Durable local history

Bridge keeps correctness-critical state—session entries and heads, worker leases and queues, approvals, usage, and the outbox—in bridge.db. This is durable local history, not a tamper-proof or replicated evidence ledger.

Provider telemetry uses a separate bridge-telemetry.db. Normalized spans are batched only after their semantic transactions commit, so a telemetry writer lock or failure cannot delay, roll back, or relabel correctness-critical state.

Shortly after startup and every 15 minutes, Bridge exports a transactionally consistent SQLite snapshot under history-snapshots/. The export runs on a maintenance thread, never on the boot path: VACUUM INTO and the checksum grow with total history, and the daemon must be reachable before either starts. A boot export is skipped when the newest snapshot is younger than the 15-minute cadence. Each export has a versioned manifest containing its filename, creation time, and SHA-256 checksum. Verification recomputes the checksum so disk corruption or accidental modification is visible. These local snapshots reduce single-file loss risk; copying the snapshot directory to another device remains the user's backup boundary.

An export writes its database and manifest under dotted .bridge-history-* pending names and publishes them with two adjacent renames, so the only state a crash can leave is a database with no manifest. Retention runs after every export and after every skipped boot export. It keeps the newest 4 snapshots, then the newest snapshot from each of the 7 most recent earlier days, under a 2 GiB ceiling: once a pair would cross the ceiling nothing older is kept, so the budget never trades a newer recovery point for older, smaller ones. The newest pair always survives; when it alone exceeds the budget the breach is logged rather than acted on. Pending files and manifest-less databases older than one hour are reclaimed. Files retention cannot positively identify as Bridge debris are never touched: a snapshot whose manifest this version cannot read, or any file another tool left in the directory, stays where it is. Every retention pass that deletes, skips an undeletable file, or finds the retained set over budget logs a bridge: history snapshot retention line with its counters.