@synapsor/runner 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/runner.mjs

@@ -1196,13 +1196,89 @@ var ProposalStoreError = class extends Error {
 };
 var ProposalStore = class {
   db;
+  path;
   constructor(path4 = ":memory:") {
+    this.path = path4;
     this.db = new DatabaseSync(path4);
     this.migrate();
   }
   close() {
     this.db.close();
   }
+  stats() {
+    const pageCount = this.numberValue("PRAGMA page_count");
+    const pageSize = this.numberValue("PRAGMA page_size");
+    return {
+      path: this.path,
+      proposals: this.countTable("proposals"),
+      evidence_bundles: this.countTable("evidence_bundles"),
+      evidence_items: this.countTable("evidence_items"),
+      query_audit: this.countTable("query_audit"),
+      writeback_receipts: this.countTable("writeback_receipts"),
+      writeback_jobs: this.countTable("writeback_jobs"),
+      idempotency_receipts: this.countTable("idempotency_receipts"),
+      replay_records: this.countTable("replay_records"),
+      approvals: this.countTable("approvals"),
+      proposal_events: this.countTable("proposal_events"),
+      shadow_human_actions: this.countTable("shadow_human_actions"),
+      page_count: pageCount,
+      page_size: pageSize,
+      approx_bytes: pageCount * pageSize
+    };
+  }
+  vacuum() {
+    this.db.exec("VACUUM");
+  }
+  pruneBefore(cutoffIso, options = {}) {
+    const dryRun = options.dryRun !== false;
+    const proposalIds = this.stringColumn("SELECT proposal_id FROM proposals WHERE created_at < ?", [cutoffIso], "proposal_id");
+    const evidenceIds = this.evidenceIdsForPrune(cutoffIso, proposalIds);
+    const deleted = {};
+    const run = (table, where, params) => {
+      deleted[table] = this.countWhere(table, where, params);
+      if (!dryRun && deleted[table] > 0) this.db.prepare(`DELETE FROM ${table} WHERE ${where}`).run(...params);
+    };
+    const proposalWhere = inWhere("proposal_id", proposalIds);
+    const evidenceWhere = inWhere("evidence_bundle_id", evidenceIds);
+    this.transaction(() => {
+      if (proposalWhere) {
+        run("idempotency_receipts", proposalWhere.sql, proposalWhere.params);
+        run("writeback_receipts", proposalWhere.sql, proposalWhere.params);
+        run("writeback_jobs", proposalWhere.sql, proposalWhere.params);
+        run("approvals", proposalWhere.sql, proposalWhere.params);
+        run("proposal_events", proposalWhere.sql, proposalWhere.params);
+        run("shadow_human_actions", proposalWhere.sql, proposalWhere.params);
+        run("replay_records", proposalWhere.sql, proposalWhere.params);
+      } else {
+        for (const table of ["idempotency_receipts", "writeback_receipts", "writeback_jobs", "approvals", "proposal_events", "shadow_human_actions", "replay_records"]) {
+          deleted[table] = 0;
+        }
+      }
+      const auditClauses = [];
+      const auditParams = [];
+      if (proposalWhere) {
+        auditClauses.push(proposalWhere.sql);
+        auditParams.push(...proposalWhere.params);
+      }
+      if (evidenceWhere) {
+        auditClauses.push(evidenceWhere.sql);
+        auditParams.push(...evidenceWhere.params);
+      }
+      auditClauses.push("(proposal_id IS NULL AND evidence_bundle_id IS NULL AND created_at < ?)");
+      auditParams.push(cutoffIso);
+      run("query_audit", auditClauses.map((clause) => `(${clause})`).join(" OR "), auditParams);
+      if (evidenceWhere) {
+        run("evidence_items", evidenceWhere.sql, evidenceWhere.params);
+        run("evidence_bundles", evidenceWhere.sql, evidenceWhere.params);
+      } else {
+        deleted.evidence_items = 0;
+        deleted.evidence_bundles = 0;
+      }
+      if (proposalWhere) run("proposals", proposalWhere.sql, proposalWhere.params);
+      else deleted.proposals = 0;
+    });
+    return { cutoff: cutoffIso, dry_run: dryRun, deleted };
+  }
   migrate() {
     this.db.exec(`
       PRAGMA foreign_keys = ON;
@@ -1353,6 +1429,154 @@ var ProposalStore = class {
       INSERT OR IGNORE INTO proposal_store_schema(version, applied_at)
       VALUES (1, datetime('now'));
     `);
+    this.ensureSearchColumns();
+    this.backfillSearchColumns();
+    this.ensureSearchIndexes();
+  }
+  ensureSearchColumns() {
+    this.ensureColumn("proposals", "principal", "TEXT");
+    this.ensureColumn("proposals", "capability", "TEXT");
+    this.ensureColumn("proposals", "interaction_id", "TEXT");
+    this.ensureColumn("proposals", "tool_call_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "principal", "TEXT");
+    this.ensureColumn("evidence_bundles", "capability", "TEXT");
+    this.ensureColumn("evidence_bundles", "source_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "source_table", "TEXT");
+    this.ensureColumn("evidence_bundles", "business_object", "TEXT");
+    this.ensureColumn("evidence_bundles", "object_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "query_fingerprint", "TEXT");
+    this.ensureColumn("query_audit", "tenant_id", "TEXT");
+    this.ensureColumn("query_audit", "principal", "TEXT");
+    this.ensureColumn("query_audit", "capability", "TEXT");
+    this.ensureColumn("query_audit", "business_object", "TEXT");
+    this.ensureColumn("query_audit", "object_id", "TEXT");
+    this.ensureColumn("query_audit", "primary_key_value", "TEXT");
+  }
+  ensureSearchIndexes() {
+    this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_proposals_tenant_created ON proposals(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_action_created ON proposals(action, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_capability_created ON proposals(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_principal_created ON proposals(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_object_created ON proposals(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_state_created ON proposals(state, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_source_table_created ON proposals(source_id, source_table, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_tenant_created ON evidence_bundles(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_proposal_id ON evidence_bundles(proposal_id);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_created ON evidence_bundles(created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_capability_created ON evidence_bundles(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_principal_created ON evidence_bundles(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_object_created ON evidence_bundles(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_source_table_created ON evidence_bundles(source_id, source_table, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_fingerprint_created ON evidence_bundles(query_fingerprint, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_evidence_items_bundle_id ON evidence_items(evidence_bundle_id);
+
+      CREATE INDEX IF NOT EXISTS idx_query_audit_evidence_id ON query_audit(evidence_bundle_id);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_source_table_created ON query_audit(source_id, table_name, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_fingerprint_created ON query_audit(query_fingerprint, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_created ON query_audit(created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_tenant_created ON query_audit(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_capability_created ON query_audit(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_principal_created ON query_audit(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_object_created ON query_audit(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_primary_key_created ON query_audit(primary_key_value, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_writeback_job ON writeback_receipts(writeback_job_id);
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_idempotency_key ON writeback_receipts(idempotency_key);
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_status_created ON writeback_receipts(status, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_replay_records_created ON replay_records(created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_approvals_proposal_id ON approvals(proposal_id);
+      CREATE INDEX IF NOT EXISTS idx_approvals_status_created ON approvals(status, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_proposal_events_kind_created ON proposal_events(kind, created_at);
+    `);
+  }
+  ensureColumn(table, column, definition) {
+    const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
+    if (columns.some((row) => isRecord2(row) && row.name === column)) return;
+    this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  }
+  backfillSearchColumns() {
+    const proposals2 = this.db.prepare("SELECT proposal_id, action, change_set_json FROM proposals").all();
+    for (const row of proposals2) {
+      if (!isRecord2(row)) continue;
+      try {
+        const changeSet = parseChangeSet(JSON.parse(String(row.change_set_json)));
+        this.db.prepare("UPDATE proposals SET principal = COALESCE(principal, ?), capability = COALESCE(capability, ?) WHERE proposal_id = ?").run(changeSet.principal.id, changeSet.action, String(row.proposal_id));
+      } catch {
+      }
+    }
+    const evidenceRows = this.db.prepare("SELECT evidence_bundle_id, proposal_id, payload_json FROM evidence_bundles").all();
+    for (const row of evidenceRows) {
+      if (!isRecord2(row)) continue;
+      const proposal = row.proposal_id == null ? void 0 : this.getProposal(String(row.proposal_id));
+      let payload = {};
+      try {
+        payload = JSON.parse(String(row.payload_json));
+      } catch {
+        payload = {};
+      }
+      const metadata = this.evidenceMetadata({
+        proposal,
+        payload,
+        items: this.evidenceItems(String(row.evidence_bundle_id)).map((item) => item.item)
+      });
+      this.db.prepare(`
+        UPDATE evidence_bundles
+        SET principal = COALESCE(principal, ?),
+            capability = COALESCE(capability, ?),
+            source_id = COALESCE(source_id, ?),
+            source_table = COALESCE(source_table, ?),
+            business_object = COALESCE(business_object, ?),
+            object_id = COALESCE(object_id, ?),
+            query_fingerprint = COALESCE(query_fingerprint, ?)
+        WHERE evidence_bundle_id = ?
+      `).run(
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.source_id ?? null,
+        metadata.source_table ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.query_fingerprint ?? null,
+        String(row.evidence_bundle_id)
+      );
+    }
+    const auditRows = this.db.prepare("SELECT audit_id, proposal_id, evidence_bundle_id, payload_json FROM query_audit").all();
+    for (const row of auditRows) {
+      if (!isRecord2(row)) continue;
+      const proposal = row.proposal_id == null ? void 0 : this.getProposal(String(row.proposal_id));
+      const evidence2 = row.evidence_bundle_id == null ? void 0 : this.getEvidenceBundle(String(row.evidence_bundle_id));
+      let payload = {};
+      try {
+        payload = JSON.parse(String(row.payload_json));
+      } catch {
+        payload = {};
+      }
+      const metadata = this.queryAuditMetadata({ proposal, evidence: evidence2, payload });
+      this.db.prepare(`
+        UPDATE query_audit
+        SET tenant_id = COALESCE(tenant_id, ?),
+            principal = COALESCE(principal, ?),
+            capability = COALESCE(capability, ?),
+            business_object = COALESCE(business_object, ?),
+            object_id = COALESCE(object_id, ?),
+            primary_key_value = COALESCE(primary_key_value, ?)
+        WHERE audit_id = ?
+      `).run(
+        metadata.tenant_id ?? null,
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.primary_key_value ?? null,
+        Number(row.audit_id)
+      );
+    }
   }
   createProposal(input) {
     const changeSet = parseChangeSet(input);
@@ -1377,6 +1601,10 @@ var ProposalStore = class {
         action,
         state,
         tenant_id,
+        principal,
+        capability,
+        interaction_id,
+        tool_call_id,
         business_object,
         object_id,
         source_kind,
@@ -1387,7 +1615,7 @@ var ProposalStore = class {
         change_set_json,
         created_at,
         updated_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
     this.transaction(() => {
       insert.run(
@@ -1397,6 +1625,10 @@ var ProposalStore = class {
         changeSet.action,
         state,
         changeSet.scope.tenant_id,
+        changeSet.principal.id,
+        changeSet.action,
+        null,
+        null,
         changeSet.scope.business_object,
         changeSet.scope.object_id,
         changeSet.source.kind,
@@ -1424,10 +1656,44 @@ var ProposalStore = class {
     const row = this.db.prepare("SELECT * FROM proposals WHERE proposal_id = ?").get(proposalId);
     return rowToProposal(row);
   }
-  listProposals(state) {
-    const rows = state ? this.db.prepare("SELECT * FROM proposals WHERE state = ? ORDER BY created_at DESC").all(state) : this.db.prepare("SELECT * FROM proposals ORDER BY created_at DESC").all();
+  listProposals(filters) {
+    if (typeof filters === "string") filters = { state: filters };
+    const query = buildProposalQuery(filters ?? {});
+    const rows = this.db.prepare(query.sql).all(...query.params);
     return rows.map((row) => rowToProposal(row)).filter((proposal) => proposal !== void 0);
   }
+  listEvidenceBundles(filters = {}) {
+    const query = buildEvidenceQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map((row) => this.rowToEvidenceBundle(row)).filter((evidence2) => evidence2 !== void 0);
+  }
+  listQueryAudit(filters = {}) {
+    const query = buildQueryAuditQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map(rowToQueryAudit).filter((record) => record !== void 0);
+  }
+  getQueryAudit(auditId) {
+    return rowToQueryAudit(this.db.prepare("SELECT * FROM query_audit WHERE audit_id = ?").get(auditId));
+  }
+  listReceipts(filters = {}) {
+    const query = buildReceiptQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map(rowToReceipt).filter((receipt) => receipt !== void 0);
+  }
+  getReceipt(receiptId) {
+    return rowToReceipt(this.db.prepare("SELECT * FROM writeback_receipts WHERE receipt_id = ?").get(receiptId));
+  }
+  getReplayByReplayId(replayId) {
+    const prefix = "replay_";
+    const proposalId = replayId.startsWith(prefix) ? replayId.slice(prefix.length) : replayId;
+    return this.replay(proposalId);
+  }
+  proposalIdForEvidence(evidenceBundleId) {
+    const evidence2 = this.getEvidenceBundle(evidenceBundleId);
+    if (evidence2?.proposal_id) return evidence2.proposal_id;
+    const row = this.db.prepare("SELECT proposal_id FROM query_audit WHERE evidence_bundle_id = ? AND proposal_id IS NOT NULL ORDER BY created_at DESC LIMIT 1").get(evidenceBundleId);
+    return isRecord2(row) && row.proposal_id != null ? String(row.proposal_id) : void 0;
+  }
   approveProposal(proposalId, options) {
     const proposal = this.requireProposal(proposalId);
     assertWritebackAllowed(proposal, "approved");
@@ -1691,17 +1957,38 @@ var ProposalStore = class {
   recordEvidenceBundle(input) {
     assertNoSecretMaterial({ payload: input.payload, items: input.items ?? [] }, "evidence_bundle");
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (input.proposal_id) this.requireProposal(input.proposal_id);
+    const proposal = input.proposal_id ? this.requireProposal(input.proposal_id) : void 0;
+    const metadata = this.evidenceMetadata({ proposal, payload: input.payload, items: input.items ?? [] });
     this.transaction(() => {
       this.db.prepare(`
         INSERT OR REPLACE INTO evidence_bundles (
           evidence_bundle_id,
           proposal_id,
           tenant_id,
+          principal,
+          capability,
+          source_id,
+          source_table,
+          business_object,
+          object_id,
+          query_fingerprint,
           payload_json,
           created_at
-        ) VALUES (?, ?, ?, ?, ?)
-      `).run(input.evidence_bundle_id, input.proposal_id ?? null, input.tenant_id, JSON.stringify(input.payload), now);
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        input.evidence_bundle_id,
+        input.proposal_id ?? null,
+        input.tenant_id,
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.source_id ?? null,
+        metadata.source_table ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.query_fingerprint ?? null,
+        JSON.stringify(input.payload),
+        now
+      );
       for (const item of input.items ?? []) {
         this.db.prepare(`
           INSERT INTO evidence_items (evidence_bundle_id, item_json, created_at)
@@ -1719,21 +2006,35 @@ var ProposalStore = class {
   recordQueryAudit(input) {
     assertNoSecretMaterial(input.payload, "query_audit");
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (input.proposal_id) this.requireProposal(input.proposal_id);
+    const proposal = input.proposal_id ? this.requireProposal(input.proposal_id) : void 0;
+    const evidence2 = input.evidence_bundle_id ? this.getEvidenceBundle(input.evidence_bundle_id) : void 0;
+    const metadata = this.queryAuditMetadata({ proposal, evidence: evidence2, payload: input.payload });
     this.db.prepare(`
       INSERT INTO query_audit (
         proposal_id,
         evidence_bundle_id,
+        tenant_id,
+        principal,
+        capability,
+        business_object,
+        object_id,
+        primary_key_value,
         source_id,
         query_fingerprint,
         table_name,
         row_count,
         payload_json,
         created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `).run(
       input.proposal_id ?? null,
       input.evidence_bundle_id ?? null,
+      metadata.tenant_id ?? null,
+      metadata.principal ?? null,
+      metadata.capability ?? null,
+      metadata.business_object ?? null,
+      metadata.object_id ?? null,
+      metadata.primary_key_value ?? null,
       input.source_id,
       input.query_fingerprint,
       input.table_name,
@@ -1744,14 +2045,24 @@ var ProposalStore = class {
   }
   getEvidenceBundle(evidenceBundleId) {
     const row = this.db.prepare("SELECT * FROM evidence_bundles WHERE evidence_bundle_id = ?").get(evidenceBundleId);
+    return this.rowToEvidenceBundle(row);
+  }
+  rowToEvidenceBundle(row) {
     if (!isRecord2(row)) return void 0;
     return {
       evidence_bundle_id: String(row.evidence_bundle_id),
       proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
       tenant_id: String(row.tenant_id),
+      principal: row.principal == null ? void 0 : String(row.principal),
+      capability: row.capability == null ? void 0 : String(row.capability),
+      source_id: row.source_id == null ? void 0 : String(row.source_id),
+      source_table: row.source_table == null ? void 0 : String(row.source_table),
+      business_object: row.business_object == null ? void 0 : String(row.business_object),
+      object_id: row.object_id == null ? void 0 : String(row.object_id),
+      query_fingerprint: row.query_fingerprint == null ? void 0 : String(row.query_fingerprint),
       payload: JSON.parse(String(row.payload_json)),
-      items: this.evidenceItems(evidenceBundleId),
-      query_audit: this.queryAuditByEvidence(evidenceBundleId),
+      items: this.evidenceItems(String(row.evidence_bundle_id)),
+      query_audit: this.queryAuditByEvidence(String(row.evidence_bundle_id)),
       created_at: String(row.created_at)
     };
   }
@@ -1896,6 +2207,8 @@ var ProposalStore = class {
         proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
         tenant_id: String(row.tenant_id),
         payload: JSON.parse(String(row.payload_json)),
+        items: this.evidenceItems(String(row.evidence_bundle_id)),
+        query_audit: this.queryAuditByEvidence(String(row.evidence_bundle_id)),
         created_at: String(row.created_at)
       });
     }
@@ -1915,6 +2228,81 @@ var ProposalStore = class {
     }
     return records;
   }
+  evidenceMetadata(input) {
+    if (input.proposal) {
+      return {
+        principal: input.proposal.change_set.principal.id,
+        capability: input.proposal.action,
+        source_id: input.proposal.source_id,
+        source_table: `${input.proposal.source_schema}.${input.proposal.source_table}`,
+        business_object: input.proposal.business_object,
+        object_id: input.proposal.object_id,
+        query_fingerprint: input.proposal.change_set.evidence.query_fingerprint
+      };
+    }
+    const firstItem = input.items.find(isRecord2);
+    const primaryKey = isRecord2(firstItem?.primary_key) ? firstItem.primary_key : void 0;
+    const principal = stringFromPrincipal(input.payload.principal);
+    const table = stringFromUnknown(input.payload.target) ?? stringFromUnknown(firstItem?.table);
+    return {
+      principal,
+      capability: stringFromUnknown(input.payload.capability),
+      source_id: stringFromUnknown(input.payload.source_id) ?? stringFromUnknown(firstItem?.source_id),
+      source_table: table,
+      business_object: table ? lastIdentifier(table) : void 0,
+      object_id: primaryKey ? stringFromUnknown(primaryKey.value) : void 0,
+      query_fingerprint: stringFromUnknown(input.payload.query_fingerprint)
+    };
+  }
+  queryAuditMetadata(input) {
+    if (input.proposal) {
+      return {
+        tenant_id: input.proposal.tenant_id,
+        principal: input.proposal.change_set.principal.id,
+        capability: input.proposal.action,
+        business_object: input.proposal.business_object,
+        object_id: input.proposal.object_id,
+        primary_key_value: String(input.proposal.change_set.source.primary_key.value)
+      };
+    }
+    const firstItem = input.evidence?.items.find((item) => isRecord2(item.item))?.item;
+    const primaryKey = isRecord2(firstItem?.primary_key) ? firstItem.primary_key : void 0;
+    return {
+      tenant_id: input.evidence?.tenant_id ?? stringFromUnknown(input.payload.tenant_id),
+      principal: input.evidence?.principal ?? stringFromPrincipal(input.payload.principal),
+      capability: input.evidence?.capability ?? stringFromUnknown(input.payload.capability),
+      business_object: input.evidence?.business_object ?? stringFromUnknown(input.payload.business_object),
+      object_id: input.evidence?.object_id ?? stringFromUnknown(input.payload.object_id),
+      primary_key_value: primaryKey ? stringFromUnknown(primaryKey.value) : input.evidence?.object_id ?? stringFromUnknown(input.payload.primary_key_value)
+    };
+  }
+  countTable(table) {
+    return this.countWhere(table, "1 = 1", []);
+  }
+  countWhere(table, where, params) {
+    const row = this.db.prepare(`SELECT COUNT(*) AS count FROM ${table} WHERE ${where}`).get(...params);
+    return isRecord2(row) ? Number(row.count ?? 0) : 0;
+  }
+  numberValue(sql) {
+    const row = this.db.prepare(sql).get();
+    if (!isRecord2(row)) return 0;
+    const value = Object.values(row)[0];
+    return typeof value === "number" ? value : Number(value ?? 0);
+  }
+  stringColumn(sql, params, column) {
+    return this.db.prepare(sql).all(...params).map((row) => isRecord2(row) ? row[column] : void 0).filter((value) => typeof value === "string" || typeof value === "number").map(String);
+  }
+  evidenceIdsForPrune(cutoffIso, proposalIds) {
+    const proposalWhere = inWhere("proposal_id", proposalIds);
+    if (!proposalWhere) {
+      return this.stringColumn("SELECT evidence_bundle_id FROM evidence_bundles WHERE created_at < ?", [cutoffIso], "evidence_bundle_id");
+    }
+    return this.stringColumn(
+      `SELECT evidence_bundle_id FROM evidence_bundles WHERE created_at < ? OR ${proposalWhere.sql}`,
+      [cutoffIso, ...proposalWhere.params],
+      "evidence_bundle_id"
+    );
+  }
   transaction(fn) {
     this.db.exec("BEGIN IMMEDIATE");
     try {
@@ -1933,6 +2321,133 @@ function stateFromChangeSet(changeSet) {
   if (changeSet.approval.status === "canceled") return "canceled";
   return "pending_review";
 }
+function inWhere(column, values) {
+  if (values.length === 0) return void 0;
+  return {
+    sql: `${column} IN (${values.map(() => "?").join(", ")})`,
+    params: values
+  };
+}
+function buildProposalQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "source_table", filters.table);
+  addEqual(clauses, params, "state", filters.status ?? filters.state);
+  addEqual(clauses, params, "action", filters.capability ?? filters.action);
+  addObjectFilter(clauses, params, "business_object", "source_table", "object_id", filters.objectType, filters.objectId);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM proposals", clauses, params, filters.limit);
+}
+function buildEvidenceQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "evidence_bundle_id", filters.evidence);
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "capability", filters.capability);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "source_table", filters.table);
+  addEqual(clauses, params, "query_fingerprint", filters.queryFingerprint);
+  addObjectFilter(clauses, params, "business_object", "source_table", "object_id", filters.objectType, filters.objectId);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM evidence_bundles", clauses, params, filters.limit);
+}
+function buildQueryAuditQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "capability", filters.capability);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "evidence_bundle_id", filters.evidence);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "table_name", filters.table);
+  addObjectFilter(clauses, params, "business_object", "table_name", "object_id", filters.objectType, filters.objectId);
+  addEqual(clauses, params, "primary_key_value", filters.primaryKey);
+  addEqual(clauses, params, "query_fingerprint", filters.queryFingerprint);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM query_audit", clauses, params, filters.limit);
+}
+function buildReceiptQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "receipt_id", filters.receipt);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "writeback_job_id", filters.writebackJob);
+  addEqual(clauses, params, "idempotency_key", filters.idempotencyKey);
+  addEqual(clauses, params, "status", filters.status);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM writeback_receipts", clauses, params, filters.limit);
+}
+function addEqual(clauses, params, column, value) {
+  if (!value) return;
+  clauses.push(`${column} = ?`);
+  params.push(value);
+}
+function addTableFilter(clauses, params, column, value) {
+  if (!value) return;
+  if (value.includes(".")) {
+    clauses.push(`${column} = ?`);
+    params.push(value);
+    return;
+  }
+  clauses.push(`(${column} = ? OR ${column} = ?)`);
+  params.push(value, `public.${value}`);
+}
+function addObjectFilter(clauses, params, typeColumn, tableColumn, idColumn, objectType, objectId) {
+  if (objectId) {
+    clauses.push(`${idColumn} = ?`);
+    params.push(objectId);
+  }
+  if (!objectType) return;
+  const variants = objectTypeVariants(objectType);
+  const placeholders = variants.map(() => "?").join(", ");
+  clauses.push(`(${typeColumn} IN (${placeholders}) OR ${tableColumn} IN (${placeholders}))`);
+  params.push(...variants, ...variants);
+}
+function addTimeRange(clauses, params, column, from, to) {
+  if (from) {
+    clauses.push(`${column} >= ?`);
+    params.push(from);
+  }
+  if (to) {
+    clauses.push(`${column} <= ?`);
+    params.push(to);
+  }
+}
+function finishQuery(base, clauses, params, limit) {
+  const where = clauses.length ? ` WHERE ${clauses.join(" AND ")}` : "";
+  const sql = `${base}${where} ORDER BY created_at DESC${limit ? " LIMIT ?" : ""}`;
+  return { sql, params: limit ? [...params, limit] : params };
+}
+function objectTypeVariants(value) {
+  const variants = /* @__PURE__ */ new Set([value]);
+  if (value.endsWith("s")) variants.add(value.slice(0, -1));
+  else variants.add(`${value}s`);
+  for (const variant of [...variants]) {
+    if (!variant.includes(".")) variants.add(`public.${variant}`);
+  }
+  return [...variants];
+}
+function stringFromUnknown(value) {
+  if (typeof value === "string" && value.trim()) return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return void 0;
+}
+function stringFromPrincipal(value) {
+  if (typeof value === "string") return value;
+  if (isRecord2(value)) return stringFromUnknown(value.id);
+  return void 0;
+}
+function lastIdentifier(value) {
+  const parts = value.split(".");
+  return parts[parts.length - 1] ?? value;
+}
 function stateFromReceipt(receipt) {
   if (receipt.status === "applied" || receipt.status === "already_applied") return "applied";
   if (receipt.status === "conflict") return "conflict";
@@ -2007,6 +2522,10 @@ function rowToProposal(row) {
     action: String(row.action),
     state: String(row.state),
     tenant_id: String(row.tenant_id),
+    principal: row.principal == null ? void 0 : String(row.principal),
+    capability: row.capability == null ? void 0 : String(row.capability),
+    interaction_id: row.interaction_id == null ? void 0 : String(row.interaction_id),
+    tool_call_id: row.tool_call_id == null ? void 0 : String(row.tool_call_id),
     business_object: String(row.business_object),
     object_id: String(row.object_id),
     source_kind: String(row.source_kind),
@@ -2033,6 +2552,7 @@ function rowToEvent(row) {
 function rowToReceipt(row) {
   if (!isRecord2(row)) return void 0;
   return {
+    receipt_id: Number(row.receipt_id),
     writeback_job_id: String(row.writeback_job_id),
     proposal_id: String(row.proposal_id),
     runner_id: String(row.runner_id),
@@ -2049,6 +2569,12 @@ function rowToQueryAudit(row) {
     audit_id: Number(row.audit_id),
     proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
     evidence_bundle_id: row.evidence_bundle_id == null ? void 0 : String(row.evidence_bundle_id),
+    tenant_id: row.tenant_id == null ? void 0 : String(row.tenant_id),
+    principal: row.principal == null ? void 0 : String(row.principal),
+    capability: row.capability == null ? void 0 : String(row.capability),
+    business_object: row.business_object == null ? void 0 : String(row.business_object),
+    object_id: row.object_id == null ? void 0 : String(row.object_id),
+    primary_key_value: row.primary_key_value == null ? void 0 : String(row.primary_key_value),
     source_id: String(row.source_id),
     query_fingerprint: String(row.query_fingerprint),
     table_name: String(row.table_name),
@@ -2158,7 +2684,7 @@ function createMcpRuntime(config, options = {}) {
 }
 function createSynapsorMcpServer(runtime) {
   const server = new McpServer(
-    { name: "synapsor-runner", version: "0.1.0-alpha.2" },
+    { name: "synapsor-runner", version: "0.1.0-alpha.4" },
     { capabilities: { tools: {}, resources: {} } }
   );
   if (runtime.config.mode === "cloud") {
@@ -2798,9 +3324,9 @@ function readLocalResource(store, uri) {
     return { proposal, events: store.events(id), receipts: store.receipts(id) };
   }
   if (collection === "evidence") {
-    const evidence = store.getEvidenceBundle(id);
-    if (!evidence) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Evidence bundle not found: ${id}`);
-    return evidence;
+    const evidence2 = store.getEvidenceBundle(id);
+    if (!evidence2) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Evidence bundle not found: ${id}`);
+    return evidence2;
   }
   if (collection === "replay") {
     const proposalId = id.startsWith("replay_") ? id.slice("replay_".length) : id;
@@ -4392,7 +4918,7 @@ async function handleRequest(input) {
   }
   if (request.method === "GET" && url.pathname === "/") {
     response.setHeader("set-cookie", `synapsor_ui_token=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/`);
-    sendHtml(response, renderShell(csrfToken, tour || url.searchParams.get("tour") === "1"));
+    sendHtml(response, renderShell(csrfToken, tour || url.searchParams.get("tour") === "1", configPath, storePath));
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/summary") {
@@ -4691,8 +5217,10 @@ function sendHtml(response, html) {
   response.setHeader("cache-control", "no-store");
   response.end(html);
 }
-function renderShell(csrfToken, tour = false) {
+function renderShell(csrfToken, tour = false, configPath = "synapsor.runner.json", storePath = "./.synapsor/local.db") {
   const escapedCsrf = escapeScriptString(csrfToken);
+  const escapedConfigPath = escapeScriptString(configPath);
+  const escapedStorePath = escapeScriptString(storePath);
   const tourHtml = tour ? `
     <div class="card full tour">
       <h2>Commit-safe MCP in one loop</h2>
@@ -4822,6 +5350,8 @@ details.raw > summary { cursor:pointer; color:var(--blue); font-weight:600; font
 </main>
 <script>
 const csrfToken = "${escapedCsrf}";
+const configPath = "${escapedConfigPath}";
+const storePath = "${escapedStorePath}";
 const state = { selected: null, firstId: null };
 const byId = (id) => document.getElementById(id);
 const text = (tag, value, className = "") => { const node = document.createElement(tag); node.textContent = value == null ? "" : String(value); if (className) node.className = className; return node; };
@@ -4915,6 +5445,13 @@ function guardDrawer(gc) {
   d.append(kv);
   return d;
 }
+function shellQuote(value) {
+  const text = String(value || "");
+  return /^[A-Za-z0-9_./:@=-]+$/.test(text) ? text : "'" + text.replace(/'/g, "'\\\\''") + "'";
+}
+function trustedApplyCommand(proposalId) {
+  return "synapsor apply " + shellQuote(proposalId) + " --config " + shellQuote(configPath) + " --store " + shellQuote(storePath);
+}
 async function loadSummary() {
   const payload = await api("/api/summary");
   const root = byId("summary"); root.replaceChildren(text("h2", "Setup summary"));
@@ -5109,6 +5646,24 @@ async function loadDetail(proposalId) {
     const reject = el("button", { class: "danger", text: "Reject", onclick: async () => { await api("/api/proposals/" + encodeURIComponent(proposalId) + "/reject", { method: "POST", headers: { "x-synapsor-csrf": csrfToken }, body: JSON.stringify({ actor: actor.value, reason: reason.value || "rejected from local UI", confirm: "reject" }) }); await loadProposals(); await loadDetail(proposalId); } });
     actions.append(approve, reject);
     reviewPane.append(el("div", { class: "callout", text: "You are the approval authority here \u2014 the model cannot reach these controls." }), actor, reason, actions);
+  } else if (proposal.state === "approved" || proposal.state === "pending_worker") {
+    const command = trustedApplyCommand(proposalId);
+    const commandBox = el("div", { class: "mono", text: command, style: "display:block;margin-top:8px" });
+    const copied = el("span", { class: "status-line", text: "" });
+    const copy = el("button", { text: "Copy guarded apply command", onclick: async () => {
+      try {
+        await navigator.clipboard.writeText(command);
+        copied.textContent = "Copied. Run this from a trusted terminal with write credentials.";
+      } catch {
+        copied.textContent = "Copy this guarded apply command and run it from a trusted terminal with write credentials.";
+      }
+    } });
+    reviewPane.append(
+      el("div", { class: "callout", text: "Apply guarded writeback from a trusted terminal. This remains outside MCP, so the model still cannot commit." }),
+      commandBox,
+      el("div", { class: "actions" }, [copy]),
+      copied,
+    );
   }
 
   jsonPane.append(
@@ -5162,8 +5717,97 @@ function stringOrDefault(value, fallback) {
 // apps/runner/src/cli.ts
 var adapters = { postgres: postgresAdapter, mysql: mysqlAdapter };
 var handlerReceiptStatuses = /* @__PURE__ */ new Set(["applied", "already_applied", "conflict", "failed"]);
+var dangerousDatabaseMcpAuditExample = {
+  tools: [
+    {
+      name: "execute_sql",
+      description: "Execute arbitrary SQL against the application database.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          sql: { type: "string" }
+        },
+        required: ["sql"]
+      }
+    },
+    {
+      name: "run_query",
+      description: "Run any query and return database rows.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: { type: "string" },
+          table: { type: "string" },
+          columns: {
+            type: "array",
+            items: { type: "string" }
+          }
+        },
+        required: ["query"]
+      }
+    },
+    {
+      name: "approve_refund",
+      description: "Approve and issue a customer refund immediately.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          refund_id: { type: "string" },
+          tenant_id: { type: "string" },
+          amount_cents: { type: "number" }
+        },
+        required: ["refund_id", "tenant_id", "amount_cents"]
+      }
+    },
+    {
+      name: "update_customer",
+      description: "Update a customer record directly.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          customer_id: { type: "string" },
+          tenant_id: { type: "string" },
+          column: { type: "string" },
+          value: { type: "string" }
+        },
+        required: ["customer_id", "tenant_id", "column", "value"]
+      }
+    },
+    {
+      name: "delete_order",
+      description: "Delete an order from the database.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          order_id: { type: "string" },
+          tenant_id: { type: "string" }
+        },
+        required: ["order_id", "tenant_id"]
+      }
+    },
+    {
+      name: "query_database",
+      description: "Query arbitrary tables and columns from the database.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          database: { type: "string" },
+          schema: { type: "string" },
+          table: { type: "string" },
+          columns: {
+            type: "array",
+            items: { type: "string" }
+          },
+          where: { type: "string" }
+        },
+        required: ["table"]
+      }
+    }
+  ]
+};
 var defaultConfigPath = "synapsor.runner.json";
 var defaultStorePath = "./.synapsor/local.db";
+var quickDemoStorePath = "./.synapsor/quick-demo.db";
 var referenceDemoDir = "examples/reference-support-billing-app";
 var referenceDemoConfigPath = `${referenceDemoDir}/synapsor.runner.json`;
 var referenceDemoContainer = "synapsor_runner_reference_support_billing";
@@ -5186,6 +5830,14 @@ async function main(argv) {
     usage([]);
     return 0;
   }
+  if (!isKnownTopLevelCommand(command)) {
+    process2.stderr.write(`Unknown command: synapsor ${command}
+
+Try:
+synapsor --help
+`);
+    return 2;
+  }
   if (isHelpRequest(rest)) {
     usage([command, ...rest.filter((arg) => arg !== "--help" && arg !== "-h")]);
     return 0;
@@ -5213,9 +5865,18 @@ async function main(argv) {
   if (command === "benchmark") return benchmark(rest);
   if (command === "proposals") return proposals(rest);
   if (command === "replay") return replay(rest);
+  if (command === "evidence") return evidence(rest);
+  if (command === "query-audit") return queryAudit(rest);
+  if (command === "receipts") return receipts(rest);
+  if (command === "activity") return activity(rest);
+  if (command === "store") return storeCommand(rest);
   if (command === "shadow") return shadow(rest);
   if (command === "ui") return ui(rest);
-  usage([]);
+  process2.stderr.write(`Unknown command: synapsor ${command}
+
+Try:
+synapsor --help
+`);
   return 2;
 }
 async function init(args) {
@@ -6039,6 +6700,49 @@ function formatLocalDoctorReport(report) {
   return `${lines.join("\n")}
 `;
 }
+function formatLocalDoctorMarkdown(report) {
+  const store = report.store_stats;
+  const boundaryOk = report.checks.find((check) => check.name === "mcp-tool-boundary")?.ok === true;
+  const lines = [
+    "# Synapsor Runner Doctor Report",
+    "",
+    `- Runner package: @synapsor/runner`,
+    `- Node version: ${process2.versions.node}`,
+    `- Config: ${report.config_path}`,
+    `- Mode: ${report.mode}`,
+    `- Status: ${report.ok ? "ok" : "needs attention"}`,
+    "",
+    "## Semantic Tools",
+    "",
+    ...report.tools.length ? report.tools.map((tool) => `- ${tool}`) : ["- none listed"],
+    "",
+    "## Safety Boundary",
+    "",
+    `- Raw SQL / commit tools exposed: ${boundaryOk ? "no obvious forbidden tools detected" : "needs review"}`,
+    "- Database URLs, passwords, bearer tokens, and private keys are intentionally not included in this report.",
+    "",
+    "## Local Store",
+    "",
+    `- Path: ${store?.path ?? "not configured"}`,
+    `- Exists: ${store?.exists ? "yes" : "no"}`,
+    ...store?.exists ? [
+      `- Proposals: ${store.proposals ?? 0}`,
+      `- Evidence bundles: ${store.evidence ?? 0}`,
+      `- Query audit records: ${store.query_audit ?? 0}`,
+      `- Receipts: ${store.receipts ?? 0}`
+    ] : [],
+    "",
+    "## Checks",
+    "",
+    ...report.checks.map((check) => `- ${check.level.toUpperCase()} ${check.name}: ${check.message}`),
+    "",
+    "## Redaction Note",
+    "",
+    "This report is redacted by design. Do not attach raw database URLs, passwords, API keys, bearer tokens, private keys, cookies, or customer data when sharing diagnostics."
+  ];
+  return `${lines.join("\n")}
+`;
+}
 var moduleDir = path3.dirname(fileURLToPath(import.meta.url));
 var packageAssetRoot = path3.resolve(moduleDir, "..");
 var sourceAssetRoot = path3.resolve(moduleDir, "../../..");
@@ -6391,9 +7095,16 @@ async function localDoctor(args) {
     mode: String(parsed.mode),
     config_path: configPath,
     checks,
-    tools: tools2
+    tools: tools2,
+    store_stats: await localDoctorStoreStats(optionalArg(args, "--store") ?? parsed.storage?.sqlite_path)
   };
-  if (args.includes("--json")) {
+  if (args.includes("--report")) {
+    const output = outputArg(args) ?? "synapsor-doctor.md";
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, formatLocalDoctorMarkdown(report), "utf8");
+    process2.stdout.write(`wrote redacted doctor report: ${output}
+`);
+  } else if (args.includes("--json")) {
     process2.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
   } else {
@@ -6401,6 +7112,23 @@ async function localDoctor(args) {
   }
   return report.ok ? 0 : 1;
 }
+async function localDoctorStoreStats(storePath) {
+  if (!storePath || storePath === ":memory:") return { path: storePath ?? "not configured", exists: storePath === ":memory:" };
+  if (!await fileExists(storePath)) return { path: storePath, exists: false };
+  const store = new ProposalStore(storePath);
+  try {
+    return {
+      path: storePath,
+      exists: true,
+      proposals: store.listProposals({ limit: 1e6 }).length,
+      evidence: store.listEvidenceBundles({ limit: 1e6 }).length,
+      query_audit: store.listQueryAudit({ limit: 1e6 }).length,
+      receipts: store.listReceipts({ limit: 1e6 }).length
+    };
+  } finally {
+    store.close();
+  }
+}
 async function validate(args) {
   const job = await readJob(args);
   parseWritebackJob(job);
@@ -6479,21 +7207,21 @@ async function applyProposal(args, proposalId) {
         lease_seconds: Number(optionalArg(args, "--lease-seconds") ?? "300")
       });
       const result = await applySqlJob(job, configPath, storePath, dryRun, envWithDemoDefaults(config, configPath));
-      process2.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(result, null, 2)}
+` : formatApplyResult(parseWritebackJob(job), result, dryRun, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     const executor = executorConfig(config, executorName);
     if (executor.type === "http_handler") {
       const result = await applyHttpHandlerProposal({ store, proposalId: resolvedProposalId, proposal, executorName, executor, runnerId, dryRun, env: envWithDemoDefaults(config, configPath) });
-      process2.stdout.write(`${JSON.stringify(redactConfig(result), null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(redactConfig(result), null, 2)}
+` : formatHandlerApplyResult(result, resolvedProposalId, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     if (executor.type === "command_handler") {
       const result = await applyCommandHandlerProposal({ store, proposalId: resolvedProposalId, proposal, executorName, executor, runnerId, dryRun, env: envWithDemoDefaults(config, configPath) });
-      process2.stdout.write(`${JSON.stringify(redactConfig(result), null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(redactConfig(result), null, 2)}
+` : formatHandlerApplyResult(result, resolvedProposalId, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     throw new Error(`unsupported executor type for ${executorName}`);
@@ -6669,8 +7397,8 @@ function prepareHandlerProposal(store, proposal, runnerId) {
   };
 }
 function duplicateHandlerReceipt(store, proposalId) {
-  const receipts = store.receipts(proposalId);
-  const existing = receipts.find((receipt) => receipt.writeback_job_id.startsWith("hwb_"));
+  const receipts2 = store.receipts(proposalId);
+  const existing = receipts2.find((receipt) => receipt.writeback_job_id.startsWith("hwb_"));
   return existing ? { receipt: existing.receipt } : void 0;
 }
 function alreadyAppliedReceipt(receipt, runnerId) {
@@ -6749,6 +7477,107 @@ function buildHandlerReceipt(input) {
 function hashReceipt(input) {
   return `sha256:${crypto5.createHash("sha256").update(JSON.stringify(input)).digest("hex")}`;
 }
+function formatApplyResult(job, result, dryRun, storePath) {
+  const status = writebackResultStatus(result);
+  const affectedRows = writebackAffectedRows(result);
+  const errorCode = writebackErrorCode(result);
+  const receiptHash = writebackReceiptHash(result);
+  const conflictGuardPassed = status === "conflict" && errorCode === "VERSION_CONFLICT" ? "no" : status === "applied" ? "yes" : "not completed";
+  const title = status === "conflict" ? "Guarded writeback returned conflict." : status === "failed" ? "Guarded writeback failed." : dryRun ? "Guarded writeback dry run passed." : affectedRows === 0 ? "Guarded writeback already applied." : "Guarded writeback applied.";
+  const lines = [
+    title,
+    "",
+    "Checks:",
+    "* proposal approved: yes",
+    `* primary key matched: ${status === "conflict" && errorCode === "ROW_NOT_FOUND" ? "no" : status === "failed" ? "not completed" : "yes"}`,
+    `* tenant guard matched: ${status === "conflict" && errorCode === "ROW_NOT_FOUND" ? "no" : status === "failed" ? "not completed" : "yes"}`,
+    "* allowed columns only: yes",
+    `* conflict guard passed: ${conflictGuardPassed}`,
+    `* affected rows: ${affectedRows}`,
+    `* idempotency key: ${job.idempotency_key}`,
+    ""
+  ];
+  if (status === "conflict") {
+    lines.push(
+      errorCode === "VERSION_CONFLICT" ? "The row changed after the agent saw it." : "The target row was not available under the primary-key and tenant guard.",
+      "",
+      "Result:",
+      "conflict",
+      "",
+      "Source DB changed by Synapsor:",
+      "no",
+      "",
+      "Why:",
+      errorCode === "VERSION_CONFLICT" ? "conflict/version guard did not match" : errorCode || "guarded writeback returned conflict",
+      ""
+    );
+  }
+  if (status === "failed") {
+    lines.push("Error:", errorCode || "writeback failed", "");
+  }
+  lines.push(
+    "Receipt:",
+    receiptHash || "(stored locally)",
+    "",
+    "Replay:",
+    `${cliCommandName()} replay ${job.proposal_id} --store ${storePath}`,
+    ""
+  );
+  return `${lines.join("\n")}
+`;
+}
+function formatHandlerApplyResult(receipt, proposalId, storePath) {
+  const title = receipt.status === "conflict" ? "App-owned writeback returned conflict." : receipt.status === "failed" ? "App-owned writeback failed." : receipt.status === "already_applied" ? "App-owned writeback already applied." : "App-owned writeback applied.";
+  const lines = [
+    title,
+    "",
+    "Checks:",
+    "* proposal approved: yes",
+    "* execution authority: app-owned handler outside MCP",
+    `* source database changed by handler: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    `* affected rows: ${receipt.rows_affected}`,
+    `* idempotency key: ${receipt.idempotency_key}`,
+    ""
+  ];
+  if (receipt.status === "conflict") {
+    lines.push(
+      "Result:",
+      "conflict",
+      "",
+      "Why:",
+      receipt.safe_error_code || "handler returned conflict",
+      ""
+    );
+  }
+  if (receipt.status === "failed") {
+    lines.push("Error:", receipt.safe_error_code || "handler writeback failed", "");
+  }
+  lines.push(
+    "Receipt:",
+    receipt.receipt_hash,
+    "",
+    "Replay:",
+    `${cliCommandName()} replay ${proposalId} --store ${storePath}`,
+    ""
+  );
+  return `${lines.join("\n")}
+`;
+}
+function writebackResultStatus(result) {
+  return String(result.status ?? "unknown");
+}
+function writebackAffectedRows(result) {
+  const value = result.affected_rows ?? result.rows_affected ?? 0;
+  return Number.isFinite(Number(value)) ? Number(value) : 0;
+}
+function writebackErrorCode(result) {
+  const value = result.error_code ?? result.safe_error_code;
+  return typeof value === "string" && value ? value : void 0;
+}
+function writebackReceiptHash(result) {
+  const value = result.result_hash ?? result.receipt_hash;
+  return typeof value === "string" && value ? value : void 0;
+}
 function parseOptionalJson(text) {
   if (!text.trim()) return {};
   try {
@@ -6912,7 +7741,7 @@ async function cloudConnect(args) {
     return 1;
   }
   const runnerId = String(parsed.cloud.runner_id || process2.env.SYNAPSOR_RUNNER_ID || "synapsor_runner_local").trim();
-  const runnerVersion = String(parsed.cloud.runner_version || process2.env.npm_package_version || "0.1.0-alpha.2").trim();
+  const runnerVersion = String(parsed.cloud.runner_version || process2.env.npm_package_version || "0.1.0-alpha.4").trim();
   const engines = normalizeEngines(parsed.cloud.engines);
   const capabilities = normalizeCapabilities(parsed.cloud.capabilities);
   const client = new ControlPlaneClient({
@@ -7015,8 +7844,16 @@ async function demo(args) {
   return prepareReferenceDemo(args);
 }
 async function quickDemo() {
+  const seeded = await seedQuickDemoStore(quickDemoStorePath);
   process2.stdout.write([
-    "Synapsor Runner quick demo (fixture-only)",
+    "Synapsor Runner quick demo",
+    "",
+    "This is a fixture-only first look. It does not start Docker, connect a database,",
+    "or require an MCP client. It writes an inspectable local ledger fixture to:",
+    quickDemoStorePath,
+    "",
+    "If you ran this through one-off npx and did not install the package, prefix",
+    "follow-up commands with: npx -y -p @synapsor/runner@alpha synapsor",
     "",
     "Raw MCP shape:",
     "execute_sql(sql: string)",
@@ -7027,7 +7864,7 @@ async function quickDemo() {
     "billing.propose_late_fee_waiver(invoice_id, reason)",
     "",
     "Agent requested:",
-    'billing.propose_late_fee_waiver(invoice_id="INV-3001")',
+    'billing.propose_late_fee_waiver(invoice_id="INV-3001", reason="approved support waiver")',
     "",
     "Trusted context:",
     "tenant_id = acme",
@@ -7043,47 +7880,215 @@ async function quickDemo() {
     "required outside MCP",
     "",
     "Replay:",
-    "available after approval/apply",
+    `${seeded.replay_id} captures the local proposal, evidence handle, query audit, and events.`,
+    "",
+    "Inspect this local fixture:",
+    `${cliCommandName()} proposals show latest --store ${quickDemoStorePath}`,
+    `${cliCommandName()} evidence show ${seeded.evidence_bundle_id} --store ${quickDemoStorePath}`,
+    `${cliCommandName()} activity search --object invoice:INV-3001 --store ${quickDemoStorePath}`,
+    `${cliCommandName()} replay show --proposal ${seeded.proposal_id} --store ${quickDemoStorePath}`,
     "",
-    "Next:",
+    "Approve the fixture outside MCP:",
+    `${cliCommandName()} proposals approve latest --yes --store ${quickDemoStorePath}`,
+    `${cliCommandName()} replay show latest --store ${quickDemoStorePath}`,
+    "",
+    "For real guarded writeback against disposable Postgres:",
     `${cliCommandName()} demo`,
-    `${cliCommandName()} audit <your-mcp-tools.json>`,
+    "",
+    "Audit risky MCP database tools:",
+    `${cliCommandName()} audit --example dangerous-db-mcp`,
     ""
   ].join("\n"));
   return 0;
 }
-async function mcpServe(args) {
-  const configPath = optionalArg(args, "--config") ?? process2.env.SYNAPSOR_MCP_CONFIG;
-  const readOnly = args.includes("--read-only");
-  const config = readOnly ? { ...await readRuntimeConfig(configPath ?? defaultConfigPath), mode: "read_only" } : void 0;
-  await serveStdio({
-    configPath,
-    storePath: optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE,
-    config
-  });
-  return 0;
-}
-async function mcpAudit(args) {
-  const json = args.includes("--json");
-  const target2 = firstPositional(args);
-  if (!target2) {
-    throw new Error("mcp audit requires <target>");
+async function seedQuickDemoStore(storePath) {
+  const resolved = path3.resolve(storePath);
+  await fs3.mkdir(path3.dirname(resolved), { recursive: true });
+  await fs3.rm(resolved, { force: true });
+  const store = new ProposalStore(resolved);
+  try {
+    const changeSet = quickDemoChangeSet();
+    const proposal = store.createProposal(changeSet);
+    store.recordEvidenceBundle({
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      proposal_id: proposal.proposal_id,
+      tenant_id: changeSet.scope.tenant_id,
+      payload: {
+        capability: changeSet.action,
+        proposal_id: proposal.proposal_id,
+        source_id: changeSet.source.source_id,
+        target: `${changeSet.source.schema}.${changeSet.source.table}`,
+        principal: changeSet.principal.id,
+        tenant_id: changeSet.scope.tenant_id,
+        business_object: changeSet.scope.business_object,
+        object_id: changeSet.scope.object_id,
+        query_fingerprint: changeSet.evidence.query_fingerprint,
+        source_database_changed: false
+      },
+      items: [
+        {
+          kind: "external_row",
+          source_id: changeSet.source.source_id,
+          table: `${changeSet.source.schema}.${changeSet.source.table}`,
+          primary_key: changeSet.source.primary_key,
+          tenant: changeSet.guards.tenant,
+          visible_row: changeSet.before
+        },
+        {
+          kind: "proposal_diff",
+          before: changeSet.before,
+          patch: changeSet.patch,
+          after: changeSet.after
+        }
+      ]
+    });
+    store.recordQueryAudit({
+      proposal_id: proposal.proposal_id,
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      source_id: changeSet.source.source_id,
+      query_fingerprint: changeSet.evidence.query_fingerprint,
+      table_name: `${changeSet.source.schema}.${changeSet.source.table}`,
+      row_count: 1,
+      payload: {
+        capability: changeSet.action,
+        tenant_bound: true,
+        statement_template: "SELECT id, tenant_id, updated_at, late_fee_cents FROM invoices WHERE id = ? AND tenant_id = ? LIMIT 1",
+        parameters_redacted: true
+      }
+    });
+    store.replay(proposal.proposal_id);
+    return {
+      proposal_id: proposal.proposal_id,
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      replay_id: `replay_${proposal.proposal_id}`
+    };
+  } finally {
+    store.close();
   }
-  const timeoutMs = Number(optionalArg(args, "--timeout-ms") ?? "5000");
-  const payload = await readMcpAuditTarget(target2, args, timeoutMs);
-  const report = auditMcpManifest(payload, { target: target2 });
-  process2.stdout.write(json ? `${JSON.stringify(report, null, 2)}
-` : formatMcpAuditReport(report));
-  return 0;
 }
-async function propose(args) {
-  const capabilityName = firstPositional(args);
-  if (!capabilityName) throw new Error("propose requires <capability-name>");
-  const configPath = optionalArg(args, "--config") ?? defaultConfigPath;
-  const storePath = optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE ?? defaultStorePath;
-  const config = await readRuntimeConfig(configPath);
-  const capability = (config.capabilities ?? []).find((item) => item.name === capabilityName);
-  if (!capability) throw new Error(`proposal capability not found: ${capabilityName}`);
+function quickDemoChangeSet() {
+  const base = {
+    schema_version: protocolVersions.changeSet,
+    proposal_id: "wrp_quick_INV_3001",
+    proposal_version: 1,
+    action: "billing.propose_late_fee_waiver",
+    mode: "review_required",
+    principal: {
+      id: "support.agent",
+      source: "trusted_session"
+    },
+    scope: {
+      tenant_id: "acme",
+      business_object: "invoice",
+      object_id: "INV-3001"
+    },
+    source: {
+      kind: "external_postgres",
+      source_id: "app_postgres",
+      schema: "public",
+      table: "invoices",
+      primary_key: {
+        column: "id",
+        value: "INV-3001"
+      }
+    },
+    before: {
+      id: "INV-3001",
+      tenant_id: "acme",
+      updated_at: "2026-06-23T09:00:00Z",
+      late_fee_cents: 5500
+    },
+    patch: {
+      late_fee_cents: 0
+    },
+    after: {
+      id: "INV-3001",
+      tenant_id: "acme",
+      updated_at: "2026-06-23T09:00:00Z",
+      late_fee_cents: 0
+    },
+    guards: {
+      tenant: {
+        column: "tenant_id",
+        value: "acme"
+      },
+      allowed_columns: ["late_fee_cents"],
+      expected_version: {
+        column: "updated_at",
+        value: "2026-06-23T09:00:00Z"
+      }
+    },
+    evidence: {
+      bundle_id: "ev_quick_INV_3001",
+      query_fingerprint: "sha256:quick-demo-invoice-read",
+      items: [
+        {
+          kind: "external_row",
+          source_id: "app_postgres",
+          table: "public.invoices",
+          primary_key: { column: "id", value: "INV-3001" }
+        }
+      ]
+    },
+    approval: {
+      status: "pending",
+      required_role: "local_operator"
+    },
+    writeback: {
+      status: "not_applied",
+      mode: "trusted_worker_required"
+    },
+    source_database_mutated: false,
+    integrity: {
+      proposal_hash: "sha256:placeholder"
+    },
+    created_at: "2026-06-23T09:00:00Z"
+  };
+  return {
+    ...base,
+    integrity: {
+      proposal_hash: hashReceipt({ ...base, integrity: void 0 })
+    }
+  };
+}
+async function mcpServe(args) {
+  const configPath = optionalArg(args, "--config") ?? process2.env.SYNAPSOR_MCP_CONFIG;
+  const readOnly = args.includes("--read-only");
+  const config = readOnly ? { ...await readRuntimeConfig(configPath ?? defaultConfigPath), mode: "read_only" } : void 0;
+  await serveStdio({
+    configPath,
+    storePath: optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE,
+    config
+  });
+  return 0;
+}
+async function mcpAudit(args) {
+  const format = optionalArg(args, "--format") ?? (args.includes("--json") ? "json" : "text");
+  if (!["text", "json", "markdown"].includes(format)) {
+    throw new Error("audit --format must be text, json, or markdown");
+  }
+  const example = optionalArg(args, "--example");
+  const target2 = example ? `example:${example}` : firstPositional(args);
+  if (!target2) {
+    throw new Error("mcp audit requires <target> or --example dangerous-db-mcp");
+  }
+  const timeoutMs = Number(optionalArg(args, "--timeout-ms") ?? "5000");
+  const payload = example ? builtInMcpAuditExample(example) : await readMcpAuditTarget(target2, args, timeoutMs);
+  const report = auditMcpManifest(payload, { target: target2 });
+  if (format === "json") process2.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+  else if (format === "markdown") process2.stdout.write(formatMcpAuditMarkdown(report));
+  else process2.stdout.write(formatMcpAuditReport(report));
+  return 0;
+}
+async function propose(args) {
+  const capabilityName = firstPositional(args);
+  if (!capabilityName) throw new Error("propose requires <capability-name>");
+  const configPath = optionalArg(args, "--config") ?? defaultConfigPath;
+  const storePath = optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE ?? defaultStorePath;
+  const config = await readRuntimeConfig(configPath);
+  const capability = (config.capabilities ?? []).find((item) => item.name === capabilityName);
+  if (!capability) throw new Error(`proposal capability not found: ${capabilityName}`);
   if (capability.kind !== "proposal") throw new Error(`${capabilityName} is a ${capability.kind} capability. Use a proposal capability with ${cliCommandName()} propose.`);
   const input = await proposalInput(args, capability);
   const env = envWithDemoDefaults(config, configPath);
@@ -7106,8 +8111,9 @@ async function audit(args) {
   const url = optionalArg(args, "--url");
   const stdio = optionalArg(args, "--stdio");
   const mcpConfig2 = optionalArg(args, "--mcp-config");
-  const target2 = url ?? (stdio ? `stdio:${stdio}` : mcpConfig2 ?? firstPositional(args));
-  if (!target2) throw new Error("audit requires <target>, --mcp-config <path>, --stdio <command>, or --url <url>");
+  const example = optionalArg(args, "--example");
+  const target2 = example ? `example:${example}` : url ?? (stdio ? `stdio:${stdio}` : mcpConfig2 ?? firstPositional(args));
+  if (!target2) throw new Error("audit requires <target>, --example dangerous-db-mcp, --mcp-config <path>, --stdio <command>, or --url <url>");
   const forwarded = args.filter((arg, index) => {
     const previous = args[index - 1];
     return !["--url", "--stdio", "--mcp-config"].includes(arg) && !["--url", "--stdio", "--mcp-config"].includes(previous ?? "");
@@ -7137,13 +8143,13 @@ function sampleInputForCapability(capability) {
   const input = {};
   for (const [name, spec] of Object.entries(capability.args)) {
     if (name === capability.lookup.id_from_arg) input[name] = sampleIdForCapability(capability, name);
-    else if (/reason/i.test(name)) input[name] = "approved support waiver";
+    else if (/reason/i.test(name)) input[name] = sampleReasonForCapability(capability);
     else if (/resolution/i.test(name)) input[name] = "Resolved after reviewing policy evidence.";
+    else if (spec.enum?.length) input[name] = spec.enum[0];
     else if (/status/i.test(name)) input[name] = "pending_review";
     else if (/amount|cents|fee|credit|balance/i.test(name)) input[name] = typeof spec.maximum === "number" ? Math.min(spec.maximum, 1e3) : 0;
     else if (spec.type === "number") input[name] = spec.minimum ?? 1;
     else if (spec.type === "boolean") input[name] = true;
-    else if (spec.enum?.length) input[name] = spec.enum[0];
     else input[name] = `sample_${name}`;
   }
   const missing = Object.entries(capability.args).filter(([, spec]) => spec.required !== false).filter(([name]) => input[name] === void 0).map(([name]) => name);
@@ -7154,12 +8160,20 @@ function sampleInputForCapability(capability) {
 }
 function sampleIdForCapability(capability, argName) {
   const text = `${capability.name} ${capability.target.table} ${argName}`.toLowerCase();
+  const arg = argName.toLowerCase();
   if (/invoice|billing/.test(text)) return "INV-3001";
+  if (/account|customer/.test(arg) || /accounts|customers/.test(text)) return "cust_acme_1";
   if (/ticket|support/.test(text)) return "T-1042";
-  if (/order/.test(text)) return "ord_1001";
-  if (/account|customer/.test(text)) return "cust_acme_1";
+  if (/order/.test(text)) return "O-1001";
   return "sample_1";
 }
+function sampleReasonForCapability(capability) {
+  const text = `${capability.name} ${capability.target.table}`.toLowerCase();
+  if (/order|status_change/.test(text)) return "payment cleared and ready for the next status";
+  if (/credit|customer|account/.test(text)) return "support goodwill credit";
+  if (/late_fee|waiver|billing|invoice/.test(text)) return "approved support waiver";
+  return "reviewed and approved by support";
+}
 function formatProposeResult(capabilityName, result, storePath) {
   const proposalId = String(result.proposal_id ?? "");
   const evidenceId = String(result.evidence_bundle_id ?? "");
@@ -7723,6 +8737,10 @@ async function readMcpAuditTarget(target2, args, timeoutMs) {
   }
   return parsed;
 }
+function builtInMcpAuditExample(example) {
+  if (example === "dangerous-db-mcp") return dangerousDatabaseMcpAuditExample;
+  throw new Error(`unknown audit example: ${example}. Available examples: dangerous-db-mcp`);
+}
 function isRunnerConfigLike(value) {
   return isRecord6(value) && value.version === 1 && Array.isArray(value.capabilities);
 }
@@ -7813,12 +8831,50 @@ async function proposals(args) {
 }
 async function replay(args) {
   const [subcommand, ...rest] = args;
+  if (subcommand === "list") return replayList(rest);
   if (subcommand && !["show", "export"].includes(subcommand)) return replayShow(args);
   if (subcommand === "show") return replayShow(rest);
   if (subcommand === "export") return replayExport(rest);
   usage(["replay"]);
   return 2;
 }
+async function evidence(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "show") return evidenceShow(rest);
+  if (subcommand === "list") return evidenceList(rest);
+  if (subcommand === "export") return evidenceExport(rest);
+  usage(["evidence"]);
+  return 2;
+}
+async function queryAudit(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "list") return queryAuditList(rest);
+  if (subcommand === "show") return queryAuditShow(rest);
+  if (subcommand === "export") return queryAuditExport(rest);
+  usage(["query-audit"]);
+  return 2;
+}
+async function receipts(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "list") return receiptsList(rest);
+  if (subcommand === "show") return receiptsShow(rest);
+  usage(["receipts"]);
+  return 2;
+}
+async function activity(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "search") return activitySearch(rest);
+  usage(["activity"]);
+  return 2;
+}
+async function storeCommand(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "stats") return storeStats(rest);
+  if (subcommand === "vacuum") return storeVacuum(rest);
+  if (subcommand === "prune") return storePrune(rest);
+  usage(["store"]);
+  return 2;
+}
 async function shadow(args) {
   const [subcommand, ...rest] = args;
   if (subcommand === "list") return shadowList(rest);
@@ -7939,10 +8995,11 @@ async function shadowReport(args) {
   }
 }
 async function proposalsList(args) {
+  assertKnownOptions(args, proposalListAllowedOptions, "proposals list");
   const store = await openLocalStore(args);
   try {
-    const state = optionalArg(args, "--state");
-    const rows = store.listProposals(state);
+    const filters = proposalFiltersFromArgs(args);
+    const rows = store.listProposals(filters);
     if (args.includes("--json")) {
       process2.stdout.write(`${JSON.stringify({ proposals: rows }, null, 2)}
 `);
@@ -7968,12 +9025,13 @@ async function proposalsShow(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = store.getProposal(resolvedProposalId);
     if (!proposal) throw new Error(`proposal not found: ${resolvedProposalId}`);
-    const payload = { proposal, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId) };
+    const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+    const payload = { proposal, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId), evidence: evidence2 };
     if (args.includes("--json")) {
       process2.stdout.write(`${JSON.stringify(payload, null, 2)}
 `);
     } else {
-      process2.stdout.write(formatProposalDetail(proposal));
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
       for (const event of payload.events) {
         process2.stdout.write(`event ${event.event_id}: ${event.kind} by ${event.actor} at ${event.created_at}
 `);
@@ -7992,7 +9050,8 @@ async function proposalsApprove(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = requireLocalProposal(store, resolvedProposalId);
     if (!args.includes("--json")) {
-      process2.stdout.write(formatProposalDetail(proposal));
+      const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
     }
     await confirmDangerousAction(args, `Approve proposal ${resolvedProposalId} for guarded writeback?`);
     const updated = store.approveProposal(resolvedProposalId, {
@@ -8019,7 +9078,8 @@ async function proposalsReject(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = requireLocalProposal(store, resolvedProposalId);
     if (!args.includes("--json")) {
-      process2.stdout.write(formatProposalDetail(proposal));
+      const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
     }
     await confirmDangerousAction(args, `Reject proposal ${resolvedProposalId}?`);
     const updated = store.rejectProposal(resolvedProposalId, {
@@ -8063,28 +9123,180 @@ async function proposalsWritebackJob(args) {
     store.close();
   }
 }
-async function replayShow(args) {
-  const proposalId = positional(args, 0);
-  if (!proposalId) throw new Error("replay show requires <proposal_id>");
+async function evidenceList(args) {
+  assertKnownOptions(args, evidenceListAllowedOptions, "evidence list");
   const store = await openLocalStore(args);
   try {
-    const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
-    const replayRecord = store.replay(resolvedProposalId);
+    const rows = store.listEvidenceBundles(evidenceFiltersFromArgs(args));
     if (args.includes("--json")) {
-      process2.stdout.write(`${JSON.stringify(replayRecord, null, 2)}
+      process2.stdout.write(`${JSON.stringify({ evidence: rows }, null, 2)}
 `);
+    } else if (rows.length === 0) {
+      process2.stdout.write("No evidence bundles found.\n");
     } else {
-      process2.stdout.write(`Replay ${replayRecord.replay_id}
+      for (const bundle of rows) process2.stdout.write(formatEvidenceSummary(bundle));
+    }
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function evidenceShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "evidence show");
+  const evidenceId = positional(args, 0);
+  if (!evidenceId) throw new Error("evidence show requires <evidence_bundle_id>");
+  const store = await openLocalStore(args);
+  try {
+    const evidence2 = store.getEvidenceBundle(evidenceId);
+    if (!evidence2) throw new Error(`evidence bundle not found: ${evidenceId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(evidence2, null, 2)}
+`);
+    else process2.stdout.write(formatEvidenceDetail(evidence2));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function evidenceExport(args) {
+  assertKnownOptions(args, exportAllowedOptions, "evidence export");
+  const evidenceId = positional(args, 0) ?? optionalArg(args, "--evidence");
+  if (!evidenceId) throw new Error("evidence export requires <evidence_bundle_id>");
+  const output = outputArg(args);
+  if (!output) throw new Error("evidence export requires --output <path>");
+  const format = exportFormat(args);
+  const store = await openLocalStore(args);
+  try {
+    const evidence2 = store.getEvidenceBundle(evidenceId);
+    if (!evidence2) throw new Error(`evidence bundle not found: ${evidenceId}`);
+    const text = format === "json" ? `${JSON.stringify(evidence2, null, 2)}
+` : formatEvidenceMarkdown(evidence2);
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, text, "utf8");
+    process2.stdout.write(`exported ${evidence2.evidence_bundle_id} to ${output}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditList(args) {
+  assertKnownOptions(args, queryAuditListAllowedOptions, "query-audit list");
+  const store = await openLocalStore(args);
+  try {
+    const rows = store.listQueryAudit(queryAuditFiltersFromArgs(args));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ query_audit: rows }, null, 2)}
+`);
+    else if (rows.length === 0) process2.stdout.write("No query audit records found.\n");
+    else for (const row of rows) process2.stdout.write(formatQueryAuditSummary(row));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "query-audit show");
+  const auditId = Number(positional(args, 0));
+  if (!Number.isInteger(auditId) || auditId <= 0) throw new Error("query-audit show requires <audit_id>");
+  const store = await openLocalStore(args);
+  try {
+    const row = store.getQueryAudit(auditId);
+    if (!row) throw new Error(`query audit record not found: ${auditId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(row, null, 2)}
 `);
-      process2.stdout.write(formatProposalDetail(replayRecord.proposal));
-      process2.stdout.write(`events: ${replayRecord.events.length}
+    else process2.stdout.write(formatQueryAuditDetail(row));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditExport(args) {
+  assertKnownOptions(args, exportAllowedOptions, "query-audit export");
+  const auditId = Number(positional(args, 0) ?? optionalArg(args, "--audit"));
+  if (!Number.isInteger(auditId) || auditId <= 0) throw new Error("query-audit export requires <audit_id>");
+  const output = outputArg(args);
+  if (!output) throw new Error("query-audit export requires --output <path>");
+  const format = exportFormat(args, ["json"]);
+  const store = await openLocalStore(args);
+  try {
+    const row = store.getQueryAudit(auditId);
+    if (!row) throw new Error(`query audit record not found: ${auditId}`);
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, `${JSON.stringify(row, null, 2)}
+`, "utf8");
+    process2.stdout.write(`exported query audit ${auditId} to ${output}
 `);
-      process2.stdout.write(`receipts: ${replayRecord.receipts.length}
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function receiptsList(args) {
+  assertKnownOptions(args, receiptListAllowedOptions, "receipts list");
+  const store = await openLocalStore(args);
+  try {
+    const rows = store.listReceipts(receiptFiltersFromArgs(args));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ receipts: rows }, null, 2)}
+`);
+    else if (rows.length === 0) process2.stdout.write("No writeback receipts found.\n");
+    else for (const receipt of rows) process2.stdout.write(formatReceiptSummary(receipt));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function receiptsShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "receipts show");
+  const receiptId = Number(positional(args, 0));
+  if (!Number.isInteger(receiptId) || receiptId <= 0) throw new Error("receipts show requires <receipt_id>");
+  const store = await openLocalStore(args);
+  try {
+    const receipt = store.getReceipt(receiptId);
+    if (!receipt) throw new Error(`writeback receipt not found: ${receiptId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(receipt, null, 2)}
 `);
-      process2.stdout.write(`evidence bundles: ${replayRecord.evidence.length}
+    else process2.stdout.write(formatReceiptDetail(receipt));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function replayList(args) {
+  assertKnownOptions(args, replayListAllowedOptions, "replay list");
+  const store = await openLocalStore(args);
+  try {
+    const filters = proposalFiltersFromReplayArgs(args, store);
+    const proposals2 = store.listProposals(filters);
+    const rows = proposals2.map((proposal) => ({
+      replay_id: `replay_${proposal.proposal_id}`,
+      proposal_id: proposal.proposal_id,
+      created_at: proposal.created_at,
+      state: proposal.state,
+      tenant_id: proposal.tenant_id,
+      principal: proposal.principal ?? proposal.change_set.principal.id,
+      capability: proposal.action,
+      business_object: proposal.business_object,
+      object_id: proposal.object_id
+    }));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ replays: rows }, null, 2)}
 `);
-      process2.stdout.write(`query audit records: ${replayRecord.query_audit.length}
+    else if (rows.length === 0) process2.stdout.write("No replay records found.\n");
+    else for (const row of rows) process2.stdout.write(formatReplaySummary(row));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function replayShow(args) {
+  assertKnownOptions(args, replayShowAllowedOptions, "replay show");
+  const store = await openLocalStore(args);
+  try {
+    const resolvedProposalId = resolveReplayProposalId(args, store);
+    const replayRecord = store.replay(resolvedProposalId);
+    if (args.includes("--json")) {
+      process2.stdout.write(`${JSON.stringify(replayRecord, null, 2)}
 `);
+    } else {
+      process2.stdout.write(formatReplayDetail(replayRecord));
     }
     return 0;
   } finally {
@@ -8092,17 +9304,18 @@ async function replayShow(args) {
   }
 }
 async function replayExport(args) {
-  const proposalId = positional(args, 0);
-  if (!proposalId) throw new Error("replay export requires <proposal_id>");
+  assertKnownOptions(args, replayExportAllowedOptions, "replay export");
   const output = outputArg(args);
   if (!output) throw new Error("replay export requires --output <path>");
+  const format = exportFormat(args);
   const store = await openLocalStore(args);
   try {
-    const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
+    const resolvedProposalId = resolveReplayProposalId(args, store);
     const replayRecord = store.replay(resolvedProposalId);
+    const text = format === "json" ? `${JSON.stringify(replayRecord, null, 2)}
+` : formatReplayMarkdown(replayRecord);
     await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
-    await fs3.writeFile(output, `${JSON.stringify(replayRecord, null, 2)}
-`, "utf8");
+    await fs3.writeFile(output, text, "utf8");
     process2.stdout.write(`exported ${replayRecord.replay_id} to ${output}
 `);
     return 0;
@@ -8110,9 +9323,421 @@ async function replayExport(args) {
     store.close();
   }
 }
+async function activitySearch(args) {
+  assertKnownOptions(args, activitySearchAllowedOptions, "activity search");
+  const store = await openLocalStore(args);
+  try {
+    const proposalFilters = proposalFiltersFromActivityArgs(args, store);
+    const evidenceFilters = evidenceFiltersFromActivityArgs(args, store);
+    const queryAuditFilters = queryAuditFiltersFromActivityArgs(args, store);
+    const receiptFilters = receiptFiltersFromActivityArgs(args, store);
+    const proposals2 = store.listProposals(proposalFilters);
+    const evidenceRows = store.listEvidenceBundles(evidenceFilters);
+    const queryAuditRows = store.listQueryAudit(queryAuditFilters);
+    const receiptsRows = store.listReceipts(receiptFilters);
+    const proposalIds = new Set(proposals2.map((proposal) => proposal.proposal_id));
+    const evidenceIds = new Set(evidenceRows.map((evidence2) => evidence2.evidence_bundle_id));
+    const results = proposals2.map((proposal) => activityFromProposal(proposal));
+    for (const evidence2 of evidenceRows) {
+      if (evidence2.proposal_id && proposalIds.has(evidence2.proposal_id)) continue;
+      results.push(activityFromEvidence(evidence2));
+    }
+    for (const audit2 of queryAuditRows) {
+      const proposalId = stringField(audit2, "proposal_id");
+      const evidenceId = stringField(audit2, "evidence_bundle_id");
+      if (proposalId && proposalIds.has(proposalId)) continue;
+      if (evidenceId && evidenceIds.has(evidenceId)) continue;
+      results.push(activityFromQueryAudit(audit2));
+    }
+    for (const receipt of receiptsRows) {
+      if (proposalIds.has(receipt.proposal_id)) continue;
+      results.push(activityFromReceipt(receipt));
+    }
+    const sorted = results.sort((left, right) => String(right.created_at ?? "").localeCompare(String(left.created_at ?? ""))).slice(0, limitFromArgs(args));
+    if (args.includes("--json")) {
+      process2.stdout.write(`${JSON.stringify({ interactions: sorted }, null, 2)}
+`);
+    } else if (sorted.length === 0) {
+      process2.stdout.write("No local interactions found.\n");
+    } else {
+      process2.stdout.write(`Found ${sorted.length} local interaction${sorted.length === 1 ? "" : "s"}
+
+`);
+      sorted.forEach((item, index) => process2.stdout.write(formatActivityItem(item, index + 1)));
+    }
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storeStats(args) {
+  assertKnownOptions(args, storeStatsAllowedOptions, "store stats");
+  const store = await openLocalStore(args);
+  try {
+    const stats = store.stats();
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(stats, null, 2)}
+`);
+    else process2.stdout.write(formatStoreStats(stats));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storeVacuum(args) {
+  assertKnownOptions(args, storeVacuumAllowedOptions, "store vacuum");
+  const store = await openLocalStore(args);
+  try {
+    const before = store.stats();
+    store.vacuum();
+    const after = store.stats();
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ before, after }, null, 2)}
+`);
+    else process2.stdout.write(`vacuumed local store ${before.path}
+approx bytes: ${before.approx_bytes} -> ${after.approx_bytes}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storePrune(args) {
+  assertKnownOptions(args, storePruneAllowedOptions, "store prune");
+  const olderThan = optionalArg(args, "--older-than");
+  if (!olderThan) throw new Error("store prune requires --older-than <duration>, for example --older-than 30d");
+  if (args.includes("--yes") && args.includes("--dry-run")) throw new Error("store prune accepts either --dry-run or --yes, not both");
+  const cutoff = cutoffFromOlderThan(olderThan);
+  const dryRun = !args.includes("--yes");
+  const store = await openLocalStore(args);
+  try {
+    const result = store.pruneBefore(cutoff, { dryRun });
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    else process2.stdout.write(formatStorePrune(result));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+var commonReadOptions = /* @__PURE__ */ new Set(["--store", "--json"]);
+var showAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var exportAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--output", "--out", "--format", "--evidence", "--audit"]);
+var proposalListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--action",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--status",
+  "--state",
+  "--source",
+  "--table",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var evidenceListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--proposal",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--source",
+  "--table",
+  "--query-fingerprint",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var queryAuditListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--proposal",
+  "--evidence",
+  "--source",
+  "--table",
+  "--primary-key",
+  "--query-fingerprint",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var receiptListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--proposal",
+  "--writeback-job",
+  "--idempotency-key",
+  "--status",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var replayShowAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--proposal", "--replay", "--evidence"]);
+var replayExportAllowedOptions = /* @__PURE__ */ new Set([...replayShowAllowedOptions, "--output", "--out", "--format"]);
+var replayListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--proposal",
+  "--evidence",
+  "--receipt",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--status",
+  "--state",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var activitySearchAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--proposal",
+  "--evidence",
+  "--replay",
+  "--receipt",
+  "--source",
+  "--table",
+  "--query-fingerprint",
+  "--status",
+  "--state",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var storeStatsAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var storeVacuumAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var storePruneAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--older-than", "--dry-run", "--yes"]);
+function assertKnownOptions(args, allowed, commandName) {
+  for (const arg of args) {
+    if (!arg.startsWith("--")) continue;
+    const option = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
+    if (option === "--help" || option === "-h") continue;
+    if (!allowed.has(option)) throw new Error(`Unknown option for ${commandName}: ${option}`);
+  }
+}
+function proposalFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    proposal: optionalArg(args, "--proposal"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    action: optionalArg(args, "--action"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    status: optionalArg(args, "--status"),
+    state: optionalArg(args, "--state"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function evidenceFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    evidence: optionalArg(args, "--evidence"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function queryAuditFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal"),
+    evidence: optionalArg(args, "--evidence"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    primaryKey: optionalArg(args, "--primary-key"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function receiptFiltersFromArgs(args) {
+  return {
+    receipt: optionalArg(args, "--receipt"),
+    proposal: optionalArg(args, "--proposal"),
+    writebackJob: optionalArg(args, "--writeback-job"),
+    idempotencyKey: optionalArg(args, "--idempotency-key"),
+    status: optionalArg(args, "--status"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function proposalFiltersFromReplayArgs(args, store) {
+  return proposalFiltersFromActivityArgs(args, store);
+}
+function proposalFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store);
+  return {
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    action: optionalArg(args, "--capability"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    status: optionalArg(args, "--status"),
+    state: optionalArg(args, "--state"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function evidenceFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store, { includeEvidence: false });
+  return {
+    evidence: optionalArg(args, "--evidence"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function queryAuditFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store, { includeEvidence: false });
+  return {
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    evidence: optionalArg(args, "--evidence"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function receiptFiltersFromActivityArgs(args, store) {
+  const linkedProposal = linkedProposalFilter(args, store, { includeReceipt: false });
+  return {
+    receipt: optionalArg(args, "--receipt"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    status: optionalArg(args, "--status") ?? optionalArg(args, "--state"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function linkedProposalFilter(args, store, options = {}) {
+  const noLinkedProposal = "__synapsor_no_linked_proposal__";
+  const replay2 = optionalArg(args, "--replay");
+  if (replay2) return proposalIdFromReplayId(replay2);
+  if (!store) return void 0;
+  if (options.includeEvidence !== false) {
+    const evidence2 = optionalArg(args, "--evidence");
+    if (evidence2) return store.proposalIdForEvidence(evidence2) ?? noLinkedProposal;
+  }
+  if (options.includeReceipt !== false) {
+    const receiptValue = optionalArg(args, "--receipt");
+    if (receiptValue) {
+      const receiptId = Number(receiptValue);
+      if (!Number.isInteger(receiptId) || receiptId <= 0) throw new Error("--receipt must be a positive receipt id");
+      return store.getReceipt(receiptId)?.proposal_id ?? noLinkedProposal;
+    }
+  }
+  return void 0;
+}
+function objectFilterFromArgs(args) {
+  const value = optionalArg(args, "--object");
+  if (!value) return {};
+  const separator = value.indexOf(":");
+  if (separator <= 0 || separator === value.length - 1) {
+    throw new Error("--object must use type:id, for example invoice:INV-3001");
+  }
+  return { type: value.slice(0, separator), id: value.slice(separator + 1) };
+}
+function limitFromArgs(args) {
+  const value = optionalArg(args, "--limit");
+  if (!value) return 20;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) throw new Error("--limit must be a positive integer");
+  return Math.min(parsed, 200);
+}
+function exportFormat(args, supported = ["json", "markdown"]) {
+  const format = optionalArg(args, "--format") ?? "json";
+  if (!supported.includes(format)) {
+    throw new Error(`unsupported export format: ${format}. Supported formats: ${supported.join(", ")}`);
+  }
+  return format;
+}
+function resolveReplayProposalId(args, store) {
+  const explicitProposal = optionalArg(args, "--proposal");
+  if (explicitProposal) return resolveProposalIdFromStore(explicitProposal, store);
+  const explicitReplay = optionalArg(args, "--replay");
+  if (explicitReplay) return proposalIdFromReplayId(explicitReplay);
+  const explicitEvidence = optionalArg(args, "--evidence");
+  if (explicitEvidence) {
+    const proposalId = store.proposalIdForEvidence(explicitEvidence);
+    if (!proposalId) throw new Error(`evidence bundle ${explicitEvidence} is not linked to a replayable proposal`);
+    return proposalId;
+  }
+  const value = positional(args, 0);
+  if (!value) throw new Error("replay show requires <proposal_id>, --proposal <proposal_id>, --replay <replay_id>, or --evidence <evidence_bundle_id>");
+  if (value === "latest") return resolveProposalIdFromStore(value, store);
+  if (value.startsWith("replay_")) return proposalIdFromReplayId(value);
+  if (value.startsWith("ev_")) throw new Error(`Use --evidence ${value} to replay from an evidence bundle.`);
+  return resolveProposalIdFromStore(value, store);
+}
+function proposalIdFromReplayId(replayId) {
+  if (!replayId.startsWith("replay_")) throw new Error(`invalid replay id: ${replayId}`);
+  const proposalId = replayId.slice("replay_".length);
+  if (!proposalId) throw new Error(`invalid replay id: ${replayId}`);
+  return proposalId;
+}
 async function openLocalStore(args) {
   const storePath = optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE ?? "./.synapsor/local.db";
   if (storePath !== ":memory:") {
+    if (!await fileExists(storePath)) throw missingLocalStoreError(storePath);
     await fs3.mkdir(path3.dirname(path3.resolve(storePath)), { recursive: true });
   }
   return new ProposalStore(storePath);
@@ -8157,6 +9782,7 @@ function requireLocalProposal(store, proposalId) {
 }
 async function resolveProposalId(proposalId, storePath) {
   if (proposalId !== "latest") return proposalId;
+  if (storePath !== ":memory:" && !await fileExists(storePath)) throw missingLocalStoreError(storePath);
   const store = new ProposalStore(storePath);
   try {
     return resolveProposalIdFromStore(proposalId, store);
@@ -8170,6 +9796,15 @@ function resolveProposalIdFromStore(proposalId, store) {
   if (!latest) throw new Error("no proposals found in the local store");
   return latest.proposal_id;
 }
+function missingLocalStoreError(storePath) {
+  return new Error([
+    `No local Synapsor proposal store was found at ${storePath}.`,
+    "Run:",
+    `${cliCommandName()} demo`,
+    "or pass:",
+    "--store /path/to/local.db"
+  ].join("\n"));
+}
 async function readRuntimeConfig(configPath) {
   const parsed = JSON.parse(await fs3.readFile(configPath, "utf8"));
   return parsed;
@@ -8320,24 +9955,36 @@ function firstPositional(args) {
     "--allowed-columns",
     "--approval-role",
     "--actor",
+    "--action",
+    "--audit",
     "--bearer-env",
+    "--capability",
     "--config",
     "--conflict-column",
     "--database-url-env",
     "--destination",
     "--engine",
+    "--evidence",
+    "--example",
+    "--format",
     "--from",
     "--from-env",
     "--host",
+    "--idempotency-key",
     "--input",
     "--job",
     "--lease-seconds",
+    "--limit",
     "--lookup-arg",
     "--mode",
     "--mcp-config",
     "--namespace",
     "--numeric-bound",
+    "--object",
+    "--object-id",
+    "--object-type",
     "--object-name",
+    "--older-than",
     "--output",
     "--out",
     "--patch-fixed",
@@ -8345,22 +9992,31 @@ function firstPositional(args) {
     "--port",
     "--primary-key",
     "--principal-env",
+    "--proposal",
     "--project",
+    "--query-fingerprint",
     "--reason",
     "--recipe",
+    "--receipt",
+    "--replay",
     "--runner",
     "--schema",
     "--source-name",
+    "--source",
     "--state",
+    "--status",
     "--stdio",
     "--store",
     "--table",
+    "--tenant",
     "--tenant-env",
     "--tenant-key",
     "--timeout-ms",
+    "--to",
     "--transition-guard",
     "--url",
     "--visible-columns",
+    "--writeback-job",
     "--write-url-env"
   ]);
   for (let index = 0; index < args.length; index += 1) {
@@ -8436,15 +10092,16 @@ function parseJsonRpcResponse(stdout, id) {
 }
 function formatProposalSummary(proposal) {
   return [
-    `${proposal.proposal_id}  ${proposal.state}  ${proposal.action}`,
+    `${proposal.created_at}  ${proposal.proposal_id}  ${proposal.state}  ${proposal.action}`,
+    `  object: ${proposal.business_object}:${proposal.object_id}`,
     `  target: ${proposal.source_kind}:${proposal.source_id}/${proposal.source_schema}.${proposal.source_table}/${proposal.object_id}`,
     `  tenant: ${proposal.tenant_id}  source changed: ${proposal.source_database_mutated ? "yes" : "no"}`
   ].join("\n") + "\n";
 }
-function formatProposalDetail(proposal) {
+function formatProposalDetail(proposal, storedEvidenceItemCount) {
   const changeSet = proposal.change_set;
   const conflictGuard = changeSet.guards.expected_version;
-  const evidenceItems = changeSet.evidence.items?.length ?? 0;
+  const evidenceItems = storedEvidenceItemCount ?? changeSet.evidence.items?.length ?? 0;
   const approvalStatus = currentApprovalStatus(proposal);
   const writebackStatus = currentWritebackStatus(proposal);
   return [
@@ -8471,6 +10128,386 @@ function formatProposalDetail(proposal) {
     })
   ].join("\n") + "\n";
 }
+function formatEvidenceSummary(evidence2) {
+  return [
+    `${evidence2.created_at}  ${evidence2.evidence_bundle_id}`,
+    `  tenant: ${evidence2.tenant_id}  capability: ${evidence2.capability ?? "unknown"}  proposal: ${evidence2.proposal_id ?? "none"}`,
+    `  source: ${evidence2.source_id ?? "unknown"}/${evidence2.source_table ?? "unknown"}  object: ${evidence2.business_object ?? "object"}:${evidence2.object_id ?? "unknown"}`
+  ].join("\n") + "\n";
+}
+function formatEvidenceDetail(evidence2) {
+  const audit2 = evidence2.query_audit[0];
+  const lines = [
+    `Evidence bundle: ${evidence2.evidence_bundle_id}`,
+    `Tenant: ${evidence2.tenant_id}`,
+    `Proposal: ${evidence2.proposal_id ?? "none"}`,
+    `Principal: ${evidence2.principal ?? "unknown"}`,
+    `Capability: ${evidence2.capability ?? "unknown"}`,
+    `Source: ${evidence2.source_id ?? "unknown"}`,
+    `Table: ${evidence2.source_table ?? "unknown"}`,
+    `Query fingerprint: ${evidence2.query_fingerprint ?? stringField(audit2, "query_fingerprint") ?? "unknown"}`,
+    `Rows captured: ${evidence2.items.length}`,
+    `Created at: ${evidence2.created_at}`,
+    "Projection: captured visible fields only; credentials and secret-looking values are rejected before persistence.",
+    "",
+    "Items:",
+    ...evidence2.items.flatMap((item, index) => formatEvidenceItem(item, index + 1)),
+    "",
+    "Related:",
+    ...evidence2.proposal_id ? [`  ${cliCommandName()} proposals show ${evidence2.proposal_id}`, `  ${cliCommandName()} replay show --proposal ${evidence2.proposal_id}`] : [],
+    `  ${cliCommandName()} query-audit list --evidence ${evidence2.evidence_bundle_id}`
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function formatEvidenceItem(item, index) {
+  const payload = isRecord6(item.item) ? item.item : item;
+  const visibleRow = isRecord6(payload.visible_row) ? payload.visible_row : payload;
+  const title = stringField(payload, "kind") ?? "item";
+  const primaryKey = isRecord6(payload.primary_key) ? payload.primary_key : void 0;
+  const heading = primaryKey ? `* ${title} ${formatScalar(primaryKey.value)}` : `* ${title} ${index}`;
+  const rows = Object.entries(visibleRow).filter(([key]) => !["kind", "source_id", "table", "primary_key", "tenant"].includes(key)).slice(0, 12).map(([key, value]) => `  ${key}: ${formatScalar(value)}`);
+  return [heading, ...rows.length ? rows : ["  (no scalar preview fields)"]];
+}
+function formatEvidenceMarkdown(evidence2) {
+  return [
+    `# Evidence ${evidence2.evidence_bundle_id}`,
+    "",
+    `- Tenant: ${evidence2.tenant_id}`,
+    `- Proposal: ${evidence2.proposal_id ?? "none"}`,
+    `- Principal: ${evidence2.principal ?? "unknown"}`,
+    `- Capability: ${evidence2.capability ?? "unknown"}`,
+    `- Source: ${evidence2.source_id ?? "unknown"}`,
+    `- Table: ${evidence2.source_table ?? "unknown"}`,
+    `- Query fingerprint: ${evidence2.query_fingerprint ?? "unknown"}`,
+    `- Created at: ${evidence2.created_at}`,
+    "",
+    "## Captured Items",
+    "",
+    "```json",
+    JSON.stringify(evidence2.items, null, 2),
+    "```",
+    "",
+    "## Query Audit",
+    "",
+    "```json",
+    JSON.stringify(evidence2.query_audit, null, 2),
+    "```"
+  ].join("\n") + "\n";
+}
+function formatQueryAuditSummary(row) {
+  return [
+    `${row.created_at}  audit ${row.audit_id}`,
+    `  source: ${row.source_id}/${row.table_name}  rows: ${row.row_count}  query: ${row.query_fingerprint}`,
+    `  proposal: ${row.proposal_id ?? "none"}  evidence: ${row.evidence_bundle_id ?? "none"}`
+  ].join("\n") + "\n";
+}
+function formatQueryAuditDetail(row) {
+  const payload = isRecord6(row.payload) ? row.payload : {};
+  return [
+    `Query audit: ${row.audit_id}`,
+    `Created at: ${row.created_at}`,
+    `Source: ${row.source_id}`,
+    `Table: ${row.table_name}`,
+    `Rows: ${row.row_count}`,
+    `Query fingerprint: ${row.query_fingerprint}`,
+    `Proposal: ${row.proposal_id ?? "none"}`,
+    `Evidence: ${row.evidence_bundle_id ?? "none"}`,
+    `Tenant: ${row.tenant_id ?? "unknown"}`,
+    `Capability: ${row.capability ?? payload.capability ?? "unknown"}`,
+    `Parameters redacted: ${payload.parameters_redacted === true ? "yes" : "unknown"}`,
+    "",
+    "Payload:",
+    JSON.stringify(payload, null, 2)
+  ].join("\n") + "\n";
+}
+function formatReceiptSummary(receipt) {
+  return [
+    `${receipt.created_at}  receipt ${receipt.receipt_id}  ${receipt.status}`,
+    `  proposal: ${receipt.proposal_id}  job: ${receipt.writeback_job_id}`,
+    `  idempotency: ${receipt.idempotency_key}  source changed: ${receipt.source_database_mutated ? "yes" : "no"}`
+  ].join("\n") + "\n";
+}
+function formatReceiptDetail(receipt) {
+  return [
+    `Receipt: ${receipt.receipt_id}`,
+    `Proposal: ${receipt.proposal_id}`,
+    `Writeback job: ${receipt.writeback_job_id}`,
+    `Runner: ${receipt.runner_id}`,
+    `Status: ${receipt.status}`,
+    `Idempotency key: ${receipt.idempotency_key}`,
+    `Source database mutated: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    `Rows affected: ${receipt.receipt.rows_affected}`,
+    `Safe error: ${receipt.receipt.safe_error_code ?? "none"}`,
+    `Receipt hash: ${receipt.receipt.receipt_hash}`,
+    `Created at: ${receipt.created_at}`,
+    "",
+    "Related:",
+    `  ${cliCommandName()} replay show --proposal ${receipt.proposal_id}`
+  ].join("\n") + "\n";
+}
+function formatReplaySummary(row) {
+  return [
+    `${row.created_at}  ${row.replay_id}`,
+    `  proposal: ${row.proposal_id}  status: ${row.state}`,
+    `  tenant: ${row.tenant_id}  capability: ${row.capability}  object: ${row.business_object}:${row.object_id}`
+  ].join("\n") + "\n";
+}
+function formatReplayDetail(replay2) {
+  const evidenceItems = replay2.evidence.reduce((count, item) => {
+    const evidence2 = item;
+    return count + (Array.isArray(evidence2.items) ? evidence2.items.length : 0);
+  }, 0);
+  return [
+    `Replay ${replay2.replay_id}`,
+    formatProposalDetail(replay2.proposal, evidenceItems).trimEnd(),
+    `events: ${replay2.events.length}`,
+    ...replay2.events.map((event) => `  ${event.kind} by ${event.actor} at ${event.created_at}`),
+    `receipts: ${replay2.receipts.length}`,
+    ...replay2.receipts.map((receipt) => `  receipt ${receipt.receipt_id}: ${receipt.status} job ${receipt.writeback_job_id}`),
+    `evidence bundles: ${replay2.evidence.length}`,
+    ...replay2.evidence.map((evidence2) => `  ${evidence2.evidence_bundle_id ?? "unknown"}`),
+    `query audit records: ${replay2.query_audit.length}`,
+    ...replay2.query_audit.map((record) => `  audit ${record.audit_id}: ${record.source_id}/${record.table_name} rows ${record.row_count}`)
+  ].join("\n") + "\n";
+}
+function formatReplayMarkdown(replay2) {
+  const proposal = replay2.proposal;
+  const principal = proposal.change_set.principal.id;
+  const approvalEvents = replay2.events.filter((event) => /approved|rejected|canceled/i.test(event.kind));
+  const evidenceLines = replay2.evidence.length > 0 ? replay2.evidence.flatMap((evidence2) => {
+    const record = evidence2;
+    const payload = isRecord6(record.payload) ? record.payload : {};
+    const sourceId = stringField(payload, "source_id") ?? proposal.source_id;
+    const table = stringField(payload, "target") ?? `${proposal.source_schema}.${proposal.source_table}`;
+    const queryFingerprint = stringField(payload, "query_fingerprint") ?? proposal.change_set.evidence.query_fingerprint;
+    return [
+      `- evidence: ${record.evidence_bundle_id ?? proposal.change_set.evidence.bundle_id}`,
+      `  - source: ${sourceId}.${table}`,
+      `  - query fingerprint: ${queryFingerprint}`,
+      `  - rows captured: ${Array.isArray(record.items) ? record.items.length : 0}`
+    ];
+  }) : [`- evidence: ${proposal.change_set.evidence.bundle_id}`, `  - source: ${proposal.source_id}.${proposal.source_schema}.${proposal.source_table}`, `  - query fingerprint: ${proposal.change_set.evidence.query_fingerprint}`, "  - rows captured: 0"];
+  const receiptLines = replay2.receipts.length > 0 ? replay2.receipts.flatMap((receipt) => [
+    `- receipt: ${receipt.receipt_id}`,
+    `  - status: ${receipt.status}`,
+    `  - affected rows: ${receipt.receipt.rows_affected}`,
+    `  - idempotency key: ${receipt.idempotency_key}`,
+    `  - source database mutated: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    ...receipt.receipt.safe_error_code ? [`  - safe error: ${receipt.receipt.safe_error_code}`] : []
+  ]) : ["- no writeback receipt recorded yet"];
+  return [
+    "# Synapsor Replay",
+    "",
+    `Proposal: ${proposal.proposal_id}`,
+    `Capability: ${proposal.action}`,
+    `Tenant: ${proposal.tenant_id}`,
+    `Object: ${proposal.business_object}:${proposal.object_id}`,
+    `Status: ${proposal.state}`,
+    "",
+    "## What The Agent Requested",
+    "",
+    `The model-facing capability requested \`${proposal.action}\` for ${proposal.business_object}:${proposal.object_id}.`,
+    "The source database was not mutated when the proposal was created.",
+    "",
+    "## Trusted Context",
+    "",
+    `tenant_id = ${proposal.tenant_id}`,
+    `principal = ${principal}`,
+    `principal_source = ${proposal.change_set.principal.source}`,
+    "",
+    "## Evidence",
+    "",
+    ...evidenceLines,
+    "",
+    "## Proposed Diff",
+    "",
+    ...Object.keys(proposal.change_set.patch).map((column) => `- ${column}: ${JSON.stringify(proposal.change_set.before[column])} -> ${JSON.stringify(proposal.change_set.after[column])}`),
+    "",
+    "## Approval",
+    "",
+    ...approvalEvents.length > 0 ? approvalEvents.map((event) => `- ${event.kind} by ${event.actor} at ${event.created_at}`) : [`- ${proposal.change_set.approval.status}${proposal.change_set.approval.required_role ? `; required role: ${proposal.change_set.approval.required_role}` : ""}`],
+    "",
+    "## Guarded Writeback",
+    "",
+    ...receiptLines,
+    "",
+    "## Query Audit",
+    "",
+    ...replay2.query_audit.map((record) => `- audit ${record.audit_id}: ${record.source_id}/${record.table_name} rows ${record.row_count} fingerprint ${record.query_fingerprint}`),
+    "",
+    "## Replay Note",
+    "",
+    "This is local captured interaction replay, not external database time travel. It reconstructs what the runner recorded: trusted context, evidence handles, proposal diff, approval events, query audit, and writeback receipts."
+  ].join("\n") + "\n";
+}
+function activityFromProposal(proposal) {
+  return {
+    kind: "proposal",
+    created_at: proposal.created_at,
+    capability: proposal.action,
+    tenant: proposal.tenant_id,
+    principal: proposal.principal ?? proposal.change_set.principal.id,
+    object: `${proposal.business_object}:${proposal.object_id}`,
+    proposal: proposal.proposal_id,
+    evidence: proposal.change_set.evidence.bundle_id,
+    status: proposal.state,
+    replay: `replay_${proposal.proposal_id}`,
+    source: proposal.source_id,
+    table: `${proposal.source_schema}.${proposal.source_table}`
+  };
+}
+function activityFromEvidence(evidence2) {
+  return {
+    kind: "evidence",
+    created_at: evidence2.created_at,
+    capability: evidence2.capability,
+    tenant: evidence2.tenant_id,
+    principal: evidence2.principal,
+    object: evidence2.business_object && evidence2.object_id ? `${evidence2.business_object}:${evidence2.object_id}` : void 0,
+    proposal: evidence2.proposal_id,
+    evidence: evidence2.evidence_bundle_id,
+    status: "evidence_recorded",
+    source: evidence2.source_id,
+    table: evidence2.source_table
+  };
+}
+function activityFromQueryAudit(audit2) {
+  const businessObject = stringField(audit2, "business_object");
+  const objectId = stringField(audit2, "object_id") ?? stringField(audit2, "primary_key_value");
+  return {
+    kind: "query-audit",
+    created_at: stringField(audit2, "created_at"),
+    capability: stringField(audit2, "capability"),
+    tenant: stringField(audit2, "tenant_id"),
+    principal: stringField(audit2, "principal"),
+    object: businessObject && objectId ? `${businessObject}:${objectId}` : void 0,
+    proposal: stringField(audit2, "proposal_id"),
+    evidence: stringField(audit2, "evidence_bundle_id"),
+    status: "query_audited",
+    source: stringField(audit2, "source_id"),
+    table: stringField(audit2, "table_name"),
+    query_audit: stringField(audit2, "audit_id"),
+    query_fingerprint: stringField(audit2, "query_fingerprint")
+  };
+}
+function activityFromReceipt(receipt) {
+  return {
+    kind: "receipt",
+    created_at: receipt.created_at,
+    proposal: receipt.proposal_id,
+    receipt: receipt.receipt_id,
+    status: receipt.status,
+    replay: `replay_${receipt.proposal_id}`,
+    source_database_mutated: receipt.source_database_mutated
+  };
+}
+function formatActivityItem(item, index) {
+  const lines = [
+    `${index}. ${item.created_at}`,
+    `   kind: ${item.kind}`,
+    ...item.capability ? [`   capability: ${item.capability}`] : [],
+    ...item.tenant ? [`   tenant: ${item.tenant}`] : [],
+    ...item.object ? [`   object: ${item.object}`] : [],
+    ...item.proposal ? [`   proposal: ${item.proposal}`] : [],
+    ...item.evidence ? [`   evidence: ${item.evidence}`] : [],
+    ...item.query_audit ? [`   query audit: ${item.query_audit}`] : [],
+    ...item.query_fingerprint ? [`   query fingerprint: ${item.query_fingerprint}`] : [],
+    ...item.receipt ? [`   receipt: ${item.receipt}`] : [],
+    ...item.status ? [`   status: ${item.status}`] : [],
+    ...item.replay ? [`   replay: ${item.replay}`] : [],
+    ""
+  ];
+  return lines.join("\n");
+}
+function formatStoreStats(stats) {
+  return [
+    `Local store: ${stats.path}`,
+    `Approx size: ${stats.approx_bytes} bytes`,
+    `Proposals: ${stats.proposals}`,
+    `Evidence bundles: ${stats.evidence_bundles}`,
+    `Evidence items: ${stats.evidence_items}`,
+    `Query audit records: ${stats.query_audit}`,
+    `Writeback receipts: ${stats.writeback_receipts}`,
+    `Writeback jobs: ${stats.writeback_jobs}`,
+    `Idempotency receipts: ${stats.idempotency_receipts}`,
+    `Replay records: ${stats.replay_records}`,
+    `Approvals: ${stats.approvals}`,
+    `Proposal events: ${stats.proposal_events}`,
+    `Shadow human actions: ${stats.shadow_human_actions}`
+  ].join("\n") + "\n";
+}
+function formatStorePrune(result) {
+  const lines = [
+    `Local store prune ${result.dry_run ? "dry run" : "complete"}`,
+    `Cutoff: ${result.cutoff}`,
+    "",
+    "Rows:",
+    ...Object.entries(result.deleted).map(([table, count]) => `  ${table}: ${count}`)
+  ];
+  if (result.dry_run) {
+    lines.push("", "No rows were deleted. Rerun with --yes to apply this prune.");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function cutoffFromOlderThan(value) {
+  const match = value.match(/^(\d+)([smhd])$/i);
+  if (!match) throw new Error("--older-than must use a duration such as 30d, 12h, 90m, or 0d");
+  const amount = Number(match[1]);
+  const unit = (match[2] ?? "d").toLowerCase();
+  const multiplier = unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return new Date(Date.now() - amount * multiplier).toISOString();
+}
+function formatMcpAuditMarkdown(report) {
+  const lines = [
+    "# Synapsor MCP Database Risk Review",
+    "",
+    `- Target: ${report.target}`,
+    `- Generated at: ${report.generated_at}`,
+    `- Tools inspected: ${report.summary.tools_inspected}`,
+    `- Findings: HIGH ${report.summary.high} | MEDIUM ${report.summary.medium} | LOW ${report.summary.low}`,
+    `- Total findings: ${report.summary.total_findings}`,
+    "",
+    `> ${report.disclaimer}`,
+    ""
+  ];
+  if (report.findings.length === 0) {
+    lines.push("No obvious database-commit risks were detected in the static manifest.", "");
+    lines.push("This does not prove the MCP server or its tools are secure.", "");
+  } else {
+    lines.push("## Findings", "");
+    for (const finding of report.findings) {
+      lines.push(`### ${finding.severity}: ${finding.code}${finding.tool ? ` (${finding.tool})` : ""}`);
+      lines.push("");
+      lines.push(finding.message);
+      lines.push("");
+      if (finding.evidence.length > 0) {
+        lines.push("Evidence:");
+        for (const evidence2 of finding.evidence) lines.push(`- ${evidence2}`);
+        lines.push("");
+      }
+      lines.push(`Recommendation: ${finding.recommendation}`);
+      lines.push("");
+    }
+  }
+  lines.push("## Safer Shape", "");
+  lines.push("- expose semantic inspect/propose tools instead of raw SQL;");
+  lines.push("- bind tenant/principal from trusted context;");
+  lines.push("- keep approval outside MCP;");
+  lines.push("- apply approved changes through guarded writeback;");
+  lines.push("- keep replay/evidence handles for later review.");
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function stringField(record, key) {
+  if (!isRecord6(record)) return void 0;
+  const value = record[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number") return String(value);
+  return void 0;
+}
 function currentApprovalStatus(proposal) {
   if (proposal.state === "rejected") return "rejected";
   if (proposal.state === "canceled") return "canceled";
@@ -8601,7 +10638,7 @@ function starterCloudConfig() {
       base_url_env: "SYNAPSOR_CLOUD_BASE_URL",
       runner_token_env: "SYNAPSOR_RUNNER_TOKEN",
       runner_id: "synapsor_runner_local",
-      runner_version: "0.1.0-alpha.2",
+      runner_version: "0.1.0-alpha.4",
       project_id: "token_scope",
       adapter_id: "mcp.your_adapter",
       source_id: "src_replace_me",
@@ -8624,6 +10661,37 @@ function normalizeCapabilities(value) {
 function isHelpRequest(args) {
   return args.includes("--help") || args.includes("-h");
 }
+function isKnownTopLevelCommand(command) {
+  return (/* @__PURE__ */ new Set([
+    "help",
+    "init",
+    "inspect",
+    "config",
+    "doctor",
+    "validate",
+    "apply",
+    "propose",
+    "audit",
+    "start",
+    "runner",
+    "cloud",
+    "mcp",
+    "tools",
+    "onboard",
+    "demo",
+    "recipes",
+    "benchmark",
+    "proposals",
+    "replay",
+    "evidence",
+    "query-audit",
+    "receipts",
+    "activity",
+    "store",
+    "shadow",
+    "ui"
+  ])).has(command);
+}
 function cliCommandName() {
   if (process2.env.SYNAPSOR_RUNNER_COMMAND_NAME) return process2.env.SYNAPSOR_RUNNER_COMMAND_NAME;
   const invoked = path3.basename(process2.argv[1] ?? "");
@@ -8648,6 +10716,11 @@ Commands:
   propose      Create a local evidence-backed proposal
   audit        Review MCP/database tool risk
   proposals   Review, approve, or reject proposals
+  evidence    Inspect local evidence bundles
+  query-audit Inspect local query audit records
+  receipts    Inspect guarded writeback receipts
+  activity    Search local evidence/replay ledger
+  store       Inspect and maintain the local SQLite ledger
   apply        Apply an approved proposal with guarded writeback
   replay       Show what happened
   demo         Start the local commit-safety demo
@@ -8675,6 +10748,7 @@ Generate a reviewed Synapsor Runner contract. Defaults to read-only in the wizar
     mcp: `Usage:
   ${cmd} mcp serve --config ./synapsor.runner.json --store ./.synapsor/local.db
   ${cmd} mcp config --absolute-paths --config ./synapsor.runner.json --store ./.synapsor/local.db
+  ${cmd} mcp audit --example dangerous-db-mcp
   ${cmd} mcp audit ./tools-list.json
 
 MCP clients see semantic tools. They do not receive raw SQL, write credentials, approval tools, or commit tools.
@@ -8694,23 +10768,60 @@ Print MCP client configuration that references the local runner command, not dat
   ${cmd} propose <capability-name> --input ./input.json
   ${cmd} propose <capability-name> --json '{"invoice_id":"INV-3001","reason":"support-approved waiver"}'
 
+Examples after running ${cmd} demo:
+  ${cmd} propose billing.propose_late_fee_waiver --sample
+  ${cmd} propose support.propose_plan_credit --sample
+  ${cmd} propose orders.propose_status_change --sample
+
 Create the same evidence-backed proposal the MCP tool would create. The source database is not mutated.
 `,
     audit: `Usage:
+  ${cmd} audit --example dangerous-db-mcp
+  ${cmd} audit --example dangerous-db-mcp --format json
+  ${cmd} audit --example dangerous-db-mcp --format markdown
   ${cmd} audit ./synapsor.runner.json
   ${cmd} audit --mcp-config ./claude_desktop_config.json
   ${cmd} audit --stdio "node ./server.js"
   ${cmd} audit --url http://localhost:3000/mcp
 
 Static MCP/database risk review only. This is not a security guarantee.
+`,
+    doctor: `Usage:
+  ${cmd} doctor --config synapsor.runner.json
+  ${cmd} doctor --config synapsor.runner.json --json
+  ${cmd} doctor --config synapsor.runner.json --report --redact --output synapsor-doctor.md
+  ${cmd} doctor --first-run
+
+Validate local config, environment bindings, semantic tool boundary, source metadata when reachable, and local store stats. Reports are redacted; do not paste secrets into issues.
 `,
     proposals: `Usage:
-  ${cmd} proposals list [--store ./.synapsor/local.db]
+  ${cmd} proposals list [--tenant acme] [--capability billing.propose_late_fee_waiver] [--object invoice:INV-3001] [--status applied]
   ${cmd} proposals show latest
   ${cmd} proposals approve latest --yes
   ${cmd} proposals reject latest --reason "..."
 
 Review decisions happen outside the model-facing MCP tool surface.
+`,
+    evidence: `Usage:
+  ${cmd} evidence list [--tenant acme] [--capability billing.inspect_invoice] [--object invoice:INV-3001]
+  ${cmd} evidence show ev_...
+  ${cmd} evidence export ev_... --format json --output evidence.json
+  ${cmd} evidence export ev_... --format markdown --output evidence.md
+
+Inspect captured local evidence bundles and query-audit links without rerunning external DB reads.
+`,
+    "query-audit": `Usage:
+  ${cmd} query-audit list [--evidence ev_...] [--source app_postgres] [--table invoices]
+  ${cmd} query-audit show <audit_id>
+  ${cmd} query-audit export <audit_id> --format json --output audit.json
+
+Inspect local query fingerprints, table names, row counts, and redacted-parameter metadata.
+`,
+    receipts: `Usage:
+  ${cmd} receipts list [--proposal wrp_...] [--status applied]
+  ${cmd} receipts show <receipt_id>
+
+Inspect guarded writeback receipts recorded by the trusted runner path.
 `,
     apply: `Usage:
   ${cmd} apply latest [--config ./synapsor.runner.json] [--store ./.synapsor/local.db]
@@ -8719,18 +10830,36 @@ Review decisions happen outside the model-facing MCP tool surface.
 Apply an approved proposal through guarded writeback. Requires a trusted write credential.
 `,
     replay: `Usage:
-  ${cmd} replay latest [--store ./.synapsor/local.db]
+  ${cmd} replay list [--tenant acme] [--object invoice:INV-3001]
   ${cmd} replay show latest
-  ${cmd} replay export latest --output replay.json
+  ${cmd} replay show --proposal wrp_...
+  ${cmd} replay show --replay replay_wrp_...
+  ${cmd} replay show --evidence ev_...
+  ${cmd} replay export --proposal wrp_... --format json --output replay.json
+  ${cmd} replay export --proposal wrp_... --format markdown --output replay.md
 
 Show evidence, proposal events, receipts, and replay state without rerunning side effects.
+`,
+    activity: `Usage:
+  ${cmd} activity search --tenant acme --object invoice:INV-3001
+  ${cmd} activity search --capability billing.propose_late_fee_waiver --from 2026-06-01 --to 2026-06-23
+
+Search the local SQLite evidence/replay ledger across proposals, evidence, query audit, receipts, and replay records.
+`,
+    store: `Usage:
+  ${cmd} store stats --store ./.synapsor/local.db
+  ${cmd} store vacuum --store ./.synapsor/local.db
+  ${cmd} store prune --store ./.synapsor/local.db --older-than 30d --dry-run
+  ${cmd} store prune --store ./.synapsor/local.db --older-than 30d --yes
+
+Local store maintenance only. Prune defaults to dry-run and never touches your source Postgres/MySQL database.
 `,
     demo: `Usage:
 	  ${cmd} demo [--force]
 	  ${cmd} demo --quick
 
 	Start a disposable local Postgres demo and write ./synapsor.runner.json for the first-run flow.
-	Use --quick for a fixture-only 15-second explanation with no Docker startup.
+	Use --quick for a fixture-only 15-second explanation and local ledger seed with no Docker startup.
 	`,
     ui: `Usage:
   ${cmd} ui [--tour] [--config synapsor.runner.json] [--store ./.synapsor/local.db]