@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-webhooks': patch
+---
+
+fix(plugin-webhooks): a webhook delivery the outbox could not record is now reported at `error`, once per webhook, with what was lost and how to fix it
+
+Clause-②: no
+
+- **What was wrong.** When the `sys_http_delivery` write for a webhook event failed, the auto-enqueuer logged one bare `WARN [webhook-auto-enqueuer] enqueue failed` line per event. The event was lost: it is never sent, retried or redeliverable, because no row exists. The record write that produced the event had already answered 200, and the webhook still read active in Setup, so nothing else looked wrong. On PostgreSQL every record-update delivery was lost this way.
+- **What changed.** The first lost delivery for a webhook is logged at `error`. The line names the webhook, says the event is lost and why nothing else shows it, and says where the cause is (the record's meta) and what to restore. Later lost events for the same webhook are logged at `debug`, each with its `eventId`. The `error` is said again only after a delivery for that webhook was recorded in between. A logger without `error` still receives the line at `warn`. Bulk (`data.records.*`) deliveries are reported the same way.
+- **Unchanged.** Successful deliveries, the delivery rows, the parked-subscription path and every export. This change does not fix the PostgreSQL loss itself: that cause is upstream of the webhook plugin and is fixed separately.
@@ -592,6 +592,120 @@ describe('AutoEnqueuer', () => {
     });
 });
 
+/**
+ * #24835 — a delivery the outbox could not record is a DURABILITY loss: the
+ * record write already answered 200 and the webhook still reads active, so it
+ * is reported at `error` (AGENTS.md "Degradation log levels"), said once per
+ * webhook, and re-armed by the next delivery recorded for that webhook. The
+ * measured cause was a payload `JSON.stringify` refused on PostgreSQL; any
+ * refused write takes the same path, so the fake throws that error.
+ */
+describe('AutoEnqueuer — a delivery that could not be recorded is reported at error (#24835)', () => {
+    type Line = { level: 'debug' | 'warn' | 'error'; msg: string; meta?: any };
+    function capturingLogger() {
+        const lines: Line[] = [];
+        const logger = {
+            info() {},
+            debug: (msg: string, meta?: unknown) => { lines.push({ level: 'debug', msg, meta }); },
+            warn: (msg: string, meta?: unknown) => { lines.push({ level: 'warn', msg, meta }); },
+            error: (msg: string, _err?: unknown, meta?: unknown) => { lines.push({ level: 'error', msg, meta }); },
+        };
+        // Only the lines about a lost event: they carry its `eventId`.
+        const about = (level: Line['level']) => lines.filter((l) => l.level === level && l.meta?.eventId);
+        return { logger, about };
+    }
+    const refused: HttpEnqueueFn = async () => {
+        throw new TypeError("Converting circular structure to JSON --> starting at object with constructor 'Timeout'");
+    };
+    const at = (s: number) => `2026-10-20T00:00:0${s}.000Z`;
+
+    it('reports the first lost delivery once at error, naming the webhook; later losses stay at debug', async () => {
+        const engine = new FakeEngine({ sys_webhook: [webhook({ name: 'contact_changed' })] });
+        const realtime = new FakeRealtime();
+        const { logger, about } = capturingLogger();
+        const ae = new AutoEnqueuer(engine, realtime, refused, { refreshIntervalMs: 0, logger });
+        await ae.start();
+
+        await realtime.publish(event('updated', 'contact', { id: 'c-1' }, at(1)));
+        await realtime.publish(event('updated', 'contact', { id: 'c-1' }, at(2)));
+        await flush();
+        await ae.stop();
+
+        const errors = about('error');
+        expect(errors).toHaveLength(1);
+        expect(errors[0].msg).toContain("'contact_changed'");
+        expect(errors[0].msg).toContain('sys_http_delivery');
+        expect(errors[0].meta).toMatchObject({ webhook: 'contact_changed', eventId: `contact:c-1:updated:${at(1)}` });
+        expect(String(errors[0].meta.err)).toContain('circular');
+        // The second loss is still on record, with its own event id — not a
+        // second error, and never the old bare warn.
+        expect(about('debug').map((l) => l.meta.eventId)).toEqual([`contact:c-1:updated:${at(2)}`]);
+        expect(about('warn')).toHaveLength(0);
+    });
+
+    it('says it once per webhook — one failing webhook does not silence another', async () => {
+        const engine = new FakeEngine({
+            sys_webhook: [webhook({ id: 'wh-a', name: 'hook_a' }), webhook({ id: 'wh-b', name: 'hook_b' })],
+        });
+        const realtime = new FakeRealtime();
+        const { logger, about } = capturingLogger();
+        const ae = new AutoEnqueuer(engine, realtime, refused, { refreshIntervalMs: 0, logger });
+        await ae.start();
+
+        await realtime.publish(event('created', 'contact', { id: 'c-1' }, at(1)));
+        await flush();
+        await ae.stop();
+
+        expect(about('error').map((l) => l.meta.webhook).sort()).toEqual(['hook_a', 'hook_b']);
+    });
+
+    it('is loud again once a delivery for the webhook was recorded in between', async () => {
+        const engine = new FakeEngine({ sys_webhook: [webhook({ name: 'contact_changed' })] });
+        const realtime = new FakeRealtime();
+        const { logger, about } = capturingLogger();
+        let broken = true;
+        const enqueue: HttpEnqueueFn = async (input) => {
+            if (broken) return refused(input);
+            return 'id';
+        };
+        const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0, logger });
+        await ae.start();
+
+        await realtime.publish(event('updated', 'contact', { id: 'c-1' }, at(1)));
+        await flush();
+        broken = false;
+        await realtime.publish(event('updated', 'contact', { id: 'c-1' }, at(2)));
+        await flush();
+        broken = true;
+        await realtime.publish(event('updated', 'contact', { id: 'c-1' }, at(3)));
+        await flush();
+        await ae.stop();
+
+        expect(about('error').map((l) => l.meta.eventId)).toEqual([
+            `contact:c-1:updated:${at(1)}`,
+            `contact:c-1:updated:${at(3)}`,
+        ]);
+        expect(about('debug')).toHaveLength(0);
+    });
+
+    it('reports a lost bulk delivery through the same register', async () => {
+        const engine = new FakeEngine({ sys_webhook: [webhook({ name: 'contact_bulk', triggers: 'bulk_update' })] });
+        const realtime = new FakeRealtime();
+        const { logger, about } = capturingLogger();
+        const ae = new AutoEnqueuer(engine, realtime, refused, { refreshIntervalMs: 0, logger });
+        await ae.start();
+
+        await realtime.publish(bulkEvent('updated', 'contact', 3, at(1)));
+        await flush();
+        await ae.stop();
+
+        const errors = about('error');
+        expect(errors).toHaveLength(1);
+        expect(errors[0].meta.webhook).toBe('contact_bulk');
+        expect(about('warn')).toHaveLength(0);
+    });
+});
+
 /**
  * #4639 — predicate writes dispatch under their OWN opt-in triggers.
  *
 
@@ -677,12 +677,23 @@ export class AutoEnqueuer {
      *
      * AGENTS.md decides that with one question — *does the system still look
      * normal from the outside while something it claims is persisted has not
-     * landed?* For a PARKED subscription the answer is unambiguously yes, and
-     * worse than for an ordinary enqueue failure: the durable record is the
+     * landed?* The answer is yes on BOTH branches, so both report at `error`.
+     *
+     * [#24835] The ordinary branch used to log a bare `warn` ("enqueue
+     * failed"), on the reading that the subscription is otherwise healthy. That
+     * reading is the problem: the record write that produced the event already
+     * answered 200, the webhook still reads active, and the `sys_http_delivery`
+     * row — the outbox's whole durability claim — was never written, so the
+     * event is never sent, retried or redeliverable, and nothing else looks
+     * wrong. Measured on PostgreSQL, where every update delivery was lost this
+     * way behind one WARN per event. It is said ONCE per webhook
+     * ({@link writeFailing}), with the consequence and the fix, and re-armed by
+     * the next recorded delivery for that webhook; each further lost event is
+     * kept at `debug` with its `eventId`.
+     *
+     * For a PARKED subscription it is worse still: the durable record is the
      * only trace this event ever existed, so losing the write puts us back
-     * exactly where this issue started, silently. So `error` there, and the
-     * pre-existing `warn` for an ordinary enqueue, where the delivery itself is
-     * the thing that did not happen and the subscription is otherwise healthy.
+     * exactly where #8069 started, silently.
      *
      * The realistic cause of the parked branch is a host that wired
      * {@link HttpEnqueueFn} straight to `IHttpOutbox.enqueue` instead of
@@ -699,7 +710,30 @@ export class AutoEnqueuer {
     ): void {
         const meta = { webhook: sub.name, eventId, err: (err as Error)?.message ?? err };
         if (!sub.parkedReason) {
-            this.logger?.warn?.(`[webhook-auto-enqueuer] ${verb} failed`, meta);
+            if (this.writeFailing.has(sub.id)) {
+                this.logger?.debug?.(
+                    `[webhook-auto-enqueuer] webhook '${sub.name}': ${verb} failed again — this event `
+                        + 'is lost too (reported at error on the first failure)',
+                    meta,
+                );
+                return;
+            }
+            this.writeFailing.add(sub.id);
+            const lost =
+                `[webhook-auto-enqueuer] webhook '${sub.name}': a delivery could not be recorded in `
+                + 'sys_http_delivery, so this event is LOST — it will never be sent, retried or '
+                + 'redelivered, and there is no row for an operator to find. The record write that '
+                + 'produced it already succeeded and the webhook still reads active, so nothing else '
+                + 'looks wrong. Fix: the cause in this record\'s meta says why the outbox write was '
+                + 'refused — make that write succeed (the datasource holding sys_http_delivery '
+                + 'reachable and its schema synced; a payload the outbox cannot store comes from the '
+                + 'event\'s producer, upstream of this webhook). Said once until a delivery for this '
+                + 'webhook is recorded again; each further lost event is logged at debug with its eventId.';
+            if (typeof this.logger?.error === 'function') {
+                this.logger?.error(lost, err, meta);
+            } else {
+                this.logger?.warn?.(lost, meta);
+            }
             return;
         }
         const message =
@@ -718,6 +752,20 @@ export class AutoEnqueuer {
         }
     }
 
+    /**
+     * [#24835] Webhook ids whose outbox write has failed and not yet succeeded
+     * again — the say-once ledger for {@link reportWriteFailure}'s ordinary
+     * branch, the enqueue twin of {@link droppedForSecret}: the loud first
+     * report is said once per outage, and said again if the same webhook breaks
+     * after a delivery for it was recorded.
+     */
+    private readonly writeFailing = new Set<string>();
+
+    /** [#24835] A delivery for `sub` was recorded — a later failure is a new outage. */
+    private recordedWrite(sub: CachedSubscription): void {
+        this.writeFailing.delete(sub.id);
+    }
+
     private park(sub: CachedSubscription, err: unknown, credential: DropReason): void {
         sub.secret = undefined;
         sub.headers = undefined;
@@ -1195,7 +1243,10 @@ export class AutoEnqueuer {
                     action,
                     timestamp: event.timestamp,
                 },
-            }).catch((err) => this.reportWriteFailure(sub, eventId, err, 'enqueue'));
+            }).then(
+                () => this.recordedWrite(sub),
+                (err) => this.reportWriteFailure(sub, eventId, err, 'enqueue'),
+            );
         }
     }
 
@@ -1333,7 +1384,10 @@ export class AutoEnqueuer {
                     action,
                     timestamp: event.timestamp,
                 },
-            }).catch((err) => this.reportWriteFailure(sub, eventId, err, 'bulk enqueue'));
+            }).then(
+                () => this.recordedWrite(sub),
+                (err) => this.reportWriteFailure(sub, eventId, err, 'bulk enqueue'),
+            );
         }
     }