@h-ai/feedback 0.1.0-alpha.74 → 0.1.0-alpha.75

package/dist/index.d.ts

@@ -39,6 +39,11 @@ declare const FeedbackConfigSchema: z.ZodObject<{
     leaseMs: z.ZodDefault<z.ZodNumber>;
     maxAttempts: z.ZodDefault<z.ZodNumber>;
     retentionDays: z.ZodDefault<z.ZodNumber>;
+    maxReportsPerUserDay: z.ZodDefault<z.ZodNumber>;
+    maxBytesPerUserDay: z.ZodDefault<z.ZodNumber>;
+    maxStoredBytesPerScope: z.ZodDefault<z.ZodNumber>;
+    maxExportsPerReport: z.ZodDefault<z.ZodNumber>;
+    exportRetentionHours: z.ZodDefault<z.ZodNumber>;
     envAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
     maxTotalBytes: z.ZodDefault<z.ZodNumber>;
     maxAttachmentBytes: z.ZodDefault<z.ZodNumber>;
@@ -86,6 +91,7 @@ declare const HaiFeedbackError: {
     LIMIT_EXCEEDED: _h_ai_core.HaiErrorDef;
     INVALID_INPUT: _h_ai_core.HaiErrorDef;
     CHECKSUM_MISMATCH: _h_ai_core.HaiErrorDef;
+    QUOTA_EXCEEDED: _h_ai_core.HaiErrorDef;
 };
 /**
  * 由可信服务端认证与授权策略生成的范围；HTTP 输入不能指定此对象。

package/dist/index.js

@@ -1,6 +1,6 @@
-import { HaiFeedbackError, feedbackM, redactFeedbackText } from './chunk-UIVT267C.js';
-export { HaiFeedbackError } from './chunk-UIVT267C.js';
-import { createFeedbackBundle } from './chunk-5QWKURWU.js';
+import { HaiFeedbackError, feedbackM, redactFeedbackText } from './chunk-7W47WZXY.js';
+export { HaiFeedbackError } from './chunk-7W47WZXY.js';
+import { createFeedbackBundle } from './chunk-KGMLTOMM.js';
 import { z } from 'zod';
 import { resolveFeedbackBudget, FeedbackReportSchema, FeedbackEvidenceInputSchema, FeedbackExportInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackEvidenceQuerySchema, FeedbackEvidenceSchema, FeedbackListInputSchema, FeedbackSubmitInputSchema, FeedbackJobSchema, FeedbackHistorySchema, FeedbackAttachmentSchema, FeedbackUploadInputSchema, FeedbackAttachmentInputSchema } from '@h-ai/api-contract/feedback';
 import { core, ok, err } from '@h-ai/core';
@@ -55,6 +55,16 @@ var FeedbackConfigSchema = z.strictObject({
   maxAttempts: z.number().int().min(1).max(20).default(5),
   /** 已受理反馈及对象附件的保留天数。 */
   retentionDays: z.number().int().min(1).max(3650).default(30),
+  /** 单个用户按数据库 UTC 日累计受理上限；幂等重试不重复计数。 */
+  maxReportsPerUserDay: z.number().int().min(1).max(1e4).default(20),
+  /** 单个用户每日预留存储字节（报告与最多历史导出）；默认 2 GiB。 */
+  maxBytesPerUserDay: z.number().int().min(4 * 1024 * 1024).max(1024 ** 4).default(2 * 1024 ** 3),
+  /** 应用内单个 scope 的持久材料预留容量；到期清理成功后释放，默认 10 GiB。 */
+  maxStoredBytesPerScope: z.number().int().min(4 * 1024 * 1024).max(1024 ** 4).default(10 * 1024 ** 3),
+  /** 单份报告最多历史导出数；已有有效快照复用，不重复计数。 */
+  maxExportsPerReport: z.number().int().min(1).max(20).default(5),
+  /** 已完成导出的有效小时数；过期禁止下载，后台删除对象，默认 24 小时。 */
+  exportRetentionHours: z.number().int().min(1).max(720).default(24),
   /** 允许采集的服务端环境变量名；凭据类名称仍按敏感信息策略排除。 */
   envAllowlist: z.array(z.string().min(1).max(128)).max(100).default([]),
   /** 未压缩导出总预算；客户端、附件总量和传输预算由此派生。 */
@@ -74,6 +84,7 @@ var EVIDENCE = "hai_feedback_evidence";
 var ATTACHMENTS = "hai_feedback_attachments";
 var HISTORY = "hai_feedback_history";
 var JOBS = "hai_feedback_jobs";
+var QUOTAS = "hai_feedback_quotas";
 var identityColumns = ["id", "report_id", "scope_id", "app_id", "user_id", "source", "request_id", "error_id", "client_id"];
 function feedbackTextEquals(column, value, params) {
   if (!identityColumns.includes(column))
@@ -112,7 +123,7 @@ function readFeedbackJson(value) {
   return typeof value === "string" ? JSON.parse(value) : value;
 }
 var FeedbackReportRepository = class extends BaseReldbCrudRepository {
-  tables = { reports: REPORTS, evidence: EVIDENCE, attachments: ATTACHMENTS, history: HISTORY, jobs: JOBS };
+  tables = { reports: REPORTS, evidence: EVIDENCE, attachments: ATTACHMENTS, history: HISTORY, jobs: JOBS, quotas: QUOTAS };
   constructor() {
     super(reldb, {
       table: REPORTS,
@@ -124,6 +135,18 @@ var FeedbackReportRepository = class extends BaseReldbCrudRepository {
     if (!report.success)
       return report;
     const definitions = [
+      [QUOTAS, {
+        id: { type: "TEXT", primaryKey: true },
+        app_id: { type: "TEXT", notNull: true },
+        scope_id: { type: "TEXT", notNull: true },
+        user_id: { type: "TEXT", notNull: true },
+        period: { type: "BIGINT", notNull: true },
+        report_count: { type: "BIGINT", notNull: true },
+        reserved_bytes: { type: "BIGINT", notNull: true },
+        report_bytes: { type: "BIGINT", notNull: true, defaultValue: 0 },
+        export_limit: { type: "INTEGER", notNull: true, defaultValue: 0 },
+        updated_at: { type: "BIGINT", notNull: true }
+      }],
       [EVIDENCE, {
         id: { type: "TEXT", primaryKey: true },
         report_id: { type: "TEXT" },
@@ -180,9 +203,11 @@ var FeedbackReportRepository = class extends BaseReldbCrudRepository {
         return created;
     }
     const indexes = [
+      { table: QUOTAS, name: "hai_feedback_quotas_expiry", columns: ["app_id", "period"] },
       { table: REPORTS, name: "hai_feedback_reports_scope_time", columns: ["scope_id", "created_at"] },
       { table: REPORTS, name: "hai_feedback_reports_scope_status", columns: ["scope_id", "status", "created_at"] },
       { table: EVIDENCE, name: "hai_feedback_evidence_report_seq", columns: ["report_id", "source", "sequence"] },
+      { table: EVIDENCE, name: "hai_feedback_evidence_temp_expiry", columns: ["app_id", "report_id", "expires_at"] },
       { table: EVIDENCE, name: "hai_feedback_evidence_temp_scope", columns: ["scope_id", "user_id", "timestamp"] },
       { table: ATTACHMENTS, name: "hai_feedback_attachments_report", columns: ["report_id"] },
       { table: HISTORY, name: "hai_feedback_history_report", columns: ["report_id"] },
@@ -287,28 +312,68 @@ function createFeedbackCapture(appId, envAllowlist, service) {
   let capacityLoss;
   let sequence = 0;
   let totalBytes = 0;
+  let pendingBytes = 0;
+  let failures = 0;
+  let retryAfter = 0;
   let stopped = false;
   let flushing = null;
-  async function flush() {
+  function removePending(key) {
+    const previous = pending.get(key);
+    if (previous)
+      pendingBytes -= previous.bytes;
+    pending.delete(key);
+  }
+  async function flush(force = false) {
     if (flushing)
       return flushing;
+    if (!force && retryAfter > Date.now())
+      return;
     flushing = core.context.run({ suppressLogObservers: true }, async () => {
-      for (const [key, item] of [...pending]) {
-        const current2 = await reldb.sql.get("SELECT id FROM hai_feedback_evidence WHERE id = ?", [key]);
+      const snapshot = [...pending];
+      let offset = 0;
+      while (offset < snapshot.length) {
+        const batch = [];
+        let bytes = 0;
+        while (offset < snapshot.length && batch.length < 32) {
+          const [key, item] = snapshot[offset];
+          if (batch.length && bytes + item.bytes > 256 * 1024)
+            break;
+          offset++;
+          if (item.event.timestamp < Date.now() - 5 * 6e4) {
+            removePending(key);
+            rememberLoss(item, "server_pending_evidence_expired");
+            continue;
+          }
+          batch.push([key, item]);
+          bytes += item.bytes;
+        }
+        if (!batch.length)
+          continue;
+        const current2 = await reldb.sql.query(`SELECT id FROM hai_feedback_evidence WHERE id IN (${batch.map(() => "?").join(",")})`, batch.map(([key]) => key));
         if (!current2.success) {
-          rememberLoss(item, "server_temporary_evidence_write_failed");
+          for (const [, item] of batch) rememberLoss(item, "server_temporary_evidence_write_failed");
+          retryAfter = Date.now() + Math.min(3e4, 250 * 2 ** Math.min(++failures, 7));
           return;
         }
-        if (!current2.data) {
-          const event = item.event;
-          const result = await reldb.sql.execute("INSERT INTO hai_feedback_evidence (id, report_id, scope_id, user_id, app_id, source, sequence, kind, timestamp, request_id, error_id, revision, bytes, expires_at, payload) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [key, null, item.scopeId, item.userId, appId, event.source, event.sequence, event.kind, event.timestamp, event.requestId ?? null, event.errorId ?? null, 1, item.bytes, Date.now() + 5 * 6e4, JSON.stringify(event)]);
+        const existing = new Set(current2.data.map((row) => row.id));
+        const additions = batch.filter(([key]) => !existing.has(key));
+        if (additions.length) {
+          const params = additions.flatMap(([key, item]) => {
+            const event = item.event;
+            return [key, null, item.scopeId, item.userId, appId, event.source, event.sequence, event.kind, event.timestamp, event.requestId ?? null, event.errorId ?? null, 1, item.bytes, event.timestamp + 5 * 6e4, JSON.stringify(event)];
+          });
+          const duplicate = reldb.config?.type === "mysql" ? "ON DUPLICATE KEY UPDATE id = id" : "ON CONFLICT (id) DO NOTHING";
+          const result = await reldb.sql.execute(`INSERT INTO hai_feedback_evidence (id, report_id, scope_id, user_id, app_id, source, sequence, kind, timestamp, request_id, error_id, revision, bytes, expires_at, payload) VALUES ${additions.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").join(",")} ${duplicate}`, params);
           if (!result.success) {
-            rememberLoss(item, "server_temporary_evidence_write_failed");
+            for (const [, item] of batch) rememberLoss(item, "server_temporary_evidence_write_failed");
+            retryAfter = Date.now() + Math.min(3e4, 250 * 2 ** Math.min(++failures, 7));
             return;
           }
         }
-        pending.delete(key);
+        for (const [key] of batch) removePending(key);
       }
+      failures = 0;
+      retryAfter = 0;
     }).finally(() => {
       flushing = null;
     });
@@ -318,7 +383,7 @@ function createFeedbackCapture(appId, envAllowlist, service) {
     for (const [key2, previous] of losses) {
       if (previous.event.timestamp < Date.now() - 5 * 6e4) {
         losses.delete(key2);
-        pending.delete(createHash("sha256").update(`${source}:${previous.event.sequence}`).digest("hex"));
+        removePending(createHash("sha256").update(`${source}:${previous.event.sequence}`).digest("hex"));
       }
     }
     if (capacityLoss && capacityLoss.timestamp < Date.now() - 5 * 6e4)
@@ -334,12 +399,21 @@ function createFeedbackCapture(appId, envAllowlist, service) {
     }
     const entry = { event, scopeId: item.scopeId, userId: item.userId, bytes: Buffer.byteLength(JSON.stringify(event)) };
     losses.set(key, entry);
-    pending.set(createHash("sha256").update(`${source}:${event.sequence}`).digest("hex"), entry);
+    if (pendingBytes + entry.bytes <= 8 * 1024 * 1024) {
+      pending.set(createHash("sha256").update(`${source}:${event.sequence}`).digest("hex"), entry);
+      pendingBytes += entry.bytes;
+    } else {
+      capacityLoss ??= { ...event, requestId: void 0, missingReason: "server_capture_capacity_exceeded" };
+    }
   }
   function pin(item, errorId) {
     if (item.event.kind === "error")
       item.event.errorId = item.event.id;
     else item.event.errorId ??= errorId;
+    const bytes = Buffer.byteLength(JSON.stringify(item.event));
+    if (item.buffered)
+      totalBytes += bytes - item.bytes;
+    item.bytes = bytes;
     const key = createHash("sha256").update(`${source}:${item.event.sequence}`).digest("hex");
     if (pending.has(key))
       return;
@@ -347,8 +421,13 @@ function createFeedbackCapture(appId, envAllowlist, service) {
       rememberLoss(item, "server_pending_evidence_overflow");
       return;
     }
+    if (pendingBytes + item.bytes > 8 * 1024 * 1024 - 128 * 1024) {
+      rememberLoss(item, "server_pending_evidence_bytes_exceeded");
+      return;
+    }
     const event = { ...item.event };
     pending.set(key, { ...item, event });
+    pendingBytes += item.bytes;
   }
   function observe(record) {
     if (stopped || record.context.module === "feedback")
@@ -386,9 +465,12 @@ function createFeedbackCapture(appId, envAllowlist, service) {
       else rememberLoss(item, "server_error_window_overflow");
     }
     buffer.push(item);
-    totalBytes += bytes;
+    item.buffered = true;
+    totalBytes += item.bytes;
     while (buffer.length > 1e4 || totalBytes > 16 * 1024 * 1024 || (buffer[0]?.event.timestamp ?? Date.now()) < Date.now() - 5 * 6e4) {
       const removed = buffer.shift();
+      if (removed)
+        removed.buffered = false;
       totalBytes -= removed?.bytes ?? 0;
       if (removed && removed.event.timestamp >= Date.now() - 5 * 6e4)
         rememberLoss(removed, "server_log_buffer_overflow");
@@ -401,7 +483,7 @@ function createFeedbackCapture(appId, envAllowlist, service) {
   timer.unref();
   return {
     async collect(scopeId, userId, anchor) {
-      await flush();
+      await flush(true);
       const params = [];
       const identity = `${feedbackTextEquals("app_id", appId, params)} AND ${feedbackTextEquals("scope_id", scopeId, params)} AND ${feedbackTextEquals("user_id", userId, params)}`;
       params.push(anchor - 5 * 6e4, anchor + 3e4);
@@ -463,7 +545,7 @@ function createFeedbackCapture(appId, envAllowlist, service) {
       stopped = true;
       stop();
       clearInterval(timer);
-      await flush();
+      await flush(true);
     }
   };
 }
@@ -513,8 +595,70 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
   let stopped = false;
   let timer;
   let running = null;
+  let idleRounds = 0;
+  let cleanupBacklog = false;
+  let cleanupAfter = 0;
+  let wakePending = false;
   const shutdown = new AbortController();
+  function schedule(delay) {
+    if (stopped || !config.workerIntervalMs)
+      return;
+    if (timer)
+      clearTimeout(timer);
+    timer = setTimeout(() => {
+      timer = void 0;
+      void tick();
+    }, delay);
+    timer.unref();
+  }
+  function wakeWorker() {
+    idleRounds = 0;
+    if (running)
+      wakePending = true;
+    else
+      schedule(config.workerIntervalMs);
+  }
+  async function tick() {
+    if (stopped)
+      return;
+    const result = await runJobs();
+    idleRounds = result.success && (result.data.processed > 0 || cleanupBacklog || wakePending) ? 0 : Math.min(idleRounds + 1, 10);
+    wakePending = false;
+    schedule(Math.min(3e4, config.workerIntervalMs * 2 ** idleRounds));
+  }
   const collectEvidence = options.collectEvidence;
+  function quotaExceeded() {
+    return err(HaiFeedbackError.QUOTA_EXCEEDED, feedbackM("feedback_quotaExceeded"));
+  }
+  function scopeQuotaId(scopeId) {
+    return hash(JSON.stringify([config.appId, scopeId, "storage"]));
+  }
+  async function reserveQuota(tx, actor, reportId) {
+    const time = await tx.get(`SELECT ${clock} AS now`);
+    if (!time.success)
+      return time;
+    const now = Number(time.data?.now);
+    if (!Number.isFinite(now))
+      return failed();
+    const day = Math.floor(now / 864e5) * 864e5;
+    const bytes = budget.maxTotalBytes * (config.maxExportsPerReport + 1);
+    const buckets = [
+      { id: scopeQuotaId(actor.scopeId), period: 0, maxReports: Number.MAX_SAFE_INTEGER, maxBytes: config.maxStoredBytesPerScope },
+      { id: hash(JSON.stringify([config.appId, actor.scopeId, actor.userId, day])), period: day, maxReports: config.maxReportsPerUserDay, maxBytes: config.maxBytesPerUserDay }
+    ];
+    for (const bucket of buckets) {
+      const suffix = reldb.config?.type === "mysql" ? "ON DUPLICATE KEY UPDATE id = id" : "ON CONFLICT (id) DO NOTHING";
+      const inserted = await tx.execute(`INSERT INTO ${table.quotas} (id, app_id, scope_id, user_id, period, report_count, reserved_bytes, updated_at) VALUES (?, ?, ?, ?, ?, 0, 0, ?) ${suffix}`, [bucket.id, config.appId, actor.scopeId, bucket.period === 0 ? "" : actor.userId, bucket.period, now]);
+      if (!inserted.success)
+        return inserted;
+      const reserved = await tx.execute(`UPDATE ${table.quotas} SET report_count = report_count + 1, reserved_bytes = reserved_bytes + ?, updated_at = ? WHERE id = ? AND report_count < ? AND reserved_bytes <= ?`, [bytes, now, bucket.id, bucket.maxReports, bucket.maxBytes - bytes]);
+      if (!reserved.success)
+        return reserved;
+      if (!reserved.data.changes)
+        return quotaExceeded();
+    }
+    return tx.execute(`INSERT INTO ${table.quotas} (id, app_id, scope_id, user_id, period, report_count, reserved_bytes, report_bytes, export_limit, updated_at) VALUES (?, ?, ?, ?, -1, 1, ?, ?, ?, ?)`, [reportId, config.appId, actor.scopeId, actor.userId, bytes, budget.maxTotalBytes, config.maxExportsPerReport, now]);
+  }
   async function access(id, actor, permission, sql = reldb.sql) {
     if (!validActor(actor))
       return forbidden();
@@ -638,25 +782,21 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
     const result = await sql.query(`SELECT * FROM ${table.evidence} WHERE report_id = ? AND revision <= ? ORDER BY timestamp, source, sequence`, [id, revision]);
     return result.success ? ok(result.data.map((row) => FeedbackEvidenceSchema.parse({ ...FeedbackEvidenceInputSchema.parse(readFeedbackJson(row.payload)), feedbackId: id, revision: Number(row.revision) }))) : result;
   }
+  async function runJobs() {
+    if (stopped)
+      return err(HaiFeedbackError.NOT_INITIALIZED, feedbackM("feedback_notInitialized"));
+    if (running)
+      return running;
+    running = core.context.run({ suppressLogObservers: true }, processJobs).catch(failed).finally(() => {
+      running = null;
+    });
+    return running;
+  }
   const operations = {
     start() {
       if (!config.workerIntervalMs || stopped)
         return;
-      const tick = async () => {
-        if (stopped)
-          return;
-        await operations.runJobs();
-        if (!stopped) {
-          timer = setTimeout(() => {
-            void tick();
-          }, config.workerIntervalMs);
-          timer.unref();
-        }
-      };
-      timer = setTimeout(() => {
-        void tick();
-      }, config.workerIntervalMs);
-      timer.unref();
+      schedule(config.workerIntervalMs);
     },
     async close() {
       stopped = true;
@@ -674,6 +814,8 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
       if (!parsed.success || parsed.data.appId !== config.appId)
         return invalid();
       const sanitized = FeedbackSubmitInputSchema.parse(sanitizeFeedbackValue(parsed.data));
+      if (sanitized.evidence?.some((event) => event.source.startsWith("server:")))
+        return invalid();
       const submissionKey = hash(JSON.stringify([actor.scopeId, actor.userId, config.appId, sanitized.submissionId]));
       const digest = hash(canonicalFeedbackJson(sanitized));
       const existing = await reldb.sql.get(`SELECT * FROM ${table.reports} WHERE submission_key = ?`, [submissionKey]);
@@ -714,7 +856,10 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         const inserted = await repo.create({ ...row }, tx);
         if (!inserted.success)
           return inserted;
-        const initial = await appendInside(tx, row, sanitized.evidence ?? []);
+        const reservation = await reserveQuota(tx, actor, id);
+        if (!reservation.success)
+          return reservation;
+        const initial = await appendInside(tx, row, [...sanitized.evidence ?? [], capture.environment()], true);
         if (!initial.success)
           return initial;
         if ((sanitized.attachments ?? []).reduce((total, file) => total + file.size, 0) > budget.maxAttachmentsBytes)
@@ -756,9 +901,7 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
           return missing();
         return duplicate.data.submission_hash === digest ? ok(repo.report(duplicate.data)) : conflict();
       }
-      const environment = await appendInternal(id, actor, [capture.environment()]);
-      if (!environment.success)
-        core.logger.warn("Feedback environment collection deferred", { module: "feedback", feedbackId: id });
+      wakeWorker();
       const current2 = await repo.find(id, actor.scopeId);
       return current2.success && current2.data ? ok(repo.report(current2.data)) : result;
     },
@@ -970,13 +1113,15 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         if (!resumed.success)
           return resumed;
       }
+      if (updated.success)
+        wakeWorker();
       return updated.success ? ok(void 0) : updated;
     },
     async export(input, actor) {
       const parsed = FeedbackExportInputSchema.safeParse(input);
       if (!parsed.success)
         return invalid();
-      return repo.transaction(async (tx) => {
+      const result = await repo.transaction(async (tx) => {
         const row = await access(input.id, actor, "feedback:export", tx);
         if (!row.success)
           return row;
@@ -990,12 +1135,20 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         if (previous.data) {
           const snapshot = readFeedbackJson(previous.data.payload);
           const live = snapshot && typeof snapshot === "object" && "snapshotExpiresAt" in snapshot && typeof snapshot.snapshotExpiresAt === "number" && snapshot.snapshotExpiresAt > Date.now();
-          if (previous.data.status === "succeeded" || live)
+          if (previous.data.status === "succeeded" && Number(previous.data.created_at) + config.exportRetentionHours * 36e5 > Date.now() || previous.data.status !== "succeeded" && live)
             return ok(jobData(previous.data));
         }
         if (revision < Number(row.data.revision)) {
           return missing();
         }
+        const exports = await tx.get(`SELECT COUNT(*) AS count FROM ${table.jobs} WHERE report_id = ? AND kind = 'export'`, [input.id]);
+        if (!exports.success)
+          return exports;
+        const reservation = await tx.get(`SELECT report_bytes, export_limit FROM ${table.quotas} WHERE id = ?`, [input.id]);
+        if (!reservation.success)
+          return reservation;
+        if (!reservation.data || Number(exports.data?.count ?? 0) >= Math.min(config.maxExportsPerReport, Number(reservation.data.export_limit)))
+          return quotaExceeded();
         const events = await evidence(input.id, revision, tx);
         if (!events.success)
           return events;
@@ -1006,12 +1159,15 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         if (!changes.success)
           return changes;
         const suffix = `${revision}:${row.data.version}${previous.data ? `:${previous.data.id}` : ""}`;
-        const added = await insertJob(tx, repo.report(row.data), "export", suffix, { report: repo.report(row.data), evidence: events.data, attachments: files.data, history: changes.data, snapshotExpiresAt: Date.now() + 36e5 }, Date.now());
+        const added = await insertJob(tx, repo.report(row.data), "export", suffix, { report: repo.report(row.data), evidence: events.data, attachments: files.data, history: changes.data, maxBytes: Number(reservation.data.report_bytes), snapshotExpiresAt: Date.now() + 36e5 }, Date.now());
         if (!added.success)
           return added;
         const job = await tx.get(`SELECT * FROM ${table.jobs} WHERE id = ?`, [added.data]);
         return job.success && job.data ? ok(jobData(job.data)) : missing();
       });
+      if (result.success)
+        wakeWorker();
+      return result;
     },
     async getExport(input, actor) {
       const row = await access(input.id, actor, "feedback:export");
@@ -1032,6 +1188,8 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
           return missing();
         return err(HaiFeedbackError.CONFLICT, feedbackM("feedback_exportPending"));
       }
+      if (Number(job.data.created_at) + config.exportRetentionHours * 36e5 <= Date.now())
+        return missing();
       if (job.data.status === "failed")
         return failed();
       const data = readFeedbackJson(job.data.result);
@@ -1044,16 +1202,7 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         return err(HaiFeedbackError.CHECKSUM_MISMATCH, feedbackM("feedback_checksumMismatch"));
       return ok({ name: `${repo.report(row.data).number}.zip`, contentType: "application/zip", dataBase64: bytes.data.toString("base64") });
     },
-    async runJobs() {
-      if (stopped)
-        return err(HaiFeedbackError.NOT_INITIALIZED, feedbackM("feedback_notInitialized"));
-      if (running)
-        return running;
-      running = core.context.run({ suppressLogObservers: true }, processJobs).catch(failed).finally(() => {
-        running = null;
-      });
-      return running;
-    }
+    runJobs
   };
   async function upload(input, actor) {
     const parsed = FeedbackUploadInputSchema.safeParse(input);
@@ -1181,6 +1330,21 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         return limited();
       return ok(void 0);
     }
+    const frozenFiles = files.map((file) => ({ id: file.rowId, size: file.bytes.length, checksum: file.metadata.checksum })).sort((left, right) => left.id.localeCompare(right.id));
+    const frozen = await withLease(job, async (tx) => {
+      const current2 = await tx.get(`SELECT * FROM ${table.jobs} WHERE id = ?`, [job.id]);
+      if (!current2.success || !current2.data)
+        return missing();
+      const payload = readFeedbackJson(current2.data.payload);
+      if (!payload || typeof payload !== "object")
+        return invalid();
+      if ("businessFiles" in payload)
+        return canonicalFeedbackJson(payload.businessFiles) === canonicalFeedbackJson(frozenFiles) ? ok(void 0) : conflict();
+      const updated = await tx.execute(`UPDATE ${table.jobs} SET payload = ? WHERE id = ? AND token = ?`, [JSON.stringify({ ...payload, businessFiles: frozenFiles }), job.id, job.token]);
+      return updated.success ? ok(void 0) : updated;
+    });
+    if (!frozen.success)
+      return frozen;
     const capacity = await checkCapacity(reldb.sql);
     if (!capacity.success)
       return capacity;
@@ -1254,8 +1418,6 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
           if (!terminal.success)
             return terminal;
         }
-        if (!saved.data.changes && job.kind === "export" && result.success && result.data && typeof result.data === "object" && "key" in result.data && typeof result.data.key === "string")
-          await storage.file.delete(result.data.key);
         if (job.kind === "notify")
           await notificationSummary(job.report_id);
         processed++;
@@ -1267,8 +1429,47 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         clearInterval(renewal);
       }
     }
-    const expired = await reldb.sql.execute(`DELETE FROM ${table.evidence} WHERE report_id IS NULL AND expires_at < ?`, [Date.now()]);
-    return expired.success ? ok({ processed }) : expired;
+    if (Date.now() >= cleanupAfter) {
+      const expiredExports = await reldb.sql.query(`SELECT * FROM ${table.jobs} WHERE app_id = ? AND kind = 'export' AND status = 'succeeded' AND created_at <= ${clock} - ? ORDER BY created_at, id LIMIT 20`, [config.appId, config.exportRetentionHours * 36e5]);
+      if (!expiredExports.success)
+        return expiredExports;
+      for (const job of expiredExports.data) {
+        if (job.app_id !== config.appId)
+          continue;
+        const result = readFeedbackJson(job.result);
+        if (result && typeof result === "object" && "key" in result && typeof result.key === "string") {
+          const deleted = await storage.file.delete(result.key);
+          if (!deleted.success)
+            return deleted;
+        }
+        const marked = await reldb.sql.execute(`UPDATE ${table.jobs} SET status = 'failed', result = NULL, payload = ?, last_error = ? WHERE id = ? AND status = 'succeeded'`, [JSON.stringify({ expired: true }), HaiFeedbackError.NOT_FOUND.code, job.id]);
+        if (!marked.success)
+          return marked;
+      }
+      const quotaRows = await reldb.sql.query(`SELECT id FROM ${table.quotas} WHERE app_id = ? AND period > 0 AND period < ${clock} - 172800000 ORDER BY period, id LIMIT 100`, [config.appId]);
+      if (!quotaRows.success)
+        return quotaRows;
+      if (quotaRows.data.length) {
+        const removed = await reldb.sql.execute(`DELETE FROM ${table.quotas} WHERE id IN (${quotaRows.data.map(() => "?").join(",")})`, quotaRows.data.map((row) => row.id));
+        if (!removed.success)
+          return removed;
+      }
+    }
+    if (Date.now() >= cleanupAfter) {
+      const params = [];
+      const identity = feedbackTextEquals("app_id", config.appId, params);
+      const expired = await reldb.sql.query(`SELECT id FROM ${table.evidence} WHERE ${identity} AND report_id IS NULL AND expires_at < ? ORDER BY expires_at, id LIMIT 100`, [...params, Date.now()]);
+      if (!expired.success)
+        return expired;
+      if (expired.data.length) {
+        const removed = await reldb.sql.execute(`DELETE FROM ${table.evidence} WHERE ${identity} AND report_id IS NULL AND id IN (${expired.data.map(() => "?").join(",")})`, [...params, ...expired.data.map((row) => row.id)]);
+        if (!removed.success)
+          return removed;
+      }
+      cleanupBacklog = expired.data.length === 100;
+      cleanupAfter = cleanupBacklog ? 0 : Date.now() + 3e4;
+    }
+    return ok({ processed });
   }
   async function executeJob(job) {
     if (job.app_id !== config.appId)
@@ -1406,6 +1607,8 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
       if (!("report" in payload) || !("evidence" in payload) || !("attachments" in payload))
         return invalid();
       const fixed = payload;
+      if (!Number.isSafeInteger(fixed.maxBytes) || fixed.maxBytes < 4 * 1024 * 1024 || fixed.maxBytes > 40 * 1024 * 1024)
+        return invalid();
       if (fixed.snapshotExpiresAt < Date.now())
         return missing();
       const files = [];
@@ -1425,12 +1628,17 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         const info = attachmentData(file);
         files.push({ id: info.id, name: info.name, contentType: info.contentType, checksum: info.checksum, bytes: stored2.data });
       }
-      const bundle = await createFeedbackBundle({ maxBytes: budget.maxTotalBytes, report: fixed.report, evidence: fixed.evidence, history: fixed.history, attachments: files, missing: unavailable2 });
+      const bundle = await createFeedbackBundle({ maxBytes: fixed.maxBytes, createdAt: Number(job.created_at), report: fixed.report, evidence: fixed.evidence, history: fixed.history, attachments: files, missing: unavailable2 });
       if (!bundle.success)
         return bundle;
-      const key = `feedback/${hash(report.scopeId).slice(0, 16)}/${report.id}/exports/${job.id}-${job.token}.zip`;
+      const key = `feedback/${hash(report.scopeId).slice(0, 16)}/${report.id}/exports/${job.id}.zip`;
       const stored = await storage.file.put(key, bundle.data, { contentType: "application/zip", ifNoneMatch: "*" });
-      return stored.success ? ok({ key, checksum: hash(bundle.data), size: bundle.data.length }) : stored;
+      if (!stored.success) {
+        const existing = await storage.file.get(key);
+        if (!existing.success || hash(existing.data) !== hash(bundle.data))
+          return stored;
+      }
+      return ok({ key, checksum: hash(bundle.data), size: bundle.data.length });
     }
     const marked = await withLease(job, async (tx) => {
       const locked = await repo.find(report.id, report.scopeId, tx);
@@ -1459,6 +1667,17 @@ function createFeedbackOperations(repo, config, capture, options = {}) {
         if (!removed2.success)
           return removed2;
       }
+      const reservation = await tx.get(`SELECT reserved_bytes FROM ${table.quotas} WHERE id = ?`, [report.id]);
+      if (!reservation.success)
+        return reservation;
+      if (reservation.data) {
+        const released = await tx.execute(`UPDATE ${table.quotas} SET report_count = report_count - 1, reserved_bytes = reserved_bytes - ?, updated_at = ${clock} WHERE id = ? AND reserved_bytes >= ? AND report_count > 0`, [Number(reservation.data.reserved_bytes), scopeQuotaId(report.scopeId), Number(reservation.data.reserved_bytes)]);
+        if (!released.success || !released.data.changes)
+          return released.success ? conflict() : released;
+        const removed2 = await tx.execute(`DELETE FROM ${table.quotas} WHERE id = ?`, [report.id]);
+        if (!removed2.success)
+          return removed2;
+      }
       const removedJobs = await tx.execute(`DELETE FROM ${table.jobs} WHERE report_id = ? AND id <> ?`, [report.id, job.id]);
       if (!removedJobs.success)
         return removedJobs;