@@ -138,7 +138,7 @@
     "packages/daemon/src/server/upload-http.ts#handleUploadPreflight": "sha256:6d850c477241295d0e8d7e9da3c0dd6abc6f8ea436d52674c3e2ebd77b43f711",
     "packages/daemon/src/server/upload-http.ts#readUploadFinalizeBody": "sha256:076298afa73d7e498a964b6c48d823de1cc8b15e9e971d0a22b7e6c3fd98d685",
     "packages/daemon/src/server/upload-http.ts#readUploadPreflightBody": "sha256:2e56302178b75d9a6f5424f01dfc46551dca2056ba06a43e48ae09ec528956b6",
-    "packages/daemon/src/server/upload-http.ts#resolveHttpRequestBaseUrl": "sha256:0d06968c7577c421573281bc574485dc964e98f484afd1dc022fbba24d1face3",
+    "packages/daemon/src/server/upload-http.ts#resolveHttpRequestBaseUrl": "sha256:3c8f0835eda833c06a4d14a7e0b5036d6b9fa3c1216d84d033f11a4fa0f93c0b",
     "packages/daemon/src/server/upload-http.ts#resolveUploadHttpRoute": "sha256:8837e62933cf57111a8070454877c5859aed65b4dcdba755f145346e30f82835",
     "packages/daemon/src/server/upload-http.ts#sendJson": "sha256:c2317b4b14a10731684c9160038005965856150f05f8923765a3fa833d2ecae9",
     "packages/daemon/src/server/upload-http.ts#sendUploadedArtifactResponse": "sha256:9e418403448d58a96284fed605762fa71f9349bf2c70ad79df69b2b3e27487d6",
@@ -510,6 +510,11 @@
       "declaration": "packages/daemon/src/server/http/http-rpc-methods.ts#toInstallFromSourceDaemonRequest",
       "digest": "sha256:071c53e7bd8e553cb9df820961294ed4d1e2e385053485364d895cb1777e9429",
       "rationale": "Implementation-only validation repair: a supplied retentionMs is validated before request projection instead of silently dropping fractions or malformed values. Existing integer values in the supported 1..2147483647 range and omitted values keep their request projection, defaults, payload fields and response framing. Unsupported durations now fail clearly with the existing INVALID_ARGS envelope; released clients can parse that normal command error. No route, authentication, method or wire field changes; no protocol bump under ADR 0006."
+    },
+    {
+      "declaration": "packages/daemon/src/server/upload-http.ts#resolveHttpRequestBaseUrl",
+      "digest": "sha256:3c8f0835eda833c06a4d14a7e0b5036d6b9fa3c1216d84d033f11a4fa0f93c0b",
+      "rationale": "#4419 constrains forwarded protocol metadata to http/https before constructing the credentialed upload origin. Valid existing http/https forwarding and the request host/port retain their contracts; comma-separated forwarding uses its first value, and unsupported or URL-shaped values cannot replace the authority. Released clients still parse the same upload ticket fields, credential headers and HTTP(S) URL, with unchanged routes and response shapes. No new field is required and no supported peer payload is removed or reinterpreted; this is an implementation security correction under ADR 0006, not a protocol change."
     }
   ]
 }