@oneuptime/common 12.0.33 → 13.0.0

package/Server/Utils/SessionReplay/SessionReplayReadService.ts

@@ -2,22 +2,35 @@ import { SQL, Statement } from "../AnalyticsDatabase/Statement";
 import { getQuerySettings } from "../AnalyticsDatabase/QuerySettingsHelper";
 import RumSessionService from "../../Services/RumSessionService";
 import RumSessionChunkService from "../../Services/RumSessionChunkService";
+import ExceptionInstanceService from "../../Services/ExceptionInstanceService";
 import {
   DbJSONResponse,
   Results,
 } from "../../Services/AnalyticsDatabaseService";
+import logger from "../Logger";
 import AnalyticsTableName from "../../../Types/AnalyticsDatabase/AnalyticsTableName";
 import TableColumnType from "../../../Types/AnalyticsDatabase/TableColumnType";
 import Includes from "../../../Types/BaseDatabase/Includes";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
+import OneUptimeDate from "../../../Types/Date";
 import ChunkMath from "../../../Utils/Rum/ChunkMath";
 import {
   MAX_SESSION_REPLAY_CHUNKS_PER_READ,
   MAX_SESSION_REPLAY_READ_BYTES,
+  SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH,
+  SESSION_REPLAY_MAX_SESSION_MS,
+  SESSION_REPLAY_MAX_TAG_KEYS,
+  SESSION_REPLAY_RECORDER_CAPABILITIES,
   SessionReplayChunkManifestEntry,
   SessionReplayGap,
+  SessionReplaySealedReason,
 } from "../../../Types/Rum/SessionReplay";
+import {
+  SESSION_REPLAY_SORT_BY_VALUES,
+  SessionReplaySortBy,
+  SessionReplaySortedListCursorDto,
+} from "../../../Types/Rum/SessionReplayApi";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 
@@ -50,10 +63,9 @@ import CaptureSpan from "../Telemetry/CaptureSpan";
  *  3. The manifest read must never name the `payload` column, so
  *     ClickHouse never touches (and never decompresses) the only column
  *     in the system that holds a recording of a real person's screen.
- *     The byte-cap pre-check is the one exception, and it measures
- *     `length(payload)` inside ClickHouse without ever shipping the
- *     bytes: the cap has to bound the size of what is actually returned,
- *     and the only honest measure of that is the stored column itself.
+ *     getChunks is the one read that names it, and it measures
+ *     `length(payload)` in the same statement that ships the bytes, so
+ *     the column is decompressed exactly once per page.
  *
  * NOTE on aliases: ClickHouse substitutes SELECT aliases into same-level
  * unqualified WHERE references, and an aggregate alias there is an
@@ -84,6 +96,29 @@ export const MAX_SESSION_REPLAY_LIST_LIMIT: number = 200;
 /* Sessions returned by the exception -> replay lookup. */
 export const MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT: number = 20;
 
+/*
+ * Default window for the exception -> replay lookup when the caller gives
+ * none. RumSession is partitioned by day, so an unbounded lookup scans
+ * every partition the project has ever written; 30 days covers every
+ * retention tier a recording can still be played under.
+ */
+export const DEFAULT_SESSION_REPLAY_FOR_EXCEPTION_WINDOW_DAYS: number = 30;
+
+/*
+ * Sessions the exception-instance side index may name. The instance table
+ * carries the session id of the page that threw, which is how a session
+ * is found BEFORE the finalizer has written its fingerprint list.
+ */
+const MAX_EXCEPTION_INSTANCE_SESSION_IDS: number = 100;
+
+/*
+ * Padding around an exception's own timestamp when the caller pins the
+ * lookup to a moment: a session that contains the error started at most
+ * SESSION_REPLAY_MAX_SESSION_MS before it, and clock skew between the
+ * browser and the server is bounded far below this.
+ */
+export const SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS: number = 5 * 60 * 1000;
+
 /*
  * Row ceiling on one manifest. A session is capped at
  * MAX_SESSION_REPLAY_CHUNKS_PER_SESSION (480) chunks PER TAB, and a
@@ -93,11 +128,24 @@ export const MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT: number = 20;
  */
 const MAX_MANIFEST_ROWS: number = 4096;
 
-export interface SessionReplayListCursor {
-  /* Server-clamped session start of the last row of the previous page. */
-  startTimeUnixMs: number;
-  sessionId: string;
-}
+/*
+ * How long one application's activity summary is served from memory. The
+ * health card polls every 10-60s per viewer and the summary is a small
+ * aggregate over a day of headers, so a 30s cache turns N viewers into
+ * one ClickHouse query per pod per half minute.
+ */
+export const SESSION_REPLAY_ACTIVITY_SUMMARY_CACHE_TTL_MS: number = 30 * 1000;
+const MAX_ACTIVITY_SUMMARY_CACHE_ENTRIES: number = 1000;
+
+/* The header attribute the ingest writes chunk 0's capability list into. */
+export const RECORDER_CAPABILITIES_ATTRIBUTE: string = "recorder.capabilities";
+
+/*
+ * The keyset cursor the list accepts and emits. The legacy
+ * {startTimeUnixMs, sessionId} shape is normalised to this by
+ * parseSessionReplayListCursor before it reaches the service.
+ */
+export type SessionReplayListCursor = SessionReplaySortedListCursorDto;
 
 export interface SessionReplayListFilters {
   hasError?: boolean | undefined;
@@ -118,6 +166,20 @@ export interface SessionReplayListFilters {
   /* "sessions that hit /checkout" - matches the routes array. */
   route?: string | undefined;
   minDurationMs?: number | undefined;
+  /*
+   * Free text: sessionId prefix, entry/exit URL and routes substring, exact
+   * trace id, and the identified user label when the caller may read it.
+   * Capped at SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH by the handler.
+   */
+  search?: string | undefined;
+  /* startsWith over the routes array and the entry URL. */
+  urlPrefix?: string | undefined;
+  /* Every pair must match the session's tag map. */
+  tags?: Record<string, string> | undefined;
+  hasIdentifiedUser?: boolean | undefined;
+  /* (not finalized OR has chunks) AND not recording-lost. */
+  isPlayable?: boolean | undefined;
+  hasTraces?: boolean | undefined;
 }
 
 export interface SessionReplayListRequest {
@@ -128,11 +190,15 @@ export interface SessionReplayListRequest {
   filters: SessionReplayListFilters;
   limit: number;
   cursor?: SessionReplayListCursor | undefined;
+  /* Absent means "startTime", which is what the list always did. */
+  sortBy?: SessionReplaySortBy | undefined;
   /*
    * The raw end-user identifier has its own, narrower column ACL than the
    * rest of the header row. This raw-SQL path never invokes
    * ModelPermission, so the caller decides column-by-column and the
    * column is simply not named in the SELECT when it is not permitted.
+   * Gates the traits column and the label half of the search predicate
+   * as well.
    */
   includeIdentifiedUserLabel: boolean;
 }
@@ -170,7 +236,24 @@ export interface SessionReplayListItem {
   identifiedUserKey: string;
   /* Present only when the caller holds the narrower identity permission. */
   identifiedUserLabel?: string | undefined;
+  identifiedUserTraits?: Record<string, string> | undefined;
   samplePercentageAtCapture: number;
+  /* First MAX_LIST_ROUTES routes, in order. */
+  routes: Array<string>;
+  traceCount: number;
+  exceptionGroupCount: number;
+  /*
+   * The first exception fingerprint of the session, "" when there is none.
+   * The list's errors badge links at the exception group with it.
+   */
+  topExceptionFingerprint: string;
+  clickCount: number;
+  activeMs: number;
+  firstErrorOffsetMs: number;
+  expiresAtUnixMs: number;
+  tags: Record<string, string>;
+  startTimeUnixMs: number;
+  endTimeUnixMs: number;
 }
 
 export interface SessionReplayListResult {
@@ -178,6 +261,9 @@ export interface SessionReplayListResult {
   nextCursor: SessionReplayListCursor | null;
 }
 
+/* Routes projected onto a list row; the table shows three and says "(N pages)". */
+export const MAX_LIST_ROUTES: number = 5;
+
 export interface SessionReplaySessionHeader {
   sessionId: string;
   projectId: string;
@@ -222,6 +308,50 @@ export interface SessionReplaySessionHeader {
   traceIds: Array<string>;
   exceptionFingerprints: Array<string>;
   clockSkewMs: number;
+  /*
+   * The session clock as numbers, so the player places every telemetry
+   * row at rowUnixMs - startTimeUnixMs without re-parsing an ISO string.
+   */
+  startTimeUnixMs: number;
+  endTimeUnixMs: number;
+  /* The recorder's own start clock, before the server clamped it. */
+  clientReportedStartUnixMs: number;
+  tags: Record<string, string>;
+  expiresAtUnixMs: number;
+  clickCount: number;
+  customEventCount: number;
+  activeMs: number;
+  firstErrorOffsetMs: number;
+  /*
+   * From chunk 0's envelope (attributes["recorder.capabilities"]); empty
+   * for recordings that predate the field.
+   */
+  recorderCapabilities: Array<string>;
+  /*
+   * Never populated by getSessionHeader. The manifest handler fills them
+   * from getSessionIdentity ONLY after canReadIdentifiedUserLabel passes,
+   * so no statement names the identity columns for a caller who may not
+   * read them.
+   */
+  identifiedUserLabel?: string | undefined;
+  identifiedUserTraits?: Record<string, string> | undefined;
+}
+
+/* The two identity columns, read separately behind the identity ACL. */
+export interface SessionReplaySessionIdentity {
+  identifiedUserLabel: string;
+  identifiedUserTraits: Record<string, string>;
+}
+
+/*
+ * What is still knowable about a session whose header has aged out of
+ * retention (or was never finalized), for the "this recording expired on
+ * <date>" answer instead of a bare "not found".
+ */
+export interface SessionReplayExpiredSessionInfo {
+  rumApplicationId: string;
+  startTime: Date;
+  expiresAt: Date;
 }
 
 /*
@@ -238,6 +368,8 @@ export interface SessionReplayManifestTab {
   gaps: Array<SessionReplayGap>;
   maxChunkIndex: number;
   totalPayloadBytes: number;
+  /* Where this tab's footage begins on the session clock. */
+  firstChunkStartOffsetMs: number;
 }
 
 export interface SessionReplayManifest {
@@ -256,6 +388,17 @@ export interface SessionReplayChunkPayload {
   payload: string;
 }
 
+export interface SessionReplayChunkReadResult {
+  /* The longest contiguous prefix of the requested chunks under the cap. */
+  chunks: Array<SessionReplayChunkPayload>;
+  /*
+   * Chunks that exist and were requested but did not fit under
+   * MAX_SESSION_REPLAY_READ_BYTES behind the ones served. A chunk absent
+   * from storage is NOT listed here: that is a gap, not an omission.
+   */
+  omittedChunkIndexes: Array<number>;
+}
+
 export interface SessionReplayExceptionSession {
   sessionId: string;
   rumApplicationId: string;
@@ -277,6 +420,26 @@ export interface SessionReplayExceptionSession {
   isFinalized: boolean;
 }
 
+export interface SessionReplayApplicationActivitySummary {
+  /* null when ClickHouse could not answer; the UI renders "unknown". */
+  sessionsLast24h: number | null;
+  playableSessionsLast24h: number | null;
+  /* null when the application has no session in retention. */
+  lastSessionStartedAt: Date | null;
+  /*
+   * What the NEWEST session's recorder said it could capture, filtered to
+   * the known vocabulary. null when there is no session in retention, when
+   * that session predates the attribute, or when the query failed - all
+   * three render as "not reported yet", which is the honest answer.
+   *
+   * This is how an operator spots a stale cached recorder artifact
+   * ("click labels: no") without opening a recording, which would write an
+   * audit row. It rides on the last-session query that is already run for
+   * lastSessionStartedAt, so it costs no extra round trip.
+   */
+  recorderCapabilities: Array<string> | null;
+}
+
 /*
  * Header columns that are aggregated with argMax and their SELECT alias.
  * Kept as data rather than a hand-written SELECT list so the list, header
@@ -305,6 +468,44 @@ function argMaxDateTime(column: string): string {
   return `toFloat64(toUnixTimestamp64Milli(${argMaxColumn(column)}))`;
 }
 
+/* A Date column (retentionDate) as unix milliseconds. */
+function argMaxDate(column: string): string {
+  return `toFloat64(toUnixTimestamp(${argMaxColumn(column)})) * 1000`;
+}
+
+/*
+ * Duration that stays honest for a session the finalizer has not reached.
+ *
+ * The provisional header is written on chunk 0 with durationMs 0 and
+ * endTime = chunk 0's end, and it stays that way for the 10+ minutes of
+ * idleness the finalizer waits for. Reported verbatim, every live or
+ * recently finished session read "0s" in the list and a "longer than"
+ * filter hid all of them - the first thing a person testing their install
+ * sees is a session that claims to be empty. Until the finalized row
+ * exists, the span the header itself asserts (endTime - startTime) is the
+ * best lower bound there is, so the live value is the larger of the two.
+ * The finalized row's durationMs is authoritative and is used as-is.
+ */
+/*
+ * durationMs is Int128 on disk while the clock arithmetic is Int64; both
+ * branches are cast to Int64 (a session is capped at four hours, so the
+ * cast cannot overflow) so `if` and `greatest` see one type.
+ */
+const LIVE_DURATION_EXPRESSION: string = `toFloat64(if(${argMaxColumn(
+  "isFinalized",
+)}, toInt64(${argMaxColumn("durationMs")}), greatest(toInt64(${argMaxColumn(
+  "durationMs",
+)}), toUnixTimestamp64Milli(${argMaxColumn(
+  "endTime",
+)}) - toUnixTimestamp64Milli(${argMaxColumn("startTime")}))))`;
+
+/*
+ * The frustration total, shared by the hasFrustration predicate and the
+ * "frustration" sort so the two can never disagree about what counts.
+ */
+const FRUSTRATION_TOTAL_EXPRESSION: string =
+  "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
+
 /*
  * Aliases deliberately differ from the physical column names. See the
  * ILLEGAL_AGGREGATION note in the file header.
@@ -312,7 +513,7 @@ function argMaxDateTime(column: string): string {
 const HEADER_AGGREGATES: Array<AggregatedColumn> = [
   { alias: "aggStartTime", expression: argMaxDateTime("startTime") },
   { alias: "aggEndTime", expression: argMaxDateTime("endTime") },
-  { alias: "aggDurationMs", expression: argMaxNumeric("durationMs") },
+  { alias: "aggDurationMs", expression: LIVE_DURATION_EXPRESSION },
   { alias: "aggIsFinalized", expression: argMaxColumn("isFinalized") },
   { alias: "aggSealedReason", expression: argMaxColumn("sealedReason") },
   { alias: "aggChunkCount", expression: argMaxNumeric("chunkCount") },
@@ -336,6 +537,12 @@ const HEADER_AGGREGATES: Array<AggregatedColumn> = [
   { alias: "aggTriggerReason", expression: argMaxColumn("triggerReason") },
   { alias: "aggEntryUrl", expression: argMaxColumn("entryUrl") },
   { alias: "aggExitUrl", expression: argMaxColumn("exitUrl") },
+  /*
+   * The full routes array: the list projects the first MAX_LIST_ROUTES and
+   * the urlPrefix / search predicates run over the argMax'd whole, never
+   * the raw column (which would match a superseded header version).
+   */
+  { alias: "aggRoutes", expression: argMaxColumn("routes") },
   { alias: "aggBrowserName", expression: argMaxColumn("browserName") },
   { alias: "aggBrowserVersion", expression: argMaxColumn("browserVersion") },
   { alias: "aggOsName", expression: argMaxColumn("osName") },
@@ -351,6 +558,36 @@ const HEADER_AGGREGATES: Array<AggregatedColumn> = [
     alias: "aggSamplePercentage",
     expression: argMaxNumeric("samplePercentageAtCapture"),
   },
+  /*
+   * Counts rather than the arrays themselves: the list only says "3 traces"
+   * and "2 exception groups", and the hasTraces predicate needs a number.
+   */
+  {
+    alias: "aggTraceCount",
+    expression: `toFloat64(length(${argMaxColumn("traceIds")}))`,
+  },
+  {
+    alias: "aggExceptionGroupCount",
+    expression: `toFloat64(length(${argMaxColumn("exceptionFingerprints")}))`,
+  },
+  /*
+   * The first fingerprint, so the list's "3 errors" badge can link at the
+   * exception group instead of at an unfiltered Exceptions page. Empty
+   * string when the session recorded no exception group; arrayElement on
+   * an empty array returns the type's default, which for String is ''.
+   */
+  {
+    alias: "aggTopExceptionFingerprint",
+    expression: `arrayElement(${argMaxColumn("exceptionFingerprints")}, 1)`,
+  },
+  { alias: "aggClickCount", expression: argMaxNumeric("clickCount") },
+  { alias: "aggActiveMs", expression: argMaxNumeric("activeMs") },
+  {
+    alias: "aggFirstErrorOffsetMs",
+    expression: argMaxNumeric("firstErrorOffsetMs"),
+  },
+  { alias: "aggExpiresAt", expression: argMaxDate("retentionDate") },
+  { alias: "aggTags", expression: argMaxColumn("tags") },
 ];
 
 /* Only the manifest needs these; the list never renders them. */
@@ -362,7 +599,6 @@ const HEADER_DETAIL_AGGREGATES: Array<AggregatedColumn> = [
   { alias: "aggRrwebVersion", expression: argMaxColumn("rrwebVersion") },
   { alias: "aggSchemaVersion", expression: argMaxNumeric("schemaVersion") },
   { alias: "aggWireVersion", expression: argMaxNumeric("wireVersion") },
-  { alias: "aggRoutes", expression: argMaxColumn("routes") },
   { alias: "aggFidelityNotices", expression: argMaxColumn("fidelityNotices") },
   {
     alias: "aggFullSnapshotChunkIndexes",
@@ -374,6 +610,31 @@ const HEADER_DETAIL_AGGREGATES: Array<AggregatedColumn> = [
     expression: argMaxColumn("exceptionFingerprints"),
   },
   { alias: "aggClockSkewMs", expression: argMaxNumeric("clockSkewMs") },
+  {
+    alias: "aggClientReportedStart",
+    expression: argMaxDateTime("clientReportedStartTime"),
+  },
+  {
+    alias: "aggCustomEventCount",
+    expression: argMaxNumeric("customEventCount"),
+  },
+  { alias: "aggAttributes", expression: argMaxColumn("attributes") },
+];
+
+/*
+ * The two columns under the identity ACL. Named in a statement ONLY when
+ * the caller has already passed canReadIdentifiedUserLabel for the
+ * application the statement is pinned to.
+ */
+const IDENTITY_AGGREGATES: Array<AggregatedColumn> = [
+  {
+    alias: "aggIdentifiedUserLabel",
+    expression: argMaxColumn("identifiedUserLabel"),
+  },
+  {
+    alias: "aggIdentifiedUserTraits",
+    expression: argMaxColumn("identifiedUserTraits"),
+  },
 ];
 
 function toSelectList(columns: Array<AggregatedColumn>): string {
@@ -456,6 +717,32 @@ function readNumberArray(row: JSONObject, key: string): Array<number> {
   return numbers;
 }
 
+/*
+ * A Map(String, String) column. ClickHouse serialises it as a JSON object;
+ * anything else (including an array, or a row that predates the column)
+ * reads as an empty map.
+ */
+function readStringMap(row: JSONObject, key: string): Record<string, string> {
+  const value: unknown = row[key];
+  const result: Record<string, string> = {};
+
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return result;
+  }
+
+  for (const entryKey of Object.keys(value as Record<string, unknown>)) {
+    const entry: unknown = (value as Record<string, unknown>)[entryKey];
+
+    if (typeof entry === "string") {
+      result[entryKey] = entry;
+    } else if (typeof entry === "number" || typeof entry === "boolean") {
+      result[entryKey] = String(entry);
+    }
+  }
+
+  return result;
+}
+
 /*
  * Unix millis -> Date. The queries return epoch milliseconds as a Float64
  * precisely so no ClickHouse datetime string ever has to be re-parsed
@@ -466,7 +753,79 @@ function readDate(row: JSONObject, key: string): Date {
   return new Date(readNumber(row, key));
 }
 
+/*
+ * The capability list chunk 0 declared, filtered to the vocabulary this
+ * build knows so a stored typo never reaches the player as a capability.
+ */
+function readRecorderCapabilities(row: JSONObject): Array<string> {
+  const attributes: Record<string, string> = readStringMap(
+    row,
+    "aggAttributes",
+  );
+  const raw: string | undefined = attributes[RECORDER_CAPABILITIES_ATTRIBUTE];
+
+  if (!raw) {
+    return [];
+  }
+
+  return raw
+    .split(",")
+    .map((capability: string): string => {
+      return capability.trim();
+    })
+    .filter((capability: string): boolean => {
+      return SESSION_REPLAY_RECORDER_CAPABILITIES.includes(capability);
+    });
+}
+
+interface ActivitySummaryCacheEntry {
+  summary: SessionReplayApplicationActivitySummary;
+  expiresAt: number;
+}
+
+const activitySummaryCache: Map<string, ActivitySummaryCacheEntry> = new Map<
+  string,
+  ActivitySummaryCacheEntry
+>();
+
+/*
+ * Where the published recorder version comes from. The recorder manifest
+ * is read by App/FeatureSet/BrowserRecorder/Manifest.ts, which lives in
+ * the App tree and cannot be imported from Common; the feature set that
+ * mounts the read routes registers the reader at boot. Until it does, the
+ * ingest-status route answers null - "unknown", never a guessed version.
+ */
+type PublishedRecorderVersionProvider = () => string | null;
+
+let publishedRecorderVersionProvider: PublishedRecorderVersionProvider | null =
+  null;
+
 export default class SessionReplayReadService {
+  public static setPublishedRecorderVersionProvider(
+    provider: PublishedRecorderVersionProvider | null,
+  ): void {
+    publishedRecorderVersionProvider = provider;
+  }
+
+  public static getPublishedRecorderVersion(): string | null {
+    if (!publishedRecorderVersionProvider) {
+      return null;
+    }
+
+    try {
+      const version: string | null = publishedRecorderVersionProvider();
+
+      return typeof version === "string" && version.length > 0 ? version : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /* Test seam: the summary cache is process-local. */
+  public static clearActivitySummaryCache(): void {
+    activitySummaryCache.clear();
+  }
+
   /*
    * Session list.
    *
@@ -474,7 +833,10 @@ export default class SessionReplayReadService {
    * are the first three elements of the sort key AND they are part of the
    * ReplacingMergeTree replace key, so they are byte-identical on every
    * duplicate row of a session. Filtering on them before the GROUP BY is
-   * therefore both index-friendly and safe.
+   * therefore both index-friendly and safe. Nothing else is ever added to
+   * the WHERE: any other predicate would have to run over raw rows and
+   * would either match a superseded header version or force a scan that
+   * the (projectId, rumApplicationId, startTime) prefix cannot prune.
    *
    * Everything else is filtered in HAVING against the argMax'd value.
    * That is not a style choice: a provisional header (written on chunk 0,
@@ -492,6 +854,24 @@ export default class SessionReplayReadService {
       Math.min(request.limit, MAX_SESSION_REPLAY_LIST_LIMIT),
     );
 
+    const sortBy: SessionReplaySortBy = request.sortBy || "startTime";
+
+    if (!SESSION_REPLAY_SORT_BY_VALUES.includes(sortBy)) {
+      throw new BadDataException(
+        `sortBy must be one of ${SESSION_REPLAY_SORT_BY_VALUES.join(", ")}.`,
+      );
+    }
+
+    if (request.cursor && request.cursor.sortBy !== sortBy) {
+      /*
+       * A cursor is a position in ONE ordering. Applying a "most errors"
+       * cursor to a "newest" list would silently skip or repeat sessions.
+       */
+      throw new BadDataException(
+        `The cursor belongs to a list sorted by ${request.cursor.sortBy}, not ${sortBy}. Start from the first page.`,
+      );
+    }
+
     const selectList: string = toSelectList(HEADER_AGGREGATES);
 
     const statement: Statement = SQL`
@@ -503,9 +883,7 @@ export default class SessionReplayReadService {
     statement.append(`    ${selectList}`);
 
     if (request.includeIdentifiedUserLabel) {
-      statement.append(
-        `,\n        ${argMaxColumn("identifiedUserLabel")} AS aggIdentifiedUserLabel`,
-      );
+      statement.append(`,\n        ${toSelectList(IDENTITY_AGGREGATES)}`);
     }
 
     statement.append(SQL`
@@ -532,19 +910,24 @@ export default class SessionReplayReadService {
 
     /*
      * Keyset cursor. The sort key is (projectId, rumApplicationId,
-     * startTime, sessionId) and the list is ordered by the same tuple
-     * descending, so the previous page's last startTime is a valid
-     * WHERE-level upper bound: it prunes granules instead of paging with
-     * OFFSET, which on a wide time window would re-read and re-aggregate
-     * everything already returned. The exact ties are removed by the
-     * HAVING tiebreak below - the WHERE bound is deliberately inclusive
-     * so a row sharing the boundary timestamp is not skipped.
+     * startTime, sessionId) and the newest-first list is ordered by the
+     * same tuple descending, so the previous page's last startTime is a
+     * valid WHERE-level upper bound: it prunes granules instead of paging
+     * with OFFSET, which on a wide time window would re-read and
+     * re-aggregate everything already returned. The exact ties are
+     * removed by the HAVING tiebreak below - the WHERE bound is
+     * deliberately inclusive so a row sharing the boundary timestamp is
+     * not skipped.
+     *
+     * Only for the startTime sort: for any other key the cursor value is
+     * an aggregate, and a WHERE on startTime would drop sessions that
+     * belong on later pages.
      */
-    if (request.cursor) {
+    if (request.cursor && sortBy === "startTime") {
       statement.append(
         SQL` AND startTime <= ${{
           type: TableColumnType.DateTime64,
-          value: new Date(request.cursor.startTimeUnixMs),
+          value: new Date(request.cursor.sortValue),
         }}`,
       );
     }
@@ -556,16 +939,25 @@ export default class SessionReplayReadService {
     SessionReplayReadService.appendListHavingFilters(
       statement,
       request.filters,
+      request.includeIdentifiedUserLabel,
     );
 
+    const sortExpression: string =
+      SessionReplayReadService.getSortExpression(sortBy);
+
     if (request.cursor) {
+      statement.append(` AND (${sortExpression} < `);
       statement.append(
-        SQL` AND (aggStartTime < ${{
+        SQL`${{
           type: TableColumnType.Decimal,
-          value: request.cursor.startTimeUnixMs,
-        }} OR (aggStartTime = ${{
+          value: request.cursor.sortValue,
+        }}`,
+      );
+      statement.append(` OR (${sortExpression} = `);
+      statement.append(
+        SQL`${{
           type: TableColumnType.Decimal,
-          value: request.cursor.startTimeUnixMs,
+          value: request.cursor.sortValue,
         }} AND sessionId < ${{
           type: TableColumnType.Text,
           value: request.cursor.sessionId,
@@ -573,12 +965,12 @@ export default class SessionReplayReadService {
       );
     }
 
+    statement.append(` ORDER BY ${sortExpression} DESC, sessionId DESC`);
     statement.append(
-      SQL` ORDER BY aggStartTime DESC, sessionId DESC
-           LIMIT ${{
-             type: TableColumnType.Number,
-             value: limit + 1,
-           }}`,
+      SQL` LIMIT ${{
+        type: TableColumnType.Number,
+        value: limit + 1,
+      }}`,
     );
 
     statement.append(READ_QUERY_SETTINGS);
@@ -600,11 +992,14 @@ export default class SessionReplayReadService {
 
     const sessions: Array<SessionReplayListItem> = pageRows.map(
       (row: JSONObject): SessionReplayListItem => {
+        const startTime: Date = readDate(row, "aggStartTime");
+        const endTime: Date = readDate(row, "aggEndTime");
+
         const item: SessionReplayListItem = {
           sessionId: readString(row, "sessionId"),
           rumApplicationId: readString(row, "applicationId"),
-          startTime: readDate(row, "aggStartTime"),
-          endTime: readDate(row, "aggEndTime"),
+          startTime: startTime,
+          endTime: endTime,
           durationMs: readNumber(row, "aggDurationMs"),
           isFinalized: readBoolean(row, "aggIsFinalized"),
           sealedReason: readString(row, "aggSealedReason"),
@@ -632,10 +1027,28 @@ export default class SessionReplayReadService {
           viewportHeight: readNumber(row, "aggViewportHeight"),
           identifiedUserKey: readString(row, "aggIdentifiedUserKey"),
           samplePercentageAtCapture: readNumber(row, "aggSamplePercentage"),
+          routes: readStringArray(row, "aggRoutes").slice(0, MAX_LIST_ROUTES),
+          traceCount: readNumber(row, "aggTraceCount"),
+          exceptionGroupCount: readNumber(row, "aggExceptionGroupCount"),
+          topExceptionFingerprint: readString(
+            row,
+            "aggTopExceptionFingerprint",
+          ),
+          clickCount: readNumber(row, "aggClickCount"),
+          activeMs: readNumber(row, "aggActiveMs"),
+          firstErrorOffsetMs: readNumber(row, "aggFirstErrorOffsetMs"),
+          expiresAtUnixMs: readNumber(row, "aggExpiresAt"),
+          tags: readStringMap(row, "aggTags"),
+          startTimeUnixMs: startTime.getTime(),
+          endTimeUnixMs: endTime.getTime(),
         };
 
         if (request.includeIdentifiedUserLabel) {
           item.identifiedUserLabel = readString(row, "aggIdentifiedUserLabel");
+          item.identifiedUserTraits = readStringMap(
+            row,
+            "aggIdentifiedUserTraits",
+          );
         }
 
         return item;
@@ -650,7 +1063,11 @@ export default class SessionReplayReadService {
       nextCursor:
         hasMore && lastSession
           ? {
-              startTimeUnixMs: lastSession.startTime.getTime(),
+              sortBy: sortBy,
+              sortValue: SessionReplayReadService.getSortValue(
+                sortBy,
+                lastSession,
+              ),
               sessionId: lastSession.sessionId,
             }
           : null,
@@ -663,14 +1080,22 @@ export default class SessionReplayReadService {
    *
    * This is also what resolves a sessionId to its owning RUM application
    * for the handler-level authorization check, which is why it is keyed
-   * on (projectId, sessionId) only and never accepts an application id
-   * from the caller: an application id supplied in the request body would
-   * make the check circular.
+   * on (projectId, sessionId) and the optional rumApplicationId is a
+   * DISAMBIGUATOR, never a substitute for the check: a supplied id only
+   * narrows which header row is read, and the handler still authorizes
+   * the application that row names.
    */
   @CaptureSpan()
   public static async getSessionHeader(data: {
     projectId: ObjectID;
     sessionId: string;
+    /*
+     * Which application's recording to read when the same browser-minted
+     * sessionId was recorded under more than one application (an
+     * appIdentifier rename, two apps on one origin). Without it an
+     * ambiguous id is refused.
+     */
+    rumApplicationId?: ObjectID | undefined;
   }): Promise<SessionReplaySessionHeader | null> {
     const selectList: string = toSelectList([
       ...HEADER_AGGREGATES,
@@ -698,6 +1123,15 @@ export default class SessionReplayReadService {
         }}
     `);
 
+    if (data.rumApplicationId) {
+      statement.append(
+        SQL` AND rumApplicationId = ${{
+          type: TableColumnType.ObjectID,
+          value: data.rumApplicationId,
+        }}`,
+      );
+    }
+
     statement.append(RETENTION_FILTER);
 
     /*
@@ -711,9 +1145,10 @@ export default class SessionReplayReadService {
      * sessionId share a key space. Picking the newest group would let
      * anyone who can write to application A resolve a sessionId belonging
      * to application B onto their own application and pass the label
-     * check. An ambiguous sessionId is refused outright instead: it is
-     * either an attack or a collision, and neither has a correct
-     * recording to return.
+     * check. An ambiguous sessionId is refused outright unless the caller
+     * named the application it wants (which is then authorized on its own
+     * merits): it is either an attack or a collision, and neither has a
+     * single correct recording to return.
      */
     statement.append(
       " GROUP BY projectId, rumApplicationId, sessionId ORDER BY aggStartTime DESC LIMIT 2",
@@ -730,7 +1165,7 @@ export default class SessionReplayReadService {
 
     if (rows.length > 1) {
       throw new BadDataException(
-        "This session id resolves to more than one RUM application and cannot be played back.",
+        "This session id was recorded under more than one application in this project. Open it from the session list of the application you want to watch, which passes rumApplicationId to choose the recording.",
       );
     }
 
@@ -740,12 +1175,15 @@ export default class SessionReplayReadService {
       return null;
     }
 
+    const startTime: Date = readDate(row, "aggStartTime");
+    const endTime: Date = readDate(row, "aggEndTime");
+
     return {
       sessionId: readString(row, "sessionId"),
       projectId: readString(row, "headerProjectId"),
       rumApplicationId: readString(row, "applicationId"),
-      startTime: readDate(row, "aggStartTime"),
-      endTime: readDate(row, "aggEndTime"),
+      startTime: startTime,
+      endTime: endTime,
       durationMs: readNumber(row, "aggDurationMs"),
       isFinalized: readBoolean(row, "aggIsFinalized"),
       sealedReason: readString(row, "aggSealedReason"),
@@ -787,57 +1225,43 @@ export default class SessionReplayReadService {
       traceIds: readStringArray(row, "aggTraceIds"),
       exceptionFingerprints: readStringArray(row, "aggExceptionFingerprints"),
       clockSkewMs: readNumber(row, "aggClockSkewMs"),
+      startTimeUnixMs: startTime.getTime(),
+      endTimeUnixMs: endTime.getTime(),
+      clientReportedStartUnixMs: readNumber(row, "aggClientReportedStart"),
+      tags: readStringMap(row, "aggTags"),
+      expiresAtUnixMs: readNumber(row, "aggExpiresAt"),
+      clickCount: readNumber(row, "aggClickCount"),
+      customEventCount: readNumber(row, "aggCustomEventCount"),
+      activeMs: readNumber(row, "aggActiveMs"),
+      firstErrorOffsetMs: readNumber(row, "aggFirstErrorOffsetMs"),
+      recorderCapabilities: readRecorderCapabilities(row),
     };
   }
 
   /*
-   * Playback manifest: everything the player needs to draw a complete,
-   * honest timeline without fetching one payload byte.
-   *
-   * The `payload` column is deliberately absent from this SELECT. That is
-   * the entire performance story of the feature: a 14-chunk session is
-   * one 128-row granule of a handful of narrow columns (~2 KB) instead of
-   * megabytes of decompressed recording.
+   * The identity columns for one session, pinned to the application the
+   * caller was authorized against. This is the ONLY statement outside the
+   * identity-gated list projection that names identifiedUserLabel or
+   * identifiedUserTraits, and the manifest handler calls it strictly
+   * after canReadIdentifiedUserLabel has passed for this application. It
+   * is a separate, tiny read rather than two more columns on
+   * getSessionHeader because the header is resolved BEFORE the
+   * application (and therefore the identity decision) is known.
    */
   @CaptureSpan()
-  public static async getManifest(data: {
-    header: SessionReplaySessionHeader;
+  public static async getSessionIdentity(data: {
     projectId: ObjectID;
-    /*
-     * The application the caller was actually authorized against, always
-     * the one resolved from the session header server-side. Every chunk
-     * read is pinned to it: the chunk table's replace key does not
-     * include rumApplicationId, so (projectId, sessionId) alone is not a
-     * tenant-safe key once a sessionId can be reused across
-     * applications.
-     */
     rumApplicationId: ObjectID;
     sessionId: string;
-  }): Promise<SessionReplayManifest> {
-    /*
-     * LIMIT 1 BY (tabId, chunkIndex) after ORDER BY ... version DESC
-     * keeps exactly the highest-version row per chunk. tabId is part of
-     * the group because chunkIndex is minted per tab. Ordering by
-     * tabId/chunkIndex first (rather than by version alone) leaves the
-     * output already sorted for the caller - LIMIT BY runs after ORDER
-     * BY, so the version DESC tiebreak still selects the right row.
-     */
+  }): Promise<SessionReplaySessionIdentity> {
     const statement: Statement = SQL`
       SELECT
-        tabId,
-        chunkIndex,
-        chunkStartOffsetMs,
-        chunkEndOffsetMs,
-        eventCount,
-        hasFullSnapshot,
-        toFloat64(payloadBytes) AS chunkPayloadBytes,
-        errorCount,
-        rageClickCount,
-        deadClickCount,
-        errorClickCount,
-        refreshRageCount,
-        routeCount
-      FROM ${AnalyticsTableName.RumSessionChunk}
+    `;
+
+    statement.append(`    ${toSelectList(IDENTITY_AGGREGATES)}`);
+
+    statement.append(SQL`
+      FROM ${AnalyticsTableName.RumSession}
       WHERE projectId = ${{
         type: TableColumnType.ObjectID,
         value: data.projectId,
@@ -850,55 +1274,221 @@ export default class SessionReplayReadService {
           type: TableColumnType.Text,
           value: data.sessionId,
         }}
-    `;
+    `);
 
     statement.append(RETENTION_FILTER);
-
     statement.append(
-      SQL` ORDER BY tabId ASC, chunkIndex ASC, version DESC
-           LIMIT 1 BY tabId, chunkIndex
-           LIMIT ${{
-             type: TableColumnType.Number,
-             value: MAX_MANIFEST_ROWS,
-           }}`,
+      " GROUP BY projectId, rumApplicationId, sessionId LIMIT 1",
     );
-
     statement.append(READ_QUERY_SETTINGS);
 
-    const dbResult: Results =
-      await RumSessionChunkService.executeQuery(statement);
+    const dbResult: Results = await RumSessionService.executeQuery(statement);
     const response: DbJSONResponse = await dbResult.json<{
       data?: Array<JSONObject>;
     }>();
 
-    const rows: Array<JSONObject> = response.data || [];
-
-    const tabsById: Map<
-      string,
-      Array<SessionReplayChunkManifestEntry>
-    > = new Map<string, Array<SessionReplayChunkManifestEntry>>();
-
-    for (const row of rows) {
-      const tabId: string = readString(row, "tabId");
+    const row: JSONObject | undefined = (response.data || [])[0];
 
-      const entry: SessionReplayChunkManifestEntry = {
-        chunkIndex: readNumber(row, "chunkIndex"),
-        tabId: tabId,
-        chunkStartOffsetMs: readNumber(row, "chunkStartOffsetMs"),
-        chunkEndOffsetMs: readNumber(row, "chunkEndOffsetMs"),
-        eventCount: readNumber(row, "eventCount"),
-        hasFullSnapshot: readBoolean(row, "hasFullSnapshot"),
-        payloadBytes: readNumber(row, "chunkPayloadBytes"),
-        errorCount: readNumber(row, "errorCount"),
-        rageClickCount: readNumber(row, "rageClickCount"),
-        deadClickCount: readNumber(row, "deadClickCount"),
-        errorClickCount: readNumber(row, "errorClickCount"),
-        refreshRageCount: readNumber(row, "refreshRageCount"),
-        routeCount: readNumber(row, "routeCount"),
-      };
+    if (!row) {
+      return { identifiedUserLabel: "", identifiedUserTraits: {} };
+    }
 
-      const existing: Array<SessionReplayChunkManifestEntry> | undefined =
-        tabsById.get(tabId);
+    return {
+      identifiedUserLabel: readString(row, "aggIdentifiedUserLabel"),
+      identifiedUserTraits: readStringMap(row, "aggIdentifiedUserTraits"),
+    };
+  }
+
+  /*
+   * For a sessionId that getSessionHeader could not find: did a header
+   * ever exist, and when did (or does) it expire? Runs WITHOUT the
+   * retention filter, which is safe only because it returns dates and an
+   * application id and never a row's content - it lets the handler say
+   * "this recording expired on <date>" instead of "not found".
+   *
+   * null when no row exists at all (never recorded, or already dropped by
+   * the ClickHouse TTL, or erased).
+   */
+  @CaptureSpan()
+  public static async getExpiredSessionInfo(data: {
+    projectId: ObjectID;
+    sessionId: string;
+    rumApplicationId?: ObjectID | undefined;
+  }): Promise<SessionReplayExpiredSessionInfo | null> {
+    const statement: Statement = SQL`
+      SELECT
+        toString(rumApplicationId) AS applicationId,
+        toFloat64(toUnixTimestamp(max(retentionDate))) * 1000 AS expiresAtUnixMs,
+        toFloat64(toUnixTimestamp64Milli(min(startTime))) AS startTimeUnixMs
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: data.projectId,
+      }}
+        AND sessionId = ${{
+          type: TableColumnType.Text,
+          value: data.sessionId,
+        }}
+    `;
+
+    if (data.rumApplicationId) {
+      statement.append(
+        SQL` AND rumApplicationId = ${{
+          type: TableColumnType.ObjectID,
+          value: data.rumApplicationId,
+        }}`,
+      );
+    }
+
+    statement.append(
+      " GROUP BY rumApplicationId ORDER BY expiresAtUnixMs DESC LIMIT 1",
+    );
+    statement.append(READ_QUERY_SETTINGS);
+
+    const dbResult: Results = await RumSessionService.executeQuery(statement);
+    const response: DbJSONResponse = await dbResult.json<{
+      data?: Array<JSONObject>;
+    }>();
+
+    const row: JSONObject | undefined = (response.data || [])[0];
+
+    if (!row) {
+      return null;
+    }
+
+    return {
+      rumApplicationId: readString(row, "applicationId"),
+      startTime: readDate(row, "startTimeUnixMs"),
+      expiresAt: readDate(row, "expiresAtUnixMs"),
+    };
+  }
+
+  /*
+   * Playback manifest: everything the player needs to draw a complete,
+   * honest timeline without fetching one payload byte.
+   *
+   * The `payload` column is deliberately absent from this SELECT. That is
+   * the entire performance story of the feature: a 14-chunk session is
+   * one 128-row granule of a handful of narrow columns (~2 KB) instead of
+   * megabytes of decompressed recording.
+   */
+  @CaptureSpan()
+  public static async getManifest(data: {
+    header: SessionReplaySessionHeader;
+    projectId: ObjectID;
+    /*
+     * The application the caller was actually authorized against, always
+     * the one resolved from the session header server-side. Every chunk
+     * read is pinned to it: the chunk table's replace key does not
+     * include rumApplicationId, so (projectId, sessionId) alone is not a
+     * tenant-safe key once a sessionId can be reused across
+     * applications.
+     */
+    rumApplicationId: ObjectID;
+    sessionId: string;
+  }): Promise<SessionReplayManifest> {
+    /*
+     * LIMIT 1 BY (tabId, chunkIndex) after ORDER BY ... version DESC
+     * keeps exactly the highest-version row per chunk. tabId is part of
+     * the group because chunkIndex is minted per tab. Ordering by
+     * tabId/chunkIndex first (rather than by version alone) leaves the
+     * output already sorted for the caller - LIMIT BY runs after ORDER
+     * BY, so the version DESC tiebreak still selects the right row.
+     *
+     * clickCount and url are narrow columns: the activity lane and the
+     * URL bar read them before any chunk is decoded. payloadBytes stays
+     * the WIRE size the recorder posted; the stored size is only ever
+     * measured by getChunks, which is the read the cap actually bounds.
+     */
+    const statement: Statement = SQL`
+      SELECT
+        tabId,
+        chunkIndex,
+        chunkStartOffsetMs,
+        chunkEndOffsetMs,
+        eventCount,
+        hasFullSnapshot,
+        toFloat64(payloadBytes) AS chunkPayloadBytes,
+        errorCount,
+        rageClickCount,
+        deadClickCount,
+        errorClickCount,
+        refreshRageCount,
+        routeCount,
+        clickCount,
+        url
+      FROM ${AnalyticsTableName.RumSessionChunk}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: data.projectId,
+      }}
+        AND rumApplicationId = ${{
+          type: TableColumnType.ObjectID,
+          value: data.rumApplicationId,
+        }}
+        AND sessionId = ${{
+          type: TableColumnType.Text,
+          value: data.sessionId,
+        }}
+    `;
+
+    statement.append(RETENTION_FILTER);
+
+    statement.append(
+      SQL` ORDER BY tabId ASC, chunkIndex ASC, version DESC
+           LIMIT 1 BY tabId, chunkIndex
+           LIMIT ${{
+             type: TableColumnType.Number,
+             value: MAX_MANIFEST_ROWS,
+           }}`,
+    );
+
+    statement.append(READ_QUERY_SETTINGS);
+
+    const dbResult: Results =
+      await RumSessionChunkService.executeQuery(statement);
+    const response: DbJSONResponse = await dbResult.json<{
+      data?: Array<JSONObject>;
+    }>();
+
+    const rows: Array<JSONObject> = response.data || [];
+
+    const tabsById: Map<
+      string,
+      Array<SessionReplayChunkManifestEntry>
+    > = new Map<string, Array<SessionReplayChunkManifestEntry>>();
+
+    let liveDurationMs: number = 0;
+    let liveEventCount: number = 0;
+    let liveMaxChunkIndex: number = 0;
+
+    for (const row of rows) {
+      const tabId: string = readString(row, "tabId");
+
+      const entry: SessionReplayChunkManifestEntry = {
+        chunkIndex: readNumber(row, "chunkIndex"),
+        tabId: tabId,
+        chunkStartOffsetMs: readNumber(row, "chunkStartOffsetMs"),
+        chunkEndOffsetMs: readNumber(row, "chunkEndOffsetMs"),
+        eventCount: readNumber(row, "eventCount"),
+        hasFullSnapshot: readBoolean(row, "hasFullSnapshot"),
+        payloadBytes: readNumber(row, "chunkPayloadBytes"),
+        errorCount: readNumber(row, "errorCount"),
+        rageClickCount: readNumber(row, "rageClickCount"),
+        deadClickCount: readNumber(row, "deadClickCount"),
+        errorClickCount: readNumber(row, "errorClickCount"),
+        refreshRageCount: readNumber(row, "refreshRageCount"),
+        routeCount: readNumber(row, "routeCount"),
+        clickCount: readNumber(row, "clickCount"),
+        url: readString(row, "url"),
+      };
+
+      liveDurationMs = Math.max(liveDurationMs, entry.chunkEndOffsetMs);
+      liveEventCount += entry.eventCount;
+      liveMaxChunkIndex = Math.max(liveMaxChunkIndex, entry.chunkIndex);
+
+      const existing: Array<SessionReplayChunkManifestEntry> | undefined =
+        tabsById.get(tabId);
 
       if (existing) {
         existing.push(entry);
@@ -944,107 +1534,95 @@ export default class SessionReplayReadService {
           },
           0,
         ),
+        firstChunkStartOffsetMs: entries.reduce(
+          (min: number, entry: SessionReplayChunkManifestEntry): number => {
+            return Math.min(min, entry.chunkStartOffsetMs);
+          },
+          Number.POSITIVE_INFINITY,
+        ),
       });
     }
 
+    for (const tab of tabs) {
+      if (!Number.isFinite(tab.firstChunkStartOffsetMs)) {
+        tab.firstChunkStartOffsetMs = 0;
+      }
+    }
+
     return {
-      header: data.header,
+      header: SessionReplayReadService.reconcileLiveHeader({
+        header: data.header,
+        chunkRowCount: rows.length,
+        liveDurationMs: liveDurationMs,
+        liveEventCount: liveEventCount,
+        liveMaxChunkIndex: liveMaxChunkIndex,
+      }),
       tabs: tabs,
       isChunkIndexTruncated: rows.length >= MAX_MANIFEST_ROWS,
     };
   }
 
   /*
-   * Total STORED bytes for a specific set of chunks, without shipping the
-   * payload column to the application.
-   *
-   * `length(payload)`, deliberately NOT `payloadBytes`. Those are two
-   * different quantities: payloadBytes is the post-gzip WIRE size the
-   * recorder uploaded (the metering signal), while the payload column
-   * holds the DECOMPRESSED JSON and is what this endpoint actually
-   * returns. rrweb JSON gzips 10-20x, so a cap applied to payloadBytes
-   * bounds a number an order of magnitude smaller than the response and
-   * therefore bounds nothing useful.
-   *
-   * The cost is that ClickHouse has to decompress the column to measure
-   * it, which is exactly what naming `payload` was meant to avoid. It is
-   * still worth doing before the read rather than after: the bytes are
-   * measured inside ClickHouse and never cross the wire, and the marks
-   * the following read needs are warm by the time it runs.
+   * A provisional header (isFinalized false) says durationMs 0, chunkCount
+   * 0 and eventCount 0 while its chunk rows say otherwise; the manifest
+   * has just read every chunk row, so it reports what the rows prove. A
+   * finalized header is authoritative and returned untouched.
    */
-  @CaptureSpan()
-  public static async getChunkStoredBytes(data: {
-    projectId: ObjectID;
-    rumApplicationId: ObjectID;
-    sessionId: string;
-    tabId: string;
-    chunkIndexes: Array<number>;
-  }): Promise<number> {
-    if (data.chunkIndexes.length === 0) {
-      return 0;
+  private static reconcileLiveHeader(data: {
+    header: SessionReplaySessionHeader;
+    chunkRowCount: number;
+    liveDurationMs: number;
+    liveEventCount: number;
+    liveMaxChunkIndex: number;
+  }): SessionReplaySessionHeader {
+    if (data.header.isFinalized || data.chunkRowCount === 0) {
+      return data.header;
     }
 
-    const statement: Statement = SQL`
-      SELECT
-        chunkIndex,
-        toFloat64(length(payload)) AS chunkStoredBytes
-      FROM ${AnalyticsTableName.RumSessionChunk}
-      WHERE projectId = ${{
-        type: TableColumnType.ObjectID,
-        value: data.projectId,
-      }}
-        AND rumApplicationId = ${{
-          type: TableColumnType.ObjectID,
-          value: data.rumApplicationId,
-        }}
-        AND sessionId = ${{
-          type: TableColumnType.Text,
-          value: data.sessionId,
-        }}
-        AND tabId = ${{
-          type: TableColumnType.Text,
-          value: data.tabId,
-        }}
-        AND chunkIndex IN (${{
-          type: TableColumnType.Number,
-          value: new Includes(data.chunkIndexes),
-        }})
-    `;
-
-    statement.append(RETENTION_FILTER);
-
-    /*
-     * Deduplicated exactly like the payload read, so the pre-check and
-     * the read it guards can never disagree about which rows count.
-     * Summed in TypeScript rather than in SQL because the row count is
-     * bounded by MAX_SESSION_REPLAY_CHUNKS_PER_READ, and a wrapping
-     * aggregate would need a subquery whose LIMIT BY semantics are
-     * easier to get subtly wrong than to read.
-     */
-    statement.append(
-      " ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex",
+    const durationMs: number = Math.max(
+      data.header.durationMs,
+      data.liveDurationMs,
     );
-
-    statement.append(READ_QUERY_SETTINGS);
-
-    const dbResult: Results =
-      await RumSessionChunkService.executeQuery(statement);
-    const response: DbJSONResponse = await dbResult.json<{
-      data?: Array<JSONObject>;
-    }>();
-
-    return (response.data || []).reduce(
-      (total: number, row: JSONObject): number => {
-        return total + readNumber(row, "chunkStoredBytes");
-      },
-      0,
+    const endTimeUnixMs: number = Math.max(
+      data.header.endTimeUnixMs,
+      data.header.startTimeUnixMs + durationMs,
     );
+
+    return {
+      ...data.header,
+      durationMs: durationMs,
+      endTime: new Date(endTimeUnixMs),
+      endTimeUnixMs: endTimeUnixMs,
+      chunkCount: Math.max(data.header.chunkCount, data.chunkRowCount),
+      eventCount: Math.max(data.header.eventCount, data.liveEventCount),
+      maxChunkIndex: Math.max(
+        data.header.maxChunkIndex,
+        data.liveMaxChunkIndex,
+      ),
+    };
   }
 
   /*
    * The payload read. The only query in the system that names the
    * `payload` column.
    *
+   * The byte cap is measured on `length(payload)` - the DECOMPRESSED
+   * stored JSON that is actually returned - in the SAME statement that
+   * ships the bytes, so the column is decompressed once per page rather
+   * than once for a pre-check and again for the read. `payloadBytes` is
+   * the post-gzip WIRE size the recorder uploaded; rrweb JSON gzips
+   * 10-20x, so a cap on it bounds a number an order of magnitude smaller
+   * than the response and therefore bounds nothing useful.
+   *
+   * Prefix semantics rather than refusal. A page that does not fit is
+   * answered with the longest prefix of whole chunks that does, and ALWAYS
+   * with at least the first chunk: the ingest cap
+   * (SESSION_REPLAY_MAX_DECOMPRESSED_FRAME_BYTES) already bounds a single
+   * frame, so a lone chunk can never exceed what the ingest let in, and a
+   * single oversized snapshot that could never be served would dead-end
+   * playback at that chunk forever. The player plans pages against the
+   * wire size it has, requests, and reads back whichever chunks arrived.
+   *
    * Both caps are enforced here rather than only at the route so no
    * future caller can reach the payload column without them.
    */
@@ -1055,9 +1633,9 @@ export default class SessionReplayReadService {
     sessionId: string;
     tabId: string;
     chunkIndexes: Array<number>;
-  }): Promise<Array<SessionReplayChunkPayload>> {
+  }): Promise<SessionReplayChunkReadResult> {
     if (data.chunkIndexes.length === 0) {
-      return [];
+      return { chunks: [], omittedChunkIndexes: [] };
     }
 
     if (data.chunkIndexes.length > MAX_SESSION_REPLAY_CHUNKS_PER_READ) {
@@ -1066,52 +1644,69 @@ export default class SessionReplayReadService {
       );
     }
 
-    const totalBytes: number =
-      await SessionReplayReadService.getChunkStoredBytes(data);
-
-    if (totalBytes > MAX_SESSION_REPLAY_READ_BYTES) {
-      throw new BadDataException(
-        `The requested chunks total ${totalBytes} bytes, which exceeds the ${MAX_SESSION_REPLAY_READ_BYTES} byte limit for a single read. Request fewer chunks.`,
-      );
-    }
-
+    /*
+     * Innermost: the de-duplicated rows. A retried delivery is two
+     * physically present rows on a ReplacingMergeTree until a merge runs.
+     * Feeding both to the player would replay the same mutations twice,
+     * which rrweb resolves against node ids and would either throw or
+     * render a DOM that never existed.
+     *
+     * Middle: a running total of stored bytes in chunk order. Outermost:
+     * a row is SERVED when the total up to and including it is under the
+     * cap, or when it is the first row; a row that is not served keeps
+     * its index (so the caller can name what was omitted) but ships an
+     * empty payload, so the bytes crossing the wire are bounded inside
+     * ClickHouse and never in the application.
+     *
+     * The outer projection is aliased servedPayload rather than payload:
+     * an alias that names the column its own expression reads is a
+     * cyclic alias to ClickHouse.
+     */
     const statement: Statement = SQL`
       SELECT
         chunkIndex,
-        payload
-      FROM ${AnalyticsTableName.RumSessionChunk}
-      WHERE projectId = ${{
-        type: TableColumnType.ObjectID,
-        value: data.projectId,
-      }}
-        AND rumApplicationId = ${{
-          type: TableColumnType.ObjectID,
-          value: data.rumApplicationId,
-        }}
-        AND sessionId = ${{
-          type: TableColumnType.Text,
-          value: data.sessionId,
-        }}
-        AND tabId = ${{
-          type: TableColumnType.Text,
-          value: data.tabId,
-        }}
-        AND chunkIndex IN (${{
-          type: TableColumnType.Number,
-          value: new Includes(data.chunkIndexes),
-        }})
+        if(isServed, payload, '') AS servedPayload,
+        isServed
+      FROM (
+        SELECT
+          chunkIndex,
+          payload,
+          (sum(length(payload)) OVER (ORDER BY chunkIndex ASC ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) <= ${{
+            type: TableColumnType.Decimal,
+            value: MAX_SESSION_REPLAY_READ_BYTES,
+          }}
+            OR row_number() OVER (ORDER BY chunkIndex ASC) = 1) AS isServed
+        FROM (
+          SELECT
+            chunkIndex,
+            payload
+          FROM ${AnalyticsTableName.RumSessionChunk}
+          WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+          }}
+            AND rumApplicationId = ${{
+              type: TableColumnType.ObjectID,
+              value: data.rumApplicationId,
+            }}
+            AND sessionId = ${{
+              type: TableColumnType.Text,
+              value: data.sessionId,
+            }}
+            AND tabId = ${{
+              type: TableColumnType.Text,
+              value: data.tabId,
+            }}
+            AND chunkIndex IN (${{
+              type: TableColumnType.Number,
+              value: new Includes(data.chunkIndexes),
+            }})
     `;
 
     statement.append(RETENTION_FILTER);
 
-    /*
-     * A retried delivery is two physically present rows on a
-     * ReplacingMergeTree until a merge runs. Feeding both to the player
-     * would replay the same mutations twice, which rrweb resolves against
-     * node ids and would either throw or render a DOM that never existed.
-     */
     statement.append(
-      " ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex",
+      " ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex\n        )\n      )\n      ORDER BY chunkIndex ASC",
     );
 
     statement.append(READ_QUERY_SETTINGS);
@@ -1124,39 +1719,58 @@ export default class SessionReplayReadService {
 
     /*
      * The cap is re-applied to the bytes actually being handed back, not
-     * only to what the pre-check believed. The pre-check reads a
-     * different snapshot of a ReplacingMergeTree than the read it guards,
-     * and any future change to how stored size is derived would otherwise
-     * silently unbound the response. Accumulated as the rows are mapped
-     * so an oversized read fails before the caller ever holds the whole
-     * set.
+     * only to what ClickHouse computed: any future change to how stored
+     * size is derived would otherwise silently unbound the response. The
+     * prefix is also re-established here - a served row behind an
+     * unserved one would be a hole the player cannot play across, so the
+     * served set stops at the first omission.
      */
     let totalReturnedBytes: number = 0;
     const chunks: Array<SessionReplayChunkPayload> = [];
+    const omittedChunkIndexes: Array<number> = [];
 
-    for (const row of response.data || []) {
-      const payload: string = readString(row, "payload");
+    const chunkRows: Array<JSONObject> = response.data || [];
 
-      totalReturnedBytes += Buffer.byteLength(payload, "utf8");
+    for (const row of chunkRows) {
+      const chunkIndex: number = readNumber(row, "chunkIndex");
+      const payload: string = readString(row, "servedPayload");
+      const isServed: boolean =
+        row["isServed"] === undefined ? true : readBoolean(row, "isServed");
 
-      if (totalReturnedBytes > MAX_SESSION_REPLAY_READ_BYTES) {
-        throw new BadDataException(
-          `The requested chunks exceed the ${MAX_SESSION_REPLAY_READ_BYTES} byte limit for a single read. Request fewer chunks.`,
-        );
+      const payloadBytes: number = Buffer.byteLength(payload, "utf8");
+
+      const fits: boolean =
+        chunks.length === 0 ||
+        totalReturnedBytes + payloadBytes <= MAX_SESSION_REPLAY_READ_BYTES;
+
+      if (!isServed || !fits || omittedChunkIndexes.length > 0) {
+        omittedChunkIndexes.push(chunkIndex);
+        continue;
       }
 
+      totalReturnedBytes += payloadBytes;
+
       chunks.push({
-        chunkIndex: readNumber(row, "chunkIndex"),
+        chunkIndex: chunkIndex,
         payload: payload,
       });
     }
 
-    return chunks;
+    return { chunks: chunks, omittedChunkIndexes: omittedChunkIndexes };
   }
 
   /*
    * Sessions that observed a given exception fingerprint.
    *
+   * Two sources, one header query. The header's exceptionFingerprints
+   * array is written by the finalizer, so for the first 10+ minutes after
+   * the error - the whole incident, from the reporter's point of view -
+   * the session's header knows nothing about it. The exception instance
+   * table, however, carries the session id of the page that threw, from
+   * the moment the exception is ingested. Those ids are looked up first
+   * (cheap: bloom-indexed fingerprint, bounded window) and OR-ed into the
+   * header predicate, so a live session is found as soon as its error is.
+   *
    * hasAny() appears twice on purpose. In the WHERE it is a bloom-pruned
    * pre-filter over physical rows; a group survives it if ANY of its rows
    * carries the fingerprint, which necessarily includes the case where
@@ -1164,6 +1778,10 @@ export default class SessionReplayReadService {
    * drop a true match. The HAVING then re-checks the argMax'd array so a
    * fingerprint present only on a superseded row does not produce a false
    * positive.
+   *
+   * Always windowed. RumSession is partitioned by day, so without a
+   * window this scanned every partition the project ever wrote on every
+   * exception page load.
    */
   @CaptureSpan()
   public static async getSessionsForException(data: {
@@ -1178,6 +1796,8 @@ export default class SessionReplayReadService {
     accessibleRumApplicationIds: Array<ObjectID> | null;
     startTime?: Date | undefined;
     endTime?: Date | undefined;
+    /* Pin to the one session the caller already knows threw. */
+    sessionId?: string | undefined;
     limit: number;
   }): Promise<Array<SessionReplayExceptionSession>> {
     if (
@@ -1192,10 +1812,27 @@ export default class SessionReplayReadService {
       Math.min(data.limit, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT),
     );
 
+    const endTime: Date = data.endTime || OneUptimeDate.getCurrentDate();
+    const startTime: Date =
+      data.startTime ||
+      OneUptimeDate.addRemoveDays(
+        endTime,
+        -DEFAULT_SESSION_REPLAY_FOR_EXCEPTION_WINDOW_DAYS,
+      );
+
+    const instanceSessionIds: Array<string> =
+      await SessionReplayReadService.getSessionIdsForExceptionInstances({
+        projectId: data.projectId,
+        exceptionFingerprint: data.exceptionFingerprint,
+        startTime: startTime,
+        endTime: endTime,
+        sessionId: data.sessionId,
+      });
+
     const selectList: string = toSelectList([
       { alias: "aggStartTime", expression: argMaxDateTime("startTime") },
       { alias: "aggEndTime", expression: argMaxDateTime("endTime") },
-      { alias: "aggDurationMs", expression: argMaxNumeric("durationMs") },
+      { alias: "aggDurationMs", expression: LIVE_DURATION_EXPRESSION },
       { alias: "aggHasError", expression: argMaxColumn("hasError") },
       { alias: "aggErrorCount", expression: argMaxNumeric("errorCount") },
       /*
@@ -1247,14 +1884,8 @@ export default class SessionReplayReadService {
         type: TableColumnType.ObjectID,
         value: data.projectId,
       }}
-        AND hasAny(exceptionFingerprints, [${{
-          type: TableColumnType.Text,
-          value: data.exceptionFingerprint,
-        }}])
     `);
 
-    statement.append(RETENTION_FILTER);
-
     if (data.accessibleRumApplicationIds) {
       statement.append(
         SQL` AND rumApplicationId IN (${{
@@ -1264,31 +1895,66 @@ export default class SessionReplayReadService {
       );
     }
 
-    if (data.startTime) {
+    statement.append(
+      SQL` AND startTime >= ${{
+        type: TableColumnType.DateTime64,
+        value: startTime,
+      }} AND startTime <= ${{
+        type: TableColumnType.DateTime64,
+        value: endTime,
+      }}`,
+    );
+
+    statement.append(RETENTION_FILTER);
+
+    if (data.sessionId) {
       statement.append(
-        SQL` AND startTime >= ${{
-          type: TableColumnType.DateTime64,
-          value: data.startTime,
+        SQL` AND sessionId = ${{
+          type: TableColumnType.Text,
+          value: data.sessionId,
         }}`,
       );
     }
 
-    if (data.endTime) {
+    statement.append(
+      SQL` AND (hasAny(exceptionFingerprints, [${{
+        type: TableColumnType.Text,
+        value: data.exceptionFingerprint,
+      }}])`,
+    );
+
+    if (instanceSessionIds.length > 0) {
       statement.append(
-        SQL` AND startTime <= ${{
-          type: TableColumnType.DateTime64,
-          value: data.endTime,
-        }}`,
+        SQL` OR sessionId IN (${{
+          type: TableColumnType.Text,
+          value: new Includes(instanceSessionIds),
+        }})`,
       );
     }
 
+    statement.append(")");
+
     statement.append(
       SQL` GROUP BY projectId, rumApplicationId, sessionId
-           HAVING hasAny(aggExceptionFingerprints, [${{
+           HAVING (hasAny(aggExceptionFingerprints, [${{
              type: TableColumnType.Text,
              value: data.exceptionFingerprint,
-           }}])
-           ORDER BY aggStartTime DESC
+           }}])`,
+    );
+
+    if (instanceSessionIds.length > 0) {
+      statement.append(
+        SQL` OR sessionId IN (${{
+          type: TableColumnType.Text,
+          value: new Includes(instanceSessionIds),
+        }})`,
+      );
+    }
+
+    statement.append(")");
+
+    statement.append(
+      SQL` ORDER BY aggStartTime DESC
            LIMIT ${{
              type: TableColumnType.Number,
              value: limit,
@@ -1328,9 +1994,344 @@ export default class SessionReplayReadService {
     );
   }
 
+  /*
+   * Session ids of the pages that threw this exception, from the
+   * exception instance table. The instance's `time` sits inside its
+   * session, so a session that started inside the window threw inside
+   * [startTime, endTime + max session length].
+   *
+   * Best-effort: the side index only ADDS live sessions to the answer, so
+   * a failure here degrades to the finalized-only lookup with a warning
+   * rather than failing the exception page's replay card.
+   *
+   * A caller-pinned sessionId narrows the lookup rather than bypassing it,
+   * so the pin can never assert that a session threw something the
+   * instance table has no record of it throwing.
+   */
+  private static async getSessionIdsForExceptionInstances(data: {
+    projectId: ObjectID;
+    exceptionFingerprint: string;
+    startTime: Date;
+    endTime: Date;
+    sessionId?: string | undefined;
+  }): Promise<Array<string>> {
+    const statement: Statement = SQL`
+      SELECT DISTINCT sessionId
+      FROM ${AnalyticsTableName.ExceptionInstance}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: data.projectId,
+      }}
+        AND fingerprint = ${{
+          type: TableColumnType.Text,
+          value: data.exceptionFingerprint,
+        }}
+        AND sessionId != ''
+        AND time >= ${{
+          type: TableColumnType.DateTime64,
+          value: data.startTime,
+        }}
+        AND time <= ${{
+          type: TableColumnType.DateTime64,
+          value: new Date(
+            data.endTime.getTime() + SESSION_REPLAY_MAX_SESSION_MS,
+          ),
+        }}
+    `;
+
+    /*
+     * A pinned sessionId narrows this lookup; it does NOT replace it.
+     *
+     * Returning the pinned id unchecked made the caller's statement read
+     * `sessionId = X AND (hasAny(fingerprints, [f]) OR sessionId IN (X))`,
+     * whose second arm is trivially true - so the fingerprint constrained
+     * nothing and the "Watch what the user saw" card would present any
+     * accessible session as having observed this exception, on nothing but
+     * a stale occurrence row. Asking the instance table whether THAT
+     * session threw THIS fingerprint keeps the pin's real purpose (a live
+     * session whose header has no fingerprints yet) while keeping the
+     * claim true. A failure here answers [] and the header's mandatory
+     * hasAny() predicate decides alone - fail closed.
+     */
+    if (data.sessionId) {
+      statement.append(
+        SQL` AND sessionId = ${{
+          type: TableColumnType.Text,
+          value: data.sessionId,
+        }}`,
+      );
+    }
+
+    statement.append(SQL`
+      ORDER BY sessionId ASC
+      LIMIT ${{
+        type: TableColumnType.Number,
+        value: MAX_EXCEPTION_INSTANCE_SESSION_IDS,
+      }}
+    `);
+
+    statement.append(READ_QUERY_SETTINGS);
+
+    try {
+      const dbResult: Results =
+        await ExceptionInstanceService.executeQuery(statement);
+      const response: DbJSONResponse = await dbResult.json<{
+        data?: Array<JSONObject>;
+      }>();
+
+      return (response.data || [])
+        .map((row: JSONObject): string => {
+          return readString(row, "sessionId");
+        })
+        .filter((sessionId: string): boolean => {
+          return sessionId.length > 0;
+        });
+    } catch (err: unknown) {
+      logger.warn(
+        "SessionReplayReadService: could not look up exception instances by session; answering from finalized headers only",
+      );
+      logger.warn(err);
+
+      return [];
+    }
+  }
+
+  /*
+   * Recording activity for one application over the last 24 hours, for
+   * the health surface. No GROUP BY and no payload: uniqExact over the
+   * sort-key range for the counts, and an ORDER BY startTime DESC LIMIT 1
+   * (read in sort-key order, stops after one granule) for the most recent
+   * start, which is NOT bounded to 24h so "the most recent was 3 days
+   * ago" can be said when today is quiet.
+   *
+   * "Playable" is counted by subtraction: a session is unplayable only
+   * when its FINALIZED row says it holds no chunks or was sealed as
+   * recording-lost. Every other session - live, or finalized with footage
+   * - can be watched. Counted that way because a finalized session still
+   * has its provisional row on disk until a merge runs, and that row
+   * would otherwise count a lost recording as live.
+   *
+   * ClickHouse trouble answers null (the UI says "unknown"), never 0:
+   * "no sessions" and "could not count" are different diagnoses.
+   */
+  @CaptureSpan()
+  public static async getApplicationActivitySummary(data: {
+    projectId: ObjectID;
+    rumApplicationId: ObjectID;
+    nowUnixMs?: number | undefined;
+  }): Promise<SessionReplayApplicationActivitySummary> {
+    const nowUnixMs: number = data.nowUnixMs ?? Date.now();
+    const cacheKey: string = `${data.projectId.toString()}:${data.rumApplicationId.toString()}`;
+
+    const cached: ActivitySummaryCacheEntry | undefined =
+      activitySummaryCache.get(cacheKey);
+
+    if (cached && cached.expiresAt > nowUnixMs) {
+      return cached.summary;
+    }
+
+    const summary: SessionReplayApplicationActivitySummary =
+      await SessionReplayReadService.readApplicationActivitySummary({
+        projectId: data.projectId,
+        rumApplicationId: data.rumApplicationId,
+        nowUnixMs: nowUnixMs,
+      });
+
+    /*
+     * Coarse LRU: evict the oldest entry when full and the key is new, so
+     * a burst of distinct applications cannot grow the map without bound.
+     */
+    if (
+      activitySummaryCache.size >= MAX_ACTIVITY_SUMMARY_CACHE_ENTRIES &&
+      !activitySummaryCache.has(cacheKey)
+    ) {
+      const oldest: string | undefined = activitySummaryCache
+        .keys()
+        .next().value;
+
+      if (oldest !== undefined) {
+        activitySummaryCache.delete(oldest);
+      }
+    }
+
+    activitySummaryCache.delete(cacheKey);
+    activitySummaryCache.set(cacheKey, {
+      summary: summary,
+      expiresAt: nowUnixMs + SESSION_REPLAY_ACTIVITY_SUMMARY_CACHE_TTL_MS,
+    });
+
+    return summary;
+  }
+
+  private static async readApplicationActivitySummary(data: {
+    projectId: ObjectID;
+    rumApplicationId: ObjectID;
+    nowUnixMs: number;
+  }): Promise<SessionReplayApplicationActivitySummary> {
+    const countsStatement: Statement = SQL`
+      SELECT
+        toFloat64(uniqExact(sessionId)) AS sessionCount,
+        toFloat64(uniqExactIf(sessionId, isFinalized AND (chunkCount = 0 OR sealedReason = ${{
+          type: TableColumnType.Text,
+          value: SessionReplaySealedReason.RecordingLost,
+        }}))) AS unplayableCount
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: data.projectId,
+      }}
+        AND rumApplicationId = ${{
+          type: TableColumnType.ObjectID,
+          value: data.rumApplicationId,
+        }}
+        AND startTime >= ${{
+          type: TableColumnType.DateTime64,
+          value: new Date(data.nowUnixMs - 24 * 60 * 60 * 1000),
+        }}
+    `;
+
+    countsStatement.append(RETENTION_FILTER);
+    countsStatement.append(READ_QUERY_SETTINGS);
+
+    const lastStartStatement: Statement = SQL`
+      SELECT
+        toFloat64(toUnixTimestamp64Milli(startTime)) AS lastStartUnixMs,
+        /*
+         * The newest session's recorder capabilities, read off the same row
+         * that answers "when did recording last start". Named directly (not
+         * through the argMax alias set) because this statement has no GROUP
+         * BY: it is one row, read in sort-key order, LIMIT 1.
+         */
+        attributes AS aggAttributes
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: data.projectId,
+      }}
+        AND rumApplicationId = ${{
+          type: TableColumnType.ObjectID,
+          value: data.rumApplicationId,
+        }}
+    `;
+
+    lastStartStatement.append(RETENTION_FILTER);
+    lastStartStatement.append(" ORDER BY startTime DESC LIMIT 1");
+    lastStartStatement.append(READ_QUERY_SETTINGS);
+
+    try {
+      const [countsResult, lastStartResult]: [Results, Results] =
+        await Promise.all([
+          RumSessionService.executeQuery(countsStatement),
+          RumSessionService.executeQuery(lastStartStatement),
+        ]);
+
+      const countsResponse: DbJSONResponse = await countsResult.json<{
+        data?: Array<JSONObject>;
+      }>();
+      const lastStartResponse: DbJSONResponse = await lastStartResult.json<{
+        data?: Array<JSONObject>;
+      }>();
+
+      const countsRow: JSONObject | undefined = (countsResponse.data || [])[0];
+      const lastStartRow: JSONObject | undefined = (lastStartResponse.data ||
+        [])[0];
+
+      const sessionCount: number = countsRow
+        ? readNumber(countsRow, "sessionCount")
+        : 0;
+      const unplayableCount: number = countsRow
+        ? readNumber(countsRow, "unplayableCount")
+        : 0;
+
+      const lastStartUnixMs: number = lastStartRow
+        ? readNumber(lastStartRow, "lastStartUnixMs")
+        : 0;
+
+      /*
+       * An empty list means "the newest session declared none" (an old
+       * recorder artifact), which is not the same as "we could not tell" -
+       * but the health copy renders both as "not reported yet", and
+       * claiming a recorder has NO capabilities would be a stronger
+       * statement than the row supports. So an empty list answers null and
+       * only a non-empty one is reported.
+       */
+      const recorderCapabilities: Array<string> = lastStartRow
+        ? readRecorderCapabilities(lastStartRow)
+        : [];
+
+      return {
+        sessionsLast24h: sessionCount,
+        playableSessionsLast24h: Math.max(0, sessionCount - unplayableCount),
+        lastSessionStartedAt:
+          lastStartUnixMs > 0 ? new Date(lastStartUnixMs) : null,
+        recorderCapabilities:
+          recorderCapabilities.length > 0 ? recorderCapabilities : null,
+      };
+    } catch (err: unknown) {
+      logger.warn(
+        "SessionReplayReadService: could not read the application activity summary",
+      );
+      logger.warn(err);
+
+      return {
+        sessionsLast24h: null,
+        playableSessionsLast24h: null,
+        lastSessionStartedAt: null,
+        recorderCapabilities: null,
+      };
+    }
+  }
+
+  /* The HAVING/ORDER BY expression for a sort key. */
+  private static getSortExpression(sortBy: SessionReplaySortBy): string {
+    switch (sortBy) {
+      case "durationMs":
+        return "aggDurationMs";
+      case "errorCount":
+        return "aggErrorCount";
+      case "frustration":
+        return FRUSTRATION_TOTAL_EXPRESSION;
+      case "startTime":
+      default:
+        return "aggStartTime";
+    }
+  }
+
+  /* The cursor value of a row under a sort key: what the expression above yields. */
+  private static getSortValue(
+    sortBy: SessionReplaySortBy,
+    item: SessionReplayListItem,
+  ): number {
+    switch (sortBy) {
+      case "durationMs":
+        return item.durationMs;
+      case "errorCount":
+        return item.errorCount;
+      case "frustration":
+        return (
+          item.rageClickCount +
+          item.deadClickCount +
+          item.errorClickCount +
+          item.refreshRageCount
+        );
+      case "startTime":
+      default:
+        return item.startTime.getTime();
+    }
+  }
+
+  /*
+   * Every list predicate, in cost order: booleans and equality over
+   * aliases first, IN lists next, array membership after, and the
+   * substring predicates (tags, urlPrefix, search) LAST. ClickHouse
+   * evaluates HAVING per group after aggregation, so the order does not
+   * change what is scanned, but a cheap predicate that fails first spares
+   * the string work for every group it eliminates.
+   */
   private static appendListHavingFilters(
     statement: Statement,
     filters: SessionReplayListFilters,
+    includeIdentifiedUserLabel: boolean,
   ): void {
     if (filters.hasError !== undefined) {
       statement.append(
@@ -1352,11 +2353,10 @@ export default class SessionReplayReadService {
        * honour false, so accepting the value and ignoring it returned the
        * whole unfiltered list with a 200 and no indication why.
        */
-      const total: string =
-        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
-
       statement.append(
-        filters.hasFrustration ? ` AND ${total} > 0` : ` AND ${total} = 0`,
+        filters.hasFrustration
+          ? ` AND ${FRUSTRATION_TOTAL_EXPRESSION} > 0`
+          : ` AND ${FRUSTRATION_TOTAL_EXPRESSION} = 0`,
       );
     }
 
@@ -1369,6 +2369,37 @@ export default class SessionReplayReadService {
       );
     }
 
+    if (filters.hasIdentifiedUser !== undefined) {
+      /*
+       * The digest column, not the label: it is under the ordinary session
+       * ACL, and "did somebody identify" discloses nothing about who.
+       */
+      statement.append(
+        filters.hasIdentifiedUser
+          ? " AND aggIdentifiedUserKey != ''"
+          : " AND aggIdentifiedUserKey = ''",
+      );
+    }
+
+    if (filters.isPlayable !== undefined) {
+      /*
+       * A live session is playable (its chunks are being written); a
+       * finalized one only when the finalizer counted chunks and did not
+       * seal it as lost.
+       */
+      const playable: string = `((aggIsFinalized = 0 OR aggChunkCount > 0) AND aggSealedReason != '${SessionReplaySealedReason.RecordingLost}')`;
+
+      statement.append(
+        filters.isPlayable ? ` AND ${playable}` : ` AND NOT ${playable}`,
+      );
+    }
+
+    if (filters.hasTraces !== undefined) {
+      statement.append(
+        filters.hasTraces ? " AND aggTraceCount > 0" : " AND aggTraceCount = 0",
+      );
+    }
+
     if (filters.triggerReasons && filters.triggerReasons.length > 0) {
       statement.append(
         SQL` AND aggTriggerReason IN (${{
@@ -1425,16 +2456,10 @@ export default class SessionReplayReadService {
 
     if (filters.route) {
       /*
-       * `has`, not a Search/LIKE. StatementGenerator's own comment calls
-       * restoring the exact-match array fast path "the single biggest
-       * performance fix" - a lowerUTF8 arrayExists has no bloom
-       * pre-filter and full-scans the table.
-       *
-       * The argMax expression is appended as raw SQL rather than
-       * interpolated into the template: a plain string substituted into
-       * an SQL`` literal is bound as an Identifier and would be quoted.
+       * `has`, not a Search/LIKE: exact membership is the cheap array
+       * path. Over the argMax alias, never the raw column.
        */
-      statement.append(` AND has(${argMaxColumn("routes")}, `);
+      statement.append(" AND has(aggRoutes, ");
       statement.append(
         SQL`${{
           type: TableColumnType.Text,
@@ -1454,5 +2479,121 @@ export default class SessionReplayReadService {
         }}`,
       );
     }
+
+    if (filters.tags) {
+      /*
+       * Every pair must match. mapContains first so an absent key never
+       * matches the empty string a Map subscript returns for it. Bounded
+       * by the number of tags a session can even carry.
+       */
+      const pairs: Array<[string, string]> = Object.entries(filters.tags)
+        .filter(([key, value]: [string, string]): boolean => {
+          return key.length > 0 && typeof value === "string";
+        })
+        .slice(0, SESSION_REPLAY_MAX_TAG_KEYS);
+
+      for (const [key, value] of pairs) {
+        statement.append(" AND mapContains(aggTags, ");
+        statement.append(
+          SQL`${{
+            type: TableColumnType.Text,
+            value: key,
+          }}) AND aggTags[${{
+            type: TableColumnType.Text,
+            value: key,
+          }}] = ${{
+            type: TableColumnType.Text,
+            value: value,
+          }}`,
+        );
+      }
+    }
+
+    if (filters.urlPrefix) {
+      /*
+       * "sessions that touched /checkout/*": a prefix over every route the
+       * session visited and over the entry URL, which for a pre-migration
+       * session is the only URL the header holds.
+       *
+       * The stored values are scrubbed ABSOLUTE urls (https://host/path),
+       * but the filter a human types is a PATH - the search box routes any
+       * value beginning with "/" here, and the docs promise `url:/checkout`
+       * outright. Matching only the full string meant that documented
+       * search never matched anything, in any project, with no error to
+       * say so. So the path of each route and of the entry URL is matched
+       * as well as the whole URL: an absolute prefix still matches on the
+       * first arm, a path prefix on the second. ClickHouse's path() returns
+       * the path component without host or query, which is exactly the
+       * shape the recorder's route list is scrubbed down to.
+       */
+      const prefixParameter: { type: TableColumnType; value: string } = {
+        type: TableColumnType.Text,
+        value: filters.urlPrefix,
+      };
+
+      statement.append(" AND (arrayExists(r -> startsWith(r, ");
+      statement.append(SQL`${prefixParameter}`);
+      statement.append(") OR startsWith(path(r), ");
+      statement.append(SQL`${prefixParameter}`);
+      statement.append("), aggRoutes) OR startsWith(aggEntryUrl, ");
+      statement.append(SQL`${prefixParameter}`);
+      statement.append(") OR startsWith(path(aggEntryUrl), ");
+      statement.append(SQL`${prefixParameter}`);
+      statement.append("))");
+    }
+
+    if (filters.search) {
+      SessionReplayReadService.appendSearchPredicate(
+        statement,
+        filters.search,
+        includeIdentifiedUserLabel,
+      );
+    }
+  }
+
+  /*
+   * Free-text search, last of the predicates because it is the only one
+   * that does substring work per group. The identified user label is
+   * searched ONLY when the caller may read it: without that gate a caller
+   * denied the label could ask "is jane@example.com here" and read every
+   * other field of the answer.
+   */
+  private static appendSearchPredicate(
+    statement: Statement,
+    search: string,
+    includeIdentifiedUserLabel: boolean,
+  ): void {
+    const term: string = search
+      .trim()
+      .substring(0, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH);
+
+    if (!term) {
+      return;
+    }
+
+    const textParameter: { type: TableColumnType; value: string } = {
+      type: TableColumnType.Text,
+      value: term,
+    };
+
+    statement.append(" AND (startsWith(sessionId, ");
+    statement.append(SQL`${textParameter})`);
+    statement.append(" OR positionCaseInsensitiveUTF8(aggEntryUrl, ");
+    statement.append(SQL`${textParameter}) > 0`);
+    statement.append(" OR positionCaseInsensitiveUTF8(aggExitUrl, ");
+    statement.append(SQL`${textParameter}) > 0`);
+    statement.append(" OR arrayExists(r -> positionCaseInsensitiveUTF8(r, ");
+    statement.append(SQL`${textParameter}) > 0, aggRoutes)`);
+    statement.append(` OR has(${argMaxColumn("traceIds")}, `);
+    statement.append(SQL`${textParameter})`);
+
+    if (includeIdentifiedUserLabel) {
+      statement.append(
+        " OR positionCaseInsensitiveUTF8(aggIdentifiedUserLabel, ",
+      );
+      statement.append(SQL`${textParameter}) > 0`);
+    }
+
+    statement.append(")");
   }
 }