Events are accepted but do not appear

Symptoms

The producer received a successful HTTP exchange, but a hunt has no matching event or detection.

Likely causes

The reply was not a full durable ACK; the event writer is behind; the query uses the wrong tenant/time range; the record was quarantined; or the event simply does not match a rule. Inventory uses a separate route/store.

Diagnosis

Confirm ACK fields and count. Check gateway batch_admitted, event-writer logs and committed lag, migration status, and quarantine metrics. Compare event time with the half-open query window. Confirm the query certificate organizations include the stamped tenant.

Resolution

Restore the failing broker/store boundary, resolve a permanent-record refusal, or correct the query scope/window. Preserve producer IDs and timestamps when retrying. Do not advance consumer offsets to hide a growing backlog.

Verification

A known development probe event is durably acknowledged and then queryable in its intended tenant. Evaluate detection separately against the actual active ruleset.

Continue with health and metrics and failure semantics.

Source evidence

Reviewed against the source baseline. Seagull-backend-v2/internal/ingest/http.go · Seagull-backend-v2/internal/broker/consumer.go · Seagull-backend-v2/internal/hunt/scope.go.