Everything we store about this account, measured

Every field we hold, what it is for, how long it survives, and who else necessarily sees it — and, for the fields with a retention window, whether the oldest surviving row actually agrees with the window we advertise. A policy is a sentence; this is a measurement, and a purge that has been failing shows up here as retention_not_honoured.

The ledger behind it cannot drift: every column of every table we wrote is described in code, and a migration that adds a column fails our build until someone classifies it.

Counts and date ranges, never contents. How many tickets and how old, not the tickets — a transparency endpoint must not become a one-call way to read the account back. Identity fields return presence plus a redacted shape; secrets are named and never rendered.

AI activity is declared separately. Detailed own-account activity counts and retention measurement additionally require the explicit activity-read capability on a current non-legacy owner root key. Other REST keys without that grant and hosted MCP receive the declaration without activity metrics. A deliberately granted root REST key may be used by any client, including local MCP; its holder receives the authorized metrics. Authorized metrics are excluded from generic response logging.

Scope read: the account reading itself.