Upstream's status surface has segments and collections views; Stream had neither, so an operator watching a backfill had no way to see what the archive actually contained. Both render from metadata the manifest already holds resident. Segments comes straight off the sealed summaries; collections folds each segment's resident collection index into one table. Neither opens a segment file, so a request costs a walk over sealed segments rather than anything proportional to archive size -- the same bounded-cost rule the host view follows. DID-level marker sentinels are excluded: they carry no real collection and would read as one. The archive contract cross-checks every segment row against listSegments so the view cannot drift into a second source of truth, and asserts no sentinel leaks. The status contract covers the empty archive, where the views must say so plainly rather than render a blank table that looks like a healthy zero. zig build test (304), ReleaseSafe, differential-oracle, archive-contract, status-contract. Audit: status summary/collections/segments blocked -> partial; the summary's own shape and the unsurfaced timing fields are named as what remains. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>