */
+export interface AcquisitionPlanAssembly {
+    subPlans: readonly AcquisitionSubPlan[];
+    drops: readonly AcquisitionPlanDrop[];
+}
+export declare function buildAcquisitionPlanAssembly(input: BuildAcquisitionPlanInput): AcquisitionPlanAssembly;