@fabricorg/platform-host 4.0.0 → 6.0.0

package/dist/index.js

@@ -1,4 +1,5 @@
-import { AdapterRegistry, createFabricId, assertGovernanceRuntimeEvidence, FABRIC_GOVERNANCE_CONTRACT_VERSION, assertMutationGovernanceContext, evaluatePolicyDefinitions, aggregatePolicyOutcomes, validateStateMachineTransition, executeWithAdapterRetry } from '@fabricorg/platform';
+import { AdapterRegistry, createFabricId, assertGovernanceRuntimeEvidence, FABRIC_GOVERNANCE_CONTRACT_VERSION, assertMutationGovernanceContext, evaluatePolicyDefinitions, aggregatePolicyOutcomes, evaluateStateMachineTransition, executeWithAdapterRetry, assertAdapterOutcomeConsistency } from '@fabricorg/platform';
+import { assertAssemblyRuntimeCompatible } from '@fabricorg/assembly';
 import { createHash } from 'crypto';
 
 // src/host.ts
@@ -62,6 +63,213 @@ function normalizeProvenance(input, options) {
   };
 }
 
+// src/observability.ts
+var PLATFORM_HOST_HEALTH_CONTRACT_VERSION = 1;
+var PLATFORM_HOST_METRIC_NAMES = {
+  workerCyclesStarted: "fabric.platform.worker.cycles.started",
+  workerCyclesCompleted: "fabric.platform.worker.cycles.completed",
+  workerCyclesFailed: "fabric.platform.worker.cycles.failed",
+  invocationSubmitted: "fabric.platform.invocation.submitted",
+  invocationExecutionStarted: "fabric.platform.invocation.execution_started",
+  invocationLeaseClaimed: "fabric.platform.invocation.lease_claimed",
+  invocationCompleted: "fabric.platform.invocation.completed",
+  invocationFailed: "fabric.platform.invocation.failed",
+  invocationPolicyBlocked: "fabric.platform.invocation.policy_blocked",
+  invocationValidationFailed: "fabric.platform.invocation.validation_failed",
+  invocationApprovalWaited: "fabric.platform.invocation.approval_waited",
+  invocationReconciliationRequired: "fabric.platform.invocation.reconciliation_required",
+  outboxRelayCyclesStarted: "fabric.platform.outbox.relay_cycles.started",
+  outboxRelayCyclesCompleted: "fabric.platform.outbox.relay_cycles.completed",
+  outboxRelayCyclesFailed: "fabric.platform.outbox.relay_cycles.failed",
+  outboxLeaseClaimed: "fabric.platform.outbox.lease_claimed",
+  outboxPublished: "fabric.platform.outbox.published",
+  outboxFailed: "fabric.platform.outbox.failed",
+  outboxDeadLettered: "fabric.platform.outbox.dead_lettered",
+  invocationBacklog: "fabric.platform.invocation.backlog",
+  invocationRunning: "fabric.platform.invocation.running",
+  invocationExpiredLeases: "fabric.platform.invocation.expired_leases",
+  invocationApprovalWaits: "fabric.platform.invocation.approval_waits",
+  invocationReconciliationRequiredGauge: "fabric.platform.invocation.reconciliation_required.count",
+  outboxBacklog: "fabric.platform.outbox.backlog",
+  outboxExpiredLeases: "fabric.platform.outbox.expired_leases",
+  outboxDeadLetters: "fabric.platform.outbox.dead_letters"
+};
+function emitPlatformHostTelemetry(telemetry, input) {
+  if (!telemetry) return;
+  const record = input.kind === "event" ? { ...input, metricType: "counter", occurredAt: input.occurredAt ?? /* @__PURE__ */ new Date() } : { ...input, observedAt: input.observedAt ?? /* @__PURE__ */ new Date() };
+  try {
+    const result = typeof telemetry === "function" ? telemetry(record) : telemetry.record(record);
+    if (isPromiseLike(result)) void result.catch(() => void 0);
+  } catch {
+  }
+}
+async function getPlatformHostHealthSnapshot(options) {
+  const generatedAt = options.now?.() ?? /* @__PURE__ */ new Date();
+  const workerSummary = summarizeWorkers(options.workers ?? [], generatedAt);
+  const scope = {
+    ...options.tenantId ? { tenantId: options.tenantId } : {},
+    ...options.spaceId ? { spaceId: options.spaceId } : {}
+  };
+  try {
+    const counts = await readHealthCounts(options.store, {
+      ...options.tenantId ? { tenantId: options.tenantId } : {},
+      ...options.spaceId ? { spaceId: options.spaceId } : {},
+      now: generatedAt
+    });
+    const snapshot = createHealthSnapshot(
+      generatedAt,
+      scope,
+      counts,
+      workerSummary,
+      true
+    );
+    emitHealthMetrics(options.telemetry, snapshot);
+    return snapshot;
+  } catch {
+    const snapshot = createHealthSnapshot(
+      generatedAt,
+      scope,
+      zeroHealthCounts(),
+      workerSummary,
+      false
+    );
+    emitHealthMetrics(options.telemetry, snapshot);
+    return snapshot;
+  }
+}
+async function readHealthCounts(store, query) {
+  const candidate = store;
+  if (typeof candidate.getHealthCounts === "function") {
+    return assertHealthCounts(await candidate.getHealthCounts(query));
+  }
+  const recoverable = store;
+  const outbox = store;
+  if (typeof recoverable.listActionInvocations !== "function") {
+    throw new Error("Health counts are not supported by this store.");
+  }
+  const invocations = await recoverable.listActionInvocations({
+    ...query.tenantId ? { tenantId: query.tenantId } : {},
+    ...query.spaceId ? { spaceId: query.spaceId } : {},
+    limit: Number.MAX_SAFE_INTEGER
+  });
+  const outboxRecords = typeof outbox.listOutbox === "function" ? await outbox.listOutbox({
+    ...query.tenantId ? { tenantId: query.tenantId } : {},
+    ...query.spaceId ? { spaceId: query.spaceId } : {}
+  }) : [];
+  return countsFromRecords(invocations, outboxRecords, query.now);
+}
+function countsFromRecords(invocations, outbox, now) {
+  return {
+    invocationBacklog: invocations.filter((item) => item.status === "pending").length,
+    invocationRunning: invocations.filter((item) => item.status === "running").length,
+    invocationExpiredLeases: invocations.filter(
+      (item) => item.status === "running" && item.leaseExpiresAt !== void 0 && item.leaseExpiresAt.getTime() <= now.getTime()
+    ).length,
+    invocationApprovalWaits: invocations.filter((item) => item.status === "waiting_for_approval").length,
+    invocationReconciliationRequired: invocations.filter((item) => item.status === "reconciliation_required").length,
+    outboxBacklog: outbox.filter((item) => item.status === "pending").length,
+    outboxExpiredLeases: outbox.filter(
+      (item) => item.status === "pending" && item.leaseExpiresAt !== void 0 && item.leaseExpiresAt.getTime() <= now.getTime()
+    ).length,
+    outboxDeadLetters: outbox.filter((item) => item.status === "dead_letter").length
+  };
+}
+function assertHealthCounts(value) {
+  for (const [name, count] of Object.entries(value)) {
+    if (!Number.isSafeInteger(count) || count < 0) {
+      throw new Error(`Invalid health count: ${name}`);
+    }
+  }
+  return value;
+}
+function zeroHealthCounts() {
+  return {
+    invocationBacklog: 0,
+    invocationRunning: 0,
+    invocationExpiredLeases: 0,
+    invocationApprovalWaits: 0,
+    invocationReconciliationRequired: 0,
+    outboxBacklog: 0,
+    outboxExpiredLeases: 0,
+    outboxDeadLetters: 0
+  };
+}
+function summarizeWorkers(workers, now) {
+  let healthy = 0;
+  let stale = 0;
+  for (const worker of workers) {
+    if (Number.isFinite(worker.staleAfterMs) && worker.staleAfterMs >= 0 && worker.lastHeartbeatAt.getTime() + worker.staleAfterMs >= now.getTime()) healthy += 1;
+    else stale += 1;
+  }
+  return { reported: workers.length, healthy, stale };
+}
+function createHealthSnapshot(generatedAt, scope, counts, workers, dataAvailable) {
+  const reasonCodes = [];
+  if (!dataAvailable) reasonCodes.push("health_source_unavailable");
+  if (workers.stale > 0) reasonCodes.push("workers_stale");
+  if (counts.invocationExpiredLeases > 0) reasonCodes.push("invocation_expired_leases");
+  if (counts.outboxExpiredLeases > 0) reasonCodes.push("outbox_expired_leases");
+  if (counts.outboxDeadLetters > 0) reasonCodes.push("outbox_dead_letters");
+  if (counts.invocationReconciliationRequired > 0) reasonCodes.push("reconciliation_required");
+  const unhealthy = !dataAvailable;
+  const degraded = unhealthy || reasonCodes.length > 0;
+  return {
+    contractVersion: PLATFORM_HOST_HEALTH_CONTRACT_VERSION,
+    generatedAt,
+    scope,
+    dataAvailable,
+    status: unhealthy ? "unhealthy" : degraded ? "degraded" : "healthy",
+    readiness: {
+      ready: dataAvailable && workers.stale === 0,
+      reasonCodes
+    },
+    workers,
+    invocations: {
+      backlog: counts.invocationBacklog,
+      running: counts.invocationRunning,
+      expiredLeases: counts.invocationExpiredLeases,
+      approvalWaits: counts.invocationApprovalWaits,
+      reconciliationRequired: counts.invocationReconciliationRequired
+    },
+    outbox: {
+      backlog: counts.outboxBacklog,
+      expiredLeases: counts.outboxExpiredLeases,
+      deadLetters: counts.outboxDeadLetters
+    }
+  };
+}
+function emitHealthMetrics(telemetry, snapshot) {
+  const scope = {
+    ...snapshot.scope.tenantId ? { tenantId: snapshot.scope.tenantId } : {},
+    ...snapshot.scope.spaceId ? { spaceId: snapshot.scope.spaceId } : {}
+  };
+  const metrics = [
+    [PLATFORM_HOST_METRIC_NAMES.invocationBacklog, snapshot.invocations.backlog],
+    [PLATFORM_HOST_METRIC_NAMES.invocationRunning, snapshot.invocations.running],
+    [PLATFORM_HOST_METRIC_NAMES.invocationExpiredLeases, snapshot.invocations.expiredLeases],
+    [PLATFORM_HOST_METRIC_NAMES.invocationApprovalWaits, snapshot.invocations.approvalWaits],
+    [PLATFORM_HOST_METRIC_NAMES.invocationReconciliationRequiredGauge, snapshot.invocations.reconciliationRequired],
+    [PLATFORM_HOST_METRIC_NAMES.outboxBacklog, snapshot.outbox.backlog],
+    [PLATFORM_HOST_METRIC_NAMES.outboxExpiredLeases, snapshot.outbox.expiredLeases],
+    [PLATFORM_HOST_METRIC_NAMES.outboxDeadLetters, snapshot.outbox.deadLetters]
+  ];
+  for (const [name, value] of metrics) {
+    emitPlatformHostTelemetry(telemetry, {
+      kind: "metric",
+      name,
+      metricType: "gauge",
+      value,
+      ...scope,
+      observedAt: snapshot.generatedAt
+    });
+  }
+}
+function isPromiseLike(value) {
+  return Boolean(
+    value && typeof value === "object" && "then" in value && typeof value.then === "function"
+  );
+}
+
 // src/host.ts
 var DEFAULT_EXTRACT_EVENTS = (data) => {
   const value = data._events;
@@ -71,6 +279,19 @@ var RecoverableFinalizationError = class extends Error {
   name = "RecoverableFinalizationError";
 };
 function createGovernedActionHost(options) {
+  if (options.composition) {
+    if (!options.registry?.orderedModules) {
+      throw new Error("Composition-bound Platform Host requires an explicit module registry.");
+    }
+    assertAssemblyRuntimeCompatible(
+      options.composition.assembly,
+      options.registry.orderedModules.map((module) => ({
+        namespace: module.namespace,
+        version: module.version ?? "",
+        manifestDigest: module.manifestDigest ?? ""
+      }))
+    );
+  }
   if (options.outbox) {
     const outboxStore = asOutboxStore(options.store);
     if (!outboxStore || !asAtomicMutationStore(options.store) || outboxStore.transactionalOutbox !== true) {
@@ -92,6 +313,12 @@ function createGovernedActionHost(options) {
     }
     const action = actionResolver(input.actionId);
     if (!action) throw new Error(`Unknown action: ${input.actionId}`);
+    if (action.execution?.connectivity === "online-required" && input.executionReason === "offline_replay") {
+      throw new Error(`Action ${input.actionId} is online-required and cannot be submitted as an offline replay.`);
+    }
+    if (action.execution?.sensitivity === "restricted" && Object.keys(input.provenance?.auditAttributes ?? {}).length > 0) {
+      throw new Error(`Action ${input.actionId} declares restricted sensitivity; provenance audit attributes must not be durably recorded.`);
+    }
     const authorizationInput = toAuthorizationInput(action, input);
     if (!await options.authorization.checkEntitlement(authorizationInput)) {
       throw new Error(`Module "${action.namespace}" is not enabled for tenant ${input.tenantId}`);
@@ -110,10 +337,13 @@ function createGovernedActionHost(options) {
       input.provenance,
       options.provenance
     );
+    const initiatingReleaseDigest = await options.composition?.resolveInitiatingReleaseDigest?.(input);
     const runtimeEvidence = {
       governanceContractVersion: FABRIC_GOVERNANCE_CONTRACT_VERSION,
       hostContractVersion: PLATFORM_HOST_CONTRACT_VERSION,
-      ...options.runtimeEvidence
+      ...options.runtimeEvidence,
+      ...options.composition ? { assemblyDigest: options.composition.assembly.assemblyDigest } : {},
+      ...initiatingReleaseDigest ? { initiatingReleaseDigest } : {}
     };
     assertGovernanceRuntimeEvidence(runtimeEvidence);
     const durableInvocation = await options.store.createActionInvocation({
@@ -142,6 +372,15 @@ function createGovernedActionHost(options) {
       ...input.executionReason ? { executionReason: input.executionReason } : {},
       ...input.authorizationBindingId ? { authorizationBindingId: input.authorizationBindingId } : {}
     });
+    emitPlatformHostTelemetry(options.telemetry, {
+      kind: "event",
+      name: "invocation.submitted",
+      metricName: PLATFORM_HOST_METRIC_NAMES.invocationSubmitted,
+      occurredAt: now(),
+      tenantId: input.tenantId,
+      spaceId: input.spaceId,
+      attributes: { actionVersion: action.version }
+    });
     if (durableInvocation.id !== actionInvocationId && input.idempotencyKey) {
       const conflict = idempotencyConflict(durableInvocation, {
         actorId: input.actorId,
@@ -164,7 +403,24 @@ function createGovernedActionHost(options) {
     }
     const durableWorkflowId = `action-invocation-${durableInvocation.id}`;
     if (durableInvocation.id !== actionInvocationId) {
-      return {
+      if (options.dispatcher && durableInvocation.status === "pending") {
+        const dispatched = await options.dispatcher.dispatch({
+          actionInvocationId: durableInvocation.id,
+          actionId: durableInvocation.actionId,
+          tenantId: input.tenantId,
+          spaceId: input.spaceId,
+          workflowId: durableWorkflowId
+        });
+        return withConsistency({
+          actionInvocationId: durableInvocation.id,
+          status: durableInvocation.status,
+          workflowId: dispatched.workflowId,
+          ...dispatched.runId ? { runId: dispatched.runId } : {},
+          ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
+          ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
+        }, input.actionId);
+      }
+      return withConsistency({
         actionInvocationId: durableInvocation.id,
         status: durableInvocation.status,
         workflowId: durableWorkflowId,
@@ -172,33 +428,28 @@ function createGovernedActionHost(options) {
         ...durableInvocation.error ? { error: durableInvocation.error } : {},
         ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
         ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {},
-        ...durableInvocation.authorizationReconciliation ? { reconciliation: durableInvocation.authorizationReconciliation } : {}
-      };
+        ...durableInvocation.authorizationReconciliation ? { reconciliation: durableInvocation.authorizationReconciliation } : {},
+        ...durableInvocation.adapterReconciliation ? { adapterReconciliation: durableInvocation.adapterReconciliation } : {}
+      }, input.actionId);
     }
     if (options.dispatcher) {
       try {
         const dispatched = await options.dispatcher.dispatch({
           actionInvocationId: durableInvocation.id,
+          actionId: durableInvocation.actionId,
           tenantId: input.tenantId,
           spaceId: input.spaceId,
           workflowId: durableWorkflowId
         });
-        return {
+        return withConsistency({
           actionInvocationId: durableInvocation.id,
           status: durableInvocation.status,
           workflowId: dispatched.workflowId,
           ...dispatched.runId ? { runId: dispatched.runId } : {},
           ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
           ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
-        };
+        }, input.actionId);
       } catch (error) {
-        const message = errorMessage(error);
-        await options.store.updateActionInvocation(
-          durableInvocation.id,
-          input.tenantId,
-          input.spaceId,
-          { status: "failed", error: message }
-        );
         throw error;
       }
     }
@@ -207,7 +458,7 @@ function createGovernedActionHost(options) {
       input.tenantId,
       input.spaceId
     );
-    return { ...executed, workflowId: durableWorkflowId };
+    return { ...withConsistency(executed, input.actionId), workflowId: durableWorkflowId };
   }
   async function executeInvocation(actionInvocationId, tenantId, spaceId, executionOptions = {}, executionReasonOverride) {
     const loadedInvocation = await options.store.getActionInvocation(
@@ -221,18 +472,32 @@ function createGovernedActionHost(options) {
     const resumingRunningInvocation = loadedInvocation.status === "running";
     let invocation = loadedInvocation;
     if (isTerminal(invocation.status) || invocation.status === "waiting_for_approval") {
-      return actionResult(invocation);
+      return withConsistency(actionResult(invocation), invocation.actionId);
     }
-    if (invocation.status === "running" && invocation.leaseOwner && executionOptions.leaseOwner !== invocation.leaseOwner) {
+    if (invocation.status === "running" && invocation.leaseOwner && (executionOptions.leaseOwner !== invocation.leaseOwner || (invocation.leaseToken ?? 0) > 0 && executionOptions.leaseToken !== invocation.leaseToken)) {
       return {
         ...actionResult(invocation),
-        error: `Invocation is leased by ${invocation.leaseOwner}`
+        error: `Invocation lease is not owned by the supplied worker generation`
       };
     }
     const action = actionResolver(invocation.actionId);
     if (!action) {
       return fail(invocation, "failed", `Unknown action: ${invocation.actionId}`);
     }
+    if (action.kind === "saga") {
+      return fail(
+        invocation,
+        "failed",
+        `Saga action ${invocation.actionId} requires a durable PlatformActionDispatcher and cannot execute as an atomic Host action.`
+      );
+    }
+    if (resumingRunningInvocation && invocation.attemptCount === 0 && !invocation.leaseOwner && !action.idempotent) {
+      return fail(
+        invocation,
+        "failed",
+        `Interrupted inline action ${invocation.actionId} is not declared idempotent; manual reconciliation is required.`
+      );
+    }
     if (invocation.attemptCount > 1 && !action.idempotent) {
       return fail(
         invocation,
@@ -245,6 +510,15 @@ function createGovernedActionHost(options) {
         status: "running"
       });
     }
+    emitPlatformHostTelemetry(options.telemetry, {
+      kind: "event",
+      name: "invocation.execution_started",
+      metricName: PLATFORM_HOST_METRIC_NAMES.invocationExecutionStarted,
+      occurredAt: now(),
+      tenantId,
+      spaceId,
+      attributes: { actionVersion: invocation.actionVersion }
+    });
     try {
       const parsed = action.schema.safeParse(invocation.parameters);
       if (!parsed.success) {
@@ -310,7 +584,7 @@ function createGovernedActionHost(options) {
           );
         }
         if ((invocation.hitlRoute === "needs-approval" || invocation.hitlRoute === "escalate") && !invocation.approvalDecision?.approved) {
-          await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, {
+          await persistInvocation(invocation, {
             status: "waiting_for_approval"
           });
           return {
@@ -337,8 +611,8 @@ function createGovernedActionHost(options) {
           ...invocation.provenance ? { provenance: invocation.provenance } : {},
           message: `Action ${action.actionId} requires durable capture-time authorization evidence`
         };
-        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
-        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
+        await persistInvocation(invocation, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return withConsistency({ actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation }, action.actionId);
       }
       const bindingExpired = authorityMoment !== "capture" && invocation.authorizationBinding?.expiresAt !== void 0 && Date.parse(invocation.authorizationBinding.expiresAt) <= now().getTime();
       if (bindingExpired) {
@@ -350,8 +624,8 @@ function createGovernedActionHost(options) {
           ...invocation.provenance ? { provenance: invocation.provenance } : {},
           message: `Authorization binding for action ${action.actionId} expired before execution`
         };
-        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
-        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
+        await persistInvocation(invocation, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return withConsistency({ actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation }, action.actionId);
       }
       const executionAuthorized = authorityMoment === "capture" ? invocation.authorizationBinding !== void 0 : options.authorization.authorizeExecution ? await options.authorization.authorizeExecution({
         ...authorizationInput,
@@ -372,8 +646,8 @@ function createGovernedActionHost(options) {
           ...invocation.provenance ? { provenance: invocation.provenance } : {},
           message: `Actor ${invocation.actorId} is not authorized to execute action ${action.actionId}`
         };
-        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
-        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
+        await persistInvocation(invocation, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return withConsistency({ actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation }, action.actionId);
       }
       const definitions = options.resolvePolicies ? await options.resolvePolicies({
         ...authorizationInput,
@@ -434,30 +708,6 @@ function createGovernedActionHost(options) {
           })));
         }
       }
-      const binding = action.stateMachine;
-      if (binding) {
-        const entityId = binding.getEntityId(parsed.data);
-        const currentState = entityId ? await options.store.getEntityState(
-          tenantId,
-          spaceId,
-          binding.entityType,
-          entityId
-        ) ?? initialState(stateMachineResolver(binding.entityType)) : initialState(stateMachineResolver(binding.entityType));
-        const targetState = typeof binding.targetState === "function" ? binding.targetState(parsed.data) : binding.targetState;
-        if (targetState !== "") {
-          const transition = validateStateMachineTransition(
-            stateMachineResolver(binding.entityType),
-            binding.entityType,
-            currentState,
-            targetState,
-            action.actionId
-          );
-          const replayingAppliedTransition = action.idempotent && currentState === targetState;
-          if (!transition.valid && !replayingAppliedTransition) {
-            return fail(invocation, "failed", transition.error ?? "Invalid state transition");
-          }
-        }
-      }
       let data;
       let domainEvents = [];
       try {
@@ -465,6 +715,42 @@ function createGovernedActionHost(options) {
           if (options.outbox && !transaction?.appendEventWithOutbox) {
             throw new Error("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
           }
+          const binding = action.stateMachine;
+          if (binding) {
+            const machine = stateMachineResolver(binding.entityType);
+            const entityId = binding.getEntityId(parsed.data);
+            const getEntityState = transaction?.getEntityState ? transaction.getEntityState.bind(transaction) : options.store.getEntityState.bind(options.store);
+            const currentState = entityId ? await getEntityState(
+              tenantId,
+              spaceId,
+              binding.entityType,
+              entityId
+            ) ?? initialState(machine) : initialState(machine);
+            const targetState = typeof binding.targetState === "function" ? binding.targetState(parsed.data) : binding.targetState;
+            if (targetState !== "") {
+              const transition = await evaluateStateMachineTransition(
+                machine,
+                binding.entityType,
+                currentState,
+                targetState,
+                action.actionId,
+                {
+                  entity: {
+                    ...entityId ? { id: entityId } : {},
+                    state: currentState
+                  },
+                  actionInvocationId,
+                  actorId: invocation.actorId,
+                  parameters: parsed.data,
+                  db
+                }
+              );
+              const replayingAppliedTransition = action.idempotent && currentState === targetState;
+              if (!transition.valid && !replayingAppliedTransition) {
+                throw new Error(transition.error ?? "Invalid state transition");
+              }
+            }
+          }
           const handlerResult = action.handler ? await action.handler(
             {
               actionInvocationId,
@@ -564,7 +850,21 @@ function createGovernedActionHost(options) {
           subjectId: adapterEventSubject.subjectId,
           payload: { adapterType: step.adapterType, operation: step.operation }
         }, `adapter:${stepIndex}:started`);
+        let adapterDeadlineTimer;
         try {
+          const adapterController = options.adapterDeadlineMs ? new AbortController() : void 0;
+          const deadlineMs = options.adapterDeadlineMs ? now().getTime() + options.adapterDeadlineMs : void 0;
+          if (adapterController && deadlineMs) {
+            const remaining = deadlineMs - now().getTime();
+            if (remaining <= 0) {
+              throw new Error(`Adapter deadline already expired before execution: ${step.adapterType}:${step.operation}`);
+            }
+            adapterDeadlineTimer = setTimeout(
+              () => adapterController.abort(new Error("Adapter deadline exceeded")),
+              remaining
+            );
+            adapterDeadlineTimer.unref?.();
+          }
           const result2 = await executeWithAdapterRetry({
             policy: step.retryPolicy ?? adapter.retryPolicy,
             defaultIdempotent: adapter.idempotent,
@@ -581,13 +881,77 @@ function createGovernedActionHost(options) {
                 correlationId: invocation.correlationId,
                 ...invocation.causationId ? { causationId: invocation.causationId } : {},
                 attempt,
-                maxAttempts
+                maxAttempts,
+                ...deadlineMs ? { deadlineMs } : {},
+                ...adapterController ? { signal: adapterController.signal } : {}
               });
             },
             isSuccessful: (result3) => result3.success,
-            getError: (result3) => result3.error
+            getError: (result3) => result3.error,
+            classifyOutcome: (result3) => result3.outcome ?? "transient_failure",
+            classifyThrownError: (error) => {
+              if (adapterController?.signal.aborted) return "timeout";
+              const message = error instanceof Error ? error.message : String(error);
+              if (/timeout|deadline|timed?\s*out/i.test(message)) return "timeout";
+              return "transient_failure";
+            }
           });
+          assertAdapterOutcomeConsistency(result2);
           if (!result2.success) {
+            const outcome = result2.outcome ?? "transient_failure";
+            if (outcome === "ambiguous") {
+              const evidence = result2.outcomeEvidence;
+              const message = result2.error ?? "Adapter outcome is ambiguous; external effect may or may not have been applied";
+              const adapterReconciliation = {
+                kind: "adapter_outcome_ambiguous",
+                adapterType: step.adapterType,
+                operation: step.operation,
+                vendor: adapter.vendor,
+                adapterInvocationId,
+                ...evidence?.reason ?? result2.error ? { reason: evidence?.reason ?? result2.error } : {},
+                ...evidence?.externalReference ? { externalReference: evidence.externalReference } : {},
+                message
+              };
+              await options.store.updateAdapterInvocation(adapterInvocationId, {
+                status: "ambiguous",
+                error: message,
+                updatedAt: now()
+              });
+              await appendEvent(invocation, {
+                eventType: "AdapterInvocationAmbiguous",
+                subjectType: adapterEventSubject.subjectType,
+                subjectId: adapterEventSubject.subjectId,
+                payload: {
+                  adapterType: step.adapterType,
+                  operation: step.operation,
+                  ...evidence?.externalReference ? { externalReference: evidence.externalReference } : {}
+                }
+              }, `adapter:${stepIndex}:ambiguous`);
+              const governanceStore2 = asGovernanceStore(options.store);
+              if (governanceStore2 && evidence) {
+                await governanceStore2.appendExternalReconciliation({
+                  id: lifecycleId("rec", actionInvocationId, `${adapter.vendor}:${adapterInvocationId}`),
+                  actionInvocationId,
+                  tenantId,
+                  spaceId,
+                  status: "pending",
+                  provider: adapter.vendor,
+                  ...evidence.externalReference ? { externalOperationId: evidence.externalReference } : {},
+                  attempt: 1,
+                  reason: message,
+                  observedAt: now()
+                });
+              }
+              await persistInvocation(invocation, {
+                status: "reconciliation_required",
+                error: message,
+                adapterReconciliation
+              });
+              return withConsistency(
+                { actionInvocationId, status: "reconciliation_required", error: message, adapterReconciliation },
+                action.actionId
+              );
+            }
             await options.store.updateAdapterInvocation(adapterInvocationId, {
               status: "failed",
               error: result2.error ?? "Adapter failed",
@@ -647,6 +1011,8 @@ function createGovernedActionHost(options) {
             updatedAt: now()
           });
           return fail(invocation, "failed", message);
+        } finally {
+          if (adapterDeadlineTimer) clearTimeout(adapterDeadlineTimer);
         }
       }
       const governanceStore = asGovernanceStore(options.store);
@@ -671,20 +1037,41 @@ function createGovernedActionHost(options) {
                 transaction
               );
             }
-            await transaction.updateActionInvocation(
-              actionInvocationId,
-              tenantId,
-              spaceId,
-              { status: "completed", result }
-            );
+            if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
+              if (!transaction.updateLeasedActionInvocation) {
+                throw new Error("Leased atomic finalization requires transaction-scoped fencing support.");
+              }
+              const updated = await transaction.updateLeasedActionInvocation({
+                id: actionInvocationId,
+                tenantId,
+                spaceId,
+                workerId: invocation.leaseOwner,
+                leaseToken: invocation.leaseToken,
+                patch: { status: "completed", result }
+              });
+              if (!updated) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
+            } else {
+              await transaction.updateActionInvocation(
+                actionInvocationId,
+                tenantId,
+                spaceId,
+                { status: "completed", result }
+              );
+            }
           });
+          emitInvocationStatusTelemetry(
+            invocation,
+            "completed",
+            options.telemetry,
+            now()
+          );
         } else {
           if (action.eventPhase === "after_adapters") {
             for (const [index, event] of domainEvents.entries()) {
               await appendEvent(invocation, event, `domain:${index}`, action.version);
             }
           }
-          await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, {
+          await persistInvocation(invocation, {
             status: "completed",
             result
           });
@@ -715,7 +1102,7 @@ function createGovernedActionHost(options) {
       spaceId
     );
     if (!invocation) throw new Error(`ActionInvocation not found: ${actionInvocationId}`);
-    if (isTerminal(invocation.status)) return actionResult(invocation);
+    if (isTerminal(invocation.status)) return withConsistency(actionResult(invocation), invocation.actionId);
     if (invocation.status !== "waiting_for_approval") {
       return {
         ...actionResult(invocation),
@@ -765,14 +1152,23 @@ function createGovernedActionHost(options) {
     const transitioned = transition.invocation ?? await options.store.getActionInvocation(actionInvocationId, tenantId, spaceId);
     if (!transition.applied || !transitioned) {
       if (!transitioned) throw new Error(`ActionInvocation not found: ${actionInvocationId}`);
-      return actionResult(transitioned);
+      return withConsistency(actionResult(transitioned), transitioned.actionId);
+    }
+    if (!decision.approved) {
+      emitInvocationStatusTelemetry(
+        transitioned,
+        "failed",
+        options.telemetry,
+        now(),
+        "waiting_for_approval"
+      );
+      return withConsistency(actionResult(transitioned), transitioned.actionId);
     }
-    if (!decision.approved) return actionResult(transitioned);
     return executeInvocation(
       actionInvocationId,
       tenantId,
       spaceId,
-      { leaseOwner },
+      { leaseOwner, leaseToken: transitioned.leaseToken },
       "approval_resume"
     );
   }
@@ -808,6 +1204,13 @@ function createGovernedActionHost(options) {
       spaceId
     });
   }
+  function declaredConsistency(actionId) {
+    return actionResolver(actionId)?.execution?.consistency;
+  }
+  function withConsistency(result, actionId) {
+    const consistency = declaredConsistency(actionId);
+    return consistency ? { ...result, consistency } : result;
+  }
   async function appendEvent(invocation, event, deduplicationKey, defaultEventSchemaVersion = 1, transaction) {
     const timestamp = now();
     const envelope = {
@@ -830,7 +1233,8 @@ function createGovernedActionHost(options) {
       recordedAt: timestamp,
       correlationId: invocation.correlationId,
       ...invocation.causationId ? { causationId: invocation.causationId } : {},
-      ...invocation.provenance ? { provenance: { source: invocation.provenance.source, ...invocation.provenance.auditAttributes ? { auditAttributes: invocation.provenance.auditAttributes } : {} } } : {}
+      ...invocation.provenance ? { provenance: { source: invocation.provenance.source, ...invocation.provenance.auditAttributes ? { auditAttributes: invocation.provenance.auditAttributes } : {} } } : {},
+      ...declaredConsistency(invocation.actionId) === "provisional-until-reconciled" ? { consistency: "provisional-until-reconciled" } : {}
     };
     if (options.outbox) {
       const hostLifecycleEvent = (/* @__PURE__ */ new Set(["AdapterInvocationStarted", "AdapterInvocationSucceeded", "AdapterInvocationFailed", "ComplianceBlocked"])).has(envelope.eventType);
@@ -860,12 +1264,7 @@ function createGovernedActionHost(options) {
     }
   }
   async function fail(invocation, status, error) {
-    await options.store.updateActionInvocation(
-      invocation.id,
-      invocation.tenantId,
-      invocation.spaceId,
-      { status, error }
-    );
+    await persistInvocation(invocation, { status, error });
     return {
       actionInvocationId: invocation.id,
       status,
@@ -874,6 +1273,33 @@ function createGovernedActionHost(options) {
       ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
     };
   }
+  async function persistInvocation(invocation, patch) {
+    const previousStatus = invocation.status;
+    if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
+      const recoverable = options.store;
+      if (!recoverable.updateLeasedActionInvocation) {
+        throw new Error("Leased execution requires a fencing-capable PlatformHostStore.");
+      }
+      const updated = await recoverable.updateLeasedActionInvocation({
+        id: invocation.id,
+        tenantId: invocation.tenantId,
+        spaceId: invocation.spaceId,
+        workerId: invocation.leaseOwner,
+        leaseToken: invocation.leaseToken,
+        patch
+      });
+      if (!updated) throw new RecoverableFinalizationError(`Invocation lease lost: ${invocation.id}`);
+      emitInvocationStatusTelemetry(invocation, patch.status, options.telemetry, now(), previousStatus);
+      return;
+    }
+    await options.store.updateActionInvocation(
+      invocation.id,
+      invocation.tenantId,
+      invocation.spaceId,
+      patch
+    );
+    emitInvocationStatusTelemetry(invocation, patch.status, options.telemetry, now(), previousStatus);
+  }
   return { submitAction, executeInvocation, resumeApprovedInvocation, recordExecutionAttestation, recordExternalReconciliation };
 }
 function actionResult(invocation) {
@@ -884,7 +1310,8 @@ function actionResult(invocation) {
     ...invocation.error ? { error: invocation.error } : {},
     ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
     ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {},
-    ...invocation.authorizationReconciliation ? { reconciliation: invocation.authorizationReconciliation } : {}
+    ...invocation.authorizationReconciliation ? { reconciliation: invocation.authorizationReconciliation } : {},
+    ...invocation.adapterReconciliation ? { adapterReconciliation: invocation.adapterReconciliation } : {}
   };
 }
 function asApprovalStore(store) {
@@ -938,6 +1365,24 @@ function initialState(machine) {
 function isTerminal(status) {
   return ["completed", "failed", "blocked_by_policy", "reconciliation_required", "validation_failed"].includes(status);
 }
+function emitInvocationStatusTelemetry(invocation, status, telemetry, occurredAt, previousStatus) {
+  if (!status) return;
+  const event = status === "completed" ? { name: "invocation.completed", metricName: PLATFORM_HOST_METRIC_NAMES.invocationCompleted } : status === "blocked_by_policy" ? { name: "invocation.policy_blocked", metricName: PLATFORM_HOST_METRIC_NAMES.invocationPolicyBlocked } : status === "validation_failed" ? { name: "invocation.validation_failed", metricName: PLATFORM_HOST_METRIC_NAMES.invocationValidationFailed } : status === "waiting_for_approval" ? { name: "invocation.approval_waited", metricName: PLATFORM_HOST_METRIC_NAMES.invocationApprovalWaited } : status === "reconciliation_required" ? { name: "invocation.reconciliation_required", metricName: PLATFORM_HOST_METRIC_NAMES.invocationReconciliationRequired } : status === "failed" ? { name: "invocation.failed", metricName: PLATFORM_HOST_METRIC_NAMES.invocationFailed } : void 0;
+  if (!event) return;
+  emitPlatformHostTelemetry(telemetry, {
+    kind: "event",
+    name: event.name,
+    metricName: event.metricName,
+    occurredAt,
+    tenantId: invocation.tenantId,
+    spaceId: invocation.spaceId,
+    attributes: {
+      ...invocation.actionId ? { actionId: invocation.actionId } : {},
+      ...invocation.actionVersion !== void 0 ? { actionVersion: invocation.actionVersion } : {},
+      ...previousStatus ? { fromStatus: previousStatus } : {}
+    }
+  });
+}
 function withoutPrivateHostFields(data, eventResultFields) {
   return Object.fromEntries(
     Object.entries(data).filter(([key]) => !eventResultFields.includes(key))
@@ -998,35 +1443,80 @@ function toEnterpriseEventEnvelope(event, metadata) {
     payloadClassification: metadata.payloadClassification,
     ...metadata.traceContext ? { traceContext: { ...metadata.traceContext } } : {},
     ...metadata.includeProvenance && event.provenance ? { provenance: event.provenance } : {},
+    // A provisional fact must stay marked as provisional once it leaves the platform.
+    ...event.consistency ? { consistency: event.consistency } : {},
     payload: event.payload
   };
 }
 async function runOutboxRelayCycle(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const maxAttempts = options.maxAttempts ?? 10;
-  const records = await options.store.claimOutbox({
-    workerId: options.workerId,
-    leaseDurationMs: options.leaseDurationMs ?? 3e4,
-    limit: options.batchSize ?? 100,
-    now: now()
-  });
+  const leaseDurationMs = options.leaseDurationMs ?? 3e4;
+  emitRelayTelemetry(options.telemetry, "outbox.relay.started", now(), options.workerId);
+  let records;
+  try {
+    records = await options.store.claimOutbox({
+      workerId: options.workerId,
+      leaseDurationMs,
+      limit: options.batchSize ?? 100,
+      now: now()
+    });
+  } catch (error) {
+    emitRelayTelemetry(options.telemetry, "outbox.relay.failed", now(), options.workerId);
+    throw error;
+  }
+  for (const record of records) {
+    emitPlatformHostTelemetry(options.telemetry, {
+      kind: "event",
+      name: "outbox.lease_claimed",
+      metricName: PLATFORM_HOST_METRIC_NAMES.outboxLeaseClaimed,
+      occurredAt: now(),
+      tenantId: record.tenantId,
+      spaceId: record.spaceId,
+      attributes: { attempt: record.attemptCount }
+    });
+  }
   const result = { claimed: records.length, published: 0, failed: 0, deadLettered: 0 };
   for (const record of records) {
+    const stopHeartbeat = startOutboxHeartbeat(options, record, leaseDurationMs);
     try {
-      await options.publisher.publish(record.event);
+      await publishWithTimeout(
+        options.publisher,
+        record.event,
+        options.publishTimeoutMs ?? 1e4
+      );
+      await stopHeartbeat();
       try {
-        await options.store.markOutboxPublished(record.id, options.workerId, now());
+        await options.store.markOutboxPublished(record.id, options.workerId, now(), record.leaseToken);
       } catch {
         result.failed += 1;
+        emitPlatformHostTelemetry(options.telemetry, {
+          kind: "event",
+          name: "outbox.failed",
+          metricName: PLATFORM_HOST_METRIC_NAMES.outboxFailed,
+          occurredAt: now(),
+          tenantId: record.tenantId,
+          spaceId: record.spaceId
+        });
         continue;
       }
       result.published += 1;
+      emitPlatformHostTelemetry(options.telemetry, {
+        kind: "event",
+        name: "outbox.published",
+        metricName: PLATFORM_HOST_METRIC_NAMES.outboxPublished,
+        occurredAt: now(),
+        tenantId: record.tenantId,
+        spaceId: record.spaceId
+      });
     } catch {
+      await stopHeartbeat();
       const deadLetter = record.attemptCount >= maxAttempts;
       try {
         await options.store.markOutboxFailed({
           id: record.id,
           workerId: options.workerId,
+          leaseToken: record.leaseToken,
           error: "Event publisher failed",
           availableAt: new Date(now().getTime() + (options.retryDelayMs?.(record.attemptCount) ?? 1e3)),
           deadLetter
@@ -1035,16 +1525,84 @@ async function runOutboxRelayCycle(options) {
       }
       result.failed += 1;
       if (deadLetter) result.deadLettered += 1;
+      emitPlatformHostTelemetry(options.telemetry, {
+        kind: "event",
+        name: deadLetter ? "outbox.dead_lettered" : "outbox.failed",
+        metricName: deadLetter ? PLATFORM_HOST_METRIC_NAMES.outboxDeadLettered : PLATFORM_HOST_METRIC_NAMES.outboxFailed,
+        occurredAt: now(),
+        tenantId: record.tenantId,
+        spaceId: record.spaceId,
+        attributes: { attempt: record.attemptCount }
+      });
     }
   }
+  emitRelayTelemetry(options.telemetry, "outbox.relay.completed", now(), options.workerId, {
+    claimed: result.claimed,
+    published: result.published,
+    failed: result.failed,
+    deadLettered: result.deadLettered
+  });
   return result;
 }
+async function publishWithTimeout(publisher, event, timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("publishTimeoutMs must be a positive finite number");
+  }
+  const controller = new AbortController();
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const error = new Error(`Event publisher timed out after ${timeoutMs}ms`);
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
+  });
+  try {
+    await Promise.race([publisher.publish(event, { signal: controller.signal }), timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function startOutboxHeartbeat(options, record, leaseDurationMs) {
+  if (!record.leaseToken) return async () => void 0;
+  const intervalMs = options.leaseRenewalIntervalMs ?? Math.max(1, Math.floor(leaseDurationMs / 3));
+  let stopped = false;
+  let timer;
+  let running;
+  const schedule = () => {
+    if (!stopped) timer = setTimeout(tick, intervalMs);
+  };
+  const tick = () => {
+    running = options.store.renewOutboxLease({
+      id: record.id,
+      workerId: options.workerId,
+      leaseToken: record.leaseToken,
+      leaseDurationMs
+    }).then(() => void 0).catch(() => void 0).finally(schedule);
+  };
+  schedule();
+  return async () => {
+    stopped = true;
+    if (timer) clearTimeout(timer);
+    await running;
+  };
+}
 function cloneOutboxRecord(record) {
   return {
     ...record,
     event: { ...record.event, ...record.event.traceContext ? { traceContext: { ...record.event.traceContext } } : {} }
   };
 }
+function emitRelayTelemetry(telemetry, name, occurredAt, workerId, attributes) {
+  const metricName = name === "outbox.relay.started" ? PLATFORM_HOST_METRIC_NAMES.outboxRelayCyclesStarted : name === "outbox.relay.completed" ? PLATFORM_HOST_METRIC_NAMES.outboxRelayCyclesCompleted : PLATFORM_HOST_METRIC_NAMES.outboxRelayCyclesFailed;
+  emitPlatformHostTelemetry(telemetry, {
+    kind: "event",
+    name,
+    metricName,
+    occurredAt,
+    attributes: { workerId, ...attributes }
+  });
+}
 
 // src/memory-store.ts
 var MemoryPlatformHostStore = class {
@@ -1087,12 +1645,33 @@ var MemoryPlatformHostStore = class {
       };
       const result = await run({
         db: this.db,
+        getActionInvocationForUpdate: async (id, tenantId, spaceId) => {
+          const record = await this.getActionInvocation(id, tenantId, spaceId);
+          return record ? structuredClone(record) : void 0;
+        },
+        getEvent: async (id, tenantId, spaceId) => pendingEvents.find((candidate) => candidate.event.id === id && candidate.event.tenantId === tenantId && candidate.event.spaceId === spaceId)?.event ?? this.events.find((event) => event.id === id && event.tenantId === tenantId && event.spaceId === spaceId),
         appendEvent: (event) => appendPending(event),
         appendEventWithOutbox: (event, metadata) => appendPending(event, metadata),
         nextEventSequence: async (tenantId, spaceId) => (await this.listEvents(tenantId, spaceId)).length + pendingEvents.filter((candidate) => candidate.event.tenantId === tenantId && candidate.event.spaceId === spaceId).length + 1,
         listEvents: async (tenantId, spaceId) => [...await this.listEvents(tenantId, spaceId), ...pendingEvents.map((candidate) => candidate.event).filter((event) => event.tenantId === tenantId && event.spaceId === spaceId)],
+        getEntityState: async (tenantId, spaceId, entityType, entityId) => {
+          let state = await this.getEntityState(tenantId, spaceId, entityType, entityId);
+          for (const pending of pendingEvents) {
+            const event = pending.event;
+            if (event.tenantId !== tenantId || event.spaceId !== spaceId || event.subjectType !== entityType || event.subjectId !== entityId) continue;
+            const candidate = event.payload?.toState;
+            if (typeof candidate === "string") state = candidate;
+          }
+          return state;
+        },
         updateActionInvocation: async (id, tenantId, spaceId, patch) => {
           pendingUpdates.push({ id, tenantId, spaceId, patch });
+        },
+        updateLeasedActionInvocation: async (input) => {
+          const record = await this.getActionInvocation(input.id, input.tenantId, input.spaceId);
+          if (!record || record.status !== "running" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken) return false;
+          pendingUpdates.push({ id: input.id, tenantId: input.tenantId, spaceId: input.spaceId, patch: input.patch });
+          return true;
         }
       });
       for (const update of pendingUpdates) {
@@ -1119,7 +1698,7 @@ var MemoryPlatformHostStore = class {
       if (existing) return existing;
     }
     const now = /* @__PURE__ */ new Date();
-    const record = { ...input, attemptCount: 0, createdAt: now, updatedAt: now };
+    const record = { ...input, attemptCount: 0, leaseToken: 0, createdAt: now, updatedAt: now };
     this.invocations.push(record);
     return record;
   }
@@ -1169,6 +1748,7 @@ var MemoryPlatformHostStore = class {
     record.error = void 0;
     record.leaseOwner = input.leaseOwner;
     record.leaseExpiresAt = new Date(input.now.getTime() + input.leaseDurationMs);
+    record.leaseToken = (record.leaseToken ?? 0) + 1;
     record.attemptCount = Math.max(record.attemptCount, 1);
     return { applied: true, invocation: record };
   }
@@ -1246,31 +1826,41 @@ var MemoryPlatformHostStore = class {
     return this.outbox.filter((record) => record.status === "pending" && record.availableAt <= current && (!record.leaseExpiresAt || record.leaseExpiresAt <= current) && (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId)).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime() || left.id.localeCompare(right.id)).slice(0, Math.max(1, Math.min(input.limit ?? 100, 1e3))).map((record) => {
       record.leaseOwner = input.workerId;
       record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+      record.leaseToken = (record.leaseToken ?? 0) + 1;
       record.attemptCount += 1;
       return cloneOutboxRecord(record);
     });
   }
-  async markOutboxPublished(id, workerId, publishedAt) {
-    const record = this.requireLeasedOutbox(id, workerId);
+  async markOutboxPublished(id, workerId, publishedAt, leaseToken) {
+    const record = this.requireLeasedOutbox(id, workerId, leaseToken);
     record.status = "published";
     record.publishedAt = publishedAt;
     delete record.leaseOwner;
     delete record.leaseExpiresAt;
   }
   async markOutboxFailed(input) {
-    const record = this.requireLeasedOutbox(input.id, input.workerId);
+    const record = this.requireLeasedOutbox(input.id, input.workerId, input.leaseToken);
     record.status = input.deadLetter ? "dead_letter" : "pending";
     record.lastError = input.error;
     record.availableAt = input.availableAt;
     delete record.leaseOwner;
     delete record.leaseExpiresAt;
   }
+  async renewOutboxLease(input) {
+    const record = this.outbox.find((candidate) => candidate.id === input.id);
+    const current = input.now ?? /* @__PURE__ */ new Date();
+    if (!record || record.status !== "pending" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return false;
+    record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+    return true;
+  }
   async listOutbox(input = {}) {
     return this.outbox.filter((record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (!input.statuses?.length || input.statuses.includes(record.status))).map(cloneOutboxRecord);
   }
-  requireLeasedOutbox(id, workerId) {
+  requireLeasedOutbox(id, workerId, leaseToken) {
     const record = this.outbox.find((candidate) => candidate.id === id);
-    if (!record || record.leaseOwner !== workerId) throw new Error(`Outbox record ${id} is not leased by ${workerId}.`);
+    if (!record || record.leaseOwner !== workerId || (record.leaseToken ?? 0) !== (leaseToken ?? 0)) {
+      throw new Error(`Outbox record ${id} is not leased by ${workerId}.`);
+    }
     return record;
   }
   async nextEventSequence(tenantId, spaceId) {
@@ -1292,24 +1882,128 @@ var MemoryPlatformHostStore = class {
       (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (!input.statuses?.length || input.statuses.includes(record.status)) && (!input.updatedBefore || record.updatedAt < input.updatedBefore)
     ).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime()).slice(0, input.limit ?? 100);
   }
+  async getHealthCounts(input) {
+    const invocations = this.invocations.filter(
+      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId)
+    );
+    const outbox = this.outbox.filter(
+      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId)
+    );
+    return {
+      invocationBacklog: invocations.filter((item) => item.status === "pending").length,
+      invocationRunning: invocations.filter((item) => item.status === "running").length,
+      invocationExpiredLeases: invocations.filter(
+        (item) => item.status === "running" && item.leaseExpiresAt !== void 0 && item.leaseExpiresAt.getTime() <= input.now.getTime()
+      ).length,
+      invocationApprovalWaits: invocations.filter((item) => item.status === "waiting_for_approval").length,
+      invocationReconciliationRequired: invocations.filter((item) => item.status === "reconciliation_required").length,
+      outboxBacklog: outbox.filter((item) => item.status === "pending").length,
+      outboxExpiredLeases: outbox.filter(
+        (item) => item.status === "pending" && item.leaseExpiresAt !== void 0 && item.leaseExpiresAt.getTime() <= input.now.getTime()
+      ).length,
+      outboxDeadLetters: outbox.filter((item) => item.status === "dead_letter").length
+    };
+  }
   async claimActionInvocations(input) {
     const current = input.now ?? /* @__PURE__ */ new Date();
     const eligible = this.invocations.filter(
-      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (record.status === "pending" || record.status === "running" && (!record.leaseExpiresAt || record.leaseExpiresAt <= current))
+      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (record.status === "pending" || record.status === "running" && record.leaseExpiresAt !== void 0 && record.leaseExpiresAt <= current)
     ).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime()).slice(0, input.limit ?? 10);
     for (const record of eligible) {
       record.status = "running";
       record.leaseOwner = input.workerId;
       record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+      record.leaseToken = (record.leaseToken ?? 0) + 1;
       record.attemptCount += 1;
       record.updatedAt = current;
     }
-    return eligible;
+    return eligible.map((record) => structuredClone(record));
+  }
+  async updateLeasedActionInvocation(input) {
+    const record = await this.getActionInvocation(input.id, input.tenantId, input.spaceId);
+    if (!record || record.status !== "running" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken) return false;
+    await this.updateActionInvocation(input.id, input.tenantId, input.spaceId, input.patch);
+    return true;
+  }
+  async renewActionInvocationLease(input) {
+    const record = await this.getActionInvocation(input.id, input.tenantId, input.spaceId);
+    const current = input.now ?? /* @__PURE__ */ new Date();
+    if (!record || record.status !== "running" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return false;
+    record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+    record.updatedAt = current;
+    return true;
   }
   async listEvents(tenantId, spaceId) {
     return this.events.filter((event) => event.tenantId === tenantId && event.spaceId === spaceId).sort((left, right) => left.sequence - right.sequence);
   }
 };
+async function applyPostgresMigrations(client, migrations) {
+  const ordered = validateMigrations(migrations);
+  const statements = ordered.map((migration) => migrationStatement(migration));
+  await client.query(`
+		BEGIN;
+		SELECT pg_advisory_xact_lock(hashtext('fabric_platform.schema_migrations'));
+		CREATE SCHEMA IF NOT EXISTS fabric_platform;
+		CREATE TABLE IF NOT EXISTS fabric_platform.schema_migrations (
+			version integer PRIMARY KEY,
+			name text NOT NULL,
+			checksum text NOT NULL,
+			applied_at timestamptz NOT NULL DEFAULT now()
+		);
+		${statements.join("\n")}
+		COMMIT;
+	`);
+}
+function validateMigrations(migrations) {
+  const ordered = [...migrations].sort((left, right) => left.version - right.version);
+  const versions = /* @__PURE__ */ new Set();
+  for (const migration of ordered) {
+    if (!Number.isSafeInteger(migration.version) || migration.version < 1) {
+      throw new Error(`Migration version must be a positive safe integer: ${migration.version}`);
+    }
+    if (versions.has(migration.version)) {
+      throw new Error(`Duplicate migration version: ${migration.version}`);
+    }
+    if (!/^[a-z][a-z0-9_]*$/.test(migration.name)) {
+      throw new Error(`Invalid migration name: ${migration.name}`);
+    }
+    if (migration.sql.trim().length === 0) {
+      throw new Error(`Migration ${migration.version} has no SQL`);
+    }
+    versions.add(migration.version);
+  }
+  return ordered;
+}
+function migrationStatement(migration) {
+  const checksum = createHash("sha256").update(migration.sql).digest("hex");
+  const delimiter = `$fabric_platform_migration_${migration.version}$`;
+  if (migration.sql.includes(delimiter)) {
+    throw new Error(`Migration ${migration.version} contains its reserved SQL delimiter`);
+  }
+  return `
+		DO ${delimiter}
+		DECLARE
+			recorded_checksum text;
+		BEGIN
+			SELECT checksum INTO recorded_checksum
+			FROM fabric_platform.schema_migrations
+			WHERE version = ${migration.version};
+
+			IF FOUND THEN
+				IF recorded_checksum <> ${sqlLiteral(checksum)} THEN
+					RAISE EXCEPTION 'Migration checksum mismatch for version ${migration.version}';
+				END IF;
+			ELSE
+				${migration.sql}
+				INSERT INTO fabric_platform.schema_migrations (version, name, checksum)
+				VALUES (${migration.version}, ${sqlLiteral(migration.name)}, ${sqlLiteral(checksum)});
+			END IF;
+		END
+		${delimiter};`;
+}
+function sqlLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
 
 // src/postgres-store.ts
 var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
@@ -1322,11 +2016,23 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         const scoped = new _PostgresPlatformHostStore(db2, sql2);
         return run({
           db: db2,
+          getActionInvocationForUpdate: async (id, tenantId, spaceId) => {
+            const result = await sql2.query(
+              `SELECT * FROM fabric_platform.action_invocations
+								 WHERE id=$1 AND tenant_id=$2 AND space_id=$3
+								 FOR UPDATE`,
+              [id, tenantId, spaceId]
+            );
+            return result.rows[0] ? toActionRecord(result.rows[0]) : void 0;
+          },
+          getEvent: (id, tenantId, spaceId) => scoped.getEvent(id, tenantId, spaceId),
           appendEvent: (event) => scoped.appendEvent(event),
           appendEventWithOutbox: (event, metadata) => scoped.appendEventWithOutbox(event, metadata),
           nextEventSequence: (tenantId, spaceId) => scoped.nextEventSequence(tenantId, spaceId),
           listEvents: (tenantId, spaceId) => scoped.listEvents(tenantId, spaceId),
-          updateActionInvocation: (id, tenantId, spaceId, patch) => scoped.updateActionInvocation(id, tenantId, spaceId, patch)
+          getEntityState: (tenantId, spaceId, entityType, entityId) => scoped.getEntityState(tenantId, spaceId, entityType, entityId),
+          updateActionInvocation: (id, tenantId, spaceId, patch) => scoped.updateActionInvocation(id, tenantId, spaceId, patch),
+          updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input)
         });
       });
     }
@@ -1336,7 +2042,10 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
   transactionWithEvents;
   transactionalOutbox;
   async ensureSchema() {
-    await this.sql.query(`
+    await applyPostgresMigrations(this.sql, [{
+      version: 1,
+      name: "host_ledger_baseline",
+      sql: `
 			CREATE SCHEMA IF NOT EXISTS fabric_platform;
 			CREATE TABLE IF NOT EXISTS fabric_platform.action_invocations (
 				id text PRIMARY KEY, tenant_id text NOT NULL, space_id text NOT NULL,
@@ -1347,7 +2056,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				parameter_digest text, parameter_digest_algorithm text, idempotency_actor_id text,
 				idempotency_authorization_binding_id text, invocation_provenance jsonb,
 				authorization_binding jsonb, execution_reason text, authorization_reconciliation jsonb,
-				authorization_binding_id text, error text,
+				adapter_reconciliation jsonb, authorization_binding_id text, error text,
 				attempt_count integer NOT NULL DEFAULT 0, lease_owner text,
 				lease_expires_at timestamptz, hitl_route text, hitl_risk_tier text,
 				hitl_reason text, hitl_policy_version text, approval_decision jsonb,
@@ -1364,6 +2073,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ADD COLUMN IF NOT EXISTS authorization_binding jsonb,
 				ADD COLUMN IF NOT EXISTS execution_reason text,
 				ADD COLUMN IF NOT EXISTS authorization_reconciliation jsonb,
+				ADD COLUMN IF NOT EXISTS adapter_reconciliation jsonb,
 				ADD COLUMN IF NOT EXISTS authorization_binding_id text,
 				ADD COLUMN IF NOT EXISTS attempt_count integer NOT NULL DEFAULT 0,
 				ADD COLUMN IF NOT EXISTS lease_owner text,
@@ -1429,10 +2139,11 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				actor_id text NOT NULL, actor_type text NOT NULL, action_invocation_id text,
 				payload jsonb NOT NULL, sequence bigint NOT NULL,
 				occurred_at timestamptz NOT NULL, recorded_at timestamptz NOT NULL,
-				correlation_id text NOT NULL, causation_id text, provenance jsonb,
+				correlation_id text NOT NULL, causation_id text, provenance jsonb, consistency text,
 				UNIQUE (tenant_id, space_id, sequence)
 			);
 			ALTER TABLE fabric_platform.asset_events ADD COLUMN IF NOT EXISTS provenance jsonb;
+			ALTER TABLE fabric_platform.asset_events ADD COLUMN IF NOT EXISTS consistency text;
 			CREATE INDEX IF NOT EXISTS asset_events_subject_idx
 				ON fabric_platform.asset_events
 				(tenant_id, space_id, subject_type, subject_id, sequence);
@@ -1445,7 +2156,17 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			);
 			CREATE INDEX IF NOT EXISTS event_outbox_claim_idx
 				ON fabric_platform.event_outbox (status, available_at, lease_expires_at, created_at);
-		`);
+			`
+    }, {
+      version: 2,
+      name: "lease_fencing",
+      sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN lease_token bigint NOT NULL DEFAULT 0;
+				ALTER TABLE fabric_platform.event_outbox
+					ADD COLUMN lease_token bigint NOT NULL DEFAULT 0;
+			`
+    }]);
   }
   async transaction(run) {
     return run(this.db);
@@ -1506,6 +2227,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 status=COALESCE($4,status), result=COALESCE($5::jsonb,result),
 			 error=CASE WHEN $6::boolean THEN $7 ELSE error END,
 			 authorization_reconciliation=CASE WHEN $8::boolean THEN $9::jsonb ELSE authorization_reconciliation END,
+			 adapter_reconciliation=CASE WHEN $10::boolean THEN $11::jsonb ELSE adapter_reconciliation END,
 			 lease_owner=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
 			 lease_expires_at=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
@@ -1521,7 +2243,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "error"),
         patch.error ?? null,
         Object.hasOwn(patch, "authorizationReconciliation"),
-        patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null
+        patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null,
+        Object.hasOwn(patch, "adapterReconciliation"),
+        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null
       ]
     );
   }
@@ -1555,6 +2279,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 error=CASE WHEN $5::boolean THEN NULL ELSE $6 END,
 			 lease_owner=CASE WHEN $5::boolean THEN $7 ELSE NULL END,
 			 lease_expires_at=CASE WHEN $5::boolean THEN $8::timestamptz ELSE NULL END,
+			 lease_token=CASE WHEN $5::boolean THEN lease_token+1 ELSE lease_token END,
 			 attempt_count=CASE WHEN $5::boolean THEN GREATEST(attempt_count,1) ELSE attempt_count END,
 			 updated_at=$9
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3 AND status='waiting_for_approval'
@@ -1716,8 +2441,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       `INSERT INTO fabric_platform.asset_events
 			 (id,tenant_id,space_id,event_type,event_schema_version,subject_type,subject_id,
 			  actor_id,actor_type,action_invocation_id,payload,sequence,occurred_at,recorded_at,
-			  correlation_id,causation_id,provenance)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb)
+			  correlation_id,causation_id,provenance,consistency)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb,$18)
 				 ON CONFLICT (id) DO NOTHING`,
       [
         event.id,
@@ -1736,7 +2461,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         event.recordedAt,
         event.correlationId,
         event.causationId ?? null,
-        event.provenance ? JSON.stringify(event.provenance) : null
+        event.provenance ? JSON.stringify(event.provenance) : null,
+        event.consistency ?? null
       ]
     );
   }
@@ -1747,8 +2473,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				INSERT INTO fabric_platform.asset_events
 				 (id,tenant_id,space_id,event_type,event_schema_version,subject_type,subject_id,
 				  actor_id,actor_type,action_invocation_id,payload,sequence,occurred_at,recorded_at,
-				  correlation_id,causation_id,provenance)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb)
+				  correlation_id,causation_id,provenance,consistency)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb,$19)
 				 ON CONFLICT (id) DO NOTHING RETURNING id
 			)
 			INSERT INTO fabric_platform.event_outbox
@@ -1773,7 +2499,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         event.correlationId,
         event.causationId ?? null,
         event.provenance ? JSON.stringify(event.provenance) : null,
-        JSON.stringify(envelope)
+        JSON.stringify(envelope),
+        event.consistency ?? null
       ]
     );
   }
@@ -1790,28 +2517,48 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ORDER BY created_at,id FOR UPDATE SKIP LOCKED LIMIT $4
 			)
 			UPDATE fabric_platform.event_outbox AS item
-			SET lease_owner=$5, lease_expires_at=$6, attempt_count=attempt_count+1
+			SET lease_owner=$5, lease_expires_at=$6, lease_token=lease_token+1,
+			    attempt_count=attempt_count+1
 			FROM claimable WHERE item.id=claimable.id RETURNING item.*`,
       [current, input.tenantId ?? null, input.spaceId ?? null, Math.max(1, Math.min(input.limit ?? 100, 1e3)), input.workerId, leaseExpiresAt]
     );
     return result.rows.map(toOutboxRecord);
   }
-  async markOutboxPublished(id, workerId, publishedAt) {
+  async markOutboxPublished(id, workerId, publishedAt, leaseToken) {
     const result = await this.sql.query(
       `UPDATE fabric_platform.event_outbox SET status='published',published_at=$3,
-			 lease_owner=NULL,lease_expires_at=NULL WHERE id=$1 AND lease_owner=$2 RETURNING id`,
-      [id, workerId, publishedAt]
+			 lease_owner=NULL,lease_expires_at=NULL
+			 WHERE id=$1 AND lease_owner=$2 AND lease_token=COALESCE($4,0) RETURNING id`,
+      [id, workerId, publishedAt, leaseToken ?? null]
     );
     if (result.rows.length === 0) throw new Error(`Outbox record ${id} is not leased by ${workerId}.`);
   }
   async markOutboxFailed(input) {
     const result = await this.sql.query(
       `UPDATE fabric_platform.event_outbox SET status=$3,last_error=$4,available_at=$5,
-			 lease_owner=NULL,lease_expires_at=NULL WHERE id=$1 AND lease_owner=$2 RETURNING id`,
-      [input.id, input.workerId, input.deadLetter ? "dead_letter" : "pending", input.error, input.availableAt]
+			 lease_owner=NULL,lease_expires_at=NULL
+			 WHERE id=$1 AND lease_owner=$2 AND lease_token=COALESCE($6,0) RETURNING id`,
+      [input.id, input.workerId, input.deadLetter ? "dead_letter" : "pending", input.error, input.availableAt, input.leaseToken ?? null]
     );
     if (result.rows.length === 0) throw new Error(`Outbox record ${input.id} is not leased by ${input.workerId}.`);
   }
+  async renewOutboxLease(input) {
+    const current = input.now ?? /* @__PURE__ */ new Date();
+    const result = await this.sql.query(
+      `UPDATE fabric_platform.event_outbox SET lease_expires_at=$5
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3
+			   AND lease_expires_at > $4
+			 RETURNING id`,
+      [
+        input.id,
+        input.workerId,
+        input.leaseToken,
+        current,
+        new Date(current.getTime() + input.leaseDurationMs)
+      ]
+    );
+    return result.rows.length === 1;
+  }
   async listOutbox(input = {}) {
     const result = await this.sql.query(
       `SELECT * FROM fabric_platform.event_outbox
@@ -1860,6 +2607,55 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     );
     return result.rows.map(toActionRecord);
   }
+  async getHealthCounts(input) {
+    const result = await this.sql.query(
+      `SELECT
+				(SELECT COUNT(*) FROM fabric_platform.action_invocations
+				 WHERE status='pending'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS invocation_backlog,
+				(SELECT COUNT(*) FROM fabric_platform.action_invocations
+				 WHERE status='running'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS invocation_running,
+				(SELECT COUNT(*) FROM fabric_platform.action_invocations
+				 WHERE status='running' AND lease_expires_at IS NOT NULL AND lease_expires_at <= $3
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS invocation_expired_leases,
+				(SELECT COUNT(*) FROM fabric_platform.action_invocations
+				 WHERE status='waiting_for_approval'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS invocation_approval_waits,
+				(SELECT COUNT(*) FROM fabric_platform.action_invocations
+				 WHERE status='reconciliation_required'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS invocation_reconciliation_required,
+				(SELECT COUNT(*) FROM fabric_platform.event_outbox
+				 WHERE status='pending'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS outbox_backlog,
+				(SELECT COUNT(*) FROM fabric_platform.event_outbox
+				 WHERE status='pending' AND lease_expires_at IS NOT NULL AND lease_expires_at <= $3
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS outbox_expired_leases,
+				(SELECT COUNT(*) FROM fabric_platform.event_outbox
+				 WHERE status='dead_letter'
+				   AND ($1::text IS NULL OR tenant_id=$1)
+				   AND ($2::text IS NULL OR space_id=$2)) AS outbox_dead_letters`,
+      [input.tenantId ?? null, input.spaceId ?? null, input.now]
+    );
+    const row = result.rows[0] ?? {};
+    return {
+      invocationBacklog: Number(row.invocation_backlog ?? 0),
+      invocationRunning: Number(row.invocation_running ?? 0),
+      invocationExpiredLeases: Number(row.invocation_expired_leases ?? 0),
+      invocationApprovalWaits: Number(row.invocation_approval_waits ?? 0),
+      invocationReconciliationRequired: Number(row.invocation_reconciliation_required ?? 0),
+      outboxBacklog: Number(row.outbox_backlog ?? 0),
+      outboxExpiredLeases: Number(row.outbox_expired_leases ?? 0),
+      outboxDeadLetters: Number(row.outbox_dead_letters ?? 0)
+    };
+  }
   async claimActionInvocations(input) {
     const current = input.now ?? /* @__PURE__ */ new Date();
     const limit = Math.max(1, Math.min(input.limit ?? 10, 100));
@@ -1868,7 +2664,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       `WITH claimable AS (
 				SELECT id FROM fabric_platform.action_invocations
 				WHERE (status='pending' OR
-				       (status='running' AND (lease_expires_at IS NULL OR lease_expires_at <= $1)))
+				       (status='running' AND lease_expires_at IS NOT NULL AND lease_expires_at <= $1))
 				  AND ($2::text IS NULL OR tenant_id=$2)
 				  AND ($3::text IS NULL OR space_id=$3)
 				ORDER BY created_at
@@ -1877,7 +2673,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			)
 			UPDATE fabric_platform.action_invocations AS invocation
 			SET status='running', lease_owner=$5, lease_expires_at=$6,
-			    attempt_count=attempt_count+1, updated_at=$1
+			    lease_token=lease_token+1, attempt_count=attempt_count+1, updated_at=$1
 			FROM claimable WHERE invocation.id=claimable.id
 			RETURNING invocation.*`,
       [
@@ -1891,6 +2687,61 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     );
     return result.rows.map(toActionRecord);
   }
+  async updateLeasedActionInvocation(input) {
+    const patch = input.patch;
+    const result = await this.sql.query(
+      `UPDATE fabric_platform.action_invocations SET
+			 status=COALESCE($6,status), result=COALESCE($7::jsonb,result),
+			 error=CASE WHEN $8::boolean THEN $9 ELSE error END,
+			 authorization_reconciliation=CASE WHEN $10::boolean THEN $11::jsonb ELSE authorization_reconciliation END,
+			 adapter_reconciliation=CASE WHEN $12::boolean THEN $13::jsonb ELSE adapter_reconciliation END,
+			 lease_owner=CASE WHEN $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			                  THEN NULL ELSE lease_owner END,
+			 lease_expires_at=CASE WHEN $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			                       THEN NULL ELSE lease_expires_at END,
+			 updated_at=now()
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3
+			   AND status='running' AND lease_owner=$4 AND lease_token=$5
+			 RETURNING id`,
+      [
+        input.id,
+        input.tenantId,
+        input.spaceId,
+        input.workerId,
+        input.leaseToken,
+        patch.status ?? null,
+        patch.result === void 0 ? null : JSON.stringify(patch.result),
+        Object.hasOwn(patch, "error"),
+        patch.error ?? null,
+        Object.hasOwn(patch, "authorizationReconciliation"),
+        patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null,
+        Object.hasOwn(patch, "adapterReconciliation"),
+        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null
+      ]
+    );
+    return result.rows.length === 1;
+  }
+  async renewActionInvocationLease(input) {
+    const current = input.now ?? /* @__PURE__ */ new Date();
+    const result = await this.sql.query(
+      `UPDATE fabric_platform.action_invocations
+			 SET lease_expires_at=$6,updated_at=$5
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3
+			   AND status='running' AND lease_owner=$4 AND lease_token=$7
+			   AND lease_expires_at > $5
+			 RETURNING id`,
+      [
+        input.id,
+        input.tenantId,
+        input.spaceId,
+        input.workerId,
+        current,
+        new Date(current.getTime() + input.leaseDurationMs),
+        input.leaseToken
+      ]
+    );
+    return result.rows.length === 1;
+  }
   async listEvents(tenantId, spaceId) {
     const result = await this.sql.query(
       `SELECT * FROM fabric_platform.asset_events
@@ -1899,6 +2750,14 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     );
     return result.rows.map(toEventRecord);
   }
+  async getEvent(id, tenantId, spaceId) {
+    const result = await this.sql.query(
+      `SELECT * FROM fabric_platform.asset_events
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`,
+      [id, tenantId, spaceId]
+    );
+    return result.rows[0] ? toEventRecord(result.rows[0]) : void 0;
+  }
 };
 function toAdapterRecord(row) {
   return {
@@ -1941,8 +2800,10 @@ function toActionRecord(row) {
     ...row.authorization_binding ? { authorizationBinding: row.authorization_binding } : {},
     ...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
     ...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
+    ...row.adapter_reconciliation ? { adapterReconciliation: row.adapter_reconciliation } : {},
     ...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},
     attemptCount: Number(row.attempt_count ?? 0),
+    leaseToken: Number(row.lease_token ?? 0),
     ...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
     ...row.lease_expires_at ? { leaseExpiresAt: new Date(row.lease_expires_at) } : {},
     ...row.hitl_route ? { hitlRoute: String(row.hitl_route) } : {},
@@ -2015,7 +2876,8 @@ function toEventRecord(row) {
     recordedAt: new Date(row.recorded_at),
     correlationId: String(row.correlation_id),
     ...row.causation_id ? { causationId: String(row.causation_id) } : {},
-    ...row.provenance ? { provenance: row.provenance } : {}
+    ...row.provenance ? { provenance: row.provenance } : {},
+    ...row.consistency ? { consistency: row.consistency } : {}
   };
 }
 function toOutboxRecord(row) {
@@ -2037,6 +2899,7 @@ function toOutboxRecord(row) {
       correlationId: String(event.correlationId),
       ...event.causationId ? { causationId: String(event.causationId) } : {},
       ...event.provenance ? { provenance: event.provenance } : {},
+      ...event.consistency ? { consistency: event.consistency } : {},
       occurredAt: new Date(event.occurredAt),
       recordedAt: new Date(event.recordedAt),
       producerModuleVersion: String(event.producerModuleVersion),
@@ -2049,6 +2912,7 @@ function toOutboxRecord(row) {
     availableAt: new Date(row.available_at),
     ...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
     ...row.lease_expires_at ? { leaseExpiresAt: new Date(row.lease_expires_at) } : {},
+    leaseToken: Number(row.lease_token ?? 0),
     ...row.last_error ? { lastError: String(row.last_error) } : {},
     createdAt: new Date(row.created_at),
     ...row.published_at ? { publishedAt: new Date(row.published_at) } : {}
@@ -2065,38 +2929,93 @@ function createStoreBackedActionDispatcher() {
   };
 }
 async function runPlatformActionWorkerCycle(options) {
-  const claimed = await options.store.claimActionInvocations({
-    workerId: options.workerId,
-    limit: options.batchSize ?? DEFAULT_BATCH_SIZE,
-    leaseDurationMs: options.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS,
-    ...options.tenantId ? { tenantId: options.tenantId } : {},
-    ...options.spaceId ? { spaceId: options.spaceId } : {}
-  });
+  const leaseDurationMs = options.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS;
+  emitWorkerTelemetry(options.telemetry, "worker.cycle.started", options.workerId);
+  let claimed;
+  try {
+    claimed = await options.store.claimActionInvocations({
+      workerId: options.workerId,
+      limit: options.batchSize ?? DEFAULT_BATCH_SIZE,
+      leaseDurationMs,
+      ...options.tenantId ? { tenantId: options.tenantId } : {},
+      ...options.spaceId ? { spaceId: options.spaceId } : {}
+    });
+  } catch (error) {
+    emitWorkerTelemetry(options.telemetry, "worker.cycle.failed", options.workerId);
+    throw error;
+  }
+  for (const invocation of claimed) {
+    emitPlatformHostTelemetry(options.telemetry, {
+      kind: "event",
+      name: "invocation.lease_claimed",
+      metricName: PLATFORM_HOST_METRIC_NAMES.invocationLeaseClaimed,
+      occurredAt: /* @__PURE__ */ new Date(),
+      tenantId: invocation.tenantId,
+      spaceId: invocation.spaceId,
+      attributes: { attempt: invocation.attemptCount }
+    });
+  }
   let completed = 0;
   let failed = 0;
   let waitingForApproval = 0;
   for (const invocation of claimed) {
+    const stopHeartbeat = startLeaseHeartbeat(options, invocation, leaseDurationMs);
     try {
-      const result = await options.host.executeInvocation(
+      const result2 = await options.host.executeInvocation(
         invocation.id,
         invocation.tenantId,
         invocation.spaceId,
-        { leaseOwner: options.workerId }
+        { leaseOwner: options.workerId, leaseToken: invocation.leaseToken }
       );
-      if (result.status === "completed") completed += 1;
-      else if (result.status === "waiting_for_approval") waitingForApproval += 1;
+      if (result2.status === "completed") completed += 1;
+      else if (result2.status === "waiting_for_approval") waitingForApproval += 1;
       else failed += 1;
     } catch (error) {
       failed += 1;
       options.onError?.(error, invocation);
+    } finally {
+      await stopHeartbeat();
     }
   }
-  return {
+  const result = {
     claimed: claimed.length,
     completed,
     failed,
     ...waitingForApproval > 0 ? { waitingForApproval } : {}
   };
+  emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, result);
+  return result;
+}
+function startLeaseHeartbeat(options, invocation, leaseDurationMs) {
+  if (!invocation?.leaseToken) return async () => void 0;
+  const intervalMs = options.leaseRenewalIntervalMs ?? Math.max(1, Math.floor(leaseDurationMs / 3));
+  let stopped = false;
+  let timer;
+  let running;
+  const schedule = () => {
+    if (!stopped) timer = setTimeout(tick, intervalMs);
+  };
+  const tick = () => {
+    running = options.store.renewActionInvocationLease({
+      id: invocation.id,
+      tenantId: invocation.tenantId,
+      spaceId: invocation.spaceId,
+      workerId: options.workerId,
+      leaseToken: invocation.leaseToken,
+      leaseDurationMs
+    }).then((renewed) => {
+      if (!renewed) options.onError?.(
+        new Error(`Invocation lease lost: ${invocation.id}`),
+        invocation
+      );
+    }).catch((error) => options.onError?.(error, invocation)).finally(schedule);
+  };
+  schedule();
+  return async () => {
+    stopped = true;
+    if (timer) clearTimeout(timer);
+    await running;
+  };
 }
 async function runPlatformActionWorker(options) {
   while (!options.signal?.aborted) {
@@ -2122,7 +3041,158 @@ async function abortableDelay(milliseconds, signal) {
     );
   });
 }
+function emitWorkerTelemetry(telemetry, name, workerId, attributes) {
+  const metricName = name === "worker.cycle.started" ? PLATFORM_HOST_METRIC_NAMES.workerCyclesStarted : name === "worker.cycle.completed" ? PLATFORM_HOST_METRIC_NAMES.workerCyclesCompleted : PLATFORM_HOST_METRIC_NAMES.workerCyclesFailed;
+  emitPlatformHostTelemetry(telemetry, {
+    kind: "event",
+    name,
+    metricName,
+    occurredAt: /* @__PURE__ */ new Date(),
+    attributes: { workerId, ...attributes }
+  });
+}
+
+// src/saga-parent-lifecycle.ts
+var TERMINAL_PARENT_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "blocked_by_policy",
+  "reconciliation_required",
+  "validation_failed"
+]);
+function createDurableSagaParentLifecycle(options) {
+  const store = options.store;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const transactionWithEvents = store.transactionWithEvents?.bind(store);
+  if (!transactionWithEvents) {
+    throw new Error(
+      "Durable saga parent lifecycle requires store.transactionWithEvents for atomic event and parent updates."
+    );
+  }
+  const runInTransaction = transactionWithEvents;
+  async function applyLifecycleTransition(input, lifecycleId2, eventType, payload, patch) {
+    const eventId = `sagapar_${digestParameters({
+      parentInvocationId: input.parentInvocationId,
+      lifecycleId: lifecycleId2
+    }).slice(0, 40)}`;
+    await runInTransaction(async (transaction) => {
+      if (!transaction.getActionInvocationForUpdate) {
+        throw new Error(
+          "Durable saga parent lifecycle requires transaction.getActionInvocationForUpdate for serialization."
+        );
+      }
+      if (!transaction.getEvent) {
+        throw new Error(
+          "Durable saga parent lifecycle requires transaction.getEvent for identity-scoped evidence lookup."
+        );
+      }
+      const parent = await transaction.getActionInvocationForUpdate(
+        input.parentInvocationId,
+        input.tenantId,
+        input.spaceId
+      );
+      if (!parent) {
+        throw new Error(`Saga parent invocation not found: ${input.parentInvocationId}`);
+      }
+      const prior = await transaction.getEvent(eventId, input.tenantId, input.spaceId);
+      if (prior) {
+        if (prior.eventType !== eventType || digestParameters(prior.payload) !== digestParameters(payload)) {
+          throw new Error(`Saga lifecycle identity ${lifecycleId2} has contradictory evidence.`);
+        }
+        return;
+      }
+      if (TERMINAL_PARENT_STATUSES.has(parent.status)) {
+        throw new Error(
+          `Saga parent invocation ${input.parentInvocationId} is already terminal (${parent.status}).`
+        );
+      }
+      const sequence = await transaction.nextEventSequence(input.tenantId, input.spaceId);
+      const timestamp = now();
+      await transaction.appendEvent({
+        id: eventId,
+        tenantId: input.tenantId,
+        spaceId: input.spaceId,
+        eventType,
+        eventSchemaVersion: 1,
+        subjectType: "ActionInvocation",
+        subjectId: input.parentInvocationId,
+        actorId: "system",
+        actorType: "system",
+        actionInvocationId: input.parentInvocationId,
+        payload,
+        sequence,
+        occurredAt: timestamp,
+        recordedAt: timestamp,
+        correlationId: input.parentInvocationId,
+        causationId: lifecycleId2
+      });
+      if (patch) {
+        await transaction.updateActionInvocation(
+          input.parentInvocationId,
+          input.tenantId,
+          input.spaceId,
+          patch
+        );
+      }
+    });
+  }
+  return {
+    async recordProgress(input) {
+      await applyLifecycleTransition(
+        input,
+        input.lifecycleId ?? `host:${input.parentInvocationId}:progress:${input.progress.stepId}:${input.progress.index}`,
+        "SagaParentProgress",
+        {
+          stepId: input.progress.stepId,
+          index: input.progress.index,
+          total: input.progress.total,
+          completedAt: input.progress.completedAt
+        }
+      );
+    },
+    async parkApproval(input) {
+      await applyLifecycleTransition(
+        input,
+        input.lifecycleId ?? `host:${input.parentInvocationId}:approval:${input.approvalId}`,
+        "SagaParentApprovalParked",
+        {
+          stepId: input.stepId,
+          approvalId: input.approvalId,
+          reason: input.reason
+        },
+        { status: "waiting_for_approval" }
+      );
+    },
+    async cancel(input) {
+      await applyLifecycleTransition(
+        input,
+        input.lifecycleId ?? `host:${input.parentInvocationId}:cancel`,
+        "SagaParentCancelled",
+        { reason: input.reason, actorId: input.actorId },
+        { status: "failed", error: `Saga cancelled: ${input.reason}` }
+      );
+    },
+    async complete(input) {
+      await applyLifecycleTransition(
+        input,
+        input.lifecycleId ?? `host:${input.parentInvocationId}:complete`,
+        "SagaParentCompleted",
+        { result: input.result },
+        { status: "completed", result: input.result }
+      );
+    },
+    async fail(input) {
+      await applyLifecycleTransition(
+        input,
+        input.lifecycleId ?? `host:${input.parentInvocationId}:fail`,
+        "SagaParentFailed",
+        { error: input.error, compensation: input.compensation },
+        { status: "failed", error: input.error }
+      );
+    }
+  };
+}
 
-export { IdempotencyConflictError, MemoryPlatformHostStore, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PostgresPlatformHostStore, canonicalJson, cloneOutboxRecord, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, toEnterpriseEventEnvelope };
+export { IdempotencyConflictError, MemoryPlatformHostStore, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, PostgresPlatformHostStore, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, toEnterpriseEventEnvelope };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map