@akasecurity/ai-tc-claude-code 0.9.10 → 0.9.12

package/scripts/post-tool-use.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH2 = "/";
+    var SLASH3 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH2).filter(Boolean);
+        const slices = path.split(SLASH3).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH2) + SLASH2,
+            slices.join(SLASH3) + SLASH3,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH2).filter(Boolean);
+          slices = path.split(SLASH3).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH2) + SLASH2,
+          slices.join(SLASH3) + SLASH3,
           cache,
           checkUnignored,
           slices
@@ -491,9 +491,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// ../../packages/plugin-runtime/src/attached/egress-wire.ts
-import { createHash as createHash4 } from "crypto";
-
 // ../../packages/persistence/src/attached-derived.ts
 import { rmSync } from "fs";
 import { join } from "path";
@@ -505,6 +502,14 @@ var ATTACHED_FORWARD_DROPS_FILENAME = "attached-forward-drops.json";
 import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync3, statSync } from "fs";
 import { join as join2 } from "path";
 
+// ../../packages/schema/src/drizzle/deferred-migrations.ts
+var DEFERRED_MIGRATION_TAGS = [
+  "0031_audit_capture_by_time_index",
+  "0032_audit_capture_by_id_index",
+  "0033_audit_capture_location_index",
+  "0034_findings_read_indexes"
+];
+
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
   {
@@ -622,6 +627,30 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0028_activity_session_probe_indexes",
     sql: "CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--> statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--> statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"
+  },
+  {
+    tag: "0029_audit_capture_rollup_index",
+    sql: "CREATE INDEX `idx_audit_capture_rollup` ON `audit_events` (`event_type`,`started_at`,`repo`,`id`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0030_audit_content_expiry",
+    sql: "ALTER TABLE `audit_events` ADD `content_expired_at` integer;--> statement-breakpoint\nCREATE INDEX `idx_audit_expirable_body` ON `audit_events` (`started_at`) WHERE content IS NOT NULL;"
+  },
+  {
+    tag: "0031_audit_capture_by_time_index",
+    sql: "CREATE INDEX `idx_audit_capture_by_time` ON `audit_events` (`started_at`,`id`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0032_audit_capture_by_id_index",
+    sql: "CREATE INDEX `idx_audit_capture_by_id` ON `audit_events` (`id`,`started_at`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0033_audit_capture_location_index",
+    sql: "CREATE INDEX `idx_audit_capture_location` ON `audit_events` (`repo`,`file_path`,`started_at`,`id`,`event_type`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0034_findings_read_indexes",
+    sql: "CREATE INDEX `idx_inspection_definitions_rule` ON `inspection_definitions` (`rule_id`,`severity`,`category`);--> statement-breakpoint\nCREATE INDEX `idx_inspection_findings_def` ON `inspection_findings` (`inspection_definition_id`,`audit_event_id`);--> statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event_cover` ON `inspection_findings` (`audit_event_id`,`inspection_definition_id`,`action_taken`,`finding_key`,`id`);"
   }
 ];
 
@@ -20669,6 +20698,15 @@ var FindingCategory = external_exports.enum([
 ]).meta({ id: "FindingCategory" });
 var FindingOrigin = external_exports.enum(["in-flight", "at-rest"]).meta({ id: "FindingOrigin" });
 var FindingStatus = external_exports.enum(["open", "handled", "resolved", "dismissed"]).meta({ id: "FindingStatus" });
+var SyncFailureReason = external_exports.enum(["deployment_refused", "payload_invalid", "detached_undelivered"]).meta({ id: "SyncFailureReason" });
+var FindingDeliveryState = external_exports.enum(["sent", "queued", "not_sent", "never_offered", "local_scan"]).meta({ id: "FindingDeliveryState" });
+var FindingDelivery = external_exports.object({
+  state: FindingDeliveryState,
+  // The delivery time for `sent`; the failure time for `not_sent` when recorded.
+  at: external_exports.iso.datetime().optional(),
+  // Only on `not_sent`, and only when a known reason was recorded.
+  reason: SyncFailureReason.optional()
+}).meta({ id: "FindingDelivery" });
 var ResolutionMethod = external_exports.enum([
   "enforced-in-flight",
   "fixed-at-source",
@@ -20725,7 +20763,10 @@ var FindingInstance = external_exports.object({
   // The session that event belongs to, when it has one — the seam a
   // per-instance "view session" link needs. Absent for events captured
   // outside a session.
-  sessionId: external_exports.string().optional()
+  sessionId: external_exports.string().optional(),
+  // The delivery state of the event above (see FindingDelivery). Optional so
+  // readers that do not project it stay valid.
+  delivery: FindingDelivery.optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -20742,13 +20783,11 @@ var FindingGroup = external_exports.object({
   latestDetectedAt: external_exports.iso.datetime(),
   instances: external_exports.array(FindingInstance),
   // Derived from instances' statuses with open-dominates precedence (see
-  // buildFindingGroups). Undefined only when no instance carries a status.
+  // foldGroupStatus). Undefined only when no instance carries a status.
   status: FindingStatus.optional(),
-  // The distinct people across the WHOLE group, not just the `instances`
-  // preview — from the store's whole-group aggregate when it supplies one,
-  // else folded from the rows (see buildFindingGroups). Undefined when no
-  // instance carries a user, or when the store supplied whole-group folds
-  // without one.
+  // The distinct people across the WHOLE group, not just the instances
+  // carried here. Undefined when no instance carries a user, or when the
+  // store supplied whole-group folds without one.
   users: external_exports.array(FindingUser).optional()
 }).meta({ id: "FindingGroup" });
 var FindingStats = external_exports.object({
@@ -20777,21 +20816,34 @@ var FindingFacets = external_exports.object({
   // counted under no value.
   status: external_exports.array(FindingFacetItem),
   // Host tool (attributes.tool_name). Present only on the instance-level
-  // reads, which can filter by it; the grouped read omits the dimension
+  // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
-  tool: external_exports.array(FindingFacetItem).optional()
+  tool: external_exports.array(FindingFacetItem).optional(),
+  // Delivery states (FindingDeliveryState). Present only on the
+  // instance-level reads, like `tool`.
+  deployment: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
-var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
-var ListGroupedFindingsQuery = external_exports.object({
+var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
+  id: "FindingTypeSummary"
+});
+var DEFAULT_FINDING_TYPES_LIMIT = 50;
+var MAX_FINDING_TYPES_LIMIT = 100;
+var ListFindingTypesQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
-  // FindingAction.
+  // FindingAction. It narrows TYPES: a type's severity is the one its newest
+  // firing version carries, and this list pages types.
+  //
+  // That is NOT a claim the findings of a type share it. A rule can hold several
+  // definition versions at different severities, so a type kept by this filter
+  // can hold findings that individually do not match — see totals.findings on
+  // ListFindingTypesResponse, which counts them all.
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
-  // Matches a group's DERIVED status (see FindingGroup.status), not its
-  // individual instances' — so a filtered group's Status column always reads
-  // one of the requested values.
+  // Matches a type's DERIVED status (see FindingGroup.status), not its
+  // individual findings' — so a filtered row's status always reads one of the
+  // requested values.
   status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
@@ -20801,23 +20853,37 @@ var ListGroupedFindingsQuery = external_exports.object({
   // from a time-scoped page (Activity's range) can carry that scope. Absent
   // means all time — this list has no default window.
   from: external_exports.iso.datetime().optional(),
-  // A group or instance id that must appear in the page even when the cursor
-  // has already advanced past its sort position. This is what keeps the
-  // Findings page's one-shot ?finding= deep link resolving once the list
-  // paginates: the target group is appended out of sort order rather than
-  // scanning forward for it. Never affects totals, facets or the cursor.
+  // A RULE id that must appear in the page even when the cursor has already
+  // advanced past its sort position. This is what keeps the selected type
+  // visible in the list once it paginates: the target is appended out of sort
+  // order rather than scanned forward for. Never affects totals, facets or the
+  // cursor. Unlike the grouped read this replaces, it names a rule only — an
+  // instance id is resolved by `findingInstance`, which is a primary-key seek
+  // and so is not bounded by what any page happens to hold.
   includeId: external_exports.string().optional(),
-  groupBy: external_exports.literal("type").optional(),
-  limit: external_exports.coerce.number().int().min(1).max(100).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_TYPES_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
-var ListGroupedFindingsResponse = external_exports.object({
+var ListFindingTypesResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings belonging to the matching TYPES — not findings that each match
+    // the filters. The filters here select types, so a type that survives
+    // contributes its whole instanceCount.
+    //
+    // `status` is the one exception, narrowed per finding via
+    // countInstancesByStatus. `severity`, `provider` and `action` are not, so
+    // this can exceed what the instance read reports for the same filters: a
+    // rule whose severity moved between versions is kept on its newest and
+    // still counts its older findings. Narrowing the other three needs
+    // per-dimension counts the aggregate does not carry today.
     findings: external_exports.number().int().nonnegative(),
-    groups: external_exports.number().int().nonnegative()
+    // Counts TYPES, which is the unit this read pages. The instance read's
+    // own totals count findings; the two deliberately answer different
+    // questions and are never summed.
+    types: external_exports.number().int().nonnegative()
   }),
   facets: FindingFacets,
-  items: external_exports.array(FindingGroup),
+  items: external_exports.array(FindingTypeSummary),
   nextCursor: external_exports.string().nullable(),
   // Present only on session-scoped queries (`sessionId` set): per ruleId, how
   // many times that rule fired in the session's persisted transcript. Findings
@@ -20825,7 +20891,7 @@ var ListGroupedFindingsResponse = external_exports.object({
   // every firing, so the two numbers legitimately differ — this map lets a
   // session-scoped view show both.
   sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
-}).meta({ id: "ListGroupedFindingsResponse" });
+}).meta({ id: "ListFindingTypesResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
   // it, so it is excluded from the request contract. The mapping helper
@@ -20855,16 +20921,19 @@ var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
 var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
-  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  // Rule ids, the same vocabulary the types list's `subtype` carries. Pinning
+  // ONE of them is how the master/detail view scopes its right-hand panel.
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   // Matches each instance's OWN derived status (deriveFindingStatus), unlike
-  // the grouped query's group-level fold.
+  // the types query's type-level fold.
   status: external_exports.array(FindingStatus).optional(),
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   // Exact repository / file-path matches, for the drill-down out of the
   // locations view. A row whose event carries no repo/file matches neither.
   repo: external_exports.string().optional(),
@@ -20877,37 +20946,51 @@ var ListFindingInstancesQuery = external_exports.object({
 });
 var ListFindingInstancesResponse = external_exports.object({
   // Instances matching the filters across the whole scope, not just this
-  // page — cursor-independent, like the grouped list's totals.
+  // page — cursor-independent, like the types list's totals.
   totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
-  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // Counts in INSTANCES here, where the types response counts types. Each
   // dimension still excludes its own filter.
   facets: FindingFacets,
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
-var FindingLocationFile = external_exports.object({
-  // Empty when the instances carried no file path (a prompt or a tool call
-  // with no file attribution).
-  file: external_exports.string(),
-  instanceCount: external_exports.number().int().nonnegative(),
-  maxSeverity: Severity,
-  latestDetectedAt: external_exports.iso.datetime(),
-  // Folded from the instances' derived statuses with the same
-  // open-dominates precedence a group uses.
-  status: FindingStatus.optional(),
-  // Distinct rules seen at this location, capped — the row shows them as
-  // chips, and the count is what conveys scale.
-  ruleIds: external_exports.array(external_exports.string())
-}).meta({ id: "FindingLocationFile" });
-var FindingLocationRepo = external_exports.object({
+var ListFindingInstancesPage = external_exports.object({
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesPage" });
+var FindingLocationSummary = external_exports.object({
+  // Opaque, stable, minted from the pair by encodeLocationId. It exists
+  // because a location's identity is two values and a URL param carries one:
+  // `?loc=` names a location the way `?rule=` names a type. Only ever compared
+  // for EQUALITY — the page's selection check, this read's `includeId`, the
+  // client's page dedupe — never decoded, and never a sort key.
+  id: external_exports.string(),
   /** Empty when the instances carried no repo attribute. */
   repo: external_exports.string(),
+  // Empty when the instances carried no file path (a prompt, or a tool call
+  // with no file attribution). Both halves empty is a real location — usually
+  // the largest one in a store — and is selectable like any other.
+  file: external_exports.string(),
   instanceCount: external_exports.number().int().nonnegative(),
+  // The WORST severity present, not the first row's. It is this list's primary
+  // sort key, so it is also what explains why a row is where it is, and it is
+  // how a reader decides what to open without opening everything.
   maxSeverity: Severity,
   latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same open-dominates
+  // precedence a group uses, so it answers "is anything left to do here" and
+  // not much more: a location holding 1 open among 40 resolved reads like one
+  // holding 40 open. That loss is accepted — the panel beside this list
+  // carries each finding's own status, and instanceCount sits next to the
+  // badge.
   status: FindingStatus.optional(),
-  files: external_exports.array(FindingLocationFile)
-}).meta({ id: "FindingLocationRepo" });
+  // Every distinct rule seen at this location, UNCAPPED — so the length is a
+  // tally rather than a sample and a row can say how many there are. Bounded
+  // by the ruleset, not by the store. The view bounds what it DISPLAYS.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationSummary" });
+var DEFAULT_FINDING_LOCATIONS_LIMIT = 50;
+var MAX_FINDING_LOCATIONS_LIMIT = 100;
 var ListFindingLocationsQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
@@ -20917,21 +21000,47 @@ var ListFindingLocationsQuery = external_exports.object({
   // instances that match, and folds its status from those.
   status: external_exports.array(FindingStatus).optional(),
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+  // A LOCATION id (see FindingLocationSummary.id) that must appear in the page
+  // even when the cursor has already advanced past its sort position — the
+  // counterpart of ListFindingTypesQuery.includeId, and needed far more often
+  // here. Selecting a row pushes the URL, which re-renders the server and resets
+  // the client's page cache to page 0; with distinct (repo, file) pairs running
+  // into the thousands, a selection sitting off page 0 is the ordinary case
+  // rather than a deep-link corner. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_LOCATIONS_LIMIT).optional(),
+  cursor: external_exports.string().optional()
 });
 var ListFindingLocationsResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings matching the filters across the whole scope. Unlike the types
+    // read's same-named field this needs no caveat: the filters here narrow
+    // per finding, so this is the sum of every row's instanceCount.
     findings: external_exports.number().int().nonnegative(),
-    repos: external_exports.number().int().nonnegative(),
-    files: external_exports.number().int().nonnegative()
+    // Counts LOCATIONS, the unit this read pages — the number the paginator
+    // states. The facets beside it count FINDINGS (see below); a surface
+    // showing both says which is which.
+    locations: external_exports.number().int().nonnegative()
   }),
-  /** Sorted by max severity, then most recent. */
-  items: external_exports.array(FindingLocationRepo),
-  /** Whether `limit` truncated the repo list. */
-  hasMore: external_exports.boolean()
+  // Counts in FINDINGS, where the types response counts types, each dimension
+  // still excluding its own filter. Deliberately not locations: counting those
+  // needs a set of location keys per dimension per value — memory tracking the
+  // store times the vocabulary, in a read whose scan promises flat memory —
+  // and the cheap per-location version is not an approximation but WRONG. A
+  // location holding {claudecode, block} and {codex, warn} would survive
+  // provider=claudecode AND action=warn, under which no single finding
+  // matches, so the facet would contradict the instanceCount this whole view
+  // rests on. Findings also keep the toolbar in the same unit as the page
+  // tally and the panel it sits above.
+  facets: FindingFacets,
+  /** Sorted by max severity, then most recent, then (repo, file). */
+  items: external_exports.array(FindingLocationSummary),
+  nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/meta.ts
@@ -21095,6 +21204,10 @@ var CaptureAttributes = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass.
   exception_ids: external_exports.array(external_exports.guid()).optional(),
+  // The persisted spellings of EventMetadata's messageId/conversationId — the
+  // join back to the `llm_call` leaf for the same assistant turn.
+  message_id: external_exports.string().optional(),
+  conversation_id: external_exports.string().optional(),
   // Whole milliseconds this capture's inspection blocked its caller — the
   // plugin's own added latency (see EventMetadata.inspectionMs, whose value
   // this is). Promoted to the `inspection_ms` generated column so the facet is
@@ -21103,7 +21216,19 @@ var CaptureAttributes = external_exports.object({
   // inline json_extract and is not itself an optimization.
   // ABSENT on replayed captures (backfill / worktree scan) and on rows written
   // before the measurement shipped — never present as a placeholder 0.
-  inspection_ms: external_exports.number().int().nonnegative().optional()
+  inspection_ms: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture could not carry out became instead (see
+  // EventMetadata.redactDegradedTo, whose value this is). Present only when a
+  // degrade actually happened, so absence is the ordinary case rather than a
+  // reader having to distinguish it from a zero.
+  //
+  // PER CAPTURE, while `inspection_findings.action_taken` is per finding —
+  // so on a multi-finding row this does not say which finding degraded, and
+  // its presence does not mean the fallback decided the capture's action. A
+  // capture denied by another finding's own Block policy carries `block`
+  // here too. The full statement is on EventMetadata.redactDegradedTo; it is
+  // repeated rather than referenced because a store reader opens this file.
+  redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
@@ -21302,7 +21427,17 @@ var AuditEvent = external_exports.object({
   /** `share` to a first-party/internal destination. */
   internal: external_exports.boolean(),
   /** Event needs review (e.g. unverified egress). */
-  flagged: external_exports.boolean()
+  flagged: external_exports.boolean(),
+  /**
+   * The body this event's `title` is drawn from was cleared by local body
+   * expiry, so an EMPTY title here means "gone", not "never had one".
+   *
+   * A separate flag rather than a sentinel written into `title`: the title is
+   * rendered text, and a store-layer module that invented display copy for it
+   * would be choosing words the view is supposed to choose. Additive and
+   * defaulted, so an older producer still validates.
+   */
+  bodyExpired: external_exports.boolean().default(false)
 }).meta({ id: "ActivityAuditEvent" });
 var ActivitySessionSummary = external_exports.object({
   id: external_exports.string(),
@@ -22100,6 +22235,14 @@ var ControlPlaneErrorBody = external_exports.object({
     message: external_exports.string().optional()
   }).optional()
 });
+var RemoteFailureKind = external_exports.enum([
+  "unauthorized",
+  "forbidden",
+  "route-absent",
+  "invalid-request",
+  "rejected",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22635,6 +22778,12 @@ var EventMetadata = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass. Absent on captures where no exception applied.
   exceptionIds: external_exports.array(external_exports.guid()).optional(),
+  // The assistant message this capture belongs to, and the conversation it sits
+  // in — set by the browser extension's network capture so a stored `response`
+  // row can be joined to the `llm_call` leaf describing the same turn. Absent
+  // on every other capture path, which has no such id.
+  messageId: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
   // front of. Measured inside `capture()` (@akasecurity/plugin-sdk) across
@@ -22647,7 +22796,37 @@ var EventMetadata = external_exports.object({
   // Absent is also what every pre-measurement client writes, and what a
   // clock failure degrades to — a reader must treat absence as "not measured"
   // and never as a zero, which would read as "inspection is free".
-  inspectionMs: external_exports.number().int().nonnegative().optional()
+  inspectionMs: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture COULD NOT CARRY OUT became instead — the
+  // workspace's `redactFallback`, applied because the field could not be
+  // masked in place (a shell command, a URL, or any argument on a host whose
+  // hook contract offers no rewrite channel).
+  //
+  // It exists because the action alone cannot say why. A finding recorded as
+  // `warn` reads identically whether its detection was ASSIGNED Warn or was
+  // assigned Redact on a field that could not take one — and those are
+  // different facts about the same row: the first is a policy the user chose,
+  // the second is a masking the host could not perform. Absent means no
+  // degrade happened, which is every ordinary capture.
+  //
+  // TWO LIMITS a reader of a stored row has to know, because the grain here
+  // is the CAPTURE while `actionTaken` is per FINDING:
+  //
+  //   - It does not say WHICH finding degraded. A capture carrying a degraded
+  //     `redact` alongside a finding ASSIGNED the same action stores both
+  //     identically and one reason for the pair; attributing it to both
+  //     describes the assigned one wrongly, and to neither loses the degrade.
+  //   - PRESENCE IS NOT CAUSATION. The value is the action the lost redact
+  //     became, not the reason the capture ended as it did — a capture denied
+  //     by some other finding's own Block policy still carries `block` here,
+  //     and clearing the workspace's fallback would not have let it through.
+  //     Gate on the value against what a fallback can produce; never read the
+  //     field's presence as "this was the fallback's doing".
+  //
+  // Both are pinned as behaviour in @akasecurity/plugin-sdk's runtime suite.
+  // Closing either means moving the reason onto the finding row, which
+  // already carries its own action.
+  redactDegradedTo: ActionTaken.optional()
 }).meta({ id: "EventMetadata" });
 var Event = external_exports.object({
   id: external_exports.guid(),
@@ -22757,7 +22936,32 @@ var RotateKeyInput = external_exports.object({
   confirmation: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/finding-delivery.ts
+var KNOWN_REASONS = SyncFailureReason.options;
+function knownReason(value) {
+  return value !== null && KNOWN_REASONS.includes(value) ? value : void 0;
+}
+function deriveFindingDelivery(row) {
+  if (row.kind === "code_change") return { state: "local_scan" };
+  if (row.syncedAt !== null && row.syncedAt > 0) {
+    return { state: "sent", at: epochMillisToIso(row.syncedAt) };
+  }
+  if (row.syncedAt !== null) {
+    const reason = knownReason(row.syncFailure);
+    return {
+      state: "not_sent",
+      ...row.syncFailedAt === null ? {} : { at: epochMillisToIso(row.syncFailedAt) },
+      ...reason === void 0 ? {} : { reason }
+    };
+  }
+  if (row.outboxOwed === 1 || row.syncClaimedAt !== null) return { state: "queued" };
+  return { state: "never_offered" };
+}
+
 // ../../packages/schema/src/zod/findings-group-build.ts
+function lookupOwn(map2, key) {
+  return Object.hasOwn(map2, key) ? map2[key] : void 0;
+}
 function toApiAction(dbVal) {
   const map2 = {
     log: "monitored",
@@ -22766,7 +22970,7 @@ function toApiAction(dbVal) {
     warn: "warned",
     allow: "allowed"
   };
-  return map2[dbVal] ?? "allowed";
+  return lookupOwn(map2, dbVal) ?? "allowed";
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
@@ -22774,13 +22978,18 @@ function toApiCategory(dbVal) {
   return parsed2.success ? parsed2.data : "custom";
 }
 function toApiProvider(sourceTool) {
-  return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
+  return lookupOwn(TOOL_TO_HARNESS, sourceTool) ?? HARNESS.Api;
 }
-var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
+var FINDING_STATUS_PRECEDENCE = [
+  "open",
+  "handled",
+  "dismissed",
+  "resolved"
+];
 function foldGroupStatus(instanceStatuses) {
   const statuses = new Set(instanceStatuses.filter((s) => s !== void 0));
   if (statuses.size === 0) return void 0;
-  for (const candidate of STATUS_PRECEDENCE) {
+  for (const candidate of FINDING_STATUS_PRECEDENCE) {
     if (statuses.has(candidate)) return candidate;
   }
   return void 0;
@@ -22793,139 +23002,62 @@ function deriveFindingStatus(row) {
   if (row.latestResolutionStatus === "dismissed") return "dismissed";
   return "open";
 }
-function distinctUsers(instances) {
-  const seen = /* @__PURE__ */ new Set();
-  const users = [];
-  for (const i of instances) {
-    if (i.user === void 0 || seen.has(i.user.id)) continue;
-    seen.add(i.user.id);
-    users.push(i.user);
-  }
-  return users;
-}
 function sortUsers(users) {
   return [...users].sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
 }
-function buildFindingGroups(rows, opts = {}) {
-  const overrides = opts.overrides;
+function buildFindingTypes(aggregates, opts = {}) {
   const packNames = opts.packNames;
-  const aggregates = opts.aggregates;
-  const byRuleId = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const existing = byRuleId.get(row.ruleId);
-    if (existing) existing.push(row);
-    else byRuleId.set(row.ruleId, [row]);
-  }
-  const groups = [];
-  for (const [ruleId, ruleRows] of byRuleId) {
-    const instances = ruleRows.map((r) => {
-      const effectiveDbAction = overrides?.get(r.id) ?? r.actionTaken;
-      return {
-        id: r.id,
-        provider: toApiProvider(r.sourceTool),
-        repo: r.repo,
-        file: r.file,
-        ...r.toolName === void 0 ? {} : { toolName: r.toolName },
-        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
-        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
-        ...r.user === void 0 ? {} : { user: r.user },
-        action: toApiAction(effectiveDbAction),
-        detectedAt: r.occurredAt,
-        confidence: r.confidence,
-        status: r.status
-      };
-    });
-    const agg = aggregates?.get(ruleId);
-    const users = agg ? sortUsers(agg.users ?? []) : distinctUsers(instances);
-    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
-      (max, r) => r.occurredAt > max ? r.occurredAt : max,
-      ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    );
-    const seenProviders = /* @__PURE__ */ new Set();
-    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
-      if (seenProviders.has(p)) return false;
-      seenProviders.add(p);
-      return true;
-    });
-    const actionSet = new Set(
-      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
-    );
+  const types = [];
+  for (const [ruleId, agg] of aggregates) {
+    const users = sortUsers(agg.users ?? []);
+    const providers = [...new Set(agg.sourceTools.map(toApiProvider))].sort();
+    const actionSet = new Set(agg.actionsTaken.map(toApiAction));
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
-    const severity = ruleRows[0]?.severity ?? "low";
-    const detection = {
-      id: ruleId,
-      name: packNames?.get(ruleId) ?? null
-    };
-    const apiCategory = toApiCategory(ruleRows[0]?.category ?? "custom");
-    const policy = { id: `category:${apiCategory}`, name: apiCategory };
-    const match = {
-      maskedValue: ruleRows[0]?.maskedMatch ?? "",
-      contextPrefix: ""
-      // empty (pending privacy review)
-    };
-    const status = foldGroupStatus(
-      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
-    );
-    const group = {
+    const apiCategory = toApiCategory(agg.category ?? "custom");
+    const type = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
       // human label comes with pack metadata later
-      severity,
-      match,
-      detection,
-      policy,
-      instanceCount: agg?.instanceCount ?? instances.length,
+      severity: agg.severity ?? "low",
+      detection: { id: ruleId, name: packNames?.get(ruleId) ?? null },
+      policy: { id: `category:${apiCategory}`, name: apiCategory },
+      instanceCount: agg.instanceCount,
       providers,
       aggregateAction,
-      latestDetectedAt,
-      instances,
-      status,
+      latestDetectedAt: agg.latestDetectedAt,
+      status: foldGroupStatus(agg.statusInputs.map(deriveFindingStatus)),
       ...users.length > 0 ? { users } : {}
     };
-    if (agg) {
-      actionsCache.set(group, [...actionSet]);
-      if (agg.searchText !== void 0) {
-        haystackCache.set(group, buildHaystack(group, agg.searchText));
-      }
+    actionsCache.set(type, [...actionSet]);
+    if (agg.searchText !== void 0) {
+      haystackCache.set(type, buildHaystack(type, agg.searchText));
     }
-    groups.push(group);
+    types.push(type);
   }
-  return groups;
+  return types;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function buildHaystack(g, extra) {
+function buildHaystack(t, extra) {
   return [
-    g.subtype,
-    g.category,
-    g.match.maskedValue,
-    g.policy.name,
-    g.id,
-    ...g.instances.map((i) => i.repo),
-    ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.toolName ? `via ${i.toolName}` : ""),
-    ...g.instances.map((i) => i.id),
-    // The people: the whole group's list when the store folded one, plus the
-    // preview's own — the two overlap, and a haystack does not mind.
-    ...(g.users ?? []).map((u) => u.name),
-    ...g.instances.map((i) => i.user?.name ?? ""),
+    t.subtype,
+    t.category,
+    t.policy.name,
+    t.id,
+    ...(t.users ?? []).map((u) => u.name),
     ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
 }
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
+function typeHaystack(t) {
+  const cached2 = haystackCache.get(t);
   if (cached2 !== void 0) return cached2;
-  const haystack = buildHaystack(g);
-  haystackCache.set(g, haystack);
+  const haystack = buildHaystack(t);
+  haystackCache.set(t, haystack);
   return haystack;
 }
 var actionsCache = /* @__PURE__ */ new WeakMap();
-function groupActions(g) {
-  const cached2 = actionsCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const actions = [...new Set(g.instances.map((i) => i.action))];
-  actionsCache.set(g, actions);
-  return actions;
+function typeActions(t) {
+  return actionsCache.get(t) ?? [];
 }
 function countInstancesByStatus(statusInputs, statuses) {
   const statusSet = new Set(statuses);
@@ -22936,8 +23068,8 @@ function countInstancesByStatus(statusInputs, statuses) {
   }
   return sum;
 }
-function applyFindingFilters(groups, opts) {
-  let filtered = groups;
+function applyFindingFilters(types, opts) {
+  let filtered = types;
   if (opts.severity && opts.severity.length > 0) {
     const sevSet = new Set(opts.severity);
     filtered = filtered.filter((g) => sevSet.has(g.severity));
@@ -22948,7 +23080,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
+    filtered = filtered.filter((t) => typeActions(t).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -22960,26 +23092,31 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.q) {
     const q = opts.q.toLowerCase();
-    filtered = filtered.filter((g) => groupHaystack(g).includes(q));
+    filtered = filtered.filter((t) => typeHaystack(t).includes(q));
   }
   return filtered;
 }
-var SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
-var SEVERITY_RANK = SEVERITY_ORDER;
+function rankByOrder(members2) {
+  return Object.fromEntries(members2.map((member, index) => [member, index]));
+}
+var SEVERITY_RANK = rankByOrder(Severity.options);
+function severityRank(severity) {
+  return lookupOwn(SEVERITY_RANK, severity);
+}
 function compareFindingGroupOrder(a, b) {
-  const rankA = SEVERITY_RANK[a.severity] ?? -1;
-  const rankB = SEVERITY_RANK[b.severity] ?? -1;
+  const rankA = severityRank(a.severity) ?? -1;
+  const rankB = severityRank(b.severity) ?? -1;
   const severityDiff = rankA - rankB;
   if (severityDiff !== 0) return severityDiff;
   const recencyDiff = b.latestDetectedAt.localeCompare(a.latestDetectedAt);
   if (recencyDiff !== 0) return recencyDiff;
   return a.id.localeCompare(b.id);
 }
-function sortFindingGroups(groups) {
-  return [...groups].sort(compareFindingGroupOrder);
+function sortFindingTypes(types) {
+  return [...types].sort(compareFindingGroupOrder);
 }
-function computeFindingFacets(allGroups, opts) {
-  const forSeverity = applyFindingFilters(allGroups, {
+function computeFindingFacets(allTypes, opts) {
+  const forSeverity = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -22990,7 +23127,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forSeverity) {
     severityMap.set(g.severity, (severityMap.get(g.severity) ?? 0) + 1);
   }
-  const forProvider = applyFindingFilters(allGroups, {
+  const forProvider = applyFindingFilters(allTypes, {
     actions: opts.actions,
     statuses: opts.statuses,
     q: opts.q,
@@ -23001,7 +23138,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forProvider) {
     for (const p of g.providers) providerMap.set(p, (providerMap.get(p) ?? 0) + 1);
   }
-  const forAction = applyFindingFilters(allGroups, {
+  const forAction = applyFindingFilters(allTypes, {
     providers: opts.providers,
     statuses: opts.statuses,
     q: opts.q,
@@ -23010,9 +23147,9 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of typeActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
-  const forSubtype = applyFindingFilters(allGroups, {
+  const forSubtype = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -23021,7 +23158,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const subtypeMap = /* @__PURE__ */ new Map();
   for (const g of forSubtype) subtypeMap.set(g.subtype, (subtypeMap.get(g.subtype) ?? 0) + 1);
-  const forStatus = applyFindingFilters(allGroups, {
+  const forStatus = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     q: opts.q,
@@ -23043,6 +23180,20 @@ function computeFindingFacets(allGroups, opts) {
 }
 
 // ../../packages/schema/src/zod/findings-flat-build.ts
+function compareCodePoints(a, b) {
+  const aIter = a[Symbol.iterator]();
+  const bIter = b[Symbol.iterator]();
+  for (; ; ) {
+    const aNext = aIter.next();
+    const bNext = bIter.next();
+    if (aNext.done && bNext.done) return 0;
+    if (aNext.done) return -1;
+    if (bNext.done) return 1;
+    const aPoint = aNext.value.codePointAt(0) ?? 0;
+    const bPoint = bNext.value.codePointAt(0) ?? 0;
+    if (aPoint !== bPoint) return aPoint - bPoint;
+  }
+}
 function rowHaystack(row) {
   return [
     row.ruleId,
@@ -23067,12 +23218,24 @@ function matchesDimension(row, opts, dimension) {
       return !opts.actions?.length || opts.actions.includes(toApiAction(row.actionTaken));
     case "statuses":
       return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
+    case "deliveries":
+      return !opts.deliveries?.length || row.delivery !== void 0 && opts.deliveries.includes(row.delivery.state);
     case "tools":
       return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    // An EMPTY value is a real filter here, not an absent one. The location
+    // list buckets a finding whose event recorded no repo — or no file — under
+    // the empty string, and selecting that bucket has to narrow the panel to
+    // exactly it. Only `undefined` means "no filter"; a caller that wants every
+    // row omits the key, which every call site already does.
+    //
+    // Reading '' as unset is what this replaced, and it failed in the one place
+    // it mattered: the no-repo/no-file bucket is often the largest in a real
+    // store, and its panel dropped both predicates and returned the WHOLE scope
+    // — a row reading 3 findings beside a panel listing every finding there is.
     case "repo":
-      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+      return opts.repo === void 0 || row.repo === opts.repo;
     case "file":
-      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+      return opts.file === void 0 || row.file === opts.file;
     case "q":
       return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
   }
@@ -23083,6 +23246,7 @@ var DIMENSIONS = [
   "providers",
   "actions",
   "statuses",
+  "deliveries",
   "tools",
   "repo",
   "file",
@@ -23096,10 +23260,19 @@ function matchesInstanceFilters(row, opts, except) {
   return true;
 }
 function toItems(counts) {
-  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value));
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort(
+    (a, b) => b.count - a.count || a.value.localeCompare(b.value) || // localeCompare reports canonically-equivalent strings (an NFC and an
+    // NFD spelling of the same text) as equal, so a count tie between
+    // them would otherwise be ordered by whichever the Map iteration
+    // produced. compareCodePoints breaks that tie deterministically, which
+    // makes this a TOTAL order — not one that agrees with SQL collation,
+    // which it need not: foldFacetTuples runs this same sort over grouped
+    // tuples, so both paths order facets identically by construction.
+    compareCodePoints(a.value, b.value)
+  );
 }
-function bump(counts, value) {
-  counts.set(value, (counts.get(value) ?? 0) + 1);
+function bump(counts, value, by = 1) {
+  counts.set(value, (counts.get(value) ?? 0) + by);
 }
 function createInstanceFacetAccumulator(opts) {
   const severity = /* @__PURE__ */ new Map();
@@ -23108,6 +23281,7 @@ function createInstanceFacetAccumulator(opts) {
   const action = /* @__PURE__ */ new Map();
   const status = /* @__PURE__ */ new Map();
   const tool = /* @__PURE__ */ new Map();
+  const deployment = /* @__PURE__ */ new Map();
   return {
     add(row) {
       if (matchesInstanceFilters(row, opts, "severity")) bump(severity, row.severity);
@@ -23122,6 +23296,9 @@ function createInstanceFacetAccumulator(opts) {
       if (row.toolName !== void 0 && matchesInstanceFilters(row, opts, "tools")) {
         bump(tool, row.toolName);
       }
+      if (row.delivery !== void 0 && matchesInstanceFilters(row, opts, "deliveries")) {
+        bump(deployment, row.delivery.state);
+      }
     },
     facets: () => ({
       severity: toItems(severity),
@@ -23129,7 +23306,8 @@ function createInstanceFacetAccumulator(opts) {
       provider: toItems(provider),
       action: toItems(action),
       status: toItems(status),
-      tool: toItems(tool)
+      tool: toItems(tool),
+      deployment: toItems(deployment)
     })
   };
 }
@@ -23143,6 +23321,7 @@ function toInstanceDetail(row) {
     ...row.toolName === void 0 ? {} : { toolName: row.toolName },
     eventId: row.eventId,
     ...row.sessionId === void 0 ? {} : { sessionId: row.sessionId },
+    ...row.delivery === void 0 ? {} : { delivery: row.delivery },
     ...row.user === void 0 ? {} : { user: row.user },
     action: toApiAction(row.actionTaken),
     detectedAt: row.occurredAt,
@@ -23157,12 +23336,6 @@ function toInstanceDetail(row) {
     policy: { id: `category:${category}`, name: category }
   };
 }
-var SEVERITY_ORDER2 = {
-  critical: 0,
-  high: 1,
-  medium: 2,
-  low: 3
-};
 function newLocationAccumulator() {
   return {
     instanceCount: 0,
@@ -23177,7 +23350,7 @@ function newLocationAccumulator() {
 }
 function addToLocation(acc, row) {
   acc.instanceCount += 1;
-  const rank = SEVERITY_ORDER2[row.severity] ?? Number.MAX_SAFE_INTEGER - 1;
+  const rank = severityRank(row.severity) ?? Number.MAX_SAFE_INTEGER - 1;
   if (rank < acc.maxSeverityRank) {
     acc.maxSeverityRank = rank;
     acc.maxSeverity = row.severity;
@@ -23186,6 +23359,23 @@ function addToLocation(acc, row) {
   acc.statuses.push(row.status);
   acc.ruleIds.add(row.ruleId);
 }
+function compareLocationOrder(a, b) {
+  const rankA = severityRank(a.maxSeverity) ?? -1;
+  const rankB = severityRank(b.maxSeverity) ?? -1;
+  if (rankA !== rankB) return rankA - rankB;
+  if (a.latestDetectedAt !== b.latestDetectedAt) {
+    return a.latestDetectedAt < b.latestDetectedAt ? 1 : -1;
+  }
+  const repoDiff = compareCodePoints(a.repo, b.repo);
+  if (repoDiff !== 0) return repoDiff;
+  return compareCodePoints(a.file, b.file);
+}
+function encodeLocationId(repo, file2) {
+  return `${encodePart(repo)}/${encodePart(file2)}`;
+}
+function encodePart(value) {
+  return encodeURIComponent(value.replace(/[\uD800-\uDFFF]/gu, "\uFFFD"));
+}
 
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -23253,6 +23443,11 @@ var Policy = external_exports.object({
   // test `prohibitedModels` passes and `reversibleRuleIds` fails.
   provenance: PolicyProvenance.optional()
 }).meta({ id: "Policy" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
 var PolicyBundle = external_exports.object({
   version: external_exports.string(),
   policies: external_exports.array(Policy),
@@ -23300,6 +23495,16 @@ var PolicyBundle = external_exports.object({
   // control plane), so no name resolution stands between the decision and the
   // comparison.
   prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  // What a resolved `redact` becomes on a field the host cannot rewrite, as
+  // the ORGANIZATION would have it. Merged raise-only against the device's own
+  // `WorkspaceSettings.redactFallback` (see strongerRedactFallback below), so
+  // a control plane can tighten a machine and never loosen one — the same
+  // direction `mergeRaiseOnly` enforces for policies.
+  //
+  // Optional so an older backend, and an older on-disk cache, still parses;
+  // absent leaves the device's own setting in force, which is the behaviour
+  // that predates the field and the safe direction to default.
+  redactFallback: RedactFallback.optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -23329,11 +23534,6 @@ function severityFloorPolicy(category) {
   const peak = CATEGORY_PEAK_SEVERITY[category];
   return peak === "critical" || peak === "high" ? "warn" : "monitor";
 }
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
-  id: "RedactFallback"
-});
 var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
 var BUILTIN_POLICY_SPECS = {
   monitor: {
@@ -23389,6 +23589,11 @@ function isActionAtLeast(action, floor) {
 function strongerAction(a, b) {
   return actionRank(a) >= actionRank(b) ? a : b;
 }
+function strongerRedactFallback(local, remote) {
+  if (remote === void 0) return local;
+  const localAction = builtinPolicyToAction(local);
+  return localAction === strongerAction(localAction, builtinPolicyToAction(remote)) ? local : remote;
+}
 function weakestBuiltinAtLeast(floor) {
   return KNOWN_BUILTIN_IDS.find((id) => isActionAtLeast(builtinPolicyToAction(id), floor)) ?? "block";
 }
@@ -23637,7 +23842,7 @@ function isVaultConsentValid(consent) {
 }
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 8;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
@@ -23657,6 +23862,15 @@ var HistorySyncConsent = external_exports.object({
   payloadVersion: external_exports.number().int().positive(),
   endpoint: external_exports.string()
 });
+var BODY_RETENTION_DEFAULT_DAYS = 30;
+var BodyRetention = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  // Never 0, and the ceiling is a fat-finger guard rather than a policy
+  // limit — `enabled` is the real gate. A low value cannot reach a row the
+  // sync ledger still owes: the sweep's age filter only ever NARROWS a
+  // candidate set that is already bounded by "delivered, or never owed".
+  retainDays: external_exports.number().int().min(1).max(3650).default(BODY_RETENTION_DEFAULT_DAYS)
+}).meta({ id: "BodyRetention" });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   runMode: RunMode.default("standalone"),
@@ -23700,12 +23914,18 @@ var WorkspaceSettings = external_exports.object({
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
   // Records that the user consented to the DEFERRED send — the outbox — along
-  // with the payload shape and the endpoint they agreed to. Since payload v2
-  // that covers both the pre-attach backlog and undelivered captures (which
-  // carry prompt/reply text in `content`); the key name predates the widening.
-  // Absent until granted, and a grant for a different endpoint or an older
-  // payload no longer counts.
-  historySyncConsent: HistorySyncConsent.optional()
+  // with the payload shape and the endpoint they agreed to. Since payload v3
+  // that covers the pre-attach backlog AND undelivered captures alike, and both
+  // carry prompt/reply/tool-output text in `content`; the key name predates
+  // both widenings. Absent until granted, and a grant for a different endpoint
+  // or an older payload no longer counts.
+  historySyncConsent: HistorySyncConsent.optional(),
+  // Local body expiry (see BodyRetention). Off until switched on; expiring a
+  // body never removes the row or its findings.
+  bodyRetention: BodyRetention.default({
+    enabled: false,
+    retainDays: BODY_RETENTION_DEFAULT_DAYS
+  })
 });
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
@@ -23800,12 +24020,15 @@ function toCaptureAttributes(event) {
     ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
     ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
     ...metadata?.inspectionMs !== void 0 ? { inspection_ms: metadata.inspectionMs } : {},
+    ...metadata?.redactDegradedTo !== void 0 ? { redact_degraded_to: metadata.redactDegradedTo } : {},
     // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
     // has ever populated either), but every legacy metadata key still rides
     // the bag rather than being silently dropped — CaptureAttributes'
     // `.catchall(z.unknown())` carries the long tail.
     ...metadata?.model !== void 0 ? { model: metadata.model } : {},
-    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
+    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {},
+    ...metadata?.messageId !== void 0 ? { message_id: metadata.messageId } : {},
+    ...metadata?.conversationId !== void 0 ? { conversation_id: metadata.conversationId } : {}
   };
 }
 function captureDefinitionVersion(finding) {
@@ -23833,10 +24056,22 @@ var ManagedSettingKey = external_exports.enum([
   "vaultInlineReveal",
   "modelJudgeConsent",
   "dataSharesInPlace",
-  "redactFallback"
+  "redactFallback",
+  // Pins the toggle and the day count together — see BodyRetention on why the
+  // two are one unit. An administrator mandating a window wants the count
+  // enforced with it, not one a user can widen while the toggle stays on.
+  "bodyRetention"
 ]).meta({ id: "ManagedSettingKey" });
+function isManagedSettingKey(value) {
+  return ManagedSettingKey.safeParse(value).success;
+}
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  // `controlPlane` and `bodyRetention` are the two nested values, and both are
+  // plain, non-strict objects: a key under either that this build does not know
+  // is stripped and nothing reports it. The unknown-value split in
+  // ManagedSettings below classifies top-level names only, so it stops at
+  // these boundaries.
   controlPlane: external_exports.object({
     endpoint: external_exports.string().min(1),
     label: external_exports.string().min(1).optional()
@@ -23847,7 +24082,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
   dataSharesInPlace: external_exports.boolean().optional(),
-  redactFallback: RedactFallback.optional()
+  redactFallback: RedactFallback.optional(),
+  bodyRetention: BodyRetention.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -23855,11 +24091,59 @@ var ManagedSettings = external_exports.object({
   // decision from a bug. Absent renders as a generic "your organization".
   organization: external_exports.string().min(1).optional(),
   // What the administrator pinned.
-  values: ManagedSettingsValues.default({}),
+  //
+  // Parsed as a RECORD rather than as the nested schema, and split below for
+  // the same reason `lockedFields` is parsed as names: a plain `z.object`
+  // drops an unrecognised key and succeeds, so a pin this build does not know
+  // vanished and nothing anywhere said so. A pin with no lock is a supported
+  // shape — it is a DEFAULT the user may still change — so that silence hit
+  // exactly the file an administrator is most likely to write while a fleet
+  // is mid-upgrade.
+  //
+  // Splitting here rather than calling `.strict()`: strict would REFUSE the
+  // file, which is the outcome the lock half already rejected — an older
+  // build then runs entirely unmanaged, every pin and lock gone. A bad KNOWN
+  // value still fails, because the nested schema is re-run over the known
+  // subset and its issues are re-raised on this parse.
+  values: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
-  lockedFields: external_exports.array(ManagedSettingKey).default([])
+  //
+  // Parsed as NAMES rather than as the enum, and split below: a name this
+  // build does not know is dropped from the locked set and reported, never a
+  // reason to refuse the file. The same shape reaches an older build whenever
+  // an administrator locks a key a newer build added, and refusing it there
+  // ran that build entirely unmanaged — every pin and lock gone — on exactly
+  // the fleets most likely to carry a version skew. A name outside the enum
+  // is still never HONOURED: the lockable set stays explicit above.
+  lockedFields: external_exports.array(external_exports.string()).default([])
+}).transform(({ lockedFields, values, ...rest }, ctx) => {
+  const known = [];
+  const unknown2 = [];
+  for (const name of lockedFields) {
+    if (isManagedSettingKey(name)) known.push(name);
+    else unknown2.push(name);
+  }
+  const knownValues = /* @__PURE__ */ Object.create(null);
+  const unknownValues = [];
+  for (const [name, value] of Object.entries(values)) {
+    if (Object.hasOwn(ManagedSettingsValues.shape, name)) knownValues[name] = value;
+    else unknownValues.push(name);
+  }
+  const pinned = ManagedSettingsValues.safeParse(knownValues);
+  if (!pinned.success) {
+    for (const issue2 of pinned.error.issues)
+      ctx.addIssue({ ...issue2, path: ["values", ...issue2.path] });
+    return external_exports.NEVER;
+  }
+  return {
+    ...rest,
+    values: pinned.data,
+    lockedFields: known,
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {},
+    ...unknownValues.length > 0 ? { unknownValueFields: unknownValues } : {}
+  };
 }).meta({ id: "ManagedSettings" });
 
 // ../../packages/schema/src/zod/project-files.ts
@@ -23983,7 +24267,11 @@ var FindingsTimeseriesPoint = external_exports.object({
   timestamp: external_exports.iso.date(),
   critical: external_exports.number().int().nonnegative(),
   high: external_exports.number().int().nonnegative(),
-  medium: external_exports.number().int().nonnegative()
+  medium: external_exports.number().int().nonnegative(),
+  // Optional and additive, so a producer written against the earlier
+  // three-series contract keeps validating. A consumer plotting it resolves the
+  // absent case itself — the chart point requires a number.
+  low: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
   range: TimeRange,
@@ -24009,6 +24297,10 @@ var ResolvedFeedItem = external_exports.object({
   findingKey: external_exports.string(),
   ruleId: external_exports.string(),
   severity: Severity,
+  // Repository slug, and the file path RELATIVE to it. The pair is what
+  // identifies the file: a bare path matches the same name in every repo.
+  // Optional and additive; empty when the event carried no repo.
+  repo: external_exports.string().optional(),
   path: external_exports.string(),
   // ISO-8601 datetime (matches FindingInstance.detectedAt / the rest of the
   // findings domain). The reader `.toISOString()`s the DB epoch-ms values.
@@ -24114,7 +24406,23 @@ var SaveSettingsInput = external_exports.object({
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
-  vaultInlineReveal: external_exports.string()
+  vaultInlineReveal: external_exports.string(),
+  // Widened to `string` like its neighbours rather than typed as
+  // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
+  // the call site, so the domain check receives the type it was written for.
+  //
+  // NOT because a narrower schema would reject differently. `parseActionInput`
+  // is a `safeParse` wrapper and throws for no field schema, so either spelling
+  // reaches a recoverable `{ ok: false }` and there is no rejected promise to
+  // trade against. The real cost runs the other way and is the part worth
+  // knowing: a value this schema admits and the domain enum then rejects lands
+  // on the action's shared refusal, which names NO field, where a shape
+  // rejection reaches `malformedInput` and names the schema key.
+  redactFallback: external_exports.string(),
+  // Shape only, the way the enum fields above are strings only: the RANGE is
+  // `BodyRetention`'s and the action checks it there, so there is one place
+  // that decides what a legal horizon is rather than two that can drift.
+  bodyRetention: external_exports.object({ enabled: external_exports.boolean(), retainDays: external_exports.number() })
 });
 var AttachInput = external_exports.object({
   endpoint: external_exports.string(),
@@ -24286,6 +24594,52 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../../packages/schema/src/zod/web-capture.ts
+var WebUsageSource = external_exports.enum(["site", "estimated", "none"]);
+var WebUsage = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().optional(),
+  outputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheReadInputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheCreationInputTokens: external_exports.number().int().nonnegative().optional()
+});
+var WebToolCall = external_exports.object({
+  toolUseId: external_exports.string().min(1),
+  toolName: external_exports.string().min(1),
+  target: external_exports.string().optional(),
+  isError: external_exports.boolean().optional(),
+  inputSize: external_exports.number().int().nonnegative().optional(),
+  outputSize: external_exports.number().int().nonnegative().optional()
+});
+var WebExchange = external_exports.object({
+  messageId: external_exports.string().min(1),
+  startedAt: external_exports.iso.datetime(),
+  model: external_exports.string().optional(),
+  usage: WebUsage.optional(),
+  usageSource: WebUsageSource,
+  stopReason: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  toolCalls: external_exports.array(WebToolCall).default([]),
+  // Absent when the adapter recovered no text. Capped by the caller at
+  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
+  // short capture is never mistaken for a short reply.
+  responseText: external_exports.string().optional(),
+  truncated: external_exports.boolean().default(false)
+});
+var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
+var WebCaptureStatus = external_exports.object({
+  patched: external_exports.boolean(),
+  live: external_exports.boolean(),
+  blind: external_exports.boolean(),
+  sendsSeenDom: external_exports.number().int().nonnegative(),
+  exchangesSeenNet: external_exports.number().int().nonnegative(),
+  parseFailures: external_exports.number().int().nonnegative(),
+  unparsedBodies: external_exports.number().int().nonnegative(),
+  // The adapter-declared JSON key paths that were absent from a real payload —
+  // the earliest signal that a site's contract moved.
+  shapeMisses: external_exports.array(external_exports.string()).default([])
+});
+
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -24646,6 +25000,22 @@ function discardStore(file2, backup) {
   }
 }
 
+// ../../packages/persistence/src/internal/sql-functions.ts
+var utf8 = new TextDecoder();
+function akaLower(value) {
+  if (value === null) return null;
+  if (typeof value === "string") return value.toLowerCase();
+  if (typeof value === "number" || typeof value === "bigint") return String(value).toLowerCase();
+  return utf8.decode(value).toLowerCase();
+}
+function registerSqlFunctions(db) {
+  db.function(
+    "aka_lower",
+    { deterministic: true, directOnly: true, useBigIntArguments: true },
+    akaLower
+  );
+}
+
 // ../../packages/persistence/src/internal/sql-text.ts
 function escapeLikePattern(s) {
   return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -24730,6 +25100,11 @@ function schemaObjectExists(db, kind, name) {
 function indexExists(db, name) {
   return schemaObjectExists(db, "index", name);
 }
+function indexColumns(db, name) {
+  if (!indexExists(db, name)) return [];
+  const columns = db.prepare(`PRAGMA index_info(${name})`).all();
+  return columns.map((c) => c.name).filter((c) => c !== null);
+}
 function columnNames(db, table, opts) {
   const pragma = opts?.includeGenerated ? "table_xinfo" : "table_info";
   const columns = db.prepare(`PRAGMA ${pragma}(${table})`).all();
@@ -24791,6 +25166,647 @@ function mapRowsTolerant(rows, map2) {
   return out;
 }
 
+// ../../packages/persistence/src/internal/outbox-lane.ts
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var OUTBOX_CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+
+// ../../packages/persistence/src/sync-failure.ts
+var SYNC_FAILURE_REASONS = SyncFailureReason.options;
+function syncFailureRejectCondition(column = "sync_failure") {
+  const members2 = SYNC_FAILURE_REASONS.map((r) => `'${r}'`).join(", ");
+  return `NEW.${column} IS NOT NULL AND NEW.${column} NOT IN (${members2})`;
+}
+
+// ../../packages/persistence/src/repositories/history-sync.ts
+var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
+var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_TYPE_LIST;
+var COUNTED_EVENT_TYPES = [
+  ...STRUCTURAL_EVENT_TYPES,
+  ...OUTBOX_CAPTURE_EVENT_TYPES
+];
+var COUNTED_TYPE_LIST = COUNTED_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var PARTITION_BUCKETS = `
+         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
+         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NOT NULL THEN 1 ELSE 0 END) AS inProgress,
+         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS synced,
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND sync_failure = 'deployment_refused' THEN 1 ELSE 0 END) AS refused,
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND sync_failure = 'detached_undelivered' THEN 1 ELSE 0 END) AS detached,
+         -- Spelled as what it INCLUDES rather than what it excludes, so a reason
+         -- added later lands in no bucket and fails the sum assertion, instead
+         -- of silently joining this one.
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND (sync_failure IS NULL OR sync_failure = 'payload_invalid')
+                  THEN 1 ELSE 0 END) AS failed,
+         COUNT(*) AS total`;
+var COUNTED_SCOPE = `
+       WHERE event_type IN (${COUNTED_TYPE_LIST})
+         AND (
+           event_type IN (${TYPE_LIST})
+           OR synced_at IS NOT NULL
+           OR outbox_owed = 1
+         )`;
+var SKIPPED = -1;
+var ROW_COLUMNS = `id,
+   parent_id AS parentId,
+   root_session_id AS rootSessionId,
+   event_type AS eventType,
+   host_id AS hostId,
+   harness_id AS harnessId,
+   source_project_id AS sourceProjectId,
+   started_at AS startedAt,
+   ended_at AS endedAt,
+   severity,
+   priority,
+   content,
+   content_hash AS contentHash,
+   attributes`;
+var SqliteHistorySyncRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.ensureRowStmt = db.prepare(`INSERT OR IGNORE INTO history_sync (id) VALUES (1)`);
+    this.sessionsStmt = db.prepare(
+      `SELECT COALESCE(root_session_id, id) AS sessionId, MIN(started_at) AS earliest
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at < :before
+        GROUP BY sessionId
+        ORDER BY earliest
+        LIMIT :limit`
+    );
+    this.rowsStmt = db.prepare(
+      `SELECT ${ROW_COLUMNS}
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at < :before
+          AND COALESCE(root_session_id, id) = :sessionId
+        ORDER BY (event_type = 'session') DESC, started_at
+        LIMIT :limit`
+    );
+    this.captureRowsStmt = db.prepare(
+      `SELECT ${ROW_COLUMNS}
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND sync_claimed_at IS NULL
+          AND outbox_owed = 1
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before
+        ORDER BY started_at
+        LIMIT :limit`
+    );
+    this.markOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
+    );
+    this.markCaptureBacklogOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1
+        WHERE synced_at IS NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before`
+    );
+    this.stampStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = :at,
+              sync_claimed_at = NULL,
+              sync_failed_at = :failedAt,
+              sync_failure = :failure
+        WHERE id = :id`
+    );
+    this.claimRowStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = :at WHERE id = :id AND synced_at IS NULL`
+    );
+    this.releaseRowStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = NULL WHERE id = :id`
+    );
+    this.releaseStaleClaimsStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = NULL
+        WHERE sync_claimed_at IS NOT NULL AND sync_claimed_at < :staleBefore`
+    );
+    this.partitionStmt = db.prepare(`SELECT${PARTITION_BUCKETS}
+       FROM audit_events${COUNTED_SCOPE}`);
+    this.partitionByKindStmt = db.prepare(
+      `SELECT event_type AS kind,${PARTITION_BUCKETS}
+       FROM audit_events INDEXED BY idx_audit_events_sync${COUNTED_SCOPE}
+       GROUP BY event_type`
+    );
+    this.countsStmt = db.prepare(
+      `SELECT
+         SUM(CASE WHEN synced_at IS NULL AND started_at < :before THEN 1 ELSE 0 END) AS pending,
+         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS sent,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND (sync_failure IS NULL OR sync_failure = 'payload_invalid')
+                  THEN 1 ELSE 0 END) AS skipped,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND sync_failure = 'deployment_refused' THEN 1 ELSE 0 END) AS refused,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND sync_failure = 'detached_undelivered' THEN 1 ELSE 0 END) AS detached
+       FROM audit_events
+       WHERE event_type IN (${TYPE_LIST})`
+    );
+    this.captureSkipCountStmt = db.prepare(
+      // EVERY sentinel capture, whatever the reason — deliberately NOT split the
+      // way the structural totals are. The split exists because a refusal is
+      // terminal only against the deployment that gave it, and the structural
+      // re-arm frees it on a change of deployment. The capture lane has no such
+      // escape: re-arming a capture would offer one deployment's undelivered
+      // prompts, with their text, to a deployment that never saw them, which is
+      // exactly what disownCapturesStmt exists to prevent. So on this lane both
+      // reasons mean the same thing — this row will not be sent — and splitting
+      // them would put refused captures in a bucket nothing reads and nothing
+      // frees.
+      `SELECT COUNT(*) AS skipped
+         FROM audit_events
+        WHERE synced_at = ${String(SKIPPED)}
+          AND event_type IN (${CAPTURE_TYPE_LIST})`
+    );
+    this.fingerprintStmt = db.prepare(
+      `SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
+         FROM history_sync WHERE id = 1`
+    );
+    this.setFingerprintStmt = db.prepare(
+      `UPDATE history_sync
+          SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
+        WHERE id = 1`
+    );
+    this.disownCapturesStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = NULL
+        WHERE outbox_owed IS NOT NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :attachedAt`
+    );
+    this.rearmStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = NULL, sync_failed_at = NULL, sync_failure = NULL
+        WHERE (synced_at > 0
+               OR sync_failure IN ('deployment_refused', 'detached_undelivered'))
+          AND event_type IN (${TYPE_LIST})`
+    );
+    this.claimStmt = db.prepare(
+      `UPDATE history_sync
+          SET owner_pid = :pid, owner_host = :host, acquired_at = :now, heartbeat_at = :now
+        WHERE id = 1
+          AND (owner_pid IS NULL
+               OR heartbeat_at IS NULL
+               OR heartbeat_at < :staleBefore
+               OR heartbeat_at > :now)`
+    );
+    this.heartbeatStmt = db.prepare(
+      `UPDATE history_sync SET heartbeat_at = :now WHERE id = 1 AND owner_pid = :pid`
+    );
+    this.releaseStmt = db.prepare(
+      `UPDATE history_sync
+          SET owner_pid = NULL, owner_host = NULL, acquired_at = NULL, heartbeat_at = NULL
+        WHERE id = 1 AND owner_pid = :pid`
+    );
+    this.closeWindowStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = ${String(SKIPPED)},
+              sync_failed_at = :at,
+              sync_failure = 'detached_undelivered'
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at >= :attachedAt`
+    );
+    this.releaseBoundaryStmt = db.prepare(
+      `UPDATE history_sync SET backlog_before = NULL WHERE id = 1`
+    );
+    this.freezeBoundaryStmt = db.prepare(
+      `UPDATE history_sync SET backlog_before = :backlogBefore WHERE id = 1`
+    );
+    this.leaseStmt = db.prepare(
+      `SELECT owner_pid AS ownerPid, owner_host AS ownerHost,
+              acquired_at AS acquiredAt, heartbeat_at AS heartbeatAt
+         FROM history_sync WHERE id = 1`
+    );
+    this.inspectionsStmt = db.prepare(
+      `SELECT d.rule_id AS ruleId,
+              d.name AS ruleName,
+              d.version AS ruleVersion,
+              d.category AS category,
+              d.severity AS severity,
+              f.span_start AS spanStart,
+              f.span_end AS spanEnd,
+              f.masked_match AS maskedMatch,
+              f.action_taken AS actionTaken,
+              f.confidence AS confidence
+         FROM inspection_findings f
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE f.audit_event_id = :auditEventId
+        ORDER BY f.span_start, f.id`
+    );
+  }
+  db;
+  ensureRowStmt;
+  sessionsStmt;
+  rowsStmt;
+  stampStmt;
+  countsStmt;
+  fingerprintStmt;
+  setFingerprintStmt;
+  rearmStmt;
+  claimStmt;
+  heartbeatStmt;
+  releaseStmt;
+  leaseStmt;
+  inspectionsStmt;
+  closeWindowStmt;
+  releaseBoundaryStmt;
+  freezeBoundaryStmt;
+  captureRowsStmt;
+  markOwedStmt;
+  markCaptureBacklogOwedStmt;
+  captureSkipCountStmt;
+  disownCapturesStmt;
+  partitionStmt;
+  partitionByKindStmt;
+  claimRowStmt;
+  releaseRowStmt;
+  releaseStaleClaimsStmt;
+  /**
+   * The masked detections recorded against one tool call.
+   *
+   * These travel with the event because a tool call's target is not
+   * re-inspectable from the event alone — unlike a capture, where the text
+   * itself is re-scannable. What crosses is the masked match and the rule that
+   * produced it, never the value.
+   */
+  inspectionsFor(auditEventId) {
+    return allRows(this.inspectionsStmt, { auditEventId });
+  }
+  /**
+   * Sessions with structural rows still to send, oldest first.
+   *
+   * BOUNDED BY THE BACKLOG BOUNDARY, which is the whole correctness of this
+   * read. Anything recorded after the machine attached is the live forward
+   * path's to deliver; this drain exists for what was recorded before it, and a
+   * row both paths send is at best a duplicate request and at worst — for a
+   * session root — an overwrite of the inventory ids the live path resolved.
+   */
+  pendingSessions(limit, before) {
+    return allRows(this.sessionsStmt, { limit, before }).map(
+      (r) => r.sessionId
+    );
+  }
+  /** One session's undelivered structural rows within the backlog, root first. */
+  pendingRows(sessionId, limit, before) {
+    return allRows(this.rowsStmt, { sessionId, limit, before });
+  }
+  /**
+   * Captures this machine still owes the deployment, oldest first.
+   *
+   * Selected by the `outbox_owed` marker the attached forward path writes, not
+   * by a time window — see captureRowsStmt for why a window could not express
+   * this. `before` is the grace window that leaves a just-recorded capture to
+   * the live path.
+   */
+  pendingCaptureRows(limit, before) {
+    return allRows(this.captureRowsStmt, { limit, before });
+  }
+  /**
+   * Record that a capture is OWED to the deployment.
+   *
+   * Written by the attached forward path when a live send did not confirm
+   * delivery, and read by the drain as the whole of its eligibility test. It is
+   * a fact rather than an inference: the machine was attached, the send did not
+   * land, so the row is owed — which no time window can state, because the same
+   * window that holds the rows a past attachment left owed also holds every
+   * capture recorded while the machine was DETACHED, and those were never
+   * offered to anyone.
+   *
+   * Idempotent, and never un-set: `markSynced` settling the row is what takes it
+   * out of the drain's read.
+   */
+  markCaptureOwed(id) {
+    this.markOwedStmt.run({ id });
+  }
+  /**
+   * Mark every capture already on disk as owed, as of `before`.
+   *
+   * The consent-time backfill, called once from `aka attach` when a human
+   * grants existing-history consent — never from an ongoing drain pass, and
+   * never inferred from a boundary that could later move. `before` is the
+   * caller's own "now" at the moment consent was granted, so what this marks
+   * is exactly the backlog the consent prompt already counted, not whatever a
+   * later re-attach or key rotation might widen it to.
+   *
+   * Returns how many rows matched, for the caller to log or test against. Not a
+   * count of NEWLY marked rows — a row still unsynced from an earlier call
+   * matches again and is counted again, the same as `UPDATE`'s own `changes`.
+   */
+  markCaptureBacklogOwed(before) {
+    return Number(this.markCaptureBacklogOwedStmt.run({ before }).changes);
+  }
+  /**
+   * Record delivery. Called only AFTER the far side has accepted the rows.
+   *
+   * CLEARS any failure reason in the same statement. A row that failed against
+   * one deployment and then landed is delivered, and leaving the reason behind
+   * would leave the store holding two contradictory answers about one row —
+   * with the surface free to render either.
+   */
+  markSynced(ids, atMs) {
+    this.stampAll(ids, atMs, null);
+  }
+  /**
+   * Record that THIS MACHINE cannot express the row on the wire.
+   *
+   * Reserved for a local defect — a row that cannot be rebuilt into a valid
+   * payload, or a body the client itself refused to send. It fails identically
+   * against every deployment, so it is terminal everywhere and the re-arm leaves
+   * it alone. A row that merely failed to REACH the deployment stays NULL, so it
+   * is retried; marking those would turn one outage into permanent data loss.
+   */
+  markSkipped(ids, atMs) {
+    this.stampAll(ids, SKIPPED, "payload_invalid", atMs);
+  }
+  /**
+   * Record that THIS DEPLOYMENT refused the row.
+   *
+   * The same sentinel as `markSkipped`, and deliberately so: both stop the row
+   * being re-offered on this lane, and `synced_at` goes on answering whether a
+   * row is outstanding rather than why. What separates them is the reason, and
+   * what the reason buys is the re-arm — a refusal is one deployment's verdict
+   * on one body, so it is terminal only for as long as this machine points at
+   * that deployment, and `rearmFor` clears it when the deployment changes.
+   *
+   * Leaving such a row NULL instead would be worse than the loss it replaces:
+   * these reads carry no cursor, so an unstamped row the deployment refuses is
+   * the head of every subsequent page, and the lane stalls behind it for ever.
+   */
+  markRefused(ids, atMs) {
+    this.stampAll(ids, SKIPPED, "deployment_refused", atMs);
+  }
+  eachInTransaction(ids, run) {
+    if (ids.length === 0) return;
+    withTransaction(
+      this.db,
+      () => {
+        for (const id of ids) run(id);
+      },
+      "IMMEDIATE"
+    );
+  }
+  stampAll(ids, value, failure, failedAtMs) {
+    if (ids.length === 0) return;
+    const failedAt = failure === null ? null : failedAtMs ?? null;
+    withTransaction(
+      this.db,
+      () => {
+        for (const id of ids) this.stampStmt.run({ at: value, failedAt, failure, id });
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * Claim rows as in-flight.
+   *
+   * Advisory in exactly the sense the lease is: it records that a send is in
+   * progress so a surface can say so, and a lost claim costs a row showing as
+   * queued while it is actually being sent. It is not exclusion — the far side
+   * settles a duplicate on the row id.
+   */
+  claimRows(ids, atMs) {
+    this.eachInTransaction(ids, (id) => this.claimRowStmt.run({ at: atMs, id }));
+  }
+  /** Give back a claim without settling — the send failed, the row is queued again. */
+  releaseRows(ids) {
+    this.eachInTransaction(ids, (id) => this.releaseRowStmt.run({ id }));
+  }
+  /**
+   * Clear claims older than `staleBefore`, and report how many were cleared.
+   *
+   * A process killed between claiming and settling leaves rows claimed with
+   * nothing left to settle them. Without this they read as "sending" for ever.
+   */
+  releaseStaleClaims(staleBefore) {
+    return Number(this.releaseStaleClaimsStmt.run({ staleBefore }).changes);
+  }
+  /**
+   * Every tracked row in exactly one delivery state.
+   *
+   * Takes no boundary on purpose. The boundary answers "what should the drain
+   * pick up now", which is a different question from "what state is this row
+   * in" — and a machine that has never attached has no boundary to pass, so
+   * requiring one would force a caller to invent one and report the whole store
+   * as queued.
+   */
+  /**
+   * The same partition, one row per kind that a lane carries.
+   *
+   * A kind with nothing to report is ABSENT rather than a row of zeros: the
+   * scope decides which rows exist at all, so a kind that has never been
+   * recorded — or whose captures nobody ever owed — produces no group. A caller
+   * rendering a fixed list of kinds must therefore treat a missing one as "no
+   * rows", never as "zero sent"; the two look identical in a bar and mean
+   * different things.
+   */
+  partitionByKind() {
+    return allRows(
+      this.partitionByKindStmt,
+      {}
+    ).map((row) => ({
+      kind: row.kind,
+      queued: row.queued ?? 0,
+      inProgress: row.inProgress ?? 0,
+      synced: row.synced ?? 0,
+      failed: row.failed ?? 0,
+      refused: row.refused ?? 0,
+      detached: row.detached ?? 0,
+      total: row.total ?? 0
+    }));
+  }
+  partition() {
+    const row = getRow(this.partitionStmt, {});
+    return {
+      queued: row?.queued ?? 0,
+      inProgress: row?.inProgress ?? 0,
+      synced: row?.synced ?? 0,
+      failed: row?.failed ?? 0,
+      refused: row?.refused ?? 0,
+      detached: row?.detached ?? 0,
+      total: row?.total ?? 0
+    };
+  }
+  /** `pending` counts only what is inside the backlog; sent and skipped are totals. */
+  counts(before) {
+    const row = getRow(this.countsStmt, { before });
+    const captures = getRow(this.captureSkipCountStmt);
+    return {
+      pending: row?.pending ?? 0,
+      sent: row?.sent ?? 0,
+      skipped: row?.skipped ?? 0,
+      refused: row?.refused ?? 0,
+      detached: row?.detached ?? 0,
+      capturesSkipped: captures?.skipped ?? 0
+    };
+  }
+  /**
+   * The deployment the current stamps were made against, and where its backlog
+   * ends.
+   *
+   * READ-ONLY. An absent row reads as an absent deployment, which is what a
+   * machine that has never drained is — and every writer below seeds the row
+   * before it needs one, so nothing depends on this creating it. Keeping the
+   * write off the gate path matters because the gate runs on every pass while a
+   * write has to take the database's write lock.
+   */
+  deployment() {
+    const row = getRow(
+      this.fingerprintStmt
+    );
+    return {
+      fingerprint: row?.fingerprint ?? void 0,
+      backlogBefore: row?.backlogBefore ?? void 0
+    };
+  }
+  /**
+   * Point the ledger at a different deployment, discarding what it recorded
+   * about the previous one.
+   *
+   * Delivery is a fact about ONE recipient: rows sent to the deployment a
+   * machine has just left are undelivered as far as the new one is concerned.
+   * All four in one transaction, so a crash between them cannot leave stamps
+   * attributed to the wrong deployment, a boundary that belongs to another, or
+   * a disown with no re-mark to follow it.
+   *
+   * The boundary is written HERE and only here, which is what freezes it: a
+   * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
+   * unchanged, so this never runs and the backlog does not widen back over rows
+   * the live path has since delivered.
+   *
+   * `backfillCapturesBefore` is the caller's OWN "now" at the instant a human
+   * granted existing-history consent for the deployment this call is arming —
+   * a DIFFERENT instant from `backlogBefore`: the re-mark boundary is the GRANT
+   * instant, `backlogBefore` is the ATTACH instant, and the two can be far
+   * apart. Passed only when that grant is valid, since this method has no way
+   * to check consent itself and must not mark a row owed for a machine that
+   * never agreed to it. Applied AFTER the disown above, in the SAME
+   * transaction: what the disown clears is every marker below `backlogBefore`,
+   * which includes this deployment's OWN pre-attach rows — `aka attach` calls
+   * `seedCaptureBacklogOwed` at the attach instant, so every row it marks sits
+   * on the cleared side of that bound — and the re-mark in the same
+   * transaction is what puts those rows back. A crash between the two cannot
+   * strand the ledger disowned with nothing re-marked — the transaction either
+   * lands whole or not at all, and a fingerprint mismatch that has not yet
+   * committed re-enters this method on the very next pass. Omit it (the
+   * structural-only tests do) to exercise the disown in isolation.
+   *
+   * The disown is bounded by `backlogBefore`, which is what keeps it from
+   * touching a marker the NEW deployment's OWN live path has already set: B's
+   * live path can mark a capture owed from the moment `aka attach` writes the
+   * descriptor, before the drain's first pass ever reaches this method, and
+   * such a row sits at or after the bound rather than below it. What keeps the
+   * disown from eating THIS SAME CALL's own re-mark is the order, not the
+   * bound — disown runs first, re-mark second, both inside the one
+   * transaction above.
+   */
+  rearmFor(fingerprint, backlogBefore, backfillCapturesBefore) {
+    this.ensureRowStmt.run();
+    withTransaction(
+      this.db,
+      () => {
+        const previous = getRow(this.fingerprintStmt)?.fingerprint;
+        this.rearmStmt.run();
+        if (previous !== null && previous !== void 0 && previous !== fingerprint) {
+          this.disownCapturesStmt.run({ attachedAt: backlogBefore });
+        }
+        if (backfillCapturesBefore !== void 0) {
+          this.markCaptureBacklogOwedStmt.run({ before: backfillCapturesBefore });
+        }
+        this.setFingerprintStmt.run({ fingerprint, backlogBefore });
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * End the attached period: hand its rows to the live path, and release the
+   * boundary so the next attachment can freeze a new one.
+   *
+   * WITHOUT THIS, a detach and a re-attach to the same deployment leave a window
+   * nothing delivers. The fingerprint is unchanged, so the boundary is never
+   * re-frozen and stays at the FIRST attachment — while nothing forwards at all
+   * during the detached period, because the machine is not attached. Rows
+   * recorded in that window sit after the boundary and before the re-attach, so
+   * neither path takes them, and the pending count reports none outstanding.
+   *
+   * WHAT IT RECORDS, and what it deliberately does not. These rows were the
+   * closing attachment's to deliver and are no longer outstanding — that is what
+   * lets the boundary move. It is NOT a claim that any of them arrived, and the
+   * distinction is not academic: this used to write a delivery TIME, which every
+   * read treats as delivery, so one detach turned a window of undelivered rows
+   * into a window of delivered ones and no surface could tell. It writes the
+   * skip sentinel and a reason of its own instead, so "no longer owed" and
+   * "received" stop being the same fact.
+   *
+   * A change of deployment still frees them (see the re-arm), because the next
+   * deployment has seen none of this machine's history — so the rows reach it
+   * exactly as they did when this wrote a delivery time.
+   *
+   * ONE TRANSACTION, so a crash cannot release the boundary while leaving the
+   * window unstamped — that half-state would re-send the whole attached period
+   * on the next attach, which is the failure the boundary exists to prevent.
+   */
+  closeAttachedWindow(attachedAtMs, atMs) {
+    this.ensureRowStmt.run();
+    withTransaction(
+      this.db,
+      () => {
+        const row = getRow(this.fingerprintStmt);
+        const from = row?.backlogBefore ?? attachedAtMs;
+        this.closeWindowStmt.run({ at: atMs, attachedAt: from });
+        this.releaseBoundaryStmt.run();
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * Freeze a boundary for the deployment already on file, KEEPING the stamps.
+   *
+   * The re-attach half of the above. Distinct from `rearmFor`, which is for a
+   * different deployment and therefore discards what was delivered to the old
+   * one: here the recipient is the same, so everything already sent to it stays
+   * sent.
+   */
+  freezeBoundary(backlogBefore) {
+    this.ensureRowStmt.run();
+    this.freezeBoundaryStmt.run({ backlogBefore });
+  }
+  /** Take the claim, or report that someone live already holds it. */
+  claim(pid, host, nowMs, staleAfterMs) {
+    this.ensureRowStmt.run();
+    let taken = false;
+    withTransaction(
+      this.db,
+      () => {
+        const result = this.claimStmt.run({
+          pid,
+          host,
+          now: nowMs,
+          staleBefore: nowMs - staleAfterMs
+        });
+        taken = result.changes === 1;
+      },
+      "IMMEDIATE"
+    );
+    return taken;
+  }
+  /** Say the holder is still alive. A no-op once the claim has moved on. */
+  heartbeat(pid, nowMs) {
+    this.heartbeatStmt.run({ now: nowMs, pid });
+  }
+  /** Give the claim up. Scoped to this holder, so a taken-over claim is left be. */
+  release(pid) {
+    this.releaseStmt.run({ pid });
+  }
+  /** Who holds the claim, if anyone. Read-only, for the same reason as above. */
+  lease() {
+    return getRow(this.leaseStmt);
+  }
+};
+
 // ../../packages/persistence/src/migrations.ts
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
@@ -24803,7 +25819,7 @@ function createdIndexName(statement) {
   return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
 }
 var LEGACY_DROP_MIGRATION_TAG = "0014_drop_legacy_events_findings";
-function applyMigrations(db, file2) {
+function applyMigrations(db, file2, options = {}) {
   const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
   db.exec(
     "CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)"
@@ -24817,6 +25833,7 @@ function applyMigrations(db, file2) {
   );
   for (const [index, migration] of SQLITE_MIGRATIONS.entries()) {
     if (applied.has(migration.tag)) continue;
+    if (options.skipTags?.has(migration.tag) === true) continue;
     if (migration.tag === LEGACY_DROP_MIGRATION_TAG) continue;
     const evidence = evidenceObjects(migration.sql);
     const present = evidence.filter((o) => evidenceExists(db, o));
@@ -25223,10 +26240,62 @@ function ensureSyncedAtColumn(db, table) {
   if (!columns.includes("outbox_owed")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN outbox_owed integer`);
   }
+  if (!columns.includes("sync_failed_at")) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN sync_failed_at integer`);
+  }
+  if (!columns.includes("sync_failure")) {
+    withTransaction(
+      db,
+      () => {
+        db.exec(`ALTER TABLE ${table} ADD COLUMN sync_failure text`);
+        db.exec(
+          `UPDATE ${table} SET synced_at = NULL
+            WHERE synced_at = -1
+              AND event_type IN (${COUNTED_EVENT_TYPES.map((t) => `'${t}'`).join(", ")})`
+        );
+      },
+      "IMMEDIATE"
+    );
+  }
   db.exec(
-    `CREATE INDEX IF NOT EXISTS idx_audit_events_sync
-       ON audit_events (event_type, synced_at, sync_claimed_at, started_at)`
+    `CREATE TRIGGER IF NOT EXISTS aka_sync_failure_guard
+       BEFORE UPDATE OF sync_failure ON ${table}
+       WHEN ${syncFailureRejectCondition()}
+       BEGIN SELECT RAISE(ABORT, 'sync_failure is not one of the recorded reasons'); END`
   );
+  const syncIndexColumns = [
+    "event_type",
+    "synced_at",
+    "sync_claimed_at",
+    "started_at",
+    // Appended LAST on purpose. The delivery-state read now projects it, so it
+    // has to be in the index for the read to stay covered — but putting it
+    // ahead of `started_at` would reorder the prefix the structural drain's
+    // reads match on.
+    "sync_failure"
+    // `outbox_owed` is DELIBERATELY ABSENT, and it was measured both ways.
+    //
+    // The delivery-state read tests it — a capture's state depends on whether a
+    // live forward marked it owed — so carrying it here makes that read covering
+    // rather than a row fetch per row: 16 ms against 40 ms on a real 6 GB store.
+    // But a sixth column changes what the planner charges for this index, and
+    // with no ANALYZE statistics it plans from schema shape alone: measured, it
+    // then stops choosing the per-session index for the token rollup and walks
+    // every `llm_call` in the store through the event-type index instead. That
+    // read grows with the store; this one does not.
+    //
+    // 40 ms on the largest store measured, once per render, is a cost worth
+    // paying to leave every other read's plan where it was.
+  ];
+  const currentSyncIndex = indexColumns(db, "idx_audit_events_sync");
+  const syncIndexMatches = currentSyncIndex.length === syncIndexColumns.length && currentSyncIndex.every((column, i) => column === syncIndexColumns[i]);
+  if (!syncIndexMatches) {
+    db.exec("DROP INDEX IF EXISTS idx_audit_events_sync");
+    db.exec(
+      `CREATE INDEX idx_audit_events_sync
+         ON audit_events (${syncIndexColumns.join(", ")})`
+    );
+  }
   db.exec(
     `CREATE INDEX IF NOT EXISTS idx_audit_outbox_owed
        ON audit_events (event_type, synced_at, sync_claimed_at, started_at) WHERE outbox_owed = 1`
@@ -25448,7 +26517,11 @@ function buildAuditEvent(row) {
     link: linkParsed?.success ? linkParsed.data : null,
     targetId: row.target_id,
     internal: intToBool(row.internal),
-    flagged: intToBool(row.flagged)
+    flagged: intToBool(row.flagged),
+    // Only meaningful when the title came out empty — a row whose body was
+    // expired but whose title fell back to `tool_name` still has something to
+    // render, and flagging it would make the view apologise for nothing.
+    bodyExpired: row.content_expired_at !== null && (row.title ?? "") === ""
   };
 }
 var TIMELINE_COLUMNS = `
@@ -25456,6 +26529,7 @@ var TIMELINE_COLUMNS = `
   event_type,
   started_at,
   coalesce(content, json_extract(attributes, '$.tool_name')) AS title,
+  content_expired_at,
   coalesce(json_extract(attributes, '$.detail'), json_extract(attributes, '$.target')) AS detail,
   coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
   json_extract(attributes, '$.severity') AS severity,
@@ -25582,7 +26656,8 @@ var SqliteActivityRepository = class {
             SELECT 1 FROM audit_events d
             WHERE d.root_session_id = audit_events.id
               AND (d.content LIKE ? ESCAPE '\\'
-                   OR json_extract(d.attributes, '$.detail') LIKE ? ESCAPE '\\')))`
+                   OR coalesce(json_extract(d.attributes, '$.detail'),
+                               json_extract(d.attributes, '$.target')) LIKE ? ESCAPE '\\')))`
       );
       params.push(pattern, pattern, pattern, pattern, pattern, pattern);
     }
@@ -26120,6 +27195,88 @@ var SqliteAuditEventsRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/body-retention.ts
+var DEFAULT_BATCH_SIZE = 500;
+var DEFAULT_MAX_ROWS = 5e4;
+var SYNC_LANE_TYPES_SQL = OUTBOX_CAPTURE_TYPE_LIST;
+var SqliteBodyRetentionRepository = class {
+  constructor(db) {
+    this.db = db;
+    const select = (laneClause) => `
+      SELECT id, LENGTH(CAST(content AS BLOB)) AS bytes
+        FROM audit_events
+       WHERE content IS NOT NULL
+         AND started_at < :cutoff
+         AND event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         ${laneClause}
+       ORDER BY started_at
+       LIMIT :limit`;
+    this.candidatesStmt = this.db.prepare(select(""));
+    this.candidatesSyncSafeStmt = this.db.prepare(
+      select(`AND (event_type NOT IN (${SYNC_LANE_TYPES_SQL}) OR synced_at IS NOT NULL)`)
+    );
+    this.heldBySyncStmt = this.db.prepare(`
+      SELECT COUNT(*) AS n
+        FROM audit_events
+       WHERE content IS NOT NULL
+         AND started_at < :cutoff
+         AND event_type IN (${SYNC_LANE_TYPES_SQL})
+         AND synced_at IS NULL`);
+    this.expireStmt = this.db.prepare(
+      `UPDATE audit_events SET content = NULL, content_expired_at = :now WHERE id = :id`
+    );
+  }
+  db;
+  candidatesStmt;
+  candidatesSyncSafeStmt;
+  heldBySyncStmt;
+  expireStmt;
+  /** How many bytes a pass with these options would free, changing nothing. */
+  preview(opts) {
+    const limit = opts.maxRows ?? DEFAULT_MAX_ROWS;
+    const stmt = opts.sweepSyncLane ? this.candidatesStmt : this.candidatesSyncSafeStmt;
+    const rows = stmt.all({ cutoff: opts.cutoff, limit });
+    return {
+      rowsExpired: rows.length,
+      bytesFreed: rows.reduce((sum, r) => sum + r.bytes, 0),
+      rowsHeldBySync: this.countHeldBySync(opts)
+    };
+  }
+  /** Clear eligible bodies, in bounded batches. */
+  expire(opts) {
+    const batchSize = opts.batchSize ?? DEFAULT_BATCH_SIZE;
+    const maxRows = opts.maxRows ?? DEFAULT_MAX_ROWS;
+    const stmt = opts.sweepSyncLane ? this.candidatesStmt : this.candidatesSyncSafeStmt;
+    let rowsExpired = 0;
+    let bytesFreed = 0;
+    let done = true;
+    while (rowsExpired < maxRows) {
+      const remaining = Math.min(batchSize, maxRows - rowsExpired);
+      const batch = stmt.all({ cutoff: opts.cutoff, limit: remaining });
+      if (batch.length === 0) break;
+      withTransaction(
+        this.db,
+        () => {
+          for (const row of batch) this.expireStmt.run({ id: row.id, now: opts.now });
+        },
+        "IMMEDIATE"
+      );
+      rowsExpired += batch.length;
+      bytesFreed += batch.reduce((sum, r) => sum + r.bytes, 0);
+      if (batch.length < remaining) break;
+      if (rowsExpired >= maxRows) {
+        done = stmt.all({ cutoff: opts.cutoff, limit: 1 }).length === 0;
+      }
+    }
+    return { rowsExpired, bytesFreed, rowsHeldBySync: this.countHeldBySync(opts), done };
+  }
+  countHeldBySync(opts) {
+    if (opts.sweepSyncLane) return 0;
+    const row = this.heldBySyncStmt.get({ cutoff: opts.cutoff });
+    return row.n;
+  }
+};
+
 // ../../packages/persistence/src/repositories/classified-data.ts
 var SqliteClassifiedDataRepository = class {
   constructor(db) {
@@ -26920,23 +28077,6 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../../packages/persistence/src/repositories/findings.ts
-var PREVIEW_INSTANCES_PER_GROUP = 200;
-var DEFAULT_LOCATIONS_LIMIT = 100;
-var LOCATION_RULE_IDS_CAP = 20;
-function compareLocationOrder(a, b) {
-  return compareFindingGroupOrder(
-    {
-      severity: a.maxSeverity,
-      latestDetectedAt: a.latestDetectedAt,
-      id: ""
-    },
-    {
-      severity: b.maxSeverity,
-      latestDetectedAt: b.latestDetectedAt,
-      id: ""
-    }
-  );
-}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -26965,7 +28105,15 @@ function toFlatFindingRow(r) {
     ...r.tool_name === null ? {} : { toolName: r.tool_name },
     eventId: r.event_id,
     ...r.session_id === null ? {} : { sessionId: r.session_id },
-    status: deriveInstanceStatus(r)
+    status: deriveInstanceStatus(r),
+    delivery: deriveFindingDelivery({
+      kind: r.kind,
+      syncedAt: r.synced_at,
+      syncClaimedAt: r.sync_claimed_at,
+      syncFailedAt: r.sync_failed_at,
+      syncFailure: r.sync_failure,
+      outboxOwed: r.outbox_owed
+    })
   };
 }
 function encodeGroupCursor(group) {
@@ -26988,13 +28136,51 @@ function decodeGroupCursor(cursor) {
   return null;
 }
 function firstAfter(sorted, cursor) {
-  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  const index = sorted.findIndex((t) => compareFindingGroupOrder(t, cursor) > 0);
   return index === -1 ? sorted.length : index;
 }
 function findDeepLinked(sorted, page, id) {
-  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
-  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+  if (page.some((t) => t.id === id)) return void 0;
+  return sorted.find((t) => t.id === id);
+}
+function encodeLocationCursor(location) {
+  const payload = {
+    sev: location.maxSeverity,
+    t: location.latestDetectedAt,
+    r: location.repo,
+    f: location.file
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeLocationCursor(cursor) {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.r === "string" && typeof parsed2.f === "string") {
+    return { maxSeverity: parsed2.sev, latestDetectedAt: parsed2.t, repo: parsed2.r, file: parsed2.f };
+  }
+  return null;
+}
+function firstLocationAfter(sorted, cursor) {
+  const index = sorted.findIndex((l) => compareLocationOrder(l, cursor) > 0);
+  return index === -1 ? sorted.length : index;
 }
+function findDeepLinkedLocation(sorted, page, id) {
+  if (page.some((l) => l.id === id)) return void 0;
+  return sorted.find((l) => l.id === id);
+}
+var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              e.source_tool AS source_tool,
+              e.repo AS repo,
+              e.file_path AS file,
+              e.tool_name AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status,
+              e.synced_at AS synced_at, e.sync_claimed_at AS sync_claimed_at,
+              e.sync_failed_at AS sync_failed_at, e.sync_failure AS sync_failure,
+              e.outbox_owed AS outbox_owed`;
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -27115,30 +28301,26 @@ var SqliteFindingsRepository = class {
     );
   }
   /**
-   * Grouped findings for the dashboard — joins inspection_findings⋈audit_events
-   * ⋈inspection_definitions (repo/file/toolName from the audit event's
-   * attributes bag, rule_id/category/severity from the definition), scoped to
-   * the four capture kinds (audit_events also holds structural/reconciler/scan
-   * rows this list must never surface), groups by ruleId, computes
-   * per-filter-excluded facets, applies the requested filters, and sorts by
-   * severity then recency. Filtering
-   * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
-   * reflect the full filtered set; `items` is the requested
-   * page (default 50); no cursor (nextCursor is always null). Under a `status`
-   * filter, `totals.findings` counts only instances whose derived status was
-   * requested, and each item's instance preview is narrowed the same way.
+   * Finding TYPES for the dashboard — one row per rule, scoped to the four
+   * capture kinds (audit_events also holds structural/reconciler/scan rows this
+   * list must never surface), with per-filter-excluded facets, the requested
+   * filters applied, and sorted by severity then recency. Filtering and faceting
+   * run in JS via the shared @akasecurity/schema helpers. `totals` reflect the
+   * full filtered set; `items` is the requested page (default 50), keyset-paged.
+   * Under a `status` filter, `totals.findings` counts only findings whose
+   * derived status was requested.
+   *
+   * ONE read, which materializes no findings: a single aggregate per rule_id,
+   * folding EVERY finding into the numbers a type row and the filters need
+   * (count, severity, category, providers, actions, statuses, latest, search
+   * text). The findings OF a type come from listFindingInstances scoped to
+   * `subtype`, so neither list bounds the other and no per-type cap exists.
    *
-   * Two reads, neither of which materializes a row per finding:
-   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
-   *      the group and the filters need (count, providers, actions, statuses,
-   *      latest, search text);
-   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
-   *      populate `instances` for the table's expanded rows.
    * The aggregates carry raw DB values and are translated by the same
-   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
-   * rule is ever restated in SQL.
+   * @akasecurity/schema mappers every other path uses, so no enum mapping or
+   * status rule is ever restated in SQL.
    */
-  listGroupedFindings(query) {
+  listFindingTypes(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
     const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
     const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
@@ -27151,12 +28333,7 @@ var SqliteFindingsRepository = class {
       predicate,
       params: sessionParams
     });
-    const rows = this.previewRows(aggregates, {
-      sessionId: query.sessionId,
-      from: query.from
-    });
-    const groupable = rows.map(toFlatFindingRow);
-    const allGroups = buildFindingGroups(groupable, { aggregates });
+    const allTypes = buildFindingTypes(aggregates);
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -27165,30 +28342,25 @@ var SqliteFindingsRepository = class {
       subtype: query.subtype,
       q: query.q
     };
-    const facets = computeFindingFacets(allGroups, filterOpts);
-    const sorted = sortFindingGroups(applyFindingFilters(allGroups, filterOpts));
+    const facets = computeFindingFacets(allTypes, filterOpts);
+    const sorted = sortFindingTypes(applyFindingFilters(allTypes, filterOpts));
     const statusFilter = query.status ?? [];
     const totals = {
-      findings: sorted.reduce((acc, g) => {
-        if (statusFilter.length === 0) return acc + g.instanceCount;
-        const agg = aggregates.get(g.id);
-        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? g.instanceCount : g.instanceCount);
+      findings: sorted.reduce((acc, t) => {
+        if (statusFilter.length === 0) return acc + t.instanceCount;
+        const agg = aggregates.get(t.id);
+        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? t.instanceCount : t.instanceCount);
       }, 0),
-      groups: sorted.length
+      types: sorted.length
     };
-    const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_TYPES_LIMIT;
     const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
     const start = cursor === null ? 0 : firstAfter(sorted, cursor);
     const page = sorted.slice(start, start + limit);
     const lastOnPage = page.at(-1);
     const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
     const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
-    const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const narrow = (g) => statusSet ? {
-      ...g,
-      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-    } : g;
-    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
+    const items = [...page, ...deepLinked ? [deepLinked] : []];
     return Promise.resolve({
       totals,
       facets,
@@ -27199,7 +28371,7 @@ var SqliteFindingsRepository = class {
   }
   /**
    * One row per rule_id, folding EVERY instance of the group into the values
-   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * buildFindingTypes cannot recover from an aggregate. Bounded by the number of
    * distinct rule_ids (the installed packs' rules), not by the store's size.
    *
    * A single scan, folded in two levels: the inner SELECT groups by
@@ -27253,6 +28425,7 @@ var SqliteFindingsRepository = class {
       providers: query.provider,
       actions: query.action,
       statuses: query.status,
+      deliveries: query.deployment,
       tools: query.tool,
       repo: query.repo,
       file: query.file,
@@ -27293,13 +28466,25 @@ var SqliteFindingsRepository = class {
     });
   }
   /**
-   * The same findings folded by location: repository, then file within it.
+   * The same findings folded by WHERE they live — one row per (repo, file) pair.
    *
    * The grouping keys come from the capturing event's attributes, which is what
-   * the local store relates a finding to — there is no finding↔asset row to
-   * group by instead. A repo or file the event did not record folds into the
-   * empty-string bucket, which the view renders but does not link, since no
-   * filter can name it.
+   * the local store relates a finding to; there is no finding↔asset row to group
+   * by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which is a real location like any other: it is listed,
+   * it is selectable, and its `?loc=` token is as good as any other row's.
+   *
+   * ONE flat list rather than repos nesting files. A rollup can only be paged by
+   * repo, which leaves the file list inside it unbounded — the shape the by-type
+   * list was rebuilt to remove — and two-level pagination inside an
+   * expand/collapse table is what pushed that view to master/detail in the first
+   * place.
+   *
+   * Every filter narrows the FINDINGS and the locations fall out of what
+   * survives, so each row's `instanceCount` is exactly what listFindingInstances
+   * reports for the same filters scoped to that pair. The view depends on it:
+   * one toolbar sits over both panels precisely because a location owns none of
+   * its fields.
    */
   listFindingLocations(query) {
     const opts = {
@@ -27308,16 +28493,20 @@ var SqliteFindingsRepository = class {
       providers: query.provider,
       actions: query.action,
       statuses: query.status,
+      deliveries: query.deployment,
       tools: query.tool,
       q: query.q
     };
-    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_LOCATIONS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeLocationCursor(query.cursor);
     const byRepo = /* @__PURE__ */ new Map();
+    const accumulator = createInstanceFacetAccumulator(opts);
     let total = 0;
     for (const row of this.scanFindingRows({
       sessionId: query.sessionId,
       from: query.from
     })) {
+      accumulator.add(row);
       if (!matchesInstanceFilters(row, opts)) continue;
       total += 1;
       let files = byRepo.get(row.repo);
@@ -27332,103 +28521,35 @@ var SqliteFindingsRepository = class {
       }
       addToLocation(acc, row);
     }
-    let fileCount = 0;
-    const repos = [...byRepo.entries()].map(([repo, files]) => {
-      fileCount += files.size;
-      const fileRows = [...files.entries()].map(([file2, acc]) => ({
-        file: file2,
-        instanceCount: acc.instanceCount,
-        maxSeverity: acc.maxSeverity,
-        latestDetectedAt: acc.latestDetectedAt,
-        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
-        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
-      })).sort(compareLocationOrder);
-      const rollup = fileRows.reduce(
-        (a, f) => ({
-          instanceCount: a.instanceCount + f.instanceCount,
-          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
-          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
-        }),
-        {
-          instanceCount: 0,
-          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
-          latestDetectedAt: ""
-        }
-      );
-      const statuses = fileRows.map((f) => f.status);
-      const folded = foldGroupStatus(statuses);
-      return {
-        repo,
-        instanceCount: rollup.instanceCount,
-        maxSeverity: rollup.maxSeverity,
-        latestDetectedAt: rollup.latestDetectedAt,
-        ...folded === void 0 ? {} : { status: folded },
-        files: fileRows
-      };
-    });
-    repos.sort(compareLocationOrder);
+    const sorted = [];
+    for (const [repo, files] of byRepo) {
+      for (const [file2, acc] of files) {
+        const status = foldGroupStatus(acc.statuses);
+        sorted.push({
+          id: encodeLocationId(repo, file2),
+          repo,
+          file: file2,
+          instanceCount: acc.instanceCount,
+          maxSeverity: acc.maxSeverity,
+          latestDetectedAt: acc.latestDetectedAt,
+          ...status === void 0 ? {} : { status },
+          ruleIds: [...acc.ruleIds]
+        });
+      }
+    }
+    sorted.sort(compareLocationOrder);
+    const start = cursor === null ? 0 : firstLocationAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeLocationCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinkedLocation(sorted, page, query.includeId);
     return Promise.resolve({
-      totals: { findings: total, repos: repos.length, files: fileCount },
-      items: repos.slice(0, limit),
-      hasMore: repos.length > limit
+      totals: { findings: total, locations: sorted.length },
+      facets: accumulator.facets(),
+      items: [...page, ...deepLinked ? [deepLinked] : []],
+      nextCursor
     });
   }
-  /**
-   * Each group's newest instances, for the table's expanded rows.
-   *
-   * ONE index-ordered scan with early termination, and the shape is the point.
-   * The natural spelling — `ROW_NUMBER() OVER (PARTITION BY rule_id ORDER BY
-   * started_at DESC)` then `WHERE rn <= cap` — sorts EVERY finding in scope
-   * through a temp B-tree to keep a bounded preview of each group, and then
-   * sorts the survivors again for the page order. Both sorts grow with the
-   * store while the answer does not.
-   *
-   * Instead the scan walks `audit_events` newest-first off `idx_audit_started_at`
-   * (or the session or window index the scope names — see `findingScanSql`),
-   * which is already the order the page wants, and keeps rows per rule until
-   * each rule has as many as it can show. The aggregate the caller already holds
-   * says how many that is: `min(instanceCount, PREVIEW_INSTANCES_PER_GROUP)`
-   * per rule, summed, is the number of rows this scan has to find, and it stops
-   * on the last one. That sum is bounded by `rules * PREVIEW_INSTANCES_PER_GROUP`
-   * (8,000 at this repo's 40-rule bench corpus), not by a fixed row count — a
-   * store with many firing rules widens it. The bound that DOES hold
-   * unconditionally is the sorted form's floor: this scan visits at most as
-   * many rows as `ROW_NUMBER() OVER (PARTITION BY rule_id …)` would have
-   * sorted, and stops the moment every rule has its cap, where the sorted form
-   * sorts the whole scope regardless. The true worst case — the rarest rule's
-   * wanted instances sitting at the tail of the scope — is one pass over
-   * everything in scope with a block sort of the id tie-break only, never a
-   * sort of the scope, which is still that floor.
-   *
-   * A row whose rule the aggregate did not see is skipped: the two statements
-   * run without a shared snapshot, so a capture landing between them can add a
-   * rule here that has no counts there, and the counts are what the group is
-   * built from.
-   */
-  previewRows(aggregates, scope) {
-    const wanted = /* @__PURE__ */ new Map();
-    let remaining = 0;
-    for (const [ruleId, agg] of aggregates) {
-      const n = Math.min(agg.instanceCount, PREVIEW_INSTANCES_PER_GROUP);
-      wanted.set(ruleId, n);
-      remaining += n;
-    }
-    const rows = [];
-    if (remaining === 0) return rows;
-    const { sql, params } = this.findingScanSql(scope);
-    const taken = /* @__PURE__ */ new Map();
-    for (const r of iterateRows(this.db.prepare(sql), params)) {
-      const want = wanted.get(r.rule_id);
-      if (want === void 0) continue;
-      const have = taken.get(r.rule_id) ?? 0;
-      if (have >= want) continue;
-      taken.set(r.rule_id, have + 1);
-      rows.push(r);
-      remaining -= 1;
-      if (remaining === 0) break;
-    }
-    return rows;
-  }
   /**
    * Every finding in scope as a FlatFindingRow, newest first, streamed.
    *
@@ -27455,6 +28576,33 @@ var SqliteFindingsRepository = class {
       yield toFlatFindingRow(r);
     }
   }
+  /**
+   * One finding by its own id, or null when no such row exists.
+   *
+   * A primary-key seek on `inspection_findings`, so its cost does not grow with
+   * the store — and, unlike anything derived from a list page, it resolves a
+   * finding of ANY age. That is what the Findings page's one-shot `?finding=`
+   * deep link needs: the id it carries may name a finding thousands of rows
+   * older than anything a first page holds.
+   *
+   * Deliberately UNFILTERED — no capture-kind, session or time predicate. It
+   * RESOLVES an id; whether that row would survive the list's current filters is
+   * a different question, and hiding the target because a filter excludes it is
+   * worse than showing it.
+   *
+   * `groupId` on the result IS the rule id, so this one read answers both "which
+   * type should the list select?" and "what does the drawer show?".
+   */
+  findingInstance(id) {
+    const row = this.db.prepare(
+      `SELECT ${FINDING_ROW_COLUMNS_SQL}
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+          WHERE f.id = ?`
+    ).get(id);
+    return Promise.resolve(row === void 0 ? null : toInstanceDetail(toFlatFindingRow(row)));
+  }
   /**
    * The one statement both instance-level scans run: every finding in scope,
    * joined to its event and definition, newest first.
@@ -27488,17 +28636,7 @@ var SqliteFindingsRepository = class {
       conditions.push("e.started_at >= ?");
       params.push(isoToEpochMillis(scope.from));
     }
-    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
-              d.severity AS severity, f.masked_match AS masked_match,
-              f.action_taken AS action_taken, f.confidence AS confidence,
-              e.started_at AS occurred_at,
-              e.source_tool AS source_tool,
-              e.repo AS repo,
-              e.file_path AS file,
-              e.tool_name AS tool_name,
-              f.audit_event_id AS event_id, e.root_session_id AS session_id,
-              e.event_type AS kind, f.finding_key AS finding_key,
-              ${latestResolutionStatusSql("f")} AS latest_status
+    const sql = `SELECT ${FINDING_ROW_COLUMNS_SQL}
          FROM audit_events e
          CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
          CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
@@ -27512,6 +28650,26 @@ var SqliteFindingsRepository = class {
            group_concat(DISTINCT 'via ' || e.tool_name) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
       `SELECT rule_id,
+                -- BARE columns beside max(latest_at), which is deliberate and
+                -- is SQLite's documented behaviour: with a single min()/max()
+                -- in an aggregate query, every bare column takes its value from
+                -- the row that produced the extremum. So these are the severity
+                -- and category of the definition whose finding is NEWEST, which
+                -- is what the row-based build they replaced read off its first
+                -- (newest-first) row.
+                --
+                -- min() is WRONG here and was the defect: inspection_definitions
+                -- holds one row per rule VERSION (see its writer \u2014 a version bump
+                -- mints a new row), so a rule whose severity moved between
+                -- versions has several, and min() picks the ALPHABETICALLY
+                -- smallest \u2014 'low' over 'medium', but 'critical' over 'high'.
+                -- That is arbitrary in direction, and it feeds the badge, the
+                -- filter, the facet counts and the primary sort key.
+                --
+                -- Adding a second min()/max() aggregate here would make these
+                -- bare columns ambiguous again; keep max(latest_at) the only one.
+                severity,
+                category,
                 sum(tuple_count) AS instance_count,
                 max(latest_at) AS latest_at,
                 group_concat(source_tools) AS source_tools,
@@ -27522,6 +28680,14 @@ var SqliteFindingsRepository = class {
                 group_concat(tool_names) AS tool_names
            FROM (
              SELECT d.rule_id AS rule_id,
+                    -- Severity and category are columns of the DEFINITION, and
+                    -- a rule can have SEVERAL definitions (one per version), so
+                    -- these are grouped on below and resolved to the newest
+                    -- firing version by the outer query's bare-column select.
+                    -- They ride the aggregate because the type build has no rows
+                    -- to read them off \u2014 see buildFindingTypes.
+                    d.severity AS severity,
+                    d.category AS category,
                     e.event_type || '${TUPLE_SEP}' ||
                       (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
                       coalesce(latest.status, '') AS status_tuple,
@@ -27536,7 +28702,7 @@ var SqliteFindingsRepository = class {
                LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
                  ON latest.finding_key = f.finding_key
               ${scope.predicate}
-              GROUP BY d.rule_id, status_tuple
+              GROUP BY d.rule_id, d.severity, d.category, status_tuple
            )
           GROUP BY rule_id`
     ).all(scope.params);
@@ -27545,6 +28711,8 @@ var SqliteFindingsRepository = class {
         r.rule_id,
         {
           instanceCount: r.instance_count,
+          severity: r.severity,
+          category: r.category,
           sourceTools: splitConcat(r.source_tools),
           actionsTaken: splitConcat(r.actions_taken),
           statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
@@ -27561,7 +28729,7 @@ var SqliteFindingsRepository = class {
           latestDetectedAt: epochMillisToIso(r.latest_at),
           // Free text only — joined and substring-matched, so group_concat's
           // commas need no unpicking (a repo/path containing one still matches).
-          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // Left undefined (not '') when unfetched, so buildFindingTypes can
           // tell "no q this request" from "a group with no repo/file at all"
           // and skip priming a haystack nothing will read.
           ...withSearchText ? {
@@ -27589,7 +28757,9 @@ var SqliteFindingsRepository = class {
       )
     );
     for (const row of grouped) {
-      if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
+      if (Object.hasOwn(byAction, row.action_taken)) {
+        byAction[row.action_taken] = row.c;
+      }
     }
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
     const sevRows = allRows(
@@ -27606,7 +28776,9 @@ var SqliteFindingsRepository = class {
       )
     );
     for (const row of sevRows) {
-      if (row.severity in bySeverity) bySeverity[row.severity] = row.c;
+      if (Object.hasOwn(bySeverity, row.severity)) {
+        bySeverity[row.severity] = row.c;
+      }
     }
     const categories = ENFORCEABLE_CATEGORIES;
     const enabledRows = allRows(
@@ -27655,469 +28827,6 @@ function isoDay(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 
-// ../../packages/persistence/src/repositories/history-sync.ts
-var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
-var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
-var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
-var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
-var SKIPPED = -1;
-var ROW_COLUMNS = `id,
-   parent_id AS parentId,
-   root_session_id AS rootSessionId,
-   event_type AS eventType,
-   host_id AS hostId,
-   harness_id AS harnessId,
-   source_project_id AS sourceProjectId,
-   started_at AS startedAt,
-   ended_at AS endedAt,
-   severity,
-   priority,
-   content,
-   content_hash AS contentHash,
-   attributes`;
-var SqliteHistorySyncRepository = class {
-  constructor(db) {
-    this.db = db;
-    this.ensureRowStmt = db.prepare(`INSERT OR IGNORE INTO history_sync (id) VALUES (1)`);
-    this.sessionsStmt = db.prepare(
-      `SELECT COALESCE(root_session_id, id) AS sessionId, MIN(started_at) AS earliest
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at < :before
-        GROUP BY sessionId
-        ORDER BY earliest
-        LIMIT :limit`
-    );
-    this.rowsStmt = db.prepare(
-      `SELECT ${ROW_COLUMNS}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at < :before
-          AND COALESCE(root_session_id, id) = :sessionId
-        ORDER BY (event_type = 'session') DESC, started_at
-        LIMIT :limit`
-    );
-    this.captureRowsStmt = db.prepare(
-      `SELECT ${ROW_COLUMNS}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND sync_claimed_at IS NULL
-          AND outbox_owed = 1
-          AND event_type IN (${CAPTURE_TYPE_LIST})
-          AND started_at < :before
-        ORDER BY started_at
-        LIMIT :limit`
-    );
-    this.markOwedStmt = db.prepare(
-      `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
-    );
-    this.stampStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id`
-    );
-    this.claimRowStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = :at WHERE id = :id AND synced_at IS NULL`
-    );
-    this.releaseRowStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = NULL WHERE id = :id`
-    );
-    this.releaseStaleClaimsStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = NULL
-        WHERE sync_claimed_at IS NOT NULL AND sync_claimed_at < :staleBefore`
-    );
-    this.partitionStmt = db.prepare(
-      `SELECT
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NOT NULL THEN 1 ELSE 0 END) AS inProgress,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS synced,
-         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0 THEN 1 ELSE 0 END) AS failed,
-         COUNT(*) AS total
-       FROM audit_events
-       WHERE event_type IN (${TYPE_LIST})`
-    );
-    this.countsStmt = db.prepare(
-      `SELECT
-         SUM(CASE WHEN synced_at IS NULL AND started_at < :before THEN 1 ELSE 0 END) AS pending,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS sent,
-         SUM(CASE WHEN synced_at = ${String(SKIPPED)} THEN 1 ELSE 0 END) AS skipped
-       FROM audit_events
-       WHERE event_type IN (${TYPE_LIST})`
-    );
-    this.captureSkipCountStmt = db.prepare(
-      `SELECT COUNT(*) AS skipped
-         FROM audit_events
-        WHERE synced_at = ${String(SKIPPED)}
-          AND event_type IN (${CAPTURE_TYPE_LIST})`
-    );
-    this.fingerprintStmt = db.prepare(
-      `SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
-         FROM history_sync WHERE id = 1`
-    );
-    this.setFingerprintStmt = db.prepare(
-      `UPDATE history_sync
-          SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
-        WHERE id = 1`
-    );
-    this.disownCapturesStmt = db.prepare(
-      `UPDATE audit_events SET outbox_owed = NULL
-        WHERE outbox_owed IS NOT NULL AND event_type IN (${CAPTURE_TYPE_LIST})`
-    );
-    this.rearmStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = NULL
-        WHERE synced_at > 0 AND event_type IN (${TYPE_LIST})`
-    );
-    this.claimStmt = db.prepare(
-      `UPDATE history_sync
-          SET owner_pid = :pid, owner_host = :host, acquired_at = :now, heartbeat_at = :now
-        WHERE id = 1
-          AND (owner_pid IS NULL
-               OR heartbeat_at IS NULL
-               OR heartbeat_at < :staleBefore
-               OR heartbeat_at > :now)`
-    );
-    this.heartbeatStmt = db.prepare(
-      `UPDATE history_sync SET heartbeat_at = :now WHERE id = 1 AND owner_pid = :pid`
-    );
-    this.releaseStmt = db.prepare(
-      `UPDATE history_sync
-          SET owner_pid = NULL, owner_host = NULL, acquired_at = NULL, heartbeat_at = NULL
-        WHERE id = 1 AND owner_pid = :pid`
-    );
-    this.closeWindowStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = :at
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at >= :attachedAt`
-    );
-    this.releaseBoundaryStmt = db.prepare(
-      `UPDATE history_sync SET backlog_before = NULL WHERE id = 1`
-    );
-    this.freezeBoundaryStmt = db.prepare(
-      `UPDATE history_sync SET backlog_before = :backlogBefore WHERE id = 1`
-    );
-    this.leaseStmt = db.prepare(
-      `SELECT owner_pid AS ownerPid, owner_host AS ownerHost,
-              acquired_at AS acquiredAt, heartbeat_at AS heartbeatAt
-         FROM history_sync WHERE id = 1`
-    );
-    this.inspectionsStmt = db.prepare(
-      `SELECT d.rule_id AS ruleId,
-              d.name AS ruleName,
-              d.version AS ruleVersion,
-              d.category AS category,
-              d.severity AS severity,
-              f.span_start AS spanStart,
-              f.span_end AS spanEnd,
-              f.masked_match AS maskedMatch,
-              f.action_taken AS actionTaken,
-              f.confidence AS confidence
-         FROM inspection_findings f
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE f.audit_event_id = :auditEventId
-        ORDER BY f.span_start, f.id`
-    );
-  }
-  db;
-  ensureRowStmt;
-  sessionsStmt;
-  rowsStmt;
-  stampStmt;
-  countsStmt;
-  fingerprintStmt;
-  setFingerprintStmt;
-  rearmStmt;
-  claimStmt;
-  heartbeatStmt;
-  releaseStmt;
-  leaseStmt;
-  inspectionsStmt;
-  closeWindowStmt;
-  releaseBoundaryStmt;
-  freezeBoundaryStmt;
-  captureRowsStmt;
-  markOwedStmt;
-  captureSkipCountStmt;
-  disownCapturesStmt;
-  partitionStmt;
-  claimRowStmt;
-  releaseRowStmt;
-  releaseStaleClaimsStmt;
-  /**
-   * The masked detections recorded against one tool call.
-   *
-   * These travel with the event because a tool call's target is not
-   * re-inspectable from the event alone — unlike a capture, where the text
-   * itself is re-scannable. What crosses is the masked match and the rule that
-   * produced it, never the value.
-   */
-  inspectionsFor(auditEventId) {
-    return allRows(this.inspectionsStmt, { auditEventId });
-  }
-  /**
-   * Sessions with structural rows still to send, oldest first.
-   *
-   * BOUNDED BY THE BACKLOG BOUNDARY, which is the whole correctness of this
-   * read. Anything recorded after the machine attached is the live forward
-   * path's to deliver; this drain exists for what was recorded before it, and a
-   * row both paths send is at best a duplicate request and at worst — for a
-   * session root — an overwrite of the inventory ids the live path resolved.
-   */
-  pendingSessions(limit, before) {
-    return allRows(this.sessionsStmt, { limit, before }).map(
-      (r) => r.sessionId
-    );
-  }
-  /** One session's undelivered structural rows within the backlog, root first. */
-  pendingRows(sessionId, limit, before) {
-    return allRows(this.rowsStmt, { sessionId, limit, before });
-  }
-  /**
-   * Captures this machine still owes the deployment, oldest first.
-   *
-   * Selected by the `outbox_owed` marker the attached forward path writes, not
-   * by a time window — see captureRowsStmt for why a window could not express
-   * this. `before` is the grace window that leaves a just-recorded capture to
-   * the live path.
-   */
-  pendingCaptureRows(limit, before) {
-    return allRows(this.captureRowsStmt, { limit, before });
-  }
-  /**
-   * Record that a capture is OWED to the deployment.
-   *
-   * Written by the attached forward path when a live send did not confirm
-   * delivery, and read by the drain as the whole of its eligibility test. It is
-   * a fact rather than an inference: the machine was attached, the send did not
-   * land, so the row is owed — which no time window can state, because the same
-   * window that holds the rows a past attachment left owed also holds every
-   * capture recorded while the machine was DETACHED, and those were never
-   * offered to anyone.
-   *
-   * Idempotent, and never un-set: `markSynced` settling the row is what takes it
-   * out of the drain's read.
-   */
-  markCaptureOwed(id) {
-    this.markOwedStmt.run({ id });
-  }
-  /** Record delivery. Called only AFTER the far side has accepted the rows. */
-  markSynced(ids, atMs) {
-    this.stampAll(ids, atMs);
-  }
-  /**
-   * Record that a row will never be sent.
-   *
-   * Reserved for a local defect — a row that cannot be rebuilt into a valid
-   * payload. A row that merely failed to reach the deployment stays NULL, so it
-   * is retried; marking those would turn one outage into permanent data loss.
-   */
-  markSkipped(ids) {
-    this.stampAll(ids, SKIPPED);
-  }
-  eachInTransaction(ids, run) {
-    if (ids.length === 0) return;
-    withTransaction(
-      this.db,
-      () => {
-        for (const id of ids) run(id);
-      },
-      "IMMEDIATE"
-    );
-  }
-  stampAll(ids, value) {
-    if (ids.length === 0) return;
-    withTransaction(
-      this.db,
-      () => {
-        for (const id of ids) this.stampStmt.run({ at: value, id });
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * Claim rows as in-flight.
-   *
-   * Advisory in exactly the sense the lease is: it records that a send is in
-   * progress so a surface can say so, and a lost claim costs a row showing as
-   * queued while it is actually being sent. It is not exclusion — the far side
-   * settles a duplicate on the row id.
-   */
-  claimRows(ids, atMs) {
-    this.eachInTransaction(ids, (id) => this.claimRowStmt.run({ at: atMs, id }));
-  }
-  /** Give back a claim without settling — the send failed, the row is queued again. */
-  releaseRows(ids) {
-    this.eachInTransaction(ids, (id) => this.releaseRowStmt.run({ id }));
-  }
-  /**
-   * Clear claims older than `staleBefore`, and report how many were cleared.
-   *
-   * A process killed between claiming and settling leaves rows claimed with
-   * nothing left to settle them. Without this they read as "sending" for ever.
-   */
-  releaseStaleClaims(staleBefore) {
-    return Number(this.releaseStaleClaimsStmt.run({ staleBefore }).changes);
-  }
-  /**
-   * Every tracked row in exactly one delivery state.
-   *
-   * Takes no boundary on purpose. The boundary answers "what should the drain
-   * pick up now", which is a different question from "what state is this row
-   * in" — and a machine that has never attached has no boundary to pass, so
-   * requiring one would force a caller to invent one and report the whole store
-   * as queued.
-   */
-  partition() {
-    const row = getRow(this.partitionStmt, {});
-    return {
-      queued: row?.queued ?? 0,
-      inProgress: row?.inProgress ?? 0,
-      synced: row?.synced ?? 0,
-      failed: row?.failed ?? 0,
-      total: row?.total ?? 0
-    };
-  }
-  /** `pending` counts only what is inside the backlog; sent and skipped are totals. */
-  counts(before) {
-    const row = getRow(
-      this.countsStmt,
-      { before }
-    );
-    const captures = getRow(this.captureSkipCountStmt);
-    return {
-      pending: row?.pending ?? 0,
-      sent: row?.sent ?? 0,
-      skipped: row?.skipped ?? 0,
-      capturesSkipped: captures?.skipped ?? 0
-    };
-  }
-  /**
-   * The deployment the current stamps were made against, and where its backlog
-   * ends.
-   *
-   * READ-ONLY. An absent row reads as an absent deployment, which is what a
-   * machine that has never drained is — and every writer below seeds the row
-   * before it needs one, so nothing depends on this creating it. Keeping the
-   * write off the gate path matters because the gate runs on every pass while a
-   * write has to take the database's write lock.
-   */
-  deployment() {
-    const row = getRow(
-      this.fingerprintStmt
-    );
-    return {
-      fingerprint: row?.fingerprint ?? void 0,
-      backlogBefore: row?.backlogBefore ?? void 0
-    };
-  }
-  /**
-   * Point the ledger at a different deployment, discarding what it recorded
-   * about the previous one.
-   *
-   * Delivery is a fact about ONE recipient: rows sent to the deployment a
-   * machine has just left are undelivered as far as the new one is concerned.
-   * All three in one transaction, so a crash between them cannot leave stamps
-   * attributed to the wrong deployment, or a boundary that belongs to another.
-   *
-   * The boundary is written HERE and only here, which is what freezes it: a
-   * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
-   * unchanged, so this never runs and the backlog does not widen back over rows
-   * the live path has since delivered.
-   */
-  rearmFor(fingerprint, backlogBefore) {
-    this.ensureRowStmt.run();
-    withTransaction(
-      this.db,
-      () => {
-        const previous = getRow(this.fingerprintStmt)?.fingerprint;
-        this.rearmStmt.run();
-        if (previous !== null && previous !== void 0 && previous !== fingerprint) {
-          this.disownCapturesStmt.run();
-        }
-        this.setFingerprintStmt.run({ fingerprint, backlogBefore });
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * End the attached period: hand its rows to the live path, and release the
-   * boundary so the next attachment can freeze a new one.
-   *
-   * WITHOUT THIS, a detach and a re-attach to the same deployment leave a window
-   * nothing delivers. The fingerprint is unchanged, so the boundary is never
-   * re-frozen and stays at the FIRST attachment — while nothing forwards at all
-   * during the detached period, because the machine is not attached. Rows
-   * recorded in that window sit after the boundary and before the re-attach, so
-   * neither path takes them, and the pending count reports none outstanding.
-   *
-   * Stamping the attached window is not a claim that every one of those rows
-   * reached the deployment — the live path drops on failure and says so
-   * elsewhere. It records that they were ITS to deliver, which is exactly the
-   * status quo: they sit outside the frozen boundary today and are equally never
-   * re-sent. Making it explicit is what lets the boundary move.
-   *
-   * ONE TRANSACTION, so a crash cannot release the boundary while leaving the
-   * window unstamped — that half-state would re-send the whole attached period
-   * on the next attach, which is the failure the boundary exists to prevent.
-   */
-  closeAttachedWindow(attachedAtMs, atMs) {
-    this.ensureRowStmt.run();
-    withTransaction(
-      this.db,
-      () => {
-        const row = getRow(this.fingerprintStmt);
-        const from = row?.backlogBefore ?? attachedAtMs;
-        this.closeWindowStmt.run({ at: atMs, attachedAt: from });
-        this.releaseBoundaryStmt.run();
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * Freeze a boundary for the deployment already on file, KEEPING the stamps.
-   *
-   * The re-attach half of the above. Distinct from `rearmFor`, which is for a
-   * different deployment and therefore discards what was delivered to the old
-   * one: here the recipient is the same, so everything already sent to it stays
-   * sent.
-   */
-  freezeBoundary(backlogBefore) {
-    this.ensureRowStmt.run();
-    this.freezeBoundaryStmt.run({ backlogBefore });
-  }
-  /** Take the claim, or report that someone live already holds it. */
-  claim(pid, host, nowMs, staleAfterMs) {
-    this.ensureRowStmt.run();
-    let taken = false;
-    withTransaction(
-      this.db,
-      () => {
-        const result = this.claimStmt.run({
-          pid,
-          host,
-          now: nowMs,
-          staleBefore: nowMs - staleAfterMs
-        });
-        taken = result.changes === 1;
-      },
-      "IMMEDIATE"
-    );
-    return taken;
-  }
-  /** Say the holder is still alive. A no-op once the claim has moved on. */
-  heartbeat(pid, nowMs) {
-    this.heartbeatStmt.run({ now: nowMs, pid });
-  }
-  /** Give the claim up. Scoped to this holder, so a taken-over claim is left be. */
-  release(pid) {
-    this.releaseStmt.run({ pid });
-  }
-  /** Who holds the claim, if anyone. Read-only, for the same reason as above. */
-  lease() {
-    return getRow(this.leaseStmt);
-  }
-};
-
 // ../../packages/persistence/src/repositories/inspection-definitions.ts
 var SqliteInspectionDefinitionsRepository = class {
   constructor(db) {
@@ -28312,7 +29021,8 @@ function managedSettingsPaths(platform2 = process.platform) {
   }
   return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
 }
-function readManagedSettings(paths = managedSettingsPaths()) {
+var testOnlyManagedPaths = null;
+function readManagedSettings(paths = testOnlyManagedPaths ?? managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
@@ -28347,6 +29057,7 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
   if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
   if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
+  if (values.bodyRetention !== void 0) merged.bodyRetention = values.bodyRetention;
   if (values.vaultConsent !== void 0) {
     merged.vaultConsent = values.vaultConsent ? (
       // Keep an existing valid grant so its acknowledgedAt survives; mint one
@@ -30792,7 +31503,7 @@ function toUtcDateString(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 function isTimeseriesSeverity(s) {
-  return s === "critical" || s === "high" || s === "medium";
+  return s === "critical" || s === "high" || s === "medium" || s === "low";
 }
 var SqliteSecurityRepository = class {
   constructor(db, now = () => Date.now()) {
@@ -30854,7 +31565,7 @@ var SqliteSecurityRepository = class {
                       ELSE 0
                     END) AS open_at_rest
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
@@ -30921,12 +31632,16 @@ var SqliteSecurityRepository = class {
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
     const rows = this.findingsInRange(windowStart, now);
-    const points = Array.from({ length: numBuckets }, (_, i) => ({
-      timestamp: toUtcDateString(windowStart + i * bucketMs),
-      critical: 0,
-      high: 0,
-      medium: 0
-    }));
+    const points = Array.from(
+      { length: numBuckets },
+      (_, i) => ({
+        timestamp: toUtcDateString(windowStart + i * bucketMs),
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+      })
+    );
     for (const r of rows) {
       const idx = Math.floor((r.occurredAt - windowStart) / bucketMs);
       const bucket = points[idx];
@@ -31076,7 +31791,7 @@ var SqliteSecurityRepository = class {
       this.db.prepare(
         `SELECT e.repo AS repo, count(*) AS c
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
            AND e.repo IS NOT NULL
@@ -31144,6 +31859,7 @@ var SqliteSecurityRepository = class {
         `SELECT f.finding_key AS finding_key,
                 d.rule_id AS rule_id,
                 d.severity AS severity,
+                e.repo AS repo,
                 e.file_path AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
@@ -31163,6 +31879,7 @@ var SqliteSecurityRepository = class {
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
+      repo: r.repo ?? "",
       severity: r.severity,
       path: r.path ?? "",
       resolvedAt: new Date(r.latest_resolved_at).toISOString(),
@@ -31172,15 +31889,68 @@ var SqliteSecurityRepository = class {
     }));
     return Promise.resolve({ items });
   }
+  /**
+   * Per-rule tallies of the findings that are still OPEN, whole-store.
+   *
+   * Scoped by status rather than by time, because the card this feeds is a to-do
+   * list: a secret committed three weeks ago and never rotated is still the most
+   * important thing to fix, and any window hides it. It carried a "newest N
+   * findings" cap and then a range; the first meant a different span on every
+   * machine, and the second reported "no recommendations" over live exposure.
+   *
+   * `open` mirrors `deriveFindingStatus` — at-rest, minus resolved and dismissed —
+   * so a row's count is exactly what `?status=open&type=<rule>` returns. Note that
+   * is NOT `severitySummary`'s `openAtRest`, which keeps dismissed findings (a
+   * dismissal is a judgement, not a remediation) and drops untracked legacy rows.
+   * The two answer different questions and only this one has to match a link.
+   *
+   * Aggregated in SQL: the result is O(distinct rule × category × severity), so a
+   * whole-store scope costs a grouped scan rather than a row per finding.
+   */
+  recommendationInputs() {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT d.rule_id AS rule_id,
+                d.category AS category,
+                d.severity AS severity,
+                COUNT(*) AS count
+         FROM inspection_findings f
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+           ON latest.finding_key = f.finding_key
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND e.event_type = 'code_change'
+           AND (
+             f.finding_key IS NULL
+             OR latest.status IS NULL
+             OR latest.status NOT IN ('resolved', 'dismissed')
+           )
+         GROUP BY d.rule_id, d.category, d.severity`
+      )
+    );
+    return Promise.resolve(
+      rows.map((r) => ({
+        ruleId: r.rule_id,
+        category: r.category,
+        severity: r.severity,
+        count: r.count
+      }))
+    );
+  }
   // Findings whose parent event occurred in [fromMs, toMs), with the parent's
   // epoch-millis timestamp. started_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
     const rows = allRows(
       this.db.prepare(
-        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken
+        // `rule_id`/`category` cost nothing extra: inspection_definitions is already
+        // joined for `severity`, so they are two more columns off a row this read
+        // already fetches. They feed the recommended-actions rollup.
+        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
+                d.rule_id AS rule_id, d.category AS category
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
@@ -31191,7 +31961,9 @@ var SqliteSecurityRepository = class {
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
-      actionTaken: r.action_taken
+      actionTaken: r.action_taken,
+      ruleId: r.rule_id,
+      category: r.category
     }));
   }
 };
@@ -32019,6 +32791,7 @@ function openWithPragmas(file2) {
     db.exec("PRAGMA journal_mode = WAL");
     db.exec("PRAGMA busy_timeout = 2000");
     db.exec("PRAGMA foreign_keys = ON");
+    registerSqlFunctions(db);
   } catch (err) {
     closeQuietly(db);
     throw err;
@@ -32048,7 +32821,7 @@ function backupLegacyStore(db, file2) {
   discardStore(file2, backup);
   return backup;
 }
-function openAndInitialize(file2, base) {
+function openAndInitialize(file2, base, skipTags) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
@@ -32058,7 +32831,7 @@ function openAndInitialize(file2, base) {
         `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
       );
     }
-    applyMigrations(db, file2);
+    applyMigrations(db, file2, { skipTags });
     tightenPerms(file2);
     const policies = new SqlitePoliciesRepository(db);
     const installedPacks = new SqliteInstalledPacksRepository(db, base);
@@ -32073,6 +32846,7 @@ function openAndInitialize(file2, base) {
       exceptions: new SqliteExceptionsRepository(db),
       resolutions: new SqliteResolutionsRepository(db),
       ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
+      bodyRetention: new SqliteBodyRetentionRepository(db),
       security: new SqliteSecurityRepository(db),
       detections: new SqliteDetectionsRepository(db),
       shares: new SqliteSharesRepository(db),
@@ -32095,7 +32869,8 @@ function openAndInitialize(file2, base) {
     throw err;
   }
 }
-function openLocalDatabase(dir) {
+var DEFERRED_TAGS = new Set(DEFERRED_MIGRATION_TAGS);
+function openLocalDatabase(dir, options = {}) {
   ensureDataDirSync(dir);
   const file2 = join7(dir, DB_FILENAME);
   reapStalePartials(file2);
@@ -32107,6 +32882,7 @@ function openLocalDatabase(dir) {
     installedPacks,
     scanLedger,
     historySync,
+    bodyRetention,
     secretVault,
     exceptions,
     resolutions,
@@ -32130,7 +32906,8 @@ function openLocalDatabase(dir) {
     // `dir` is always `<base>/data` — every caller resolves it through
     // `dataDir()` — so its parent is the `~/.aka` base the layout splits into
     // settings/ and data/, and the pack-policy floor needs both halves.
-    dirname2(dir)
+    dirname2(dir),
+    options.applyDeferredMigrations === true ? void 0 : DEFERRED_TAGS
   );
   function captureRowId(event) {
     return captureId(
@@ -32323,6 +33100,7 @@ function openLocalDatabase(dir) {
     installedPacks,
     scanLedger,
     historySync,
+    bodyRetention,
     secretVault,
     exceptions,
     resolutions,
@@ -32361,6 +33139,70 @@ function openLocalDatabase(dir) {
   };
 }
 
+// ../../packages/persistence/src/egress-wire.ts
+import { createHash as createHash3 } from "crypto";
+var PROJECT_KEY_DIGEST_VERSION = "v2";
+var SCP_FORM = /^(?:[^@/]+@)?([^/:]+):(.+)$/;
+var DOS_DRIVE = /^[A-Za-z]:[\\/]/;
+var FILE_URL = /^file:\/\//i;
+var SCHEME_FORM = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?(\/.*)?$/i;
+var SLASH = "/".charCodeAt(0);
+var GIT_SUFFIX = ".git";
+function trimSlashes(path) {
+  let start = 0;
+  let end = path.length;
+  while (start < end && path.charCodeAt(start) === SLASH) start += 1;
+  while (end > start && path.charCodeAt(end - 1) === SLASH) end -= 1;
+  return path.slice(start, end);
+}
+function canonicalGitUrl(url2) {
+  const trimmed = url2.trim();
+  if (DOS_DRIVE.test(trimmed) || FILE_URL.test(trimmed)) return trimmed;
+  const scheme = SCHEME_FORM.exec(trimmed);
+  const scp = scheme === null ? SCP_FORM.exec(trimmed) : null;
+  const host = (scheme?.[1] ?? scp?.[1])?.toLowerCase();
+  if (host === void 0) return trimmed;
+  const path = (scheme === null ? scp?.[2] : scheme[2]) ?? "";
+  const bare = trimSlashes(path);
+  const cleaned = bare.endsWith(GIT_SUFFIX) ? bare.slice(0, -GIT_SUFFIX.length) : bare;
+  return cleaned === "" ? host : `${host}/${cleaned}`;
+}
+function hashProjectKey(projectKey) {
+  const canonical = projectKey.startsWith("git:") ? `git:${canonicalGitUrl(projectKey.slice("git:".length))}` : projectKey;
+  return createHash3("sha256").update(`${PROJECT_KEY_DIGEST_VERSION}:${canonical}`, "utf8").digest("hex");
+}
+function toIngestHit(hit) {
+  return {
+    host: hit.host,
+    kind: hit.kind,
+    name: hit.name,
+    category: hit.category,
+    trust: hit.trust,
+    network: hit.network,
+    method: hit.method,
+    transport: hit.transport,
+    url: hit.url,
+    template: hit.template,
+    dataClass: hit.dataClass,
+    site: {
+      file: hit.site.file,
+      line: hit.site.line,
+      dynamic: hit.site.dynamic,
+      vendored: hit.site.vendored
+    }
+  };
+}
+function toEgressIngestRequest(input2) {
+  const { hits, droppedFiles } = capHits(input2.hits, input2.reconcile.mode);
+  const reconcile = withoutDroppedFiles(input2.reconcile, droppedFiles);
+  return {
+    projectKey: hashProjectKey(input2.projectKey),
+    project: input2.project,
+    reconcile,
+    hits: hits.map(toIngestHit)
+  };
+}
+
 // ../../packages/persistence/src/exception-policy.ts
 var UserGrantPolicyProvider = class {
   #exceptions;
@@ -32382,13 +33224,13 @@ var UserGrantPolicyProvider = class {
 };
 
 // ../../packages/persistence/src/finding-key.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function normalizeFilePath(filePath) {
   return filePath.replaceAll("\\", "/");
 }
 function computeFindingKey(input2) {
   const normalizedPath = normalizeFilePath(input2.filePath);
-  return createHash3("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
+  return createHash4("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
 }
 
 // ../../packages/persistence/src/fingerprint.ts
@@ -32514,14 +33356,50 @@ function fingerprintValue(key, raw) {
   return createHmac("sha256", key.material).update(raw, "utf8").digest("hex");
 }
 
-// ../../packages/persistence/src/history-preview.ts
-import { existsSync as existsSync4 } from "fs";
+// ../../packages/persistence/src/forward-health.ts
+import { readFileSync as readFileSync7 } from "fs";
 import { join as join9 } from "path";
+var FAILURES = /* @__PURE__ */ new Set([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
+var BREAKER_COOLDOWN_MS = 3e4;
+function parseForwardHealth(raw, nowMs) {
+  try {
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
+    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
+    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    return { consecutiveFailures: failures, openedAtMs, lastFailure };
+  } catch {
+    return null;
+  }
+}
+function isForwardPaused(health, nowMs) {
+  const openedAtMs = health?.openedAtMs ?? null;
+  if (openedAtMs === null) return false;
+  return nowMs - openedAtMs < BREAKER_COOLDOWN_MS;
+}
+
+// ../../packages/persistence/src/history-backfill.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join10 } from "path";
+
+// ../../packages/persistence/src/history-preview.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join11 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
+// ../../packages/persistence/src/history-sync-state.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join12 } from "path";
+
 // ../../packages/persistence/src/store-symlinks.ts
-import { existsSync as existsSync5, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname3, join as join10, resolve } from "path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join13, resolve } from "path";
 var STORE_DB = "the store database (including the prompt corpus)";
 var STORE_SETTINGS = "your settings file";
 function storeContents(home) {
@@ -32530,7 +33408,7 @@ function storeContents(home) {
     [settingsDir(home), STORE_SETTINGS],
     [dataDir(home), STORE_DB],
     [keysDir(home), "the vault key"],
-    [join10(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [join13(settingsDir(home), "settings.json"), STORE_SETTINGS],
     [dbPath(home), STORE_DB]
   ]);
 }
@@ -32545,7 +33423,7 @@ function symlinkedStorePaths(home, platform2 = process.platform) {
           holds,
           // existsSync follows the link, so a target that is gone reads as
           // absent here while lstat above still sees the link itself.
-          missing: !existsSync5(path),
+          missing: !existsSync6(path),
           mode: targetMode(path, platform2)
         }
       ];
@@ -32681,8 +33559,8 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join11 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync9, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join14 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
   gone: "the path was occupied but holds no keyring (removed while it was being created)",
@@ -32781,7 +33659,7 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync3(join11(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join14(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
@@ -32790,7 +33668,7 @@ function claimRotationLock(lock, owner) {
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join11(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join14(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
@@ -32817,7 +33695,7 @@ function acquireRotationLock(keysDir2) {
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync7(join11(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync9(join14(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
@@ -32838,7 +33716,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join11(this.#keysDir, VAULT_KEY_FILENAME);
+    return join14(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -32868,7 +33746,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync7(this.filePath, "utf8");
+      raw = readFileSync9(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -33503,55 +34381,19 @@ var SecretVault = class {
 };
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join15 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join12(dataDir2, MARKER);
-  if (existsSync6(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join15(dataDir2, MARKER);
+  if (existsSync7(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
 
-// ../../packages/plugin-runtime/src/attached/egress-wire.ts
-function hashProjectKey(projectKey) {
-  return createHash4("sha256").update(projectKey, "utf8").digest("hex");
-}
-function toIngestHit(hit) {
-  return {
-    host: hit.host,
-    kind: hit.kind,
-    name: hit.name,
-    category: hit.category,
-    trust: hit.trust,
-    network: hit.network,
-    method: hit.method,
-    transport: hit.transport,
-    url: hit.url,
-    template: hit.template,
-    dataClass: hit.dataClass,
-    site: {
-      file: hit.site.file,
-      line: hit.site.line,
-      dynamic: hit.site.dynamic,
-      vendored: hit.site.vendored
-    }
-  };
-}
-function toEgressIngestRequest(input2) {
-  const { hits, droppedFiles } = capHits(input2.hits, input2.reconcile.mode);
-  const reconcile = withoutDroppedFiles(input2.reconcile, droppedFiles);
-  return {
-    projectKey: hashProjectKey(input2.projectKey),
-    project: input2.project,
-    reconcile,
-    hits: hits.map(toIngestHit)
-  };
-}
-
 // ../../packages/remote/src/http.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
@@ -33735,10 +34577,10 @@ function parsed(schema, body, route) {
 }
 function withoutTrailingSlashes(endpoint) {
   let end = endpoint.length;
-  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH2) end -= 1;
   return endpoint.slice(0, end);
 }
-var SLASH = "/".charCodeAt(0);
+var SLASH2 = "/".charCodeAt(0);
 function createRemoteClient(options) {
   const base = withoutTrailingSlashes(options.endpoint);
   const url2 = (route) => `${base}${route}`;
@@ -33831,6 +34673,7 @@ function createRemoteClient(options) {
         url: url2(ROUTES.shares),
         body: JSON.stringify(validated.data)
       });
+      if (response.status === 404) throw new RemoteRouteAbsent(ROUTES.shares);
       okBody(response);
     },
     async pollCommand() {
@@ -33853,19 +34696,51 @@ function createRemoteClient(options) {
   };
 }
 
-// ../../packages/plugin-runtime/src/attached/failure.ts
+// ../../packages/remote/src/failure-kind.ts
 function statusOf(err) {
   if (typeof err !== "object" || err === null || !("status" in err)) return null;
   const { status } = err;
   if (typeof status !== "number" || !Number.isInteger(status)) return null;
   return status >= 100 && status <= 599 ? status : null;
 }
-function classifyFailure(err) {
-  switch (statusOf(err)) {
+function nameOf(err) {
+  if (typeof err !== "object" || err === null || !("name" in err)) return null;
+  return typeof err.name === "string" ? err.name : null;
+}
+function classifyRemoteFailure(err) {
+  switch (nameOf(err)) {
+    case "RemoteRouteAbsent":
+      return "route-absent";
+    case "RemoteRequestInvalid":
+      return "invalid-request";
+    case "RemoteResponseInvalid":
+      return "rejected";
+    default:
+      break;
+  }
+  const status = statusOf(err);
+  if (status === null) return "unreachable";
+  switch (status) {
     case 401:
       return "unauthorized";
     case 403:
       return "forbidden";
+    case 429:
+      return "unreachable";
+    case 404:
+      return "unreachable";
+    default:
+      return status >= 400 && status <= 499 ? "rejected" : "unreachable";
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/failure.ts
+function classifyFailure(err) {
+  switch (classifyRemoteFailure(err)) {
+    case "unauthorized":
+      return "unauthorized";
+    case "forbidden":
+      return "forbidden";
     default:
       return "unreachable";
   }
@@ -33887,11 +34762,11 @@ function withTimeout(promise2, ms) {
 }
 
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join16 } from "path";
 var FORWARD_DROPS_FILENAME = ATTACHED_FORWARD_DROPS_FILENAME;
 function forwardDropsPath(dataDir2) {
-  return join13(dataDir2, FORWARD_DROPS_FILENAME);
+  return join16(dataDir2, FORWARD_DROPS_FILENAME);
 }
 function recordForwardDrops(dataDir2, count, nowMs) {
   if (count <= 0) return;
@@ -33909,7 +34784,7 @@ function recordForwardDrops(dataDir2, count, nowMs) {
 }
 function readForwardDrops(dataDir2) {
   try {
-    const parsed2 = JSON.parse(readFileSync8(forwardDropsPath(dataDir2), "utf8"));
+    const parsed2 = JSON.parse(readFileSync10(forwardDropsPath(dataDir2), "utf8"));
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     const record2 = parsed2;
     if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
@@ -33927,13 +34802,12 @@ function readForwardDrops(dataDir2) {
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync14 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join17 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -33987,8 +34861,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join14(settingsDir(base), "settings.json");
-    if (existsSync7(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join17(settingsDir(base), "settings.json");
+    if (existsSync8(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -34011,9 +34885,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync12, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join16 } from "path";
+import { basename as basename3, join as join19 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -37105,8 +37979,8 @@ function uniqueRuleIds(findings) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute, join as join15, sep as sep2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join18, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -37121,36 +37995,36 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync8(join15(dir, ".git"))) return dir;
+    if (existsSync9(join18(dir, ".git"))) return dir;
     const parent = dirname4(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join15(root, ".git");
+  const dotGit = join18(root, ".git");
   try {
     if (statSync6(dotGit).isDirectory()) {
-      return { configPath: join15(dotGit, "config"), headRoot: root };
+      return { configPath: join18(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join15(root, target);
-  if (existsSync8(join15(gitdir, "config"))) {
-    return { configPath: join15(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join18(root, target);
+  if (existsSync9(join18(gitdir, "config"))) {
+    return { configPath: join18(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join15(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join18(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join15(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join18(gitdir, commonRaw);
   const headRoot = basename2(commonGitDir) === ".git" ? dirname4(commonGitDir) : root;
-  return { configPath: join15(commonGitDir, "config"), headRoot };
+  return { configPath: join18(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync9(path, "utf8");
+    return readFileSync11(path, "utf8");
   } catch {
     return void 0;
   }
@@ -37216,7 +38090,7 @@ function buildIngestEvent(input2) {
 }
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 var ISOLATED_SCAN_BUDGET_MS = 2e3;
@@ -37230,7 +38104,7 @@ function resolveWorkerUrl() {
   for (const name of ["scan-worker.js", "scan-worker.ts"]) {
     const candidate = new URL(name, import.meta.url);
     try {
-      if (existsSync9(fileURLToPath(candidate))) {
+      if (existsSync10(fileURLToPath(candidate))) {
         resolvedWorkerUrl = candidate;
         return candidate;
       }
@@ -37693,13 +38567,9 @@ function createGuardedScanner(partition, gateway, opts) {
   };
 }
 
-// ../../packages/plugin-sdk/src/ignore-layers.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join17 } from "path";
-
-// ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname4, platform, release } from "os";
+// ../../packages/plugin-sdk/src/host-floor.ts
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join21 } from "path";
 
 // ../../packages/plugin-sdk/src/model-governance.ts
 import {
@@ -37707,16 +38577,138 @@ import {
   fstatSync,
   mkdirSync as mkdirSync2,
   openSync as openSync2,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 var TAIL_BYTES = 256 * 1024;
+function readTail(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const { size } = fstatSync(fd);
+    if (size <= TAIL_BYTES) return { text: readFileSync13(fd, "utf8"), truncated: false };
+    const buffer = Buffer.allocUnsafe(TAIL_BYTES);
+    let filled = 0;
+    while (filled < TAIL_BYTES) {
+      const n = readSync(fd, buffer, filled, TAIL_BYTES - filled, size - TAIL_BYTES + filled);
+      if (n === 0) break;
+      filled += n;
+    }
+    return { text: buffer.subarray(0, filled).toString("utf8"), truncated: true };
+  } finally {
+    closeSync2(fd);
+  }
+}
+function modelFromTranscriptTail(transcriptPath, fromRecord) {
+  if (transcriptPath === void 0 || transcriptPath === "") return void 0;
+  try {
+    const { text: slice, truncated } = readTail(transcriptPath);
+    const lines = slice.split("\n");
+    if (truncated) lines.shift();
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      if (line === void 0 || line === "") continue;
+      let parsed2;
+      try {
+        parsed2 = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      const model = fromRecord(parsed2);
+      if (model !== void 0 && model !== "") return model;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/plugin-sdk/src/host-floor.ts
+var HOST_FEATURE = {
+  ModelSwitch: "model-switch",
+  VaultPointerDisplay: "vault-pointer-display"
+};
+var HOST_FLOORS = {
+  [HOST_FEATURE.ModelSwitch]: {
+    label: "model-switch protection",
+    hookEvents: ["PreModelSwitch", "PostModelSwitch"],
+    since: "2.1.251"
+  },
+  [HOST_FEATURE.VaultPointerDisplay]: {
+    label: "vault pointer display",
+    hookEvents: ["MessageDisplay"],
+    since: "2.1.152"
+  }
+};
+var hostVersionFromRecord = (record2) => {
+  if (typeof record2 !== "object" || record2 === null) return void 0;
+  const { version: version2 } = record2;
+  return typeof version2 === "string" && version2 !== "" ? version2 : void 0;
+};
+function hostVersionFromTranscript(transcriptPath) {
+  return modelFromTranscriptTail(transcriptPath, hostVersionFromRecord);
+}
+function hostFloorGaps(hostVersion) {
+  if (hostVersion === void 0) return [];
+  const gaps = [];
+  for (const [feature, row] of Object.entries(HOST_FLOORS)) {
+    if (compareBinaryVersions(hostVersion, row.since) < 0) {
+      gaps.push({ feature, label: row.label, since: row.since });
+    }
+  }
+  return gaps;
+}
+function requiredHostVersion(gaps) {
+  let highest;
+  for (const gap of gaps) {
+    if (highest === void 0 || compareBinaryVersions(gap.since, highest) > 0) highest = gap.since;
+  }
+  return highest;
+}
+function hostFloorNotice(hostVersion) {
+  if (hostVersion === void 0) return null;
+  const gaps = hostFloorGaps(hostVersion);
+  const required2 = requiredHostVersion(gaps);
+  if (required2 === void 0) return null;
+  return `This Claude Code (${hostVersion}) is older than AKA needs \u2014 some of AKA's protections are inactive in this session. Update Claude Code to ${required2} or newer to turn them on. Everything else AKA does is working normally. Run \`aka status\` for detail.`;
+}
+var HOST_VERSION_MARKER = "host-version.json";
+function recordHostVersion(dataDir2, version2) {
+  if (version2 === void 0 || !isParseableBinaryVersion(version2)) return;
+  try {
+    const current = readHostVersionCache(dataDir2);
+    if (current !== null && compareBinaryVersions(version2, current.version) <= 0) return;
+    const cache = { version: version2, observedAt: Date.now() };
+    ensureDataDirSync(dataDir2);
+    writeOwnerOnlyFileSync(join21(dataDir2, HOST_VERSION_MARKER), JSON.stringify(cache));
+  } catch {
+  }
+}
+function readHostVersionCache(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync14(join21(dataDir2, HOST_VERSION_MARKER), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const { version: version2, observedAt } = parsed2;
+    if (typeof version2 !== "string" || !isParseableBinaryVersion(version2)) return null;
+    if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return null;
+    return { version: version2, observedAt };
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join22 } from "path";
+
+// ../../packages/plugin-sdk/src/inventory-resolver.ts
+import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { join as join19 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
+import { join as join23 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
@@ -37758,8 +38750,8 @@ function createPolicyResolver(bundle) {
 }
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join20 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join24 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -37790,6 +38782,14 @@ var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID14 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
+function applyEnforcementCeiling(action, policyMode, enabled) {
+  if (!enabled || policyMode !== "warn") return action;
+  return action === "block" || action === "redact" ? "warn" : action;
+}
+function resolveEnforcedAction(action, opts) {
+  const degraded = !opts.rewritable && action === "redact" ? builtinPolicyToAction(opts.redactFallback) : action;
+  return applyEnforcementCeiling(degraded, opts.policyMode, opts.ceilingEnabled);
+}
 function startTiming() {
   try {
     return performance.now();
@@ -37826,7 +38826,7 @@ function createPluginRuntime(gateway, settings, opts) {
     bundlesPacked = true;
   }
   const policyMode = settings.policy;
-  const redactFallback = settings.redactFallback;
+  let redactFallback = settings.redactFallback;
   const dataDir2 = opts?.dataDir;
   let rules = [];
   let scanner;
@@ -37870,6 +38870,7 @@ function createPluginRuntime(gateway, settings, opts) {
     rules = [...verified, ...unverified];
     scanner = createGuardedScanner({ verified, unverified }, gateway, opts?.scanIsolation);
     bundleExceptions = bundle.exceptions ?? [];
+    redactFallback = strongerRedactFallback(settings.redactFallback, bundle.redactFallback);
     initialized = true;
   }
   let cachedKey;
@@ -37898,21 +38899,23 @@ function createPluginRuntime(gateway, settings, opts) {
   }
   function actionForFinding(finding, excepted, rewritable = true) {
     if (excepted?.has(finding)) return "allow";
-    const action = resolveAction(finding.ruleId, finding.category);
-    if (!rewritable && action === "redact") return builtinPolicyToAction(redactFallback);
-    if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn" && (action === "block" || action === "redact")) {
-      return "warn";
-    }
-    return action;
+    return resolveEnforcedAction(resolveAction(finding.ruleId, finding.category), {
+      policyMode,
+      redactFallback,
+      rewritable,
+      ceilingEnabled: ENFORCEMENT_CEILING_ENABLED
+    });
   }
   function decide(findings, text, excepted, rewritable = true) {
     if (findings.length === 0) return { action: "log", text, findings: [] };
     const actionFor = (finding) => actionForFinding(finding, excepted, rewritable);
+    const degradedActions = rewritable ? [] : findings.filter((f) => actionForFinding(f, excepted, true) === "redact").map(actionFor);
+    const degraded = degradedActions.length === 0 ? {} : { redactDegradedTo: degradedActions.reduce((a, b) => strongerAction(a, b)) };
     let worst = "log";
     for (const finding of findings) {
       worst = strongerAction(worst, actionFor(finding));
     }
-    if (worst === "block") return { action: "block", text: null, findings };
+    if (worst === "block") return { action: "block", text: null, findings, ...degraded };
     if (worst === "redact") {
       const redactFindings = findings.filter((f) => actionFor(f) === "redact");
       const reversibleFindings = redactFindings.filter((f) => resolver.isReversible(f.ruleId));
@@ -37922,9 +38925,13 @@ function createPluginRuntime(gateway, settings, opts) {
         findings,
         enforcedFindings: redactFindings,
         reversibleFindings
+        // No `degraded` here, and it is not an omission: `rewritable` is per
+        // CAPTURE, so on an unrewritable field every redact has already become
+        // the fallback and this branch is unreachable. Spreading it would read
+        // as a case that can happen.
       };
     }
-    return { action: worst, text, findings };
+    return { action: worst, text, findings, ...degraded };
   }
   function fingerprintOf(key, finding, cache) {
     let fp = cache.get(finding);
@@ -38053,8 +39060,8 @@ function createPluginRuntime(gateway, settings, opts) {
       };
     }
   }
-  async function processText(text, context) {
-    return (await evaluate(text, context, {})).decision;
+  async function processText(text, context, opts2 = {}) {
+    return (await evaluate(text, context, {}, opts2.rewritable)).decision;
   }
   async function capture(input2, opts2 = {}) {
     const timingStartedAt = input2.occurredAt === void 0 ? startTiming() : void 0;
@@ -38077,10 +39084,12 @@ function createPluginRuntime(gateway, settings, opts) {
       );
       const storedContent = maskedFindings.length > 0 ? redact(input2.text, maskedFindings) : input2.text;
       const inspectionMs = elapsedMs(timingStartedAt);
-      const metadata = exceptionIds.length > 0 || inspectionMs !== void 0 ? {
+      const redactDegradedTo = decision.redactDegradedTo;
+      const metadata = exceptionIds.length > 0 || inspectionMs !== void 0 || redactDegradedTo !== void 0 ? {
         ...input2.metadata,
         ...exceptionIds.length > 0 ? { exceptionIds } : {},
-        ...inspectionMs !== void 0 ? { inspectionMs } : {}
+        ...inspectionMs !== void 0 ? { inspectionMs } : {},
+        ...redactDegradedTo !== void 0 ? { redactDegradedTo } : {}
       } : input2.metadata;
       const event = buildIngestEvent({
         kind: input2.kind,
@@ -38152,7 +39161,7 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join21 } from "path";
+import { join as join25 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -38481,31 +39490,12 @@ function isServerRejection(err) {
 var FORWARD_BUDGET_MS = 1500;
 var DECISION_PATH_BUDGET_MS = 800;
 var BREAKER_FAILURE_THRESHOLD = 3;
-var BREAKER_COOLDOWN_MS = 3e4;
 var CLOSED = { consecutiveFailures: 0, openedAtMs: null, lastFailure: null };
-var FAILURES = /* @__PURE__ */ new Set([
-  "unauthorized",
-  "forbidden",
-  "unreachable"
-]);
 var FORWARD_STATE_FILENAME = ATTACHED_FORWARD_STATE_FILENAME;
 var STATE_FILENAME = FORWARD_STATE_FILENAME;
-function parseBreakerState(raw, nowMs) {
-  try {
-    const parsed2 = JSON.parse(raw);
-    if (typeof parsed2 !== "object" || parsed2 === null) return null;
-    const record2 = parsed2;
-    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
-    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
-    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
-    return { consecutiveFailures: failures, openedAtMs, lastFailure };
-  } catch {
-    return null;
-  }
-}
 function createForwardPolicy(deps) {
   const now = deps.now ?? (() => Date.now());
-  const file2 = join22(deps.dir, STATE_FILENAME);
+  const file2 = join26(deps.dir, STATE_FILENAME);
   let state = null;
   let loading = null;
   async function readState() {
@@ -38515,7 +39505,7 @@ function createForwardPolicy(deps) {
     } catch {
       return { ...CLOSED };
     }
-    return parseBreakerState(raw, now()) ?? { ...CLOSED };
+    return parseForwardHealth(raw, now()) ?? { ...CLOSED };
   }
   async function load() {
     if (state !== null) return state;
@@ -38561,7 +39551,7 @@ function createForwardPolicy(deps) {
       };
       const at = now();
       if (current.openedAtMs !== null) {
-        if (at - current.openedAtMs < BREAKER_COOLDOWN_MS) {
+        if (isForwardPaused(current, at)) {
           return { ok: false, reason: "breaker-open" };
         }
         await persist({
@@ -39098,7 +40088,18 @@ var AttachedDataGateway = class {
       // and the spread above would otherwise drop the field silently — which is
       // exactly what it did, leaving the whole control inert on every device
       // while every test around it stayed green.
-      prohibitedModels: cached2.prohibitedModels
+      prohibitedModels: cached2.prohibitedModels,
+      // NAMED for the same reason as the line above, and it is the same defect
+      // if it is not: `...local` above spreads the DEVICE's bundle, so a field
+      // only the cache carries is dropped in silence. That is what left
+      // `prohibitedModels` inert on every attached device with every test
+      // around it green.
+      //
+      // Taken from the cache rather than merged here, because merging it needs
+      // the device's own SETTING — which is not a bundle field and is not in
+      // scope at this seam. The runtime does that merge, raise-only, where both
+      // values are in hand (createPluginRuntime's ensureInitialized).
+      redactFallback: cached2.redactFallback
       // ALSO HONOURED FROM THE CACHE, and not a bundle field at all: each
       // merged policy's own `provenance`. `mergeRaiseOnly` spreads the policies
       // it emits, so an 'authored' policy arriving from the control plane
@@ -39226,10 +40227,6 @@ function toolAuditEvent(input2) {
   };
 }
 
-// ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join23 } from "path";
-
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash6 } from "crypto";
 import { hostname as hostname5 } from "os";
@@ -39238,6 +40235,10 @@ import { hostname as hostname5 } from "os";
 var CORRELATION_ID = EventMetadata.shape.correlationId;
 var TRACE_ID = EventMetadata.shape.traceId;
 var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
+var REDACT_DEGRADED_TO = EventMetadata.shape.redactDegradedTo.unwrap();
+
+// ../../packages/plugin-runtime/src/attached/history-sync.ts
+var CAPTURE_BATCH_BYTES = 1024 * 1024;
 
 // ../../packages/plugin-runtime/src/attached/history-sync-trigger.ts
 import { spawn } from "child_process";
@@ -39245,7 +40246,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 var HISTORY_SYNC_THROTTLE_MS = 5 * 60 * 1e3;
 
 // ../../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 function createPluginBlock(build, policyStore) {
   return async () => {
     const cached2 = await policyStore.read();
@@ -39264,7 +40265,7 @@ function createPluginBlock(build, policyStore) {
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join27 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -39288,7 +40289,7 @@ async function publishByRename(tmp, file2, move = rename2) {
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 function createPolicyStore(dir = dataDir()) {
-  const file2 = join24(dir, "policy-cache.json");
+  const file2 = join27(dir, "policy-cache.json");
   async function read() {
     try {
       const raw = await readFile2(file2, "utf8");
@@ -39519,11 +40520,11 @@ function readStorePosture(dbPath2) {
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join28 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function createPostureStore(dir = settingsDir(), legacyDir) {
-  const file2 = join25(dir, "posture-state.json");
-  const legacyFile = legacyDir === void 0 ? null : join25(legacyDir, "posture-state.json");
+  const file2 = join28(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join28(legacyDir, "posture-state.json");
   async function persist(state) {
     await ensureDataDir(dir);
     const tmp = `${file2}.${randomUUID17()}.tmp`;
@@ -39591,8 +40592,8 @@ function createPostureStore(dir = settingsDir(), legacyDir) {
 }
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync18 } from "fs";
+import { join as join29 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {
@@ -39613,6 +40614,14 @@ import { spawn as spawn2 } from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
 
+// ../../packages/plugin-runtime/src/content-retention-pass.ts
+var MAX_ROWS_PER_SWEEP = 50 * 1e3;
+
+// ../../packages/plugin-runtime/src/content-retention-trigger.ts
+import { spawn as spawn3 } from "child_process";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var CONTENT_RETENTION_THROTTLE_MS = 60 * 60 * 1e3;
+
 // ../../packages/plugin-runtime/src/attached/factory.ts
 import { hostname as hostname6 } from "os";
 
@@ -40064,17 +41073,17 @@ var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync18, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join27 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync19, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
+import { join as join30 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join27(dataDir2, MARKER_FILE);
+  const path = join30(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync18(path, "utf8"));
+    const stored = JSON.parse(readFileSync19(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -40083,7 +41092,7 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   const marker = mintMarker();
   try {
     mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join27(dataDir2, `${MARKER_FILE}.tmp`);
+    const tmp = join30(dataDir2, `${MARKER_FILE}.tmp`);
     writeFileSync8(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
@@ -40136,6 +41145,68 @@ function userDisclosure(opts) {
   return sentences.join(" ");
 }
 
+// src/hooks/host-floor-notice.ts
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync5, rmSync as rmSync7, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join31 } from "path";
+var CLAIM_DIR = "host-floor-claims";
+var CLAIM_TTL_MS = 12 * 60 * 60 * 1e3;
+var CLAIM_SWEEP_MS = 7 * 24 * 60 * 60 * 1e3;
+function sweep(dir) {
+  try {
+    for (const name of readdirSync5(dir)) {
+      const path = join31(dir, name);
+      try {
+        if (Date.now() - statSync10(path).mtimeMs > CLAIM_SWEEP_MS) rmSync7(path, { force: true });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function tryClaim(dataDir2, sessionId) {
+  if (sessionId === void 0 || sessionId === "") return () => void 0;
+  const dir = join31(dataDir2, CLAIM_DIR);
+  const path = join31(dir, encodeURIComponent(sessionId));
+  try {
+    if (Date.now() - statSync10(path).mtimeMs < CLAIM_TTL_MS) return null;
+    rmSync7(path, { force: true });
+  } catch {
+  }
+  try {
+    mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
+    writeFileSync9(path, String(Date.now()), { flag: "wx", mode: DATA_FILE_MODE });
+  } catch (err) {
+    if (err.code === "EEXIST") return null;
+    return () => void 0;
+  }
+  sweep(dir);
+  return () => {
+    try {
+      rmSync7(path, { force: true });
+    } catch {
+    }
+  };
+}
+function warnIfHostBelowFloor(config2, sessionId, transcriptPath, write = (message) => void process.stderr.write(message)) {
+  try {
+    const release2 = tryClaim(config2.dataDir, sessionId);
+    if (release2 === null) return;
+    let settled = false;
+    try {
+      const version2 = hostVersionFromTranscript(transcriptPath);
+      if (version2 === void 0) return;
+      recordHostVersion(config2.dataDir, version2);
+      const notice = hostFloorNotice(version2);
+      if (notice !== null) write(`[aka] ${notice}
+`);
+      settled = true;
+    } finally {
+      if (!settled) release2();
+    }
+  } catch {
+  }
+}
+
 // src/present.ts
 var SHADE = {
   light: "\u2591",
@@ -40389,8 +41460,8 @@ function baseMetadata(input2) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname6, join as join28 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname6, join as join32 } from "path";
 var STORE_REDIRECT_MARKER = "store-redirect-last-session";
 function markerDirs(dataDir2) {
   return [dataDir2, dirname6(dataDir2)];
@@ -40398,7 +41469,7 @@ function markerDirs(dataDir2) {
 function alreadyClaimed(dirs, marker, sessionId) {
   return dirs.some((dir) => {
     try {
-      return readFileSync19(join28(dir, marker), "utf8") === sessionId;
+      return readFileSync20(join32(dir, marker), "utf8") === sessionId;
     } catch {
       return false;
     }
@@ -40407,8 +41478,8 @@ function alreadyClaimed(dirs, marker, sessionId) {
 function recordClaim(dirs, marker, sessionId) {
   for (const dir of dirs) {
     try {
-      mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
-      writeFileSync9(join28(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      mkdirSync7(dir, { recursive: true, mode: DATA_DIR_MODE });
+      writeFileSync10(join32(dir, marker), sessionId, { mode: DATA_FILE_MODE });
       return;
     } catch {
     }
@@ -40467,6 +41538,7 @@ async function main() {
   if (filePath) metadata.filePath = filePath;
   const config2 = loadConfig();
   warnIfStoreRedirected(config2, getString(input2, "session_id"));
+  warnIfHostBelowFloor(config2, getString(input2, "session_id"), getString(input2, "transcript_path"));
   const gateway = resolveDataGateway(config2);
   const runtime = createPluginRuntime(gateway, config2.settings, { dataDir: config2.dataDir });
   const vaultGlue = isVaultConsentValid(config2.settings.vaultConsent) ? createVaultGlue() : null;