@origintrail-official/dkg-node-ui 10.0.6 → 10.0.8

package/dist/db.js

@@ -1,20 +1,24 @@
 import Database from 'better-sqlite3';
 import { join } from 'node:path';
-import { RESPONSE_CACHE_BYTES, } from '@origintrail-official/dkg-core';
+import { RESPONSE_CACHE_BYTES, parseContextGraphJoinPolicyRecord, } from '@origintrail-official/dkg-core';
 export { SqliteChainEventCursorStore, SqliteContextGraphRegistryScanCursorStore, } from './chain-cursor-stores.js';
-const SCHEMA_VERSION = 24;
+const SCHEMA_VERSION = 30;
 // Default operator retention. Lowered from 90 → 14 days on V15 (2026-05) after
 // a production incident in which the `logs` table + its FTS5 shadow tables
 // grew to ~9 GB on a 12-day-old node and corrupted the SQLite page (header
 // hash mismatch on boot). 90 days had been chosen for "metrics history",
 // but logs were the dominant grower (~1M rows/12d) and pruning was a no-op
-// on any DB younger than 90 days. 14 days is still long enough for any
-// realistic operator-driven post-mortem while bounding worst-case growth
-// of the (now FTS5-less) logs table to ~150 MB. Operators who want longer
+// on any DB younger than 90 days. 14 days is still long enough for a useful
+// operator-driven post-mortem, but the mainnet sync storm proved that time
+// retention alone cannot bound worst-case growth. Operators who want longer
 // retention can override via `setRetentionDays()`; the setting is persisted
-// in the `settings` table and re-read on next boot.
+// in the `settings` table and re-read on next boot. Time alone is not a hard
+// size bound during a log storm, so routine info/debug rows also have a count
+// ceiling. Warning/error rows keep the full operator-selected time window.
 const DEFAULT_RETENTION_DAYS = 14;
 const LEGACY_IMPLICIT_RETENTION_DAYS = 90;
+const DEFAULT_ROUTINE_LOG_ROW_CAP = 1_000_000;
+const DEFAULT_LOG_VOLUME_PRUNE_BATCH_ROWS = 25_000;
 const LOGS_VACUUM_DELETE_THRESHOLD = 10_000;
 // SQLite reports reusable-but-not-yet-reclaimed pages via freelist_count.
 // With the default 4 KiB page size this is roughly 4 MiB, large enough
@@ -100,10 +104,14 @@ export class DashboardDB {
     dataDir;
     retentionDays;
     explicitRetentionDays;
+    routineLogRowCap;
+    logVolumePruneBatchRows;
     constructor(opts) {
         this.dataDir = opts.dataDir;
         this.explicitRetentionDays = opts.retentionDays !== undefined;
         this.retentionDays = opts.retentionDays ?? DEFAULT_RETENTION_DAYS;
+        this.routineLogRowCap = Math.max(0, Math.floor(opts.routineLogRowCap ?? DEFAULT_ROUTINE_LOG_ROW_CAP));
+        this.logVolumePruneBatchRows = Math.max(1, Math.floor(opts.logVolumePruneBatchRows ?? DEFAULT_LOG_VOLUME_PRUNE_BATCH_ROWS));
         this._memoTtlMs = resolveCacheTtlMs(opts.cacheTtlMs);
         const dbPath = join(opts.dataDir, 'node-ui.db');
         this.db = new Database(dbPath);
@@ -130,120 +138,178 @@ export class DashboardDB {
     migrate() {
         const version = this.db.pragma('user_version', { simple: true });
         const upgradedExistingDb = version > 0 && version < SCHEMA_VERSION;
-        if (version >= SCHEMA_VERSION)
+        const ensureJoinPolicyAuditCapTrigger = () => this.db.exec(`
+      CREATE TRIGGER IF NOT EXISTS cap_cg_join_policy_audit_rows
+      AFTER INSERT ON context_graph_join_policy_audit
+      BEGIN
+        DELETE FROM context_graph_join_policy_audit
+        WHERE id <= NEW.id - 100000
+          AND event_type NOT IN (
+            'join_admission_committed',
+            'join_policy_changed'
+          );
+      END;
+    `);
+        const ensureJoinApprovalRepairMarker = () => {
+            const table = this.db.prepare(`
+        SELECT 1 AS found FROM sqlite_master
+        WHERE type = 'table' AND name = 'context_graph_join_approval_ledger'
+      `).get();
+            if (!table)
+                return;
+            const columns = this.db.pragma('table_info(context_graph_join_approval_ledger)');
+            if (!columns.some((column) => column.name === 'repair_pending')) {
+                this.db.exec(`
+          ALTER TABLE context_graph_join_approval_ledger
+          ADD COLUMN repair_pending INTEGER NOT NULL DEFAULT 0
+            CHECK (repair_pending IN (0, 1));
+        `);
+            }
+            this.db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_cg_join_approval_ledger_repair
+          ON context_graph_join_approval_ledger(
+            context_graph_id, request_digest, repair_pending, reserved_at DESC
+          );
+      `);
+        };
+        const ensureSyncCheckpointResponderSessionColumns = () => {
+            const table = this.db.prepare(`
+        SELECT 1 AS found FROM sqlite_master
+        WHERE type = 'table' AND name = 'sync_checkpoints'
+      `).get();
+            if (!table)
+                return;
+            const columns = new Set(this.db.prepare('PRAGMA table_info(sync_checkpoints)').all()
+                .map((column) => column.name));
+            if (!columns.has('responder_session_id')) {
+                this.db.exec(`ALTER TABLE sync_checkpoints ADD COLUMN responder_session_id TEXT;`);
+            }
+            if (!columns.has('responder_session_expires_at')) {
+                this.db.exec(`ALTER TABLE sync_checkpoints ADD COLUMN responder_session_expires_at INTEGER;`);
+            }
+        };
+        if (version > SCHEMA_VERSION)
+            return;
+        if (version === SCHEMA_VERSION) {
+            // Repair restored/development databases that carry the current version
+            // but lost an idempotent schema adjunct.
+            ensureJoinApprovalRepairMarker();
+            ensureSyncCheckpointResponderSessionColumns();
+            ensureJoinPolicyAuditCapTrigger();
             return;
+        }
         if (version < 1) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS metric_snapshots (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          cpu_percent REAL,
-          mem_used_bytes INTEGER,
-          mem_total_bytes INTEGER,
-          disk_used_bytes INTEGER,
-          disk_total_bytes INTEGER,
-          heap_used_bytes INTEGER,
-          uptime_seconds INTEGER,
-          peer_count INTEGER,
-          direct_peers INTEGER,
-          relayed_peers INTEGER,
-          mesh_peers INTEGER,
-          contextGraph_count INTEGER,
-          total_triples INTEGER,
-          total_kcs INTEGER,
-          total_kas INTEGER,
-          store_bytes INTEGER,
-          confirmed_kcs INTEGER,
-          tentative_kcs INTEGER,
-          rpc_latency_ms INTEGER,
-          rpc_healthy INTEGER,
-          relay_capacity INTEGER,
-          relay_reservation_count INTEGER,
-          relay_active_circuits INTEGER,
-          relay_bytes_in INTEGER,
-          relay_bytes_out INTEGER
-        );
-        CREATE INDEX IF NOT EXISTS idx_snapshots_ts ON metric_snapshots(ts);
-
-        CREATE TABLE IF NOT EXISTS operations (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          operation_id TEXT NOT NULL,
-          operation_name TEXT NOT NULL,
-          started_at INTEGER NOT NULL,
-          duration_ms INTEGER,
-          status TEXT DEFAULT 'in_progress',
-          peer_id TEXT,
-          contextGraph_id TEXT,
-          triple_count INTEGER,
-          error_message TEXT,
-          details TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_ops_operation_id ON operations(operation_id);
-        CREATE INDEX IF NOT EXISTS idx_ops_started_at ON operations(started_at);
-        CREATE INDEX IF NOT EXISTS idx_ops_name ON operations(operation_name);
-
-        CREATE TABLE IF NOT EXISTS logs (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          level TEXT NOT NULL,
-          operation_name TEXT,
-          operation_id TEXT,
-          module TEXT,
-          message TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_logs_ts ON logs(ts);
-        CREATE INDEX IF NOT EXISTS idx_logs_operation_id ON logs(operation_id);
-        CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
-
-        -- NOTE: Earlier schema versions (V1..V14) also created an FTS5
-        -- virtual table "logs_fts" plus AFTER INSERT/DELETE triggers to
-        -- keep it in sync with "logs". That fed a free-text search path
-        -- behind /api/logs?q=... The FTS5 index turned out to dominate
-        -- on-disk size (multi-GB shadow tables on long-lived nodes) and
-        -- the corresponding HTTP route had no production consumer
-        -- (the dashboard log viewer is file-backed via /api/node-log).
-        -- V15 drops it for fresh installs; the migration below cleans
-        -- it up for in-place upgrades.
-
-        CREATE TABLE IF NOT EXISTS query_history (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          sparql TEXT NOT NULL,
-          duration_ms INTEGER,
-          result_count INTEGER,
-          error TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_qhist_ts ON query_history(ts);
-
-        CREATE TABLE IF NOT EXISTS saved_queries (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          name TEXT NOT NULL,
-          description TEXT,
-          sparql TEXT NOT NULL,
-          created_at INTEGER NOT NULL,
-          updated_at INTEGER NOT NULL
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS metric_snapshots (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          cpu_percent REAL,
+          mem_used_bytes INTEGER,
+          mem_total_bytes INTEGER,
+          disk_used_bytes INTEGER,
+          disk_total_bytes INTEGER,
+          heap_used_bytes INTEGER,
+          uptime_seconds INTEGER,
+          peer_count INTEGER,
+          direct_peers INTEGER,
+          relayed_peers INTEGER,
+          mesh_peers INTEGER,
+          contextGraph_count INTEGER,
+          total_triples INTEGER,
+          total_kcs INTEGER,
+          total_kas INTEGER,
+          store_bytes INTEGER,
+          confirmed_kcs INTEGER,
+          tentative_kcs INTEGER,
+          rpc_latency_ms INTEGER,
+          rpc_healthy INTEGER,
+          relay_capacity INTEGER,
+          relay_reservation_count INTEGER,
+          relay_active_circuits INTEGER,
+          relay_bytes_in INTEGER,
+          relay_bytes_out INTEGER
+        );
+        CREATE INDEX IF NOT EXISTS idx_snapshots_ts ON metric_snapshots(ts);
+
+        CREATE TABLE IF NOT EXISTS operations (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          operation_id TEXT NOT NULL,
+          operation_name TEXT NOT NULL,
+          started_at INTEGER NOT NULL,
+          duration_ms INTEGER,
+          status TEXT DEFAULT 'in_progress',
+          peer_id TEXT,
+          contextGraph_id TEXT,
+          triple_count INTEGER,
+          error_message TEXT,
+          details TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_ops_operation_id ON operations(operation_id);
+        CREATE INDEX IF NOT EXISTS idx_ops_started_at ON operations(started_at);
+        CREATE INDEX IF NOT EXISTS idx_ops_name ON operations(operation_name);
+
+        CREATE TABLE IF NOT EXISTS logs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          level TEXT NOT NULL,
+          operation_name TEXT,
+          operation_id TEXT,
+          module TEXT,
+          message TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_logs_ts ON logs(ts);
+        CREATE INDEX IF NOT EXISTS idx_logs_operation_id ON logs(operation_id);
+        CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
+
+        -- NOTE: Earlier schema versions (V1..V14) also created an FTS5
+        -- virtual table "logs_fts" plus AFTER INSERT/DELETE triggers to
+        -- keep it in sync with "logs". That fed a free-text search path
+        -- behind /api/logs?q=... The FTS5 index turned out to dominate
+        -- on-disk size (multi-GB shadow tables on long-lived nodes) and
+        -- the corresponding HTTP route had no production consumer
+        -- (the dashboard log viewer is file-backed via /api/node-log).
+        -- V15 drops it for fresh installs; the migration below cleans
+        -- it up for in-place upgrades.
+
+        CREATE TABLE IF NOT EXISTS query_history (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          sparql TEXT NOT NULL,
+          duration_ms INTEGER,
+          result_count INTEGER,
+          error TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_qhist_ts ON query_history(ts);
+
+        CREATE TABLE IF NOT EXISTS saved_queries (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          name TEXT NOT NULL,
+          description TEXT,
+          sparql TEXT NOT NULL,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL
+        );
       `);
         }
         if (version < 2) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS operation_phases (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          operation_id TEXT NOT NULL,
-          phase TEXT NOT NULL,
-          started_at INTEGER NOT NULL,
-          duration_ms INTEGER,
-          status TEXT DEFAULT 'in_progress',
-          details TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_phases_op ON operation_phases(operation_id);
-
-        ALTER TABLE operations ADD COLUMN gas_used INTEGER;
-        ALTER TABLE operations ADD COLUMN gas_price_gwei REAL;
-        ALTER TABLE operations ADD COLUMN gas_cost_eth REAL;
-        ALTER TABLE operations ADD COLUMN trac_cost REAL;
-        ALTER TABLE operations ADD COLUMN tx_hash TEXT;
-        ALTER TABLE operations ADD COLUMN chain_id INTEGER;
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS operation_phases (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          operation_id TEXT NOT NULL,
+          phase TEXT NOT NULL,
+          started_at INTEGER NOT NULL,
+          duration_ms INTEGER,
+          status TEXT DEFAULT 'in_progress',
+          details TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_phases_op ON operation_phases(operation_id);
+
+        ALTER TABLE operations ADD COLUMN gas_used INTEGER;
+        ALTER TABLE operations ADD COLUMN gas_price_gwei REAL;
+        ALTER TABLE operations ADD COLUMN gas_cost_eth REAL;
+        ALTER TABLE operations ADD COLUMN trac_cost REAL;
+        ALTER TABLE operations ADD COLUMN tx_hash TEXT;
+        ALTER TABLE operations ADD COLUMN chain_id INTEGER;
       `);
         }
         if (version < 3) {
@@ -253,42 +319,42 @@ export class DashboardDB {
             // column + the partial unique index in one step; the V11 block
             // below idempotently adds the column to nodes that upgraded
             // through versions 3..10 first.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS chat_messages (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          direction TEXT NOT NULL,
-          peer TEXT NOT NULL,
-          peer_name TEXT,
-          text TEXT NOT NULL,
-          delivered INTEGER,
-          message_id TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_chat_ts ON chat_messages(ts);
-        CREATE INDEX IF NOT EXISTS idx_chat_peer ON chat_messages(peer);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS chat_messages (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          direction TEXT NOT NULL,
+          peer TEXT NOT NULL,
+          peer_name TEXT,
+          text TEXT NOT NULL,
+          delivered INTEGER,
+          message_id TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_chat_ts ON chat_messages(ts);
+        CREATE INDEX IF NOT EXISTS idx_chat_peer ON chat_messages(peer);
       `);
         }
         if (version < 4) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS chat_persistence_jobs (
-          turn_id TEXT PRIMARY KEY,
-          session_id TEXT NOT NULL,
-          user_message TEXT NOT NULL,
-          assistant_reply TEXT NOT NULL,
-          tool_calls_json TEXT,
-          status TEXT NOT NULL,
-          attempts INTEGER NOT NULL DEFAULT 0,
-          max_attempts INTEGER NOT NULL DEFAULT 3,
-          next_attempt_at INTEGER NOT NULL,
-          queued_at INTEGER NOT NULL,
-          updated_at INTEGER NOT NULL,
-          store_ms INTEGER,
-          error_message TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_chat_persist_status_next
-          ON chat_persistence_jobs(status, next_attempt_at);
-        CREATE INDEX IF NOT EXISTS idx_chat_persist_session
-          ON chat_persistence_jobs(session_id);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS chat_persistence_jobs (
+          turn_id TEXT PRIMARY KEY,
+          session_id TEXT NOT NULL,
+          user_message TEXT NOT NULL,
+          assistant_reply TEXT NOT NULL,
+          tool_calls_json TEXT,
+          status TEXT NOT NULL,
+          attempts INTEGER NOT NULL DEFAULT 0,
+          max_attempts INTEGER NOT NULL DEFAULT 3,
+          next_attempt_at INTEGER NOT NULL,
+          queued_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          store_ms INTEGER,
+          error_message TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_chat_persist_status_next
+          ON chat_persistence_jobs(status, next_attempt_at);
+        CREATE INDEX IF NOT EXISTS idx_chat_persist_session
+          ON chat_persistence_jobs(session_id);
       `);
         }
         if (version < 5) {
@@ -297,77 +363,77 @@ export class DashboardDB {
             // fresh-install CREATE so new nodes get the column + its index in one
             // step; the V16 block below idempotently adds it to nodes that upgraded
             // through versions 5..15 first (same pattern as `message_id` in V3/V11).
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS notifications (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          type TEXT NOT NULL,
-          title TEXT NOT NULL,
-          message TEXT NOT NULL,
-          source TEXT,
-          peer TEXT,
-          read INTEGER NOT NULL DEFAULT 0,
-          meta TEXT,
-          context_graph_id TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_notif_ts ON notifications(ts);
-        CREATE INDEX IF NOT EXISTS idx_notif_read ON notifications(read);
-        CREATE INDEX IF NOT EXISTS idx_notif_cg ON notifications(context_graph_id);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS notifications (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          type TEXT NOT NULL,
+          title TEXT NOT NULL,
+          message TEXT NOT NULL,
+          source TEXT,
+          peer TEXT,
+          read INTEGER NOT NULL DEFAULT 0,
+          meta TEXT,
+          context_graph_id TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_notif_ts ON notifications(ts);
+        CREATE INDEX IF NOT EXISTS idx_notif_read ON notifications(read);
+        CREATE INDEX IF NOT EXISTS idx_notif_cg ON notifications(context_graph_id);
       `);
         }
         if (version < 6) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS settings (
-          key TEXT PRIMARY KEY,
-          value TEXT NOT NULL
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS settings (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
       `);
         }
         if (version < 7) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS context_graph_subscriptions (
-          context_graph_id TEXT PRIMARY KEY,
-          name TEXT,
-          subscribed INTEGER NOT NULL,
-          synced INTEGER NOT NULL,
-          meta_synced INTEGER,
-          on_chain_id TEXT,
-          sync_scoped INTEGER NOT NULL DEFAULT 1,
-          updated_at INTEGER NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_cg_subs_sync_scoped
-          ON context_graph_subscriptions(sync_scoped);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS context_graph_subscriptions (
+          context_graph_id TEXT PRIMARY KEY,
+          name TEXT,
+          subscribed INTEGER NOT NULL,
+          synced INTEGER NOT NULL,
+          meta_synced INTEGER,
+          on_chain_id TEXT,
+          sync_scoped INTEGER NOT NULL DEFAULT 1,
+          updated_at INTEGER NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_cg_subs_sync_scoped
+          ON context_graph_subscriptions(sync_scoped);
       `);
         }
         if (version < 8) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS context_graph_memberships (
-          context_graph_id TEXT NOT NULL,
-          principal_type TEXT NOT NULL,
-          principal_id TEXT NOT NULL,
-          role TEXT,
-          status TEXT NOT NULL,
-          source TEXT,
-          display_name TEXT,
-          metadata TEXT,
-          first_seen_at INTEGER NOT NULL,
-          updated_at INTEGER NOT NULL,
-          PRIMARY KEY (context_graph_id, principal_type, principal_id)
-        );
-        CREATE INDEX IF NOT EXISTS idx_cg_members_context
-          ON context_graph_memberships(context_graph_id);
-        CREATE INDEX IF NOT EXISTS idx_cg_members_principal
-          ON context_graph_memberships(principal_type, principal_id);
-        CREATE INDEX IF NOT EXISTS idx_cg_members_status
-          ON context_graph_memberships(status);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS context_graph_memberships (
+          context_graph_id TEXT NOT NULL,
+          principal_type TEXT NOT NULL,
+          principal_id TEXT NOT NULL,
+          role TEXT,
+          status TEXT NOT NULL,
+          source TEXT,
+          display_name TEXT,
+          metadata TEXT,
+          first_seen_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (context_graph_id, principal_type, principal_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_cg_members_context
+          ON context_graph_memberships(context_graph_id);
+        CREATE INDEX IF NOT EXISTS idx_cg_members_principal
+          ON context_graph_memberships(principal_type, principal_id);
+        CREATE INDEX IF NOT EXISTS idx_cg_members_status
+          ON context_graph_memberships(status);
       `);
         }
         if (version < 9) {
             const columns = this.db.prepare('PRAGMA table_info(context_graph_subscriptions)').all();
             if (!columns.some((column) => column.name === 'shared_memory_synced')) {
-                this.db.exec(`
-          ALTER TABLE context_graph_subscriptions
-            ADD COLUMN shared_memory_synced INTEGER;
+                this.db.exec(`
+          ALTER TABLE context_graph_subscriptions
+            ADD COLUMN shared_memory_synced INTEGER;
         `);
             }
         }
@@ -436,10 +502,10 @@ export class DashboardDB {
             if (!chatCols.has('message_id')) {
                 this.db.exec(`ALTER TABLE chat_messages ADD COLUMN message_id TEXT;`);
             }
-            this.db.exec(`
-        CREATE UNIQUE INDEX IF NOT EXISTS idx_chat_msgid
-          ON chat_messages(peer, direction, message_id)
-          WHERE message_id IS NOT NULL;
+            this.db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_chat_msgid
+          ON chat_messages(peer, direction, message_id)
+          WHERE message_id IS NOT NULL;
       `);
         }
         if (version < 12) {
@@ -495,33 +561,33 @@ export class DashboardDB {
             // `message_id` is enforced via `message_idempotency` instead.
             // V13 will also preserve `chat_messages.message_id` as
             // nullable + unwritten for rollback safety.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS message_idempotency (
-          peer_id TEXT NOT NULL,
-          protocol TEXT NOT NULL,
-          message_id TEXT NOT NULL,
-          direction TEXT NOT NULL CHECK (direction IN ('in', 'out')),
-          response_blob BLOB,
-          response_size INTEGER NOT NULL DEFAULT 0,
-          ts INTEGER NOT NULL,
-          PRIMARY KEY (peer_id, protocol, message_id, direction)
-        );
-        CREATE INDEX IF NOT EXISTS idx_idem_ts ON message_idempotency(ts);
-
-        CREATE TABLE IF NOT EXISTS protocol_outbox (
-          peer_id TEXT NOT NULL,
-          protocol TEXT NOT NULL,
-          message_id TEXT NOT NULL,
-          payload BLOB NOT NULL,
-          attempts INTEGER NOT NULL DEFAULT 0,
-          first_failure_at INTEGER NOT NULL,
-          last_attempt_at INTEGER NOT NULL,
-          next_attempt_at INTEGER NOT NULL,
-          last_error TEXT,
-          PRIMARY KEY (peer_id, protocol, message_id)
-        );
-        CREATE INDEX IF NOT EXISTS idx_outbox_next_attempt
-          ON protocol_outbox(next_attempt_at);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS message_idempotency (
+          peer_id TEXT NOT NULL,
+          protocol TEXT NOT NULL,
+          message_id TEXT NOT NULL,
+          direction TEXT NOT NULL CHECK (direction IN ('in', 'out')),
+          response_blob BLOB,
+          response_size INTEGER NOT NULL DEFAULT 0,
+          ts INTEGER NOT NULL,
+          PRIMARY KEY (peer_id, protocol, message_id, direction)
+        );
+        CREATE INDEX IF NOT EXISTS idx_idem_ts ON message_idempotency(ts);
+
+        CREATE TABLE IF NOT EXISTS protocol_outbox (
+          peer_id TEXT NOT NULL,
+          protocol TEXT NOT NULL,
+          message_id TEXT NOT NULL,
+          payload BLOB NOT NULL,
+          attempts INTEGER NOT NULL DEFAULT 0,
+          first_failure_at INTEGER NOT NULL,
+          last_attempt_at INTEGER NOT NULL,
+          next_attempt_at INTEGER NOT NULL,
+          last_error TEXT,
+          PRIMARY KEY (peer_id, protocol, message_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_outbox_next_attempt
+          ON protocol_outbox(next_attempt_at);
       `);
         }
         if (version < 13) {
@@ -546,8 +612,8 @@ export class DashboardDB {
             // table rebuild on downgrade.
             //
             // No data migration. No new tables. Pure DROP INDEX.
-            this.db.exec(`
-        DROP INDEX IF EXISTS idx_chat_msgid;
+            this.db.exec(`
+        DROP INDEX IF EXISTS idx_chat_msgid;
       `);
         }
         if (version < 14) {
@@ -588,10 +654,10 @@ export class DashboardDB {
             // operation-correlated log views (`getOperation`,
             // `getFailedOperations`). Substring/text search moves to
             // /api/node-log, which already supports `?q=`.
-            this.db.exec(`
-        DROP TRIGGER IF EXISTS logs_ai;
-        DROP TRIGGER IF EXISTS logs_ad;
-        DROP TABLE   IF EXISTS logs_fts;
+            this.db.exec(`
+        DROP TRIGGER IF EXISTS logs_ai;
+        DROP TRIGGER IF EXISTS logs_ad;
+        DROP TABLE   IF EXISTS logs_fts;
       `);
             // VACUUM cannot run inside a transaction; better-sqlite3 wraps
             // multi-statement exec() in implicit BEGIN/COMMIT, so we issue
@@ -655,23 +721,23 @@ export class DashboardDB {
             // re-parsing the daemon log. One row per decision point (sweep / fetch /
             // promote / already / defer / cursor-advance / core-fill). Pruned by `ts`
             // like the other event tables.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS replication_events (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts INTEGER NOT NULL,
-          context_graph_id TEXT NOT NULL,
-          on_chain_cg_id TEXT,
-          action TEXT NOT NULL,
-          ual TEXT,
-          ordinal INTEGER,
-          ka_id TEXT,
-          from_watermark INTEGER,
-          to_watermark INTEGER,
-          head INTEGER,
-          reconciled INTEGER,
-          pending INTEGER,
-          detail TEXT
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS replication_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          context_graph_id TEXT NOT NULL,
+          on_chain_cg_id TEXT,
+          action TEXT NOT NULL,
+          ual TEXT,
+          ordinal INTEGER,
+          ka_id TEXT,
+          from_watermark INTEGER,
+          to_watermark INTEGER,
+          head INTEGER,
+          reconciled INTEGER,
+          pending INTEGER,
+          detail TEXT
+        );
       `);
             this.db.exec(`CREATE INDEX IF NOT EXISTS idx_repl_ts ON replication_events(ts);`);
             this.db.exec(`CREATE INDEX IF NOT EXISTS idx_repl_cg ON replication_events(context_graph_id, ts);`);
@@ -710,54 +776,54 @@ export class DashboardDB {
             // the 2^63 INTEGER max and under the uint96 on-chain field. Like
             // `protocol_outbox`, this state is durable and is NEVER pruned —
             // reclaiming a number could mint a duplicate kaId.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS ka_numbers (
-          author_address TEXT PRIMARY KEY,
-          next_number INTEGER NOT NULL
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS ka_numbers (
+          author_address TEXT PRIMARY KEY,
+          next_number INTEGER NOT NULL
+        );
       `);
         }
         if (version < 21) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS sync_checkpoints (
-          key TEXT PRIMARY KEY,
-          offset INTEGER NOT NULL CHECK (offset >= 0),
-          updated_at INTEGER NOT NULL,
-          expires_at INTEGER NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_sync_checkpoints_expires_at
-          ON sync_checkpoints(expires_at);
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS sync_checkpoints (
+          key TEXT PRIMARY KEY,
+          offset INTEGER NOT NULL CHECK (offset >= 0),
+          updated_at INTEGER NOT NULL,
+          expires_at INTEGER NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_sync_checkpoints_expires_at
+          ON sync_checkpoints(expires_at);
       `);
         }
         if (version < 22) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS runtime_cursors (
-          namespace TEXT NOT NULL,
-          scope TEXT NOT NULL,
-          key TEXT NOT NULL,
-          value INTEGER NOT NULL CHECK (value > 0),
-          updated_at INTEGER NOT NULL,
-          PRIMARY KEY (namespace, scope, key)
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS runtime_cursors (
+          namespace TEXT NOT NULL,
+          scope TEXT NOT NULL,
+          key TEXT NOT NULL,
+          value INTEGER NOT NULL CHECK (value > 0),
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (namespace, scope, key)
+        );
       `);
-            this.db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_runtime_cursors_namespace_scope
-          ON runtime_cursors(namespace, scope);
+            this.db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_runtime_cursors_namespace_scope
+          ON runtime_cursors(namespace, scope);
       `);
         }
         if (version < 23) {
             // OT-RFC-59 SC5: durable per-(peer, contextGraph) changelog cursor. NEVER
             // pruned (see SqliteChangelogCursorStore) — a TTL would defeat the O(delta)
             // cross-restart catch-up this table exists for.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS changelog_cursors (
-          peer_id TEXT NOT NULL,
-          context_graph_id TEXT NOT NULL,
-          era TEXT NOT NULL,
-          seq INTEGER NOT NULL CHECK (seq >= 0),
-          updated_at INTEGER NOT NULL,
-          PRIMARY KEY (peer_id, context_graph_id)
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS changelog_cursors (
+          peer_id TEXT NOT NULL,
+          context_graph_id TEXT NOT NULL,
+          era TEXT NOT NULL,
+          seq INTEGER NOT NULL CHECK (seq >= 0),
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (peer_id, context_graph_id)
+        );
       `);
         }
         if (version < 24) {
@@ -766,15 +832,199 @@ export class DashboardDB {
             // `store.nq` restore does NOT roll back with the RDF store. node-ui.db
             // survives such a restore, so a rollback under the same era rotates the era
             // (forcing peers to full-resync instead of silently skipping). Single row.
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS changelog_era (
-          id INTEGER PRIMARY KEY CHECK (id = 1),
-          era TEXT NOT NULL,
-          high_seq INTEGER NOT NULL CHECK (high_seq >= 0),
-          updated_at INTEGER NOT NULL
-        );
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS changelog_era (
+          id INTEGER PRIMARY KEY CHECK (id = 1),
+          era TEXT NOT NULL,
+          high_seq INTEGER NOT NULL CHECK (high_seq >= 0),
+          updated_at INTEGER NOT NULL
+        );
+      `);
+        }
+        if (version < 25) {
+            // Durable security audit for private-CG open enrollment. V25/V26 also
+            // used this table as admission state; V27 projects those legacy rows into
+            // the typed operational ledger below.
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS context_graph_join_policy_audit (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts INTEGER NOT NULL,
+          context_graph_id TEXT NOT NULL,
+          event_type TEXT NOT NULL,
+          actor TEXT,
+          agent_address TEXT,
+          outcome TEXT NOT NULL,
+          reason TEXT,
+          request_digest TEXT,
+          policy_version INTEGER,
+          details TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_cg_join_policy_audit_ts
+          ON context_graph_join_policy_audit(ts);
+        CREATE INDEX IF NOT EXISTS idx_cg_join_policy_audit_cg_ts
+          ON context_graph_join_policy_audit(context_graph_id, ts);
+        CREATE INDEX IF NOT EXISTS idx_cg_join_policy_audit_event_ts
+          ON context_graph_join_policy_audit(event_type, ts);
       `);
         }
+        if (version < 26) {
+            // Bound flood-generated decision noise without letting that same flood
+            // erase the two records needed to reconstruct a private-CG admission:
+            // who changed the policy, and who was automatically admitted under it.
+            // V26 additionally retained live reservations because they still enforced
+            // the rolling one-hour ceilings. V27 removes that dependency below.
+            //
+            // V25 already installed this trigger, so DROP before CREATE is required:
+            // CREATE TRIGGER IF NOT EXISTS would silently preserve the old predicate
+            // on an upgraded database.
+            this.db.exec('DROP TRIGGER IF EXISTS cap_cg_join_policy_audit_rows;');
+        }
+        if (version < 27) {
+            // Operational admission state is deliberately separate from the audit
+            // stream. Audit retention and event naming must never alter rate-limit,
+            // epoch, or commit-idempotency behaviour.
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS context_graph_join_approval_ledger (
+          context_graph_id TEXT NOT NULL,
+          request_digest TEXT NOT NULL,
+          policy_epoch INTEGER NOT NULL,
+          reserved_at INTEGER NOT NULL,
+          state TEXT NOT NULL CHECK (state IN ('reserved', 'committed')),
+          committed_at INTEGER,
+          actor TEXT NOT NULL,
+          agent_address TEXT NOT NULL,
+          policy_version INTEGER NOT NULL,
+          PRIMARY KEY (context_graph_id, request_digest, policy_epoch),
+          CHECK (length(context_graph_id) > 0),
+          CHECK (length(request_digest) > 0),
+          CHECK (typeof(policy_epoch) = 'integer'),
+          CHECK (typeof(reserved_at) = 'integer'),
+          CHECK (committed_at IS NULL OR typeof(committed_at) = 'integer'),
+          CHECK (typeof(policy_version) = 'integer'),
+          CHECK (
+            (state = 'reserved' AND committed_at IS NULL)
+            OR (state = 'committed' AND committed_at IS NOT NULL)
+          )
+        );
+        CREATE INDEX IF NOT EXISTS idx_cg_join_approval_ledger_reserved_at
+          ON context_graph_join_approval_ledger(reserved_at);
+        CREATE INDEX IF NOT EXISTS idx_cg_join_approval_ledger_cg_reserved_at
+          ON context_graph_join_approval_ledger(context_graph_id, reserved_at);
+        CREATE INDEX IF NOT EXISTS idx_cg_join_approval_ledger_digest_reserved_at
+          ON context_graph_join_approval_ledger(context_graph_id, request_digest, reserved_at DESC);
+        CREATE INDEX IF NOT EXISTS idx_cg_join_approval_ledger_committed_at
+          ON context_graph_join_approval_ledger(committed_at);
+      `);
+            // Best-effort one-time projection for V25/V26 databases. Invalid legacy
+            // JSON cannot abort startup; only rows with a typed numeric epoch can be
+            // authoritative operational state. For duplicate audit reservations,
+            // retain the newest row for each (CG, digest, epoch).
+            this.db.exec(`
+        WITH raw_reservations AS (
+          SELECT
+            id,
+            context_graph_id,
+            request_digest,
+            CASE
+              WHEN json_valid(details)
+                AND json_type(details, '$.policyEpoch') IN ('integer', 'real')
+                THEN CAST(json_extract(details, '$.policyEpoch') AS INTEGER)
+              ELSE NULL
+            END AS policy_epoch,
+            ts AS reserved_at,
+            COALESCE(actor, '') AS actor,
+            COALESCE(agent_address, '') AS agent_address,
+            COALESCE(policy_version, 1) AS policy_version
+          FROM context_graph_join_policy_audit
+          WHERE event_type = 'join_auto_reservation'
+            AND outcome = 'reserved'
+            AND request_digest IS NOT NULL
+        ),
+        ranked_reservations AS (
+          SELECT *, ROW_NUMBER() OVER (
+            PARTITION BY context_graph_id, request_digest, policy_epoch
+            ORDER BY reserved_at DESC, id DESC
+          ) AS rank
+          FROM raw_reservations
+          WHERE policy_epoch IS NOT NULL
+        ),
+        raw_commits AS (
+          SELECT
+            context_graph_id,
+            request_digest,
+            CASE
+              WHEN json_valid(details)
+                AND json_type(details, '$.policyEpoch') IN ('integer', 'real')
+                THEN CAST(json_extract(details, '$.policyEpoch') AS INTEGER)
+              ELSE NULL
+            END AS policy_epoch,
+            MIN(ts) AS committed_at
+          FROM context_graph_join_policy_audit
+          WHERE event_type = 'join_admission_committed'
+            AND outcome = 'approved'
+            AND request_digest IS NOT NULL
+          GROUP BY context_graph_id, request_digest, policy_epoch
+        )
+        INSERT OR IGNORE INTO context_graph_join_approval_ledger (
+          context_graph_id, request_digest, policy_epoch, reserved_at,
+          state, committed_at, actor, agent_address, policy_version
+        )
+        SELECT
+          reservation.context_graph_id,
+          reservation.request_digest,
+          reservation.policy_epoch,
+          reservation.reserved_at,
+          CASE WHEN commit_row.committed_at IS NULL THEN 'reserved' ELSE 'committed' END,
+          commit_row.committed_at,
+          reservation.actor,
+          reservation.agent_address,
+          reservation.policy_version
+        FROM ranked_reservations AS reservation
+        LEFT JOIN raw_commits AS commit_row
+          ON commit_row.context_graph_id = reservation.context_graph_id
+         AND commit_row.request_digest = reservation.request_digest
+         AND commit_row.policy_epoch = reservation.policy_epoch
+        WHERE reservation.rank = 1;
+      `);
+            // V26's trigger protected live reservation audit rows because they were
+            // operational state. The ledger makes that coupling obsolete, so replace
+            // the trigger while preserving the flood-resistant proof exemptions.
+            this.db.exec('DROP TRIGGER IF EXISTS cap_cg_join_policy_audit_rows;');
+        }
+        if (version < 28) {
+            // A reservation alone does not prove that admission crossed its
+            // membership boundary. Persist that distinction so an exact retry can
+            // finish moderation/audit after delegation expiry or daemon restart.
+            ensureJoinApprovalRepairMarker();
+        }
+        // Keep this repair outside the version gate. Restored/development DBs can
+        // carry the current user_version while missing a trigger; recreating it is
+        // idempotent and keeps the audit bound fail-closed on every open.
+        ensureJoinPolicyAuditCapTrigger();
+        if (version < 29) {
+            this.db.exec(`
+        CREATE TABLE IF NOT EXISTS vm_reconcile_negative_cache (
+          cache_key TEXT PRIMARY KEY,
+          context_graph_id TEXT NOT NULL,
+          failures INTEGER NOT NULL,
+          next_retry_at INTEGER NOT NULL,
+          swm_gen TEXT NOT NULL,
+          candidate_namespaces TEXT NOT NULL,
+          peer_topology_key TEXT NOT NULL,
+          updated_at INTEGER NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_vm_reconcile_negative_cg
+          ON vm_reconcile_negative_cache(context_graph_id);
+        CREATE INDEX IF NOT EXISTS idx_vm_reconcile_negative_retry
+          ON vm_reconcile_negative_cache(next_retry_at);
+      `);
+        }
+        if (version < 30) {
+            // OFFSET pagination is scoped to an immutable responder row list. Keep
+            // the opaque responder token beside the verified offset so a requester
+            // restart can resume that same list instead of discarding durable work.
+            ensureSyncCheckpointResponderSessionColumns();
+        }
         this.db.pragma(`user_version = ${SCHEMA_VERSION}`);
         if (upgradedExistingDb && !this.explicitRetentionDays) {
             this.retentionDays = LEGACY_IMPLICIT_RETENTION_DAYS;
@@ -807,7 +1057,21 @@ export class DashboardDB {
         this.db.exec(`DELETE FROM chat_persistence_jobs WHERE updated_at < ${cutoff} AND status IN ('stored', 'failed')`);
         this.db.exec(`DELETE FROM notifications WHERE ts < ${cutoff}`);
         this.db.exec(`DELETE FROM replication_events WHERE ts < ${cutoff}`);
+        this.db.exec(`DELETE FROM context_graph_join_policy_audit WHERE ts < ${cutoff}`);
+        // The admission ledger has its own typed lifetime. It intentionally does
+        // not depend on whether the corresponding audit rows still exist. Preserve
+        // the historical retention envelope for durable commit idempotency while
+        // allowing fully expired reservation/commit state to age out.
+        this.db.prepare(`
+      DELETE FROM context_graph_join_approval_ledger
+      WHERE reserved_at < ?
+        AND (committed_at IS NULL OR committed_at < ?)
+    `).run(cutoff, cutoff);
         this.db.prepare(`DELETE FROM sync_checkpoints WHERE expires_at < ?`).run(Date.now());
+        // Reconcile negatives are accelerators, never historical records. Once the
+        // retry window elapses they must not survive indefinitely or accumulate one
+        // row per previously-seen KA across restarts.
+        this.db.prepare(`DELETE FROM vm_reconcile_negative_cache WHERE next_retry_at < ?`).run(Date.now());
         // Universal Messenger idempotency table. Shorter TTL than the
         // operator retention: no realistic dedup window extends beyond
         // a day. The protocol_outbox table is intentionally not pruned
@@ -815,20 +1079,12 @@ export class DashboardDB {
         // SqliteProtocolOutboxStore.dropExpired().
         const messengerCutoff = Date.now() - 24 * 60 * 60 * 1000;
         this.db.exec(`DELETE FROM message_idempotency WHERE ts < ${messengerCutoff}`);
-        // Reclaim free pages from the file. Without this, the SQLite file
-        // size only ever grows — DELETE / DROP just marks pages reusable,
-        // it does not return them to the OS. Vacuum when prune removed a
-        // meaningful number of log rows, or when a previous migration/drop
-        // left a large freelist behind without deleting any retained logs.
-        const freePages = Number(this.db.pragma('freelist_count', { simple: true }) ?? 0);
-        if (logsDeleted > LOGS_VACUUM_DELETE_THRESHOLD || freePages > VACUUM_FREE_PAGE_THRESHOLD) {
-            try {
-                this.db.exec(`VACUUM`);
-            }
-            catch {
-                // VACUUM requires an exclusive lock. If another connection is
-                // holding the DB open we skip and retry on the next prune.
-            }
+        // Avoid rebuilding an oversized DB at startup while millions of routine
+        // rows are still live. The daemon trims that backlog in bounded batches;
+        // the final batch performs one compacting VACUUM. Databases already under
+        // the cap retain the established time-prune reclamation behaviour.
+        if (!this.hasRoutineLogOverflow()) {
+            this.reclaimFreePagesIfNeeded(logsDeleted > LOGS_VACUUM_DELETE_THRESHOLD);
         }
         // Return the WAL file itself to the OS. journal_size_limit bounds it
         // in steady state, but a TRUNCATE checkpoint here shrinks it promptly
@@ -836,6 +1092,96 @@ export class DashboardDB {
         // which rewrites the whole DB through the WAL and momentarily grows
         // it. Runs unconditionally — independent of the VACUUM gate — because
         // an idle node still wants its -wal reclaimed.
+        this.truncateWal('prune');
+    }
+    /**
+     * Remove one bounded batch of the oldest routine (non-warning/error) logs.
+     * A count cap complements time retention: a high-rate sync storm can create
+     * millions of rows inside a single day, long before a 14-day cutoff applies.
+     *
+     * Deletion is deliberately incremental so an upgrade does not block node
+     * startup on a multi-GB transaction. Once the backlog reaches the cap, one
+     * VACUUM returns the accumulated free pages to the OS and the file shrinks.
+     */
+    pruneLogVolumeBatch() {
+        const overflowCutoff = this.routineLogOverflowCutoff();
+        if (overflowCutoff === null) {
+            const reclaim = this.reclaimFreePagesIfNeeded(false);
+            if (!reclaim.reclaimPending)
+                this.truncateWal('log-volume prune');
+            return {
+                deleted: 0,
+                status: reclaim.reclaimPending
+                    ? 'reclaim-pending'
+                    : reclaim.compacted
+                        ? 'done-compacted'
+                        : 'done',
+            };
+        }
+        const deleted = this.db.prepare(`
+      DELETE FROM logs
+      WHERE id IN (
+        SELECT id
+        FROM logs
+        WHERE id <= @cutoff
+          AND level NOT IN ('warn', 'error')
+        ORDER BY id ASC
+        LIMIT @batchRows
+      )
+    `).run({
+            cutoff: overflowCutoff,
+            batchRows: this.logVolumePruneBatchRows,
+        }).changes;
+        // If the batch filled, conservatively schedule another tick. An exact-size
+        // final batch costs one extra cheap probe before compaction, which is safer
+        // than running a second million-row count after every deletion.
+        const hasMore = deleted === this.logVolumePruneBatchRows;
+        const reclaim = hasMore
+            ? { compacted: false, reclaimPending: false }
+            : this.reclaimFreePagesIfNeeded(deleted > LOGS_VACUUM_DELETE_THRESHOLD);
+        if (!hasMore && !reclaim.reclaimPending)
+            this.truncateWal('log-volume prune');
+        return {
+            deleted,
+            status: hasMore
+                ? 'more'
+                : reclaim.reclaimPending
+                    ? 'reclaim-pending'
+                    : reclaim.compacted
+                        ? 'done-compacted'
+                        : 'done',
+        };
+    }
+    routineLogOverflowCutoff() {
+        const row = this.db.prepare(`
+      SELECT id
+      FROM logs
+      WHERE level NOT IN ('warn', 'error')
+      ORDER BY id DESC
+      LIMIT 1 OFFSET ?
+    `).get(this.routineLogRowCap);
+        return row?.id ?? null;
+    }
+    hasRoutineLogOverflow() {
+        return this.routineLogOverflowCutoff() !== null;
+    }
+    reclaimFreePagesIfNeeded(force) {
+        // DELETE / DROP only marks pages reusable; VACUUM is what returns them to
+        // the OS. A failed exclusive-lock/disk attempt remains pending for a later
+        // background retry and never prevents the node from running.
+        const freePages = Number(this.db.pragma('freelist_count', { simple: true }) ?? 0);
+        if (!force && freePages <= VACUUM_FREE_PAGE_THRESHOLD) {
+            return { compacted: false, reclaimPending: false };
+        }
+        try {
+            this.db.exec(`VACUUM`);
+            return { compacted: true, reclaimPending: false };
+        }
+        catch {
+            return { compacted: false, reclaimPending: true };
+        }
+    }
+    truncateWal(reason) {
         try {
             // wal_checkpoint signals reader contention through its result row
             // (`busy = 1`), NOT by throwing — so a busy checkpoint leaves the
@@ -845,7 +1191,7 @@ export class DashboardDB {
             // rather than indistinguishable from a real one.
             const [checkpoint] = this.db.pragma('wal_checkpoint(TRUNCATE)');
             if (checkpoint?.busy) {
-                console.warn(`[DashboardDB] wal_checkpoint(TRUNCATE) busy — WAL not reclaimed this prune ` +
+                console.warn(`[DashboardDB] wal_checkpoint(TRUNCATE) busy — WAL not reclaimed during ${reason} ` +
                     `(log=${checkpoint.log}, checkpointed=${checkpoint.checkpointed}); retried next prune`);
             }
         }
@@ -856,7 +1202,7 @@ export class DashboardDB {
             // better-sqlite3 change turns lock or I/O errors into throws, the
             // stalled WAL reclaim is visible in the daemon log instead of only
             // showing up later as unexplained disk growth. Never block prune.
-            console.warn(`[DashboardDB] wal_checkpoint(TRUNCATE) failed — WAL not reclaimed this prune: ` +
+            console.warn(`[DashboardDB] wal_checkpoint(TRUNCATE) failed — WAL not reclaimed during ${reason}: ` +
                 `${err instanceof Error ? err.message : String(err)}`);
         }
     }
@@ -913,50 +1259,50 @@ export class DashboardDB {
     }
     // --- Metric snapshots ---
     insertSnapshot(snap) {
-        this.stmt('insertSnapshot', `
-      INSERT INTO metric_snapshots (
-        ts, cpu_percent, mem_used_bytes, mem_total_bytes,
-        disk_used_bytes, disk_total_bytes, heap_used_bytes, uptime_seconds,
-        peer_count, direct_peers, relayed_peers, mesh_peers, contextGraph_count,
-        total_triples, total_kcs, total_kas, store_bytes,
-        confirmed_kcs, tentative_kcs, rpc_latency_ms, rpc_healthy,
-        relay_capacity, relay_reservation_count, relay_active_circuits,
-        relay_bytes_in, relay_bytes_out
-      ) VALUES (
-        @ts, @cpu_percent, @mem_used_bytes, @mem_total_bytes,
-        @disk_used_bytes, @disk_total_bytes, @heap_used_bytes, @uptime_seconds,
-        @peer_count, @direct_peers, @relayed_peers, @mesh_peers, @contextGraph_count,
-        @total_triples, @total_kcs, @total_kas, @store_bytes,
-        @confirmed_kcs, @tentative_kcs, @rpc_latency_ms, @rpc_healthy,
-        @relay_capacity, @relay_reservation_count, @relay_active_circuits,
-        @relay_bytes_in, @relay_bytes_out
-      )
+        this.stmt('insertSnapshot', `
+      INSERT INTO metric_snapshots (
+        ts, cpu_percent, mem_used_bytes, mem_total_bytes,
+        disk_used_bytes, disk_total_bytes, heap_used_bytes, uptime_seconds,
+        peer_count, direct_peers, relayed_peers, mesh_peers, contextGraph_count,
+        total_triples, total_kcs, total_kas, store_bytes,
+        confirmed_kcs, tentative_kcs, rpc_latency_ms, rpc_healthy,
+        relay_capacity, relay_reservation_count, relay_active_circuits,
+        relay_bytes_in, relay_bytes_out
+      ) VALUES (
+        @ts, @cpu_percent, @mem_used_bytes, @mem_total_bytes,
+        @disk_used_bytes, @disk_total_bytes, @heap_used_bytes, @uptime_seconds,
+        @peer_count, @direct_peers, @relayed_peers, @mesh_peers, @contextGraph_count,
+        @total_triples, @total_kcs, @total_kas, @store_bytes,
+        @confirmed_kcs, @tentative_kcs, @rpc_latency_ms, @rpc_healthy,
+        @relay_capacity, @relay_reservation_count, @relay_active_circuits,
+        @relay_bytes_in, @relay_bytes_out
+      )
     `).run(snap);
     }
     getLatestSnapshot() {
         return this.db.prepare('SELECT * FROM metric_snapshots ORDER BY ts DESC LIMIT 1').get();
     }
     upsertContextGraphSubscription(record) {
-        this.stmt('upsertContextGraphSubscription', `
-      INSERT INTO context_graph_subscriptions (
-        context_graph_id, name, subscribed, synced, shared_memory_synced, meta_synced,
-        on_chain_id, on_chain_hash, last_reconciled_ordinal, core_hosted, sync_scoped, updated_at
-      ) VALUES (
-        @context_graph_id, @name, @subscribed, @synced, @shared_memory_synced, @meta_synced,
-        @on_chain_id, @on_chain_hash, @last_reconciled_ordinal, @core_hosted, @sync_scoped, @updated_at
-      )
-      ON CONFLICT(context_graph_id) DO UPDATE SET
-        name = excluded.name,
-        subscribed = excluded.subscribed,
-        synced = excluded.synced,
-        shared_memory_synced = excluded.shared_memory_synced,
-        meta_synced = excluded.meta_synced,
-        on_chain_id = excluded.on_chain_id,
-        on_chain_hash = excluded.on_chain_hash,
-        last_reconciled_ordinal = excluded.last_reconciled_ordinal,
-        core_hosted = excluded.core_hosted,
-        sync_scoped = excluded.sync_scoped,
-        updated_at = excluded.updated_at
+        this.stmt('upsertContextGraphSubscription', `
+      INSERT INTO context_graph_subscriptions (
+        context_graph_id, name, subscribed, synced, shared_memory_synced, meta_synced,
+        on_chain_id, on_chain_hash, last_reconciled_ordinal, core_hosted, sync_scoped, updated_at
+      ) VALUES (
+        @context_graph_id, @name, @subscribed, @synced, @shared_memory_synced, @meta_synced,
+        @on_chain_id, @on_chain_hash, @last_reconciled_ordinal, @core_hosted, @sync_scoped, @updated_at
+      )
+      ON CONFLICT(context_graph_id) DO UPDATE SET
+        name = excluded.name,
+        subscribed = excluded.subscribed,
+        synced = excluded.synced,
+        shared_memory_synced = excluded.shared_memory_synced,
+        meta_synced = excluded.meta_synced,
+        on_chain_id = excluded.on_chain_id,
+        on_chain_hash = excluded.on_chain_hash,
+        last_reconciled_ordinal = excluded.last_reconciled_ordinal,
+        core_hosted = excluded.core_hosted,
+        sync_scoped = excluded.sync_scoped,
+        updated_at = excluded.updated_at
     `).run({
             context_graph_id: record.context_graph_id,
             name: record.name ?? null,
@@ -979,7 +1325,302 @@ export class DashboardDB {
         return this.stmt('getContextGraphSubscription', 'SELECT * FROM context_graph_subscriptions WHERE context_graph_id = ?').get(contextGraphId);
     }
     deleteContextGraphSubscription(contextGraphId) {
-        this.stmt('deleteContextGraphSubscription', 'DELETE FROM context_graph_subscriptions WHERE context_graph_id = ?').run(contextGraphId);
+        const remove = this.db.transaction(() => {
+            this.stmt('deleteContextGraphSubscription', 'DELETE FROM context_graph_subscriptions WHERE context_graph_id = ?').run(contextGraphId);
+            this.stmt('deleteContextGraphReadinessProvenance', 'DELETE FROM settings WHERE key = ?')
+                .run(this.contextGraphReadinessProvenanceKey(contextGraphId));
+        });
+        remove();
+    }
+    /**
+     * CLI-owned, durable provenance for context-graph readiness flags.
+     *
+     * Subscription rows predate per-plane proof and can therefore contain the
+     * v10.0.6 false-ready shape (`synced=1`, `shared_memory_synced=1`) after an
+     * unrelated peer returned an empty response.  Keep the proof out of the
+     * agent-owned subscription upsert so older/custom agent stores remain
+     * source-compatible and routine subscription persistence cannot overwrite a
+     * proof established by the daemon's catch-up classifier.
+     */
+    getContextGraphReadinessProvenance(contextGraphId) {
+        const row = this.stmt('getContextGraphReadinessProvenance', 'SELECT value FROM settings WHERE key = ?').get(this.contextGraphReadinessProvenanceKey(contextGraphId));
+        if (!row)
+            return null;
+        try {
+            const parsed = JSON.parse(row.value);
+            if (!Number.isInteger(parsed.version) || (parsed.version ?? 0) < 1)
+                return null;
+            return {
+                version: parsed.version,
+                durableVerified: parsed.durableVerified === true,
+                sharedMemoryVerified: parsed.sharedMemoryVerified === true,
+                updatedAt: typeof parsed.updatedAt === 'number' && Number.isFinite(parsed.updatedAt)
+                    ? parsed.updatedAt
+                    : 0,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    setContextGraphReadinessProvenance(contextGraphId, provenance) {
+        const record = {
+            version: provenance.version,
+            durableVerified: provenance.durableVerified,
+            sharedMemoryVerified: provenance.sharedMemoryVerified,
+            updatedAt: provenance.updatedAt ?? Date.now(),
+        };
+        this.stmt('setContextGraphReadinessProvenance', 'INSERT OR REPLACE INTO settings (key, value) VALUES (?, ?)').run(this.contextGraphReadinessProvenanceKey(contextGraphId), JSON.stringify(record));
+    }
+    contextGraphReadinessProvenanceKey(contextGraphId) {
+        return `contextGraphReadiness:${contextGraphId}`;
+    }
+    // --- Private context-graph join policy + audit ---
+    getContextGraphJoinPolicy(contextGraphId) {
+        const row = this.stmt('getContextGraphJoinPolicy', 'SELECT value FROM settings WHERE key = ?').get(this.contextGraphJoinPolicyKey(contextGraphId));
+        if (!row)
+            return null;
+        try {
+            return parseContextGraphJoinPolicyRecord(JSON.parse(row.value), contextGraphId);
+        }
+        catch {
+            // Corrupt policy state is indistinguishable from no policy. The agent's
+            // default is manual, so this is intentionally fail-closed.
+            return null;
+        }
+    }
+    setContextGraphJoinPolicy(record) {
+        this.stmt('setContextGraphJoinPolicy', 'INSERT OR REPLACE INTO settings (key, value) VALUES (?, ?)').run(this.contextGraphJoinPolicyKey(record.contextGraphId), JSON.stringify(record));
+    }
+    setContextGraphJoinPolicyWithAudit(record, event) {
+        const transition = this.db.transaction(() => {
+            this.setContextGraphJoinPolicy(record);
+            this.appendContextGraphJoinPolicyAudit(event);
+        });
+        transition();
+    }
+    appendContextGraphJoinPolicyAudit(event) {
+        this.stmt('appendContextGraphJoinPolicyAudit', `
+      INSERT INTO context_graph_join_policy_audit (
+        ts, context_graph_id, event_type, actor, agent_address, outcome,
+        reason, request_digest, policy_version, details
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(event.timestamp, event.contextGraphId, event.eventType, event.actor ?? null, event.agentAddress ?? null, event.outcome, event.reason ?? null, event.requestDigest ?? null, event.policyVersion ?? null, event.details ? JSON.stringify(event.details) : null);
+    }
+    reserveContextGraphAutomaticApproval(input) {
+        const reserve = this.db.transaction(() => {
+            const since = input.timestamp - 60 * 60 * 1000;
+            const cgRow = this.stmt('countContextGraphAutomaticApprovalReservations', `
+        SELECT COUNT(*) AS count
+        FROM context_graph_join_approval_ledger
+        WHERE context_graph_id = ?
+          AND reserved_at >= ?
+      `).get(input.contextGraphId, since);
+            const nodeRow = this.stmt('countNodeAutomaticApprovalReservations', `
+        SELECT COUNT(*) AS count
+        FROM context_graph_join_approval_ledger
+        WHERE reserved_at >= ?
+      `).get(since);
+            const contextGraphCount = Number(cgRow?.count ?? 0);
+            const nodeCount = Number(nodeRow?.count ?? 0);
+            const existing = this.stmt('findContextGraphAutomaticApprovalReservation', `
+        SELECT 1 AS found
+        FROM context_graph_join_approval_ledger
+        WHERE context_graph_id = ?
+          AND request_digest = ?
+          AND policy_epoch = ?
+          AND reserved_at >= ?
+        LIMIT 1
+      `).get(input.contextGraphId, input.requestDigest, input.policyEpoch, since);
+            if (existing) {
+                return {
+                    allowed: true,
+                    contextGraphApprovalsLastHour: contextGraphCount,
+                    nodeApprovalsLastHour: nodeCount,
+                };
+            }
+            if (contextGraphCount >= input.contextGraphLimit) {
+                return {
+                    allowed: false,
+                    contextGraphApprovalsLastHour: contextGraphCount,
+                    nodeApprovalsLastHour: nodeCount,
+                    reason: 'context-graph-rate-limit',
+                };
+            }
+            if (nodeCount >= input.nodeLimit) {
+                return {
+                    allowed: false,
+                    contextGraphApprovalsLastHour: contextGraphCount,
+                    nodeApprovalsLastHour: nodeCount,
+                    reason: 'node-rate-limit',
+                };
+            }
+            // The typed ledger row and its audit projection share one transaction:
+            // failures cannot consume quota without an audit event or emit an audit
+            // reservation without durable operational state. An expired replay of
+            // the same digest+epoch refreshes its reservation timestamp and consumes
+            // the rolling-window quota again, matching the former append-only model.
+            this.stmt('upsertContextGraphAutomaticApprovalReservation', `
+        INSERT INTO context_graph_join_approval_ledger (
+          context_graph_id, request_digest, policy_epoch, reserved_at,
+          state, committed_at, actor, agent_address, policy_version
+        ) VALUES (?, ?, ?, ?, 'reserved', NULL, ?, ?, ?)
+        ON CONFLICT(context_graph_id, request_digest, policy_epoch) DO UPDATE SET
+          reserved_at = excluded.reserved_at,
+          actor = excluded.actor,
+          agent_address = excluded.agent_address,
+          policy_version = excluded.policy_version
+      `).run(input.contextGraphId, input.requestDigest, input.policyEpoch, input.timestamp, input.actor, input.agentAddress, input.policyVersion);
+            this.appendContextGraphJoinPolicyAudit({
+                timestamp: input.timestamp,
+                contextGraphId: input.contextGraphId,
+                eventType: 'join_auto_reservation',
+                actor: input.actor,
+                agentAddress: input.agentAddress,
+                outcome: 'reserved',
+                requestDigest: input.requestDigest,
+                policyVersion: input.policyVersion,
+                details: {
+                    contextGraphLimit: input.contextGraphLimit,
+                    nodeLimit: input.nodeLimit,
+                    policyEpoch: input.policyEpoch,
+                },
+            });
+            return {
+                allowed: true,
+                contextGraphApprovalsLastHour: contextGraphCount + 1,
+                nodeApprovalsLastHour: nodeCount + 1,
+            };
+        });
+        return reserve();
+    }
+    markContextGraphAutomaticApprovalRepairPending(input) {
+        const marked = this.stmt('markContextGraphAutomaticApprovalRepairPending', `
+      UPDATE context_graph_join_approval_ledger
+      SET repair_pending = 1
+      WHERE context_graph_id = ?
+        AND request_digest = ?
+        AND policy_epoch = ?
+        AND state = 'reserved'
+    `).run(input.contextGraphId, input.requestDigest, input.policyEpoch);
+        return marked.changes === 1;
+    }
+    getContextGraphAutomaticApprovalRepair(contextGraphId, requestDigest) {
+        const repair = this.stmt('getContextGraphAutomaticApprovalRepair', `
+      SELECT policy_epoch, actor, agent_address
+      FROM context_graph_join_approval_ledger
+      WHERE context_graph_id = ?
+        AND request_digest = ?
+        AND state = 'reserved'
+        AND repair_pending = 1
+      ORDER BY reserved_at DESC
+      LIMIT 1
+    `).get(contextGraphId, requestDigest);
+        return repair
+            ? {
+                policyEpoch: repair.policy_epoch,
+                actor: repair.actor,
+                agentAddress: repair.agent_address,
+            }
+            : null;
+    }
+    commitContextGraphAutomaticApproval(input) {
+        const commit = this.db.transaction(() => {
+            const reservation = this.stmt('findExactContextGraphAutomaticApprovalReservation', `
+        SELECT context_graph_id, request_digest, policy_epoch, reserved_at,
+               state, committed_at, actor, agent_address, policy_version
+        FROM context_graph_join_approval_ledger
+        WHERE context_graph_id = ?
+          AND request_digest = ?
+          AND policy_epoch = ?
+        LIMIT 1
+      `).get(input.contextGraphId, input.requestDigest, input.policyEpoch);
+            if (!reservation)
+                return false;
+            if (reservation.state === 'committed')
+                return true;
+            const updated = this.stmt('commitContextGraphAutomaticApprovalReservation', `
+        UPDATE context_graph_join_approval_ledger
+        SET state = 'committed', committed_at = ?, repair_pending = 0
+        WHERE context_graph_id = ?
+          AND request_digest = ?
+          AND policy_epoch = ?
+          AND state = 'reserved'
+      `).run(input.timestamp, reservation.context_graph_id, reservation.request_digest, reservation.policy_epoch);
+            if (updated.changes !== 1)
+                return false;
+            this.appendContextGraphJoinPolicyAudit({
+                timestamp: input.timestamp,
+                contextGraphId: input.contextGraphId,
+                eventType: 'join_admission_committed',
+                actor: reservation.actor || input.actor,
+                agentAddress: reservation.agent_address || input.agentAddress,
+                outcome: 'approved',
+                requestDigest: input.requestDigest,
+                policyVersion: reservation.policy_version,
+                details: {
+                    ...input.details,
+                    policyEpoch: reservation.policy_epoch,
+                },
+            });
+            return true;
+        });
+        return commit();
+    }
+    getContextGraphAutomaticApprovalUsage(contextGraphId, timestamp) {
+        const since = timestamp - 60 * 60 * 1000;
+        const contextGraphApprovalsLastHour = Number(this.stmt('getContextGraphAutomaticApprovalUsage', `
+      SELECT COUNT(*) AS count
+      FROM context_graph_join_approval_ledger
+      WHERE context_graph_id = ?
+        AND reserved_at >= ?
+    `).get(contextGraphId, since)?.count ?? 0);
+        const nodeApprovalsLastHour = Number(this.stmt('getNodeAutomaticApprovalUsage', `
+      SELECT COUNT(*) AS count
+      FROM context_graph_join_approval_ledger
+      WHERE reserved_at >= ?
+    `).get(since)?.count ?? 0);
+        return { contextGraphApprovalsLastHour, nodeApprovalsLastHour };
+    }
+    listContextGraphJoinPolicyAudit(contextGraphId) {
+        return this.stmt('listContextGraphJoinPolicyAudit', `
+      SELECT id, ts, context_graph_id, event_type, actor, agent_address,
+             outcome, reason, request_digest, policy_version, details
+      FROM context_graph_join_policy_audit
+      WHERE context_graph_id = ?
+      ORDER BY id ASC
+    `).all(contextGraphId);
+    }
+    contextGraphJoinPolicyKey(contextGraphId) {
+        return `contextGraphJoinPolicy:${contextGraphId}`;
+    }
+    upsertVmReconcileNegative(record) {
+        this.stmt('upsertVmReconcileNegative', `
+      INSERT INTO vm_reconcile_negative_cache (
+        cache_key, context_graph_id, failures, next_retry_at, swm_gen,
+        candidate_namespaces, peer_topology_key, updated_at
+      ) VALUES (
+        @cache_key, @context_graph_id, @failures, @next_retry_at, @swm_gen,
+        @candidate_namespaces, @peer_topology_key, @updated_at
+      )
+      ON CONFLICT(cache_key) DO UPDATE SET
+        context_graph_id = excluded.context_graph_id,
+        failures = excluded.failures,
+        next_retry_at = excluded.next_retry_at,
+        swm_gen = excluded.swm_gen,
+        candidate_namespaces = excluded.candidate_namespaces,
+        peer_topology_key = excluded.peer_topology_key,
+        updated_at = excluded.updated_at
+    `).run(record);
+    }
+    getVmReconcileNegative(cacheKey) {
+        return this.stmt('getVmReconcileNegative', 'SELECT * FROM vm_reconcile_negative_cache WHERE cache_key = ?').get(cacheKey);
+    }
+    deleteVmReconcileNegative(cacheKey) {
+        this.stmt('deleteVmReconcileNegative', 'DELETE FROM vm_reconcile_negative_cache WHERE cache_key = ?').run(cacheKey);
+    }
+    deleteVmReconcileNegativesForContextGraph(contextGraphId) {
+        this.stmt('deleteVmReconcileNegativesForContextGraph', 'DELETE FROM vm_reconcile_negative_cache WHERE context_graph_id = ?').run(contextGraphId);
     }
     // --- Phase F: chain-driven VM reconciliation telemetry ---
     /**
@@ -988,14 +1629,14 @@ export class DashboardDB {
      * coerced defensively so a malformed event can never abort the insert.
      */
     insertReplicationEvent(ev) {
-        this.stmt('insertReplicationEvent', `
-      INSERT INTO replication_events (
-        ts, context_graph_id, on_chain_cg_id, action, ual, ordinal, ka_id,
-        from_watermark, to_watermark, head, reconciled, pending, detail
-      ) VALUES (
-        @ts, @context_graph_id, @on_chain_cg_id, @action, @ual, @ordinal, @ka_id,
-        @from_watermark, @to_watermark, @head, @reconciled, @pending, @detail
-      )
+        this.stmt('insertReplicationEvent', `
+      INSERT INTO replication_events (
+        ts, context_graph_id, on_chain_cg_id, action, ual, ordinal, ka_id,
+        from_watermark, to_watermark, head, reconciled, pending, detail
+      ) VALUES (
+        @ts, @context_graph_id, @on_chain_cg_id, @action, @ual, @ordinal, @ka_id,
+        @from_watermark, @to_watermark, @head, @reconciled, @pending, @detail
+      )
     `).run({
             ts: ev.ts,
             context_graph_id: ev.context_graph_id,
@@ -1042,15 +1683,15 @@ export class DashboardDB {
         // and inflate the reported latency. fetch/promote for one version always
         // share the same ordinal, so this pairs them exactly; a fast-path promote
         // with no fetch for its ordinal correctly contributes a 0ms latency.
-        const latencyRows = this.db.prepare(`
-      SELECT p.ts AS promote_ts,
-             (SELECT MAX(f.ts) FROM replication_events f
-                WHERE f.action = 'fetch'
-                  AND f.context_graph_id = p.context_graph_id
-                  AND f.ordinal = p.ordinal
-                  AND f.ts <= p.ts AND f.ts >= ?) AS fetch_ts
-      FROM replication_events p
-      WHERE p.action = 'promote' AND p.ts >= ? AND p.ordinal IS NOT NULL
+        const latencyRows = this.db.prepare(`
+      SELECT p.ts AS promote_ts,
+             (SELECT MAX(f.ts) FROM replication_events f
+                WHERE f.action = 'fetch'
+                  AND f.context_graph_id = p.context_graph_id
+                  AND f.ordinal = p.ordinal
+                  AND f.ts <= p.ts AND f.ts >= ?) AS fetch_ts
+      FROM replication_events p
+      WHERE p.action = 'promote' AND p.ts >= ? AND p.ordinal IS NOT NULL
     `).all(cutoff, cutoff);
         const latencies = latencyRows
             .map((r) => (r.fetch_ts != null ? r.promote_ts - r.fetch_ts : 0))
@@ -1080,20 +1721,20 @@ export class DashboardDB {
     }
     _computeReplicationPerCg(periodMs) {
         const cutoff = Date.now() - periodMs;
-        return this.db.prepare(`
-      SELECT context_graph_id,
-             on_chain_cg_id,
-             SUM(CASE WHEN action = 'promote' THEN 1 ELSE 0 END) AS promotes,
-             SUM(CASE WHEN action = 'fetch'   THEN 1 ELSE 0 END) AS fetches,
-             SUM(CASE WHEN action = 'defer'   THEN 1 ELSE 0 END) AS defers,
-             SUM(CASE WHEN action = 'cursor-advance' THEN 1 ELSE 0 END) AS cursor_advances,
-             MAX(to_watermark) AS last_watermark,
-             MAX(head) AS last_head,
-             MAX(ts) AS last_event_ts
-      FROM replication_events
-      WHERE ts >= ?
-      GROUP BY context_graph_id, on_chain_cg_id
-      ORDER BY last_event_ts DESC
+        return this.db.prepare(`
+      SELECT context_graph_id,
+             on_chain_cg_id,
+             SUM(CASE WHEN action = 'promote' THEN 1 ELSE 0 END) AS promotes,
+             SUM(CASE WHEN action = 'fetch'   THEN 1 ELSE 0 END) AS fetches,
+             SUM(CASE WHEN action = 'defer'   THEN 1 ELSE 0 END) AS defers,
+             SUM(CASE WHEN action = 'cursor-advance' THEN 1 ELSE 0 END) AS cursor_advances,
+             MAX(to_watermark) AS last_watermark,
+             MAX(head) AS last_head,
+             MAX(ts) AS last_event_ts
+      FROM replication_events
+      WHERE ts >= ?
+      GROUP BY context_graph_id, on_chain_cg_id
+      ORDER BY last_event_ts DESC
     `).all(cutoff);
     }
     /**
@@ -1112,16 +1753,16 @@ export class DashboardDB {
         const cutoff = Date.now() - opts.periodMs;
         const bucket = Math.max(1, Math.floor(opts.bucketMs));
         const where = opts.contextGraphId ? 'AND context_graph_id = @cg' : '';
-        return this.db.prepare(`
-      SELECT (ts / @bucket) * @bucket AS bucket,
-             SUM(CASE WHEN action = 'promote' THEN 1 ELSE 0 END) AS promotes,
-             SUM(CASE WHEN action = 'fetch'   THEN 1 ELSE 0 END) AS fetches,
-             SUM(CASE WHEN action = 'defer'   THEN 1 ELSE 0 END) AS defers,
-             COUNT(*) AS total
-      FROM replication_events
-      WHERE ts >= @cutoff ${where}
-      GROUP BY bucket
-      ORDER BY bucket ASC
+        return this.db.prepare(`
+      SELECT (ts / @bucket) * @bucket AS bucket,
+             SUM(CASE WHEN action = 'promote' THEN 1 ELSE 0 END) AS promotes,
+             SUM(CASE WHEN action = 'fetch'   THEN 1 ELSE 0 END) AS fetches,
+             SUM(CASE WHEN action = 'defer'   THEN 1 ELSE 0 END) AS defers,
+             COUNT(*) AS total
+      FROM replication_events
+      WHERE ts >= @cutoff ${where}
+      GROUP BY bucket
+      ORDER BY bucket ASC
     `).all({ cutoff, bucket, cg: opts.contextGraphId ?? null });
     }
     /**
@@ -1133,13 +1774,13 @@ export class DashboardDB {
         const safeLimit = Number.isFinite(limit)
             ? Math.max(1, Math.min(1000, Math.trunc(limit)))
             : 100;
-        return this.db.prepare(`
-      SELECT ts, context_graph_id, on_chain_cg_id, action, ual, ordinal, ka_id,
-             from_watermark, to_watermark, head, reconciled, pending, detail
-      FROM replication_events
-      WHERE context_graph_id = ?
-      ORDER BY ts DESC
-      LIMIT ?
+        return this.db.prepare(`
+      SELECT ts, context_graph_id, on_chain_cg_id, action, ual, ordinal, ka_id,
+             from_watermark, to_watermark, head, reconciled, pending, detail
+      FROM replication_events
+      WHERE context_graph_id = ?
+      ORDER BY ts DESC
+      LIMIT ?
     `).all(contextGraphId, safeLimit);
     }
     /**
@@ -1148,38 +1789,38 @@ export class DashboardDB {
      * on-disk truth the Replication tab's cursor inspector renders.
      */
     getReplicationCursors() {
-        return this.db.prepare(`
-      SELECT s.context_graph_id            AS context_graph_id,
-             s.on_chain_id                 AS on_chain_id,
-             s.last_reconciled_ordinal     AS last_reconciled_ordinal,
-             s.core_hosted                 AS core_hosted,
-             s.subscribed                  AS subscribed,
-             (SELECT MAX(head) FROM replication_events e
-                WHERE e.context_graph_id = s.context_graph_id) AS last_head,
-             (SELECT MAX(ts) FROM replication_events e
-                WHERE e.context_graph_id = s.context_graph_id) AS last_event_ts
-      FROM context_graph_subscriptions s
-      ORDER BY s.context_graph_id ASC
+        return this.db.prepare(`
+      SELECT s.context_graph_id            AS context_graph_id,
+             s.on_chain_id                 AS on_chain_id,
+             s.last_reconciled_ordinal     AS last_reconciled_ordinal,
+             s.core_hosted                 AS core_hosted,
+             s.subscribed                  AS subscribed,
+             (SELECT MAX(head) FROM replication_events e
+                WHERE e.context_graph_id = s.context_graph_id) AS last_head,
+             (SELECT MAX(ts) FROM replication_events e
+                WHERE e.context_graph_id = s.context_graph_id) AS last_event_ts
+      FROM context_graph_subscriptions s
+      ORDER BY s.context_graph_id ASC
     `).all();
     }
     upsertContextGraphMember(record) {
         const firstSeenAt = record.first_seen_at ?? record.updated_at;
-        this.stmt('upsertContextGraphMember', `
-      INSERT INTO context_graph_memberships (
-        context_graph_id, principal_type, principal_id, role, status, source,
-        display_name, metadata, first_seen_at, updated_at
-      ) VALUES (
-        @context_graph_id, @principal_type, @principal_id, @role, @status, @source,
-        @display_name, @metadata, @first_seen_at, @updated_at
-      )
-      ON CONFLICT(context_graph_id, principal_type, principal_id) DO UPDATE SET
-        role = excluded.role,
-        status = excluded.status,
-        source = excluded.source,
-        display_name = excluded.display_name,
-        metadata = excluded.metadata,
-        first_seen_at = context_graph_memberships.first_seen_at,
-        updated_at = excluded.updated_at
+        this.stmt('upsertContextGraphMember', `
+      INSERT INTO context_graph_memberships (
+        context_graph_id, principal_type, principal_id, role, status, source,
+        display_name, metadata, first_seen_at, updated_at
+      ) VALUES (
+        @context_graph_id, @principal_type, @principal_id, @role, @status, @source,
+        @display_name, @metadata, @first_seen_at, @updated_at
+      )
+      ON CONFLICT(context_graph_id, principal_type, principal_id) DO UPDATE SET
+        role = excluded.role,
+        status = excluded.status,
+        source = excluded.source,
+        display_name = excluded.display_name,
+        metadata = excluded.metadata,
+        first_seen_at = context_graph_memberships.first_seen_at,
+        updated_at = excluded.updated_at
     `).run({
             context_graph_id: record.context_graph_id,
             principal_type: record.principal_type,
@@ -1195,15 +1836,15 @@ export class DashboardDB {
     }
     listContextGraphMembers(contextGraphId) {
         if (contextGraphId) {
-            return this.db.prepare(`
-        SELECT * FROM context_graph_memberships
-        WHERE context_graph_id = ?
-        ORDER BY principal_type ASC, principal_id ASC
+            return this.db.prepare(`
+        SELECT * FROM context_graph_memberships
+        WHERE context_graph_id = ?
+        ORDER BY principal_type ASC, principal_id ASC
       `).all(contextGraphId);
         }
-        return this.db.prepare(`
-      SELECT * FROM context_graph_memberships
-      ORDER BY context_graph_id ASC, principal_type ASC, principal_id ASC
+        return this.db.prepare(`
+      SELECT * FROM context_graph_memberships
+      ORDER BY context_graph_id ASC, principal_type ASC, principal_id ASC
     `).all();
     }
     deleteContextGraphMember(contextGraphId, principalType, principalId) {
@@ -1215,18 +1856,18 @@ export class DashboardDB {
             return this.db.prepare('SELECT * FROM metric_snapshots WHERE ts >= ? AND ts <= ? ORDER BY ts').all(from, to);
         }
         const step = Math.ceil(total.c / maxPoints);
-        return this.db.prepare(`
-      SELECT * FROM (
-        SELECT *, ROW_NUMBER() OVER (ORDER BY ts) as rn
-        FROM metric_snapshots WHERE ts >= ? AND ts <= ?
-      ) WHERE rn % ? = 0 ORDER BY ts
+        return this.db.prepare(`
+      SELECT * FROM (
+        SELECT *, ROW_NUMBER() OVER (ORDER BY ts) as rn
+        FROM metric_snapshots WHERE ts >= ? AND ts <= ?
+      ) WHERE rn % ? = 0 ORDER BY ts
     `).all(from, to, step);
     }
     // --- Operations ---
     insertOperation(op) {
-        this.stmt('insertOp', `
-      INSERT INTO operations (operation_id, operation_name, started_at, status, peer_id, contextGraph_id, details)
-      VALUES (@operation_id, @operation_name, @started_at, 'in_progress', @peer_id, @contextGraph_id, @details)
+        this.stmt('insertOp', `
+      INSERT INTO operations (operation_id, operation_name, started_at, status, peer_id, contextGraph_id, details)
+      VALUES (@operation_id, @operation_name, @started_at, 'in_progress', @peer_id, @contextGraph_id, @details)
     `).run({
             operation_id: op.operation_id,
             operation_name: op.operation_name,
@@ -1237,10 +1878,10 @@ export class DashboardDB {
         });
     }
     completeOperation(op) {
-        this.stmt('completeOp', `
-      UPDATE operations SET status = 'success', duration_ms = @duration_ms,
-        triple_count = @triple_count, details = COALESCE(@details, details)
-      WHERE operation_id = @operation_id AND status = 'in_progress'
+        this.stmt('completeOp', `
+      UPDATE operations SET status = 'success', duration_ms = @duration_ms,
+        triple_count = @triple_count, details = COALESCE(@details, details)
+      WHERE operation_id = @operation_id AND status = 'in_progress'
     `).run({
             operation_id: op.operation_id,
             duration_ms: op.duration_ms,
@@ -1249,10 +1890,10 @@ export class DashboardDB {
         });
     }
     failOperation(op) {
-        this.stmt('failOp', `
-      UPDATE operations SET status = 'error', duration_ms = @duration_ms,
-        error_message = @error_message
-      WHERE operation_id = @operation_id AND status = 'in_progress'
+        this.stmt('failOp', `
+      UPDATE operations SET status = 'error', duration_ms = @duration_ms,
+        error_message = @error_message
+      WHERE operation_id = @operation_id AND status = 'in_progress'
     `).run(op);
     }
     getOperations(opts = {}) {
@@ -1309,22 +1950,22 @@ export class DashboardDB {
     }
     getErrorHotspots(periodMs = 7 * 86_400_000) {
         const cutoff = Date.now() - periodMs;
-        return this.db.prepare(`
-      SELECT
-        p.phase,
-        o.operation_name,
-        COUNT(*) as error_count,
-        (SELECT p2.details FROM operation_phases p2
-         JOIN operations o2 ON o2.operation_id = p2.operation_id
-         WHERE p2.phase = p.phase AND o2.operation_name = o.operation_name
-           AND p2.status = 'error' AND p2.started_at >= ?
-         ORDER BY p2.started_at DESC LIMIT 1) as last_error,
-        MAX(p.started_at) as last_occurred
-      FROM operation_phases p
-      JOIN operations o ON o.operation_id = p.operation_id
-      WHERE p.status = 'error' AND p.started_at >= ?
-      GROUP BY p.phase, o.operation_name
-      ORDER BY error_count DESC
+        return this.db.prepare(`
+      SELECT
+        p.phase,
+        o.operation_name,
+        COUNT(*) as error_count,
+        (SELECT p2.details FROM operation_phases p2
+         JOIN operations o2 ON o2.operation_id = p2.operation_id
+         WHERE p2.phase = p.phase AND o2.operation_name = o.operation_name
+           AND p2.status = 'error' AND p2.started_at >= ?
+         ORDER BY p2.started_at DESC LIMIT 1) as last_error,
+        MAX(p.started_at) as last_occurred
+      FROM operation_phases p
+      JOIN operations o ON o.operation_id = p.operation_id
+      WHERE p.status = 'error' AND p.started_at >= ?
+      GROUP BY p.phase, o.operation_name
+      ORDER BY error_count DESC
     `).all(cutoff, cutoff);
     }
     getFailedOperations(opts = {}) {
@@ -1346,17 +1987,17 @@ export class DashboardDB {
             params.push(like, like, like);
         }
         params.push(limit);
-        const rows = this.db.prepare(`
-      SELECT
-        o.*,
-        p.phase AS phase,
-        p.details AS phase_error,
-        p.started_at AS phase_started_at
-      FROM operation_phases p
-      JOIN operations o ON o.operation_id = p.operation_id
-      WHERE ${where}
-      ORDER BY p.started_at DESC
-      LIMIT ?
+        const rows = this.db.prepare(`
+      SELECT
+        o.*,
+        p.phase AS phase,
+        p.details AS phase_error,
+        p.started_at AS phase_started_at
+      FROM operation_phases p
+      JOIN operations o ON o.operation_id = p.operation_id
+      WHERE ${where}
+      ORDER BY p.started_at DESC
+      LIMIT ?
     `).all(...params);
         const operations = rows.map(row => {
             const logs = this.db.prepare('SELECT * FROM logs WHERE operation_id = ? ORDER BY ts DESC LIMIT 20').all(row.operation_id);
@@ -1373,42 +2014,42 @@ export class DashboardDB {
     }
     // --- Operation phases ---
     insertPhase(op) {
-        this.stmt('insertPhase', `
-      INSERT INTO operation_phases (operation_id, phase, started_at, status)
-      VALUES (@operation_id, @phase, @started_at, 'in_progress')
+        this.stmt('insertPhase', `
+      INSERT INTO operation_phases (operation_id, phase, started_at, status)
+      VALUES (@operation_id, @phase, @started_at, 'in_progress')
     `).run(op);
     }
     completePhase(op) {
-        this.stmt('completePhase', `
-      UPDATE operation_phases SET status = 'success', duration_ms = @duration_ms
-      WHERE operation_id = @operation_id AND phase = @phase AND status = 'in_progress'
+        this.stmt('completePhase', `
+      UPDATE operation_phases SET status = 'success', duration_ms = @duration_ms
+      WHERE operation_id = @operation_id AND phase = @phase AND status = 'in_progress'
     `).run(op);
     }
     failPhase(op) {
-        this.stmt('failPhase', `
-      UPDATE operation_phases SET status = 'error', duration_ms = @duration_ms,
-        details = @error_message
-      WHERE operation_id = @operation_id AND phase = @phase AND status = 'in_progress'
+        this.stmt('failPhase', `
+      UPDATE operation_phases SET status = 'error', duration_ms = @duration_ms,
+        details = @error_message
+      WHERE operation_id = @operation_id AND phase = @phase AND status = 'in_progress'
     `).run(op);
     }
     failAllPhases(op) {
-        this.stmt('failAllPhases', `
-      UPDATE operation_phases SET status = 'error', duration_ms = @duration_ms,
-        details = @error_message
-      WHERE operation_id = @operation_id AND status = 'in_progress'
+        this.stmt('failAllPhases', `
+      UPDATE operation_phases SET status = 'error', duration_ms = @duration_ms,
+        details = @error_message
+      WHERE operation_id = @operation_id AND status = 'in_progress'
     `).run(op);
     }
     // --- Operation cost & tx ---
     setOperationCost(op) {
-        this.stmt('setCost', `
-      UPDATE operations SET
-        gas_used = COALESCE(@gas_used, gas_used),
-        gas_price_gwei = COALESCE(@gas_price_gwei, gas_price_gwei),
-        gas_cost_eth = COALESCE(@gas_cost_eth, gas_cost_eth),
-        trac_cost = COALESCE(@trac_cost, trac_cost),
-        tx_hash = COALESCE(@tx_hash, tx_hash),
-        chain_id = COALESCE(@chain_id, chain_id)
-      WHERE operation_id = @operation_id
+        this.stmt('setCost', `
+      UPDATE operations SET
+        gas_used = COALESCE(@gas_used, gas_used),
+        gas_price_gwei = COALESCE(@gas_price_gwei, gas_price_gwei),
+        gas_cost_eth = COALESCE(@gas_cost_eth, gas_cost_eth),
+        trac_cost = COALESCE(@trac_cost, trac_cost),
+        tx_hash = COALESCE(@tx_hash, tx_hash),
+        chain_id = COALESCE(@chain_id, chain_id)
+      WHERE operation_id = @operation_id
     `).run({
             operation_id: op.operation_id,
             gas_used: op.gas_used ?? null,
@@ -1426,17 +2067,17 @@ export class DashboardDB {
         const params = [cutoff];
         if (opts.name)
             params.push(opts.name);
-        const summaryRow = this.db.prepare(`
-      SELECT
-        COUNT(*) as totalCount,
-        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
-        SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END) as errorCount,
-        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgDurationMs,
-        AVG(gas_cost_eth) as avgGasCostEth,
-        SUM(gas_cost_eth) as totalGasCostEth,
-        AVG(trac_cost) as avgTracCost,
-        SUM(trac_cost) as totalTracCost
-      FROM operations WHERE started_at >= ? ${nameFilter}
+        const summaryRow = this.db.prepare(`
+      SELECT
+        COUNT(*) as totalCount,
+        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
+        SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END) as errorCount,
+        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgDurationMs,
+        AVG(gas_cost_eth) as avgGasCostEth,
+        SUM(gas_cost_eth) as totalGasCostEth,
+        AVG(trac_cost) as avgTracCost,
+        SUM(trac_cost) as totalTracCost
+      FROM operations WHERE started_at >= ? ${nameFilter}
     `).get(...params);
         const summary = {
             totalCount: summaryRow.totalCount ?? 0,
@@ -1453,17 +2094,17 @@ export class DashboardDB {
         const tsParams = [bucketSize, cutoff];
         if (opts.name)
             tsParams.push(opts.name);
-        const timeSeries = this.db.prepare(`
-      SELECT
-        (CAST(started_at / ? AS INTEGER) * ?) as bucket,
-        COUNT(*) as count,
-        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
-        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgDurationMs,
-        AVG(gas_cost_eth) as avgGasCostEth,
-        SUM(gas_cost_eth) as totalGasCostEth
-      FROM operations
-      WHERE started_at >= ? ${nameFilter}
-      GROUP BY bucket ORDER BY bucket
+        const timeSeries = this.db.prepare(`
+      SELECT
+        (CAST(started_at / ? AS INTEGER) * ?) as bucket,
+        COUNT(*) as count,
+        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
+        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgDurationMs,
+        AVG(gas_cost_eth) as avgGasCostEth,
+        SUM(gas_cost_eth) as totalGasCostEth
+      FROM operations
+      WHERE started_at >= ? ${nameFilter}
+      GROUP BY bucket ORDER BY bucket
     `).all(bucketSize, bucketSize, ...params);
         return {
             summary,
@@ -1480,16 +2121,16 @@ export class DashboardDB {
     // --- Per-type time series ---
     getPerTypeTimeSeries(opts) {
         const cutoff = Date.now() - opts.periodMs;
-        const rows = this.db.prepare(`
-      SELECT
-        (CAST(started_at / ? AS INTEGER) * ?) as bucket,
-        operation_name as type,
-        COUNT(*) as count,
-        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgMs,
-        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
-        SUM(gas_cost_eth) as gasCostEth
-      FROM operations WHERE started_at >= ?
-      GROUP BY bucket, operation_name ORDER BY bucket
+        const rows = this.db.prepare(`
+      SELECT
+        (CAST(started_at / ? AS INTEGER) * ?) as bucket,
+        operation_name as type,
+        COUNT(*) as count,
+        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgMs,
+        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as successCount,
+        SUM(gas_cost_eth) as gasCostEth
+      FROM operations WHERE started_at >= ?
+      GROUP BY bucket, operation_name ORDER BY bucket
     `).all(opts.bucketMs, opts.bucketMs, cutoff);
         const bucketSet = new Set();
         const typeSet = new Set();
@@ -1519,15 +2160,15 @@ export class DashboardDB {
     // --- Success rates by operation type ---
     getSuccessRatesByType(periodMs) {
         const cutoff = Date.now() - periodMs;
-        return this.db.prepare(`
-      SELECT
-        operation_name as type,
-        COUNT(*) as total,
-        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as success,
-        SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END) as error,
-        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgMs
-      FROM operations WHERE started_at >= ?
-      GROUP BY operation_name ORDER BY total DESC
+        return this.db.prepare(`
+      SELECT
+        operation_name as type,
+        COUNT(*) as total,
+        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) as success,
+        SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END) as error,
+        AVG(CASE WHEN status = 'success' THEN duration_ms END) as avgMs
+      FROM operations WHERE started_at >= ?
+      GROUP BY operation_name ORDER BY total DESC
     `).all(cutoff).map(r => ({
             ...r,
             rate: r.total > 0 ? r.success / r.total : 0,
@@ -1550,16 +2191,16 @@ export class DashboardDB {
             // on-chain (Verifiable Memory commits) are counted, so the publish
             // count and the TRAC total are consistent. Free SWM/local/testnet
             // publishes record trac_cost = 0 and are intentionally excluded.
-            const row = this.db.prepare(`
-        SELECT
-          SUM(CASE WHEN trac_cost > 0 THEN 1 ELSE 0 END) as publishCount,
-          SUM(CASE WHEN status = 'success' AND trac_cost > 0 THEN 1 ELSE 0 END) as successCount,
-          COALESCE(SUM(gas_cost_eth), 0) as totalGasEth,
-          COALESCE(SUM(trac_cost), 0) as totalTrac,
-          COALESCE(AVG(CASE WHEN trac_cost > 0 THEN gas_cost_eth END), 0) as avgGasEth,
-          COALESCE(AVG(CASE WHEN trac_cost > 0 THEN trac_cost END), 0) as avgTrac
-        FROM operations
-        WHERE operation_name = 'publish' AND trac_cost > 0 AND started_at >= ?
+            const row = this.db.prepare(`
+        SELECT
+          SUM(CASE WHEN trac_cost > 0 THEN 1 ELSE 0 END) as publishCount,
+          SUM(CASE WHEN status = 'success' AND trac_cost > 0 THEN 1 ELSE 0 END) as successCount,
+          COALESCE(SUM(gas_cost_eth), 0) as totalGasEth,
+          COALESCE(SUM(trac_cost), 0) as totalTrac,
+          COALESCE(AVG(CASE WHEN trac_cost > 0 THEN gas_cost_eth END), 0) as avgGasEth,
+          COALESCE(AVG(CASE WHEN trac_cost > 0 THEN trac_cost END), 0) as avgTrac
+        FROM operations
+        WHERE operation_name = 'publish' AND trac_cost > 0 AND started_at >= ?
       `).get(cutoff);
             results.periods.push({
                 label: p.label,
@@ -1594,9 +2235,9 @@ export class DashboardDB {
      * still throw — pinned by db.test.ts.
      */
     insertChatMessage(msg) {
-        const info = this.stmt('insertChat', `
-      INSERT INTO chat_messages (ts, direction, peer, peer_name, text, delivered, message_id)
-      VALUES (@ts, @direction, @peer, @peer_name, @text, @delivered, @message_id)
+        const info = this.stmt('insertChat', `
+      INSERT INTO chat_messages (ts, direction, peer, peer_name, text, delivered, message_id)
+      VALUES (@ts, @direction, @peer, @peer_name, @text, @delivered, @message_id)
     `).run({
             ts: msg.ts,
             direction: msg.direction,
@@ -1687,16 +2328,16 @@ export class DashboardDB {
         return this.db.prepare('SELECT * FROM chat_persistence_jobs WHERE turn_id = ?').get(turnId);
     }
     insertChatPersistenceJob(job) {
-        this.stmt('insertChatPersistenceJob', `
-      INSERT INTO chat_persistence_jobs (
-        turn_id, session_id, user_message, assistant_reply, tool_calls_json,
-        status, attempts, max_attempts, next_attempt_at, queued_at, updated_at,
-        store_ms, error_message
-      ) VALUES (
-        @turn_id, @session_id, @user_message, @assistant_reply, @tool_calls_json,
-        @status, @attempts, @max_attempts, @next_attempt_at, @queued_at, @updated_at,
-        @store_ms, @error_message
-      )
+        this.stmt('insertChatPersistenceJob', `
+      INSERT INTO chat_persistence_jobs (
+        turn_id, session_id, user_message, assistant_reply, tool_calls_json,
+        status, attempts, max_attempts, next_attempt_at, queued_at, updated_at,
+        store_ms, error_message
+      ) VALUES (
+        @turn_id, @session_id, @user_message, @assistant_reply, @tool_calls_json,
+        @status, @attempts, @max_attempts, @next_attempt_at, @queued_at, @updated_at,
+        @store_ms, @error_message
+      )
     `).run({
             ...job,
             tool_calls_json: job.tool_calls_json ?? null,
@@ -1705,46 +2346,46 @@ export class DashboardDB {
         });
     }
     markChatPersistenceInProgress(turnId, attempts, updatedAt) {
-        this.stmt('markChatPersistenceInProgress', `
-      UPDATE chat_persistence_jobs
-      SET status = 'in_progress', attempts = ?, updated_at = ?, error_message = NULL
-      WHERE turn_id = ?
+        this.stmt('markChatPersistenceInProgress', `
+      UPDATE chat_persistence_jobs
+      SET status = 'in_progress', attempts = ?, updated_at = ?, error_message = NULL
+      WHERE turn_id = ?
     `).run(attempts, updatedAt, turnId);
     }
     markChatPersistenceStored(turnId, storeMs, updatedAt) {
-        this.stmt('markChatPersistenceStored', `
-      UPDATE chat_persistence_jobs
-      SET status = 'stored', store_ms = ?, updated_at = ?, error_message = NULL
-      WHERE turn_id = ?
+        this.stmt('markChatPersistenceStored', `
+      UPDATE chat_persistence_jobs
+      SET status = 'stored', store_ms = ?, updated_at = ?, error_message = NULL
+      WHERE turn_id = ?
     `).run(storeMs, updatedAt, turnId);
     }
     markChatPersistencePendingRetry(turnId, attempts, nextAttemptAt, updatedAt, errorMessage) {
-        this.stmt('markChatPersistencePendingRetry', `
-      UPDATE chat_persistence_jobs
-      SET status = 'pending', attempts = ?, next_attempt_at = ?, updated_at = ?, error_message = ?
-      WHERE turn_id = ?
+        this.stmt('markChatPersistencePendingRetry', `
+      UPDATE chat_persistence_jobs
+      SET status = 'pending', attempts = ?, next_attempt_at = ?, updated_at = ?, error_message = ?
+      WHERE turn_id = ?
     `).run(attempts, nextAttemptAt, updatedAt, errorMessage, turnId);
     }
     markChatPersistenceFailed(turnId, attempts, updatedAt, errorMessage) {
-        this.stmt('markChatPersistenceFailed', `
-      UPDATE chat_persistence_jobs
-      SET status = 'failed', attempts = ?, updated_at = ?, error_message = ?
-      WHERE turn_id = ?
+        this.stmt('markChatPersistenceFailed', `
+      UPDATE chat_persistence_jobs
+      SET status = 'failed', attempts = ?, updated_at = ?, error_message = ?
+      WHERE turn_id = ?
     `).run(attempts, updatedAt, errorMessage, turnId);
     }
     recoverInProgressChatPersistenceJobs(now) {
-        this.stmt('recoverInProgressChatPersistenceJobs', `
-      UPDATE chat_persistence_jobs
-      SET status = 'pending', next_attempt_at = ?, updated_at = ?
-      WHERE status = 'in_progress'
+        this.stmt('recoverInProgressChatPersistenceJobs', `
+      UPDATE chat_persistence_jobs
+      SET status = 'pending', next_attempt_at = ?, updated_at = ?
+      WHERE status = 'in_progress'
     `).run(now, now);
     }
     getRunnableChatPersistenceJobs(now, limit = 10) {
-        return this.db.prepare(`
-      SELECT * FROM chat_persistence_jobs
-      WHERE status = 'pending' AND next_attempt_at <= ?
-      ORDER BY next_attempt_at ASC, queued_at ASC
-      LIMIT ?
+        return this.db.prepare(`
+      SELECT * FROM chat_persistence_jobs
+      WHERE status = 'pending' AND next_attempt_at <= ?
+      ORDER BY next_attempt_at ASC, queued_at ASC
+      LIMIT ?
     `).all(now, limit);
     }
     getNextPendingChatPersistenceAt() {
@@ -1752,19 +2393,19 @@ export class DashboardDB {
         return row?.next_at ?? null;
     }
     getChatPersistenceHealth(now) {
-        const counts = this.db.prepare(`
-      SELECT
-        SUM(CASE WHEN status = 'pending' THEN 1 ELSE 0 END) AS pending_count,
-        SUM(CASE WHEN status = 'in_progress' THEN 1 ELSE 0 END) AS in_progress_count,
-        SUM(CASE WHEN status = 'stored' THEN 1 ELSE 0 END) AS stored_count,
-        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failed_count,
-        SUM(CASE WHEN status = 'pending' AND next_attempt_at < ? THEN 1 ELSE 0 END) AS overdue_pending_count
-      FROM chat_persistence_jobs
+        const counts = this.db.prepare(`
+      SELECT
+        SUM(CASE WHEN status = 'pending' THEN 1 ELSE 0 END) AS pending_count,
+        SUM(CASE WHEN status = 'in_progress' THEN 1 ELSE 0 END) AS in_progress_count,
+        SUM(CASE WHEN status = 'stored' THEN 1 ELSE 0 END) AS stored_count,
+        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failed_count,
+        SUM(CASE WHEN status = 'pending' AND next_attempt_at < ? THEN 1 ELSE 0 END) AS overdue_pending_count
+      FROM chat_persistence_jobs
     `).get(now);
-        const oldest = this.db.prepare(`
-      SELECT MIN(queued_at) AS oldest_pending_queued_at
-      FROM chat_persistence_jobs
-      WHERE status = 'pending'
+        const oldest = this.db.prepare(`
+      SELECT MIN(queued_at) AS oldest_pending_queued_at
+      FROM chat_persistence_jobs
+      WHERE status = 'pending'
     `).get();
         return {
             pending_count: counts?.pending_count ?? 0,
@@ -1777,9 +2418,9 @@ export class DashboardDB {
     }
     // --- Logs ---
     insertLog(entry) {
-        this.stmt('insertLog', `
-      INSERT INTO logs (ts, level, operation_name, operation_id, module, message)
-      VALUES (@ts, @level, @operation_name, @operation_id, @module, @message)
+        this.stmt('insertLog', `
+      INSERT INTO logs (ts, level, operation_name, operation_id, module, message)
+      VALUES (@ts, @level, @operation_name, @operation_id, @module, @message)
     `).run({
             ts: entry.ts,
             level: entry.level,
@@ -1834,9 +2475,9 @@ export class DashboardDB {
     }
     // --- Query history ---
     insertQueryHistory(entry) {
-        this.stmt('insertQueryHistory', `
-      INSERT INTO query_history (ts, sparql, duration_ms, result_count, error)
-      VALUES (@ts, @sparql, @duration_ms, @result_count, @error)
+        this.stmt('insertQueryHistory', `
+      INSERT INTO query_history (ts, sparql, duration_ms, result_count, error)
+      VALUES (@ts, @sparql, @duration_ms, @result_count, @error)
     `).run({
             ts: Date.now(),
             sparql: entry.sparql,
@@ -1880,9 +2521,9 @@ export class DashboardDB {
     }
     // --- Notifications ---
     insertNotification(n) {
-        const result = this.stmt('insertNotif', `
-      INSERT INTO notifications (ts, type, title, message, source, peer, read, meta, context_graph_id)
-      VALUES (@ts, @type, @title, @message, @source, @peer, 0, @meta, @contextGraphId)
+        const result = this.stmt('insertNotif', `
+      INSERT INTO notifications (ts, type, title, message, source, peer, read, meta, context_graph_id)
+      VALUES (@ts, @type, @title, @message, @source, @peer, 0, @meta, @contextGraphId)
     `).run({
             ts: n.ts,
             type: n.type,
@@ -1918,8 +2559,8 @@ export class DashboardDB {
         if (cgIds.length === 0)
             return [];
         const placeholders = cgIds.map(() => '?').join(',');
-        return this.db.prepare(`SELECT * FROM notifications
-        WHERE context_graph_id IN (${placeholders})
+        return this.db.prepare(`SELECT * FROM notifications
+        WHERE context_graph_id IN (${placeholders})
         ORDER BY ts DESC LIMIT ?`).all(...cgIds, limit);
     }
     /**
@@ -1950,8 +2591,8 @@ export class DashboardDB {
         if (types.length === 0)
             return [];
         const placeholders = types.map(() => '?').join(',');
-        return this.db.prepare(`SELECT * FROM notifications
-        WHERE type IN (${placeholders})
+        return this.db.prepare(`SELECT * FROM notifications
+        WHERE type IN (${placeholders})
         ORDER BY ts DESC LIMIT ?`).all(...types, limit);
     }
     /**
@@ -1971,9 +2612,9 @@ export class DashboardDB {
         const wallet = walletAddress.trim().toLowerCase();
         if (!wallet)
             return [];
-        return this.db.prepare(`SELECT * FROM notifications
-        WHERE type = 'pca_cost_covered'
-          AND lower(json_extract(meta, '$.publisherAddress')) = ?
+        return this.db.prepare(`SELECT * FROM notifications
+        WHERE type = 'pca_cost_covered'
+          AND lower(json_extract(meta, '$.publisherAddress')) = ?
         ORDER BY ts DESC LIMIT ?`).all(wallet, limit);
     }
     markNotificationsRead(ids) {
@@ -2003,10 +2644,10 @@ export class DashboardDB {
             return [];
         const windowStart = parsed.windowBucket * ACTIVITY_DIGEST_WINDOW_MS;
         const windowEnd = windowStart + ACTIVITY_DIGEST_WINDOW_MS;
-        const rows = this.db.prepare(`SELECT id FROM notifications
-        WHERE context_graph_id = ?
-          AND type = ?
-          AND ts >= ? AND ts < ?
+        const rows = this.db.prepare(`SELECT id FROM notifications
+        WHERE context_graph_id = ?
+          AND type = ?
+          AND ts >= ? AND ts < ?
           AND json_extract(meta, '$.kind') = ?`).all(parsed.contextGraphId, ASSERTION_ACTIVITY_TYPE, windowStart, windowEnd, parsed.kind);
         return rows.map((r) => r.id);
     }
@@ -2027,32 +2668,72 @@ export class SqliteSyncCheckpointStore {
     }
     get(key) {
         const now = this.clock();
-        const row = this.db.prepare(`SELECT offset, updated_at, expires_at FROM sync_checkpoints WHERE key = ?`).get(key);
+        const row = this.db.prepare(`SELECT offset, updated_at, expires_at,
+              responder_session_id, responder_session_expires_at
+         FROM sync_checkpoints WHERE key = ?`).get(key);
         if (!row)
             return undefined;
         if (row.expires_at < now) {
             this.delete(key);
             return undefined;
         }
+        const hasFreshResponderSession = Boolean(row.responder_session_id)
+            && Number.isSafeInteger(row.responder_session_expires_at)
+            && (row.responder_session_expires_at ?? 0) > now;
+        if (row.responder_session_id && !hasFreshResponderSession) {
+            this.clearResponderSession(key);
+        }
         return {
             offset: row.offset,
             updatedAtMs: row.updated_at,
             expiresAtMs: row.expires_at,
+            ...(hasFreshResponderSession
+                ? {
+                    responderSessionId: row.responder_session_id,
+                    responderSessionExpiresAtMs: row.responder_session_expires_at,
+                }
+                : {}),
         };
     }
     set(key, value, nowMs = this.clock()) {
         if (!Number.isSafeInteger(value) || value < 0) {
             throw new Error(`Invalid sync checkpoint offset for ${key}: ${value}`);
         }
-        this.db.prepare(`
-      INSERT INTO sync_checkpoints (key, offset, updated_at, expires_at)
-      VALUES (?, ?, ?, ?)
-      ON CONFLICT(key) DO UPDATE SET
-        offset = excluded.offset,
-        updated_at = excluded.updated_at,
-        expires_at = excluded.expires_at
+        this.db.prepare(`
+      INSERT INTO sync_checkpoints (key, offset, updated_at, expires_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET
+        offset = excluded.offset,
+        updated_at = excluded.updated_at,
+        expires_at = excluded.expires_at
     `).run(key, value, nowMs, nowMs + this.ttlMs);
     }
+    setResponderSession(key, sessionId, expiresAtMs, nowMs = this.clock()) {
+        if (!sessionId || !Number.isSafeInteger(expiresAtMs)) {
+            throw new Error(`Invalid sync responder session for ${key}`);
+        }
+        if (expiresAtMs <= nowMs) {
+            this.clearResponderSession(key);
+            return;
+        }
+        this.db.prepare(`
+      INSERT INTO sync_checkpoints (
+        key, offset, updated_at, expires_at,
+        responder_session_id, responder_session_expires_at
+      ) VALUES (?, 0, ?, ?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET
+        responder_session_id = excluded.responder_session_id,
+        responder_session_expires_at = excluded.responder_session_expires_at
+    `).run(key, nowMs, nowMs + this.ttlMs, sessionId, expiresAtMs);
+    }
+    clearResponderSession(key) {
+        this.db.prepare(`
+      UPDATE sync_checkpoints
+         SET responder_session_id = NULL,
+             responder_session_expires_at = NULL
+       WHERE key = ?
+    `).run(key);
+    }
     delete(key) {
         this.db.prepare(`DELETE FROM sync_checkpoints WHERE key = ?`).run(key);
     }
@@ -2084,13 +2765,13 @@ export class SqliteChangelogCursorStore {
         if (!Number.isSafeInteger(seq) || seq < 0) {
             throw new Error(`Invalid changelog cursor seq for ${peerId}/${contextGraphId}: ${seq}`);
         }
-        this.db.prepare(`
-      INSERT INTO changelog_cursors (peer_id, context_graph_id, era, seq, updated_at)
-      VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(peer_id, context_graph_id) DO UPDATE SET
-        era = excluded.era,
-        seq = excluded.seq,
-        updated_at = excluded.updated_at
+        this.db.prepare(`
+      INSERT INTO changelog_cursors (peer_id, context_graph_id, era, seq, updated_at)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(peer_id, context_graph_id) DO UPDATE SET
+        era = excluded.era,
+        seq = excluded.seq,
+        updated_at = excluded.updated_at
     `).run(peerId, contextGraphId, era, seq, nowMs);
     }
 }
@@ -2118,13 +2799,13 @@ export class SqliteChangelogEraGuard {
         if (!Number.isSafeInteger(highSeq) || highSeq < 0) {
             throw new Error(`Invalid changelog era high_seq: ${highSeq}`);
         }
-        this.db.prepare(`
-      INSERT INTO changelog_era (id, era, high_seq, updated_at)
-      VALUES (1, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        era = excluded.era,
-        high_seq = excluded.high_seq,
-        updated_at = excluded.updated_at
+        this.db.prepare(`
+      INSERT INTO changelog_era (id, era, high_seq, updated_at)
+      VALUES (1, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        era = excluded.era,
+        high_seq = excluded.high_seq,
+        updated_at = excluded.updated_at
     `).run(era, highSeq, this.clock());
     }
 }
@@ -2158,7 +2839,7 @@ export class SqliteMessageIdempotencyStore {
     }
     check(peer, protocol, messageId, direction) {
         const row = this.db
-            .prepare(`SELECT response_blob FROM message_idempotency
+            .prepare(`SELECT response_blob FROM message_idempotency
          WHERE peer_id = ? AND protocol = ? AND message_id = ? AND direction = ?`)
             .get(peer, protocol, messageId, direction);
         if (!row)
@@ -2188,9 +2869,9 @@ export class SqliteMessageIdempotencyStore {
         // SqliteError so the substrate's bug doesn't disguise itself as
         // a normal duplicate.
         this.db
-            .prepare(`INSERT INTO message_idempotency
-           (peer_id, protocol, message_id, direction, response_blob, response_size, ts)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO message_idempotency
+           (peer_id, protocol, message_id, direction, response_blob, response_size, ts)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (peer_id, protocol, message_id, direction) DO NOTHING`)
             .run(peer, protocol, messageId, direction, blob, responseSize, this.clock());
     }
@@ -2215,15 +2896,15 @@ export class SqliteProtocolOutboxStore {
     }
     enqueue(peer, protocol, messageId, payload, error, now) {
         const existing = this.db
-            .prepare(`SELECT * FROM protocol_outbox
+            .prepare(`SELECT * FROM protocol_outbox
          WHERE peer_id = ? AND protocol = ? AND message_id = ?`)
             .get(peer, protocol, messageId);
         if (existing) {
             const newAttempts = existing.attempts + 1;
             const nextAttemptAt = now + this.backoffFor(newAttempts);
             this.db
-                .prepare(`UPDATE protocol_outbox
-           SET attempts = ?, last_attempt_at = ?, next_attempt_at = ?, last_error = ?
+                .prepare(`UPDATE protocol_outbox
+           SET attempts = ?, last_attempt_at = ?, next_attempt_at = ?, last_error = ?
            WHERE peer_id = ? AND protocol = ? AND message_id = ?`)
                 .run(newAttempts, now, nextAttemptAt, error, peer, protocol, messageId);
             return {
@@ -2242,9 +2923,9 @@ export class SqliteProtocolOutboxStore {
         const nextAttemptAt = now + this.backoffFor(attempts);
         const blob = Buffer.from(payload);
         this.db
-            .prepare(`INSERT INTO protocol_outbox
-           (peer_id, protocol, message_id, payload, attempts,
-            first_failure_at, last_attempt_at, next_attempt_at, last_error)
+            .prepare(`INSERT INTO protocol_outbox
+           (peer_id, protocol, message_id, payload, attempts,
+            first_failure_at, last_attempt_at, next_attempt_at, last_error)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(peer, protocol, messageId, blob, attempts, now, now, nextAttemptAt, error);
         return {
@@ -2261,14 +2942,14 @@ export class SqliteProtocolOutboxStore {
     }
     markDelivered(peer, protocol, messageId) {
         const result = this.db
-            .prepare(`DELETE FROM protocol_outbox
+            .prepare(`DELETE FROM protocol_outbox
          WHERE peer_id = ? AND protocol = ? AND message_id = ?`)
             .run(peer, protocol, messageId);
         return result.changes > 0;
     }
     hasEntry(peer, protocol, messageId) {
         const row = this.db
-            .prepare(`SELECT 1 FROM protocol_outbox
+            .prepare(`SELECT 1 FROM protocol_outbox
          WHERE peer_id = ? AND protocol = ? AND message_id = ? LIMIT 1`)
             .get(peer, protocol, messageId);
         return row !== undefined;
@@ -2278,27 +2959,27 @@ export class SqliteProtocolOutboxStore {
     }
     pendingFor(peer) {
         const rows = this.db
-            .prepare(`SELECT * FROM protocol_outbox
-         WHERE peer_id = ?
+            .prepare(`SELECT * FROM protocol_outbox
+         WHERE peer_id = ?
          ORDER BY first_failure_at ASC, protocol ASC, message_id ASC`)
             .all(peer);
         return rows.map(SqliteProtocolOutboxStore.rowToEntry);
     }
     due(now) {
         const rows = this.db
-            .prepare(`SELECT * FROM protocol_outbox
-         WHERE next_attempt_at <= ?
-         ORDER BY next_attempt_at ASC, first_failure_at ASC,
+            .prepare(`SELECT * FROM protocol_outbox
+         WHERE next_attempt_at <= ?
+         ORDER BY next_attempt_at ASC, first_failure_at ASC,
                   peer_id ASC, protocol ASC, message_id ASC`)
             .all(now);
         return rows.map(SqliteProtocolOutboxStore.rowToEntry);
     }
     duePage(now, limit) {
         const rows = this.db
-            .prepare(`SELECT * FROM protocol_outbox
-         WHERE next_attempt_at <= ?
-         ORDER BY next_attempt_at ASC, first_failure_at ASC,
-                  peer_id ASC, protocol ASC, message_id ASC
+            .prepare(`SELECT * FROM protocol_outbox
+         WHERE next_attempt_at <= ?
+         ORDER BY next_attempt_at ASC, first_failure_at ASC,
+                  peer_id ASC, protocol ASC, message_id ASC
          LIMIT ?`)
             .all(now, limit);
         return rows.map(SqliteProtocolOutboxStore.rowToEntry);
@@ -2388,9 +3069,9 @@ export class SqliteKaNumberStore {
         // `safeIntegers(true)` opts INTO bigint returns so the counter is
         // exact past `Number.MAX_SAFE_INTEGER` (codex PR #976 F6).
         const row = this.db
-            .prepare(`INSERT INTO ka_numbers (author_address, next_number)
-         VALUES (?, 1)
-         ON CONFLICT(author_address) DO UPDATE SET next_number = next_number + 1
+            .prepare(`INSERT INTO ka_numbers (author_address, next_number)
+         VALUES (?, 1)
+         ON CONFLICT(author_address) DO UPDATE SET next_number = next_number + 1
          RETURNING next_number - 1 AS number`)
             .safeIntegers(true)
             .get(author);
@@ -2402,9 +3083,9 @@ export class SqliteKaNumberStore {
         // `excluded.next_number` is the proposed floor from the VALUES row.
         // `better-sqlite3` accepts bigint statement parameters natively.
         this.db
-            .prepare(`INSERT INTO ka_numbers (author_address, next_number)
-         VALUES (?, ?)
-         ON CONFLICT(author_address) DO UPDATE SET
+            .prepare(`INSERT INTO ka_numbers (author_address, next_number)
+         VALUES (?, ?)
+         ON CONFLICT(author_address) DO UPDATE SET
            next_number = MAX(next_number, excluded.next_number)`)
             .run(author, nextNumberFloor);
     }