@canonry/canonry 4.177.0 → 4.177.1

package/dist/{chunk-X776E66Z.js → chunk-GJE334DA.js}

@@ -630,7 +630,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-UXXXKDW4.js";
+} from "./chunk-PQT3ECM3.js";
 
 // src/intelligence-service.ts
 import { eq as eq61, desc as desc27, asc as asc11, and as and50, ne as ne8, or as or14, inArray as inArray21, gte as gte14, lte as lte12 } from "drizzle-orm";
@@ -2242,6 +2242,11 @@ var trafficSources = sqliteTable("traffic_sources", {
   status: text("status").notNull(),
   lastSyncedAt: text("last_synced_at"),
   lastCursor: text("last_cursor"),
+  // A WordPress cursor is valid only inside the fixed [lastSyncedAt,
+  // wordpressPendingUntil) window that created it. NULL means no such window
+  // is pending; a non-NULL cursor with a NULL end is legacy state that cannot
+  // safely compose with a bounded incremental pull.
+  wordpressPendingUntil: text("wordpress_pending_until"),
   lastError: text("last_error"),
   // JSON-encoded array of normalized event IDs (e.g. `cloud-run:<ts>:<insertId>`)
   // observed in the most recent successful sync. Bounded ring buffer used to
@@ -6849,6 +6854,18 @@ var MIGRATION_VERSIONS = [
     statements: [
       `CREATE INDEX IF NOT EXISTS idx_raw_event_samples_ts ON raw_event_samples(ts)`
     ]
+  },
+  {
+    version: 145,
+    name: "wordpress-traffic-pending-window",
+    // A persisted upper bound makes a capped WordPress cursor drain a finite,
+    // repeatable [last_synced_at, wordpress_pending_until) window. Existing
+    // non-null cursors deliberately receive NULL here: they were created by
+    // the old unbounded route, so treating their already-advanced watermark
+    // as a lower bound would silently skip undrained history.
+    statements: [
+      `ALTER TABLE traffic_sources ADD COLUMN wordpress_pending_until TEXT`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -35387,7 +35404,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/traffic/connect/wordpress",
     summary: "Connect a WordPress traffic-logger source",
-    description: "Probes the WordPress traffic-logger plugin endpoint with the supplied Application Password (single page, `limit=1`) before persisting. On success, stores the credential in `~/.canonry/config.yaml` and creates / updates the project's active WordPress `traffic_sources` row. A probe failure (HTTP 4xx/5xx, network error) surfaces as 502 with the upstream status in the message so the caller learns about a bad credential up front instead of at the first sync.",
+    description: "Probes the WordPress traffic-logger plugin endpoint with the supplied Application Password (single page, `limit=1`) before persisting. On success, stores the credential in `~/.canonry/config.yaml` and creates / updates the project's active WordPress `traffic_sources` row. Changing `baseUrl` archives the old source lineage and creates a fresh source so historical rollups cannot mix across endpoints. A probe failure (HTTP 4xx/5xx, network error) surfaces as 502 with the upstream status in the message so the caller learns about a bad credential up front instead of at the first sync.",
     tags: ["traffic"],
     parameters: [nameParameter],
     requestBody: {
@@ -35514,7 +35531,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/sync",
     summary: "Trigger a sync run for a traffic source",
-    description: "Pulls from the selected Cloud Run, WordPress, Vercel, or Cloudflare Queue source, classifies crawler hits / user fetches / AI-referral sessions, and commits hourly buckets plus a bounded sample tail. Queue pull uses a durable source lease and acknowledges each Cloudflare message only after its event receipts and rollups commit.",
+    description: "Pulls from the selected Cloud Run, WordPress, Vercel, or Cloudflare Queue source, classifies crawler hits / user fetches / AI-referral sessions, and commits hourly buckets plus a bounded sample tail. WordPress uses a fixed half-open `[since, until)` window and a source lease; its first or idle sync defaults to the plugin maximum retention horizon (365d) unless `sinceMinutes` is supplied. Queue pull also uses a durable source lease and acknowledges each Cloudflare message only after its event receipts and rollups commit.",
     tags: ["traffic"],
     parameters: [
       nameParameter,
@@ -35527,7 +35544,7 @@ var routeCatalog = [
           schema: {
             type: "object",
             properties: {
-              sinceMinutes: { ...integerSchema, description: "Optional lookback for time-window sources; Cloudflare Queue pull ignores it." }
+              sinceMinutes: { ...integerSchema, description: "Optional lookback for time-window sources. Defaults are adapter-specific; a new or idle WordPress source uses 365d to cover the plugin\u2019s maximum configurable retention. Cloudflare Queue pull ignores it." }
             }
           }
         }
@@ -35536,7 +35553,7 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Sync summary returned.", "TrafficSyncResponse"),
       400: errorResponse("Invalid sync request or missing credentials."),
-      409: errorResponse("Another Queue sync currently owns the source lease."),
+      409: errorResponse("Another WordPress or Queue sync currently owns the source lease."),
       404: errorResponse("Project or traffic source not found."),
       502: errorResponse("Upstream pull, acknowledgement, or credential resolution failed.")
     }
@@ -35545,7 +35562,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/backfill",
     summary: "Reclassify historical traffic-source logs",
-    description: 'Async one-shot backfill: pulls the last `days` of events (clamped server-side to the upstream retention ceiling \u2014 30d for Cloud Logging `_Default`; the WordPress plugin honours the same window via `since`/`until` query params), classifies them with the current rules, and replaces the hourly rollup buckets + sample slice in the window inside one transaction. Returns immediately with `{ runId, status: "running" }`; poll `GET /runs/{id}` for completion. lastSyncedAt only advances forward, so a backfill never undoes incremental sync progress that ran ahead of it. Supported source types: `cloud-run`, `wordpress`, `vercel`.',
+    description: 'Async one-shot reclassification: pulls the last `days` of events, classifies them with current rules, and replaces hourly rollup buckets plus the sample slice in that window inside one transaction. Adapter limits apply (Cloud Logging `_Default` is typically 30d; request payloads are capped at 90d). Generic replace backfill supports `cloud-run` and `vercel`. WordPress is always rejected because its retained event feed cannot prove it covers every bucket; use a retention-aware repair that explicitly declares any unrecoverable span. Returns immediately with `{ runId, status: "running" }`; poll `GET /runs/{id}` for completion. lastSyncedAt only advances forward.',
     tags: ["traffic"],
     parameters: [
       nameParameter,
@@ -35558,7 +35575,7 @@ var routeCatalog = [
           schema: {
             type: "object",
             properties: {
-              days: { ...integerSchema, description: "Lookback window in days (default 30, capped at the upstream retention ceiling)." }
+              days: { ...integerSchema, description: "Lookback window in days (default 30, capped by the adapter; generic WordPress replace backfill is unavailable)." }
             }
           }
         }
@@ -35574,7 +35591,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/reset",
     summary: "Advance lastSyncedAt to NOW and clear the error state",
-    description: "Operator recovery: advances `lastSyncedAt` to NOW, sets `status` back to `connected`, and clears `last_error`. Accepts any non-archived source \u2014 the `lastSyncedAt` advance determines the next sync window for time-windowed sources (Vercel, Cloud Run) and is informational for cursor-based sources (WordPress, where `last_cursor` governs the next drain and is preserved). Common trigger: an idle Vercel/Cloud Run source whose `lastSyncedAt` has aged past the upstream retention window (`request-logs` ~14d, Cloud Logging 30d) and now throws on every sync. Any pre-existing rollup history stays in place; the skipped history is the explicit trade-off \u2014 run `traffic backfill` separately to recover any of it. `advanceToNow: true` is required (no implicit reset). Archived sources are rejected with 400 \u2014 re-connect them via the appropriate `traffic/connect/*` endpoint instead.",
+    description: "Operator recovery: advances `lastSyncedAt` to NOW, sets `status` back to `connected`, and clears `last_error`. WordPress resets also clear `last_cursor` and the pending-window marker, then record an unrecovered skip through the reset instant so the next drain cannot combine an old cursor with a new window. That prevents replay but is not a historical repair. Generic WordPress replace-mode backfill is unavailable because the plugin feed cannot prove retained coverage; use a retention-aware repair and explicitly declare any unrecoverable span. Common trigger: an idle Vercel/Cloud Run source whose `lastSyncedAt` has aged past upstream retention (`request-logs` ~14d, Cloud Logging 30d) and now throws on every sync. `advanceToNow: true` is required (no implicit reset). Archived sources are rejected with 400 \u2014 re-connect them via the appropriate `traffic/connect/*` endpoint instead.",
     tags: ["traffic"],
     parameters: [
       nameParameter,
@@ -66747,12 +66764,92 @@ async function readErrorBody2(response) {
   if (!text2) return void 0;
   return text2.length <= 500 ? text2 : `${text2.slice(0, 500)}... [truncated]`;
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseRequestedBoundary(name, value) {
+  if (value === void 0 || value === "") return void 0;
+  const timestampMs = Date.parse(value);
+  if (!Number.isFinite(timestampMs)) {
+    throw new WordpressTrafficApiError(`${name} must be a valid ISO 8601 timestamp`, 400);
+  }
+  return { value, timestampMs };
+}
+function parseRequestedWindow(options) {
+  const since = parseRequestedBoundary("since", options.since);
+  const until = parseRequestedBoundary("until", options.until);
+  if (since && until && since.timestampMs >= until.timestampMs) {
+    throw new WordpressTrafficApiError("since must be earlier than until", 400);
+  }
+  return { since, until };
+}
+function parseSiteMetadata(value) {
+  if (!isRecord2(value)) return void 0;
+  return {
+    url: typeof value.url === "string" ? value.url : void 0,
+    anonymous_id: typeof value.anonymous_id === "string" ? value.anonymous_id : void 0,
+    wordpress_version: typeof value.wordpress_version === "string" ? value.wordpress_version : void 0,
+    plugin_version: typeof value.plugin_version === "string" ? value.plugin_version : void 0
+  };
+}
+function invalidResponse(message) {
+  return new WordpressTrafficApiError(
+    `WordPress traffic endpoint returned an invalid response: ${message}`,
+    502
+  );
+}
+function parseResponseBody(value) {
+  if (!isRecord2(value)) {
+    throw invalidResponse("expected an object body");
+  }
+  if (!Array.isArray(value.events)) {
+    throw invalidResponse("events must be an array");
+  }
+  if (typeof value.has_more !== "boolean") {
+    throw invalidResponse("has_more must be a boolean");
+  }
+  const nextCursor = value.next_cursor;
+  if (value.has_more) {
+    if (typeof nextCursor !== "string" || nextCursor.trim().length === 0) {
+      throw invalidResponse("has_more=true requires a nonempty next_cursor");
+    }
+  } else if (nextCursor !== null) {
+    throw invalidResponse("has_more=false requires next_cursor=null");
+  }
+  return {
+    events: value.events,
+    nextCursor,
+    hasMore: value.has_more,
+    site: parseSiteMetadata(value.site)
+  };
+}
+async function readResponseJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw invalidResponse("body is not valid JSON");
+  }
+}
+function assertEntryIsWithinRequestedWindow(entry, window) {
+  if (!window.since && !window.until) return;
+  const observedAt = isRecord2(entry) && typeof entry.observed_at === "string" ? entry.observed_at : void 0;
+  const observedAtMs = observedAt === void 0 ? Number.NaN : Date.parse(observedAt);
+  const outsideWindow = !Number.isFinite(observedAtMs) || window.since !== void 0 && observedAtMs < window.since.timestampMs || window.until !== void 0 && observedAtMs >= window.until.timestampMs;
+  if (!outsideWindow) return;
+  const lower = window.since?.value ?? "-infinity";
+  const upper = window.until?.value ?? "+infinity";
+  throw new WordpressTrafficApiError(
+    `WordPress traffic endpoint returned an invalid or out-of-window observed_at for the requested [${lower}, ${upper}) window. Upgrade to a bounded-window-capable Canonry traffic-logger extension before syncing.`,
+    502
+  );
+}
 async function listWordpressTrafficEvents(options) {
   const endpoint = resolveEndpoint(options.baseUrl);
   const authHeader = buildBasicAuthHeader(options.username, options.applicationPassword);
   const pageSize = normalizePageSize2(options.pageSize);
   const maxPages = normalizeMaxPages2(options.maxPages);
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const requestedWindow = parseRequestedWindow(options);
   let cursor = options.cursor;
   let rawEntryCount = 0;
   let skippedEntryCount = 0;
@@ -66793,20 +66890,28 @@ async function listWordpressTrafficEvents(options) {
         body2
       );
     }
-    const body = await response.json();
-    const entries = body.events ?? [];
+    const body = parseResponseBody(await readResponseJson(response));
+    const entries = body.events;
     rawEntryCount += entries.length;
     for (const entry of entries) {
-      const normalized = normalizeWordpressTrafficEvent(entry, body.site);
+      assertEntryIsWithinRequestedWindow(entry, requestedWindow);
+      if (!isRecord2(entry)) {
+        skippedEntryCount += 1;
+        continue;
+      }
+      const normalized = normalizeWordpressTrafficEvent(
+        entry,
+        body.site
+      );
       if (normalized) {
         events.push(normalized);
       } else {
         skippedEntryCount += 1;
       }
     }
-    cursor = body.next_cursor ?? void 0;
-    hasMore = Boolean(body.has_more) && Boolean(cursor);
-    if (!body.has_more || !cursor) break;
+    cursor = body.nextCursor ?? void 0;
+    hasMore = body.hasMore;
+    if (!hasMore) break;
   }
   return {
     events,
@@ -68470,8 +68575,7 @@ function tryClaimTrafficSyncLease(input) {
   return input.db.transaction((tx) => {
     const changed = tx.update(trafficSources).set({
       syncLeaseOwner: input.owner,
-      syncLeaseExpiresAt: expiresAt,
-      updatedAt: input.now
+      syncLeaseExpiresAt: expiresAt
     }).where(and42(
       eq49(trafficSources.id, input.sourceId),
       or11(
@@ -68487,8 +68591,7 @@ function releaseTrafficSyncLease(input) {
   return input.db.transaction((tx) => {
     const changed = tx.update(trafficSources).set({
       syncLeaseOwner: null,
-      syncLeaseExpiresAt: null,
-      updatedAt: input.now
+      syncLeaseExpiresAt: null
     }).where(and42(
       eq49(trafficSources.id, input.sourceId),
       eq49(trafficSources.syncLeaseOwner, input.owner)
@@ -68504,6 +68607,7 @@ var DEFAULT_MAX_PAGES4 = 5;
 var DEFAULT_SAMPLE_LIMIT2 = 100;
 var DEFAULT_WP_PAGE_SIZE = 500;
 var DEFAULT_WP_MAX_PAGES = 20;
+var DEFAULT_WP_SYNC_WINDOW_MINUTES = 365 * 24 * 60;
 var DEFAULT_VERCEL_MAX_PAGES = 50;
 var VERCEL_MAX_SUB_WINDOWS = 5e3;
 var VERCEL_BACKFILL_CHUNK_MS = 60 * 6e4;
@@ -68517,6 +68621,7 @@ var CLOUDFLARE_INGEST_BODY_LIMIT = 256 * 1024;
 var CLOUDFLARE_QUEUE_RECEIPT_TTL_MS = 14 * 24 * 60 * 6e4 + 10 * 6e4;
 var CLOUDFLARE_QUEUE_VISIBILITY_TIMEOUT_MS = 5 * 6e4;
 var CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS = 5 * 6e4;
+var WORDPRESS_SYNC_LEASE_TTL_MS = 5 * 6e4;
 var DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX = 6e3;
 var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
 function sha256Hex3(value) {
@@ -68822,7 +68927,19 @@ function trafficConnectStatus(tx, projectId, existingSource) {
   return existingSource?.status === TrafficSourceStatuses.paused || hasConnectedTrafficSourceSibling(tx, projectId, existingSource?.id ?? "") ? TrafficSourceStatuses.paused : TrafficSourceStatuses.connected;
 }
 function isSameTrafficSourceGeneration(current, started) {
-  return isDeepStrictEqual(current.configJson, started.configJson) && current.updatedAt === started.updatedAt && current.lastSyncedAt === started.lastSyncedAt;
+  return isDeepStrictEqual(current.configJson, started.configJson) && current.updatedAt === started.updatedAt && current.lastSyncedAt === started.lastSyncedAt && current.lastCursor === started.lastCursor && current.wordpressPendingUntil === started.wordpressPendingUntil;
+}
+function wordpressBaseUrlIdentity(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  try {
+    const url = new URL(value);
+    url.hash = "";
+    url.search = "";
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+    return url.toString();
+  } catch {
+    return void 0;
+  }
 }
 function bindTrafficSyncSchedule(tx, projectId, sourceId, now, createIfMissing = true) {
   const schedule = tx.select().from(schedules).where(and43(
@@ -68879,6 +68996,10 @@ async function runBackfillTask(options) {
     } catch {
     }
   };
+  if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
+    markFailed("Generic WordPress replace backfill is unavailable because retained coverage is unproven. Use a retention-aware repair that declares the unrecoverable span.");
+    return;
+  }
   let allEvents;
   try {
     allEvents = await pullForBackfill();
@@ -68922,6 +69043,14 @@ async function runBackfillTask(options) {
   try {
     const commitOutcome = app.db.transaction((tx) => {
       const latestSource = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
+      if (latestSource?.sourceType === TrafficSourceTypes.wordpress) {
+        tx.update(runs).set({
+          status: RunStatuses.failed,
+          error: "Generic WordPress replace backfill is unavailable because retained coverage is unproven.",
+          finishedAt
+        }).where(eq50(runs.id, runId)).run();
+        return "wordpress-backfill-unsupported";
+      }
       if (!latestSource || !isAuthoritativeTrafficSource(tx, latestSource) || !isSameTrafficSourceGeneration(latestSource, sourceRow2)) {
         tx.update(runs).set({
           status: RunStatuses.failed,
@@ -69142,7 +69271,7 @@ async function runBackfillTask(options) {
         }).run();
       }
       const recordedSkipMs = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
-      const skipRecovered = Number.isFinite(recordedSkipMs) && windowStart.getTime() <= recordedSkipMs;
+      const skipRecovered = sourceRow2.sourceType !== TrafficSourceTypes.wordpress && Number.isFinite(recordedSkipMs) && windowStart.getTime() <= recordedSkipMs;
       tx.update(trafficSources).set({
         status: TrafficSourceStatuses.connected,
         lastSyncedAt: nextLastSyncedAt,
@@ -69154,7 +69283,7 @@ async function runBackfillTask(options) {
       tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq50(runs.id, runId)).run();
       return "committed";
     });
-    if (commitOutcome === "source-inactive") return;
+    if (commitOutcome === "source-inactive" || commitOutcome === "wordpress-backfill-unsupported") return;
   } catch (e) {
     markFailed(`Backfill rollup write failed: ${describeError(e)}`);
   }
@@ -69402,9 +69531,10 @@ async function trafficRoutes(app, opts) {
     const fallbackName = displayName ?? `WordPress \xB7 ${new URL(baseUrl).host}`;
     const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
       const activeSource = tx.select().from(trafficSources).where(eq50(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
-      const sourceId = activeSource?.id ?? crypto42.randomUUID();
+      const endpointChanged = activeSource !== void 0 && wordpressBaseUrlIdentity(activeSource.configJson.baseUrl) !== wordpressBaseUrlIdentity(baseUrl);
+      const sourceId = endpointChanged ? crypto42.randomUUID() : activeSource?.id ?? crypto42.randomUUID();
       const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
-      if (activeSource) {
+      if (activeSource && !endpointChanged) {
         tx.update(trafficSources).set({
           displayName: fallbackName,
           status: sourceStatus,
@@ -69413,6 +69543,13 @@ async function trafficRoutes(app, opts) {
           updatedAt: now
         }).where(eq50(trafficSources.id, sourceId)).run();
       } else {
+        if (activeSource) {
+          tx.update(trafficSources).set({
+            status: TrafficSourceStatuses.archived,
+            archivedAt: now,
+            updatedAt: now
+          }).where(eq50(trafficSources.id, activeSource.id)).run();
+        }
         tx.insert(trafficSources).values({
           id: sourceId,
           projectId: project.id,
@@ -70018,10 +70155,11 @@ async function trafficRoutes(app, opts) {
   });
   app.post("/projects/:name/traffic/sources/:id/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq50(trafficSources.id, request.params.id)).get();
-    if (!sourceRow2 || sourceRow2.projectId !== project.id) {
+    const initialSourceRow = app.db.select().from(trafficSources).where(eq50(trafficSources.id, request.params.id)).get();
+    if (!initialSourceRow || initialSourceRow.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
+    let sourceRow2 = initialSourceRow;
     const queueConfig = sourceRow2.sourceType === TrafficSourceTypes.cloudflare ? parseQueuePullCloudflareSourceConfig(sourceRow2.configJson) : null;
     if (queueConfig) {
       if (sourceRow2.status !== TrafficSourceStatuses.connected) {
@@ -70047,19 +70185,19 @@ async function trafficRoutes(app, opts) {
       })) {
         throw operationInProgress("Cloudflare Queue source sync is already in progress", { sourceId: sourceRow2.id });
       }
-      const runId2 = crypto42.randomUUID();
-      const startedAt2 = (/* @__PURE__ */ new Date()).toISOString();
+      const runId = crypto42.randomUUID();
+      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
       const startedMs = Date.now();
       try {
         app.db.insert(runs).values({
-          id: runId2,
+          id: runId,
           projectId: project.id,
           kind: RunKinds["traffic-sync"],
           status: RunStatuses.running,
           trigger: RunTriggers.manual,
           sourceId: sourceRow2.id,
-          startedAt: startedAt2,
-          createdAt: startedAt2
+          startedAt,
+          createdAt: startedAt
         }).run();
         let acceptedEvents = 0;
         let selfTrafficExcluded = 0;
@@ -70067,11 +70205,11 @@ async function trafficRoutes(app, opts) {
         let aiUserFetchHits = 0;
         let aiReferralHits = 0;
         let unknownHits = 0;
-        let crawlerBucketRows2 = 0;
-        let aiUserFetchBucketRows2 = 0;
-        let aiReferralBucketRows2 = 0;
-        let sampleRows2 = 0;
-        let committedAt = startedAt2;
+        let crawlerBucketRows = 0;
+        let aiUserFetchBucketRows = 0;
+        let aiReferralBucketRows = 0;
+        let sampleRows = 0;
+        let committedAt = startedAt;
         let remainingBacklogCount = 0;
         const canonicalHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
         for (let batch = 0; batch < cloudflareQueueMaxBatches; batch += 1) {
@@ -70190,14 +70328,14 @@ async function trafficRoutes(app, opts) {
           aiUserFetchHits += writeResult.aiUserFetchHits;
           aiReferralHits += writeResult.aiReferralHits;
           unknownHits += writeResult.unknownHits;
-          crawlerBucketRows2 += writeResult.crawlerBucketRows;
-          aiUserFetchBucketRows2 += writeResult.aiUserFetchBucketRows;
-          aiReferralBucketRows2 += writeResult.aiReferralBucketRows;
-          sampleRows2 += writeResult.sampleRows;
+          crawlerBucketRows += writeResult.crawlerBucketRows;
+          aiUserFetchBucketRows += writeResult.aiUserFetchBucketRows;
+          aiReferralBucketRows += writeResult.aiReferralBucketRows;
+          sampleRows += writeResult.sampleRows;
           const pulledEnvelopeCount = pulled.messages.length + pulled.skippedUnleasedMessageCount;
           if (pulledEnvelopeCount < CLOUDFLARE_QUEUE_BATCH_SIZE || remainingBacklogCount === 0) break;
         }
-        app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: committedAt }).where(eq50(runs.id, runId2)).run();
+        app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: committedAt }).where(eq50(runs.id, runId)).run();
         writeAuditLog(app.db, {
           projectId: project.id,
           actor: "api",
@@ -70219,9 +70357,9 @@ async function trafficRoutes(app, opts) {
           });
         } catch {
         }
-        const response2 = {
+        const response = {
           sourceId: sourceRow2.id,
-          runId: runId2,
+          runId,
           syncedAt: committedAt,
           pulledEvents: acceptedEvents,
           selfTrafficExcluded,
@@ -70229,20 +70367,20 @@ async function trafficRoutes(app, opts) {
           aiUserFetchHits,
           aiReferralHits,
           unknownHits,
-          crawlerBucketRows: crawlerBucketRows2,
-          aiUserFetchBucketRows: aiUserFetchBucketRows2,
-          aiReferralBucketRows: aiReferralBucketRows2,
-          sampleRows: sampleRows2,
+          crawlerBucketRows,
+          aiUserFetchBucketRows,
+          aiReferralBucketRows,
+          sampleRows,
           remainingBacklogCount,
-          windowStart: startedAt2,
+          windowStart: startedAt,
           windowEnd: committedAt
         };
-        return response2;
+        return response;
       } catch (error) {
         const failedAt = (/* @__PURE__ */ new Date()).toISOString();
         const safeError = error instanceof CloudflareQueueApiError ? error.message : "Cloudflare Queue sync failed; retry the active source.";
         app.db.transaction((tx) => {
-          tx.update(runs).set({ status: RunStatuses.failed, error: safeError, finishedAt: failedAt }).where(eq50(runs.id, runId2)).run();
+          tx.update(runs).set({ status: RunStatuses.failed, error: safeError, finishedAt: failedAt }).where(eq50(runs.id, runId)).run();
           const latestSource = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
           if (latestSource && latestSource.status === TrafficSourceStatuses.connected && latestSource.syncLeaseOwner === leaseOwner && isDeepStrictEqual(latestSource.configJson, sourceRow2.configJson)) {
             tx.update(trafficSources).set({ lastError: safeError, updatedAt: failedAt }).where(and43(
@@ -70271,588 +70409,690 @@ async function trafficRoutes(app, opts) {
     if (sourceRow2.status === TrafficSourceStatuses.paused || sourceRow2.status === TrafficSourceStatuses.archived || hasConnectedSibling) {
       throw validationError("Traffic source must be active before it can sync");
     }
-    const windowEnd = /* @__PURE__ */ new Date();
-    const startedAt = windowEnd.toISOString();
-    const syncStartedAtMs = windowEnd.getTime();
-    const runId = crypto42.randomUUID();
-    app.db.insert(runs).values({
-      id: runId,
-      projectId: project.id,
-      kind: RunKinds["traffic-sync"],
-      status: RunStatuses.running,
-      trigger: RunTriggers.manual,
+    const wordpressLeaseOwner = sourceRow2.sourceType === TrafficSourceTypes.wordpress ? crypto42.randomUUID() : void 0;
+    if (wordpressLeaseOwner && !tryClaimTrafficSyncLease({
+      db: app.db,
       sourceId: sourceRow2.id,
-      startedAt,
-      createdAt: startedAt
-    }).run();
-    const markFailed = (msg, errorCode) => {
-      const failedAt = (/* @__PURE__ */ new Date()).toISOString();
-      app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq50(runs.id, runId)).run();
-        const latestSource = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
-        if (latestSource?.status === TrafficSourceStatuses.connected && isDeepStrictEqual(latestSource.configJson, sourceRow2.configJson) && latestSource.updatedAt === sourceRow2.updatedAt && latestSource.lastSyncedAt === sourceRow2.lastSyncedAt) {
-          tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq50(trafficSources.id, sourceRow2.id)).run();
+      owner: wordpressLeaseOwner,
+      now: (/* @__PURE__ */ new Date()).toISOString(),
+      ttlMs: WORDPRESS_SYNC_LEASE_TTL_MS
+    })) {
+      throw operationInProgress("WordPress source sync is already in progress", { sourceId: sourceRow2.id });
+    }
+    try {
+      const syncWindowEnd = /* @__PURE__ */ new Date();
+      let windowEnd = syncWindowEnd;
+      const startedAt = syncWindowEnd.toISOString();
+      const syncStartedAtMs = syncWindowEnd.getTime();
+      const runId = crypto42.randomUUID();
+      app.db.insert(runs).values({
+        id: runId,
+        projectId: project.id,
+        kind: RunKinds["traffic-sync"],
+        status: RunStatuses.running,
+        trigger: RunTriggers.manual,
+        sourceId: sourceRow2.id,
+        startedAt,
+        createdAt: startedAt
+      }).run();
+      const markFailed = (msg, errorCode) => {
+        const failedAt = (/* @__PURE__ */ new Date()).toISOString();
+        app.db.transaction((tx) => {
+          tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq50(runs.id, runId)).run();
+          const latestSource = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
+          if (latestSource?.status === TrafficSourceStatuses.connected && isSameTrafficSourceGeneration(latestSource, sourceRow2) && (wordpressLeaseOwner === void 0 || latestSource.syncLeaseOwner === wordpressLeaseOwner)) {
+            tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq50(trafficSources.id, sourceRow2.id)).run();
+          }
+        });
+        try {
+          opts.onTrafficSynced?.({
+            status: "failed",
+            sourceType: sourceRow2.sourceType,
+            sourceId: sourceRow2.id,
+            pulledEvents: 0,
+            selfTrafficExcluded: 0,
+            crawlerHits: 0,
+            aiUserFetchHits: 0,
+            aiReferralHits: 0,
+            durationMs: Date.now() - syncStartedAtMs,
+            errorCode
+          });
+        } catch {
         }
-      });
-      try {
-        opts.onTrafficSynced?.({
-          status: "failed",
-          sourceType: sourceRow2.sourceType,
+      };
+      const renewWordpressLease = () => {
+        if (!wordpressLeaseOwner) return;
+        if (!tryClaimTrafficSyncLease({
+          db: app.db,
           sourceId: sourceRow2.id,
-          pulledEvents: 0,
-          selfTrafficExcluded: 0,
-          crawlerHits: 0,
-          aiUserFetchHits: 0,
-          aiReferralHits: 0,
-          durationMs: Date.now() - syncStartedAtMs,
-          errorCode
-        });
-      } catch {
-      }
-    };
-    let windowStart;
-    let allEvents;
-    let nextCursor;
-    let auditAction;
-    let effectiveWindowEnd = windowEnd;
-    if (sourceRow2.sourceType === TrafficSourceTypes["cloud-run"]) {
-      auditAction = "traffic.cloud-run.synced";
-      const credentialStore = opts.cloudRunCredentialStore;
-      if (!credentialStore) {
-        throw validationError("Cloud Run credential storage is not configured for this deployment");
-      }
-      const credential = credentialStore.getConnection(project.name);
-      if (!credential) {
-        throw validationError(
-          `No Cloud Run credential found for project "${project.name}". Run "canonry traffic connect cloud-run" first.`
-        );
-      }
-      const config = parseSourceConfig(sourceRow2);
-      const gcpProjectId = config.gcpProjectId ?? credential.gcpProjectId;
-      const serviceName = config.serviceName ?? credential.serviceName ?? void 0;
-      const location = config.location ?? credential.location ?? void 0;
-      const requestedMinutes = request.body?.sinceMinutes;
-      const windowMinutes = Number.isFinite(requestedMinutes) && requestedMinutes && requestedMinutes > 0 ? Math.floor(requestedMinutes) : syncWindowMinutes;
-      const requestedStartMs = windowEnd.getTime() - windowMinutes * 6e4;
-      const lastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
-      windowStart = new Date(
-        Math.min(windowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs))
-      );
-      let accessToken;
-      try {
-        accessToken = await resolveAccessToken2(credential);
-      } catch (e) {
-        const msg = describeError(e);
-        markFailed(msg, "PROVIDER_AUTH");
-        throw providerError(`Failed to resolve Cloud Run access token: ${msg}`);
-      }
-      const isFirstSync = !sourceRow2.lastSyncedAt;
-      try {
-        const page = await pullEvents(accessToken, {
-          gcpProjectId,
-          serviceName,
-          location,
-          startTime: windowStart.toISOString(),
-          endTime: windowEnd.toISOString(),
-          pageSize,
-          maxPages,
-          firstSync: isFirstSync,
-          requestUrlSubstrings: [project.canonicalDomain]
-        });
-        allEvents = page.events;
-      } catch (e) {
-        const msg = describeError(e);
-        markFailed(msg, "PROVIDER_PULL");
-        throw providerError(`Cloud Run pull failed: ${msg}`);
-      }
-    } else if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
-      auditAction = "traffic.wordpress.synced";
-      const credentialStore = opts.wordpressTrafficCredentialStore;
-      if (!credentialStore) {
-        throw validationError("WordPress traffic credential storage is not configured for this deployment");
-      }
-      const credential = credentialStore.getConnection(project.name);
-      if (!credential) {
-        app.db.delete(runs).where(eq50(runs.id, runId)).run();
-        throw validationError(
-          `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
+          owner: wordpressLeaseOwner,
+          now: (/* @__PURE__ */ new Date()).toISOString(),
+          ttlMs: WORDPRESS_SYNC_LEASE_TTL_MS
+        })) {
+          throw new Error("WordPress sync lease was lost");
+        }
+      };
+      let windowStart;
+      let allEvents;
+      let nextCursor;
+      let auditAction;
+      let effectiveWindowEnd = windowEnd;
+      if (sourceRow2.sourceType === TrafficSourceTypes["cloud-run"]) {
+        auditAction = "traffic.cloud-run.synced";
+        const credentialStore = opts.cloudRunCredentialStore;
+        if (!credentialStore) {
+          throw validationError("Cloud Run credential storage is not configured for this deployment");
+        }
+        const credential = credentialStore.getConnection(project.name);
+        if (!credential) {
+          throw validationError(
+            `No Cloud Run credential found for project "${project.name}". Run "canonry traffic connect cloud-run" first.`
+          );
+        }
+        const config = parseSourceConfig(sourceRow2);
+        const gcpProjectId = config.gcpProjectId ?? credential.gcpProjectId;
+        const serviceName = config.serviceName ?? credential.serviceName ?? void 0;
+        const location = config.location ?? credential.location ?? void 0;
+        const requestedMinutes = request.body?.sinceMinutes;
+        const windowMinutes = Number.isFinite(requestedMinutes) && requestedMinutes && requestedMinutes > 0 ? Math.floor(requestedMinutes) : syncWindowMinutes;
+        const requestedStartMs = windowEnd.getTime() - windowMinutes * 6e4;
+        const lastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
+        windowStart = new Date(
+          Math.min(windowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs))
         );
-      }
-      windowStart = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt) : windowEnd;
-      const wpPageSize = opts.defaultWordpressPageSize ?? DEFAULT_WP_PAGE_SIZE;
-      const wpMaxPages = opts.defaultWordpressMaxPages ?? DEFAULT_WP_MAX_PAGES;
-      let pinnedDispatcher;
-      try {
-        pinnedDispatcher = await assertWordpressTargetAllowed(credential.baseUrl);
-      } catch (e) {
-        const msg = describeError(e);
-        markFailed(msg, "PROVIDER_PULL");
-        throw e;
-      }
-      const collected = [];
-      let cursor = sourceRow2.lastCursor ?? void 0;
-      try {
-        for (let page = 0; page < wpMaxPages; page += 1) {
-          const pageResult = await pullWordpressEvents({
-            baseUrl: credential.baseUrl,
-            username: credential.username,
-            applicationPassword: credential.applicationPassword,
-            cursor,
-            pageSize: wpPageSize,
-            maxPages: 1,
-            dispatcher: pinnedDispatcher
+        let accessToken;
+        try {
+          accessToken = await resolveAccessToken2(credential);
+        } catch (e) {
+          const msg = describeError(e);
+          markFailed(msg, "PROVIDER_AUTH");
+          throw providerError(`Failed to resolve Cloud Run access token: ${msg}`);
+        }
+        const isFirstSync = !sourceRow2.lastSyncedAt;
+        try {
+          const page = await pullEvents(accessToken, {
+            gcpProjectId,
+            serviceName,
+            location,
+            startTime: windowStart.toISOString(),
+            endTime: windowEnd.toISOString(),
+            pageSize,
+            maxPages,
+            firstSync: isFirstSync,
+            requestUrlSubstrings: [project.canonicalDomain]
           });
-          collected.push(...pageResult.events);
-          const previousCursor = cursor;
-          cursor = pageResult.nextCursor;
-          if (!pageResult.hasMore) break;
-          if (!cursor || cursor === previousCursor) break;
+          allEvents = page.events;
+        } catch (e) {
+          const msg = describeError(e);
+          markFailed(msg, "PROVIDER_PULL");
+          throw providerError(`Cloud Run pull failed: ${msg}`);
         }
-        allEvents = collected;
-        nextCursor = cursor;
-      } catch (e) {
-        const msg = describeError(e);
-        markFailed(msg, "PROVIDER_PULL");
-        throw providerError(`WordPress pull failed: ${msg}`);
-      } finally {
-        await pinnedDispatcher.close().catch(() => {
-        });
-      }
-    } else {
-      auditAction = "traffic.vercel.synced";
-      const credentialStore = opts.vercelTrafficCredentialStore;
-      if (!credentialStore) {
-        app.db.delete(runs).where(eq50(runs.id, runId)).run();
-        throw validationError("Vercel traffic credential storage is not configured for this deployment");
-      }
-      const credential = credentialStore.getConnection(project.name);
-      if (!credential) {
-        app.db.delete(runs).where(eq50(runs.id, runId)).run();
-        throw validationError(
-          `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
-        );
-      }
-      const config = parseSourceConfig(sourceRow2);
-      const vercelProjectId = config.projectId ?? credential.projectId;
-      const vercelTeamId = config.teamId ?? credential.teamId;
-      const vercelEnvironment = config.environment ?? credential.environment;
-      const requestedMinutes = request.body?.sinceMinutes;
-      const windowMinutes = Number.isFinite(requestedMinutes) && requestedMinutes && requestedMinutes > 0 ? Math.floor(requestedMinutes) : syncWindowMinutes;
-      const requestedStartMs = windowEnd.getTime() - windowMinutes * 6e4;
-      const lastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
-      const clampedStartMs = Math.min(windowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs));
-      const cappedStartMs = Math.max(clampedStartMs, windowEnd.getTime() - VERCEL_MAX_SYNC_WINDOW_MS);
-      if (cappedStartMs > clampedStartMs) {
-        const previousSkip = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
-        const skippedThrough = Number.isFinite(previousSkip) ? new Date(Math.max(previousSkip, cappedStartMs)) : new Date(cappedStartMs);
-        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq50(trafficSources.id, sourceRow2.id)).run();
-        request.log.warn(
-          {
-            sourceId: sourceRow2.id,
-            requestedStart: new Date(clampedStartMs).toISOString(),
-            cappedStart: new Date(cappedStartMs).toISOString()
-          },
-          "Vercel sync window exceeded the max single-sync span; clamped the start forward (older traffic skipped \u2014 run a backfill to recover it)"
-        );
-      }
-      windowStart = new Date(cappedStartMs);
-      try {
-        const drained = await drainVercelTrafficEvents({
-          pull: pullVercelEvents,
-          token: credential.token,
-          projectId: vercelProjectId,
-          teamId: vercelTeamId,
-          environment: vercelEnvironment,
-          startDate: windowStart.getTime(),
-          endDate: windowEnd.getTime(),
-          pagesPerSubWindow: vercelMaxPages,
-          maxSubWindows: VERCEL_MAX_SUB_WINDOWS,
-          // Bound the drain's wall-clock so a dense/slow window can't run for
-          // many minutes. On hit the drain stops and reports how far it got.
-          deadlineMs: syncStartedAtMs + vercelSyncDeadlineMs
-        });
-        if (drained.retentionClamped) {
-          throw vercelRetentionClampError(windowStart.getTime(), drained.effectiveStartMs);
+      } else if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
+        auditAction = "traffic.wordpress.synced";
+        const credentialStore = opts.wordpressTrafficCredentialStore;
+        if (!credentialStore) {
+          throw validationError("WordPress traffic credential storage is not configured for this deployment");
         }
-        if (drained.deadlineReached) {
-          if (drained.drainedThroughMs <= windowStart.getTime()) {
-            throw new Error(
-              `sync exceeded its ${vercelSyncDeadlineMs}ms drain budget without completing any sub-window (request-logs slow or unavailable)`
-            );
+        const credential = credentialStore.getConnection(project.name);
+        if (!credential) {
+          app.db.delete(runs).where(eq50(runs.id, runId)).run();
+          throw validationError(
+            `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
+          );
+        }
+        if (sourceRow2.lastCursor && !sourceRow2.wordpressPendingUntil) {
+          const message = "WordPress source has a legacy continuation cursor without a bounded pending window. Reset it explicitly before resuming sync.";
+          markFailed(message, "INTERNAL");
+          throw validationError(message);
+        }
+        if (sourceRow2.wordpressPendingUntil) {
+          const pendingStartMs = sourceRow2.lastSyncedAt ? Date.parse(sourceRow2.lastSyncedAt) : Number.NaN;
+          const pendingEndMs = Date.parse(sourceRow2.wordpressPendingUntil);
+          if (!Number.isFinite(pendingStartMs) || !Number.isFinite(pendingEndMs) || pendingStartMs >= pendingEndMs || pendingEndMs > syncWindowEnd.getTime()) {
+            const message = "WordPress source has an invalid pending sync window. Reset it explicitly before resuming sync.";
+            markFailed(message, "INTERNAL");
+            throw validationError(message);
           }
-          effectiveWindowEnd = new Date(drained.drainedThroughMs);
-          request.log.warn(
-            {
-              sourceId: sourceRow2.id,
-              drainedThrough: effectiveWindowEnd.toISOString(),
-              requestedEnd: windowEnd.toISOString(),
-              subWindows: drained.subWindowCount
-            },
-            "Vercel drain hit its time budget; committing the partial window and advancing to it \u2014 next sync resumes from here"
+          windowStart = new Date(pendingStartMs);
+          windowEnd = new Date(pendingEndMs);
+          effectiveWindowEnd = windowEnd;
+        } else {
+          const requestedMinutes = request.body?.sinceMinutes;
+          const hasExplicitWindow = Number.isFinite(requestedMinutes) && requestedMinutes !== void 0 && requestedMinutes > 0;
+          const windowMinutes = hasExplicitWindow ? Math.floor(requestedMinutes) : DEFAULT_WP_SYNC_WINDOW_MINUTES;
+          const requestedStartMs = syncWindowEnd.getTime() - windowMinutes * 6e4;
+          const lastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
+          windowStart = new Date(
+            Math.min(syncWindowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs))
           );
+          const windowStartIso2 = windowStart.toISOString();
+          const windowEndIso2 = windowEnd.toISOString();
+          const reservedAt = (/* @__PURE__ */ new Date()).toISOString();
+          const reservedSource = app.db.transaction((tx) => {
+            const latestSource = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
+            if (!latestSource || !isAuthoritativeTrafficSource(tx, latestSource) || !isSameTrafficSourceGeneration(latestSource, sourceRow2) || latestSource.syncLeaseOwner !== wordpressLeaseOwner || latestSource.lastCursor || latestSource.wordpressPendingUntil) return void 0;
+            tx.update(trafficSources).set({
+              lastSyncedAt: windowStartIso2,
+              wordpressPendingUntil: windowEndIso2,
+              updatedAt: reservedAt
+            }).where(eq50(trafficSources.id, sourceRow2.id)).run();
+            return tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
+          }, { behavior: "immediate" });
+          if (!reservedSource) {
+            const message = "Traffic source changed while reserving the WordPress sync window; retry the sync.";
+            markFailed(message, "INTERNAL");
+            throw validationError(message);
+          }
+          sourceRow2 = reservedSource;
         }
-        if (drained.truncatedSliceCount > 0) {
-          request.log.warn(
-            {
-              sourceId: sourceRow2.id,
-              truncatedSlices: drained.truncatedSliceCount,
-              sliceStarts: drained.truncatedSliceStartsMs.map((ms) => new Date(ms).toISOString())
-            },
-            "Vercel drain truncated dense one-second slice(s); ingested a sample and advanced past them"
+        const windowStartIso = windowStart.toISOString();
+        const windowEndIso = windowEnd.toISOString();
+        const wpPageSize = opts.defaultWordpressPageSize ?? DEFAULT_WP_PAGE_SIZE;
+        const wpMaxPages = opts.defaultWordpressMaxPages ?? DEFAULT_WP_MAX_PAGES;
+        let pinnedDispatcher;
+        try {
+          renewWordpressLease();
+          pinnedDispatcher = await assertWordpressTargetAllowed(credential.baseUrl);
+        } catch (e) {
+          const msg = describeError(e);
+          markFailed(msg, "PROVIDER_PULL");
+          throw e;
+        }
+        const collected = [];
+        let cursor = sourceRow2.lastCursor ?? void 0;
+        try {
+          for (let page = 0; page < wpMaxPages; page += 1) {
+            renewWordpressLease();
+            const pageResult = await pullWordpressEvents({
+              baseUrl: credential.baseUrl,
+              username: credential.username,
+              applicationPassword: credential.applicationPassword,
+              cursor,
+              pageSize: wpPageSize,
+              maxPages: 1,
+              since: windowStartIso,
+              until: windowEndIso,
+              dispatcher: pinnedDispatcher
+            });
+            collected.push(...pageResult.events);
+            const previousCursor = cursor;
+            cursor = pageResult.nextCursor;
+            if (!pageResult.hasMore) {
+              cursor = void 0;
+              break;
+            }
+            if (!cursor || cursor === previousCursor) {
+              throw new Error("WordPress traffic endpoint returned has_more without a new continuation cursor");
+            }
+          }
+          allEvents = collected;
+          nextCursor = cursor;
+        } catch (e) {
+          const msg = describeError(e);
+          markFailed(msg, "PROVIDER_PULL");
+          throw providerError(`WordPress pull failed: ${msg}`);
+        } finally {
+          await pinnedDispatcher.close().catch(() => {
+          });
+        }
+      } else {
+        auditAction = "traffic.vercel.synced";
+        const credentialStore = opts.vercelTrafficCredentialStore;
+        if (!credentialStore) {
+          app.db.delete(runs).where(eq50(runs.id, runId)).run();
+          throw validationError("Vercel traffic credential storage is not configured for this deployment");
+        }
+        const credential = credentialStore.getConnection(project.name);
+        if (!credential) {
+          app.db.delete(runs).where(eq50(runs.id, runId)).run();
+          throw validationError(
+            `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
           );
         }
-        if (drained.deadlineSkippedSliceCount > 0) {
+        const config = parseSourceConfig(sourceRow2);
+        const vercelProjectId = config.projectId ?? credential.projectId;
+        const vercelTeamId = config.teamId ?? credential.teamId;
+        const vercelEnvironment = config.environment ?? credential.environment;
+        const requestedMinutes = request.body?.sinceMinutes;
+        const windowMinutes = Number.isFinite(requestedMinutes) && requestedMinutes && requestedMinutes > 0 ? Math.floor(requestedMinutes) : syncWindowMinutes;
+        const requestedStartMs = windowEnd.getTime() - windowMinutes * 6e4;
+        const lastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
+        const clampedStartMs = Math.min(windowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs));
+        const cappedStartMs = Math.max(clampedStartMs, windowEnd.getTime() - VERCEL_MAX_SYNC_WINDOW_MS);
+        if (cappedStartMs > clampedStartMs) {
+          const previousSkip = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
+          const skippedThrough = Number.isFinite(previousSkip) ? new Date(Math.max(previousSkip, cappedStartMs)) : new Date(cappedStartMs);
+          app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq50(trafficSources.id, sourceRow2.id)).run();
           request.log.warn(
             {
               sourceId: sourceRow2.id,
-              skippedSlices: drained.deadlineSkippedSliceCount,
-              sliceStarts: drained.deadlineSkippedSliceStartsMs.map((ms) => new Date(ms).toISOString())
+              requestedStart: new Date(clampedStartMs).toISOString(),
+              cappedStart: new Date(cappedStartMs).toISOString()
             },
-            "Vercel drain could not narrow a dense/slow head slice within its budget; skipped past it to guarantee progress"
+            "Vercel sync window exceeded the max single-sync span; clamped the start forward (older traffic skipped \u2014 run a backfill to recover it)"
           );
         }
-        allEvents = drained.events;
+        windowStart = new Date(cappedStartMs);
+        try {
+          const drained = await drainVercelTrafficEvents({
+            pull: pullVercelEvents,
+            token: credential.token,
+            projectId: vercelProjectId,
+            teamId: vercelTeamId,
+            environment: vercelEnvironment,
+            startDate: windowStart.getTime(),
+            endDate: windowEnd.getTime(),
+            pagesPerSubWindow: vercelMaxPages,
+            maxSubWindows: VERCEL_MAX_SUB_WINDOWS,
+            // Bound the drain's wall-clock so a dense/slow window can't run for
+            // many minutes. On hit the drain stops and reports how far it got.
+            deadlineMs: syncStartedAtMs + vercelSyncDeadlineMs
+          });
+          if (drained.retentionClamped) {
+            throw vercelRetentionClampError(windowStart.getTime(), drained.effectiveStartMs);
+          }
+          if (drained.deadlineReached) {
+            if (drained.drainedThroughMs <= windowStart.getTime()) {
+              throw new Error(
+                `sync exceeded its ${vercelSyncDeadlineMs}ms drain budget without completing any sub-window (request-logs slow or unavailable)`
+              );
+            }
+            effectiveWindowEnd = new Date(drained.drainedThroughMs);
+            request.log.warn(
+              {
+                sourceId: sourceRow2.id,
+                drainedThrough: effectiveWindowEnd.toISOString(),
+                requestedEnd: windowEnd.toISOString(),
+                subWindows: drained.subWindowCount
+              },
+              "Vercel drain hit its time budget; committing the partial window and advancing to it \u2014 next sync resumes from here"
+            );
+          }
+          if (drained.truncatedSliceCount > 0) {
+            request.log.warn(
+              {
+                sourceId: sourceRow2.id,
+                truncatedSlices: drained.truncatedSliceCount,
+                sliceStarts: drained.truncatedSliceStartsMs.map((ms) => new Date(ms).toISOString())
+              },
+              "Vercel drain truncated dense one-second slice(s); ingested a sample and advanced past them"
+            );
+          }
+          if (drained.deadlineSkippedSliceCount > 0) {
+            request.log.warn(
+              {
+                sourceId: sourceRow2.id,
+                skippedSlices: drained.deadlineSkippedSliceCount,
+                sliceStarts: drained.deadlineSkippedSliceStartsMs.map((ms) => new Date(ms).toISOString())
+              },
+              "Vercel drain could not narrow a dense/slow head slice within its budget; skipped past it to guarantee progress"
+            );
+          }
+          allEvents = drained.events;
+        } catch (e) {
+          const msg = describeError(e);
+          markFailed(msg, "PROVIDER_PULL");
+          throw providerError(`Vercel pull failed: ${msg}`);
+        }
+      }
+      let crawlerBucketRows = 0;
+      let aiUserFetchBucketRows = 0;
+      let aiReferralBucketRows = 0;
+      let sampleRows = 0;
+      let finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let pulledEventsCount = 0;
+      let selfTrafficExcludedCount = 0;
+      let crawlerHitsCount = 0;
+      let aiUserFetchHitsCount = 0;
+      let aiReferralHitsCount = 0;
+      let unknownHitsCount = 0;
+      try {
+        renewWordpressLease();
       } catch (e) {
         const msg = describeError(e);
-        markFailed(msg, "PROVIDER_PULL");
-        throw providerError(`Vercel pull failed: ${msg}`);
-      }
-    }
-    let crawlerBucketRows = 0;
-    let aiUserFetchBucketRows = 0;
-    let aiReferralBucketRows = 0;
-    let sampleRows = 0;
-    let finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-    let pulledEventsCount = 0;
-    let selfTrafficExcludedCount = 0;
-    let crawlerHitsCount = 0;
-    let aiUserFetchHitsCount = 0;
-    let aiReferralHitsCount = 0;
-    let unknownHitsCount = 0;
-    const commitOutcome = app.db.transaction((tx) => {
-      const latestRow = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
-      const latestHasConnectedSibling = tx.select().from(trafficSources).where(eq50(trafficSources.projectId, project.id)).all().some((row) => row.id !== sourceRow2.id && row.status === TrafficSourceStatuses.connected);
-      if (!latestRow || latestRow.status !== TrafficSourceStatuses.connected && latestRow.status !== TrafficSourceStatuses.error || latestHasConnectedSibling || !isDeepStrictEqual(latestRow.configJson, sourceRow2.configJson) || latestRow.updatedAt !== sourceRow2.updatedAt || latestRow.lastSyncedAt !== sourceRow2.lastSyncedAt) {
-        const abortedAt = (/* @__PURE__ */ new Date()).toISOString();
-        tx.update(runs).set({
-          status: RunStatuses.failed,
-          error: "Traffic source was deactivated or reconfigured during sync",
-          finishedAt: abortedAt
-        }).where(eq50(runs.id, runId)).run();
-        return "source-inactive";
-      }
-      const previousIds = latestRow.lastEventIds ?? [];
-      const seenEventIds = new Set(previousIds);
-      const dedupedEvents = seenEventIds.size === 0 ? allEvents : allEvents.filter((e) => !seenEventIds.has(e.eventId));
-      const newSorted = dedupedEvents.filter((e) => !isSelfTraffic(e)).sort((a, b) => a.observedAt < b.observedAt ? 1 : a.observedAt > b.observedAt ? -1 : 0).map((e) => e.eventId);
-      const merged = [];
-      const mergedSet = /* @__PURE__ */ new Set();
-      for (const id of [...newSorted, ...previousIds]) {
-        if (mergedSet.has(id)) continue;
-        mergedSet.add(id);
-        merged.push(id);
-        if (merged.length >= MAX_TRACKED_EVENT_IDS) break;
-      }
-      const nextEventIds = merged;
-      const report = buildTrafficProbeReport(dedupedEvents, { sampleLimit });
-      finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const rawSampleCutoff = enforceRawEventSampleRetention(
-        tx,
-        sourceRow2.id,
-        finishedAt
-      );
-      pulledEventsCount = report.totals.normalizedEvents;
-      selfTrafficExcludedCount = report.totals.selfTrafficExcluded;
-      crawlerHitsCount = report.totals.crawlerHits;
-      aiUserFetchHitsCount = report.totals.aiUserFetchHits;
-      aiReferralHitsCount = report.totals.aiReferralHits;
-      unknownHitsCount = report.totals.unknownHits;
-      for (const bucket of report.crawlerEventsHourly) {
-        const status = bucket.status ?? 0;
-        tx.insert(crawlerEventsHourly).values({
-          projectId: project.id,
-          sourceId: sourceRow2.id,
-          tsHour: bucket.tsHour,
-          botId: bucket.botId,
-          operator: bucket.operator,
-          verificationStatus: bucket.verificationStatus,
-          pathNormalized: bucket.pathNormalized,
-          status,
-          hits: bucket.hits,
-          sampledUserAgent: bucket.sampledUserAgent,
-          createdAt: finishedAt,
-          updatedAt: finishedAt
-        }).onConflictDoUpdate({
-          target: [
-            crawlerEventsHourly.projectId,
-            crawlerEventsHourly.sourceId,
-            crawlerEventsHourly.tsHour,
-            crawlerEventsHourly.botId,
-            crawlerEventsHourly.verificationStatus,
-            crawlerEventsHourly.pathNormalized,
-            crawlerEventsHourly.status
-          ],
-          set: {
-            hits: sql22`${crawlerEventsHourly.hits} + ${bucket.hits}`,
-            sampledUserAgent: bucket.sampledUserAgent,
-            updatedAt: finishedAt
-          }
-        }).run();
-        if (bucket.verificationManifest) {
-          tx.insert(crawlerVerificationManifestsHourly).values({
+        markFailed(msg, "INTERNAL");
+        throw providerError(`WordPress sync failed: ${msg}`);
+      }
+      const commitOutcome = app.db.transaction((tx) => {
+        const latestRow = tx.select().from(trafficSources).where(eq50(trafficSources.id, sourceRow2.id)).get();
+        const latestHasConnectedSibling = tx.select().from(trafficSources).where(eq50(trafficSources.projectId, project.id)).all().some((row) => row.id !== sourceRow2.id && row.status === TrafficSourceStatuses.connected);
+        if (!latestRow || latestRow.status !== TrafficSourceStatuses.connected && latestRow.status !== TrafficSourceStatuses.error || latestHasConnectedSibling || wordpressLeaseOwner !== void 0 && latestRow.syncLeaseOwner !== wordpressLeaseOwner || !isSameTrafficSourceGeneration(latestRow, sourceRow2)) {
+          const abortedAt = (/* @__PURE__ */ new Date()).toISOString();
+          tx.update(runs).set({
+            status: RunStatuses.failed,
+            error: "Traffic source was deactivated or reconfigured during sync",
+            finishedAt: abortedAt
+          }).where(eq50(runs.id, runId)).run();
+          return "source-inactive";
+        }
+        const previousIds = latestRow.lastEventIds ?? [];
+        const seenEventIds = new Set(previousIds);
+        const dedupedEvents = seenEventIds.size === 0 ? allEvents : allEvents.filter((e) => !seenEventIds.has(e.eventId));
+        const newSorted = dedupedEvents.filter((e) => !isSelfTraffic(e)).sort((a, b) => a.observedAt < b.observedAt ? 1 : a.observedAt > b.observedAt ? -1 : 0).map((e) => e.eventId);
+        const merged = [];
+        const mergedSet = /* @__PURE__ */ new Set();
+        for (const id of [...newSorted, ...previousIds]) {
+          if (mergedSet.has(id)) continue;
+          mergedSet.add(id);
+          merged.push(id);
+          if (merged.length >= MAX_TRACKED_EVENT_IDS) break;
+        }
+        const nextEventIds = merged;
+        const report = buildTrafficProbeReport(dedupedEvents, { sampleLimit });
+        finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const rawSampleCutoff = enforceRawEventSampleRetention(
+          tx,
+          sourceRow2.id,
+          finishedAt
+        );
+        pulledEventsCount = report.totals.normalizedEvents;
+        selfTrafficExcludedCount = report.totals.selfTrafficExcluded;
+        crawlerHitsCount = report.totals.crawlerHits;
+        aiUserFetchHitsCount = report.totals.aiUserFetchHits;
+        aiReferralHitsCount = report.totals.aiReferralHits;
+        unknownHitsCount = report.totals.unknownHits;
+        for (const bucket of report.crawlerEventsHourly) {
+          const status = bucket.status ?? 0;
+          tx.insert(crawlerEventsHourly).values({
             projectId: project.id,
             sourceId: sourceRow2.id,
             tsHour: bucket.tsHour,
             botId: bucket.botId,
+            operator: bucket.operator,
             verificationStatus: bucket.verificationStatus,
             pathNormalized: bucket.pathNormalized,
             status,
-            manifestId: bucket.verificationManifest.id,
-            manifestJson: bucket.verificationManifest,
             hits: bucket.hits,
+            sampledUserAgent: bucket.sampledUserAgent,
             createdAt: finishedAt,
             updatedAt: finishedAt
           }).onConflictDoUpdate({
             target: [
-              crawlerVerificationManifestsHourly.projectId,
-              crawlerVerificationManifestsHourly.sourceId,
-              crawlerVerificationManifestsHourly.tsHour,
-              crawlerVerificationManifestsHourly.botId,
-              crawlerVerificationManifestsHourly.verificationStatus,
-              crawlerVerificationManifestsHourly.pathNormalized,
-              crawlerVerificationManifestsHourly.status,
-              crawlerVerificationManifestsHourly.manifestId
+              crawlerEventsHourly.projectId,
+              crawlerEventsHourly.sourceId,
+              crawlerEventsHourly.tsHour,
+              crawlerEventsHourly.botId,
+              crawlerEventsHourly.verificationStatus,
+              crawlerEventsHourly.pathNormalized,
+              crawlerEventsHourly.status
             ],
             set: {
-              hits: sql22`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
-              manifestJson: bucket.verificationManifest,
+              hits: sql22`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+              sampledUserAgent: bucket.sampledUserAgent,
               updatedAt: finishedAt
             }
           }).run();
-        }
-        crawlerBucketRows += 1;
-      }
-      for (const bucket of report.aiUserFetchEventsHourly) {
-        const status = bucket.status ?? 0;
-        tx.insert(aiUserFetchEventsHourly).values({
-          projectId: project.id,
-          sourceId: sourceRow2.id,
-          tsHour: bucket.tsHour,
-          botId: bucket.botId,
-          operator: bucket.operator,
-          verificationStatus: bucket.verificationStatus,
-          pathNormalized: bucket.pathNormalized,
-          status,
-          hits: bucket.hits,
-          sampledUserAgent: bucket.sampledUserAgent,
-          createdAt: finishedAt,
-          updatedAt: finishedAt
-        }).onConflictDoUpdate({
-          target: [
-            aiUserFetchEventsHourly.projectId,
-            aiUserFetchEventsHourly.sourceId,
-            aiUserFetchEventsHourly.tsHour,
-            aiUserFetchEventsHourly.botId,
-            aiUserFetchEventsHourly.verificationStatus,
-            aiUserFetchEventsHourly.pathNormalized,
-            aiUserFetchEventsHourly.status
-          ],
-          set: {
-            hits: sql22`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
-            sampledUserAgent: bucket.sampledUserAgent,
-            updatedAt: finishedAt
+          if (bucket.verificationManifest) {
+            tx.insert(crawlerVerificationManifestsHourly).values({
+              projectId: project.id,
+              sourceId: sourceRow2.id,
+              tsHour: bucket.tsHour,
+              botId: bucket.botId,
+              verificationStatus: bucket.verificationStatus,
+              pathNormalized: bucket.pathNormalized,
+              status,
+              manifestId: bucket.verificationManifest.id,
+              manifestJson: bucket.verificationManifest,
+              hits: bucket.hits,
+              createdAt: finishedAt,
+              updatedAt: finishedAt
+            }).onConflictDoUpdate({
+              target: [
+                crawlerVerificationManifestsHourly.projectId,
+                crawlerVerificationManifestsHourly.sourceId,
+                crawlerVerificationManifestsHourly.tsHour,
+                crawlerVerificationManifestsHourly.botId,
+                crawlerVerificationManifestsHourly.verificationStatus,
+                crawlerVerificationManifestsHourly.pathNormalized,
+                crawlerVerificationManifestsHourly.status,
+                crawlerVerificationManifestsHourly.manifestId
+              ],
+              set: {
+                hits: sql22`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+                manifestJson: bucket.verificationManifest,
+                updatedAt: finishedAt
+              }
+            }).run();
           }
-        }).run();
-        if (bucket.verificationManifest) {
-          tx.insert(aiUserFetchVerificationManifestsHourly).values({
+          crawlerBucketRows += 1;
+        }
+        for (const bucket of report.aiUserFetchEventsHourly) {
+          const status = bucket.status ?? 0;
+          tx.insert(aiUserFetchEventsHourly).values({
             projectId: project.id,
             sourceId: sourceRow2.id,
             tsHour: bucket.tsHour,
             botId: bucket.botId,
+            operator: bucket.operator,
             verificationStatus: bucket.verificationStatus,
             pathNormalized: bucket.pathNormalized,
             status,
-            manifestId: bucket.verificationManifest.id,
-            manifestJson: bucket.verificationManifest,
             hits: bucket.hits,
+            sampledUserAgent: bucket.sampledUserAgent,
             createdAt: finishedAt,
             updatedAt: finishedAt
           }).onConflictDoUpdate({
             target: [
-              aiUserFetchVerificationManifestsHourly.projectId,
-              aiUserFetchVerificationManifestsHourly.sourceId,
-              aiUserFetchVerificationManifestsHourly.tsHour,
-              aiUserFetchVerificationManifestsHourly.botId,
-              aiUserFetchVerificationManifestsHourly.verificationStatus,
-              aiUserFetchVerificationManifestsHourly.pathNormalized,
-              aiUserFetchVerificationManifestsHourly.status,
-              aiUserFetchVerificationManifestsHourly.manifestId
+              aiUserFetchEventsHourly.projectId,
+              aiUserFetchEventsHourly.sourceId,
+              aiUserFetchEventsHourly.tsHour,
+              aiUserFetchEventsHourly.botId,
+              aiUserFetchEventsHourly.verificationStatus,
+              aiUserFetchEventsHourly.pathNormalized,
+              aiUserFetchEventsHourly.status
             ],
             set: {
-              hits: sql22`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              hits: sql22`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+              sampledUserAgent: bucket.sampledUserAgent,
+              updatedAt: finishedAt
+            }
+          }).run();
+          if (bucket.verificationManifest) {
+            tx.insert(aiUserFetchVerificationManifestsHourly).values({
+              projectId: project.id,
+              sourceId: sourceRow2.id,
+              tsHour: bucket.tsHour,
+              botId: bucket.botId,
+              verificationStatus: bucket.verificationStatus,
+              pathNormalized: bucket.pathNormalized,
+              status,
+              manifestId: bucket.verificationManifest.id,
               manifestJson: bucket.verificationManifest,
+              hits: bucket.hits,
+              createdAt: finishedAt,
+              updatedAt: finishedAt
+            }).onConflictDoUpdate({
+              target: [
+                aiUserFetchVerificationManifestsHourly.projectId,
+                aiUserFetchVerificationManifestsHourly.sourceId,
+                aiUserFetchVerificationManifestsHourly.tsHour,
+                aiUserFetchVerificationManifestsHourly.botId,
+                aiUserFetchVerificationManifestsHourly.verificationStatus,
+                aiUserFetchVerificationManifestsHourly.pathNormalized,
+                aiUserFetchVerificationManifestsHourly.status,
+                aiUserFetchVerificationManifestsHourly.manifestId
+              ],
+              set: {
+                hits: sql22`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+                manifestJson: bucket.verificationManifest,
+                updatedAt: finishedAt
+              }
+            }).run();
+          }
+          aiUserFetchBucketRows += 1;
+        }
+        for (const bucket of report.aiReferralEventsHourly) {
+          const status = bucket.status ?? 0;
+          tx.insert(aiReferralEventsHourly).values({
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            tsHour: bucket.tsHour,
+            product: bucket.product,
+            operator: bucket.operator,
+            sourceDomain: bucket.sourceDomain,
+            evidenceType: bucket.evidenceType,
+            landingPathNormalized: bucket.landingPathNormalized,
+            status,
+            sessionsOrHits: bucket.hits,
+            paidSessionsOrHits: bucket.paidHits,
+            organicSessionsOrHits: bucket.organicHits,
+            usersEstimated: null,
+            createdAt: finishedAt,
+            updatedAt: finishedAt
+          }).onConflictDoUpdate({
+            target: [
+              aiReferralEventsHourly.projectId,
+              aiReferralEventsHourly.sourceId,
+              aiReferralEventsHourly.tsHour,
+              aiReferralEventsHourly.product,
+              aiReferralEventsHourly.sourceDomain,
+              aiReferralEventsHourly.evidenceType,
+              aiReferralEventsHourly.landingPathNormalized,
+              aiReferralEventsHourly.status
+            ],
+            // All three counters accumulate. The class splits the measure, so a
+            // colliding bucket adds its paid and organic arrivals to the ones
+            // already there rather than overwriting a single label.
+            set: {
+              sessionsOrHits: sql22`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+              paidSessionsOrHits: sql22`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+              organicSessionsOrHits: sql22`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
               updatedAt: finishedAt
             }
           }).run();
+          aiReferralBucketRows += 1;
         }
-        aiUserFetchBucketRows += 1;
-      }
-      for (const bucket of report.aiReferralEventsHourly) {
-        const status = bucket.status ?? 0;
-        tx.insert(aiReferralEventsHourly).values({
-          projectId: project.id,
-          sourceId: sourceRow2.id,
-          tsHour: bucket.tsHour,
-          product: bucket.product,
-          operator: bucket.operator,
-          sourceDomain: bucket.sourceDomain,
-          evidenceType: bucket.evidenceType,
-          landingPathNormalized: bucket.landingPathNormalized,
-          status,
-          sessionsOrHits: bucket.hits,
-          paidSessionsOrHits: bucket.paidHits,
-          organicSessionsOrHits: bucket.organicHits,
-          usersEstimated: null,
-          createdAt: finishedAt,
+        for (const sample of report.samples) {
+          const sampleTimestamp = retainedRawEventSampleTimestamp(sample.observedAt, rawSampleCutoff);
+          if (!sampleTimestamp) continue;
+          const eventType = sample.crawler ? "crawler" : sample.aiUserFetch ? "ai_user_fetch" : sample.aiReferral ? "ai_referral" : "unknown";
+          const refererHost = (() => {
+            if (!sample.referer) return null;
+            try {
+              return new URL(sample.referer).hostname;
+            } catch {
+              return null;
+            }
+          })();
+          tx.insert(rawEventSamples).values({
+            id: crypto42.randomUUID(),
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            ts: sampleTimestamp,
+            eventType,
+            ipHash: null,
+            userAgent: sample.userAgent,
+            pathNormalized: sample.pathNormalized,
+            status: sample.status,
+            refererHost,
+            classifierDetailsJson: {
+              crawler: sample.crawler,
+              aiUserFetch: sample.aiUserFetch,
+              aiReferral: sample.aiReferral
+            },
+            createdAt: finishedAt
+          }).run();
+          sampleRows += 1;
+        }
+        const nextWatermark = sourceRow2.sourceType === TrafficSourceTypes.wordpress && nextCursor ? windowStart : effectiveWindowEnd;
+        const sourceUpdate = {
+          status: TrafficSourceStatuses.connected,
+          // Advance to nextWatermark, not finishedAt — events arriving at the
+          // source between the window end and finishedAt aren't in this pull's
+          // range. If we stored finishedAt, the next sync's clamp would skip past
+          // them and they'd be lost. A capped WordPress drain retains its lower
+          // bound; full pulls use effectiveWindowEnd, including a partial Vercel
+          // boundary, so the next sync resumes exactly where this one left off.
+          //
+          // Never move the watermark BACKWARD. A sync already in flight when the
+          // cursor is advanced out from under it (an operator reset, or a backfill
+          // committing a later window) would otherwise commit its own older
+          // window end and undo that advance — the source silently resumes from
+          // the past and re-walks ground that was deliberately skipped. Backfill
+          // has always guarded this; the incremental path did not, so a reset only
+          // stuck if you first disabled the schedule and drained the in-flight run.
+          lastSyncedAt: new Date(
+            Math.max(
+              latestRow.lastSyncedAt ? new Date(latestRow.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY,
+              nextWatermark.getTime()
+            )
+          ).toISOString(),
+          lastError: null,
+          lastEventIds: nextEventIds,
           updatedAt: finishedAt
-        }).onConflictDoUpdate({
-          target: [
-            aiReferralEventsHourly.projectId,
-            aiReferralEventsHourly.sourceId,
-            aiReferralEventsHourly.tsHour,
-            aiReferralEventsHourly.product,
-            aiReferralEventsHourly.sourceDomain,
-            aiReferralEventsHourly.evidenceType,
-            aiReferralEventsHourly.landingPathNormalized,
-            aiReferralEventsHourly.status
-          ],
-          // All three counters accumulate. The class splits the measure, so a
-          // colliding bucket adds its paid and organic arrivals to the ones
-          // already there rather than overwriting a single label.
-          set: {
-            sessionsOrHits: sql22`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
-            paidSessionsOrHits: sql22`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
-            organicSessionsOrHits: sql22`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
-            updatedAt: finishedAt
-          }
-        }).run();
-        aiReferralBucketRows += 1;
+        };
+        if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
+          sourceUpdate.lastCursor = nextCursor ?? null;
+          sourceUpdate.wordpressPendingUntil = nextCursor ? windowEnd.toISOString() : null;
+        }
+        tx.update(trafficSources).set(sourceUpdate).where(eq50(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq50(runs.id, runId)).run();
+        return "committed";
+      }, { behavior: "immediate" });
+      if (commitOutcome === "source-inactive") {
+        throw validationError("Traffic source is no longer active; discarded the in-flight sync");
       }
-      for (const sample of report.samples) {
-        const sampleTimestamp = retainedRawEventSampleTimestamp(sample.observedAt, rawSampleCutoff);
-        if (!sampleTimestamp) continue;
-        const eventType = sample.crawler ? "crawler" : sample.aiUserFetch ? "ai_user_fetch" : sample.aiReferral ? "ai_referral" : "unknown";
-        const refererHost = (() => {
-          if (!sample.referer) return null;
-          try {
-            return new URL(sample.referer).hostname;
-          } catch {
-            return null;
-          }
-        })();
-        tx.insert(rawEventSamples).values({
-          id: crypto42.randomUUID(),
-          projectId: project.id,
-          sourceId: sourceRow2.id,
-          ts: sampleTimestamp,
-          eventType,
-          ipHash: null,
-          userAgent: sample.userAgent,
-          pathNormalized: sample.pathNormalized,
-          status: sample.status,
-          refererHost,
-          classifierDetailsJson: {
-            crawler: sample.crawler,
-            aiUserFetch: sample.aiUserFetch,
-            aiReferral: sample.aiReferral
-          },
-          createdAt: finishedAt
-        }).run();
-        sampleRows += 1;
+      writeAuditLog(app.db, {
+        projectId: project.id,
+        actor: "api",
+        action: auditAction,
+        entityType: "traffic_source",
+        entityId: sourceRow2.id
+      });
+      if (selfTrafficExcludedCount > 0) {
+        request.log.info(
+          { sourceId: sourceRow2.id, selfTrafficExcluded: selfTrafficExcludedCount },
+          "Dropped Canonry self-traffic before rollup; excluded from pulledEvents"
+        );
       }
-      const sourceUpdate = {
-        status: TrafficSourceStatuses.connected,
-        // Advance to effectiveWindowEnd, not finishedAt — events arriving at the
-        // source between the window end and finishedAt aren't in this pull's
-        // range. If we stored finishedAt, the next sync's clamp would skip past
-        // them and they'd be lost. effectiveWindowEnd equals windowEnd on a full
-        // sync; for a Vercel drain that stopped at its deadline it is the partial
-        // boundary, so the next sync resumes exactly where this one left off.
-        //
-        // Never move the watermark BACKWARD. A sync already in flight when the
-        // cursor is advanced out from under it (an operator reset, or a backfill
-        // committing a later window) would otherwise commit its own older
-        // window end and undo that advance — the source silently resumes from
-        // the past and re-walks ground that was deliberately skipped. Backfill
-        // has always guarded this; the incremental path did not, so a reset only
-        // stuck if you first disabled the schedule and drained the in-flight run.
-        lastSyncedAt: new Date(
-          Math.max(
-            latestRow.lastSyncedAt ? new Date(latestRow.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY,
-            effectiveWindowEnd.getTime()
-          )
-        ).toISOString(),
-        lastError: null,
-        lastEventIds: nextEventIds,
-        updatedAt: finishedAt
-      };
-      if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
-        sourceUpdate.lastCursor = nextCursor ?? null;
+      try {
+        opts.onTrafficSynced?.({
+          status: "completed",
+          sourceType: sourceRow2.sourceType,
+          sourceId: sourceRow2.id,
+          pulledEvents: pulledEventsCount,
+          selfTrafficExcluded: selfTrafficExcludedCount,
+          crawlerHits: crawlerHitsCount,
+          aiUserFetchHits: aiUserFetchHitsCount,
+          aiReferralHits: aiReferralHitsCount,
+          durationMs: Date.now() - syncStartedAtMs
+        });
+      } catch {
       }
-      tx.update(trafficSources).set(sourceUpdate).where(eq50(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq50(runs.id, runId)).run();
-      return "committed";
-    });
-    if (commitOutcome === "source-inactive") {
-      throw validationError("Traffic source is no longer active; discarded the in-flight sync");
-    }
-    writeAuditLog(app.db, {
-      projectId: project.id,
-      actor: "api",
-      action: auditAction,
-      entityType: "traffic_source",
-      entityId: sourceRow2.id
-    });
-    if (selfTrafficExcludedCount > 0) {
-      request.log.info(
-        { sourceId: sourceRow2.id, selfTrafficExcluded: selfTrafficExcludedCount },
-        "Dropped Canonry self-traffic before rollup; excluded from pulledEvents"
-      );
-    }
-    try {
-      opts.onTrafficSynced?.({
-        status: "completed",
-        sourceType: sourceRow2.sourceType,
+      const response = {
         sourceId: sourceRow2.id,
+        runId,
+        syncedAt: finishedAt,
         pulledEvents: pulledEventsCount,
         selfTrafficExcluded: selfTrafficExcludedCount,
         crawlerHits: crawlerHitsCount,
         aiUserFetchHits: aiUserFetchHitsCount,
         aiReferralHits: aiReferralHitsCount,
-        durationMs: Date.now() - syncStartedAtMs
-      });
-    } catch {
+        unknownHits: unknownHitsCount,
+        crawlerBucketRows,
+        aiUserFetchBucketRows,
+        aiReferralBucketRows,
+        sampleRows,
+        windowStart: windowStart.toISOString(),
+        // The window actually synced: equals windowEnd on a full sync, or the
+        // partial boundary when a Vercel drain stopped at its deadline.
+        windowEnd: effectiveWindowEnd.toISOString()
+      };
+      return response;
+    } finally {
+      if (wordpressLeaseOwner) {
+        try {
+          releaseTrafficSyncLease({
+            db: app.db,
+            sourceId: sourceRow2.id,
+            owner: wordpressLeaseOwner,
+            now: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        } catch (error) {
+          request.log.warn({ sourceId: sourceRow2.id, error: describeError(error) }, "Failed to release WordPress sync lease");
+        }
+      }
     }
-    const response = {
-      sourceId: sourceRow2.id,
-      runId,
-      syncedAt: finishedAt,
-      pulledEvents: pulledEventsCount,
-      selfTrafficExcluded: selfTrafficExcludedCount,
-      crawlerHits: crawlerHitsCount,
-      aiUserFetchHits: aiUserFetchHitsCount,
-      aiReferralHits: aiReferralHitsCount,
-      unknownHits: unknownHitsCount,
-      crawlerBucketRows,
-      aiUserFetchBucketRows,
-      aiReferralBucketRows,
-      sampleRows,
-      windowStart: windowStart.toISOString(),
-      // The window actually synced: equals windowEnd on a full sync, or the
-      // partial boundary when a Vercel drain stopped at its deadline.
-      windowEnd: effectiveWindowEnd.toISOString()
-    };
-    return response;
   });
   app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => {
     const project = resolveProject(app.db, request.params.name);
@@ -70862,12 +71102,17 @@ async function trafficRoutes(app, opts) {
     }
     if (sourceRow2.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow2.sourceType !== TrafficSourceTypes.wordpress && sourceRow2.sourceType !== TrafficSourceTypes.vercel) {
       throw validationError(
-        `Backfill for source type "${sourceRow2.sourceType}" is not implemented yet \u2014 only cloud-run, wordpress, and vercel are supported in v1.`
+        `Backfill for source type "${sourceRow2.sourceType}" is not implemented yet \u2014 generic replace backfill supports only cloud-run and vercel; WordPress requires a retention-aware repair.`
       );
     }
     if (!isAuthoritativeTrafficSource(app.db, sourceRow2)) {
       throw validationError("Traffic source must be active before it can backfill");
     }
+    if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
+      throw validationError(
+        "Generic WordPress replace backfill is unavailable because retained coverage is unproven. Use a retention-aware repair that declares the unrecoverable span."
+      );
+    }
     const requestedDays = request.body?.days ?? DEFAULT_BACKFILL_DAYS;
     if (!Number.isInteger(requestedDays) || requestedDays <= 0) {
       throw validationError('"days" must be a positive integer');
@@ -70914,54 +71159,6 @@ async function trafficRoutes(app, opts) {
         });
         return page.events;
       };
-    } else if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
-      const credentialStore = opts.wordpressTrafficCredentialStore;
-      if (!credentialStore) {
-        throw validationError("WordPress traffic credential storage is not configured for this deployment");
-      }
-      const credential = credentialStore.getConnection(project.name);
-      if (!credential) {
-        throw validationError(
-          `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
-        );
-      }
-      await (await assertWordpressTargetAllowed(credential.baseUrl)).close().catch(() => {
-      });
-      const wpPageSize = opts.defaultWordpressPageSize ?? DEFAULT_WP_PAGE_SIZE;
-      pullErrorPrefix = "WordPress pull failed";
-      pullForBackfill = async () => {
-        const pinnedDispatcher = await assertWordpressTargetAllowed(credential.baseUrl);
-        try {
-          const collected = [];
-          const windowStartIso = windowStart.toISOString();
-          const windowEndIso = windowEnd.toISOString();
-          let cursor = void 0;
-          for (let page = 0; page < BACKFILL_MAX_PAGES; page += 1) {
-            const pageResult = await pullWordpressEvents({
-              baseUrl: credential.baseUrl,
-              username: credential.username,
-              applicationPassword: credential.applicationPassword,
-              cursor,
-              pageSize: wpPageSize,
-              // Each call fetches a single page; the for-loop drives
-              // continuation. Matches the WP sync path's pattern.
-              maxPages: 1,
-              since: windowStartIso,
-              until: windowEndIso,
-              dispatcher: pinnedDispatcher
-            });
-            collected.push(...pageResult.events);
-            const previousCursor = cursor;
-            cursor = pageResult.nextCursor;
-            if (!pageResult.hasMore) break;
-            if (!cursor || cursor === previousCursor) break;
-          }
-          return collected;
-        } finally {
-          await pinnedDispatcher.close().catch(() => {
-          });
-        }
-      };
     } else {
       const credentialStore = opts.vercelTrafficCredentialStore;
       if (!credentialStore) {
@@ -71147,6 +71344,11 @@ async function trafficRoutes(app, opts) {
       validateTrafficSourceCredential(sourceRow2, project.name);
       tx.update(trafficSources).set({
         lastSyncedAt: now,
+        ...sourceRow2.sourceType === TrafficSourceTypes.wordpress ? {
+          lastCursor: null,
+          wordpressPendingUntil: null,
+          skippedThroughAt: now
+        } : {},
         status: TrafficSourceStatuses.connected,
         lastError: null,
         updatedAt: now
@@ -73651,11 +73853,17 @@ var syncLagCheck = {
     };
     const unrecovered = measured.filter((m) => m.skippedThroughAt !== null);
     if (unrecovered.length > 0) {
+      const unrecoveredWordpress = unrecovered.filter((m) => m.sourceType === "wordpress");
+      const unrecoveredOtherSources = unrecovered.filter((m) => m.sourceType !== "wordpress");
+      const remediation = [
+        unrecoveredWordpress.length > 0 ? "For WordPress, do not run generic replace-mode backfill: the plugin feed cannot prove it still retains every bucket in the gap. Keep existing rollups intact and use a retention-aware repair that explicitly declares the unrecoverable span." : null,
+        unrecoveredOtherSources.length > 0 ? "Recover each non-WordPress gap with `canonry traffic backfill <project> --source <id> --days N --wait`, choosing N so the window reaches back past the skipped instant and stays inside the provider's log retention. This clears only when a backfill actually covers the span." : null
+      ].filter((part) => part !== null).join(" ");
       return {
         status: CheckStatuses.fail,
         code: "traffic.sync-lag.unrecovered-skip",
         summary: `${unrecovered.length} traffic source(s) previously skipped traffic that has not been backfilled: ${unrecovered.map((m) => `${m.displayName} (skipped through ${m.skippedThroughAt})`).join(", ")}. Current lag may look healthy; the gap does not close on its own.`,
-        remediation: "Recover the gap with `canonry traffic backfill <project> --source <id> --days N --wait`, choosing N so the window reaches back past the skipped instant and stays inside the provider's log retention. This clears only when a backfill actually covers the span.",
+        remediation,
         details
       };
     }
@@ -77160,6 +77368,8 @@ async function apiRoutes(app, opts) {
       resolveCloudRunAccessToken: opts.resolveCloudRunAccessToken,
       wordpressTrafficCredentialStore: opts.wordpressTrafficCredentialStore,
       pullWordpressTrafficEvents: opts.pullWordpressTrafficEvents,
+      defaultWordpressPageSize: opts.defaultWordpressPageSize,
+      defaultWordpressMaxPages: opts.defaultWordpressMaxPages,
       vercelTrafficCredentialStore: opts.vercelTrafficCredentialStore,
       pullVercelTrafficEvents: opts.pullVercelTrafficEvents,
       vercelSyncDeadlineMs: opts.vercelSyncDeadlineMs,