Chronicle SQL: Cloud query source has 78% failure rate

[digitarald]

Problem

The cloud source for chronicle SQL queries fails ~78% of the time. Very few devices have ever successfully queried cloud.

Error breakdown:

• empty_result — most common: query runs but returns nothing
• HTTP 404 — session not found on server
• DuckDB Binder Errors — same schema hallucination as local (Chronicle SQL: LLM hallucinates schema — 97% of query errors are wrong column/table names #317355)

Root Cause

Sessions either haven't been synced yet, have expired server-side, or the cloud API can't find them by the IDs being queried. The LLM may also be constructing queries for sessions that only exist locally.

Fix

1. Pre-validate that a session exists in cloud before routing the query there
2. Return a clear session_not_synced error (not generic 404) so the tool can fall back to local
3. Investigate why empty_result is so common — are the queries valid but the data missing?

Telemetry

Event: chronicle.sqlQuery with source=cloud, errors empty_result and HTTP 404

[vijayupadya]

Root cause for query failures is policy_blocked. This is expected for those cases empty_result will be returned.