Flow storage as windows plus totals, peers resolved at ingest, bounded retention, and the query shapes the schema serves

(PR #10, M3.2 operator read model). Decision 4 gains the groupings the operator surface's rollup endpoint serves and the cursor-paged form of the windows list, as additive detail: four named groupings over the same windows and the same indexes, each one hand-written statement chosen by name, never assembled; a rollup bounded to a documented group cap that returns the top groups in its order with the totals and group count of the whole and a marker when truncated; and pages keyed by (window start, row id) so a window landing between pages neither repeats nor hides a row. The peer in every read is the one stored at ingest (decision 2); the read model looks up only the current display name of the stored identity. No schema or index changes; the core decision stands.

(PR #17, M3.7 simulation review). Decision 4's operator-surface groupings gain a fifth, by resolved peer and service with the distinct workload count per group: the shape (b) already names, served on the rollup endpoint as group_by=peer,service with workload_count on each group, as its own named statement over the same windows and indexes. The simulation review's rows, matrix, and recency ordering are keyed by peer and service; the four groupings could produce them only by assembling rows client-side, which ADR-0007 as amended rules out. Additive detail; no schema or index changes; the core decision stands.

(PR #19, M3.8 policy editor). Decision 4's grouping by matched rule gains the distinct workload count per group, workload_count on the rollup endpoint, in the shape the fifth grouping carries it: the policy editor states each rule's hit counters with the number of workloads in scope that reported them, and no grouping could give that number without assembling it client-side, which ADR-0007 as amended rules out. The same statement over the same windows and indexes gains one aggregate; the set of groupings stays closed at five. Additive detail; no schema or index changes; the core decision stands.

(PR #22, flow-collection gaps). Evidence gaps join the schema, the pipeline, and the reads, as additive detail. Decision 1 gains flow_gaps beside the windows and totals: intervals in which a workload's evidence is known to be incomplete, stored once per reported interval, with region_id reserved and the workload taken from the credential. Decision 3's retention deletes gaps that ended before the horizon in the same locked batches, so gaps outlive every window they describe. Decision 4 gains the gaps read, one named statement over a workload set and a half-open range, which is not a grouping; the set of groupings stays closed at five. Decision 5's buffer records every drop as a gap as well as counting it, so the one loss model covers the buffer and the sources alike. A range whose evidence has a gap in it is not complete evidence, and the readers that draw a verdict from flows say so (ADR-0001). The windows and totals, their indexes, and the core decision stand.

(PR #23, conformance-audit absorption). Decision 5 gains a bound on the open window, as additive detail: the aggregator holds at most a configured number of distinct keys (--flow-window-keys, the closed buffer's 50,000 by default), drops an observation for a new key past it while still folding observations for keys it holds, and records the loss as a fifth gap kind, window_overflow, from the first drop to the window's close with the count of observations dropped. flow_gaps admits the fifth kind (migration 00009). The pipeline was bounded only after a window closed; an audit showed the open window growing with every distinct key. The core decision stands.

(PR #36, flow map label scope). Decision 4's operator-surface groupings gain a choice of endpoint for their workload set, as additive detail: by default the set selects the records its workloads reported, the traffic that reached them; asked for either endpoint (endpoint=either on the rollup endpoint, --endpoint either on innerwall flows rollup --group-by), it also selects the records whose source resolved at ingest to a workload in the set, a record with both ends in it counted once. A label scope on the flow map selected only destinations, so a workload that only sends traffic drew an empty map; the map now asks for either endpoint, while the simulation review, the policy editor's hit counters, and a workload's own reads keep the destination, because they answer what reached the workloads in scope. The source is matched by the identity stored at ingest (decision 2) against the scope's current membership, resolved at read time as before. Each grouping stays one named statement over the same windows; no schema or index changes; the core decision stands.

(PR #90, a backwards clock step mid-window). Decision 5 gains two rules for the agent's side, as additive detail. The collector measures each window on the monotonic clock beside the wall clock, and a window whose wall-clock length falls short of its monotonic length by more than slewing explains (a second plus 500 parts per million) is cut at the step: it ends at its start plus its monotonic length, its records' instants are held within its bounds, and the next window opens on the stepped clock. Nothing observed is lost, so a cut records no gap. Stamping the end from the stepped clock produced a window ending before it started, which the control plane refuses (issue #86). The reporter drops a window the control plane refuses as malformed instead of requeueing it, and records the loss as a sixth gap kind, window_rejected, over the window's bounds with its records as the count; flow_gaps admits the sixth kind (migration 00011). Requeued as the oldest window, a refused window was resent and refused indefinitely, holding every later window behind it. Every other failure is still requeued and retried with backoff. The core decision stands.

(PR #95, a removed owned table, issue #64). Decision 5 gains a seventh gap kind, table_removed, as additive detail. The local kill switch deletes the owned table, and the observation that depends on it and the classification its connection marks carry go with it; the agent then shipped empty windows and nothing qualified them, so a kill-switched host read as a quiet one with no evidence gaps. Every heartbeat now reads whether the table is present (ADR-0015 as amended); the first that finds it gone opens a gap from the last instant the table was known present, the next apply or restart that reinstalls it closes the gap, and while it is open each closing window cuts the gap at its own end and carries the piece, so the loss reaches the control plane while it lasts rather than when it ends. A source's restart interval is still shipped whole, since it ends within the restart backoff. flow_gaps admits the seventh kind (migration 00012). The core decision stands.

(PR #95, telemetry liveness, issue #61). Ingest gains one write beside decision 2's resolution, as additive detail: the instant the control plane received each report is stamped on its workload in Postgres (ADR-0017), before the window is validated and never moved backwards, so a report refused for its bounds still counts. The sync stream and the telemetry connection back off independently (ADR-0002, decision 5), and during a control-plane restart the console called a workload Offline, with a counter that read the sync path's last contact, while its windows kept landing every minute. The read model judges a workload's telemetry live while a report arrived within two flow windows of the read, against the same configured window ingest judges skew by, and the console names an offline stream with live telemetry as reconnecting and otherwise counts from the latest contact on either channel. The write is one row update per report. The windows, totals, gaps, and the core decision stand.

(PR #125, a silent agent, issue #114). The gaps gain an eighth kind, agent_silent, the one kind the control plane derives itself, as additive detail to decisions 1 and 2's ingest write. An agent process that is down leaves the owned table enforcing (ADR-0011) but observes nothing, and no gap said so: the agent cannot report its own absence, and ADR-0011 keeps its on-disk state to the persisted policy, so there is no recorded instant for a new process to reopen a gap from. The control plane is the party that saw the silence. Flow ingest already stamps every report's receipt on the workload (the 2026-10-13 liveness amendment); the stamping statement now returns, under a row lock, the receipt it replaces, so of two concurrent reports exactly one sees each silence. A report that ends a silence longer than two flow windows — the same allowance after which the read model stops calling the telemetry live, pinned by test — writes one gap: from the previous receipt, the last instant evidence is known to have reached the control plane, to the arriving window's start when that lies within the silence (a restarted agent opens its first window at process start), and to this report's receipt when the report carries no usable window start. A window that reaches back to or before the previous receipt is buffered evidence delivered late, not evidence lost, and derives nothing — so a telemetry-connection outage the agent rode out and a quick agent restart record no gap, and what an overflowed buffer dropped stays the agent's own buffer_overflow gap, never stored twice under two kinds. The sync stream's lifecycle is not a bound: an agent can outlive its last report and then die with buffered windows, so instants the stream was alive past the last report are not instants whose evidence survived. The kind is not one source's loss and counts nothing; a reported gap claiming it is refused at ingest. The write goes through the same store interface (one WriteGaps beside the window write), rides the same key, reads, and retention, and flow_gaps admits the eighth kind (migration 00015). An outage still running has no row; the liveness marker carries it until it ends. The core decision stands.

(a quiet workload, issue #144). The 2026-10-16 derivation gains one exception, as a correction of a subsidiary point: no agent_silent gap is derived for a silence one agent process demonstrably ran through. The agent ships only windows that hold something, so a running agent on a workload that receives little goes many windows between reports having lost nothing, and the derivation read every such stretch as an absent agent. Every heartbeat carries the agent process's uptime on its monotonic clock; heartbeat ingest records the heartbeat's receipt and that receipt minus the uptime, the process start on the control plane's clock, together and from heartbeats alone (migration 00016), and the receipt statement reads the pair under its row lock. When the process started at or before the previous receipt and its heartbeat arrived within one flow window of the arriving report, the process that ran at the previous report is the one sending this one — the arriving window was open a window length before it was sent, and two of one agent's processes never overlap — so no restart lies in the silence and whatever that process lost it reports itself. Otherwise the derivation and its bounds stand unchanged: a restarted process's start lies after the silence began, a dead process's last heartbeat is older than a window before the restarted one's first report, and a sync stream that is down leaves no recent heartbeat. This is the process's lifetime, not the sync stream's: the earlier point that the stream's lifecycle is no bound stands, and an agent that dies with buffered windows still opens its gap at the last receipt. Rows the earlier rule wrote for quiet stretches are left to retention, since nothing stored distinguishes them from an outage. The core decision stands.