@volter/supercode-teams 0.3.142 → 0.3.144

package/README.md

@@ -188,3 +188,11 @@ Only the session custodian can grant this binding, in person or through an app t
 no session-backed channel is created. The agent DM uses the exact resource `${ROOM}:dm:${PRINCIPAL}`.
 `unbind` accepts the same flags. `--conversation` remains available for existing grants; it is mutually exclusive
 with `--agent`. Opening a DM reads the existing session; sending a turn is a separate action.
+
+## Read server work diagnostics
+
+An administrator can run `supercode teams storage work --json` to read recent handler records and retained slow work. Records name normalized HTTP routes, catalog refreshes, transitions and maintenance steps, with SQL call and cursor scan/write counts. The Worker retains up to 32 slow records across a restart. Elapsed milliseconds are not CPU time; hosted per-query timing is unavailable. [Recorded private Worker proof](../../docs/evidence/teams-handler-work-2026-10-07.md).
+
+Diagnostic persistence writes at most once every five seconds; the latest window can be lost on restart. A malformed retained history does not stop activation, and the report names that condition in `persistence.restore_error`.
+
+Carried capture commits use durable prefix checkpoints. An old session may first return HTTP 503 `carry_checkpoint_pending` with `Retry-After: 1`; retry the same staged commit while the host prepares bounded batches. A ready commit verifies at most 63 old message bodies. `carry_mismatch` refuses a forged prefix, and `carry_checkpoint_unavailable` refuses an unsupported internal checkpoint. The canonical wire digest is unchanged. See [the design](../../docs/adr/0024-capture-prefix-checkpoints.md) and [the measured proof](../../docs/evidence/teams-capture-prefixes-2026-10-07.md).

package/bin/workspace.mjs

@@ -95,6 +95,11 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   if (verb === 'sessions') return sessionsCommand(sub, command);
   if (verb === 'calendar') return calendarCommand(sub, { ...command, teamPath });
   if (verb === 'settings') return settingsCommand(sub, command);
+  if (verb === 'storage') {
+    only(flags, ['json', 'help', 'context']);requireArgs(rest, 0, 0, 'storage work');
+    if(sub!=='work')usage('storage work');
+    return output(await client.request('GET',teamPath(context,'/storage/work')));
+  }
   if (verb === 'members') return membersCommand(sub, command);
   if (verb === 'groups') return groupsCommand(sub, command);
   if (verb === 'sources') return sourcesCommand(sub, command);
@@ -1434,6 +1439,7 @@ function printHelp() {
   identity link
   identities observations|sightings|resolve|observe|declare-person|link|infer|revoke|revoke-inference --body-file FILE
   server start [--data-dir DIR] [--listen HOST:PORT] [--public-origin ORIGIN] [--init-team NAME] | server token
+  storage work [--context NAME] [--json]     administrators: recent handler work and retained slow records
   publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--scope view|control] [--name] [--key] [--machine] [--token-stdin] [--record-only]
   unpublish SURFACE --room ROOM --workplace ORIGIN --organization ORG [--machine] [--token-stdin] [--record-only|--workplace-only]
   connect|disconnect|status|fold   (fold: the connector's state back into connector.json for an older daemon, with it stopped)

package/contracts/index.d.ts

@@ -23,6 +23,7 @@ export type ErrorCode =
   | 'forbidden' | 'unsupported' | 'machine_offline' | 'controller_busy' | 'conflict'
   | 'resync_required' | 'revision_mismatch' | 'idempotency_conflict' | 'source_revoked'
   | 'source_paused' | 'session_deleted' | 'batch_gap' | 'capture_conflict'
+  | 'carry_mismatch' | 'carry_checkpoint_pending' | 'carry_checkpoint_unavailable'
   | 'fidelity_unavailable' | 'rate_limited' | 'request_too_large' | 'internal_error';
 export interface Failure {
   version: 1;

package/contracts/index.mjs

@@ -1,7 +1,7 @@
 import { ContractError, canonicalJson, sha256, validationFailure } from '@volter/teams/server/wire';
 export { ContractError, canonicalJson, validationFailure };
 const ID = /^(srv|team|usr|svc|grp|ses|msg|src|mach|bind|cap|upload|grant|map|op|cont|inv|cred|req|root|inc|rule|att|evt|audit)_[0-9a-f]{32}$/;
-export const ERROR_CODES = Object.freeze(['invalid_request','ambiguous_reference','authentication_required','not_found','forbidden','unsupported','machine_offline','controller_busy','conflict','resync_required','revision_mismatch','idempotency_conflict','source_revoked','source_paused','session_deleted','batch_gap','capture_conflict','fidelity_unavailable','rate_limited','request_too_large','internal_error']);
+export const ERROR_CODES = Object.freeze(['invalid_request','ambiguous_reference','authentication_required','not_found','forbidden','unsupported','machine_offline','controller_busy','conflict','resync_required','revision_mismatch','idempotency_conflict','source_revoked','source_paused','session_deleted','batch_gap','capture_conflict','carry_mismatch','carry_checkpoint_pending','carry_checkpoint_unavailable','fidelity_unavailable','rate_limited','request_too_large','internal_error']);
 export const OPERATIONS = Object.freeze(['me','teams_list','teams_create','list','search','read','follow','descriptor','access','grant','invite','accept_invite','source_create','source_config','enroll','heartbeat','machine_configuration','capture_begin','capture_part','capture_commit','correlate','live_grant','attach','prepare','launch','export']);
 const object = (value, name) => { if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ContractError(`${name} must be an object`); return value; };
 const exact = (value, allowed, name) => { for (const key of Object.keys(object(value, name))) if (!allowed.includes(key)) throw new ContractError(`${name}.${key} is unknown`); };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.142",
+  "version": "0.3.144",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -70,7 +70,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.37",
+    "@volter/teams": "0.2.39",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/server/arc2-transactions.mjs

@@ -34,7 +34,15 @@ export function correlateSessions(db,args){
   if(members.some(row=>!manageable(row)))fail('caller must manage every constituent','forbidden',403);
   if(members.some(row=>row.deleted_at!=null)){
     const deletedAt=members.map(row=>row.deleted_at).filter(value=>value!=null).reduce((a,b)=>Math.min(a,b)),team=get('SELECT journal_revision FROM teams WHERE id=?',[args.teamId]),revision=team.journal_revision+1,canonical=rootOf(members.reduce((best,row)=>row.created_at<best.created_at?row:best,members[0]));
-    for(const member of members){run('UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?',[deletedAt,revision,args.teamId,member.id]);run('UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=?',[deletedAt,args.teamId,member.id]);}
+    for(const member of members){
+      run('UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?',[deletedAt,revision,args.teamId,member.id]);
+      run('UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=?',[deletedAt,args.teamId,member.id]);
+      // Correlation propagates a tombstone without going through DELETE /sessions.
+      // Retire only metadata here; the alarm removes each generation in bounded batches.
+      run('INSERT OR IGNORE INTO capture_prefix_garbage SELECT team_id,session_id,source_id,generation FROM capture_prefix_state WHERE team_id=? AND session_id=?',[args.teamId,member.id]);
+      run('DELETE FROM capture_prefix_state WHERE team_id=? AND session_id=?',[args.teamId,member.id]);
+      run('DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=?',[args.teamId,member.id]);
+    }
     run('UPDATE teams SET journal_revision=?,auth_epoch=auth_epoch+1 WHERE id=?',[revision,args.teamId]);run('INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',[args.teamId,revision,canonical.id,'delete',now]);run('INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,args.auditId,args.principalId,args.operation,args.correlationId,'denied',revision,now]);return{tombstoned:true,revision,canonicalId:canonical.id};
   }
   const viewBySource=new Map();for(const row of members)for(const version of all('SELECT * FROM session_versions WHERE team_id=? AND session_id=? ORDER BY revision',[args.teamId,row.id])){const sourceId=JSON.parse(version.source_projection_json).source_id??'';if(sourceId&&(!viewBySource.has(sourceId)||version.revision>viewBySource.get(sourceId).revision))viewBySource.set(sourceId,{...row,...version,source_id:sourceId});}const views=[...viewBySource.values()];if(!views.length)fail('constituent projection missing','conflict',409);

package/server/capture-prefixes.mjs

@@ -0,0 +1,113 @@
+import { randomUUID } from 'node:crypto';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { canonicalJson } from '@volter/teams/server/wire';
+import { MESSAGE_AT } from '@volter/teams/server/migrations';
+
+// This is a versioned, internal continuation of the exactly pinned noble 2.4.0
+// SHA-256 engine, not a wire digest change. Its get/set state and HashMD metadata
+// are stored together; a digest closes a clone with ']', leaving the state resumable.
+const FORMAT = 'sha256-noble-2.4.0-v1';
+const encoder = new TextEncoder();
+const CHECKPOINT_MESSAGES = 64, CHECKPOINT_BYTES = 64 * 1024;
+const WARM_MESSAGES = 256, WARM_BYTES = 1024 * 1024, GARBAGE_ROWS = 512;
+const error = (status, code, message) => Object.assign(new Error(message), { status, code });
+export function startPrefix() { return sha256.create().update(encoder.encode('[')); }
+export function savePrefix(hash) {
+  return JSON.stringify({ format: FORMAT, words: hash.get(), length: hash.length, pos: hash.pos, buffer: Buffer.from(hash.buffer.subarray(0, hash.pos)).toString('base64') });
+}
+export function loadPrefix(state) {
+  const value = JSON.parse(state);
+  if (value.format !== FORMAT || !Array.isArray(value.words) || value.words.length !== 8 || value.words.some(x => !Number.isInteger(x) || x < -2147483648 || x > 2147483647) || !Number.isSafeInteger(value.length) || value.length < 1 || !Number.isInteger(value.pos) || value.pos < 0 || value.pos >= 64 || value.pos !== value.length % 64 || typeof value.buffer !== 'string')
+    throw error(503, 'carry_checkpoint_unavailable', 'capture prefix checkpoint has an unsupported format');
+  const bytes = Buffer.from(value.buffer, 'base64');
+  if (bytes.length !== value.pos) throw error(503, 'carry_checkpoint_unavailable', 'capture prefix checkpoint has an invalid buffer');
+  const hash = sha256.create(); hash.set(...value.words); hash.length = value.length; hash.pos = value.pos; hash.buffer.set(bytes); return hash;
+}
+export function prefixDigest(hash) { return Buffer.from(hash.clone().update(encoder.encode(']')).digest()).toString('hex'); }
+export function addPrefixMessage(hash, count, message) {
+  if (count) hash.update(encoder.encode(','));
+  hash.update(encoder.encode(canonicalJson({ native_key: message.native_key, recorded_at: message.recorded_at ?? null, value: message.value })));
+}
+const identity = row => [row.team_id, row.session_id, row.source_id, row.generation];
+export function writeCheckpoint(run, state, hash, count) {
+  run('INSERT OR REPLACE INTO capture_prefix_checkpoints(team_id,session_id,source_id,generation,count,digest,sha_state) VALUES (?,?,?,?,?,?,?)', [...identity(state), count, prefixDigest(hash), savePrefix(hash)]);
+}
+export function shouldCheckpoint(state, hash, count) { return count - state.checkpoint_count >= CHECKPOINT_MESSAGES || hash.length - state.checkpoint_bytes >= CHECKPOINT_BYTES; }
+
+/** Retire by generation: changing a session does not delete its whole prefix ledger on the request loop. */
+export function retirePrefix({ get, run }, teamId, sessionId, sourceId) {
+  const state = get('SELECT generation FROM capture_prefix_state WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+  if (!state) return;
+  run('INSERT OR IGNORE INTO capture_prefix_garbage VALUES (?,?,?,?)', [teamId, sessionId, sourceId, state.generation]);
+  run('DELETE FROM capture_prefix_state WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+  run('DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+}
+
+/** Verify a prepared prefix with at most 63 message reads / one checkpoint byte interval. Never a full scan. */
+export function resolveCapturePrefix({ get, run }, { teamId, sessionId, sourceId, revision, count, digest, sentKeys }) {
+  let state = get('SELECT * FROM capture_prefix_state WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+  if (!state || state.revision !== revision) {
+    retirePrefix({ get, run }, teamId, sessionId, sourceId);
+    const hash = startPrefix();
+    state = { team_id: teamId, session_id: sessionId, source_id: sourceId, revision, generation: randomUUID(), count: 0, target_count: count, sha_state: savePrefix(hash), checkpoint_count: 0, checkpoint_bytes: hash.length, invalid: 0 };
+    run('INSERT INTO capture_prefix_state VALUES (?,?,?,?,?,?,?,?,?,?,?)', [teamId, sessionId, sourceId, revision, state.generation, 0, count, state.sha_state, 0, hash.length, 0]);
+    writeCheckpoint(run, state, hash, 0);
+  }
+  if (state.invalid) throw error(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+  if (state.count < count) {
+    run('UPDATE capture_prefix_state SET target_count=MAX(target_count,?) WHERE team_id=? AND session_id=? AND source_id=?', [count, teamId, sessionId, sourceId]);
+    run('INSERT OR IGNORE INTO capture_prefix_warm_queue(team_id,session_id,source_id) VALUES (?,?,?)', [teamId, sessionId, sourceId]);
+    return { pending: true, prepared: state.count, requested: count };
+  }
+  const checkpoint = get('SELECT * FROM capture_prefix_checkpoints WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND count<=? ORDER BY count DESC LIMIT 1', [...identity(state), count]);
+  if (!checkpoint || count - checkpoint.count >= CHECKPOINT_MESSAGES) throw error(503, 'carry_checkpoint_unavailable', 'capture prefix checkpoint is incomplete');
+  const hash = loadPrefix(checkpoint.sha_state);
+  for (let ordinal = checkpoint.count; ordinal < count; ordinal++) {
+    const row = get(`SELECT ordinal,source_id,native_key,recorded_at,value_json FROM messages m WHERE m.team_id=? AND m.session_id=? AND m.ordinal=? AND ${MESSAGE_AT()} LIMIT 1`, [teamId, sessionId, ordinal, revision, revision]);
+    if (!row || row.source_id !== sourceId) throw error(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+    addPrefixMessage(hash, ordinal, { ...row, value: JSON.parse(row.value_json) });
+  }
+  if (prefixDigest(hash) !== digest) throw error(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+  for (const key of sentKeys) {
+    const held = get('SELECT ordinal FROM capture_prefix_keys WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND native_key=?', [...identity(state), key]);
+    if (held && held.ordinal < count) throw error(409, 'capture_conflict', 'duplicate native message key');
+  }
+  return { pending: false, generation: state.generation, sha_state: savePrefix(hash), checkpoint_count: state.checkpoint_count <= count ? state.checkpoint_count : checkpoint.count, checkpoint_bytes: state.checkpoint_count <= count ? state.checkpoint_bytes : loadPrefix(checkpoint.sha_state).length };
+}
+
+/** Stop starting messages at the row/byte bound, independent of a frozen clock.
+ * A single message may cross the byte bound; its size is bounded by capture admission. */
+export function warmCapturePrefixes({ get, run }) {
+  let messages = 0, bytes = 0;
+  const garbage = get('SELECT * FROM capture_prefix_garbage ORDER BY rowid LIMIT 1');
+  if (garbage) {
+    for (const table of ['capture_prefix_keys', 'capture_prefix_checkpoints']) run(`DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table} WHERE team_id=? AND session_id=? AND source_id=? AND generation=? LIMIT ${GARBAGE_ROWS})`, identity(garbage));
+    if (!get('SELECT 1 FROM capture_prefix_keys WHERE team_id=? AND session_id=? AND source_id=? AND generation=? LIMIT 1', identity(garbage)) && !get('SELECT 1 FROM capture_prefix_checkpoints WHERE team_id=? AND session_id=? AND source_id=? AND generation=? LIMIT 1', identity(garbage))) run('DELETE FROM capture_prefix_garbage WHERE team_id=? AND session_id=? AND source_id=? AND generation=?', identity(garbage));
+  }
+  const queued = get('SELECT * FROM capture_prefix_warm_queue ORDER BY ticket LIMIT 1');
+  const state = queued ? get('SELECT * FROM capture_prefix_state WHERE team_id=? AND session_id=? AND source_id=?', [queued.team_id, queued.session_id, queued.source_id]) : null;
+  if (queued) run('DELETE FROM capture_prefix_warm_queue WHERE ticket=?', [queued.ticket]);
+  if (state) {
+    const session = get('SELECT s.revision,s.deleted_at,src.state source_state FROM sessions s JOIN sources src ON src.team_id=s.team_id AND src.id=? WHERE s.team_id=? AND s.id=?', [state.source_id, state.team_id, state.session_id]);
+    if (!session || session.source_state !== 'active' || session.deleted_at != null || session.revision !== state.revision) retirePrefix({ get, run }, state.team_id, state.session_id, state.source_id);
+    else {
+      const hash = loadPrefix(state.sha_state), startBytes = hash.length;
+      if (state.count !== state.checkpoint_count) run('DELETE FROM capture_prefix_checkpoints WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND count=?', [...identity(state), state.count]);
+      while (state.count < state.target_count && messages < WARM_MESSAGES && hash.length - startBytes < WARM_BYTES) {
+        const row = get(`SELECT ordinal,source_id,native_key,recorded_at,value_json FROM messages m WHERE m.team_id=? AND m.session_id=? AND m.ordinal=? AND ${MESSAGE_AT()} LIMIT 1`, [state.team_id, state.session_id, state.count, state.revision, state.revision]);
+        if (!row || row.source_id !== state.source_id || get('SELECT 1 FROM capture_prefix_keys WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND native_key=?', [...identity(state), row?.native_key ?? ''])) { state.invalid = 1; break; }
+        addPrefixMessage(hash, state.count, { ...row, value: JSON.parse(row.value_json) });
+        run('INSERT INTO capture_prefix_keys VALUES (?,?,?,?,?,?)', [...identity(state), row.native_key, state.count]);
+        state.count++; messages++;
+        if (shouldCheckpoint(state, hash, state.count)) { writeCheckpoint(run, state, hash, state.count); state.checkpoint_count = state.count; state.checkpoint_bytes = hash.length; }
+      }
+      // Keep the exact last state too; it lets a full-prefix append avoid every body read.
+      if (state.count === state.target_count) writeCheckpoint(run, state, hash, state.count);
+      run('UPDATE capture_prefix_state SET count=?,sha_state=?,checkpoint_count=?,checkpoint_bytes=?,invalid=? WHERE team_id=? AND session_id=? AND source_id=? AND generation=?', [state.count, savePrefix(hash), state.checkpoint_count, state.checkpoint_bytes, state.invalid, ...identity(state)]);
+      bytes = hash.length - startBytes;
+      // FIFO across sessions, including ones whose warming began after this one.
+      if (!state.invalid && state.count < state.target_count) run('INSERT OR IGNORE INTO capture_prefix_warm_queue(team_id,session_id,source_id) VALUES (?,?,?)', [state.team_id, state.session_id, state.source_id]);
+    }
+  }
+  return { messages, bytes, backlog: !!get('SELECT 1 FROM capture_prefix_warm_queue LIMIT 1') || !!get('SELECT 1 FROM capture_prefix_garbage LIMIT 1') };
+}

package/server/capture-transactions.mjs

@@ -1,15 +1,36 @@
 import { createHash } from 'node:crypto';
 import { MESSAGE_AT, OPEN_REVISION } from '@volter/teams/server/migrations';
 import { normalizeSearch, textFromContent } from './catalog.mjs';
+import { addPrefixMessage, loadPrefix, retirePrefix, savePrefix, shouldCheckpoint, writeCheckpoint } from './capture-prefixes.mjs';
 
 export function applyCaptureMessages({ get, run }, capture, revision) {
-  const { teamId, sessionId, sourceId, captureId, harness, nativeId, currentRevision, carriedCount, parts, messageNamespace } = capture;
+  const { teamId, sessionId, sourceId, captureId, harness, nativeId, currentRevision, carriedCount, parts, messageNamespace, prefix } = capture;
+  let prefixState = null, prefixHash = null;
+  if (prefix) {
+    prefixState = get('SELECT * FROM capture_prefix_state WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+    if (!prefixState || prefixState.revision !== currentRevision || prefixState.generation !== prefix.generation) throw Object.assign(new Error('session prefix changed before commit; retry'), { status: 409, code: 'revision_mismatch' });
+    prefixHash = loadPrefix(prefix.sha_state);
+    if (prefixState.count !== prefixState.checkpoint_count) run('DELETE FROM capture_prefix_checkpoints WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND count=?', [teamId, sessionId, sourceId, prefix.generation, prefixState.count]);
+    prefixState.checkpoint_count = prefix.checkpoint_count;
+    prefixState.checkpoint_bytes = prefix.checkpoint_bytes;
+    // Remove only a tail the capture replaces, through its ordinal/count index.
+    run('DELETE FROM capture_prefix_keys WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND ordinal>=?', [teamId, sessionId, sourceId, prefix.generation, carriedCount]);
+    run('DELETE FROM capture_prefix_checkpoints WHERE team_id=? AND session_id=? AND source_id=? AND generation=? AND count>?', [teamId, sessionId, sourceId, prefix.generation, carriedCount]);
+  } else retirePrefix({ get, run }, teamId, sessionId, sourceId);
   let ordinal = carriedCount;
   for (let index = 0; index < parts; index++) {
     const heldPart = get('SELECT payload_json FROM capture_parts WHERE team_id=? AND capture_id=? AND part_index=?', [teamId, captureId, index]);
     if (!heldPart) throw Object.assign(new Error('capture parts incomplete'), { status: 409, code: 'batch_gap' });
     const part = JSON.parse(heldPart.payload_json);
     for (const message of part.messages) {
+      if (prefixHash) {
+        addPrefixMessage(prefixHash, ordinal, message);
+        run('INSERT INTO capture_prefix_keys VALUES (?,?,?,?,?,?) ON CONFLICT(team_id,session_id,source_id,generation,native_key) DO UPDATE SET ordinal=excluded.ordinal', [teamId, sessionId, sourceId, prefix.generation, message.native_key, ordinal]);
+        if (shouldCheckpoint(prefixState, prefixHash, ordinal + 1)) {
+          writeCheckpoint(run, prefixState, prefixHash, ordinal + 1);
+          prefixState.checkpoint_count = ordinal + 1; prefixState.checkpoint_bytes = prefixHash.length;
+        }
+      }
       const value = JSON.stringify(message.value);
       const old = currentRevision == null ? null : get(`SELECT revision,source_id,native_key,recorded_at,value_json,until_revision FROM messages m WHERE m.team_id=? AND m.session_id=? AND m.ordinal=? AND ${MESSAGE_AT()} LIMIT 1`, [teamId, sessionId, ordinal, currentRevision, currentRevision]);
       if (old && old.source_id === sourceId && old.native_key === message.native_key && old.recorded_at === message.recorded_at && old.value_json === value) {
@@ -27,5 +48,10 @@ export function applyCaptureMessages({ get, run }, capture, revision) {
     }
   }
   if (currentRevision != null) run('UPDATE messages SET until_revision=? WHERE team_id=? AND session_id=? AND ordinal>=? AND revision<=? AND until_revision=?', [revision, teamId, sessionId, ordinal, currentRevision, OPEN_REVISION]);
+  if (prefixHash) {
+    writeCheckpoint(run, prefixState, prefixHash, ordinal);
+    run('UPDATE capture_prefix_state SET revision=?,count=?,target_count=?,sha_state=?,checkpoint_count=?,checkpoint_bytes=? WHERE team_id=? AND session_id=? AND source_id=? AND generation=?', [revision, ordinal, ordinal, savePrefix(prefixHash), prefixState.checkpoint_count, prefixState.checkpoint_bytes, teamId, sessionId, sourceId, prefix.generation]);
+    run('DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=? AND source_id=?', [teamId, sessionId, sourceId]);
+  }
   return { messages: ordinal - carriedCount };
 }

package/server/event-routes.mjs

@@ -221,7 +221,7 @@ export async function handleCatalogEvents({ api, req, res, auth, url, requestId,
   const stream = await openStream(api, req, res, auth, requestId);
   let lastCursor = null;
   const enqueue = streamQueue(stream, async () => {
-    const page = await catalogWindow(api, auth, query);
+    const page = await (api.work ? api.work('catalogWindow', () => catalogWindow(api, auth, query)) : catalogWindow(api, auth, query));
     // Authorization and expiry can change a window without creating a session revision.
     // A binding's observed_at moves with every heartbeat; only a change of what the window says is a reset.
     const digest = createHash('sha256').update(JSON.stringify(page.data, (key, value) => key === 'bindings' && Array.isArray(value) ? value.map(({ observed_at: _seen, ...binding }) => binding) : value)).digest('hex');

package/server/harness-routes.mjs

@@ -88,6 +88,11 @@ async function beforeIdempotency({ api, req, res, auth, url, path, sub, requestI
 
 async function team({ api, req, res, auth, url, path, sub, requestId }) {
   let m;
+  if(req.method==='GET'&&sub==='/storage/work'){
+    if(!isAdmin(auth))fail(403,'forbidden','Teams work diagnostics require an administrator');
+    if(!api.workReport)fail(501,'unsupported','this host does not record Teams work diagnostics');
+    send(res,200,result(api,auth,api.workReport()),requestId);return true;
+  }
   if(req.method==='GET'&&sub==='/storage/uploads'){await storageReport({api,res,auth,url,requestId});return true;}
   if(req.method==='GET'&&sub==='/sessions'){await listSessions(api,res,auth,url,requestId,false);return true;}
   if(req.method==='GET'&&sub==='/sessions/search'){await listSessions(api,res,auth,url,requestId,true);return true;}
@@ -240,13 +245,14 @@ async function correlateRoute(api,req,res,auth,path,requestId){
   if(body.evidence!=='custodian_attestation'||typeof body.harness!=='string'||typeof body.left_source_id!=='string'||typeof body.right_source_id!=='string'||typeof body.left_native_id!=='string'||typeof body.right_native_id!=='string'||!Number.isSafeInteger(body.left_revision)||!Number.isSafeInteger(body.right_revision))fail(400,'invalid_request','invalid correlation attestation');
   const correlationId=api.ids.next('correlation'),record=res._idempotencyRecord;
   const outcome=await api.store.correlateSessions({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,now:api.clock.nowMs(),correlationId,auditId:api.ids.next('audit'),operation:`POST ${path}`,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},idempotency:record?{route:record.route,key:record.key,requestDigest:record.requestDigest}:null,harness:body.harness,evidence:body,left:{sourceId:body.left_source_id,nativeId:body.left_native_id,revision:body.left_revision},right:{sourceId:body.right_source_id,nativeId:body.right_native_id,revision:body.right_revision}});
-  if(outcome.tombstoned){res._sideEffectsCommitted=true;api.events.publish(auth.team_id,{type:'session_deleted',cursor:String(outcome.revision),revision:outcome.revision,session_id:outcome.canonicalId});fail(410,'session_deleted','a correlated constituent was deleted');}
+  if(outcome.tombstoned){res._sideEffectsCommitted=true;api.events.publish(auth.team_id,{type:'session_deleted',cursor:String(outcome.revision),revision:outcome.revision,session_id:outcome.canonicalId});await api.scheduleCapturePrefixWork?.();fail(410,'session_deleted','a correlated constituent was deleted');}
   res._sideEffectsCommitted=true;api.events.publish(auth.team_id,{type:'session_changed',cursor:String(outcome.revision),revision:outcome.revision,session_id:outcome.canonicalId,reason:'metadata',read_required:true});send(res,200,outcome.response,requestId,{ETag:`"${outcome.revision}"`});
 }
 async function mutateSession(api,req,res,auth,id,requestId){const seed=await api.store.one('SELECT * FROM sessions WHERE team_id=? AND id=?',[auth.team_id,id]),root=await canonicalSession(api,auth.team_id,seed),canonicalId=root?.id??id;const row=await api.store.one('SELECT s.*,v.descriptor_json,v.source_projection_json,v.search_title,v.sort_at FROM sessions s JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? AND s.id=?',[auth.team_id,canonicalId]);if(!row)fail(404,'not_found','not found');const members=await constituents(api,auth.team_id,row);for(const member of members)if(!isAdmin(auth)&&!canManage(auth,member,await grants(api,auth.team_id,member.id)))fail(404,'not_found','not found');const expected=Number(String(req.headers['if-match']??'').replaceAll('"',''));if(!Number.isSafeInteger(expected))fail(400,'invalid_request','If-Match is required');if(expected!==row.revision)fail(409,'revision_mismatch','session revision changed');const boundaryNow=api.clock.nowMs(),revisionParam={$journalRevision:true},guards=[...authGuards(auth,boundaryNow),{sql:'SELECT 1 ok FROM sessions WHERE team_id=? AND id=? AND revision=? AND deleted_at IS NULL',params:[auth.team_id,row.id,expected],code:'revision_mismatch',status:409,message:'session revision changed'}];
   for(const member of members)guards.push(managerGuard(auth,member.id,boundaryNow,{governance:true}));
-  if(req.method==='DELETE'){const deletion=[];for(const member of members)deletion.push({sql:'UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?',params:[boundaryNow,revisionParam,auth.team_id,member.id]},{sql:'UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=?',params:[boundaryNow,auth.team_id,member.id]},{sql:'DELETE FROM session_versions WHERE team_id=? AND session_id=?',params:[auth.team_id,member.id]});deletion.push({sql:'UPDATE teams SET journal_revision=?,auth_epoch=auth_epoch+1 WHERE id=?',params:[revisionParam,auth.team_id]},{sql:'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',params:[auth.team_id,revisionParam,row.id,'delete',boundaryNow]});const {revision}=await guardedMutation(api,res,auth,guards,deletion,{status:204,body:null,targetId:row.id,journal:true});api.events.publish(auth.team_id,{type:'session_deleted',cursor:String(revision),revision,session_id:row.id});return send(res,204,null,requestId);}
+  if(req.method==='DELETE'){const deletion=[];for(const member of members)deletion.push({sql:'UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?',params:[boundaryNow,revisionParam,auth.team_id,member.id]},{sql:'UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=?',params:[boundaryNow,auth.team_id,member.id]},{sql:'DELETE FROM session_versions WHERE team_id=? AND session_id=?',params:[auth.team_id,member.id]},{sql:'INSERT OR IGNORE INTO capture_prefix_garbage SELECT team_id,session_id,source_id,generation FROM capture_prefix_state WHERE team_id=? AND session_id=?',params:[auth.team_id,member.id]},{sql:'DELETE FROM capture_prefix_state WHERE team_id=? AND session_id=?',params:[auth.team_id,member.id]},{sql:'DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=?',params:[auth.team_id,member.id]});deletion.push({sql:'UPDATE teams SET journal_revision=?,auth_epoch=auth_epoch+1 WHERE id=?',params:[revisionParam,auth.team_id]},{sql:'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',params:[auth.team_id,revisionParam,row.id,'delete',boundaryNow]});const {revision}=await guardedMutation(api,res,auth,guards,deletion,{status:204,body:null,targetId:row.id,journal:true});api.events.publish(auth.team_id,{type:'session_deleted',cursor:String(revision),revision,session_id:row.id});await api.scheduleCapturePrefixWork?.();return send(res,204,null,requestId);}
   const body=await parseJson(req);exact(body,['title']);if(body.title!==null&&typeof body.title!=='string')fail(400,'invalid_request','title must be string or null');const descriptor={...projection(row),title:body.title};delete descriptor.revision;const statements=[{sql:'UPDATE sessions SET revision=? WHERE team_id=? AND id=? AND revision=?',params:[revisionParam,auth.team_id,row.id,expected]},{sql:'INSERT INTO session_versions(team_id,session_id,revision,descriptor_json,source_projection_json,search_title,sort_at,created_at) VALUES (?,?,?,?,?,?,?,?)',params:[auth.team_id,row.id,revisionParam,{$journalJson:descriptor},row.source_projection_json,normalizeSearch(body.title??''),row.sort_at,boundaryNow]}];// The new version holds the same messages: the current version's rows stay open into it (schema 9), none copied.
+  statements.push({sql:'UPDATE capture_prefix_state SET revision=? WHERE team_id=? AND session_id=? AND revision=?',params:[revisionParam,auth.team_id,row.id,expected]});
   statements.push({sql:`UPDATE messages SET until_revision=? WHERE team_id=? AND session_id=? AND ${MESSAGE_AT('messages')}`,params:[OPEN_REVISION,auth.team_id,row.id,row.revision,row.revision]});statements.push({sql:'UPDATE teams SET journal_revision=? WHERE id=?',params:[revisionParam,auth.team_id]},{sql:'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',params:[auth.team_id,revisionParam,row.id,'metadata',boundaryNow]});const storedResponse=result(api,auth,{...descriptor,revision:'__JOURNAL_REVISION__'}),{revision}=await guardedMutation(api,res,auth,guards,statements,{status:200,body:storedResponse,targetId:row.id,journal:true}),responseDescriptor={...descriptor,revision};api.events.publish(auth.team_id,{type:'session_changed',cursor:String(revision),revision,session_id:row.id,reason:'metadata',read_required:true});send(res,200,result(api,auth,responseDescriptor),requestId,{ETag:`"${revision}"`});}
 async function readSession(api,res,auth,id,url,requestId){
   const query=qobj(url);
@@ -409,30 +415,21 @@ async function captureCommit(api,req,res,auth,sourceId,captureId,requestId){cons
   }
   if(commit.native_bundle!=null){const bundle=commit.native_bundle;exact(bundle,['id','harness','fidelity','residue','files'],'native_bundle');if(typeof bundle.id!=='string'||bundle.harness!==cap.harness||!['byte_lossless','value_lossless','semantic'].includes(bundle.fidelity)||!Array.isArray(bundle.residue)||!bundle.residue.every(x=>typeof x==='string')||!Array.isArray(bundle.files))fail(400,'invalid_request','invalid native bundle');const artifactIds=new Set(commit.artifacts.map(x=>x.upload_id)),seen=new Set();for(const file of bundle.files){exact(file,['upload_id','role'],'native_bundle file');if(!artifactIds.has(file.upload_id)||seen.has(file.upload_id)||!['primary','subagent','bundle','source_recovery'].includes(file.role))fail(400,'invalid_request','native bundle files must uniquely reference captured artifacts');seen.add(file.upload_id);}if(seen.size!==artifactIds.size||bundle.files.filter(x=>x.role==='primary').length!==1||new Set(commit.artifacts.map(x=>x.relative_name)).size!==commit.artifacts.length)fail(400,'invalid_request','native bundle must describe every unique artifact and one primary');}
   let origin=await api.store.one('SELECT * FROM origins WHERE team_id=? AND source_id=? AND harness=? AND native_id=?',[auth.team_id,sourceId,cap.harness,cap.native_id]);
-  // Verify an unchanged prefix in bounded pages, then leave those rows open.
-  // Rebuilding and serializing the whole transcript for each appended turn can
-  // exhaust a hosted worker even though the client sends only the new tail.
-  let carriedCount = 0, carriedRevision = null;
+  // Prepared digests are owned by this source and fenced by the session revision.
+  // A cold prefix queues bounded background work; no request falls back to a whole transcript read.
+  let carriedCount = 0, carriedRevision = null, prefix = null;
   if (begin.carry) {
     const { count, digest } = begin.carry;
     const session = origin ? await api.store.one('SELECT revision FROM sessions WHERE team_id=? AND id=?', [auth.team_id, origin.session_id]) : null;
     if (!session || count + messageCount > 100000) fail(409, 'carry_mismatch', 'the carried prefix is unavailable or too large');
     carriedRevision = session.revision;
-    const hash = createHash('sha256').update('[');
-    while (carriedCount < count) {
-      const page = await api.store.query(`SELECT ordinal,source_id,native_key,recorded_at,value_json FROM messages m
-        WHERE m.team_id=? AND m.session_id=? AND m.ordinal>=? AND m.ordinal<? AND ${MESSAGE_AT()} ORDER BY m.ordinal LIMIT 16`,
-        [auth.team_id, origin.session_id, carriedCount, count, carriedRevision, carriedRevision]);
-      if (!page.length) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
-      for (const row of page) {
-        if (row.ordinal !== carriedCount || row.source_id !== sourceId) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
-        if (sentKeys.has(row.native_key)) fail(409, 'capture_conflict', 'duplicate native message key');
-        if (carriedCount) hash.update(',');
-        hash.update(canonicalJson({native_key:row.native_key, recorded_at:row.recorded_at ?? null, value:JSON.parse(row.value_json)}));
-        carriedCount++;
-      }
+    prefix = await api.store.call('resolveCapturePrefix', { teamId: auth.team_id, sessionId: origin.session_id, sourceId, revision: carriedRevision, count, digest, sentKeys: [...sentKeys] });
+    if (prefix.pending) {
+      await api.scheduleCapturePrefixWork?.();
+      res.setHeader('Retry-After', '1');
+      fail(503, 'carry_checkpoint_pending', 'the session prefix is preparing; retry this capture without resending its messages');
     }
-    if (hash.update(']').digest('hex') !== digest) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+    carriedCount = count;
   }
   let lineage=null,lineageValue=null,lineageMembers=[],lineageGuards=[];if(!origin&&source.kind==='connector'&&source.machine_id){const candidates=await api.store.query("SELECT * FROM continuations WHERE team_id=? AND state='running' AND json_extract(value_json,'$.new_session_id') IS NULL AND json_extract(value_json,'$.harness')=? AND json_extract(value_json,'$.destination.machine_id')=? AND json_extract(value_json,'$.remote_result.state')='succeeded' AND json_extract(value_json,'$.remote_result.receipt.native_session_id')=?",[auth.team_id,cap.harness,source.machine_id,cap.native_id]);if(candidates.length===1){const candidate=candidates[0],membership=await api.store.one('SELECT role,active FROM memberships WHERE team_id=? AND principal_id=?',[auth.team_id,candidate.requester_id]),reader={kind:'user',team_id:auth.team_id,principal_id:candidate.requester_id,role:membership?.role,active:membership?.active===1,now:api.clock.nowMs(),group_ids:(await api.store.query('SELECT group_id FROM group_members WHERE team_id=? AND principal_id=?',[auth.team_id,candidate.requester_id])).map(x=>x.group_id)};if(await canReadMerged(api,reader,await api.store.one('SELECT * FROM sessions WHERE team_id=? AND id=?',[auth.team_id,candidate.source_session_id]))){lineage=candidate;lineageValue=JSON.parse(candidate.value_json);lineageMembers=await constituents(api,auth.team_id,await api.store.one('SELECT * FROM sessions WHERE team_id=? AND id=?',[auth.team_id,candidate.source_session_id]));}}if(lineageValue){const lineageNow=api.clock.nowMs();lineageGuards=[{sql:'SELECT 1 ok FROM memberships WHERE team_id=? AND principal_id=? AND active=1',params:[auth.team_id,lineage.requester_id],code:'conflict',status:409,message:'continuation requester membership changed'},{sql:'SELECT 1 ok FROM credentials WHERE id=? AND principal_id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)',params:[lineageValue.issuer_credential_id,lineage.requester_id,lineageNow],code:'conflict',status:409,message:'continuation issuer credential changed'},...lineageMembers.map(member=>({sql:`SELECT 1 ok FROM sessions s WHERE s.team_id=? AND s.id=? AND s.deleted_at IS NULL AND (?=0 OR s.access_revision=?) AND (s.visibility='team' OR s.custodian_id=? OR EXISTS (SELECT 1 FROM session_grants g WHERE g.team_id=s.team_id AND g.session_id=s.id AND (g.expires_at IS NULL OR g.expires_at>?) AND (g.subject_kind='principal' AND g.subject_id=? OR g.subject_kind='group' AND EXISTS (SELECT 1 FROM group_members gm WHERE gm.team_id=s.team_id AND gm.group_id=g.subject_id AND gm.principal_id=?))))`,params:[auth.team_id,member.id,member.id===lineage.source_session_id?1:0,lineageValue.access_revision,lineage.requester_id,lineageNow,lineage.requester_id,lineage.requester_id],code:'conflict',status:409,message:'continuation source authorization changed'}))];}}
   const sid=origin?.session_id??api.ids.next('session'),parentOrigin=commit.parent_native_id?await api.store.one('SELECT session_id FROM origins WHERE team_id=? AND source_id=? AND harness=? AND native_id=? AND deleted_at IS NULL',[auth.team_id,sourceId,cap.harness,commit.parent_native_id]):null,revisionParam={$journalRevision:true},recorded=commit.recorded_activity_at,boundaryNow=api.clock.nowMs(),sortAt=recorded??boundaryNow,descriptor={id:sid,revision:'__JOURNAL_REVISION__',title:commit.title,harness:cap.harness,user:{principal_id:source.kind==='connector'?source.custodian_id:null,reported_user:commit.reported_user,status:source.kind==='connector'?'verified':commit.reported_user?'reported':'unknown',mapping_id:null},repository:commit.repository,parent_id:parentOrigin?.session_id??null,continued_from:lineage?.source_session_id??null,recorded_activity_at:recorded,received_at:boundaryNow,sort_at:sortAt,activity_basis:recorded==null?'received':'recorded',source_ids:[sourceId],machine_ids:source.machine_id?[source.machine_id]:[],coverage:commit.coverage,bindings:[],actions:{}},statements=[];
@@ -447,7 +444,7 @@ async function captureCommit(api,req,res,auth,sourceId,captureId,requestId){cons
   carryGuards.push({ sql: 'SELECT 1 ok WHERE (SELECT COUNT(*) FROM capture_parts WHERE team_id=? AND capture_id=?)=?', params: [auth.team_id, captureId, commit.parts], status: 409, code: 'batch_gap', message: 'capture parts changed before commit' });
   // Another commit to this session between this read and the write would make the carried rows wrong: refused, retried.
   if(currentRevision!=null)carryGuards.push({sql:'SELECT 1 ok FROM sessions WHERE team_id=? AND id=? AND revision=?',params:[auth.team_id,sid,currentRevision],code:'revision_mismatch',status:409,message:'session changed during capture; retry'});
-  statements.push({ kind: 'capture_messages', capture: { teamId: auth.team_id, sessionId: sid, sourceId, captureId, harness: cap.harness, nativeId: cap.native_id, currentRevision, carriedCount, parts: commit.parts, messageNamespace: api.ids.next('message') } });
+  statements.push({ kind: 'capture_messages', capture: { teamId: auth.team_id, sessionId: sid, sourceId, captureId, harness: cap.harness, nativeId: cap.native_id, currentRevision, carriedCount, prefix, parts: commit.parts, messageNamespace: api.ids.next('message') } });
   const bundle=commit.native_bundle??null,legacyBundle=commit.artifacts.length?captureId:null;for(let index=0;index<commit.artifacts.length;index++){const a=commit.artifacts[index],file=bundle?.files.find(x=>x.upload_id===a.upload_id);statements.push({sql:'UPDATE uploads SET manifest_json=?,committed=1 WHERE team_id=? AND id=?',params:[JSON.stringify(a),auth.team_id,a.upload_id]},{sql:'INSERT INTO session_artifacts(team_id,session_id,revision,bundle_id,upload_id,format,provenance,file_role,fidelity,residue_json) VALUES (?,?,?,?,?,?,?,?,?,?)',params:[auth.team_id,sid,revisionParam,bundle?.id??legacyBundle,a.upload_id,bundle?.harness??cap.harness,'capture',file?.role??(index===0?'primary':'bundle'),bundle?.fidelity??'semantic',JSON.stringify(bundle?.residue??['native_bundle_metadata_unavailable'])]});}const storedReceipt={source_id:sourceId,capture_id:captureId,session_id:sid,generation:cap.generation,sequence:cap.sequence,digest:commit.digest,revision:'__JOURNAL_REVISION__',duplicate:false};statements.push({sql:"UPDATE captures SET state='committed',commit_json=?,receipt_json=? WHERE team_id=? AND id=?",params:[JSON.stringify(commit),{$journalJsonValue:storedReceipt},auth.team_id,captureId]},{sql:'DELETE FROM capture_parts WHERE team_id=? AND capture_id=?',params:[auth.team_id,captureId]},{sql:'UPDATE sources SET last_received_at=? WHERE team_id=? AND id=?',params:[boundaryNow,auth.team_id,sourceId]},{sql:'UPDATE teams SET journal_revision=? WHERE id=?',params:[revisionParam,auth.team_id]},{sql:'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',params:[auth.team_id,revisionParam,sid,'capture',boundaryNow]});const guards=[{sql:'SELECT 1 ok FROM credentials WHERE id=? AND source_id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)',params:[auth.credential_id,sourceId,boundaryNow],code:'authentication_required',status:401,message:'source credential expired or revoked'},...lineageGuards,...carryGuards,{sql:"SELECT 1 ok FROM captures c JOIN sources s ON s.team_id=c.team_id AND s.id=c.source_id LEFT JOIN machines m ON m.team_id=s.team_id AND m.id=s.machine_id LEFT JOIN sync_rules r ON r.team_id=c.team_id AND r.id=json_extract(c.begin_json,'$.rule_id') WHERE c.team_id=? AND c.id=? AND c.source_id=? AND c.state='staging' AND s.state='active' AND (s.kind!='connector' OR (m.revoked_at IS NULL AND r.machine_id=m.id AND r.source_id=s.id AND r.state='active' AND r.revision=json_extract(c.begin_json,'$.rule_revision') AND r.visibility=json_extract(c.begin_json,'$.visibility')))",params:[auth.team_id,captureId,sourceId],code:'conflict',status:409,message:'capture authorization changed'}],storedResponse=result(api,auth,storedReceipt),{revision}=await guardedMutation(api,res,auth,guards,statements,{status:200,body:storedResponse,targetId:captureId,journal:true}),receipt={...storedReceipt,revision};api.events.publish(auth.team_id,{type:'session_changed',cursor:String(revision),revision,session_id:sid,reason:'capture',read_required:true});send(res,200,result(api,auth,receipt),requestId);
 }
 

package/server/index.mjs

@@ -24,7 +24,14 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;
-  let store,http,upgrade,lockFd,maintenanceTimer,maintenanceWork,started=false;
+  let store,http,upgrade,lockFd,maintenanceTimer,maintenanceWork,maintenanceRunning=false,prefixRequested=false,maintenanceDue=0,started=false;
+  api.scheduleCapturePrefixWork=async()=>{
+    prefixRequested=true;
+    if(!started||maintenanceRunning)return;
+    if(maintenanceTimer)clearTimeout(maintenanceTimer);
+    maintenanceTimer=setTimeout(()=>{maintenanceWork=maintenance();},100);maintenanceTimer.unref?.();
+  };
+  let maintenance;
   api.start=async()=>{
     if(started)throw new Error('Teams server already started'); mkdirSync(dataDir,{recursive:true,mode:0o700});chmodSync(dataDir,0o700);
     const lock=join(dataDir,'server.lock'); const acquire=()=>{lockFd=openSync(lock,'wx',0o600);writeFileSync(lockFd,JSON.stringify({pid:process.pid,started_at:clock.nowMs()}));};try{acquire();}catch(e){let recover=false;try{const owner=JSON.parse(readFileSync(lock,'utf8'));if(Number.isInteger(owner.pid)&&owner.pid>1){try{process.kill(owner.pid,0);}catch(error){recover=error.code==='ESRCH';}}}catch{}if(!recover)throw new Error(`Teams data directory is already owned: ${dataDir}`,{cause:e});unlinkSync(lock);acquire();}
@@ -43,14 +50,24 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
       }
       api.attach({serverId});
       if(existsSync(credentialPath))api.appRootSecret=JSON.parse(readFileSync(credentialPath,'utf8')).token;
-      const maintenance=async()=>{
+      maintenance=async()=>{
+        maintenanceRunning=true;prefixRequested=false;
         let next=60000;
         try{
-          const result=await maintain(api);next=maintainDelay(api,result);
-          if(!result?.backlog){const reclaimed=await store.call('reclaimStorage');if(reclaimed.after.allocated<reclaimed.before.allocated)console.log(`Teams storage reclaimed: ${JSON.stringify(reclaimed)}`);}
-          const usage=await api.storageUsage();
-          if(usage.used>=usage.limit*0.8||usage.available_bytes<usage.min_free_bytes+usage.limit*0.2)console.warn(`Teams storage pressure: ${JSON.stringify(usage)}; native admission stops at90% or the configured disk reserve`);
+          const prefixes=await store.call('warmCapturePrefixes').catch(error=>{console.error(`Teams capture prefix preparation failed: ${error.message}`);return {backlog:true};});
+          // Prefix preparation runs in small batches; it must not pull retention,
+          // compaction or filesystem probes forward on every batch.
+          if(Date.now()>=maintenanceDue){
+            const result=await maintain(api);maintenanceDue=Date.now()+maintainDelay(api,result);
+            if(!result?.backlog){const reclaimed=await store.call('reclaimStorage');if(reclaimed.after.allocated<reclaimed.before.allocated)console.log(`Teams storage reclaimed: ${JSON.stringify(reclaimed)}`);}
+            const usage=await api.storageUsage();
+            if(usage.used>=usage.limit*0.8||usage.available_bytes<usage.min_free_bytes+usage.limit*0.2)console.warn(`Teams storage pressure: ${JSON.stringify(usage)}; native admission stops at90% or the configured disk reserve`);
+          }
+          next=Math.max(1,maintenanceDue-Date.now());
+          if(prefixes.backlog)next=Math.min(next,100);
         }catch(error){console.error(`Teams maintenance failed: ${error.message}`);next=3000;}
+        maintenanceRunning=false;
+        if(prefixRequested)next=Math.min(next,100);
         if(started){maintenanceTimer=setTimeout(()=>{maintenanceWork=maintenance();},next);maintenanceTimer.unref?.();}
         return next;
       };

package/server/store-core.mjs

@@ -6,6 +6,7 @@
 import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
+import { resolveCapturePrefix, warmCapturePrefixes } from './capture-prefixes.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
 import { AGENT_ACTIVE, AGENT_DESCENDANTS } from '@volter/teams/server/agent-authority';
 import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
@@ -157,6 +158,8 @@ export function createStoreHandlers({ all, get, run, tx }) {
     guardedTransaction: ({guards=[],statements}) => tx(() => { for(const guard of guards){const row=get(guard.sql,guard.params);if(!row){const error=new Error(guard.message??'transaction predicate changed');error.code=guard.code??'conflict';error.status=guard.status??409;throw error;}}return statements.map(s=>s.kind==='query'?all(s.sql,s.params):s.kind==='one'?get(s.sql,s.params):run(s.sql,s.params));}),
     journalTransaction: ({teamId,guards=[],statements}) => tx(() => { for(const guard of guards){const row=get(guard.sql,guard.params);if(!row){const error=new Error(guard.message??'transaction predicate changed');error.code=guard.code??'conflict';error.status=guard.status??409;throw error;}}const team=get('SELECT journal_revision FROM teams WHERE id=?',[teamId]);if(!team)throw new Error('team not found');const revision=team.journal_revision+1;const results=statements.map(s=>{if(s.kind==='capture_messages')return applyCaptureMessages({get,run},s.capture,revision);const params=(s.params??[]).map(value=>journalParam(value,revision));return s.kind==='query'?all(s.sql,params):s.kind==='one'?get(s.sql,params):run(s.sql,params);});return{revision,results};}),
     ingestOtlpBatch: args => tx(() => ingestOtlpBatch({get,all,run},args)),
+    resolveCapturePrefix: args => tx(() => resolveCapturePrefix({get,run},args)),
+    warmCapturePrefixes: () => tx(() => warmCapturePrefixes({get,run})),
     correlateSessions: args => tx(() => correlateSessions({get,all,run},args)),
     listEffects: args => tx(() => listEffects({get,all,run},args)),
     getEffect: args => tx(() => getEffect({get,all,run},args)),

package/server/work-meter.mjs

@@ -0,0 +1,84 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+
+// Only contract path words survive. Never record a caller's query, identity, body or SQL parameters.
+const WORDS = new Set('api v1 me health teams sessions messages search events catalogue machines heartbeat configuration roots sources captures parts commit uploads chunks members groups credentials permissions bindings agents publications attachments operations continuations sync-rules view-bindings exports audit storage work'.split(' '));
+export function workRoute(input) {
+  try { return new URL(input, 'http://local').pathname.split('/').map(part => !part || WORDS.has(part) ? part : ':id').join('/'); }
+  catch { return '/:invalid'; }
+}
+const rounded = value => Math.round(value * 1000) / 1000;
+
+/** Attribute synchronous SQLite work to its handler, rather than the invocation a timer happened to inherit. */
+export class WorkMeter {
+  constructor({ emit = record => console.log(JSON.stringify(record)), now = () => performance.now(), retainSlow = null, advanceClock = null, sqlTiming = true } = {}) {
+    this.now = now; this.advanceClock = advanceClock; this.sqlTiming = sqlTiming;
+    this.context = new AsyncLocalStorage(); this.recent = []; this.slow = [];
+    this.emit = record => {
+      emit(record);
+      if (!['teams_work', 'teams_sql_work'].includes(record.event)) return;
+      this.recent.push(record); if (this.recent.length > 64) this.recent.shift();
+      if ((record.elapsed_ms ?? 0) < 1000 && (record.rows_read ?? 0) + (record.rows_written ?? 0) < 5000) return;
+      this.slow.push(record); if (this.slow.length > 32) this.slow.shift();
+      try { retainSlow?.(this.slow); }
+      catch { emit({ event: 'teams_work_retention_failed', work_id: record.work_id ?? null }); }
+    };
+  }
+  restoreSlow(records) { if (Array.isArray(records)) this.slow = records.slice(-32); }
+  report() { return { clock: this.advanceClock ? 'elapsed milliseconds through an end-of-work timer boundary; SQL timing unavailable on the hosted Worker' : 'elapsed milliseconds; sql_ms measures synchronous SQL, not CPU', recent: this.recent.slice(), slow: this.slow.slice() }; }
+  async run(work, fn, detail = {}) {
+    const parent = this.context.getStore();
+    const record = { work, ...detail, work_id: crypto.randomUUID(), parent_work_id: parent?.work_id ?? null, started_at: new Date().toISOString(), started: this.now(), sql_ms: 0, sql_calls: 0, rows_read: 0, rows_written: 0, rows_known: true, returned_rows: 0, slowest_sql: null, most_rows_sql: null, finished: false };
+    this.emit({ event: 'teams_work_start', work, ...detail, work_id: record.work_id, parent_work_id: record.parent_work_id, started_at: record.started_at });
+    return this.context.run(record, async () => {
+      let outcome = 'ok';
+      try { return await fn(); }
+      catch (error) { outcome = 'error'; throw error; }
+      finally {
+        record.finished = true;
+        // Hosted Workers freeze clocks during CPU work. Yield once after the work, not once per SQL call.
+        // This reports elapsed time, including the timer's wait; it does not manufacture a CPU reading.
+        if (this.advanceClock) await this.advanceClock();
+        const { started, finished: _finished, rows_known, ...data } = record;
+        this.emit({ event: 'teams_work', ...data, slowest_sql: this.sqlTiming ? record.slowest_sql : null, rows_read: rows_known ? record.rows_read : null, rows_written: rows_known ? record.rows_written : null, elapsed_ms: rounded(this.now() - started), sql_ms: this.sqlTiming ? rounded(record.sql_ms) : null, outcome });
+        // Nested steps are separately named, and their SQL remains counted in the enclosing handler.
+        if (parent && !parent.finished) {
+          for (const field of ['sql_ms', 'sql_calls', 'rows_read', 'rows_written', 'returned_rows']) parent[field] += record[field];
+          parent.rows_known &&= record.rows_known;
+          if (record.slowest_sql && (!parent.slowest_sql || record.slowest_sql.elapsed_ms > parent.slowest_sql.elapsed_ms)) parent.slowest_sql = record.slowest_sql;
+          if (record.most_rows_sql && (!parent.most_rows_sql || record.most_rows_sql.rows_read + record.most_rows_sql.rows_written > parent.most_rows_sql.rows_read + parent.most_rows_sql.rows_written)) parent.most_rows_sql = record.most_rows_sql;
+        }
+      }
+    });
+  }
+  detail(values) {
+    const record = this.context.getStore();
+    if (record && !record.finished) Object.assign(record, values);
+  }
+  sql(query, fn) {
+    const record = this.context.getStore();
+    if (!record || record.finished) {
+      const start = this.now(); let result;
+      try { result = fn(); return result; }
+      finally {
+        const elapsed = this.now() - start;
+        if (elapsed >= 100 || (result?.rowsRead ?? 0) >= 5000) this.emit({ event: 'teams_sql_work', work: 'unscoped', origin_work: record?.work ?? null, fingerprint: createHash('sha256').update(query).digest('hex').slice(0, 16), elapsed_ms: this.sqlTiming ? rounded(elapsed) : null, rows_read: result?.rowsRead ?? null, rows_written: result?.rowsWritten ?? null, returned_rows: result?.returnedRows ?? null });
+      }
+    }
+    const start = this.now(); let result;
+    try { result = fn(); return result; }
+    finally {
+      const elapsed = this.now() - start;
+      record.sql_calls++; record.sql_ms += elapsed;
+      record.rows_known &&= Number.isFinite(result?.rowsRead) && Number.isFinite(result?.rowsWritten);
+      record.rows_read += result?.rowsRead ?? 0; record.rows_written += result?.rowsWritten ?? 0;
+      record.returned_rows += result?.returnedRows ?? 0;
+      if (!record.slowest_sql || elapsed > record.slowest_sql.elapsed_ms) {
+        record.slowest_sql = { fingerprint: createHash('sha256').update(query).digest('hex').slice(0, 16), operation: /^\s*(\w+)/.exec(query)?.[1]?.toUpperCase() ?? 'UNKNOWN', elapsed_ms: rounded(elapsed), rows_read: result?.rowsRead ?? null, rows_written: result?.rowsWritten ?? null, returned_rows: result?.returnedRows ?? null };
+      }
+      if (Number.isFinite(result?.rowsRead) && Number.isFinite(result?.rowsWritten) && (!record.most_rows_sql || result.rowsRead + result.rowsWritten > record.most_rows_sql.rows_read + record.most_rows_sql.rows_written)) {
+        record.most_rows_sql = { fingerprint: createHash('sha256').update(query).digest('hex').slice(0, 16), operation: /^\s*(\w+)/.exec(query)?.[1]?.toUpperCase() ?? 'UNKNOWN', rows_read: result.rowsRead, rows_written: result.rowsWritten, returned_rows: result?.returnedRows ?? null };
+      }
+    }
+  }
+}

package/worker/index.mjs

@@ -18,6 +18,7 @@ import { setOtlpSchemaSources } from '../server/otlp/transport.mjs';
 import { setViewerSources } from '@volter/teams/server/viewer';
 import { serveFetch } from './fetch-adapter.mjs';
 import { webSocketDuplex } from './websocket-duplex.mjs';
+import { WorkMeter, workRoute } from '../server/work-meter.mjs';
 // The hosted viewer's files, bundled as text (wrangler.toml rules) and served at /view.
 import viewerPage from '../../volter-teams/viewer/index.html';
 import viewerScript from '../../volter-teams/viewer/viewer.mjs';
@@ -56,34 +57,72 @@ const MAINTAIN_MS = 60_000;
 const BOOTSTRAP_TOKEN = /^sct_(cred_[0-9a-f]{32})\.[A-Za-z0-9_-]{16,}$/;
 
 /** SQLite primitives over the object's storage, in store-core's shape. */
-function durableSql(storage) {
+function durableSql(storage, meter) {
   const sql = storage.sql;
   const param = (value) => (value instanceof Uint8Array ? value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength) : value);
   const row = (value) => { for (const key of Object.keys(value)) if (value[key] instanceof ArrayBuffer) value[key] = Buffer.from(value[key]); return value; };
-  const all = (query, params = []) => sql.exec(query, ...params.map(param)).toArray().map(row);
+  const measured = (query, fn) => meter.sql(query, fn);
+  const all = (query, params = []) => measured(query, () => {
+    const cursor = sql.exec(query, ...params.map(param));
+    const values = cursor.toArray().map(row);
+    return { values, rowsRead: cursor.rowsRead, rowsWritten: cursor.rowsWritten, returnedRows: values.length };
+  }).values;
   const get = (query, params = []) => all(query, params)[0] ?? null;
-  const run = (query, params = []) => { sql.exec(query, ...params.map(param)); return { changes: sql.exec('SELECT changes() AS c').one().c }; };
+  const run = (query, params = []) => {
+    const counts = measured(query, () => {
+      const cursor = sql.exec(query, ...params.map(param));
+      return { rowsRead: cursor.rowsRead, rowsWritten: cursor.rowsWritten, returnedRows: 0 };
+    });
+    return { ...counts, changes: get('SELECT changes() AS c').c };
+  };
   const tx = (fn) => storage.transactionSync(fn);
-  return { all, get, run, tx, exec: (query) => sql.exec(query) };
+  return { all, get, run, tx, exec: (query) => { all(query); } };
 }
 
 export class TeamsServer extends DurableObject {
   constructor(ctx, env) {
     super(ctx, env);
-    this.ready = ctx.blockConcurrencyWhile(async () => {
+    this.nextMaintenanceAt = Date.now() + 5_000;
+    this.diagnosticPersistence = { interval_ms: 5_000, writes_since_activation: 0, last_saved_at: null, restored: false, restore_error: false };
+    this.work = new WorkMeter({ retainSlow: records => {
+      const now = Date.now(), state = this.diagnosticPersistence;
+      // Keep every slow record in memory, but never rewrite the persisted ring
+      // on each slow request. A reset can lose the most recent cooldown window.
+      if (state.last_saved_at != null && now - state.last_saved_at < state.interval_ms) return;
+      ctx.storage.kv.put('teams_work_slow_v1', JSON.stringify(records));
+      state.last_saved_at = now; state.writes_since_activation++;
+    }, advanceClock: () => scheduler.wait(0), sqlTiming: false });
+    this.ready = ctx.blockConcurrencyWhile(() => this.work.run('activation', async () => {
       // Read before migrations/maintenance: allocation failures must not hide
       // the table responsible, including hosts with a lower storage limit.
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
-      const db = durableSql(ctx.storage);
+      const db = durableSql(ctx.storage, this.work);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
+      const retained = ctx.storage.kv.get('teams_work_slow_v1');
+      if (retained) {
+        try {
+          const records = JSON.parse(retained);
+          if (!Array.isArray(records)) throw new Error('invalid diagnostic history');
+          this.work.restoreSlow(records); this.diagnosticPersistence.restored = true;
+        } catch {
+          this.diagnosticPersistence.restore_error = true;
+          console.warn('Teams diagnostic history could not be read; serving with an empty diagnostic history');
+        }
+      }
       this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null });
+      this.api.work = (name, fn, detail) => this.work.run(name, fn, detail);
+      this.api.workReport = () => ({ ...this.work.report(), persistence: { ...this.diagnosticPersistence } });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;
-        try { freeBytes = sql.exec('PRAGMA freelist_count').one().freelist_count * sql.exec('PRAGMA page_size').one().page_size; } catch { /* preserve an explicit unknown if the host omits these pragmas */ }
+        try { freeBytes = db.get('PRAGMA freelist_count').freelist_count * db.get('PRAGMA page_size').page_size; } catch { /* preserve an explicit unknown if the host omits these pragmas */ }
         return { allocated: sql.databaseSize, free_bytes: freeBytes, used: Math.max(0, sql.databaseSize - (freeBytes ?? 0)), used_is_upper_bound: freeBytes === null, limit: 10 * 1024 ** 3 };
       };
       this.api.attach({ store: new DirectStore(createStoreHandlers(db)), harnessRoutes });
+      this.api.scheduleCapturePrefixWork = async () => {
+        const soon = Date.now() + 100, armed = await ctx.storage.getAlarm();
+        if (armed == null || armed > soon) await ctx.storage.setAlarm(soon);
+      };
       const existing = await this.api.store.one("SELECT value FROM server_meta WHERE key='server_id'");
       if (existing) this.api.attach({ serverId: existing.value });
       else {
@@ -93,7 +132,16 @@ export class TeamsServer extends DurableObject {
           this.api.attach({ serverId: await bootstrapServer(this.api, { initTeam: env.INIT_TEAM, bootstrap: { server_id: ids.next('server'), team_id: ids.next('team'), principal_id: ids.next('user'), credential_id: match[1], token: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN } }) });
         }
       }
-      this.handler = createHttpHandler(this.api);
+      const handler = createHttpHandler(this.api);
+      this.handler = (req, res) => {
+        const pending = this.work.run('http', async () => {
+        const writeHead = res.writeHead;
+        res.writeHead = (...args) => { this.work.detail({ status: args[0], request_id: args[1]?.['X-Request-ID'] ?? null }); return writeHead.apply(res, args); };
+        return handler(req, res);
+        }, { method: req.method, route: workRoute(req.url) });
+        ctx.waitUntil(pending);
+        return pending;
+      };
       // Retention never runs here: an activation serves its first request as soon as the store is open, and a reset is
       // never followed by a pass that holds every request back (t_6c01c966). A capacity failure can exhaust an old
       // alarm's retries, and an exhausted alarm still reads its old time, already past, while it never fires again: so
@@ -101,13 +149,13 @@ export class TeamsServer extends DurableObject {
       const armed = await ctx.storage.getAlarm().catch(() => null);
       const now = Date.now(), soon = now + 5_000;
       if (armed == null || armed > soon || armed < now) await ctx.storage.setAlarm(soon).catch(error => console.error(`maintain alarm scheduling failed: ${error.message}`));
-    });
+    }));
   }
 
   async fetch(request) {
     await this.ready;
     if (!this.api.serverId) return Response.json({ version: 1, error: { code: 'unavailable', message: 'set the SUPERCODE_TEAMS_BOOTSTRAP_TOKEN secret (supercode teams server token) before first use' } }, { status: 503 });
-    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') return this.upgrade(request);
+    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') return this.work.run('websocket.upgrade', () => this.upgrade(request), { method: request.method, route: workRoute(request.url) });
     return serveFetch(this.handler, request, { remoteAddress: request.headers.get('cf-connecting-ip') });
   }
 
@@ -128,18 +176,31 @@ export class TeamsServer extends DurableObject {
 
   async alarm() {
     await this.ready;
-    const done = this.api.serverId ? await maintain(this.api).catch(error => { console.error(`maintain failed: ${error.message}`); return null; }) : null;
-    const usage = this.api.storageUsage();
-    if (usage.used >= usage.limit * 0.8) console.warn(`Teams storage pressure: ${JSON.stringify(usage)}; native upload admission stops at 90%`);
+    let prefixes = null;
+    if (this.api.serverId) prefixes = await this.work.run('capturePrefix', async () => {
+      const result = await this.api.store.call('warmCapturePrefixes');
+      this.work.detail({ prepared_messages: result.messages, prepared_bytes: result.bytes, backlog: result.backlog });
+      return result;
+    }).catch(error => { console.error(`capture prefix preparation failed: ${error.message}`); return { backlog: true }; });
+    let done = null;
+    if (this.api.serverId && Date.now() >= this.nextMaintenanceAt) {
+      done = await this.work.run('alarm', () => maintain(this.api)).catch(error => { console.error(`maintain failed: ${error.message}`); return null; });
+      this.nextMaintenanceAt = Date.now() + (done ? maintainDelay(this.api, done) : MAINTAIN_MS);
+      const usage = this.api.storageUsage();
+      if (usage.used >= usage.limit * 0.8) console.warn(`Teams storage pressure: ${JSON.stringify(usage)}; native upload admission stops at 90%`);
+    }
     // The database's size on every full pass, where `wrangler tail` reads it.
-    if (!done?.backlog) {
+    if (done && !done.backlog) {
       // What grows: free pages (space deletes left for reuse), and each busy table's newest rowid (its insert rate).
       const sql = this.ctx.storage.sql, one = (query) => { try { return [...sql.exec(query)][0] ?? {}; } catch { return {}; } };
       const tables = ['messages', 'capture_parts', 'captures', 'session_versions', 'idempotency', 'journal'].map((name) => `${name}=${one(`SELECT MAX(rowid) m FROM ${name}`).m ?? '-'}`).join(' ');
       console.log(`maintain: database ${(sql.databaseSize / 1048576).toFixed(1)} MB free_pages=${one('PRAGMA freelist_count').freelist_count ?? '-'} ${tables}`);
     }
     // A backlog (versions or parts left over) is worked again in seconds, not a minute.
-    await this.ctx.storage.setAlarm(Date.now() + (done ? maintainDelay(this.api, done) : MAINTAIN_MS));
+    // A prefix batch does not accelerate retention. The one alarm owns two
+    // separate deadlines, so warm-up never repeats maintenance every 100 ms.
+    const next = Math.max(1, this.nextMaintenanceAt - Date.now());
+    await this.ctx.storage.setAlarm(Date.now() + (prefixes?.backlog ? Math.min(100, next) : next));
   }
 }
 
@@ -156,6 +217,7 @@ const objectFailure = (error) => ({
 export default {
   async fetch(request, env) {
     const repeatable = request.method === 'GET' || request.method === 'HEAD';
+    const route = { method: request.method, route: workRoute(request.url) };
     const call = () => env.TEAMS_SERVER.get(env.TEAMS_SERVER.idFromName('server')).fetch(repeatable ? request.clone() : request);
     // A request safe to repeat (a read, or a link's WebSocket upgrade: every machine's connection) is tried once more
     // when the runtime says the failure is retryable and the object is not overloaded: a reset object (its code
@@ -166,10 +228,10 @@ export default {
     try { return await call(); }
     catch (error) {
       first = objectFailure(error);
-      if (!(repeatable && first.retryable && !first.overloaded)) return unavailable(first, null);
+      if (!(repeatable && first.retryable && !first.overloaded)) return unavailable(first, null, route);
     }
     try { return await call(); }
-    catch (error) { return unavailable(objectFailure(error), first); }
+    catch (error) { return unavailable(objectFailure(error), first, route); }
   },
 };
 
@@ -180,9 +242,9 @@ const PUBLIC_NAMES = new Set(['Error', 'TypeError', 'RangeError', 'ReferenceErro
 /** Failures before the HTTP handler (object initialization, migrations, storage, a reset) as our API contract, not a
  *  platform HTML page. The answer goes to callers not yet authenticated, so it names only the error's kind and the
  *  runtime's flags; its message (storage or SQL text, internal paths) is in the log line its request id leads to. */
-function unavailable(failure, retried) {
+function unavailable(failure, retried, route) {
   const requestId = crypto.randomUUID();
-  console.error(JSON.stringify({ event: 'teams_unavailable', request_id: requestId, failure, ...(retried ? { first: retried } : {}) }));
+  console.error(JSON.stringify({ event: 'teams_unavailable', request_id: requestId, ...route, failure, ...(retried ? { first: retried } : {}) }));
   const cause = `${PUBLIC_NAMES.has(failure.name) ? failure.name : 'Error'}${failure.reset ? ', object reset' : ''}${failure.overloaded ? ', overloaded' : ''}${retried ? ', after one retry' : ''}`;
-  return Response.json({ version: 1, error: { code: 'unavailable', message: `Teams server is temporarily unavailable (${cause})`, request_id: requestId, retryable: true, cause: { name: PUBLIC_NAMES.has(failure.name) ? failure.name : 'Error', retryable: failure.retryable, overloaded: failure.overloaded, remote: failure.remote, reset: failure.reset } } }, { status: 503, headers: { 'Retry-After': failure.overloaded ? '15' : '5', 'X-Request-ID': requestId } });
+  return Response.json({ version: 1, error: { code: 'unavailable', message: `Teams server is temporarily unavailable (${cause})`, request_id: requestId, ...route, retryable: true, cause: { name: PUBLIC_NAMES.has(failure.name) ? failure.name : 'Error', retryable: failure.retryable, overloaded: failure.overloaded, remote: failure.remote, reset: failure.reset } } }, { status: 503, headers: { 'Retry-After': failure.overloaded ? '15' : '5', 'X-Request-ID': requestId } });
 }