@byok-sdk/cloud-dataplane 0.4.1 → 0.5.0

package/dist/index.js

@@ -1,12 +1,12 @@
 import pg from 'pg';
+import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, validateActivityAppend, projectTimelineEvents, ByokCloudError, validateApprovalTimelineAppend, ApprovalObservationSchema, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH, parseTimelineEvents, activityCursor, parseApprovalObservations, approvalTimelineCursor } from '@byok-sdk/cloud';
+import { ByokCoreError, assertCanonicalTimestamp, contentHash, isContentHash, tenantObjectKey, objectKeyPrefix, CoreConflictError, isLegalBoardTransition, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, tenantId, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
+import { AwsClient } from 'aws4fetch';
+import { XMLParser } from 'fast-xml-parser';
 import { createHash } from 'crypto';
 import { readdir, readFile } from 'fs/promises';
 import { join } from 'path';
 import { fileURLToPath } from 'url';
-import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH } from '@byok-sdk/cloud';
-import { ByokCoreError, assertCanonicalTimestamp, contentHash, isContentHash, tenantObjectKey, objectKeyPrefix, DEFAULT_ACTIVITY_CAPACITY, CoreConflictError, isLegalBoardTransition, tenantId, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
-import { AwsClient } from 'aws4fetch';
-import { XMLParser } from 'fast-xml-parser';
 import { decodeEnvelope, isServerToDaemonType, EnvelopeSchema, encodeEnvelope } from '@byok-sdk/protocol';
 
 // src/pool.ts
@@ -29,123 +29,6 @@ function createByokPool(options) {
   });
   return pool;
 }
-var MIGRATION_ADVISORY_LOCK_KEY = "4021960801";
-var MIGRATION_FILENAME_PATTERN = /^(\d{4})[_-].+\.sql$/;
-var LEDGER_DDL = `
-CREATE TABLE IF NOT EXISTS byok_schema_migration (
-  version     text        PRIMARY KEY,
-  checksum    text        NOT NULL,
-  applied_at  timestamptz NOT NULL
-)`;
-var MigrationChecksumMismatchError = class extends Error {
-  version;
-  expectedChecksum;
-  actualChecksum;
-  constructor(version, expectedChecksum, actualChecksum) {
-    super(
-      `Migration ${version} was already applied with checksum ${expectedChecksum}, but the file on disk hashes to ${actualChecksum}. Published migrations are immutable: add a new file instead of editing this one.`
-    );
-    this.name = "MigrationChecksumMismatchError";
-    this.version = version;
-    this.expectedChecksum = expectedChecksum;
-    this.actualChecksum = actualChecksum;
-  }
-};
-var MigrationFilenameError = class extends Error {
-  filename;
-  constructor(filename, reason) {
-    super(`Migration file ${filename} is not usable: ${reason}`);
-    this.name = "MigrationFilenameError";
-    this.filename = filename;
-  }
-};
-function sha256(text) {
-  return createHash("sha256").update(text, "utf8").digest("hex");
-}
-async function readMigrationFiles(directory) {
-  const entries = await readdir(directory, { withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".sql")) continue;
-    const match = MIGRATION_FILENAME_PATTERN.exec(entry.name);
-    if (match === null) {
-      throw new MigrationFilenameError(
-        entry.name,
-        "expected a four-digit prefix, e.g. 0001_cloud_local.sql"
-      );
-    }
-    const sql = await readFile(join(directory, entry.name), "utf8");
-    files.push({
-      version: entry.name,
-      ordinal: Number.parseInt(match[1], 10),
-      checksum: sha256(sql),
-      sql
-    });
-  }
-  files.sort((left, right) => left.ordinal - right.ordinal);
-  for (let index = 1; index < files.length; index += 1) {
-    const previous = files[index - 1];
-    const current = files[index];
-    if (previous.ordinal === current.ordinal) {
-      throw new MigrationFilenameError(
-        current.version,
-        `duplicate prefix ${String(current.ordinal).padStart(4, "0")}, already used by ${previous.version}`
-      );
-    }
-  }
-  return files;
-}
-async function readLedger(client) {
-  const result = await client.query(
-    "SELECT version, checksum FROM byok_schema_migration"
-  );
-  return new Map(result.rows.map((row) => [row.version, row.checksum]));
-}
-async function migrate(pool, directory) {
-  const files = await readMigrationFiles(directory);
-  const client = await pool.connect();
-  try {
-    await client.query("SELECT pg_advisory_lock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
-    try {
-      await client.query(LEDGER_DDL);
-      const ledger = await readLedger(client);
-      const applied = [];
-      const alreadyApplied = [];
-      for (const file of files) {
-        const recordedChecksum = ledger.get(file.version);
-        if (recordedChecksum !== void 0) {
-          if (recordedChecksum !== file.checksum) {
-            throw new MigrationChecksumMismatchError(file.version, recordedChecksum, file.checksum);
-          }
-          alreadyApplied.push(file.version);
-          continue;
-        }
-        await client.query("BEGIN");
-        try {
-          await client.query(file.sql);
-          await client.query(
-            "INSERT INTO byok_schema_migration (version, checksum, applied_at) VALUES ($1, $2, now())",
-            [file.version, file.checksum]
-          );
-          await client.query("COMMIT");
-        } catch (error) {
-          await client.query("ROLLBACK").catch(() => {
-          });
-          throw error;
-        }
-        applied.push(file.version);
-      }
-      return { applied, alreadyApplied };
-    } finally {
-      await client.query("SELECT pg_advisory_unlock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
-    }
-  } finally {
-    client.release();
-  }
-}
-function migrationsDir() {
-  return fileURLToPath(new URL("./sql", import.meta.url));
-}
 var DEFAULT_LIST_LIMIT = 100;
 var MANIFEST_COLUMNS = "tenant_id, hash, byte_size, content_type, state, ref_count, created_at, updated_at, delete_pending_at";
 function toEntry(row) {
@@ -1270,11 +1153,295 @@ var PostgresTaskAttemptStore = class {
     return this.#clock.now().toISOString();
   }
 };
+function toTail(row) {
+  const entries = parseTimelineEvents(row.entries);
+  const cursor = activityCursor(entries);
+  return {
+    tenantId: row.tenant_id,
+    taskId: row.task_id,
+    entries,
+    ...cursor === void 0 ? {} : { cursor },
+    dropped: row.dropped,
+    capacity: row.capacity,
+    expiresAt: row.expires_at
+  };
+}
+var PostgresActivityStore = class {
+  constructor(pool, clock) {
+    this.pool = pool;
+    this.clock = clock;
+  }
+  pool;
+  clock;
+  async append(tenant, input) {
+    const capacity = validateActivityAppend(input);
+    const now = this.clock.now();
+    const receivedAt = now.toISOString();
+    const incoming = projectTimelineEvents(input, receivedAt);
+    const expiresAt = new Date(now.getTime() + input.ttlMs).toISOString();
+    const result = await this.pool.query(
+      `WITH incoming AS (
+         SELECT entry
+           FROM jsonb_array_elements($4::jsonb) AS element(entry)
+       ), trimmed AS (
+         SELECT COALESCE(jsonb_agg(entry ORDER BY
+                    (entry->>'batchSeq')::bigint,
+                    (entry->>'eventIndex')::bigint), '[]'::jsonb) AS entries,
+                $5::integer + GREATEST(jsonb_array_length($4::jsonb) - $6, 0) AS dropped
+           FROM (
+             SELECT entry
+               FROM incoming
+              ORDER BY (entry->>'batchSeq')::bigint DESC,
+                       (entry->>'eventIndex')::bigint DESC
+              LIMIT $6
+           ) retained
+       )
+       INSERT INTO activity_tail (tenant_id, task_id, entries, dropped, capacity, expires_at)
+       SELECT $1, $2, trimmed.entries, trimmed.dropped, $6, $7 FROM trimmed
+       ON CONFLICT (tenant_id, task_id) DO UPDATE
+          SET entries = (
+                SELECT COALESCE(jsonb_agg(entry ORDER BY
+                         (entry->>'batchSeq')::bigint,
+                         (entry->>'eventIndex')::bigint), '[]'::jsonb)
+                  FROM (
+                    SELECT entry
+                      FROM jsonb_array_elements(
+                        (CASE WHEN activity_tail.expires_at > $3
+                              THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
+                      ) AS element(entry)
+                     ORDER BY (entry->>'batchSeq')::bigint DESC,
+                              (entry->>'eventIndex')::bigint DESC
+                     LIMIT $6
+                  ) retained
+              ),
+              dropped = (CASE WHEN activity_tail.expires_at > $3
+                              THEN activity_tail.dropped ELSE 0 END)
+                        + $5::integer
+                        + GREATEST(
+                            jsonb_array_length(
+                              (CASE WHEN activity_tail.expires_at > $3
+                                    THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
+                            ) - $6,
+                            0
+                          ),
+              capacity = EXCLUDED.capacity,
+              expires_at = EXCLUDED.expires_at
+        WHERE activity_tail.expires_at <= $3
+           OR (
+              NOT EXISTS (
+                SELECT 1
+                  FROM jsonb_array_elements(activity_tail.entries) AS stored(entry)
+                 WHERE jsonb_typeof(entry) <> 'object'
+                    OR NOT (entry ?& ARRAY[
+                         'taskId', 'sourceEnvelopeId', 'batchSeq',
+                         'eventIndex', 'receivedAt', 'event'
+                       ])
+              )
+              AND NOT EXISTS (
+                SELECT 1
+                  FROM jsonb_array_elements(activity_tail.entries) AS old_element(entry)
+                  CROSS JOIN jsonb_array_elements($4::jsonb) AS new_element(candidate)
+                 WHERE (entry->>'batchSeq')::bigint = (candidate->>'batchSeq')::bigint
+                   AND (entry->>'eventIndex')::bigint = (candidate->>'eventIndex')::bigint
+                   AND entry->>'sourceEnvelopeId' <> candidate->>'sourceEnvelopeId'
+              )
+           )
+       RETURNING tenant_id, task_id, entries, dropped, capacity, expires_at`,
+      [tenant, input.taskId, receivedAt, JSON.stringify(incoming), input.dropped, capacity, expiresAt]
+    );
+    const row = result.rows[0];
+    if (row === void 0) {
+      throw new ByokCloudError(
+        "coordination_input_invalid",
+        `Activity batch ${input.batchSeq} conflicts with the existing typed tail authority.`
+      );
+    }
+    return toTail(row);
+  }
+  async read(tenant, taskId) {
+    const result = await this.pool.query(
+      `SELECT tenant_id, task_id, entries, dropped, capacity, expires_at
+         FROM activity_tail
+        WHERE tenant_id = $1 AND task_id = $2 AND expires_at > $3`,
+      [tenant, taskId, this.clock.now().toISOString()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toTail(row);
+  }
+};
+function toTail2(row) {
+  const entries = parseApprovalObservations(row.entries);
+  const cursor = approvalTimelineCursor(entries);
+  return {
+    tenantId: row.tenant_id,
+    taskId: row.task_id,
+    entries,
+    ...cursor === void 0 ? {} : { cursor },
+    dropped: row.dropped,
+    capacity: row.capacity,
+    expiresAt: row.expires_at
+  };
+}
+async function readLocked(client, tenant, taskId) {
+  const result = await client.query(
+    `SELECT tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at
+       FROM approval_timeline_tail
+      WHERE tenant_id = $1 AND task_id = $2
+      FOR UPDATE`,
+    [tenant, taskId]
+  );
+  return result.rows[0];
+}
+var PostgresApprovalTimelineStore = class {
+  constructor(pool, clock) {
+    this.pool = pool;
+    this.clock = clock;
+  }
+  pool;
+  clock;
+  async append(tenant, input) {
+    const { capacity, ttlMs, event } = validateApprovalTimelineAppend(input);
+    const now = this.clock.now();
+    const receivedAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        `SELECT pg_advisory_xact_lock(hashtextextended($1 || E'\\x1f' || $2, 0))`,
+        [tenant, input.taskId]
+      );
+      const stored = await readLocked(client, tenant, input.taskId);
+      const live = stored !== void 0 && receivedAt < stored.expires_at ? toTail2(stored) : void 0;
+      const duplicate = live?.entries.find(
+        (entry) => entry.sourceEnvelopeId === input.sourceEnvelopeId
+      );
+      if (duplicate !== void 0) {
+        if (JSON.stringify(duplicate.event) !== JSON.stringify(event)) {
+          throw new ByokCloudError(
+            "coordination_input_invalid",
+            "Approval source envelope identity already belongs to another lifecycle event."
+          );
+        }
+        await client.query("COMMIT");
+        return live;
+      }
+      const revision = live === void 0 ? 1 : Number(stored.next_revision);
+      const expectedRevision = (live?.cursor ?? 0) + 1;
+      if (!Number.isSafeInteger(revision) || revision <= 0 || revision !== expectedRevision) {
+        throw new ByokCloudError(
+          "coordination_input_invalid",
+          "Approval timeline revision authority is malformed."
+        );
+      }
+      const observation = ApprovalObservationSchema.parse({
+        taskId: input.taskId,
+        sourceEnvelopeId: input.sourceEnvelopeId,
+        revision,
+        receivedAt,
+        event
+      });
+      const allEntries = [...live?.entries ?? [], observation];
+      const evicted = Math.max(allEntries.length - capacity, 0);
+      const entries = allEntries.slice(evicted);
+      const dropped = (live?.dropped ?? 0) + evicted;
+      const result = await client.query(
+        `INSERT INTO approval_timeline_tail
+           (tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at)
+         VALUES ($1, $2, $3::jsonb, $4, $5, $6, $7)
+         ON CONFLICT (tenant_id, task_id) DO UPDATE
+           SET entries = EXCLUDED.entries,
+               next_revision = EXCLUDED.next_revision,
+               dropped = EXCLUDED.dropped,
+               capacity = EXCLUDED.capacity,
+               expires_at = EXCLUDED.expires_at
+         RETURNING tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at`,
+        [
+          tenant,
+          input.taskId,
+          JSON.stringify(entries),
+          revision + 1,
+          dropped,
+          capacity,
+          expiresAt
+        ]
+      );
+      await client.query("COMMIT");
+      return toTail2(result.rows[0]);
+    } catch (caught) {
+      await client.query("ROLLBACK");
+      throw caught;
+    } finally {
+      client.release();
+    }
+  }
+  async read(tenant, taskId) {
+    const result = await this.pool.query(
+      `SELECT tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at
+         FROM approval_timeline_tail
+        WHERE tenant_id = $1 AND task_id = $2 AND expires_at > $3`,
+      [tenant, taskId, this.clock.now().toISOString()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toTail2(row);
+  }
+};
+
+// src/stores/device-assertion-replay.ts
+var PostgresDeviceAssertionReplayAuthority = class {
+  #pool;
+  constructor(pool) {
+    this.#pool = pool;
+  }
+  async consume(input) {
+    if (!Number.isFinite(Date.parse(input.expiresAt))) {
+      throw new Error("device assertion replay expiry is invalid");
+    }
+    const result = await this.#pool.query(
+      `INSERT INTO device_assertion_replay (
+         tenant_id, issuer, product_id, device_id, audience, jti, expires_at
+       )
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (tenant_id, issuer, product_id, device_id, audience, jti) DO NOTHING
+       RETURNING jti`,
+      [
+        input.tenantId,
+        input.issuer,
+        input.productId,
+        input.deviceId,
+        input.audience,
+        input.jti,
+        input.expiresAt
+      ]
+    );
+    return result.rowCount === 1;
+  }
+  /** Bounded retention cleanup; callers choose cadence and batch size. */
+  async deleteExpired(before, limit) {
+    if (!Number.isFinite(before.getTime()) || !Number.isSafeInteger(limit) || limit <= 0) {
+      throw new Error("device assertion replay cleanup bounds are invalid");
+    }
+    const result = await this.#pool.query(
+      `DELETE FROM device_assertion_replay
+       WHERE ctid IN (
+         SELECT ctid
+         FROM device_assertion_replay
+         WHERE expires_at <= $1
+         ORDER BY expires_at
+         LIMIT $2
+       )`,
+      [before.toISOString(), limit]
+    );
+    return result.rowCount ?? 0;
+  }
+};
 
 // src/stores/index.ts
 function createPostgresCloudStores(options) {
   const { pool, clock, crypto } = options;
   return {
+    activity: new PostgresActivityStore(pool, clock),
+    approvals: new PostgresApprovalTimelineStore(pool, clock),
     devices: new PostgresDeviceDirectory(pool),
     pairingCodes: new PostgresPairingCodeStore(pool, clock),
     nonces: new PostgresNonceStore(pool, clock, crypto),
@@ -1305,16 +1472,6 @@ function toHint(row) {
     expiresAt: row.expires_at
   };
 }
-function toTail(row) {
-  return {
-    tenantId: row.tenant_id,
-    taskId: row.task_id,
-    entries: row.entries,
-    dropped: row.dropped,
-    capacity: row.capacity,
-    expiresAt: row.expires_at
-  };
-}
 function assertTtl(ttlMs) {
   if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
     throw new ByokCoreError(
@@ -1401,118 +1558,25 @@ var PostgresPresenceStore = class {
     return this.#clock.now().toISOString();
   }
 };
-var PostgresActivityStore = class {
-  #pool;
-  #clock;
-  constructor(pool, clock) {
-    this.#pool = pool;
-    this.#clock = clock;
-  }
-  async append(tenant, input) {
-    assertTtl(input.ttlMs);
-    const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;
-    if (!Number.isSafeInteger(capacity) || capacity <= 0) {
-      throw new ByokCoreError(
-        "activity_capacity_invalid",
-        `Activity capacity must be a positive integer, received ${String(capacity)}.`
-      );
-    }
-    if (input.details.length === 0 || !Number.isSafeInteger(input.dropped) || input.dropped < 0) {
-      throw new ByokCoreError(
-        "activity_batch_invalid",
-        "Activity batches require at least one detail and a non-negative integer dropped count."
-      );
-    }
-    const now = this.#now();
-    const incoming = input.details.map((detail) => ({ at: now, detail }));
-    const result = await this.#pool.query(
-      `WITH trimmed AS (
-         SELECT COALESCE(
-                  (SELECT jsonb_agg(entry ORDER BY ordinality)
-                     FROM jsonb_array_elements($4::jsonb)
-                          WITH ORDINALITY AS element(entry, ordinality)
-                    WHERE ordinality > GREATEST(jsonb_array_length($4::jsonb) - $6, 0)),
-                  '[]'::jsonb) AS entries,
-                $5::integer + GREATEST(jsonb_array_length($4::jsonb) - $6, 0) AS dropped
-       )
-       INSERT INTO activity_tail (tenant_id, task_id, entries, dropped, capacity, expires_at)
-       SELECT $1, $2, trimmed.entries, trimmed.dropped, $6, $7 FROM trimmed
-       ON CONFLICT (tenant_id, task_id) DO UPDATE
-          SET entries    = (
-                SELECT COALESCE(jsonb_agg(entry ORDER BY ordinality), '[]'::jsonb)
-                  FROM jsonb_array_elements(
-                         (CASE WHEN activity_tail.expires_at > $3
-                               THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
-                       ) WITH ORDINALITY AS element(entry, ordinality)
-                 WHERE ordinality > GREATEST(
-                   jsonb_array_length(
-                     (CASE WHEN activity_tail.expires_at > $3
-                           THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
-                   ) - $6,
-                   0
-                 )
-              ),
-              dropped    = (CASE WHEN activity_tail.expires_at > $3
-                                 THEN activity_tail.dropped ELSE 0 END)
-                           + $5::integer
-                           + GREATEST(
-                               jsonb_array_length(
-                                 (CASE WHEN activity_tail.expires_at > $3
-                                       THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
-                               ) - $6,
-                               0
-                             ),
-              capacity   = EXCLUDED.capacity,
-              expires_at = EXCLUDED.expires_at
-       RETURNING tenant_id, task_id, entries, dropped, capacity, expires_at`,
-      [
-        tenant,
-        input.taskId,
-        now,
-        JSON.stringify(incoming),
-        input.dropped,
-        capacity,
-        this.#expiry(input.ttlMs)
-      ]
-    );
-    return toTail(result.rows[0]);
-  }
-  async read(tenant, taskId) {
-    const result = await this.#pool.query(
-      `SELECT tenant_id, task_id, entries, dropped, capacity, expires_at
-         FROM activity_tail
-        WHERE tenant_id = $1 AND task_id = $2 AND expires_at > $3`,
-      [tenant, taskId, this.#now()]
-    );
-    const row = result.rows[0];
-    return row === void 0 ? void 0 : toTail(row);
-  }
-  #expiry(ttlMs) {
-    return new Date(this.#clock.now().getTime() + ttlMs).toISOString();
-  }
-  #now() {
-    return this.#clock.now().toISOString();
-  }
-};
-var DEFAULT_LIST_LIMIT2 = 50;
-var BOARD_COLUMNS = "tenant_id, item_id, channel, title, status, holder_id, held_since, board_seq, created_at, updated_at";
-function toItem(row) {
-  return {
-    tenantId: row.tenant_id,
-    itemId: row.item_id,
-    channel: row.channel,
-    title: row.title,
-    status: row.status,
-    // An unheld item has NO assignee rather than an assignee with an empty
-    // holder, which is what lets `expect(item.assignee).toBeUndefined()` mean
-    // "nobody holds this" in both compositions.
-    ...row.holder_id === null || row.held_since === null ? {} : { assignee: { holderId: row.holder_id, heldSince: row.held_since } },
-    boardSeq: Number(row.board_seq),
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
-var PostgresBoardStore = class {
+var DEFAULT_LIST_LIMIT2 = 50;
+var BOARD_COLUMNS = "tenant_id, item_id, channel, title, status, holder_id, held_since, board_seq, created_at, updated_at";
+function toItem(row) {
+  return {
+    tenantId: row.tenant_id,
+    itemId: row.item_id,
+    channel: row.channel,
+    title: row.title,
+    status: row.status,
+    // An unheld item has NO assignee rather than an assignee with an empty
+    // holder, which is what lets `expect(item.assignee).toBeUndefined()` mean
+    // "nobody holds this" in both compositions.
+    ...row.holder_id === null || row.held_since === null ? {} : { assignee: { holderId: row.holder_id, heldSince: row.held_since } },
+    boardSeq: Number(row.board_seq),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var PostgresBoardStore = class {
   #pool;
   #clock;
   constructor(pool, clock) {
@@ -2834,7 +2898,6 @@ function createPostgresCoreStores(options) {
     board: new PostgresBoardStore(pool, clock),
     truth: new PostgresTruthStore(pool, clock),
     presence: new PostgresPresenceStore(pool, clock),
-    activity: new PostgresActivityStore(pool, clock),
     objects: new PostgresObjectStore(pool, clock),
     quota: new PostgresQuotaStore(pool, clock),
     // No clock: a skill-pack manifest carries no timestamp, so this store reads
@@ -2842,1443 +2905,1565 @@ function createPostgresCoreStores(options) {
     skillPacks: new PostgresSkillPackStore(pool)
   };
 }
-var DEFAULT_BATCH_SIZE = 100;
-var MAX_BATCH_SIZE = 1e3;
-var ADVISORY_LOCK_NAMESPACE = 1106736963;
-var OUTBOX_COLUMNS2 = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at, replay_source_seq";
-var CLOUD_CLEANUP_ERROR_CODES = {
-  cleanup_invalid_input: "cleanup_invalid_input",
-  cleanup_policy_missing: "cleanup_policy_missing",
-  cleanup_job_running: "cleanup_job_running",
-  cleanup_dead_letter_not_found: "cleanup_dead_letter_not_found",
-  cleanup_accounting_drift: "cleanup_accounting_drift"
-};
-var CloudCleanupError = class extends Error {
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.name = "CloudCleanupError";
-    this.code = code;
-  }
-};
-var PostgresCloudCleanup = class {
+var RECORD_COLUMNS2 = "tenant_id, kind, subject_id, rev, content_hash, byte_size, body_kind, body_inline, body_object_hash, label, request_id, written_at";
+var RECEIPT_COLUMNS = "tenant_id, device_id, request_id, operation, resource, body_sha256, body_size, response_status, response_body, recorded_at";
+function toBody2(row) {
+  return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
+}
+function toRecord3(tenant, row) {
+  return {
+    tenantId: tenant,
+    kind: row.kind,
+    recordKey: row.subject_id,
+    rev: row.rev,
+    contentHash: row.content_hash,
+    byteSize: row.byte_size,
+    body: toBody2(row),
+    ...row.label === null ? {} : { label: row.label },
+    ...row.request_id === null ? {} : { requestId: row.request_id },
+    writtenAt: row.written_at
+  };
+}
+function toReceipt3(tenant, row) {
+  return {
+    tenantId: tenant,
+    deviceId: row.device_id,
+    requestId: row.request_id,
+    operation: row.operation,
+    resource: row.resource,
+    bodySha256: row.body_sha256,
+    bodySize: row.body_size,
+    responseStatus: row.response_status,
+    responseBody: row.response_body,
+    recordedAt: row.recorded_at.toISOString()
+  };
+}
+function sameBinding(receipt, input) {
+  return receipt.operation === input.operation && receipt.resource === input.resource && receipt.bodySha256 === input.proofBodySha256 && receipt.bodySize === input.proofBodySize;
+}
+function bodyColumns2(body) {
+  return body.kind === "inline" ? ["inline", body.body, null] : ["object", null, body.hash];
+}
+function writeKey(write) {
+  return `${write.kind}\0${write.recordKey}`;
+}
+function referenceId(write) {
+  return `${write.kind}:${write.recordKey}`;
+}
+var PostgresTruthCommitter = class {
   #pool;
   #clock;
-  #objectStorage;
-  #batchSize;
+  #crypto;
+  #truth;
   constructor(options) {
     this.#pool = options.pool;
     this.#clock = options.clock;
-    this.#objectStorage = options.objectStorage;
-    this.#batchSize = assertBatchSize(options.batchSize ?? DEFAULT_BATCH_SIZE);
+    this.#crypto = options.crypto;
+    this.#truth = new PostgresTruthStore(options.pool, options.clock);
   }
-  async writeRetentionPolicy(tenant, input) {
-    assertPolicy(input);
-    const written = await this.#pool.query(
-      `INSERT INTO tenant_retention_policy (
-         tenant_id, policy_id, mailbox_acked_retention_ms,
-         mailbox_unacked_retention_ms, request_receipt_retention_ms,
-         object_orphan_grace_ms, updated_at
-       ) VALUES ($1, $2, $3, $4, $5, $6, $7)
-       ON CONFLICT (tenant_id, policy_id) DO UPDATE
-          SET mailbox_acked_retention_ms = EXCLUDED.mailbox_acked_retention_ms,
-              mailbox_unacked_retention_ms = EXCLUDED.mailbox_unacked_retention_ms,
-              request_receipt_retention_ms = EXCLUDED.request_receipt_retention_ms,
-              object_orphan_grace_ms = EXCLUDED.object_orphan_grace_ms,
-              updated_at = EXCLUDED.updated_at
-       RETURNING tenant_id, policy_id, mailbox_acked_retention_ms,
-                 mailbox_unacked_retention_ms, request_receipt_retention_ms,
-                 object_orphan_grace_ms, updated_at`,
-      [
-        tenant,
-        input.policyId,
-        input.mailboxAckedRetentionMs,
-        input.mailboxUnackedRetentionMs,
-        input.requestReceiptRetentionMs,
-        input.objectOrphanGraceMs,
-        this.#now()
-      ]
-    );
-    return toPolicy(written.rows[0]);
+  getRecord(tenant, selector) {
+    return this.#truth.getRecord(tenant, selector);
   }
-  async readRetentionPolicy(tenant) {
-    return this.#readRetentionPolicy(this.#pool, tenant);
+  listManifest(tenant, query) {
+    return this.#truth.listManifest(tenant, query);
   }
-  /** Run one bounded tenant maintenance cycle. Completed job ids are replay-safe. */
-  async runTenant(tenant, jobId) {
-    assertIdentifier(jobId, "jobId");
+  async commit(tenant, input) {
+    await this.#validateInput(input);
     const client = await this.#pool.connect();
-    let jobStarted = false;
     try {
-      const lock = await client.query(
-        "SELECT pg_try_advisory_lock(hashtextextended($1, $2)) AS locked",
-        [tenant, ADVISORY_LOCK_NAMESPACE]
-      );
-      if (lock.rows[0]?.locked !== true) {
-        throw new CloudCleanupError(
-          "cleanup_job_running",
-          `A cleanup job is already running for tenant ${tenant}.`
-        );
-      }
-      const replay = await this.#startJob(client, tenant, jobId);
-      if (replay !== void 0) return replay;
-      jobStarted = true;
-      const policy = await this.#readRetentionPolicy(client, tenant);
-      const counts = emptyCounts();
-      const retention = await this.#runRetention(client, tenant, policy);
-      counts.mailboxDeletedCount = retention.mailbox_deleted_count;
-      counts.mailboxExpiredCount = retention.mailbox_expired_count;
-      counts.mailboxReleasedBytes = retention.mailbox_released_bytes;
-      counts.reservationsExpired = retention.reservations_expired;
-      counts.ttlRowsDeleted = retention.ttl_rows_deleted;
-      const orphanCutoff = cutoff(this.#clock.now(), policy.objectOrphanGraceMs);
-      counts.objectsTombstoned = await this.#markTombstones(client, tenant, orphanCutoff);
-      const deleteCursor = await this.#readCursor(client, tenant, "delete");
-      const pending = await client.query(
-        `SELECT hash, byte_size, content_type, state,
-                gc_accounted_bytes, gc_accounted_object
-           FROM object_manifest
-          WHERE tenant_id = $1
-            AND state = 'delete_pending'
-            AND gc_accounted_bytes IS NOT NULL
-            AND gc_accounted_object IS NOT NULL
-            AND hash > $2
-          ORDER BY hash
-          LIMIT $3`,
-        [tenant, deleteCursor ?? "", this.#batchSize]
-      );
-      for (const manifest of pending.rows) {
-        try {
-          await this.#objectStorage.deleteObject(tenant, manifest.hash);
-          const released = await this.#settleDeleted(client, tenant, manifest.hash);
-          if (released !== void 0) {
-            counts.objectsDeleted += 1n;
-            counts.objectReleasedBytes += released;
-          }
-        } catch {
-          counts.operationErrors += 1n;
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+        JSON.stringify(["truth-receipt", tenant, input.deviceId, input.requestId])
+      ]);
+      const replay = await this.#readReceipt(client, tenant, input.deviceId, input.requestId);
+      if (replay !== void 0) {
+        if (!sameBinding(replay, input)) {
+          throw new TruthCommitError(
+            "proof_request_conflict",
+            `Request ${input.requestId} was already used with a different binding.`
+          );
         }
+        const response2 = TruthCommitResponseSchema.parse(JSON.parse(replay.responseBody));
+        await client.query("COMMIT");
+        return { response: response2, replayed: true };
       }
-      await this.#advanceLexicalCursor(
-        client,
-        tenant,
-        "delete",
-        pending.rows.at(-1)?.hash,
-        pending.rows.length
-      );
-      await this.#reconcileManifests(client, tenant, counts);
-      await this.#reconcileR2(client, tenant, counts);
-      const state = counts.operationErrors === 0n ? "completed" : "completed_with_errors";
-      return this.#finishJob(client, tenant, jobId, state, counts);
-    } catch (cause) {
-      if (jobStarted) {
-        await this.#failJob(client, tenant, jobId, cause).catch(() => {
-        });
-      }
-      throw cause;
-    } finally {
-      await client.query("SELECT pg_advisory_unlock(hashtextextended($1, $2))", [
-        tenant,
-        ADVISORY_LOCK_NAMESPACE
-      ]).catch(() => {
+      const before = await this.#lockCurrentRecords(client, tenant, input.writes);
+      this.#assertWritePreconditions(input.writes, before);
+      await this.#lockAndVerifyObjects(client, tenant, input.writes, before);
+      const inlineAffected = input.writes.some((write) => {
+        const current = before.get(writeKey(write));
+        if (write.kind === "task.terminal" && current !== void 0) return false;
+        return current?.body.kind === "inline" || write.body.kind === "inline";
       });
+      const inlineDelta = inlineAffected ? await this.#prepareInlineAccounting(client, tenant, input.writes, before) : 0n;
+      const applied = await this.#applyWrites(client, tenant, input, before);
+      await this.#replaceObjectReferences(client, tenant, applied);
+      await this.#settleInlineAccounting(client, tenant, inlineDelta);
+      const response = {
+        primary: truthRecordMetadata(applied[0].record),
+        snapshots: applied.slice(1).map((entry) => truthRecordMetadata(entry.record))
+      };
+      await client.query(
+        `INSERT INTO proof_request_receipt (${RECEIPT_COLUMNS})
+         VALUES ($1, $2, $3, $4, $5, $6, $7::bigint, 200, $8, $9)`,
+        [
+          tenant,
+          input.deviceId,
+          input.requestId,
+          input.operation,
+          input.resource,
+          input.proofBodySha256,
+          input.proofBodySize,
+          JSON.stringify(response),
+          this.#now()
+        ]
+      );
+      await client.query("COMMIT");
+      return { response, replayed: false };
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
       client.release();
     }
   }
-  async listDeadLetters(tenant, query = {}) {
-    const limit = assertBatchSize(query.limit ?? DEFAULT_BATCH_SIZE);
-    if (query.deviceId !== void 0) assertIdentifier(query.deviceId, "deviceId");
-    if (query.after !== void 0) assertDeadLetterRef(query.after);
-    if (query.deviceId !== void 0 && query.after !== void 0 && query.deviceId !== query.after.deviceId) {
-      throw new CloudCleanupError(
-        "cleanup_invalid_input",
-        "A device-scoped dead-letter cursor must belong to the same device."
-      );
+  async #validateInput(input) {
+    if (input.requestId.length === 0 || input.requestId.length > TRUTH_REQUEST_ID_MAX_LENGTH) {
+      throw new TruthCommitError("proof_request_conflict", "Request id is outside the record contract.");
     }
-    const listed = await this.#pool.query(
-      `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-        WHERE tenant_id = $1
-          AND state = 'expired'
-          AND ($2::text IS NULL OR device_id = $2::text)
-          AND (device_id > $3 OR (device_id = $3 AND seq > $4::bigint))
-        ORDER BY device_id, seq
-        LIMIT $5`,
-      [
-        tenant,
-        query.deviceId ?? null,
-        query.after?.deviceId ?? "",
-        query.after?.seq ?? 0,
-        limit + 1
-      ]
-    );
-    return {
-      messages: listed.rows.slice(0, limit).map(toMailboxMessage),
-      hasMore: listed.rows.length > limit
-    };
-  }
-  /** Clone an expired row to a new monotonic seq. The original remains evidence. */
-  async replayDeadLetter(tenant, input) {
-    assertDeadLetterRef(input);
-    assertIdentifier(input.replayMessageId, "replayMessageId");
-    const client = await this.#pool.connect();
-    let result;
-    let rejection;
-    let rollbackAllocation = false;
-    try {
-      await client.query("BEGIN");
-      const originalResult = await client.query(
-        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
-            AND state = 'expired'
-          FOR UPDATE`,
-        [tenant, input.deviceId, input.seq]
-      );
-      const original = originalResult.rows[0];
-      if (original === void 0) {
-        rejection = deadLetterMissing(input);
+    const seen = /* @__PURE__ */ new Set();
+    const objectSizes = /* @__PURE__ */ new Map();
+    for (const write of input.writes) {
+      const key = writeKey(write);
+      if (seen.has(key)) {
+        throw new TruthCommitError("proof_request_conflict", `Duplicate truth write ${key}.`);
+      }
+      seen.add(key);
+      if (write.body.kind === "inline") {
+        const bytes = new TextEncoder().encode(write.body.body);
+        if (BigInt(bytes.byteLength) !== write.byteSize) {
+          throw new ByokCoreError("storage_integrity_mismatch", "Inline byte size disagrees with its content.");
+        }
+        if (await this.#crypto.sha256(bytes) !== write.contentHash) {
+          throw new ByokCoreError("storage_integrity_mismatch", "Inline hash disagrees with its content.");
+        }
+      } else if (write.body.hash !== write.contentHash) {
+        throw new ByokCoreError("storage_integrity_mismatch", "Object body hash disagrees with record hash.");
       } else {
-        const existingResult = await client.query(
-          `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-            WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-          [tenant, input.deviceId, input.replayMessageId]
-        );
-        const existing = existingResult.rows[0];
-        if (existing !== void 0) {
-          if (!replayMatches(existing, original)) {
-            rejection = new CloudCleanupError(
-              "cleanup_invalid_input",
-              `Replay id ${input.replayMessageId} already binds a different replay delivery.`
-            );
-          } else {
-            result = toMailboxMessage(existing);
-          }
-        } else {
-          const entitlement = await client.query(
-            `SELECT e.mailbox_limit_bytes, u.mailbox_bytes
-               FROM storage_entitlement e
-               JOIN storage_usage u ON u.tenant_id = e.tenant_id
-              WHERE e.tenant_id = $1
-              FOR UPDATE OF e, u`,
-            [tenant]
-          );
-          const capacity = entitlement.rows[0];
-          const serializedExisting = await client.query(
-            `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-              WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-            [tenant, input.deviceId, input.replayMessageId]
+        const priorSize = objectSizes.get(write.body.hash);
+        if (priorSize !== void 0 && priorSize !== write.byteSize) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
           );
-          const winner = serializedExisting.rows[0];
-          if (winner !== void 0) {
-            if (!replayMatches(winner, original)) {
-              rejection = new CloudCleanupError(
-                "cleanup_invalid_input",
-                `Replay id ${input.replayMessageId} already binds a different replay delivery.`
-              );
-            } else {
-              result = toMailboxMessage(winner);
-            }
-          } else if (capacity === void 0) {
-            rejection = new CloudCleanupError(
-              "cleanup_policy_missing",
-              `Tenant ${tenant} has no storage entitlement/usage row.`
-            );
-          } else {
-            const seq = await allocateMailboxSequence(
-              client,
-              tenant,
-              input.deviceId,
-              this.#now()
-            );
-            const afterAllocation = await client.query(
-              `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-                WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-              [tenant, input.deviceId, input.replayMessageId]
-            );
-            const appendWinner = afterAllocation.rows[0];
-            if (appendWinner !== void 0) {
-              rollbackAllocation = true;
-              if (!replayMatches(appendWinner, original)) {
-                rejection = new CloudCleanupError(
-                  "cleanup_invalid_input",
-                  `Replay id ${input.replayMessageId} already binds a different replay delivery.`
-                );
-              } else {
-                result = toMailboxMessage(appendWinner);
-              }
-            } else {
-              const rebound = materializeReplayBody(original, seq);
-              if (capacity.mailbox_bytes + rebound.byteSize > capacity.mailbox_limit_bytes) {
-                rejection = new ByokCoreError(
-                  "storage_quota_exceeded",
-                  `Replaying the dead letter would exceed tenant ${tenant}'s mailbox limit.`
-                );
-              } else {
-                const inserted = await client.query(
-                  `INSERT INTO outbox (${OUTBOX_COLUMNS2})
-                   VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8, $9)
-                   RETURNING ${OUTBOX_COLUMNS2}`,
-                  [
-                    tenant,
-                    input.deviceId,
-                    seq,
-                    input.replayMessageId,
-                    rebound.body,
-                    rebound.bodyHash,
-                    rebound.byteSize,
-                    this.#now(),
-                    original.seq
-                  ]
-                );
-                await client.query(
-                  `UPDATE storage_usage
-                      SET mailbox_bytes = mailbox_bytes + $2::bigint, updated_at = $3
-                    WHERE tenant_id = $1`,
-                  [tenant, rebound.byteSize, this.#now()]
-                );
-                result = toMailboxMessage(inserted.rows[0]);
-              }
-            }
-          }
         }
+        objectSizes.set(write.body.hash, write.byteSize);
       }
-      if (rejection === void 0 && !rollbackAllocation) await client.query("COMMIT");
-      else await client.query("ROLLBACK");
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
-    } finally {
-      client.release();
     }
-    if (rejection !== void 0) throw rejection;
-    return result;
   }
-  /** Explicit operator discard. Automatic retention never deletes dead letters. */
-  async discardDeadLetter(tenant, ref) {
-    assertDeadLetterRef(ref);
-    const client = await this.#pool.connect();
-    let row;
-    let rejection;
-    try {
-      await client.query("BEGIN");
-      const existing = await client.query(
-        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
-          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
-            AND state = 'expired'
-          FOR UPDATE`,
-        [tenant, ref.deviceId, ref.seq]
-      );
-      const deadLetter = existing.rows[0];
-      const usage = await client.query(
-        "SELECT mailbox_bytes FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
-        [tenant]
-      );
-      if (deadLetter === void 0) {
-        rejection = deadLetterMissing(ref);
-      } else if (usage.rows[0] === void 0 || usage.rows[0].mailbox_bytes < deadLetter.byte_size) {
-        rejection = new CloudCleanupError(
-          "cleanup_accounting_drift",
-          `Mailbox accounting cannot release dead letter ${ref.deviceId}/${String(ref.seq)}.`
-        );
-      } else {
-        const removed = await client.query(
-          `DELETE FROM outbox
-            WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
-              AND state = 'expired'
-            RETURNING ${OUTBOX_COLUMNS2}`,
-          [tenant, ref.deviceId, ref.seq]
-        );
-        await client.query(
-          `UPDATE storage_usage
-              SET mailbox_bytes = mailbox_bytes - $2::bigint, updated_at = $3
-            WHERE tenant_id = $1`,
-          [tenant, deadLetter.byte_size, this.#now()]
+  async #readReceipt(client, tenant, deviceId, requestId) {
+    const result = await client.query(
+      `SELECT ${RECEIPT_COLUMNS} FROM proof_request_receipt
+        WHERE tenant_id = $1 AND device_id = $2 AND request_id = $3`,
+      [tenant, deviceId, requestId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toReceipt3(tenant, row);
+  }
+  async #lockCurrentRecords(client, tenant, writes) {
+    const current = /* @__PURE__ */ new Map();
+    const ordered = [...writes].sort((a, b) => writeKey(a).localeCompare(writeKey(b)));
+    for (const write of ordered) {
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+        JSON.stringify(["truth-record", tenant, write.kind, write.recordKey])
+      ]);
+    }
+    for (const write of ordered) {
+      const result = await client.query(
+        `SELECT ${RECORD_COLUMNS2} FROM attested_record
+          WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
+          FOR UPDATE`,
+        [tenant, write.kind, write.recordKey]
+      );
+      current.set(
+        writeKey(write),
+        result.rows[0] === void 0 ? void 0 : toRecord3(tenant, result.rows[0])
+      );
+    }
+    return current;
+  }
+  #assertWritePreconditions(writes, current) {
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal") {
+        if (before !== void 0 && before.contentHash !== write.contentHash) {
+          throw new CoreConflictError(
+            "terminal_conflict",
+            `Task ${write.recordKey} already has a different immutable terminal.`,
+            before,
+            this.#now()
+          );
+        }
+      } else if ((before?.rev ?? 0) !== write.expectedRev) {
+        throw new CoreConflictError(
+          "truth_revision_conflict",
+          `${write.kind}/${write.recordKey} is at rev ${before?.rev ?? 0}, not ${write.expectedRev}.`,
+          before,
+          this.#now()
         );
-        row = removed.rows[0];
       }
-      if (rejection === void 0) await client.query("COMMIT");
-      else await client.query("ROLLBACK");
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
-    } finally {
-      client.release();
     }
-    if (rejection !== void 0) throw rejection;
-    return toMailboxMessage(row);
   }
-  /**
-   * Explicit recovery operation: rebuild object accounting from committed
-   * Postgres manifests. Reconciliation must run first; R2 LIST is never used as
-   * billing authority and inline/mailbox usage is left untouched.
-   */
-  async rebuildObjectUsage(tenant) {
-    const client = await this.#pool.connect();
-    try {
-      await client.query("BEGIN");
-      const locked = await client.query(
-        "SELECT 1 FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
-        [tenant]
+  async #lockAndVerifyObjects(client, tenant, writes, current) {
+    const requested = /* @__PURE__ */ new Map();
+    const affected = /* @__PURE__ */ new Set();
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "object") affected.add(before.body.hash);
+      if (write.body.kind === "object") {
+        const existing = requested.get(write.body.hash);
+        if (existing !== void 0 && existing !== write.byteSize) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
+          );
+        }
+        requested.set(write.body.hash, write.byteSize);
+        affected.add(write.body.hash);
+      }
+    }
+    for (const hash of [...affected].sort()) {
+      const result = await client.query(
+        `SELECT hash, byte_size, state FROM object_manifest
+          WHERE tenant_id = $1 AND hash = $2 FOR UPDATE`,
+        [tenant, hash]
       );
-      if (locked.rowCount === 0) {
-        throw new CloudCleanupError(
-          "cleanup_policy_missing",
-          `Tenant ${tenant} has no storage usage row to rebuild.`
+      const manifest = result.rows[0];
+      const byteSize = requested.get(hash);
+      if (manifest === void 0 || byteSize !== void 0 && (manifest.state !== "committed" || manifest.byte_size !== byteSize)) {
+        throw new TruthCommitError(
+          "truth_object_not_committed",
+          `Object ${hash} is not a committed matching manifest.`
         );
       }
-      const rebuilt = await client.query(
-        `WITH authority AS MATERIALIZED (
-           SELECT COALESCE(SUM(byte_size), 0)::bigint AS committed_object_bytes,
-                  count(*)::bigint AS object_count
-             FROM object_manifest
-            WHERE tenant_id = $1 AND state = 'committed'
-         )
-         UPDATE storage_usage u
-            SET committed_object_bytes = authority.committed_object_bytes,
-                object_count = authority.object_count,
-                updated_at = $2
-           FROM authority
-          WHERE u.tenant_id = $1
-         RETURNING u.committed_object_bytes, u.object_count, u.updated_at`,
-        [tenant, this.#now()]
-      );
-      await client.query("COMMIT");
-      const row = rebuilt.rows[0];
-      return {
-        committedObjectBytes: row.committed_object_bytes,
-        objectCount: row.object_count,
-        updatedAt: row.updated_at
-      };
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
-    } finally {
-      client.release();
     }
   }
-  async #readRetentionPolicy(queryable, tenant) {
-    const result = await queryable.query(
-      `SELECT p.tenant_id, p.policy_id, p.mailbox_acked_retention_ms,
-              p.mailbox_unacked_retention_ms, p.request_receipt_retention_ms,
-              p.object_orphan_grace_ms, p.updated_at
-         FROM storage_entitlement e
-         JOIN tenant_retention_policy p
-           ON p.tenant_id = e.tenant_id AND p.policy_id = e.retention_policy_id
-        WHERE e.tenant_id = $1`,
+  async #prepareInlineAccounting(client, tenant, writes, current) {
+    const entitlementResult = await client.query(
+      `SELECT hard_limit_bytes, max_inline_bytes, downgrade_grace_until
+         FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE`,
       [tenant]
     );
-    const row = result.rows[0];
-    if (row === void 0) {
-      throw new CloudCleanupError(
-        "cleanup_policy_missing",
-        `Tenant ${tenant} has no retention policy matching its entitlement.`
-      );
+    const entitlement = entitlementResult.rows[0];
+    if (entitlement === void 0) {
+      throw new ByokCoreError("storage_entitlement_missing", "Tenant has no storage entitlement.");
     }
-    const policy = toPolicy(row);
-    assertPolicy(policy);
-    return policy;
-  }
-  async #startJob(client, tenant, jobId) {
     const now = this.#now();
-    const started = await client.query(
-      `INSERT INTO cleanup_job (tenant_id, job_id, kind, state, started_at)
-       VALUES ($1, $2, 'tenant_cleanup', 'running', $3)
-       ON CONFLICT (tenant_id, job_id) DO UPDATE
-          SET state = 'running', started_at = EXCLUDED.started_at,
-              finished_at = NULL, error_message = NULL
-        WHERE cleanup_job.state IN ('running', 'failed')
-       RETURNING ${JOB_COLUMNS}`,
-      [tenant, jobId, now]
+    await client.query(
+      `UPDATE storage_reservation SET state = 'expired', settled_at = $2
+        WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $2`,
+      [tenant, now]
     );
-    if (started.rows[0] !== void 0) return void 0;
-    const existing = await this.#readJob(client, tenant, jobId);
-    return toCleanupResult(existing);
-  }
-  async #runRetention(client, tenant, policy) {
-    const ackedBefore = cutoff(this.#clock.now(), policy.mailboxAckedRetentionMs);
-    const expireBefore = cutoff(this.#clock.now(), policy.mailboxUnackedRetentionMs);
-    const receiptBefore = cutoff(this.#clock.now(), policy.requestReceiptRetentionMs);
-    const now = this.#now();
-    try {
-      await client.query("BEGIN");
-      const swept = await client.query(
-        `WITH deleted AS (
-           DELETE FROM outbox
-            WHERE tenant_id = $1 AND state = 'acked' AND appended_at < $2
-           RETURNING byte_size
-         ), released AS MATERIALIZED (
-           SELECT COALESCE(SUM(byte_size), 0)::bigint AS bytes FROM deleted
-         ), expired AS (
-           UPDATE outbox SET state = 'expired'
-            WHERE tenant_id = $1 AND state = 'pending' AND appended_at < $3
-           RETURNING 1
-         ), reservations AS (
-           UPDATE storage_reservation SET state = 'expired', settled_at = $4
-            WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $4
-           RETURNING 1
-         ), nonces AS (
-           DELETE FROM auth_nonce
-            WHERE tenant_id = $1 AND (used OR expires_at <= $4::timestamptz)
-           RETURNING 1
-         ), pairing_codes AS (
-           DELETE FROM pairing_code
-            WHERE tenant_id = $1
-              AND (redeemed_at IS NOT NULL OR expires_at <= $4::timestamptz)
-           RETURNING 1
-         ), receipts AS (
-           DELETE FROM device_request_receipts
-            WHERE tenant_id = $1 AND recorded_at < $5::timestamptz
-           RETURNING 1
-         ), presence AS (
-           DELETE FROM device_presence
-            WHERE tenant_id = $1 AND expires_at <= $4
-           RETURNING 1
-         ), activity AS (
-           DELETE FROM activity_tail
-            WHERE tenant_id = $1 AND expires_at <= $4
-           RETURNING 1
-         ), accounted AS (
-           UPDATE storage_usage u
-              SET mailbox_bytes = u.mailbox_bytes - released.bytes, updated_at = $4
-             FROM released
-            WHERE u.tenant_id = $1 AND u.mailbox_bytes >= released.bytes
-           RETURNING released.bytes
-         )
-         SELECT (SELECT count(*) FROM deleted)::bigint AS mailbox_deleted_count,
-                (SELECT count(*) FROM expired)::bigint AS mailbox_expired_count,
-                (SELECT bytes FROM released)::bigint AS mailbox_released_bytes,
-                (SELECT count(*) FROM accounted)::bigint AS usage_accounted,
-                (SELECT count(*) FROM reservations)::bigint AS reservations_expired,
-                ((SELECT count(*) FROM nonces)
-                 + (SELECT count(*) FROM pairing_codes)
-                 + (SELECT count(*) FROM receipts)
-                 + (SELECT count(*) FROM presence)
-                 + (SELECT count(*) FROM activity))::bigint AS ttl_rows_deleted`,
-        [tenant, ackedBefore, expireBefore, now, receiptBefore]
-      );
-      const result = swept.rows[0];
-      if (result.usage_accounted !== 1n) {
-        throw new CloudCleanupError(
-          "cleanup_accounting_drift",
-          `Mailbox accounting cannot release ${String(result.mailbox_released_bytes)} deleted bytes for tenant ${tenant}.`
+    const usageResult = await client.query(
+      `SELECT u.committed_object_bytes, u.committed_inline_bytes,
+              COALESCE((SELECT SUM(expected_bytes) FROM storage_reservation r
+                         WHERE r.tenant_id = $1 AND r.state = 'reserved'), 0)::bigint AS reserved_bytes
+         FROM storage_usage u WHERE u.tenant_id = $1 FOR UPDATE`,
+      [tenant]
+    );
+    const usage = usageResult.rows[0];
+    if (usage === void 0) throw new Error(`storage usage for ${tenant} is missing`);
+    const affectedHashes = /* @__PURE__ */ new Set();
+    const sizes = /* @__PURE__ */ new Map();
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "inline") {
+        affectedHashes.add(before.contentHash);
+        sizes.set(before.contentHash, before.byteSize);
+      }
+      if (write.body.kind !== "inline") continue;
+      if (write.byteSize > entitlement.max_inline_bytes) {
+        throw new ByokCoreError(
+          "storage_object_too_large",
+          `Inline truth ${write.kind}/${write.recordKey} exceeds maxInlineBytes.`
         );
       }
-      await client.query("COMMIT");
-      return result;
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
-    }
-  }
-  async #markTombstones(client, tenant, orphanCutoff) {
-    try {
-      await client.query("BEGIN");
-      await client.query(
-        "SELECT 1 FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE",
-        [tenant]
-      );
-      const marked = await client.query(
-        `WITH candidates AS MATERIALIZED (
-         SELECT m.tenant_id, m.hash
-           FROM object_manifest m
-          WHERE m.tenant_id = $1
-            AND m.state IN ('pending', 'committed')
-            AND m.ref_count = 0
-            AND m.updated_at < $2
-            AND NOT EXISTS (
-              SELECT 1 FROM object_reference r
-               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
-            )
-            AND NOT EXISTS (
-              SELECT 1 FROM storage_reservation s
-               WHERE s.tenant_id = m.tenant_id AND s.content_hash = m.hash
-                 AND s.state = 'reserved'
-            )
-          ORDER BY m.updated_at, m.hash
-          LIMIT $3
-          FOR UPDATE OF m SKIP LOCKED
-       )
-       UPDATE object_manifest m
-          SET gc_accounted_bytes = CASE WHEN m.state = 'committed' THEN m.byte_size ELSE 0 END,
-              gc_accounted_object = (m.state = 'committed'),
-              state = 'delete_pending', delete_pending_at = $4, updated_at = $4
-         FROM candidates c
-        WHERE m.tenant_id = c.tenant_id AND m.hash = c.hash
-       RETURNING m.hash`,
-        [tenant, orphanCutoff, this.#batchSize, this.#now()]
-      );
-      await client.query("COMMIT");
-      return BigInt(marked.rowCount ?? 0);
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
+      const knownSize = sizes.get(write.contentHash);
+      if (knownSize !== void 0 && knownSize !== write.byteSize) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Inline hash ${write.contentHash} was declared with inconsistent byte sizes.`
+        );
+      }
+      affectedHashes.add(write.contentHash);
+      sizes.set(write.contentHash, write.byteSize);
     }
-  }
-  async #settleDeleted(client, tenant, hash) {
-    const settled = await client.query(
-      `WITH candidate AS MATERIALIZED (
-         SELECT m.gc_accounted_bytes, m.gc_accounted_object
-           FROM object_manifest m
-           JOIN storage_usage u ON u.tenant_id = m.tenant_id
-          WHERE m.tenant_id = $1 AND m.hash = $2
-            AND m.state = 'delete_pending'
-            AND m.ref_count = 0
-            AND m.gc_accounted_bytes IS NOT NULL
-            AND m.gc_accounted_object IS NOT NULL
-            AND NOT EXISTS (
-              SELECT 1 FROM object_reference r
-               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
-            )
-            AND u.committed_object_bytes >= m.gc_accounted_bytes
-            AND u.object_count >= CASE WHEN m.gc_accounted_object THEN 1 ELSE 0 END
-          FOR UPDATE OF m, u
-       ), moved AS (
-         UPDATE object_manifest m
-            SET state = 'deleted', updated_at = $3
-           FROM candidate c
-          WHERE m.tenant_id = $1 AND m.hash = $2 AND m.state = 'delete_pending'
-         RETURNING c.gc_accounted_bytes, c.gc_accounted_object
-       ), accounted AS (
-         UPDATE storage_usage u
-            SET committed_object_bytes = u.committed_object_bytes - moved.gc_accounted_bytes,
-                object_count = u.object_count - CASE WHEN moved.gc_accounted_object THEN 1 ELSE 0 END,
-                updated_at = $3
-           FROM moved
-          WHERE u.tenant_id = $1
-         RETURNING moved.gc_accounted_bytes
-       )
-       SELECT gc_accounted_bytes FROM accounted`,
-      [tenant, hash, this.#now()]
-    );
-    const row = settled.rows[0];
-    if (row !== void 0) return row.gc_accounted_bytes;
-    const current = await client.query(
-      "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
-      [tenant, hash]
-    );
-    if (current.rows[0]?.state === "deleted") return void 0;
-    throw new CloudCleanupError(
-      "cleanup_accounting_drift",
-      `Object ${hash} could not settle its delete tombstone against storage usage.`
-    );
-  }
-  async #reconcileManifests(client, tenant, counts) {
-    const cursor = await this.#readCursor(client, tenant, "manifest");
-    const page = await client.query(
-      `SELECT hash, byte_size, content_type, state,
-              gc_accounted_bytes, gc_accounted_object
-         FROM object_manifest
-        WHERE tenant_id = $1
-          AND state IN ('committed', 'delete_pending')
-          AND hash > $2
-        ORDER BY hash
-        LIMIT $3`,
-      [tenant, cursor ?? "", this.#batchSize]
+    const hashes = [...affectedHashes].sort();
+    const baseline = new Map(hashes.map((hash) => [hash, 0n]));
+    const existing = await client.query(
+      `SELECT content_hash, byte_size, count(*)::bigint AS ref_count
+         FROM attested_record
+        WHERE tenant_id = $1 AND body_kind = 'inline' AND content_hash = ANY($2::text[])
+        GROUP BY content_hash, byte_size`,
+      [tenant, hashes]
     );
-    for (const manifest of page.rows) {
-      const observed = await this.#objectStorage.inspectObject(
-        tenant,
-        manifest.hash
-      );
-      if (manifest.state === "delete_pending") {
-        if (observed === void 0) {
-          try {
-            const released = await this.#settleDeleted(
-              client,
-              tenant,
-              manifest.hash
-            );
-            if (released !== void 0) {
-              counts.objectsDeleted += 1n;
-              counts.objectReleasedBytes += released;
-            }
-          } catch {
-            counts.operationErrors += 1n;
-          }
-        }
-        continue;
+    for (const row of existing.rows) {
+      const knownSize = sizes.get(row.content_hash);
+      if (knownSize !== void 0 && knownSize !== row.byte_size) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Stored inline hash ${row.content_hash} disagrees on byte size.`
+        );
       }
-      if (observed === void 0) {
-        counts.missingObjects += 1n;
-      } else if (observed.observedByteSize !== manifest.byte_size || observed.observedContentType !== manifest.content_type) {
-        counts.shapeDrift += 1n;
+      if ((baseline.get(row.content_hash) ?? 0n) !== 0n) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Stored inline hash ${row.content_hash} has multiple byte sizes.`
+        );
+      }
+      baseline.set(row.content_hash, row.ref_count);
+      sizes.set(row.content_hash, row.byte_size);
+    }
+    const projected = new Map(baseline);
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "inline") {
+        projected.set(before.contentHash, (projected.get(before.contentHash) ?? 0n) - 1n);
+      }
+      if (write.body.kind === "inline") {
+        projected.set(write.contentHash, (projected.get(write.contentHash) ?? 0n) + 1n);
       }
     }
-    await this.#advanceLexicalCursor(
-      client,
-      tenant,
-      "manifest",
-      page.rows.at(-1)?.hash,
-      page.rows.length
-    );
+    let delta = 0n;
+    let newlyCommitted = 0n;
+    for (const hash of hashes) {
+      const before = baseline.get(hash) ?? 0n;
+      const after = projected.get(hash) ?? 0n;
+      if (after < 0n) throw new Error(`inline reference count for ${hash} would become negative`);
+      const byteSize = sizes.get(hash);
+      if (byteSize === void 0) throw new Error(`inline byte size for ${hash} is missing`);
+      if (before === 0n && after > 0n) {
+        delta += byteSize;
+        newlyCommitted += byteSize;
+      } else if (before > 0n && after === 0n) {
+        delta -= byteSize;
+      }
+    }
+    const used = usage.committed_object_bytes + usage.committed_inline_bytes + usage.reserved_bytes;
+    if (newlyCommitted > 0n && used >= entitlement.hard_limit_bytes && entitlement.downgrade_grace_until !== null && entitlement.downgrade_grace_until <= now) {
+      throw new ByokCoreError("storage_write_suspended", "Durable writes are suspended.");
+    }
+    if (used + delta > entitlement.hard_limit_bytes) {
+      throw new ByokCoreError("storage_quota_exceeded", "Final inline truth usage exceeds quota.");
+    }
+    return delta;
   }
-  async #reconcileR2(client, tenant, counts) {
-    const cursor = await this.#readCursor(client, tenant, "r2");
-    const page = await this.#objectStorage.listTenantObjects(
-      tenant,
-      cursor ?? void 0,
-      this.#batchSize
-    );
-    for (const object of page.objects) {
-      if (object.hash === void 0) {
-        counts.invalidObjectKeys += 1n;
+  async #applyWrites(client, tenant, input, current) {
+    const applied = [];
+    for (const write of input.writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) {
+        applied.push({ input: write, before, record: before, mutated: false });
         continue;
       }
-      const manifest = await client.query(
-        "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
-        [tenant, object.hash]
-      );
-      const state = manifest.rows[0]?.state;
-      if (state !== void 0 && state !== "deleted") continue;
-      const observed = await this.#objectStorage.inspectObject(tenant, object.hash);
-      if (observed === void 0) continue;
-      const witnessed = await client.query(
-        `INSERT INTO object_manifest (
-           tenant_id, hash, byte_size, content_type, state, ref_count,
-           created_at, updated_at, delete_pending_at,
-           gc_accounted_bytes, gc_accounted_object
-         ) VALUES ($1, $2, $3, $4, 'pending', 0, $5, $5, NULL, NULL, NULL)
-         ON CONFLICT (tenant_id, hash) DO UPDATE
-            SET byte_size = EXCLUDED.byte_size,
-                content_type = EXCLUDED.content_type,
-                state = 'pending', ref_count = 0,
-                created_at = EXCLUDED.created_at,
-                updated_at = EXCLUDED.updated_at,
-                delete_pending_at = NULL,
-                gc_accounted_bytes = NULL,
-                gc_accounted_object = NULL
-          WHERE object_manifest.state = 'deleted'
-         RETURNING 1`,
-        [
-          tenant,
-          object.hash,
-          observed.observedByteSize,
-          observed.observedContentType,
-          this.#now()
-        ]
+      const [bodyKind, bodyInline, bodyObjectHash] = bodyColumns2(write.body);
+      const values = [
+        tenant,
+        write.kind,
+        write.recordKey,
+        write.contentHash,
+        write.byteSize,
+        bodyKind,
+        bodyInline,
+        bodyObjectHash,
+        write.label ?? null,
+        input.requestId,
+        this.#now()
+      ];
+      const result = before === void 0 ? await client.query(
+        `INSERT INTO attested_record (${RECORD_COLUMNS2})
+               VALUES ($1, $2, $3, 1, $4, $5, $6, $7, $8, $9, $10, $11)
+               RETURNING ${RECORD_COLUMNS2}`,
+        values
+      ) : await client.query(
+        `UPDATE attested_record
+                  SET rev = rev + 1, content_hash = $4, byte_size = $5,
+                      body_kind = $6, body_inline = $7, body_object_hash = $8,
+                      label = $9, request_id = $10, written_at = $11
+                WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
+               RETURNING ${RECORD_COLUMNS2}`,
+        values
       );
-      counts.orphanWitnessesCreated += BigInt(witnessed.rowCount ?? 0);
-    }
-    if (page.nextContinuationToken === void 0) {
-      await this.#clearCursor(client, tenant, "r2");
-    } else {
-      await this.#writeCursor(client, tenant, "r2", page.nextContinuationToken);
+      applied.push({
+        input: write,
+        before,
+        record: toRecord3(tenant, result.rows[0]),
+        mutated: true
+      });
     }
+    return applied;
   }
-  async #advanceLexicalCursor(client, tenant, kind, lastValue, rowCount) {
-    if (lastValue === void 0 || rowCount < this.#batchSize) {
-      await this.#clearCursor(client, tenant, kind);
-    } else {
-      await this.#writeCursor(client, tenant, kind, lastValue);
+  async #replaceObjectReferences(client, tenant, applied) {
+    const affected = /* @__PURE__ */ new Set();
+    for (const entry of applied) {
+      if (!entry.mutated) continue;
+      const refId = referenceId(entry.input);
+      if (entry.input.body.kind === "object") {
+        affected.add(entry.input.body.hash);
+        await client.query(
+          `INSERT INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)
+           VALUES ($1, $2, 'truth', $3, $4)
+           ON CONFLICT (tenant_id, hash, ref_kind, ref_id) DO NOTHING`,
+          [tenant, entry.input.body.hash, refId, this.#now()]
+        );
+      }
+      if (entry.before?.body.kind === "object" && (entry.input.body.kind !== "object" || entry.input.body.hash !== entry.before.body.hash)) {
+        affected.add(entry.before.body.hash);
+        await client.query(
+          `DELETE FROM object_reference
+            WHERE tenant_id = $1 AND hash = $2 AND ref_kind = 'truth' AND ref_id = $3`,
+          [tenant, entry.before.body.hash, refId]
+        );
+      }
+    }
+    for (const hash of [...affected].sort()) {
+      await client.query(
+        `UPDATE object_manifest
+            SET ref_count = (SELECT count(*) FROM object_reference r
+                              WHERE r.tenant_id = $1 AND r.hash = $2),
+                updated_at = $3
+          WHERE tenant_id = $1 AND hash = $2`,
+        [tenant, hash, this.#now()]
+      );
     }
   }
-  async #readCursor(client, tenant, kind) {
-    const result = await client.query(
-      "SELECT cursor_value FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
-      [tenant, kind]
-    );
-    return result.rows[0]?.cursor_value ?? null;
-  }
-  async #writeCursor(client, tenant, kind, value) {
-    await client.query(
-      `INSERT INTO gc_cursor (tenant_id, cursor_kind, cursor_value, updated_at)
-       VALUES ($1, $2, $3, $4)
-       ON CONFLICT (tenant_id, cursor_kind) DO UPDATE
-          SET cursor_value = EXCLUDED.cursor_value, updated_at = EXCLUDED.updated_at`,
-      [tenant, kind, value, this.#now()]
-    );
+  async #settleInlineAccounting(client, tenant, delta) {
+    if (delta !== 0n) {
+      const updated = await client.query(
+        `UPDATE storage_usage
+            SET committed_inline_bytes = committed_inline_bytes + $2::bigint,
+                updated_at = $3
+          WHERE tenant_id = $1 AND committed_inline_bytes + $2::bigint >= 0
+         RETURNING 1`,
+        [tenant, delta, this.#now()]
+      );
+      if (updated.rowCount !== 1) throw new Error("inline accounting would become negative");
+    }
   }
-  async #clearCursor(client, tenant, kind) {
-    await client.query(
-      "DELETE FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
-      [tenant, kind]
-    );
+  #now() {
+    return this.#clock.now().toISOString();
   }
-  async #finishJob(client, tenant, jobId, state, counts) {
-    const finished = await client.query(
-      `UPDATE cleanup_job SET
-         state = $3, finished_at = $4,
-         mailbox_deleted_count = $5, mailbox_expired_count = $6,
-         mailbox_released_bytes = $7, reservations_expired = $8,
-         ttl_rows_deleted = $9,
-         objects_tombstoned = $10, objects_deleted = $11,
-         object_released_bytes = $12, orphan_witnesses_created = $13,
-         missing_objects = $14, shape_drift = $15,
-         invalid_object_keys = $16, operation_errors = $17,
-         error_message = NULL
-       WHERE tenant_id = $1 AND job_id = $2
-       RETURNING ${JOB_COLUMNS}`,
-      [
-        tenant,
-        jobId,
-        state,
-        this.#now(),
-        counts.mailboxDeletedCount,
-        counts.mailboxExpiredCount,
-        counts.mailboxReleasedBytes,
-        counts.reservationsExpired,
-        counts.ttlRowsDeleted,
-        counts.objectsTombstoned,
-        counts.objectsDeleted,
-        counts.objectReleasedBytes,
-        counts.orphanWitnessesCreated,
-        counts.missingObjects,
-        counts.shapeDrift,
-        counts.invalidObjectKeys,
-        counts.operationErrors
-      ]
+};
+var MIGRATION_ADVISORY_LOCK_KEY = "4021960801";
+var MIGRATION_FILENAME_PATTERN = /^(\d{4})[_-].+\.sql$/;
+var LEDGER_DDL = `
+CREATE TABLE IF NOT EXISTS byok_schema_migration (
+  version     text        PRIMARY KEY,
+  checksum    text        NOT NULL,
+  applied_at  timestamptz NOT NULL
+)`;
+var MigrationChecksumMismatchError = class extends Error {
+  version;
+  expectedChecksum;
+  actualChecksum;
+  constructor(version, expectedChecksum, actualChecksum) {
+    super(
+      `Migration ${version} was already applied with checksum ${expectedChecksum}, but the file on disk hashes to ${actualChecksum}. Published migrations are immutable: add a new file instead of editing this one.`
     );
-    return toCleanupResult(finished.rows[0]);
+    this.name = "MigrationChecksumMismatchError";
+    this.version = version;
+    this.expectedChecksum = expectedChecksum;
+    this.actualChecksum = actualChecksum;
   }
-  async #failJob(client, tenant, jobId, cause) {
-    const message = (cause instanceof Error ? cause.message : String(cause)).slice(0, 2e3);
-    await client.query(
-      `UPDATE cleanup_job
-          SET state = 'failed', finished_at = $3, error_message = $4
-        WHERE tenant_id = $1 AND job_id = $2`,
-      [tenant, jobId, this.#now(), message]
-    );
+};
+var MigrationFilenameError = class extends Error {
+  filename;
+  constructor(filename, reason) {
+    super(`Migration file ${filename} is not usable: ${reason}`);
+    this.name = "MigrationFilenameError";
+    this.filename = filename;
   }
-  async #readJob(client, tenant, jobId) {
-    const result = await client.query(
-      `SELECT ${JOB_COLUMNS} FROM cleanup_job WHERE tenant_id = $1 AND job_id = $2`,
-      [tenant, jobId]
-    );
-    return result.rows[0];
+};
+function sha256(text) {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+async function readMigrationFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".sql")) continue;
+    const match = MIGRATION_FILENAME_PATTERN.exec(entry.name);
+    if (match === null) {
+      throw new MigrationFilenameError(
+        entry.name,
+        "expected a four-digit prefix, e.g. 0001_cloud_local.sql"
+      );
+    }
+    const sql = await readFile(join(directory, entry.name), "utf8");
+    files.push({
+      version: entry.name,
+      ordinal: Number.parseInt(match[1], 10),
+      checksum: sha256(sql),
+      sql
+    });
   }
-  #now() {
-    return this.#clock.now().toISOString();
+  files.sort((left, right) => left.ordinal - right.ordinal);
+  for (let index = 1; index < files.length; index += 1) {
+    const previous = files[index - 1];
+    const current = files[index];
+    if (previous.ordinal === current.ordinal) {
+      throw new MigrationFilenameError(
+        current.version,
+        `duplicate prefix ${String(current.ordinal).padStart(4, "0")}, already used by ${previous.version}`
+      );
+    }
   }
-};
-function createPostgresCloudMaintenance(options) {
-  const objectStorage = new R2ObjectMaintenanceStore(options.objectStorage);
-  return new PostgresCloudCleanup({
-    pool: options.pool,
-    clock: options.clock,
-    objectStorage,
-    ...options.batchSize === void 0 ? {} : { batchSize: options.batchSize }
-  });
+  return files;
 }
-var JOB_COLUMNS = [
-  "tenant_id",
-  "job_id",
-  "state",
-  "started_at",
-  "finished_at",
-  "mailbox_deleted_count",
-  "mailbox_expired_count",
-  "mailbox_released_bytes",
-  "reservations_expired",
-  "ttl_rows_deleted",
-  "objects_tombstoned",
-  "objects_deleted",
-  "object_released_bytes",
-  "orphan_witnesses_created",
-  "missing_objects",
-  "shape_drift",
-  "invalid_object_keys",
-  "operation_errors",
-  "error_message"
-].join(", ");
-function emptyCounts() {
-  return {
-    mailboxDeletedCount: 0n,
-    mailboxExpiredCount: 0n,
-    mailboxReleasedBytes: 0n,
-    reservationsExpired: 0n,
-    ttlRowsDeleted: 0n,
-    objectsTombstoned: 0n,
-    objectsDeleted: 0n,
-    objectReleasedBytes: 0n,
-    orphanWitnessesCreated: 0n,
-    missingObjects: 0n,
-    shapeDrift: 0n,
-    invalidObjectKeys: 0n,
-    operationErrors: 0n
-  };
-}
-function toPolicy(row) {
-  return {
-    tenantId: tenantId(row.tenant_id),
-    policyId: row.policy_id,
-    mailboxAckedRetentionMs: row.mailbox_acked_retention_ms,
-    mailboxUnackedRetentionMs: row.mailbox_unacked_retention_ms,
-    requestReceiptRetentionMs: row.request_receipt_retention_ms,
-    objectOrphanGraceMs: row.object_orphan_grace_ms,
-    updatedAt: row.updated_at
-  };
-}
-function toCleanupResult(row) {
-  return {
-    tenantId: tenantId(row.tenant_id),
-    jobId: row.job_id,
-    state: row.state,
-    startedAt: row.started_at,
-    ...row.finished_at === null ? {} : { finishedAt: row.finished_at },
-    mailboxDeletedCount: row.mailbox_deleted_count,
-    mailboxExpiredCount: row.mailbox_expired_count,
-    mailboxReleasedBytes: row.mailbox_released_bytes,
-    reservationsExpired: row.reservations_expired,
-    ttlRowsDeleted: row.ttl_rows_deleted,
-    objectsTombstoned: row.objects_tombstoned,
-    objectsDeleted: row.objects_deleted,
-    objectReleasedBytes: row.object_released_bytes,
-    orphanWitnessesCreated: row.orphan_witnesses_created,
-    missingObjects: row.missing_objects,
-    shapeDrift: row.shape_drift,
-    invalidObjectKeys: row.invalid_object_keys,
-    operationErrors: row.operation_errors,
-    ...row.error_message === null ? {} : { errorMessage: row.error_message }
-  };
-}
-function toMailboxMessage(row) {
-  return {
-    tenantId: tenantId(row.tenant_id),
-    deviceId: row.device_id,
-    seq: Number(row.seq),
-    messageId: row.message_id,
-    body: row.body,
-    bodyHash: row.body_hash,
-    byteSize: row.byte_size,
-    state: row.state,
-    appendedAt: row.appended_at
-  };
+async function readLedger(client) {
+  const result = await client.query(
+    "SELECT version, checksum FROM byok_schema_migration"
+  );
+  return new Map(result.rows.map((row) => [row.version, row.checksum]));
 }
-function materializeReplayBody(original, seq) {
+async function migrate(pool, directory) {
+  const files = await readMigrationFiles(directory);
+  const client = await pool.connect();
   try {
-    const envelope = decodeEnvelope(original.body);
-    if (!isServerToDaemonType(envelope.type)) {
-      throw new Error(`Envelope type ${envelope.type} is not server-to-daemon.`);
+    await client.query("SELECT pg_advisory_lock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
+    try {
+      await client.query(LEDGER_DDL);
+      const ledger = await readLedger(client);
+      const applied = [];
+      const alreadyApplied = [];
+      for (const file of files) {
+        const recordedChecksum = ledger.get(file.version);
+        if (recordedChecksum !== void 0) {
+          if (recordedChecksum !== file.checksum) {
+            throw new MigrationChecksumMismatchError(file.version, recordedChecksum, file.checksum);
+          }
+          alreadyApplied.push(file.version);
+          continue;
+        }
+        await client.query("BEGIN");
+        try {
+          await client.query(file.sql);
+          await client.query(
+            "INSERT INTO byok_schema_migration (version, checksum, applied_at) VALUES ($1, $2, now())",
+            [file.version, file.checksum]
+          );
+          await client.query("COMMIT");
+        } catch (error) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw error;
+        }
+        applied.push(file.version);
+      }
+      return { applied, alreadyApplied };
+    } finally {
+      await client.query("SELECT pg_advisory_unlock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
     }
-    const rebound = EnvelopeSchema.parse({ ...envelope, seq });
-    const body = encodeEnvelope(rebound);
-    const bytes = new TextEncoder().encode(body);
-    return {
-      body,
-      bodyHash: contentHash(`sha256:${createHash("sha256").update(bytes).digest("hex")}`),
-      byteSize: BigInt(bytes.length)
-    };
-  } catch (cause) {
-    throw new CloudCleanupError(
-      "cleanup_invalid_input",
-      `Dead letter ${original.device_id}/${String(original.seq)} is not a replayable server-to-daemon envelope.`,
-      { cause }
-    );
+  } finally {
+    client.release();
   }
 }
-function replayMatches(row, original) {
-  if (row.replay_source_seq !== original.seq) return false;
-  const expected = materializeReplayBody(original, Number(row.seq));
-  return row.body === expected.body && row.body_hash === expected.bodyHash && row.byte_size === expected.byteSize;
+function migrationsDir() {
+  return fileURLToPath(new URL("./sql", import.meta.url));
 }
-function assertPolicy(input) {
-  assertIdentifier(input.policyId, "policyId");
-  for (const [field, value] of [
-    ["mailboxAckedRetentionMs", input.mailboxAckedRetentionMs],
-    ["mailboxUnackedRetentionMs", input.mailboxUnackedRetentionMs],
-    ["requestReceiptRetentionMs", input.requestReceiptRetentionMs],
-    ["objectOrphanGraceMs", input.objectOrphanGraceMs]
-  ]) {
-    if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {
-      throw new CloudCleanupError(
-        "cleanup_invalid_input",
-        `${field} must be a non-negative duration no larger than Number.MAX_SAFE_INTEGER milliseconds.`
-      );
-    }
+var DEFAULT_BATCH_SIZE = 100;
+var MAX_BATCH_SIZE = 1e3;
+var ADVISORY_LOCK_NAMESPACE = 1106736963;
+var OUTBOX_COLUMNS2 = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at, replay_source_seq";
+var CLOUD_CLEANUP_ERROR_CODES = {
+  cleanup_invalid_input: "cleanup_invalid_input",
+  cleanup_policy_missing: "cleanup_policy_missing",
+  cleanup_job_running: "cleanup_job_running",
+  cleanup_dead_letter_not_found: "cleanup_dead_letter_not_found",
+  cleanup_accounting_drift: "cleanup_accounting_drift"
+};
+var CloudCleanupError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "CloudCleanupError";
+    this.code = code;
   }
-}
-function assertBatchSize(value) {
-  if (!Number.isInteger(value) || value < 1 || value > MAX_BATCH_SIZE) {
-    throw new CloudCleanupError(
-      "cleanup_invalid_input",
-      `batchSize/limit must be a whole number in [1, ${String(MAX_BATCH_SIZE)}].`
-    );
+};
+var PostgresCloudCleanup = class {
+  #pool;
+  #clock;
+  #objectStorage;
+  #batchSize;
+  constructor(options) {
+    this.#pool = options.pool;
+    this.#clock = options.clock;
+    this.#objectStorage = options.objectStorage;
+    this.#batchSize = assertBatchSize(options.batchSize ?? DEFAULT_BATCH_SIZE);
   }
-  return value;
-}
-function assertIdentifier(value, field) {
-  if (value.length === 0 || value.length > 256 || value.trim() !== value) {
-    throw new CloudCleanupError(
-      "cleanup_invalid_input",
-      `${field} must be a non-empty, unpadded string no longer than 256 characters.`
+  async writeRetentionPolicy(tenant, input) {
+    assertPolicy(input);
+    const written = await this.#pool.query(
+      `INSERT INTO tenant_retention_policy (
+         tenant_id, policy_id, mailbox_acked_retention_ms,
+         mailbox_unacked_retention_ms, request_receipt_retention_ms,
+         object_orphan_grace_ms, updated_at
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (tenant_id, policy_id) DO UPDATE
+          SET mailbox_acked_retention_ms = EXCLUDED.mailbox_acked_retention_ms,
+              mailbox_unacked_retention_ms = EXCLUDED.mailbox_unacked_retention_ms,
+              request_receipt_retention_ms = EXCLUDED.request_receipt_retention_ms,
+              object_orphan_grace_ms = EXCLUDED.object_orphan_grace_ms,
+              updated_at = EXCLUDED.updated_at
+       RETURNING tenant_id, policy_id, mailbox_acked_retention_ms,
+                 mailbox_unacked_retention_ms, request_receipt_retention_ms,
+                 object_orphan_grace_ms, updated_at`,
+      [
+        tenant,
+        input.policyId,
+        input.mailboxAckedRetentionMs,
+        input.mailboxUnackedRetentionMs,
+        input.requestReceiptRetentionMs,
+        input.objectOrphanGraceMs,
+        this.#now()
+      ]
     );
+    return toPolicy(written.rows[0]);
   }
-}
-function assertDeadLetterRef(ref) {
-  assertIdentifier(ref.deviceId, "deviceId");
-  if (!Number.isSafeInteger(ref.seq) || ref.seq < 1) {
-    throw new CloudCleanupError(
-      "cleanup_invalid_input",
-      "A dead-letter seq must be a positive safe integer."
-    );
+  async readRetentionPolicy(tenant) {
+    return this.#readRetentionPolicy(this.#pool, tenant);
   }
-}
-function cutoff(now, durationMs) {
-  return new Date(now.getTime() - Number(durationMs)).toISOString();
-}
-function deadLetterMissing(ref) {
-  return new CloudCleanupError(
-    "cleanup_dead_letter_not_found",
-    `Expired mailbox row ${ref.deviceId}/${String(ref.seq)} was not found.`
-  );
-}
-var RECORD_COLUMNS2 = "tenant_id, kind, subject_id, rev, content_hash, byte_size, body_kind, body_inline, body_object_hash, label, request_id, written_at";
-var RECEIPT_COLUMNS = "tenant_id, device_id, request_id, operation, resource, body_sha256, body_size, response_status, response_body, recorded_at";
-function toBody2(row) {
-  return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
-}
-function toRecord3(tenant, row) {
-  return {
-    tenantId: tenant,
-    kind: row.kind,
-    recordKey: row.subject_id,
-    rev: row.rev,
-    contentHash: row.content_hash,
-    byteSize: row.byte_size,
-    body: toBody2(row),
-    ...row.label === null ? {} : { label: row.label },
-    ...row.request_id === null ? {} : { requestId: row.request_id },
-    writtenAt: row.written_at
-  };
-}
-function toReceipt3(tenant, row) {
-  return {
-    tenantId: tenant,
-    deviceId: row.device_id,
-    requestId: row.request_id,
-    operation: row.operation,
-    resource: row.resource,
-    bodySha256: row.body_sha256,
-    bodySize: row.body_size,
-    responseStatus: row.response_status,
-    responseBody: row.response_body,
-    recordedAt: row.recorded_at.toISOString()
-  };
-}
-function sameBinding(receipt, input) {
-  return receipt.operation === input.operation && receipt.resource === input.resource && receipt.bodySha256 === input.proofBodySha256 && receipt.bodySize === input.proofBodySize;
-}
-function bodyColumns2(body) {
-  return body.kind === "inline" ? ["inline", body.body, null] : ["object", null, body.hash];
-}
-function writeKey(write) {
-  return `${write.kind}\0${write.recordKey}`;
-}
-function referenceId(write) {
-  return `${write.kind}:${write.recordKey}`;
-}
-var PostgresTruthCommitter = class {
-  #pool;
-  #clock;
-  #crypto;
-  #truth;
-  constructor(options) {
-    this.#pool = options.pool;
-    this.#clock = options.clock;
-    this.#crypto = options.crypto;
-    this.#truth = new PostgresTruthStore(options.pool, options.clock);
-  }
-  getRecord(tenant, selector) {
-    return this.#truth.getRecord(tenant, selector);
-  }
-  listManifest(tenant, query) {
-    return this.#truth.listManifest(tenant, query);
-  }
-  async commit(tenant, input) {
-    await this.#validateInput(input);
+  /** Run one bounded tenant maintenance cycle. Completed job ids are replay-safe. */
+  async runTenant(tenant, jobId) {
+    assertIdentifier(jobId, "jobId");
     const client = await this.#pool.connect();
+    let jobStarted = false;
     try {
-      await client.query("BEGIN");
-      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
-        JSON.stringify(["truth-receipt", tenant, input.deviceId, input.requestId])
-      ]);
-      const replay = await this.#readReceipt(client, tenant, input.deviceId, input.requestId);
-      if (replay !== void 0) {
-        if (!sameBinding(replay, input)) {
-          throw new TruthCommitError(
-            "proof_request_conflict",
-            `Request ${input.requestId} was already used with a different binding.`
-          );
+      const lock = await client.query(
+        "SELECT pg_try_advisory_lock(hashtextextended($1, $2)) AS locked",
+        [tenant, ADVISORY_LOCK_NAMESPACE]
+      );
+      if (lock.rows[0]?.locked !== true) {
+        throw new CloudCleanupError(
+          "cleanup_job_running",
+          `A cleanup job is already running for tenant ${tenant}.`
+        );
+      }
+      const replay = await this.#startJob(client, tenant, jobId);
+      if (replay !== void 0) return replay;
+      jobStarted = true;
+      const policy = await this.#readRetentionPolicy(client, tenant);
+      const counts = emptyCounts();
+      const retention = await this.#runRetention(client, tenant, policy);
+      counts.mailboxDeletedCount = retention.mailbox_deleted_count;
+      counts.mailboxExpiredCount = retention.mailbox_expired_count;
+      counts.mailboxReleasedBytes = retention.mailbox_released_bytes;
+      counts.reservationsExpired = retention.reservations_expired;
+      counts.ttlRowsDeleted = retention.ttl_rows_deleted;
+      const orphanCutoff = cutoff(this.#clock.now(), policy.objectOrphanGraceMs);
+      counts.objectsTombstoned = await this.#markTombstones(client, tenant, orphanCutoff);
+      const deleteCursor = await this.#readCursor(client, tenant, "delete");
+      const pending = await client.query(
+        `SELECT hash, byte_size, content_type, state,
+                gc_accounted_bytes, gc_accounted_object
+           FROM object_manifest
+          WHERE tenant_id = $1
+            AND state = 'delete_pending'
+            AND gc_accounted_bytes IS NOT NULL
+            AND gc_accounted_object IS NOT NULL
+            AND hash > $2
+          ORDER BY hash
+          LIMIT $3`,
+        [tenant, deleteCursor ?? "", this.#batchSize]
+      );
+      for (const manifest of pending.rows) {
+        try {
+          await this.#objectStorage.deleteObject(tenant, manifest.hash);
+          const released = await this.#settleDeleted(client, tenant, manifest.hash);
+          if (released !== void 0) {
+            counts.objectsDeleted += 1n;
+            counts.objectReleasedBytes += released;
+          }
+        } catch {
+          counts.operationErrors += 1n;
         }
-        const response2 = TruthCommitResponseSchema.parse(JSON.parse(replay.responseBody));
-        await client.query("COMMIT");
-        return { response: response2, replayed: true };
       }
-      const before = await this.#lockCurrentRecords(client, tenant, input.writes);
-      this.#assertWritePreconditions(input.writes, before);
-      await this.#lockAndVerifyObjects(client, tenant, input.writes, before);
-      const inlineAffected = input.writes.some((write) => {
-        const current = before.get(writeKey(write));
-        if (write.kind === "task.terminal" && current !== void 0) return false;
-        return current?.body.kind === "inline" || write.body.kind === "inline";
-      });
-      const inlineDelta = inlineAffected ? await this.#prepareInlineAccounting(client, tenant, input.writes, before) : 0n;
-      const applied = await this.#applyWrites(client, tenant, input, before);
-      await this.#replaceObjectReferences(client, tenant, applied);
-      await this.#settleInlineAccounting(client, tenant, inlineDelta);
-      const response = {
-        primary: truthRecordMetadata(applied[0].record),
-        snapshots: applied.slice(1).map((entry) => truthRecordMetadata(entry.record))
-      };
-      await client.query(
-        `INSERT INTO proof_request_receipt (${RECEIPT_COLUMNS})
-         VALUES ($1, $2, $3, $4, $5, $6, $7::bigint, 200, $8, $9)`,
-        [
-          tenant,
-          input.deviceId,
-          input.requestId,
-          input.operation,
-          input.resource,
-          input.proofBodySha256,
-          input.proofBodySize,
-          JSON.stringify(response),
-          this.#now()
-        ]
+      await this.#advanceLexicalCursor(
+        client,
+        tenant,
+        "delete",
+        pending.rows.at(-1)?.hash,
+        pending.rows.length
       );
-      await client.query("COMMIT");
-      return { response, replayed: false };
-    } catch (error) {
-      await client.query("ROLLBACK").catch(() => void 0);
-      throw error;
+      await this.#reconcileManifests(client, tenant, counts);
+      await this.#reconcileR2(client, tenant, counts);
+      const state = counts.operationErrors === 0n ? "completed" : "completed_with_errors";
+      return this.#finishJob(client, tenant, jobId, state, counts);
+    } catch (cause) {
+      if (jobStarted) {
+        await this.#failJob(client, tenant, jobId, cause).catch(() => {
+        });
+      }
+      throw cause;
     } finally {
+      await client.query("SELECT pg_advisory_unlock(hashtextextended($1, $2))", [
+        tenant,
+        ADVISORY_LOCK_NAMESPACE
+      ]).catch(() => {
+      });
       client.release();
     }
   }
-  async #validateInput(input) {
-    if (input.requestId.length === 0 || input.requestId.length > TRUTH_REQUEST_ID_MAX_LENGTH) {
-      throw new TruthCommitError("proof_request_conflict", "Request id is outside the record contract.");
-    }
-    const seen = /* @__PURE__ */ new Set();
-    const objectSizes = /* @__PURE__ */ new Map();
-    for (const write of input.writes) {
-      const key = writeKey(write);
-      if (seen.has(key)) {
-        throw new TruthCommitError("proof_request_conflict", `Duplicate truth write ${key}.`);
-      }
-      seen.add(key);
-      if (write.body.kind === "inline") {
-        const bytes = new TextEncoder().encode(write.body.body);
-        if (BigInt(bytes.byteLength) !== write.byteSize) {
-          throw new ByokCoreError("storage_integrity_mismatch", "Inline byte size disagrees with its content.");
-        }
-        if (await this.#crypto.sha256(bytes) !== write.contentHash) {
-          throw new ByokCoreError("storage_integrity_mismatch", "Inline hash disagrees with its content.");
-        }
-      } else if (write.body.hash !== write.contentHash) {
-        throw new ByokCoreError("storage_integrity_mismatch", "Object body hash disagrees with record hash.");
-      } else {
-        const priorSize = objectSizes.get(write.body.hash);
-        if (priorSize !== void 0 && priorSize !== write.byteSize) {
-          throw new ByokCoreError(
-            "storage_integrity_mismatch",
-            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
-          );
-        }
-        objectSizes.set(write.body.hash, write.byteSize);
-      }
+  async listDeadLetters(tenant, query = {}) {
+    const limit = assertBatchSize(query.limit ?? DEFAULT_BATCH_SIZE);
+    if (query.deviceId !== void 0) assertIdentifier(query.deviceId, "deviceId");
+    if (query.after !== void 0) assertDeadLetterRef(query.after);
+    if (query.deviceId !== void 0 && query.after !== void 0 && query.deviceId !== query.after.deviceId) {
+      throw new CloudCleanupError(
+        "cleanup_invalid_input",
+        "A device-scoped dead-letter cursor must belong to the same device."
+      );
     }
-  }
-  async #readReceipt(client, tenant, deviceId, requestId) {
-    const result = await client.query(
-      `SELECT ${RECEIPT_COLUMNS} FROM proof_request_receipt
-        WHERE tenant_id = $1 AND device_id = $2 AND request_id = $3`,
-      [tenant, deviceId, requestId]
+    const listed = await this.#pool.query(
+      `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+        WHERE tenant_id = $1
+          AND state = 'expired'
+          AND ($2::text IS NULL OR device_id = $2::text)
+          AND (device_id > $3 OR (device_id = $3 AND seq > $4::bigint))
+        ORDER BY device_id, seq
+        LIMIT $5`,
+      [
+        tenant,
+        query.deviceId ?? null,
+        query.after?.deviceId ?? "",
+        query.after?.seq ?? 0,
+        limit + 1
+      ]
     );
-    const row = result.rows[0];
-    return row === void 0 ? void 0 : toReceipt3(tenant, row);
+    return {
+      messages: listed.rows.slice(0, limit).map(toMailboxMessage),
+      hasMore: listed.rows.length > limit
+    };
   }
-  async #lockCurrentRecords(client, tenant, writes) {
-    const current = /* @__PURE__ */ new Map();
-    const ordered = [...writes].sort((a, b) => writeKey(a).localeCompare(writeKey(b)));
-    for (const write of ordered) {
-      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
-        JSON.stringify(["truth-record", tenant, write.kind, write.recordKey])
-      ]);
-    }
-    for (const write of ordered) {
-      const result = await client.query(
-        `SELECT ${RECORD_COLUMNS2} FROM attested_record
-          WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
+  /** Clone an expired row to a new monotonic seq. The original remains evidence. */
+  async replayDeadLetter(tenant, input) {
+    assertDeadLetterRef(input);
+    assertIdentifier(input.replayMessageId, "replayMessageId");
+    const client = await this.#pool.connect();
+    let result;
+    let rejection;
+    let rollbackAllocation = false;
+    try {
+      await client.query("BEGIN");
+      const originalResult = await client.query(
+        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+            AND state = 'expired'
           FOR UPDATE`,
-        [tenant, write.kind, write.recordKey]
-      );
-      current.set(
-        writeKey(write),
-        result.rows[0] === void 0 ? void 0 : toRecord3(tenant, result.rows[0])
+        [tenant, input.deviceId, input.seq]
       );
-    }
-    return current;
-  }
-  #assertWritePreconditions(writes, current) {
-    for (const write of writes) {
-      const before = current.get(writeKey(write));
-      if (write.kind === "task.terminal") {
-        if (before !== void 0 && before.contentHash !== write.contentHash) {
-          throw new CoreConflictError(
-            "terminal_conflict",
-            `Task ${write.recordKey} already has a different immutable terminal.`,
-            before,
-            this.#now()
-          );
-        }
-      } else if ((before?.rev ?? 0) !== write.expectedRev) {
-        throw new CoreConflictError(
-          "truth_revision_conflict",
-          `${write.kind}/${write.recordKey} is at rev ${before?.rev ?? 0}, not ${write.expectedRev}.`,
-          before,
-          this.#now()
+      const original = originalResult.rows[0];
+      if (original === void 0) {
+        rejection = deadLetterMissing(input);
+      } else {
+        const existingResult = await client.query(
+          `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+            WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+          [tenant, input.deviceId, input.replayMessageId]
         );
-      }
-    }
-  }
-  async #lockAndVerifyObjects(client, tenant, writes, current) {
-    const requested = /* @__PURE__ */ new Map();
-    const affected = /* @__PURE__ */ new Set();
-    for (const write of writes) {
-      const before = current.get(writeKey(write));
-      if (write.kind === "task.terminal" && before !== void 0) continue;
-      if (before?.body.kind === "object") affected.add(before.body.hash);
-      if (write.body.kind === "object") {
-        const existing = requested.get(write.body.hash);
-        if (existing !== void 0 && existing !== write.byteSize) {
-          throw new ByokCoreError(
-            "storage_integrity_mismatch",
-            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
+        const existing = existingResult.rows[0];
+        if (existing !== void 0) {
+          if (!replayMatches(existing, original)) {
+            rejection = new CloudCleanupError(
+              "cleanup_invalid_input",
+              `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+            );
+          } else {
+            result = toMailboxMessage(existing);
+          }
+        } else {
+          const entitlement = await client.query(
+            `SELECT e.mailbox_limit_bytes, u.mailbox_bytes
+               FROM storage_entitlement e
+               JOIN storage_usage u ON u.tenant_id = e.tenant_id
+              WHERE e.tenant_id = $1
+              FOR UPDATE OF e, u`,
+            [tenant]
+          );
+          const capacity = entitlement.rows[0];
+          const serializedExisting = await client.query(
+            `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+              WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+            [tenant, input.deviceId, input.replayMessageId]
           );
+          const winner = serializedExisting.rows[0];
+          if (winner !== void 0) {
+            if (!replayMatches(winner, original)) {
+              rejection = new CloudCleanupError(
+                "cleanup_invalid_input",
+                `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+              );
+            } else {
+              result = toMailboxMessage(winner);
+            }
+          } else if (capacity === void 0) {
+            rejection = new CloudCleanupError(
+              "cleanup_policy_missing",
+              `Tenant ${tenant} has no storage entitlement/usage row.`
+            );
+          } else {
+            const seq = await allocateMailboxSequence(
+              client,
+              tenant,
+              input.deviceId,
+              this.#now()
+            );
+            const afterAllocation = await client.query(
+              `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+                WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+              [tenant, input.deviceId, input.replayMessageId]
+            );
+            const appendWinner = afterAllocation.rows[0];
+            if (appendWinner !== void 0) {
+              rollbackAllocation = true;
+              if (!replayMatches(appendWinner, original)) {
+                rejection = new CloudCleanupError(
+                  "cleanup_invalid_input",
+                  `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+                );
+              } else {
+                result = toMailboxMessage(appendWinner);
+              }
+            } else {
+              const rebound = materializeReplayBody(original, seq);
+              if (capacity.mailbox_bytes + rebound.byteSize > capacity.mailbox_limit_bytes) {
+                rejection = new ByokCoreError(
+                  "storage_quota_exceeded",
+                  `Replaying the dead letter would exceed tenant ${tenant}'s mailbox limit.`
+                );
+              } else {
+                const inserted = await client.query(
+                  `INSERT INTO outbox (${OUTBOX_COLUMNS2})
+                   VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8, $9)
+                   RETURNING ${OUTBOX_COLUMNS2}`,
+                  [
+                    tenant,
+                    input.deviceId,
+                    seq,
+                    input.replayMessageId,
+                    rebound.body,
+                    rebound.bodyHash,
+                    rebound.byteSize,
+                    this.#now(),
+                    original.seq
+                  ]
+                );
+                await client.query(
+                  `UPDATE storage_usage
+                      SET mailbox_bytes = mailbox_bytes + $2::bigint, updated_at = $3
+                    WHERE tenant_id = $1`,
+                  [tenant, rebound.byteSize, this.#now()]
+                );
+                result = toMailboxMessage(inserted.rows[0]);
+              }
+            }
+          }
         }
-        requested.set(write.body.hash, write.byteSize);
-        affected.add(write.body.hash);
       }
+      if (rejection === void 0 && !rollbackAllocation) await client.query("COMMIT");
+      else await client.query("ROLLBACK");
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
     }
-    for (const hash of [...affected].sort()) {
-      const result = await client.query(
-        `SELECT hash, byte_size, state FROM object_manifest
-          WHERE tenant_id = $1 AND hash = $2 FOR UPDATE`,
-        [tenant, hash]
+    if (rejection !== void 0) throw rejection;
+    return result;
+  }
+  /** Explicit operator discard. Automatic retention never deletes dead letters. */
+  async discardDeadLetter(tenant, ref) {
+    assertDeadLetterRef(ref);
+    const client = await this.#pool.connect();
+    let row;
+    let rejection;
+    try {
+      await client.query("BEGIN");
+      const existing = await client.query(
+        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+            AND state = 'expired'
+          FOR UPDATE`,
+        [tenant, ref.deviceId, ref.seq]
       );
-      const manifest = result.rows[0];
-      const byteSize = requested.get(hash);
-      if (manifest === void 0 || byteSize !== void 0 && (manifest.state !== "committed" || manifest.byte_size !== byteSize)) {
-        throw new TruthCommitError(
-          "truth_object_not_committed",
-          `Object ${hash} is not a committed matching manifest.`
+      const deadLetter = existing.rows[0];
+      const usage = await client.query(
+        "SELECT mailbox_bytes FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      if (deadLetter === void 0) {
+        rejection = deadLetterMissing(ref);
+      } else if (usage.rows[0] === void 0 || usage.rows[0].mailbox_bytes < deadLetter.byte_size) {
+        rejection = new CloudCleanupError(
+          "cleanup_accounting_drift",
+          `Mailbox accounting cannot release dead letter ${ref.deviceId}/${String(ref.seq)}.`
+        );
+      } else {
+        const removed = await client.query(
+          `DELETE FROM outbox
+            WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+              AND state = 'expired'
+            RETURNING ${OUTBOX_COLUMNS2}`,
+          [tenant, ref.deviceId, ref.seq]
+        );
+        await client.query(
+          `UPDATE storage_usage
+              SET mailbox_bytes = mailbox_bytes - $2::bigint, updated_at = $3
+            WHERE tenant_id = $1`,
+          [tenant, deadLetter.byte_size, this.#now()]
         );
+        row = removed.rows[0];
       }
+      if (rejection === void 0) await client.query("COMMIT");
+      else await client.query("ROLLBACK");
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
     }
+    if (rejection !== void 0) throw rejection;
+    return toMailboxMessage(row);
   }
-  async #prepareInlineAccounting(client, tenant, writes, current) {
-    const entitlementResult = await client.query(
-      `SELECT hard_limit_bytes, max_inline_bytes, downgrade_grace_until
-         FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE`,
-      [tenant]
-    );
-    const entitlement = entitlementResult.rows[0];
-    if (entitlement === void 0) {
-      throw new ByokCoreError("storage_entitlement_missing", "Tenant has no storage entitlement.");
-    }
-    const now = this.#now();
-    await client.query(
-      `UPDATE storage_reservation SET state = 'expired', settled_at = $2
-        WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $2`,
-      [tenant, now]
-    );
-    const usageResult = await client.query(
-      `SELECT u.committed_object_bytes, u.committed_inline_bytes,
-              COALESCE((SELECT SUM(expected_bytes) FROM storage_reservation r
-                         WHERE r.tenant_id = $1 AND r.state = 'reserved'), 0)::bigint AS reserved_bytes
-         FROM storage_usage u WHERE u.tenant_id = $1 FOR UPDATE`,
+  /**
+   * Explicit recovery operation: rebuild object accounting from committed
+   * Postgres manifests. Reconciliation must run first; R2 LIST is never used as
+   * billing authority and inline/mailbox usage is left untouched.
+   */
+  async rebuildObjectUsage(tenant) {
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        "SELECT 1 FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      if (locked.rowCount === 0) {
+        throw new CloudCleanupError(
+          "cleanup_policy_missing",
+          `Tenant ${tenant} has no storage usage row to rebuild.`
+        );
+      }
+      const rebuilt = await client.query(
+        `WITH authority AS MATERIALIZED (
+           SELECT COALESCE(SUM(byte_size), 0)::bigint AS committed_object_bytes,
+                  count(*)::bigint AS object_count
+             FROM object_manifest
+            WHERE tenant_id = $1 AND state = 'committed'
+         )
+         UPDATE storage_usage u
+            SET committed_object_bytes = authority.committed_object_bytes,
+                object_count = authority.object_count,
+                updated_at = $2
+           FROM authority
+          WHERE u.tenant_id = $1
+         RETURNING u.committed_object_bytes, u.object_count, u.updated_at`,
+        [tenant, this.#now()]
+      );
+      await client.query("COMMIT");
+      const row = rebuilt.rows[0];
+      return {
+        committedObjectBytes: row.committed_object_bytes,
+        objectCount: row.object_count,
+        updatedAt: row.updated_at
+      };
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+  async #readRetentionPolicy(queryable, tenant) {
+    const result = await queryable.query(
+      `SELECT p.tenant_id, p.policy_id, p.mailbox_acked_retention_ms,
+              p.mailbox_unacked_retention_ms, p.request_receipt_retention_ms,
+              p.object_orphan_grace_ms, p.updated_at
+         FROM storage_entitlement e
+         JOIN tenant_retention_policy p
+           ON p.tenant_id = e.tenant_id AND p.policy_id = e.retention_policy_id
+        WHERE e.tenant_id = $1`,
       [tenant]
     );
-    const usage = usageResult.rows[0];
-    if (usage === void 0) throw new Error(`storage usage for ${tenant} is missing`);
-    const affectedHashes = /* @__PURE__ */ new Set();
-    const sizes = /* @__PURE__ */ new Map();
-    for (const write of writes) {
-      const before = current.get(writeKey(write));
-      if (write.kind === "task.terminal" && before !== void 0) continue;
-      if (before?.body.kind === "inline") {
-        affectedHashes.add(before.contentHash);
-        sizes.set(before.contentHash, before.byteSize);
+    const row = result.rows[0];
+    if (row === void 0) {
+      throw new CloudCleanupError(
+        "cleanup_policy_missing",
+        `Tenant ${tenant} has no retention policy matching its entitlement.`
+      );
+    }
+    const policy = toPolicy(row);
+    assertPolicy(policy);
+    return policy;
+  }
+  async #startJob(client, tenant, jobId) {
+    const now = this.#now();
+    const started = await client.query(
+      `INSERT INTO cleanup_job (tenant_id, job_id, kind, state, started_at)
+       VALUES ($1, $2, 'tenant_cleanup', 'running', $3)
+       ON CONFLICT (tenant_id, job_id) DO UPDATE
+          SET state = 'running', started_at = EXCLUDED.started_at,
+              finished_at = NULL, error_message = NULL
+        WHERE cleanup_job.state IN ('running', 'failed')
+       RETURNING ${JOB_COLUMNS}`,
+      [tenant, jobId, now]
+    );
+    if (started.rows[0] !== void 0) return void 0;
+    const existing = await this.#readJob(client, tenant, jobId);
+    return toCleanupResult(existing);
+  }
+  async #runRetention(client, tenant, policy) {
+    const ackedBefore = cutoff(this.#clock.now(), policy.mailboxAckedRetentionMs);
+    const expireBefore = cutoff(this.#clock.now(), policy.mailboxUnackedRetentionMs);
+    const receiptBefore = cutoff(this.#clock.now(), policy.requestReceiptRetentionMs);
+    const now = this.#now();
+    try {
+      await client.query("BEGIN");
+      const swept = await client.query(
+        `WITH deleted AS (
+           DELETE FROM outbox
+            WHERE tenant_id = $1 AND state = 'acked' AND appended_at < $2
+           RETURNING byte_size
+         ), released AS MATERIALIZED (
+           SELECT COALESCE(SUM(byte_size), 0)::bigint AS bytes FROM deleted
+         ), expired AS (
+           UPDATE outbox SET state = 'expired'
+            WHERE tenant_id = $1 AND state = 'pending' AND appended_at < $3
+           RETURNING 1
+         ), reservations AS (
+           UPDATE storage_reservation SET state = 'expired', settled_at = $4
+            WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $4
+           RETURNING 1
+         ), nonces AS (
+           DELETE FROM auth_nonce
+            WHERE tenant_id = $1 AND (used OR expires_at <= $4::timestamptz)
+           RETURNING 1
+         ), pairing_codes AS (
+           DELETE FROM pairing_code
+            WHERE tenant_id = $1
+              AND (redeemed_at IS NOT NULL OR expires_at <= $4::timestamptz)
+           RETURNING 1
+         ), receipts AS (
+           DELETE FROM device_request_receipts
+            WHERE tenant_id = $1 AND recorded_at < $5::timestamptz
+           RETURNING 1
+         ), presence AS (
+           DELETE FROM device_presence
+            WHERE tenant_id = $1 AND expires_at <= $4
+           RETURNING 1
+         ), activity AS (
+           DELETE FROM activity_tail
+            WHERE tenant_id = $1 AND expires_at <= $4
+           RETURNING 1
+         ), approvals AS (
+           DELETE FROM approval_timeline_tail
+            WHERE tenant_id = $1 AND expires_at <= $4
+           RETURNING 1
+         ), accounted AS (
+           UPDATE storage_usage u
+              SET mailbox_bytes = u.mailbox_bytes - released.bytes, updated_at = $4
+             FROM released
+            WHERE u.tenant_id = $1 AND u.mailbox_bytes >= released.bytes
+           RETURNING released.bytes
+         )
+         SELECT (SELECT count(*) FROM deleted)::bigint AS mailbox_deleted_count,
+                (SELECT count(*) FROM expired)::bigint AS mailbox_expired_count,
+                (SELECT bytes FROM released)::bigint AS mailbox_released_bytes,
+                (SELECT count(*) FROM accounted)::bigint AS usage_accounted,
+                (SELECT count(*) FROM reservations)::bigint AS reservations_expired,
+                ((SELECT count(*) FROM nonces)
+                 + (SELECT count(*) FROM pairing_codes)
+                 + (SELECT count(*) FROM receipts)
+                 + (SELECT count(*) FROM presence)
+                 + (SELECT count(*) FROM activity)
+                 + (SELECT count(*) FROM approvals))::bigint AS ttl_rows_deleted`,
+        [tenant, ackedBefore, expireBefore, now, receiptBefore]
+      );
+      const result = swept.rows[0];
+      if (result.usage_accounted !== 1n) {
+        throw new CloudCleanupError(
+          "cleanup_accounting_drift",
+          `Mailbox accounting cannot release ${String(result.mailbox_released_bytes)} deleted bytes for tenant ${tenant}.`
+        );
+      }
+      await client.query("COMMIT");
+      return result;
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    }
+  }
+  async #markTombstones(client, tenant, orphanCutoff) {
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT 1 FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      const marked = await client.query(
+        `WITH candidates AS MATERIALIZED (
+         SELECT m.tenant_id, m.hash
+           FROM object_manifest m
+          WHERE m.tenant_id = $1
+            AND m.state IN ('pending', 'committed')
+            AND m.ref_count = 0
+            AND m.updated_at < $2
+            AND NOT EXISTS (
+              SELECT 1 FROM object_reference r
+               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM storage_reservation s
+               WHERE s.tenant_id = m.tenant_id AND s.content_hash = m.hash
+                 AND s.state = 'reserved'
+            )
+          ORDER BY m.updated_at, m.hash
+          LIMIT $3
+          FOR UPDATE OF m SKIP LOCKED
+       )
+       UPDATE object_manifest m
+          SET gc_accounted_bytes = CASE WHEN m.state = 'committed' THEN m.byte_size ELSE 0 END,
+              gc_accounted_object = (m.state = 'committed'),
+              state = 'delete_pending', delete_pending_at = $4, updated_at = $4
+         FROM candidates c
+        WHERE m.tenant_id = c.tenant_id AND m.hash = c.hash
+       RETURNING m.hash`,
+        [tenant, orphanCutoff, this.#batchSize, this.#now()]
+      );
+      await client.query("COMMIT");
+      return BigInt(marked.rowCount ?? 0);
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    }
+  }
+  async #settleDeleted(client, tenant, hash) {
+    const settled = await client.query(
+      `WITH candidate AS MATERIALIZED (
+         SELECT m.gc_accounted_bytes, m.gc_accounted_object
+           FROM object_manifest m
+           JOIN storage_usage u ON u.tenant_id = m.tenant_id
+          WHERE m.tenant_id = $1 AND m.hash = $2
+            AND m.state = 'delete_pending'
+            AND m.ref_count = 0
+            AND m.gc_accounted_bytes IS NOT NULL
+            AND m.gc_accounted_object IS NOT NULL
+            AND NOT EXISTS (
+              SELECT 1 FROM object_reference r
+               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
+            )
+            AND u.committed_object_bytes >= m.gc_accounted_bytes
+            AND u.object_count >= CASE WHEN m.gc_accounted_object THEN 1 ELSE 0 END
+          FOR UPDATE OF m, u
+       ), moved AS (
+         UPDATE object_manifest m
+            SET state = 'deleted', updated_at = $3
+           FROM candidate c
+          WHERE m.tenant_id = $1 AND m.hash = $2 AND m.state = 'delete_pending'
+         RETURNING c.gc_accounted_bytes, c.gc_accounted_object
+       ), accounted AS (
+         UPDATE storage_usage u
+            SET committed_object_bytes = u.committed_object_bytes - moved.gc_accounted_bytes,
+                object_count = u.object_count - CASE WHEN moved.gc_accounted_object THEN 1 ELSE 0 END,
+                updated_at = $3
+           FROM moved
+          WHERE u.tenant_id = $1
+         RETURNING moved.gc_accounted_bytes
+       )
+       SELECT gc_accounted_bytes FROM accounted`,
+      [tenant, hash, this.#now()]
+    );
+    const row = settled.rows[0];
+    if (row !== void 0) return row.gc_accounted_bytes;
+    const current = await client.query(
+      "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
+      [tenant, hash]
+    );
+    if (current.rows[0]?.state === "deleted") return void 0;
+    throw new CloudCleanupError(
+      "cleanup_accounting_drift",
+      `Object ${hash} could not settle its delete tombstone against storage usage.`
+    );
+  }
+  async #reconcileManifests(client, tenant, counts) {
+    const cursor = await this.#readCursor(client, tenant, "manifest");
+    const page = await client.query(
+      `SELECT hash, byte_size, content_type, state,
+              gc_accounted_bytes, gc_accounted_object
+         FROM object_manifest
+        WHERE tenant_id = $1
+          AND state IN ('committed', 'delete_pending')
+          AND hash > $2
+        ORDER BY hash
+        LIMIT $3`,
+      [tenant, cursor ?? "", this.#batchSize]
+    );
+    for (const manifest of page.rows) {
+      const observed = await this.#objectStorage.inspectObject(
+        tenant,
+        manifest.hash
+      );
+      if (manifest.state === "delete_pending") {
+        if (observed === void 0) {
+          try {
+            const released = await this.#settleDeleted(
+              client,
+              tenant,
+              manifest.hash
+            );
+            if (released !== void 0) {
+              counts.objectsDeleted += 1n;
+              counts.objectReleasedBytes += released;
+            }
+          } catch {
+            counts.operationErrors += 1n;
+          }
+        }
+        continue;
       }
-      if (write.body.kind !== "inline") continue;
-      if (write.byteSize > entitlement.max_inline_bytes) {
-        throw new ByokCoreError(
-          "storage_object_too_large",
-          `Inline truth ${write.kind}/${write.recordKey} exceeds maxInlineBytes.`
-        );
+      if (observed === void 0) {
+        counts.missingObjects += 1n;
+      } else if (observed.observedByteSize !== manifest.byte_size || observed.observedContentType !== manifest.content_type) {
+        counts.shapeDrift += 1n;
       }
-      const knownSize = sizes.get(write.contentHash);
-      if (knownSize !== void 0 && knownSize !== write.byteSize) {
-        throw new ByokCoreError(
-          "storage_integrity_mismatch",
-          `Inline hash ${write.contentHash} was declared with inconsistent byte sizes.`
-        );
+    }
+    await this.#advanceLexicalCursor(
+      client,
+      tenant,
+      "manifest",
+      page.rows.at(-1)?.hash,
+      page.rows.length
+    );
+  }
+  async #reconcileR2(client, tenant, counts) {
+    const cursor = await this.#readCursor(client, tenant, "r2");
+    const page = await this.#objectStorage.listTenantObjects(
+      tenant,
+      cursor ?? void 0,
+      this.#batchSize
+    );
+    for (const object of page.objects) {
+      if (object.hash === void 0) {
+        counts.invalidObjectKeys += 1n;
+        continue;
       }
-      affectedHashes.add(write.contentHash);
-      sizes.set(write.contentHash, write.byteSize);
+      const manifest = await client.query(
+        "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
+        [tenant, object.hash]
+      );
+      const state = manifest.rows[0]?.state;
+      if (state !== void 0 && state !== "deleted") continue;
+      const observed = await this.#objectStorage.inspectObject(tenant, object.hash);
+      if (observed === void 0) continue;
+      const witnessed = await client.query(
+        `INSERT INTO object_manifest (
+           tenant_id, hash, byte_size, content_type, state, ref_count,
+           created_at, updated_at, delete_pending_at,
+           gc_accounted_bytes, gc_accounted_object
+         ) VALUES ($1, $2, $3, $4, 'pending', 0, $5, $5, NULL, NULL, NULL)
+         ON CONFLICT (tenant_id, hash) DO UPDATE
+            SET byte_size = EXCLUDED.byte_size,
+                content_type = EXCLUDED.content_type,
+                state = 'pending', ref_count = 0,
+                created_at = EXCLUDED.created_at,
+                updated_at = EXCLUDED.updated_at,
+                delete_pending_at = NULL,
+                gc_accounted_bytes = NULL,
+                gc_accounted_object = NULL
+          WHERE object_manifest.state = 'deleted'
+         RETURNING 1`,
+        [
+          tenant,
+          object.hash,
+          observed.observedByteSize,
+          observed.observedContentType,
+          this.#now()
+        ]
+      );
+      counts.orphanWitnessesCreated += BigInt(witnessed.rowCount ?? 0);
+    }
+    if (page.nextContinuationToken === void 0) {
+      await this.#clearCursor(client, tenant, "r2");
+    } else {
+      await this.#writeCursor(client, tenant, "r2", page.nextContinuationToken);
+    }
+  }
+  async #advanceLexicalCursor(client, tenant, kind, lastValue, rowCount) {
+    if (lastValue === void 0 || rowCount < this.#batchSize) {
+      await this.#clearCursor(client, tenant, kind);
+    } else {
+      await this.#writeCursor(client, tenant, kind, lastValue);
+    }
+  }
+  async #readCursor(client, tenant, kind) {
+    const result = await client.query(
+      "SELECT cursor_value FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
+      [tenant, kind]
+    );
+    return result.rows[0]?.cursor_value ?? null;
+  }
+  async #writeCursor(client, tenant, kind, value) {
+    await client.query(
+      `INSERT INTO gc_cursor (tenant_id, cursor_kind, cursor_value, updated_at)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (tenant_id, cursor_kind) DO UPDATE
+          SET cursor_value = EXCLUDED.cursor_value, updated_at = EXCLUDED.updated_at`,
+      [tenant, kind, value, this.#now()]
+    );
+  }
+  async #clearCursor(client, tenant, kind) {
+    await client.query(
+      "DELETE FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
+      [tenant, kind]
+    );
+  }
+  async #finishJob(client, tenant, jobId, state, counts) {
+    const finished = await client.query(
+      `UPDATE cleanup_job SET
+         state = $3, finished_at = $4,
+         mailbox_deleted_count = $5, mailbox_expired_count = $6,
+         mailbox_released_bytes = $7, reservations_expired = $8,
+         ttl_rows_deleted = $9,
+         objects_tombstoned = $10, objects_deleted = $11,
+         object_released_bytes = $12, orphan_witnesses_created = $13,
+         missing_objects = $14, shape_drift = $15,
+         invalid_object_keys = $16, operation_errors = $17,
+         error_message = NULL
+       WHERE tenant_id = $1 AND job_id = $2
+       RETURNING ${JOB_COLUMNS}`,
+      [
+        tenant,
+        jobId,
+        state,
+        this.#now(),
+        counts.mailboxDeletedCount,
+        counts.mailboxExpiredCount,
+        counts.mailboxReleasedBytes,
+        counts.reservationsExpired,
+        counts.ttlRowsDeleted,
+        counts.objectsTombstoned,
+        counts.objectsDeleted,
+        counts.objectReleasedBytes,
+        counts.orphanWitnessesCreated,
+        counts.missingObjects,
+        counts.shapeDrift,
+        counts.invalidObjectKeys,
+        counts.operationErrors
+      ]
+    );
+    return toCleanupResult(finished.rows[0]);
+  }
+  async #failJob(client, tenant, jobId, cause) {
+    const message = (cause instanceof Error ? cause.message : String(cause)).slice(0, 2e3);
+    await client.query(
+      `UPDATE cleanup_job
+          SET state = 'failed', finished_at = $3, error_message = $4
+        WHERE tenant_id = $1 AND job_id = $2`,
+      [tenant, jobId, this.#now(), message]
+    );
+  }
+  async #readJob(client, tenant, jobId) {
+    const result = await client.query(
+      `SELECT ${JOB_COLUMNS} FROM cleanup_job WHERE tenant_id = $1 AND job_id = $2`,
+      [tenant, jobId]
+    );
+    return result.rows[0];
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+function createPostgresCloudMaintenance(options) {
+  const objectStorage = new R2ObjectMaintenanceStore(options.objectStorage);
+  return new PostgresCloudCleanup({
+    pool: options.pool,
+    clock: options.clock,
+    objectStorage,
+    ...options.batchSize === void 0 ? {} : { batchSize: options.batchSize }
+  });
+}
+var JOB_COLUMNS = [
+  "tenant_id",
+  "job_id",
+  "state",
+  "started_at",
+  "finished_at",
+  "mailbox_deleted_count",
+  "mailbox_expired_count",
+  "mailbox_released_bytes",
+  "reservations_expired",
+  "ttl_rows_deleted",
+  "objects_tombstoned",
+  "objects_deleted",
+  "object_released_bytes",
+  "orphan_witnesses_created",
+  "missing_objects",
+  "shape_drift",
+  "invalid_object_keys",
+  "operation_errors",
+  "error_message"
+].join(", ");
+function emptyCounts() {
+  return {
+    mailboxDeletedCount: 0n,
+    mailboxExpiredCount: 0n,
+    mailboxReleasedBytes: 0n,
+    reservationsExpired: 0n,
+    ttlRowsDeleted: 0n,
+    objectsTombstoned: 0n,
+    objectsDeleted: 0n,
+    objectReleasedBytes: 0n,
+    orphanWitnessesCreated: 0n,
+    missingObjects: 0n,
+    shapeDrift: 0n,
+    invalidObjectKeys: 0n,
+    operationErrors: 0n
+  };
+}
+function toPolicy(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    policyId: row.policy_id,
+    mailboxAckedRetentionMs: row.mailbox_acked_retention_ms,
+    mailboxUnackedRetentionMs: row.mailbox_unacked_retention_ms,
+    requestReceiptRetentionMs: row.request_receipt_retention_ms,
+    objectOrphanGraceMs: row.object_orphan_grace_ms,
+    updatedAt: row.updated_at
+  };
+}
+function toCleanupResult(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    jobId: row.job_id,
+    state: row.state,
+    startedAt: row.started_at,
+    ...row.finished_at === null ? {} : { finishedAt: row.finished_at },
+    mailboxDeletedCount: row.mailbox_deleted_count,
+    mailboxExpiredCount: row.mailbox_expired_count,
+    mailboxReleasedBytes: row.mailbox_released_bytes,
+    reservationsExpired: row.reservations_expired,
+    ttlRowsDeleted: row.ttl_rows_deleted,
+    objectsTombstoned: row.objects_tombstoned,
+    objectsDeleted: row.objects_deleted,
+    objectReleasedBytes: row.object_released_bytes,
+    orphanWitnessesCreated: row.orphan_witnesses_created,
+    missingObjects: row.missing_objects,
+    shapeDrift: row.shape_drift,
+    invalidObjectKeys: row.invalid_object_keys,
+    operationErrors: row.operation_errors,
+    ...row.error_message === null ? {} : { errorMessage: row.error_message }
+  };
+}
+function toMailboxMessage(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    deviceId: row.device_id,
+    seq: Number(row.seq),
+    messageId: row.message_id,
+    body: row.body,
+    bodyHash: row.body_hash,
+    byteSize: row.byte_size,
+    state: row.state,
+    appendedAt: row.appended_at
+  };
+}
+function materializeReplayBody(original, seq) {
+  try {
+    const envelope = decodeEnvelope(original.body);
+    if (!isServerToDaemonType(envelope.type)) {
+      throw new Error(`Envelope type ${envelope.type} is not server-to-daemon.`);
     }
-    const hashes = [...affectedHashes].sort();
-    const baseline = new Map(hashes.map((hash) => [hash, 0n]));
-    const existing = await client.query(
-      `SELECT content_hash, byte_size, count(*)::bigint AS ref_count
-         FROM attested_record
-        WHERE tenant_id = $1 AND body_kind = 'inline' AND content_hash = ANY($2::text[])
-        GROUP BY content_hash, byte_size`,
-      [tenant, hashes]
+    const rebound = EnvelopeSchema.parse({ ...envelope, seq });
+    const body = encodeEnvelope(rebound);
+    const bytes = new TextEncoder().encode(body);
+    return {
+      body,
+      bodyHash: contentHash(`sha256:${createHash("sha256").update(bytes).digest("hex")}`),
+      byteSize: BigInt(bytes.length)
+    };
+  } catch (cause) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `Dead letter ${original.device_id}/${String(original.seq)} is not a replayable server-to-daemon envelope.`,
+      { cause }
     );
-    for (const row of existing.rows) {
-      const knownSize = sizes.get(row.content_hash);
-      if (knownSize !== void 0 && knownSize !== row.byte_size) {
-        throw new ByokCoreError(
-          "storage_integrity_mismatch",
-          `Stored inline hash ${row.content_hash} disagrees on byte size.`
-        );
-      }
-      if ((baseline.get(row.content_hash) ?? 0n) !== 0n) {
-        throw new ByokCoreError(
-          "storage_integrity_mismatch",
-          `Stored inline hash ${row.content_hash} has multiple byte sizes.`
-        );
-      }
-      baseline.set(row.content_hash, row.ref_count);
-      sizes.set(row.content_hash, row.byte_size);
-    }
-    const projected = new Map(baseline);
-    for (const write of writes) {
-      const before = current.get(writeKey(write));
-      if (write.kind === "task.terminal" && before !== void 0) continue;
-      if (before?.body.kind === "inline") {
-        projected.set(before.contentHash, (projected.get(before.contentHash) ?? 0n) - 1n);
-      }
-      if (write.body.kind === "inline") {
-        projected.set(write.contentHash, (projected.get(write.contentHash) ?? 0n) + 1n);
-      }
-    }
-    let delta = 0n;
-    let newlyCommitted = 0n;
-    for (const hash of hashes) {
-      const before = baseline.get(hash) ?? 0n;
-      const after = projected.get(hash) ?? 0n;
-      if (after < 0n) throw new Error(`inline reference count for ${hash} would become negative`);
-      const byteSize = sizes.get(hash);
-      if (byteSize === void 0) throw new Error(`inline byte size for ${hash} is missing`);
-      if (before === 0n && after > 0n) {
-        delta += byteSize;
-        newlyCommitted += byteSize;
-      } else if (before > 0n && after === 0n) {
-        delta -= byteSize;
-      }
-    }
-    const used = usage.committed_object_bytes + usage.committed_inline_bytes + usage.reserved_bytes;
-    if (newlyCommitted > 0n && used >= entitlement.hard_limit_bytes && entitlement.downgrade_grace_until !== null && entitlement.downgrade_grace_until <= now) {
-      throw new ByokCoreError("storage_write_suspended", "Durable writes are suspended.");
-    }
-    if (used + delta > entitlement.hard_limit_bytes) {
-      throw new ByokCoreError("storage_quota_exceeded", "Final inline truth usage exceeds quota.");
-    }
-    return delta;
   }
-  async #applyWrites(client, tenant, input, current) {
-    const applied = [];
-    for (const write of input.writes) {
-      const before = current.get(writeKey(write));
-      if (write.kind === "task.terminal" && before !== void 0) {
-        applied.push({ input: write, before, record: before, mutated: false });
-        continue;
-      }
-      const [bodyKind, bodyInline, bodyObjectHash] = bodyColumns2(write.body);
-      const values = [
-        tenant,
-        write.kind,
-        write.recordKey,
-        write.contentHash,
-        write.byteSize,
-        bodyKind,
-        bodyInline,
-        bodyObjectHash,
-        write.label ?? null,
-        input.requestId,
-        this.#now()
-      ];
-      const result = before === void 0 ? await client.query(
-        `INSERT INTO attested_record (${RECORD_COLUMNS2})
-               VALUES ($1, $2, $3, 1, $4, $5, $6, $7, $8, $9, $10, $11)
-               RETURNING ${RECORD_COLUMNS2}`,
-        values
-      ) : await client.query(
-        `UPDATE attested_record
-                  SET rev = rev + 1, content_hash = $4, byte_size = $5,
-                      body_kind = $6, body_inline = $7, body_object_hash = $8,
-                      label = $9, request_id = $10, written_at = $11
-                WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
-               RETURNING ${RECORD_COLUMNS2}`,
-        values
+}
+function replayMatches(row, original) {
+  if (row.replay_source_seq !== original.seq) return false;
+  const expected = materializeReplayBody(original, Number(row.seq));
+  return row.body === expected.body && row.body_hash === expected.bodyHash && row.byte_size === expected.byteSize;
+}
+function assertPolicy(input) {
+  assertIdentifier(input.policyId, "policyId");
+  for (const [field, value] of [
+    ["mailboxAckedRetentionMs", input.mailboxAckedRetentionMs],
+    ["mailboxUnackedRetentionMs", input.mailboxUnackedRetentionMs],
+    ["requestReceiptRetentionMs", input.requestReceiptRetentionMs],
+    ["objectOrphanGraceMs", input.objectOrphanGraceMs]
+  ]) {
+    if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new CloudCleanupError(
+        "cleanup_invalid_input",
+        `${field} must be a non-negative duration no larger than Number.MAX_SAFE_INTEGER milliseconds.`
       );
-      applied.push({
-        input: write,
-        before,
-        record: toRecord3(tenant, result.rows[0]),
-        mutated: true
-      });
     }
-    return applied;
   }
-  async #replaceObjectReferences(client, tenant, applied) {
-    const affected = /* @__PURE__ */ new Set();
-    for (const entry of applied) {
-      if (!entry.mutated) continue;
-      const refId = referenceId(entry.input);
-      if (entry.input.body.kind === "object") {
-        affected.add(entry.input.body.hash);
-        await client.query(
-          `INSERT INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)
-           VALUES ($1, $2, 'truth', $3, $4)
-           ON CONFLICT (tenant_id, hash, ref_kind, ref_id) DO NOTHING`,
-          [tenant, entry.input.body.hash, refId, this.#now()]
-        );
-      }
-      if (entry.before?.body.kind === "object" && (entry.input.body.kind !== "object" || entry.input.body.hash !== entry.before.body.hash)) {
-        affected.add(entry.before.body.hash);
-        await client.query(
-          `DELETE FROM object_reference
-            WHERE tenant_id = $1 AND hash = $2 AND ref_kind = 'truth' AND ref_id = $3`,
-          [tenant, entry.before.body.hash, refId]
-        );
-      }
-    }
-    for (const hash of [...affected].sort()) {
-      await client.query(
-        `UPDATE object_manifest
-            SET ref_count = (SELECT count(*) FROM object_reference r
-                              WHERE r.tenant_id = $1 AND r.hash = $2),
-                updated_at = $3
-          WHERE tenant_id = $1 AND hash = $2`,
-        [tenant, hash, this.#now()]
-      );
-    }
+}
+function assertBatchSize(value) {
+  if (!Number.isInteger(value) || value < 1 || value > MAX_BATCH_SIZE) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `batchSize/limit must be a whole number in [1, ${String(MAX_BATCH_SIZE)}].`
+    );
   }
-  async #settleInlineAccounting(client, tenant, delta) {
-    if (delta !== 0n) {
-      const updated = await client.query(
-        `UPDATE storage_usage
-            SET committed_inline_bytes = committed_inline_bytes + $2::bigint,
-                updated_at = $3
-          WHERE tenant_id = $1 AND committed_inline_bytes + $2::bigint >= 0
-         RETURNING 1`,
-        [tenant, delta, this.#now()]
-      );
-      if (updated.rowCount !== 1) throw new Error("inline accounting would become negative");
-    }
+  return value;
+}
+function assertIdentifier(value, field) {
+  if (value.length === 0 || value.length > 256 || value.trim() !== value) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `${field} must be a non-empty, unpadded string no longer than 256 characters.`
+    );
   }
-  #now() {
-    return this.#clock.now().toISOString();
+}
+function assertDeadLetterRef(ref) {
+  assertIdentifier(ref.deviceId, "deviceId");
+  if (!Number.isSafeInteger(ref.seq) || ref.seq < 1) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      "A dead-letter seq must be a positive safe integer."
+    );
   }
-};
+}
+function cutoff(now, durationMs) {
+  return new Date(now.getTime() - Number(durationMs)).toISOString();
+}
+function deadLetterMissing(ref) {
+  return new CloudCleanupError(
+    "cleanup_dead_letter_not_found",
+    `Expired mailbox row ${ref.deviceId}/${String(ref.seq)} was not found.`
+  );
+}
 
-export { CLOUD_CLEANUP_ERROR_CODES, CloudCleanupError, DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, MigrationChecksumMismatchError, MigrationFilenameError, ObjectStoreRequestError, PostgresActivityStore, PostgresBoardStore, PostgresCloudCleanup, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudMaintenance, createPostgresCloudStores, createPostgresCoreStores, migrate, migrationsDir, readMigrationFiles };
+export { CLOUD_CLEANUP_ERROR_CODES, CloudCleanupError, DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, MigrationChecksumMismatchError, MigrationFilenameError, ObjectStoreRequestError, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresBoardStore, PostgresCloudCleanup, PostgresDeviceAssertionReplayAuthority, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresProofRequestReceiptStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresSkillPackStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudMaintenance, createPostgresCloudStores, createPostgresCoreStores, migrate, migrationsDir, readMigrationFiles };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map