@dbos-inc/dbos-sdk 4.26.3-preview → 4.26.5-preview

package/dist/src/system_database.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SystemDatabase = exports.ensureSystemDatabase = exports.grantDbosSchemaPermissions = exports.getDbosSchemaPermissionsSql = exports.DEFAULT_NOTIFICATION_COALESCE_MS = exports.DBOS_STREAMS_CHANNEL = exports.DBOS_WORKFLOW_EVENTS_CHANNEL = exports.DBOS_NOTIFICATIONS_CHANNEL = exports.DBOS_STREAM_CLOSED_SENTINEL = exports.DEFAULT_POOL_SIZE = exports.DBOS_FUNCNAME_CLOSESTREAM = exports.DBOS_FUNCNAME_WRITESTREAM = exports.DBOS_FUNCNAME_GETSTATUS = exports.DBOS_FUNCNAME_SLEEP = exports.DBOS_FUNCNAME_GETEVENT = exports.DBOS_FUNCNAME_SETEVENT = exports.DBOS_FUNCNAME_RECV = exports.DBOS_FUNCNAME_SEND = void 0;
+exports.SystemDatabase = exports.ensureSystemDatabase = exports.grantDbosSchemaPermissions = exports.getDbosSchemaPermissionsSql = exports.DEFAULT_RENAME_BATCH_SIZE = exports.DEFAULT_NOTIFICATION_COALESCE_MS = exports.DBOS_STREAMS_CHANNEL = exports.DBOS_WORKFLOW_EVENTS_CHANNEL = exports.DBOS_NOTIFICATIONS_CHANNEL = exports.DBOS_STREAM_CLOSED_SENTINEL = exports.DEFAULT_POOL_SIZE = exports.DBOS_FUNCNAME_CLOSESTREAM = exports.DBOS_FUNCNAME_WRITESTREAM = exports.DBOS_FUNCNAME_GETSTATUS = exports.DBOS_FUNCNAME_SLEEP = exports.DBOS_FUNCNAME_GETEVENT = exports.DBOS_FUNCNAME_SETEVENT = exports.DBOS_FUNCNAME_RECV = exports.DBOS_FUNCNAME_SEND = void 0;
 const dbos_executor_1 = require("./dbos-executor");
 const pg_1 = require("pg");
 const error_1 = require("./error");
@@ -38,6 +38,8 @@ exports.DBOS_WORKFLOW_EVENTS_CHANNEL = 'dbos_workflow_events_channel';
 exports.DBOS_STREAMS_CHANNEL = 'dbos_streams_channel';
 // Interval for coalescing LISTEN/NOTIFY notifications off the write path; caps the rate of notifying commits regardless of write throughput.
 exports.DEFAULT_NOTIFICATION_COALESCE_MS = 10;
+// Workflows re-owned per transaction by a rename. Matches the GC default.
+exports.DEFAULT_RENAME_BATCH_SIZE = 10_000;
 const QUEUE_COLUMN_BY_FIELD = {
     concurrency: 'concurrency',
     workerConcurrency: 'worker_concurrency',
@@ -47,6 +49,7 @@ const QUEUE_COLUMN_BY_FIELD = {
     partitionQueue: 'partition_queue',
     pollingIntervalSec: 'polling_interval_sec',
 };
+const QUEUE_COLUMNS = 'name, concurrency, worker_concurrency, rate_limit_max, rate_limit_period_sec, priority_enabled, partition_queue, polling_interval_sec, application_name';
 function queueRecordFromRow(row) {
     return {
         name: row.name,
@@ -57,6 +60,7 @@ function queueRecordFromRow(row) {
         priorityEnabled: row.priority_enabled,
         partitionQueue: row.partition_queue,
         pollingIntervalSec: row.polling_interval_sec,
+        applicationName: row.application_name ?? undefined,
     };
 }
 /** The statements granting permissions on all entities in the system schema to a role. */
@@ -172,6 +176,32 @@ class NotificationMap {
         }
     }
 }
+function mapVersionInfo(row) {
+    return {
+        versionId: row.version_id,
+        versionName: row.version_name,
+        versionTimestamp: Number(row.version_timestamp),
+        createdAt: Number(row.created_at),
+        applicationName: row.application_name ?? undefined,
+    };
+}
+const SCHEDULE_COLUMNS = 'schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name, application_name';
+function mapWorkflowSchedule(row) {
+    return {
+        scheduleId: row.schedule_id,
+        scheduleName: row.schedule_name,
+        workflowName: row.workflow_name,
+        workflowClassName: row.workflow_class_name,
+        schedule: row.schedule,
+        status: row.status,
+        context: row.context,
+        lastFiredAt: row.last_fired_at ?? null,
+        automaticBackfill: !!row.automatic_backfill,
+        cronTimezone: row.cron_timezone ?? null,
+        queueName: row.queue_name ?? null,
+        applicationName: row.application_name ?? undefined,
+    };
+}
 function mapWorkflowStatus(row) {
     return {
         workflowUUID: row.workflow_uuid,
@@ -209,6 +239,7 @@ function mapWorkflowStatus(row) {
         scheduleName: row.schedule_name ?? undefined,
         debounceDeadlineEpochMS: row.debounce_deadline_epoch_ms ? Number(row.debounce_deadline_epoch_ms) : undefined,
         isDebounced: row.is_debounced ?? false,
+        applicationName: row.application_name ?? undefined,
     };
 }
 // SQLSTATE classes/codes that are generally safe to retry
@@ -364,6 +395,7 @@ class SystemDatabase {
     systemDatabaseUrl;
     logger;
     serializer;
+    appName;
     // ==================== Lifecycle ====================
     pool;
     schemaName;
@@ -411,10 +443,13 @@ class SystemDatabase {
     runningWorkflowMap = new Map(); // Map from workflowID to workflow promise, queue name and partition key
     // Per-partition-key created_at cursors: keep per-key queue order monotonic across batches
     #batchCreatedAtCursors = new Map();
-    constructor(systemDatabaseUrl, logger, serializer, sysDbPoolSize = exports.DEFAULT_POOL_SIZE, systemDatabasePool, schemaName = 'dbos', useListenNotify = true, pollingConcurrency, notificationCoalesceMs = exports.DEFAULT_NOTIFICATION_COALESCE_MS) {
+    constructor(systemDatabaseUrl, logger, serializer, sysDbPoolSize = exports.DEFAULT_POOL_SIZE, systemDatabasePool, schemaName = 'dbos', useListenNotify = true, pollingConcurrency, notificationCoalesceMs = exports.DEFAULT_NOTIFICATION_COALESCE_MS, 
+    // The application this handle acts for; undefined writes unclaimed rows.
+    appName) {
         this.systemDatabaseUrl = systemDatabaseUrl;
         this.logger = logger;
         this.serializer = serializer;
+        this.appName = appName;
         this.schemaName = schemaName;
         this.shouldUseDBNotifications = useListenNotify;
         this.notificationCoalesceMs = notificationCoalesceMs;
@@ -448,6 +483,60 @@ class SystemDatabase {
     getSerializer() {
         return this.serializer;
     }
+    // ==================== Application Ownership ====================
+    /**
+     * A predicate matching rows owned by these applications plus unclaimed ones, which belong to
+     * every application; unset or empty matches everything. Appends its bind parameter to `params`.
+     */
+    #appNameFilter(column, value, params) {
+        // An empty name is no name: it is not a value any application could be configured with.
+        const names = !value ? [] : Array.isArray(value) ? value : [value];
+        if (names.length === 0)
+            return 'TRUE';
+        params.push(names);
+        return `(${column} = ANY($${params.length}) OR ${column} IS NULL)`;
+    }
+    /**
+     * The filter above defaulted to this handle's own application: an unset filter scopes to what
+     * this application owns, not to every application's rows. A handle with no application of its
+     * own still matches every one.
+     */
+    #observabilityFilter(column, value, params) {
+        return this.#appNameFilter(column, value ?? this.appName, params);
+    }
+    /**
+     * The version name a dequeue treats as latest: this application's own plus unclaimed
+     * ones, so a named peer's deploy does not demote this one.
+     */
+    async #latestApplicationVersionName(client) {
+        const params = [];
+        const scope = this.#appNameFilter('application_name', this.appName, params);
+        const { rows } = await client.query(`SELECT version_name
+         FROM "${this.schemaName}".application_versions
+        WHERE ${scope}
+        ORDER BY version_timestamp DESC LIMIT 1`, params);
+        return rows[0]?.version_name;
+    }
+    /**
+     * The owner to persist when writing a row that may already exist. A nameless writer
+     * leaves the owner intact; a named one collides only with a different name.
+     */
+    async #resolveRowOwner(client, table, keyColumn, name, owner, kind) {
+        const { rows } = await client.query(`SELECT application_name FROM "${this.schemaName}".${table} WHERE ${keyColumn} = $1`, [name]);
+        const current = rows[0]?.application_name ?? null;
+        if (current === null)
+            return owner;
+        if (owner === undefined || current === owner)
+            return current;
+        // A version name is computed or pinned, so "pick another" is config advice, not a rename.
+        const takeANewName = kind === 'Application version'
+            ? `set a distinct applicationVersion for '${owner}'`
+            : `give '${owner}' a different ${kind.toLowerCase()} name`;
+        throw new error_1.DBOSError(`${kind} '${name}' is already registered by application '${current}' in this system database. ` +
+            `${kind} names must be unique across applications sharing a system database. ` +
+            `Either ${takeANewName}, or, if '${current}' was renamed to '${owner}', ` +
+            `re-own its rows first with dbos rename-application`);
+    }
     async init() {
         await ensureSystemDatabase(this.systemDatabaseUrl, this.logger, this.customPool ? this.pool : undefined, this.schemaName, this.shouldUseDBNotifications);
         if (this.shouldUseDBNotifications) {
@@ -458,8 +547,11 @@ class SystemDatabase {
         }
     }
     async destroy() {
+        // Set synchronously, before any await, so no reconnect is scheduled or published after this point.
+        this.#notificationsStopped = true;
         if (this.reconnectTimeout) {
             clearTimeout(this.reconnectTimeout);
+            this.reconnectTimeout = null;
         }
         // Stop the notifier and await its final flush before the pool closes.
         this.#notifierActive = false;
@@ -469,12 +561,7 @@ class SystemDatabase {
             this.#notifierLoop = undefined;
         }
         if (this.notificationsClient) {
-            try {
-                this.notificationsClient.release(true);
-            }
-            catch (e) {
-                this.logger.warn(`Error ending notifications client: ${String(e)}`);
-            }
+            this.#retireNotificationsClient(this.notificationsClient);
         }
         await this.pool.end();
     }
@@ -658,6 +745,7 @@ class SystemDatabase {
             'delay_until_epoch_ms',
             'attributes',
             'schedule_name',
+            'application_name',
         ];
         const client = await this.pool.connect();
         try {
@@ -675,7 +763,7 @@ class SystemDatabase {
                     tuples.push(`(${columns.map(() => `$${paramIdx++}`).join(', ')})`);
                     params.push(status.workflowUUID, status.status, status.workflowName, 
                     // For cross-language compatibility, these MUST be NULL in the database when not set
-                    status.workflowClassName === '' ? null : status.workflowClassName, status.workflowConfigName === '' ? null : status.workflowConfigName, status.queueName ?? null, status.authenticatedUser, status.assumedRole, JSON.stringify(status.authenticatedRoles), JSON.stringify(status.request), status.executorId, status.applicationVersion ?? null, status.applicationID, createdAt, 0, createdAt, status.timeoutMS ?? null, status.deadlineEpochMS ?? null, status.input, null, status.priority, status.queuePartitionKey ?? null, status.parentWorkflowID ?? null, status.serialization, null, status.delayUntilEpochMS ?? null, status.attributes ? JSON.stringify(status.attributes) : null, status.scheduleName ?? null);
+                    status.workflowClassName === '' ? null : status.workflowClassName, status.workflowConfigName === '' ? null : status.workflowConfigName, status.queueName ?? null, status.authenticatedUser, status.assumedRole, JSON.stringify(status.authenticatedRoles), JSON.stringify(status.request), status.executorId, status.applicationVersion ?? null, status.applicationID, createdAt, 0, createdAt, status.timeoutMS ?? null, status.deadlineEpochMS ?? null, status.input, null, status.priority, status.queuePartitionKey ?? null, status.parentWorkflowID ?? null, status.serialization, null, status.delayUntilEpochMS ?? null, status.attributes ? JSON.stringify(status.attributes) : null, status.scheduleName ?? null, status.applicationName ?? null);
                 }
                 const { rows } = await client.query(`INSERT INTO "${this.schemaName}".workflow_status (${columns.join(', ')})
            VALUES ${tuples.join(', ')}
@@ -734,15 +822,28 @@ class SystemDatabase {
         return rowCount > 0;
     }
     async getPendingWorkflows(executorID, appVersion) {
+        const params = [workflow_1.StatusString.PENDING, executorID, appVersion];
+        // executor_id defaults to "local", so it collides across applications.
+        const scope = this.#appNameFilter('application_name', this.appName, params);
         const getWorkflows = await this.pool.query(`SELECT workflow_uuid
        FROM "${this.schemaName}".workflow_status
-       WHERE status=$1 AND executor_id=$2 AND application_version=$3`, [workflow_1.StatusString.PENDING, executorID, appVersion]);
+       WHERE status=$1 AND executor_id=$2 AND application_version=$3 AND ${scope}`, params);
         return getWorkflows.rows.map((i) => ({
             workflowUUID: i.workflow_uuid,
         }));
     }
     // Recovery re-enqueues rather than executing directly so the queue's atomic dequeue admits exactly one runner, and the executor ID predicate rejects sweeps for rows a live executor has already claimed.
     async reenqueueWorkflowsForRecovery(executorID, appVersion, recoveryQueueName) {
+        const params = [
+            workflow_1.StatusString.ENQUEUED,
+            Date.now(),
+            recoveryQueueName,
+            workflow_1.StatusString.PENDING,
+            executorID,
+            appVersion,
+        ];
+        // executor_id defaults to "local", so it collides across applications.
+        const scope = this.#appNameFilter('application_name', this.appName, params);
         const result = await this.pool.query(`UPDATE "${this.schemaName}".workflow_status
        SET started_at_epoch_ms = NULL,
            status = $1,
@@ -751,7 +852,8 @@ class SystemDatabase {
        WHERE status = $4
          AND executor_id = $5
          AND application_version = $6
-       RETURNING workflow_uuid`, [workflow_1.StatusString.ENQUEUED, Date.now(), recoveryQueueName, workflow_1.StatusString.PENDING, executorID, appVersion]);
+         AND ${scope}
+       RETURNING workflow_uuid`, params);
         return result.rows.map((row) => row.workflow_uuid);
     }
     async getWorkflowStatus(workflowID, callerID, callerFN) {
@@ -877,9 +979,9 @@ class SystemDatabase {
         // Insert a patchmarker
         const dn = Date.now();
         await this.pool.query(`INSERT INTO ${this.schemaName}.operation_outputs
-       (workflow_uuid, function_id, output, error, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
-       ON CONFLICT DO NOTHING;`, [workflowID, functionID, null, null, patchName, null, dn, dn]);
+       (workflow_uuid, function_id, output, error, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms, application_name)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+       ON CONFLICT DO NOTHING;`, [workflowID, functionID, null, null, patchName, null, dn, dn, this.appName ?? null]);
         return { isPatched: true, hasEntry: true };
     }
     // ==================== Workflow Management ====================
@@ -937,8 +1039,9 @@ class SystemDatabase {
      * Extend an existing debounced DELAYED workflow's delay and update its inputs, atomically.
      * The new delay is capped at the workflow's debounce_deadline_epoch_ms, if one is set.
      * Matching on workflow name and class ensures a debounce-key collision between different
-     * workflows never overwrites another workflow's inputs. If nothing matched, returns the
-     * current holder (or that the key is unheld) so the caller can start fresh or surface a conflict.
+     * workflows never overwrites another workflow's inputs. The bounce acts for `params.applicationName`:
+     * it extends only that application's holders plus unclaimed ones, claiming those. If nothing matched,
+     * returns the current holder (or that the key is unheld) so the caller can start fresh or surface a conflict.
      * Runs on `client` if given, joining its transaction (e.g. a transactional step's);
      * otherwise in its own retried transaction.
      */
@@ -966,17 +1069,7 @@ class SystemDatabase {
     }
     async #debounceDelayedWorkflowInternal(client, params) {
         const classNameOrNull = params.workflowClassName === '' ? null : params.workflowClassName;
-        const updated = await client.query(`UPDATE "${this.schemaName}".workflow_status
-       SET delay_until_epoch_ms = CASE
-             WHEN debounce_deadline_epoch_ms IS NOT NULL AND debounce_deadline_epoch_ms < $1
-             THEN debounce_deadline_epoch_ms
-             ELSE $1
-           END,
-           inputs = $2, serialization = $3, updated_at = $4
-       WHERE name = $5 AND class_name IS NOT DISTINCT FROM $6
-         AND queue_name = $7 AND deduplication_id = $8
-         AND status = $9 AND is_debounced = TRUE
-       RETURNING workflow_uuid`, [
+        const updateParams = [
             params.delayUntilEpochMS,
             params.input,
             params.serialization,
@@ -986,7 +1079,24 @@ class SystemDatabase {
             params.queueName,
             params.deduplicationID,
             workflow_1.StatusString.DELAYED,
-        ]);
+            params.applicationName ?? null,
+        ];
+        // Never extend a workflow the target application doesn't own; falls through to the holder below.
+        const ownScope = this.#appNameFilter('application_name', params.applicationName, updateParams);
+        const updated = await client.query(`UPDATE "${this.schemaName}".workflow_status
+       SET delay_until_epoch_ms = CASE
+             WHEN debounce_deadline_epoch_ms IS NOT NULL AND debounce_deadline_epoch_ms < $1
+             THEN debounce_deadline_epoch_ms
+             ELSE $1
+           END,
+           inputs = $2, serialization = $3, updated_at = $4,
+           -- Claim it for the target, as its dequeue would: left unclaimed, every peer coalesces onto the one workflow and the last inputs win.
+           application_name = COALESCE(application_name, $10)
+       WHERE name = $5 AND class_name IS NOT DISTINCT FROM $6
+         AND queue_name = $7 AND deduplication_id = $8
+         AND status = $9 AND is_debounced = TRUE
+         AND ${ownScope}
+       RETURNING workflow_uuid`, updateParams);
         if (updated.rows.length > 0) {
             return {
                 bouncedWorkflowID: updated.rows[0].workflow_uuid,
@@ -994,10 +1104,11 @@ class SystemDatabase {
                 holderIsDebounced: false,
                 holderWorkflowName: null,
                 holderWorkflowClassName: null,
+                holderApplicationName: null,
             };
         }
-        // No match: the key is unheld, or held by a non-debounced or name-colliding workflow.
-        const holder = await client.query(`SELECT workflow_uuid, is_debounced, name, class_name
+        // Unscoped, so a holder that blocked the update above is reportable.
+        const holder = await client.query(`SELECT workflow_uuid, is_debounced, name, class_name, application_name
        FROM "${this.schemaName}".workflow_status
        WHERE queue_name = $1 AND deduplication_id = $2`, [params.queueName, params.deduplicationID]);
         if (holder.rows.length === 0) {
@@ -1007,6 +1118,7 @@ class SystemDatabase {
                 holderIsDebounced: false,
                 holderWorkflowName: null,
                 holderWorkflowClassName: null,
+                holderApplicationName: null,
             };
         }
         return {
@@ -1015,6 +1127,7 @@ class SystemDatabase {
             holderIsDebounced: holder.rows[0].is_debounced ?? false,
             holderWorkflowName: holder.rows[0].name,
             holderWorkflowClassName: holder.rows[0].class_name ?? null,
+            holderApplicationName: holder.rows[0].application_name ?? null,
         };
     }
     // Get the immediate (one-level) child workflow IDs for a set of workflows.
@@ -1126,7 +1239,7 @@ class SystemDatabase {
             // Fetch the status of all original workflows inside the transaction.
             const { rows: statusRows } = await client.query(`SELECT workflow_uuid, name, class_name, config_name, application_id,
                 authenticated_user, authenticated_roles, assumed_role, inputs, serialization,
-                request, application_version, attributes
+                request, application_version, attributes, application_name
          FROM "${this.schemaName}".workflow_status
          WHERE workflow_uuid = ANY($1)`, [originalWorkflowIDs]);
             const statusByID = new Map(statusRows.map((r) => [r.workflow_uuid, r]));
@@ -1155,10 +1268,16 @@ class SystemDatabase {
                 'forked_from',
                 'serialization',
                 'attributes',
+                'application_name',
             ];
             if (options.timeoutMS !== undefined) {
                 insertCols.push('workflow_timeout_ms');
             }
+            // One owner per fork, shared by its status row and its copied steps: the source's, or this application claiming an unclaimed one.
+            const forkOwners = new Map(originalWorkflowIDs.map((origID, i) => [
+                forkedWorkflowIDs[i],
+                statusByID.get(origID).application_name ?? this.appName ?? null,
+            ]));
             const valuesPlaceholders = [];
             const params = [];
             let paramIdx = 1;
@@ -1168,7 +1287,7 @@ class SystemDatabase {
                 const ws = statusByID.get(origID);
                 const placeholders = insertCols.map(() => `$${paramIdx++}`).join(', ');
                 valuesPlaceholders.push(`(${placeholders})`);
-                params.push(forkID, workflow_1.StatusString.ENQUEUED, ws.name, ws.class_name ?? null, ws.config_name ?? null, queueName, ws.authenticated_user, ws.assumed_role, ws.authenticated_roles, ws.request, options.applicationVersion ?? ws.application_version ?? null, ws.application_id, ws.inputs, options.queuePartitionKey ?? null, origID, ws.serialization, ws.attributes ? JSON.stringify(ws.attributes) : null);
+                params.push(forkID, workflow_1.StatusString.ENQUEUED, ws.name, ws.class_name ?? null, ws.config_name ?? null, queueName, ws.authenticated_user, ws.assumed_role, ws.authenticated_roles, ws.request, options.applicationVersion ?? ws.application_version ?? null, ws.application_id, ws.inputs, options.queuePartitionKey ?? null, origID, ws.serialization, ws.attributes ? JSON.stringify(ws.attributes) : null, forkOwners.get(forkID) ?? null);
                 if (options.timeoutMS !== undefined) {
                     params.push(options.timeoutMS);
                 }
@@ -1187,11 +1306,12 @@ class SystemDatabase {
                 const mappingParams = [];
                 let mIdx = 1;
                 for (const m of forkMappings) {
-                    mappingValues.push(`($${mIdx}::text, $${mIdx + 1}::text, $${mIdx + 2}::int)`);
-                    mappingParams.push(m.origID, m.forkID, m.startStep);
-                    mIdx += 3;
+                    // Cast: an unclaimed fork makes owner a bare NULL the VALUES list cannot type.
+                    mappingValues.push(`($${mIdx}::text, $${mIdx + 1}::text, $${mIdx + 2}::int, $${mIdx + 3}::text)`);
+                    mappingParams.push(m.origID, m.forkID, m.startStep, forkOwners.get(m.forkID) ?? null);
+                    mIdx += 4;
                 }
-                const mappingCTE = `WITH mapping(orig_id, fork_id, start_step) AS (VALUES ${mappingValues.join(', ')})`;
+                const mappingCTE = `WITH mapping(orig_id, fork_id, start_step, owner) AS (VALUES ${mappingValues.join(', ')})`;
                 // Build the child_workflow_id expression, applying replacements if provided.
                 let childWfExpr = 'oo.child_workflow_id';
                 const ooParams = [...mappingParams];
@@ -1207,8 +1327,8 @@ class SystemDatabase {
                 // Copy operation outputs
                 await client.query(`${mappingCTE}
            INSERT INTO "${this.schemaName}".operation_outputs
-             (workflow_uuid, function_id, output, error, serialization, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms)
-           SELECT m.fork_id, oo.function_id, oo.output, oo.error, oo.serialization, oo.function_name, ${childWfExpr}, oo.started_at_epoch_ms, oo.completed_at_epoch_ms
+             (workflow_uuid, function_id, output, error, serialization, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms, application_name)
+           SELECT m.fork_id, oo.function_id, oo.output, oo.error, oo.serialization, oo.function_name, ${childWfExpr}, oo.started_at_epoch_ms, oo.completed_at_epoch_ms, m.owner
            FROM mapping m
            JOIN "${this.schemaName}".operation_outputs oo
              ON oo.workflow_uuid = m.orig_id AND oo.function_id < m.start_step`, ooParams);
@@ -1276,7 +1396,7 @@ class SystemDatabase {
             deduplication_id, inputs, priority, queue_partition_key, forked_from,
             parent_workflow_id, serialization, delay_until_epoch_ms,
             was_forked_from, rate_limited, completed_at, attributes, schedule_name,
-            debounce_deadline_epoch_ms, is_debounced
+            debounce_deadline_epoch_ms, is_debounced, application_name
           FROM "${this.schemaName}".workflow_status
           WHERE workflow_uuid = $1`, [wfID]);
                 if (statusResult.rows.length === 0) {
@@ -1287,7 +1407,7 @@ class SystemDatabase {
                 const outputsResult = await client.query(`SELECT
             workflow_uuid, function_id, function_name, output, error,
             child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms,
-            serialization
+            serialization, application_name
           FROM "${this.schemaName}".operation_outputs
           WHERE workflow_uuid = $1`, [wfID]);
                 // Export workflow_events
@@ -1332,8 +1452,8 @@ class SystemDatabase {
             deduplication_id, inputs, priority, queue_partition_key, forked_from,
             parent_workflow_id, serialization, delay_until_epoch_ms,
             was_forked_from, rate_limited, completed_at, attributes, schedule_name,
-            debounce_deadline_epoch_ms, is_debounced
-          ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36)`, [
+            debounce_deadline_epoch_ms, is_debounced, application_name
+          ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37)`, [
                     status.workflow_uuid,
                     status.status,
                     status.name,
@@ -1372,14 +1492,15 @@ class SystemDatabase {
                     status.schedule_name ?? null,
                     status.debounce_deadline_epoch_ms ?? null,
                     status.is_debounced ?? false,
+                    status.application_name ?? null,
                 ]);
                 // Import operation_outputs
                 for (const output of workflow.operation_outputs) {
                     await client.query(`INSERT INTO "${this.schemaName}".operation_outputs (
               workflow_uuid, function_id, function_name, output, error,
               child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms,
-              serialization
-            ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [
+              serialization, application_name
+            ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`, [
                         output.workflow_uuid,
                         output.function_id,
                         output.function_name,
@@ -1389,6 +1510,7 @@ class SystemDatabase {
                         output.started_at_epoch_ms,
                         output.completed_at_epoch_ms,
                         output.serialization,
+                        output.application_name ?? null,
                     ]);
                 }
                 // Import workflow_events
@@ -2092,10 +2214,13 @@ class SystemDatabase {
         // Transition workflows from DELAYED to ENQUEUED when their delay has expired.
         // For debounced workflows, clear the deduplication ID in the same atomic update: it is a
         // debounce key held only while DELAYED, so a later same-key debounce starts a fresh workflow.
+        const params = [workflow_1.StatusString.ENQUEUED, Date.now(), workflow_1.StatusString.DELAYED];
+        // Only what this application would dequeue: a peer's debounce key is not ours to clear.
+        const scope = this.#appNameFilter('application_name', this.appName, params);
         await this.pool.query(`UPDATE "${this.schemaName}".workflow_status
        SET status = $1, updated_at = $2,
            deduplication_id = CASE WHEN is_debounced THEN NULL ELSE deduplication_id END
-       WHERE status = $3 AND delay_until_epoch_ms <= $2`, [workflow_1.StatusString.ENQUEUED, Date.now(), workflow_1.StatusString.DELAYED]);
+       WHERE status = $3 AND delay_until_epoch_ms <= $2 AND ${scope}`, params);
     }
     async getDeduplicatedWorkflow(queueName, deduplicationID) {
         const { rows } = await this.pool.query(`SELECT workflow_uuid FROM "${this.schemaName}".workflow_status
@@ -2107,18 +2232,21 @@ class SystemDatabase {
     }
     async getQueuePartitions(queueName) {
         // Recursive-CTE loose index scan: SELECT DISTINCT would scan every ENQUEUED row, whereas each iteration here is one seek on idx_workflow_status_partition_dequeue_v2, so cost scales with the number of partitions rather than the backlog depth.
+        const params = [queueName, workflow_1.StatusString.ENQUEUED];
+        // Only partitions this application can actually dequeue from.
+        const scope = this.#appNameFilter('application_name', this.appName, params);
         const { rows } = await this.pool.query(`WITH RECURSIVE partitions AS (
          (SELECT MIN(queue_partition_key) AS pk
           FROM "${this.schemaName}".workflow_status
-          WHERE queue_name = $1 AND status = $2 AND queue_partition_key IS NOT NULL)
+          WHERE queue_name = $1 AND status = $2 AND queue_partition_key IS NOT NULL AND ${scope})
          UNION ALL
          (SELECT (SELECT MIN(queue_partition_key)
                   FROM "${this.schemaName}".workflow_status
-                  WHERE queue_name = $1 AND status = $2 AND queue_partition_key > partitions.pk)
+                  WHERE queue_name = $1 AND status = $2 AND queue_partition_key > partitions.pk AND ${scope})
           FROM partitions
           WHERE partitions.pk IS NOT NULL)
        )
-       SELECT pk FROM partitions WHERE pk IS NOT NULL`, [queueName, workflow_1.StatusString.ENQUEUED]);
+       SELECT pk FROM partitions WHERE pk IS NOT NULL`, params);
         return rows.map((row) => row.pk);
     }
     async findAndMarkStartableWorkflows(queue, executorID, appVersion, queuePartitionKey) {
@@ -2152,11 +2280,14 @@ class SystemDatabase {
                     startTimeMs - limiterPeriodMS,
                     ...partitionParams,
                 ];
+                // Count only what this application would dequeue, matching the select below.
+                const scope = this.#appNameFilter('application_name', this.appName, params);
                 const countResult = await client.query(`SELECT COUNT(*) FROM "${this.schemaName}".workflow_status
            WHERE queue_name = $1
              AND rate_limited = TRUE
              AND status NOT IN ($2, $3)
              AND started_at_epoch_ms > $4
+             AND ${scope}
              ${partitionFilter.replace('$PARTITION', '$5')}`, params);
                 numRecentQueries = Number(countResult.rows[0].count);
                 if (numRecentQueries >= queue.rateLimit.limitPerPeriod) {
@@ -2175,9 +2306,10 @@ class SystemDatabase {
             if (queue.concurrency !== undefined) {
                 // Global concurrency still requires a DB query since other workers may be running workflows too.
                 const params = [queue.name, workflow_1.StatusString.PENDING, ...partitionParams];
+                const scope = this.#appNameFilter('application_name', this.appName, params);
                 const runningTasksResult = await client.query(`SELECT COUNT(*) as task_count
            FROM "${this.schemaName}".workflow_status
-           WHERE queue_name = $1 AND status = $2
+           WHERE queue_name = $1 AND status = $2 AND ${scope}
              ${partitionFilter.replace('$PARTITION', '$3')}`, params);
                 const totalRunningTasks = Number(runningTasksResult.rows[0]?.task_count ?? 0);
                 if (totalRunningTasks > queue.concurrency) {
@@ -2192,10 +2324,7 @@ class SystemDatabase {
                 return claimedIDs;
             }
             // Retrieve the first max_tasks workflows in the queue.
-            const latestVersionResult = await client.query(`SELECT version_name
-         FROM "${this.schemaName}".application_versions
-         ORDER BY version_timestamp DESC LIMIT 1`);
-            const latestVersion = latestVersionResult.rows[0]?.version_name;
+            const latestVersion = await this.#latestApplicationVersionName(client);
             const isLatestVersion = latestVersion === undefined || latestVersion === appVersion;
             const versionClause = isLatestVersion
                 ? '(application_version = $3 OR application_version IS NULL)'
@@ -2203,12 +2332,14 @@ class SystemDatabase {
             const lockMode = queue.concurrency ? 'FOR UPDATE NOWAIT' : 'FOR UPDATE SKIP LOCKED';
             const limitClause = maxTasks !== Infinity ? `LIMIT ${maxTasks}` : '';
             const selectParams = [workflow_1.StatusString.ENQUEUED, queue.name, appVersion, ...partitionParams];
+            const selectScope = this.#appNameFilter('application_name', this.appName, selectParams);
             const selectQuery = `
         SELECT workflow_uuid
         FROM "${this.schemaName}".workflow_status
         WHERE status = $1
           AND queue_name = $2
           AND ${versionClause}
+          AND ${selectScope}
           ${partitionFilter.replace('$PARTITION', '$4')}
         ORDER BY priority ASC, created_at ASC
         ${limitClause}
@@ -2229,26 +2360,32 @@ class SystemDatabase {
                 // Start the functions by marking them as pending and updating their executor IDs.
                 // Only claim the workflow if the UPDATE actually transitioned an ENQUEUED row —
                 // otherwise another worker won the race and we must not re-dispatch it.
+                const updateParams = [
+                    workflow_1.StatusString.PENDING,
+                    executorID,
+                    appVersion,
+                    startTimeMs,
+                    queue.rateLimit !== undefined,
+                    id,
+                    workflow_1.StatusString.ENQUEUED,
+                    // Claim an unclaimed row for this application; a nameless dequeuer leaves ownership untouched.
+                    this.appName ?? null,
+                ];
+                // Re-check ownership alongside status, as the partitioned claim guard does.
+                const claimScope = this.#appNameFilter('application_name', this.appName, updateParams);
                 const updateRes = await client.query(`UPDATE "${this.schemaName}".workflow_status
            SET status = $1,
                executor_id = $2,
                application_version = $3,
                started_at_epoch_ms = $4,
                rate_limited = $5,
+               application_name = COALESCE(application_name, $8),
                workflow_deadline_epoch_ms = CASE
                  WHEN workflow_timeout_ms IS NOT NULL AND workflow_deadline_epoch_ms IS NULL
                  THEN (EXTRACT(epoch FROM now()) * 1000)::bigint + workflow_timeout_ms
                  ELSE workflow_deadline_epoch_ms
                END
-           WHERE workflow_uuid = $6 AND status = $7`, [
-                    workflow_1.StatusString.PENDING,
-                    executorID,
-                    appVersion,
-                    startTimeMs,
-                    queue.rateLimit !== undefined,
-                    id,
-                    workflow_1.StatusString.ENQUEUED,
-                ]);
+           WHERE workflow_uuid = $6 AND status = $7 AND ${claimScope}`, updateParams);
                 if ((updateRes.rowCount ?? 0) > 0) {
                     claimedIDs.push(id);
                 }
@@ -2277,23 +2414,28 @@ class SystemDatabase {
         const client = await this.pool.connect();
         try {
             await client.query('BEGIN');
-            const latestVersionResult = await client.query(`SELECT version_name
-         FROM "${this.schemaName}".application_versions
-         ORDER BY version_timestamp DESC LIMIT 1`);
-            const latestVersion = latestVersionResult.rows[0]?.version_name;
+            const latestVersion = await this.#latestApplicationVersionName(client);
             const isLatestVersion = latestVersion === undefined || latestVersion === appVersion;
             const versionClause = (n) => isLatestVersion
                 ? `(application_version = $${n} OR application_version IS NULL)`
                 : `application_version = $${n}`;
+            const candidateParams = [
+                queue.name,
+                workflow_1.StatusString.ENQUEUED,
+                appVersion,
+                workflow_1.StatusString.PENDING,
+                this.partitionedDequeueSweepCap,
+            ];
+            const candidateScope = this.#appNameFilter('application_name', this.appName, candidateParams);
             // Walk distinct partition keys with a recursive-CTE loose index scan (one seek per key, mirroring getQueuePartitions) so sweep cost scales with partition count, not backlog depth.
             const candidateResult = await client.query(`WITH RECURSIVE partitions AS (
            (SELECT MIN(queue_partition_key) AS pk
             FROM "${this.schemaName}".workflow_status
-            WHERE queue_name = $1 AND status = $2 AND queue_partition_key IS NOT NULL)
+            WHERE queue_name = $1 AND status = $2 AND queue_partition_key IS NOT NULL AND ${candidateScope})
            UNION ALL
            (SELECT (SELECT MIN(queue_partition_key)
                     FROM "${this.schemaName}".workflow_status
-                    WHERE queue_name = $1 AND status = $2 AND queue_partition_key > partitions.pk)
+                    WHERE queue_name = $1 AND status = $2 AND queue_partition_key > partitions.pk AND ${candidateScope})
             FROM partitions
             WHERE partitions.pk IS NOT NULL)
          )
@@ -2306,12 +2448,13 @@ class SystemDatabase {
            WHERE queue_name = $1 AND status = $2
              AND queue_partition_key = partitions.pk
              AND ${versionClause(3)}
+             AND ${candidateScope}
            -- workflow_uuid totalizes the head order (same head for every worker under created_at ties) and the index's trailing workflow_uuid keeps this a pure top-1 probe.
            ORDER BY priority ASC, created_at ASC, workflow_uuid ASC
            LIMIT 1
          ) head ON TRUE
          WHERE partitions.pk IS NOT NULL
-           -- Admit a partition's head only while nothing in that partition runs anywhere, on any app version.
+           -- Unscoped by design: a mutual-exclusion probe must block on any owner's row.
            AND NOT EXISTS (
              SELECT 1
              FROM "${this.schemaName}".workflow_status
@@ -2319,7 +2462,7 @@ class SystemDatabase {
                AND queue_partition_key IS NOT NULL AND queue_partition_key = partitions.pk
            )
          ORDER BY partitions.pk ASC
-         LIMIT $5`, [queue.name, workflow_1.StatusString.ENQUEUED, appVersion, workflow_1.StatusString.PENDING, this.partitionedDequeueSweepCap]);
+         LIMIT $5`, candidateParams);
             const candidateIDs = candidateResult.rows.map((row) => row.workflow_uuid);
             if (candidateIDs.length === 0) {
                 await client.query('COMMIT');
@@ -2327,16 +2470,19 @@ class SystemDatabase {
             }
             await (0, debugpoint_1.debugTriggerPoint)(debugpoint_1.DEBUG_TRIGGER_PARTITIONED_DEQUEUE_AFTER_CANDIDATES);
             // Re-check queue/partition/version alongside status so a row resumeWorkflows moved to another queue mid-sweep is dropped, not hijacked.
-            const claimGuard = (ids, status, name, version) => `workflow_uuid = ANY($${ids}::text[])
+            const claimGuard = (ids, status, name, version, scope) => `workflow_uuid = ANY($${ids}::text[])
            AND status = $${status}
            AND queue_name = $${name}
            AND queue_partition_key IS NOT NULL
-           AND ${versionClause(version)}`;
+           AND ${versionClause(version)}
+           AND ${scope}`;
+            const lockedParams = [candidateIDs, workflow_1.StatusString.ENQUEUED, queue.name, appVersion];
+            const lockedScope = this.#appNameFilter('application_name', this.appName, lockedParams);
             // Lock the fixed candidate set — never a LIMIT query, whose SKIP LOCKED could slide past a locked head and admit out of order.
             const lockedResult = await client.query(`SELECT workflow_uuid
          FROM "${this.schemaName}".workflow_status
-         WHERE ${claimGuard(1, 2, 3, 4)}
-         FOR UPDATE SKIP LOCKED`, [candidateIDs, workflow_1.StatusString.ENQUEUED, queue.name, appVersion]);
+         WHERE ${claimGuard(1, 2, 3, 4, lockedScope)}
+         FOR UPDATE SKIP LOCKED`, lockedParams);
             const lockedIDs = new Set(lockedResult.rows.map((row) => row.workflow_uuid));
             // Preserve partition order for submission.
             const claimIDs = candidateIDs.filter((id) => lockedIDs.has(id));
@@ -2344,6 +2490,18 @@ class SystemDatabase {
                 await client.query('COMMIT');
                 return [];
             }
+            const flipParams = [
+                workflow_1.StatusString.PENDING,
+                executorID,
+                claimIDs,
+                workflow_1.StatusString.ENQUEUED,
+                queue.name,
+                appVersion,
+                startTimeMs,
+                // Claim the row, as the unpartitioned dequeue does.
+                this.appName ?? null,
+            ];
+            const flipScope = this.#appNameFilter('application_name', this.appName, flipParams);
             // Start the workflows by marking them PENDING; RETURNING reports exactly the rows this statement flipped.
             const flippedResult = await client.query(`UPDATE "${this.schemaName}".workflow_status
          SET status = $1,
@@ -2351,13 +2509,14 @@ class SystemDatabase {
              application_version = $6,
              started_at_epoch_ms = $7,
              rate_limited = FALSE,
+             application_name = COALESCE(application_name, $8),
              workflow_deadline_epoch_ms = CASE
                WHEN workflow_timeout_ms IS NOT NULL AND workflow_deadline_epoch_ms IS NULL
                THEN (EXTRACT(epoch FROM now()) * 1000)::bigint + workflow_timeout_ms
                ELSE workflow_deadline_epoch_ms
              END
-         WHERE ${claimGuard(3, 4, 5, 6)}
-         RETURNING workflow_uuid`, [workflow_1.StatusString.PENDING, executorID, claimIDs, workflow_1.StatusString.ENQUEUED, queue.name, appVersion, startTimeMs]);
+         WHERE ${claimGuard(3, 4, 5, 6, flipScope)}
+         RETURNING workflow_uuid`, flipParams);
             await client.query('COMMIT');
             const flippedIDs = new Set(flippedResult.rows.map((row) => row.workflow_uuid));
             const claimedIDs = claimIDs.filter((id) => flippedIDs.has(id));
@@ -2408,6 +2567,7 @@ class SystemDatabase {
             'schedule_name',
             'debounce_deadline_epoch_ms',
             'is_debounced',
+            'application_name',
         ];
         input.loadInput = input.loadInput ?? true;
         input.loadOutput = input.loadOutput ?? true;
@@ -2452,6 +2612,15 @@ class SystemDatabase {
         addFilter('name', input.workflowName);
         addFilter('queue_name', input.queueName);
         addFilter('schedule_name', input.scheduleName);
+        // A workflow ID is a global address, so an ID-keyed read is an identity read: it takes an
+        // explicit filter but is never defaulted to this one. Otherwise unset scopes to this
+        // application, as on every other observability query.
+        // Falsy, not just undefined: a Conductor request carries an omitted list as JSON null.
+        const idKeyed = (input.workflowIDs?.length ?? 0) > 0;
+        whereClauses.push(idKeyed
+            ? this.#appNameFilter('application_name', input.applicationName, params)
+            : this.#observabilityFilter('application_name', input.applicationName, params));
+        paramCounter = params.length + 1;
         if (input.workflow_id_prefix) {
             if (Array.isArray(input.workflow_id_prefix)) {
                 const likeClauses = input.workflow_id_prefix.map((_, i) => `workflow_uuid LIKE $${paramCounter + i}`);
@@ -2554,6 +2723,7 @@ class SystemDatabase {
             ['queue_name', input.groupByQueueName ?? false, 'queue_name'],
             ['executor_id', input.groupByExecutorId ?? false, 'executor_id'],
             ['application_version', input.groupByApplicationVersion ?? false, 'application_version'],
+            ['application_name', input.groupByApplicationName ?? false, 'application_name'],
         ];
         const groupNames = [];
         const groupColumns = [];
@@ -2624,6 +2794,9 @@ class SystemDatabase {
         addFilter('forked_from', input.forkedFrom);
         addFilter('parent_workflow_id', input.parentWorkflowID);
         addFilter('schedule_name', input.scheduleName);
+        // Unset scopes to this application, as on every other observability query.
+        whereClauses.push(this.#observabilityFilter('application_name', input.applicationName, params));
+        paramIdx = params.length + 1;
         // Only workflows that are actively enqueued.
         if (input.queuesOnly) {
             whereClauses.push(`queue_name IS NOT NULL`);
@@ -2786,6 +2959,9 @@ class SystemDatabase {
             params.push(new Date(input.completedBefore).getTime());
             paramIdx++;
         }
+        // Unset scopes to this application, as on every other observability query.
+        whereClauses.push(this.#observabilityFilter('application_name', input.applicationName, params));
+        paramIdx = params.length + 1;
         const whereClause = whereClauses.length > 0 ? `WHERE ${whereClauses.join(' AND ')}` : '';
         const groupByClause = groupColumns.join(', ');
         const selectClause = [...groupSelectColumns, ...selectColumns].join(', ');
@@ -2814,10 +2990,13 @@ class SystemDatabase {
     async garbageCollect(cutoffEpochTimestampMs, rowsThreshold) {
         if (rowsThreshold !== undefined && rowsThreshold !== null) {
             // Get the created_at timestamp of the rows_threshold newest row
+            const params = [rowsThreshold - 1];
+            const scope = this.#appNameFilter('application_name', this.appName, params);
             const result = await this.pool.query(`SELECT created_at
          FROM "${this.schemaName}".workflow_status
+         WHERE ${scope}
          ORDER BY created_at DESC
-         LIMIT 1 OFFSET $1`, [rowsThreshold - 1]);
+         LIMIT 1 OFFSET $1`, params);
             if (result.rows.length > 0) {
                 const rowsBasedCutoff = result.rows[0].created_at;
                 // Use the more restrictive cutoff (higher timestamp = more recent = more deletion)
@@ -2831,21 +3010,51 @@ class SystemDatabase {
         if (cutoffEpochTimestampMs === undefined || cutoffEpochTimestampMs === null) {
             return;
         }
+        const deleteParams = [
+            cutoffEpochTimestampMs,
+            workflow_1.StatusString.PENDING,
+            workflow_1.StatusString.ENQUEUED,
+            workflow_1.StatusString.DELAYED,
+        ];
+        // Unclaimed rows included: excluding them would leak pre-upgrade rows forever.
+        const deleteScope = this.#appNameFilter('application_name', this.appName, deleteParams);
         // Delete all workflows older than cutoff that are NOT PENDING, ENQUEUED, or DELAYED
         await this.pool.query(`DELETE FROM "${this.schemaName}".workflow_status
        WHERE created_at < $1
-         AND status NOT IN ($2, $3, $4)`, [cutoffEpochTimestampMs, workflow_1.StatusString.PENDING, workflow_1.StatusString.ENQUEUED, workflow_1.StatusString.DELAYED]);
+         AND status NOT IN ($2, $3, $4)
+         AND ${deleteScope}`, deleteParams);
         return;
     }
-    async getMetrics(startTime, endTime) {
+    /**
+     * IDs of this application's in-flight workflows created at or before the cutoff.
+     * Claiming-scoped, so an upgrade still times out its own unclaimed workflows.
+     */
+    async listTimedOutWorkflowIds(cutoffEpochTimestampMs) {
+        const params = [
+            cutoffEpochTimestampMs,
+            workflow_1.StatusString.PENDING,
+            workflow_1.StatusString.ENQUEUED,
+            workflow_1.StatusString.DELAYED,
+        ];
+        const scope = this.#appNameFilter('application_name', this.appName, params);
+        const { rows } = await this.pool.query(`SELECT workflow_uuid
+       FROM "${this.schemaName}".workflow_status
+       WHERE created_at <= $1
+         AND status IN ($2, $3, $4)
+         AND ${scope}`, params);
+        return rows.map((row) => row.workflow_uuid);
+    }
+    async getMetrics(startTime, endTime, applicationName) {
         const startEpochMs = new Date(startTime).getTime();
         const endEpochMs = new Date(endTime).getTime();
         const metrics = [];
         // Query workflow metrics
+        const workflowParams = [startEpochMs, endEpochMs];
+        const workflowScope = this.#observabilityFilter('application_name', applicationName, workflowParams);
         const workflowResult = await this.pool.query(`SELECT name, COUNT(workflow_uuid) as count
        FROM "${this.schemaName}".workflow_status
-       WHERE created_at >= $1 AND created_at < $2
-       GROUP BY name`, [startEpochMs, endEpochMs]);
+       WHERE created_at >= $1 AND created_at < $2 AND ${workflowScope}
+       GROUP BY name`, workflowParams);
         for (const row of workflowResult.rows) {
             metrics.push({
                 metricType: 'workflow_count',
@@ -2854,10 +3063,12 @@ class SystemDatabase {
             });
         }
         // Query step metrics
+        const stepParams = [startEpochMs, endEpochMs];
+        const stepScope = this.#observabilityFilter('application_name', applicationName, stepParams);
         const stepResult = await this.pool.query(`SELECT function_name, COUNT(*) as count
        FROM "${this.schemaName}".operation_outputs
-       WHERE completed_at_epoch_ms >= $1 AND completed_at_epoch_ms < $2
-       GROUP BY function_name`, [startEpochMs, endEpochMs]);
+       WHERE completed_at_epoch_ms >= $1 AND completed_at_epoch_ms < $2 AND ${stepScope}
+       GROUP BY function_name`, stepParams);
         for (const row of stepResult.rows) {
             metrics.push({
                 metricType: 'step_count',
@@ -2870,10 +3081,11 @@ class SystemDatabase {
     // ==================== Scheduling ====================
     async createSchedule(schedule, client) {
         const q = client ?? this.pool;
+        const owner = await this.#resolveRowOwner(q, 'workflow_schedules', 'schedule_name', schedule.scheduleName, schedule.applicationName, 'Schedule');
         try {
             await q.query(`INSERT INTO "${this.schemaName}".workflow_schedules
-         (schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`, [
+         (schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name, application_name)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [
                 schedule.scheduleId,
                 schedule.scheduleName,
                 schedule.workflowName,
@@ -2885,6 +3097,7 @@ class SystemDatabase {
                 schedule.automaticBackfill,
                 schedule.cronTimezone,
                 schedule.queueName,
+                owner ?? null,
             ]);
         }
         catch (e) {
@@ -2894,6 +3107,10 @@ class SystemDatabase {
             throw e;
         }
     }
+    /**
+     * List only schedules owned by these applications, plus unclaimed ones.
+     * By default, only list this application's schedules.
+     */
     async listSchedules(filters, client) {
         const q = client ?? this.pool;
         const conditions = [];
@@ -2925,45 +3142,23 @@ class SystemDatabase {
             });
             conditions.push(`(${likeClauses.join(' OR ')})`);
         }
+        // Unset scopes to this application, as on every other observability query.
+        conditions.push(this.#observabilityFilter('application_name', filters?.applicationName, params));
+        paramIdx = params.length + 1;
         const where = conditions.length > 0 ? ` WHERE ${conditions.join(' AND ')}` : '';
-        const result = await q.query(`SELECT schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name
+        const result = await q.query(`SELECT ${SCHEDULE_COLUMNS}
        FROM "${this.schemaName}".workflow_schedules${where}
        ORDER BY schedule_name`, params);
-        return result.rows.map((row) => ({
-            scheduleId: row.schedule_id,
-            scheduleName: row.schedule_name,
-            workflowName: row.workflow_name,
-            workflowClassName: row.workflow_class_name,
-            schedule: row.schedule,
-            status: row.status,
-            context: row.context,
-            lastFiredAt: row.last_fired_at ?? null,
-            automaticBackfill: !!row.automatic_backfill,
-            cronTimezone: row.cron_timezone ?? null,
-            queueName: row.queue_name ?? null,
-        }));
+        return result.rows.map((row) => mapWorkflowSchedule(row));
     }
     async getSchedule(name, client) {
         const q = client ?? this.pool;
-        const result = await q.query(`SELECT schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name
+        const result = await q.query(`SELECT ${SCHEDULE_COLUMNS}
        FROM "${this.schemaName}".workflow_schedules
        WHERE schedule_name = $1`, [name]);
         if (result.rows.length === 0)
             return null;
-        const row = result.rows[0];
-        return {
-            scheduleId: row.schedule_id,
-            scheduleName: row.schedule_name,
-            workflowName: row.workflow_name,
-            workflowClassName: row.workflow_class_name,
-            schedule: row.schedule,
-            status: row.status,
-            context: row.context,
-            lastFiredAt: row.last_fired_at ?? null,
-            automaticBackfill: !!row.automatic_backfill,
-            cronTimezone: row.cron_timezone ?? null,
-            queueName: row.queue_name ?? null,
-        };
+        return mapWorkflowSchedule(result.rows[0]);
     }
     async deleteSchedule(name, client) {
         const q = client ?? this.pool;
@@ -3019,10 +3214,11 @@ class SystemDatabase {
         try {
             await client.query('BEGIN');
             for (const sched of schedules) {
+                const owner = await this.#resolveRowOwner(client, 'workflow_schedules', 'schedule_name', sched.scheduleName, sched.applicationName, 'Schedule');
                 // Upsert on schedule_name; on conflict, preserve schedule_id and runtime state (status, last_fired_at) and update only the declared definition fields, so an unchanged re-apply is a no-op.
                 await client.query(`INSERT INTO "${this.schemaName}".workflow_schedules
-           (schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name)
-           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+           (schedule_id, schedule_name, workflow_name, workflow_class_name, schedule, status, context, last_fired_at, automatic_backfill, cron_timezone, queue_name, application_name)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
            ON CONFLICT (schedule_name) DO UPDATE SET
              workflow_name = EXCLUDED.workflow_name,
              workflow_class_name = EXCLUDED.workflow_class_name,
@@ -3030,7 +3226,9 @@ class SystemDatabase {
              context = EXCLUDED.context,
              automatic_backfill = EXCLUDED.automatic_backfill,
              cron_timezone = EXCLUDED.cron_timezone,
-             queue_name = EXCLUDED.queue_name`, [
+             queue_name = EXCLUDED.queue_name,
+             -- Claim only an unclaimed row, so a registration landing between the check above and this write keeps the name it took.
+             application_name = COALESCE("${this.schemaName}".workflow_schedules.application_name, EXCLUDED.application_name)`, [
                     sched.scheduleId,
                     sched.scheduleName,
                     sched.workflowName,
@@ -3042,7 +3240,10 @@ class SystemDatabase {
                     sched.automaticBackfill,
                     sched.cronTimezone,
                     sched.queueName,
+                    owner ?? null,
                 ]);
+                // Read back, since the guard above is silent about why it declined to claim.
+                await this.#resolveRowOwner(client, 'workflow_schedules', 'schedule_name', sched.scheduleName, sched.applicationName, 'Schedule');
             }
             await client.query('COMMIT');
         }
@@ -3055,56 +3256,109 @@ class SystemDatabase {
         }
     }
     // ==================== Application Versions ====================
-    async createApplicationVersion(versionName) {
-        const versionId = (0, crypto_1.randomUUID)();
-        await this.pool.query(`INSERT INTO "${this.schemaName}".application_versions (version_id, version_name)
-       VALUES ($1, $2)
-       ON CONFLICT (version_name) DO NOTHING`, [versionId, versionName]);
+    /**
+     * Register this version, claiming the row if nobody owns it yet so a pinned version
+     * does not stay unclaimed. A peer's name is a collision, which is why this throws.
+     */
+    async createApplicationVersion(versionName, applicationName) {
+        const owner = applicationName ?? this.appName;
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            // Claim a pre-upgrade row in place, so the version is not recreated or retimed.
+            const claimed = await client.query(`UPDATE "${this.schemaName}".application_versions
+         SET application_name = $1
+         WHERE version_name = $2 AND application_name IS NULL`, [owner ?? null, versionName]);
+            if ((claimed.rowCount ?? 0) === 0) {
+                // Targetless DO NOTHING: names no arbiter, so it survives version_name's uniqueness being dropped while still absorbing a concurrent registrar.
+                await client.query(`INSERT INTO "${this.schemaName}".application_versions (version_id, version_name, application_name)
+           VALUES ($1, $2, $3)
+           ON CONFLICT DO NOTHING`, [(0, crypto_1.randomUUID)(), versionName, owner ?? null]);
+            }
+            // Read back, since the writes above are silent about why they declined to claim.
+            await this.#resolveRowOwner(client, 'application_versions', 'version_name', versionName, owner, 'Application version');
+            await client.query('COMMIT');
+        }
+        catch (e) {
+            await client.query('ROLLBACK');
+            throw e;
+        }
+        finally {
+            client.release();
+        }
     }
-    async updateApplicationVersionTimestamp(versionName, newTimestamp) {
-        await this.pool.query(`UPDATE "${this.schemaName}".application_versions
-       SET version_timestamp = $1
-       WHERE version_name = $2`, [newTimestamp, versionName]);
+    /**
+     * Promote a version to latest. Promoting a peer's is a collision, not a retiming;
+     * promotion claims an unclaimed row, which would otherwise be every peer's latest.
+     */
+    async updateApplicationVersionTimestamp(versionName, newTimestamp, applicationName) {
+        const owner = applicationName ?? this.appName;
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            const resolved = await this.#resolveRowOwner(client, 'application_versions', 'version_name', versionName, owner, 'Application version');
+            // Scoped to the row this writer resolved to: once version_name is no longer globally unique, a bare name match would retime every peer's version.
+            const scope = resolved === undefined ? 'application_name IS NULL' : '(application_name = $3 OR application_name IS NULL)';
+            const params = [newTimestamp, versionName];
+            if (resolved !== undefined)
+                params.push(resolved);
+            await client.query(`UPDATE "${this.schemaName}".application_versions
+         SET version_timestamp = $1, application_name = ${resolved === undefined ? 'application_name' : '$3'}
+         WHERE version_name = $2 AND ${scope}`, params);
+            await client.query('COMMIT');
+        }
+        catch (e) {
+            await client.query('ROLLBACK');
+            throw e;
+        }
+        finally {
+            client.release();
+        }
     }
     async listApplicationVersions() {
-        const { rows } = await this.pool.query(`SELECT version_id, version_name, version_timestamp, created_at
+        const params = [];
+        const scope = this.#appNameFilter('application_name', this.appName, params);
+        const { rows } = await this.pool.query(`SELECT version_id, version_name, version_timestamp, created_at, application_name
        FROM "${this.schemaName}".application_versions
-       ORDER BY version_timestamp DESC`);
-        return rows.map((r) => ({
-            versionId: r.version_id,
-            versionName: r.version_name,
-            versionTimestamp: Number(r.version_timestamp),
-            createdAt: Number(r.created_at),
-        }));
+       WHERE ${scope}
+       ORDER BY version_timestamp DESC`, params);
+        return rows.map(mapVersionInfo);
     }
-    async getLatestApplicationVersion() {
-        const { rows } = await this.pool.query(`SELECT version_id, version_name, version_timestamp, created_at
+    /**
+     * The latest version registered by an application. Defaults to this handle's, so a
+     * caller acting for another one — firing its schedule — must name it.
+     */
+    async getLatestApplicationVersion(applicationName) {
+        const owner = applicationName ?? this.appName;
+        const params = [];
+        const scope = this.#appNameFilter('application_name', owner, params);
+        const { rows } = await this.pool.query(`SELECT version_id, version_name, version_timestamp, created_at, application_name
        FROM "${this.schemaName}".application_versions
+       WHERE ${scope}
        ORDER BY version_timestamp DESC
-       LIMIT 1`);
+       LIMIT 1`, params);
         if (rows.length === 0) {
             throw new error_1.DBOSInitializationError('No application versions found');
         }
-        const r = rows[0];
-        return {
-            versionId: r.version_id,
-            versionName: r.version_name,
-            versionTimestamp: Number(r.version_timestamp),
-            createdAt: Number(r.created_at),
-        };
+        return mapVersionInfo(rows[0]);
     }
     // ==================== Queues ====================
     async getQueue(name) {
-        const { rows } = await this.pool.query(`SELECT name, concurrency, worker_concurrency, rate_limit_max, rate_limit_period_sec,
-              priority_enabled, partition_queue, polling_interval_sec
+        const { rows } = await this.pool.query(`SELECT ${QUEUE_COLUMNS}
          FROM "${this.schemaName}".queues
         WHERE name = $1`, [name]);
         return rows.length === 0 ? null : queueRecordFromRow(rows[0]);
     }
-    async listQueues() {
-        const { rows } = await this.pool.query(`SELECT name, concurrency, worker_concurrency, rate_limit_max, rate_limit_period_sec,
-              priority_enabled, partition_queue, polling_interval_sec
-         FROM "${this.schemaName}".queues`);
+    /**
+     * List only queues owned by these applications, plus unclaimed ones.
+     * By default, only list this application's queues.
+     */
+    async listQueues(applicationName) {
+        const params = [];
+        const scope = this.#observabilityFilter('application_name', applicationName, params);
+        const { rows } = await this.pool.query(`SELECT ${QUEUE_COLUMNS}
+         FROM "${this.schemaName}".queues
+        WHERE ${scope}`, params);
         return rows.map(queueRecordFromRow);
     }
     async deleteQueue(name) {
@@ -3140,16 +3394,21 @@ class SystemDatabase {
           priority_enabled = EXCLUDED.priority_enabled,
           partition_queue = EXCLUDED.partition_queue,
           polling_interval_sec = EXCLUDED.polling_interval_sec,
-          updated_at = EXCLUDED.updated_at`
+          updated_at = EXCLUDED.updated_at,
+          -- Claim only an unclaimed row, so a registration landing between the check above and this write keeps the name it just took.
+          application_name = COALESCE("${this.schemaName}".queues.application_name, EXCLUDED.application_name)`
             : `ON CONFLICT (name) DO NOTHING`;
+        const owner = record.applicationName ?? this.appName;
         const client = await this.pool.connect();
         try {
             await client.query('BEGIN');
             const existed = await client.query(`SELECT name FROM "${this.schemaName}".queues WHERE name = $1`, [record.name]);
+            // A name collision is a conflict in every mode: the name is the queue's address.
+            const resolvedOwner = await this.#resolveRowOwner(client, 'queues', 'name', record.name, owner, 'Queue');
             await client.query(`INSERT INTO "${this.schemaName}".queues
           (name, concurrency, worker_concurrency, rate_limit_max, rate_limit_period_sec,
-           priority_enabled, partition_queue, polling_interval_sec, updated_at)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+           priority_enabled, partition_queue, polling_interval_sec, updated_at, application_name)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
          ${onConflict}`, [
                 record.name,
                 record.concurrency,
@@ -3160,7 +3419,10 @@ class SystemDatabase {
                 record.partitionQueue,
                 record.pollingIntervalSec,
                 now,
+                resolvedOwner ?? null,
             ]);
+            // Read back, since the guard above is silent about why it declined to claim.
+            await this.#resolveRowOwner(client, 'queues', 'name', record.name, owner, 'Queue');
             await client.query('COMMIT');
             return existed.rowCount === 0;
         }
@@ -3172,6 +3434,123 @@ class SystemDatabase {
             client.release();
         }
     }
+    // ==================== Application Rename ====================
+    /**
+     * Rows a rename moves: an application's own, unclaimed ones, or both. Unlike
+     * the claiming scope, unclaimed rows are not implied; they move only when asked.
+     */
+    #renameSource(oldName, adoptUnclaimedRows, params) {
+        const clauses = [];
+        if (oldName !== undefined) {
+            params.push(oldName);
+            clauses.push(`application_name = $${params.length}`);
+        }
+        if (adoptUnclaimedRows) {
+            clauses.push('application_name IS NULL');
+        }
+        // Callers validate that at least one source is named.
+        return `(${clauses.join(' OR ')})`;
+    }
+    /**
+     * Re-own a table's rows in half-open key ranges, so a long history neither moves in
+     * one transaction nor rescans what it already moved; a re-run resumes.
+     */
+    async #renameRowsInBatches(table, keyColumn, oldName, newName, batchSize, adoptUnclaimedRows) {
+        if (batchSize === undefined) {
+            const params = [newName];
+            const predicate = this.#renameSource(oldName, adoptUnclaimedRows, params);
+            const res = await this.pool.query(`UPDATE "${this.schemaName}".${table} SET application_name = $1 WHERE ${predicate}`, params);
+            return res.rowCount ?? 0;
+        }
+        let total = 0;
+        // Ranges, not LIMIT: a LIMIT repages every row already moved, and an IN list of keys plans as a whole-table hash join.
+        let watermark = undefined;
+        for (;;) {
+            const boundParams = [];
+            const predicate = this.#renameSource(oldName, adoptUnclaimedRows, boundParams);
+            let scope = predicate;
+            if (watermark !== undefined) {
+                boundParams.push(watermark);
+                scope = `${predicate} AND ${keyColumn} > $${boundParams.length}`;
+            }
+            // The batchSize-th matching key bounds this range; distinct, so a key's rows are never split across batches.
+            const upperResult = await this.pool.query(`SELECT DISTINCT ${keyColumn} FROM "${this.schemaName}".${table}
+         WHERE ${scope} ORDER BY ${keyColumn} LIMIT 1 OFFSET ${batchSize - 1}`, boundParams);
+            const upper = upperResult.rows[0]?.[keyColumn];
+            const updateParams = [newName];
+            const updatePredicate = this.#renameSource(oldName, adoptUnclaimedRows, updateParams);
+            let batch = updatePredicate;
+            if (upper !== undefined) {
+                if (watermark !== undefined) {
+                    updateParams.push(watermark);
+                    batch = `${batch} AND ${keyColumn} > $${updateParams.length}`;
+                }
+                updateParams.push(upper);
+                batch = `${batch} AND ${keyColumn} <= $${updateParams.length}`;
+            }
+            // The final batch drops the watermark, so rows that appeared below it still move.
+            const res = await this.pool.query(`UPDATE "${this.schemaName}".${table} SET application_name = $1 WHERE ${batch}`, updateParams);
+            total += res.rowCount ?? 0;
+            // Fewer than a full batch remained, so that update took the rest.
+            if (upper === undefined)
+                return total;
+            watermark = upper;
+        }
+    }
+    /**
+     * Give `newName` ownership of rows `oldName` holds, of unclaimed rows, or of both.
+     * The renamed application must be stopped, or its dequeues race this.
+     */
+    async renameApplication(oldName, newName, options = {}) {
+        const adoptUnclaimedRows = options.adoptUnclaimedRows ?? false;
+        const batchSize = options.batchSize === null ? undefined : (options.batchSize ?? exports.DEFAULT_RENAME_BATCH_SIZE);
+        if (oldName !== undefined && oldName === '') {
+            throw new error_1.DBOSError("The application's previous name cannot be empty.");
+        }
+        if (oldName === undefined && !adoptUnclaimedRows) {
+            throw new error_1.DBOSError('Nothing to re-own: name the application to rename, adopt unclaimed rows, or both.');
+        }
+        if (oldName === newName) {
+            throw new error_1.DBOSError(`Application '${newName}' already holds that name; nothing to rename.`);
+        }
+        // A NaN survives a bare `< 1` test and would only fail once it reached SQL, leaving the rename half-applied.
+        if (batchSize !== undefined && (!Number.isInteger(batchSize) || batchSize < 1)) {
+            throw new error_1.DBOSError(`batchSize must be a positive integer, got ${batchSize}`);
+        }
+        // Never a merge: queue, schedule, and version names are globally unique whatever their owner, so this cannot collide.
+        const client = await this.pool.connect();
+        let queues, schedules, versions, inFlight;
+        try {
+            await client.query('BEGIN');
+            const move = async (table, statuses) => {
+                const params = [newName];
+                let where = this.#renameSource(oldName, adoptUnclaimedRows, params);
+                if (statuses !== undefined) {
+                    params.push(statuses);
+                    where = `${where} AND status = ANY($${params.length})`;
+                }
+                const res = await client.query(`UPDATE "${this.schemaName}".${table} SET application_name = $1 WHERE ${where}`, params);
+                return res.rowCount ?? 0;
+            };
+            // A half-owned application dequeues work whose version row it can no longer see, so these move together.
+            queues = await move('queues');
+            schedules = await move('workflow_schedules');
+            versions = await move('application_versions');
+            inFlight = await move('workflow_status', [workflow_1.StatusString.PENDING, workflow_1.StatusString.ENQUEUED, workflow_1.StatusString.DELAYED]);
+            await client.query('COMMIT');
+        }
+        catch (e) {
+            await client.query('ROLLBACK');
+            throw e;
+        }
+        finally {
+            client.release();
+        }
+        // Only terminal rows are left to match, and they scope observability and GC alone, so they may lag behind the commit above.
+        const terminal = await this.#renameRowsInBatches('workflow_status', 'workflow_uuid', oldName, newName, batchSize, adoptUnclaimedRows);
+        const steps = await this.#renameRowsInBatches('operation_outputs', 'workflow_uuid', oldName, newName, batchSize, adoptUnclaimedRows);
+        return { queues, schedules, versions, workflows: inFlight + terminal, steps };
+    }
     // ==================== Internal ====================
     async insertWorkflowStatus(client, initStatus, ownerXid, incrementAttempts = false) {
         try {
@@ -3206,8 +3585,9 @@ class SystemDatabase {
           attributes,
           schedule_name,
           debounce_deadline_epoch_ms,
-          is_debounced
-        ) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $26, $27, $28, $29, $30, $31, $32)
+          is_debounced,
+          application_name
+        ) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $26, $27, $28, $29, $30, $31, $32, $33)
         ON CONFLICT (workflow_uuid)
           DO UPDATE SET
             recovery_attempts = CASE
@@ -3255,6 +3635,8 @@ class SystemDatabase {
                 initStatus.scheduleName ?? null,
                 initStatus.debounceDeadlineEpochMS ?? null,
                 initStatus.isDebounced ?? false,
+                // Absent from the conflict update: a re-enqueue must not re-own a claimed row.
+                initStatus.applicationName ?? null,
             ]);
             if (rows.length === 0) {
                 throw new Error(`Attempt to insert workflow ${initStatus.workflowUUID} failed`);
@@ -3342,8 +3724,8 @@ class SystemDatabase {
     async recordOperationResultInternal(client, workflowID, functionID, functionName, checkConflict, startTimeEpochMs, endTimeEpochMs, options = {}) {
         try {
             const out = await client.query(`INSERT INTO ${this.schemaName}.operation_outputs
-         (workflow_uuid, function_id, output, error, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms, serialization)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+         (workflow_uuid, function_id, output, error, function_name, child_workflow_id, started_at_epoch_ms, completed_at_epoch_ms, serialization, application_name)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
          ON CONFLICT (workflow_uuid, function_id) DO UPDATE
          SET completed_at_epoch_ms = operation_outputs.completed_at_epoch_ms
          RETURNING completed_at_epoch_ms;`, [
@@ -3356,6 +3738,8 @@ class SystemDatabase {
                 startTimeEpochMs,
                 endTimeEpochMs,
                 options.serialization ?? null,
+                // Mirrors the parent: only the running application records its steps.
+                this.appName ?? null,
             ]);
             if (checkConflict &&
                 (out?.rowCount ?? 0) > 0 &&
@@ -3457,10 +3841,35 @@ class SystemDatabase {
      * workflow listener by resolving its promise.
      */
     reconnectTimeout = null;
+    #notificationsStopped = false;
+    // Disown the client and release it once; a late socket error must not re-enter this path and release again.
+    #retireNotificationsClient(client) {
+        if (this.notificationsClient === client) {
+            this.notificationsClient = null;
+        }
+        client.removeAllListeners();
+        // Errors can still arrive while release() tears the connection down; a bare emit would crash the process.
+        client.on('error', () => { });
+        try {
+            client.release(true);
+        }
+        catch (e) {
+            this.logger.warn(`Error releasing notifications client: ${String(e)}`);
+        }
+    }
+    // Shutdown can begin during any await in the setup below; releasing the client instead of carrying on
+    // keeps pool.end() from waiting on a connection that will never be published.
+    #abandonIfStopped(client) {
+        if (!this.#notificationsStopped) {
+            return false;
+        }
+        this.#retireNotificationsClient(client);
+        return true;
+    }
     async #listenForNotifications() {
         const connect = async () => {
             const reconnect = () => {
-                if (this.reconnectTimeout) {
+                if (this.reconnectTimeout || this.#notificationsStopped) {
                     return;
                 }
                 this.reconnectTimeout = setTimeout(async () => {
@@ -3468,12 +3877,24 @@ class SystemDatabase {
                     await connect();
                 }, 1000);
             };
-            let client = null;
+            let acquired = null;
             try {
-                client = await this.pool.connect();
+                const client = await this.pool.connect();
+                acquired = client;
+                if (this.#abandonIfStopped(client))
+                    return;
+                // Catch errors during setup
+                const setup = { error: null };
+                const onSetupError = (err) => {
+                    setup.error = err;
+                };
+                client.on('error', onSetupError);
                 await client.query(`LISTEN ${exports.DBOS_NOTIFICATIONS_CHANNEL};`);
                 await client.query(`LISTEN ${exports.DBOS_WORKFLOW_EVENTS_CHANNEL};`);
                 await client.query(`LISTEN ${exports.DBOS_STREAMS_CHANNEL};`);
+                // The self-test's NOTIFY needs a second client, which can queue forever on an ending pool.
+                if (this.#abandonIfStopped(client))
+                    return;
                 // Self-test: verify LISTEN actually works by sending a NOTIFY and checking it arrives.
                 // If a transaction-mode pooler (e.g. PgBouncer pool_mode=transaction) is in the path,
                 // LISTEN succeeds but the subscription is silently lost when the backend is released.
@@ -3485,10 +3906,16 @@ class SystemDatabase {
                 };
                 client.on('notification', onSelfTest);
                 await this.pool.query("NOTIFY dbos_notifications_channel, 'dbos_listen_selftest'");
-                for (let i = 0; i < 30 && !selfTestReceived; i++) {
+                for (let i = 0; i < 30 && !selfTestReceived && !setup.error && !this.#notificationsStopped; i++) {
                     await new Promise((r) => setTimeout(r, 100));
                 }
                 client.removeListener('notification', onSelfTest);
+                // Both checked before the warning below, so an abandoned self-test is not reported as a pooler problem.
+                if (this.#abandonIfStopped(client))
+                    return;
+                if (setup.error) {
+                    throw setup.error;
+                }
                 if (!selfTestReceived) {
                     this.logger.warn('LISTEN/NOTIFY self-test failed: notification was not received within 3 seconds. ' +
                         'This typically means the connection is going through a transaction-mode pooler ' +
@@ -3508,28 +3935,19 @@ class SystemDatabase {
                         this.streamsMap.callCallbacks(msg.payload);
                     }
                 };
+                client.removeListener('error', onSetupError);
                 client.on('notification', handler);
                 client.on('error', (err) => {
                     this.logger.warn(`Error in notifications client: ${err}`);
-                    if (this.notificationsClient === client) {
-                        this.notificationsClient = null;
-                    }
-                    if (client) {
-                        client.removeAllListeners();
-                        // Errors can still arrive while release() tears the connection down; a bare emit would crash the process.
-                        client.on('error', () => { });
-                        client.release(true);
-                    }
+                    this.#retireNotificationsClient(client);
                     reconnect();
                 });
                 this.notificationsClient = client;
             }
             catch (error) {
                 this.logger.warn(`Error in notifications listener: ${String(error)}`);
-                if (client) {
-                    client.removeAllListeners();
-                    client.on('error', () => { });
-                    client.release(true);
+                if (acquired) {
+                    this.#retireNotificationsClient(acquired);
                 }
                 reconnect();
             }
@@ -3697,7 +4115,13 @@ __decorate([
 __decorate([
     dbRetry(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [Number]),
+    __metadata("design:returntype", Promise)
+], SystemDatabase.prototype, "listTimedOutWorkflowIds", null);
+__decorate([
+    dbRetry(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Array]),
     __metadata("design:returntype", Promise)
 ], SystemDatabase.prototype, "getMetrics", null);
 //# sourceMappingURL=system_database.js.map