context.v_kpi_compact_7d counts a failed-read sentinel as a real sample, splitting over-cap episodes

REPORTED (pm-llmmsgsrv-cc, SAVETOKE-33 audit-finding, measured on the live DB): context.v_kpi_compact_7d (schema.sql:397, served by kpi-web/server.mjs:163) does not filter sample_flag. zero_read is a failed-read sentinel - all 372 in 24h have ctx_tokens min=avg=max=0, against 60011..558454 on real samples - and it carries over_cap=0 unconditionally, so a failed read inside a sustained over-cap run breaks one gaps-and-islands run into two. Measured over 7d: 196 episodes reported, 190 with zero_read excluded, so 6 split artifacts and 3.1 percent inflation. Of 37 agent/session pairs, 21 carry zero_read and all 21 also carry over-cap. Proposed fix, one clause in the s CTE: AND coalesce(sample_flag,'') <> 'zero_read'. VERIFIED AT SOURCE ON WHEY: the s CTE at schema.sql:398-405 selects FROM context.samples with only a ts predicate, no sample_flag clause - the defect is real as described. TWO ADDITIONAL FINDINGS FROM THAT VERIFICATION, both in this lane. FIRST, SCHEMA DRIFT: sample_flag is declared NOWHERE in the tracked schema - not in the context.samples CREATE TABLE, not in any of the five context views, and the string does not appear anywhere in one-db/schema.sql or one-db/agent-telemetry/schema.sql. The column is added and written by context-monitor.sh v4.56/v4.57 (:3985, :4042), outside the tracked schema file. So the tracked schema no longer describes the live table, and the proposed one-clause fix cannot be applied to schema.sql until the column is also declared there. SECOND, THE PROPOSED FILTER IS NOT SUFFICIENT ON ITS OWN: context-monitor.sh v4.59 (:732) deliberately SPLIT the insert and the stamp into two legs, and the stamp leg can fail on its own - :4057 emits severity=degraded with the inserts already committed and sample_flag not updated (missing UPDATE grant is the named cause). Every zero-read row whose stamp leg failed keeps sample_flag NULL, passes coalesce(sample_flag,'') <> 'zero_read', and splits an episode exactly as before. ctx_tokens = 0 is the invariant the sentinel is derived FROM; sample_flag is a post-hoc stamp on a separate transaction. The filter should test the invariant, alone or in addition. NOT YET MEASURED, needs a venus-side read I cannot do from whey (no PG reach): how many rows have ctx_tokens = 0 AND sample_flag IS NULL. That count is the size of the residual after the proposed fix. Same class as ONEDB-17 one layer up: there the signal was missing entirely, here the flag is set correctly and the consumer ignores it - and per this item, the flag can also be silently absent.