events: outboxSchema indexes the rejected rows rejected() counts (0.99.0) (#137)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 5717d09..7d04cde 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,14 @@
  # Changelog
  
++## 0.99.0 (2026-11-08)
++
++- **`openvibe-sdk/events`: `outboxSchema()` indexes the rejected rows `rejected()` counts.** Every outbox made with the
++  helper now also gets `<table>_rejected` on `(rejected_at) WHERE rejected_at IS NOT NULL`. Before it, the count read
++  the whole outbox every time it was not cached (523 ms and 112 M buffers a day on Deals, 2026-11-08), because the
++  product had no index on `rejected_at`. A service that already has its outbox table must add the same statement in an
++  expand migration: the DDL is a migration helper, never run at boot, so `CREATE INDEX IF NOT EXISTS` in this helper
++  only reaches tables created after it.
++
  ## 0.98.1 (2026-11-07)
  
  - `ai.batches.cancel` says what cancelling does: only the prompts that never had a run are cancelled, and
ddiff --git a/README.md b/README.md
iindex 8382cf5..68ff108 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.98.1 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.99.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -11,7 +11,7 @@
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.98.1
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.99.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 1daa910..8162cef 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.98.1",
++  "version": "0.99.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 963a88c..d5ee618 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.98.1, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.99.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, modules, realtime, media, community, bot, search, bench, meme, vision, themes, redact, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -48,7 +48,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.98.1';
++const SDK_VERSION = '0.99.0';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex b855855..3526a01 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.98.1",
++  "version": "0.99.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.98.1",
++      "version": "0.99.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex f18c0ff..3569fd9 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.98.1",
++  "version": "0.99.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex dab6cf0..08c01e1 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.98.1';
++const SDK_VERSION = '0.99.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/outbox.js b/src/outbox.js
iindex 2903cd5..52dd2ec 100644
---- a/src/outbox.js
++++ b/src/outbox.js
@@@ -68,7 +68,8 @@ function outboxSchema(table = 'event_outbox') {
      last_error      text
  );
  CREATE INDEX IF NOT EXISTS ${table}_due ON ${table} (next_attempt_at, id) WHERE sent_at IS NULL AND rejected_at IS NULL;
--CREATE INDEX IF NOT EXISTS ${table}_sent ON ${table} (sent_at) WHERE sent_at IS NOT NULL;`;
++CREATE INDEX IF NOT EXISTS ${table}_sent ON ${table} (sent_at) WHERE sent_at IS NOT NULL;
++CREATE INDEX IF NOT EXISTS ${table}_rejected ON ${table} (rejected_at) WHERE rejected_at IS NOT NULL;`;
  }
  
  /** The inbox table's DDL, for a service migration. */
ddiff --git a/test/pg-outbox.test.js b/test/pg-outbox.test.js
iindex 518e16f..67df47f 100644
---- a/test/pg-outbox.test.js
++++ b/test/pg-outbox.test.js
@@@ -56,6 +56,17 @@ function cases(label, open) {
                  assert.equal(counts, 5, 'without countsCacheMs (and outside production) every call counts');
              } finally { await done(); }
          }],
++        [`${label}: the schema indexes the rejected rows rejected() counts`, async () => {
++            const { db, done } = await open();
++            try {
++                assert.match(outboxSchema('event_outbox'), /CREATE INDEX IF NOT EXISTS event_outbox_rejected ON event_outbox \(rejected_at\) WHERE rejected_at IS NOT NULL/);
++                await db.query(`INSERT INTO event_outbox (event_id, envelope, created_at, rejected_at) VALUES
++                    ('evt_rejected', '{}'::jsonb, 1, 2), ('evt_live', '{}'::jsonb, 1, NULL)`);
++                await db.query('SET enable_seqscan = off');
++                const plan = (await db.many('EXPLAIN SELECT count(*) FROM event_outbox WHERE rejected_at IS NOT NULL')).map((r) => Object.values(r)[0]).join('\n');
++                assert.match(plan, /event_outbox_rejected/, 'the rejected count is an index-only scan of the partial index');
++            } finally { await done(); }
++        }],
          [`${label}: a kick() from inside a transaction never hands the relay that transaction`, async () => {
              const { db, done } = await open();
              try {