fix: repair chained imports and track blocked evidence dependencies

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-465c-7d43-8c4c-d10f0a1feadd

audit_core/sqlite_backend.py

@@ -220,7 +220,8 @@ class SQLiteAuditBackend:
         return [{"accepted_at": at, **json.loads(rec)} for rec, at in rows]
 
     def event_counts(
-        self, source: str, since: str, until: str, tenant: str | None = None
+        self, source: str, since: str, until: str, tenant: str | None = None,
+        *, stream_instance_id: str | None = None
     ) -> list[dict]:
         """Per-class counts for one source over a bounded window.
 
@@ -238,6 +239,10 @@ class SQLiteAuditBackend:
         if tenant is not None:
             sql += " AND tenant = ?"
             params += (tenant,)
+        if stream_instance_id is not None:
+            sql += " AND json_type(record, '$.details.data.stream_instance_id') = 'text'"
+            sql += " AND json_extract(record, '$.details.data.stream_instance_id') = ?"
+            params += (stream_instance_id,)
         sql += " GROUP BY action ORDER BY action"
         return [{"class": action, "count": count} for action, count in self._query(sql, params)]