@akasecurity/ai-tc-claude-code 0.9.9 → 0.9.10

package/scripts/pre-tool-use.js

@@ -493,11 +493,12 @@ var require_ignore = __commonJS({
 
 // ../../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync7 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // ../../packages/persistence/src/attached-derived.ts
 import { rmSync } from "fs";
 import { join } from "path";
+var POLICY_CACHE_FILENAME = "policy-cache.json";
 var ATTACHED_FORWARD_STATE_FILENAME = "attached-state.json";
 var ATTACHED_FORWARD_DROPS_FILENAME = "attached-forward-drops.json";
 
@@ -598,6 +599,30 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0022_audit_inspection_ms",
     sql: "ALTER TABLE `audit_events` ADD `inspection_ms` integer GENERATED ALWAYS AS (json_extract(attributes, '$.inspection_ms')) VIRTUAL;"
+  },
+  {
+    tag: "0023_secret_vault_user_authorized",
+    sql: "ALTER TABLE `secret_vault` ADD `user_authorized` integer DEFAULT 0 NOT NULL;"
+  },
+  {
+    tag: "0024_finding_resolution_key_created_index",
+    sql: "DROP INDEX IF EXISTS `idx_finding_resolution_key`;--> statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key_created` ON `finding_resolution` (`finding_key`,`created_at`);"
+  },
+  {
+    tag: "0025_audit_capture_attribute_columns",
+    sql: "ALTER TABLE `audit_events` ADD `source_tool` text GENERATED ALWAYS AS (json_extract(attributes, '$.source_tool')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `repo` text GENERATED ALWAYS AS (json_extract(attributes, '$.repo')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `file_path` text GENERATED ALWAYS AS (json_extract(attributes, '$.file_path')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `tool_name` text GENERATED ALWAYS AS (json_extract(attributes, '$.tool_name')) VIRTUAL;"
+  },
+  {
+    tag: "0026_audit_llm_call_usage_columns",
+    sql: "ALTER TABLE `audit_events` ADD `service_tier` text GENERATED ALWAYS AS (json_extract(attributes, '$.service_tier')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_1h_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_1h_input_tokens')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_5m_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_5m_input_tokens')) VIRTUAL;--> statement-breakpoint\nALTER TABLE `audit_events` ADD `web_search_requests` integer GENERATED ALWAYS AS (json_extract(attributes, '$.web_search_requests')) VIRTUAL;"
+  },
+  {
+    tag: "0027_audit_llm_usage_index",
+    sql: "CREATE INDEX `idx_audit_llm_usage` ON `audit_events` (`started_at`,`root_session_id`,`provider`,`model`,`service_tier`,`input_tokens`,`output_tokens`,`cache_creation_input_tokens`,`cache_read_input_tokens`,`ephemeral_1h_input_tokens`,`ephemeral_5m_input_tokens`,`web_search_requests`) WHERE event_type = 'llm_call' AND attributes IS NOT NULL;"
+  },
+  {
+    tag: "0028_activity_session_probe_indexes",
+    sql: "CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--> statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--> statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--> statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"
   }
 ];
 
@@ -22137,6 +22162,26 @@ var AttachTokenResponse = external_exports.union([
   AttachTokenExpired,
   external_exports.object({ status: printable(64) })
 ]);
+var DeviceCommandKind = external_exports.enum(["shares_rescan"]);
+var DeviceCommand = external_exports.object({
+  id: printable(128).min(1),
+  kind: DeviceCommandKind,
+  issuedAt: printable(64).min(1),
+  expiresAt: printable(64).min(1)
+}).strict();
+var DeviceCommandPollResponse = external_exports.object({ command: DeviceCommand.nullable() });
+var DeviceCommandFailureReason = external_exports.enum(["scan_failed", "no_projects", "expired"]);
+var DeviceCommandAckBody = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({
+    outcome: external_exports.literal("reported"),
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("failed"),
+    reason: DeviceCommandFailureReason,
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict()
+]);
 
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -22303,7 +22348,7 @@ var PackManifest = external_exports.object({
 }).meta({ id: "PackManifest" });
 
 // ../../packages/schema/src/zod/detection.ts
-var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
+var OriginEnum = external_exports.enum(["library", "custom"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
 var LibraryStateEnum = external_exports.enum(["new", "imported", "update"]).meta({ id: "LibraryStateEnum" });
 var DetectionCounts = external_exports.object({
@@ -22440,14 +22485,17 @@ function optional2(key, parsed2, raw) {
 function isStringArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+var ORIGIN_VALUES = { library: true, custom: true };
+function resolveOrigin(origin) {
+  return origin != null && Object.hasOwn(ORIGIN_VALUES, origin) ? origin : "library";
+}
 function summaryToDetectionListItem(s) {
   return {
     id: `${s.namespace}/${s.packId}`,
     name: s.name,
     version: s.version,
     enabled: s.enabled,
-    origin: "library",
-    // v1: every installed pack is library origin
+    origin: resolveOrigin(s.origin),
     namespace: s.namespace,
     packId: s.packId,
     ruleCount: s.ruleCount,
@@ -22499,7 +22547,7 @@ function rowToDetectionDetail(row, findingsLast30d, update) {
     name: row.name,
     version: row.version,
     enabled: row.enabled,
-    origin: "library",
+    origin: resolveOrigin(row.origin),
     namespace: row.namespace,
     packId: row.packId,
     ruleCount: row.rules.length,
@@ -22519,16 +22567,20 @@ function splitDetectionId(id) {
 }
 function buildDetectionsList(summaries, query) {
   const withUpdate = summaries.filter((s) => s.latestVersion != null);
+  const originOf = (s) => resolveOrigin(s.origin);
   const counts = {
     all: summaries.length,
-    library: summaries.length,
-    // all origin=library in v1
-    custom: 0,
+    library: summaries.filter((s) => originOf(s) === "library").length,
+    custom: summaries.filter((s) => originOf(s) === "custom").length,
+    // No origin member produces this, so it is 0 BY CONSTRUCTION rather than by
+    // omission: `customized` would mean a LIBRARY pack whose rules were edited in
+    // place, and that state does not exist — editing a library pack forks it. See
+    // OriginEnum.
     customized: 0,
     updates: withUpdate.length
   };
   const filter = query.filter;
-  let filtered = filter === "custom" || filter === "customized" ? [] : filter === "updates" ? [...withUpdate] : [...summaries];
+  let filtered = filter === "customized" ? [] : filter === "custom" ? summaries.filter((s) => originOf(s) === "custom") : filter === "library" ? summaries.filter((s) => originOf(s) === "library") : filter === "updates" ? [...withUpdate] : [...summaries];
   if (query.q) {
     const q = query.q.toLowerCase();
     filtered = filtered.filter(
@@ -22608,8 +22660,9 @@ var Event = external_exports.object({
   metadata: EventMetadata.optional()
 }).meta({ id: "Event" });
 var IngestEvent = Event.meta({ id: "IngestEvent" });
+var INGEST_BATCH_MAX = 100;
 var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
+  events: external_exports.array(IngestEvent).min(1).max(INGEST_BATCH_MAX),
   // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
   // additionally rejects any event whose contentHash the store has already
   // recorded — for re-runnable bulk ingest (worktree scan, transcript
@@ -23165,6 +23218,252 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var PolicyProvenance = external_exports.enum(["builtin", "authored"]).meta({ id: "PolicyProvenance" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional(),
+  // Whether an AUTHORED policy governs this row's target — not a claim about
+  // which row this is. A producer that collapses several rows onto one target
+  // must carry the marker onto whichever row survives, or the collapse decides
+  // the answer; a survivor may therefore be a built-in expansion still marked
+  // 'authored' because an authored sibling targeted the same thing.
+  // Optional so an older producer — and an older on-disk cache — still parses;
+  // absent reads as 'builtin', which is the behaviour that predates the field.
+  //
+  // Deliberately NOT `kind`/PolicyKind: that name and that enum answer which
+  // built-in archetype catalog entry a policy is, which every catalog surface
+  // reads and which a caller may state. This one is a statement the PRODUCER
+  // of a bundle makes about a row, and only the bundle builder ever stamps it
+  // — the CRUD routes neither accept nor set it.
+  //
+  // A device consumes this in exactly one direction: an 'authored' policy
+  // arriving from a control plane marks the rules it targets as not
+  // locally re-assignable. That can only ever ADD a refusal, never relax one,
+  // which is what makes it safe to honour from an unsigned cache — the same
+  // test `prohibitedModels` passes and `reversibleRuleIds` fails.
+  provenance: PolicyProvenance.optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  // Model ids (the raw `model` string a harness reports, e.g.
+  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
+  // a session onto one (PreModelSwitch) and refuses a turn that would run on
+  // one (UserPromptSubmit). Optional so an older backend — and an older
+  // on-disk cache — still parses; consumers read `?? []`, which is the
+  // unenforced behaviour that predates this field and the safe direction to
+  // default.
+  //
+  // Ids, not display names: the governance decision is keyed on the exact
+  // string the harness reports (`model_status_override.versionId` in the
+  // control plane), so no name resolution stands between the decision and the
+  // comparison.
+  prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var POLICY_BUNDLE_SHAPE_ID = [
+  ...Object.keys(PolicyBundle.shape),
+  ...Object.keys(Policy.shape).map((key) => `policies.${key}`),
+  ...PolicyTarget.options.flatMap((member) => "shape" in member ? Object.keys(member.shape) : []).map((key) => `policies.target.${key}`),
+  ...Object.keys(ExceptionBundleEntry.shape).map((key) => `exceptions.${key}`)
+].sort().join(",");
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
+var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var PALETTE_WEAKEST_FIRST = [
+  ...new Set(KNOWN_BUILTIN_IDS.map(builtinPolicyToAction))
+];
+var BELOW_PALETTE = ACTION_TAKEN_KEYS.filter(
+  (action) => !PALETTE_WEAKEST_FIRST.includes(action)
+);
+var ACTION_STRENGTH_ORDER = [
+  ...BELOW_PALETTE,
+  ...PALETTE_WEAKEST_FIRST
+];
+function actionRank(action) {
+  return ACTION_STRENGTH_ORDER.indexOf(action);
+}
+function isActionAtLeast(action, floor) {
+  return actionRank(action) >= actionRank(floor);
+}
+function strongerAction(a, b) {
+  return actionRank(a) >= actionRank(b) ? a : b;
+}
+function weakestBuiltinAtLeast(floor) {
+  return KNOWN_BUILTIN_IDS.find((id) => isActionAtLeast(builtinPolicyToAction(id), floor)) ?? "block";
+}
+var PackPolicyFloor = external_exports.object({
+  /**
+   * The weakest archetype the device may assign. Stated as a BuiltinPolicyId
+   * rather than a raw ActionTaken because that is the vocabulary the user
+   * picks from — a floor a UI cannot name is one it cannot explain.
+   */
+  floor: BuiltinPolicyId,
+  /**
+   * True when the organization AUTHORED a policy governing this pack rather
+   * than stating a minimum: it gave the answer, so the pack is not
+   * re-assignable locally in either direction.
+   */
+  locked: external_exports.boolean()
+}).describe("PackPolicyFloor");
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+function builtinPolicyIsReversible(id) {
+  return BUILTIN_POLICY_SPECS[id].reversible;
+}
+function policyIdIsReversible(policyId) {
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
+  return builtinPolicyIsReversible(id);
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var DEFAULT_PACK_POLICY_ID = "monitor";
+function policyIdToAction(policyId) {
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
+  return BUILTIN_POLICIES[id].action;
+}
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/vault.ts
 var POINTER_FORMAT_VERSION = 2;
 var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
@@ -23205,6 +23504,14 @@ var VaultEntry = external_exports.object({
   // How many times this value has been detected on this machine — the reuse
   // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
   occurrenceCount: external_exports.number().int().nonnegative(),
+  // True when a PERSON asked for this value to be replaced — the surfaced-
+  // secrets strike — rather than a pack enforcing its assignment. One value is
+  // one row however many paths vault it, so this is what tells a policy sweep
+  // that the row carries somebody's own instruction and not just an assignment
+  // that has since been lowered. STICKY and MONOTONIC: a later automatic
+  // vaulting of the same value must never clear it — what the user said about
+  // the value does not expire.
+  userAuthorized: external_exports.boolean(),
   firstSeen: external_exports.string(),
   lastSeen: external_exports.string()
 });
@@ -23331,7 +23638,7 @@ function isVaultConsentValid(consent) {
 }
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 6;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
@@ -23373,6 +23680,19 @@ var WorkspaceSettings = external_exports.object({
   vaultKeyCustody: VaultKeyCustody.default("file"),
   // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
   vaultInlineReveal: VaultInlineReveal.default("masked"),
+  // What a `redact` policy degrades to on a FIELD the host cannot rewrite in
+  // place. Not a handling policy: the policy has already resolved to redact,
+  // and this only says what happens when the host offers no channel to carry it
+  // out — Antigravity's PreToolUse has no updatedInput at all, and Codex and
+  // Claude Code decline to mask a field that EXECUTES because masking would
+  // change what runs. Per FIELD rather than per host, so a host that can
+  // rewrite some inputs keeps true redaction on those.
+  //
+  // Spelled in the built-in policy vocabulary rather than as a fresh enum, so
+  // an attached machine's merge is `strongerAction` over the one action ladder
+  // and no second rank order exists to drift from it. 'deny' is a host wire
+  // word and stays out of the stored value.
+  redactFallback: RedactFallback.default("warn"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -23380,10 +23700,12 @@ var WorkspaceSettings = external_exports.object({
   // Absent until granted; a stale payloadVersion means the consent no longer
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
-  // Records that the user consented to sending the activity already recorded on
-  // this machine to the deployment it is attached to, along with the payload
-  // shape and the endpoint they agreed to. Absent until granted, and a grant for
-  // a different endpoint or an older payload no longer counts.
+  // Records that the user consented to the DEFERRED send — the outbox — along
+  // with the payload shape and the endpoint they agreed to. Since payload v2
+  // that covers both the pre-attach backlog and undelivered captures (which
+  // carry prompt/reply text in `content`); the key name predates the widening.
+  // Absent until granted, and a grant for a different endpoint or an older
+  // payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional()
 });
 function defaultWorkspaceSettings() {
@@ -23511,7 +23833,8 @@ var ManagedSettingKey = external_exports.enum([
   "vaultKeyCustody",
   "vaultInlineReveal",
   "modelJudgeConsent",
-  "dataSharesInPlace"
+  "dataSharesInPlace",
+  "redactFallback"
 ]).meta({ id: "ManagedSettingKey" });
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
@@ -23524,7 +23847,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
-  dataSharesInPlace: external_exports.boolean().optional()
+  dataSharesInPlace: external_exports.boolean().optional(),
+  redactFallback: RedactFallback.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -23539,186 +23863,6 @@ var ManagedSettings = external_exports.object({
   lockedFields: external_exports.array(ManagedSettingKey).default([])
 }).meta({ id: "ManagedSettings" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
-  // A second axis over the same `redact` action, carried beside the policies
-  // rather than on them: nothing writes ruleId-targeted policies to disk, so
-  // widening Policy itself would change a persisted shape to express something
-  // only the in-memory bundle needs. Optional so an older producer — or an
-  // older on-disk cache — still parses; consumers read `?? []` and get the
-  // pre-existing one-way behaviour, which is the safe direction to default.
-  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  // Model ids (the raw `model` string a harness reports, e.g.
-  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
-  // a session onto one (PreModelSwitch) and refuses a turn that would run on
-  // one (UserPromptSubmit). Optional so an older backend — and an older
-  // on-disk cache — still parses; consumers read `?? []`, which is the
-  // unenforced behaviour that predates this field and the safe direction to
-  // default.
-  //
-  // Ids, not display names: the governance decision is keyed on the exact
-  // string the harness reports (`model_status_override.versionId` in the
-  // control plane), so no name resolution stands between the decision and the
-  // comparison.
-  prohibitedModels: external_exports.array(external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    reversible: false,
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    reversible: false,
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    reversible: false,
-    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
-  },
-  vault: {
-    name: "Redact & Vault",
-    action: "redact",
-    reversible: true,
-    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    reversible: false,
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => !BUILTIN_POLICY_SPECS[id].reversible
-);
-var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => BUILTIN_POLICY_SPECS[id].reversible
-);
-var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
-function builtinPolicyIsReversible(id) {
-  return BUILTIN_POLICY_SPECS[id].reversible;
-}
-function policyIdIsReversible(policyId) {
-  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
-  return builtinPolicyIsReversible(id);
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var DEFAULT_PACK_POLICY_ID = "monitor";
-function policyIdToAction(policyId) {
-  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
-  return BUILTIN_POLICIES[id].action;
-}
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -23964,10 +24108,12 @@ var DismissRecommendedActionResponse = external_exports.object({ id: external_ex
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
 // ../../packages/schema/src/zod/settings-action.ts
+var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
+var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
-  modelJudgeConsent: external_exports.boolean(),
-  historySyncConsent: external_exports.boolean(),
+  modelJudgeConsent: ModelJudgeConsentChoice,
+  historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string()
 });
@@ -24117,9 +24263,9 @@ function deriveReviewReasons(trust, transports) {
   if (transports.includes("http") || transports.includes("ws")) reasons.push("plaintext_transport");
   return reasons;
 }
-function buildReviewInfo(trust, transports) {
+function buildReviewInfo(trust, transports, decided) {
   const reasons = deriveReviewReasons(trust, transports);
-  return { needsReview: reasons.length > 0, reasons };
+  return { needsReview: reasons.length > 0 && !decided, reasons };
 }
 function distinctTransports(transports) {
   return Array.from(new Set(transports));
@@ -24337,8 +24483,8 @@ function readControlPlaneCredential(settingsDir2, connection) {
 }
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join4, sep } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+import { dirname as dirname2, join as join7, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/persistence/src/ids.ts
@@ -24603,6 +24749,10 @@ function allRows(stmt, params) {
   if (Array.isArray(params)) return stmt.all(...params);
   return stmt.all(params);
 }
+function* iterateRows(stmt, params) {
+  const rows = params === void 0 ? stmt.iterate() : Array.isArray(params) ? stmt.iterate(...params) : stmt.iterate(params);
+  for (const row of rows) yield row;
+}
 function getRow(stmt, params) {
   if (params === void 0) return stmt.get();
   if (Array.isArray(params)) return stmt.get(...params);
@@ -25071,10 +25221,17 @@ function ensureSyncedAtColumn(db, table) {
   if (!columns.includes("sync_claimed_at")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN sync_claimed_at integer`);
   }
+  if (!columns.includes("outbox_owed")) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN outbox_owed integer`);
+  }
   db.exec(
     `CREATE INDEX IF NOT EXISTS idx_audit_events_sync
        ON audit_events (event_type, synced_at, sync_claimed_at, started_at)`
   );
+  db.exec(
+    `CREATE INDEX IF NOT EXISTS idx_audit_outbox_owed
+       ON audit_events (event_type, synced_at, sync_claimed_at, started_at) WHERE outbox_owed = 1`
+  );
   db.exec(
     `CREATE INDEX IF NOT EXISTS idx_audit_claimed
        ON audit_events (sync_claimed_at) WHERE sync_claimed_at IS NOT NULL`
@@ -25179,7 +25336,6 @@ function decodeKeysetCursor(cursor) {
 // ../../packages/persistence/src/repositories/activity.ts
 var DAY_MS = 864e5;
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
-var LAST_ACTIVITY_EXPR = `max(started_at, coalesce(ended_at, started_at))`;
 function defaultTimeZone() {
   try {
     return Intl.DateTimeFormat().resolvedOptions().timeZone;
@@ -25234,6 +25390,7 @@ var DB_EVENT_TYPE_TO_KIND = {
   error: "error",
   active: "active"
 };
+var TIMELINE_EVENT_TYPES = Object.keys(DB_EVENT_TYPE_TO_KIND).map((kind) => `'${kind}'`).join(", ");
 function safeParseStringArray(raw) {
   if (!raw) return [];
   const parsed2 = safeJson(raw, null);
@@ -25307,6 +25464,37 @@ var TIMELINE_COLUMNS = `
   json_extract(attributes, '$.targetId') AS target_id,
   json_extract(attributes, '$.internal') AS internal,
   json_extract(attributes, '$.flagged') AS flagged`;
+var LLM_USAGE_SELECT = `
+  SELECT root_session_id AS sessionId,
+         provider,
+         model,
+         service_tier AS serviceTier,
+         coalesce(sum(input_tokens), 0) AS inputTokens,
+         coalesce(sum(output_tokens), 0) AS outputTokens,
+         coalesce(sum(cache_creation_input_tokens), 0) AS cacheCreationTokens,
+         coalesce(sum(cache_read_input_tokens), 0) AS cacheReadTokens,
+         coalesce(sum(ephemeral_1h_input_tokens), 0) AS ephemeral1hTokens,
+         coalesce(sum(ephemeral_5m_input_tokens), 0) AS ephemeral5mTokens,
+         coalesce(sum(web_search_requests), 0) AS webSearchRequests`;
+var LLM_USAGE_SCOPE = `event_type = 'llm_call' AND attributes IS NOT NULL AND root_session_id IS NOT NULL`;
+var LLM_USAGE_GROUP = `GROUP BY root_session_id, provider, model, service_tier`;
+function usageLeaves(rows) {
+  return rows.map((row) => {
+    const attributes = {
+      input_tokens: row.inputTokens,
+      output_tokens: row.outputTokens,
+      cache_creation_input_tokens: row.cacheCreationTokens,
+      cache_read_input_tokens: row.cacheReadTokens,
+      ephemeral_1h_input_tokens: row.ephemeral1hTokens,
+      ephemeral_5m_input_tokens: row.ephemeral5mTokens,
+      web_search_requests: row.webSearchRequests
+    };
+    if (row.provider !== null) attributes.provider = row.provider;
+    if (row.model !== null) attributes.model = row.model;
+    if (row.serviceTier !== null) attributes.service_tier = row.serviceTier;
+    return { sessionId: row.sessionId, attributes };
+  });
+}
 var SESSION_ROOT = `event_type = 'session'`;
 var HAS_ACTIVITY = `EXISTS (
   SELECT 1 FROM audit_events c
@@ -25332,16 +25520,17 @@ var SqliteActivityRepository = class {
     const liveThreshold = this.now() - LIVE_ACTIVITY_WINDOW_MS;
     const liveNow = countScalar(
       this.db,
-      `SELECT count(*) AS n FROM audit_events s
+      `SELECT count(*) AS n FROM audit_events s INDEXED BY sqlite_autoindex_audit_events_1
            WHERE s.event_type = 'session' AND s.ended_at IS NULL
-             AND max(
-               s.started_at,
-               coalesce(
-                 (SELECT max(${LAST_ACTIVITY_EXPR}) FROM audit_events e WHERE e.root_session_id = s.id),
-                 s.started_at
-               )
-             ) >= ?`,
-      [liveThreshold]
+             AND s.id IN (
+               SELECT id FROM audit_events WHERE event_type = 'session' AND started_at >= ?
+               UNION
+               SELECT root_session_id FROM audit_events INDEXED BY idx_audit_started_at
+                WHERE started_at >= ?
+               UNION
+               SELECT root_session_id FROM audit_events INDEXED BY idx_audit_ended_at
+                WHERE ended_at >= ?)`,
+      [liveThreshold, liveThreshold, liveThreshold]
     );
     const toolCallsToday = countScalar(
       this.db,
@@ -25471,7 +25660,7 @@ var SqliteActivityRepository = class {
       this.db.prepare(
         `SELECT ${TIMELINE_COLUMNS}
          FROM audit_events
-         WHERE id = ? OR root_session_id = ?
+         WHERE (id = ? OR root_session_id = ?) AND event_type IN (${TIMELINE_EVENT_TYPES})
          ORDER BY started_at ASC, id ASC`
       ),
       [sessionId, sessionId]
@@ -25484,14 +25673,14 @@ var SqliteActivityRepository = class {
            coalesce(sum(output_tokens), 0) AS output,
            coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
            coalesce(sum(cache_read_input_tokens), 0) AS cache_read
-         FROM audit_events
+         FROM audit_events INDEXED BY idx_audit_session_type
          WHERE root_session_id = ? AND event_type = 'llm_call'`
       ),
       [sessionId]
     ) ?? { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
     const primaryModel = getRow(
       this.db.prepare(
-        `SELECT model, provider FROM audit_events
+        `SELECT model, provider FROM audit_events INDEXED BY idx_audit_session_type
          WHERE root_session_id = ? AND event_type = 'llm_call'
          ORDER BY started_at ASC, id ASC
          LIMIT 1`
@@ -25502,7 +25691,7 @@ var SqliteActivityRepository = class {
       this.db.prepare(
         `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
                 count(*) AS n
-         FROM audit_events
+         FROM audit_events INDEXED BY idx_audit_session
          WHERE root_session_id = ? AND event_type = 'tool_call'
          GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`
       ),
@@ -25510,7 +25699,7 @@ var SqliteActivityRepository = class {
     );
     const modelRows = allRows(
       this.db.prepare(
-        `SELECT DISTINCT model FROM audit_events
+        `SELECT DISTINCT model FROM audit_events INDEXED BY idx_audit_session_type
          WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
          ORDER BY model`
       ),
@@ -25519,7 +25708,7 @@ var SqliteActivityRepository = class {
     const derivedModels = modelRows.map((r) => r.model);
     const commits = countScalar(
       this.db,
-      `SELECT count(*) AS n FROM audit_events
+      `SELECT count(*) AS n FROM audit_events INDEXED BY idx_audit_session
            WHERE root_session_id = ? AND event_type = 'commit'`,
       [sessionId]
     );
@@ -25555,25 +25744,57 @@ var SqliteActivityRepository = class {
     return Promise.resolve(session);
   }
   /**
-   * Cross-session token report — every `llm_call` leaf (optionally windowed to
-   * `started_at >= fromMs`) grouped into per-session `SessionTokenReport`s, with
-   * USD cost DERIVED at read time via the shared `defaultCostModel` (never
-   * stored). `fromMs` lets the Activity page scope the usage panel to its
-   * selected time range; omit it for all-time (the CLI/TUI overview). The
-   * caller collapses these onto per-model rows with `aggregateTokenUsage`.
+   * Cross-session token report — every `llm_call` in the store (or in a
+   * `started_at >= fromMs` window, the Activity page's range) grouped per
+   * session, with USD cost DERIVED at read time via the shared
+   * `defaultCostModel` (never stored). The caller collapses these onto
+   * per-model rows with `aggregateTokenUsage`.
+   *
+   * Grouped in SQL over `idx_audit_llm_usage` — one entry per call carrying
+   * the members the rollup sums — and priced once per group, which is exact
+   * (see LlmUsageRow). Reading the bags and folding them in JS measured 31 ms
+   * for a seven-day window at 50k calls, and naming the VIRTUAL columns
+   * against the table 40 ms, since each is a json_extract recomputed per row;
+   * the index stores the values once, at write, and answers the same window in
+   * 8.5 ms. `INDEXED BY` is deliberate: with or without ANALYZE statistics the
+   * planner prefers the general event-type index and fetches every row to
+   * recompute the columns it could have read. The index is one every open
+   * store carries, since opening runs the migrations, so the hard requirement
+   * `INDEXED BY` introduces is already met; token-rollup-plans.test.ts pins
+   * the plan. All-time is a scan of the whole index — still one narrow entry
+   * per call, no bag parsed.
    */
   tokenReports(fromMs) {
-    const leaves = this.readLlmCallLeaves(fromMs === void 0 ? {} : { fromMs });
-    return Promise.resolve(buildTokenReports(leaves, defaultCostModel));
+    const rows = allRows(
+      this.db.prepare(
+        `${LLM_USAGE_SELECT}
+           FROM audit_events INDEXED BY idx_audit_llm_usage
+          WHERE ${LLM_USAGE_SCOPE}${fromMs === void 0 ? "" : " AND started_at >= ?"}
+          ${LLM_USAGE_GROUP}`
+      ),
+      fromMs === void 0 ? void 0 : [fromMs]
+    );
+    return Promise.resolve(buildTokenReports(usageLeaves(rows), defaultCostModel));
   }
   /**
-   * One session's token report — its `llm_call` leaves grouped per (provider,
-   * model) with derived cost, or `null` when the session made no `llm_call`s
-   * (an empty/tool-only session). Feeds the session-detail pane's per-model
-   * breakdown + estimated cost.
+   * One session's token report — its `llm_call`s grouped per (provider,
+   * model, tier) with derived cost, or `null` when the session made no
+   * `llm_call`s (an empty/tool-only session). Feeds the session-detail pane's
+   * per-model breakdown + estimated cost. The same rollup as `tokenReports`,
+   * seeking one root through a root-led `llm_call` index; the bag-reading fold
+   * it replaces walked every `llm_call` in the store to find one session's.
    */
   tokenReportForSession(sessionId) {
-    const reports = buildTokenReports(this.readLlmCallLeaves({ sessionId }), defaultCostModel);
+    const rows = allRows(
+      this.db.prepare(
+        `${LLM_USAGE_SELECT}
+           FROM audit_events
+          WHERE ${LLM_USAGE_SCOPE} AND root_session_id = ?
+          ${LLM_USAGE_GROUP}`
+      ),
+      [sessionId]
+    );
+    const reports = buildTokenReports(usageLeaves(rows), defaultCostModel);
     return Promise.resolve(reports[0] ?? null);
   }
   /**
@@ -25597,42 +25818,6 @@ var SqliteActivityRepository = class {
     for (const row of rows) seen.add(toHarness(row.harness));
     return Promise.resolve([...seen]);
   }
-  /**
-   * The raw `llm_call` leaves (session id + parsed attribute bag) for the token
-   * rollups, optionally narrowed to one session and/or a `started_at >= fromMs`
-   * window. A leaf whose attributes blob is NULL or unparseable is skipped
-   * (best-effort read — a corrupt bag never breaks the report). `root_session_id`
-   * is the leaf's session (the reconciler sets parent_id = root_session_id).
-   */
-  readLlmCallLeaves(opts = {}) {
-    const conditions = ["event_type = 'llm_call'", "attributes IS NOT NULL"];
-    const params = [];
-    if (opts.sessionId !== void 0) {
-      conditions.push("root_session_id = ?");
-      params.push(opts.sessionId);
-    }
-    if (opts.fromMs !== void 0) {
-      conditions.push("started_at >= ?");
-      params.push(opts.fromMs);
-    }
-    const rows = allRows(
-      this.db.prepare(
-        `SELECT root_session_id AS sessionId, attributes
-           FROM audit_events
-          WHERE ${conditions.join(" AND ")}`
-      ),
-      params
-    );
-    return mapRowsTolerant(
-      rows.filter(
-        (row) => row.sessionId !== null
-      ),
-      (row) => ({
-        sessionId: row.sessionId,
-        attributes: JSON.parse(row.attributes)
-      })
-    );
-  }
   /**
    * Per-session turns/findings/shares + last-activity for a page of session ids,
    * in grouped queries (not one per row). An id with no matching rows still
@@ -25647,20 +25832,23 @@ var SqliteActivityRepository = class {
     const inClause = placeholders(sessionIds.length);
     const lastActivityRows = allRows(
       this.db.prepare(
-        `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
-         WHERE root_session_id IN (${inClause})
-         GROUP BY root_session_id`
+        `SELECT ids.value AS id,
+                (SELECT max(started_at) FROM audit_events e WHERE e.root_session_id = ids.value) AS ms,
+                (SELECT max(ended_at) FROM audit_events e
+                  WHERE e.root_session_id = ids.value AND e.ended_at IS NOT NULL) AS me
+         FROM json_each(?) AS ids`
       ),
-      sessionIds
+      [JSON.stringify(sessionIds)]
     );
     for (const row of lastActivityRows) {
-      if (row.id === null) continue;
       const entry = result.get(row.id);
-      if (entry && row.m !== null) entry.lastActivityMs = row.m;
+      const last = Math.max(row.ms ?? 0, row.me ?? 0);
+      if (entry && last > 0) entry.lastActivityMs = last;
     }
     const turnsRows = allRows(
       this.db.prepare(
-        `SELECT root_session_id AS id, count(*) AS n FROM audit_events
+        `SELECT root_session_id AS id, count(*) AS n
+         FROM audit_events INDEXED BY idx_audit_session_prompt
          WHERE root_session_id IN (${inClause}) AND event_type = 'prompt'
          GROUP BY root_session_id`
       ),
@@ -25675,7 +25863,7 @@ var SqliteActivityRepository = class {
       this.db.prepare(
         `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.run_key')) AS n
-         FROM audit_events
+         FROM audit_events INDEXED BY idx_audit_session_run_key
          WHERE root_session_id IN (${inClause}) AND event_type = 'llm_call'
            AND json_extract(attributes, '$.run_key') IS NOT NULL
          GROUP BY root_session_id`
@@ -25705,7 +25893,7 @@ var SqliteActivityRepository = class {
       this.db.prepare(
         `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.destination')) AS n
-         FROM audit_events
+         FROM audit_events INDEXED BY idx_audit_session_share
          WHERE root_session_id IN (${inClause}) AND event_type = 'share'
          GROUP BY root_session_id`
       ),
@@ -26734,7 +26922,6 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 
 // ../../packages/persistence/src/repositories/findings.ts
 var PREVIEW_INSTANCES_PER_GROUP = 200;
-var SCAN_BATCH_ROWS = 1e3;
 var DEFAULT_LOCATIONS_LIMIT = 100;
 var LOCATION_RULE_IDS_CAP = 20;
 function compareLocationOrder(a, b) {
@@ -26763,6 +26950,25 @@ function deriveInstanceStatus(row) {
     latestResolutionStatus: row.latest_status
   });
 }
+function toFlatFindingRow(r) {
+  return {
+    id: r.id,
+    ruleId: r.rule_id,
+    category: r.category,
+    severity: r.severity,
+    maskedMatch: r.masked_match,
+    actionTaken: r.action_taken,
+    confidence: r.confidence,
+    occurredAt: epochMillisToIso(r.occurred_at),
+    sourceTool: r.source_tool,
+    repo: r.repo ?? "",
+    file: r.file ?? "",
+    ...r.tool_name === null ? {} : { toolName: r.tool_name },
+    eventId: r.event_id,
+    ...r.session_id === null ? {} : { sessionId: r.session_id },
+    status: deriveInstanceStatus(r)
+  };
+}
 function encodeGroupCursor(group) {
   const payload = {
     sev: group.severity,
@@ -26838,7 +27044,7 @@ var SqliteFindingsRepository = class {
       this.db.prepare(
         `SELECT f.id, f.audit_event_id AS event_id, d.rule_id, d.category, d.severity,
                 f.masked_match, f.action_taken, f.confidence, e.started_at AS occurred_at,
-                json_extract(e.attributes, '$.source_tool') AS source_tool,
+                e.source_tool AS source_tool,
                 e.event_type AS kind
          FROM audit_events e
          CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
@@ -26946,56 +27152,11 @@ var SqliteFindingsRepository = class {
       predicate,
       params: sessionParams
     });
-    const rows = allRows(
-      this.db.prepare(
-        `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
-                occurred_at, source_tool, repo, file, tool_name, event_id, session_id,
-                kind, finding_key, latest_status
-         FROM (
-           SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
-                  d.severity AS severity, f.masked_match AS masked_match,
-                  f.action_taken AS action_taken, f.confidence AS confidence,
-                  e.started_at AS occurred_at,
-                  json_extract(e.attributes, '$.source_tool') AS source_tool,
-                  json_extract(e.attributes, '$.repo') AS repo,
-                  json_extract(e.attributes, '$.file_path') AS file,
-                  json_extract(e.attributes, '$.tool_name') AS tool_name,
-                  f.audit_event_id AS event_id, e.root_session_id AS session_id,
-                  e.event_type AS kind, f.finding_key AS finding_key,
-                  latest.status AS latest_status,
-                  ROW_NUMBER() OVER (
-                    PARTITION BY d.rule_id
-                    ORDER BY e.started_at DESC, f.id DESC
-                  ) AS rn
-             FROM inspection_findings f
-             JOIN audit_events e ON e.id = f.audit_event_id
-             JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-             LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
-               ON latest.finding_key = f.finding_key
-             ${predicate}
-         )
-         WHERE rn <= :cap
-         ORDER BY occurred_at DESC, id DESC`
-      ),
-      { cap: PREVIEW_INSTANCES_PER_GROUP, ...sessionParams }
-    );
-    const groupable = rows.map((r) => ({
-      id: r.id,
-      ruleId: r.rule_id,
-      category: r.category,
-      severity: r.severity,
-      maskedMatch: r.masked_match,
-      actionTaken: r.action_taken,
-      confidence: r.confidence,
-      occurredAt: epochMillisToIso(r.occurred_at),
-      sourceTool: r.source_tool,
-      repo: r.repo ?? "",
-      file: r.file ?? "",
-      ...r.tool_name === null ? {} : { toolName: r.tool_name },
-      eventId: r.event_id,
-      ...r.session_id === null ? {} : { sessionId: r.session_id },
-      status: deriveInstanceStatus(r)
-    }));
+    const rows = this.previewRows(aggregates, {
+      sessionId: query.sessionId,
+      from: query.from
+    });
+    const groupable = rows.map(toFlatFindingRow);
     const allGroups = buildFindingGroups(groupable, { aggregates });
     const filterOpts = {
       severity: query.severity,
@@ -27081,8 +27242,10 @@ var SqliteFindingsRepository = class {
    *
    * The scan runs from the top of the scope on every request, not from the
    * cursor: `totals` and `facets` describe the whole filtered scope and must not
-   * move as the caller pages. Rows are pulled in batches so memory stays flat
-   * while the counting runs, and only the page itself is retained.
+   * move as the caller pages. Rows come off ONE statement, iterated rather
+   * than materialized (`scanFindingRows`), so memory stays flat while the
+   * counting runs — a generator streaming the index order, not a sequence of
+   * fetched batches; only the page itself is retained.
    */
   listFindingInstances(query) {
     const opts = {
@@ -27098,6 +27261,10 @@ var SqliteFindingsRepository = class {
     };
     const limit = query.limit ?? DEFAULT_FLAT_FINDINGS_LIMIT;
     const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const isPastCursor = cursor === null ? () => true : (row) => {
+      const rowMs = isoToEpochMillis(row.occurredAt);
+      return rowMs <= cursor.startedAtMs && (rowMs < cursor.startedAtMs || row.id < cursor.id);
+    };
     const accumulator = createInstanceFacetAccumulator(opts);
     const items = [];
     let total = 0;
@@ -27110,6 +27277,7 @@ var SqliteFindingsRepository = class {
       accumulator.add(row);
       if (!matchesInstanceFilters(row, opts)) continue;
       total += 1;
+      if (!isPastCursor(row)) continue;
       if (items.length < limit) {
         items.push(toInstanceDetail(row));
         last = row;
@@ -27118,15 +27286,6 @@ var SqliteFindingsRepository = class {
       }
     }
     const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null;
-    if (cursor !== null) {
-      const resumed = this.pageAfter(cursor, opts, limit, query);
-      return Promise.resolve({
-        totals: { findings: total },
-        facets: accumulator.facets(),
-        items: resumed.items,
-        nextCursor: resumed.nextCursor
-      });
-    }
     return Promise.resolve({
       totals: { findings: total },
       facets: accumulator.facets(),
@@ -27134,35 +27293,6 @@ var SqliteFindingsRepository = class {
       nextCursor
     });
   }
-  /**
-   * The page of matching rows strictly after `cursor`. Separate from the
-   * counting pass because that one starts at the top of the scope by design;
-   * this one narrows the scan with the same keyset predicate the activity list
-   * uses, so a later page costs less than the first rather than more.
-   */
-  pageAfter(cursor, opts, limit, query) {
-    const items = [];
-    let last;
-    let hasMore = false;
-    for (const row of this.scanFindingRows({
-      sessionId: query.sessionId,
-      from: query.from,
-      after: cursor
-    })) {
-      if (!matchesInstanceFilters(row, opts)) continue;
-      if (items.length < limit) {
-        items.push(toInstanceDetail(row));
-        last = row;
-      } else {
-        hasMore = true;
-        break;
-      }
-    }
-    return {
-      items,
-      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null
-    };
-  }
   /**
    * The same findings folded by location: repository, then file within it.
    *
@@ -27245,25 +27375,111 @@ var SqliteFindingsRepository = class {
     });
   }
   /**
-   * Every finding in scope as a FlatFindingRow, newest first, pulled in batches.
+   * Each group's newest instances, for the table's expanded rows.
+   *
+   * ONE index-ordered scan with early termination, and the shape is the point.
+   * The natural spelling — `ROW_NUMBER() OVER (PARTITION BY rule_id ORDER BY
+   * started_at DESC)` then `WHERE rn <= cap` — sorts EVERY finding in scope
+   * through a temp B-tree to keep a bounded preview of each group, and then
+   * sorts the survivors again for the page order. Both sorts grow with the
+   * store while the answer does not.
+   *
+   * Instead the scan walks `audit_events` newest-first off `idx_audit_started_at`
+   * (or the session or window index the scope names — see `findingScanSql`),
+   * which is already the order the page wants, and keeps rows per rule until
+   * each rule has as many as it can show. The aggregate the caller already holds
+   * says how many that is: `min(instanceCount, PREVIEW_INSTANCES_PER_GROUP)`
+   * per rule, summed, is the number of rows this scan has to find, and it stops
+   * on the last one. That sum is bounded by `rules * PREVIEW_INSTANCES_PER_GROUP`
+   * (8,000 at this repo's 40-rule bench corpus), not by a fixed row count — a
+   * store with many firing rules widens it. The bound that DOES hold
+   * unconditionally is the sorted form's floor: this scan visits at most as
+   * many rows as `ROW_NUMBER() OVER (PARTITION BY rule_id …)` would have
+   * sorted, and stops the moment every rule has its cap, where the sorted form
+   * sorts the whole scope regardless. The true worst case — the rarest rule's
+   * wanted instances sitting at the tail of the scope — is one pass over
+   * everything in scope with a block sort of the id tie-break only, never a
+   * sort of the scope, which is still that floor.
+   *
+   * A row whose rule the aggregate did not see is skipped: the two statements
+   * run without a shared snapshot, so a capture landing between them can add a
+   * rule here that has no counts there, and the counts are what the group is
+   * built from.
+   */
+  previewRows(aggregates, scope) {
+    const wanted = /* @__PURE__ */ new Map();
+    let remaining = 0;
+    for (const [ruleId, agg] of aggregates) {
+      const n = Math.min(agg.instanceCount, PREVIEW_INSTANCES_PER_GROUP);
+      wanted.set(ruleId, n);
+      remaining += n;
+    }
+    const rows = [];
+    if (remaining === 0) return rows;
+    const { sql, params } = this.findingScanSql(scope);
+    const taken = /* @__PURE__ */ new Map();
+    for (const r of iterateRows(this.db.prepare(sql), params)) {
+      const want = wanted.get(r.rule_id);
+      if (want === void 0) continue;
+      const have = taken.get(r.rule_id) ?? 0;
+      if (have >= want) continue;
+      taken.set(r.rule_id, have + 1);
+      rows.push(r);
+      remaining -= 1;
+      if (remaining === 0) break;
+    }
+    return rows;
+  }
+  /**
+   * Every finding in scope as a FlatFindingRow, newest first, streamed.
    *
    * A generator so a caller streams the scope without it ever being an array:
    * the flat list counts and facets the whole filtered scope, which on a large
-   * store is far more rows than any page. Each batch advances the same keyset
-   * predicate the page read uses, so the scan is a sequence of bounded reads
-   * rather than one unbounded result set.
-   *
-   * The latest-resolution lookup is the CORRELATED form, not the derived table
-   * the grouped path joins: only `status` is needed, idx_finding_resolution_key
-   * makes it a point lookup per row, and the derived table would re-materialize
-   * a window over the whole resolution table once per batch.
+   * store is far more rows than any page. The rows come off ONE statement,
+   * iterated rather than materialized, in the index order `findingScanSql`
+   * arranges — so the scan is a single pass with a block sort of the id
+   * tie-break only, never a sort of the scope, where a sequence of
+   * keyset-bounded batches re-sorted everything below the cursor on every
+   * batch and cost the square of the scope.
    *
-   * `scope` carries ONLY what no facet counts. A filter dimension narrowed here
-   * would be missing from its own facet, which is computed by excluding that
-   * dimension — see listFindingInstances.
+   * `sessionId` and `from` carry ONLY what no facet counts — a filter
+   * dimension narrowed here would be missing from its own facet, which is
+   * computed by excluding that dimension (see listFindingInstances). There is
+   * no `after`/cursor parameter: a keyset page is collected inline from this
+   * same pass (`listFindingInstances`' `isPastCursor`) rather than by a second,
+   * narrower statement, since the counting pass already visits every row a
+   * page-2+ request would otherwise re-seek for.
    */
   *scanFindingRows(scope) {
-    const conditions = [`e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`];
+    const { sql, params } = this.findingScanSql(scope);
+    for (const r of iterateRows(this.db.prepare(sql), params)) {
+      yield toFlatFindingRow(r);
+    }
+  }
+  /**
+   * The one statement both instance-level scans run: every finding in scope,
+   * joined to its event and definition, newest first.
+   *
+   * THE PLAN IS THE POINT, and two things in the SQL exist only to pin it —
+   * the same two `recentFindings` documents at length, for the same reason:
+   *
+   *  - **`+e.event_type`** makes the capture-kind predicate non-indexable, so
+   *    the planner cannot pick `idx_audit_type_t` and then sort. That index
+   *    yields `started_at` order per event type, not across the four, so
+   *    satisfying the ORDER BY from it would need a merge SQLite does not do.
+   *    Freed of it, the planner walks `idx_audit_started_at` backwards — or
+   *    `idx_audit_session` for a session scope, which is also `started_at`
+   *    ordered within the session — and the order falls out of the index.
+   *  - **`CROSS JOIN`** pins `audit_events` as the driving table. With plain
+   *    JOINs the planner drives from the findings and sorts everything.
+   *
+   * The latest-resolution lookup is the CORRELATED form: only `status` is
+   * needed, `idx_finding_resolution_key_created` answers it with one backward
+   * index probe per keyed row, and a derived table over the whole resolution
+   * table would be materialized before the first row streamed.
+   */
+  findingScanSql(scope) {
+    const conditions = [`+e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`];
     const params = [];
     if (scope.sessionId !== void 0 && scope.sessionId !== "") {
       conditions.push("e.root_session_id = ?");
@@ -27277,58 +27493,24 @@ var SqliteFindingsRepository = class {
               d.severity AS severity, f.masked_match AS masked_match,
               f.action_taken AS action_taken, f.confidence AS confidence,
               e.started_at AS occurred_at,
-              json_extract(e.attributes, '$.source_tool') AS source_tool,
-              json_extract(e.attributes, '$.repo') AS repo,
-              json_extract(e.attributes, '$.file_path') AS file,
-              json_extract(e.attributes, '$.tool_name') AS tool_name,
+              e.source_tool AS source_tool,
+              e.repo AS repo,
+              e.file_path AS file,
+              e.tool_name AS tool_name,
               f.audit_event_id AS event_id, e.root_session_id AS session_id,
               e.event_type AS kind, f.finding_key AS finding_key,
               ${latestResolutionStatusSql("f")} AS latest_status
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         FROM audit_events e
+         CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
         WHERE ${conditions.join(" AND ")}
-          AND (e.started_at < ? OR (e.started_at = ? AND f.id < ?))
-        ORDER BY e.started_at DESC, f.id DESC
-        LIMIT ?`;
-    let after = scope.after ?? { startedAtMs: Number.MAX_SAFE_INTEGER, id: "\uFFFF" };
-    for (; ; ) {
-      const rows = allRows(this.db.prepare(sql), [
-        ...params,
-        after.startedAtMs,
-        after.startedAtMs,
-        after.id,
-        SCAN_BATCH_ROWS
-      ]);
-      for (const r of rows) {
-        yield {
-          id: r.id,
-          ruleId: r.rule_id,
-          category: r.category,
-          severity: r.severity,
-          maskedMatch: r.masked_match,
-          actionTaken: r.action_taken,
-          confidence: r.confidence,
-          occurredAt: epochMillisToIso(r.occurred_at),
-          sourceTool: r.source_tool,
-          repo: r.repo ?? "",
-          file: r.file ?? "",
-          ...r.tool_name === null ? {} : { toolName: r.tool_name },
-          eventId: r.event_id,
-          ...r.session_id === null ? {} : { sessionId: r.session_id },
-          status: deriveInstanceStatus(r)
-        };
-      }
-      if (rows.length < SCAN_BATCH_ROWS) return;
-      const lastRow = rows[rows.length - 1];
-      if (lastRow === void 0) return;
-      after = { startedAtMs: lastRow.occurred_at, id: lastRow.id };
-    }
+        ORDER BY e.started_at DESC, f.id DESC`;
+    return { sql, params };
   }
   groupAggregates(withSearchText, scope) {
-    const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.attributes, '$.repo')) AS repos,
-           group_concat(DISTINCT json_extract(e.attributes, '$.file_path')) AS files,
-           group_concat(DISTINCT 'via ' || json_extract(e.attributes, '$.tool_name')) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
+    const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT e.repo) AS repos,
+           group_concat(DISTINCT e.file_path) AS files,
+           group_concat(DISTINCT 'via ' || e.tool_name) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
       `SELECT rule_id,
                 sum(tuple_count) AS instance_count,
@@ -27346,7 +27528,7 @@ var SqliteFindingsRepository = class {
                       coalesce(latest.status, '') AS status_tuple,
                     count(*) AS tuple_count,
                     max(e.started_at) AS latest_at,
-                    group_concat(DISTINCT json_extract(e.attributes, '$.source_tool')) AS source_tools,
+                    group_concat(DISTINCT e.source_tool) AS source_tools,
                     group_concat(DISTINCT f.action_taken) AS actions_taken
                     ${innerSearchColumns}
                FROM inspection_findings f
@@ -27477,6 +27659,8 @@ function isoDay(ms) {
 // ../../packages/persistence/src/repositories/history-sync.ts
 var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
 var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
 var SKIPPED = -1;
 var ROW_COLUMNS = `id,
    parent_id AS parentId,
@@ -27516,6 +27700,20 @@ var SqliteHistorySyncRepository = class {
         ORDER BY (event_type = 'session') DESC, started_at
         LIMIT :limit`
     );
+    this.captureRowsStmt = db.prepare(
+      `SELECT ${ROW_COLUMNS}
+         FROM audit_events
+        WHERE synced_at IS NULL
+          AND sync_claimed_at IS NULL
+          AND outbox_owed = 1
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before
+        ORDER BY started_at
+        LIMIT :limit`
+    );
+    this.markOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
+    );
     this.stampStmt = db.prepare(
       `UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id`
     );
@@ -27547,6 +27745,12 @@ var SqliteHistorySyncRepository = class {
        FROM audit_events
        WHERE event_type IN (${TYPE_LIST})`
     );
+    this.captureSkipCountStmt = db.prepare(
+      `SELECT COUNT(*) AS skipped
+         FROM audit_events
+        WHERE synced_at = ${String(SKIPPED)}
+          AND event_type IN (${CAPTURE_TYPE_LIST})`
+    );
     this.fingerprintStmt = db.prepare(
       `SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
          FROM history_sync WHERE id = 1`
@@ -27556,6 +27760,10 @@ var SqliteHistorySyncRepository = class {
           SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
         WHERE id = 1`
     );
+    this.disownCapturesStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = NULL
+        WHERE outbox_owed IS NOT NULL AND event_type IN (${CAPTURE_TYPE_LIST})`
+    );
     this.rearmStmt = db.prepare(
       `UPDATE audit_events SET synced_at = NULL
         WHERE synced_at > 0 AND event_type IN (${TYPE_LIST})`
@@ -27628,6 +27836,10 @@ var SqliteHistorySyncRepository = class {
   closeWindowStmt;
   releaseBoundaryStmt;
   freezeBoundaryStmt;
+  captureRowsStmt;
+  markOwedStmt;
+  captureSkipCountStmt;
+  disownCapturesStmt;
   partitionStmt;
   claimRowStmt;
   releaseRowStmt;
@@ -27661,6 +27873,34 @@ var SqliteHistorySyncRepository = class {
   pendingRows(sessionId, limit, before) {
     return allRows(this.rowsStmt, { sessionId, limit, before });
   }
+  /**
+   * Captures this machine still owes the deployment, oldest first.
+   *
+   * Selected by the `outbox_owed` marker the attached forward path writes, not
+   * by a time window — see captureRowsStmt for why a window could not express
+   * this. `before` is the grace window that leaves a just-recorded capture to
+   * the live path.
+   */
+  pendingCaptureRows(limit, before) {
+    return allRows(this.captureRowsStmt, { limit, before });
+  }
+  /**
+   * Record that a capture is OWED to the deployment.
+   *
+   * Written by the attached forward path when a live send did not confirm
+   * delivery, and read by the drain as the whole of its eligibility test. It is
+   * a fact rather than an inference: the machine was attached, the send did not
+   * land, so the row is owed — which no time window can state, because the same
+   * window that holds the rows a past attachment left owed also holds every
+   * capture recorded while the machine was DETACHED, and those were never
+   * offered to anyone.
+   *
+   * Idempotent, and never un-set: `markSynced` settling the row is what takes it
+   * out of the drain's read.
+   */
+  markCaptureOwed(id) {
+    this.markOwedStmt.run({ id });
+  }
   /** Record delivery. Called only AFTER the far side has accepted the rows. */
   markSynced(ids, atMs) {
     this.stampAll(ids, atMs);
@@ -27744,10 +27984,12 @@ var SqliteHistorySyncRepository = class {
       this.countsStmt,
       { before }
     );
+    const captures = getRow(this.captureSkipCountStmt);
     return {
       pending: row?.pending ?? 0,
       sent: row?.sent ?? 0,
-      skipped: row?.skipped ?? 0
+      skipped: row?.skipped ?? 0,
+      capturesSkipped: captures?.skipped ?? 0
     };
   }
   /**
@@ -27788,7 +28030,11 @@ var SqliteHistorySyncRepository = class {
     withTransaction(
       this.db,
       () => {
+        const previous = getRow(this.fingerprintStmt)?.fingerprint;
         this.rearmStmt.run();
+        if (previous !== null && previous !== void 0 && previous !== fingerprint) {
+          this.disownCapturesStmt.run();
+        }
         this.setFingerprintStmt.run({ fingerprint, backlogBefore });
       },
       "IMMEDIATE"
@@ -27985,7 +28231,259 @@ var SqliteInspectionFindingsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
+
+// ../../packages/persistence/src/policy-floor.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
+
+// ../../packages/persistence/src/local-layout.ts
+import { renameSync as renameSync3 } from "fs";
+import { mkdir } from "fs/promises";
+import { homedir } from "os";
+import { join as join4 } from "path";
+function defaultDataDir() {
+  return join4(homedir(), ".aka");
+}
+function settingsDir(base = defaultDataDir()) {
+  return join4(base, "settings");
+}
+function dataDir(base = defaultDataDir()) {
+  return join4(base, "data");
+}
+function dbPath(base = defaultDataDir()) {
+  return join4(dataDir(base), "aka.db");
+}
+function keysDir(base = defaultDataDir()) {
+  return join4(base, "keys");
+}
+async function ensureDataDir(dir = defaultDataDir()) {
+  await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
+}
+function ensureLayoutDirSync(dir = defaultDataDir()) {
+  ensureDataDirSync(dir);
+}
+function migrateLegacyLayout(base = defaultDataDir()) {
+  const moves = [
+    { name: "config.json", dest: settingsDir(base) },
+    { name: "policy-cache.json", dest: dataDir(base) }
+  ];
+  for (const { name, dest } of moves) {
+    try {
+      ensureDataDirSync(dest);
+      const moved = join4(dest, name);
+      renameSync3(join4(base, name), moved);
+      tightenFile(moved);
+    } catch {
+    }
+  }
+}
+
+// ../../packages/persistence/src/settings.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync as readFileSync2,
+  rmSync as rmSync5,
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+
+// ../../packages/persistence/src/managed-settings.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { posix, win32 } from "path";
+function managedSettingsPaths(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return [
+      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+    ];
+  }
+  if (platform2 === "win32") {
+    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
+  }
+  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+}
+function readManagedSettings(paths = managedSettingsPaths()) {
+  for (const path of paths) {
+    let text;
+    try {
+      text = readFileSync3(path, "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseJsonObject(text);
+    if (!record2) continue;
+    const parsed2 = ManagedSettings.safeParse(record2);
+    if (parsed2.success) return parsed2.data;
+  }
+  return null;
+}
+function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
+  if (!managed) return settings;
+  const { values } = managed;
+  const merged = { ...settings };
+  if (values.runMode !== void 0) merged.runMode = values.runMode;
+  if (values.controlPlane !== void 0) {
+    merged.controlPlane = {
+      ...values.controlPlane,
+      // The administrator pinned WHICH deployment, not WHEN this machine
+      // joined it. Keep the user's own attach time when the endpoint is
+      // unchanged, so a managed machine does not appear to re-attach on every
+      // read; stamp a fresh one when the administrator moved it.
+      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
+    };
+  }
+  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
+  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
+  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
+  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
+  if (values.vaultConsent !== void 0) {
+    merged.vaultConsent = values.vaultConsent ? (
+      // Keep an existing valid grant so its acknowledgedAt survives; mint one
+      // at the current version otherwise.
+      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
+    ) : void 0;
+  }
+  if (values.modelJudgeConsent !== void 0) {
+    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
+      acknowledgedAt: now().toISOString(),
+      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
+    } : void 0;
+  }
+  return merged;
+}
+
+// ../../packages/persistence/src/settings.ts
+var SETTINGS_FILENAME = "settings.json";
+function readWorkspaceSettings(base = defaultDataDir()) {
+  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
+}
+function readUserSettings(base) {
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  if (!record2) return defaultWorkspaceSettings();
+  try {
+    return WorkspaceSettings.parse(record2);
+  } catch {
+    return defaultWorkspaceSettings();
+  }
+}
+function readJson(file2) {
+  let text;
+  try {
+    text = readFileSync4(file2, "utf8");
+  } catch {
+    return null;
+  }
+  return parseJsonObject(text) ?? null;
+}
+
+// ../../packages/persistence/src/policy-floor.ts
+function refusalMessage(pack, attempted, floor, refusal) {
+  switch (refusal) {
+    case "lock":
+      return `refusing to re-assign '${pack}': its policy is set by the connected control plane`;
+    case "disable":
+      return `refusing to disable '${pack}': it is governed by the connected control plane`;
+    case "floor":
+      return `refusing to set '${pack}' to '${attempted ?? "unassigned"}': the connected control plane requires at least '${floor}'`;
+  }
+}
+var PolicyFloorError = class extends Error {
+  /** `namespace/packId` of the detection whose write was refused. */
+  pack;
+  /**
+   * The archetype the caller asked for, or null when the write named none —
+   * clearing the assignment, or switching the detection off.
+   */
+  attempted;
+  /** The weakest archetype the control plane permits for this pack. */
+  floor;
+  refusal;
+  constructor(pack, attempted, floor, refusal) {
+    super(refusalMessage(pack, attempted, floor, refusal));
+    this.name = "PolicyFloorError";
+    this.pack = pack;
+    this.attempted = attempted;
+    this.floor = floor;
+    this.refusal = refusal;
+  }
+};
+function readCachedPolicyBundle(base = defaultDataDir()) {
+  try {
+    const raw = readFileSync5(join6(dataDir(base), POLICY_CACHE_FILENAME), "utf8");
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    return PolicyBundle.parse(parsed2.bundle);
+  } catch {
+    return null;
+  }
+}
+function indexEnabled(policies) {
+  const byRuleId = /* @__PURE__ */ new Map();
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const policy of policies) {
+    if (!policy.enabled) continue;
+    if ("ruleId" in policy.target) {
+      if (!byRuleId.has(policy.target.ruleId)) byRuleId.set(policy.target.ruleId, policy.action);
+    } else if (!byCategory.has(policy.target.category)) {
+      byCategory.set(policy.target.category, policy.action);
+    }
+  }
+  return { byRuleId, byCategory };
+}
+function hasAuthoredPolicy(policies, rules, byRuleId) {
+  const ruleIds = new Set(rules.map((rule) => rule.id));
+  const categories = new Set(rules.map((rule) => rule.category));
+  const bundleNamesPack = rules.some((rule) => byRuleId.has(rule.id));
+  return policies.some((policy) => {
+    if (!policy.enabled || policy.provenance !== "authored") return false;
+    return "ruleId" in policy.target ? ruleIds.has(policy.target.ruleId) : bundleNamesPack && categories.has(policy.target.category);
+  });
+}
+function controlPlanePolicyFloor(rules, base = defaultDataDir()) {
+  const floors = openControlPlaneFloors(base);
+  return floors === null ? null : floors.floorFor(rules);
+}
+function openControlPlaneFloors(base = defaultDataDir()) {
+  if (!isAttached(readWorkspaceSettings(base))) return null;
+  const bundle = readCachedPolicyBundle(base);
+  if (bundle === null) return null;
+  const indexes = indexEnabled(bundle.policies);
+  return { floorFor: (rules) => resolveFloor(rules, bundle.policies, indexes) };
+}
+function resolveFloor(rules, policies, { byRuleId, byCategory }) {
+  let action = null;
+  for (const rule of rules) {
+    const resolved = byRuleId.get(rule.id) ?? byCategory.get(rule.category);
+    if (resolved === void 0) continue;
+    action = action === null ? resolved : strongerAction(action, resolved);
+  }
+  if (action === null) return null;
+  return {
+    floor: weakestBuiltinAtLeast(action),
+    locked: hasAuthoredPolicy(policies, rules, byRuleId)
+  };
+}
+function policyAssignmentRefusal(policyId, floor) {
+  if (floor.locked) return "lock";
+  const effective = policyId ?? DEFAULT_PACK_POLICY_ID;
+  return isActionAtLeast(builtinPolicyToAction(effective), builtinPolicyToAction(floor.floor)) ? null : "floor";
+}
+function packEnablementRefusal(enabled, floor) {
+  if (floor === null || enabled) return null;
+  return "disable";
+}
 
 // ../../packages/persistence/src/semver.ts
 function parse3(version2) {
@@ -28079,8 +28577,19 @@ function ruleIdsOf(rulesJson) {
   return ids;
 }
 var SqliteInstalledPacksRepository = class {
-  constructor(db) {
+  /**
+   * `baseDir` is the `~/.aka` LAYOUT BASE, not the data dir — the control-plane
+   * floor needs both halves of it (settings/ says whether this machine is
+   * attached, data/ holds the cached bundle). It is optional because a caller
+   * holding only a DatabaseSync — every test construction site, and any embedder
+   * that opens the store itself — has no layout to point at, and such a caller
+   * gets the pre-existing behaviour: no floor, no lock. Production threads it in
+   * from `openLocalDatabase`, which is the single construction site that owns a
+   * real `~/.aka`.
+   */
+  constructor(db, baseDir) {
     this.db = db;
+    this.baseDir = baseDir;
     this.insertMissingStmt = db.prepare(
       `INSERT INTO installed_packs (id, namespace, pack_id, version, name, rules_json, enabled, created_at, updated_at)
        VALUES (:id, :namespace, :packId, :version, :name, :rulesJson, 1, :now, :now)
@@ -28102,11 +28611,17 @@ var SqliteInstalledPacksRepository = class {
     this.signatureStmt = db.prepare(
       `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
     );
+    this.packRulesStmt = db.prepare(
+      `SELECT rules_json AS rulesJson FROM installed_packs
+        WHERE namespace = ? AND pack_id = ?`
+    );
   }
   db;
+  baseDir;
   insertMissingStmt;
   upsertAvailableStmt;
   signatureStmt;
+  packRulesStmt;
   /**
    * Record the running binary's detection inventory. Refreshes the
    * available_packs mirror (pruning packs the binary no longer ships) and
@@ -28148,7 +28663,7 @@ var SqliteInstalledPacksRepository = class {
           let behind = false;
           for (const row of rows) {
             const params = {
-              id: randomUUID3(),
+              id: randomUUID4(),
               namespace: row.namespace,
               packId: row.packId,
               version: row.version,
@@ -28160,7 +28675,7 @@ var SqliteInstalledPacksRepository = class {
             if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
               this.upsertAvailableStmt.run({
                 ...params,
-                id: randomUUID3(),
+                id: randomUUID4(),
                 recordedBy: meta4?.recordedBy ?? null
               });
             } else {
@@ -28406,9 +28921,65 @@ var SqliteInstalledPacksRepository = class {
   // NOT on the hook path — so, unlike recordInventory, these surface errors to the
   // caller rather than swallowing them. Each returns whether a row matched, so the
   // caller can tell an edit from a no-such-detection.
+  /**
+   * The rules one installed pack owns, reduced to what a floor computation
+   * reads. Display-tolerant parsing on purpose: a pack whose snapshot is
+   * unreadable contributes no rules to a scan either, so it is not a detection
+   * the control plane can be governing, and an empty list correctly imposes no
+   * floor. Enabled state is deliberately not filtered — a disabled pack is one
+   * the user can re-enable, and its assignment stays governed meanwhile.
+   */
+  packFloorRules(namespace, packId) {
+    const row = getRow(this.packRulesStmt, [namespace, packId]);
+    if (!row) return [];
+    return parseRules(row.rulesJson).map((rule) => ({ id: rule.id, category: rule.category }));
+  }
+  /**
+   * What the connected control plane imposes on one installed pack, or null on a
+   * machine that is its own authority (standalone, no cached bundle, or a
+   * repository constructed without a layout base).
+   *
+   * Exposed as a READ so a surface can render the constraint — grey out the
+   * choices below the floor, mark a locked detection as locked — rather than
+   * offer the user a picker whose selections it will then be told it may not
+   * make. The refusal in `setPolicy` does not depend on any surface calling this.
+   */
+  policyFloor(namespace, packId) {
+    if (this.baseDir === void 0) return null;
+    return controlPlanePolicyFloor(this.packFloorRules(namespace, packId), this.baseDir);
+  }
+  /**
+   * The same answer for several packs, keyed `namespace/packId` and carrying an
+   * entry only for a pack the control plane actually governs.
+   *
+   * A surface listing every detection asks per pack, and asking through
+   * `policyFloor` re-reads the settings, re-reads and re-parses the whole cached
+   * bundle and rebuilds its indexes once per pack — the entire cost of one
+   * answer, repeated for each row, on every render. This reads all of that once.
+   * Packs whose rules the snapshot cannot produce simply contribute no entry,
+   * exactly as the single-pack read returns null for them.
+   */
+  policyFloors(packs2) {
+    const floors = /* @__PURE__ */ new Map();
+    if (this.baseDir === void 0) return floors;
+    const source = openControlPlaneFloors(this.baseDir);
+    if (source === null) return floors;
+    for (const pack of packs2) {
+      const floor = source.floorFor(this.packFloorRules(pack.namespace, pack.packId));
+      if (floor !== null) floors.set(`${pack.namespace}/${pack.packId}`, floor);
+    }
+    return floors;
+  }
   /**
    * Assign (or clear, with null) the enforcement policy for one installed pack.
-   * `policyId` must be a known built-in id (monitor/warn/redact/block).
+   * `policyId` must be a known built-in id (monitor/warn/redact/block/vault).
+   *
+   * On an ATTACHED machine the organization's bundle is a floor this refuses to
+   * write below, and a detection the organization has authored a policy for is
+   * refused outright — see policy-floor.ts for both, and for why the refusal is
+   * a throw rather than a silently substituted value. This is the one device-local
+   * write path for the assignment, so the check belongs here rather than on any
+   * surface that offers the choice.
    */
   setPolicy(namespace, packId, policyId) {
     if (policyId !== null && !BuiltinPolicyId.safeParse(policyId).success) {
@@ -28416,14 +28987,38 @@ var SqliteInstalledPacksRepository = class {
         `Unknown policy '${policyId}'. Must be one of: ${KNOWN_BUILTIN_IDS.join(", ")}.`
       );
     }
+    const requested = policyId;
+    const floor = this.policyFloor(namespace, packId);
+    if (floor !== null) {
+      const refusal = policyAssignmentRefusal(requested, floor);
+      if (refusal !== null) {
+        throw new PolicyFloorError(`${namespace}/${packId}`, requested, floor.floor, refusal);
+      }
+    }
     const res = this.db.prepare(
       `UPDATE installed_packs SET policy_id = :policyId, updated_at = :now
          WHERE namespace = :namespace AND pack_id = :packId`
     ).run({ policyId, now: Date.now(), namespace, packId });
     return Number(res.changes) > 0;
   }
-  /** Enable or disable one installed pack. */
+  /**
+   * Enable or disable one installed pack.
+   *
+   * On an ATTACHED machine a detection the organization's bundle governs at all
+   * may not be switched OFF here — see packEnablementRefusal for why that is not
+   * merely another point below the floor, and why re-enabling stays open. Like
+   * the assignment above, the check belongs at this write path rather than on a
+   * surface: this is the one device-local writer of the column, and a refusal
+   * that lived in a page would leave the CLI free.
+   */
   setEnabled(namespace, packId, enabled) {
+    const floor = this.policyFloor(namespace, packId);
+    if (floor !== null) {
+      const refusal = packEnablementRefusal(enabled, floor);
+      if (refusal !== null) {
+        throw new PolicyFloorError(`${namespace}/${packId}`, null, floor.floor, refusal);
+      }
+    }
     const res = this.db.prepare(
       `UPDATE installed_packs SET enabled = :enabled, updated_at = :now
          WHERE namespace = :namespace AND pack_id = :packId`
@@ -28509,7 +29104,7 @@ var SqliteInventoryRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
@@ -28998,7 +29593,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
            VALUES (:id, :projectId, :path, :access, :now, :now)
            ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID4(), projectId, path, access, now: Date.now() });
+      ).run({ id: randomUUID5(), projectId, path, access, now: Date.now() });
     }
     return true;
   }
@@ -29019,7 +29614,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
            VALUES (:id, :assetId, :trust, :now, :now)
            ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID4(), assetId, trust, now: Date.now() });
+      ).run({ id: randomUUID5(), assetId, trust, now: Date.now() });
     }
     this.configRowsCache = void 0;
     return "ok";
@@ -29316,7 +29911,7 @@ var SqliteInventoryAssetsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var SqlitePoliciesRepository = class {
   constructor(db) {
     this.db = db;
@@ -29351,7 +29946,7 @@ var SqlitePoliciesRepository = class {
     failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
-          id: randomUUID5(),
+          id: randomUUID6(),
           target: JSON.stringify({ category }),
           action,
           now: Date.now()
@@ -29371,7 +29966,7 @@ var SqlitePoliciesRepository = class {
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
          VALUES (:id, 'global', :target, :action, 1, :now, :now)
          ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
-    ).run({ id: randomUUID5(), target: JSON.stringify({ category }), action, now });
+    ).run({ id: randomUUID6(), target: JSON.stringify({ category }), action, now });
   }
   // Caps every global per-category policy currently set to block/redact down
   // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
@@ -29439,7 +30034,7 @@ var SqlitePolicyCatalogRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var SqliteProjectFilesRepository = class {
   constructor(db) {
     this.db = db;
@@ -29471,7 +30066,7 @@ var SqliteProjectFilesRepository = class {
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
-        id: randomUUID6(),
+        id: randomUUID7(),
         projectId,
         path: file2.path,
         name: file2.name,
@@ -29485,9 +30080,9 @@ var SqliteProjectFilesRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var SqliteResolutionsRepository = class {
-  constructor(db, now = () => Date.now(), newId = () => randomUUID7()) {
+  constructor(db, now = () => Date.now(), newId = () => randomUUID8()) {
     this.db = db;
     this.now = now;
     this.newId = newId;
@@ -29700,7 +30295,7 @@ var SqliteScanLedgerRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function pageLimit(requested, fallback) {
   if (requested === void 0) return fallback;
   return Math.min(Math.max(1, Math.trunc(requested)), MAX_VAULT_PAGE_LIMIT);
@@ -29746,12 +30341,14 @@ var SELECT_COLUMNS = `
   ciphertext,
   nonce,
   auth_tag AS authTag,
+  user_authorized AS userAuthorized,
   occurrence_count AS occurrenceCount,
   first_seen AS firstSeen,
   last_seen AS lastSeen`;
 function toRow(raw) {
-  const { provider, ...rest } = raw;
-  return provider === null ? rest : { ...rest, provider };
+  const { provider, userAuthorized, ...rest } = raw;
+  const row = { ...rest, userAuthorized: userAuthorized !== 0 };
+  return provider === null ? row : { ...row, provider };
 }
 var SqliteSecretVaultRepository = class {
   constructor(db) {
@@ -29761,17 +30358,18 @@ var SqliteSecretVaultRepository = class {
          pointer_id, value_fingerprint, fingerprint_key_version, key_version,
          format_version, category, rule_id, masked_match, provider,
          ciphertext, nonce, auth_tag,
-         occurrence_count, first_seen, last_seen
+         user_authorized, occurrence_count, first_seen, last_seen
        ) VALUES (
          :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
          :formatVersion, :category, :ruleId, :maskedMatch, :provider,
          :ciphertext, :nonce, :authTag,
-         1, :now, :now
+         :userAuthorized, 1, :now, :now
        )`
     );
     this.bumpStmt = db.prepare(
       `UPDATE secret_vault
-       SET occurrence_count = occurrence_count + 1, last_seen = :now
+       SET occurrence_count = occurrence_count + 1, last_seen = :now,
+           user_authorized = max(user_authorized, :userAuthorized)
        WHERE value_fingerprint = :valueFingerprint`
     );
     this.byPointerStmt = db.prepare(
@@ -29791,6 +30389,7 @@ var SqliteSecretVaultRepository = class {
        SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
        WHERE pointer_id = :pointerId`
     );
+    this.deleteByPointerStmt = db.prepare(`DELETE FROM secret_vault WHERE pointer_id = :pointerId`);
     this.derefStmt = db.prepare(
       `INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
        VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`
@@ -29804,6 +30403,7 @@ var SqliteSecretVaultRepository = class {
   listStmt;
   replaceCiphertextStmt;
   refreshFingerprintStmt;
+  deleteByPointerStmt;
   derefStmt;
   /**
    * Vault a value, or record another sighting of one already vaulted. Keyed on
@@ -29812,6 +30412,11 @@ var SqliteSecretVaultRepository = class {
    * pointer, category and ciphertext, so the same secret always resolves to one
    * wire token. `minted` is true only when this call created the row.
    *
+   * `userAuthorized` is the one field a repeat call may still change, and only
+   * upwards: it records that a PERSON asked for this value to be replaced, and
+   * the row is shared with every automatic path that vaults the same value. See
+   * `bumpStmt` for why clearing it is the defect this shape exists to refuse.
+   *
    * The read-then-write runs in one IMMEDIATE transaction so two concurrent
    * writers cannot both decide they are minting.
    */
@@ -29838,13 +30443,18 @@ var SqliteSecretVaultRepository = class {
               ciphertext: input2.ciphertext,
               nonce: input2.nonce,
               authTag: input2.authTag,
+              userAuthorized: input2.userAuthorized === true ? 1 : 0,
               now
             })
           );
           minted = true;
           return;
         }
-        this.bumpStmt.run({ valueFingerprint: input2.valueFingerprint, now });
+        this.bumpStmt.run({
+          valueFingerprint: input2.valueFingerprint,
+          userAuthorized: input2.userAuthorized === true ? 1 : 0,
+          now
+        });
       },
       "IMMEDIATE"
     );
@@ -29904,6 +30514,42 @@ var SqliteSecretVaultRepository = class {
     );
     return destroyed;
   }
+  /**
+   * Destroy the named entries and report WHICH ones went — the scoped
+   * counterpart to `purgeAll`, for a caller that has already put those specific
+   * values back where they came from. Ids the store does not hold are absent
+   * from the answer rather than an error, so a set assembled from a stale read
+   * is not a fault. The deref audit is left alone, exactly as the purge leaves
+   * it.
+   *
+   * The ids come back rather than a count because the caller's next act is to
+   * write a purge row per destroyed entry, and a record of destruction has to
+   * be a record of what was really destroyed: a selection is a claim about a
+   * read that has since gone stale, and auditing from it invents a purge for an
+   * entry still sitting in the vault.
+   *
+   * One transaction over the whole set rather than a statement per id: the
+   * caller hands this the result of a restore pass it has completed, and a
+   * fault partway through must leave the vault as it was found rather than
+   * destroying a prefix of it. The vault holds the only copy of what a pointer
+   * stands for, so half a delete is not a state anything can recover from.
+   */
+  deleteByPointerIds(pointerIds) {
+    if (pointerIds.length === 0) return [];
+    const deleted = [];
+    withTransaction(
+      this.db,
+      () => {
+        for (const pointerId of pointerIds) {
+          if (Number(this.deleteByPointerStmt.run({ pointerId }).changes) > 0) {
+            deleted.push(pointerId);
+          }
+        }
+      },
+      "IMMEDIATE"
+    );
+    return deleted;
+  }
   /**
    * Record (or re-stamp) one place a pointer has been written. One row per
    * (pointer, location); a re-sighting bumps last_seen. Best-effort bookkeeping
@@ -29916,7 +30562,7 @@ var SqliteSecretVaultRepository = class {
          VALUES (:id, :pointerId, :location, :kind, :now, :now)
          ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
     ).run({
-      id: randomUUID8(),
+      id: randomUUID9(),
       pointerId: entry.pointerId,
       location: entry.location,
       kind: entry.kind,
@@ -30429,15 +31075,15 @@ var SqliteSecurityRepository = class {
     const from = now - RANGE_DAYS[range] * DAY_MS4;
     const rows = allRows(
       this.db.prepare(
-        `SELECT json_extract(e.attributes, '$.repo') AS repo, count(*) AS c
+        `SELECT e.repo AS repo, count(*) AS c
          FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
-           AND json_extract(e.attributes, '$.repo') IS NOT NULL
-           AND json_extract(e.attributes, '$.repo') != ''
-         GROUP BY repo
-         ORDER BY c DESC, repo
+           AND e.repo IS NOT NULL
+           AND e.repo != ''
+         GROUP BY e.repo
+         ORDER BY c DESC, e.repo
          LIMIT :limit`
       ),
       { from, to: now, limit }
@@ -30499,7 +31145,7 @@ var SqliteSecurityRepository = class {
         `SELECT f.finding_key AS finding_key,
                 d.rule_id AS rule_id,
                 d.severity AS severity,
-                json_extract(e.attributes, '$.file_path') AS path,
+                e.file_path AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
          FROM ${LATEST_RESOLUTION_BY_KEY_SQL} latest
@@ -30552,7 +31198,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -30640,7 +31286,7 @@ function buildSummary(dest, endpoints) {
     callSiteCount,
     transports: distinctTransports(transports),
     dataClasses: distinctDataClasses(dataClasses),
-    review: buildReviewInfo(dest.trust, transports),
+    review: buildReviewInfo(dest.trust, transports, dest.overrideDecision !== null),
     network: dest.kind === "provider" ? null : parseNetwork(dest.networkJson),
     endpoints: endpoints.map(toEndpointSummary)
   };
@@ -30667,7 +31313,7 @@ function buildDetail(dest, endpoints, callSites) {
     lastSeen: new Date(lastSeenMs).toISOString(),
     transports: distinctTransports(transports),
     dataClasses: distinctDataClasses(endpoints.map((e) => e.dataClass)),
-    review: buildReviewInfo(dest.trust, transports),
+    review: buildReviewInfo(dest.trust, transports, dest.overrideDecision !== null),
     network: dest.kind === "provider" ? null : parseNetwork(dest.networkJson),
     note: dest.note,
     endpoints: endpoints.map((ep) => ({
@@ -30696,7 +31342,11 @@ var SqliteSharesRepository = class {
        FROM share_destination d
        LEFT JOIN share_endpoint e ON e.destination_id = d.id
          AND e.transport IN ${PLAINTEXT_TRANSPORT_SQL}
-       WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
+       WHERE (d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL)
+         AND NOT EXISTS (
+           SELECT 1 FROM egress_decision_override o
+           WHERE o.host = d.host OR (o.destination_id = d.id AND o.host IS NULL)
+         )`
     );
     const kindCounts = countBy(
       this.db,
@@ -30808,7 +31458,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID9(),
+          id: randomUUID10(),
           destinationId,
           host: dest.host,
           decision,
@@ -30957,7 +31607,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID9(),
+          id: randomUUID10(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -30973,7 +31623,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID9(),
+          id: randomUUID10(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -30986,7 +31636,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID9(),
+        id: randomUUID10(),
         endpointId,
         project: input2.project,
         projectKey: input2.projectKey,
@@ -31351,6 +32001,7 @@ function purgeSampleData(db) {
 }
 
 // ../../packages/persistence/src/database.ts
+var CAPTURE_GRAIN = new Set(EventKind.options);
 var UNSAFE_TEST_ONLY_RAW_HANDLE = /* @__PURE__ */ Symbol(
   "aka.persistence.unsafeTestOnlyRawHandle"
 );
@@ -31398,7 +32049,7 @@ function backupLegacyStore(db, file2) {
   discardStore(file2, backup);
   return backup;
 }
-function openAndInitialize(file2) {
+function openAndInitialize(file2, base) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
@@ -31411,7 +32062,7 @@ function openAndInitialize(file2) {
     applyMigrations(db, file2);
     tightenPerms(file2);
     const policies = new SqlitePoliciesRepository(db);
-    const installedPacks = new SqliteInstalledPacksRepository(db);
+    const installedPacks = new SqliteInstalledPacksRepository(db, base);
     const repositories = {
       events: new SqliteEventsRepository(db),
       findings: new SqliteFindingsRepository(db),
@@ -31447,7 +32098,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join4(dir, DB_FILENAME);
+  const file2 = join7(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -31475,7 +32126,13 @@ function openLocalDatabase(dir) {
     inspectionDefinitions,
     inspectionFindings,
     configInventory
-  } = openAndInitialize(file2);
+  } = openAndInitialize(
+    file2,
+    // `dir` is always `<base>/data` — every caller resolves it through
+    // `dataDir()` — so its parent is the `~/.aka` base the layout splits into
+    // settings/ and data/, and the pack-policy floor needs both halves.
+    dirname2(dir)
+  );
   function captureRowId(event) {
     return captureId(
       event.metadata?.sessionId ?? null,
@@ -31488,6 +32145,21 @@ function openLocalDatabase(dir) {
       historySync.markSynced([captureRowId(event)], atMs);
     });
   }
+  function markCaptureOwed(event) {
+    failOpenTransaction(db, () => {
+      historySync.markCaptureOwed(captureRowId(event));
+    });
+  }
+  function markAuditEventsDelivered(events2, atMs) {
+    const stampable = events2.filter((event) => !CAPTURE_GRAIN.has(event.eventType));
+    if (stampable.length === 0) return;
+    failOpenTransaction(db, () => {
+      historySync.markSynced(
+        stampable.map((event) => event.id),
+        atMs
+      );
+    });
+  }
   function recordCapture(event, detected) {
     failOpenTransaction(db, () => {
       const sessionId = event.metadata?.sessionId;
@@ -31574,7 +32246,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID10(),
+          id: randomUUID11(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -31670,6 +32342,8 @@ function openLocalDatabase(dir) {
     inspectionFindings,
     recordCapture,
     markCaptureDelivered,
+    markCaptureOwed,
+    markAuditEventsDelivered,
     ensureInventory,
     recordConfigScan,
     recordProjectFiles,
@@ -31708,20 +32382,6 @@ var UserGrantPolicyProvider = class {
   }
 };
 
-// ../../packages/persistence/src/file-lock.ts
-import { randomUUID as randomUUID11 } from "crypto";
-import {
-  closeSync,
-  existsSync as existsSync2,
-  openSync,
-  readFileSync as readFileSync2,
-  rmSync as rmSync5,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { hostname as hostname3 } from "os";
-var PARK = new Int32Array(new SharedArrayBuffer(4));
-
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash3 } from "crypto";
 function normalizeFilePath(filePath) {
@@ -31734,13 +32394,13 @@ function computeFindingKey(input2) {
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join5(dataDir2, EXCEPTION_KEY_FILENAME);
+  return join8(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
   const parsed2 = JSON.parse(raw);
@@ -31778,7 +32438,7 @@ var FloorUnreadableError = class extends Error {
   }
 };
 function storedKeyVersionFloor(dataDir2) {
-  const file2 = join5(dataDir2, DB_FILENAME);
+  const file2 = join8(dataDir2, DB_FILENAME);
   if (!existsSync3(file2)) return 0;
   let db;
   try {
@@ -31833,7 +32493,7 @@ function occupantMessage(file2, kind) {
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync3(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync6(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -31857,146 +32517,12 @@ function fingerprintValue(key, raw) {
 
 // ../../packages/persistence/src/history-preview.ts
 import { existsSync as existsSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join9 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
-// ../../packages/persistence/src/local-layout.ts
-import { renameSync as renameSync3 } from "fs";
-import { mkdir } from "fs/promises";
-import { homedir } from "os";
-import { join as join7 } from "path";
-function defaultDataDir() {
-  return join7(homedir(), ".aka");
-}
-function settingsDir(base = defaultDataDir()) {
-  return join7(base, "settings");
-}
-function dataDir(base = defaultDataDir()) {
-  return join7(base, "data");
-}
-function dbPath(base = defaultDataDir()) {
-  return join7(dataDir(base), "aka.db");
-}
-function keysDir(base = defaultDataDir()) {
-  return join7(base, "keys");
-}
-async function ensureDataDir(dir = defaultDataDir()) {
-  await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
-  tightenDir(dir);
-}
-function ensureLayoutDirSync(dir = defaultDataDir()) {
-  ensureDataDirSync(dir);
-}
-function migrateLegacyLayout(base = defaultDataDir()) {
-  const moves = [
-    { name: "config.json", dest: settingsDir(base) },
-    { name: "policy-cache.json", dest: dataDir(base) }
-  ];
-  for (const { name, dest } of moves) {
-    try {
-      ensureDataDirSync(dest);
-      const moved = join7(dest, name);
-      renameSync3(join7(base, name), moved);
-      tightenFile(moved);
-    } catch {
-    }
-  }
-}
-
-// ../../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { posix, win32 } from "path";
-function managedSettingsPaths(platform2 = process.platform) {
-  if (platform2 === "darwin") {
-    return [
-      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
-      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
-    ];
-  }
-  if (platform2 === "win32") {
-    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
-  }
-  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
-}
-function readManagedSettings(paths = managedSettingsPaths()) {
-  for (const path of paths) {
-    let text;
-    try {
-      text = readFileSync4(path, "utf8");
-    } catch {
-      continue;
-    }
-    const record2 = parseJsonObject(text);
-    if (!record2) continue;
-    const parsed2 = ManagedSettings.safeParse(record2);
-    if (parsed2.success) return parsed2.data;
-  }
-  return null;
-}
-function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
-  if (!managed) return settings;
-  const { values } = managed;
-  const merged = { ...settings };
-  if (values.runMode !== void 0) merged.runMode = values.runMode;
-  if (values.controlPlane !== void 0) {
-    merged.controlPlane = {
-      ...values.controlPlane,
-      // The administrator pinned WHICH deployment, not WHEN this machine
-      // joined it. Keep the user's own attach time when the endpoint is
-      // unchanged, so a managed machine does not appear to re-attach on every
-      // read; stamp a fresh one when the administrator moved it.
-      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
-    };
-  }
-  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
-  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
-  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
-  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
-  if (values.vaultConsent !== void 0) {
-    merged.vaultConsent = values.vaultConsent ? (
-      // Keep an existing valid grant so its acknowledgedAt survives; mint one
-      // at the current version otherwise.
-      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
-    ) : void 0;
-  }
-  if (values.modelJudgeConsent !== void 0) {
-    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
-      acknowledgedAt: now().toISOString(),
-      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
-    } : void 0;
-  }
-  return merged;
-}
-
-// ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
-var SETTINGS_FILENAME = "settings.json";
-function readWorkspaceSettings(base = defaultDataDir()) {
-  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
-}
-function readUserSettings(base) {
-  const record2 = readJson(join8(settingsDir(base), SETTINGS_FILENAME));
-  if (!record2) return defaultWorkspaceSettings();
-  try {
-    return WorkspaceSettings.parse(record2);
-  } catch {
-    return defaultWorkspaceSettings();
-  }
-}
-function readJson(file2) {
-  let text;
-  try {
-    text = readFileSync5(file2, "utf8");
-  } catch {
-    return null;
-  }
-  return parseJsonObject(text) ?? null;
-}
-
 // ../../packages/persistence/src/store-symlinks.ts
 import { existsSync as existsSync5, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname2, join as join9, resolve } from "path";
+import { dirname as dirname3, join as join10, resolve } from "path";
 var STORE_DB = "the store database (including the prompt corpus)";
 var STORE_SETTINGS = "your settings file";
 function storeContents(home) {
@@ -32005,7 +32531,7 @@ function storeContents(home) {
     [settingsDir(home), STORE_SETTINGS],
     [dataDir(home), STORE_DB],
     [keysDir(home), "the vault key"],
-    [join9(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [join10(settingsDir(home), "settings.json"), STORE_SETTINGS],
     [dbPath(home), STORE_DB]
   ]);
 }
@@ -32033,7 +32559,7 @@ function linkTarget(path) {
   try {
     return realpathSync(path);
   } catch {
-    return resolve(dirname2(path), readlinkSync(path));
+    return resolve(dirname3(path), readlinkSync(path));
   }
 }
 function targetMode(path, platform2) {
@@ -32156,8 +32682,8 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join11 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
   gone: "the path was occupied but holds no keyring (removed while it was being created)",
@@ -32256,7 +32782,7 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync3(join10(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join11(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
@@ -32265,7 +32791,7 @@ function claimRotationLock(lock, owner) {
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join10(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join11(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
@@ -32292,7 +32818,7 @@ function acquireRotationLock(keysDir2) {
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync6(join10(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync7(join11(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
@@ -32313,7 +32839,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join10(this.#keysDir, VAULT_KEY_FILENAME);
+    return join11(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -32343,7 +32869,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync6(this.filePath, "utf8");
+      raw = readFileSync7(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -32630,7 +33156,14 @@ var SecretVault = class {
     const existing = this.#repo.byValueFingerprint(valueFingerprint);
     const now = this.#now();
     if (existing) {
-      this.#repo.upsert({ ...existing, provider: existing.provider ?? void 0 }, now);
+      this.#repo.upsert(
+        {
+          ...existing,
+          provider: existing.provider ?? void 0,
+          userAuthorized: meta4.userAuthorized === true
+        },
+        now
+      );
       return await this.#emitToken(existing.keyVersion, existing.pointerId, existing.category);
     }
     const { material, version: version2 } = await this.#keys.loadOrCreate();
@@ -32652,6 +33185,7 @@ var SecretVault = class {
         ruleId: meta4.ruleId,
         maskedMatch: meta4.maskedMatch,
         provider: meta4.provider,
+        userAuthorized: meta4.userAuthorized === true,
         ciphertext: sealed.ciphertext.toString("base64"),
         nonce: sealed.nonce.toString("base64"),
         authTag: sealed.authTag.toString("base64")
@@ -32971,11 +33505,11 @@ var SecretVault = class {
 
 // ../../packages/persistence/src/warn-era-cap.ts
 import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join11(dataDir2, MARKER);
+  const marker = join12(dataDir2, MARKER);
   if (existsSync6(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
@@ -33035,7 +33569,7 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join12(settingsDir(base), "settings.json");
+    const settingsFile = join13(settingsDir(base), "settings.json");
     if (existsSync7(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
@@ -33059,9 +33593,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join14 } from "path";
+import { basename as basename3, join as join15 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -36150,8 +36684,8 @@ function bundledDetections() {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute, join as join13, sep as sep2 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join14, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -36166,36 +36700,36 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync8(join13(dir, ".git"))) return dir;
-    const parent = dirname3(dir);
+    if (existsSync8(join14(dir, ".git"))) return dir;
+    const parent = dirname4(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join13(root, ".git");
+  const dotGit = join14(root, ".git");
   try {
     if (statSync6(dotGit).isDirectory()) {
-      return { configPath: join13(dotGit, "config"), headRoot: root };
+      return { configPath: join14(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join13(root, target);
-  if (existsSync8(join13(gitdir, "config"))) {
-    return { configPath: join13(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join14(root, target);
+  if (existsSync8(join14(gitdir, "config"))) {
+    return { configPath: join14(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join13(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join14(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join13(gitdir, commonRaw);
-  const headRoot = basename2(commonGitDir) === ".git" ? dirname3(commonGitDir) : root;
-  return { configPath: join13(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join14(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname4(commonGitDir) : root;
+  return { configPath: join14(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync7(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return void 0;
   }
@@ -36740,8 +37274,8 @@ function createGuardedScanner(partition, gateway, opts) {
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync9 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
@@ -36752,24 +37286,115 @@ import {
   fstatSync,
   mkdirSync as mkdirSync2,
   openSync as openSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   readSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
+var DATE_SUFFIX = /-\d{8}$/;
+function normalizeModelId(model) {
+  return model.trim().toLowerCase().replace(DATE_SUFFIX, "");
+}
+var SPAWN_INHERIT_WORDS = /* @__PURE__ */ new Set(["inherit", "default"]);
+function isBoundary(char) {
+  return char === "" || /[^a-z0-9]/.test(char);
+}
+function matchProhibitedSpawnModel(requested, prohibited) {
+  if (requested === void 0 || requested === "") return void 0;
+  if (prohibited === void 0 || prohibited.length === 0) return void 0;
+  const needle = normalizeModelId(requested);
+  if (needle === "" || SPAWN_INHERIT_WORDS.has(needle)) return void 0;
+  const exact = prohibited.find((p) => normalizeModelId(p) === needle);
+  if (exact !== void 0) return exact;
+  if (!needle.includes("-")) {
+    return prohibited.find((p) => normalizeModelId(p).split("-").includes(needle));
+  }
+  return prohibited.find((p) => {
+    const base = normalizeModelId(p);
+    if (base === "") return false;
+    let at = needle.indexOf(base);
+    while (at !== -1) {
+      if (isBoundary(at === 0 ? "" : needle.charAt(at - 1)) && isBoundary(needle.charAt(at + base.length))) {
+        return true;
+      }
+      at = needle.indexOf(base, at + 1);
+    }
+    return false;
+  });
+}
 var TAIL_BYTES = 256 * 1024;
+function prohibitedModelMessage(model, action) {
+  const subject = action === "switch" ? `Cannot switch to ${model}` : action === "spawn" ? `Cannot start a subagent on ${model}` : `This session is running on ${model}, which cannot be used`;
+  const remedy = action === "spawn" ? "Name an approved model on the subagent" : "Switch to an approved model with /model";
+  return `${subject} \u2014 your organization has prohibited this model. ${remedy}, or ask an administrator to change its status in AKA under Govern \u2192 LLM Providers.`;
+}
+function buildModelRefusalEvent(input2) {
+  return {
+    id: input2.id,
+    eventType: "model_refusal",
+    startedAt: input2.occurredAt,
+    // Omitted rather than nulled when unknown: `root_session_id` is a self-FK,
+    // and a session id naming no row would fail the insert outright.
+    ...input2.sessionId === void 0 || input2.sessionId === "" ? {} : { rootSessionId: input2.sessionId },
+    attributes: {
+      // `model` is a generated column on audit_events, so the refused model is
+      // queryable without unpacking the bag — which is what lets the control
+      // plane group refusals by the same id the prohibition was keyed on.
+      model: input2.model,
+      refusal_seam: input2.seam,
+      source_tool: input2.sourceTool,
+      // Omitted rather than duplicated when the caller named the id itself.
+      ...input2.requestedModel === void 0 || input2.requestedModel === input2.model ? {} : { requested_model: input2.requestedModel }
+    }
+  };
+}
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
-import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname5, sep as sep3 } from "path";
+
+// ../../packages/plugin-sdk/src/policy-resolver.ts
+function createPolicyResolver(bundle) {
+  const byRule = /* @__PURE__ */ new Map();
+  const byCategory = /* @__PURE__ */ new Map();
+  let reversible = /* @__PURE__ */ new Set();
+  try {
+    for (const policy of bundle.policies) {
+      if (!policy.enabled) continue;
+      if ("ruleId" in policy.target) {
+        if (!byRule.has(policy.target.ruleId)) byRule.set(policy.target.ruleId, policy.action);
+      } else if (!byCategory.has(policy.target.category)) {
+        byCategory.set(policy.target.category, policy.action);
+      }
+    }
+    reversible = new Set(bundle.reversibleRuleIds ?? []);
+  } catch {
+    byRule.clear();
+    byCategory.clear();
+    reversible = /* @__PURE__ */ new Set();
+  }
+  return {
+    actionFor(ruleId, category) {
+      const byRuleAction = byRule.get(ruleId);
+      if (byRuleAction !== void 0) return byRuleAction;
+      const byCategoryAction = byCategory.get(category);
+      if (byCategoryAction !== void 0) return byCategoryAction;
+      const fallback = DEFAULT_ACTIONS[category];
+      return fallback ?? "log";
+    },
+    isReversible(ruleId) {
+      return reversible.has(ruleId);
+    }
+  };
+}
 
 // ../../packages/plugin-sdk/src/project-files.ts
 import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join18 } from "path";
+import { basename as basename5, join as join19 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -36800,7 +37425,6 @@ var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID14 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
-var ACTION_PRIORITY = ["block", "redact", "warn", "log", "allow"];
 function startTiming() {
   try {
     return performance.now();
@@ -36837,28 +37461,22 @@ function createPluginRuntime(gateway, settings, opts) {
     bundlesPacked = true;
   }
   const policyMode = settings.policy;
+  const redactFallback = settings.redactFallback;
   const dataDir2 = opts?.dataDir;
-  let policies = [];
   let rules = [];
   let scanner;
   let bundleExceptions = [];
   let initialized = false;
-  const ruleActionIndex = /* @__PURE__ */ new Map();
-  const categoryActionIndex = /* @__PURE__ */ new Map();
-  let reversibleRuleIndex = /* @__PURE__ */ new Set();
+  let resolver = createPolicyResolver({
+    version: "",
+    policies: [],
+    customKeywords: [],
+    fetchedAt: ""
+  });
   async function ensureInitialized() {
     if (initialized) return;
     const bundle = await gateway.getPolicyBundle();
-    policies = bundle.policies;
-    for (const p of policies) {
-      if (!p.enabled) continue;
-      if ("ruleId" in p.target) {
-        if (!ruleActionIndex.has(p.target.ruleId)) ruleActionIndex.set(p.target.ruleId, p.action);
-      } else if (!categoryActionIndex.has(p.target.category)) {
-        categoryActionIndex.set(p.target.category, p.action);
-      }
-    }
-    reversibleRuleIndex = new Set(bundle.reversibleRuleIds ?? []);
+    resolver = createPolicyResolver(bundle);
     const bundledProbeKeys = new Set(
       getLoadedRules().map(ruleProbeKey).filter((key) => key !== void 0)
     );
@@ -36911,33 +37529,28 @@ function createPluginRuntime(gateway, settings, opts) {
     return cachedKey;
   }
   function resolveAction(ruleId, category) {
-    const byRule = ruleActionIndex.get(ruleId);
-    if (byRule !== void 0) return byRule;
-    const byCategory = categoryActionIndex.get(category);
-    if (byCategory !== void 0) return byCategory;
-    const fallback = DEFAULT_ACTIONS[category];
-    return fallback ?? "log";
-  }
-  function actionForFinding(finding, excepted) {
+    return resolver.actionFor(ruleId, category);
+  }
+  function actionForFinding(finding, excepted, rewritable = true) {
     if (excepted?.has(finding)) return "allow";
     const action = resolveAction(finding.ruleId, finding.category);
+    if (!rewritable && action === "redact") return builtinPolicyToAction(redactFallback);
     if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn" && (action === "block" || action === "redact")) {
       return "warn";
     }
     return action;
   }
-  function decide(findings, text, excepted) {
+  function decide(findings, text, excepted, rewritable = true) {
     if (findings.length === 0) return { action: "log", text, findings: [] };
-    const actionFor = (finding) => actionForFinding(finding, excepted);
+    const actionFor = (finding) => actionForFinding(finding, excepted, rewritable);
     let worst = "log";
     for (const finding of findings) {
-      const action = actionFor(finding);
-      if (ACTION_PRIORITY.indexOf(action) < ACTION_PRIORITY.indexOf(worst)) worst = action;
+      worst = strongerAction(worst, actionFor(finding));
     }
     if (worst === "block") return { action: "block", text: null, findings };
     if (worst === "redact") {
       const redactFindings = findings.filter((f) => actionFor(f) === "redact");
-      const reversibleFindings = redactFindings.filter((f) => reversibleRuleIndex.has(f.ruleId));
+      const reversibleFindings = redactFindings.filter((f) => resolver.isReversible(f.ruleId));
       return {
         action: "redact",
         text: redact(text, redactFindings),
@@ -37013,7 +37626,7 @@ function createPluginRuntime(gateway, settings, opts) {
       return { excepted: /* @__PURE__ */ new Set(), exceptionIds: [] };
     }
   }
-  async function recordBlockedDetections(decision, excepted, ctx, fpCache) {
+  async function recordBlockedDetections(decision, excepted, ctx, fpCache, rewritable = true) {
     const references = [];
     try {
       if (decision.action !== "block" && decision.action !== "redact") return references;
@@ -37021,7 +37634,7 @@ function createPluginRuntime(gateway, settings, opts) {
       if (!key) return references;
       const seen = /* @__PURE__ */ new Set();
       for (const finding of decision.findings) {
-        const action = actionForFinding(finding, excepted);
+        const action = actionForFinding(finding, excepted, rewritable);
         if (action !== "block" && action !== "redact") continue;
         const fp = fingerprintOf(key, finding, fpCache);
         const pair = `${finding.ruleId}:${fp}`;
@@ -37048,7 +37661,7 @@ function createPluginRuntime(gateway, settings, opts) {
     }
     return references;
   }
-  async function evaluate(text, context, ctx) {
+  async function evaluate(text, context, ctx, rewritable = true) {
     try {
       await ensureInitialized();
       if (!scanner) throw new Error("the runtime initialized without a scanner");
@@ -37057,8 +37670,14 @@ function createPluginRuntime(gateway, settings, opts) {
       const findings = dropShieldedFindings(matched, shielded.spans);
       const fpCache = /* @__PURE__ */ new Map();
       const { excepted, exceptionIds } = await applyExceptions(findings, ctx, fpCache);
-      const decision = decide(findings, text, excepted);
-      const blockedReferences = await recordBlockedDetections(decision, excepted, ctx, fpCache);
+      const decision = decide(findings, text, excepted, rewritable);
+      const blockedReferences = await recordBlockedDetections(
+        decision,
+        excepted,
+        ctx,
+        fpCache,
+        rewritable
+      );
       if (blockedReferences.length > 0) decision.blockedReferences = blockedReferences;
       return { decision, excepted, exceptionIds };
     } catch {
@@ -37082,12 +37701,16 @@ function createPluginRuntime(gateway, settings, opts) {
         sourceTool: input2.sourceTool,
         metadata: input2.metadata,
         preAuthorizedGrantIds: opts2.preAuthorizedGrantIds
-      }
+      },
+      opts2.rewritable
     );
     if (opts2.persist === "with-findings" && decision.findings.length === 0) return decision;
     try {
       const contentHash = contentHashOf(input2.text);
-      const storedContent = decision.findings.length > 0 ? redact(input2.text, decision.findings) : input2.text;
+      const maskedFindings = decision.findings.filter(
+        (match) => isActionAtLeast(actionForFinding(match, excepted, opts2.rewritable), "redact")
+      );
+      const storedContent = maskedFindings.length > 0 ? redact(input2.text, maskedFindings) : input2.text;
       const inspectionMs = elapsedMs(timingStartedAt);
       const metadata = exceptionIds.length > 0 || inspectionMs !== void 0 ? {
         ...input2.metadata,
@@ -37124,7 +37747,7 @@ function createPluginRuntime(gateway, settings, opts) {
           severity: match.severity,
           span: match.span,
           maskedMatch,
-          actionTaken: actionForFinding(match, excepted),
+          actionTaken: actionForFinding(match, excepted, opts2.rewritable),
           confidence: match.confidence,
           ...findingKey ? { findingKey } : {}
         };
@@ -37164,7 +37787,7 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -37226,14 +37849,26 @@ var SecretVaultGlue = class {
   }
   async tokenizeText(text, opts) {
     try {
-      const findings = opts?.findings ?? this.#selfScan(text);
-      const reversible = opts?.reversible;
-      const keeps = (finding) => reversible === void 0 || reversible.has(finding);
-      if (findings === null) return { text: "[REDACTED]", pointers: [], degraded: [] };
-      if (findings.length === 0) return { text, pointers: [], degraded: [] };
+      const supplied = opts?.findings;
+      const resolver = opts?.resolver;
+      const scanned = supplied ?? this.#selfScan(text);
+      if (scanned === null) {
+        return { text: "[REDACTED]", pointers: [], degraded: [], redacted: [] };
+      }
+      const findings = supplied === void 0 && resolver !== void 0 ? scanned.filter(
+        (f) => isActionAtLeast(resolver.actionFor(f.ruleId, f.category), "redact")
+      ) : scanned;
+      let reversible = opts?.reversible;
+      if (resolver !== void 0 && reversible === void 0) {
+        reversible = new Set(findings.filter((f) => resolver.isReversible(f.ruleId)));
+      }
+      const reversibleSet = reversible;
+      const keeps = (finding) => reversibleSet === void 0 || reversibleSet.has(finding);
+      if (findings.length === 0) return { text, pointers: [], degraded: [], redacted: [] };
       const groups = groupSpans(text, findings);
       const pointers = [];
       const degraded = [];
+      const redacted = [];
       let out = text;
       for (const group of [...groups].reverse()) {
         const original = text.slice(group.start, group.end);
@@ -37247,6 +37882,7 @@ var SecretVaultGlue = class {
           degraded.unshift({ category: group.category });
         } else if (!keeps(finding)) {
           replacement = redactedPlaceholder(finding.category);
+          redacted.unshift({ category: finding.category });
         } else {
           replacement = await this.tokenizeValue(finding.rawMatch, {
             ruleId: finding.ruleId,
@@ -37267,9 +37903,9 @@ var SecretVaultGlue = class {
           }
         }
       }
-      return { text: out, pointers, degraded };
+      return { text: out, pointers, degraded, redacted };
     } catch {
-      return { text: "[REDACTED]", pointers: [], degraded: [] };
+      return { text: "[REDACTED]", pointers: [], degraded: [], redacted: [] };
     }
   }
   async detokenizeText(text, opts) {
@@ -37471,17 +38107,17 @@ var UNOPENABLE_VAULT = {
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync12, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join20 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync13, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
+import { join as join21 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join20(dataDir2, MARKER_FILE);
+  const path = join21(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync12(path, "utf8"));
+    const stored = JSON.parse(readFileSync13(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -37490,7 +38126,7 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   const marker = mintMarker();
   try {
     mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join20(dataDir2, `${MARKER_FILE}.tmp`);
+    const tmp = join21(dataDir2, `${MARKER_FILE}.tmp`);
     writeFileSync8(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
@@ -37543,6 +38179,117 @@ function userDisclosure(opts) {
   return sentences.join(" ");
 }
 
+// src/hooks/model-guard.ts
+import { randomUUID as randomUUID15 } from "crypto";
+import { readFileSync as readFileSync14, statSync as statSync9 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname6, join as join22 } from "path";
+var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
+var SAFE_SUBAGENT_TYPE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+function projectAgentsRoot(from) {
+  if (from === void 0 || from === "") return void 0;
+  const home = homedir3();
+  let dir = from;
+  for (let depth = 0; depth < 24; depth += 1) {
+    if (dir === home) return void 0;
+    try {
+      if (statSync9(join22(dir, ".claude", "agents")).isDirectory()) return dir;
+    } catch {
+    }
+    const parent = dirname6(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+  return void 0;
+}
+function modelFromAgentDefinition(subagentType, cwd) {
+  if (subagentType === void 0 || !SAFE_SUBAGENT_TYPE.test(subagentType)) return void 0;
+  const roots = [projectAgentsRoot(cwd), homedir3()].filter(
+    (r) => r !== void 0 && r !== ""
+  );
+  for (const root of roots) {
+    try {
+      const raw = readFileSync14(join22(root, ".claude", "agents", `${subagentType}.md`), "utf8");
+      const lines = raw.split("\n");
+      if (lines[0]?.trim() !== "---") continue;
+      for (const line of lines.slice(1)) {
+        if (line.trim() === "---") break;
+        const sep4 = line.indexOf(":");
+        if (sep4 === -1) continue;
+        if (line.slice(0, sep4).trim() !== "model") continue;
+        const value = line.slice(sep4 + 1).trim().replace(/^['"]|['"]$/g, "");
+        if (value !== "") return value;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resolveSpawnModel(toolInput, cwd) {
+  const explicit = toolInput.model;
+  if (typeof explicit === "string" && explicit !== "") return explicit;
+  const subagentType = toolInput.subagent_type;
+  return modelFromAgentDefinition(typeof subagentType === "string" ? subagentType : void 0, cwd);
+}
+function decideSubagentSpawn(requested, prohibitedModels) {
+  if (requested === void 0 || requested === "") return null;
+  const matched = matchProhibitedSpawnModel(requested, prohibitedModels);
+  if (matched === void 0) return null;
+  return {
+    matched,
+    output: {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: prohibitedModelMessage(requested, "spawn")
+      }
+    }
+  };
+}
+async function handleSubagentSpawn(openGateway, toolName, toolInput, sessionId, cwd, emit2) {
+  if (!SUBAGENT_TOOLS.has(toolName)) return false;
+  const gateway = openGateway();
+  if (gateway === null) return false;
+  let decision;
+  let requested;
+  try {
+    const { prohibitedModels } = await gateway.getPolicyBundle();
+    if (prohibitedModels === void 0 || prohibitedModels.length === 0) {
+      await gateway.close();
+      return false;
+    }
+    requested = resolveSpawnModel(toolInput, cwd);
+    decision = decideSubagentSpawn(requested, prohibitedModels);
+  } catch {
+    await gateway.close();
+    return false;
+  }
+  if (decision === null || requested === void 0) {
+    await gateway.close();
+    return false;
+  }
+  try {
+    await gateway.recordAuditEvent(
+      buildModelRefusalEvent({
+        id: randomUUID15(),
+        sessionId,
+        model: decision.matched,
+        requestedModel: requested,
+        seam: "spawn",
+        sourceTool: SOURCE_TOOL.ClaudeCode,
+        occurredAt: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  } catch {
+  }
+  await emit2(decision.output);
+  try {
+    await gateway.close();
+  } catch {
+  }
+  return true;
+}
+
 // src/hooks/paths.ts
 function stringAtPath(root, path) {
   let current = root;
@@ -37774,7 +38521,13 @@ var STATIC_FIELDS = {
   // machine, but it is still a channel a secret can ride into a context the
   // user never sees. Scanned as data: the masked prompt is a coherent
   // instruction, so redaction is the intended end state and block still blocks.
-  Task: [{ path: ["prompt"], executable: false }]
+  //
+  // BOTH spellings. The harness renamed this tool — older builds send `Task`,
+  // current ones send `Agent` — and a table naming only the old one scans
+  // nothing at all on a current build, silently, because an unknown tool yields
+  // no fields and the hook returns before any decision.
+  Task: [{ path: ["prompt"], executable: false }],
+  Agent: [{ path: ["prompt"], executable: false }]
 };
 var MCP_MAX_DEPTH = 6;
 var MCP_MAX_LEAF_CHARS = 1e6;
@@ -37811,6 +38564,7 @@ function multiEditFields(toolInput) {
     executable: false
   }));
 }
+var SCANNED_TOOL_NAMES = Object.keys(STATIC_FIELDS);
 function scannableInputFields(toolName, toolInput) {
   const candidates = toolName.startsWith("mcp__") ? mcpFields(toolInput) : toolName === "MultiEdit" ? multiEditFields(toolInput) : (
     // hasOwn guard: a bare index would resolve Object.prototype members for
@@ -37886,8 +38640,8 @@ function baseMetadata(input2) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname5, join as join27 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join29 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/egress-wire.ts
 import { createHash as createHash5 } from "crypto";
@@ -37926,6 +38680,307 @@ function toEgressIngestRequest(input2) {
   };
 }
 
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+var RemoteRequestError = class extends Error {
+  constructor(status) {
+    super(`control-plane request failed with status ${String(status)}`);
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+  status;
+};
+var RemoteRouteAbsent = class extends Error {
+  constructor(route) {
+    super(`control plane does not serve ${route}`);
+    this.route = route;
+    this.name = "RemoteRouteAbsent";
+  }
+  route;
+};
+var RemoteRequestInvalid = class extends Error {
+  constructor(route, cause) {
+    super(`refusing to send a malformed body to ${route}`);
+    this.cause = cause;
+    this.name = "RemoteRequestInvalid";
+  }
+  cause;
+};
+var RemoteResponseInvalid = class extends Error {
+  constructor(route, detail) {
+    super(`control plane answered ${route} with ${detail}`);
+    this.name = "RemoteResponseInvalid";
+  }
+};
+var RemoteTransportError = class extends Error {
+  /**
+   * The status the peer sent, when headers arrived and only the BODY was
+   * refused.
+   *
+   * Undefined for the ordinary case this class was written for — no answer at
+   * all. It exists because two paths reject after a status has already been
+   * delivered: an oversized body and an aborted response. Discarding it there
+   * reported a deployment answering 401 with a verbose body as a network
+   * outage, which sends the reader to look at their network instead of their
+   * credential.
+   */
+  constructor(reason, status) {
+    super(`control-plane request did not complete: ${reason}`);
+    this.status = status;
+    this.name = "RemoteTransportError";
+  }
+  status;
+};
+async function send(options) {
+  const url2 = new URL(options.url);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
+  const requestOptions = {
+    method: options.method,
+    headers: {
+      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
+      // last they win, and two of the values below are ones no caller may
+      // replace: `x-api-key` is the credential, and `content-length` is the
+      // byte count that stops a multi-byte body being truncated by the
+      // receiver. `SendOptions.headers` is a free-form record on an exported
+      // function, so "no caller does that today" is not the guarantee to rely
+      // on. The one header any caller actually passes — `if-none-match` on the
+      // conditional GET — is untouched by this order.
+      ...options.headers,
+      // The credential. One header, matching what the deployment authenticates
+      // on; a second copy in an `Authorization` header would be one more place
+      // it can be logged by an intermediary for no gain.
+      //
+      // Spread conditionally rather than assigned as `undefined`: Node's header
+      // handling and `content-length` bookkeeping treat a present-but-undefined
+      // key differently from an absent one, and "the header is not there" is
+      // the property the attach flow needs.
+      ...options.apiKey === void 0 ? {} : { "x-api-key": options.apiKey },
+      accept: "application/json",
+      ...options.body === void 0 ? {} : {
+        "content-type": "application/json",
+        // Byte length, not string length: a multi-byte body sent with a
+        // character count is truncated by the receiver.
+        "content-length": String(Buffer.byteLength(options.body))
+      }
+    }
+  };
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const fail = (reason, status) => {
+      if (settled) return;
+      settled = true;
+      reject(new RemoteTransportError(reason, status));
+    };
+    const req = send_(url2, requestOptions, (res) => {
+      const chunks = [];
+      let size = 0;
+      res.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
+          res.destroy();
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("aborted", () => {
+        fail("the response was aborted", res.statusCode);
+      });
+      res.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve2({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+    });
+    const deadline = setTimeout(() => {
+      fail(`no response within ${String(timeoutMs)}ms`);
+      req.destroy();
+    }, timeoutMs);
+    deadline.unref();
+    req.on("upgrade", (_res, socket) => {
+      fail("the deployment answered with a protocol upgrade");
+      socket.destroy();
+    });
+    req.on("close", () => {
+      fail("the connection closed before a response was read");
+      clearTimeout(deadline);
+    });
+    req.on("error", (err) => {
+      fail(err.message);
+    });
+    if (options.body !== void 0) req.write(options.body);
+    req.end();
+  });
+}
+
+// ../../packages/remote/src/client.ts
+var ROUTES = {
+  events: "/v1/events",
+  auditEvents: "/v1/audit-events",
+  auditEventsBatch: "/v1/audit-events/batch",
+  inventory: "/v1/inventory",
+  storePosture: "/v1/store-posture",
+  policyBundle: "/v1/policy-bundle",
+  whoami: "/v1/plugin/whoami",
+  shares: "/v1/shares",
+  commands: "/v1/plugin/commands"
+};
+function ackRoute(id) {
+  return `${ROUTES.commands}/${encodeURIComponent(id)}/ack`;
+}
+function headerValue(response, name) {
+  const raw = response.headers[name];
+  if (raw === void 0) return void 0;
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function okBody(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new RemoteRequestError(response.status);
+  }
+  return response.body;
+}
+function parsed(schema, body, route) {
+  let json2;
+  try {
+    json2 = JSON.parse(body);
+  } catch {
+    throw new RemoteResponseInvalid(route, "a body that is not JSON");
+  }
+  const result = schema.safeParse(json2);
+  if (!result.success) {
+    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+  }
+  return result.data;
+}
+function withoutTrailingSlashes(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  return endpoint.slice(0, end);
+}
+var SLASH = "/".charCodeAt(0);
+function createRemoteClient(options) {
+  const base = withoutTrailingSlashes(options.endpoint);
+  const url2 = (route) => `${base}${route}`;
+  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
+  const sendOne = async (event) => {
+    const validated = RecordAuditEventRequest.safeParse(event);
+    if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
+    const response = await send({
+      ...common,
+      method: "POST",
+      url: url2(ROUTES.auditEvents),
+      body: JSON.stringify(validated.data)
+    });
+    okBody(response);
+  };
+  return {
+    async ingestEvents(batch) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.events),
+        body: JSON.stringify(batch)
+      });
+      return parsed(IngestAck, okBody(response), ROUTES.events);
+    },
+    async ingestInventory(context) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.inventory),
+        body: JSON.stringify(context)
+      });
+      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
+    },
+    async recordAuditEvent(event) {
+      await sendOne(event);
+    },
+    async recordAuditEvents(events, opts) {
+      const validated = RecordAuditEventBatch.safeParse({ events });
+      if (!validated.success) {
+        throw new RemoteRequestInvalid(ROUTES.auditEventsBatch, validated.error);
+      }
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.auditEventsBatch),
+        body: JSON.stringify(validated.data)
+      });
+      if (response.status === 404) {
+        if (opts?.fallbackToSingleEvents !== true) {
+          throw new RemoteRouteAbsent(ROUTES.auditEventsBatch);
+        }
+        for (const event of validated.data.events) await sendOne(event);
+        return { accepted: validated.data.events.length };
+      }
+      return parsed(AuditEventBatchAck, okBody(response), ROUTES.auditEventsBatch);
+    },
+    async reportStorePosture(snapshot) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.storePosture),
+        body: JSON.stringify(snapshot)
+      });
+      okBody(response);
+    },
+    async getPolicyBundle(etag) {
+      const response = await send({
+        ...common,
+        method: "GET",
+        url: url2(ROUTES.policyBundle),
+        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
+      });
+      if (response.status === 304) {
+        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+      }
+      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
+      return { changed: true, bundle, etag: headerValue(response, "etag") };
+    },
+    async whoami() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
+      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
+    },
+    async recordProjectEgress(request) {
+      const validated = EgressIngestRequest.safeParse(request);
+      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.shares, validated.error);
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.shares),
+        body: JSON.stringify(validated.data)
+      });
+      okBody(response);
+    },
+    async pollCommand() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.commands) });
+      if (response.status === 404) return null;
+      return parsed(DeviceCommandPollResponse, okBody(response), ROUTES.commands).command;
+    },
+    async ackCommand(id, body) {
+      const validated = DeviceCommandAckBody.safeParse(body);
+      const route = ackRoute(id);
+      if (!validated.success) throw new RemoteRequestInvalid(route, validated.error);
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(route),
+        body: JSON.stringify(validated.data)
+      });
+      okBody(response);
+    }
+  };
+}
+
 // ../../packages/plugin-runtime/src/attached/failure.ts
 function statusOf(err) {
   if (typeof err !== "object" || err === null || !("status" in err)) return null;
@@ -37944,12 +38999,27 @@ function classifyFailure(err) {
   }
 }
 
+// ../../packages/plugin-runtime/src/attached/with-timeout.ts
+var REQUEST_TIMEOUT_MS = 2e3;
+function withTimeout(promise2, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error("attached gateway request timed out"));
+    }, ms);
+  });
+  promise2.catch(() => void 0);
+  return Promise.race([promise2, timeout]).finally(() => {
+    clearTimeout(timer);
+  });
+}
+
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join23 } from "path";
 var FORWARD_DROPS_FILENAME = ATTACHED_FORWARD_DROPS_FILENAME;
 function forwardDropsPath(dataDir2) {
-  return join21(dataDir2, FORWARD_DROPS_FILENAME);
+  return join23(dataDir2, FORWARD_DROPS_FILENAME);
 }
 function recordForwardDrops(dataDir2, count, nowMs) {
   if (count <= 0) return;
@@ -37967,7 +39037,7 @@ function recordForwardDrops(dataDir2, count, nowMs) {
 }
 function readForwardDrops(dataDir2) {
   try {
-    const parsed2 = JSON.parse(readFileSync13(forwardDropsPath(dataDir2), "utf8"));
+    const parsed2 = JSON.parse(readFileSync15(forwardDropsPath(dataDir2), "utf8"));
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     const record2 = parsed2;
     if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
@@ -37984,30 +39054,20 @@ function readForwardDrops(dataDir2) {
 }
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
-import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync14 } from "fs";
+import { randomUUID as randomUUID16 } from "crypto";
+import { readFileSync as readFileSync16 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join22 } from "path";
-
-// ../../packages/plugin-runtime/src/attached/with-timeout.ts
-var REQUEST_TIMEOUT_MS = 2e3;
-function withTimeout(promise2, ms) {
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      reject(new Error("attached gateway request timed out"));
-    }, ms);
-  });
-  promise2.catch(() => void 0);
-  return Promise.race([promise2, timeout]).finally(() => {
-    clearTimeout(timer);
-  });
-}
-
-// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+import { join as join24 } from "path";
 function isInvalidRequest(err) {
   return typeof err === "object" && err !== null && err.name === "RemoteRequestInvalid";
 }
+function isRouteAbsent(err) {
+  return typeof err === "object" && err !== null && err.name === "RemoteRouteAbsent";
+}
+function isServerRejection(err) {
+  const status = statusOf(err);
+  return status !== null && status >= 400 && status <= 499 && status !== 401 && status !== 403 && status !== 404 && status !== 429;
+}
 var FORWARD_BUDGET_MS = 1500;
 var DECISION_PATH_BUDGET_MS = 800;
 var BREAKER_FAILURE_THRESHOLD = 3;
@@ -38035,7 +39095,7 @@ function parseBreakerState(raw, nowMs) {
 }
 function createForwardPolicy(deps) {
   const now = deps.now ?? (() => Date.now());
-  const file2 = join22(deps.dir, STATE_FILENAME);
+  const file2 = join24(deps.dir, STATE_FILENAME);
   let state = null;
   let loading = null;
   async function readState() {
@@ -38060,7 +39120,7 @@ function createForwardPolicy(deps) {
     state = next;
     try {
       await ensureDataDir(deps.dir);
-      const tmp = `${file2}.${randomUUID15()}.tmp`;
+      const tmp = `${file2}.${randomUUID16()}.tmp`;
       await writeFile(tmp, JSON.stringify(next), { encoding: "utf8", mode: DATA_FILE_MODE });
       await rename(tmp, file2);
     } catch {
@@ -38075,6 +39135,20 @@ function createForwardPolicy(deps) {
       } catch {
         current = { ...CLOSED };
       }
+      const restoreOpenedAtMs = (openedAtMs) => persist({
+        consecutiveFailures: current.consecutiveFailures,
+        openedAtMs,
+        lastFailure: current.lastFailure
+      });
+      const recordFailure = (cause) => {
+        const failures = current.consecutiveFailures + 1;
+        const shouldOpen = current.openedAtMs !== null || failures >= BREAKER_FAILURE_THRESHOLD;
+        return persist({
+          consecutiveFailures: failures,
+          openedAtMs: shouldOpen ? now() : null,
+          lastFailure: cause
+        });
+      };
       const at = now();
       if (current.openedAtMs !== null) {
         if (at - current.openedAtMs < BREAKER_COOLDOWN_MS) {
@@ -38093,15 +39167,20 @@ function createForwardPolicy(deps) {
         }
         return { ok: true, value };
       } catch (err) {
-        if (isInvalidRequest(err)) return { ok: false, reason: "invalid-request" };
+        if (isInvalidRequest(err)) {
+          if (current.openedAtMs !== null) await restoreOpenedAtMs(current.openedAtMs);
+          return { ok: false, reason: "invalid-request" };
+        }
+        if (isRouteAbsent(err)) {
+          if (current.openedAtMs !== null) await restoreOpenedAtMs(null);
+          return { ok: false, reason: "route-absent" };
+        }
+        if (isServerRejection(err)) {
+          await recordFailure("unreachable");
+          return { ok: false, reason: "rejected" };
+        }
         const reason = classifyFailure(err);
-        const failures = current.consecutiveFailures + 1;
-        const shouldOpen = current.openedAtMs !== null || failures >= BREAKER_FAILURE_THRESHOLD;
-        await persist({
-          consecutiveFailures: failures,
-          openedAtMs: shouldOpen ? now() : null,
-          lastFailure: reason
-        });
+        await recordFailure(reason);
         return { ok: false, reason };
       }
     }
@@ -38109,13 +39188,11 @@ function createForwardPolicy(deps) {
 }
 
 // ../../packages/plugin-runtime/src/attached/gateway.ts
-var ACTION_STRENGTH = {
-  allow: 0,
-  log: 1,
-  warn: 2,
-  redact: 3,
-  block: 4
-};
+function strongerOf(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  return strongerAction(a, b);
+}
 function ruleCategoryMap(wireRules, localRules) {
   const map2 = /* @__PURE__ */ new Map();
   for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
@@ -38125,11 +39202,6 @@ function ruleCategoryMap(wireRules, localRules) {
   }
   return map2;
 }
-function strongerOf(a, b) {
-  if (a === null) return b;
-  if (b === null) return a;
-  return ACTION_STRENGTH[a] >= ACTION_STRENGTH[b] ? a : b;
-}
 function policyKey(policy) {
   return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
 }
@@ -38148,7 +39220,7 @@ function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
     const floor = floorFor(policy, categoryByRuleId);
     remoteCategoryAction.set(
       policy.target.category,
-      floor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[floor] ? floor : policy.action
+      floor !== null && !isActionAtLeast(policy.action, floor) ? floor : policy.action
     );
   }
   for (const policy of localPolicies) {
@@ -38165,7 +39237,7 @@ function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
     }
     merged.set(
       key,
-      remoteFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[remoteFloor] ? { ...policy, action: remoteFloor } : policy
+      remoteFloor !== null && !isActionAtLeast(policy.action, remoteFloor) ? { ...policy, action: remoteFloor } : policy
     );
   }
   const localCategoryAction = /* @__PURE__ */ new Map();
@@ -38185,13 +39257,13 @@ function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
       if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
     }
     const effectiveFloor = strongerOf(floor, localFloor);
-    const clamped = effectiveFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[effectiveFloor] ? { ...policy, action: effectiveFloor } : policy;
+    const clamped = effectiveFloor !== null && !isActionAtLeast(policy.action, effectiveFloor) ? { ...policy, action: effectiveFloor } : policy;
     const existing = merged.get(key);
     if (existing === void 0) {
       merged.set(key, clamped);
       continue;
     }
-    if (ACTION_STRENGTH[clamped.action] > ACTION_STRENGTH[existing.action]) {
+    if (actionRank(clamped.action) > actionRank(existing.action)) {
       merged.set(key, clamped);
     }
   }
@@ -38224,6 +39296,8 @@ var AttachedDataGateway = class {
     );
     if (forwarded.ok && forwarded.value.accepted + forwarded.value.duplicates > 0) {
       this.deps.local.markCaptureDelivered(record2.event, Date.now());
+    } else {
+      this.deps.local.markCaptureOwed(record2.event);
     }
   }
   async ensureInventory(ctx) {
@@ -38260,9 +39334,10 @@ var AttachedDataGateway = class {
   // a retried tool_call, exactly this path — can never stomp a populated row.
   async recordAuditEvent(event) {
     await this.deps.local.recordAuditEvent(event);
-    await this.deps.forward.run(
+    const forwarded = await this.deps.forward.run(
       () => this.deps.client.recordAuditEvent(reKeyForForward(event, this.remoteInventory))
     );
+    if (forwarded.ok) this.deps.local.markAuditEventsDelivered([event], Date.now());
   }
   // Attached `llm_call` is written locally by the inner gateway, then routed to
   // the control plane through the existing `recordAuditEvent` ingest (no dedicated
@@ -38271,44 +39346,170 @@ var AttachedDataGateway = class {
   // which would write the event to the local store a second time.
   async recordLlmCall(input2) {
     await this.deps.local.recordLlmCall(input2);
-    await this.deps.forward.run(
-      () => this.deps.client.recordAuditEvent(
-        reKeyForForward(llmAuditEvent(input2), this.remoteInventory)
-      )
+    const event = llmAuditEvent(input2);
+    const forwarded = await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(reKeyForForward(event, this.remoteInventory))
     );
+    if (forwarded.ok) this.deps.local.markAuditEventsDelivered([event], Date.now());
   }
   /**
-   * Forward one batch, item by item, under ONE aggregate deadline.
+   * Forward one batch in CHUNKS of AUDIT_EVENT_BATCH_MAX, under ONE aggregate deadline.
+   *
+   * This used to send one HTTP request per event, which is what made the batch
+   * budget bite: at 200ms round-trip a 3s budget admitted ~15 events and threw
+   * away everything after them. The same rows now cross 50 at a time over
+   * `POST /v1/audit-events/batch` — the route the attach-time drain has always
+   * used — so the same budget admits ~750. The wire cap is the server's own
+   * constant, sized against server cost, and the client REFUSES a longer array
+   * client-side, so the chunking here is not a convention.
+   *
+   * Still serial, and still for the original reason: firing N requests at once
+   * would trade a latency problem for a burst the plane's per-key rate limiting
+   * answers with the refusals the breaker then counts. Fewer, fuller requests is
+   * the fix; more concurrent ones is not.
+   *
+   * When the deadline passes the remainder is dropped rather than sent: the
+   * local write has already succeeded, so every caller has a correct result to
+   * return. What is dropped is COUNTED, everywhere it can happen — this path
+   * returns BEFORE `ForwardPolicy.run` is reached, so without the tally in
+   * `forward-drops.ts` a slow-but-answering plane produces no failures, keeps
+   * the breaker closed, renders a healthy block, and discards the tail of every
+   * batch indefinitely. The SAME tally also covers a single that fails inside
+   * the per-item retry below — the breaker opening mid-retry is a failure the
+   * breaker's own state DOES capture, but the events still in this chunk once
+   * that happens are neither delivered nor otherwise counted anywhere, which is
+   * the same invisibility with a different cause.
    *
-   * Per-item budgets bound each request and nothing bounded their sum — see
-   * BATCH_FORWARD_BUDGET_MS. When the deadline passes the remainder is dropped
-   * rather than sent: the local write has already succeeded, so every caller
-   * has a correct result to return, and a drop is the outcome this path is
-   * built to accept (G8) where a blown hook timeout is not.
+   * `ok` ALONE IS NOT DELIVERY, the same rule `recordCapture` states for the
+   * single-event ack and at fifty times the blast radius here:
+   * `AuditEventBatchAck.accepted` is an aggregate count the wire contract does
+   * not tie to the chunk's own length, so a 2xx answering `{accepted: 30}` for
+   * fifty events is well-formed. Trusting `ok` alone would stamp all fifty as
+   * delivered and never re-offer the twenty the plane did not take. So success
+   * is checked against `chunk.length`; anything short of it falls into the same
+   * per-item pass as a refused chunk, which is the only way to recover the
+   * rows that did not land, since the ack carries no per-row verdict to
+   * resend by.
    *
-   * Serial rather than concurrent on purpose. Firing N requests at once would
-   * trade a latency problem for a burst the plane's own per-key rate limiting
-   * would answer with the refusals the breaker then counts.
+   * That fallback ASSUMES a re-send of an already-landed row is a harmless
+   * no-op rather than a second cost — an assumption this file cannot verify.
+   * `AuditEventBatchAck` carries only `accepted`, unlike its sibling
+   * `IngestAck` (`accepted` + `duplicates`, with `accepted + duplicates ==`
+   * the batch size as the invariant `recordCapture` reads), so whether a
+   * duplicate counts toward THIS route's `accepted` is not expressed
+   * anywhere in this repo. If it follows its sibling's convention and does
+   * NOT, a chunk containing even one already-delivered row — the ordinary
+   * consequence of a lost stamp, which this file already treats as cheap —
+   * answers short forever and enters the per-item pass on every pass it is
+   * offered again. The cost of that is bounded rather than silent: the
+   * pass converges (every row lands and stamps), so it is one wasted round
+   * of singles rather than a stall, and it errs toward an extra resend
+   * rather than toward the lost row the alternative risks.
    *
-   * WHAT IS DROPPED IS COUNTED. Every other forward failure ends in
-   * `ForwardPolicy.run`'s catch and moves the breaker's file, which is what
-   * lets status call the forward unhealthy; this path returns BEFORE `run` is
-   * reached, so without the tally in `forward-drops.ts` a slow-but-answering
-   * plane produces no failures, keeps the breaker closed, renders a healthy
-   * block, and discards the tail of every batch indefinitely.
+   * BATCH-ATOMIC SETTLEMENT is otherwise the rule: the receiver wraps a chunk in
+   * one transaction, so a full 2xx settles every event in it and a non-2xx
+   * settles none — which is why the whole chunk is stamped together on a FULL
+   * accept and none of it otherwise. THREE reasons do not deserve whole-chunk
+   * treatment, alongside a short accept, and all are re-sent one event at a
+   * time:
+   *
+   *   `invalid-request` a chunk the client refused to send at all. One malformed
+   *                     event would otherwise cost the 49 good ones beside it —
+   *                     a new way to lose data introduced by the very change
+   *                     meant to stop losing it.
+   *   `route-absent`    a deployment that predates the batch route. The
+   *                     single-event route is the one it serves, and re-sending
+   *                     here rather than inside the client is what gives each
+   *                     request its own budget instead of 50 inside one.
+   *   `rejected`        the deployment's SERVER-side twin of `invalid-request` —
+   *                     a 4xx body refusal from schema drift on the other side
+   *                     of the wire. Settlement is batch-atomic on this reason
+   *                     exactly as on the others, so leaving it out would cost
+   *                     the whole chunk for one event the DEPLOYMENT considers
+   *                     malformed, where the per-item form cost only that one.
+   *
+   * Every other reason (breaker-open, a refusal, a timeout) applies to the whole
+   * chunk, and re-sending it item by item would just spend the budget failing 50
+   * more times — for those, the blast radius stays exactly what it was before
+   * batching.
    */
   async forwardBatch(inputs, toEvent) {
     const deadline = Date.now() + BATCH_FORWARD_BUDGET_MS;
-    for (let i = 0; i < inputs.length; i += 1) {
-      const now = Date.now();
-      if (now >= deadline) {
-        recordForwardDrops(this.deps.dataDir, inputs.length - i, now);
-        return;
+    const delivered = [];
+    try {
+      for (let i = 0; i < inputs.length; i += AUDIT_EVENT_BATCH_MAX) {
+        const now = Date.now();
+        if (now >= deadline) {
+          recordForwardDrops(this.deps.dataDir, inputs.length - i, now);
+          return;
+        }
+        const chunk = inputs.slice(i, i + AUDIT_EVENT_BATCH_MAX).map((input2) => toEvent(input2));
+        const forwarded = await this.deps.forward.run(
+          () => this.deps.client.recordAuditEvents(
+            chunk.map((event) => reKeyForForward(event, this.remoteInventory))
+          )
+        );
+        if (forwarded.ok) {
+          if (forwarded.value.accepted === chunk.length) {
+            delivered.push(...chunk);
+            continue;
+          }
+        } else if (
+          // THREE reasons are worth a second pass, one at a time, and they are
+          // the three settled BEFORE the control plane refused anything, or
+          // (for `rejected`) refused the BODY rather than the connection.
+          //
+          // `invalid-request` — the CLIENT refused the body before any request
+          // went out: a defect in one event, not an outage. Re-sending singly
+          // isolates the bad one instead of charging its 49 neighbours for it.
+          //
+          // `route-absent` — the deployment predates the batch route and serves
+          // only the single-event one. The retry IS the compatibility path, and
+          // it has to live HERE rather than inside the client: each single gets
+          // its own FORWARD_BUDGET_MS through `run`, whereas the client's own
+          // fallback would spend 50 sequential round trips inside the ONE
+          // budget wrapping this call — turning a working older deployment into
+          // a timeout, three of those into an open breaker, and every row into
+          // a silent drop while the status surface called an answering
+          // deployment down.
+          //
+          // `rejected` — the deployment's own 4xx refusal of the body, the
+          // server-side twin of `invalid-request`: isolating it the same way
+          // costs one event instead of the whole chunk for a defect the
+          // deployment considers local to one row.
+          //
+          // Every other reason (breaker-open, a refusal, a timeout) applies to
+          // the whole chunk; re-sending it item by item would just spend the
+          // budget failing 50 more times.
+          forwarded.reason !== "invalid-request" && forwarded.reason !== "route-absent" && forwarded.reason !== "rejected"
+        ) {
+          continue;
+        }
+        for (const [j, event] of chunk.entries()) {
+          const at = Date.now();
+          if (at >= deadline) {
+            recordForwardDrops(this.deps.dataDir, inputs.length - i - j, at);
+            return;
+          }
+          const single = await this.deps.forward.run(
+            () => this.deps.client.recordAuditEvent(reKeyForForward(event, this.remoteInventory))
+          );
+          if (single.ok) {
+            delivered.push(event);
+            continue;
+          }
+          if (single.reason === "breaker-open") {
+            recordForwardDrops(this.deps.dataDir, inputs.length - i - j, at);
+            return;
+          }
+          recordForwardDrops(this.deps.dataDir, 1, at);
+        }
+      }
+    } finally {
+      try {
+        this.deps.local.markAuditEventsDelivered(delivered, Date.now());
+      } catch {
       }
-      const input2 = inputs[i];
-      await this.deps.forward.run(
-        () => this.deps.client.recordAuditEvent(reKeyForForward(toEvent(input2), this.remoteInventory))
-      );
     }
   }
   // Delegated as a BATCH rather than looped over recordLlmCall: the inner
@@ -38351,9 +39552,10 @@ var AttachedDataGateway = class {
   // local store.
   async recordConfigScan(record2) {
     await this.deps.local.recordConfigScan(record2);
-    await this.deps.forward.run(
+    const forwarded = await this.deps.forward.run(
       () => this.deps.client.recordAuditEvent(reKeyForForward(record2.scanEvent, this.remoteInventory))
     );
+    if (forwarded.ok) this.deps.local.markAuditEventsDelivered([record2.scanEvent], Date.now());
   }
   async recordBlockedDetection(entry) {
     return this.deps.local.recordBlockedDetection(entry);
@@ -38487,6 +39689,18 @@ var AttachedDataGateway = class {
       // exactly what it did, leaving the whole control inert on every device
       // while every test around it stayed green.
       prohibitedModels: cached2.prohibitedModels
+      // ALSO HONOURED FROM THE CACHE, and not a bundle field at all: each
+      // merged policy's own `provenance`. `mergeRaiseOnly` spreads the policies
+      // it emits, so an 'authored' policy arriving from the control plane
+      // keeps that marker even where the clamp rebuilds it with a stronger
+      // action. The device reads it in exactly one direction — the rules such a
+      // policy targets are not locally re-assignable — so it sits on the
+      // `prohibitedModels` side of the line for the same reason that field
+      // does: it can only ever ADD a refusal, never relax one, and an unsigned
+      // cache therefore has no relaxation to grant by carrying it. Dropping it
+      // would be the silent failure rather than the safe one — the action would
+      // still be enforced while the local override the organization authored
+      // away quietly came back.
       // `rulesComplete` is a STANDALONE-ONLY signal (the user's local installed
       // snapshot) and is taken from the LOCAL bundle only — never from the wire
       // or the on-disk cache. Honoring a cached one would hand the control plane, or
@@ -38526,10 +39740,10 @@ var AttachedDataGateway = class {
   //
   // Implementing these is what actually closes the skipped-local-maintenance
   // gap: the OSS structural guard `hasLocalStoreMaintenance()` is satisfied by
-  // any object carrying all five, so the composite qualifies and SessionStart
+  // any object carrying them all, so the composite qualifies and SessionStart
   // runs maintenance on the device's real store.
   //
-  // ⚠ Three of the six are SYNCHRONOUS and must stay that way. `handle-session-start`
+  // ⚠ Several of them are SYNCHRONOUS and must stay that way. `handle-session-start`
   // calls `capWarnEraEnforcement` without `await` and uses `staleBinaryNotice`'s
   // return value directly; declaring them `async` here would hand those call
   // sites a Promise and silently break both.
@@ -38552,9 +39766,15 @@ var AttachedDataGateway = class {
   // Delegated like the rest, and SYNCHRONOUS for the reason the note above
   // gives: `recordCapture` calls it after the forward has already settled, on a
   // path that has nothing left to await.
+  markCaptureOwed(event) {
+    this.deps.local.markCaptureOwed(event);
+  }
   markCaptureDelivered(event, atMs) {
     this.deps.local.markCaptureDelivered(event, atMs);
   }
+  markAuditEventsDelivered(events, atMs) {
+    this.deps.local.markAuditEventsDelivered(events, atMs);
+  }
 };
 function reKeyForForward(event, remote) {
   if (remote === null) {
@@ -38597,281 +39817,17 @@ function toolAuditEvent(input2) {
 }
 
 // ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join25 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash6 } from "crypto";
 import { hostname as hostname5 } from "os";
 
-// ../../packages/remote/src/http.ts
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-var DEFAULT_TIMEOUT_MS = 1e4;
-var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
-var RemoteRequestError = class extends Error {
-  constructor(status) {
-    super(`control-plane request failed with status ${String(status)}`);
-    this.status = status;
-    this.name = "RemoteRequestError";
-  }
-  status;
-};
-var RemoteRequestInvalid = class extends Error {
-  constructor(route, cause) {
-    super(`refusing to send a malformed body to ${route}`);
-    this.cause = cause;
-    this.name = "RemoteRequestInvalid";
-  }
-  cause;
-};
-var RemoteResponseInvalid = class extends Error {
-  constructor(route, detail) {
-    super(`control plane answered ${route} with ${detail}`);
-    this.name = "RemoteResponseInvalid";
-  }
-};
-var RemoteTransportError = class extends Error {
-  /**
-   * The status the peer sent, when headers arrived and only the BODY was
-   * refused.
-   *
-   * Undefined for the ordinary case this class was written for — no answer at
-   * all. It exists because two paths reject after a status has already been
-   * delivered: an oversized body and an aborted response. Discarding it there
-   * reported a deployment answering 401 with a verbose body as a network
-   * outage, which sends the reader to look at their network instead of their
-   * credential.
-   */
-  constructor(reason, status) {
-    super(`control-plane request did not complete: ${reason}`);
-    this.status = status;
-    this.name = "RemoteTransportError";
-  }
-  status;
-};
-async function send(options) {
-  const url2 = new URL(options.url);
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
-  const requestOptions = {
-    method: options.method,
-    headers: {
-      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
-      // last they win, and two of the values below are ones no caller may
-      // replace: `x-api-key` is the credential, and `content-length` is the
-      // byte count that stops a multi-byte body being truncated by the
-      // receiver. `SendOptions.headers` is a free-form record on an exported
-      // function, so "no caller does that today" is not the guarantee to rely
-      // on. The one header any caller actually passes — `if-none-match` on the
-      // conditional GET — is untouched by this order.
-      ...options.headers,
-      // The credential. One header, matching what the deployment authenticates
-      // on; a second copy in an `Authorization` header would be one more place
-      // it can be logged by an intermediary for no gain.
-      //
-      // Spread conditionally rather than assigned as `undefined`: Node's header
-      // handling and `content-length` bookkeeping treat a present-but-undefined
-      // key differently from an absent one, and "the header is not there" is
-      // the property the attach flow needs.
-      ...options.apiKey === void 0 ? {} : { "x-api-key": options.apiKey },
-      accept: "application/json",
-      ...options.body === void 0 ? {} : {
-        "content-type": "application/json",
-        // Byte length, not string length: a multi-byte body sent with a
-        // character count is truncated by the receiver.
-        "content-length": String(Buffer.byteLength(options.body))
-      }
-    }
-  };
-  return new Promise((resolve2, reject) => {
-    let settled = false;
-    const fail = (reason, status) => {
-      if (settled) return;
-      settled = true;
-      reject(new RemoteTransportError(reason, status));
-    };
-    const req = send_(url2, requestOptions, (res) => {
-      const chunks = [];
-      let size = 0;
-      res.on("data", (chunk) => {
-        size += chunk.length;
-        if (size > MAX_RESPONSE_BYTES) {
-          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
-          res.destroy();
-          req.destroy();
-          return;
-        }
-        chunks.push(chunk);
-      });
-      res.on("aborted", () => {
-        fail("the response was aborted", res.statusCode);
-      });
-      res.on("end", () => {
-        if (settled) return;
-        settled = true;
-        resolve2({
-          status: res.statusCode ?? 0,
-          headers: res.headers,
-          body: Buffer.concat(chunks).toString("utf8")
-        });
-      });
-    });
-    const deadline = setTimeout(() => {
-      fail(`no response within ${String(timeoutMs)}ms`);
-      req.destroy();
-    }, timeoutMs);
-    deadline.unref();
-    req.on("upgrade", (_res, socket) => {
-      fail("the deployment answered with a protocol upgrade");
-      socket.destroy();
-    });
-    req.on("close", () => {
-      fail("the connection closed before a response was read");
-      clearTimeout(deadline);
-    });
-    req.on("error", (err) => {
-      fail(err.message);
-    });
-    if (options.body !== void 0) req.write(options.body);
-    req.end();
-  });
-}
-
-// ../../packages/remote/src/client.ts
-var ROUTES = {
-  events: "/v1/events",
-  auditEvents: "/v1/audit-events",
-  auditEventsBatch: "/v1/audit-events/batch",
-  inventory: "/v1/inventory",
-  storePosture: "/v1/store-posture",
-  policyBundle: "/v1/policy-bundle",
-  whoami: "/v1/plugin/whoami",
-  shares: "/v1/shares"
-};
-function headerValue(response, name) {
-  const raw = response.headers[name];
-  if (raw === void 0) return void 0;
-  return Array.isArray(raw) ? raw[0] : raw;
-}
-function okBody(response) {
-  if (response.status < 200 || response.status >= 300) {
-    throw new RemoteRequestError(response.status);
-  }
-  return response.body;
-}
-function parsed(schema, body, route) {
-  let json2;
-  try {
-    json2 = JSON.parse(body);
-  } catch {
-    throw new RemoteResponseInvalid(route, "a body that is not JSON");
-  }
-  const result = schema.safeParse(json2);
-  if (!result.success) {
-    throw new RemoteResponseInvalid(route, "a body this client cannot read");
-  }
-  return result.data;
-}
-function withoutTrailingSlashes(endpoint) {
-  let end = endpoint.length;
-  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
-  return endpoint.slice(0, end);
-}
-var SLASH = "/".charCodeAt(0);
-function createRemoteClient(options) {
-  const base = withoutTrailingSlashes(options.endpoint);
-  const url2 = (route) => `${base}${route}`;
-  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
-  const sendOne = async (event) => {
-    const validated = RecordAuditEventRequest.safeParse(event);
-    if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
-    const response = await send({
-      ...common,
-      method: "POST",
-      url: url2(ROUTES.auditEvents),
-      body: JSON.stringify(validated.data)
-    });
-    okBody(response);
-  };
-  return {
-    async ingestEvents(batch) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.events),
-        body: JSON.stringify(batch)
-      });
-      return parsed(IngestAck, okBody(response), ROUTES.events);
-    },
-    async ingestInventory(context) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.inventory),
-        body: JSON.stringify(context)
-      });
-      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
-    },
-    async recordAuditEvent(event) {
-      await sendOne(event);
-    },
-    async recordAuditEvents(events) {
-      const validated = RecordAuditEventBatch.safeParse({ events });
-      if (!validated.success) {
-        throw new RemoteRequestInvalid(ROUTES.auditEventsBatch, validated.error);
-      }
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.auditEventsBatch),
-        body: JSON.stringify(validated.data)
-      });
-      if (response.status === 404) {
-        for (const event of validated.data.events) await sendOne(event);
-        return { accepted: validated.data.events.length };
-      }
-      return parsed(AuditEventBatchAck, okBody(response), ROUTES.auditEventsBatch);
-    },
-    async reportStorePosture(snapshot) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.storePosture),
-        body: JSON.stringify(snapshot)
-      });
-      okBody(response);
-    },
-    async getPolicyBundle(etag) {
-      const response = await send({
-        ...common,
-        method: "GET",
-        url: url2(ROUTES.policyBundle),
-        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
-      });
-      if (response.status === 304) {
-        return { changed: false, etag: headerValue(response, "etag") ?? etag };
-      }
-      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
-      return { changed: true, bundle, etag: headerValue(response, "etag") };
-    },
-    async whoami() {
-      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
-      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
-    },
-    async recordProjectEgress(request) {
-      const validated = EgressIngestRequest.safeParse(request);
-      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.shares, validated.error);
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.shares),
-        body: JSON.stringify(validated.data)
-      });
-      okBody(response);
-    }
-  };
-}
+// ../../packages/plugin-runtime/src/attached/capture-rebuild.ts
+var CORRELATION_ID = EventMetadata.shape.correlationId;
+var TRACE_ID = EventMetadata.shape.traceId;
+var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
 
 // ../../packages/plugin-runtime/src/attached/history-sync-trigger.ts
 import { spawn } from "child_process";
@@ -38879,7 +39835,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 var HISTORY_SYNC_THROTTLE_MS = 5 * 60 * 1e3;
 
 // ../../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 function createPluginBlock(build, policyStore) {
   return async () => {
     const cached2 = await policyStore.read();
@@ -38896,9 +39852,9 @@ function createPluginBlock(build, policyStore) {
 }
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -38922,7 +39878,7 @@ async function publishByRename(tmp, file2, move = rename2) {
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 function createPolicyStore(dir = dataDir()) {
-  const file2 = join24(dir, "policy-cache.json");
+  const file2 = join26(dir, "policy-cache.json");
   async function read() {
     try {
       const raw = await readFile2(file2, "utf8");
@@ -38931,22 +39887,32 @@ function createPolicyStore(dir = dataDir()) {
       const record2 = parsed2;
       const bundle = PolicyBundle.parse(record2.bundle);
       const fetchedAtMs = typeof record2.fetchedAtMs === "number" ? record2.fetchedAtMs : 0;
-      const etag = typeof record2.etag === "string" ? record2.etag : void 0;
+      const stored = typeof record2.etag === "string" ? record2.etag : void 0;
+      const replayable = record2.shapeId === POLICY_BUNDLE_SHAPE_ID || knowsMoreThanThisBuild(record2.shapeId);
+      const etag = replayable ? stored : void 0;
       return { bundle, fetchedAtMs, ...etag === void 0 ? {} : { etag } };
     } catch {
       return null;
     }
   }
-  async function write(bundle, etag) {
-    await ensureDataDir(dir);
-    const stored = {
-      bundle,
-      fetchedAtMs: Date.now(),
-      ...etag === void 0 ? {} : { etag }
-    };
-    const tmp = `${file2}.${randomUUID16()}.tmp`;
+  function knowsMoreThanThisBuild(shapeId) {
+    if (typeof shapeId !== "string" || shapeId === "") return false;
+    const theirs = new Set(shapeId.split(","));
+    const ours = new Set(POLICY_BUNDLE_SHAPE_ID.split(","));
+    return theirs.size > ours.size && [...ours].every((key) => theirs.has(key));
+  }
+  async function priorRecord() {
+    try {
+      const parsed2 = JSON.parse(await readFile2(file2, "utf8"));
+      return typeof parsed2 === "object" && parsed2 !== null ? parsed2 : null;
+    } catch {
+      return null;
+    }
+  }
+  async function publishRecord(record2) {
+    const tmp = `${file2}.${randomUUID17()}.tmp`;
     try {
-      await writeFile2(tmp, JSON.stringify(stored), {
+      await writeFile2(tmp, JSON.stringify(record2), {
         encoding: "utf8",
         mode: DATA_FILE_MODE,
         flag: "wx"
@@ -38957,6 +39923,27 @@ function createPolicyStore(dir = dataDir()) {
       throw err;
     }
   }
+  async function write(bundle, etag) {
+    await ensureDataDir(dir);
+    const prior = await priorRecord();
+    const priorVersion = prior?.bundle?.version;
+    if (prior !== null && knowsMoreThanThisBuild(prior.shapeId) && priorVersion === bundle.version) {
+      await publishRecord({
+        ...prior,
+        fetchedAtMs: Date.now()
+      });
+      return;
+    }
+    await publishRecord({
+      bundle,
+      fetchedAtMs: Date.now(),
+      // Stamped on EVERY write, the 304 arm's included: that arm hands back the
+      // bundle it already holds, and the point of the stamp is to describe the
+      // build that last narrowed those bytes, which is this one.
+      shapeId: POLICY_BUNDLE_SHAPE_ID,
+      ...etag === void 0 ? {} : { etag }
+    });
+  }
   return { read, write, file: file2 };
 }
 
@@ -39009,7 +39996,7 @@ function createPostureReporter(deps) {
 }
 
 // ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
-import { statSync as statSync9 } from "fs";
+import { statSync as statSync10 } from "fs";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // ../../packages/plugin-runtime/src/attached/action-counts.ts
@@ -39040,7 +40027,7 @@ function emptyReadout(readError = false) {
 }
 function readStorePosture(dbPath2) {
   try {
-    statSync9(dbPath2);
+    statSync10(dbPath2);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") return emptyReadout();
@@ -39120,16 +40107,16 @@ function readStorePosture(dbPath2) {
 }
 
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function createPostureStore(dir = settingsDir(), legacyDir) {
-  const file2 = join25(dir, "posture-state.json");
-  const legacyFile = legacyDir === void 0 ? null : join25(legacyDir, "posture-state.json");
+  const file2 = join27(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join27(legacyDir, "posture-state.json");
   async function persist(state) {
     await ensureDataDir(dir);
-    const tmp = `${file2}.${randomUUID17()}.tmp`;
+    const tmp = `${file2}.${randomUUID18()}.tmp`;
     try {
       await writeFile3(tmp, JSON.stringify(state), { encoding: "utf8", mode: DATA_FILE_MODE });
       await publishByRename(tmp, file2);
@@ -39171,7 +40158,7 @@ function createPostureStore(dir = settingsDir(), legacyDir) {
       }
       return legacy;
     }
-    const fresh = { deviceId: randomUUID17(), lastAttemptedAtMs: 0 };
+    const fresh = { deviceId: randomUUID18(), lastAttemptedAtMs: 0 };
     try {
       await ensureDataDir(dir);
       if (createOwnerOnlyFileSync(file2, JSON.stringify(fresh))) return fresh;
@@ -39194,8 +40181,8 @@ function createPostureStore(dir = settingsDir(), legacyDir) {
 }
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { join as join28 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {
@@ -39220,7 +40207,7 @@ var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
 import { hostname as hostname6 } from "os";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 
 // ../../packages/plugin-runtime/src/recorder.ts
 var PLUGIN_RECORDER_BINARY = "plugin";
@@ -39428,7 +40415,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID18(),
+      id: randomUUID19(),
       scope: "global",
       target: { ruleId },
       action,
@@ -39513,9 +40500,21 @@ var StandaloneDataGateway = class {
   // for the whole of it, so a member that threw would make that answer a lie
   // the moment a composite delegated to it. A store-level no-op is the honest
   // shape — a standalone machine has nothing delivered to record.
+  markCaptureOwed(event) {
+    this.db.markCaptureOwed(event);
+  }
   markCaptureDelivered(event, atMs) {
     this.db.markCaptureDelivered(event, atMs);
   }
+  // Implemented, not stubbed, for the same reason its sibling above is: the
+  // attached gateway is a DECORATOR over an instance of this class
+  // (`attached/factory.ts` builds one and passes it as `deps.local`), so every
+  // stamp the live forward makes lands here with a non-empty array. This is the
+  // production write path for that feature, not a shape-satisfying no-op — a
+  // machine that is merely standalone simply never calls it.
+  markAuditEventsDelivered(events, atMs) {
+    this.db.markAuditEventsDelivered(events, atMs);
+  }
   staleBinaryNotice(currentVersion) {
     try {
       const newest = this.db.installedPacks.newestRecordedBinary();
@@ -39650,7 +40649,7 @@ function resolveDataGateway(config2, meta4, gatewayFactory = defaultGatewayFacto
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/hooks/store-health.ts
@@ -39674,12 +40673,12 @@ function claimStoreUnavailableWarning(dataDir2, sessionId) {
   return true;
 }
 function markerDirs(dataDir2) {
-  return [dataDir2, dirname5(dataDir2)];
+  return [dataDir2, dirname7(dataDir2)];
 }
 function alreadyClaimed(dirs, marker, sessionId) {
   return dirs.some((dir) => {
     try {
-      return readFileSync18(join27(dir, marker), "utf8") === sessionId;
+      return readFileSync20(join29(dir, marker), "utf8") === sessionId;
     } catch {
       return false;
     }
@@ -39689,7 +40688,7 @@ function recordClaim(dirs, marker, sessionId) {
   for (const dir of dirs) {
     try {
       mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
-      writeFileSync9(join27(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      writeFileSync9(join29(dir, marker), sessionId, { mode: DATA_FILE_MODE });
       return;
     } catch {
     }
@@ -39714,7 +40713,7 @@ function formatMode(mode) {
 }
 function warnIfStoreRedirected(config2, sessionId, write = (message) => void process.stderr.write(message)) {
   try {
-    const paths = symlinkedStorePaths(dirname5(config2.dataDir));
+    const paths = symlinkedStorePaths(dirname7(config2.dataDir));
     if (paths.length === 0) return;
     if (!sessionId) {
       write(storeRedirectedMessage(paths));
@@ -39736,10 +40735,22 @@ async function main() {
   const rawToolInput = input2.tool_input;
   if (typeof rawToolInput !== "object" || rawToolInput === null) return;
   const toolInput = rawToolInput;
+  const sessionId = getString(input2, "session_id");
+  let configMemo;
+  const loadConfigOnce = () => configMemo ??= loadConfig();
+  if (await handleSubagentSpawn(
+    () => openGatewayOrNull(loadConfigOnce()),
+    toolName,
+    toolInput,
+    sessionId,
+    getString(input2, "cwd"),
+    emit
+  )) {
+    return;
+  }
   const fields = scannableInputFields(toolName, toolInput);
   if (fields.length === 0) return;
-  const config2 = loadConfig();
-  const sessionId = getString(input2, "session_id");
+  const config2 = loadConfigOnce();
   warnIfStoreRedirected(config2, sessionId);
   const consented = isVaultConsentValid(config2.settings.vaultConsent);
   const vaultGlue = consented ? createVaultGlue() : null;