@synapsor/runner 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/runner.mjs

@@ -1180,6 +1180,7 @@ function isRecord(value) {
 // packages/mcp-server/src/index.ts
 import crypto from "node:crypto";
 import fs from "node:fs";
+import { createServer } from "node:http";
 import path from "node:path";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1196,13 +1197,89 @@ var ProposalStoreError = class extends Error {
 };
 var ProposalStore = class {
   db;
+  path;
   constructor(path4 = ":memory:") {
+    this.path = path4;
     this.db = new DatabaseSync(path4);
     this.migrate();
   }
   close() {
     this.db.close();
   }
+  stats() {
+    const pageCount = this.numberValue("PRAGMA page_count");
+    const pageSize = this.numberValue("PRAGMA page_size");
+    return {
+      path: this.path,
+      proposals: this.countTable("proposals"),
+      evidence_bundles: this.countTable("evidence_bundles"),
+      evidence_items: this.countTable("evidence_items"),
+      query_audit: this.countTable("query_audit"),
+      writeback_receipts: this.countTable("writeback_receipts"),
+      writeback_jobs: this.countTable("writeback_jobs"),
+      idempotency_receipts: this.countTable("idempotency_receipts"),
+      replay_records: this.countTable("replay_records"),
+      approvals: this.countTable("approvals"),
+      proposal_events: this.countTable("proposal_events"),
+      shadow_human_actions: this.countTable("shadow_human_actions"),
+      page_count: pageCount,
+      page_size: pageSize,
+      approx_bytes: pageCount * pageSize
+    };
+  }
+  vacuum() {
+    this.db.exec("VACUUM");
+  }
+  pruneBefore(cutoffIso, options = {}) {
+    const dryRun = options.dryRun !== false;
+    const proposalIds = this.stringColumn("SELECT proposal_id FROM proposals WHERE created_at < ?", [cutoffIso], "proposal_id");
+    const evidenceIds = this.evidenceIdsForPrune(cutoffIso, proposalIds);
+    const deleted = {};
+    const run = (table, where, params) => {
+      deleted[table] = this.countWhere(table, where, params);
+      if (!dryRun && deleted[table] > 0) this.db.prepare(`DELETE FROM ${table} WHERE ${where}`).run(...params);
+    };
+    const proposalWhere = inWhere("proposal_id", proposalIds);
+    const evidenceWhere = inWhere("evidence_bundle_id", evidenceIds);
+    this.transaction(() => {
+      if (proposalWhere) {
+        run("idempotency_receipts", proposalWhere.sql, proposalWhere.params);
+        run("writeback_receipts", proposalWhere.sql, proposalWhere.params);
+        run("writeback_jobs", proposalWhere.sql, proposalWhere.params);
+        run("approvals", proposalWhere.sql, proposalWhere.params);
+        run("proposal_events", proposalWhere.sql, proposalWhere.params);
+        run("shadow_human_actions", proposalWhere.sql, proposalWhere.params);
+        run("replay_records", proposalWhere.sql, proposalWhere.params);
+      } else {
+        for (const table of ["idempotency_receipts", "writeback_receipts", "writeback_jobs", "approvals", "proposal_events", "shadow_human_actions", "replay_records"]) {
+          deleted[table] = 0;
+        }
+      }
+      const auditClauses = [];
+      const auditParams = [];
+      if (proposalWhere) {
+        auditClauses.push(proposalWhere.sql);
+        auditParams.push(...proposalWhere.params);
+      }
+      if (evidenceWhere) {
+        auditClauses.push(evidenceWhere.sql);
+        auditParams.push(...evidenceWhere.params);
+      }
+      auditClauses.push("(proposal_id IS NULL AND evidence_bundle_id IS NULL AND created_at < ?)");
+      auditParams.push(cutoffIso);
+      run("query_audit", auditClauses.map((clause) => `(${clause})`).join(" OR "), auditParams);
+      if (evidenceWhere) {
+        run("evidence_items", evidenceWhere.sql, evidenceWhere.params);
+        run("evidence_bundles", evidenceWhere.sql, evidenceWhere.params);
+      } else {
+        deleted.evidence_items = 0;
+        deleted.evidence_bundles = 0;
+      }
+      if (proposalWhere) run("proposals", proposalWhere.sql, proposalWhere.params);
+      else deleted.proposals = 0;
+    });
+    return { cutoff: cutoffIso, dry_run: dryRun, deleted };
+  }
   migrate() {
     this.db.exec(`
       PRAGMA foreign_keys = ON;
@@ -1353,6 +1430,154 @@ var ProposalStore = class {
       INSERT OR IGNORE INTO proposal_store_schema(version, applied_at)
       VALUES (1, datetime('now'));
     `);
+    this.ensureSearchColumns();
+    this.backfillSearchColumns();
+    this.ensureSearchIndexes();
+  }
+  ensureSearchColumns() {
+    this.ensureColumn("proposals", "principal", "TEXT");
+    this.ensureColumn("proposals", "capability", "TEXT");
+    this.ensureColumn("proposals", "interaction_id", "TEXT");
+    this.ensureColumn("proposals", "tool_call_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "principal", "TEXT");
+    this.ensureColumn("evidence_bundles", "capability", "TEXT");
+    this.ensureColumn("evidence_bundles", "source_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "source_table", "TEXT");
+    this.ensureColumn("evidence_bundles", "business_object", "TEXT");
+    this.ensureColumn("evidence_bundles", "object_id", "TEXT");
+    this.ensureColumn("evidence_bundles", "query_fingerprint", "TEXT");
+    this.ensureColumn("query_audit", "tenant_id", "TEXT");
+    this.ensureColumn("query_audit", "principal", "TEXT");
+    this.ensureColumn("query_audit", "capability", "TEXT");
+    this.ensureColumn("query_audit", "business_object", "TEXT");
+    this.ensureColumn("query_audit", "object_id", "TEXT");
+    this.ensureColumn("query_audit", "primary_key_value", "TEXT");
+  }
+  ensureSearchIndexes() {
+    this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_proposals_tenant_created ON proposals(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_action_created ON proposals(action, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_capability_created ON proposals(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_principal_created ON proposals(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_object_created ON proposals(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_state_created ON proposals(state, created_at);
+      CREATE INDEX IF NOT EXISTS idx_proposals_source_table_created ON proposals(source_id, source_table, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_tenant_created ON evidence_bundles(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_proposal_id ON evidence_bundles(proposal_id);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_created ON evidence_bundles(created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_capability_created ON evidence_bundles(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_principal_created ON evidence_bundles(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_object_created ON evidence_bundles(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_source_table_created ON evidence_bundles(source_id, source_table, created_at);
+      CREATE INDEX IF NOT EXISTS idx_evidence_bundles_fingerprint_created ON evidence_bundles(query_fingerprint, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_evidence_items_bundle_id ON evidence_items(evidence_bundle_id);
+
+      CREATE INDEX IF NOT EXISTS idx_query_audit_evidence_id ON query_audit(evidence_bundle_id);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_source_table_created ON query_audit(source_id, table_name, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_fingerprint_created ON query_audit(query_fingerprint, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_created ON query_audit(created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_tenant_created ON query_audit(tenant_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_capability_created ON query_audit(capability, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_principal_created ON query_audit(principal, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_object_created ON query_audit(business_object, object_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_query_audit_primary_key_created ON query_audit(primary_key_value, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_writeback_job ON writeback_receipts(writeback_job_id);
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_idempotency_key ON writeback_receipts(idempotency_key);
+      CREATE INDEX IF NOT EXISTS idx_writeback_receipts_status_created ON writeback_receipts(status, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_replay_records_created ON replay_records(created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_approvals_proposal_id ON approvals(proposal_id);
+      CREATE INDEX IF NOT EXISTS idx_approvals_status_created ON approvals(status, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_proposal_events_kind_created ON proposal_events(kind, created_at);
+    `);
+  }
+  ensureColumn(table, column, definition) {
+    const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
+    if (columns.some((row) => isRecord2(row) && row.name === column)) return;
+    this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  }
+  backfillSearchColumns() {
+    const proposals2 = this.db.prepare("SELECT proposal_id, action, change_set_json FROM proposals").all();
+    for (const row of proposals2) {
+      if (!isRecord2(row)) continue;
+      try {
+        const changeSet = parseChangeSet(JSON.parse(String(row.change_set_json)));
+        this.db.prepare("UPDATE proposals SET principal = COALESCE(principal, ?), capability = COALESCE(capability, ?) WHERE proposal_id = ?").run(changeSet.principal.id, changeSet.action, String(row.proposal_id));
+      } catch {
+      }
+    }
+    const evidenceRows = this.db.prepare("SELECT evidence_bundle_id, proposal_id, payload_json FROM evidence_bundles").all();
+    for (const row of evidenceRows) {
+      if (!isRecord2(row)) continue;
+      const proposal = row.proposal_id == null ? void 0 : this.getProposal(String(row.proposal_id));
+      let payload = {};
+      try {
+        payload = JSON.parse(String(row.payload_json));
+      } catch {
+        payload = {};
+      }
+      const metadata = this.evidenceMetadata({
+        proposal,
+        payload,
+        items: this.evidenceItems(String(row.evidence_bundle_id)).map((item) => item.item)
+      });
+      this.db.prepare(`
+        UPDATE evidence_bundles
+        SET principal = COALESCE(principal, ?),
+            capability = COALESCE(capability, ?),
+            source_id = COALESCE(source_id, ?),
+            source_table = COALESCE(source_table, ?),
+            business_object = COALESCE(business_object, ?),
+            object_id = COALESCE(object_id, ?),
+            query_fingerprint = COALESCE(query_fingerprint, ?)
+        WHERE evidence_bundle_id = ?
+      `).run(
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.source_id ?? null,
+        metadata.source_table ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.query_fingerprint ?? null,
+        String(row.evidence_bundle_id)
+      );
+    }
+    const auditRows = this.db.prepare("SELECT audit_id, proposal_id, evidence_bundle_id, payload_json FROM query_audit").all();
+    for (const row of auditRows) {
+      if (!isRecord2(row)) continue;
+      const proposal = row.proposal_id == null ? void 0 : this.getProposal(String(row.proposal_id));
+      const evidence2 = row.evidence_bundle_id == null ? void 0 : this.getEvidenceBundle(String(row.evidence_bundle_id));
+      let payload = {};
+      try {
+        payload = JSON.parse(String(row.payload_json));
+      } catch {
+        payload = {};
+      }
+      const metadata = this.queryAuditMetadata({ proposal, evidence: evidence2, payload });
+      this.db.prepare(`
+        UPDATE query_audit
+        SET tenant_id = COALESCE(tenant_id, ?),
+            principal = COALESCE(principal, ?),
+            capability = COALESCE(capability, ?),
+            business_object = COALESCE(business_object, ?),
+            object_id = COALESCE(object_id, ?),
+            primary_key_value = COALESCE(primary_key_value, ?)
+        WHERE audit_id = ?
+      `).run(
+        metadata.tenant_id ?? null,
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.primary_key_value ?? null,
+        Number(row.audit_id)
+      );
+    }
   }
   createProposal(input) {
     const changeSet = parseChangeSet(input);
@@ -1377,6 +1602,10 @@ var ProposalStore = class {
         action,
         state,
         tenant_id,
+        principal,
+        capability,
+        interaction_id,
+        tool_call_id,
         business_object,
         object_id,
         source_kind,
@@ -1387,7 +1616,7 @@ var ProposalStore = class {
         change_set_json,
         created_at,
         updated_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
     this.transaction(() => {
       insert.run(
@@ -1397,6 +1626,10 @@ var ProposalStore = class {
         changeSet.action,
         state,
         changeSet.scope.tenant_id,
+        changeSet.principal.id,
+        changeSet.action,
+        null,
+        null,
         changeSet.scope.business_object,
         changeSet.scope.object_id,
         changeSet.source.kind,
@@ -1424,10 +1657,44 @@ var ProposalStore = class {
     const row = this.db.prepare("SELECT * FROM proposals WHERE proposal_id = ?").get(proposalId);
     return rowToProposal(row);
   }
-  listProposals(state) {
-    const rows = state ? this.db.prepare("SELECT * FROM proposals WHERE state = ? ORDER BY created_at DESC").all(state) : this.db.prepare("SELECT * FROM proposals ORDER BY created_at DESC").all();
+  listProposals(filters) {
+    if (typeof filters === "string") filters = { state: filters };
+    const query = buildProposalQuery(filters ?? {});
+    const rows = this.db.prepare(query.sql).all(...query.params);
     return rows.map((row) => rowToProposal(row)).filter((proposal) => proposal !== void 0);
   }
+  listEvidenceBundles(filters = {}) {
+    const query = buildEvidenceQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map((row) => this.rowToEvidenceBundle(row)).filter((evidence2) => evidence2 !== void 0);
+  }
+  listQueryAudit(filters = {}) {
+    const query = buildQueryAuditQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map(rowToQueryAudit).filter((record) => record !== void 0);
+  }
+  getQueryAudit(auditId) {
+    return rowToQueryAudit(this.db.prepare("SELECT * FROM query_audit WHERE audit_id = ?").get(auditId));
+  }
+  listReceipts(filters = {}) {
+    const query = buildReceiptQuery(filters);
+    const rows = this.db.prepare(query.sql).all(...query.params);
+    return rows.map(rowToReceipt).filter((receipt) => receipt !== void 0);
+  }
+  getReceipt(receiptId) {
+    return rowToReceipt(this.db.prepare("SELECT * FROM writeback_receipts WHERE receipt_id = ?").get(receiptId));
+  }
+  getReplayByReplayId(replayId) {
+    const prefix = "replay_";
+    const proposalId = replayId.startsWith(prefix) ? replayId.slice(prefix.length) : replayId;
+    return this.replay(proposalId);
+  }
+  proposalIdForEvidence(evidenceBundleId) {
+    const evidence2 = this.getEvidenceBundle(evidenceBundleId);
+    if (evidence2?.proposal_id) return evidence2.proposal_id;
+    const row = this.db.prepare("SELECT proposal_id FROM query_audit WHERE evidence_bundle_id = ? AND proposal_id IS NOT NULL ORDER BY created_at DESC LIMIT 1").get(evidenceBundleId);
+    return isRecord2(row) && row.proposal_id != null ? String(row.proposal_id) : void 0;
+  }
   approveProposal(proposalId, options) {
     const proposal = this.requireProposal(proposalId);
     assertWritebackAllowed(proposal, "approved");
@@ -1691,17 +1958,38 @@ var ProposalStore = class {
   recordEvidenceBundle(input) {
     assertNoSecretMaterial({ payload: input.payload, items: input.items ?? [] }, "evidence_bundle");
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (input.proposal_id) this.requireProposal(input.proposal_id);
+    const proposal = input.proposal_id ? this.requireProposal(input.proposal_id) : void 0;
+    const metadata = this.evidenceMetadata({ proposal, payload: input.payload, items: input.items ?? [] });
     this.transaction(() => {
       this.db.prepare(`
         INSERT OR REPLACE INTO evidence_bundles (
           evidence_bundle_id,
           proposal_id,
           tenant_id,
+          principal,
+          capability,
+          source_id,
+          source_table,
+          business_object,
+          object_id,
+          query_fingerprint,
           payload_json,
           created_at
-        ) VALUES (?, ?, ?, ?, ?)
-      `).run(input.evidence_bundle_id, input.proposal_id ?? null, input.tenant_id, JSON.stringify(input.payload), now);
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        input.evidence_bundle_id,
+        input.proposal_id ?? null,
+        input.tenant_id,
+        metadata.principal ?? null,
+        metadata.capability ?? null,
+        metadata.source_id ?? null,
+        metadata.source_table ?? null,
+        metadata.business_object ?? null,
+        metadata.object_id ?? null,
+        metadata.query_fingerprint ?? null,
+        JSON.stringify(input.payload),
+        now
+      );
       for (const item of input.items ?? []) {
         this.db.prepare(`
           INSERT INTO evidence_items (evidence_bundle_id, item_json, created_at)
@@ -1719,21 +2007,35 @@ var ProposalStore = class {
   recordQueryAudit(input) {
     assertNoSecretMaterial(input.payload, "query_audit");
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (input.proposal_id) this.requireProposal(input.proposal_id);
+    const proposal = input.proposal_id ? this.requireProposal(input.proposal_id) : void 0;
+    const evidence2 = input.evidence_bundle_id ? this.getEvidenceBundle(input.evidence_bundle_id) : void 0;
+    const metadata = this.queryAuditMetadata({ proposal, evidence: evidence2, payload: input.payload });
     this.db.prepare(`
       INSERT INTO query_audit (
         proposal_id,
         evidence_bundle_id,
+        tenant_id,
+        principal,
+        capability,
+        business_object,
+        object_id,
+        primary_key_value,
         source_id,
         query_fingerprint,
         table_name,
         row_count,
         payload_json,
         created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `).run(
       input.proposal_id ?? null,
       input.evidence_bundle_id ?? null,
+      metadata.tenant_id ?? null,
+      metadata.principal ?? null,
+      metadata.capability ?? null,
+      metadata.business_object ?? null,
+      metadata.object_id ?? null,
+      metadata.primary_key_value ?? null,
       input.source_id,
       input.query_fingerprint,
       input.table_name,
@@ -1744,14 +2046,24 @@ var ProposalStore = class {
   }
   getEvidenceBundle(evidenceBundleId) {
     const row = this.db.prepare("SELECT * FROM evidence_bundles WHERE evidence_bundle_id = ?").get(evidenceBundleId);
+    return this.rowToEvidenceBundle(row);
+  }
+  rowToEvidenceBundle(row) {
     if (!isRecord2(row)) return void 0;
     return {
       evidence_bundle_id: String(row.evidence_bundle_id),
       proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
       tenant_id: String(row.tenant_id),
+      principal: row.principal == null ? void 0 : String(row.principal),
+      capability: row.capability == null ? void 0 : String(row.capability),
+      source_id: row.source_id == null ? void 0 : String(row.source_id),
+      source_table: row.source_table == null ? void 0 : String(row.source_table),
+      business_object: row.business_object == null ? void 0 : String(row.business_object),
+      object_id: row.object_id == null ? void 0 : String(row.object_id),
+      query_fingerprint: row.query_fingerprint == null ? void 0 : String(row.query_fingerprint),
       payload: JSON.parse(String(row.payload_json)),
-      items: this.evidenceItems(evidenceBundleId),
-      query_audit: this.queryAuditByEvidence(evidenceBundleId),
+      items: this.evidenceItems(String(row.evidence_bundle_id)),
+      query_audit: this.queryAuditByEvidence(String(row.evidence_bundle_id)),
       created_at: String(row.created_at)
     };
   }
@@ -1896,6 +2208,8 @@ var ProposalStore = class {
         proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
         tenant_id: String(row.tenant_id),
         payload: JSON.parse(String(row.payload_json)),
+        items: this.evidenceItems(String(row.evidence_bundle_id)),
+        query_audit: this.queryAuditByEvidence(String(row.evidence_bundle_id)),
         created_at: String(row.created_at)
       });
     }
@@ -1915,6 +2229,81 @@ var ProposalStore = class {
     }
     return records;
   }
+  evidenceMetadata(input) {
+    if (input.proposal) {
+      return {
+        principal: input.proposal.change_set.principal.id,
+        capability: input.proposal.action,
+        source_id: input.proposal.source_id,
+        source_table: `${input.proposal.source_schema}.${input.proposal.source_table}`,
+        business_object: input.proposal.business_object,
+        object_id: input.proposal.object_id,
+        query_fingerprint: input.proposal.change_set.evidence.query_fingerprint
+      };
+    }
+    const firstItem = input.items.find(isRecord2);
+    const primaryKey = isRecord2(firstItem?.primary_key) ? firstItem.primary_key : void 0;
+    const principal = stringFromPrincipal(input.payload.principal);
+    const table = stringFromUnknown(input.payload.target) ?? stringFromUnknown(firstItem?.table);
+    return {
+      principal,
+      capability: stringFromUnknown(input.payload.capability),
+      source_id: stringFromUnknown(input.payload.source_id) ?? stringFromUnknown(firstItem?.source_id),
+      source_table: table,
+      business_object: table ? lastIdentifier(table) : void 0,
+      object_id: primaryKey ? stringFromUnknown(primaryKey.value) : void 0,
+      query_fingerprint: stringFromUnknown(input.payload.query_fingerprint)
+    };
+  }
+  queryAuditMetadata(input) {
+    if (input.proposal) {
+      return {
+        tenant_id: input.proposal.tenant_id,
+        principal: input.proposal.change_set.principal.id,
+        capability: input.proposal.action,
+        business_object: input.proposal.business_object,
+        object_id: input.proposal.object_id,
+        primary_key_value: String(input.proposal.change_set.source.primary_key.value)
+      };
+    }
+    const firstItem = input.evidence?.items.find((item) => isRecord2(item.item))?.item;
+    const primaryKey = isRecord2(firstItem?.primary_key) ? firstItem.primary_key : void 0;
+    return {
+      tenant_id: input.evidence?.tenant_id ?? stringFromUnknown(input.payload.tenant_id),
+      principal: input.evidence?.principal ?? stringFromPrincipal(input.payload.principal),
+      capability: input.evidence?.capability ?? stringFromUnknown(input.payload.capability),
+      business_object: input.evidence?.business_object ?? stringFromUnknown(input.payload.business_object),
+      object_id: input.evidence?.object_id ?? stringFromUnknown(input.payload.object_id),
+      primary_key_value: primaryKey ? stringFromUnknown(primaryKey.value) : input.evidence?.object_id ?? stringFromUnknown(input.payload.primary_key_value)
+    };
+  }
+  countTable(table) {
+    return this.countWhere(table, "1 = 1", []);
+  }
+  countWhere(table, where, params) {
+    const row = this.db.prepare(`SELECT COUNT(*) AS count FROM ${table} WHERE ${where}`).get(...params);
+    return isRecord2(row) ? Number(row.count ?? 0) : 0;
+  }
+  numberValue(sql) {
+    const row = this.db.prepare(sql).get();
+    if (!isRecord2(row)) return 0;
+    const value = Object.values(row)[0];
+    return typeof value === "number" ? value : Number(value ?? 0);
+  }
+  stringColumn(sql, params, column) {
+    return this.db.prepare(sql).all(...params).map((row) => isRecord2(row) ? row[column] : void 0).filter((value) => typeof value === "string" || typeof value === "number").map(String);
+  }
+  evidenceIdsForPrune(cutoffIso, proposalIds) {
+    const proposalWhere = inWhere("proposal_id", proposalIds);
+    if (!proposalWhere) {
+      return this.stringColumn("SELECT evidence_bundle_id FROM evidence_bundles WHERE created_at < ?", [cutoffIso], "evidence_bundle_id");
+    }
+    return this.stringColumn(
+      `SELECT evidence_bundle_id FROM evidence_bundles WHERE created_at < ? OR ${proposalWhere.sql}`,
+      [cutoffIso, ...proposalWhere.params],
+      "evidence_bundle_id"
+    );
+  }
   transaction(fn) {
     this.db.exec("BEGIN IMMEDIATE");
     try {
@@ -1933,6 +2322,133 @@ function stateFromChangeSet(changeSet) {
   if (changeSet.approval.status === "canceled") return "canceled";
   return "pending_review";
 }
+function inWhere(column, values) {
+  if (values.length === 0) return void 0;
+  return {
+    sql: `${column} IN (${values.map(() => "?").join(", ")})`,
+    params: values
+  };
+}
+function buildProposalQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "source_table", filters.table);
+  addEqual(clauses, params, "state", filters.status ?? filters.state);
+  addEqual(clauses, params, "action", filters.capability ?? filters.action);
+  addObjectFilter(clauses, params, "business_object", "source_table", "object_id", filters.objectType, filters.objectId);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM proposals", clauses, params, filters.limit);
+}
+function buildEvidenceQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "evidence_bundle_id", filters.evidence);
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "capability", filters.capability);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "source_table", filters.table);
+  addEqual(clauses, params, "query_fingerprint", filters.queryFingerprint);
+  addObjectFilter(clauses, params, "business_object", "source_table", "object_id", filters.objectType, filters.objectId);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM evidence_bundles", clauses, params, filters.limit);
+}
+function buildQueryAuditQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "tenant_id", filters.tenant);
+  addEqual(clauses, params, "principal", filters.principal);
+  addEqual(clauses, params, "capability", filters.capability);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "evidence_bundle_id", filters.evidence);
+  addEqual(clauses, params, "source_id", filters.source);
+  addTableFilter(clauses, params, "table_name", filters.table);
+  addObjectFilter(clauses, params, "business_object", "table_name", "object_id", filters.objectType, filters.objectId);
+  addEqual(clauses, params, "primary_key_value", filters.primaryKey);
+  addEqual(clauses, params, "query_fingerprint", filters.queryFingerprint);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM query_audit", clauses, params, filters.limit);
+}
+function buildReceiptQuery(filters) {
+  const clauses = [];
+  const params = [];
+  addEqual(clauses, params, "receipt_id", filters.receipt);
+  addEqual(clauses, params, "proposal_id", filters.proposal);
+  addEqual(clauses, params, "writeback_job_id", filters.writebackJob);
+  addEqual(clauses, params, "idempotency_key", filters.idempotencyKey);
+  addEqual(clauses, params, "status", filters.status);
+  addTimeRange(clauses, params, "created_at", filters.from, filters.to);
+  return finishQuery("SELECT * FROM writeback_receipts", clauses, params, filters.limit);
+}
+function addEqual(clauses, params, column, value) {
+  if (!value) return;
+  clauses.push(`${column} = ?`);
+  params.push(value);
+}
+function addTableFilter(clauses, params, column, value) {
+  if (!value) return;
+  if (value.includes(".")) {
+    clauses.push(`${column} = ?`);
+    params.push(value);
+    return;
+  }
+  clauses.push(`(${column} = ? OR ${column} = ?)`);
+  params.push(value, `public.${value}`);
+}
+function addObjectFilter(clauses, params, typeColumn, tableColumn, idColumn, objectType, objectId) {
+  if (objectId) {
+    clauses.push(`${idColumn} = ?`);
+    params.push(objectId);
+  }
+  if (!objectType) return;
+  const variants = objectTypeVariants(objectType);
+  const placeholders = variants.map(() => "?").join(", ");
+  clauses.push(`(${typeColumn} IN (${placeholders}) OR ${tableColumn} IN (${placeholders}))`);
+  params.push(...variants, ...variants);
+}
+function addTimeRange(clauses, params, column, from, to) {
+  if (from) {
+    clauses.push(`${column} >= ?`);
+    params.push(from);
+  }
+  if (to) {
+    clauses.push(`${column} <= ?`);
+    params.push(to);
+  }
+}
+function finishQuery(base, clauses, params, limit) {
+  const where = clauses.length ? ` WHERE ${clauses.join(" AND ")}` : "";
+  const sql = `${base}${where} ORDER BY created_at DESC${limit ? " LIMIT ?" : ""}`;
+  return { sql, params: limit ? [...params, limit] : params };
+}
+function objectTypeVariants(value) {
+  const variants = /* @__PURE__ */ new Set([value]);
+  if (value.endsWith("s")) variants.add(value.slice(0, -1));
+  else variants.add(`${value}s`);
+  for (const variant of [...variants]) {
+    if (!variant.includes(".")) variants.add(`public.${variant}`);
+  }
+  return [...variants];
+}
+function stringFromUnknown(value) {
+  if (typeof value === "string" && value.trim()) return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return void 0;
+}
+function stringFromPrincipal(value) {
+  if (typeof value === "string") return value;
+  if (isRecord2(value)) return stringFromUnknown(value.id);
+  return void 0;
+}
+function lastIdentifier(value) {
+  const parts = value.split(".");
+  return parts[parts.length - 1] ?? value;
+}
 function stateFromReceipt(receipt) {
   if (receipt.status === "applied" || receipt.status === "already_applied") return "applied";
   if (receipt.status === "conflict") return "conflict";
@@ -2007,6 +2523,10 @@ function rowToProposal(row) {
     action: String(row.action),
     state: String(row.state),
     tenant_id: String(row.tenant_id),
+    principal: row.principal == null ? void 0 : String(row.principal),
+    capability: row.capability == null ? void 0 : String(row.capability),
+    interaction_id: row.interaction_id == null ? void 0 : String(row.interaction_id),
+    tool_call_id: row.tool_call_id == null ? void 0 : String(row.tool_call_id),
     business_object: String(row.business_object),
     object_id: String(row.object_id),
     source_kind: String(row.source_kind),
@@ -2033,6 +2553,7 @@ function rowToEvent(row) {
 function rowToReceipt(row) {
   if (!isRecord2(row)) return void 0;
   return {
+    receipt_id: Number(row.receipt_id),
     writeback_job_id: String(row.writeback_job_id),
     proposal_id: String(row.proposal_id),
     runner_id: String(row.runner_id),
@@ -2049,6 +2570,12 @@ function rowToQueryAudit(row) {
     audit_id: Number(row.audit_id),
     proposal_id: row.proposal_id == null ? void 0 : String(row.proposal_id),
     evidence_bundle_id: row.evidence_bundle_id == null ? void 0 : String(row.evidence_bundle_id),
+    tenant_id: row.tenant_id == null ? void 0 : String(row.tenant_id),
+    principal: row.principal == null ? void 0 : String(row.principal),
+    capability: row.capability == null ? void 0 : String(row.capability),
+    business_object: row.business_object == null ? void 0 : String(row.business_object),
+    object_id: row.object_id == null ? void 0 : String(row.object_id),
+    primary_key_value: row.primary_key_value == null ? void 0 : String(row.primary_key_value),
     source_id: String(row.source_id),
     query_fingerprint: String(row.query_fingerprint),
     table_name: String(row.table_name),
@@ -2158,7 +2685,7 @@ function createMcpRuntime(config, options = {}) {
 }
 function createSynapsorMcpServer(runtime) {
   const server = new McpServer(
-    { name: "synapsor-runner", version: "0.1.0-alpha.3" },
+    { name: "synapsor-runner", version: "0.1.0-alpha.5" },
     { capabilities: { tools: {}, resources: {} } }
   );
   if (runtime.config.mode === "cloud") {
@@ -2252,6 +2779,233 @@ async function serveStdio(options = {}) {
     process.once("SIGTERM", close);
   });
 }
+async function startHttpMcpServer(options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 8765;
+  const authTokenEnv = options.authTokenEnv ?? "SYNAPSOR_RUNNER_HTTP_TOKEN";
+  const env = options.env ?? process.env;
+  const devNoAuth = options.devNoAuth === true;
+  if (devNoAuth && !isLoopbackHost(host)) {
+    throw new McpRuntimeError("HTTP_DEV_NO_AUTH_UNSAFE_HOST", "--dev-no-auth is only allowed with localhost or 127.0.0.1.");
+  }
+  const authToken = devNoAuth ? void 0 : env[authTokenEnv];
+  if (!devNoAuth && !authToken) {
+    throw new McpRuntimeError("HTTP_AUTH_TOKEN_MISSING", `${authTokenEnv} is not set. HTTP MCP requires bearer auth by default.`);
+  }
+  const config = options.config ?? loadRuntimeConfigFromFile(options.configPath);
+  const cloudTools = config.mode === "cloud" ? await fetchCloudToolMetadata(config, env) : void 0;
+  const runtime = createMcpRuntime(config, {
+    env,
+    storePath: options.storePath,
+    readRow: options.readRow,
+    cloudTools
+  });
+  const server = createServer((request, response) => {
+    void handleHttpMcpRequest({
+      request,
+      response,
+      runtime,
+      authToken,
+      devNoAuth,
+      corsOrigin: options.corsOrigin
+    });
+  });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(port, host, () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+  } catch (error) {
+    runtime.close();
+    throw error;
+  }
+  const address = server.address();
+  const actualHost = address.address === "::" ? host : address.address;
+  const actualPort = address.port;
+  const url = `http://${actualHost}:${actualPort}/mcp`;
+  if (options.log !== false) {
+    const log = options.log ?? process.stderr;
+    log.write(`Synapsor Runner HTTP MCP listening on ${url}
+`);
+    log.write(devNoAuth ? "Auth: disabled for localhost development only\n" : `Auth: bearer token from ${authTokenEnv}
+`);
+    log.write(`Config: ${options.configPath ?? "synapsor.runner.json"}
+`);
+    log.write(`Store: ${options.storePath ?? config.storage?.sqlite_path ?? "./.synapsor/local.db"}
+`);
+  }
+  return {
+    host: actualHost,
+    port: actualPort,
+    url,
+    close: () => closeHttpServer(server, runtime)
+  };
+}
+async function handleHttpMcpRequest(input) {
+  const { request, response, runtime, authToken, devNoAuth, corsOrigin } = input;
+  try {
+    setCommonHttpHeaders(response, corsOrigin);
+    if (request.method === "OPTIONS" && corsOrigin) {
+      response.statusCode = 204;
+      response.end();
+      return;
+    }
+    const url = new URL(request.url ?? "/", "http://localhost");
+    if (request.method === "GET" && url.pathname === "/healthz") {
+      writeJson(response, 200, {
+        ok: true,
+        transport: "http",
+        tools: runtime.listTools().length,
+        mode: runtime.config.mode
+      });
+      return;
+    }
+    if (url.pathname !== "/mcp") {
+      writeJson(response, 404, { ok: false, error: "not_found" });
+      return;
+    }
+    if (request.method !== "POST") {
+      writeJson(response, 405, { ok: false, error: "method_not_allowed" });
+      return;
+    }
+    if (!devNoAuth && !validBearerToken(request.headers.authorization, authToken ?? "")) {
+      writeJson(response, 401, { ok: false, error: "unauthorized" });
+      return;
+    }
+    const body = await readRequestBody(request);
+    const payload = JSON.parse(body);
+    if (!isRecord3(payload)) {
+      writeJson(response, 400, jsonRpcError(null, -32600, "JSON-RPC request must be an object."));
+      return;
+    }
+    const id = payload.id ?? null;
+    const method = typeof payload.method === "string" ? payload.method : void 0;
+    if (!method) {
+      writeJson(response, 400, jsonRpcError(id, -32600, "JSON-RPC method is required."));
+      return;
+    }
+    const result = await handleHttpJsonRpcMethod(runtime, method, isRecord3(payload.params) ? payload.params : {});
+    writeJson(response, 200, {
+      jsonrpc: "2.0",
+      id,
+      result: sanitizeHttpPayload(result, authToken)
+    });
+  } catch (error) {
+    const message = sanitizeHttpError(error, authToken);
+    writeJson(response, 200, jsonRpcError(null, -32e3, message));
+  }
+}
+async function handleHttpJsonRpcMethod(runtime, method, params) {
+  if (method === "tools/list") {
+    return {
+      tools: runtime.listTools().map(httpToolMetadata)
+    };
+  }
+  if (method === "tools/call") {
+    const name = typeof params.name === "string" ? params.name : void 0;
+    if (!name) throw new McpRuntimeError("HTTP_TOOL_NAME_REQUIRED", "tools/call requires params.name.");
+    const args = isRecord3(params.arguments) ? params.arguments : isRecord3(params.args) ? params.args : {};
+    return await toolCallResult(runtime, name, args);
+  }
+  if (method === "resources/read") {
+    const uri = typeof params.uri === "string" ? params.uri : void 0;
+    if (!uri) throw new McpRuntimeError("HTTP_RESOURCE_URI_REQUIRED", "resources/read requires params.uri.");
+    return resourceResult(uri, runtime.readResource);
+  }
+  throw new McpRuntimeError("HTTP_JSONRPC_METHOD_UNSUPPORTED", `Unsupported MCP HTTP method: ${method}`);
+}
+function httpToolMetadata(tool) {
+  return {
+    name: tool.name,
+    title: tool.title,
+    description: tool.description,
+    inputSchema: tool.input_schema,
+    annotations: {
+      ...tool.annotations,
+      raw_sql_exposed: false,
+      approval_or_commit_tool: false
+    },
+    _meta: {
+      "synapsor.raw_sql_exposed": false,
+      "synapsor.approval_tool": false,
+      "synapsor.database_credentials_exposed": false,
+      "synapsor.model_controlled_tenant_authority": false
+    }
+  };
+}
+function validBearerToken(header, expected) {
+  if (!header?.startsWith("Bearer ")) return false;
+  const actual = header.slice("Bearer ".length);
+  const actualBuffer = Buffer.from(actual);
+  const expectedBuffer = Buffer.from(expected);
+  return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
+}
+function setCommonHttpHeaders(response, corsOrigin) {
+  response.setHeader("content-type", "application/json; charset=utf-8");
+  if (corsOrigin) {
+    response.setHeader("access-control-allow-origin", corsOrigin);
+    response.setHeader("access-control-allow-methods", "POST, GET, OPTIONS");
+    response.setHeader("access-control-allow-headers", "authorization, content-type");
+  }
+}
+function writeJson(response, statusCode, payload) {
+  response.statusCode = statusCode;
+  response.end(`${JSON.stringify(payload, null, 2)}
+`);
+}
+async function readRequestBody(request) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > 1024 * 1024) {
+      throw new McpRuntimeError("HTTP_BODY_TOO_LARGE", "HTTP MCP request body exceeds 1 MiB.");
+    }
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function jsonRpcError(id, code, message) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    error: { code, message }
+  };
+}
+function sanitizeHttpError(error, authToken) {
+  const raw = error instanceof Error ? error.message : String(error);
+  return sanitizeHttpString(raw, authToken);
+}
+function sanitizeHttpPayload(value, authToken) {
+  if (typeof value === "string") return sanitizeHttpString(value, authToken);
+  if (Array.isArray(value)) return value.map((item) => sanitizeHttpPayload(item, authToken));
+  if (isRecord3(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeHttpPayload(item, authToken)]));
+  }
+  return value;
+}
+function sanitizeHttpString(value, authToken) {
+  let redacted = value.replace(/(?:postgres(?:ql)?|mysql):\/\/[^\s"']+/gi, "[redacted-database-url]");
+  if (authToken) redacted = redacted.split(authToken).join("[redacted-token]");
+  return redacted;
+}
+function isLoopbackHost(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+async function closeHttpServer(server, runtime) {
+  await new Promise((resolve, reject) => {
+    server.close((error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  }).finally(() => {
+    runtime.close();
+  });
+}
 async function toolCallResult(runtime, toolName, args) {
   try {
     const structuredContent = await runtime.callTool(toolName, args);
@@ -2798,9 +3552,9 @@ function readLocalResource(store, uri) {
     return { proposal, events: store.events(id), receipts: store.receipts(id) };
   }
   if (collection === "evidence") {
-    const evidence = store.getEvidenceBundle(id);
-    if (!evidence) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Evidence bundle not found: ${id}`);
-    return evidence;
+    const evidence2 = store.getEvidenceBundle(id);
+    if (!evidence2) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Evidence bundle not found: ${id}`);
+    return evidence2;
   }
   if (collection === "replay") {
     const proposalId = id.startsWith("replay_") ? id.slice("replay_".length) : id;
@@ -4337,7 +5091,7 @@ async function startPolling(config, adapters2, signal) {
 // apps/runner/src/local-ui.ts
 import crypto4 from "node:crypto";
 import fs2 from "node:fs/promises";
-import { createServer } from "node:http";
+import { createServer as createServer2 } from "node:http";
 import path2 from "node:path";
 async function startLocalUiServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
@@ -4348,7 +5102,7 @@ async function startLocalUiServer(options = {}) {
   const storePath = path2.resolve(options.storePath ?? "./.synapsor/local.db");
   const token = options.token ?? crypto4.randomBytes(24).toString("base64url");
   const csrfToken = options.csrfToken ?? crypto4.randomBytes(24).toString("base64url");
-  const server = createServer(async (request, response) => {
+  const server = createServer2(async (request, response) => {
     try {
       await handleRequest({ request, response, configPath, storePath, token, csrfToken, tour: options.tour === true });
     } catch (error) {
@@ -4392,7 +5146,7 @@ async function handleRequest(input) {
   }
   if (request.method === "GET" && url.pathname === "/") {
     response.setHeader("set-cookie", `synapsor_ui_token=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/`);
-    sendHtml(response, renderShell(csrfToken, tour || url.searchParams.get("tour") === "1"));
+    sendHtml(response, renderShell(csrfToken, tour || url.searchParams.get("tour") === "1", configPath, storePath));
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/summary") {
@@ -4691,8 +5445,10 @@ function sendHtml(response, html) {
   response.setHeader("cache-control", "no-store");
   response.end(html);
 }
-function renderShell(csrfToken, tour = false) {
+function renderShell(csrfToken, tour = false, configPath = "synapsor.runner.json", storePath = "./.synapsor/local.db") {
   const escapedCsrf = escapeScriptString(csrfToken);
+  const escapedConfigPath = escapeScriptString(configPath);
+  const escapedStorePath = escapeScriptString(storePath);
   const tourHtml = tour ? `
     <div class="card full tour">
       <h2>Commit-safe MCP in one loop</h2>
@@ -4822,6 +5578,8 @@ details.raw > summary { cursor:pointer; color:var(--blue); font-weight:600; font
 </main>
 <script>
 const csrfToken = "${escapedCsrf}";
+const configPath = "${escapedConfigPath}";
+const storePath = "${escapedStorePath}";
 const state = { selected: null, firstId: null };
 const byId = (id) => document.getElementById(id);
 const text = (tag, value, className = "") => { const node = document.createElement(tag); node.textContent = value == null ? "" : String(value); if (className) node.className = className; return node; };
@@ -4915,6 +5673,13 @@ function guardDrawer(gc) {
   d.append(kv);
   return d;
 }
+function shellQuote(value) {
+  const text = String(value || "");
+  return /^[A-Za-z0-9_./:@=-]+$/.test(text) ? text : "'" + text.replace(/'/g, "'\\\\''") + "'";
+}
+function trustedApplyCommand(proposalId) {
+  return "synapsor apply " + shellQuote(proposalId) + " --config " + shellQuote(configPath) + " --store " + shellQuote(storePath);
+}
 async function loadSummary() {
   const payload = await api("/api/summary");
   const root = byId("summary"); root.replaceChildren(text("h2", "Setup summary"));
@@ -5109,6 +5874,24 @@ async function loadDetail(proposalId) {
     const reject = el("button", { class: "danger", text: "Reject", onclick: async () => { await api("/api/proposals/" + encodeURIComponent(proposalId) + "/reject", { method: "POST", headers: { "x-synapsor-csrf": csrfToken }, body: JSON.stringify({ actor: actor.value, reason: reason.value || "rejected from local UI", confirm: "reject" }) }); await loadProposals(); await loadDetail(proposalId); } });
     actions.append(approve, reject);
     reviewPane.append(el("div", { class: "callout", text: "You are the approval authority here \u2014 the model cannot reach these controls." }), actor, reason, actions);
+  } else if (proposal.state === "approved" || proposal.state === "pending_worker") {
+    const command = trustedApplyCommand(proposalId);
+    const commandBox = el("div", { class: "mono", text: command, style: "display:block;margin-top:8px" });
+    const copied = el("span", { class: "status-line", text: "" });
+    const copy = el("button", { text: "Copy guarded apply command", onclick: async () => {
+      try {
+        await navigator.clipboard.writeText(command);
+        copied.textContent = "Copied. Run this from a trusted terminal with write credentials.";
+      } catch {
+        copied.textContent = "Copy this guarded apply command and run it from a trusted terminal with write credentials.";
+      }
+    } });
+    reviewPane.append(
+      el("div", { class: "callout", text: "Apply guarded writeback from a trusted terminal. This remains outside MCP, so the model still cannot commit." }),
+      commandBox,
+      el("div", { class: "actions" }, [copy]),
+      copied,
+    );
   }
 
   jsonPane.append(
@@ -5252,6 +6035,7 @@ var dangerousDatabaseMcpAuditExample = {
 };
 var defaultConfigPath = "synapsor.runner.json";
 var defaultStorePath = "./.synapsor/local.db";
+var quickDemoStorePath = "./.synapsor/quick-demo.db";
 var referenceDemoDir = "examples/reference-support-billing-app";
 var referenceDemoConfigPath = `${referenceDemoDir}/synapsor.runner.json`;
 var referenceDemoContainer = "synapsor_runner_reference_support_billing";
@@ -5274,6 +6058,14 @@ async function main(argv) {
     usage([]);
     return 0;
   }
+  if (!isKnownTopLevelCommand(command)) {
+    process2.stderr.write(`Unknown command: synapsor ${command}
+
+Try:
+synapsor --help
+`);
+    return 2;
+  }
   if (isHelpRequest(rest)) {
     usage([command, ...rest.filter((arg) => arg !== "--help" && arg !== "-h")]);
     return 0;
@@ -5301,9 +6093,18 @@ async function main(argv) {
   if (command === "benchmark") return benchmark(rest);
   if (command === "proposals") return proposals(rest);
   if (command === "replay") return replay(rest);
+  if (command === "evidence") return evidence(rest);
+  if (command === "query-audit") return queryAudit(rest);
+  if (command === "receipts") return receipts(rest);
+  if (command === "activity") return activity(rest);
+  if (command === "store") return storeCommand(rest);
   if (command === "shadow") return shadow(rest);
   if (command === "ui") return ui(rest);
-  usage([]);
+  process2.stderr.write(`Unknown command: synapsor ${command}
+
+Try:
+synapsor --help
+`);
   return 2;
 }
 async function init(args) {
@@ -5367,7 +6168,9 @@ async function runInitWizard(args, options = {}) {
   const ask = options.ask ?? askTtyQuestion;
   const stdout = options.stdout ?? process2.stdout;
   stdout.write("Synapsor Runner guided init\n");
-  stdout.write("Use a staging or disposable Postgres/MySQL database first. The wizard stores environment-variable names, not credentials.\n\n");
+  stdout.write("Use a staging or disposable Postgres/MySQL database first. The wizard stores environment-variable names, not credentials.\n");
+  stdout.write("Flow: inspect database -> create trusted context -> create capability -> expose MCP tool.\n\n");
+  stdout.write("Step 1: Inspect database metadata\n");
   const engineInput = await askChoice(ask, "Engine", optionalArg(args, "--engine") ?? "auto", ["postgres", "mysql", "auto"]);
   const databaseInput = databaseInputFromArgs(args);
   if (databaseInput.inlineUrl) {
@@ -5390,21 +6193,27 @@ async function runInitWizard(args, options = {}) {
     stdout.write(`  - ${table2.schema}.${table2.name} (${table2.type}, pk=${table2.primary_key.join(",") || "none"}, tenant=${table2.suggestions.tenant_columns.join(",") || "none"})
 `);
   }
-  const tableName = await askDefault(ask, "Table/view for this capability", optionalArg(args, "--table") ?? tables[0]?.name ?? "");
+  stdout.write("\nStep 2: Create trusted context\n");
+  stdout.write("Choose the source object and trusted scope. Tenant and principal values come from your backend/session, not from the model.\n");
+  const tableName = await askDefault(ask, "Source table/view for this context", optionalArg(args, "--table") ?? tables[0]?.name ?? "");
   const table = findInspectionTable(inspection, tableName, schema);
   if (!table) throw new Error(`table not found in inspection: ${schema}.${tableName}`);
   const columns = table.columns.map((column) => column.name);
   const primaryKey = await askColumn(ask, "Primary-key column", optionalArg(args, "--primary-key") ?? table.primary_key[0] ?? inferPrimaryKeyCandidate(table), columns);
   const suggestedTenant = optionalArg(args, "--tenant-key") ?? table.suggestions.tenant_columns[0];
-  const tenantAnswer = await askDefault(ask, "Tenant/scope column. Leave blank only for a reviewed single-tenant dev source", suggestedTenant ?? "");
+  const tenantAnswer = await askDefault(ask, "Trusted tenant/scope column", suggestedTenant ?? "");
   const singleTenantDev = !tenantAnswer && (await askDefault(ask, "No tenant column selected. Type yes to mark this as a single-tenant dev source", "no")).toLowerCase() === "yes";
   if (!tenantAnswer && !singleTenantDev) throw new Error("tenant/scope column is required unless single-tenant dev source is explicitly confirmed");
   if (tenantAnswer && !columns.includes(tenantAnswer)) throw new Error(`tenant column ${tenantAnswer} does not exist on ${table.schema}.${table.name}`);
-  const mode = await askChoice(ask, "Mode", optionalArg(args, "--mode") ?? "read_only", ["read_only", "shadow", "review"]);
+  const tenantEnv = await askEnvName(ask, "Trusted tenant env var", optionalArg(args, "--tenant-env") ?? "SYNAPSOR_TENANT_ID");
+  const principalEnv = await askEnvName(ask, "Trusted principal env var", optionalArg(args, "--principal-env") ?? "SYNAPSOR_PRINCIPAL");
+  stdout.write("\nStep 3: Create capability\n");
+  stdout.write("Name the semantic tool the model can call. Table, key, visible fields, and mode define what that capability can do.\n");
+  const mode = await askChoice(ask, "Capability mode", optionalArg(args, "--mode") ?? "read_only", ["read_only", "shadow", "review"]);
   const conflictAnswer = mode === "read_only" ? optionalArg(args, "--conflict-column") ?? "" : await askDefault(ask, "Conflict/version column", optionalArg(args, "--conflict-column") ?? table.suggestions.conflict_columns[0] ?? "");
   if (conflictAnswer && !columns.includes(conflictAnswer)) throw new Error(`conflict column ${conflictAnswer} does not exist on ${table.schema}.${table.name}`);
   const defaultVisible = table.suggestions.default_visible_columns.join(",");
-  let visibleColumns = parseColumnList(await askDefault(ask, "Read-visible columns", optionalArg(args, "--visible-columns") ?? defaultVisible));
+  let visibleColumns = parseColumnList(await askDefault(ask, "Capability read-visible columns", optionalArg(args, "--visible-columns") ?? defaultVisible));
   ensureColumnsExist(visibleColumns, columns, "visible");
   if (mode !== "read_only" && !conflictAnswer) {
     const weak = await askDefault(ask, "No conflict/version column selected. Type yes to continue with a weak guard", "no");
@@ -5472,8 +6281,6 @@ async function runInitWizard(args, options = {}) {
   const namespace = await askDefault(ask, "Capability namespace", optionalArg(args, "--namespace") ?? recipeSpec?.namespace ?? "source");
   const objectName = await askDefault(ask, "Business object name", optionalArg(args, "--object-name") ?? recipeSpec?.object_name ?? safeObjectName(table.name));
   const lookupArg = await askDefault(ask, "Model-visible object id argument", optionalArg(args, "--lookup-arg") ?? recipeSpec?.lookup_arg ?? `${objectName}_id`);
-  const tenantEnv = await askEnvName(ask, "Trusted tenant env var", optionalArg(args, "--tenant-env") ?? "SYNAPSOR_TENANT_ID");
-  const principalEnv = await askEnvName(ask, "Trusted principal env var", optionalArg(args, "--principal-env") ?? "SYNAPSOR_PRINCIPAL");
   const writeUrlEnv = mode === "review" ? await askEnvName(ask, "Write URL env var for trusted apply path", optionalArg(args, "--write-url-env") ?? "SYNAPSOR_DATABASE_WRITE_URL") : optionalArg(args, "--write-url-env") ?? "SYNAPSOR_DATABASE_WRITE_URL";
   const approvalRole = mode === "read_only" ? "local_reviewer" : await askDefault(ask, "Required approval role", optionalArg(args, "--approval-role") ?? recipeSpec?.approval?.required_role ?? "local_reviewer");
   const spec = {
@@ -5511,6 +6318,8 @@ async function runInitWizard(args, options = {}) {
   const generated = generateRunnerConfigFromSpec(spec);
   const tools2 = generated.config.capabilities.map((capability) => `${capability.name} (${capability.kind})`);
   stdout.write("\nPreview:\n");
+  stdout.write(`  trusted context: tenant from ${tenantEnv}${singleTenantDev ? " (single-tenant dev source)" : tenantAnswer ? ` via ${tenantAnswer}` : ""}; principal from ${principalEnv}
+`);
   stdout.write(`  source: ${inspection.engine} ${table.schema}.${table.name}
 `);
   stdout.write(`  mode: ${mode}
@@ -6127,6 +6936,49 @@ function formatLocalDoctorReport(report) {
   return `${lines.join("\n")}
 `;
 }
+function formatLocalDoctorMarkdown(report) {
+  const store = report.store_stats;
+  const boundaryOk = report.checks.find((check) => check.name === "mcp-tool-boundary")?.ok === true;
+  const lines = [
+    "# Synapsor Runner Doctor Report",
+    "",
+    `- Runner package: @synapsor/runner`,
+    `- Node version: ${process2.versions.node}`,
+    `- Config: ${report.config_path}`,
+    `- Mode: ${report.mode}`,
+    `- Status: ${report.ok ? "ok" : "needs attention"}`,
+    "",
+    "## Semantic Tools",
+    "",
+    ...report.tools.length ? report.tools.map((tool) => `- ${tool}`) : ["- none listed"],
+    "",
+    "## Safety Boundary",
+    "",
+    `- Raw SQL / commit tools exposed: ${boundaryOk ? "no obvious forbidden tools detected" : "needs review"}`,
+    "- Database URLs, passwords, bearer tokens, and private keys are intentionally not included in this report.",
+    "",
+    "## Local Store",
+    "",
+    `- Path: ${store?.path ?? "not configured"}`,
+    `- Exists: ${store?.exists ? "yes" : "no"}`,
+    ...store?.exists ? [
+      `- Proposals: ${store.proposals ?? 0}`,
+      `- Evidence bundles: ${store.evidence ?? 0}`,
+      `- Query audit records: ${store.query_audit ?? 0}`,
+      `- Receipts: ${store.receipts ?? 0}`
+    ] : [],
+    "",
+    "## Checks",
+    "",
+    ...report.checks.map((check) => `- ${check.level.toUpperCase()} ${check.name}: ${check.message}`),
+    "",
+    "## Redaction Note",
+    "",
+    "This report is redacted by design. Do not attach raw database URLs, passwords, API keys, bearer tokens, private keys, cookies, or customer data when sharing diagnostics."
+  ];
+  return `${lines.join("\n")}
+`;
+}
 var moduleDir = path3.dirname(fileURLToPath(import.meta.url));
 var packageAssetRoot = path3.resolve(moduleDir, "..");
 var sourceAssetRoot = path3.resolve(moduleDir, "../../..");
@@ -6479,9 +7331,16 @@ async function localDoctor(args) {
     mode: String(parsed.mode),
     config_path: configPath,
     checks,
-    tools: tools2
+    tools: tools2,
+    store_stats: await localDoctorStoreStats(optionalArg(args, "--store") ?? parsed.storage?.sqlite_path)
   };
-  if (args.includes("--json")) {
+  if (args.includes("--report")) {
+    const output = outputArg(args) ?? "synapsor-doctor.md";
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, formatLocalDoctorMarkdown(report), "utf8");
+    process2.stdout.write(`wrote redacted doctor report: ${output}
+`);
+  } else if (args.includes("--json")) {
     process2.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
   } else {
@@ -6489,6 +7348,23 @@ async function localDoctor(args) {
   }
   return report.ok ? 0 : 1;
 }
+async function localDoctorStoreStats(storePath) {
+  if (!storePath || storePath === ":memory:") return { path: storePath ?? "not configured", exists: storePath === ":memory:" };
+  if (!await fileExists(storePath)) return { path: storePath, exists: false };
+  const store = new ProposalStore(storePath);
+  try {
+    return {
+      path: storePath,
+      exists: true,
+      proposals: store.listProposals({ limit: 1e6 }).length,
+      evidence: store.listEvidenceBundles({ limit: 1e6 }).length,
+      query_audit: store.listQueryAudit({ limit: 1e6 }).length,
+      receipts: store.listReceipts({ limit: 1e6 }).length
+    };
+  } finally {
+    store.close();
+  }
+}
 async function validate(args) {
   const job = await readJob(args);
   parseWritebackJob(job);
@@ -6567,21 +7443,21 @@ async function applyProposal(args, proposalId) {
         lease_seconds: Number(optionalArg(args, "--lease-seconds") ?? "300")
       });
       const result = await applySqlJob(job, configPath, storePath, dryRun, envWithDemoDefaults(config, configPath));
-      process2.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(result, null, 2)}
+` : formatApplyResult(parseWritebackJob(job), result, dryRun, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     const executor = executorConfig(config, executorName);
     if (executor.type === "http_handler") {
       const result = await applyHttpHandlerProposal({ store, proposalId: resolvedProposalId, proposal, executorName, executor, runnerId, dryRun, env: envWithDemoDefaults(config, configPath) });
-      process2.stdout.write(`${JSON.stringify(redactConfig(result), null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(redactConfig(result), null, 2)}
+` : formatHandlerApplyResult(result, resolvedProposalId, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     if (executor.type === "command_handler") {
       const result = await applyCommandHandlerProposal({ store, proposalId: resolvedProposalId, proposal, executorName, executor, runnerId, dryRun, env: envWithDemoDefaults(config, configPath) });
-      process2.stdout.write(`${JSON.stringify(redactConfig(result), null, 2)}
-`);
+      process2.stdout.write(args.includes("--json") ? `${JSON.stringify(redactConfig(result), null, 2)}
+` : formatHandlerApplyResult(result, resolvedProposalId, storePath));
       return result.status === "failed" ? 1 : 0;
     }
     throw new Error(`unsupported executor type for ${executorName}`);
@@ -6757,8 +7633,8 @@ function prepareHandlerProposal(store, proposal, runnerId) {
   };
 }
 function duplicateHandlerReceipt(store, proposalId) {
-  const receipts = store.receipts(proposalId);
-  const existing = receipts.find((receipt) => receipt.writeback_job_id.startsWith("hwb_"));
+  const receipts2 = store.receipts(proposalId);
+  const existing = receipts2.find((receipt) => receipt.writeback_job_id.startsWith("hwb_"));
   return existing ? { receipt: existing.receipt } : void 0;
 }
 function alreadyAppliedReceipt(receipt, runnerId) {
@@ -6837,14 +7713,115 @@ function buildHandlerReceipt(input) {
 function hashReceipt(input) {
   return `sha256:${crypto5.createHash("sha256").update(JSON.stringify(input)).digest("hex")}`;
 }
-function parseOptionalJson(text) {
-  if (!text.trim()) return {};
-  try {
-    return JSON.parse(text);
-  } catch {
-    return { status: "failed", safe_error_code: "HANDLER_INVALID_JSON" };
+function formatApplyResult(job, result, dryRun, storePath) {
+  const status = writebackResultStatus(result);
+  const affectedRows = writebackAffectedRows(result);
+  const errorCode = writebackErrorCode(result);
+  const receiptHash = writebackReceiptHash(result);
+  const conflictGuardPassed = status === "conflict" && errorCode === "VERSION_CONFLICT" ? "no" : status === "applied" ? "yes" : "not completed";
+  const title = status === "conflict" ? "Guarded writeback returned conflict." : status === "failed" ? "Guarded writeback failed." : dryRun ? "Guarded writeback dry run passed." : affectedRows === 0 ? "Guarded writeback already applied." : "Guarded writeback applied.";
+  const lines = [
+    title,
+    "",
+    "Checks:",
+    "* proposal approved: yes",
+    `* primary key matched: ${status === "conflict" && errorCode === "ROW_NOT_FOUND" ? "no" : status === "failed" ? "not completed" : "yes"}`,
+    `* tenant guard matched: ${status === "conflict" && errorCode === "ROW_NOT_FOUND" ? "no" : status === "failed" ? "not completed" : "yes"}`,
+    "* allowed columns only: yes",
+    `* conflict guard passed: ${conflictGuardPassed}`,
+    `* affected rows: ${affectedRows}`,
+    `* idempotency key: ${job.idempotency_key}`,
+    ""
+  ];
+  if (status === "conflict") {
+    lines.push(
+      errorCode === "VERSION_CONFLICT" ? "The row changed after the agent saw it." : "The target row was not available under the primary-key and tenant guard.",
+      "",
+      "Result:",
+      "conflict",
+      "",
+      "Source DB changed by Synapsor:",
+      "no",
+      "",
+      "Why:",
+      errorCode === "VERSION_CONFLICT" ? "conflict/version guard did not match" : errorCode || "guarded writeback returned conflict",
+      ""
+    );
   }
-}
+  if (status === "failed") {
+    lines.push("Error:", errorCode || "writeback failed", "");
+  }
+  lines.push(
+    "Receipt:",
+    receiptHash || "(stored locally)",
+    "",
+    "Replay:",
+    `${cliCommandName()} replay ${job.proposal_id} --store ${storePath}`,
+    ""
+  );
+  return `${lines.join("\n")}
+`;
+}
+function formatHandlerApplyResult(receipt, proposalId, storePath) {
+  const title = receipt.status === "conflict" ? "App-owned writeback returned conflict." : receipt.status === "failed" ? "App-owned writeback failed." : receipt.status === "already_applied" ? "App-owned writeback already applied." : "App-owned writeback applied.";
+  const lines = [
+    title,
+    "",
+    "Checks:",
+    "* proposal approved: yes",
+    "* execution authority: app-owned handler outside MCP",
+    `* source database changed by handler: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    `* affected rows: ${receipt.rows_affected}`,
+    `* idempotency key: ${receipt.idempotency_key}`,
+    ""
+  ];
+  if (receipt.status === "conflict") {
+    lines.push(
+      "Result:",
+      "conflict",
+      "",
+      "Why:",
+      receipt.safe_error_code || "handler returned conflict",
+      ""
+    );
+  }
+  if (receipt.status === "failed") {
+    lines.push("Error:", receipt.safe_error_code || "handler writeback failed", "");
+  }
+  lines.push(
+    "Receipt:",
+    receipt.receipt_hash,
+    "",
+    "Replay:",
+    `${cliCommandName()} replay ${proposalId} --store ${storePath}`,
+    ""
+  );
+  return `${lines.join("\n")}
+`;
+}
+function writebackResultStatus(result) {
+  return String(result.status ?? "unknown");
+}
+function writebackAffectedRows(result) {
+  const value = result.affected_rows ?? result.rows_affected ?? 0;
+  return Number.isFinite(Number(value)) ? Number(value) : 0;
+}
+function writebackErrorCode(result) {
+  const value = result.error_code ?? result.safe_error_code;
+  return typeof value === "string" && value ? value : void 0;
+}
+function writebackReceiptHash(result) {
+  const value = result.result_hash ?? result.receipt_hash;
+  return typeof value === "string" && value ? value : void 0;
+}
+function parseOptionalJson(text) {
+  if (!text.trim()) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { status: "failed", safe_error_code: "HANDLER_INVALID_JSON" };
+  }
+}
 function scalarOrUndefined(value) {
   if (value === void 0) return void 0;
   if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
@@ -7000,7 +7977,7 @@ async function cloudConnect(args) {
     return 1;
   }
   const runnerId = String(parsed.cloud.runner_id || process2.env.SYNAPSOR_RUNNER_ID || "synapsor_runner_local").trim();
-  const runnerVersion = String(parsed.cloud.runner_version || process2.env.npm_package_version || "0.1.0-alpha.3").trim();
+  const runnerVersion = String(parsed.cloud.runner_version || process2.env.npm_package_version || "0.1.0-alpha.5").trim();
   const engines = normalizeEngines(parsed.cloud.engines);
   const capabilities = normalizeCapabilities(parsed.cloud.capabilities);
   const client = new ControlPlaneClient({
@@ -7050,6 +8027,7 @@ async function cloudConnect(args) {
 async function mcp(args) {
   const [subcommand, ...rest] = args;
   if (subcommand === "serve") return mcpServe(rest);
+  if (subcommand === "serve-http") return mcpServeHttp(rest);
   if (subcommand === "audit") return mcpAudit(rest);
   if (subcommand === "config") return mcpConfig(rest);
   if (subcommand === "configure") return mcpConfigure(rest);
@@ -7095,16 +8073,98 @@ async function onboard(args) {
 }
 async function demo(args) {
   const [subcommand] = args;
+  if (subcommand === "inspect") return demoInspect(args.slice(1));
   if (subcommand && !subcommand.startsWith("-") && subcommand !== "reference-support-billing") {
     usage(["demo"]);
     return 2;
   }
-  if (args.includes("--quick")) return quickDemo();
+  if (args.includes("--quick")) return quickDemo(args);
   return prepareReferenceDemo(args);
 }
-async function quickDemo() {
-  process2.stdout.write([
-    "Synapsor Runner quick demo (fixture-only)",
+async function quickDemo(args) {
+  const allowed = /* @__PURE__ */ new Set(["--quick", "--guided", "--no-interactive", "--details", "--json"]);
+  assertKnownOptions(args, allowed, "demo --quick");
+  const seeded = await seedQuickDemoStore(quickDemoStorePath);
+  const summary = quickDemoSummary(seeded);
+  if (args.includes("--json")) {
+    process2.stdout.write(`${JSON.stringify(summary, null, 2)}
+`);
+    return 0;
+  }
+  if (args.includes("--details")) {
+    process2.stdout.write(formatQuickDemoDetails(seeded));
+    return 0;
+  }
+  const canPauseForInput = Boolean(process2.stdin.isTTY && process2.stdout.isTTY && !process2.env.CI && !process2.env.VITEST);
+  const forceConcise = args.includes("--no-interactive");
+  const forceGuided = args.includes("--guided") && !forceConcise;
+  const shouldGuide = forceGuided || canPauseForInput && !forceConcise;
+  if (shouldGuide) {
+    await runGuidedQuickDemo(seeded, { pause: canPauseForInput });
+    return 0;
+  }
+  process2.stdout.write(formatQuickDemoConcise(seeded));
+  return 0;
+}
+async function demoInspect(args) {
+  const allowed = /* @__PURE__ */ new Set(["--npx", "--json"]);
+  assertKnownOptions(args, allowed, "demo inspect");
+  const seeded = await seedQuickDemoStore(quickDemoStorePath);
+  const commands = quickDemoInspectCommands(args.includes("--npx"));
+  if (args.includes("--json")) {
+    process2.stdout.write(`${JSON.stringify({ ...quickDemoSummary(seeded), commands }, null, 2)}
+`);
+    return 0;
+  }
+  process2.stdout.write(formatQuickDemoInspect(commands));
+  return 0;
+}
+function quickDemoSummary(seeded) {
+  return {
+    mode: "fixture_only",
+    store: quickDemoStorePath,
+    proposal_id: seeded.proposal_id,
+    evidence_bundle_id: seeded.evidence_bundle_id,
+    replay_id: seeded.replay_id,
+    model_tool: "billing.propose_late_fee_waiver",
+    business_object: "invoice:INV-3001",
+    proposed_change: { late_fee_cents: { before: 5500, after: 0 } },
+    source_database_changed: false,
+    approval: "required outside MCP"
+  };
+}
+function formatQuickDemoConcise(seeded) {
+  void seeded;
+  return [
+    "Synapsor quick demo complete.",
+    "",
+    "The model asked to waive a late fee:",
+    'billing.propose_late_fee_waiver(invoice_id="INV-3001")',
+    "",
+    "Result:",
+    "* proposal created",
+    "* source DB changed: no",
+    "* approval required outside MCP",
+    "* evidence + replay saved locally",
+    "",
+    "Local ledger:",
+    quickDemoStorePath,
+    "",
+    "Next:",
+    `${cliCommandName()} demo inspect`,
+    ""
+  ].join("\n");
+}
+function formatQuickDemoDetails(seeded) {
+  return [
+    "Synapsor Runner quick demo is ready.",
+    "",
+    "This is a fixture-only first look. It does not start Docker, connect a database,",
+    "or require an MCP client. It writes an inspectable local ledger fixture to:",
+    quickDemoStorePath,
+    "",
+    "If you ran this through one-off npx and did not install the package, prefix",
+    "follow-up commands with: npx -y -p @synapsor/runner@alpha synapsor",
     "",
     "Raw MCP shape:",
     "execute_sql(sql: string)",
@@ -7115,7 +8175,7 @@ async function quickDemo() {
     "billing.propose_late_fee_waiver(invoice_id, reason)",
     "",
     "Agent requested:",
-    'billing.propose_late_fee_waiver(invoice_id="INV-3001")',
+    'billing.propose_late_fee_waiver(invoice_id="INV-3001", reason="approved support waiver")',
     "",
     "Trusted context:",
     "tenant_id = acme",
@@ -7131,14 +8191,360 @@ async function quickDemo() {
     "required outside MCP",
     "",
     "Replay:",
-    "available after approval/apply",
+    `${seeded.replay_id} captures the local proposal, evidence handle, query audit, and events.`,
+    `Proposal id: ${seeded.proposal_id}`,
+    `Evidence id: ${seeded.evidence_bundle_id}`,
     "",
-    "Next:",
+    "What this proves:",
+    "* The model gets a business tool, not raw SQL.",
+    "* The model created a proposal, not a write.",
+    "* Source DB changed: no.",
+    "* You can inspect evidence and replay locally.",
+    "",
+    "Try:",
+    `1. ${cliCommandName()} proposals show latest --store ${quickDemoStorePath}`,
+    `2. ${cliCommandName()} activity search --object invoice:INV-3001 --store ${quickDemoStorePath}`,
+    `3. ${cliCommandName()} replay show latest --store ${quickDemoStorePath}`,
+    "",
+    "For full reviewer detail:",
+    `${cliCommandName()} replay show latest --details --store ${quickDemoStorePath}`,
+    "",
+    "For real guarded writeback against disposable Postgres:",
     `${cliCommandName()} demo`,
-    `${cliCommandName()} audit --example dangerous-db-mcp`,
+    ""
+  ].join("\n");
+}
+async function runGuidedQuickDemo(seeded, options) {
+  const screens = quickDemoGuidedScreens(seeded);
+  for (const [index, screen] of screens.entries()) {
+    printStep(screen.title, screen.body, index + 1, screens.length);
+    if (index < screens.length - 1) {
+      await waitForEnter("Press Enter to continue...", options);
+    }
+  }
+}
+function quickDemoGuidedScreens(seeded) {
+  return [
+    {
+      title: "Synapsor Runner quick demo",
+      body: [
+        "This teaches the Synapsor safety model without Docker, a database, or an MCP client.",
+        "",
+        "It also creates a local fixture ledger you can inspect."
+      ]
+    },
+    {
+      title: "The risky default",
+      body: [
+        "Many database MCP demos expose this:",
+        "",
+        "execute_sql(sql: string)",
+        "",
+        "That means the model can receive database authority directly."
+      ]
+    },
+    {
+      title: "The Synapsor boundary",
+      body: [
+        "Synapsor gives the model business tools instead:",
+        "",
+        "billing.inspect_invoice(invoice_id)",
+        "billing.propose_late_fee_waiver(invoice_id, reason)",
+        "",
+        "The model can ask for a business change.",
+        "It cannot commit the write."
+      ]
+    },
+    {
+      title: "What the agent requested",
+      body: [
+        'billing.propose_late_fee_waiver(invoice_id="INV-3001")',
+        "",
+        "Proposed change:",
+        "late_fee_cents: 5500 -> 0",
+        "",
+        "Source DB changed:",
+        "no"
+      ]
+    },
+    {
+      title: "What Synapsor saved",
+      body: [
+        "Synapsor saved:",
+        "",
+        "- proposal: what the model requested",
+        "- evidence: what data supported it",
+        "- query audit: what was read",
+        "- replay: what happened later",
+        "",
+        `Proposal: ${seeded.proposal_id}`,
+        `Evidence: ${seeded.evidence_bundle_id}`,
+        `Replay: ${seeded.replay_id}`,
+        "",
+        "Local ledger:",
+        quickDemoStorePath
+      ]
+    },
+    {
+      title: "Inspect it",
+      body: [
+        "Run this next:",
+        "",
+        "npx -y -p @synapsor/runner@alpha synapsor demo inspect",
+        "",
+        "demo inspect shows the proposal, evidence, activity search, and replay commands.",
+        "",
+        "If installed globally, use:",
+        "synapsor demo inspect"
+      ]
+    },
+    {
+      title: "Next paths",
+      body: [
+        "Full disposable Postgres demo:",
+        `${cliCommandName()} demo`,
+        "",
+        "Audit risky MCP database tools:",
+        `${cliCommandName()} audit --example dangerous-db-mcp`,
+        "",
+        "Use your own staging DB:",
+        'export DATABASE_URL="postgres://..."',
+        `${cliCommandName()} inspect --from-env DATABASE_URL`,
+        "",
+        "Done. You just saw Synapsor's core boundary: business tools for the model, approval/writeback outside the model, and replay for inspection."
+      ]
+    }
+  ];
+}
+function printStep(title, body, index, total) {
+  const divider = "------------------------------------------------------------";
+  process2.stdout.write([
+    "",
+    divider,
+    `Step ${index}/${total}: ${title}`,
+    divider,
+    "",
+    ...body,
     ""
   ].join("\n"));
-  return 0;
+}
+async function waitForEnter(message, options) {
+  if (!options.pause) {
+    process2.stdout.write(`${message}
+`);
+    return;
+  }
+  const rl = readline.createInterface({ input: process2.stdin, output: process2.stdout });
+  try {
+    await rl.question(`${message} `);
+  } finally {
+    rl.close();
+  }
+}
+function quickDemoInspectCommands(useNpx) {
+  const cmd = useNpx ? "npx -y -p @synapsor/runner@alpha synapsor" : cliCommandName();
+  return [
+    {
+      label: "Proposal summary",
+      description: "See what the model asked to change.",
+      command: `${cmd} proposals show latest --store ${quickDemoStorePath}`
+    },
+    {
+      label: "Evidence",
+      description: "Inspect rows and evidence items captured for the proposal.",
+      command: `${cmd} evidence show ev_quick_INV_3001 --store ${quickDemoStorePath}`
+    },
+    {
+      label: "Activity search",
+      description: "Find the local ledger records for invoice INV-3001.",
+      command: `${cmd} activity search --object invoice:INV-3001 --store ${quickDemoStorePath}`
+    },
+    {
+      label: "Replay",
+      description: "Replay the local proposal/evidence/audit story.",
+      command: `${cmd} replay show latest --store ${quickDemoStorePath}`
+    },
+    {
+      label: "Approve outside MCP",
+      description: "Approve the proposal through the local operator boundary.",
+      command: `${cmd} proposals approve latest --yes --store ${quickDemoStorePath}`
+    },
+    {
+      label: "Full Docker-backed demo",
+      description: "Run the disposable Postgres-backed proof.",
+      command: `${cmd} demo`
+    },
+    {
+      label: "Audit risky MCP database tools",
+      description: "Review common dangerous MCP tool shapes.",
+      command: `${cmd} audit --example dangerous-db-mcp`
+    }
+  ];
+}
+function formatQuickDemoInspect(commands) {
+  return [
+    "Quick demo inspection",
+    "",
+    "Local ledger:",
+    quickDemoStorePath,
+    "",
+    ...commands.flatMap((item, index) => [
+      `${index + 1}. ${item.label}`,
+      `   ${item.description}`,
+      `   ${item.command}`,
+      ""
+    ])
+  ].join("\n");
+}
+async function seedQuickDemoStore(storePath) {
+  const resolved = path3.resolve(storePath);
+  await fs3.mkdir(path3.dirname(resolved), { recursive: true });
+  await fs3.rm(resolved, { force: true });
+  const store = new ProposalStore(resolved);
+  try {
+    const changeSet = quickDemoChangeSet();
+    const proposal = store.createProposal(changeSet);
+    store.recordEvidenceBundle({
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      proposal_id: proposal.proposal_id,
+      tenant_id: changeSet.scope.tenant_id,
+      payload: {
+        capability: changeSet.action,
+        proposal_id: proposal.proposal_id,
+        source_id: changeSet.source.source_id,
+        target: `${changeSet.source.schema}.${changeSet.source.table}`,
+        principal: changeSet.principal.id,
+        tenant_id: changeSet.scope.tenant_id,
+        business_object: changeSet.scope.business_object,
+        object_id: changeSet.scope.object_id,
+        query_fingerprint: changeSet.evidence.query_fingerprint,
+        source_database_changed: false
+      },
+      items: [
+        {
+          kind: "external_row",
+          source_id: changeSet.source.source_id,
+          table: `${changeSet.source.schema}.${changeSet.source.table}`,
+          primary_key: changeSet.source.primary_key,
+          tenant: changeSet.guards.tenant,
+          visible_row: changeSet.before
+        },
+        {
+          kind: "proposal_diff",
+          before: changeSet.before,
+          patch: changeSet.patch,
+          after: changeSet.after
+        }
+      ]
+    });
+    store.recordQueryAudit({
+      proposal_id: proposal.proposal_id,
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      source_id: changeSet.source.source_id,
+      query_fingerprint: changeSet.evidence.query_fingerprint,
+      table_name: `${changeSet.source.schema}.${changeSet.source.table}`,
+      row_count: 1,
+      payload: {
+        capability: changeSet.action,
+        tenant_bound: true,
+        statement_template: "SELECT id, tenant_id, updated_at, late_fee_cents FROM invoices WHERE id = ? AND tenant_id = ? LIMIT 1",
+        parameters_redacted: true
+      }
+    });
+    store.replay(proposal.proposal_id);
+    return {
+      proposal_id: proposal.proposal_id,
+      evidence_bundle_id: changeSet.evidence.bundle_id,
+      replay_id: `replay_${proposal.proposal_id}`
+    };
+  } finally {
+    store.close();
+  }
+}
+function quickDemoChangeSet() {
+  const base = {
+    schema_version: protocolVersions.changeSet,
+    proposal_id: "wrp_quick_INV_3001",
+    proposal_version: 1,
+    action: "billing.propose_late_fee_waiver",
+    mode: "review_required",
+    principal: {
+      id: "support.agent",
+      source: "trusted_session"
+    },
+    scope: {
+      tenant_id: "acme",
+      business_object: "invoice",
+      object_id: "INV-3001"
+    },
+    source: {
+      kind: "external_postgres",
+      source_id: "app_postgres",
+      schema: "public",
+      table: "invoices",
+      primary_key: {
+        column: "id",
+        value: "INV-3001"
+      }
+    },
+    before: {
+      id: "INV-3001",
+      tenant_id: "acme",
+      updated_at: "2026-06-23T09:00:00Z",
+      late_fee_cents: 5500
+    },
+    patch: {
+      late_fee_cents: 0
+    },
+    after: {
+      id: "INV-3001",
+      tenant_id: "acme",
+      updated_at: "2026-06-23T09:00:00Z",
+      late_fee_cents: 0
+    },
+    guards: {
+      tenant: {
+        column: "tenant_id",
+        value: "acme"
+      },
+      allowed_columns: ["late_fee_cents"],
+      expected_version: {
+        column: "updated_at",
+        value: "2026-06-23T09:00:00Z"
+      }
+    },
+    evidence: {
+      bundle_id: "ev_quick_INV_3001",
+      query_fingerprint: "sha256:quick-demo-invoice-read",
+      items: [
+        {
+          kind: "external_row",
+          source_id: "app_postgres",
+          table: "public.invoices",
+          primary_key: { column: "id", value: "INV-3001" }
+        }
+      ]
+    },
+    approval: {
+      status: "pending",
+      required_role: "local_operator"
+    },
+    writeback: {
+      status: "not_applied",
+      mode: "trusted_worker_required"
+    },
+    source_database_mutated: false,
+    integrity: {
+      proposal_hash: "sha256:placeholder"
+    },
+    created_at: "2026-06-23T09:00:00Z"
+  };
+  return {
+    ...base,
+    integrity: {
+      proposal_hash: hashReceipt({ ...base, integrity: void 0 })
+    }
+  };
 }
 async function mcpServe(args) {
   const configPath = optionalArg(args, "--config") ?? process2.env.SYNAPSOR_MCP_CONFIG;
@@ -7151,8 +8557,46 @@ async function mcpServe(args) {
   });
   return 0;
 }
+async function mcpServeHttp(args) {
+  const configPath = optionalArg(args, "--config") ?? process2.env.SYNAPSOR_MCP_CONFIG;
+  const readOnly = args.includes("--read-only");
+  const config = readOnly ? { ...await readRuntimeConfig(configPath ?? defaultConfigPath), mode: "read_only" } : void 0;
+  const host = optionalArg(args, "--host") ?? "127.0.0.1";
+  const port = Number(optionalArg(args, "--port") ?? "8765");
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error("--port must be an integer from 1 to 65535");
+  }
+  if (host === "0.0.0.0") {
+    process2.stderr.write("Warning: binding Synapsor Runner HTTP MCP to 0.0.0.0 exposes model-facing tools on the network. Use TLS, private networking, authentication, and rate limits.\n");
+  }
+  const server = await startHttpMcpServer({
+    configPath,
+    config,
+    storePath: optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE,
+    host,
+    port,
+    authTokenEnv: optionalArg(args, "--auth-token-env") ?? "SYNAPSOR_RUNNER_HTTP_TOKEN",
+    devNoAuth: args.includes("--dev-no-auth"),
+    corsOrigin: optionalArg(args, "--cors-origin")
+  });
+  process2.stderr.write("Press Ctrl+C to stop.\n");
+  await new Promise((resolve) => {
+    const stop = async () => {
+      process2.off("SIGINT", stop);
+      process2.off("SIGTERM", stop);
+      await server.close();
+      resolve();
+    };
+    process2.once("SIGINT", stop);
+    process2.once("SIGTERM", stop);
+  });
+  return 0;
+}
 async function mcpAudit(args) {
-  const json = args.includes("--json");
+  const format = optionalArg(args, "--format") ?? (args.includes("--json") ? "json" : "text");
+  if (!["text", "json", "markdown"].includes(format)) {
+    throw new Error("audit --format must be text, json, or markdown");
+  }
   const example = optionalArg(args, "--example");
   const target2 = example ? `example:${example}` : firstPositional(args);
   if (!target2) {
@@ -7161,8 +8605,10 @@ async function mcpAudit(args) {
   const timeoutMs = Number(optionalArg(args, "--timeout-ms") ?? "5000");
   const payload = example ? builtInMcpAuditExample(example) : await readMcpAuditTarget(target2, args, timeoutMs);
   const report = auditMcpManifest(payload, { target: target2 });
-  process2.stdout.write(json ? `${JSON.stringify(report, null, 2)}
-` : formatMcpAuditReport(report));
+  if (format === "json") process2.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+  else if (format === "markdown") process2.stdout.write(formatMcpAuditMarkdown(report));
+  else process2.stdout.write(formatMcpAuditReport(report));
   return 0;
 }
 async function propose(args) {
@@ -7227,13 +8673,13 @@ function sampleInputForCapability(capability) {
   const input = {};
   for (const [name, spec] of Object.entries(capability.args)) {
     if (name === capability.lookup.id_from_arg) input[name] = sampleIdForCapability(capability, name);
-    else if (/reason/i.test(name)) input[name] = "approved support waiver";
+    else if (/reason/i.test(name)) input[name] = sampleReasonForCapability(capability);
     else if (/resolution/i.test(name)) input[name] = "Resolved after reviewing policy evidence.";
+    else if (spec.enum?.length) input[name] = spec.enum[0];
     else if (/status/i.test(name)) input[name] = "pending_review";
     else if (/amount|cents|fee|credit|balance/i.test(name)) input[name] = typeof spec.maximum === "number" ? Math.min(spec.maximum, 1e3) : 0;
     else if (spec.type === "number") input[name] = spec.minimum ?? 1;
     else if (spec.type === "boolean") input[name] = true;
-    else if (spec.enum?.length) input[name] = spec.enum[0];
     else input[name] = `sample_${name}`;
   }
   const missing = Object.entries(capability.args).filter(([, spec]) => spec.required !== false).filter(([name]) => input[name] === void 0).map(([name]) => name);
@@ -7244,12 +8690,20 @@ function sampleInputForCapability(capability) {
 }
 function sampleIdForCapability(capability, argName) {
   const text = `${capability.name} ${capability.target.table} ${argName}`.toLowerCase();
+  const arg = argName.toLowerCase();
   if (/invoice|billing/.test(text)) return "INV-3001";
+  if (/account|customer/.test(arg) || /accounts|customers/.test(text)) return "cust_acme_1";
   if (/ticket|support/.test(text)) return "T-1042";
-  if (/order/.test(text)) return "ord_1001";
-  if (/account|customer/.test(text)) return "cust_acme_1";
+  if (/order/.test(text)) return "O-1001";
   return "sample_1";
 }
+function sampleReasonForCapability(capability) {
+  const text = `${capability.name} ${capability.target.table}`.toLowerCase();
+  if (/order|status_change/.test(text)) return "payment cleared and ready for the next status";
+  if (/credit|customer|account/.test(text)) return "support goodwill credit";
+  if (/late_fee|waiver|billing|invoice/.test(text)) return "approved support waiver";
+  return "reviewed and approved by support";
+}
 function formatProposeResult(capabilityName, result, storePath) {
   const proposalId = String(result.proposal_id ?? "");
   const evidenceId = String(result.evidence_bundle_id ?? "");
@@ -7907,12 +9361,50 @@ async function proposals(args) {
 }
 async function replay(args) {
   const [subcommand, ...rest] = args;
+  if (subcommand === "list") return replayList(rest);
   if (subcommand && !["show", "export"].includes(subcommand)) return replayShow(args);
   if (subcommand === "show") return replayShow(rest);
   if (subcommand === "export") return replayExport(rest);
   usage(["replay"]);
   return 2;
 }
+async function evidence(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "show") return evidenceShow(rest);
+  if (subcommand === "list") return evidenceList(rest);
+  if (subcommand === "export") return evidenceExport(rest);
+  usage(["evidence"]);
+  return 2;
+}
+async function queryAudit(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "list") return queryAuditList(rest);
+  if (subcommand === "show") return queryAuditShow(rest);
+  if (subcommand === "export") return queryAuditExport(rest);
+  usage(["query-audit"]);
+  return 2;
+}
+async function receipts(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "list") return receiptsList(rest);
+  if (subcommand === "show") return receiptsShow(rest);
+  usage(["receipts"]);
+  return 2;
+}
+async function activity(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "search") return activitySearch(rest);
+  usage(["activity"]);
+  return 2;
+}
+async function storeCommand(args) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "stats") return storeStats(rest);
+  if (subcommand === "vacuum") return storeVacuum(rest);
+  if (subcommand === "prune") return storePrune(rest);
+  usage(["store"]);
+  return 2;
+}
 async function shadow(args) {
   const [subcommand, ...rest] = args;
   if (subcommand === "list") return shadowList(rest);
@@ -8033,10 +9525,11 @@ async function shadowReport(args) {
   }
 }
 async function proposalsList(args) {
+  assertKnownOptions(args, proposalListAllowedOptions, "proposals list");
   const store = await openLocalStore(args);
   try {
-    const state = optionalArg(args, "--state");
-    const rows = store.listProposals(state);
+    const filters = proposalFiltersFromArgs(args);
+    const rows = store.listProposals(filters);
     if (args.includes("--json")) {
       process2.stdout.write(`${JSON.stringify({ proposals: rows }, null, 2)}
 `);
@@ -8055,6 +9548,7 @@ async function proposalsList(args) {
   }
 }
 async function proposalsShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "proposals show");
   const proposalId = positional(args, 0);
   if (!proposalId) throw new Error("proposals show requires <proposal_id>");
   const store = await openLocalStore(args);
@@ -8062,16 +9556,17 @@ async function proposalsShow(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = store.getProposal(resolvedProposalId);
     if (!proposal) throw new Error(`proposal not found: ${resolvedProposalId}`);
-    const payload = { proposal, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId) };
+    const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+    const payload = { proposal, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId), evidence: evidence2 };
     if (args.includes("--json")) {
       process2.stdout.write(`${JSON.stringify(payload, null, 2)}
 `);
+    } else if (showDetails(args)) {
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
+      process2.stdout.write(formatProposalEventDetail(payload.events));
+      if (args.includes("--debug")) process2.stdout.write(formatProposalDebug(proposal, optionalArg(args, "--store")));
     } else {
-      process2.stdout.write(formatProposalDetail(proposal));
-      for (const event of payload.events) {
-        process2.stdout.write(`event ${event.event_id}: ${event.kind} by ${event.actor} at ${event.created_at}
-`);
-      }
+      process2.stdout.write(formatProposalFirstLook(proposal, evidence2?.items.length, proposalId, storeOptionSuffix(args)));
     }
     return 0;
   } finally {
@@ -8086,7 +9581,8 @@ async function proposalsApprove(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = requireLocalProposal(store, resolvedProposalId);
     if (!args.includes("--json")) {
-      process2.stdout.write(formatProposalDetail(proposal));
+      const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
     }
     await confirmDangerousAction(args, `Approve proposal ${resolvedProposalId} for guarded writeback?`);
     const updated = store.approveProposal(resolvedProposalId, {
@@ -8113,7 +9609,8 @@ async function proposalsReject(args) {
     const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
     const proposal = requireLocalProposal(store, resolvedProposalId);
     if (!args.includes("--json")) {
-      process2.stdout.write(formatProposalDetail(proposal));
+      const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
+      process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
     }
     await confirmDangerousAction(args, `Reject proposal ${resolvedProposalId}?`);
     const updated = store.rejectProposal(resolvedProposalId, {
@@ -8157,58 +9654,628 @@ async function proposalsWritebackJob(args) {
     store.close();
   }
 }
-async function replayShow(args) {
-  const proposalId = positional(args, 0);
-  if (!proposalId) throw new Error("replay show requires <proposal_id>");
+async function evidenceList(args) {
+  assertKnownOptions(args, evidenceListAllowedOptions, "evidence list");
   const store = await openLocalStore(args);
   try {
-    const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
-    const replayRecord = store.replay(resolvedProposalId);
+    const rows = store.listEvidenceBundles(evidenceFiltersFromArgs(args));
     if (args.includes("--json")) {
-      process2.stdout.write(`${JSON.stringify(replayRecord, null, 2)}
+      process2.stdout.write(`${JSON.stringify({ evidence: rows }, null, 2)}
 `);
+    } else if (rows.length === 0) {
+      process2.stdout.write("No evidence bundles found.\n");
     } else {
-      process2.stdout.write(`Replay ${replayRecord.replay_id}
-`);
-      process2.stdout.write(formatProposalDetail(replayRecord.proposal));
-      process2.stdout.write(`events: ${replayRecord.events.length}
-`);
-      process2.stdout.write(`receipts: ${replayRecord.receipts.length}
-`);
-      process2.stdout.write(`evidence bundles: ${replayRecord.evidence.length}
-`);
-      process2.stdout.write(`query audit records: ${replayRecord.query_audit.length}
-`);
+      for (const bundle of rows) process2.stdout.write(formatEvidenceSummary(bundle));
     }
     return 0;
   } finally {
     store.close();
   }
 }
-async function replayExport(args) {
-  const proposalId = positional(args, 0);
-  if (!proposalId) throw new Error("replay export requires <proposal_id>");
-  const output = outputArg(args);
-  if (!output) throw new Error("replay export requires --output <path>");
+async function evidenceShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "evidence show");
+  const evidenceId = positional(args, 0);
+  if (!evidenceId) throw new Error("evidence show requires <evidence_bundle_id>");
   const store = await openLocalStore(args);
   try {
-    const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
-    const replayRecord = store.replay(resolvedProposalId);
-    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
-    await fs3.writeFile(output, `${JSON.stringify(replayRecord, null, 2)}
-`, "utf8");
-    process2.stdout.write(`exported ${replayRecord.replay_id} to ${output}
+    const evidence2 = store.getEvidenceBundle(evidenceId);
+    if (!evidence2) throw new Error(`evidence bundle not found: ${evidenceId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(evidence2, null, 2)}
 `);
+    else if (showDetails(args)) process2.stdout.write(formatEvidenceDetail(evidence2));
+    else process2.stdout.write(formatEvidenceFirstLook(evidence2, storeOptionSuffix(args)));
     return 0;
   } finally {
     store.close();
   }
 }
-async function openLocalStore(args) {
-  const storePath = optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE ?? "./.synapsor/local.db";
-  if (storePath !== ":memory:") {
-    await fs3.mkdir(path3.dirname(path3.resolve(storePath)), { recursive: true });
-  }
+async function evidenceExport(args) {
+  assertKnownOptions(args, exportAllowedOptions, "evidence export");
+  const evidenceId = positional(args, 0) ?? optionalArg(args, "--evidence");
+  if (!evidenceId) throw new Error("evidence export requires <evidence_bundle_id>");
+  const output = outputArg(args);
+  if (!output) throw new Error("evidence export requires --output <path>");
+  const format = exportFormat(args);
+  const store = await openLocalStore(args);
+  try {
+    const evidence2 = store.getEvidenceBundle(evidenceId);
+    if (!evidence2) throw new Error(`evidence bundle not found: ${evidenceId}`);
+    const text = format === "json" ? `${JSON.stringify(evidence2, null, 2)}
+` : formatEvidenceMarkdown(evidence2);
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, text, "utf8");
+    process2.stdout.write(`exported ${evidence2.evidence_bundle_id} to ${output}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditList(args) {
+  assertKnownOptions(args, queryAuditListAllowedOptions, "query-audit list");
+  const store = await openLocalStore(args);
+  try {
+    const rows = store.listQueryAudit(queryAuditFiltersFromArgs(args));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ query_audit: rows }, null, 2)}
+`);
+    else if (rows.length === 0) process2.stdout.write("No query audit records found.\n");
+    else for (const row of rows) process2.stdout.write(formatQueryAuditSummary(row, showDetails(args), storeOptionSuffix(args)));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "query-audit show");
+  const auditId = Number(positional(args, 0));
+  if (!Number.isInteger(auditId) || auditId <= 0) throw new Error("query-audit show requires <audit_id>");
+  const store = await openLocalStore(args);
+  try {
+    const row = store.getQueryAudit(auditId);
+    if (!row) throw new Error(`query audit record not found: ${auditId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(row, null, 2)}
+`);
+    else process2.stdout.write(showDetails(args) ? formatQueryAuditDetail(row) : formatQueryAuditFirstLook(row, storeOptionSuffix(args)));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function queryAuditExport(args) {
+  assertKnownOptions(args, exportAllowedOptions, "query-audit export");
+  const auditId = Number(positional(args, 0) ?? optionalArg(args, "--audit"));
+  if (!Number.isInteger(auditId) || auditId <= 0) throw new Error("query-audit export requires <audit_id>");
+  const output = outputArg(args);
+  if (!output) throw new Error("query-audit export requires --output <path>");
+  const format = exportFormat(args, ["json"]);
+  const store = await openLocalStore(args);
+  try {
+    const row = store.getQueryAudit(auditId);
+    if (!row) throw new Error(`query audit record not found: ${auditId}`);
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, `${JSON.stringify(row, null, 2)}
+`, "utf8");
+    process2.stdout.write(`exported query audit ${auditId} to ${output}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function receiptsList(args) {
+  assertKnownOptions(args, receiptListAllowedOptions, "receipts list");
+  const store = await openLocalStore(args);
+  try {
+    const rows = store.listReceipts(receiptFiltersFromArgs(args));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ receipts: rows }, null, 2)}
+`);
+    else if (rows.length === 0) process2.stdout.write("No writeback receipts found.\n");
+    else for (const receipt of rows) process2.stdout.write(formatReceiptSummary(receipt));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function receiptsShow(args) {
+  assertKnownOptions(args, showAllowedOptions, "receipts show");
+  const receiptId = Number(positional(args, 0));
+  if (!Number.isInteger(receiptId) || receiptId <= 0) throw new Error("receipts show requires <receipt_id>");
+  const store = await openLocalStore(args);
+  try {
+    const receipt = store.getReceipt(receiptId);
+    if (!receipt) throw new Error(`writeback receipt not found: ${receiptId}`);
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(receipt, null, 2)}
+`);
+    else process2.stdout.write(showDetails(args) ? formatReceiptDetail(receipt) : formatReceiptFirstLook(receipt, storeOptionSuffix(args)));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function replayList(args) {
+  assertKnownOptions(args, replayListAllowedOptions, "replay list");
+  const store = await openLocalStore(args);
+  try {
+    const filters = proposalFiltersFromReplayArgs(args, store);
+    const proposals2 = store.listProposals(filters);
+    const rows = proposals2.map((proposal) => ({
+      replay_id: `replay_${proposal.proposal_id}`,
+      proposal_id: proposal.proposal_id,
+      created_at: proposal.created_at,
+      state: proposal.state,
+      tenant_id: proposal.tenant_id,
+      principal: proposal.principal ?? proposal.change_set.principal.id,
+      capability: proposal.action,
+      business_object: proposal.business_object,
+      object_id: proposal.object_id
+    }));
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ replays: rows }, null, 2)}
+`);
+    else if (rows.length === 0) process2.stdout.write("No replay records found.\n");
+    else for (const row of rows) process2.stdout.write(formatReplaySummary(row));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function replayShow(args) {
+  assertKnownOptions(args, replayShowAllowedOptions, "replay show");
+  const store = await openLocalStore(args);
+  try {
+    const resolvedProposalId = resolveReplayProposalId(args, store);
+    const replayRecord = store.replay(resolvedProposalId);
+    if (args.includes("--json")) {
+      process2.stdout.write(`${JSON.stringify(replayRecord, null, 2)}
+`);
+    } else if (showDetails(args)) {
+      process2.stdout.write(formatReplayDetail(replayRecord));
+      if (args.includes("--debug")) process2.stdout.write(formatReplayDebug(replayRecord, optionalArg(args, "--store")));
+    } else {
+      process2.stdout.write(formatReplayFirstLook(replayRecord, storeOptionSuffix(args)));
+    }
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function replayExport(args) {
+  assertKnownOptions(args, replayExportAllowedOptions, "replay export");
+  const output = outputArg(args);
+  if (!output) throw new Error("replay export requires --output <path>");
+  const format = exportFormat(args);
+  const store = await openLocalStore(args);
+  try {
+    const resolvedProposalId = resolveReplayProposalId(args, store);
+    const replayRecord = store.replay(resolvedProposalId);
+    const text = format === "json" ? `${JSON.stringify(replayRecord, null, 2)}
+` : formatReplayMarkdown(replayRecord);
+    await fs3.mkdir(path3.dirname(path3.resolve(output)), { recursive: true });
+    await fs3.writeFile(output, text, "utf8");
+    process2.stdout.write(`exported ${replayRecord.replay_id} to ${output}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function activitySearch(args) {
+  assertKnownOptions(args, activitySearchAllowedOptions, "activity search");
+  const store = await openLocalStore(args);
+  try {
+    const proposalFilters = proposalFiltersFromActivityArgs(args, store);
+    const evidenceFilters = evidenceFiltersFromActivityArgs(args, store);
+    const queryAuditFilters = queryAuditFiltersFromActivityArgs(args, store);
+    const receiptFilters = receiptFiltersFromActivityArgs(args, store);
+    const proposals2 = store.listProposals(proposalFilters);
+    const evidenceRows = store.listEvidenceBundles(evidenceFilters);
+    const queryAuditRows = store.listQueryAudit(queryAuditFilters);
+    const receiptsRows = store.listReceipts(receiptFilters);
+    const proposalIds = new Set(proposals2.map((proposal) => proposal.proposal_id));
+    const evidenceIds = new Set(evidenceRows.map((evidence2) => evidence2.evidence_bundle_id));
+    const results = proposals2.map((proposal) => activityFromProposal(proposal));
+    for (const evidence2 of evidenceRows) {
+      if (evidence2.proposal_id && proposalIds.has(evidence2.proposal_id)) continue;
+      results.push(activityFromEvidence(evidence2));
+    }
+    for (const audit2 of queryAuditRows) {
+      const proposalId = stringField(audit2, "proposal_id");
+      const evidenceId = stringField(audit2, "evidence_bundle_id");
+      if (proposalId && proposalIds.has(proposalId)) continue;
+      if (evidenceId && evidenceIds.has(evidenceId)) continue;
+      results.push(activityFromQueryAudit(audit2));
+    }
+    for (const receipt of receiptsRows) {
+      if (proposalIds.has(receipt.proposal_id)) continue;
+      results.push(activityFromReceipt(receipt));
+    }
+    const sorted = results.sort((left, right) => String(right.created_at ?? "").localeCompare(String(left.created_at ?? ""))).slice(0, limitFromArgs(args));
+    if (args.includes("--json")) {
+      process2.stdout.write(`${JSON.stringify({ interactions: sorted }, null, 2)}
+`);
+    } else if (sorted.length === 0) {
+      process2.stdout.write("No local interactions found.\n");
+    } else {
+      process2.stdout.write(`Found ${sorted.length} local interaction${sorted.length === 1 ? "" : "s"}
+
+`);
+      sorted.forEach((item, index) => process2.stdout.write(formatActivityItem(item, index + 1, showDetails(args))));
+      process2.stdout.write(formatActivityNext(sorted, storeOptionSuffix(args)));
+    }
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storeStats(args) {
+  assertKnownOptions(args, storeStatsAllowedOptions, "store stats");
+  const store = await openLocalStore(args);
+  try {
+    const stats = store.stats();
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(stats, null, 2)}
+`);
+    else process2.stdout.write(formatStoreStats(stats));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storeVacuum(args) {
+  assertKnownOptions(args, storeVacuumAllowedOptions, "store vacuum");
+  const store = await openLocalStore(args);
+  try {
+    const before = store.stats();
+    store.vacuum();
+    const after = store.stats();
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify({ before, after }, null, 2)}
+`);
+    else process2.stdout.write(`vacuumed local store ${before.path}
+approx bytes: ${before.approx_bytes} -> ${after.approx_bytes}
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+async function storePrune(args) {
+  assertKnownOptions(args, storePruneAllowedOptions, "store prune");
+  const olderThan = optionalArg(args, "--older-than");
+  if (!olderThan) throw new Error("store prune requires --older-than <duration>, for example --older-than 30d");
+  if (args.includes("--yes") && args.includes("--dry-run")) throw new Error("store prune accepts either --dry-run or --yes, not both");
+  const cutoff = cutoffFromOlderThan(olderThan);
+  const dryRun = !args.includes("--yes");
+  const store = await openLocalStore(args);
+  try {
+    const result = store.pruneBefore(cutoff, { dryRun });
+    if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    else process2.stdout.write(formatStorePrune(result));
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+var commonReadOptions = /* @__PURE__ */ new Set(["--store", "--json", "--details", "--debug"]);
+var showAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var exportAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--output", "--out", "--format", "--evidence", "--audit"]);
+var proposalListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--action",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--status",
+  "--state",
+  "--source",
+  "--table",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var evidenceListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--proposal",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--source",
+  "--table",
+  "--query-fingerprint",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var queryAuditListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--proposal",
+  "--evidence",
+  "--source",
+  "--table",
+  "--primary-key",
+  "--query-fingerprint",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var receiptListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--proposal",
+  "--writeback-job",
+  "--idempotency-key",
+  "--status",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var replayShowAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--proposal", "--replay", "--evidence"]);
+var replayExportAllowedOptions = /* @__PURE__ */ new Set([...replayShowAllowedOptions, "--output", "--out", "--format"]);
+var replayListAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--proposal",
+  "--evidence",
+  "--receipt",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--status",
+  "--state",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var activitySearchAllowedOptions = /* @__PURE__ */ new Set([
+  ...commonReadOptions,
+  "--tenant",
+  "--principal",
+  "--capability",
+  "--object",
+  "--object-type",
+  "--object-id",
+  "--proposal",
+  "--evidence",
+  "--replay",
+  "--receipt",
+  "--source",
+  "--table",
+  "--query-fingerprint",
+  "--status",
+  "--state",
+  "--from",
+  "--to",
+  "--limit"
+]);
+var storeStatsAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var storeVacuumAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions]);
+var storePruneAllowedOptions = /* @__PURE__ */ new Set([...commonReadOptions, "--older-than", "--dry-run", "--yes"]);
+function assertKnownOptions(args, allowed, commandName) {
+  for (const arg of args) {
+    if (!arg.startsWith("--")) continue;
+    const option = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
+    if (option === "--help" || option === "-h") continue;
+    if (!allowed.has(option)) throw new Error(`Unknown option for ${commandName}: ${option}`);
+  }
+}
+function proposalFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    proposal: optionalArg(args, "--proposal"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    action: optionalArg(args, "--action"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    status: optionalArg(args, "--status"),
+    state: optionalArg(args, "--state"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function evidenceFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    evidence: optionalArg(args, "--evidence"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function queryAuditFiltersFromArgs(args) {
+  const object = objectFilterFromArgs(args);
+  return {
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal"),
+    evidence: optionalArg(args, "--evidence"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    primaryKey: optionalArg(args, "--primary-key"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function receiptFiltersFromArgs(args) {
+  return {
+    receipt: optionalArg(args, "--receipt"),
+    proposal: optionalArg(args, "--proposal"),
+    writebackJob: optionalArg(args, "--writeback-job"),
+    idempotencyKey: optionalArg(args, "--idempotency-key"),
+    status: optionalArg(args, "--status"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function proposalFiltersFromReplayArgs(args, store) {
+  return proposalFiltersFromActivityArgs(args, store);
+}
+function proposalFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store);
+  return {
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    action: optionalArg(args, "--capability"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    status: optionalArg(args, "--status"),
+    state: optionalArg(args, "--state"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function evidenceFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store, { includeEvidence: false });
+  return {
+    evidence: optionalArg(args, "--evidence"),
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function queryAuditFiltersFromActivityArgs(args, store) {
+  const object = objectFilterFromArgs(args);
+  const linkedProposal = linkedProposalFilter(args, store, { includeEvidence: false });
+  return {
+    tenant: optionalArg(args, "--tenant"),
+    principal: optionalArg(args, "--principal"),
+    capability: optionalArg(args, "--capability"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    evidence: optionalArg(args, "--evidence"),
+    source: optionalArg(args, "--source"),
+    table: optionalArg(args, "--table"),
+    objectType: optionalArg(args, "--object-type") ?? object.type,
+    objectId: optionalArg(args, "--object-id") ?? object.id,
+    queryFingerprint: optionalArg(args, "--query-fingerprint"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function receiptFiltersFromActivityArgs(args, store) {
+  const linkedProposal = linkedProposalFilter(args, store, { includeReceipt: false });
+  return {
+    receipt: optionalArg(args, "--receipt"),
+    proposal: optionalArg(args, "--proposal") ?? linkedProposal,
+    status: optionalArg(args, "--status") ?? optionalArg(args, "--state"),
+    from: optionalArg(args, "--from"),
+    to: optionalArg(args, "--to"),
+    limit: limitFromArgs(args)
+  };
+}
+function linkedProposalFilter(args, store, options = {}) {
+  const noLinkedProposal = "__synapsor_no_linked_proposal__";
+  const replay2 = optionalArg(args, "--replay");
+  if (replay2) return proposalIdFromReplayId(replay2);
+  if (!store) return void 0;
+  if (options.includeEvidence !== false) {
+    const evidence2 = optionalArg(args, "--evidence");
+    if (evidence2) return store.proposalIdForEvidence(evidence2) ?? noLinkedProposal;
+  }
+  if (options.includeReceipt !== false) {
+    const receiptValue = optionalArg(args, "--receipt");
+    if (receiptValue) {
+      const receiptId = Number(receiptValue);
+      if (!Number.isInteger(receiptId) || receiptId <= 0) throw new Error("--receipt must be a positive receipt id");
+      return store.getReceipt(receiptId)?.proposal_id ?? noLinkedProposal;
+    }
+  }
+  return void 0;
+}
+function objectFilterFromArgs(args) {
+  const value = optionalArg(args, "--object");
+  if (!value) return {};
+  const separator = value.indexOf(":");
+  if (separator <= 0 || separator === value.length - 1) {
+    throw new Error("--object must use type:id, for example invoice:INV-3001");
+  }
+  return { type: value.slice(0, separator), id: value.slice(separator + 1) };
+}
+function limitFromArgs(args) {
+  const value = optionalArg(args, "--limit");
+  if (!value) return 20;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) throw new Error("--limit must be a positive integer");
+  return Math.min(parsed, 200);
+}
+function exportFormat(args, supported = ["json", "markdown"]) {
+  const format = optionalArg(args, "--format") ?? "json";
+  if (!supported.includes(format)) {
+    throw new Error(`unsupported export format: ${format}. Supported formats: ${supported.join(", ")}`);
+  }
+  return format;
+}
+function resolveReplayProposalId(args, store) {
+  const explicitProposal = optionalArg(args, "--proposal");
+  if (explicitProposal) return resolveProposalIdFromStore(explicitProposal, store);
+  const explicitReplay = optionalArg(args, "--replay");
+  if (explicitReplay) return proposalIdFromReplayId(explicitReplay);
+  const explicitEvidence = optionalArg(args, "--evidence");
+  if (explicitEvidence) {
+    const proposalId = store.proposalIdForEvidence(explicitEvidence);
+    if (!proposalId) throw new Error(`evidence bundle ${explicitEvidence} is not linked to a replayable proposal`);
+    return proposalId;
+  }
+  const value = positional(args, 0);
+  if (!value) throw new Error("replay show requires <proposal_id>, --proposal <proposal_id>, --replay <replay_id>, or --evidence <evidence_bundle_id>");
+  if (value === "latest") return resolveProposalIdFromStore(value, store);
+  if (value.startsWith("replay_")) return proposalIdFromReplayId(value);
+  if (value.startsWith("ev_")) throw new Error(`Use --evidence ${value} to replay from an evidence bundle.`);
+  return resolveProposalIdFromStore(value, store);
+}
+function proposalIdFromReplayId(replayId) {
+  if (!replayId.startsWith("replay_")) throw new Error(`invalid replay id: ${replayId}`);
+  const proposalId = replayId.slice("replay_".length);
+  if (!proposalId) throw new Error(`invalid replay id: ${replayId}`);
+  return proposalId;
+}
+async function openLocalStore(args) {
+  const storePath = optionalArg(args, "--store") ?? process2.env.SYNAPSOR_LOCAL_STORE ?? "./.synapsor/local.db";
+  if (storePath !== ":memory:") {
+    if (!await fileExists(storePath)) throw missingLocalStoreError(storePath);
+    await fs3.mkdir(path3.dirname(path3.resolve(storePath)), { recursive: true });
+  }
   return new ProposalStore(storePath);
 }
 async function writeFileGuarded(filePath, content, force) {
@@ -8251,6 +10318,7 @@ function requireLocalProposal(store, proposalId) {
 }
 async function resolveProposalId(proposalId, storePath) {
   if (proposalId !== "latest") return proposalId;
+  if (storePath !== ":memory:" && !await fileExists(storePath)) throw missingLocalStoreError(storePath);
   const store = new ProposalStore(storePath);
   try {
     return resolveProposalIdFromStore(proposalId, store);
@@ -8264,6 +10332,15 @@ function resolveProposalIdFromStore(proposalId, store) {
   if (!latest) throw new Error("no proposals found in the local store");
   return latest.proposal_id;
 }
+function missingLocalStoreError(storePath) {
+  return new Error([
+    `No local Synapsor proposal store was found at ${storePath}.`,
+    "Run:",
+    `${cliCommandName()} demo`,
+    "or pass:",
+    "--store /path/to/local.db"
+  ].join("\n"));
+}
 async function readRuntimeConfig(configPath) {
   const parsed = JSON.parse(await fs3.readFile(configPath, "utf8"));
   return parsed;
@@ -8414,25 +10491,38 @@ function firstPositional(args) {
     "--allowed-columns",
     "--approval-role",
     "--actor",
+    "--action",
+    "--auth-token-env",
+    "--audit",
     "--bearer-env",
+    "--capability",
     "--config",
     "--conflict-column",
+    "--cors-origin",
     "--database-url-env",
     "--destination",
     "--engine",
+    "--evidence",
     "--example",
+    "--format",
     "--from",
     "--from-env",
     "--host",
+    "--idempotency-key",
     "--input",
     "--job",
     "--lease-seconds",
+    "--limit",
     "--lookup-arg",
     "--mode",
     "--mcp-config",
     "--namespace",
     "--numeric-bound",
+    "--object",
+    "--object-id",
+    "--object-type",
     "--object-name",
+    "--older-than",
     "--output",
     "--out",
     "--patch-fixed",
@@ -8440,22 +10530,31 @@ function firstPositional(args) {
     "--port",
     "--primary-key",
     "--principal-env",
+    "--proposal",
     "--project",
+    "--query-fingerprint",
     "--reason",
     "--recipe",
+    "--receipt",
+    "--replay",
     "--runner",
     "--schema",
     "--source-name",
+    "--source",
     "--state",
+    "--status",
     "--stdio",
     "--store",
     "--table",
+    "--tenant",
     "--tenant-env",
     "--tenant-key",
     "--timeout-ms",
+    "--to",
     "--transition-guard",
     "--url",
     "--visible-columns",
+    "--writeback-job",
     "--write-url-env"
   ]);
   for (let index = 0; index < args.length; index += 1) {
@@ -8531,25 +10630,60 @@ function parseJsonRpcResponse(stdout, id) {
 }
 function formatProposalSummary(proposal) {
   return [
-    `${proposal.proposal_id}  ${proposal.state}  ${proposal.action}`,
+    `${proposal.created_at}  ${proposal.proposal_id}  ${proposal.state}  ${proposal.action}`,
+    `  object: ${proposal.business_object}:${proposal.object_id}`,
     `  target: ${proposal.source_kind}:${proposal.source_id}/${proposal.source_schema}.${proposal.source_table}/${proposal.object_id}`,
     `  tenant: ${proposal.tenant_id}  source changed: ${proposal.source_database_mutated ? "yes" : "no"}`
   ].join("\n") + "\n";
 }
-function formatProposalDetail(proposal) {
+function formatProposalFirstLook(proposal, storedEvidenceItemCount, proposalRef, storeSuffix) {
+  const evidenceItems = storedEvidenceItemCount ?? proposal.change_set.evidence.items?.length ?? 0;
+  return [
+    `Proposal ${proposal.proposal_id}`,
+    `Status: ${humanStatus(proposal.state)}`,
+    "",
+    "Agent requested:",
+    proposal.action,
+    "",
+    "Business object:",
+    `${proposal.business_object} ${proposal.object_id}`,
+    "",
+    "Proposed change:",
+    ...formatChangeLines(proposal).map((line) => line.replace(/^  /, "")),
+    "",
+    "Source DB changed:",
+    proposal.source_database_mutated ? "yes" : "no",
+    "",
+    "Approval:",
+    approvalBoundary(proposal),
+    "",
+    "Evidence:",
+    `${proposal.change_set.evidence.bundle_id}${evidenceItems > 0 ? ` (${plural(evidenceItems, "item")})` : ""}`,
+    "",
+    "Next:",
+    ...proposalNextCommands(proposal, proposalRef, storeSuffix).map((command) => `${command}`),
+    "",
+    "More detail:",
+    `${cliCommandName()} proposals show ${proposalRef} --details${storeSuffix}`,
+    ""
+  ].join("\n");
+}
+function formatProposalDetail(proposal, storedEvidenceItemCount) {
   const changeSet = proposal.change_set;
   const conflictGuard = changeSet.guards.expected_version;
-  const evidenceItems = changeSet.evidence.items?.length ?? 0;
+  const evidenceItems = storedEvidenceItemCount ?? changeSet.evidence.items?.length ?? 0;
   const approvalStatus = currentApprovalStatus(proposal);
   const writebackStatus = currentWritebackStatus(proposal);
   return [
-    `proposal: ${proposal.proposal_id}`,
-    `state: ${proposal.state}`,
-    `action: ${proposal.action}`,
+    `Proposal details: ${proposal.proposal_id}`,
+    "",
+    "Review details:",
     `principal: ${changeSet.principal.id} (${changeSet.principal.source})`,
     `tenant: ${proposal.tenant_id}`,
     `target: ${proposal.source_kind}:${proposal.source_id}/${proposal.source_schema}.${proposal.source_table}/${proposal.object_id}`,
     `primary key: ${changeSet.source.primary_key.column}=${formatScalar(changeSet.source.primary_key.value)}`,
+    `status: ${proposal.state}`,
+    `action: ${proposal.action}`,
     `approval: ${approvalStatus}${changeSet.approval.required_role ? ` required role ${changeSet.approval.required_role}` : ""}`,
     `proposal hash: ${proposal.proposal_hash}`,
     `proposal version: ${proposal.proposal_version}`,
@@ -8558,14 +10692,565 @@ function formatProposalDetail(proposal) {
     `evidence: ${changeSet.evidence.bundle_id}  query ${changeSet.evidence.query_fingerprint}  items ${evidenceItems}`,
     `writeback: ${writebackStatus} via ${changeSet.writeback.mode}`,
     `source database changed: ${proposal.source_database_mutated ? "yes" : "no"}`,
-    "diff:",
-    ...Object.keys(changeSet.patch).map((column) => {
-      const before = changeSet.before[column];
-      const proposed = changeSet.after[column];
-      return `  ${column}: ${JSON.stringify(before)} -> ${JSON.stringify(proposed)}`;
-    })
+    "",
+    "Diff:",
+    ...formatChangeLines(proposal)
+  ].join("\n") + "\n";
+}
+function formatProposalEventDetail(events) {
+  if (events.length === 0) return "Events:\n  none\n";
+  return [
+    "Events:",
+    ...events.map((event) => `  event ${event.event_id}: ${event.kind} by ${event.actor} at ${event.created_at}`)
+  ].join("\n") + "\n";
+}
+function formatProposalDebug(proposal, storePath) {
+  return [
+    "Debug:",
+    `store: ${storePath ?? process2.env.SYNAPSOR_LOCAL_STORE ?? "./.synapsor/local.db"}`,
+    `interaction id: ${proposal.interaction_id ?? "none"}`,
+    `tool call id: ${proposal.tool_call_id ?? "none"}`,
+    `source kind: ${proposal.source_kind}`,
+    `writeback mode: ${proposal.change_set.writeback.mode}`,
+    ""
+  ].join("\n");
+}
+function formatEvidenceSummary(evidence2) {
+  return [
+    `${evidence2.created_at}  ${evidence2.evidence_bundle_id}`,
+    `  tenant: ${evidence2.tenant_id}  capability: ${evidence2.capability ?? "unknown"}  proposal: ${evidence2.proposal_id ?? "none"}`,
+    `  source: ${evidence2.source_id ?? "unknown"}/${evidence2.source_table ?? "unknown"}  object: ${evidence2.business_object ?? "object"}:${evidence2.object_id ?? "unknown"}`
   ].join("\n") + "\n";
 }
+function formatEvidenceFirstLook(evidence2, storeSuffix) {
+  const object = evidence2.business_object && evidence2.object_id ? `${evidence2.business_object} ${evidence2.object_id}` : "not linked";
+  const lines = [
+    `Evidence ${evidence2.evidence_bundle_id}`,
+    "",
+    "Used for:",
+    evidence2.capability ?? "unknown capability",
+    object,
+    "",
+    "Captured:",
+    plural(evidence2.items.length, "evidence item"),
+    plural(evidence2.query_audit.length, "query audit record"),
+    "",
+    "Source:",
+    `${evidence2.source_id ?? "unknown"} / ${evidence2.source_table ?? "unknown"}`,
+    "",
+    "Rows:",
+    ...evidence2.items.flatMap((item, index) => formatEvidenceItem(item, index + 1)),
+    "",
+    "Next:",
+    `  ${cliCommandName()} query-audit list --evidence ${evidence2.evidence_bundle_id}${storeSuffix}`,
+    ...evidence2.proposal_id ? [`  ${cliCommandName()} replay show --proposal ${evidence2.proposal_id}${storeSuffix}`] : [],
+    "",
+    "More detail:",
+    `  ${cliCommandName()} evidence show ${evidence2.evidence_bundle_id} --details${storeSuffix}`
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function formatEvidenceDetail(evidence2) {
+  const audit2 = evidence2.query_audit[0];
+  const lines = [
+    `Evidence bundle: ${evidence2.evidence_bundle_id}`,
+    `Tenant: ${evidence2.tenant_id}`,
+    `Proposal: ${evidence2.proposal_id ?? "none"}`,
+    `Principal: ${evidence2.principal ?? "unknown"}`,
+    `Capability: ${evidence2.capability ?? "unknown"}`,
+    `Source: ${evidence2.source_id ?? "unknown"}`,
+    `Table: ${evidence2.source_table ?? "unknown"}`,
+    `Query fingerprint: ${evidence2.query_fingerprint ?? stringField(audit2, "query_fingerprint") ?? "unknown"}`,
+    `Rows captured: ${evidence2.items.length}`,
+    `Created at: ${evidence2.created_at}`,
+    "Projection: captured visible fields only; credentials and secret-looking values are rejected before persistence.",
+    "",
+    "Items:",
+    ...evidence2.items.flatMap((item, index) => formatEvidenceItem(item, index + 1)),
+    "",
+    "Related:",
+    ...evidence2.proposal_id ? [`  ${cliCommandName()} proposals show ${evidence2.proposal_id}`, `  ${cliCommandName()} replay show --proposal ${evidence2.proposal_id}`] : [],
+    `  ${cliCommandName()} query-audit list --evidence ${evidence2.evidence_bundle_id}`
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function formatEvidenceItem(item, index) {
+  const payload = isRecord6(item.item) ? item.item : item;
+  const visibleRow = isRecord6(payload.visible_row) ? payload.visible_row : payload;
+  const title = stringField(payload, "kind") ?? "item";
+  const primaryKey = isRecord6(payload.primary_key) ? payload.primary_key : void 0;
+  const heading = primaryKey ? `* ${title} ${formatScalar(primaryKey.value)}` : `* ${title} ${index}`;
+  const rows = Object.entries(visibleRow).filter(([key]) => !["kind", "source_id", "table", "primary_key", "tenant"].includes(key)).flatMap(([key, value]) => formatEvidenceFieldLines(key, value)).slice(0, 12);
+  return [heading, ...rows.length ? rows : ["  (no scalar preview fields)"]];
+}
+function formatEvidenceFieldLines(key, value) {
+  if (isRecord6(value)) {
+    const nested = Object.entries(value).filter(([, nestedValue]) => nestedValue === null || ["string", "number", "boolean"].includes(typeof nestedValue)).slice(0, 6).map(([nestedKey, nestedValue]) => `  ${key}.${nestedKey}: ${formatScalar(nestedValue)}`);
+    return nested.length ? nested : [`  ${key}: [object]`];
+  }
+  return [`  ${key}: ${formatScalar(value)}`];
+}
+function formatEvidenceMarkdown(evidence2) {
+  return [
+    `# Evidence ${evidence2.evidence_bundle_id}`,
+    "",
+    `- Tenant: ${evidence2.tenant_id}`,
+    `- Proposal: ${evidence2.proposal_id ?? "none"}`,
+    `- Principal: ${evidence2.principal ?? "unknown"}`,
+    `- Capability: ${evidence2.capability ?? "unknown"}`,
+    `- Source: ${evidence2.source_id ?? "unknown"}`,
+    `- Table: ${evidence2.source_table ?? "unknown"}`,
+    `- Query fingerprint: ${evidence2.query_fingerprint ?? "unknown"}`,
+    `- Created at: ${evidence2.created_at}`,
+    "",
+    "## Captured Items",
+    "",
+    "```json",
+    JSON.stringify(evidence2.items, null, 2),
+    "```",
+    "",
+    "## Query Audit",
+    "",
+    "```json",
+    JSON.stringify(evidence2.query_audit, null, 2),
+    "```"
+  ].join("\n") + "\n";
+}
+function formatQueryAuditSummary(row, details = false, storeSuffix = "") {
+  const lines = [
+    `${row.created_at}  audit ${row.audit_id}`,
+    `  source: ${row.source_id}/${row.table_name}  rows: ${row.row_count}`,
+    `  proposal: ${row.proposal_id ?? "none"}  evidence: ${row.evidence_bundle_id ?? "none"}`,
+    ...details ? [`  query fingerprint: ${row.query_fingerprint}`] : [],
+    `  detail: ${cliCommandName()} query-audit show ${row.audit_id}${details ? "" : " --details"}${storeSuffix}`
+  ];
+  return lines.join("\n") + "\n";
+}
+function formatQueryAuditFirstLook(row, storeSuffix) {
+  return [
+    `Query audit ${row.audit_id}`,
+    "",
+    "Read:",
+    `${row.source_id}/${row.table_name}`,
+    "",
+    "Rows returned:",
+    String(row.row_count ?? "unknown"),
+    "",
+    "Linked records:",
+    `proposal: ${row.proposal_id ?? "none"}`,
+    `evidence: ${row.evidence_bundle_id ?? "none"}`,
+    "",
+    "More detail:",
+    `${cliCommandName()} query-audit show ${row.audit_id} --details${storeSuffix}`,
+    ""
+  ].join("\n");
+}
+function formatQueryAuditDetail(row) {
+  const payload = isRecord6(row.payload) ? row.payload : {};
+  return [
+    `Query audit: ${row.audit_id}`,
+    `Created at: ${row.created_at}`,
+    `Source: ${row.source_id}`,
+    `Table: ${row.table_name}`,
+    `Rows: ${row.row_count}`,
+    `Query fingerprint: ${row.query_fingerprint}`,
+    `Proposal: ${row.proposal_id ?? "none"}`,
+    `Evidence: ${row.evidence_bundle_id ?? "none"}`,
+    `Tenant: ${row.tenant_id ?? "unknown"}`,
+    `Capability: ${row.capability ?? payload.capability ?? "unknown"}`,
+    `Parameters redacted: ${payload.parameters_redacted === true ? "yes" : "unknown"}`,
+    "",
+    "Payload:",
+    JSON.stringify(payload, null, 2)
+  ].join("\n") + "\n";
+}
+function formatReceiptSummary(receipt) {
+  return [
+    `${receipt.created_at}  receipt ${receipt.receipt_id}  ${receipt.status}`,
+    `  proposal: ${receipt.proposal_id}  job: ${receipt.writeback_job_id}`,
+    `  idempotency: ${receipt.idempotency_key}  source changed: ${receipt.source_database_mutated ? "yes" : "no"}`
+  ].join("\n") + "\n";
+}
+function formatReceiptFirstLook(receipt, storeSuffix) {
+  const checks = receipt.status === "applied" ? ["primary key matched", "tenant guard matched", "allowed columns only", "conflict guard passed"] : receipt.status === "conflict" ? ["primary key matched", "tenant guard matched", "conflict guard blocked stale write"] : ["guarded writeback did not apply"];
+  return [
+    `Receipt ${formatReceiptId(receipt.receipt_id)}`,
+    `Status: ${humanStatus(receipt.status)}`,
+    "",
+    "Proposal:",
+    receipt.proposal_id,
+    "",
+    "Writeback:",
+    "guarded single-row update",
+    "",
+    "Checks:",
+    ...checks.map((check) => `${check}`),
+    `affected rows: ${receipt.receipt.rows_affected}`,
+    "",
+    "Source DB changed:",
+    receipt.source_database_mutated ? "yes" : "no",
+    "",
+    "Next:",
+    `${cliCommandName()} replay show --proposal ${receipt.proposal_id}${storeSuffix}`,
+    "",
+    "More detail:",
+    `${cliCommandName()} receipts show ${receipt.receipt_id} --details${storeSuffix}`,
+    ""
+  ].join("\n");
+}
+function formatReceiptDetail(receipt) {
+  return [
+    `Receipt: ${receipt.receipt_id}`,
+    `Proposal: ${receipt.proposal_id}`,
+    `Writeback job: ${receipt.writeback_job_id}`,
+    `Runner: ${receipt.runner_id}`,
+    `Status: ${receipt.status}`,
+    `Idempotency key: ${receipt.idempotency_key}`,
+    `Source database mutated: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    `Rows affected: ${receipt.receipt.rows_affected}`,
+    `Safe error: ${receipt.receipt.safe_error_code ?? "none"}`,
+    `Receipt hash: ${receipt.receipt.receipt_hash}`,
+    `Created at: ${receipt.created_at}`,
+    "",
+    "Related:",
+    `  ${cliCommandName()} replay show --proposal ${receipt.proposal_id}`
+  ].join("\n") + "\n";
+}
+function formatReplaySummary(row) {
+  return [
+    `${row.created_at}  ${row.replay_id}`,
+    `  proposal: ${row.proposal_id}  status: ${row.state}`,
+    `  tenant: ${row.tenant_id}  capability: ${row.capability}  object: ${row.business_object}:${row.object_id}`
+  ].join("\n") + "\n";
+}
+function formatReplayFirstLook(replay2, storeSuffix) {
+  const proposal = replay2.proposal;
+  const evidenceItems = replay2.evidence.reduce((count, item) => {
+    const evidence2 = item;
+    return count + (Array.isArray(evidence2.items) ? evidence2.items.length : 0);
+  }, 0);
+  const latestReceipt = replay2.receipts.at(-1);
+  const writebackStatus = latestReceipt ? humanStatus(latestReceipt.status) : humanStatus(currentWritebackStatus(proposal));
+  const approvalLine = proposal.state === "pending_review" ? "Approval is still pending" : `Proposal is ${humanStatus(proposal.state)}`;
+  return [
+    `Replay ${replay2.replay_id}`,
+    "",
+    "What happened:",
+    `1. Agent called ${proposal.action}`,
+    `2. Runner read ${proposal.business_object} ${proposal.object_id} under tenant ${proposal.tenant_id}`,
+    `3. Runner created evidence bundle ${proposal.change_set.evidence.bundle_id}`,
+    "4. Runner created a proposal",
+    `5. Source DB changed: ${proposal.source_database_mutated ? "yes" : "no"}`,
+    `6. ${approvalLine}`,
+    "",
+    "Proposed change:",
+    ...formatChangeLines(proposal).map((line) => line.replace(/^  /, "")),
+    "",
+    "Evidence:",
+    plural(replay2.query_audit.length, "query audit record"),
+    plural(evidenceItems, "evidence item"),
+    "",
+    "Writeback:",
+    writebackStatus,
+    ...latestReceipt ? [`source DB changed after writeback: ${latestReceipt.source_database_mutated ? "yes" : "no"}`] : [],
+    "",
+    "Next:",
+    `  ${cliCommandName()} evidence show ${proposal.change_set.evidence.bundle_id}${storeSuffix}`,
+    ...proposal.state === "pending_review" ? [`  ${cliCommandName()} proposals approve ${proposal.proposal_id} --yes${storeSuffix}`] : [],
+    "",
+    "More detail:",
+    `  ${cliCommandName()} replay show --proposal ${proposal.proposal_id} --details${storeSuffix}`,
+    ""
+  ].join("\n");
+}
+function formatReplayDetail(replay2) {
+  const evidenceItems = replay2.evidence.reduce((count, item) => {
+    const evidence2 = item;
+    return count + (Array.isArray(evidence2.items) ? evidence2.items.length : 0);
+  }, 0);
+  return [
+    `Replay details ${replay2.replay_id}`,
+    formatProposalDetail(replay2.proposal, evidenceItems).trimEnd(),
+    `events: ${replay2.events.length}`,
+    ...replay2.events.map((event) => `  ${event.kind} by ${event.actor} at ${event.created_at}`),
+    `receipts: ${replay2.receipts.length}`,
+    ...replay2.receipts.map((receipt) => `  receipt ${receipt.receipt_id}: ${receipt.status} job ${receipt.writeback_job_id}`),
+    `evidence bundles: ${replay2.evidence.length}`,
+    ...replay2.evidence.map((evidence2) => `  ${evidence2.evidence_bundle_id ?? "unknown"}`),
+    `query audit records: ${replay2.query_audit.length}`,
+    ...replay2.query_audit.map((record) => `  audit ${record.audit_id}: ${record.source_id}/${record.table_name} rows ${record.row_count}`)
+  ].join("\n") + "\n";
+}
+function formatReplayDebug(replay2, storePath) {
+  return [
+    "Debug:",
+    `store: ${storePath ?? process2.env.SYNAPSOR_LOCAL_STORE ?? "./.synapsor/local.db"}`,
+    `generated at: ${replay2.generated_at}`,
+    `event ids: ${replay2.events.map((event) => event.event_id).join(", ") || "none"}`,
+    `receipt ids: ${replay2.receipts.map((receipt) => receipt.receipt_id).join(", ") || "none"}`,
+    ""
+  ].join("\n");
+}
+function formatReplayMarkdown(replay2) {
+  const proposal = replay2.proposal;
+  const principal = proposal.change_set.principal.id;
+  const approvalEvents = replay2.events.filter((event) => /approved|rejected|canceled/i.test(event.kind));
+  const evidenceLines = replay2.evidence.length > 0 ? replay2.evidence.flatMap((evidence2) => {
+    const record = evidence2;
+    const payload = isRecord6(record.payload) ? record.payload : {};
+    const sourceId = stringField(payload, "source_id") ?? proposal.source_id;
+    const table = stringField(payload, "target") ?? `${proposal.source_schema}.${proposal.source_table}`;
+    const queryFingerprint = stringField(payload, "query_fingerprint") ?? proposal.change_set.evidence.query_fingerprint;
+    return [
+      `- evidence: ${record.evidence_bundle_id ?? proposal.change_set.evidence.bundle_id}`,
+      `  - source: ${sourceId}.${table}`,
+      `  - query fingerprint: ${queryFingerprint}`,
+      `  - rows captured: ${Array.isArray(record.items) ? record.items.length : 0}`
+    ];
+  }) : [`- evidence: ${proposal.change_set.evidence.bundle_id}`, `  - source: ${proposal.source_id}.${proposal.source_schema}.${proposal.source_table}`, `  - query fingerprint: ${proposal.change_set.evidence.query_fingerprint}`, "  - rows captured: 0"];
+  const receiptLines = replay2.receipts.length > 0 ? replay2.receipts.flatMap((receipt) => [
+    `- receipt: ${receipt.receipt_id}`,
+    `  - status: ${receipt.status}`,
+    `  - affected rows: ${receipt.receipt.rows_affected}`,
+    `  - idempotency key: ${receipt.idempotency_key}`,
+    `  - source database mutated: ${receipt.source_database_mutated ? "yes" : "no"}`,
+    ...receipt.receipt.safe_error_code ? [`  - safe error: ${receipt.receipt.safe_error_code}`] : []
+  ]) : ["- no writeback receipt recorded yet"];
+  return [
+    "# Synapsor Replay",
+    "",
+    `Proposal: ${proposal.proposal_id}`,
+    `Capability: ${proposal.action}`,
+    `Tenant: ${proposal.tenant_id}`,
+    `Object: ${proposal.business_object}:${proposal.object_id}`,
+    `Status: ${proposal.state}`,
+    "",
+    "## What The Agent Requested",
+    "",
+    `The model-facing capability requested \`${proposal.action}\` for ${proposal.business_object}:${proposal.object_id}.`,
+    "The source database was not mutated when the proposal was created.",
+    "",
+    "## Trusted Context",
+    "",
+    `tenant_id = ${proposal.tenant_id}`,
+    `principal = ${principal}`,
+    `principal_source = ${proposal.change_set.principal.source}`,
+    "",
+    "## Evidence",
+    "",
+    ...evidenceLines,
+    "",
+    "## Proposed Diff",
+    "",
+    ...Object.keys(proposal.change_set.patch).map((column) => `- ${column}: ${JSON.stringify(proposal.change_set.before[column])} -> ${JSON.stringify(proposal.change_set.after[column])}`),
+    "",
+    "## Approval",
+    "",
+    ...approvalEvents.length > 0 ? approvalEvents.map((event) => `- ${event.kind} by ${event.actor} at ${event.created_at}`) : [`- ${proposal.change_set.approval.status}${proposal.change_set.approval.required_role ? `; required role: ${proposal.change_set.approval.required_role}` : ""}`],
+    "",
+    "## Guarded Writeback",
+    "",
+    ...receiptLines,
+    "",
+    "## Query Audit",
+    "",
+    ...replay2.query_audit.map((record) => `- audit ${record.audit_id}: ${record.source_id}/${record.table_name} rows ${record.row_count} fingerprint ${record.query_fingerprint}`),
+    "",
+    "## Replay Note",
+    "",
+    "This is local captured interaction replay, not external database time travel. It reconstructs what the runner recorded: trusted context, evidence handles, proposal diff, approval events, query audit, and writeback receipts."
+  ].join("\n") + "\n";
+}
+function activityFromProposal(proposal) {
+  return {
+    kind: "proposal",
+    created_at: proposal.created_at,
+    capability: proposal.action,
+    tenant: proposal.tenant_id,
+    principal: proposal.principal ?? proposal.change_set.principal.id,
+    object: `${proposal.business_object}:${proposal.object_id}`,
+    proposal: proposal.proposal_id,
+    evidence: proposal.change_set.evidence.bundle_id,
+    status: proposal.state,
+    replay: `replay_${proposal.proposal_id}`,
+    source: proposal.source_id,
+    table: `${proposal.source_schema}.${proposal.source_table}`
+  };
+}
+function activityFromEvidence(evidence2) {
+  return {
+    kind: "evidence",
+    created_at: evidence2.created_at,
+    capability: evidence2.capability,
+    tenant: evidence2.tenant_id,
+    principal: evidence2.principal,
+    object: evidence2.business_object && evidence2.object_id ? `${evidence2.business_object}:${evidence2.object_id}` : void 0,
+    proposal: evidence2.proposal_id,
+    evidence: evidence2.evidence_bundle_id,
+    status: "evidence_recorded",
+    source: evidence2.source_id,
+    table: evidence2.source_table
+  };
+}
+function activityFromQueryAudit(audit2) {
+  const businessObject = stringField(audit2, "business_object");
+  const objectId = stringField(audit2, "object_id") ?? stringField(audit2, "primary_key_value");
+  return {
+    kind: "query-audit",
+    created_at: stringField(audit2, "created_at"),
+    capability: stringField(audit2, "capability"),
+    tenant: stringField(audit2, "tenant_id"),
+    principal: stringField(audit2, "principal"),
+    object: businessObject && objectId ? `${businessObject}:${objectId}` : void 0,
+    proposal: stringField(audit2, "proposal_id"),
+    evidence: stringField(audit2, "evidence_bundle_id"),
+    status: "query_audited",
+    source: stringField(audit2, "source_id"),
+    table: stringField(audit2, "table_name"),
+    query_audit: stringField(audit2, "audit_id"),
+    query_fingerprint: stringField(audit2, "query_fingerprint")
+  };
+}
+function activityFromReceipt(receipt) {
+  return {
+    kind: "receipt",
+    created_at: receipt.created_at,
+    proposal: receipt.proposal_id,
+    receipt: receipt.receipt_id,
+    status: receipt.status,
+    replay: `replay_${receipt.proposal_id}`,
+    source_database_mutated: receipt.source_database_mutated
+  };
+}
+function formatActivityItem(item, index, details = false) {
+  const lines = [
+    `${index}. ${item.created_at}`,
+    `   kind: ${item.kind}`,
+    ...item.capability ? [`   capability: ${item.capability}`] : [],
+    ...item.tenant ? [`   tenant: ${item.tenant}`] : [],
+    ...item.object ? [`   object: ${item.object}`] : [],
+    ...item.proposal ? [`   proposal: ${item.proposal}`] : [],
+    ...item.evidence ? [`   evidence: ${item.evidence}`] : [],
+    ...item.query_audit ? [`   query audit: ${item.query_audit}`] : [],
+    ...details && item.query_fingerprint ? [`   query fingerprint: ${item.query_fingerprint}`] : [],
+    ...item.receipt ? [`   receipt: ${item.receipt}`] : [],
+    ...item.status ? [`   status: ${humanStatus(String(item.status))}`] : [],
+    ...item.replay ? [`   replay: ${item.replay}`] : [],
+    ""
+  ];
+  return lines.join("\n");
+}
+function formatActivityNext(items, storeSuffix) {
+  const first = items[0];
+  if (!first) return "";
+  const proposal = stringField(first, "proposal");
+  const replayId = stringField(first, "replay");
+  const evidence2 = stringField(first, "evidence");
+  const lines = ["Next:"];
+  if (proposal) {
+    lines.push(`${cliCommandName()} proposals show ${proposal}${storeSuffix}`);
+    lines.push(`${cliCommandName()} replay show --proposal ${proposal}${storeSuffix}`);
+  } else if (replayId) {
+    lines.push(`${cliCommandName()} replay show --replay ${replayId}${storeSuffix}`);
+  } else if (evidence2) {
+    lines.push(`${cliCommandName()} evidence show ${evidence2}${storeSuffix}`);
+  } else {
+    lines.push(`${cliCommandName()} activity search --details${storeSuffix}`);
+  }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function formatStoreStats(stats) {
+  return [
+    `Local store: ${stats.path}`,
+    `Approx size: ${stats.approx_bytes} bytes`,
+    `Proposals: ${stats.proposals}`,
+    `Evidence bundles: ${stats.evidence_bundles}`,
+    `Evidence items: ${stats.evidence_items}`,
+    `Query audit records: ${stats.query_audit}`,
+    `Writeback receipts: ${stats.writeback_receipts}`,
+    `Writeback jobs: ${stats.writeback_jobs}`,
+    `Idempotency receipts: ${stats.idempotency_receipts}`,
+    `Replay records: ${stats.replay_records}`,
+    `Approvals: ${stats.approvals}`,
+    `Proposal events: ${stats.proposal_events}`,
+    `Shadow human actions: ${stats.shadow_human_actions}`
+  ].join("\n") + "\n";
+}
+function formatStorePrune(result) {
+  const lines = [
+    `Local store prune ${result.dry_run ? "dry run" : "complete"}`,
+    `Cutoff: ${result.cutoff}`,
+    "",
+    "Rows:",
+    ...Object.entries(result.deleted).map(([table, count]) => `  ${table}: ${count}`)
+  ];
+  if (result.dry_run) {
+    lines.push("", "No rows were deleted. Rerun with --yes to apply this prune.");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function cutoffFromOlderThan(value) {
+  const match = value.match(/^(\d+)([smhd])$/i);
+  if (!match) throw new Error("--older-than must use a duration such as 30d, 12h, 90m, or 0d");
+  const amount = Number(match[1]);
+  const unit = (match[2] ?? "d").toLowerCase();
+  const multiplier = unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return new Date(Date.now() - amount * multiplier).toISOString();
+}
+function formatMcpAuditMarkdown(report) {
+  const lines = [
+    "# Synapsor MCP Database Risk Review",
+    "",
+    `- Target: ${report.target}`,
+    `- Generated at: ${report.generated_at}`,
+    `- Tools inspected: ${report.summary.tools_inspected}`,
+    `- Findings: HIGH ${report.summary.high} | MEDIUM ${report.summary.medium} | LOW ${report.summary.low}`,
+    `- Total findings: ${report.summary.total_findings}`,
+    "",
+    `> ${report.disclaimer}`,
+    ""
+  ];
+  if (report.findings.length === 0) {
+    lines.push("No obvious database-commit risks were detected in the static manifest.", "");
+    lines.push("This does not prove the MCP server or its tools are secure.", "");
+  } else {
+    lines.push("## Findings", "");
+    for (const finding of report.findings) {
+      lines.push(`### ${finding.severity}: ${finding.code}${finding.tool ? ` (${finding.tool})` : ""}`);
+      lines.push("");
+      lines.push(finding.message);
+      lines.push("");
+      if (finding.evidence.length > 0) {
+        lines.push("Evidence:");
+        for (const evidence2 of finding.evidence) lines.push(`- ${evidence2}`);
+        lines.push("");
+      }
+      lines.push(`Recommendation: ${finding.recommendation}`);
+      lines.push("");
+    }
+  }
+  lines.push("## Safer Shape", "");
+  lines.push("- expose semantic inspect/propose tools instead of raw SQL;");
+  lines.push("- bind tenant/principal from trusted context;");
+  lines.push("- keep approval outside MCP;");
+  lines.push("- apply approved changes through guarded writeback;");
+  lines.push("- keep replay/evidence handles for later review.");
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function stringField(record, key) {
+  if (!isRecord6(record)) return void 0;
+  const value = record[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number") return String(value);
+  return void 0;
+}
 function currentApprovalStatus(proposal) {
   if (proposal.state === "rejected") return "rejected";
   if (proposal.state === "canceled") return "canceled";
@@ -8579,6 +11264,60 @@ function currentWritebackStatus(proposal) {
   if (proposal.state === "failed") return "failed";
   return proposal.change_set.writeback.status;
 }
+function showDetails(args) {
+  return args.includes("--details") || args.includes("--debug");
+}
+function storeOptionSuffix(args) {
+  const storePath = optionalArg(args, "--store");
+  return storePath ? ` --store ${storePath}` : "";
+}
+function humanStatus(value) {
+  const normalized = value.replace(/_/g, " ");
+  if (normalized === "pending review") return "pending review";
+  if (normalized === "not applied") return "not applied";
+  return normalized;
+}
+function plural(count, label) {
+  return `${count} ${label}${count === 1 ? "" : "s"}`;
+}
+function formatReceiptId(receiptId) {
+  return `rct_${String(receiptId).padStart(6, "0")}`;
+}
+function approvalBoundary(proposal) {
+  if (proposal.state === "pending_review") return "required outside MCP";
+  if (proposal.state === "approved" || proposal.state === "pending_worker") return "approved outside MCP; waiting for trusted worker";
+  if (proposal.state === "applied") return "approved outside MCP; writeback applied";
+  if (proposal.state === "conflict") return "approved outside MCP; writeback blocked by conflict guard";
+  if (proposal.state === "failed") return "approved outside MCP; writeback failed safely";
+  if (proposal.state === "rejected") return "rejected outside MCP";
+  return humanStatus(proposal.state);
+}
+function proposalNextCommands(proposal, proposalRef, storeSuffix) {
+  if (proposal.state === "pending_review") {
+    return [
+      `${cliCommandName()} proposals approve ${proposalRef} --yes${storeSuffix}`,
+      `${cliCommandName()} replay show ${proposalRef === "latest" ? "latest" : `--proposal ${proposal.proposal_id}`}${storeSuffix}`
+    ];
+  }
+  if (proposal.state === "approved" || proposal.state === "pending_worker") {
+    return [
+      `${cliCommandName()} replay show --proposal ${proposal.proposal_id}${storeSuffix}`
+    ];
+  }
+  return [
+    `${cliCommandName()} replay show --proposal ${proposal.proposal_id}${storeSuffix}`
+  ];
+}
+function formatChangeLines(proposal) {
+  const changeSet = proposal.change_set;
+  const columns = Object.keys(changeSet.patch);
+  if (columns.length === 0) return ["  (no changed columns)"];
+  return columns.map((column) => {
+    const before = changeSet.before[column];
+    const proposed = changeSet.after[column];
+    return `  ${column}: ${formatScalar(before)} -> ${formatScalar(proposed)}`;
+  });
+}
 function formatShadowComparison(comparison) {
   return [
     `shadow comparison: ${comparison.proposal_id}`,
@@ -8696,7 +11435,7 @@ function starterCloudConfig() {
       base_url_env: "SYNAPSOR_CLOUD_BASE_URL",
       runner_token_env: "SYNAPSOR_RUNNER_TOKEN",
       runner_id: "synapsor_runner_local",
-      runner_version: "0.1.0-alpha.3",
+      runner_version: "0.1.0-alpha.5",
       project_id: "token_scope",
       adapter_id: "mcp.your_adapter",
       source_id: "src_replace_me",
@@ -8719,6 +11458,37 @@ function normalizeCapabilities(value) {
 function isHelpRequest(args) {
   return args.includes("--help") || args.includes("-h");
 }
+function isKnownTopLevelCommand(command) {
+  return (/* @__PURE__ */ new Set([
+    "help",
+    "init",
+    "inspect",
+    "config",
+    "doctor",
+    "validate",
+    "apply",
+    "propose",
+    "audit",
+    "start",
+    "runner",
+    "cloud",
+    "mcp",
+    "tools",
+    "onboard",
+    "demo",
+    "recipes",
+    "benchmark",
+    "proposals",
+    "replay",
+    "evidence",
+    "query-audit",
+    "receipts",
+    "activity",
+    "store",
+    "shadow",
+    "ui"
+  ])).has(command);
+}
 function cliCommandName() {
   if (process2.env.SYNAPSOR_RUNNER_COMMAND_NAME) return process2.env.SYNAPSOR_RUNNER_COMMAND_NAME;
   const invoked = path3.basename(process2.argv[1] ?? "");
@@ -8743,6 +11513,11 @@ Commands:
   propose      Create a local evidence-backed proposal
   audit        Review MCP/database tool risk
   proposals   Review, approve, or reject proposals
+  evidence    Inspect local evidence bundles
+  query-audit Inspect local query audit records
+  receipts    Inspect guarded writeback receipts
+  activity    Search local evidence/replay ledger
+  store       Inspect and maintain the local SQLite ledger
   apply        Apply an approved proposal with guarded writeback
   replay       Show what happened
   demo         Start the local commit-safety demo
@@ -8769,16 +11544,31 @@ Generate a reviewed Synapsor Runner contract. Defaults to read-only in the wizar
 `,
     mcp: `Usage:
   ${cmd} mcp serve --config ./synapsor.runner.json --store ./.synapsor/local.db
+  ${cmd} mcp serve-http --config ./synapsor.runner.json --store ./.synapsor/local.db --auth-token-env SYNAPSOR_RUNNER_HTTP_TOKEN
   ${cmd} mcp config --absolute-paths --config ./synapsor.runner.json --store ./.synapsor/local.db
   ${cmd} mcp audit --example dangerous-db-mcp
   ${cmd} mcp audit ./tools-list.json
 
+Use stdio for local MCP clients that launch the runner. Use authenticated HTTP for app/server deployments.
 MCP clients see semantic tools. They do not receive raw SQL, write credentials, approval tools, or commit tools.
 `,
     "mcp serve": `Usage:
   ${cmd} mcp serve --config ./synapsor.runner.json --store ./.synapsor/local.db [--read-only] [--local]
 
-Start the stdio MCP server. Startup logs stay off stdout so the MCP protocol remains clean.
+Start the stdio MCP server for local MCP clients such as Claude Desktop, Cursor, or local agent tools. Startup logs stay off stdout so the MCP protocol remains clean.
+`,
+    "mcp serve-http": `Usage:
+  export SYNAPSOR_RUNNER_HTTP_TOKEN=...
+  ${cmd} mcp serve-http --config ./synapsor.runner.json --store ./.synapsor/local.db [--host 127.0.0.1] [--port 8765] [--auth-token-env SYNAPSOR_RUNNER_HTTP_TOKEN]
+
+Start the HTTP MCP server for app/server deployments. Bearer auth is required by default.
+
+Security:
+  - Defaults to 127.0.0.1:8765.
+  - Refuses to start if the auth token env var is missing.
+  - Use --dev-no-auth only for localhost development.
+  - If binding to 0.0.0.0, use TLS, private networking, authentication, and rate limits.
+  - Optional CORS: --cors-origin http://localhost:3000
 `,
     "mcp config": `Usage:
   ${cmd} mcp config [claude-desktop|cursor|generic|vscode] [--absolute-paths] [--config ./synapsor.runner.json] [--store ./.synapsor/local.db]
@@ -8790,24 +11580,64 @@ Print MCP client configuration that references the local runner command, not dat
   ${cmd} propose <capability-name> --input ./input.json
   ${cmd} propose <capability-name> --json '{"invoice_id":"INV-3001","reason":"support-approved waiver"}'
 
+Examples after running ${cmd} demo:
+  ${cmd} propose billing.propose_late_fee_waiver --sample
+  ${cmd} propose support.propose_plan_credit --sample
+  ${cmd} propose orders.propose_status_change --sample
+
 Create the same evidence-backed proposal the MCP tool would create. The source database is not mutated.
 `,
     audit: `Usage:
   ${cmd} audit --example dangerous-db-mcp
+  ${cmd} audit --example dangerous-db-mcp --format json
+  ${cmd} audit --example dangerous-db-mcp --format markdown
   ${cmd} audit ./synapsor.runner.json
   ${cmd} audit --mcp-config ./claude_desktop_config.json
   ${cmd} audit --stdio "node ./server.js"
   ${cmd} audit --url http://localhost:3000/mcp
 
 Static MCP/database risk review only. This is not a security guarantee.
+`,
+    doctor: `Usage:
+  ${cmd} doctor --config synapsor.runner.json
+  ${cmd} doctor --config synapsor.runner.json --json
+  ${cmd} doctor --config synapsor.runner.json --report --redact --output synapsor-doctor.md
+  ${cmd} doctor --first-run
+
+Validate local config, environment bindings, semantic tool boundary, source metadata when reachable, and local store stats. Reports are redacted; do not paste secrets into issues.
 `,
     proposals: `Usage:
-  ${cmd} proposals list [--store ./.synapsor/local.db]
-  ${cmd} proposals show latest
-  ${cmd} proposals approve latest --yes
-  ${cmd} proposals reject latest --reason "..."
+	  ${cmd} proposals list [--tenant acme] [--capability billing.propose_late_fee_waiver] [--object invoice:INV-3001] [--status applied]
+	  ${cmd} proposals show latest
+	  ${cmd} proposals show latest --details
+	  ${cmd} proposals approve latest --yes
+	  ${cmd} proposals reject latest --reason "..."
+
+	Review decisions happen outside the model-facing MCP tool surface. Human output is concise by default; use --details for reviewer metadata or --json for complete records.
+	`,
+    evidence: `Usage:
+	  ${cmd} evidence list [--tenant acme] [--capability billing.inspect_invoice] [--object invoice:INV-3001]
+	  ${cmd} evidence show ev_...
+	  ${cmd} evidence show ev_... --details
+	  ${cmd} evidence export ev_... --format json --output evidence.json
+  ${cmd} evidence export ev_... --format markdown --output evidence.md
+
+Inspect captured local evidence bundles and query-audit links without rerunning external DB reads.
+`,
+    "query-audit": `Usage:
+	  ${cmd} query-audit list [--evidence ev_...] [--source app_postgres] [--table invoices]
+	  ${cmd} query-audit show <audit_id>
+	  ${cmd} query-audit show <audit_id> --details
+	  ${cmd} query-audit export <audit_id> --format json --output audit.json
 
-Review decisions happen outside the model-facing MCP tool surface.
+Inspect local query fingerprints, table names, row counts, and redacted-parameter metadata.
+`,
+    receipts: `Usage:
+	  ${cmd} receipts list [--proposal wrp_...] [--status applied]
+	  ${cmd} receipts show <receipt_id>
+	  ${cmd} receipts show <receipt_id> --details
+
+	Inspect guarded writeback receipts recorded by the trusted runner path. Use --details for idempotency keys, receipt hashes, and runner metadata.
 `,
     apply: `Usage:
   ${cmd} apply latest [--config ./synapsor.runner.json] [--store ./.synapsor/local.db]
@@ -8816,18 +11646,43 @@ Review decisions happen outside the model-facing MCP tool surface.
 Apply an approved proposal through guarded writeback. Requires a trusted write credential.
 `,
     replay: `Usage:
-  ${cmd} replay latest [--store ./.synapsor/local.db]
-  ${cmd} replay show latest
-  ${cmd} replay export latest --output replay.json
+  ${cmd} replay list [--tenant acme] [--object invoice:INV-3001]
+	  ${cmd} replay show latest
+	  ${cmd} replay show latest --details
+	  ${cmd} replay show --proposal wrp_...
+  ${cmd} replay show --replay replay_wrp_...
+  ${cmd} replay show --evidence ev_...
+  ${cmd} replay export --proposal wrp_... --format json --output replay.json
+  ${cmd} replay export --proposal wrp_... --format markdown --output replay.md
+
+	Show evidence, proposal events, receipts, and replay state without rerunning side effects. Human output is concise by default; use --details for reviewer metadata or --json for complete records.
+`,
+    activity: `Usage:
+	  ${cmd} activity search --tenant acme --object invoice:INV-3001
+	  ${cmd} activity search --tenant acme --object invoice:INV-3001 --details
+	  ${cmd} activity search --capability billing.propose_late_fee_waiver --from 2026-06-01 --to 2026-06-23
+
+Search the local SQLite evidence/replay ledger across proposals, evidence, query audit, receipts, and replay records.
+`,
+    store: `Usage:
+  ${cmd} store stats --store ./.synapsor/local.db
+  ${cmd} store vacuum --store ./.synapsor/local.db
+  ${cmd} store prune --store ./.synapsor/local.db --older-than 30d --dry-run
+  ${cmd} store prune --store ./.synapsor/local.db --older-than 30d --yes
 
-Show evidence, proposal events, receipts, and replay state without rerunning side effects.
+Local store maintenance only. Prune defaults to dry-run and never touches your source Postgres/MySQL database.
 `,
     demo: `Usage:
 	  ${cmd} demo [--force]
 	  ${cmd} demo --quick
+	  ${cmd} demo --quick --guided
+	  ${cmd} demo --quick --no-interactive
+	  ${cmd} demo --quick --details
+	  ${cmd} demo inspect
+	  ${cmd} demo inspect --npx
 
 	Start a disposable local Postgres demo and write ./synapsor.runner.json for the first-run flow.
-	Use --quick for a fixture-only 15-second explanation with no Docker startup.
+	Use --quick for a fixture-only guided walkthrough and local ledger seed with no Docker startup. Use demo inspect to print follow-up commands for the quick-demo fixture.
 	`,
     ui: `Usage:
   ${cmd} ui [--tour] [--config synapsor.runner.json] [--store ./.synapsor/local.db]