@open-everywhere/core 0.1.0

package/dist/agent/operational/store.d.ts

@@ -0,0 +1,1953 @@
+import { type Routine } from "../routines/routine.js";
+import type { PendingActionRow } from "../approvals/types.js";
+import type { ModelReasoning } from "../memory/domain.js";
+import type { PendingUnifiedWake, UnifiedWakeRecord } from "../channels/unified-window.js";
+import type { SessionTailEntry } from "../channels/session-tail.js";
+import type { CredentialGrantAskRow, CredentialGrantAskState, CredentialGrantMode, CredentialGrantRow } from "./credential-grant-rows.js";
+import type { AuditEpochSeal } from "../audit/chain.js";
+/** The canonical table list the sqlite-to-postgres migrator iterates. migrate-operational-test.ts asserts it matches the tables both adapters create, so a CREATE TABLE missing here fails that test; instance_meta is the one deployment-level table and is still copied. */
+export declare const OPERATIONAL_TABLES: readonly ["spend_ledger", "routine", "routine_prompt_revisions", "audit_entry", "spend_limit", "halt", "connector_override", "thread_engagement", "channel_session", "session_tail", "event_dedupe", "unified_wake_target", "thread_ownership", "thread_seat_state", "turn_anchor", "task_result", "slack_attachment", "stored_credential", "credential_intake", "webhook_capture_window", "github_installation", "pr_session_approval", "pending_actions", "domain_skill", "domain_skill_revisions", "domain_model", "usage_events", "instance_meta", "webhook_capture", "identity_link_sets", "identity_linked_ids", "identity_link_challenges", "notice_claim", "model_call_capture", "proactive_address", "memory_proposal", "credential_grant_ask", "credential_grant", "dm_audience", "ingress_delivery"];
+/** Housekeeping ceiling for the shared event_dedupe table: rows older than this are swept on the next write for that org, whatever TTL wrote them. It must stay above the longest caller TTL in the tree (2 h today) or the sweep expires live keys. */
+export declare const EVENT_DEDUPE_MAX_RETENTION_MS: number;
+/** A completed ingress delivery keeps only its content-free dedupe tombstone for one day. Pending
+ * rows deliberately have no retention deadline: deleting accepted work because an outage lasted
+ * longer than a clock would turn durable acceptance into silent loss. */
+export declare const INGRESS_DELIVERY_TOMBSTONE_RETENTION_MS: number;
+export declare function assertIngressDeliveryRetainUntil(completedAt: string, retainUntil: string): void;
+/** The window CLOSES on reaching this many deliveries; it is not a ring with FIFO eviction. A human quotes delivery numbers back, so the numbering must stay stable between the render and the filter being written. */
+export declare const CAPTURE_MAX_DELIVERIES = 50;
+/**
+ * X — the longest a window may be armed for, whatever the arming caller asks. A window that outlives
+ * the sitting it was opened for is indistinguishable from permanent payload storage, which §2.6 says
+ * this must never become. One hour is long enough to catch a periodic sender and short enough that
+ * forgetting to disarm costs nothing.
+ */
+export declare const CAPTURE_MAX_WINDOW_MS: number;
+/**
+ * The ABSOLUTE ceiling, independent of every window: any captured row older than this is swept on
+ * the next write for that org, whether or not a window is still open and whether or not anyone has
+ * read it. This is the bound that holds when the other two are wrong — an arming path with a bug, a
+ * clock that jumped, a window nobody closed. Must stay above {@link CAPTURE_MAX_WINDOW_MS} or rows
+ * would expire inside the window that is still filling them.
+ */
+export declare const CAPTURE_MAX_RETENTION_MS: number;
+/**
+ * One captured delivery, as stored and as read back.
+ *
+ * 🔴 `documentJson` IS THE `EventFilterDocument`, NOT THE RAW BODY, and the whole safety argument
+ * rests on that being true — see `webhooks/capture-window.ts`'s header for what that excludes and
+ * why the exclusion is structural rather than a redaction pass anyone could forget to run.
+ */
+/** One hook's arm state for the capture window, kept as a row rather than a config field because a window is at most an hour of wall clock. It carries no authority: the hook's identity and read grant are read from the config registry at arm and delivery time, so this row can never become a second place a hook is defined. */
+export interface WebhookCaptureWindowRow {
+    /** The DECLARED hook's id — the same string `webhook_capture.source` holds for that hook's rows
+     *  (a config delivery emits under `hook.id`), so the window and the deliveries it admitted share
+     *  one key and cannot drift apart. */
+    readonly hookId: string;
+    /** ISO-8601, ALREADY CLAMPED to {@link CAPTURE_MAX_WINDOW_MS} by the arming path. */
+    readonly captureUntil: string;
+    readonly armedBy: string;
+    readonly armedAt: string;
+}
+export interface CapturedDeliveryRow {
+    /** 1-based ordinal WITHIN the current window — the number a human says out loud. */
+    readonly seq: number;
+    /** ISO-8601 receive time (OUR clock, not the sender's `occurredAt`). */
+    readonly capturedAt: string;
+    /** Serialized `EventFilterDocument`. Opaque to the store. */
+    readonly documentJson: string;
+}
+/** One immutable audit record. */
+export interface AuditEntry {
+    /** ISO-8601; stamped by appendAudit when the caller omits it. */
+    readonly ts: string;
+    /** Tenant — the outermost partition key (Partition.org). */
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace: string;
+    /** The surface, when the event is surface-scoped (memory write); omitted otherwise. */
+    readonly surface?: string;
+    /**
+     * The conversation this row's surface names ({@link SurfaceMode}) — what the anti-doxxing mask
+     * reads before `query_analytics` publishes the surface (OPE-1866).
+     *
+     * 🔴 ABSENT MEANS UNCLASSIFIED, AND THE MASK FAILS CLOSED ON IT — spend/dm-mask.ts buckets the
+     * surface as `(unclassified)` rather than publishing an id it cannot classify.
+     *
+     * 🔴 ONLY `audit/tool-action.ts` STAMPS IT TODAY, so most audit rows mask. That writer is the
+     * per-action tool affordance; the ~35 other modules that call `appendAudit` — the memory, egress,
+     * approvals, connector and per-provider writers — pass no mode, and their surface-scoped rows
+     * therefore report as `(unclassified)` even though many of them do hold a ctx to read one from.
+     * That is FAIL-CLOSED but it is a real loss of report fidelity, and it does NOT heal as rows age
+     * out: it is a property of the writers, not of the migration. Stamping the rest is a mechanical
+     * sweep across several planes and wants its own review (OPE-1940).
+     *
+     * A row that names no surface, and a row whose binding only GAP-FILLED its mode (OPE-1867), are
+     * absent for their own honest reasons and always will be.
+     */
+    readonly surfaceMode?: SurfaceMode;
+    /** WHO asked — the acting principal, when known. */
+    readonly principalId?: string;
+    /** WHAT — a stable dotted action key, e.g. "memory.write", "egress.policy". */
+    readonly action: string;
+    readonly detail?: Readonly<Record<string, unknown>>;
+}
+export type AuditInput = Omit<AuditEntry, "ts"> & {
+    readonly ts?: string;
+};
+/** One audit row as a READ returns it: the stored record plus its storage `seq` (OPE-1933).
+ *
+ *  🔴 `seq` IS THE ONLY MONOTONIC ORDER KEY THE LOG HAS. `ts` is wall-clock — `appendAudit` stamps
+ *  `new Date()` at append — so on a box whose clock steps BACKWARD a row written later can carry an
+ *  EARLIER `ts` than a row written before it. A reader that anchors "everything after this instant"
+ *  on `ts` then drops the very row it is waiting for, forever and silently. `seq` is the store's
+ *  own insert order (sqlite AUTOINCREMENT / postgres IDENTITY) and never moves backwards, so a
+ *  reader anchors on a `seq` CURSOR instead and uses `ts` only as a coarse query window.
+ *
+ *  It is a READ shape only. {@link AuditEntry} stays the write shape, because a caller appending a
+ *  row cannot know the `seq` the store has not allocated yet. */
+export interface AuditReadRow extends AuditEntry {
+    /** Storage sequence — sqlite AUTOINCREMENT / postgres IDENTITY; establishes order, NOT hashed. */
+    readonly seq: number;
+}
+/** One audit row as the hash-chain verifier sees it (OPE-52, audit-wedge WS-6c): the hashed
+ *  content, its storage `seq` (the order key + stable locator), and its stored `prevSha` —
+ *  the sha256 of the immediately preceding row for the SAME org (null on the org's genesis
+ *  row). The chain logic lives in agent/audit/chain.ts (auditRowSha/findChainBreak). */
+export interface AuditChainRow {
+    /** Storage sequence — sqlite AUTOINCREMENT / postgres IDENTITY; establishes order, NOT hashed. */
+    readonly seq: number;
+    readonly ts: string;
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface?: string;
+    /** The conversation the surface names — see {@link AuditEntry.surfaceMode}. Hashed only when
+     *  present, so a pre-OPE-1866 row's sha is unchanged (agent/audit/chain.ts). */
+    readonly surfaceMode?: SurfaceMode;
+    readonly principalId?: string;
+    readonly action: string;
+    readonly detail?: Readonly<Record<string, unknown>>;
+    /** sha256 of the preceding row (same org, by seq); null on the org's first (genesis) row. */
+    readonly prevSha: string | null;
+}
+/** What a successful epoch seal WROTE (OPE-1636): the seal itself, and the `seq` the marker row
+ *  landed on — the value `--accept-epoch` takes. The seq is RETURNED rather than re-read, because
+ *  the only way to learn it afterwards is to read the chain again OUTSIDE the critical section,
+ *  where a concurrent append can already be the last row and `.at(-1)` names the wrong one. */
+export interface AuditChainEpochWritten {
+    readonly seal: AuditEpochSeal;
+    readonly markerSeq: number;
+}
+export interface AuditFilter {
+    /** 🔴 REQUIRED, and the audit log's tenancy boundary (OPE-1812). Every other field NARROWS the
+     *  read; this one PARTITIONS it. It was optional, and an omitted org widened the read to every
+     *  org's rows, because both adapters build the `WHERE` from whatever the caller passes. The
+     *  store now refuses such a read — see {@link auditReadOrg}. A caller that wants every org's
+     *  rows names the orgs (`listAuditOrgs()`) and reads each one. */
+    readonly org: string;
+    readonly platform?: string;
+    readonly workspace?: string;
+    readonly surface?: string;
+    readonly action?: string;
+    readonly principalId?: string;
+    /** ISO-8601 lower bound (inclusive). */
+    readonly since?: string;
+    /**
+     * ISO-8601 UPPER bound (inclusive) — the other half of a bounded window (OPE-1886).
+     *
+     * 🔴 WITHOUT IT A PAST WINDOW IS UNREADABLE ONCE NEWER ROWS EXIST. The read sorts newest-first
+     * and then applies `limit`, so a caller asking about 19:21–19:56 got the newest `limit` rows of
+     * everything since 19:21. On ship #214 the board wrote well over 1000 rows after the six legs
+     * under investigation, and every read for those legs' wake rows came back holding only the
+     * newest rows — an absence that proved nothing. An upper bound makes the window itself the
+     * page, so its rows are readable at any later volume.
+     *
+     * Inclusive, like `since`: `until` is the same kind of instant, and one bound that includes its
+     * endpoint beside one that excludes it is how an off-by-one row gets attributed to the wrong
+     * window. A caller paging backwards therefore re-reads the rows stamped exactly at `until` and
+     * must de-duplicate them.
+     */
+    readonly until?: string;
+    /** Cap the result (after sort); newest-first. */
+    readonly limit?: number;
+}
+/**
+ * The audit read's org, or a refusal. ONE definition, called by both adapters before either builds
+ * a `WHERE` (OPE-1812) — a bound that lives in two hand-copied query builders drifts.
+ *
+ * 🔴 IT REFUSES, IT NEVER WIDENS. An audit read whose org is missing or empty used to return every
+ * org's rows: the filter was optional, so `WHERE` came out empty and the query read the whole log.
+ * The type now makes that a compile error, and this makes it a throw — the type alone stops nothing
+ * at a boundary the control plane reaches with parsed JSON, and a widened audit read is the one
+ * failure here that answers with another tenant's evidence instead of an error.
+ *
+ * The empty string is refused with the absent case because `org_id = ''` matches no row any caller
+ * wants: the deployment org is a non-empty name, so an empty org is a caller that lost its org, and
+ * answering it with zero rows would read as "this tenant did nothing".
+ */
+export declare function auditReadOrg(filter: AuditFilter): string;
+export type CostSource = "measured" | "derived";
+/**
+ * WHAT KIND OF CONVERSATION a row was written in (OPE-1862) — the one fact the anti-doxxing mask
+ * reads, on `spend_ledger` and on `usage_events` alike.
+ *
+ * 🔴 IT IS NOT `kind`, AND THE TWO MAY NEVER BE CONFLATED. `usage_events.kind` is the TURN-ORIGIN
+ * tag (hooks/spend.ts `turnKind`): a routine fire, a supervisor turn and a delegated subagent turn
+ * each win that tag BEFORE the DM test runs, so a routine fired inside a DM is stamped
+ * `kind: "routine"` and the tag can never answer "was this a DM". This column answers exactly that
+ * and nothing else. It is written from the turn's own binding (`bindFrom(ctx).mode`), so every
+ * platform answers for its own surfaces and no reader has to test the SHAPE of a surface id.
+ *
+ * `''` (ledger) or absent (usage_events) means UNSTAMPED — a row written before this column, or by
+ * a writer with no binding. A reader may not guess: spend/reporting.ts masks such a row rather than
+ * reveal a surface id it cannot classify.
+ */
+export type SurfaceMode = "dm" | "mpim" | "channel";
+/** The stored `surface_mode` as a {@link SurfaceMode}, or undefined for every other value —
+ *  `''`, NULL, and anything an older or foreign writer left. ONE parser for both adapters, so a
+ *  row cannot mean one thing on SQLite and another on Postgres. */
+export declare function asSurfaceMode(value: unknown): SurfaceMode | undefined;
+/** The `surfaceMode` half of an audit row rebuilt from storage — spread into the row object, and
+ *  EMPTY unless the stored value is inside the enum (OPE-1866). One helper for both adapters and
+ *  for all three audit reads, because the hash-chain link recomputes a predecessor's sha from this
+ *  same reading: a column that read one way for the digest and another for the report would break
+ *  the chain on a row nobody touched. */
+export declare function auditSurfaceMode(value: unknown): {
+    surfaceMode?: SurfaceMode;
+};
+/** The attribution dimensions of one ledger row. `''` means unattributed — NOT NULL because
+ *  Postgres PK columns cannot be NULL, and a nullable unique index would silently break the
+ *  upsert-and-add dedup (two NULL-keyed writes would insert two rows instead of summing). */
+export interface SpendLedgerKey {
+    readonly surfaceKey: string;
+    /** The acting principal, or `''` when the turn had none. */
+    readonly principalId: string;
+    /** The routine this spend belongs to (OPE-145 grain), or `''` for a non-routine turn. */
+    readonly routineId: string;
+    /** The model priced against, or `''` when there is none (sandbox runtime), or the explicit
+     *  UNKNOWN_MODEL sentinel when a token-bearing model call reached the ledger with no model
+     *  stamp at all (spend/spend.ts — deliberately NOT `''`, which would blend an unattributed
+     *  model call into the sandbox bucket). */
+    readonly model: string;
+    /** Calendar month, "YYYY-MM". */
+    readonly period: string;
+    /** WHICH cost answer this row's calls carried (OPE-369) — part of the key so the row is
+     *  homogeneous; see the {@link CostSource} section above. */
+    readonly costSource: CostSource;
+}
+export interface SpendLedgerRow extends SpendLedgerKey {
+    readonly org: string;
+    /** The conversation this row's spend happened in ({@link SurfaceMode}), or `''` when nothing
+     *  stamped it. DELIBERATELY NOT part of {@link SpendLedgerKey}: a surface is a DM or it is not,
+     *  for as long as it exists, so the mode is a property of `surface_key` and adding it to the
+     *  primary key would split one surface's month across two rows for no gain — and would force a
+     *  table drop on both engines, which the additive column does not. */
+    readonly surfaceMode: string;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cacheReadTokens: number;
+    readonly cacheWriteTokens: number;
+    /** REASONING tokens summed over this bucket's calls (OPE-1611) — attribution only, never
+     *  billed: no rate table names a reasoning rate. 0 where no call reported the dimension, which
+     *  a monthly SUM cannot tell apart from "every call reported zero" — the per-call row
+     *  ({@link UsageEventEntry.reasoningTokens}) is where that distinction lives. */
+    readonly reasoningTokens: number;
+    /** Millionths of a dollar (integer — never a float for money), DERIVED at write from this
+     *  deployment's rate table. Always populated; the ONE figure every cap denomination sums. */
+    readonly usdMicros: number;
+    /** Millionths of a dollar the GATEWAY measured for these same calls (OPE-369). 0 on a
+     *  `derived` row — nothing measured it. */
+    readonly usdMicrosMeasured: number;
+    readonly calls: number;
+}
+/** One upsert-and-add write. Omitted dimensions default to `''` (unattributed); omitted
+ *  amounts to 0. Each write also increments the row's `calls` by 1. */
+export interface SpendLedgerWrite {
+    readonly surfaceKey: string;
+    readonly principalId?: string;
+    readonly routineId?: string;
+    readonly model?: string;
+    /** The conversation this increment happened in ({@link SurfaceMode}) — what the report mask
+     *  reads. Omitted ⇒ the row keeps whatever mode it already carries, and a NEW row is stamped
+     *  `''` (unstamped), which every report masks. */
+    readonly surfaceMode?: SurfaceMode;
+    readonly period: string;
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+    /** Reasoning tokens for this increment (OPE-1611); omitted ⇒ adds 0, exactly like the cache
+     *  dimensions. Attribution only — it never enters `usdMicros`. */
+    readonly reasoningTokens?: number;
+    readonly usdMicros?: number;
+    /** Gateway-measured micros for this increment; omitted (or 0) means nothing measured it.
+     *  Supplying it does NOT change `usdMicros` — the two are stored side by side. */
+    readonly usdMicrosMeasured?: number;
+    /** Defaults to "derived" — a writer that has a measured figure must say so explicitly, so a
+     *  row can never claim measurement it didn't get. */
+    readonly costSource?: CostSource;
+}
+/** Filter for the two ledger reads — the SUM read ({@link OperationalStore.spendTotals}) and the
+ *  LIST read ({@link OperationalStore.listSpendLedger}). All optional; org (each method's own arg)
+ *  always narrows. `surfaceKey` is an exact match; `surfaceKeyPrefix` a LIKE prefix (the workspace
+ *  rollup). Every conjunct ANDs, and both backends assemble them from one definition
+ *  ({@link spendLedgerConjuncts}), so the two cannot disagree about what a filter means. */
+export interface SpendLedgerFilter {
+    readonly surfaceKey?: string;
+    readonly surfaceKeyPrefix?: string;
+    readonly principalId?: string;
+    readonly routineId?: string;
+    readonly period?: string;
+    /** Inclusive lower bound on period, and the bound is a month string ("YYYY-MM"), never an ISO instant: a fixed-width zero-padded month compares chronologically. An exact period and this range both apply and AND together. */
+    readonly periodFrom?: string;
+    /** INCLUSIVE upper bound on `period` — the "until" half. See {@link periodFrom} for the
+     *  "YYYY-MM" grain the bound is written in. */
+    readonly periodTo?: string;
+    /** Narrow to rows that took one cost path (OPE-369) — the drift read's filter. Absent (the
+     *  normal case, and every cap's case) sums BOTH kinds, which is why enforcement is unchanged. */
+    readonly costSource?: CostSource;
+}
+/** Summed amounts over a keyed prefix of the ledger — what a cap compares against. */
+export interface SpendTotals {
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cacheReadTokens: number;
+    readonly cacheWriteTokens: number;
+    /** Reasoning tokens summed over the matched rows (OPE-1611) — attribution, never a cap
+     *  denomination (`billableTokens` stays input + output). */
+    readonly reasoningTokens: number;
+    /** The DERIVED sum — what every cap compares against, measured rows included (their derived
+     *  shadow is stored too, precisely so this sum never develops a hole). */
+    readonly usdMicros: number;
+    /** The MEASURED sum over the same rows (0 where nothing was measured). */
+    readonly usdMicrosMeasured: number;
+    readonly calls: number;
+}
+/** Escapes the LIKE metacharacters so a literal ref prefix matches itself and cannot widen a credential enumeration. The escape character is a backslash, declared by the caller's ESCAPE clause, and it is escaped first so a prefix ending in one cannot consume the next character. */
+export declare function likePrefixPattern(prefix: string): string;
+/** The shared WHERE assembly for BOTH spend reads — the SUM read and the LIST read — as ONE
+ *  definition (like assertSpendLimitAmount) so the two backends' filter semantics cannot drift.
+ *  `?` placeholders; the Postgres adapter renders them to $n positionally. */
+export declare function spendLedgerConjuncts(filter: SpendLedgerFilter): {
+    conjuncts: string[];
+    params: (string | number)[];
+};
+export interface OverrideMeta {
+    /** Epoch ms after which the override is ignored (consult falls back to config). Spend only. */
+    readonly expiresAt?: number;
+    /** Free-text why, surfaced in the drift view. */
+    readonly reason?: string;
+    readonly setBy?: string;
+}
+/** One override row per (org, scopeKey, level); setting a new one replaces the previous at that scope and level wholesale. A user-level row overlays the per-user caps only and never the place ladder, and both domain-level and user-level spend-cap approvals are org-admin only. */
+export declare const CAP_LEVELS: readonly ["surface", "workspace", "domain", "user"];
+/** The runtime levels array lives in this leaf module because the two propose tools need the levels as values and cannot import them from each other: a const crossing the set_spend_limit to card-venue cycle is a TDZ ReferenceError at module eval. The type is derived from the array, so the two are provably the same set. */
+export type CapLevel = (typeof CAP_LEVELS)[number];
+export interface SpendLimitRow extends OverrideMeta {
+    readonly org: string;
+    readonly scopeKey: string;
+    readonly level: CapLevel;
+    readonly monthlyTokens?: number;
+    readonly monthlyUsd?: number;
+}
+/** The amount(s) a spend-limit override sets — at least one component required. */
+export interface SpendLimitAmount {
+    readonly monthlyTokens?: number;
+    readonly monthlyUsd?: number;
+}
+/** Exact row facts used by an owner-safe clear. Every optional component is compared as
+ *  `undefined`/NULL when absent; this is an equality guard, not a partial filter. */
+export interface SpendLimitMatch extends SpendLimitAmount, OverrideMeta {
+}
+/** Exact ownership facts used by an owner-safe halt clear. */
+export interface HaltMatch {
+    readonly setAt: string;
+    readonly setBy?: string;
+    /** Host-minted wake that owns a chat-set halt; absent on operator/legacy rows. */
+    readonly setRef?: string;
+}
+/** Shared write-side guard for setSpendLimit (both adapters call it): an override with
+ *  no component, or a non-positive/non-finite one, is a caller bug — fail loud at the
+ *  ONE mutation path rather than storing a row the overlay can't interpret. Negative
+ *  values are additionally load-bearing to reject: the SQLite adapter encodes "no token
+ *  component" as -1 in the legacy NOT NULL column (see sqlite.ts), so a genuine
+ *  negative limit must never reach storage. */
+export declare function assertSpendLimitAmount(limit: SpendLimitAmount): void;
+/** A halt points either at the whole org or at one (level, scopeKey) address drawn from the spend overlay's own level vocabulary. orgWide is a marker field, never a sentinel scope key, and the union is discriminated so an org-wide row has no level or scopeKey to consult. */
+export type HaltAddress = {
+    readonly orgWide: true;
+} | {
+    readonly orgWide: false;
+    readonly level: CapLevel;
+    readonly scopeKey: string;
+};
+/** One stored halt address and its state. `active: false` is a CLEARED row, kept so the trail can
+ *  answer who halted and who resumed without a second table. */
+export interface HaltRow {
+    readonly org: string;
+    readonly address: HaltAddress;
+    readonly active: boolean;
+    /** ISO-8601 of the last SET. */
+    readonly setAt: string;
+    readonly setBy?: string;
+    /** Host-minted wake that owns this set, when the chat door supplied one. */
+    readonly setRef?: string;
+    /** ISO-8601 of the last CLEAR, absent on a row that was never cleared. */
+    readonly clearedAt?: string;
+    readonly clearedBy?: string;
+}
+/** The three storage columns an address occupies, shared by both adapters so their encodings cannot
+ *  drift. On an ORG-WIDE row `level` and `scopeKey` are EMPTY FILLER, never an address: the
+ *  `orgWide` column is what every match branches on first, so no domain named `""` — a shape
+ *  `access/scope-key.ts` already treats as unusable — can be mistaken for the org-wide row. */
+export declare function haltAddressColumns(address: HaltAddress): {
+    level: string;
+    scopeKey: string;
+    orgWide: boolean;
+};
+/** The inverse of {@link haltAddressColumns}. An `orgWide` row ignores the two filler columns. */
+export declare function haltAddressFromColumns(level: string, scopeKey: string, orgWide: boolean): HaltAddress;
+/** Shared write-side guard for setHalt/clearHalt (both adapters call it): an ADDRESSED row must
+ *  name a real level and a non-blank scope key. Fail loud at the ONE mutation path rather than
+ *  storing a row whose address collides with the org-wide row's filler columns. */
+export declare function assertHaltAddress(address: HaltAddress): void;
+/** A connector grant/revoke override — admin-set at runtime, overlaying bundle grants. */
+export interface ConnectorOverrideRow {
+    readonly connector: string;
+    readonly granted: boolean;
+    /** Why + who, for the drift view. (No expiresAt — auto-expiry would re-open access.) */
+    readonly reason?: string;
+    readonly setBy?: string;
+}
+/** A connector override with its scope — the org-wide drift-view shape. */
+export interface ScopedConnectorOverrideRow extends ConnectorOverrideRow {
+    readonly scopeKey: string;
+}
+export interface DomainModelRow {
+    readonly org: string;
+    readonly domain: string;
+    /** The picked model id, or absent for a reasoning-only pick. Validated against the
+     *  envelope's allow-list/provider-deny at SET time (control/writes.ts); the envelope
+     *  clamps again at resolve time as a backstop (defence in depth). */
+    readonly modelId?: string;
+    /** The picked reasoning effort, or absent for a modelId-only pick. Validated at SET
+     *  time against the domain's effective reasoningCeiling; clamped again at resolve time. */
+    readonly reasoning?: ModelReasoning;
+    readonly setBy?: string;
+    /** ISO-8601 of the last set. */
+    readonly updatedAt: string;
+}
+/** At-least-one-component guard for a domain model pick (mirrors assertSpendLimitAmount's
+ *  role for spend): a row with neither field, or a blank modelId, is a caller bug — fail
+ *  loud at the ONE mutation path (control/writes.ts set_domain_model) rather than storing
+ *  a row the resolver can't interpret. */
+export declare function assertDomainModelPick(pick: {
+    readonly modelId?: string;
+    readonly reasoning?: ModelReasoning;
+}): void;
+export interface DomainSkillRow {
+    readonly org: string;
+    readonly domain: string;
+    readonly name: string;
+    readonly content: string;
+    /** The authoring principal, when known (audit/provenance only — no ownership gate). */
+    readonly updatedBy?: string;
+    /** ISO-8601 of the last create/update. */
+    readonly updatedAt: string;
+}
+export interface DomainSkillRevisionRow {
+    /** Monotonic per-database insertion order — the ONLY total order (two revisions can share
+     *  `recordedAt` to the second). Ascending = oldest first. */
+    readonly seq: number;
+    readonly org: string;
+    readonly domain: string;
+    readonly name: string;
+    /** The exact body written to `domain_skill` — byte-for-byte what the card displayed. */
+    readonly content: string;
+    /** The AUTHORING principal (the row's `updatedBy`), when known. */
+    readonly authoredBy?: string;
+    /** The principal whose click ARMED this body — the approver, when the write came through an
+     *  approval. Absent for a write outside the card path (a test, a migration, a seed). */
+    readonly armedBy?: string;
+    /** `pending_actions.id` of the card that armed it — the join back to the frozen args and the
+     *  `approval.approved` audit row. Absent for the same reason `armedBy` can be. */
+    readonly approvalId?: string;
+    /** ISO-8601 — the same stamp written to the live row's `updatedAt`. */
+    readonly recordedAt: string;
+}
+/** Who armed a `putDomainSkill` write, for the revision row. Optional at the port because the
+ *  store must never refuse to record a revision just because provenance is thin — a body with
+ *  no known approver is still a body that was written, and losing it is the failure this table
+ *  exists to prevent. The approval path (approvals/skill-create.ts) always supplies both. */
+export interface DomainSkillProvenance {
+    readonly armedBy?: string;
+    readonly approvalId?: string;
+}
+export interface RoutinePromptRevisionRow {
+    /** Monotonic per-database insertion order — the ONLY total order. Ascending = oldest first.
+     *  (The genesis row carries the routine's `createdAt`, so `recordedAt` is NOT monotonic.) */
+    readonly seq: number;
+    readonly org: string;
+    readonly surfaceKey: string;
+    /** `Routine.id` — the routine this text ran under. The row it points at may since be gone. */
+    readonly routineId: string;
+    /** The exact prompt, byte-for-byte as the routine held it. */
+    readonly prompt: string;
+    /** The `promptGeneration` this text ran under — the join to `routinePermissionKey()`, so an auditor
+     *  reading a standing grant in the audit log can recover the instruction it covered. */
+    readonly generation?: number;
+    /** Who authored this text: the routine's `createdBy` for the genesis row, the edit's
+     *  `requestedBy` for every later one. Absent when neither was known. */
+    readonly authoredBy?: string;
+    /** The principal whose click ARMED this text. Absent on the genesis row (the store knows who
+     *  created the routine, not who clicked its card) and on any write outside the card path. */
+    readonly armedBy?: string;
+    /** `pending_actions.id` of the card that armed it — the join back to the frozen args (which
+     *  carry BOTH prompts verbatim) and the `approval.approved` audit row. */
+    readonly approvalId?: string;
+    /** ISO-8601: when this text was recorded — the routine's `createdAt` on the genesis row, the
+     *  instant of the write for every later one. */
+    readonly recordedAt: string;
+}
+/** Who armed a prompt-replacing `updateRoutine`, for the revision row. Every field is optional at
+ *  the port for the same reason {@link DomainSkillProvenance}'s are: the store must never refuse
+ *  to record a superseded prompt because provenance is thin. The approval path
+ *  (approvals/routine-lifecycle.ts) supplies all three. */
+export interface RoutinePromptProvenance {
+    /** The principal who ASKED for the edit — recorded as the new text's author. */
+    readonly authoredBy?: string;
+    readonly armedBy?: string;
+    /** `pending_actions.id` of the card that armed it. */
+    readonly approvalId?: string;
+}
+/** One row an adapter is to append to `routine_prompt_revisions`. The identity (`org`,
+ *  `surfaceKey`, `routineId`) is the adapter's — it already has it — so this carries only what
+ *  varies per row. */
+export interface RoutinePromptRevisionWrite {
+    readonly prompt: string;
+    readonly generation: number;
+    readonly authoredBy?: string;
+    readonly armedBy?: string;
+    readonly approvalId?: string;
+    readonly recordedAt: string;
+}
+/** Pure, and shared by both backends so the two cannot drift on the judgement rather than the dialect. It emits a genesis row for the text being destroyed only when the log is empty, attributed from the routine's own createdBy and createdAt, never from the edit that is replacing it. */
+export declare function routinePromptRevisionWrites(input: {
+    readonly existing: Routine;
+    readonly updated: Routine;
+    readonly provenance?: RoutinePromptProvenance;
+    /** Does the log already hold a row for this routine? Only false on its first edit. */
+    readonly hasPriorRevisions: boolean;
+    readonly nowIso: string;
+}): RoutinePromptRevisionWrite[];
+/** The top of the observable delegation-depth range: 2 means two or more hops from the root. eve names the immediate parent and denormalises the root but publishes no hop counter, so only depths 0 and 1 are exact. */
+export declare const MAX_OBSERVABLE_DELEGATION_DEPTH = 2;
+export interface UsageEventEntry {
+    /** Tenant — the outermost partition key, same convention as every other row here. */
+    readonly org: string;
+    /** `platform/workspace/surface` — this event's surface (memory/partition.ts). */
+    readonly surfaceKey: string;
+    /** The session this event belongs to — the per-conversation cost key. */
+    readonly sessionId: string;
+    /** The acting principal (bindFrom(ctx).principalId), when the turn had one. */
+    readonly principalId?: string;
+    /** ISO-8601; stamped by appendUsageEvent when the caller omits it. */
+    readonly ts: string;
+    /** Best-effort turn-origin tag: "dm" | "channel" | "routine" | "sandbox" | ...
+     *  free-form (new sources can add their own); absent when undeterminable.
+     *  🔴 IT DOES NOT ANSWER "was this a DM" — {@link UsageEventEntry.surfaceMode} does. A routine,
+     *  supervisor or subagent turn wins this tag before the DM test runs (hooks/spend.ts). */
+    readonly kind?: string;
+    /** The conversation this event happened in ({@link SurfaceMode}) — the fact the report mask
+     *  reads. Absent on a row written before the column, or by a writer with no binding; a report
+     *  masks such a row rather than guess. */
+    readonly surfaceMode?: SurfaceMode;
+    /**
+     * WHICH routine this event's turn belongs to (OPE-145) — present exactly when `kind === "routine"`,
+     * absent otherwise. `kind` alone said only THAT a routine ran; with no id, per-routine cost was
+     * unanswerable and a per-routine budget had nothing to key on. Read off the dispatcher's
+     * ROUTINE_MARKER in the fired session's auth attributes (hooks/spend.ts) — the same seam the
+     * outcome hook reads, so it is available for the whole session lifetime, subagents included.
+     */
+    readonly routineId?: string;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cacheReadTokens: number;
+    readonly cacheWriteTokens: number;
+    /** True means the call's source published a cache figure, so a 0 beside it is real; absent means the question was never asked. It does NOT mean the figure is informative: the Vercel AI Gateway applies the cache discount without populating the token split, so a zero cache count is never evidence that caching did not happen. */
+    readonly cacheTokensReported?: boolean;
+    /**
+     * REASONING tokens for this one call (OPE-1611). ABSENT = the source did not report the
+     * dimension; a number (0 included) = it did. See {@link import("../spend/spend.js").Usage} for
+     * why a turn step reports nothing here today, and why this is never priced.
+     */
+    readonly reasoningTokens?: number;
+    /** The model id, when the emitting source can name one (rarely — see hooks/spend.ts;
+     *  eve's step.completed carries no model field today), or the UNKNOWN_MODEL sentinel when a
+     *  token-bearing model call could not be attributed to one (spend/spend.ts). */
+    readonly model?: string;
+    /** Millionths of a dollar the gateway measured for this call; absent on a direct-provider deployment and on non-model rows. There is deliberately no derived twin here — derived cost is computed at read time from the model and tokens, so a price-table fix corrects history, while a measured figure can be recomputed from nothing. */
+    readonly usdMicrosMeasured?: number;
+    /** WHICH cost answer this call carried (OPE-369): "measured" iff {@link usdMicrosMeasured} is
+     *  present. Absent on pre-migration rows and on non-model rows. */
+    readonly costSource?: CostSource;
+    /** How many delegation hops from the root conversation this call ran at: 0 is the root turn, 1 a directly-delegated child. The top of the range is a band, not a count, because eve's parent projection carries the immediate parent and the root and nothing in between. */
+    readonly delegationDepth?: number;
+    /** The ROOT (user-facing) session at the top of this call's delegation chain — its own session
+     *  id on a root turn (OPE-369). Total going forward, so grouping a whole delegation TREE's cost
+     *  is one `GROUP BY root_session_id`, including grandchildren, which file under their immediate
+     *  parent and would otherwise be invisible to the root. */
+    readonly rootSessionId?: string;
+    /** Extensibility slot (e.g. sandbox seconds) — structured, stored as JSON text. */
+    readonly detail?: Readonly<Record<string, unknown>>;
+}
+/** Caller input — `ts` and the four token counts are optional (0 / stamped when absent),
+ *  so a zero-token event (the sandbox line) reads naturally as `{ ...meta, detail }`. */
+export type UsageEventInput = Omit<UsageEventEntry, "ts" | "inputTokens" | "outputTokens" | "cacheReadTokens" | "cacheWriteTokens"> & {
+    readonly ts?: string;
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+};
+export interface UsageSummaryFilter {
+    /** Prefix match on surfaceKey (e.g. "slack/T1" for one workspace). */
+    readonly surfaceKeyPrefix?: string;
+    /** ISO-8601 lower bound (inclusive). */
+    readonly sinceTs?: string;
+    /** ISO-8601 upper bound (inclusive). */
+    readonly untilTs?: string;
+    /** Also excludes any row whose owning session had a recorded usage event before this bound, closing the leak sinceTs alone cannot: sinceTs bounds the event's own write time, so a turn from an older session that flushes inside the window still counts. A session's start is approximated as the earliest ts this store ever recorded for its session id. */
+    readonly sessionStartedAfter?: string;
+}
+/** One grouped rollup row: sums + counts for one (surfaceKey, principalId, kind, routineId, model)
+ *  tuple. `routineId` joined the grain in OPE-145 — it is null on every non-routine row, so the
+ *  grouping is unchanged for them, and it is what makes per-routine cost (and a per-routine budget)
+ *  computable from the same rollup everything else already uses. */
+export interface UsageSummaryRow {
+    readonly surfaceKey: string;
+    readonly principalId?: string;
+    readonly kind?: string;
+    /** The conversation these events happened in ({@link SurfaceMode}) — a grouping column, so one
+     *  surface's unstamped legacy rows never blend with its stamped ones. Absent when unstamped. */
+    readonly surfaceMode?: SurfaceMode;
+    /** The routine this group's events belong to (OPE-145); absent for non-routine usage. */
+    readonly routineId?: string;
+    readonly model?: string;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cacheReadTokens: number;
+    readonly cacheWriteTokens: number;
+    /** Reasoning tokens summed over this group's calls (OPE-1611); 0 when none reported any. */
+    readonly reasoningTokens: number;
+    /** How many of this group's calls REPORTED the cache split (`cache_tokens_reported = true`).
+     *  `events - cacheReportedCalls` is the honest "cache attribution unreported" count — the
+     *  number a report shows instead of implying the group's cache zeros mean no caching. */
+    readonly cacheReportedCalls: number;
+    /** How many of this group's calls reported a reasoning-token count at all (a non-NULL
+     *  `reasoning_tokens`). 0 means the group's `reasoningTokens` sum carries no information. */
+    readonly reasoningReportedCalls: number;
+    /** Row count in this group (≈ model-call count). */
+    readonly events: number;
+    /** Distinct session_id count in this group (≈ conversation count). */
+    readonly sessions: number;
+}
+export interface CompiledAnalyticsQuery {
+    readonly table: "audit_entry" | "usage_events" | "spend_ledger";
+    readonly select: readonly {
+        readonly expr: string;
+        readonly alias: string;
+    }[];
+    readonly groupBy: readonly string[];
+    /** WHERE conjuncts (AND-joined), scope conjuncts FIRST; `?` placeholders. */
+    readonly where: readonly string[];
+    /** Bind params, positionally matched to `?` across `where` in order. */
+    readonly params: readonly unknown[];
+    readonly orderBy: {
+        readonly expr: string;
+        readonly dir: "ASC" | "DESC";
+    } | null;
+    readonly limit: number;
+}
+/** Separator framing every id in a stored promoter list. A newline cannot occur inside a platform
+ *  event id, and {@link framePromoterId} escapes one anyway. */
+export declare const PROMOTER_SEP = "\n";
+/**
+ * How many recent promoter ids one row keeps. The bound is the point: an unbounded list on a hot
+ * row is its own defect, so the oldest entry is dropped once a promotion pushes the list past this.
+ *
+ * 🔴 THE BOUND IS THE RESIDUAL, AND IT IS THE HONEST ONE TO STATE. A replay of a promotion that
+ * this many DISTINCT later promotions have already pushed off the list clears `stopped` again.
+ * Closing that needs an unbounded list, which is the defect this bound exists to avoid.
+ */
+export declare const PROMOTER_LIST_MAX = 32;
+/**
+ * Frame one promoting event id for storage and for the membership test — the SAME transform on
+ * both sides, which is what makes a redelivery match the entry its first delivery wrote.
+ *
+ * A separator inside the raw id would let a caller spell two entries in one value, so it is
+ * replaced by a space. The transform is deterministic, so a redelivery still matches; two ids that
+ * differ only in a separator collapse onto one entry, which errs towards KEEPING a stand-down.
+ */
+export declare function framePromoterId(raw: string): string;
+/** Decode a stored promoter list into its ids, oldest first. NULL, empty and a list of nothing all
+ *  read as an empty array — "this row records no promoter", which never blocks a clear. */
+export declare function decodePromoterList(stored: string | null | undefined): string[];
+/** The {@link EngagementRow.recentPromoters} half of a decoded row — present only when the row
+ *  records a promoter, so an empty list reads as ABSENT rather than as `[]`. Both adapters spread
+ *  this, so the "when is it absent" rule is written once. */
+export declare function promoterListField(stored: string | null | undefined): {
+    recentPromoters?: readonly string[];
+};
+export interface EngagementRow {
+    readonly org: string;
+    /** The channel as a fully-qualified surface key (`platform/workspace/surface`). */
+    readonly surfaceKey: string;
+    /** Slack thread root ts — the engagement is per thread, not per channel. */
+    readonly threadTs: string;
+    /** ISO-8601 when the thread was first engaged (set once). */
+    readonly engagedAt: string;
+    /** ISO-8601 of the most recent delivered turn (refreshed each engaged turn). */
+    readonly lastTurnAt: string;
+    /**
+     * TRUE once the bot is an INVITED PARTICIPANT here — it has actually posted a reply or
+     * been @mentioned — vs a WARM WATCHER latched by a name-drop wake that hasn't (yet)
+     * earned a reply. The distinction is load-bearing for two behaviours: a warm thread's
+     * rolled-in messages keep the quiet-failure / higher-bar posture (oeUninvited) until a
+     * reply promotes it, and a warm thread is auto-shed after a run of silent turns whereas
+     * a participating thread is sticky (only an explicit stop disengages it). Never
+     * downgraded true→false.
+     */
+    readonly participating: boolean;
+    /**
+     * Consecutive woken-but-silent turns since the last engage/participation. Bumped when a
+     * warm (non-participating) woken turn judges NO_REPLY; RESET to 0 the moment a reply or
+     * @mention promotes the thread (participating → true). The warm auto-disengage threshold
+     * (channels/slack.ts WARM_SILENT_LIMIT) reads it to shed a name-drop that never landed.
+     */
+    readonly silentStreak: number;
+    /**
+     * The session token that OWNS this thread, when ownership routing is in play
+     * (Slack Claude-Tag-parity build)
+     * — either a thread token (`${channelId}:${threadTs}`) or the channel supervisor's token
+     * (`${channelId}:oe-sup:<generation>`, see {@link ChannelSessionRow}). Optional: absent on
+     * rows written before ownership routing existed, and until a T1.3+ router leg sets it —
+     * markEngaged only ever SETS it when the caller passes one (never clears an existing
+     * value with an absent opt, see markEngaged's doc comment).
+     */
+    readonly ownerToken?: string;
+    /**
+     * How this engagement came to exist: `"thread"` — today's only path, an @mention or an
+     * earned reply (markThreadEngaged with no `kind` opt) — or `"spawned"` — a T3.1
+     * `start_thread_session` handoff bind. Additive column: rows written before this field
+     * existed have no stored value and read back as `"thread"` (the fail-safe default — see
+     * markEngaged/getEngagement in sqlite.ts + postgres.ts). Set once at creation; never
+     * changed by a later markEngaged refresh/promotion.
+     */
+    readonly kind: "thread" | "spawned";
+    /** True once an explicit stop landed on this thread on the Slack window-riding supervisor path, where deleting the row would suppress nothing because the wake gate never reads engagement for a window domain. A promotion clears it; the Discord path still deletes its row on stop. */
+    readonly stopped: boolean;
+    /** The ids of the events that promoted this row to participating, most recent last and at most PROMOTER_LIST_MAX of them: a promotion carrying an id the list still holds does NOT clear stopped, so a redelivered mention cannot lift a stand-down. Every promoter the list still holds is guarded, not only the latest; the bound is the residual. */
+    readonly recentPromoters?: readonly string[];
+}
+/**
+ * ONE in-flight turn, addressed the three ways an ingress trigger can know it (OPE-418). The
+ * WRITE shape — `putTurnAnchor` stamps `createdAt` from its own `at` argument, so it isn't here.
+ *
+ * 🔴 EVERY FIELD IS HOST-RESOLVED. `sessionId`/`turnId` come from eve's own turn context, the keys
+ * from the resolved binding. A model never authors any of them, and nothing here is ever read back
+ * into a prompt — this row exists so an ingress process can call `attachSession(id).cancel({turnId})`
+ * with NO model call and NO session mint, which is what makes stop free and over-cap-proof.
+ */
+export interface TurnAnchorWrite {
+    /** The continuation token / window this turn belongs to. ALWAYS written — it is the primary key. */
+    readonly windowKey: string;
+    /** `"<platform>:<channelId>:<messageId>"` where the surface knows the anchor message (the thread
+     *  root a reaction lands on). Absent where it doesn't (a webhook fire, a routine). */
+    readonly anchorKey?: string;
+    /** `"<platform>:<channelId>"` — the slash-command resolution arm. Absent when unresolvable. */
+    readonly channelKey?: string;
+    /** eve's durable session id — the `attachSession` argument. */
+    readonly sessionId: string;
+    /** eve's turn id — passed to `cancel({turnId})` so a stale stop can never kill a LATER turn. */
+    readonly turnId: string;
+    /** The fully-qualified surface key (`platform/workspace/surface`), for the audit row. */
+    readonly surfaceKey: string;
+}
+/** A stored {@link TurnAnchorWrite}, plus the stamp the TTL prunes on. */
+export interface TurnAnchorRow extends TurnAnchorWrite {
+    readonly createdAt: string;
+}
+/**
+ * One THREAD SEAT's durable record (OPE-1696) — what a standing seat reads when it asks about a thread it handed off. Written at the spawn and again at the hand-back; never consulted for ROUTING, which stays on the ownership row alone.
+ * It carries no inference and no summary the host wrote: `report` is the seat's OWN closing words, and every other field is a fact the deployment recorded at the moment it happened.
+ */
+export interface ThreadSeatStateWrite {
+    /** The container (unifiedThreadRef.channelKey) — half the primary key. */
+    readonly channelKey: string;
+    /** The thread within it (unifiedThreadRef.threadKey) — the other half. */
+    readonly threadKey: string;
+    /** The thread seat's window token (`…:win:s/…`) — its identity, and what `message_thread_seat` addresses. */
+    readonly seatToken: string;
+    /** The PARENT standing seat's channel_session REGISTRY key, not its token: a parent rotates, and
+     *  the hand-back must wake the generation that is live THEN, not the one that spawned. */
+    readonly parentRegistryKey: string;
+    /** `open` from the spawn until the seat hands the thread back; `completed` after. */
+    readonly state: "open" | "completed";
+    /** The thread's own wake ORIGIN as JSON (channels/unified-window.ts `UnifiedWakeOrigin`) — the
+     *  reply target a later delivery to this seat must carry, recorded at the spawn because no
+     *  platform codec can rebuild an origin from a thread key alone. Validated on read, never trusted
+     *  raw. */
+    readonly originJson: string;
+    /** The seat's closing report, in its own words — present only once it has handed back. */
+    readonly report?: string;
+    /** ISO-8601 of the spawn. */
+    readonly openedAt: string;
+}
+/** A stored {@link ThreadSeatStateWrite}, plus the stamp the TTL prunes on (also the "last changed" a reader sees). */
+export interface ThreadSeatStateRow extends ThreadSeatStateWrite {
+    readonly updatedAt: string;
+}
+/** The live channel-supervisor session pointer for one (org, surfaceKey): one row tracking the current generation only, since a rotation replaces it wholesale and no history is kept. The token's shape is platform-specific and caller-minted; this store holds no routing logic. */
+export interface ChannelSessionRow {
+    readonly org: string;
+    /** The channel as a fully-qualified surface key (`platform/workspace/surface`) — same convention as EngagementRow. */
+    readonly surfaceKey: string;
+    /** The live continuation token for the current generation. */
+    readonly token: string;
+    /** Monotonic generation counter: 1 on first mint, +1 on every rotation. */
+    readonly generation: number;
+    /** ISO-8601 when THIS generation was minted (reset by rotateChannelSession). */
+    readonly createdAt: string;
+    /** ISO-8601 of the most recent wake delivered to this generation (bumped by touchChannelSession; reset on rotation). */
+    readonly lastWakeAt: string;
+    /** Turns served by this generation (bumped by touchChannelSession; reset to 0 on rotation) — the rotation-by-budget BACKSTOP (T1.5, #551). */
+    readonly turnCount: number;
+    /**
+     * Measured cumulative `inputTokens + cacheReadTokens` for THIS generation (bumped by
+     * bumpChannelSessionUsage from the spend hook; reset to 0 on rotation) — the PRIMARY
+     * rotation trigger against eve #551's cumulative-input death (§2, rotation-551-fix-design).
+     * NULL = unknown accumulation (a pre-migration row) ⇒ shouldRotate FAILS SAFE and rotates.
+     */
+    readonly inputTokensTotal: number | null;
+    /**
+     * ISO-8601 of the FIRST successfully-delivered wake on this generation (set once, COALESCE,
+     * by touchChannelSession; NULL on a freshly-minted/rotated row). NULL ⇒ no wake has been
+     * delivered yet ⇒ the next wake is still "fresh" and re-carries backscroll (H7c self-heal:
+     * a failed first wake no longer mints an amnesiac generation).
+     */
+    readonly firstWakeAt: string | null;
+    /** The most recent request's measured input on this generation — SET, not accumulated, and the context-size measure compaction reads, unlike the cumulative inputTokensTotal. NULL means no request has completed yet and deliberately does not rotate, because every freshly-minted generation is NULL. */
+    readonly lastInputTokens: number | null;
+    /** Set only by markChannelSessionRotation — the ops sweep and the pruned-deployment heal — never by a deploy and never by an ordinary wake. The next wake rotates before it delivers and clears the mark, so one mark buys one rotation, and it runs through the seat's own in-band rotate leg, which is the only leg that can carry the recorded tail. */
+    readonly rotateMarkedAt: string | null;
+    /**
+     * OPE-1821: the RUNNING CODE fingerprint this seat was last served with — the build-time hash of
+     * this bundle's runtime source (channels/runtime-rotation.ts states exactly what it covers).
+     * Written ONLY by {@link OperationalStore.stampChannelSessionRuntime}, never by a rotation: the
+     * stamp happens pre-dispatch, and a rotation that reset it would make the seat rotate again on its
+     * very next wake. NULL means no wake has stamped this row yet — a freshly-minted generation, or a
+     * row written before this column existed.
+     */
+    readonly servedCodeFingerprint: string | null;
+    /** OPE-1821: the DOMAIN declaration fingerprint this seat was last served with (channels/domain-fingerprint.ts). Same writer, same NULL meaning, as {@link ChannelSessionRow.servedCodeFingerprint}. The pair moves together, so a reader never sees one half of a swap. */
+    readonly servedDomainFingerprint: string | null;
+}
+/**
+ * What {@link OperationalStore.stampChannelSessionRuntime} did, and what the row held before it.
+ *
+ * 🔴 `"rotate"` IS AT-MOST-ONCE, AND THAT IS THE WHOLE POINT. The stamp is one conditional UPDATE,
+ * so of two wakes that both find the same stale seat exactly one gets `"rotate"` and the other gets
+ * `"current"` — the seat's generation retires once, not twice. A read-then-write in the caller could
+ * not give that, which is why the comparison lives in the store and not in runtime-rotation.ts.
+ */
+export interface ChannelSessionRuntimeStamp {
+    /**
+     * - `"rotate"` — the row carried a DIFFERENT pair, and THIS call won the swap. The caller must retire the generation.
+     * - `"adopted"` — the row carried NO pair (NULL), so it was stamped without rotating. A freshly-minted generation is already running this code, and a row written before the columns existed cannot prove otherwise; rotating on absence would retire every seat's first generation before its second wake.
+     * - `"current"` — the row already carried this exact pair. The steady state, and the answer a racing loser gets.
+     * - `"absent"` — no row for this (org, surfaceKey). There is no generation to retire; the caller's own mint arm writes the first one.
+     */
+    readonly outcome: "rotate" | "adopted" | "current" | "absent";
+    /** The pair as the row held it BEFORE this call, for the audit row that says WHAT changed. Both NULL on `"adopted"` and on `"absent"`. */
+    readonly previousCodeFingerprint: string | null;
+    readonly previousDomainFingerprint: string | null;
+}
+/** One durable uploaded-attachment record — the CROSS-PROCESS half of the Slack attachment
+ *  registry (channels/slack-attachments.ts). Its `urlPrivate` came from a Slack event's
+ *  `files[].url_private` (TRUSTED provenance, written only from the parse path), never a
+ *  model-supplied string — the same contract the in-memory `SlackAttachmentRecord` carries.
+ *  The BYTES are NOT stored, only the (short-lived) download URL + metadata. */
+export interface SlackAttachmentRow {
+    /** The Slack `url_private` download URL (the trusted event-supplied string). */
+    readonly urlPrivate: string;
+    /** IANA media type from the event (`files[].mimetype`), when known. */
+    readonly mimeType?: string;
+    /** Original filename from the event, when known — the raw-bytes read path infers a type
+     *  from its extension when the mimetype is absent. */
+    readonly name?: string;
+    /** The Slack team id the event belonged to, when known (future multi-bot token routing). */
+    readonly teamId?: string;
+}
+/** One GitHub App installation OE learned from the App's own `installation` webhook
+ *  (scm/installations.ts). NOT a credential — an installation id is a public routing
+ *  number; the App private key (the actual secret) stays in env and is never stored here.
+ *  Provenance is the SIGNATURE-VERIFIED webhook delivery only (the same
+ *  `GITHUB_WEBHOOK_SECRET` gate the chat surface uses), never a model string. */
+export interface GitHubInstallationRow {
+    /** The GitHub account the App is installed on (`installation.account.login`) — the key
+     *  the SCM plane's owner→installation map is looked up by. */
+    readonly owner: string;
+    /** `installation.id`, as a string (GitHub sends a number; the mint API takes a path segment). */
+    readonly installationId: string;
+    /** `installation.account.type` — "Organization" | "User" (diagnostics only). */
+    readonly accountType?: string;
+    /** `installation.repository_selection` — "all" | "selected". Refreshed by the
+     *  `installation_repositories` event so the row doesn't go stale on a scope change. */
+    readonly repositorySelection?: string;
+    /** ISO-8601 of the delivery that last wrote this row. */
+    readonly updatedAt: string;
+}
+/** One stored credential — the ciphertext half of the `db` credential broker
+ *  (agent/credentials/db-broker.ts, task #113). The VALUE is NEVER stored in plaintext:
+ *  `ciphertext` is the broker's AES-256-GCM envelope (iv‖tag‖ct, base64), opaque to this store.
+ *  `connector`/`domain` are display/label metadata only (surfaced in audit + admin views, never the
+ *  value). Written host-side by the credential-intake webhook path, read host-side at
+ *  egress-resolution time — the model touches neither end. */
+export interface StoredCredentialRow {
+    /** The unique lookup key, e.g. `db:notion-<domain>-key` (the ref egress resolves through getSecret). */
+    readonly ref: string;
+    /** The opaque AES-256-GCM envelope, base64. NEVER plaintext, NEVER logged. */
+    readonly ciphertext: string;
+    /** Connector label (e.g. "notion"), for audit + admin views only. */
+    readonly connector?: string;
+    /** Domain label the credential belongs to, for audit + admin views only. */
+    readonly domain?: string;
+    /** The principal that stored it (the intake requester). */
+    readonly createdBy: string;
+    /** ISO-8601 when it was stored. */
+    readonly createdAt: string;
+}
+/** One pending credential-intake — the opaque, single-use, TTL'd binding a "Set API key" button
+ *  carries (agent/credentials/intake.ts, task #113). Binds an intake id to WHERE the resolved
+ *  secret is stored (`ref`), WHO may complete it (`requestedBy` — the button click must match this
+ *  principal), and the connector/domain labels the modal shows. `usedAt` stays NULL until consumed
+ *  (single-use CAS); `expiresAt` bounds the window (~15 min). It NEVER carries the secret value —
+ *  that exists only inside the view_submission handler's own scope. */
+export interface CredentialIntakeRow {
+    readonly org: string;
+    readonly id: string;
+    /** The stored_credential ref the resolved value is written under. */
+    readonly ref: string;
+    readonly connector: string;
+    readonly domain?: string;
+    /** The ONLY principal permitted to open the modal + submit — a different clicker is refused. */
+    readonly requestedBy: string;
+    /** Where the button lives (for the ephemeral wrong-clicker notice + the success confirmation). */
+    readonly channelId: string;
+    readonly threadTs?: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    /** ISO-8601 when consumed; NULL/undefined = still open (single-use guard). */
+    readonly usedAt?: string;
+}
+/** One approval memo. Two planes write here and sessionId tells them apart: a bare session or window token for a session grant, a routine permission key for a declared permission. kind is an open set, so read it with a positive test for the shape you want — an else that treats anything unrecognised as held authority over-reports it. */
+export interface SessionApprovalRow {
+    readonly org: string;
+    /** The session/window token the proposing turn ran under (embeds the generation), or a routine's
+     *  permission key `oe-routine:<id>:g<n>` when the row is a declared permission. */
+    readonly sessionId: string;
+    readonly kind: string;
+    /** The member who clicked "Approve for session" — the attribution carried on every subsequent skip. */
+    readonly grantedBy: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+/** A link-set's lifecycle. `revoked` is TERMINAL (the offboarding lever); `suspended` is the
+ *  reversible hold a directory deprovision lands on. */
+export type LinkSetStatus = "active" | "suspended" | "revoked";
+/** One linked account's lifecycle. `suggested` = proposed by a directory sync, not yet proven;
+ *  `confirmed` = evidence-backed and live; `revoked` = TERMINAL (never transitions back). */
+export type LinkedIdStatus = "suggested" | "confirmed" | "revoked";
+/** A challenge's lifecycle. `pending` → `claimed` → (`ratified` | `denied`), or `expired`.
+ *  SINGLE-USE is the `pending`-only claim CAS: once a row leaves `pending` its nonce can never
+ *  be claimed again, so the code is spent by the first claimer whatever happens next. */
+export type LinkChallengeStatus = "pending" | "claimed" | "ratified" | "denied" | "expired";
+/** One canonical person, as stored. `handle` is DISPLAY ONLY — see the section header. */
+export interface LinkSetRow {
+    readonly org: string;
+    /** Opaque, host-minted id — the ONLY join key for a set. */
+    readonly id: string;
+    /** Display handle for admin lists + audit rows. NEVER a lookup key. */
+    readonly handle: string;
+    readonly status: LinkSetStatus;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** One account belonging to a link-set. `(org, platform, tenant, nativeId)` is the PRIMARY KEY —
+ *  the "an account is exactly one person" invariant, enforced by the engine and not merely by the
+ *  write API (which enforces it again; defence in depth). */
+export interface LinkedIdRow {
+    readonly org: string;
+    readonly linkSetId: string;
+    readonly platform: string;
+    /** Which workspace issued nativeId, and part of the primary key: on a tenant-scoped platform the id alone does not name an account, because two Slack workspaces can issue the same U-string to two people. Empty means a vendor-global platform, or a row written before this column existed. */
+    readonly tenant: string;
+    readonly nativeId: string;
+    readonly status: LinkedIdStatus;
+    /** WHAT established this row, in the canonical evidence spelling
+     *  (`challenge:<id>` | `config-import` | `directory-sync:<provider>`) — identity/link-store.ts
+     *  owns the vocabulary. Never blank: a row with no evidence is a row nobody can audit. */
+    readonly establishedBy: string;
+    /** The evidence record as JSON (opaque to the store) — the structured form of `establishedBy`,
+     *  so a later phase can answer "which challenge / which sync run" without parsing a label. */
+    readonly evidenceJson?: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** One proof-of-control challenge. NO RAW CODE ever touches this row — only sha-256 digests. */
+export interface LinkChallengeRow {
+    readonly org: string;
+    readonly id: string;
+    /**
+     * sha-256 (hex) of the uppercased code the TARGET posts back (code-1). The raw nonce exists only
+     * in the message that carried it and in the initiator's own head; a stolen database yields no
+     * usable codes.
+     *
+     * On the DIRECTORY transport nothing ever claims by nonce, so this holds a value that no message
+     * can match — see identity/link-store.ts `issueLinkChallenge`.
+     */
+    readonly nonceHash: string;
+    /** Which transport identifies the target: "code" is the bearer-code path and the default for every row written before this column, "directory" is the reverse-initiated path. It is a stored column rather than an inference because it decides the finalizer — the code transport forces a code-back, the directory transport does not. */
+    readonly transport: string;
+    /** The account the DIRECTORY transport asked. Written at ISSUE time, before any consent exists —
+     *  it is what the consent CAS matches against, so consent from any other account matches no row.
+     *  Absent on the code transport, where the target is unknown until it claims. */
+    readonly targetPlatform?: string;
+    readonly targetTenant?: string;
+    readonly targetNativeId?: string;
+    /**
+     * sha-256 (hex) of the CODE-BACK (code-2) — the value the INITIATOR must feed back to finalize.
+     * Minted at CONSENT time and only when {@link codeBackDecision} said to; absent means the finalizer
+     * is the ordinary acknowledged ratification.
+     *
+     * 🔴 ITS PRESENCE IS THE REQUIREMENT. identity/link-flow.ts's `finalizeGate` reads THIS, never the
+     * live setting — a knob flipped between consent and finalize must not strand a person holding a
+     * code the tool now refuses, nor drop a requirement the consent step already enforced.
+     */
+    readonly backNonceHash?: string;
+    readonly initiatingPlatform: string;
+    /** The initiator's TENANT (OPE-309 phase 2) — `""` off a tenant-scoped platform; see
+     *  {@link LinkedIdRow.tenant}. Recorded rather than re-derived at ratification, because the
+     *  workspace the DM came from is a fact of the ISSUING turn and the ratifying turn may be days
+     *  later and (post-phase-1) on a deployment whose admitted set has moved. */
+    readonly initiatingTenant: string;
+    readonly initiatingNativeId: string;
+    /** The surface key the challenge was issued from — the DM the ratification must come back to. */
+    readonly initiatingSurfaceKey: string;
+    /** The claiming account, stamped from the WAKE'S OWN captured author at claim time — never from
+     *  message content. NULL until claimed. */
+    readonly claimedPlatform?: string;
+    /** The claimant's TENANT, stamped in the same CAS as the other two claim columns — so a claimed
+     *  row names a complete account and `ratifyLinkChallenge` never has to guess one half of it. */
+    readonly claimedTenant?: string;
+    readonly claimedNativeId?: string;
+    readonly claimedAt?: string;
+    readonly status: LinkChallengeStatus;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    /** When the initiator ratified/denied it, or when the sweep expired it. */
+    readonly decidedAt?: string;
+}
+export interface LinkChallengeFilter {
+    readonly initiatingPlatform?: string;
+    /** Narrow to one workspace's initiator (OPE-309 phase 2). Omitted ⇒ every tenant, which is what
+     *  an admin-wide listing wants; the confirm path always supplies it, so a person confirming in
+     *  workspace A can never be shown a challenge minted by their namesake in workspace B. */
+    readonly initiatingTenant?: string;
+    readonly initiatingNativeId?: string;
+    /** Narrow to the challenges aimed AT one account (the directory transport's target). The three
+     *  target conjuncts are what `confirm_link` uses to find "somebody asked to link YOUR account" —
+     *  a caller sees a consent ask only when they ARE the account it names, by construction rather
+     *  than by a check the file could get backwards. */
+    readonly targetPlatform?: string;
+    readonly targetTenant?: string;
+    readonly targetNativeId?: string;
+    /** Narrow to the challenges one account ANSWERED. 🔴 TWO ACTS WRITE THIS TRIPLE, not one:
+     *  {@link OperationalStore.claimLinkChallenge} stamps the CODE transport's claimant from the wake's
+     *  own captured author, and {@link OperationalStore.consentLinkChallenge} stamps the DIRECTORY
+     *  transport's consenter in the same columns and to the same `claimed` status. So these conjuncts
+     *  find "this account is already mid-loop" through either door — which is what `link_identity`
+     *  asks, and why a caller that puts words in front of a person must read `transport` too. A whole
+     *  account, never a (platform, id) pair, for the reason {@link LinkedIdRow.tenant} gives. */
+    readonly claimedPlatform?: string;
+    readonly claimedTenant?: string;
+    readonly claimedNativeId?: string;
+    readonly status?: LinkChallengeStatus;
+}
+/** One capture, as written. Every field is a fact about the CALL, never about its result. */
+export interface ModelCallCaptureWrite {
+    readonly org: string;
+    /** Spend grain (`domainKeyOf`) — the same key the call's `usage_events` row carries. */
+    readonly surfaceKey: string;
+    /** eve's durable session id (`wrun_…`), the join key the transcript route uses. */
+    readonly sessionId: string;
+    /** eve's turn id for this call's turn (`turn_<sequence>`); `""` when none was resolvable. */
+    readonly turnId: string;
+    /** 0-based index of this call WITHIN its turn, as the recorder counted it. */
+    readonly stepIndex: number;
+    /** ISO-8601 write time. */
+    readonly ts: string;
+    /** The model id this call ran on — the id the router resolved, not the deployment default. */
+    readonly model: string;
+    /** The transport's provider label (e.g. "gateway"). */
+    readonly provider: string;
+    /** Serialised-shape version — see CAPTURE_SCHEMA_VERSION. The replay bench validates on read. */
+    readonly schemaVersion: number;
+    /** sha256 (hex) of the UNCOMPRESSED serialised body. The identity a replay quotes. */
+    readonly sha256: string;
+    /** Byte length of the uncompressed serialised body. */
+    readonly bodyBytes: number;
+    /** gzip(body) base64'd. EMPTY when `truncated` — see CAPTURE_MAX_BODY_B64_BYTES. */
+    readonly bodyGzipB64: string;
+    /** True when the body exceeded the store ceiling and was dropped. The row is still a witness that
+     *  the call happened (so the cross-check stays honest), but it cannot be replayed. */
+    readonly truncated: boolean;
+}
+/** One capture, as read back. `seq` is the store's own insertion order within the org. */
+export interface ModelCallCaptureRow extends ModelCallCaptureWrite {
+    readonly seq: number;
+}
+/**
+ * One SESSION's capture footprint, for the retention operator (OPE-857): a run is harvested and
+ * purged by session, and there is no supported way to find which sessions a run produced until
+ * this row exists. Aggregated from `model_call_capture`, never carries a body byte — this is a
+ * listing, not a harvest read.
+ */
+export interface ModelCallCaptureSessionRow {
+    readonly sessionId: string;
+    /** ISO-8601 timestamp of the session's earliest capture. */
+    readonly firstTs: string;
+    /** ISO-8601 timestamp of the session's latest capture. */
+    readonly lastTs: string;
+    readonly rowCount: number;
+    /** Sum of `bodyBytes` across the session's rows (uncompressed; a truncated row contributes 0 body
+     *  bytes stored but its `bodyBytes` fact still counts, matching what `modelCallCapturesForSession`
+     *  reports for that row). */
+    readonly totalBytes: number;
+}
+export interface ModelCallCaptureReadOptions {
+    /** Include the gzip body. Default TRUE (the harvest read). `false` returns metadata with an empty
+     *  body — enough to count, to cross-check, and to pick a cut point before fetching its bytes. */
+    readonly includeBody?: boolean;
+    readonly turnId?: string;
+    /** Max rows, oldest first. Omitted ⇒ every row for the session. */
+    readonly limit?: number;
+}
+export interface MemoryProposalRow {
+    /** The store's own insertion order within the org — the review worklist's stable id. */
+    readonly id: number;
+    readonly org: string;
+    /** A destructive op kind (`DESTRUCTIVE_KINDS` in memory/dream/ops.ts) or "skill" for a Mode-1 suggestion. */
+    readonly kind: string;
+    /** WHERE it applies — a silo name (Mode 2) or a surfaceKey (Mode 1). OE-minted, taint-clean. */
+    readonly scope: string;
+    readonly summary: string;
+    /** The affected line(s), for review. Member-authored content — this is why the table exists. */
+    readonly before?: string;
+    /** The suggested replacement / new content (e.g. a proposed SKILL.md body). */
+    readonly after?: string;
+    readonly detail?: Readonly<Record<string, unknown>>;
+    /** The proposing principal, or DREAM_ACTOR for a cycle-emitted proposal. */
+    readonly principalId: string;
+    /** ISO-8601 write time. */
+    readonly createdAt: string;
+}
+export type MemoryProposalWrite = Omit<MemoryProposalRow, "id">;
+export interface DmAudienceRow {
+    /** The ARN-like person address this row is keyed on, e.g. `slack:person/U0123ABC`. */
+    readonly address: string;
+    /** ISO-8601 of the FIRST proactive DM delivered under this grant; undefined = never delivered. */
+    readonly firstDmAt?: string;
+    /** ISO-8601 the recipient stopped proactive DMs; undefined = not stopped. */
+    readonly stoppedAt?: string;
+}
+/** One durable proactive address. `address` is provider-shaped and opaque to core — see the section
+ *  header above. */
+export interface ProactiveAddress {
+    readonly platform: string;
+    /** The provider's own record species inside `platform`. Opaque to core. */
+    readonly kind: string;
+    /** The provider's own key inside (`platform`, `kind`) — a principal id, a team id, … */
+    readonly refKey: string;
+    /** The workspace/tenant the address lives in; `""` when the platform has none. */
+    readonly tenant: string;
+    /** The provider-shaped address bag. Core round-trips it as JSON and reads no field. */
+    readonly address: Readonly<Record<string, unknown>>;
+    /** ISO-8601 of the last write. */
+    readonly updatedAt: string;
+}
+/** The one place the stored address bag is parsed, so the two adapters cannot disagree about a corrupt or non-object one. A bag that will not parse becomes an empty object rather than throwing, so one bad row cannot take a whole lookup down. */
+export declare function proactiveAddressRow(platform: string, kind: string, refKey: string, tenant: string, addressJson: string, updatedAt: string): ProactiveAddress;
+/** The immutable identity of one verified provider delivery. `authorityId` is the configured
+ * credential/signer id that verified it, never the signing secret. It participates in the key so
+ * one integration cannot spend another integration's delivery identity. */
+export interface IngressDeliveryKey {
+    readonly source: string;
+    readonly authorityId: string;
+    readonly deliveryId: string;
+}
+/** The bytes admitted after provider verification. `payloadJson` is opaque to the store and owns
+ * its own schemaVersion; raw signatures and credential material never belong here. */
+export interface IngressDeliveryWrite extends IngressDeliveryKey {
+    readonly payloadJson: string;
+    readonly receivedAt: string;
+}
+/** A content-free recovery candidate. The payload is returned only by the atomic claim to its
+ * winner, never by the due-list scan. */
+export interface DueIngressDelivery extends IngressDeliveryKey {
+    readonly receivedAt: string;
+    readonly availableAt: string;
+}
+/** The fenced work item returned by a successful exact claim. */
+export interface ClaimedIngressDelivery extends DueIngressDelivery {
+    readonly payloadJson: string;
+    readonly claimId: string;
+    readonly claimedAt: string;
+}
+/**
+ * Durable, host-side store for operational state, partitioned by org. Spend and
+ * routines are mutable; the audit log is APPEND-ONLY (no delete method on this seam). On
+ * Postgres that is enforced at the DB layer — SELECT/INSERT-only RLS under FORCE, which
+ * binds the table owner the app connects as, so UPDATE/DELETE are denied. On SQLite
+ * (single-tenant-trusted local/self-host) there is no RLS, so it is append-only by
+ * contract only (the absence of a delete path).
+ */
+export interface OperationalStore {
+    /** Backend id, for logs/diagnostics: "sqlite" | "postgres". */
+    readonly id: string;
+    /** Inspectable path (sqlite) or a descriptor (postgres) — for logging/views. */
+    root(): string;
+    /** Upsert-and-add one spend increment to its (org, surface, principal, routine, model,
+     *  period) row: amounts sum, `calls` increments by 1. Atomic. */
+    recordSpend(org: string, write: SpendLedgerWrite): Promise<void>;
+    /** SUM the ledger over a keyed prefix (org-scoped; every filter conjunct ANDs) — the
+     *  ONE read every cap denomination uses. Zero totals when nothing matches. */
+    spendTotals(org: string, filter?: SpendLedgerFilter): Promise<SpendTotals>;
+    /** Raw ledger rows for the report and admin rollups. Name the org on any path a remote caller can reach — omitting it reads every tenant's rows — and name the period, because omitting it reads the org's whole ledger history. */
+    listSpendLedger(org?: string, filter?: SpendLedgerFilter): Promise<SpendLedgerRow[]>;
+    listRoutines(org: string, surfaceKey: string): Promise<Routine[]>;
+    getRoutine(org: string, surfaceKey: string, id: string): Promise<Routine | null>;
+    addRoutine(routine: Routine): Promise<Routine>;
+    /**
+     * Apply a patch to one routine. When the patch REPLACES `prompt`, the adapter also appends to
+     * the append-only `routine_prompt_revisions` log — see {@link RoutinePromptRevisionRow} for what
+     * is recorded, why the recording lives HERE rather than at the caller, and why the log begins at
+     * the first edit rather than at creation. `provenance` names the approval that armed the new
+     * text; every other patch (a fire's `nextRunAt`, a watch's `lastStateHash`, a job's ledger)
+     * records nothing and pays nothing.
+     */
+    updateRoutine(org: string, surfaceKey: string, id: string, patch: Partial<Routine>, provenance?: RoutinePromptProvenance): Promise<Routine | null>;
+    removeRoutine(org: string, surfaceKey: string, id: string): Promise<boolean>;
+    listAllRoutines(): Promise<Routine[]>;
+    /** Every recorded prompt for a surface's routines, OLDEST FIRST (`seq` ascending). Narrow to one
+     *  routine with `routineId`; omit it to sweep the surface, which is how you reach the history of
+     *  a routine that has since been cancelled and whose row is gone. */
+    listRoutinePromptRevisions(org: string, surfaceKey: string, routineId?: string): Promise<RoutinePromptRevisionRow[]>;
+    /** Append one already-stamped audit record. There is intentionally NO delete. The store
+     *  stamps this row's `prev_sha` = sha256 of the org's current last row (OPE-52 hash chain,
+     *  agent/audit/chain.ts) — a read-last-then-insert that the ADAPTER serialises per org, so
+     *  every caller is covered, not only those that come through audit.ts (OPE-1636). */
+    appendAudit(entry: AuditEntry): Promise<void>;
+    /** Read audit records matching a filter, newest-first — each with its storage `seq`
+     *  ({@link AuditReadRow}), which is the only order key that survives a backward clock step. */
+    readAudit(filter: AuditFilter): Promise<AuditReadRow[]>;
+    /** Distinct org_ids present in the audit log — the per-org hash-chain walk's key set (OPE-52). */
+    listAuditOrgs(): Promise<string[]>;
+    /** One org's audit rows OLDEST-first (seq ASC) with their `prevSha` + `seq`, for hash-chain
+     *  verification (OPE-52). `tailLimit` (>0) returns only the last N by seq — still oldest-first —
+     *  the boot tail-check window; absent/≤0 returns the full chain (the --verify-chain walk). */
+    readAuditChain(org: string, opts?: {
+        readonly tailLimit?: number;
+    }): Promise<AuditChainRow[]>;
+    /** Seal the org's existing audit rows under a NEW chain epoch and append the marker (OPE-1636,
+     *  agent/audit/chain.ts). Reads the era and inserts the marker in ONE critical section, so the
+     *  seal cannot be born stale. Returns the seal written AND the marker's seq, or null when there
+     *  is nothing to seal (no rows, or the chain already ends at an epoch). `sealedBy` is recorded as
+     *  the row's principal — an operator act carries a name.
+     *
+     *  🔴 IT BLOCKS THE ORG'S APPENDS while it runs. The critical section holds the whole era read,
+     *  which is the org's ENTIRE chain, so a large log makes that a long hold — see the seal command
+     *  and docs/security/audit-and-provenance.md. */
+    sealAuditChainEpoch(org: string, sealedBy: string): Promise<AuditChainEpochWritten | null>;
+    /** Set (upsert) a spend-limit override for (org, scopeKey, level), with optional bridge
+     *  metadata. `limit` carries a token and/or USD component (see SpendLimitAmount); the
+     *  upsert replaces any previous override row at that scope+level wholesale. */
+    setSpendLimit(org: string, scopeKey: string, level: CapLevel, limit: SpendLimitAmount, meta?: OverrideMeta, condition?: {
+        readonly ifAbsent?: true;
+    }): Promise<boolean>;
+    /** Clear a spend-limit override. When `expected` is present, delete only the byte-for-byte
+     *  logical row the caller owns; a missing or changed row returns false and is left untouched. */
+    clearSpendLimit(org: string, scopeKey: string, level: CapLevel, expected?: SpendLimitMatch): Promise<boolean>;
+    /** All spend-limit overrides for an org (small; consulted on the spend-check path + drift view). */
+    spendLimits(org: string): Promise<SpendLimitRow[]>;
+    /** Arm the break-glass HALT at one address (see {@link HaltAddress}). Upsert: re-halting an
+     *  already-halted address restamps `setBy`/`setAt` and clears the previous resume stamps. */
+    setHalt(org: string, address: HaltAddress, meta?: {
+        readonly setBy?: string;
+        readonly setAt?: string;
+        readonly setRef?: string;
+    }): Promise<void>;
+    /** Clear the halt at one address. Returns true iff an ACTIVE row was cleared — false is
+     *  "nothing was halted there", never an error, so `resume` is idempotent. */
+    clearHalt(org: string, address: HaltAddress, meta?: {
+        readonly clearedBy?: string;
+    }, expected?: HaltMatch): Promise<boolean>;
+    /** Every ACTIVE halt row for an org (tiny; read on the enforcement paths). Cleared rows are kept
+     *  in the table for the trail but are never returned here — a reader asks one question. */
+    activeHalts(org: string): Promise<HaltRow[]>;
+    /** Set (upsert) a connector grant/revoke override for (org, scopeKey, connector), with optional reason/setBy. */
+    setConnectorOverride(org: string, scopeKey: string, connector: string, granted: boolean, meta?: Omit<OverrideMeta, "expiresAt">): Promise<void>;
+    /** Clear a connector override (revert to config). Returns true if one was removed. */
+    clearConnectorOverride(org: string, scopeKey: string, connector: string): Promise<boolean>;
+    /** Connector overrides for one scope — applied over the bundle-granted set by the gate. */
+    connectorOverrides(org: string, scopeKey: string): Promise<ConnectorOverrideRow[]>;
+    /** Every connector override for an org (across scopes) — the drift view. */
+    allConnectorOverrides(org: string): Promise<ScopedConnectorOverrideRow[]>;
+    /** Set (upsert) a domain's runtime model/reasoning pick — replaces any previous pick
+     *  for (org, domain) wholesale (assertDomainModelPick guards the shape). */
+    setDomainModel(org: string, domain: string, pick: {
+        readonly modelId?: string;
+        readonly reasoning?: ModelReasoning;
+    }, setBy?: string): Promise<void>;
+    /** Clear a domain's model pick (reverts to the git-config route). Returns true if one was removed. */
+    clearDomainModel(org: string, domain: string): Promise<boolean>;
+    /** This domain's model pick, or null if none set — the hot-path read model/routing.ts
+     *  consults (cached there; routing runs on every model call). */
+    getDomainModel(org: string, domain: string): Promise<DomainModelRow | null>;
+    /** Every domain model pick for an org (small; admin/diagnostic use). */
+    domainModels(org: string): Promise<DomainModelRow[]>;
+    /**
+     * Mark a thread engaged (upsert). First touch: engagedAt=lastTurnAt=at, silentStreak=0,
+     * participating = `opts?.participating ?? false`, kind = `opts?.kind ?? "thread"`,
+     * ownerToken = `opts?.ownerToken` (absent if not given). Existing row: ALWAYS refresh
+     * lastTurnAt; if `opts?.participating === true` PROMOTE participating→true AND reset
+     * silentStreak→0 (a reply/mention invited the bot). participating is never downgraded
+     * true→false, so a plain refresh (no opts, or `participating:false`) leaves an already
+     * participating thread — and its silentStreak — untouched. `ownerToken` is only ever
+     * SET by a later call that passes one (an absent opt on a refresh never clears an
+     * existing owner); `kind` is fixed at first touch and never changed by a later call. A
+     * PROMOTION (`participating === true`) also CLEARS a `stopped` marker (task #100 follow-up:
+     * a re-invitation — a directMention or OE's own reply — re-engages a stopped thread); a warm
+     * refresh (participating absent/false) leaves `stopped` untouched.
+     *
+     * `engagedBy` NAMES THE PROMOTING EVENT and is the one exception to that clearing rule
+     * (OPE-1527, widened by OPE-1562): a promotion whose id is ALREADY in the row's
+     * {@link EngagementRow.recentPromoters} list leaves `stopped` set, so a redelivered @mention
+     * cannot lift a stand-down — including one a later @mention has since superseded. The id is
+     * appended to that list (de-duplicated, most recent last, bounded by
+     * {@link PROMOTER_LIST_MAX}) only by a promotion; a warm refresh records nothing. An absent id,
+     * and an empty list, clear exactly as before.
+     */
+    markEngaged(org: string, surfaceKey: string, threadTs: string, at: string, opts?: {
+        participating?: boolean;
+        ownerToken?: string;
+        kind?: "thread" | "spawned";
+        engagedBy?: string;
+    }): Promise<void>;
+    /**
+     * Mark a thread STOPPED (task #100 follow-up — the window-riding supervisor stop). Sets the
+     * durable `stopped` flag on an EXISTING row (does NOT delete it, unlike {@link disengage} —
+     * the flag is what the route reads to suppress later non-mention wakes). Returns true if a row
+     * was updated, false if the thread had no engagement row. Idempotent (re-stopping is a no-op
+     * write). The Slack window stop path calls THIS; the Discord path keeps calling `disengage`.
+     */
+    markStopped(org: string, surfaceKey: string, threadTs: string): Promise<boolean>;
+    /**
+     * Increment a thread's silent_streak by 1 and return the NEW value. No-op returning 0
+     * when the thread has no engagement row (nothing to shed). Called when a warm woken
+     * turn judges silence; the caller sheds the thread once the return hits the limit.
+     */
+    bumpSilentStreak(org: string, surfaceKey: string, threadTs: string): Promise<number>;
+    getEngagement(org: string, surfaceKey: string, threadTs: string): Promise<EngagementRow | null>;
+    /** Disengage a thread (explicit stop). Returns true if one was removed. */
+    disengage(org: string, surfaceKey: string, threadTs: string): Promise<boolean>;
+    /** All engaged threads for an org — for diagnostics + the dream-cycle sweep. */
+    listEngagements(org: string): Promise<EngagementRow[]>;
+    getChannelSession(org: string, surfaceKey: string): Promise<ChannelSessionRow | null>;
+    /**
+     * Mint a fresh generation for (org, surfaceKey): generation = (current row's generation
+     * ?? 0) + 1, token = `newToken` (caller-computed — the token's platform-specific shape,
+     * e.g. `${channelId}:oe-sup:<generation>`, is not this store's concern), createdAt =
+     * lastWakeAt = `at`, turnCount + input_tokens_total reset to 0, last_input_tokens reset to
+     * NULL, first_wake_at reset to NULL (no wake delivered on the new generation yet — H7c),
+     * rotate_marked_at reset to NULL (the operator mark is SPENT by this rotation — OPE-820).
+     * Upserts the ONE row for this surface — no generation history is kept (see the {@link
+     * ChannelSessionRow} doc comment). Returns the freshly-minted row.
+     */
+    rotateChannelSession(org: string, surfaceKey: string, newToken: string, at: string): Promise<ChannelSessionRow>;
+    /**
+     * OPE-1821 — the PRE-DISPATCH comparison that decides whether a standing seat runs stale code.
+     * Compare `codeFingerprint`/`domainFingerprint` against the pair the row was last served with; on
+     * a difference, write the new pair and answer `"rotate"` (see {@link ChannelSessionRuntimeStamp}).
+     * ONE conditional UPDATE, so the swap is atomic and a concurrent wake on the same stale seat
+     * answers `"current"` instead of rotating it a second time.
+     * It NEVER creates a row: a surface with no seat has no generation to retire.
+     */
+    stampChannelSessionRuntime(org: string, surfaceKey: string, codeFingerprint: string, domainFingerprint: string): Promise<ChannelSessionRuntimeStamp>;
+    /** Mark the current generation for retirement at its next wake; returns false when no row exists and never creates one. It rotates nothing itself — the seat's own next wake takes the in-band rotate leg that carries the recorded tail — and it is idempotent, with the first mark standing. */
+    markChannelSessionRotation(org: string, surfaceKey: string, at: string): Promise<boolean>;
+    /**
+     * Record one more turn on the CURRENT generation: lastWakeAt = `at`, turnCount += 1, and
+     * first_wake_at = COALESCE(first_wake_at, `at`) — set ONCE, on the first delivered wake
+     * (H7c: this runs only after a successful wake, so it stamps "first wake delivered"). No-op
+     * if no row exists yet for this surface (nothing to touch — the caller mints one via
+     * rotateChannelSession first).
+     */
+    touchChannelSession(org: string, surfaceKey: string, at: string): Promise<void>;
+    /**
+     * Add `delta` measured input tokens (`inputTokens + cacheReadTokens`) to the CURRENT
+     * generation's cumulative counter — the PRIMARY rotation trigger's input (§2, #551).
+     * Guarded by `token`: the UPDATE only lands when the row's live token matches, so a
+     * straggler step from a retired generation (a rotation-boundary race) mismatches and is a
+     * no-op — no phantom counting across generations. Best-effort at the caller (spend hook);
+     * a NULL counter is COALESCE'd to 0 before the add (backfill posture). No-op if no row
+     * exists or the token doesn't match — RETURNS the matched-row count (0 or 1) so the caller
+     * can tell a legitimate straggler no-op from a systematically missed counter (the #551
+     * counter sat at 0 in prod for weeks because this was silent).
+     *
+     * The SAME write also SETS `last_input_tokens = delta` (OPE-794). One measurement, two rotation
+     * rungs: cumulative accumulation is the running sum, context size is the latest value. They share
+     * a writer so they can never disagree about which step they saw, and the token guard covers both.
+     */
+    bumpChannelSessionUsage(org: string, surfaceKey: string, token: string, delta: number): Promise<number>;
+    /**
+     * All channel_session rows for `org`, narrowed to registry keys that START WITH `keyPrefix`
+     * (an exact string prefix — no wildcard interpretation), or every row when `keyPrefix` is
+     * omitted. The one enumeration seam a deploy-time MASS rotation needs (OPE-806): every standing
+     * seat this deployment has ever minted lives under `oe-domain::` (channel windows AND DM seats
+     * alike — a DM seat is a degenerate window on its own `oe-domain::oe-dm/<surfaceKey>` pseudo-
+     * domain row, unified-supervisor.ts), so `listChannelSessions(org, "oe-domain::")` is a complete
+     * sweep list with no separate DM enumeration needed. A full per-org scan is fine here: the row
+     * count is dozens, not millions — no pagination.
+     */
+    listChannelSessions(org: string, keyPrefix?: string): Promise<ChannelSessionRow[]>;
+    /**
+     * Append one entry to a standing seat generation's TAIL ring — the recorded conversation a
+     * rotation carries into the fresh generation's first wake. `token` is the generation's live
+     * continuation token, so a straggler write from a retired generation lands under the retired
+     * token and is never read again.
+     *
+     * Bounded on write: the adapter prunes the ring to the newest {@link SESSION_TAIL_MAX_ENTRIES}
+     * entries for that token, so a busy generation cannot grow the table without limit. Best-effort
+     * at every caller — a lost tail entry costs continuity, never a wake.
+     */
+    appendSessionTail(org: string, surfaceKey: string, token: string, entry: SessionTailEntry): Promise<void>;
+    /**
+     * Read one generation's tail ring, OLDEST-FIRST. The rotate leg calls this with the OUTGOING
+     * generation's token, immediately before minting the next one. Empty ⇒ no recorded tail: a brand
+     * new surface, or a generation that predates this feature (the bootstrap case), and the caller
+     * falls back to a capped platform fetch.
+     */
+    readSessionTail(org: string, surfaceKey: string, token: string): Promise<SessionTailEntry[]>;
+    /** Drop a generation's ring once its tail has been carried forward. Best-effort housekeeping. */
+    clearSessionTail(org: string, surfaceKey: string, token: string): Promise<void>;
+    /**
+     * Rewrite the TEXT of one `post`-kind ring row, matched by its recorded platform `messageId`, on
+     * ONE generation's ring (OPE-815). The only mutation this ring ever takes, and it is narrow on
+     * purpose: the sole caller is `edit_reply`'s CONFIRMED-success path
+     * (channels/session-tail-record.ts `editPostTail`) — never a definitive refusal, never an ambiguous
+     * outcome — so a row changes here only when the platform itself confirmed the room's copy changed.
+     * Every other field on the row is untouched. Returns whether a row matched; `false` on a miss (the
+     * generation already rotated the row off its ring, or no post row there carries this id) is silent
+     * and expected, matching every other write on this ring — nothing here throws into its caller.
+     */
+    editSessionTailPost(org: string, surfaceKey: string, token: string, messageId: string, text: string): Promise<boolean>;
+    /** All skills authored for (org, domain), for the resolver merge + list_skills. */
+    listDomainSkills(org: string, domain: string): Promise<DomainSkillRow[]>;
+    /**
+     * Upsert one domain skill (create if absent, else overwrite content/updatedBy/updatedAt)
+     * AND append the body to `domain_skill_revisions` — one revision per call, the first write
+     * included. The two happen together in the adapter rather than at the caller so that no
+     * write path can produce a body in `domain_skill` with no record of what was armed; see
+     * {@link DomainSkillRevisionRow}. `provenance` names the approval that armed it.
+     */
+    putDomainSkill(org: string, domain: string, name: string, content: string, updatedBy: string | undefined, updatedAt: string, provenance?: DomainSkillProvenance): Promise<void>;
+    /** Delete one domain skill by name. Returns true if one was removed. The skill's revisions
+     *  are NOT removed — an append-only log does not un-record a body that was once armed. */
+    deleteDomainSkill(org: string, domain: string, name: string): Promise<boolean>;
+    /** Every recorded body for a domain's skills, OLDEST FIRST (`seq` ascending). Narrow to one
+     *  skill with `name`; omit it to sweep the whole domain, which is how you reach the history
+     *  of a skill that has since been deleted and whose name you no longer have. */
+    listDomainSkillRevisions(org: string, domain: string, name?: string): Promise<DomainSkillRevisionRow[]>;
+    /** Append one usage event (best-effort by contract at the caller — see spend/usage-events.ts). */
+    appendUsageEvent(entry: UsageEventEntry): Promise<void>;
+    /** Every usage event for one session (org-scoped), oldest-first. Returns the RAW
+     *  rows rather than a pre-summed projection: a session_cost tool wants the turn
+     *  count and the kind/model breakdown, not just a total, so summing is left to the
+     *  caller (cheap — a session's row count is small). */
+    usageForSession(org: string, sessionId: string): Promise<UsageEventEntry[]>;
+    /** Grouped rollup by (surfaceKey, principalId, kind, routineId, surfaceMode, model) within an org — the
+     *  admin/analytics view + the cost-prediction input. */
+    usageSummary(org: string, filter?: UsageSummaryFilter): Promise<UsageSummaryRow[]>;
+    /**
+     * Opportunistic retention: delete this org's usage events older than `olderThanTs`
+     * (ISO-8601). Returns the count removed. NO-OP on Postgres (see operational/postgres.ts
+     * for why — the table is append-only there, same posture as audit_entry).
+     */
+    pruneUsageEvents(org: string, olderThanTs: string): Promise<number>;
+    /** Append one captured model-call body. Best-effort by contract at the caller
+     *  (`model/call-capture.ts` swallows its own failures — a lost capture never breaks a turn). */
+    appendModelCallCapture(write: ModelCallCaptureWrite): Promise<void>;
+    /** One session's captures, oldest first (`seq` ascending). `includeBody: false` returns the
+     *  metadata with an EMPTY `bodyGzipB64` — the cheap read for counting and for the
+     *  capture-vs-step cross-check, which never needs the bytes. */
+    modelCallCapturesForSession(org: string, sessionId: string, opts?: ModelCallCaptureReadOptions): Promise<ModelCallCaptureRow[]>;
+    /** Every session with at least one capture row, most-recently-active first — the retention
+     *  operator's "what did this run produce" read (OPE-857). Carries no body byte; a listing, not a
+     *  harvest. */
+    modelCallCaptureSessions(org: string): Promise<ModelCallCaptureSessionRow[]>;
+    /** Delete one session's captures. THE retention verb (see the section header): a soak run's
+     *  captures are harvested and then dropped. Returns the count removed. */
+    deleteModelCallCapturesForSession(org: string, sessionId: string): Promise<number>;
+    /** Append one proposal; returns the stored row with its store-assigned `id`. */
+    addMemoryProposal(write: MemoryProposalWrite): Promise<MemoryProposalRow>;
+    /** Every proposal recorded for an org, newest-first — the review worklist. */
+    listMemoryProposals(org: string): Promise<MemoryProposalRow[]>;
+    /** This person's row, or null when this deployment has never delivered to them and they have never
+     *  stopped it. Null therefore reads as "first delivery, not stopped", which is the correct floor. */
+    getDmAudience(org: string, address: string): Promise<DmAudienceRow | null>;
+    /**
+     * Record that a proactive DM landed. Upsert; `firstDmAt` is set ONLY on the first call and never
+     * moved after (COALESCE, in both adapters) — it is the fact "the carded first delivery already
+     * happened", so a later write that reset it would card a second time and, worse, would card again
+     * after every delivery. NEVER touches `stoppedAt`.
+     */
+    markDmAudienceDelivered(org: string, address: string, at: string): Promise<void>;
+    /** Set the recipient's STOP. Upsert, so a person may stop before any delivery has landed (a stop
+     *  written by somebody who was carded and then said no). Idempotent: re-stopping keeps the
+     *  ORIGINAL `stoppedAt`, so the trail keeps when the boundary was first drawn. */
+    setDmAudienceStopped(org: string, address: string, at: string): Promise<void>;
+    /** Clear the recipient's stop. Returns true when a stop was actually lifted, so the caller can tell
+     *  "resumed" apart from "there was nothing to resume" and never claims an act that did not happen. */
+    clearDmAudienceStopped(org: string, address: string): Promise<boolean>;
+    /** Every DM-audience row for an org — the operator's "who has stopped us" read. Small by nature:
+     *  one row per person this deployment has ever proactively DMed. */
+    listDmAudience(org: string): Promise<DmAudienceRow[]>;
+    /**
+     * Execute one compiled, constrained analytics query (OPE-66) and return the raw result rows,
+     * each keyed by the compiled query's SELECT aliases. READ-ONLY by construction — a
+     * CompiledAnalyticsQuery is SELECT-only (no mutation verbs in the grammar); values reach SQL only
+     * as bind params. The org filter is already the FIRST scope conjunct in `compiled.where`; Postgres
+     * org RLS backstops it. Adapters assemble the SQL via analytics/compile.ts's assembleAnalyticsSql
+     * (rendering the placeholder style) so the raw SQL string stays inside the adapter. Numeric sums
+     * come back per-engine (SQLite number, Postgres bigint-as-string) — the caller (analytics/
+     * execute.ts) coerces.
+     */
+    runAnalyticsQuery(compiled: CompiledAnalyticsQuery): Promise<Record<string, unknown>[]>;
+    /** Insert one verified delivery iff its full identity is new. The first payload wins for the
+     * row's lifetime; duplicates never rewrite it. Also prunes this org/source's elapsed completed
+     * tombstones. */
+    enqueueIngressDelivery(org: string, write: IngressDeliveryWrite): Promise<boolean>;
+    /** Content-free pending/stale candidates, oldest first. An active lease is omitted until
+     * `claimedAt <= staleBeforeIso`; completed rows never appear. */
+    listDueIngressDeliveries(org: string, source: string, nowIso: string, staleBeforeIso: string, limit: number): Promise<readonly DueIngressDelivery[]>;
+    /** Atomic exact-key claim. Returns the payload only to the winner. A free or stale lease may be
+     * claimed when the row is due and incomplete; an active/completed/missing row returns null. */
+    claimIngressDelivery(org: string, key: IngressDeliveryKey, claimId: string, claimedAtIso: string, staleBeforeIso: string): Promise<ClaimedIngressDelivery | null>;
+    /** Guarded retry release. Only the current claim holder can clear its lease and set the next
+     * eligible instant. Pending rows do not expire: accepted work remains recoverable after outages. */
+    releaseIngressDelivery(org: string, key: IngressDeliveryKey, claimId: string, availableAtIso: string): Promise<boolean>;
+    /** Guarded completion. Erases payload bytes in the same CAS and retains only a content-free
+     * dedupe tombstone until the caller's validated deadline (at most
+     * {@link INGRESS_DELIVERY_TOMBSTONE_RETENTION_MS} after completion). */
+    completeIngressDelivery(org: string, key: IngressDeliveryKey, claimId: string, completedAtIso: string, retainUntilIso: string): Promise<boolean>;
+    /** Guarded deletion for a DEFINITIVE pre-dispatch refusal. It is deliberately narrower than a
+     * retry release: removing the row makes a vendor redelivery eligible to enqueue again. */
+    discardIngressDelivery(org: string, key: IngressDeliveryKey, claimId: string): Promise<boolean>;
+    /** Records key as handled: true is the first sighting within ttlMs and false is a duplicate, and two racing calls resolve to exactly one true. Both prunes are org-scoped and ttlMs is per key and per caller, so any statement added here must stay keyed by org, and by key wherever a caller's TTL is involved. */
+    markEventSeen(org: string, key: string, at: string, ttlMs: number): Promise<boolean>;
+    /**
+     * READ-ONLY twin of {@link OperationalStore.markEventSeen}: true when `key` has a live
+     * (non-expired, per the same `ttlMs` semantics) row for this org, false otherwise. Never
+     * writes — a caller that must know "is this already marked" before deciding whether marking
+     * is even safe (OPE-436: a mark written from inside a step that might still crash before it
+     * commits) needs a check with no side effect of its own.
+     */
+    hasEventSeen(org: string, key: string, at: string, ttlMs: number): Promise<boolean>;
+    /** Drops key's row, so the next markEventSeen on it is a first sighting again. Release a claim only when the platform PROVED nothing landed: on an ambiguous failure the claim must stay, because a retry could double-post. */
+    forgetEventSeen(org: string, key: string): Promise<void>;
+    /** Appends one delivery to the capture window. FALSE is the ordinary outcome — the window is shut for all but a bounded period after arming — and a capture failure must never affect whether a delivery routes. Every bound is enforced in the adapter, in order: the absolute-age sweep, then the window deadline, then the row count. */
+    captureDelivery(org: string, source: string, documentJson: string, at: string, captureUntil: string, maxRows: number): Promise<boolean>;
+    /**
+     * The captured window for `source`, OLDEST FIRST — the order the `seq` numbering runs in, which is
+     * the order a human reads them in and says "17, 21 and 28" about. Never applies a read-time TTL:
+     * rows die on the prune-on-write path, and a read that silently hid rows the table still holds
+     * would make the numbering disagree with itself between two calls.
+     */
+    listCapturedDeliveries(org: string, source: string, limit: number): Promise<readonly CapturedDeliveryRow[]>;
+    /**
+     * Drop `source`'s whole captured window. Called when a window is (re-)armed, so numbering restarts
+     * at 1 against a set that is entirely from the current window — and reachable as the disarm/forget
+     * action, which is why the capture window is not a thing a deployment can only wait out.
+     */
+    clearCapturedDeliveries(org: string, source: string): Promise<void>;
+    /** Records the originating surface and conversation for one wake; the upsert updates target_json, created_at and window_token ONLY. It must never touch answered_at or audited_at — a retry would make an answered wake answerable again — and inbound is sticky-true, so a redrive cannot clear a flag a human's message set. */
+    putUnifiedWakeTarget(org: string, wakeId: string, targetJson: string, at: string, ttlMs: number, windowToken?: string, inbound?: boolean): Promise<void>;
+    /** The stored origin JSON for a wakeId, or null when unknown/expired — the caller FAILS
+     *  CLOSED (posts nothing) on null, never guesses a target. */
+    getUnifiedWakeTarget(org: string, wakeId: string): Promise<string | null>;
+    /** The FULL row (origin JSON + createdAt + windowToken + the answered marks) for a wakeId, or
+     *  null when unknown. Read by the answerable-reply fence, which needs the lifecycle columns
+     *  `getUnifiedWakeTarget` deliberately doesn't return. NOTE: like `getUnifiedWakeTarget` this
+     *  applies NO read-time TTL — the row's `createdAt` is returned and the CALLER enforces the
+     *  bound (rows die on disk only via the opportunistic prune-on-write, which on a quiet org may
+     *  not run for days). */
+    getUnifiedWakeRecord(org: string, wakeId: string): Promise<UnifiedWakeRecord | null>;
+    /** Mark a wake ANSWERED at `at` (ISO-8601) by `turnId`. Idempotent UPDATE — a missing row is a
+     *  no-op (never an insert: an answered mark without an origin is meaningless). No CAS is needed:
+     *  eve permits one active turn per continuation token and the fence confines writers to one
+     *  window. */
+    markUnifiedWakeAnswered(org: string, wakeId: string, at: string, turnId?: string): Promise<void>;
+    /** Stamps audited_at on every named wake that lacks one — the turn-end wake-accounting horizon, so a wake is reported unaccounted at most once. It is not markUnifiedWakeAnswered and must never be merged with it: no query filters on this column, so it changes no gate's behaviour. */
+    markUnifiedWakesAudited(org: string, wakeIds: readonly string[], at: string): Promise<void>;
+    /** The unanswered, inbound, not-yet-audited wakes on one window token, oldest first. It is a separate method so the freshness gate's query stays byte-identical, and filtering audited rows in SQL keeps limit bounding only the rows this audit still has to consider. */
+    listUnauditedUnifiedWakes(org: string, windowToken: string, limit: number): Promise<readonly PendingUnifiedWake[]>;
+    /** The unanswered, inbound wakes on one window token registered after afterIso, oldest first and capped at limit. Inbound-only is load-bearing: a delegating turn mints its own task and completion wakes on the same conversation, and counting them would report every delegating turn as stale. */
+    listPendingUnifiedWakes(org: string, windowToken: string, afterIso: string, limit: number): Promise<readonly PendingUnifiedWake[]>;
+    /** Upsert the owner of (org, channelKey, threadKey). Rows older than `ttlMs` are pruned
+     *  opportunistically on write, same posture as putUnifiedWakeTarget. */
+    putThreadOwner(org: string, channelKey: string, threadKey: string, taskToken: string, at: string, ttlMs: number): Promise<void>;
+    getThreadOwner(org: string, channelKey: string, threadKey: string): Promise<string | null>;
+    /** Clear the owner of (org, channelKey, threadKey). Returns true if a row was removed. */
+    clearThreadOwner(org: string, channelKey: string, threadKey: string): Promise<boolean>;
+    /** Upsert the thread-seat row. Same opportunistic org-scoped TTL prune as putThreadOwner. */
+    putThreadSeatState(org: string, row: ThreadSeatStateWrite, at: string, ttlMs: number): Promise<void>;
+    /** The thread-seat row for one thread, or null when unwritten/expired. */
+    getThreadSeatState(org: string, channelKey: string, threadKey: string): Promise<ThreadSeatStateRow | null>;
+    /** Upsert the anchor for one in-flight turn on `windowKey`. Rows older than `ttlMs` are pruned
+     *  opportunistically on write (org-scoped), same posture as putThreadOwner. */
+    putTurnAnchor(org: string, anchor: TurnAnchorWrite, at: string, ttlMs: number): Promise<void>;
+    getTurnAnchorByWindow(org: string, windowKey: string): Promise<TurnAnchorRow | null>;
+    getTurnAnchorByAnchor(org: string, anchorKey: string): Promise<TurnAnchorRow | null>;
+    /** The MOST RECENT anchor in a channel (`<platform>:<channelId>`), or null — the slash-command
+     *  resolution arm. Newest by `created_at`; ties are broken by `window_key` for determinism. */
+    getLatestTurnAnchorForChannel(org: string, channelKey: string): Promise<TurnAnchorRow | null>;
+    /** Clear the anchor on `windowKey`. Returns whether a row was removed. */
+    clearTurnAnchor(org: string, windowKey: string): Promise<boolean>;
+    /** Upsert a row. Rows older than `ttlMs` are pruned opportunistically on write, same posture as
+     *  putUnifiedWakeTarget/putThreadOwner. */
+    putTaskResult(org: string, taskId: string, resultJson: string, at: string, ttlMs: number): Promise<void>;
+    /** Put-if-absent variant: INSERT … ON CONFLICT DO NOTHING, reporting whether THIS call inserted the
+     *  row — so a best-effort writer can never overwrite an authoritative one it raced. Same
+     *  opportunistic TTL prune as put. */
+    putTaskResultIfAbsent(org: string, taskId: string, resultJson: string, at: string, ttlMs: number): Promise<boolean>;
+    /** The stored JSON for a key, or null when unwritten/expired. */
+    getTaskResult(org: string, taskId: string): Promise<string | null>;
+    /** Delete one row. Returns true if a row was removed. */
+    deleteTaskResult(org: string, taskId: string): Promise<boolean>;
+    /** Upsert one uploaded attachment under (org, fileId). Rows older than `ttlMs` are pruned
+     *  opportunistically on write, same posture as putUnifiedWakeTarget/putTaskResult. */
+    putSlackAttachment(org: string, fileId: string, rec: SlackAttachmentRow, at: string, ttlMs: number): Promise<void>;
+    /** The stored attachment record for (org, fileId), or null when unknown/expired — the resolver
+     *  FAILS CLOSED on null (never fetches an arbitrary URL for an unknown id). */
+    getSlackAttachment(org: string, fileId: string): Promise<SlackAttachmentRow | null>;
+    /** Insert one freshly-proposed pending action (status "pending" by construction). */
+    addPendingAction(row: PendingActionRow): Promise<void>;
+    /** Insert-if-absent twin of addPendingAction, reporting whether THIS call inserted the row. The auto-approved wedge needs it because its row id is derived from the decision and eve re-runs an uncommitted step body on crash-recovery redelivery; the card path keeps the plain insert, where a collision is a bug. */
+    addPendingActionIfAbsent(row: PendingActionRow): Promise<boolean>;
+    getPendingAction(org: string, id: string): Promise<PendingActionRow | null>;
+    /** Every still-"pending" action for an org, oldest first — the control-plane list
+     *  view's read model (decided/expired rows are excluded; they're terminal). */
+    listPendingActions(org: string): Promise<readonly PendingActionRow[]>;
+    /** Every still-"pending" action for an org whose TTL has passed (`expires_at <= nowIso`),
+     *  oldest first — the sweep's read model (schedules/tidy.ts → approvals/flow.ts
+     *  sweepExpiredPendings). An unclicked pending otherwise never gets a terminal row; the
+     *  sweep CAS-expires each, audits `approval.expired`, and (task #105) routes best-effort
+     *  expiry feedback via the row's mint-frozen `postedTo` (NULL ⇒ audit-only, no feedback). */
+    listExpiredPendingActions(org: string, nowIso: string): Promise<readonly PendingActionRow[]>;
+    /** Every "rejected" action for an org decided at or after `sinceIso`, newest decision first. The propose path reads it to REPORT a fresh reject of the same proposal to the next proposer (OPE-2071); it never blocks a card. */
+    listRejectedActionsSince(org: string, sinceIso: string): Promise<readonly PendingActionRow[]>;
+    /** Record the card's message ts after the initial post (fire-once, no CAS needed). */
+    setPendingActionMessage(org: string, id: string, messageTs: string): Promise<void>;
+    /**
+     * Compare-and-set the decision: a single `UPDATE ... WHERE org=? AND id=? AND
+     * status='pending'`, so of two racing calls (two clicks, or a click racing an
+     * expiry sweep) exactly one changes a row. Returns whether THIS call won.
+     */
+    decidePendingAction(org: string, id: string, status: "approved" | "rejected" | "expired", decidedBy: string, decidedAt: string): Promise<boolean>;
+    /** Upsert one session-approval memo (idempotent per (org, sessionId, kind)); prunes expired rows. */
+    setSessionApproval(row: SessionApprovalRow): Promise<void>;
+    /** The LIVE memo for (org, sessionId, kind) — null when absent OR expired (expires_at <= nowIso). */
+    getSessionApproval(org: string, sessionId: string, kind: string, nowIso: string): Promise<SessionApprovalRow | null>;
+    /**
+     * EVERY live memo under one key (OPE-152), kind-ascending. A session grant never needed this —
+     * nothing renders a session's grant set, and the session dies on its own — but a routine's declared
+     * permission is
+     * standing and unattended, so the set has to be readable or it is authority nobody can see
+     * (`list_routines`, via routines/declared-permissions.ts).
+     */
+    listSessionApprovals(org: string, sessionId: string, nowIso: string): Promise<SessionApprovalRow[]>;
+    /**
+     * REVOKE every memo under one key (OPE-152); returns how many rows went. The FIRST delete on this
+     * seam, and it is deliberate: a session grant's death mechanism is the session token's generation,
+     * so nothing ever had to remove one, but a routine's declared permission must be withdrawable from the
+     * channel WITHOUT cancelling the routine — an off switch that also stops the work is not an off
+     * switch for the authority. (`revoke_routine_permissions`, via routines/declared-permissions.ts.)
+     */
+    revokeSessionApprovals(org: string, sessionId: string): Promise<number>;
+    /** Deletes every inert legacy connector.op: memo this org holds under a routine permission key, whatever its expiry. Such a row lifts nothing on any code path, which is what makes an unattended sweep safe here; expiry is deliberately not in the predicate, because these rows carry the routine grain's far-future sentinel. */
+    sweepLegacyConnectorOpRows(org: string): Promise<number>;
+    /** Upsert one credential envelope under (org, rec.ref). `rec.ciphertext` is opaque to the store. */
+    putStoredCredential(org: string, rec: StoredCredentialRow): Promise<void>;
+    /** The row stored under (org, ref), or null when unknown — the broker FAILS CLOSED on null. */
+    getStoredCredential(org: string, ref: string): Promise<StoredCredentialRow | null>;
+    /** Destroys the envelope stored under (org, ref); idempotent, answering false when nothing was there. It is a real delete rather than a status flip because the row IS the secret: severing reachability alone leaves a live, decryptable token behind. What happened is recorded in the append-only audit log instead. */
+    deleteStoredCredential(org: string, ref: string): Promise<boolean>;
+    /** Stored-credential refs for an org, and deliberately refs only: a listing carrying envelopes would put every secret in the org through a path with no reason to hold one. refPrefix goes into the SQL predicate and is matched literally, so an in-product caller is never handed names outside the namespace it owns. */
+    listStoredCredentialRefs(org: string, refPrefix?: string): Promise<readonly string[]>;
+    /** Upsert one discovered installation under (org, rec.owner). Idempotent — a redelivered
+     *  `created` rewrites the same row. */
+    putGitHubInstallation(org: string, rec: GitHubInstallationRow): Promise<void>;
+    /** Forget one owner's discovered installation (an uninstall/suspend delivery). Returns true if
+     *  a row was removed. Never touches the env map — that composition happens above the store. */
+    deleteGitHubInstallation(org: string, owner: string): Promise<boolean>;
+    /** Every discovered installation for an org, owner-ascending — the hydration read. */
+    listGitHubInstallations(org: string): Promise<readonly GitHubInstallationRow[]>;
+    /**
+     * Atomically claim (org, ref) for single-flight refresh: set (claim_id, claimed_at) IFF the row is
+     * unclaimed (claim_id NULL) OR its existing claim's lease has expired (claimed_at ≤ `staleBeforeIso`
+     * — a crashed winner never wedges the row). Returns true IFF THIS call won the claim. A missing row
+     * returns false. `claimId` is a random, non-secret id; `claimedAtIso`/`staleBeforeIso` are ISO-8601.
+     */
+    claimStoredCredential(org: string, ref: string, claimId: string, claimedAtIso: string, staleBeforeIso: string): Promise<boolean>;
+    /**
+     * Release a claim on (org, ref) IFF `claimId` still holds it (a guarded clear — a caller whose lease
+     * was stolen never clears the new owner's claim). Returns true iff a claim was cleared; idempotent.
+     */
+    releaseStoredCredential(org: string, ref: string, claimId: string): Promise<boolean>;
+    /** Insert one freshly-minted intake (usedAt NULL by construction). */
+    addCredentialIntake(row: CredentialIntakeRow): Promise<void>;
+    getCredentialIntake(org: string, id: string): Promise<CredentialIntakeRow | null>;
+    /** Compare-and-set single-use: stamp usedAt only when it was NULL. Returns whether THIS call won. */
+    consumeCredentialIntake(org: string, id: string, usedAt: string): Promise<boolean>;
+    /**
+     * Arm (or re-arm) `hookId`'s window. UPSERT: re-arming overwrites, because a second window is
+     * never wanted alongside the first — the numbering the human reads is only meaningful over one.
+     * There is deliberately NO disarm verb: `capture_events` disarms by re-arming for the shortest
+     * window and clearing the rows, so "forget what you captured" is one act rather than two that can
+     * half-run.
+     */
+    armWebhookCaptureWindow(org: string, hookId: string, captureUntil: string, armedBy: string, at: string): Promise<void>;
+    /**
+     * The arm state for `hookId`, or null when it was never armed. Returns an EXPIRED row as-is rather
+     * than filtering it out: expiry is a comparison the caller makes against its own clock
+     * (`captureWindowOpen`), and a store that silently hid closed windows would make "when did this
+     * last get armed?" unanswerable from the operator plane.
+     */
+    getWebhookCaptureWindow(org: string, hookId: string): Promise<WebhookCaptureWindowRow | null>;
+    /** Upsert one link-set (create, or update handle/status/updatedAt for an existing id). */
+    putLinkSet(org: string, row: LinkSetRow): Promise<void>;
+    /** One link-set by its opaque id, or null. There is deliberately NO by-handle lookup. */
+    getLinkSet(org: string, id: string): Promise<LinkSetRow | null>;
+    /** Every link-set for an org, id-ascending — the admin list view. */
+    listLinkSets(org: string): Promise<readonly LinkSetRow[]>;
+    /**
+     * Compare-and-set a link-set's status: the UPDATE lands only when the row's CURRENT status is
+     * one of `from`, so `revoked` (never in any caller's `from`) is terminal at the query layer as
+     * well as in the write API. Returns whether THIS call changed a row.
+     */
+    updateLinkSetStatus(org: string, id: string, from: readonly LinkSetStatus[], to: LinkSetStatus, at: string): Promise<boolean>;
+    /**
+     * INSERT one linked id, or report that the account is already claimed. `INSERT … ON CONFLICT DO
+     * NOTHING` on the (org, platform, tenant, native_id) PK, returning TRUE only when THIS call
+     * inserted — so two racing joins resolve to exactly one, and "an account is exactly one person"
+     * is a property of the engine rather than of a check-then-write the caller could lose.
+     */
+    insertLinkedId(org: string, row: LinkedIdRow): Promise<boolean>;
+    /** The row claiming (org, platform, tenant, nativeId), whatever its status, or null when
+     *  unclaimed. */
+    getLinkedId(org: string, platform: string, tenant: string, nativeId: string): Promise<LinkedIdRow | null>;
+    /** Linked ids for an org, narrowed to one set with `linkSetId`; (platform, tenant, nativeId)-ascending. */
+    listLinkedIds(org: string, linkSetId?: string): Promise<readonly LinkedIdRow[]>;
+    /**
+     * Compare-and-set one linked id's status + its evidence stamp. Lands only when the row's CURRENT
+     * status is one of `from` — `revoked` is never a legal `from`, which is what makes revocation
+     * terminal at the query layer. Returns whether THIS call changed a row.
+     */
+    updateLinkedIdStatus(org: string, platform: string, tenant: string, nativeId: string, from: readonly LinkedIdStatus[], to: LinkedIdStatus, establishedBy: string, evidenceJson: string | undefined, at: string): Promise<boolean>;
+    /** Delete one linked id — the person's own SEVER (the account becomes joinable again). Returns
+     *  true if a row went. Admin revocation deliberately does NOT use this: it tombstones instead. */
+    deleteLinkedId(org: string, platform: string, tenant: string, nativeId: string): Promise<boolean>;
+    /** Tombstone every not-already-revoked id of one set (the offboarding cascade). Returns the count. */
+    revokeLinkedIdsForSet(org: string, linkSetId: string, at: string): Promise<number>;
+    /** The platforms still holding linked-id rows with an empty tenant — the backfill worklist. It is deployment-wide rather than org-scoped, because the tenant a row should carry comes from the deployment's own reach, and it makes no judgement about which platforms are tenant-scoped. */
+    unbackfilledLinkedIdPlatforms(): Promise<readonly string[]>;
+    /**
+     * Stamp `tenant` onto every linked-id row of `platform` that still carries `""`. Returns how many
+     * rows moved. Deployment-wide, for the reason above; idempotent, because a second run matches
+     * nothing. NEVER overwrites a row that already names a tenant — a stamped row is a delivery's own
+     * statement about itself and a backfill is only ever allowed to fill a blank.
+     */
+    backfillLinkedIdTenant(platform: string, tenant: string, at: string): Promise<number>;
+    /** Insert one freshly-minted challenge (status "pending" by construction). */
+    addLinkChallenge(org: string, row: LinkChallengeRow): Promise<void>;
+    getLinkChallenge(org: string, id: string): Promise<LinkChallengeRow | null>;
+    /** Challenges matching a filter, newest-first — the initiator's own pending-claim lookup and
+     *  the admin view. Never exposes the nonce in any queryable form beyond its hash. */
+    listLinkChallenges(org: string, filter?: LinkChallengeFilter): Promise<readonly LinkChallengeRow[]>;
+    /** Single-use compare-and-set claim: returns the row as claimed, or null when nothing was claimable — spent, expired, denied and unknown are indistinguishable on purpose, so a claim probe cannot become a nonce oracle. The self-claim exclusion is in the statement, because the initiator's own next message in the issuing DM can easily contain the code. */
+    claimLinkChallenge(org: string, nonceHash: string, platform: string, tenant: string, nativeId: string, at: string, backNonceHash?: string): Promise<LinkChallengeRow | null>;
+    /** Directory-transport consent: a compare-and-set that lands only while the row is pending, at is before expires_at, and the consenting account IS the one the challenge named. The target match is a conjunct rather than a caller-side check, because consent from any other account must satisfy nothing. */
+    consentLinkChallenge(org: string, id: string, consenter: {
+        readonly platform: string;
+        readonly tenant: string;
+        readonly nativeId: string;
+    }, at: string, backNonceHash?: string): Promise<LinkChallengeRow | null>;
+    /** CAS a claimed challenge to its terminal outcome (`ratified` | `denied`), or a pending/claimed
+     *  one to `expired`. Lands only from `from`; returns whether THIS call decided it. */
+    decideLinkChallenge(org: string, id: string, from: readonly LinkChallengeStatus[], to: LinkChallengeStatus, at: string): Promise<boolean>;
+    /** Sweep: mark every still-open (pending|claimed) challenge whose TTL has passed `expired`.
+     *  Called opportunistically on write (the prune-on-write posture every TTL'd table here uses —
+     *  a serverless deployment has no reliable cron to hang a sweep on). Returns the count. */
+    expireLinkChallenges(org: string, nowIso: string): Promise<number>;
+    addCredentialGrantAsk(org: string, row: CredentialGrantAskRow): Promise<void>;
+    getCredentialGrantAsk(org: string, id: string): Promise<CredentialGrantAskRow | null>;
+    /** The one pending, unexpired ask for (requester, owner, verb, resource) — the anti-nag control, so a second ask while one is pending answers "already asked" instead of DMing the owner again. Expiry is in the predicate, never a status read alone: a lapsed pending row must read as gone or it blocks every later ask forever. */
+    liveCredentialGrantAsk(org: string, requesterPrincipalId: string, ownerPrincipalId: string, verb: string, resource: string, nowIso: string): Promise<CredentialGrantAskRow | null>;
+    /**
+     * APPROVE: move `pending` → `approved` and stamp `grantId`, IFF the ask is still pending AND `at`
+     * is before its `expires_at`. Returns the row as approved, or null.
+     *
+     * 🔴 THE TTL IS A CONJUNCT. A late click on a stale card must LOSE THIS CAS, not be caught by a UI
+     * state — the card lives in a DM the owner can scroll back to at any time, so the row is the only
+     * thing that can refuse it.
+     */
+    approveCredentialGrantAsk(org: string, id: string, mode: CredentialGrantMode, grantId: string, at: string): Promise<CredentialGrantAskRow | null>;
+    /** CAS one ask to a terminal outcome (`declined` | `expired`). Lands only from `from`; returns
+     *  whether THIS call decided it, so two racing deciders resolve to exactly one true. */
+    decideCredentialGrantAsk(org: string, id: string, from: readonly CredentialGrantAskState[], to: CredentialGrantAskState, at: string): Promise<boolean>;
+    /**
+     * Stamp where the owner's DM card landed (OPE-1112). Called once, right after delivery.
+     *
+     * A separate statement rather than a column on the insert because the card is delivered AFTER the
+     * row exists — {@link OperationalStore.addCredentialGrantAsk} must land first so a delivery
+     * failure has a row to close.
+     */
+    setCredentialGrantAskCard(org: string, id: string, surfaceId: string, messageId: string): Promise<void>;
+    /** Every still-pending ask whose TTL has passed, as ROWS rather than a count: a lapsed ask owes a message to the requester and a rewrite of the owner's card, and neither address survives anywhere but the row. The caller CASes each with decideCredentialGrantAsk, so a click racing the sweep still resolves to one decider. */
+    listExpiredCredentialGrantAsks(org: string, nowIso: string): Promise<readonly CredentialGrantAskRow[]>;
+    /** Every pending, unexpired ask for one chat — the rows holding a mounted tool name no grant row carries yet. A name is claimed at ask time, not approve time, so reading only the grant rows reads the chat as holding fewer names than it does for the whole ask TTL. */
+    pendingCredentialGrantAsksForScope(org: string, scopeKey: string, nowIso: string): Promise<readonly CredentialGrantAskRow[]>;
+    addCredentialGrant(org: string, row: CredentialGrantRow): Promise<void>;
+    getCredentialGrant(org: string, id: string): Promise<CredentialGrantRow | null>;
+    /**
+     * EVERY grant ISSUED to one chat, whatever its current status, newest first.
+     *
+     * 🔴 STATUS IS NOT A FILTER HERE, and that is a correctness requirement rather than a convenience.
+     * The mount projects this list, and eve re-runs the `session.started` resolvers on the cold-heal
+     * path. A resolver that mounted on STATUS would silently drop a tool whose description is already
+     * in the persisted transcript. Mount on EXISTENCE; refuse on STATE (design §7).
+     */
+    credentialGrantsForScope(org: string, scopeKey: string): Promise<readonly CredentialGrantRow[]>;
+    /**
+     * EVERY LIVE `standing` grant bound to one CONVERSATION-STABLE scope key (OPE-1950) — domain-shaped
+     * or room-shaped (`access/credential-grant-scope.ts`), newest first, active, unexpired and
+     * unrevoked. The key is OPAQUE here: this reads exact equality and never its shape. The second half
+     * of every use-time lookup: a seat reads its own session-keyed rows through
+     * {@link credentialGrantsForScope} and the room's conversation-keyed standing rows through this, and
+     * the union is what it may reach.
+     *
+     * 🔴 STATUS AND EXPIRY DO FILTER HERE, where {@link credentialGrantsForScope} must not, and the
+     * difference is deliberate. That method's no-filter rule protects the COLD-HEAL path: a session
+     * whose transcript already describes a granted tool must keep meeting it, refusing on state. A
+     * conversation-keyed row is read by sessions that never saw it — the seat that asked has rotated away —
+     * so mounting a revoked or expired one there would offer a brand-new conversation a tool its owner
+     * has already ended. The narrower rule is the safe direction for a key that crosses sessions.
+     *
+     * 🔴 `mode = 'standing'` IS IN THE PREDICATE, not assumed from the key's shape. Only a standing
+     * grant ever binds to a domain, and stating it in SQL means no future writer can widen the
+     * exact-session rule that `once` and `session` keep by writing a differently-shaped key.
+     */
+    liveStandingCredentialGrantsForScope(org: string, scopeKey: string, nowIso: string): Promise<readonly CredentialGrantRow[]>;
+    /** Every grant one owner still has live at nowIso — active and unexpired — oldest first, for the owner's own revoke route. Status filters here, unlike credentialGrantsForScope, because this is the list a person can act on; expiry is in the predicate, never the status column alone. */
+    liveCredentialGrantsForOwner(org: string, ownerPrincipalId: string, nowIso: string): Promise<readonly CredentialGrantRow[]>;
+    /** The one live borrow grant for (owner, connector, mcpTool, frozen-args digest, scope). The frozen arguments are part of the key, so the same vendor tool frozen two ways is two decisions and two grants; a row whose frozenArgs column is absent never matches. */
+    liveBorrowCredentialGrant(org: string, ownerPrincipalId: string, connector: string, mcpTool: string, frozenArgsDigest: string, scopeKey: string, nowIso: string): Promise<CredentialGrantRow | null>;
+    /**
+     * BURN: move `active` → `used`, IFF still active AND `at` is before `expires_at`. Returns the row
+     * as burned, or null. This is the WHOLE of once-mode's single-use guarantee — a retried turn, a
+     * replayed step and two parallel calls in one step all race here, and exactly one wins.
+     */
+    burnCredentialGrant(org: string, id: string, at: string): Promise<CredentialGrantRow | null>;
+    /** Undoes one burn, and only the burn the caller owns: the used_at conjunct stops a caller that LOST the burn race from un-spending the winner's. It is not a general un-use — the broker calls it only for a refusal that provably never sent — and a revoked_at stamp poisons it, so an owner's revoke beats a refund racing it. */
+    refundCredentialGrant(org: string, id: string, burnedAt: string): Promise<boolean>;
+    /**
+     * CLAIM ONE REFUND for `id` on `turnKey`, and answer whether this turn still had one to give
+     * (OPE-1264). `cap` is the allowance per row per turn; the caller owns the number.
+     *
+     * 🔴 IT LIVES BESIDE THE BURN BECAUSE IT MUST BE AS DURABLE AS THE BURN. The count started life
+     * in eve durable context, which is serialized only when a step COMPLETES. A crash mid-step is
+     * redelivered against the last persisted context, so the refunds stood and the counts did not,
+     * and one turn could write an unbounded number of refunds by crashing. The count is a column on
+     * the grant row instead: the refund and its claim now land with one durability.
+     *
+     * 🔴 IT IS ONE STATEMENT, so two calls racing in one step cannot both read `cap - 1`. The row's
+     * stored turn decides the arithmetic: a `turnKey` that is STRICTLY LATER than the stored one
+     * rolls the count to 1 and adopts the new key, any other key increments, and a count already at
+     * `cap` claims nothing and leaves the row alone.
+     *
+     * 🔴 THE ROLL IS ONE-DIRECTIONAL, AND THAT IS THE WHOLE OF OPE-1281. "Later" is read from the
+     * turn's own ordinal — {@link import("./credential-grant-rows.js").grantRefundTurnOrdinal} over
+     * eve's `` `turn_${sequence}` `` — held beside the key in `refund_turn_seq`. Comparing the KEYS
+     * for inequality, which is what this statement did until OPE-1281, made the cap rollable in both
+     * directions: two turn ids alternating on one row each read the other as new and each got a fresh
+     * allowance, so one row yielded K refunds PER ALTERNATION rather than K per turn. One row is read
+     * by one eve session (`scopeKey` is the session id), so the only event that can deliver those
+     * turns out of order is a crashed turn's redelivery re-executing its body after a later turn has
+     * already counted on the row — the event OPE-1264 is about. An ordinal that only ever moves
+     * forward closes it without depending on whether eve can overlap the two, which is a property
+     * nothing in this repository can prove (OPE-1281, measured against eve 0.52.2 and NOT re-read at the 0.54.3 bump).
+     *
+     * 🔴 AN ABSENT OR UNREADABLE `turnKey` NEVER ROLLS. A caller that could not read a turn id — or
+     * one whose key carries no ordinal, which is where a change of eve's key shape lands — counts
+     * against whatever turn the row already holds and leaves it in place, so the allowance narrows to
+     * the row's lifetime instead of resetting. Rolling on absence would be the one way this statement
+     * could hand out a fresh allowance to a caller that proved nothing about the turn.
+     *
+     * 🔴 A ROW MIGRATED FROM BEFORE OPE-1281 HAS A TURN AND NO ORDINAL, AND IT NEVER ROLLS AGAIN.
+     * Only a row with BOTH columns empty has genuinely counted nothing, and only that row rolls
+     * without an ordinal to beat. Reading a missing ordinal as "never counted" instead would let any
+     * turn roll such a row — the turn already counted there included — which is exactly the hole this
+     * ticket closes, re-opened for the length of the upgrade. The cost of the safe reading is that a
+     * row which had already counted refunds keeps that one allowance for the rest of its life; a
+     * grant's TTL bounds how long any row stays in that state, and narrowing is the direction this
+     * statement takes everywhere else.
+     *
+     * A row that does not exist claims nothing and answers false — the fail-closed direction, and a
+     * refund of a row that is gone would fail anyway.
+     */
+    claimCredentialGrantRefund(org: string, id: string, turnKey: string | undefined, cap: number): Promise<boolean>;
+    /** Moves active to revoked and answers whether THIS call revoked a live grant. It also stamps revoked_at on an already-used row while returning false, so an owner's revoke beats a refund racing it; the status is left alone there because a spent grant is already terminal. */
+    revokeCredentialGrant(org: string, id: string, at: string): Promise<boolean>;
+    /** Sweep: mark every still-active grant whose TTL has passed `expired`. Returns the count. */
+    expireCredentialGrants(org: string, nowIso: string): Promise<number>;
+    /** Claim `key` for this org, once and forever. TRUE = the caller won the claim and must do the
+     *  thing; FALSE = it was already claimed and the caller must not. Atomic: two racing callers
+     *  resolve to exactly one TRUE. Never expires. */
+    claimNotice(org: string, key: string, at: string): Promise<boolean>;
+    /** READ-ONLY twin of {@link OperationalStore.claimNotice}: has `key` already been claimed? Never
+     *  writes — for a caller that must know before deciding whether claiming is even correct. */
+    noticeClaimed(org: string, key: string): Promise<boolean>;
+    /** Upsert one address. `updatedAt` is re-stamped on every call, so a repeated write from a live
+     *  ingest path keeps the row current rather than duplicating it. */
+    recordProactiveAddress(org: string, row: ProactiveAddress): Promise<void>;
+    proactiveAddress(org: string, platform: string, kind: string, refKey: string): Promise<ProactiveAddress | undefined>;
+    /** Every address of one (`platform`, `kind`), most recently seen first. `limit` bounds the read —
+     *  a caller that fans a live vendor call out per row must never inherit an unbounded list. */
+    proactiveAddresses(org: string, platform: string, kind: string, limit: number): Promise<readonly ProactiveAddress[]>;
+    getMeta(key: string): Promise<string | null>;
+    setMeta(key: string, value: string): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map