@akasecurity/ai-tc-claude-code 0.9.11 → 0.9.13

package/scripts/history-sync.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH2 = "/";
+    var SLASH3 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH2).filter(Boolean);
+        const slices = path.split(SLASH3).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH2) + SLASH2,
+            slices.join(SLASH3) + SLASH3,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH2).filter(Boolean);
+          slices = path.split(SLASH3).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH2) + SLASH2,
+          slices.join(SLASH3) + SLASH3,
           cache,
           checkUnignored,
           slices
@@ -502,6 +502,14 @@ var ATTACHED_HISTORY_SYNC_STATE_FILENAME = "attached-history-sync.json";
 import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync3, statSync } from "fs";
 import { join as join2 } from "path";
 
+// ../../packages/schema/src/drizzle/deferred-migrations.ts
+var DEFERRED_MIGRATION_TAGS = [
+  "0031_audit_capture_by_time_index",
+  "0032_audit_capture_by_id_index",
+  "0033_audit_capture_location_index",
+  "0034_findings_read_indexes"
+];
+
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
   {
@@ -619,6 +627,30 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0028_activity_session_probe_indexes",
     sql: "CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--> statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--> statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"
+  },
+  {
+    tag: "0029_audit_capture_rollup_index",
+    sql: "CREATE INDEX `idx_audit_capture_rollup` ON `audit_events` (`event_type`,`started_at`,`repo`,`id`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0030_audit_content_expiry",
+    sql: "ALTER TABLE `audit_events` ADD `content_expired_at` integer;--> statement-breakpoint\nCREATE INDEX `idx_audit_expirable_body` ON `audit_events` (`started_at`) WHERE content IS NOT NULL;"
+  },
+  {
+    tag: "0031_audit_capture_by_time_index",
+    sql: "CREATE INDEX `idx_audit_capture_by_time` ON `audit_events` (`started_at`,`id`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0032_audit_capture_by_id_index",
+    sql: "CREATE INDEX `idx_audit_capture_by_id` ON `audit_events` (`id`,`started_at`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0033_audit_capture_location_index",
+    sql: "CREATE INDEX `idx_audit_capture_location` ON `audit_events` (`repo`,`file_path`,`started_at`,`id`,`event_type`) WHERE event_type IN ('prompt','response','code_change','tool_use');"
+  },
+  {
+    tag: "0034_findings_read_indexes",
+    sql: "CREATE INDEX `idx_inspection_definitions_rule` ON `inspection_definitions` (`rule_id`,`severity`,`category`);--> statement-breakpoint\nCREATE INDEX `idx_inspection_findings_def` ON `inspection_findings` (`inspection_definition_id`,`audit_event_id`);--> statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event_cover` ON `inspection_findings` (`audit_event_id`,`inspection_definition_id`,`action_taken`,`finding_key`,`id`);"
   }
 ];
 
@@ -20446,7 +20478,17 @@ var UNPRICEABLE_PROVIDERS = Object.freeze([
   "gateway",
   "unknown",
   "cli",
-  "api"
+  "api",
+  // The browser extension's native host records these as `llm_call.provider`
+  // for a web-chat turn — the web tool id, deliberately never the vendor id
+  // (`openai`/`anthropic`) the session root carries. Subscription traffic
+  // burns rate-limit budget, not dollar credits, and listing them here is
+  // what keeps that true structurally: a later maintainer who wants to price
+  // web-chat traffic at API rates has to delete this entry first, and meet
+  // the reason on the way, rather than quietly adding one to
+  // PROVIDER_PLATFORM.
+  "chatgpt",
+  "claude-ai"
 ]);
 function platformForProvider(provider) {
   return PROVIDER_PLATFORM.get(provider.trim().toLowerCase()) ?? null;
@@ -20589,7 +20631,12 @@ var HARNESS = {
   ClaudeDesktop: "claudedesktop",
   ChatGpt: "chatgpt",
   ClaudeAi: "claudeai",
-  Api: "api"
+  Api: "api",
+  // Not a coding assistant a person drives — an in-process SDK embedded in an
+  // application, so it has no IDE/CLI/desktop/web surface of its own. Carries
+  // the same id as its SOURCE_TOOL counterpart, unlike every capture-side tool
+  // whose wire spelling differs from its display spelling.
+  AiTcSdk: "ai-tc-sdk"
 };
 var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
 var SOURCE_TOOL = {
@@ -20605,9 +20652,15 @@ var SOURCE_TOOL = {
   // whose tool could not be identified both render through the read side's
   // miss path rather than as a harness of their own.
   Cli: "cli",
-  Unknown: "unknown"
+  Unknown: "unknown",
+  // The wire id an in-process, request-path SDK stamps on its own structural
+  // rows (`request_decision`) — never a capture of prompt/response/tool text,
+  // since the SDK sits in front of a model call rather than inside a coding
+  // assistant's own hook contract.
+  AiTcSdk: "ai-tc-sdk"
 };
 var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var WebSourceTool = SourceTool.extract(["ChatGpt", "ClaudeAi"]);
 var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
   [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
@@ -20616,7 +20669,12 @@ var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
   [SOURCE_TOOL.Codex]: HARNESS.Codex,
   [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
-  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi,
+  // Wire and display id are the same string here, but the row still belongs:
+  // both vocabularies carry the `AiTcSdk` member, and the join is exactly
+  // their intersection — leaving a shared member out would read as an
+  // uninstrumented tool on both surfaces, which this one is not.
+  [SOURCE_TOOL.AiTcSdk]: HARNESS.AiTcSdk
 };
 
 // ../../packages/schema/src/zod/finding.ts
@@ -20650,7 +20708,8 @@ var FindingProvider = Harness.extract([
   "ClaudeAi",
   "Codex",
   "Antigravity",
-  "Api"
+  "Api",
+  "AiTcSdk"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
@@ -20666,6 +20725,15 @@ var FindingCategory = external_exports.enum([
 ]).meta({ id: "FindingCategory" });
 var FindingOrigin = external_exports.enum(["in-flight", "at-rest"]).meta({ id: "FindingOrigin" });
 var FindingStatus = external_exports.enum(["open", "handled", "resolved", "dismissed"]).meta({ id: "FindingStatus" });
+var SyncFailureReason = external_exports.enum(["deployment_refused", "payload_invalid", "detached_undelivered"]).meta({ id: "SyncFailureReason" });
+var FindingDeliveryState = external_exports.enum(["sent", "queued", "not_sent", "never_offered", "local_scan"]).meta({ id: "FindingDeliveryState" });
+var FindingDelivery = external_exports.object({
+  state: FindingDeliveryState,
+  // The delivery time for `sent`; the failure time for `not_sent` when recorded.
+  at: external_exports.iso.datetime().optional(),
+  // Only on `not_sent`, and only when a known reason was recorded.
+  reason: SyncFailureReason.optional()
+}).meta({ id: "FindingDelivery" });
 var ResolutionMethod = external_exports.enum([
   "enforced-in-flight",
   "fixed-at-source",
@@ -20722,7 +20790,10 @@ var FindingInstance = external_exports.object({
   // The session that event belongs to, when it has one — the seam a
   // per-instance "view session" link needs. Absent for events captured
   // outside a session.
-  sessionId: external_exports.string().optional()
+  sessionId: external_exports.string().optional(),
+  // The delivery state of the event above (see FindingDelivery). Optional so
+  // readers that do not project it stay valid.
+  delivery: FindingDelivery.optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -20774,7 +20845,10 @@ var FindingFacets = external_exports.object({
   // Host tool (attributes.tool_name). Present only on the instance-level
   // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
-  tool: external_exports.array(FindingFacetItem).optional()
+  tool: external_exports.array(FindingFacetItem).optional(),
+  // Delivery states (FindingDeliveryState). Present only on the
+  // instance-level reads, like `tool`.
+  deployment: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
   id: "FindingTypeSummary"
@@ -20885,6 +20959,8 @@ var ListFindingInstancesQuery = external_exports.object({
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   // Exact repository / file-path matches, for the drill-down out of the
   // locations view. A row whose event carries no repo/file matches neither.
   repo: external_exports.string().optional(),
@@ -20905,6 +20981,10 @@ var ListFindingInstancesResponse = external_exports.object({
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
+var ListFindingInstancesPage = external_exports.object({
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesPage" });
 var FindingLocationSummary = external_exports.object({
   // Opaque, stable, minted from the pair by encodeLocationId. It exists
   // because a location's identity is two values and a URL param carries one:
@@ -20947,6 +21027,8 @@ var ListFindingLocationsQuery = external_exports.object({
   // instances that match, and folds its status from those.
   status: external_exports.array(FindingStatus).optional(),
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
@@ -21004,18 +21086,41 @@ var AuditEventType = external_exports.enum([
   // 'tool_call' is the reconciler's structural row for every call, while
   // 'tool_use' exists only where a hook enforced against the arguments.
   "tool_use",
-  // One row per model REFUSAL: a switch onto a prohibited model that was
-  // denied, or a turn refused because the session was already running on one.
-  // A structural row like the ones above rather than a capture — it carries
-  // the model that was refused and nothing the user typed, because what is
-  // worth recording about a governance decision is the decision, and prompt
-  // text is the thing this product exists to keep from travelling.
+  // One row per model REFUSAL, across all four seams a prohibited model can be
+  // stopped at: a switch onto it, a turn already running on it, a subagent
+  // spawn asking for it, or a request-path refusal an embedded request-path
+  // SDK makes in-process before the call leaves the application. Which seam
+  // rides `attributes.refusal_seam`, never this member name. A structural row
+  // like the ones above rather than a capture — it carries the model that was
+  // refused and nothing the user typed, because what is worth recording about
+  // a governance decision is the decision, and prompt text is the thing this
+  // product exists to keep from travelling.
   "model_refusal",
+  // One row per request-path DECISION: a policy check an embedded request-path
+  // SDK performs in-process before a model call leaves the application, or
+  // against that call's non-streamed response. A structural row like
+  // 'model_refusal' rather than a capture — content-free in the same way:
+  // which side, which seam, what action and which field are decided rides
+  // `attributes`, never this member name, and the matched text itself never
+  // travels.
+  //
+  // A prohibited-model refusal on the request path is deliberately NOT this
+  // member: it stays 'model_refusal' with `refusal_seam: 'request'`, so it
+  // shares one bucket with the plugin's switch/turn/spawn refusals rather
+  // than splitting one governance concept across two event types. This
+  // member carries every OTHER request-path decision.
+  "request_decision",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
   // surface renders.
-  "config_scan"
+  "config_scan",
+  // One row per reported browser-extension capture status, hung off the web
+  // session root. The durable home of what one tab's network interception
+  // is doing — a write-through of the native host's in-memory tracker, so a
+  // second process (aka extension status) and a restarted host both have
+  // somewhere to read it back from.
+  "capture_status"
 ]).meta({ id: "AuditEventType" });
 var AttributeBag = external_exports.record(external_exports.string(), external_exports.unknown());
 var HostAttributes = external_exports.object({
@@ -21149,6 +21254,10 @@ var CaptureAttributes = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass.
   exception_ids: external_exports.array(external_exports.guid()).optional(),
+  // The persisted spellings of EventMetadata's messageId/conversationId — the
+  // join back to the `llm_call` leaf for the same assistant turn.
+  message_id: external_exports.string().optional(),
+  conversation_id: external_exports.string().optional(),
   // Whole milliseconds this capture's inspection blocked its caller — the
   // plugin's own added latency (see EventMetadata.inspectionMs, whose value
   // this is). Promoted to the `inspection_ms` generated column so the facet is
@@ -21157,7 +21266,33 @@ var CaptureAttributes = external_exports.object({
   // inline json_extract and is not itself an optimization.
   // ABSENT on replayed captures (backfill / worktree scan) and on rows written
   // before the measurement shipped — never present as a placeholder 0.
-  inspection_ms: external_exports.number().int().nonnegative().optional()
+  inspection_ms: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture could not carry out became instead (see
+  // EventMetadata.redactDegradedTo, whose value this is). Present only when a
+  // degrade actually happened, so absence is the ordinary case rather than a
+  // reader having to distinguish it from a zero.
+  //
+  // PER CAPTURE, while `inspection_findings.action_taken` is per finding —
+  // so on a multi-finding row this does not say which finding degraded, and
+  // its presence does not mean the fallback decided the capture's action. A
+  // capture denied by another finding's own Block policy carries `block`
+  // here too. The full statement is on EventMetadata.redactDegradedTo; it is
+  // repeated rather than referenced because a store reader opens this file.
+  redact_degraded_to: ActionTaken.optional()
+}).catchall(external_exports.unknown());
+var CaptureStatusAttributes = external_exports.object({
+  source_tool: external_exports.string().optional(),
+  patched: external_exports.boolean().optional(),
+  live: external_exports.boolean().optional(),
+  blind: external_exports.boolean().optional(),
+  sends_seen_dom: external_exports.number().int().nonnegative().optional(),
+  exchanges_seen_net: external_exports.number().int().nonnegative().optional(),
+  parse_failures: external_exports.number().int().nonnegative().optional(),
+  unparsed_bodies: external_exports.number().int().nonnegative().optional(),
+  shape_misses: external_exports.array(external_exports.string()).optional(),
+  conversation_endpoints: external_exports.number().int().nonnegative().optional(),
+  closed: external_exports.boolean().optional(),
+  enforcement: external_exports.string().optional()
 }).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
@@ -21356,7 +21491,17 @@ var AuditEvent = external_exports.object({
   /** `share` to a first-party/internal destination. */
   internal: external_exports.boolean(),
   /** Event needs review (e.g. unverified egress). */
-  flagged: external_exports.boolean()
+  flagged: external_exports.boolean(),
+  /**
+   * The body this event's `title` is drawn from was cleared by local body
+   * expiry, so an EMPTY title here means "gone", not "never had one".
+   *
+   * A separate flag rather than a sentinel written into `title`: the title is
+   * rendered text, and a store-layer module that invented display copy for it
+   * would be choosing words the view is supposed to choose. Additive and
+   * defaulted, so an older producer still validates.
+   */
+  bodyExpired: external_exports.boolean().default(false)
 }).meta({ id: "ActivityAuditEvent" });
 var ActivitySessionSummary = external_exports.object({
   id: external_exports.string(),
@@ -22008,6 +22153,30 @@ var AttachedCredential = external_exports.object({
   keyPrefix: external_exports.string().min(1).max(16).optional(),
   mintedAt: external_exports.iso.datetime().optional()
 });
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function unsafeEndpointReason(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return "unparseable";
+  }
+  if (parsed2.username !== "" || parsed2.password !== "") return "userinfo";
+  if (parsed2.search !== "" || parsed2.hash !== "") return "query-or-fragment";
+  if (parsed2.protocol === "https:") return null;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname) ? null : "insecure";
+}
+function isSafeEndpoint(endpoint) {
+  return unsafeEndpointReason(endpoint) === null;
+}
+function originOnly(endpoint) {
+  try {
+    const parsed2 = new URL(endpoint);
+    return `${parsed2.protocol}//${parsed2.host}`;
+  } catch {
+    return "(unparseable endpoint)";
+  }
+}
 var MAX_DATE_MS = 253402300799999;
 var MAX_INT4 = 2147483647;
 var StorePosturePack = external_exports.object({
@@ -22162,6 +22331,11 @@ var RemoteFailureKind = external_exports.enum([
   "rejected",
   "unreachable"
 ]);
+var ControlPlaneFailure = RemoteFailureKind.extract([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22697,6 +22871,17 @@ var EventMetadata = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass. Absent on captures where no exception applied.
   exceptionIds: external_exports.array(external_exports.guid()).optional(),
+  // The assistant message this capture belongs to, and the conversation it sits
+  // in — set by the browser extension's network capture so a stored `response`
+  // row can be joined to the `llm_call` leaf describing the same turn. Absent
+  // on every other capture path, which has no such id.
+  //
+  // Non-empty for the reason WebExchange.messageId is: it is the join key, and
+  // a blank one matches no `llm_call` leaf. That refusal reaches only the
+  // places an event is PARSED; the local write path types the event and parses
+  // nothing, which is why `toCaptureAttributes` omits a blank one separately.
+  messageId: external_exports.string().min(1).optional(),
+  conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
   // front of. Measured inside `capture()` (@akasecurity/plugin-sdk) across
@@ -22709,7 +22894,37 @@ var EventMetadata = external_exports.object({
   // Absent is also what every pre-measurement client writes, and what a
   // clock failure degrades to — a reader must treat absence as "not measured"
   // and never as a zero, which would read as "inspection is free".
-  inspectionMs: external_exports.number().int().nonnegative().optional()
+  inspectionMs: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture COULD NOT CARRY OUT became instead — the
+  // workspace's `redactFallback`, applied because the field could not be
+  // masked in place (a shell command, a URL, or any argument on a host whose
+  // hook contract offers no rewrite channel).
+  //
+  // It exists because the action alone cannot say why. A finding recorded as
+  // `warn` reads identically whether its detection was ASSIGNED Warn or was
+  // assigned Redact on a field that could not take one — and those are
+  // different facts about the same row: the first is a policy the user chose,
+  // the second is a masking the host could not perform. Absent means no
+  // degrade happened, which is every ordinary capture.
+  //
+  // TWO LIMITS a reader of a stored row has to know, because the grain here
+  // is the CAPTURE while `actionTaken` is per FINDING:
+  //
+  //   - It does not say WHICH finding degraded. A capture carrying a degraded
+  //     `redact` alongside a finding ASSIGNED the same action stores both
+  //     identically and one reason for the pair; attributing it to both
+  //     describes the assigned one wrongly, and to neither loses the degrade.
+  //   - PRESENCE IS NOT CAUSATION. The value is the action the lost redact
+  //     became, not the reason the capture ended as it did — a capture denied
+  //     by some other finding's own Block policy still carries `block` here,
+  //     and clearing the workspace's fallback would not have let it through.
+  //     Gate on the value against what a fallback can produce; never read the
+  //     field's presence as "this was the fallback's doing".
+  //
+  // Both are pinned as behaviour in @akasecurity/plugin-sdk's runtime suite.
+  // Closing either means moving the reason onto the finding row, which
+  // already carries its own action.
+  redactDegradedTo: ActionTaken.optional()
 }).meta({ id: "EventMetadata" });
 var Event = external_exports.object({
   id: external_exports.guid(),
@@ -22819,7 +23034,32 @@ var RotateKeyInput = external_exports.object({
   confirmation: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/finding-delivery.ts
+var KNOWN_REASONS = SyncFailureReason.options;
+function knownReason(value) {
+  return value !== null && KNOWN_REASONS.includes(value) ? value : void 0;
+}
+function deriveFindingDelivery(row) {
+  if (row.kind === "code_change") return { state: "local_scan" };
+  if (row.syncedAt !== null && row.syncedAt > 0) {
+    return { state: "sent", at: epochMillisToIso(row.syncedAt) };
+  }
+  if (row.syncedAt !== null) {
+    const reason = knownReason(row.syncFailure);
+    return {
+      state: "not_sent",
+      ...row.syncFailedAt === null ? {} : { at: epochMillisToIso(row.syncFailedAt) },
+      ...reason === void 0 ? {} : { reason }
+    };
+  }
+  if (row.outboxOwed === 1 || row.syncClaimedAt !== null) return { state: "queued" };
+  return { state: "never_offered" };
+}
+
 // ../../packages/schema/src/zod/findings-group-build.ts
+function lookupOwn(map2, key) {
+  return Object.hasOwn(map2, key) ? map2[key] : void 0;
+}
 function toApiAction(dbVal) {
   const map2 = {
     log: "monitored",
@@ -22828,7 +23068,7 @@ function toApiAction(dbVal) {
     warn: "warned",
     allow: "allowed"
   };
-  return map2[dbVal] ?? "allowed";
+  return lookupOwn(map2, dbVal) ?? "allowed";
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
@@ -22836,13 +23076,18 @@ function toApiCategory(dbVal) {
   return parsed2.success ? parsed2.data : "custom";
 }
 function toApiProvider(sourceTool) {
-  return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
+  return lookupOwn(TOOL_TO_HARNESS, sourceTool) ?? HARNESS.Api;
 }
-var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
+var FINDING_STATUS_PRECEDENCE = [
+  "open",
+  "handled",
+  "dismissed",
+  "resolved"
+];
 function foldGroupStatus(instanceStatuses) {
   const statuses = new Set(instanceStatuses.filter((s) => s !== void 0));
   if (statuses.size === 0) return void 0;
-  for (const candidate of STATUS_PRECEDENCE) {
+  for (const candidate of FINDING_STATUS_PRECEDENCE) {
     if (statuses.has(candidate)) return candidate;
   }
   return void 0;
@@ -22949,11 +23194,16 @@ function applyFindingFilters(types, opts) {
   }
   return filtered;
 }
-var SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
-var SEVERITY_RANK = SEVERITY_ORDER;
+function rankByOrder(members2) {
+  return Object.fromEntries(members2.map((member, index) => [member, index]));
+}
+var SEVERITY_RANK = rankByOrder(Severity.options);
+function severityRank(severity) {
+  return lookupOwn(SEVERITY_RANK, severity);
+}
 function compareFindingGroupOrder(a, b) {
-  const rankA = SEVERITY_RANK[a.severity] ?? -1;
-  const rankB = SEVERITY_RANK[b.severity] ?? -1;
+  const rankA = severityRank(a.severity) ?? -1;
+  const rankB = severityRank(b.severity) ?? -1;
   const severityDiff = rankA - rankB;
   if (severityDiff !== 0) return severityDiff;
   const recencyDiff = b.latestDetectedAt.localeCompare(a.latestDetectedAt);
@@ -23028,6 +23278,20 @@ function computeFindingFacets(allTypes, opts) {
 }
 
 // ../../packages/schema/src/zod/findings-flat-build.ts
+function compareCodePoints(a, b) {
+  const aIter = a[Symbol.iterator]();
+  const bIter = b[Symbol.iterator]();
+  for (; ; ) {
+    const aNext = aIter.next();
+    const bNext = bIter.next();
+    if (aNext.done && bNext.done) return 0;
+    if (aNext.done) return -1;
+    if (bNext.done) return 1;
+    const aPoint = aNext.value.codePointAt(0) ?? 0;
+    const bPoint = bNext.value.codePointAt(0) ?? 0;
+    if (aPoint !== bPoint) return aPoint - bPoint;
+  }
+}
 function rowHaystack(row) {
   return [
     row.ruleId,
@@ -23052,6 +23316,8 @@ function matchesDimension(row, opts, dimension) {
       return !opts.actions?.length || opts.actions.includes(toApiAction(row.actionTaken));
     case "statuses":
       return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
+    case "deliveries":
+      return !opts.deliveries?.length || row.delivery !== void 0 && opts.deliveries.includes(row.delivery.state);
     case "tools":
       return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
     // An EMPTY value is a real filter here, not an absent one. The location
@@ -23078,6 +23344,7 @@ var DIMENSIONS = [
   "providers",
   "actions",
   "statuses",
+  "deliveries",
   "tools",
   "repo",
   "file",
@@ -23091,10 +23358,19 @@ function matchesInstanceFilters(row, opts, except) {
   return true;
 }
 function toItems(counts) {
-  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value));
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort(
+    (a, b) => b.count - a.count || a.value.localeCompare(b.value) || // localeCompare reports canonically-equivalent strings (an NFC and an
+    // NFD spelling of the same text) as equal, so a count tie between
+    // them would otherwise be ordered by whichever the Map iteration
+    // produced. compareCodePoints breaks that tie deterministically, which
+    // makes this a TOTAL order — not one that agrees with SQL collation,
+    // which it need not: foldFacetTuples runs this same sort over grouped
+    // tuples, so both paths order facets identically by construction.
+    compareCodePoints(a.value, b.value)
+  );
 }
-function bump(counts, value) {
-  counts.set(value, (counts.get(value) ?? 0) + 1);
+function bump(counts, value, by = 1) {
+  counts.set(value, (counts.get(value) ?? 0) + by);
 }
 function createInstanceFacetAccumulator(opts) {
   const severity = /* @__PURE__ */ new Map();
@@ -23103,6 +23379,7 @@ function createInstanceFacetAccumulator(opts) {
   const action = /* @__PURE__ */ new Map();
   const status = /* @__PURE__ */ new Map();
   const tool = /* @__PURE__ */ new Map();
+  const deployment = /* @__PURE__ */ new Map();
   return {
     add(row) {
       if (matchesInstanceFilters(row, opts, "severity")) bump(severity, row.severity);
@@ -23117,6 +23394,9 @@ function createInstanceFacetAccumulator(opts) {
       if (row.toolName !== void 0 && matchesInstanceFilters(row, opts, "tools")) {
         bump(tool, row.toolName);
       }
+      if (row.delivery !== void 0 && matchesInstanceFilters(row, opts, "deliveries")) {
+        bump(deployment, row.delivery.state);
+      }
     },
     facets: () => ({
       severity: toItems(severity),
@@ -23124,7 +23404,8 @@ function createInstanceFacetAccumulator(opts) {
       provider: toItems(provider),
       action: toItems(action),
       status: toItems(status),
-      tool: toItems(tool)
+      tool: toItems(tool),
+      deployment: toItems(deployment)
     })
   };
 }
@@ -23138,6 +23419,7 @@ function toInstanceDetail(row) {
     ...row.toolName === void 0 ? {} : { toolName: row.toolName },
     eventId: row.eventId,
     ...row.sessionId === void 0 ? {} : { sessionId: row.sessionId },
+    ...row.delivery === void 0 ? {} : { delivery: row.delivery },
     ...row.user === void 0 ? {} : { user: row.user },
     action: toApiAction(row.actionTaken),
     detectedAt: row.occurredAt,
@@ -23152,12 +23434,6 @@ function toInstanceDetail(row) {
     policy: { id: `category:${category}`, name: category }
   };
 }
-var SEVERITY_ORDER2 = {
-  critical: 0,
-  high: 1,
-  medium: 2,
-  low: 3
-};
 function newLocationAccumulator() {
   return {
     instanceCount: 0,
@@ -23172,7 +23448,7 @@ function newLocationAccumulator() {
 }
 function addToLocation(acc, row) {
   acc.instanceCount += 1;
-  const rank = SEVERITY_ORDER2[row.severity] ?? Number.MAX_SAFE_INTEGER - 1;
+  const rank = severityRank(row.severity) ?? Number.MAX_SAFE_INTEGER - 1;
   if (rank < acc.maxSeverityRank) {
     acc.maxSeverityRank = rank;
     acc.maxSeverity = row.severity;
@@ -23182,15 +23458,15 @@ function addToLocation(acc, row) {
   acc.ruleIds.add(row.ruleId);
 }
 function compareLocationOrder(a, b) {
-  const rankA = SEVERITY_ORDER2[a.maxSeverity] ?? -1;
-  const rankB = SEVERITY_ORDER2[b.maxSeverity] ?? -1;
+  const rankA = severityRank(a.maxSeverity) ?? -1;
+  const rankB = severityRank(b.maxSeverity) ?? -1;
   if (rankA !== rankB) return rankA - rankB;
   if (a.latestDetectedAt !== b.latestDetectedAt) {
     return a.latestDetectedAt < b.latestDetectedAt ? 1 : -1;
   }
-  if (a.repo !== b.repo) return a.repo < b.repo ? -1 : 1;
-  if (a.file !== b.file) return a.file < b.file ? -1 : 1;
-  return 0;
+  const repoDiff = compareCodePoints(a.repo, b.repo);
+  if (repoDiff !== 0) return repoDiff;
+  return compareCodePoints(a.file, b.file);
 }
 function encodeLocationId(repo, file2) {
   return `${encodePart(repo)}/${encodePart(file2)}`;
@@ -23265,6 +23541,11 @@ var Policy = external_exports.object({
   // test `prohibitedModels` passes and `reversibleRuleIds` fails.
   provenance: PolicyProvenance.optional()
 }).meta({ id: "Policy" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
 var PolicyBundle = external_exports.object({
   version: external_exports.string(),
   policies: external_exports.array(Policy),
@@ -23312,6 +23593,16 @@ var PolicyBundle = external_exports.object({
   // control plane), so no name resolution stands between the decision and the
   // comparison.
   prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  // What a resolved `redact` becomes on a field the host cannot rewrite, as
+  // the ORGANIZATION would have it. Merged raise-only against the device's own
+  // `WorkspaceSettings.redactFallback` (see strongerRedactFallback below), so
+  // a control plane can tighten a machine and never loosen one — the same
+  // direction `mergeRaiseOnly` enforces for policies.
+  //
+  // Optional so an older backend, and an older on-disk cache, still parses;
+  // absent leaves the device's own setting in force, which is the behaviour
+  // that predates the field and the safe direction to default.
+  redactFallback: RedactFallback.optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -23341,11 +23632,6 @@ function severityFloorPolicy(category) {
   const peak = CATEGORY_PEAK_SEVERITY[category];
   return peak === "critical" || peak === "high" ? "warn" : "monitor";
 }
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
-  id: "RedactFallback"
-});
 var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
 var BUILTIN_POLICY_SPECS = {
   monitor: {
@@ -23638,7 +23924,7 @@ var VaultConsent = external_exports.object({
 });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 8;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var HISTORY_SYNC_PAYLOAD_VERSION = 3;
 var RunMode = external_exports.enum(["standalone", "attached"]);
@@ -23663,6 +23949,27 @@ function isHistorySyncConsentValid(consent, endpoint) {
   if (consent === void 0 || endpoint === void 0) return false;
   return consent.payloadVersion === HISTORY_SYNC_PAYLOAD_VERSION && consent.endpoint === endpoint;
 }
+var WebChatCaptureConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+var WebChatResponseCapture = external_exports.enum(["with-findings", "always", "never"]);
+var WebChatCapture = external_exports.object({
+  responses: WebChatResponseCapture.default("with-findings"),
+  account: external_exports.boolean().default(false),
+  // Absent until granted. Presence alone does not authorize anything — see
+  // isWebChatCaptureConsentValid.
+  consent: WebChatCaptureConsent.optional()
+});
+var BODY_RETENTION_DEFAULT_DAYS = 30;
+var BodyRetention = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  // Never 0, and the ceiling is a fat-finger guard rather than a policy
+  // limit — `enabled` is the real gate. A low value cannot reach a row the
+  // sync ledger still owes: the sweep's age filter only ever NARROWS a
+  // candidate set that is already bounded by "delivered, or never owed".
+  retainDays: external_exports.number().int().min(1).max(3650).default(BODY_RETENTION_DEFAULT_DAYS)
+}).meta({ id: "BodyRetention" });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   runMode: RunMode.default("standalone"),
@@ -23711,7 +24018,23 @@ var WorkspaceSettings = external_exports.object({
   // carry prompt/reply/tool-output text in `content`; the key name predates
   // both widenings. Absent until granted, and a grant for a different endpoint
   // or an older payload no longer counts.
-  historySyncConsent: HistorySyncConsent.optional()
+  historySyncConsent: HistorySyncConsent.optional(),
+  // What the browser extension may record from a web chat, and the grant that
+  // authorizes it. Absent until the user answers: recording something that was
+  // never recorded before is never an assumed grant on upgrade, so the whole
+  // block is optional rather than defaulted in. What an absent block means is
+  // webChatCaptureOf's answer, in one place.
+  //
+  // Enforcement is NOT gated on this. A machine that has never answered still
+  // blocks, redacts and warns on what a user sends; the grant covers what is
+  // written down.
+  webChatCapture: WebChatCapture.optional(),
+  // Local body expiry (see BodyRetention). Off until switched on; expiring a
+  // body never removes the row or its findings.
+  bodyRetention: BodyRetention.default({
+    enabled: false,
+    retainDays: BODY_RETENTION_DEFAULT_DAYS
+  })
 });
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
@@ -23806,12 +24129,18 @@ function toCaptureAttributes(event) {
     ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
     ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
     ...metadata?.inspectionMs !== void 0 ? { inspection_ms: metadata.inspectionMs } : {},
+    ...metadata?.redactDegradedTo !== void 0 ? { redact_degraded_to: metadata.redactDegradedTo } : {},
     // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
     // has ever populated either), but every legacy metadata key still rides
     // the bag rather than being silently dropped — CaptureAttributes'
     // `.catchall(z.unknown())` carries the long tail.
     ...metadata?.model !== void 0 ? { model: metadata.model } : {},
-    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
+    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {},
+    // A blank id is omitted rather than stored: it is a join key and `''` joins
+    // nothing. This runs on the local write path, which types the event but
+    // never parses it, so EventMetadata's own `.min(1)` does not reach here.
+    ...metadata?.messageId !== void 0 && metadata.messageId !== "" ? { message_id: metadata.messageId } : {},
+    ...metadata?.conversationId !== void 0 ? { conversation_id: metadata.conversationId } : {}
   };
 }
 function captureDefinitionVersion(finding) {
@@ -23839,13 +24168,22 @@ var ManagedSettingKey = external_exports.enum([
   "vaultInlineReveal",
   "modelJudgeConsent",
   "dataSharesInPlace",
-  "redactFallback"
+  "redactFallback",
+  // Pins the toggle and the day count together — see BodyRetention on why the
+  // two are one unit. An administrator mandating a window wants the count
+  // enforced with it, not one a user can widen while the toggle stays on.
+  "bodyRetention"
 ]).meta({ id: "ManagedSettingKey" });
 function isManagedSettingKey(value) {
   return ManagedSettingKey.safeParse(value).success;
 }
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  // `controlPlane` and `bodyRetention` are the two nested values, and both are
+  // plain, non-strict objects: a key under either that this build does not know
+  // is stripped and nothing reports it. The unknown-value split in
+  // ManagedSettings below classifies top-level names only, so it stops at
+  // these boundaries.
   controlPlane: external_exports.object({
     endpoint: external_exports.string().min(1),
     label: external_exports.string().min(1).optional()
@@ -23856,7 +24194,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
   dataSharesInPlace: external_exports.boolean().optional(),
-  redactFallback: RedactFallback.optional()
+  redactFallback: RedactFallback.optional(),
+  bodyRetention: BodyRetention.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -23864,7 +24203,21 @@ var ManagedSettings = external_exports.object({
   // decision from a bug. Absent renders as a generic "your organization".
   organization: external_exports.string().min(1).optional(),
   // What the administrator pinned.
-  values: ManagedSettingsValues.default({}),
+  //
+  // Parsed as a RECORD rather than as the nested schema, and split below for
+  // the same reason `lockedFields` is parsed as names: a plain `z.object`
+  // drops an unrecognised key and succeeds, so a pin this build does not know
+  // vanished and nothing anywhere said so. A pin with no lock is a supported
+  // shape — it is a DEFAULT the user may still change — so that silence hit
+  // exactly the file an administrator is most likely to write while a fleet
+  // is mid-upgrade.
+  //
+  // Splitting here rather than calling `.strict()`: strict would REFUSE the
+  // file, which is the outcome the lock half already rejected — an older
+  // build then runs entirely unmanaged, every pin and lock gone. A bad KNOWN
+  // value still fails, because the nested schema is re-run over the known
+  // subset and its issues are re-raised on this parse.
+  values: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
@@ -23877,17 +24230,31 @@ var ManagedSettings = external_exports.object({
   // the fleets most likely to carry a version skew. A name outside the enum
   // is still never HONOURED: the lockable set stays explicit above.
   lockedFields: external_exports.array(external_exports.string()).default([])
-}).transform(({ lockedFields, ...rest }) => {
+}).transform(({ lockedFields, values, ...rest }, ctx) => {
   const known = [];
   const unknown2 = [];
   for (const name of lockedFields) {
     if (isManagedSettingKey(name)) known.push(name);
     else unknown2.push(name);
   }
+  const knownValues = /* @__PURE__ */ Object.create(null);
+  const unknownValues = [];
+  for (const [name, value] of Object.entries(values)) {
+    if (Object.hasOwn(ManagedSettingsValues.shape, name)) knownValues[name] = value;
+    else unknownValues.push(name);
+  }
+  const pinned = ManagedSettingsValues.safeParse(knownValues);
+  if (!pinned.success) {
+    for (const issue2 of pinned.error.issues)
+      ctx.addIssue({ ...issue2, path: ["values", ...issue2.path] });
+    return external_exports.NEVER;
+  }
   return {
     ...rest,
+    values: pinned.data,
     lockedFields: known,
-    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {}
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {},
+    ...unknownValues.length > 0 ? { unknownValueFields: unknownValues } : {}
   };
 }).meta({ id: "ManagedSettings" });
 
@@ -24146,12 +24513,30 @@ var RecommendedActionIdParam = external_exports.object({ id: external_exports.st
 // ../../packages/schema/src/zod/settings-action.ts
 var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
 var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
+var WebChatCaptureConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "WebChatCaptureConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
-  vaultInlineReveal: external_exports.string()
+  vaultInlineReveal: external_exports.string(),
+  webChatCaptureConsent: WebChatCaptureConsentChoice,
+  // Widened to `string` like its neighbours rather than typed as
+  // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
+  // the call site, so the domain check receives the type it was written for.
+  //
+  // NOT because a narrower schema would reject differently. `parseActionInput`
+  // is a `safeParse` wrapper and throws for no field schema, so either spelling
+  // reaches a recoverable `{ ok: false }` and there is no rejected promise to
+  // trade against. The real cost runs the other way and is the part worth
+  // knowing: a value this schema admits and the domain enum then rejects lands
+  // on the action's shared refusal, which names NO field, where a shape
+  // rejection reaches `malformedInput` and names the schema key.
+  redactFallback: external_exports.string(),
+  // Shape only, the way the enum fields above are strings only: the RANGE is
+  // `BodyRetention`'s and the action checks it there, so there is one place
+  // that decides what a legal horizon is rather than two that can drift.
+  bodyRetention: external_exports.object({ enabled: external_exports.boolean(), retainDays: external_exports.number() })
 });
 var AttachInput = external_exports.object({
   endpoint: external_exports.string(),
@@ -24323,6 +24708,123 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../../packages/schema/src/zod/web-capture.ts
+var WebUsageSource = external_exports.enum(["site", "estimated", "none"]);
+var WebUsage = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().optional(),
+  outputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheReadInputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheCreationInputTokens: external_exports.number().int().nonnegative().optional()
+});
+var WebToolCall = external_exports.object({
+  toolUseId: external_exports.string().min(1),
+  toolName: external_exports.string().min(1),
+  target: external_exports.string().optional(),
+  isError: external_exports.boolean().optional(),
+  inputSize: external_exports.number().int().nonnegative().optional(),
+  outputSize: external_exports.number().int().nonnegative().optional()
+});
+var WebExchange = external_exports.object({
+  messageId: external_exports.string().min(1),
+  startedAt: external_exports.iso.datetime(),
+  model: external_exports.string().optional(),
+  usage: WebUsage.optional(),
+  usageSource: WebUsageSource,
+  stopReason: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  toolCalls: external_exports.array(WebToolCall).default([]),
+  // Absent when the adapter recovered no text. Capped by the caller at
+  // RESPONSE_TEXT_MAX_BYTES, so a short capture is never mistaken for a short
+  // reply.
+  responseText: external_exports.string().optional(),
+  // The stored text is short of the reply. It does NOT say which of the two
+  // ceilings on this path cut it: the caller applies its own cap on the raw
+  // bytes it reads off the wire, which can be reached by a stream whose
+  // recovered text stays well under RESPONSE_TEXT_MAX_BYTES, and applies that
+  // one to the text. A reader cannot tell them apart, and nothing downstream
+  // should branch as though it could.
+  truncated: external_exports.boolean().default(false)
+});
+var WebEnforcementState = external_exports.enum([
+  "watching",
+  "composer-only",
+  "button-only",
+  "unattached",
+  "unknown"
+]);
+var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
+var WebCaptureStatus = external_exports.object({
+  patched: external_exports.boolean(),
+  live: external_exports.boolean(),
+  blind: external_exports.boolean(),
+  sendsSeenDom: external_exports.number().int().nonnegative(),
+  exchangesSeenNet: external_exports.number().int().nonnegative(),
+  parseFailures: external_exports.number().int().nonnegative(),
+  unparsedBodies: external_exports.number().int().nonnegative(),
+  // The adapter-declared JSON key paths that were absent from a real payload —
+  // the earliest signal that a site's contract moved.
+  shapeMisses: external_exports.array(external_exports.string()).default([]),
+  // How many `kind: 'conversation'` endpoints the reporting tab's adapter
+  // compiled. Zero means this build declares none for the site, so observing
+  // nothing is the design rather than a fault — the one fact that separates a
+  // site nobody has surveyed yet from one whose contract moved. Defaulted so a
+  // build predating the field is read as declaring nothing rather than refused.
+  conversationEndpoints: external_exports.number().int().nonnegative().default(0),
+  // The document that sent this report is going away. The bridge sets it on
+  // its `pagehide` report and nowhere else.
+  //
+  // A property of the REPORT rather than of capture health, which is why
+  // nothing in `deriveWebCaptureState` reads it and why it stays out of the
+  // bridge's own report signature — a closing tab's last word must not be
+  // suppressed for carrying the same health as the report before it. What
+  // reads it is the per-site fold: a document that said it was unloading stops
+  // voting on the site's state, so the reload the `blind` remediation asks for
+  // can actually clear the verdict it was shown. A document that dies without
+  // sending one is covered by CAPTURE_STATUS_DOCUMENT_QUIET_MS instead.
+  //
+  // Defaulted so a build predating the field reads as a document that never
+  // said it was closing — which keeps it voting, the same as every report that
+  // is not a final one.
+  closed: external_exports.boolean().default(false),
+  // What the DOM enforcement path is doing, which none of the counters above
+  // can say: `sendsSeenDom` rises only once a send has COMPLETED, so a tab
+  // whose watcher never bound reports zero exactly like a tab nobody typed in.
+  // Defaulted to 'unknown' rather than 'watching' so a status from a build
+  // predating the field is not read as reporting a healthy one.
+  enforcement: WebEnforcementState.default("unknown")
+});
+function webCaptureStatusObservedTurnPath(status) {
+  if (!status.patched) return true;
+  if (status.conversationEndpoints === 0) return true;
+  return status.blind || status.shapeMisses.length > 0 || status.parseFailures > 0 || status.unparsedBodies > 0 || status.exchangesSeenNet > 0;
+}
+function pickReportedCaptureStatus(candidates) {
+  return candidates.find((c) => webCaptureStatusObservedTurnPath(c.status)) ?? candidates[0];
+}
+var CAPTURE_STATUS_RECENCY_MS = 30 * 24 * 60 * 60 * 1e3;
+var CAPTURE_STATUS_RECENCY_DAYS = CAPTURE_STATUS_RECENCY_MS / (24 * 60 * 60 * 1e3);
+var CAPTURE_STATUS_DOCUMENT_QUIET_MS = 12 * 60 * 60 * 1e3;
+function fromCaptureStatusAttributes(bag) {
+  const parsedBag = CaptureStatusAttributes.safeParse(bag);
+  if (!parsedBag.success) return null;
+  const b = parsedBag.data;
+  const parsedStatus = WebCaptureStatus.safeParse({
+    patched: b.patched,
+    live: b.live,
+    blind: b.blind,
+    sendsSeenDom: b.sends_seen_dom,
+    exchangesSeenNet: b.exchanges_seen_net,
+    parseFailures: b.parse_failures,
+    unparsedBodies: b.unparsed_bodies,
+    shapeMisses: b.shape_misses,
+    conversationEndpoints: b.conversation_endpoints,
+    closed: b.closed,
+    enforcement: b.enforcement
+  });
+  return parsedStatus.success ? parsedStatus.data : null;
+}
+
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -24395,17 +24897,6 @@ function writeOwnerOnlyFileSync(file2, data) {
 function controlPlaneCredentialPath(settingsDir2) {
   return join2(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
 }
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-function isSafeEndpoint(endpoint) {
-  let parsed2;
-  try {
-    parsed2 = new URL(endpoint);
-  } catch {
-    return false;
-  }
-  if (parsed2.protocol === "https:") return true;
-  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
-}
 function repairOrRefuseMode(file2) {
   const link = lstatSync2(file2, { throwIfNoEntry: false });
   if (link === void 0) return "absent";
@@ -24611,6 +25102,22 @@ function discardStore(file2, backup) {
   }
 }
 
+// ../../packages/persistence/src/internal/sql-functions.ts
+var utf8 = new TextDecoder();
+function akaLower(value) {
+  if (value === null) return null;
+  if (typeof value === "string") return value.toLowerCase();
+  if (typeof value === "number" || typeof value === "bigint") return String(value).toLowerCase();
+  return utf8.decode(value).toLowerCase();
+}
+function registerSqlFunctions(db) {
+  db.function(
+    "aka_lower",
+    { deterministic: true, directOnly: true, useBigIntArguments: true },
+    akaLower
+  );
+}
+
 // ../../packages/persistence/src/internal/sql-text.ts
 function escapeLikePattern(s) {
   return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -24695,6 +25202,11 @@ function schemaObjectExists(db, kind, name) {
 function indexExists(db, name) {
   return schemaObjectExists(db, "index", name);
 }
+function indexColumns(db, name) {
+  if (!indexExists(db, name)) return [];
+  const columns = db.prepare(`PRAGMA index_info(${name})`).all();
+  return columns.map((c) => c.name).filter((c) => c !== null);
+}
 function columnNames(db, table, opts) {
   const pragma = opts?.includeGenerated ? "table_xinfo" : "table_info";
   const columns = db.prepare(`PRAGMA ${pragma}(${table})`).all();
@@ -24756,135 +25268,778 @@ function mapRowsTolerant(rows, map2) {
   return out;
 }
 
-// ../../packages/persistence/src/migrations.ts
-function describeObject(object2) {
-  return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
-}
-function splitStatements(sql) {
-  return sql.split(/-->\s*statement-breakpoint/).map((s) => s.trim()).filter((s) => s.length > 0);
-}
-function createdIndexName(statement) {
-  const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
-  return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
+// ../../packages/persistence/src/internal/outbox-lane.ts
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var OUTBOX_CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+
+// ../../packages/persistence/src/sync-failure.ts
+var SYNC_FAILURE_REASONS = SyncFailureReason.options;
+function syncFailureRejectCondition(column = "sync_failure") {
+  const members2 = SYNC_FAILURE_REASONS.map((r) => `'${r}'`).join(", ");
+  return `NEW.${column} IS NOT NULL AND NEW.${column} NOT IN (${members2})`;
 }
-var LEGACY_DROP_MIGRATION_TAG = "0014_drop_legacy_events_findings";
-function applyMigrations(db, file2) {
-  const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
-  db.exec(
-    "CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)"
-  );
-  const applied = new Set(
-    db.prepare("SELECT tag FROM migration_ledger").all().map((r) => r.tag)
-  );
-  const preLedgerStore = applied.size === 0 && legacyCount > 0;
-  const record2 = db.prepare(
-    "INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)"
-  );
-  for (const [index, migration] of SQLITE_MIGRATIONS.entries()) {
-    if (applied.has(migration.tag)) continue;
-    if (migration.tag === LEGACY_DROP_MIGRATION_TAG) continue;
-    const evidence = evidenceObjects(migration.sql);
-    const present = evidence.filter((o) => evidenceExists(db, o));
-    if (present.length > 0 && present.length < evidence.length) {
-      const missing = evidence.filter((o) => !present.includes(o));
-      const message = `sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
-      akaWarn(message);
-      throw new Error(`[aka] ${message}`);
-    }
-    const alreadyApplied = evidence.length > 0 ? present.length === evidence.length : preLedgerStore && index < legacyCount;
-    const wantsFkOff = /PRAGMA foreign_keys\s*=\s*OFF/i.test(migration.sql);
-    const statements = splitStatements(migration.sql);
-    if (wantsFkOff) db.exec("PRAGMA foreign_keys = OFF");
-    try {
-      withTransaction(
-        db,
-        () => {
-          for (const statement of statements) {
-            const indexName = createdIndexName(statement);
-            if (indexName === void 0) {
-              if (alreadyApplied) continue;
-            } else if (indexExists(db, indexName)) {
-              continue;
-            }
-            db.exec(statement);
-          }
-          if (wantsFkOff && !alreadyApplied) {
-            const violations = db.prepare("PRAGMA foreign_key_check").all();
-            if (violations.length > 0) {
-              throw new Error(
-                `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
-              );
-            }
-          }
-          record2.run(migration.tag, Date.now());
-        },
-        "IMMEDIATE"
-      );
-    } finally {
-      if (wantsFkOff) db.exec("PRAGMA foreign_keys = ON");
-    }
+
+// ../../packages/persistence/src/repositories/history-sync.ts
+var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
+var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_TYPE_LIST;
+var COUNTED_EVENT_TYPES = [
+  ...STRUCTURAL_EVENT_TYPES,
+  ...OUTBOX_CAPTURE_EVENT_TYPES
+];
+var COUNTED_TYPE_LIST = COUNTED_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var PARTITION_BUCKETS = `
+         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
+         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NOT NULL THEN 1 ELSE 0 END) AS inProgress,
+         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS synced,
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND sync_failure = 'deployment_refused' THEN 1 ELSE 0 END) AS refused,
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND sync_failure = 'detached_undelivered' THEN 1 ELSE 0 END) AS detached,
+         -- Spelled as what it INCLUDES rather than what it excludes, so a reason
+         -- added later lands in no bucket and fails the sum assertion, instead
+         -- of silently joining this one.
+         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0
+                       AND (sync_failure IS NULL OR sync_failure = 'payload_invalid')
+                  THEN 1 ELSE 0 END) AS failed,
+         COUNT(*) AS total`;
+var COUNTED_SCOPE = `
+       WHERE event_type IN (${COUNTED_TYPE_LIST})
+         AND (
+           event_type IN (${TYPE_LIST})
+           OR synced_at IS NOT NULL
+           OR outbox_owed = 1
+         )`;
+var SKIPPED = -1;
+var HISTORY_SYNC_LEASE_STALE_MS = 6e4;
+var ROW_COLUMNS = `id,
+   parent_id AS parentId,
+   root_session_id AS rootSessionId,
+   event_type AS eventType,
+   host_id AS hostId,
+   harness_id AS harnessId,
+   source_project_id AS sourceProjectId,
+   started_at AS startedAt,
+   ended_at AS endedAt,
+   severity,
+   priority,
+   content,
+   content_hash AS contentHash,
+   attributes`;
+var SqliteHistorySyncRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.ensureRowStmt = db.prepare(`INSERT OR IGNORE INTO history_sync (id) VALUES (1)`);
+    this.sessionsStmt = db.prepare(
+      `SELECT COALESCE(root_session_id, id) AS sessionId, MIN(started_at) AS earliest
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at < :before
+        GROUP BY sessionId
+        ORDER BY earliest
+        LIMIT :limit`
+    );
+    this.rowsStmt = db.prepare(
+      `SELECT ${ROW_COLUMNS}
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at < :before
+          AND COALESCE(root_session_id, id) = :sessionId
+        ORDER BY (event_type = 'session') DESC, started_at
+        LIMIT :limit`
+    );
+    this.captureRowsStmt = db.prepare(
+      `SELECT ${ROW_COLUMNS}
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND sync_claimed_at IS NULL
+          AND outbox_owed = 1
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before
+        ORDER BY started_at
+        LIMIT :limit`
+    );
+    this.markOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
+    );
+    this.markCaptureBacklogOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1
+        WHERE synced_at IS NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before`
+    );
+    this.stampStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = :at,
+              sync_claimed_at = NULL,
+              sync_failed_at = :failedAt,
+              sync_failure = :failure
+        WHERE id = :id`
+    );
+    this.claimRowStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = :at WHERE id = :id AND synced_at IS NULL`
+    );
+    this.releaseRowStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = NULL WHERE id = :id`
+    );
+    this.releaseStaleClaimsStmt = db.prepare(
+      `UPDATE audit_events SET sync_claimed_at = NULL
+        WHERE sync_claimed_at IS NOT NULL AND sync_claimed_at < :staleBefore`
+    );
+    this.partitionStmt = db.prepare(`SELECT${PARTITION_BUCKETS}
+       FROM audit_events${COUNTED_SCOPE}`);
+    this.partitionByKindStmt = db.prepare(
+      `SELECT event_type AS kind,${PARTITION_BUCKETS}
+       FROM audit_events INDEXED BY idx_audit_events_sync${COUNTED_SCOPE}
+       GROUP BY event_type`
+    );
+    this.countsStmt = db.prepare(
+      `SELECT
+         SUM(CASE WHEN synced_at IS NULL AND started_at < :before THEN 1 ELSE 0 END) AS pending,
+         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS sent,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND (sync_failure IS NULL OR sync_failure = 'payload_invalid')
+                  THEN 1 ELSE 0 END) AS skipped,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND sync_failure = 'deployment_refused' THEN 1 ELSE 0 END) AS refused,
+         SUM(CASE WHEN synced_at = ${String(SKIPPED)}
+                       AND sync_failure = 'detached_undelivered' THEN 1 ELSE 0 END) AS detached
+       FROM audit_events
+       WHERE event_type IN (${TYPE_LIST})`
+    );
+    this.captureSkipCountStmt = db.prepare(
+      // EVERY sentinel capture, whatever the reason — deliberately NOT split the
+      // way the structural totals are. The split exists because a refusal is
+      // terminal only against the deployment that gave it, and the structural
+      // re-arm frees it on a change of deployment. The capture lane has no such
+      // escape: re-arming a capture would offer one deployment's undelivered
+      // prompts, with their text, to a deployment that never saw them, which is
+      // exactly what disownCapturesStmt exists to prevent. So on this lane both
+      // reasons mean the same thing — this row will not be sent — and splitting
+      // them would put refused captures in a bucket nothing reads and nothing
+      // frees.
+      `SELECT COUNT(*) AS skipped
+         FROM audit_events
+        WHERE synced_at = ${String(SKIPPED)}
+          AND event_type IN (${CAPTURE_TYPE_LIST})`
+    );
+    this.fingerprintStmt = db.prepare(
+      `SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
+         FROM history_sync WHERE id = 1`
+    );
+    this.setFingerprintStmt = db.prepare(
+      `UPDATE history_sync
+          SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
+        WHERE id = 1`
+    );
+    this.disownCapturesStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = NULL
+        WHERE outbox_owed IS NOT NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :attachedAt`
+    );
+    this.rearmStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = NULL, sync_failed_at = NULL, sync_failure = NULL
+        WHERE (synced_at > 0
+               OR sync_failure IN ('deployment_refused', 'detached_undelivered'))
+          AND event_type IN (${TYPE_LIST})`
+    );
+    this.claimStmt = db.prepare(
+      `UPDATE history_sync
+          SET owner_pid = :pid, owner_host = :host, acquired_at = :now, heartbeat_at = :now
+        WHERE id = 1
+          AND (owner_pid IS NULL
+               OR heartbeat_at IS NULL
+               OR heartbeat_at < :staleBefore
+               OR heartbeat_at > :now)`
+    );
+    this.heartbeatStmt = db.prepare(
+      `UPDATE history_sync SET heartbeat_at = :now WHERE id = 1 AND owner_pid = :pid`
+    );
+    this.releaseStmt = db.prepare(
+      `UPDATE history_sync
+          SET owner_pid = NULL, owner_host = NULL, acquired_at = NULL, heartbeat_at = NULL
+        WHERE id = 1 AND owner_pid = :pid`
+    );
+    this.closeWindowStmt = db.prepare(
+      `UPDATE audit_events
+          SET synced_at = ${String(SKIPPED)},
+              sync_failed_at = :at,
+              sync_failure = 'detached_undelivered'
+        WHERE synced_at IS NULL
+          AND event_type IN (${TYPE_LIST})
+          AND started_at >= :attachedAt`
+    );
+    this.releaseBoundaryStmt = db.prepare(
+      `UPDATE history_sync SET backlog_before = NULL WHERE id = 1`
+    );
+    this.freezeBoundaryStmt = db.prepare(
+      `UPDATE history_sync SET backlog_before = :backlogBefore WHERE id = 1`
+    );
+    this.leaseStmt = db.prepare(
+      `SELECT owner_pid AS ownerPid, owner_host AS ownerHost,
+              acquired_at AS acquiredAt, heartbeat_at AS heartbeatAt
+         FROM history_sync WHERE id = 1`
+    );
+    this.inspectionsStmt = db.prepare(
+      `SELECT d.rule_id AS ruleId,
+              d.name AS ruleName,
+              d.version AS ruleVersion,
+              d.category AS category,
+              d.severity AS severity,
+              f.span_start AS spanStart,
+              f.span_end AS spanEnd,
+              f.masked_match AS maskedMatch,
+              f.action_taken AS actionTaken,
+              f.confidence AS confidence
+         FROM inspection_findings f
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE f.audit_event_id = :auditEventId
+        ORDER BY f.span_start, f.id`
+    );
   }
-  if (legacyCount < SQLITE_MIGRATIONS.length) {
-    db.exec(`PRAGMA user_version = ${String(SQLITE_MIGRATIONS.length)}`);
+  db;
+  ensureRowStmt;
+  sessionsStmt;
+  rowsStmt;
+  stampStmt;
+  countsStmt;
+  fingerprintStmt;
+  setFingerprintStmt;
+  rearmStmt;
+  claimStmt;
+  heartbeatStmt;
+  releaseStmt;
+  leaseStmt;
+  inspectionsStmt;
+  closeWindowStmt;
+  releaseBoundaryStmt;
+  freezeBoundaryStmt;
+  captureRowsStmt;
+  markOwedStmt;
+  markCaptureBacklogOwedStmt;
+  captureSkipCountStmt;
+  disownCapturesStmt;
+  partitionStmt;
+  partitionByKindStmt;
+  claimRowStmt;
+  releaseRowStmt;
+  releaseStaleClaimsStmt;
+  /**
+   * The masked detections recorded against one tool call.
+   *
+   * These travel with the event because a tool call's target is not
+   * re-inspectable from the event alone — unlike a capture, where the text
+   * itself is re-scannable. What crosses is the masked match and the rule that
+   * produced it, never the value.
+   */
+  inspectionsFor(auditEventId) {
+    return allRows(this.inspectionsStmt, { auditEventId });
   }
-  ensureSyncedAtColumn(db, "audit_events");
-  ensureScanLedgerTable(db);
-  ensureHistorySyncTable(db);
-  ensureBlockedDetectionsTable(db);
-  ensureRuleProbeCacheTable(db);
-  ensureWriteGateTrigger(db);
-  ensureTokenUsageColumns(db);
-  reconcileSourceProjectIds(db);
-  if (!applied.has(LEGACY_DROP_MIGRATION_TAG)) {
-    const drained = runLegacyHistoryBackfill(db);
-    if (drained) applyLegacyDropMigration(db, file2);
+  /**
+   * Sessions with structural rows still to send, oldest first.
+   *
+   * BOUNDED BY THE BACKLOG BOUNDARY, which is the whole correctness of this
+   * read. Anything recorded after the machine attached is the live forward
+   * path's to deliver; this drain exists for what was recorded before it, and a
+   * row both paths send is at best a duplicate request and at worst — for a
+   * session root — an overwrite of the inventory ids the live path resolved.
+   */
+  pendingSessions(limit, before) {
+    return allRows(this.sessionsStmt, { limit, before }).map(
+      (r) => r.sessionId
+    );
   }
-}
-function readLegacyTables(db) {
-  let holdsRows = false;
-  const marks = [];
-  for (const table of ["events", "findings"]) {
-    try {
-      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table}`).get();
-      if (row === void 0) {
-        holdsRows = true;
-        marks.push(`${table}:unreadable`);
-        continue;
-      }
-      if (row.n > 0) holdsRows = true;
-      marks.push(`${table}:${String(row.n)}:${String(row.hi)}`);
-    } catch {
-      holdsRows = true;
-      marks.push(`${table}:unreadable`);
-    }
+  /** One session's undelivered structural rows within the backlog, root first. */
+  pendingRows(sessionId, limit, before) {
+    return allRows(this.rowsStmt, { sessionId, limit, before });
   }
-  return { holdsRows, mark: marks.join("|") };
-}
-function applyLegacyDropMigration(db, file2) {
-  const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
-  if (!migration) return;
-  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
-  if (file2 !== void 0 && before?.holdsRows === true) {
-    try {
-      backupBeforeLegacyDrop(db, file2);
-    } catch (error61) {
-      akaWarn(`legacy events/findings backup failed; deferring the drop: ${String(error61)}`);
-      return;
-    }
+  /**
+   * Captures this machine still owes the deployment, oldest first.
+   *
+   * Selected by the `outbox_owed` marker the attached forward path writes, not
+   * by a time window — see captureRowsStmt for why a window could not express
+   * this. `before` is the grace window that leaves a just-recorded capture to
+   * the live path.
+   */
+  pendingCaptureRows(limit, before) {
+    return allRows(this.captureRowsStmt, { limit, before });
   }
-  try {
+  /**
+   * Record that a capture is OWED to the deployment.
+   *
+   * Written by the attached forward path when a live send did not confirm
+   * delivery, and read by the drain as the whole of its eligibility test. It is
+   * a fact rather than an inference: the machine was attached, the send did not
+   * land, so the row is owed — which no time window can state, because the same
+   * window that holds the rows a past attachment left owed also holds every
+   * capture recorded while the machine was DETACHED, and those were never
+   * offered to anyone.
+   *
+   * Idempotent, and never un-set: `markSynced` settling the row is what takes it
+   * out of the drain's read.
+   */
+  markCaptureOwed(id) {
+    this.markOwedStmt.run({ id });
+  }
+  /**
+   * Mark every capture already on disk as owed, as of `before`.
+   *
+   * The consent-time backfill, called once from `aka attach` when a human
+   * grants existing-history consent — never from an ongoing drain pass, and
+   * never inferred from a boundary that could later move. `before` is the
+   * caller's own "now" at the moment consent was granted, so what this marks
+   * is exactly the backlog the consent prompt already counted, not whatever a
+   * later re-attach or key rotation might widen it to.
+   *
+   * Returns how many rows matched, for the caller to log or test against. Not a
+   * count of NEWLY marked rows — a row still unsynced from an earlier call
+   * matches again and is counted again, the same as `UPDATE`'s own `changes`.
+   */
+  markCaptureBacklogOwed(before) {
+    return Number(this.markCaptureBacklogOwedStmt.run({ before }).changes);
+  }
+  /**
+   * Record delivery. Called only AFTER the far side has accepted the rows.
+   *
+   * CLEARS any failure reason in the same statement. A row that failed against
+   * one deployment and then landed is delivered, and leaving the reason behind
+   * would leave the store holding two contradictory answers about one row —
+   * with the surface free to render either.
+   */
+  markSynced(ids, atMs) {
+    this.stampAll(ids, atMs, null);
+  }
+  /**
+   * Record that THIS MACHINE cannot express the row on the wire.
+   *
+   * Reserved for a local defect — a row that cannot be rebuilt into a valid
+   * payload, or a body the client itself refused to send. It fails identically
+   * against every deployment, so it is terminal everywhere and the re-arm leaves
+   * it alone. A row that merely failed to REACH the deployment stays NULL, so it
+   * is retried; marking those would turn one outage into permanent data loss.
+   */
+  markSkipped(ids, atMs) {
+    this.stampAll(ids, SKIPPED, "payload_invalid", atMs);
+  }
+  /**
+   * Record that THIS DEPLOYMENT refused the row.
+   *
+   * The same sentinel as `markSkipped`, and deliberately so: both stop the row
+   * being re-offered on this lane, and `synced_at` goes on answering whether a
+   * row is outstanding rather than why. What separates them is the reason, and
+   * what the reason buys is the re-arm — a refusal is one deployment's verdict
+   * on one body, so it is terminal only for as long as this machine points at
+   * that deployment, and `rearmFor` clears it when the deployment changes.
+   *
+   * Leaving such a row NULL instead would be worse than the loss it replaces:
+   * these reads carry no cursor, so an unstamped row the deployment refuses is
+   * the head of every subsequent page, and the lane stalls behind it for ever.
+   */
+  markRefused(ids, atMs) {
+    this.stampAll(ids, SKIPPED, "deployment_refused", atMs);
+  }
+  eachInTransaction(ids, run) {
+    if (ids.length === 0) return;
     withTransaction(
-      db,
+      this.db,
       () => {
-        const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
-        if (alreadyDropped) return;
-        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
-          akaWarn(
-            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
-          );
-          return;
-        }
-        for (const statement of splitStatements(migration.sql)) {
+        for (const id of ids) run(id);
+      },
+      "IMMEDIATE"
+    );
+  }
+  stampAll(ids, value, failure, failedAtMs) {
+    if (ids.length === 0) return;
+    const failedAt = failure === null ? null : failedAtMs ?? null;
+    withTransaction(
+      this.db,
+      () => {
+        for (const id of ids) this.stampStmt.run({ at: value, failedAt, failure, id });
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * Claim rows as in-flight.
+   *
+   * Advisory in exactly the sense the lease is: it records that a send is in
+   * progress so a surface can say so, and a lost claim costs a row showing as
+   * queued while it is actually being sent. It is not exclusion — the far side
+   * settles a duplicate on the row id.
+   */
+  claimRows(ids, atMs) {
+    this.eachInTransaction(ids, (id) => this.claimRowStmt.run({ at: atMs, id }));
+  }
+  /** Give back a claim without settling — the send failed, the row is queued again. */
+  releaseRows(ids) {
+    this.eachInTransaction(ids, (id) => this.releaseRowStmt.run({ id }));
+  }
+  /**
+   * Clear claims older than `staleBefore`, and report how many were cleared.
+   *
+   * A process killed between claiming and settling leaves rows claimed with
+   * nothing left to settle them. Without this they read as "sending" for ever.
+   */
+  releaseStaleClaims(staleBefore) {
+    return Number(this.releaseStaleClaimsStmt.run({ staleBefore }).changes);
+  }
+  /**
+   * Every tracked row in exactly one delivery state.
+   *
+   * Takes no boundary on purpose. The boundary answers "what should the drain
+   * pick up now", which is a different question from "what state is this row
+   * in" — and a machine that has never attached has no boundary to pass, so
+   * requiring one would force a caller to invent one and report the whole store
+   * as queued.
+   */
+  /**
+   * The same partition, one row per kind that a lane carries.
+   *
+   * A kind with nothing to report is ABSENT rather than a row of zeros: the
+   * scope decides which rows exist at all, so a kind that has never been
+   * recorded — or whose captures nobody ever owed — produces no group. A caller
+   * rendering a fixed list of kinds must therefore treat a missing one as "no
+   * rows", never as "zero sent"; the two look identical in a bar and mean
+   * different things.
+   */
+  partitionByKind() {
+    return allRows(
+      this.partitionByKindStmt,
+      {}
+    ).map((row) => ({
+      kind: row.kind,
+      queued: row.queued ?? 0,
+      inProgress: row.inProgress ?? 0,
+      synced: row.synced ?? 0,
+      failed: row.failed ?? 0,
+      refused: row.refused ?? 0,
+      detached: row.detached ?? 0,
+      total: row.total ?? 0
+    }));
+  }
+  partition() {
+    const row = getRow(this.partitionStmt, {});
+    return {
+      queued: row?.queued ?? 0,
+      inProgress: row?.inProgress ?? 0,
+      synced: row?.synced ?? 0,
+      failed: row?.failed ?? 0,
+      refused: row?.refused ?? 0,
+      detached: row?.detached ?? 0,
+      total: row?.total ?? 0
+    };
+  }
+  /** `pending` counts only what is inside the backlog; sent and skipped are totals. */
+  counts(before) {
+    const row = getRow(this.countsStmt, { before });
+    const captures = getRow(this.captureSkipCountStmt);
+    return {
+      pending: row?.pending ?? 0,
+      sent: row?.sent ?? 0,
+      skipped: row?.skipped ?? 0,
+      refused: row?.refused ?? 0,
+      detached: row?.detached ?? 0,
+      capturesSkipped: captures?.skipped ?? 0
+    };
+  }
+  /**
+   * The deployment the current stamps were made against, and where its backlog
+   * ends.
+   *
+   * READ-ONLY. An absent row reads as an absent deployment, which is what a
+   * machine that has never drained is — and every writer below seeds the row
+   * before it needs one, so nothing depends on this creating it. Keeping the
+   * write off the gate path matters because the gate runs on every pass while a
+   * write has to take the database's write lock.
+   */
+  deployment() {
+    const row = getRow(
+      this.fingerprintStmt
+    );
+    return {
+      fingerprint: row?.fingerprint ?? void 0,
+      backlogBefore: row?.backlogBefore ?? void 0
+    };
+  }
+  /**
+   * Point the ledger at a different deployment, discarding what it recorded
+   * about the previous one.
+   *
+   * Delivery is a fact about ONE recipient: rows sent to the deployment a
+   * machine has just left are undelivered as far as the new one is concerned.
+   * All four in one transaction, so a crash between them cannot leave stamps
+   * attributed to the wrong deployment, a boundary that belongs to another, or
+   * a disown with no re-mark to follow it.
+   *
+   * The boundary is written HERE and only here, which is what freezes it: a
+   * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
+   * unchanged, so this never runs and the backlog does not widen back over rows
+   * the live path has since delivered.
+   *
+   * `backfillCapturesBefore` is the caller's OWN "now" at the instant a human
+   * granted existing-history consent for the deployment this call is arming —
+   * a DIFFERENT instant from `backlogBefore`: the re-mark boundary is the GRANT
+   * instant, `backlogBefore` is the ATTACH instant, and the two can be far
+   * apart. Passed only when that grant is valid, since this method has no way
+   * to check consent itself and must not mark a row owed for a machine that
+   * never agreed to it. Applied AFTER the disown above, in the SAME
+   * transaction: what the disown clears is every marker below `backlogBefore`,
+   * which includes this deployment's OWN pre-attach rows — `aka attach` calls
+   * `seedCaptureBacklogOwed` at the attach instant, so every row it marks sits
+   * on the cleared side of that bound — and the re-mark in the same
+   * transaction is what puts those rows back. A crash between the two cannot
+   * strand the ledger disowned with nothing re-marked — the transaction either
+   * lands whole or not at all, and a fingerprint mismatch that has not yet
+   * committed re-enters this method on the very next pass. Omit it (the
+   * structural-only tests do) to exercise the disown in isolation.
+   *
+   * The disown is bounded by `backlogBefore`, which is what keeps it from
+   * touching a marker the NEW deployment's OWN live path has already set: B's
+   * live path can mark a capture owed from the moment `aka attach` writes the
+   * descriptor, before the drain's first pass ever reaches this method, and
+   * such a row sits at or after the bound rather than below it. What keeps the
+   * disown from eating THIS SAME CALL's own re-mark is the order, not the
+   * bound — disown runs first, re-mark second, both inside the one
+   * transaction above.
+   */
+  rearmFor(fingerprint, backlogBefore, backfillCapturesBefore) {
+    this.ensureRowStmt.run();
+    withTransaction(
+      this.db,
+      () => {
+        const previous = getRow(this.fingerprintStmt)?.fingerprint;
+        this.rearmStmt.run();
+        if (previous !== null && previous !== void 0 && previous !== fingerprint) {
+          this.disownCapturesStmt.run({ attachedAt: backlogBefore });
+        }
+        if (backfillCapturesBefore !== void 0) {
+          this.markCaptureBacklogOwedStmt.run({ before: backfillCapturesBefore });
+        }
+        this.setFingerprintStmt.run({ fingerprint, backlogBefore });
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * End the attached period: hand its rows to the live path, and release the
+   * boundary so the next attachment can freeze a new one.
+   *
+   * WITHOUT THIS, a detach and a re-attach to the same deployment leave a window
+   * nothing delivers. The fingerprint is unchanged, so the boundary is never
+   * re-frozen and stays at the FIRST attachment — while nothing forwards at all
+   * during the detached period, because the machine is not attached. Rows
+   * recorded in that window sit after the boundary and before the re-attach, so
+   * neither path takes them, and the pending count reports none outstanding.
+   *
+   * WHAT IT RECORDS, and what it deliberately does not. These rows were the
+   * closing attachment's to deliver and are no longer outstanding — that is what
+   * lets the boundary move. It is NOT a claim that any of them arrived, and the
+   * distinction is not academic: this used to write a delivery TIME, which every
+   * read treats as delivery, so one detach turned a window of undelivered rows
+   * into a window of delivered ones and no surface could tell. It writes the
+   * skip sentinel and a reason of its own instead, so "no longer owed" and
+   * "received" stop being the same fact.
+   *
+   * A change of deployment still frees them (see the re-arm), because the next
+   * deployment has seen none of this machine's history — so the rows reach it
+   * exactly as they did when this wrote a delivery time.
+   *
+   * ONE TRANSACTION, so a crash cannot release the boundary while leaving the
+   * window unstamped — that half-state would re-send the whole attached period
+   * on the next attach, which is the failure the boundary exists to prevent.
+   */
+  closeAttachedWindow(attachedAtMs, atMs) {
+    this.ensureRowStmt.run();
+    withTransaction(
+      this.db,
+      () => {
+        const row = getRow(this.fingerprintStmt);
+        const from = row?.backlogBefore ?? attachedAtMs;
+        this.closeWindowStmt.run({ at: atMs, attachedAt: from });
+        this.releaseBoundaryStmt.run();
+      },
+      "IMMEDIATE"
+    );
+  }
+  /**
+   * Freeze a boundary for the deployment already on file, KEEPING the stamps.
+   *
+   * The re-attach half of the above. Distinct from `rearmFor`, which is for a
+   * different deployment and therefore discards what was delivered to the old
+   * one: here the recipient is the same, so everything already sent to it stays
+   * sent.
+   */
+  freezeBoundary(backlogBefore) {
+    this.ensureRowStmt.run();
+    this.freezeBoundaryStmt.run({ backlogBefore });
+  }
+  /** Take the claim, or report that someone live already holds it. */
+  claim(pid, host, nowMs, staleAfterMs) {
+    this.ensureRowStmt.run();
+    let taken = false;
+    withTransaction(
+      this.db,
+      () => {
+        const result = this.claimStmt.run({
+          pid,
+          host,
+          now: nowMs,
+          staleBefore: nowMs - staleAfterMs
+        });
+        taken = result.changes === 1;
+      },
+      "IMMEDIATE"
+    );
+    return taken;
+  }
+  /** Say the holder is still alive. A no-op once the claim has moved on. */
+  heartbeat(pid, nowMs) {
+    this.heartbeatStmt.run({ now: nowMs, pid });
+  }
+  /** Give the claim up. Scoped to this holder, so a taken-over claim is left be. */
+  release(pid) {
+    this.releaseStmt.run({ pid });
+  }
+  /** Who holds the claim, if anyone. Read-only, for the same reason as above. */
+  lease() {
+    return getRow(this.leaseStmt);
+  }
+};
+
+// ../../packages/persistence/src/migrations.ts
+function describeObject(object2) {
+  return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
+}
+function splitStatements(sql) {
+  return sql.split(/-->\s*statement-breakpoint/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function createdIndexName(statement) {
+  const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
+  return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
+}
+var LEGACY_DROP_MIGRATION_TAG = "0014_drop_legacy_events_findings";
+function applyMigrations(db, file2, options = {}) {
+  const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
+  db.exec(
+    "CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)"
+  );
+  const applied = new Set(
+    db.prepare("SELECT tag FROM migration_ledger").all().map((r) => r.tag)
+  );
+  const preLedgerStore = applied.size === 0 && legacyCount > 0;
+  const record2 = db.prepare(
+    "INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)"
+  );
+  for (const [index, migration] of SQLITE_MIGRATIONS.entries()) {
+    if (applied.has(migration.tag)) continue;
+    if (options.skipTags?.has(migration.tag) === true) continue;
+    if (migration.tag === LEGACY_DROP_MIGRATION_TAG) continue;
+    const evidence = evidenceObjects(migration.sql);
+    const present = evidence.filter((o) => evidenceExists(db, o));
+    if (present.length > 0 && present.length < evidence.length) {
+      const missing = evidence.filter((o) => !present.includes(o));
+      const message = `sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
+      akaWarn(message);
+      throw new Error(`[aka] ${message}`);
+    }
+    const alreadyApplied = evidence.length > 0 ? present.length === evidence.length : preLedgerStore && index < legacyCount;
+    const wantsFkOff = /PRAGMA foreign_keys\s*=\s*OFF/i.test(migration.sql);
+    const statements = splitStatements(migration.sql);
+    if (wantsFkOff) db.exec("PRAGMA foreign_keys = OFF");
+    try {
+      withTransaction(
+        db,
+        () => {
+          for (const statement of statements) {
+            const indexName = createdIndexName(statement);
+            if (indexName === void 0) {
+              if (alreadyApplied) continue;
+            } else if (indexExists(db, indexName)) {
+              continue;
+            }
+            db.exec(statement);
+          }
+          if (wantsFkOff && !alreadyApplied) {
+            const violations = db.prepare("PRAGMA foreign_key_check").all();
+            if (violations.length > 0) {
+              throw new Error(
+                `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
+              );
+            }
+          }
+          record2.run(migration.tag, Date.now());
+        },
+        "IMMEDIATE"
+      );
+    } finally {
+      if (wantsFkOff) db.exec("PRAGMA foreign_keys = ON");
+    }
+  }
+  if (legacyCount < SQLITE_MIGRATIONS.length) {
+    db.exec(`PRAGMA user_version = ${String(SQLITE_MIGRATIONS.length)}`);
+  }
+  ensureSyncedAtColumn(db, "audit_events");
+  ensureScanLedgerTable(db);
+  ensureHistorySyncTable(db);
+  ensureBlockedDetectionsTable(db);
+  ensureRuleProbeCacheTable(db);
+  ensureWriteGateTrigger(db);
+  ensureTokenUsageColumns(db);
+  reconcileSourceProjectIds(db);
+  if (!applied.has(LEGACY_DROP_MIGRATION_TAG)) {
+    const drained = runLegacyHistoryBackfill(db);
+    if (drained) applyLegacyDropMigration(db, file2);
+  }
+}
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
+function applyLegacyDropMigration(db, file2) {
+  const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
+  if (!migration) return;
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
+    try {
+      backupBeforeLegacyDrop(db, file2);
+    } catch (error61) {
+      akaWarn(`legacy events/findings backup failed; deferring the drop: ${String(error61)}`);
+      return;
+    }
+  }
+  try {
+    withTransaction(
+      db,
+      () => {
+        const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
+        if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
+        for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
         db.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(
@@ -25188,10 +26343,62 @@ function ensureSyncedAtColumn(db, table) {
   if (!columns.includes("outbox_owed")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN outbox_owed integer`);
   }
+  if (!columns.includes("sync_failed_at")) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN sync_failed_at integer`);
+  }
+  if (!columns.includes("sync_failure")) {
+    withTransaction(
+      db,
+      () => {
+        db.exec(`ALTER TABLE ${table} ADD COLUMN sync_failure text`);
+        db.exec(
+          `UPDATE ${table} SET synced_at = NULL
+            WHERE synced_at = -1
+              AND event_type IN (${COUNTED_EVENT_TYPES.map((t) => `'${t}'`).join(", ")})`
+        );
+      },
+      "IMMEDIATE"
+    );
+  }
   db.exec(
-    `CREATE INDEX IF NOT EXISTS idx_audit_events_sync
-       ON audit_events (event_type, synced_at, sync_claimed_at, started_at)`
+    `CREATE TRIGGER IF NOT EXISTS aka_sync_failure_guard
+       BEFORE UPDATE OF sync_failure ON ${table}
+       WHEN ${syncFailureRejectCondition()}
+       BEGIN SELECT RAISE(ABORT, 'sync_failure is not one of the recorded reasons'); END`
   );
+  const syncIndexColumns = [
+    "event_type",
+    "synced_at",
+    "sync_claimed_at",
+    "started_at",
+    // Appended LAST on purpose. The delivery-state read now projects it, so it
+    // has to be in the index for the read to stay covered — but putting it
+    // ahead of `started_at` would reorder the prefix the structural drain's
+    // reads match on.
+    "sync_failure"
+    // `outbox_owed` is DELIBERATELY ABSENT, and it was measured both ways.
+    //
+    // The delivery-state read tests it — a capture's state depends on whether a
+    // live forward marked it owed — so carrying it here makes that read covering
+    // rather than a row fetch per row: 16 ms against 40 ms on a real 6 GB store.
+    // But a sixth column changes what the planner charges for this index, and
+    // with no ANALYZE statistics it plans from schema shape alone: measured, it
+    // then stops choosing the per-session index for the token rollup and walks
+    // every `llm_call` in the store through the event-type index instead. That
+    // read grows with the store; this one does not.
+    //
+    // 40 ms on the largest store measured, once per render, is a cost worth
+    // paying to leave every other read's plan where it was.
+  ];
+  const currentSyncIndex = indexColumns(db, "idx_audit_events_sync");
+  const syncIndexMatches = currentSyncIndex.length === syncIndexColumns.length && currentSyncIndex.every((column, i) => column === syncIndexColumns[i]);
+  if (!syncIndexMatches) {
+    db.exec("DROP INDEX IF EXISTS idx_audit_events_sync");
+    db.exec(
+      `CREATE INDEX idx_audit_events_sync
+         ON audit_events (${syncIndexColumns.join(", ")})`
+    );
+  }
   db.exec(
     `CREATE INDEX IF NOT EXISTS idx_audit_outbox_owed
        ON audit_events (event_type, synced_at, sync_claimed_at, started_at) WHERE outbox_owed = 1`
@@ -25413,7 +26620,11 @@ function buildAuditEvent(row) {
     link: linkParsed?.success ? linkParsed.data : null,
     targetId: row.target_id,
     internal: intToBool(row.internal),
-    flagged: intToBool(row.flagged)
+    flagged: intToBool(row.flagged),
+    // Only meaningful when the title came out empty — a row whose body was
+    // expired but whose title fell back to `tool_name` still has something to
+    // render, and flagging it would make the view apologise for nothing.
+    bodyExpired: row.content_expired_at !== null && (row.title ?? "") === ""
   };
 }
 var TIMELINE_COLUMNS = `
@@ -25421,6 +26632,7 @@ var TIMELINE_COLUMNS = `
   event_type,
   started_at,
   coalesce(content, json_extract(attributes, '$.tool_name')) AS title,
+  content_expired_at,
   coalesce(json_extract(attributes, '$.detail'), json_extract(attributes, '$.target')) AS detail,
   coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
   json_extract(attributes, '$.severity') AS severity,
@@ -25463,7 +26675,7 @@ var SESSION_ROOT = `event_type = 'session'`;
 var HAS_ACTIVITY = `EXISTS (
   SELECT 1 FROM audit_events c
   WHERE c.root_session_id = audit_events.id
-    AND c.event_type NOT IN ('hook', 'config_scan'))`;
+    AND c.event_type NOT IN ('hook', 'config_scan', 'capture_status'))`;
 var SqliteActivityRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -25490,10 +26702,10 @@ var SqliteActivityRepository = class {
                SELECT id FROM audit_events WHERE event_type = 'session' AND started_at >= ?
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_started_at
-                WHERE started_at >= ?
+                WHERE started_at >= ? AND event_type <> 'capture_status'
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_ended_at
-                WHERE ended_at >= ?)`,
+                WHERE ended_at >= ? AND event_type <> 'capture_status')`,
       [liveThreshold, liveThreshold, liveThreshold]
     );
     const toolCallsToday = countScalar(
@@ -25900,7 +27112,10 @@ var SqliteAuditEventsRepository = class {
          attributes = excluded.attributes,
          ended_at   = excluded.ended_at
        WHERE COALESCE(json_extract(excluded.attributes, '$.output_tokens'), 0)
-           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)`
+           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)
+          OR (json_extract(excluded.attributes, '$.usage_source') IS NOT NULL
+              AND json_extract(excluded.attributes, '$.output_tokens') IS NULL
+              AND excluded.attributes <> audit_events.attributes)`
     );
     this.upsertSessionRootStmt = db.prepare(
       `INSERT OR IGNORE INTO audit_events
@@ -26086,6 +27301,169 @@ var SqliteAuditEventsRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/body-retention.ts
+var DEFAULT_BATCH_SIZE = 500;
+var DEFAULT_MAX_ROWS = 5e4;
+var SYNC_LANE_TYPES_SQL = OUTBOX_CAPTURE_TYPE_LIST;
+var SqliteBodyRetentionRepository = class {
+  constructor(db) {
+    this.db = db;
+    const select = (laneClause) => `
+      SELECT id, LENGTH(CAST(content AS BLOB)) AS bytes
+        FROM audit_events
+       WHERE content IS NOT NULL
+         AND started_at < :cutoff
+         AND event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         ${laneClause}
+       ORDER BY started_at
+       LIMIT :limit`;
+    this.candidatesStmt = this.db.prepare(select(""));
+    this.candidatesSyncSafeStmt = this.db.prepare(
+      select(`AND (event_type NOT IN (${SYNC_LANE_TYPES_SQL}) OR synced_at IS NOT NULL)`)
+    );
+    this.heldBySyncStmt = this.db.prepare(`
+      SELECT COUNT(*) AS n
+        FROM audit_events
+       WHERE content IS NOT NULL
+         AND started_at < :cutoff
+         AND event_type IN (${SYNC_LANE_TYPES_SQL})
+         AND synced_at IS NULL`);
+    this.expireStmt = this.db.prepare(
+      `UPDATE audit_events SET content = NULL, content_expired_at = :now WHERE id = :id`
+    );
+  }
+  db;
+  candidatesStmt;
+  candidatesSyncSafeStmt;
+  heldBySyncStmt;
+  expireStmt;
+  /** How many bytes a pass with these options would free, changing nothing. */
+  preview(opts) {
+    const limit = opts.maxRows ?? DEFAULT_MAX_ROWS;
+    const stmt = opts.sweepSyncLane ? this.candidatesStmt : this.candidatesSyncSafeStmt;
+    const rows = stmt.all({ cutoff: opts.cutoff, limit });
+    return {
+      rowsExpired: rows.length,
+      bytesFreed: rows.reduce((sum, r) => sum + r.bytes, 0),
+      rowsHeldBySync: this.countHeldBySync(opts)
+    };
+  }
+  /** Clear eligible bodies, in bounded batches. */
+  expire(opts) {
+    const batchSize = opts.batchSize ?? DEFAULT_BATCH_SIZE;
+    const maxRows = opts.maxRows ?? DEFAULT_MAX_ROWS;
+    const stmt = opts.sweepSyncLane ? this.candidatesStmt : this.candidatesSyncSafeStmt;
+    let rowsExpired = 0;
+    let bytesFreed = 0;
+    let done = true;
+    while (rowsExpired < maxRows) {
+      const remaining = Math.min(batchSize, maxRows - rowsExpired);
+      const batch = stmt.all({ cutoff: opts.cutoff, limit: remaining });
+      if (batch.length === 0) break;
+      withTransaction(
+        this.db,
+        () => {
+          for (const row of batch) this.expireStmt.run({ id: row.id, now: opts.now });
+        },
+        "IMMEDIATE"
+      );
+      rowsExpired += batch.length;
+      bytesFreed += batch.reduce((sum, r) => sum + r.bytes, 0);
+      if (batch.length < remaining) break;
+      if (rowsExpired >= maxRows) {
+        done = stmt.all({ cutoff: opts.cutoff, limit: 1 }).length === 0;
+      }
+    }
+    return { rowsExpired, bytesFreed, rowsHeldBySync: this.countHeldBySync(opts), done };
+  }
+  countHeldBySync(opts) {
+    if (opts.sweepSyncLane) return 0;
+    const row = this.heldBySyncStmt.get({ cutoff: opts.cutoff });
+    return row.n;
+  }
+};
+
+// ../../packages/persistence/src/repositories/capture-status.ts
+var STATUS_LOOKBACK_ROWS = 128;
+var SqliteCaptureStatusRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.recentStmt = db.prepare(
+      `SELECT a.started_at AS startedAt,
+              a.attributes AS attributes,
+              a.root_session_id AS rootSessionId
+         FROM audit_events a
+        WHERE a.event_type = 'capture_status'
+          AND a.source_tool = ?
+          AND a.started_at >= ?
+        ORDER BY a.started_at DESC, a.id DESC
+        LIMIT ?`
+    );
+  }
+  db;
+  recentStmt;
+  /**
+   * Every document that reported for a site, in registry order by site, from
+   * the last `CAPTURE_STATUS_RECENCY_MS`.
+   *
+   * SEVERAL per site, not one: a browser is many documents and each reports
+   * for itself, so one row per site is a choice about which of them a user
+   * sees — and the newest is the wrong one, since a healthy tab writing a
+   * fresh report would hide a drifting tab's verdict, which is the whole
+   * reason these rows exist. The pick WITHIN a document is made here (the
+   * unchanged `pickReportedCaptureStatus`, over that document's own rows);
+   * choosing between documents belongs where the state semantics live, and
+   * that is `reportedCaptureDocumentForSite` in `@akasecurity/detections` —
+   * this package may not import it.
+   *
+   * `now` is a required argument rather than a `Date.now()` read, so a caller
+   * that already holds a render instant passes THAT one and a test can drive
+   * the window without moving the wall clock.
+   *
+   * A site whose reports have all aged out contributes nothing, so it derives
+   * to `unreported`. That is the point: nothing but the browser extension ever
+   * writes these rows, so an uninstalled extension's last verdict would
+   * otherwise stand as a live claim for ever with no later report able to
+   * clear it.
+   */
+  latest(now) {
+    const since = now - CAPTURE_STATUS_RECENCY_MS;
+    const documents = [];
+    for (const tool of WebSourceTool.options) {
+      const rows = /* @__PURE__ */ new Map();
+      const lastWord = /* @__PURE__ */ new Map();
+      for (const row of allRows(this.recentStmt, [
+        tool,
+        since,
+        STATUS_LOOKBACK_ROWS
+      ])) {
+        const status = fromCaptureStatusAttributes(parseJsonObject(row.attributes));
+        if (status === null) continue;
+        const record2 = { tool, observedAt: epochMillisToIso(row.startedAt), status };
+        const group = rows.get(row.rootSessionId);
+        if (group === void 0) {
+          rows.set(row.rootSessionId, [record2]);
+          lastWord.set(row.rootSessionId, { at: record2.observedAt, closed: status.closed });
+        } else {
+          group.push(record2);
+        }
+      }
+      for (const [root, candidates] of rows) {
+        const picked = pickReportedCaptureStatus(candidates);
+        const last = lastWord.get(root);
+        if (picked === void 0 || last === void 0) continue;
+        documents.push({
+          ...picked,
+          ...root === null ? {} : { rootSessionId: root },
+          lastReportAt: last.at,
+          closed: last.closed
+        });
+      }
+    }
+    return documents;
+  }
+};
+
 // ../../packages/persistence/src/repositories/classified-data.ts
 var SqliteClassifiedDataRepository = class {
   constructor(db) {
@@ -26914,7 +28292,15 @@ function toFlatFindingRow(r) {
     ...r.tool_name === null ? {} : { toolName: r.tool_name },
     eventId: r.event_id,
     ...r.session_id === null ? {} : { sessionId: r.session_id },
-    status: deriveInstanceStatus(r)
+    status: deriveInstanceStatus(r),
+    delivery: deriveFindingDelivery({
+      kind: r.kind,
+      syncedAt: r.synced_at,
+      syncClaimedAt: r.sync_claimed_at,
+      syncFailedAt: r.sync_failed_at,
+      syncFailure: r.sync_failure,
+      outboxOwed: r.outbox_owed
+    })
   };
 }
 function encodeGroupCursor(group) {
@@ -26978,7 +28364,10 @@ var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS c
               e.tool_name AS tool_name,
               f.audit_event_id AS event_id, e.root_session_id AS session_id,
               e.event_type AS kind, f.finding_key AS finding_key,
-              ${latestResolutionStatusSql("f")} AS latest_status`;
+              ${latestResolutionStatusSql("f")} AS latest_status,
+              e.synced_at AS synced_at, e.sync_claimed_at AS sync_claimed_at,
+              e.sync_failed_at AS sync_failed_at, e.sync_failure AS sync_failure,
+              e.outbox_owed AS outbox_owed`;
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -27223,6 +28612,7 @@ var SqliteFindingsRepository = class {
       providers: query.provider,
       actions: query.action,
       statuses: query.status,
+      deliveries: query.deployment,
       tools: query.tool,
       repo: query.repo,
       file: query.file,
@@ -27290,6 +28680,7 @@ var SqliteFindingsRepository = class {
       providers: query.provider,
       actions: query.action,
       statuses: query.status,
+      deliveries: query.deployment,
       tools: query.tool,
       q: query.q
     };
@@ -27553,7 +28944,9 @@ var SqliteFindingsRepository = class {
       )
     );
     for (const row of grouped) {
-      if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
+      if (Object.hasOwn(byAction, row.action_taken)) {
+        byAction[row.action_taken] = row.c;
+      }
     }
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
     const sevRows = allRows(
@@ -27570,7 +28963,9 @@ var SqliteFindingsRepository = class {
       )
     );
     for (const row of sevRows) {
-      if (row.severity in bySeverity) bySeverity[row.severity] = row.c;
+      if (Object.hasOwn(bySeverity, row.severity)) {
+        bySeverity[row.severity] = row.c;
+      }
     }
     const categories = ENFORCEABLE_CATEGORIES;
     const enabledRows = allRows(
@@ -27619,525 +29014,6 @@ function isoDay(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 
-// ../../packages/persistence/src/repositories/history-sync.ts
-var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
-var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
-var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
-var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
-var SKIPPED = -1;
-var ROW_COLUMNS = `id,
-   parent_id AS parentId,
-   root_session_id AS rootSessionId,
-   event_type AS eventType,
-   host_id AS hostId,
-   harness_id AS harnessId,
-   source_project_id AS sourceProjectId,
-   started_at AS startedAt,
-   ended_at AS endedAt,
-   severity,
-   priority,
-   content,
-   content_hash AS contentHash,
-   attributes`;
-var SqliteHistorySyncRepository = class {
-  constructor(db) {
-    this.db = db;
-    this.ensureRowStmt = db.prepare(`INSERT OR IGNORE INTO history_sync (id) VALUES (1)`);
-    this.sessionsStmt = db.prepare(
-      `SELECT COALESCE(root_session_id, id) AS sessionId, MIN(started_at) AS earliest
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at < :before
-        GROUP BY sessionId
-        ORDER BY earliest
-        LIMIT :limit`
-    );
-    this.rowsStmt = db.prepare(
-      `SELECT ${ROW_COLUMNS}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at < :before
-          AND COALESCE(root_session_id, id) = :sessionId
-        ORDER BY (event_type = 'session') DESC, started_at
-        LIMIT :limit`
-    );
-    this.captureRowsStmt = db.prepare(
-      `SELECT ${ROW_COLUMNS}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND sync_claimed_at IS NULL
-          AND outbox_owed = 1
-          AND event_type IN (${CAPTURE_TYPE_LIST})
-          AND started_at < :before
-        ORDER BY started_at
-        LIMIT :limit`
-    );
-    this.markOwedStmt = db.prepare(
-      `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
-    );
-    this.markCaptureBacklogOwedStmt = db.prepare(
-      `UPDATE audit_events SET outbox_owed = 1
-        WHERE synced_at IS NULL
-          AND event_type IN (${CAPTURE_TYPE_LIST})
-          AND started_at < :before`
-    );
-    this.stampStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id`
-    );
-    this.claimRowStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = :at WHERE id = :id AND synced_at IS NULL`
-    );
-    this.releaseRowStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = NULL WHERE id = :id`
-    );
-    this.releaseStaleClaimsStmt = db.prepare(
-      `UPDATE audit_events SET sync_claimed_at = NULL
-        WHERE sync_claimed_at IS NOT NULL AND sync_claimed_at < :staleBefore`
-    );
-    this.partitionStmt = db.prepare(
-      `SELECT
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NOT NULL THEN 1 ELSE 0 END) AS inProgress,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS synced,
-         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0 THEN 1 ELSE 0 END) AS failed,
-         COUNT(*) AS total
-       FROM audit_events
-       WHERE event_type IN (${TYPE_LIST})`
-    );
-    this.countsStmt = db.prepare(
-      `SELECT
-         SUM(CASE WHEN synced_at IS NULL AND started_at < :before THEN 1 ELSE 0 END) AS pending,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS sent,
-         SUM(CASE WHEN synced_at = ${String(SKIPPED)} THEN 1 ELSE 0 END) AS skipped
-       FROM audit_events
-       WHERE event_type IN (${TYPE_LIST})`
-    );
-    this.captureSkipCountStmt = db.prepare(
-      `SELECT COUNT(*) AS skipped
-         FROM audit_events
-        WHERE synced_at = ${String(SKIPPED)}
-          AND event_type IN (${CAPTURE_TYPE_LIST})`
-    );
-    this.fingerprintStmt = db.prepare(
-      `SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
-         FROM history_sync WHERE id = 1`
-    );
-    this.setFingerprintStmt = db.prepare(
-      `UPDATE history_sync
-          SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
-        WHERE id = 1`
-    );
-    this.disownCapturesStmt = db.prepare(
-      `UPDATE audit_events SET outbox_owed = NULL
-        WHERE outbox_owed IS NOT NULL
-          AND event_type IN (${CAPTURE_TYPE_LIST})
-          AND started_at < :attachedAt`
-    );
-    this.rearmStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = NULL
-        WHERE synced_at > 0 AND event_type IN (${TYPE_LIST})`
-    );
-    this.claimStmt = db.prepare(
-      `UPDATE history_sync
-          SET owner_pid = :pid, owner_host = :host, acquired_at = :now, heartbeat_at = :now
-        WHERE id = 1
-          AND (owner_pid IS NULL
-               OR heartbeat_at IS NULL
-               OR heartbeat_at < :staleBefore
-               OR heartbeat_at > :now)`
-    );
-    this.heartbeatStmt = db.prepare(
-      `UPDATE history_sync SET heartbeat_at = :now WHERE id = 1 AND owner_pid = :pid`
-    );
-    this.releaseStmt = db.prepare(
-      `UPDATE history_sync
-          SET owner_pid = NULL, owner_host = NULL, acquired_at = NULL, heartbeat_at = NULL
-        WHERE id = 1 AND owner_pid = :pid`
-    );
-    this.closeWindowStmt = db.prepare(
-      `UPDATE audit_events SET synced_at = :at
-        WHERE synced_at IS NULL
-          AND event_type IN (${TYPE_LIST})
-          AND started_at >= :attachedAt`
-    );
-    this.releaseBoundaryStmt = db.prepare(
-      `UPDATE history_sync SET backlog_before = NULL WHERE id = 1`
-    );
-    this.freezeBoundaryStmt = db.prepare(
-      `UPDATE history_sync SET backlog_before = :backlogBefore WHERE id = 1`
-    );
-    this.leaseStmt = db.prepare(
-      `SELECT owner_pid AS ownerPid, owner_host AS ownerHost,
-              acquired_at AS acquiredAt, heartbeat_at AS heartbeatAt
-         FROM history_sync WHERE id = 1`
-    );
-    this.inspectionsStmt = db.prepare(
-      `SELECT d.rule_id AS ruleId,
-              d.name AS ruleName,
-              d.version AS ruleVersion,
-              d.category AS category,
-              d.severity AS severity,
-              f.span_start AS spanStart,
-              f.span_end AS spanEnd,
-              f.masked_match AS maskedMatch,
-              f.action_taken AS actionTaken,
-              f.confidence AS confidence
-         FROM inspection_findings f
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE f.audit_event_id = :auditEventId
-        ORDER BY f.span_start, f.id`
-    );
-  }
-  db;
-  ensureRowStmt;
-  sessionsStmt;
-  rowsStmt;
-  stampStmt;
-  countsStmt;
-  fingerprintStmt;
-  setFingerprintStmt;
-  rearmStmt;
-  claimStmt;
-  heartbeatStmt;
-  releaseStmt;
-  leaseStmt;
-  inspectionsStmt;
-  closeWindowStmt;
-  releaseBoundaryStmt;
-  freezeBoundaryStmt;
-  captureRowsStmt;
-  markOwedStmt;
-  markCaptureBacklogOwedStmt;
-  captureSkipCountStmt;
-  disownCapturesStmt;
-  partitionStmt;
-  claimRowStmt;
-  releaseRowStmt;
-  releaseStaleClaimsStmt;
-  /**
-   * The masked detections recorded against one tool call.
-   *
-   * These travel with the event because a tool call's target is not
-   * re-inspectable from the event alone — unlike a capture, where the text
-   * itself is re-scannable. What crosses is the masked match and the rule that
-   * produced it, never the value.
-   */
-  inspectionsFor(auditEventId) {
-    return allRows(this.inspectionsStmt, { auditEventId });
-  }
-  /**
-   * Sessions with structural rows still to send, oldest first.
-   *
-   * BOUNDED BY THE BACKLOG BOUNDARY, which is the whole correctness of this
-   * read. Anything recorded after the machine attached is the live forward
-   * path's to deliver; this drain exists for what was recorded before it, and a
-   * row both paths send is at best a duplicate request and at worst — for a
-   * session root — an overwrite of the inventory ids the live path resolved.
-   */
-  pendingSessions(limit, before) {
-    return allRows(this.sessionsStmt, { limit, before }).map(
-      (r) => r.sessionId
-    );
-  }
-  /** One session's undelivered structural rows within the backlog, root first. */
-  pendingRows(sessionId, limit, before) {
-    return allRows(this.rowsStmt, { sessionId, limit, before });
-  }
-  /**
-   * Captures this machine still owes the deployment, oldest first.
-   *
-   * Selected by the `outbox_owed` marker the attached forward path writes, not
-   * by a time window — see captureRowsStmt for why a window could not express
-   * this. `before` is the grace window that leaves a just-recorded capture to
-   * the live path.
-   */
-  pendingCaptureRows(limit, before) {
-    return allRows(this.captureRowsStmt, { limit, before });
-  }
-  /**
-   * Record that a capture is OWED to the deployment.
-   *
-   * Written by the attached forward path when a live send did not confirm
-   * delivery, and read by the drain as the whole of its eligibility test. It is
-   * a fact rather than an inference: the machine was attached, the send did not
-   * land, so the row is owed — which no time window can state, because the same
-   * window that holds the rows a past attachment left owed also holds every
-   * capture recorded while the machine was DETACHED, and those were never
-   * offered to anyone.
-   *
-   * Idempotent, and never un-set: `markSynced` settling the row is what takes it
-   * out of the drain's read.
-   */
-  markCaptureOwed(id) {
-    this.markOwedStmt.run({ id });
-  }
-  /**
-   * Mark every capture already on disk as owed, as of `before`.
-   *
-   * The consent-time backfill, called once from `aka attach` when a human
-   * grants existing-history consent — never from an ongoing drain pass, and
-   * never inferred from a boundary that could later move. `before` is the
-   * caller's own "now" at the moment consent was granted, so what this marks
-   * is exactly the backlog the consent prompt already counted, not whatever a
-   * later re-attach or key rotation might widen it to.
-   *
-   * Returns how many rows matched, for the caller to log or test against. Not a
-   * count of NEWLY marked rows — a row still unsynced from an earlier call
-   * matches again and is counted again, the same as `UPDATE`'s own `changes`.
-   */
-  markCaptureBacklogOwed(before) {
-    return Number(this.markCaptureBacklogOwedStmt.run({ before }).changes);
-  }
-  /** Record delivery. Called only AFTER the far side has accepted the rows. */
-  markSynced(ids, atMs) {
-    this.stampAll(ids, atMs);
-  }
-  /**
-   * Record that a row will never be sent.
-   *
-   * Reserved for a local defect — a row that cannot be rebuilt into a valid
-   * payload. A row that merely failed to reach the deployment stays NULL, so it
-   * is retried; marking those would turn one outage into permanent data loss.
-   */
-  markSkipped(ids) {
-    this.stampAll(ids, SKIPPED);
-  }
-  eachInTransaction(ids, run) {
-    if (ids.length === 0) return;
-    withTransaction(
-      this.db,
-      () => {
-        for (const id of ids) run(id);
-      },
-      "IMMEDIATE"
-    );
-  }
-  stampAll(ids, value) {
-    if (ids.length === 0) return;
-    withTransaction(
-      this.db,
-      () => {
-        for (const id of ids) this.stampStmt.run({ at: value, id });
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * Claim rows as in-flight.
-   *
-   * Advisory in exactly the sense the lease is: it records that a send is in
-   * progress so a surface can say so, and a lost claim costs a row showing as
-   * queued while it is actually being sent. It is not exclusion — the far side
-   * settles a duplicate on the row id.
-   */
-  claimRows(ids, atMs) {
-    this.eachInTransaction(ids, (id) => this.claimRowStmt.run({ at: atMs, id }));
-  }
-  /** Give back a claim without settling — the send failed, the row is queued again. */
-  releaseRows(ids) {
-    this.eachInTransaction(ids, (id) => this.releaseRowStmt.run({ id }));
-  }
-  /**
-   * Clear claims older than `staleBefore`, and report how many were cleared.
-   *
-   * A process killed between claiming and settling leaves rows claimed with
-   * nothing left to settle them. Without this they read as "sending" for ever.
-   */
-  releaseStaleClaims(staleBefore) {
-    return Number(this.releaseStaleClaimsStmt.run({ staleBefore }).changes);
-  }
-  /**
-   * Every tracked row in exactly one delivery state.
-   *
-   * Takes no boundary on purpose. The boundary answers "what should the drain
-   * pick up now", which is a different question from "what state is this row
-   * in" — and a machine that has never attached has no boundary to pass, so
-   * requiring one would force a caller to invent one and report the whole store
-   * as queued.
-   */
-  partition() {
-    const row = getRow(this.partitionStmt, {});
-    return {
-      queued: row?.queued ?? 0,
-      inProgress: row?.inProgress ?? 0,
-      synced: row?.synced ?? 0,
-      failed: row?.failed ?? 0,
-      total: row?.total ?? 0
-    };
-  }
-  /** `pending` counts only what is inside the backlog; sent and skipped are totals. */
-  counts(before) {
-    const row = getRow(
-      this.countsStmt,
-      { before }
-    );
-    const captures = getRow(this.captureSkipCountStmt);
-    return {
-      pending: row?.pending ?? 0,
-      sent: row?.sent ?? 0,
-      skipped: row?.skipped ?? 0,
-      capturesSkipped: captures?.skipped ?? 0
-    };
-  }
-  /**
-   * The deployment the current stamps were made against, and where its backlog
-   * ends.
-   *
-   * READ-ONLY. An absent row reads as an absent deployment, which is what a
-   * machine that has never drained is — and every writer below seeds the row
-   * before it needs one, so nothing depends on this creating it. Keeping the
-   * write off the gate path matters because the gate runs on every pass while a
-   * write has to take the database's write lock.
-   */
-  deployment() {
-    const row = getRow(
-      this.fingerprintStmt
-    );
-    return {
-      fingerprint: row?.fingerprint ?? void 0,
-      backlogBefore: row?.backlogBefore ?? void 0
-    };
-  }
-  /**
-   * Point the ledger at a different deployment, discarding what it recorded
-   * about the previous one.
-   *
-   * Delivery is a fact about ONE recipient: rows sent to the deployment a
-   * machine has just left are undelivered as far as the new one is concerned.
-   * All four in one transaction, so a crash between them cannot leave stamps
-   * attributed to the wrong deployment, a boundary that belongs to another, or
-   * a disown with no re-mark to follow it.
-   *
-   * The boundary is written HERE and only here, which is what freezes it: a
-   * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
-   * unchanged, so this never runs and the backlog does not widen back over rows
-   * the live path has since delivered.
-   *
-   * `backfillCapturesBefore` is the caller's OWN "now" at the instant a human
-   * granted existing-history consent for the deployment this call is arming —
-   * a DIFFERENT instant from `backlogBefore`: the re-mark boundary is the GRANT
-   * instant, `backlogBefore` is the ATTACH instant, and the two can be far
-   * apart. Passed only when that grant is valid, since this method has no way
-   * to check consent itself and must not mark a row owed for a machine that
-   * never agreed to it. Applied AFTER the disown above, in the SAME
-   * transaction: what the disown clears is every marker below `backlogBefore`,
-   * which includes this deployment's OWN pre-attach rows — `aka attach` calls
-   * `seedCaptureBacklogOwed` at the attach instant, so every row it marks sits
-   * on the cleared side of that bound — and the re-mark in the same
-   * transaction is what puts those rows back. A crash between the two cannot
-   * strand the ledger disowned with nothing re-marked — the transaction either
-   * lands whole or not at all, and a fingerprint mismatch that has not yet
-   * committed re-enters this method on the very next pass. Omit it (the
-   * structural-only tests do) to exercise the disown in isolation.
-   *
-   * The disown is bounded by `backlogBefore`, which is what keeps it from
-   * touching a marker the NEW deployment's OWN live path has already set: B's
-   * live path can mark a capture owed from the moment `aka attach` writes the
-   * descriptor, before the drain's first pass ever reaches this method, and
-   * such a row sits at or after the bound rather than below it. What keeps the
-   * disown from eating THIS SAME CALL's own re-mark is the order, not the
-   * bound — disown runs first, re-mark second, both inside the one
-   * transaction above.
-   */
-  rearmFor(fingerprint, backlogBefore, backfillCapturesBefore) {
-    this.ensureRowStmt.run();
-    withTransaction(
-      this.db,
-      () => {
-        const previous = getRow(this.fingerprintStmt)?.fingerprint;
-        this.rearmStmt.run();
-        if (previous !== null && previous !== void 0 && previous !== fingerprint) {
-          this.disownCapturesStmt.run({ attachedAt: backlogBefore });
-        }
-        if (backfillCapturesBefore !== void 0) {
-          this.markCaptureBacklogOwedStmt.run({ before: backfillCapturesBefore });
-        }
-        this.setFingerprintStmt.run({ fingerprint, backlogBefore });
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * End the attached period: hand its rows to the live path, and release the
-   * boundary so the next attachment can freeze a new one.
-   *
-   * WITHOUT THIS, a detach and a re-attach to the same deployment leave a window
-   * nothing delivers. The fingerprint is unchanged, so the boundary is never
-   * re-frozen and stays at the FIRST attachment — while nothing forwards at all
-   * during the detached period, because the machine is not attached. Rows
-   * recorded in that window sit after the boundary and before the re-attach, so
-   * neither path takes them, and the pending count reports none outstanding.
-   *
-   * Stamping the attached window is not a claim that every one of those rows
-   * reached the deployment — the live path drops on failure and says so
-   * elsewhere. It records that they were ITS to deliver, which is exactly the
-   * status quo: they sit outside the frozen boundary today and are equally never
-   * re-sent. Making it explicit is what lets the boundary move.
-   *
-   * ONE TRANSACTION, so a crash cannot release the boundary while leaving the
-   * window unstamped — that half-state would re-send the whole attached period
-   * on the next attach, which is the failure the boundary exists to prevent.
-   */
-  closeAttachedWindow(attachedAtMs, atMs) {
-    this.ensureRowStmt.run();
-    withTransaction(
-      this.db,
-      () => {
-        const row = getRow(this.fingerprintStmt);
-        const from = row?.backlogBefore ?? attachedAtMs;
-        this.closeWindowStmt.run({ at: atMs, attachedAt: from });
-        this.releaseBoundaryStmt.run();
-      },
-      "IMMEDIATE"
-    );
-  }
-  /**
-   * Freeze a boundary for the deployment already on file, KEEPING the stamps.
-   *
-   * The re-attach half of the above. Distinct from `rearmFor`, which is for a
-   * different deployment and therefore discards what was delivered to the old
-   * one: here the recipient is the same, so everything already sent to it stays
-   * sent.
-   */
-  freezeBoundary(backlogBefore) {
-    this.ensureRowStmt.run();
-    this.freezeBoundaryStmt.run({ backlogBefore });
-  }
-  /** Take the claim, or report that someone live already holds it. */
-  claim(pid, host, nowMs, staleAfterMs) {
-    this.ensureRowStmt.run();
-    let taken = false;
-    withTransaction(
-      this.db,
-      () => {
-        const result = this.claimStmt.run({
-          pid,
-          host,
-          now: nowMs,
-          staleBefore: nowMs - staleAfterMs
-        });
-        taken = result.changes === 1;
-      },
-      "IMMEDIATE"
-    );
-    return taken;
-  }
-  /** Say the holder is still alive. A no-op once the claim has moved on. */
-  heartbeat(pid, nowMs) {
-    this.heartbeatStmt.run({ now: nowMs, pid });
-  }
-  /** Give the claim up. Scoped to this holder, so a taken-over claim is left be. */
-  release(pid) {
-    this.releaseStmt.run({ pid });
-  }
-  /** Who holds the claim, if anyone. Read-only, for the same reason as above. */
-  lease() {
-    return getRow(this.leaseStmt);
-  }
-};
-
 // ../../packages/persistence/src/repositories/inspection-definitions.ts
 var SqliteInspectionDefinitionsRepository = class {
   constructor(db) {
@@ -28340,6 +29216,7 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
   if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
   if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
+  if (values.bodyRetention !== void 0) merged.bodyRetention = values.bodyRetention;
   if (values.vaultConsent !== void 0) {
     merged.vaultConsent = values.vaultConsent ? (
       // Keep an existing valid grant so its acknowledgedAt survives; mint one
@@ -30847,7 +31724,7 @@ var SqliteSecurityRepository = class {
                       ELSE 0
                     END) AS open_at_rest
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
@@ -31073,7 +31950,7 @@ var SqliteSecurityRepository = class {
       this.db.prepare(
         `SELECT e.repo AS repo, count(*) AS c
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
            AND e.repo IS NOT NULL
@@ -31197,7 +32074,7 @@ var SqliteSecurityRepository = class {
                 d.severity AS severity,
                 COUNT(*) AS count
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
@@ -31232,7 +32109,7 @@ var SqliteSecurityRepository = class {
         `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
                 d.rule_id AS rule_id, d.category AS category
          FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
@@ -32073,6 +32950,7 @@ function openWithPragmas(file2) {
     db.exec("PRAGMA journal_mode = WAL");
     db.exec("PRAGMA busy_timeout = 2000");
     db.exec("PRAGMA foreign_keys = ON");
+    registerSqlFunctions(db);
   } catch (err) {
     closeQuietly(db);
     throw err;
@@ -32102,7 +32980,7 @@ function backupLegacyStore(db, file2) {
   discardStore(file2, backup);
   return backup;
 }
-function openAndInitialize(file2, base) {
+function openAndInitialize(file2, base, skipTags) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
@@ -32112,7 +32990,7 @@ function openAndInitialize(file2, base) {
         `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
       );
     }
-    applyMigrations(db, file2);
+    applyMigrations(db, file2, { skipTags });
     tightenPerms(file2);
     const policies = new SqlitePoliciesRepository(db);
     const installedPacks = new SqliteInstalledPacksRepository(db, base);
@@ -32127,6 +33005,7 @@ function openAndInitialize(file2, base) {
       exceptions: new SqliteExceptionsRepository(db),
       resolutions: new SqliteResolutionsRepository(db),
       ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
+      bodyRetention: new SqliteBodyRetentionRepository(db),
       security: new SqliteSecurityRepository(db),
       detections: new SqliteDetectionsRepository(db),
       shares: new SqliteSharesRepository(db),
@@ -32137,6 +33016,7 @@ function openAndInitialize(file2, base) {
       activity: new SqliteActivityRepository(db),
       sourceProject: new SqliteSourceProjectRepository(db),
       auditEvents: new SqliteAuditEventsRepository(db),
+      captureStatus: new SqliteCaptureStatusRepository(db),
       classifiedData: new SqliteClassifiedDataRepository(db),
       inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
       inspectionFindings: new SqliteInspectionFindingsRepository(db),
@@ -32149,7 +33029,8 @@ function openAndInitialize(file2, base) {
     throw err;
   }
 }
-function openLocalDatabase(dir) {
+var DEFERRED_TAGS = new Set(DEFERRED_MIGRATION_TAGS);
+function openLocalDatabase(dir, options = {}) {
   ensureDataDirSync(dir);
   const file2 = join7(dir, DB_FILENAME);
   reapStalePartials(file2);
@@ -32161,6 +33042,7 @@ function openLocalDatabase(dir) {
     installedPacks,
     scanLedger,
     historySync,
+    bodyRetention,
     secretVault,
     exceptions,
     resolutions,
@@ -32175,6 +33057,7 @@ function openLocalDatabase(dir) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -32184,7 +33067,8 @@ function openLocalDatabase(dir) {
     // `dir` is always `<base>/data` — every caller resolves it through
     // `dataDir()` — so its parent is the `~/.aka` base the layout splits into
     // settings/ and data/, and the pack-policy floor needs both halves.
-    dirname2(dir)
+    dirname2(dir),
+    options.applyDeferredMigrations === true ? void 0 : DEFERRED_TAGS
   );
   function captureRowId(event) {
     return captureId(
@@ -32377,6 +33261,7 @@ function openLocalDatabase(dir) {
     installedPacks,
     scanLedger,
     historySync,
+    bodyRetention,
     secretVault,
     exceptions,
     resolutions,
@@ -32390,6 +33275,7 @@ function openLocalDatabase(dir) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -32417,6 +33303,7 @@ function openLocalDatabase(dir) {
 
 // ../../packages/persistence/src/egress-wire.ts
 import { createHash as createHash3 } from "crypto";
+var SLASH = "/".charCodeAt(0);
 
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash4 } from "crypto";
@@ -32427,18 +33314,109 @@ import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
 import { join as join8 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
+// ../../packages/persistence/src/forward-health.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+var BREAKER_COOLDOWN_MS = 3e4;
+function parseForwardHealth(raw, nowMs) {
+  try {
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
+    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
+    const parsedFailure = ControlPlaneFailure.safeParse(record2.lastFailure);
+    const lastFailure = parsedFailure.success ? parsedFailure.data : null;
+    return { consecutiveFailures: failures, openedAtMs, lastFailure };
+  } catch {
+    return null;
+  }
+}
+function readForwardHealth(dir, nowMs = Date.now()) {
+  try {
+    return parseForwardHealth(
+      readFileSync7(join9(dir, ATTACHED_FORWARD_STATE_FILENAME), "utf8"),
+      nowMs
+    );
+  } catch {
+    return null;
+  }
+}
+function isForwardPaused(health, nowMs) {
+  const openedAtMs = health?.openedAtMs ?? null;
+  if (openedAtMs === null) return false;
+  return nowMs - openedAtMs < BREAKER_COOLDOWN_MS;
+}
+
 // ../../packages/persistence/src/history-backfill.ts
 import { existsSync as existsSync4 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // ../../packages/persistence/src/history-preview.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
+// ../../packages/persistence/src/history-sync-state.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join12 } from "path";
+var HISTORY_SYNC_STATE_FILENAME = ATTACHED_HISTORY_SYNC_STATE_FILENAME;
+var PHASES = /* @__PURE__ */ new Set(["filling", "complete"]);
+var OUTCOMES = /* @__PURE__ */ new Set([
+  "ok",
+  "unreachable",
+  "refused",
+  "interrupted"
+]);
+var SPEC_VERSION = 1;
+function historySyncStatePath(dataDir2) {
+  return join12(dataDir2, HISTORY_SYNC_STATE_FILENAME);
+}
+function writeHistorySyncState(dataDir2, state) {
+  try {
+    ensureDataDirSync(dataDir2);
+    const persisted = { specVersion: SPEC_VERSION, ...state };
+    writeOwnerOnlyFileSync(historySyncStatePath(dataDir2), `${JSON.stringify(persisted)}
+`);
+  } catch {
+  }
+}
+function readHistorySyncState(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync8(historySyncStatePath(dataDir2), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const r = parsed2;
+    if (r.specVersion !== SPEC_VERSION) return null;
+    if (typeof r.phase !== "string" || !PHASES.has(r.phase)) return null;
+    if (typeof r.lastOutcome !== "string" || !OUTCOMES.has(r.lastOutcome)) return null;
+    if (!isCount(r.lastPassAtMs)) return null;
+    if (!isCount(r.sentTotal) || !isCount(r.pendingTotal) || !isCount(r.skippedTotal)) return null;
+    if (!isNullableCount(r.startedAtMs) || !isNullableCount(r.completedAtMs)) return null;
+    return {
+      specVersion: SPEC_VERSION,
+      phase: r.phase,
+      lastOutcome: r.lastOutcome,
+      lastPassAtMs: r.lastPassAtMs,
+      sentTotal: r.sentTotal,
+      pendingTotal: r.pendingTotal,
+      skippedTotal: r.skippedTotal,
+      startedAtMs: r.startedAtMs,
+      completedAtMs: r.completedAtMs
+    };
+  } catch {
+    return null;
+  }
+}
+function isCount(v) {
+  return typeof v === "number" && Number.isFinite(v) && v >= 0;
+}
+function isNullableCount(v) {
+  return v === null || isCount(v);
+}
+
 // ../../packages/persistence/src/store-symlinks.ts
 import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname3, join as join11, resolve } from "path";
+import { dirname as dirname3, join as join13, resolve } from "path";
 
 // ../../packages/persistence/src/vault/crypto.ts
 import {
@@ -32452,15 +33430,15 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join12 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync9, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
 import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join13 } from "path";
+import { join as join15 } from "path";
 
 // ../../packages/remote/src/http.ts
 import { request as httpRequest } from "http";
@@ -32491,6 +33469,12 @@ var RemoteRequestInvalid = class extends Error {
   }
   cause;
 };
+var RemoteEndpointRefused = class extends Error {
+  constructor(endpoint) {
+    super(`refusing to talk to an unsafe control-plane endpoint: ${originOnly(endpoint)}`);
+    this.name = "RemoteEndpointRefused";
+  }
+};
 var RemoteResponseInvalid = class extends Error {
   constructor(route, detail) {
     super(`control plane answered ${route} with ${detail}`);
@@ -32643,14 +33627,15 @@ function parsed(schema, body, route) {
   }
   return result.data;
 }
-function withoutTrailingSlashes(endpoint) {
+function resolveBaseUrl(endpoint) {
+  if (!isSafeEndpoint(endpoint)) throw new RemoteEndpointRefused(endpoint);
   let end = endpoint.length;
-  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH2) end -= 1;
   return endpoint.slice(0, end);
 }
-var SLASH = "/".charCodeAt(0);
+var SLASH2 = "/".charCodeAt(0);
 function createRemoteClient(options) {
-  const base = withoutTrailingSlashes(options.endpoint);
+  const base = resolveBaseUrl(options.endpoint);
   const url2 = (route) => `${base}${route}`;
   const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
   const sendOne = async (event) => {
@@ -32765,18 +33750,17 @@ function createRemoteClient(options) {
 }
 
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync15 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync8 } from "fs";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -32797,9 +33781,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync12, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join17 } from "path";
+import { basename as basename3, join as join19 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -33528,6 +34512,56 @@ var CONFIG_POSTURE_RULES = [
   }
 ];
 
+// ../../packages/detections/src/posture/web-capture-posture.ts
+var RULE_VERSION2 = "1";
+var DRIFT_MIN_PARSE_FAILURES = 2;
+var WEB_CAPTURE_DRIFT_STATES = /* @__PURE__ */ new Set([
+  "blind",
+  "degraded"
+]);
+var WEB_CAPTURE_DRIFT_RULE = {
+  ruleId: "web-capture-drift",
+  version: RULE_VERSION2,
+  name: "Web chat capture is not reading the site",
+  category: "config",
+  severity: "medium",
+  definition: JSON.stringify({
+    kind: "web-capture-drift",
+    states: [...WEB_CAPTURE_DRIFT_STATES],
+    minParseFailures: DRIFT_MIN_PARSE_FAILURES
+  })
+};
+var STATIC_COPY = {
+  active: { headline: "turns are being observed on this site" },
+  unreported: {
+    // Says "recently" rather than "yet": the store read is bounded to
+    // CAPTURE_STATUS_RECENCY_MS, so this state covers a site nothing has ever
+    // reported for AND one whose last report has aged out. The two are the
+    // same fact to a reader — nobody has confirmed anything lately — and the
+    // copy may not claim the stronger of them.
+    headline: `no report in the last ${String(CAPTURE_STATUS_RECENCY_DAYS)} days \u2014 open the site in Chrome with the extension loaded`
+  },
+  standby: {
+    headline: "this build declares no endpoints for the site, so nothing is observed yet"
+  },
+  unpatched: {
+    // Says what the flags say and no more. `patched` is false both for a tap
+    // that installed and hooked neither transport and for one that never ran
+    // at all — a page reports the same status either way, so the copy may not
+    // assert one of them.
+    headline: "the page tap captured neither fetch nor XHR \u2014 it may not have installed; reload the extension at chrome://extensions"
+  },
+  idle: { headline: "watching; no turn has been observed yet" },
+  blind: {
+    headline: "messages were sent in the page that the network capture never saw",
+    remediation: "reload the tab. If it persists after `aka update` and reloading the extension at chrome://extensions, the site's send path has changed and needs a new extension build."
+  },
+  degraded: {
+    headline: "the site's payloads no longer carry the fields the extension reads",
+    remediation: "run `aka update`, then reload the extension at chrome://extensions. If it stays degraded after an update, the site's contract has changed and needs a new extension build."
+  }
+};
+
 // ../../packages/detections/src/security/redos-probe.ts
 var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
@@ -33557,8 +34591,8 @@ var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute, join as join16, sep as sep2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join18, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
@@ -33569,8 +34603,8 @@ import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/host-floor.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join21 } from "path";
 
 // ../../packages/plugin-sdk/src/model-governance.ts
 import {
@@ -33578,11 +34612,11 @@ import {
   fstatSync,
   mkdirSync as mkdirSync2,
   openSync as openSync2,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync13,
   readSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 var TAIL_BYTES = 256 * 1024;
 
 // ../../packages/plugin-sdk/src/host-floor.ts
@@ -33605,15 +34639,15 @@ var HOST_FLOORS = {
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join22 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join21 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
+import { join as join23 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
@@ -33621,7 +34655,7 @@ import { basename as basename4, dirname as dirname5, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 import { existsSync as existsSync11, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join22 } from "path";
+import { basename as basename5, join as join24 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -33657,94 +34691,7 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join23 } from "path";
-
-// ../../packages/plugin-runtime/src/attached/forward-policy.ts
-var BREAKER_COOLDOWN_MS = 3e4;
-var FAILURES = /* @__PURE__ */ new Set([
-  "unauthorized",
-  "forbidden",
-  "unreachable"
-]);
-var FORWARD_STATE_FILENAME = ATTACHED_FORWARD_STATE_FILENAME;
-var STATE_FILENAME = FORWARD_STATE_FILENAME;
-function parseBreakerState(raw, nowMs) {
-  try {
-    const parsed2 = JSON.parse(raw);
-    if (typeof parsed2 !== "object" || parsed2 === null) return null;
-    const record2 = parsed2;
-    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
-    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
-    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
-    return { consecutiveFailures: failures, openedAtMs, lastFailure };
-  } catch {
-    return null;
-  }
-}
-function readForwardHealth(dir, nowMs = Date.now()) {
-  try {
-    return parseBreakerState(readFileSync15(join24(dir, STATE_FILENAME), "utf8"), nowMs);
-  } catch {
-    return null;
-  }
-}
-
-// ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync16 } from "fs";
 import { join as join25 } from "path";
-var HISTORY_SYNC_STATE_FILENAME = ATTACHED_HISTORY_SYNC_STATE_FILENAME;
-var PHASES = /* @__PURE__ */ new Set(["filling", "complete"]);
-var OUTCOMES = /* @__PURE__ */ new Set([
-  "ok",
-  "unreachable",
-  "refused",
-  "interrupted"
-]);
-var SPEC_VERSION = 1;
-function historySyncStatePath(dataDir2) {
-  return join25(dataDir2, HISTORY_SYNC_STATE_FILENAME);
-}
-function writeHistorySyncState(dataDir2, state) {
-  try {
-    ensureDataDirSync(dataDir2);
-    const persisted = { specVersion: SPEC_VERSION, ...state };
-    writeOwnerOnlyFileSync(historySyncStatePath(dataDir2), `${JSON.stringify(persisted)}
-`);
-  } catch {
-  }
-}
-function readHistorySyncState(dataDir2) {
-  try {
-    const parsed2 = JSON.parse(readFileSync16(historySyncStatePath(dataDir2), "utf8"));
-    if (typeof parsed2 !== "object" || parsed2 === null) return null;
-    const r = parsed2;
-    if (r.specVersion !== SPEC_VERSION) return null;
-    if (typeof r.phase !== "string" || !PHASES.has(r.phase)) return null;
-    if (typeof r.lastOutcome !== "string" || !OUTCOMES.has(r.lastOutcome)) return null;
-    if (!isCount(r.lastPassAtMs)) return null;
-    if (!isCount(r.sentTotal) || !isCount(r.pendingTotal) || !isCount(r.skippedTotal)) return null;
-    if (!isNullableCount(r.startedAtMs) || !isNullableCount(r.completedAtMs)) return null;
-    return {
-      specVersion: SPEC_VERSION,
-      phase: r.phase,
-      lastOutcome: r.lastOutcome,
-      lastPassAtMs: r.lastPassAtMs,
-      sentTotal: r.sentTotal,
-      pendingTotal: r.pendingTotal,
-      skippedTotal: r.skippedTotal,
-      startedAtMs: r.startedAtMs,
-      completedAtMs: r.completedAtMs
-    };
-  } catch {
-    return null;
-  }
-}
-function isCount(v) {
-  return typeof v === "number" && Number.isFinite(v) && v >= 0;
-}
-function isNullableCount(v) {
-  return v === null || isCount(v);
-}
 
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash6 } from "crypto";
@@ -33770,7 +34717,16 @@ function rebuildCapture(row) {
   const metadata = {
     ...rootSessionId === null ? {} : { sessionId: rootSessionId },
     ...filePath === void 0 ? {} : { filePath },
-    ...pick2(attributes, { repo: "repo", toolName: "tool_name", model: "model" }),
+    ...pick2(attributes, {
+      repo: "repo",
+      toolName: "tool_name",
+      model: "model",
+      // The join back to the llm_call leaf for the same web-chat turn.
+      // Stripping these would forward a response capture the deployment can
+      // never correlate to the llm_call leaf describing the same turn.
+      messageId: "message_id",
+      conversationId: "conversation_id"
+    }),
     // The two constrained strings, kept only if they satisfy the wire.
     ...withField("traceId", keep(stringOrUndefined(attributes.trace_id), TRACE_ID)),
     ...withField(
@@ -33791,7 +34747,20 @@ function rebuildCapture(row) {
     // it, IngestEvent.safeParse then refuses the assembled event, and the whole
     // capture becomes a permanent skip. That is the per-row door the rest of this
     // function exists to avoid, and this field was the last one still using it.
-    ...withList("exceptionIds", keepAll(attributes.exception_ids, EXCEPTION_ID))
+    ...withList("exceptionIds", keepAll(attributes.exception_ids, EXCEPTION_ID)),
+    // Carried, for the same reason exceptionIds is: it says WHY an enforced
+    // detection let a value through, and a capture that means one thing live
+    // and another when drained is worse than one that carries neither.
+    //
+    // Parsed rather than type-checked. The bag is free-form JSON, so a hand
+    // edit or an older build can leave any string here; an unparseable one is
+    // dropped rather than assembled into an event the deployment would refuse
+    // with a 400 — which, on a drain that reads the head of the unstamped set
+    // with no cursor, is the per-row door that retires the whole lane.
+    ...withField(
+      "redactDegradedTo",
+      keep(stringOrUndefined(attributes.redact_degraded_to), REDACT_DEGRADED_TO)
+    )
     // inspectionMs is DELIBERATELY not carried. It measures latency a live host
     // session actually waited on, and a row being drained hours later is not
     // that; the field's own contract says a replay leaves it absent rather than
@@ -33820,6 +34789,7 @@ function keepAll(value, schema) {
 var CORRELATION_ID = EventMetadata.shape.correlationId;
 var TRACE_ID = EventMetadata.shape.traceId;
 var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
+var REDACT_DEGRADED_TO = EventMetadata.shape.redactDegradedTo.unwrap();
 function isoOrUndefined(epochMs) {
   if (!Number.isFinite(epochMs)) return void 0;
   const iso = new Date(epochMs);
@@ -33899,7 +34869,6 @@ function attributesOf(raw) {
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 var HISTORY_REQUEST_TIMEOUT_MS = 15e3;
 var HISTORY_PASS_BUDGET_MS = 12e4;
-var HISTORY_LEASE_STALE_MS = 6e4;
 var HEARTBEAT_EVERY_MS = 1e4;
 var PACE_INTERVAL_MS = 200;
 var MAX_ATTEMPTS = 4;
@@ -33908,6 +34877,23 @@ var SESSION_PAGE = 25;
 var ROW_PAGE = 200;
 var CAPTURE_GRACE_MS = 3e4;
 var CAPTURE_BATCH_SIZE = INGEST_BATCH_MAX;
+var CAPTURE_BATCH_BYTES = 1024 * 1024;
+function underByteCeiling(ready) {
+  const fitting = [];
+  const oversized = [];
+  let bytes = 0;
+  for (const item of ready) {
+    const size = Buffer.byteLength(item.event.content, "utf8");
+    if (size > CAPTURE_BATCH_BYTES) {
+      oversized.push(item.id);
+      continue;
+    }
+    if (bytes + size > CAPTURE_BATCH_BYTES) break;
+    bytes += size;
+    fitting.push(item);
+  }
+  return { fitting, oversized };
+}
 var STRUCTURAL_BUDGET_SHARE = 0.7;
 var BATCH_SIZE = AUDIT_EVENT_BATCH_MAX;
 function endpointFingerprint(endpoint) {
@@ -33937,8 +34923,7 @@ async function runHistorySync(deps) {
     const state = readControlPlaneCredentialFile(deps.settingsDir, connection);
     if (!state.usable) return didNotRun("credential-unusable");
     const nowMs = now();
-    const openedAtMs = readForwardHealth(deps.dataDir, nowMs)?.openedAtMs ?? null;
-    if (openedAtMs !== null && nowMs - openedAtMs < BREAKER_COOLDOWN_MS) {
+    if (isForwardPaused(readForwardHealth(deps.dataDir, nowMs), nowMs)) {
       return didNotRun("breaker-open");
     }
     db = (deps.openStore ?? openLocalDatabase)(deps.dataDir);
@@ -33958,7 +34943,7 @@ async function runHistorySync(deps) {
       backlogBefore = recorded.backlogBefore;
     }
     const pid = process.pid;
-    if (!ledger.claim(pid, hostname5(), now(), HISTORY_LEASE_STALE_MS)) {
+    if (!ledger.claim(pid, hostname5(), now(), HISTORY_SYNC_LEASE_STALE_MS)) {
       return didNotRun("already-running");
     }
     const client = deps.sendBatch !== void 0 && deps.sendCaptures !== void 0 && deps.sendOne !== void 0 ? void 0 : createRemoteClient({
@@ -34008,6 +34993,7 @@ async function runHistorySync(deps) {
 async function drain(d) {
   const startedAt = d.now();
   const deadline = startedAt + d.budgetMs;
+  d.ledger.releaseStaleClaims(startedAt - HISTORY_SYNC_LEASE_STALE_MS);
   const structuralDeadline = Math.min(deadline, startedAt + d.budgetMs * STRUCTURAL_BUDGET_SHARE);
   let sent = 0;
   let skipped = 0;
@@ -34030,7 +35016,7 @@ async function drain(d) {
         for (const row of rows) {
           const event = rebuildAuditEvent(row, d.ledger.inspectionsFor(row.id));
           if (event === void 0) {
-            d.ledger.markSkipped([row.id]);
+            d.ledger.markSkipped([row.id], d.now());
             skipped += 1;
             continue;
           }
@@ -34042,7 +35028,14 @@ async function drain(d) {
             break outer;
           }
           const chunk = ready.slice(i, i + BATCH_SIZE);
-          const result = await sendChunk(d, chunk, beat);
+          const chunkIds = chunk.map((c) => c.id);
+          d.ledger.claimRows(chunkIds, d.now());
+          let result;
+          try {
+            result = await sendChunk(d, chunk, beat);
+          } finally {
+            releaseClaim(d, chunkIds);
+          }
           sent += result.sent;
           skipped += result.skipped;
           if (result.stopped !== void 0) {
@@ -34100,7 +35093,7 @@ async function drainCaptures(d, deadline, beat) {
       ready.push({ id: row.id, event });
     }
     if (unbuildable.length > 0) {
-      d.ledger.markSkipped(unbuildable);
+      d.ledger.markSkipped(unbuildable, d.now());
       skipped += unbuildable.length;
     }
     if (ready.length === 0) {
@@ -34108,7 +35101,24 @@ async function drainCaptures(d, deadline, beat) {
       await d.sleep(PACE_INTERVAL_MS);
       continue;
     }
-    const result = await sendCaptureChunk(d, ready, beat);
+    const { fitting, oversized } = underByteCeiling(ready);
+    if (oversized.length > 0) {
+      d.ledger.markSkipped(oversized, d.now());
+      skipped += oversized.length;
+    }
+    if (fitting.length === 0) {
+      beat();
+      await d.sleep(PACE_INTERVAL_MS);
+      continue;
+    }
+    const readyIds = fitting.map((r) => r.id);
+    d.ledger.claimRows(readyIds, d.now());
+    let result;
+    try {
+      result = await sendCaptureChunk(d, fitting, beat);
+    } finally {
+      releaseClaim(d, readyIds);
+    }
     sent += result.sent;
     skipped += result.skipped;
     if (result.stopped !== void 0) return { sent, skipped, stopped: result.stopped };
@@ -34136,7 +35146,7 @@ async function sendCaptureChunk(d, chunk, beat) {
   {
     const only = chunk.length === 1 ? chunk[0] : void 0;
     if (only !== void 0) {
-      d.ledger.markSkipped([only.id]);
+      recordGaveUp(d, [only.id], outcome.verdict);
       return { sent: 0, skipped: 1 };
     }
     return await isolate(d, chunk, beat);
@@ -34163,7 +35173,8 @@ async function sendCapturesWithRetries(d, chunk, beat) {
     } catch (err) {
       const kind = classify(err);
       if (kind === "refused") return { verdict: "refused" };
-      if (kind === "skip") return { verdict: "skip" };
+      if (kind === "payload-invalid") return { verdict: "payload-invalid" };
+      if (kind === "deployment-refused") return { verdict: "deployment-refused" };
       if (attempt === MAX_ATTEMPTS - 1) return { verdict: "unreachable" };
       const ceiling = Math.min(MAX_BACKOFF_MS, 1e3 * 2 ** attempt);
       beat();
@@ -34205,7 +35216,7 @@ async function sendSingleRow(d, one, beat) {
   if (outcome.verdict === "refused" || outcome.verdict === "unreachable") {
     return { sent: 0, skipped: 0, stopped: outcome.verdict };
   }
-  d.ledger.markSkipped([one.id]);
+  recordGaveUp(d, [one.id], outcome.verdict);
   return { sent: 0, skipped: 1 };
 }
 async function isolateStructural(d, chunk, beat) {
@@ -34229,7 +35240,8 @@ async function sendWithRetries(d, attempt, beat) {
     } catch (err) {
       const kind = classify(err);
       if (kind === "refused") return { verdict: "refused" };
-      if (kind === "skip") return { verdict: "skip" };
+      if (kind === "payload-invalid") return { verdict: "payload-invalid" };
+      if (kind === "deployment-refused") return { verdict: "deployment-refused" };
       if (i === MAX_ATTEMPTS - 1) return { verdict: "unreachable" };
       const ceiling = Math.min(MAX_BACKOFF_MS, 1e3 * 2 ** i);
       beat();
@@ -34238,6 +35250,22 @@ async function sendWithRetries(d, attempt, beat) {
   }
   return { verdict: "unreachable" };
 }
+function releaseClaim(d, ids) {
+  try {
+    d.ledger.releaseRows(ids);
+  } catch {
+  }
+}
+function recordGaveUp(d, ids, verdict) {
+  switch (verdict) {
+    case "deployment-refused":
+      d.ledger.markRefused(ids, d.now());
+      return;
+    case "payload-invalid":
+      d.ledger.markSkipped(ids, d.now());
+      return;
+  }
+}
 function statusOf2(err) {
   if (typeof err !== "object" || err === null || !("status" in err)) return null;
   const { status } = err;
@@ -34245,7 +35273,7 @@ function statusOf2(err) {
   return status >= 100 && status <= 599 ? status : null;
 }
 function classify(err) {
-  if (err.name === "RemoteRequestInvalid") return "skip";
+  if (err.name === "RemoteRequestInvalid") return "payload-invalid";
   switch (statusOf2(err)) {
     // Terminal in a way a timeout is not: the credential may have died with an
     // offboarded member, and every later row would fail the same way.
@@ -34253,11 +35281,11 @@ function classify(err) {
     case 403:
       return "refused";
     // The deployment understood the request and rejected it. Re-sending an
-    // identical body cannot change that.
+    // identical body TO THIS DEPLOYMENT cannot change that.
     case 400:
     case 413:
     case 422:
-      return "skip";
+      return "deployment-refused";
     default:
       return "retry";
   }
@@ -34293,7 +35321,18 @@ async function runHistorySyncPass(base = defaultDataDir(), seams = {}) {
       // field whose capture half is one pass wide, so the surface beside
       // `sentTotal` and `pendingTotal` would announce a permanent loss once and
       // drop it on the next pass, while the rows stayed gone.
-      skippedTotal: result.counts.skipped + result.counts.capturesSkipped,
+      //
+      // EVERY reason the store can name, not just the original one. Splitting
+      // `skipped` into its reasons gave the store a truer answer and silently
+      // shrank this number twice over: a structural row a deployment rejected,
+      // and a window a detach closed over undelivered, both used to land in
+      // `skipped` and reach a surface, and after the splits each reached
+      // nothing. A bucket this sum does not name is a row that disappears from
+      // the only total anyone sees.
+      //
+      // The capture term needs no counterpart: that lane keeps both of its
+      // reasons in one total, because neither is ever freed there.
+      skippedTotal: result.counts.skipped + result.counts.refused + result.counts.detached + result.counts.capturesSkipped,
       // The first pass that ran is when this machine started sending, and it
       // keeps that answer across every later pass.
       startedAtMs: previous?.startedAtMs ?? result.atMs,
@@ -34330,10 +35369,13 @@ import { readFileSync as readFileSync17 } from "fs";
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
+var IMMEDIATE_RETRIES = 8;
+var TIMED_RETRIES = 4;
+var ATTEMPTS = 1 + IMMEDIATE_RETRIES + TIMED_RETRIES;
 
 // ../../packages/plugin-runtime/src/attached/posture-reporter.ts
 var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
@@ -34345,11 +35387,11 @@ import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
 import { readFileSync as readFileSync18 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {
@@ -34370,6 +35412,14 @@ import { spawn as spawn2 } from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
 
+// ../../packages/plugin-runtime/src/content-retention-pass.ts
+var MAX_ROWS_PER_SWEEP = 50 * 1e3;
+
+// ../../packages/plugin-runtime/src/content-retention-trigger.ts
+import { spawn as spawn3 } from "child_process";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var CONTENT_RETENTION_THROTTLE_MS = 60 * 60 * 1e3;
+
 // ../../packages/plugin-runtime/src/attached/factory.ts
 import { hostname as hostname6 } from "os";