@fabricorg/platform-host 8.1.2 → 8.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { AdapterCircuitBreakerRegistry, AdapterRegistry, FABRIC_GOVERNANCE_CONTRACT_VERSION, aggregatePolicyOutcomes, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, canonicalJson, createFabricId, evaluatePolicyDefinitions, evaluateStateMachineTransition, executeWithAdapterRetry, isAdapterCircuitOpenError, isReconciliationRequiredError, isRetryableExecutionError } from "@fabricorg/platform";
+import { AdapterCircuitBreakerRegistry, AdapterRegistry, FABRIC_GOVERNANCE_CONTRACT_VERSION, ReconciliationRequiredError, aggregatePolicyOutcomes, assertActionFinalization, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, canonicalJson, createFabricId, evaluatePolicyDefinitions, evaluateStateMachineTransition, executeWithAdapterRetry, isAdapterCircuitOpenError, isReconciliationRequiredError, isRetryableExecutionError } from "@fabricorg/platform";
 import { performance } from "perf_hooks";
 import { assertAssemblyRuntimeCompatible } from "@fabricorg/assembly";
 import { createHash } from "crypto";
@@ -35,6 +35,18 @@ var ActionAdmissionError = class extends Error {
 		this.name = "ActionAdmissionError";
 	}
 };
+/** A definitive authorization-boundary refusal before an invocation is created. */
+var SubmissionRefusalError = class extends Error {
+	actionId;
+	refusal;
+	code = "ACTION_SUBMISSION_REFUSED";
+	constructor(actionId, refusal, message) {
+		super(message);
+		this.actionId = actionId;
+		this.refusal = refusal;
+		this.name = "SubmissionRefusalError";
+	}
+};
 /**
 * Why a completion was not applied, typed so a webhook handler can answer
 * the external system correctly: `retryable` means the invocation is still
@@ -95,6 +107,82 @@ function normalizeProvenance(input, options) {
 	};
 }
 //#endregion
+//#region src/action-finalization.ts
+/** Strict JSON evidence: reject lossy serialization rather than silently dropping values. */
+function finalizationJson(value) {
+	const ancestors = /* @__PURE__ */ new Set();
+	function check(item) {
+		if (item === null || typeof item === "string" || typeof item === "boolean") return;
+		if (typeof item === "number" && Number.isFinite(item)) return;
+		if (typeof item !== "object" || !item || ancestors.has(item)) throw new Error("Finalization requires JSON-compatible data.");
+		if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) throw new Error("Finalization requires plain JSON objects.");
+		if (Object.getOwnPropertySymbols(item).length > 0) throw new Error("Finalization requires JSON string keys.");
+		if (Array.isArray(item)) {
+			const keys = Object.keys(item);
+			if (keys.length !== item.length || keys.some((key, index) => key !== String(index))) throw new Error("Finalization requires dense JSON arrays.");
+		}
+		ancestors.add(item);
+		for (const child of Object.values(item)) check(child);
+		ancestors.delete(item);
+	}
+	check(value);
+	return JSON.parse(JSON.stringify(value));
+}
+/** Match the persisted JSON representation before validating finalization execution input. */
+function normalizeFinalizationJson(value) {
+	return finalizationJson(JSON.parse(JSON.stringify(value)));
+}
+/** Omit only public optional fields; payloads and patch values retain strict JSON validation. */
+function omitUndefinedOptionalFields(value, keys) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return value;
+	const copy = { ...value };
+	for (const key of keys) if (Object.hasOwn(copy, key) && copy[key] === void 0) delete copy[key];
+	return copy;
+}
+function validateFinalization(value, action, privateFields, contracts) {
+	const normalized = omitUndefinedOptionalFields(value, [
+		"events",
+		"resultPatch",
+		"stagedInvocations"
+	]);
+	if (normalized !== value && normalized && typeof normalized === "object" && !Array.isArray(normalized)) {
+		const record = normalized;
+		if (Array.isArray(record.events)) {
+			const events = Object.assign(record.events.slice(), record.events);
+			for (let index = 0; index < events.length; index++) if (Object.hasOwn(events, index)) events[index] = omitUndefinedOptionalFields(events[index], ["eventSchemaVersion"]);
+			record.events = events;
+		}
+	}
+	const result = finalizationJson(normalized);
+	if (!result || typeof result !== "object" || Array.isArray(result) || Object.keys(result).some((key) => key !== "events" && key !== "resultPatch" && key !== "stagedInvocations")) throw new Error("Finalization must return only events, resultPatch and stagedInvocations.");
+	if (result.resultPatch !== void 0) {
+		if (!result.resultPatch || typeof result.resultPatch !== "object" || Array.isArray(result.resultPatch)) throw new Error("Finalization resultPatch must be an object.");
+		if (Object.keys(result.resultPatch).some((key) => privateFields.includes(key))) throw new Error("Finalization resultPatch contains a private result key.");
+	}
+	if (result.events !== void 0) {
+		if (!Array.isArray(result.events)) throw new Error("Finalization events must be an array.");
+		for (const event of result.events) {
+			if (!event || typeof event !== "object" || Array.isArray(event) || Object.keys(event).some((key) => ![
+				"eventType",
+				"subjectType",
+				"subjectId",
+				"payload",
+				"eventSchemaVersion"
+			].includes(key))) throw new Error("Invalid finalization event fields.");
+			for (const key of [
+				"eventType",
+				"subjectType",
+				"subjectId"
+			]) if (typeof event[key] !== "string" || !event[key].trim()) throw new Error("Finalization event identifiers must be non-empty.");
+			if (!Object.hasOwn(event, "payload")) throw new Error("Finalization event requires a JSON payload.");
+			if (event.eventSchemaVersion !== void 0 && (!Number.isInteger(event.eventSchemaVersion) || event.eventSchemaVersion <= 0)) throw new Error("Finalization eventSchemaVersion must be a positive integer.");
+			if (!action.emitsEvents.includes(event.eventType)) throw new Error("Finalization emitted undeclared event type.");
+			if (contracts && (!contracts.hasEventType(event.eventType) || !contracts.hasSubjectType(event.subjectType))) throw new Error("Finalization emitted an unregistered event or subject type.");
+		}
+	}
+	return result;
+}
+//#endregion
 //#region src/observability.ts
 /** Version of the vendor-neutral health/readiness contract. */
 const PLATFORM_HOST_HEALTH_CONTRACT_VERSION = 1;
@@ -1076,6 +1164,120 @@ function createOutboxRequeue(deps) {
 	};
 }
 //#endregion
+//#region src/staged-invocations.ts
+const MAX_STAGED_INVOCATIONS = 32;
+const MAX_STAGED_INVOCATION_KEY_LENGTH = 128;
+const MAX_STAGED_INVOCATION_BYTES = 65536;
+const MAX_STAGED_INVOCATION_BATCH_BYTES = 262144;
+const STAGED_INVOCATION_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+/** Validate and normalize one immutable batch before its parent transaction commits. */
+function prepareStagedInvocationBatch(input) {
+	if (!Array.isArray(input.requests)) throw new Error("stagedInvocations must be an array.");
+	if (input.requests.length > 32) throw new Error(`stagedInvocations exceeds the 32 request limit.`);
+	const normalized = input.requests.map((candidate, index) => {
+		if (!candidate || typeof candidate !== "object" || Array.isArray(candidate) || Object.keys(candidate).some((key) => ![
+			"key",
+			"actionId",
+			"parameters"
+		].includes(key))) throw new Error(`stagedInvocations[${index}] must contain only key, actionId and parameters.`);
+		const request = {
+			key: candidate.key,
+			actionId: candidate.actionId,
+			parameters: candidate.parameters
+		};
+		if (typeof request.key !== "string" || request.key.length === 0 || request.key.length > 128 || !STAGED_INVOCATION_KEY_PATTERN.test(request.key)) throw new Error(`stagedInvocations[${index}] key must match ${STAGED_INVOCATION_KEY_PATTERN} and be at most 128 characters.`);
+		if (!(input.parentAction.stagesInvocations ?? []).includes(request.actionId)) throw new Error(`Action "${input.parentAction.actionId}" may not stage "${String(request.actionId)}".`);
+		const child = input.resolveAction(request.actionId);
+		if (!child) throw new Error(`Staged action "${String(request.actionId)}" is not registered.`);
+		const parameters = finalizationJson(request.parameters);
+		if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) throw new Error(`stagedInvocations[${index}] parameters must be a JSON object.`);
+		if (!child.schema.safeParse(parameters).success) throw new Error(`stagedInvocations[${index}] parameters do not match action "${child.actionId}".`);
+		let redactedParameters = parameters;
+		if (input.redactParameters && !input.redactedKeys?.includes(request.key)) try {
+			redactedParameters = input.redactParameters(child.actionId, structuredClone(parameters));
+		} catch {
+			throw new Error("Staged invocation parameter redaction failed.");
+		}
+		const durableParameters = finalizationJson(redactedParameters);
+		if (!durableParameters || typeof durableParameters !== "object" || Array.isArray(durableParameters) || !child.schema.safeParse(durableParameters).success) throw new Error(`stagedInvocations[${index}] redacted parameters do not match action "${child.actionId}".`);
+		if (byteLength(canonicalJson({
+			key: request.key,
+			actionId: child.actionId,
+			parameters: durableParameters
+		})) > 65536) throw new Error(`stagedInvocations[${index}] exceeds ${MAX_STAGED_INVOCATION_BYTES} bytes.`);
+		return {
+			key: request.key,
+			actionId: child.actionId,
+			expectedActionVersion: child.version,
+			parameters: durableParameters,
+			parameterDigest: digestParameters(durableParameters)
+		};
+	});
+	for (const [index, request] of normalized.entries()) if (normalized.findIndex((candidate) => candidate.key === request.key) !== index) throw new Error(`stagedInvocations contains duplicate key "${request.key}".`);
+	normalized.sort((left, right) => compareText(left.key, right.key) || compareText(left.actionId, right.actionId));
+	const batchIdentity = normalized.map(({ key, actionId, expectedActionVersion, parameters, parameterDigest }) => ({
+		key,
+		actionId,
+		expectedActionVersion,
+		parameters,
+		parameterDigest
+	}));
+	if (byteLength(canonicalJson(batchIdentity)) > 262144) throw new Error(`stagedInvocations batch exceeds ${MAX_STAGED_INVOCATION_BATCH_BYTES} bytes.`);
+	const batchDigest = digestParameters({
+		parentInvocationId: input.parent.id,
+		requests: batchIdentity
+	});
+	return normalized.map((request) => ({
+		id: lifecycleId("stg", input.parent.id, request.key),
+		tenantId: input.parent.tenantId,
+		spaceId: input.parent.spaceId,
+		parentInvocationId: input.parent.id,
+		parentActionId: input.parent.actionId,
+		...request,
+		batchDigest,
+		status: "pending",
+		attemptCount: 0,
+		availableAt: new Date(input.now),
+		leaseToken: 0,
+		createdAt: new Date(input.now),
+		updatedAt: new Date(input.now)
+	}));
+}
+function stagedInvocationRequestIdentity(record) {
+	return canonicalJson({
+		id: record.id,
+		tenantId: record.tenantId,
+		spaceId: record.spaceId,
+		parentInvocationId: record.parentInvocationId,
+		parentActionId: record.parentActionId,
+		key: record.key,
+		actionId: record.actionId,
+		expectedActionVersion: record.expectedActionVersion,
+		parameters: record.parameters,
+		parameterDigest: record.parameterDigest,
+		batchDigest: record.batchDigest
+	});
+}
+function cloneStagedInvocationRecord(record) {
+	return {
+		...structuredClone(record),
+		availableAt: new Date(record.availableAt),
+		...record.leaseExpiresAt ? { leaseExpiresAt: new Date(record.leaseExpiresAt) } : {},
+		createdAt: new Date(record.createdAt),
+		updatedAt: new Date(record.updatedAt)
+	};
+}
+function asStagedInvocationStore(store) {
+	const candidate = store;
+	return candidate.transactionalStagedInvocations === true && typeof candidate.getActionInvocationByStagedOrigin === "function" && typeof candidate.createActionInvocationForStagedLease === "function" && typeof candidate.claimStagedInvocations === "function" && typeof candidate.markStagedInvocationDispatched === "function" && typeof candidate.markStagedInvocationRejected === "function" && typeof candidate.markStagedInvocationFailed === "function" && typeof candidate.renewStagedInvocationLease === "function" && typeof candidate.rotateStagedInvocationLease === "function" && typeof candidate.cancelStagedInvocationsForFailedParents === "function" && typeof candidate.listStagedInvocations === "function" ? candidate : void 0;
+}
+function byteLength(value) {
+	return new TextEncoder().encode(value).byteLength;
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+//#endregion
 //#region src/host.ts
 const DEFAULT_EXTRACT_EVENTS = (data) => {
 	const value = data._events;
@@ -1100,6 +1302,25 @@ const ADMISSION_FAILED = Object.freeze({ kind: "failed" });
 const ADMISSION_TIMED_OUT = Object.freeze({ kind: "timed_out" });
 /** What an admission refusal's code may look like; anything else is `invalid_decision`. */
 const ADMISSION_REFUSAL_CODE = /^[a-z][A-Za-z0-9_.:-]{0,127}$/;
+var StagedDispatchRejectionError = class extends Error {
+	name = "StagedDispatchRejectionError";
+};
+var StagedDispatchLeaseLostError = class extends Error {
+	name = "StagedDispatchLeaseLostError";
+};
+var StagedDispatcherHandoffError = class extends Error {
+	name = "StagedDispatcherHandoffError";
+};
+var StagedSubmissionTimeoutError = class extends Error {
+	name = "StagedSubmissionTimeoutError";
+};
+/** Fixed stage error texts: a stage records no caught error text and no parameters. */
+const STAGED_ERROR = Object.freeze({
+	dispatch: "Staged invocation dispatch failed.",
+	refused: "Staged invocation submission was definitively refused.",
+	handoff: "Staged child dispatcher handoff was not confirmed.",
+	lookup: "Staged child lookup failed."
+});
 function createGovernedActionHost(options) {
 	const retryableExecutionMaxAttempts = options.retryableExecutionMaxAttempts ?? 5;
 	if (!Number.isInteger(retryableExecutionMaxAttempts) || retryableExecutionMaxAttempts <= 0) throw new Error("retryableExecutionMaxAttempts must be a positive integer.");
@@ -1129,6 +1350,9 @@ function createGovernedActionHost(options) {
 	const configuredActionResolver = options.resolveAction ?? options.registry?.resolveAction;
 	if (!configuredActionResolver) throw new Error("Platform Host requires an explicit module registry or resolveAction function.");
 	const actionResolver = configuredActionResolver;
+	const stagedStore = asStagedInvocationStore(options.store);
+	const declaresStaging = options.registry?.orderedModules?.some((module) => (module.actions ?? []).some((action) => (action.stagesInvocations?.length ?? 0) > 0)) ?? false;
+	if (declaresStaging && (!stagedStore || !asAtomicMutationStore(options.store))) throw new Error("Staged descendant invocations require a store with transactionalStagedInvocations and transactionWithEvents capabilities.");
 	const stateMachineResolver = options.registry?.resolveStateMachine ?? (() => void 0);
 	const eventResultFields = options.eventResultFields ?? ["_events"];
 	const admissionTimeoutMs = options.admissionTimeoutMs ?? DEFAULT_ADMISSION_TIMEOUT_MS;
@@ -1137,8 +1361,12 @@ function createGovernedActionHost(options) {
 		return error instanceof HostError ? errorMessage(error) : redactErrorText(options.redactErrorText, context, errorMessage(error));
 	}
 	async function submitAction(input) {
+		return submitActionInternal(input);
+	}
+	async function submitActionInternal(input, internal = {}) {
 		const read = snapshotSubmission(input);
-		if (read.executionReason && !["initial", "offline_replay"].includes(read.executionReason)) throw new Error(`Unsupported submitted execution reason: ${read.executionReason}`);
+		const submittedExecutionReason = read.executionReason;
+		if (submittedExecutionReason && !["initial", "offline_replay"].includes(submittedExecutionReason) && !(internal.staged && submittedExecutionReason === "staged_dispatch")) throw new Error(`Unsupported submitted execution reason: ${submittedExecutionReason}`);
 		const action = actionResolver(read.actionId);
 		if (!action) throw new Error(`Unknown action: ${read.actionId}`);
 		const declaresAdmission = action.admitSubmission !== void 0;
@@ -1146,15 +1374,15 @@ function createGovernedActionHost(options) {
 		if (action.execution?.connectivity === "online-required" && submission.executionReason === "offline_replay") throw new Error(`Action ${submission.actionId} is online-required and cannot be submitted as an offline replay.`);
 		if (action.execution?.sensitivity === "restricted" && Object.keys(submission.provenance?.auditAttributes ?? {}).length > 0) throw new Error(`Action ${submission.actionId} declares restricted sensitivity; provenance audit attributes must not be durably recorded.`);
 		const authorizationInput = toAuthorizationInput(action, submission);
-		if (!await options.authorization.checkEntitlement(authorizationInput)) throw new Error(`Module "${action.namespace}" is not enabled for tenant ${submission.tenantId}`);
-		if (!await options.authorization.authorize(authorizationInput)) throw new Error(`Actor ${submission.actorId} is not authorized for action ${submission.actionId}`);
+		if (!await options.authorization.checkEntitlement(authorizationInput)) throw new SubmissionRefusalError(action.actionId, "entitlement", `Module "${action.namespace}" is not enabled for tenant ${submission.tenantId}`);
+		if (!await options.authorization.authorize(authorizationInput)) throw new SubmissionRefusalError(action.actionId, "authorization", `Actor ${submission.actorId} is not authorized for action ${submission.actionId}`);
 		if (declaresAdmission && (!submission.parametersArePrivate || !isRecord(submission.parameters))) refuseAdmission(action, submission, "invalid_parameters");
 		const actionInvocationId = createFabricId("act");
 		if (submission.correlationId && submission.provenance?.correlationId && submission.correlationId !== submission.provenance.correlationId) throw new Error("Invocation provenance correlationId does not match submission correlationId.");
 		if (submission.causationId && submission.provenance?.causationId && submission.causationId !== submission.provenance.causationId) throw new Error("Invocation provenance causationId does not match submission causationId.");
 		const correlationId = submission.correlationId ?? submission.provenance?.correlationId ?? createFabricId("corr");
 		const prepare = () => {
-			const durableParameters = options.redactActionParameters ? options.redactActionParameters(submission.actionId, submission.parameters) : submission.parameters;
+			const durableParameters = !internal.parametersAlreadyRedacted && options.redactActionParameters ? options.redactActionParameters(submission.actionId, submission.parameters) : submission.parameters;
 			const parameterDigest = digestParameters(submission.parameters);
 			if (submission.authorizationBinding) validateAuthorizationBinding(submission, parameterDigest, action.execution?.authorityMoment, now());
 			return {
@@ -1175,7 +1403,7 @@ function createGovernedActionHost(options) {
 		assertGovernanceRuntimeEvidence(runtimeEvidence);
 		const admission = declaresAdmission ? await admitSubmission(action, submission) : void 0;
 		const { durableParameters, parameterDigest } = early ?? prepare();
-		const durableInvocation = await options.store.createActionInvocation({
+		const invocationInput = {
 			id: actionInvocationId,
 			tenantId: submission.tenantId,
 			spaceId: submission.spaceId,
@@ -1201,7 +1429,24 @@ function createGovernedActionHost(options) {
 			...submission.executionReason ? { executionReason: submission.executionReason } : {},
 			...submission.authorizationBindingId ? { authorizationBindingId: submission.authorizationBindingId } : {},
 			...admission ? { admittedAt: admission.admittedAt } : {}
-		});
+		};
+		const staged = internal.staged;
+		const durableInvocation = staged ? await (async () => {
+			if (!stagedStore) throw new Error("Staged invocation store capability disappeared.");
+			const created = await stagedStore.createActionInvocationForStagedLease({
+				stageId: staged.id,
+				workerId: staged.workerId,
+				leaseToken: staged.leaseToken,
+				now: now(),
+				invocation: {
+					...invocationInput,
+					stagedOrigin: staged.origin
+				}
+			});
+			if (created.kind === "lease_lost") throw new StagedDispatchLeaseLostError("Staged invocation lease lost before child creation.");
+			staged.onChild(created.invocation);
+			return created.invocation;
+		})() : await options.store.createActionInvocation(invocationInput);
 		emitPlatformHostTelemetry(options.telemetry, {
 			kind: "event",
 			name: "invocation.submitted",
@@ -1235,6 +1480,7 @@ function createGovernedActionHost(options) {
 			}
 		}
 		const durableWorkflowId = `action-invocation-${durableInvocation.id}`;
+		if (internal.staged && durableInvocation.id !== actionInvocationId) return replayExistingStagedInvocation(durableInvocation);
 		if (durableInvocation.id !== actionInvocationId) {
 			if (options.dispatcher && durableInvocation.status === "pending") {
 				const dispatched = await options.dispatcher.dispatch({
@@ -1283,6 +1529,7 @@ function createGovernedActionHost(options) {
 				...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
 			}, submission.actionId);
 		} catch (error) {
+			if (internal.staged) throw new StagedDispatcherHandoffError("Staged child dispatcher handoff failed.");
 			throw error;
 		}
 		return {
@@ -1291,6 +1538,48 @@ function createGovernedActionHost(options) {
 		};
 	}
 	/**
+	* Hand an existing staged child to the dispatcher again under its stable
+	* workflow id, as the public replay branch above does, when the child is
+	* still pending and a dispatcher is configured. Returns undefined when no
+	* handoff is needed. Raw dispatcher errors are replaced by a fixed one.
+	*/
+	async function handOffExistingStagedChild(existing) {
+		if (!options.dispatcher || existing.status !== "pending") return void 0;
+		try {
+			return await options.dispatcher.dispatch({
+				actionInvocationId: existing.id,
+				actionId: existing.actionId,
+				tenantId: existing.tenantId,
+				spaceId: existing.spaceId,
+				workflowId: `action-invocation-${existing.id}`
+			});
+		} catch {
+			throw new StagedDispatcherHandoffError("Staged child dispatcher handoff failed.");
+		}
+	}
+	async function replayExistingStagedInvocation(existing) {
+		const workflowId = `action-invocation-${existing.id}`;
+		const dispatched = await handOffExistingStagedChild(existing);
+		if (dispatched) return withConsistency({
+			actionInvocationId: existing.id,
+			status: existing.status,
+			workflowId: dispatched.workflowId,
+			...dispatched.runId ? { runId: dispatched.runId } : {}
+		}, existing.actionId);
+		return withConsistency({
+			actionInvocationId: existing.id,
+			status: existing.status,
+			workflowId,
+			result: existing.result,
+			...existing.error ? { error: existing.error } : {},
+			...existing.hitlRoute ? { hitlRoute: existing.hitlRoute } : {},
+			...existing.hitlRiskTier ? { hitlRiskTier: existing.hitlRiskTier } : {},
+			...existing.authorizationReconciliation ? { reconciliation: existing.authorizationReconciliation } : {},
+			...existing.adapterReconciliation ? { adapterReconciliation: existing.adapterReconciliation } : {},
+			...existing.pendingCompletion ? { pendingCompletion: existing.pendingCompletion } : {}
+		}, existing.actionId);
+	}
+	/**
 	* Run the action's `admitSubmission` check on a copy of the submission
 	* snapshot's parameters, with the snapshot's scope and actor, bounded by
 	* `admissionTimeoutMs`. Returns when it was admitted; anything but
@@ -1462,6 +1751,7 @@ function createGovernedActionHost(options) {
 			await attemptEvidenceWrites(evidenceWrites);
 		}
 		async function failExecution(record, status, error) {
+			if (record.finalizationCheckpoint && hasDurableProviderEffect) return settleAppliedEffect(error);
 			await persistExecutionInvocation(record, {
 				status,
 				error
@@ -1754,14 +2044,34 @@ function createGovernedActionHost(options) {
 			};
 		}
 		const action = actionResolver(invocation.actionId);
-		if (action && (resumingRunningInvocation || invocation.attemptCount > 1)) try {
-			for (const [stepIndex] of (action.adapterSteps ?? []).entries()) {
+		let hasNonSucceededAdapterRow = false;
+		if ((action || invocation.finalizationCheckpoint) && (resumingRunningInvocation || invocation.attemptCount > 1)) try {
+			let runningCheckpoint;
+			for (const stepIndex of Array.from({ length: Math.max((action?.adapterSteps ?? []).length, invocation.finalizationCheckpoint?.steps.length ?? 0) }, (_, index) => index)) {
 				const record = await options.store.getAdapterInvocation(lifecycleId("adp", actionInvocationId, String(stepIndex)), adapterInvocationScope);
-				if (record) adapterStatuses.set(record.id, record.status);
+				if (record) {
+					adapterStatuses.set(record.id, record.status);
+					hasNonSucceededAdapterRow ||= record.status !== "succeeded";
+				}
 				if (record?.status === "succeeded") hasDurableProviderEffect = true;
+				if (invocation.finalizationCheckpoint && record?.status === "running") runningCheckpoint ??= {
+					stepIndex,
+					record
+				};
 				if (record?.status !== "ambiguous") continue;
 				return await settleUnknownOutcome(stepIndex, recordedAdapterReconciliation(record), record.reconciliation?.adapterEventSubject);
 			}
+			if (runningCheckpoint) {
+				const { stepIndex, record } = runningCheckpoint;
+				return await settleUnknownOutcome(stepIndex, {
+					kind: "adapter_outcome_ambiguous",
+					adapterInvocationId: record.id,
+					adapterType: record.adapterType,
+					operation: record.operation,
+					vendor: record.vendor,
+					message: "Recorded adapter outcome is unknown."
+				});
+			}
 		} catch (error) {
 			if (error instanceof RecoverableFinalizationError) throw error;
 			throw new RecoverableFinalizationError(caughtError({
@@ -1771,6 +2081,37 @@ function createGovernedActionHost(options) {
 		}
 		if (invocation.status === "running" && invocation.pendingCompletion && !invocation.leaseOwner) return withConsistency(actionResult(invocation), invocation.actionId);
 		if (!action) return hostOperation(() => failExecution(invocation, "failed", `Unknown action: ${invocation.actionId}`));
+		if (invocation.finalizationCheckpoint && !action.finalize) return interruptedNonIdempotent("Action no longer declares its checkpointed finalizer.");
+		let hasFencedAdapterWrites = false;
+		try {
+			assertAdapterStepDeadlines(action);
+			assertActionFinalization(action);
+			if ((action.stagesInvocations?.length ?? 0) > 0) {
+				const store = asAtomicMutationStore(options.store);
+				if (!stagedStore || !store) throw new Error("Staged descendant invocations require an atomic staging-capable store.");
+				await store.transactionWithEvents(async (transaction) => {
+					if (typeof transaction.stageInvocations !== "function") throw new Error("Staged descendant invocations require transaction-scoped stageInvocations support.");
+				});
+			}
+			if (action.finalize) {
+				const store = asAtomicMutationStore(options.store);
+				if (!store) throw new Error("Action finalization requires atomic mutation transactions.");
+				await store.transactionWithEvents(async (transaction) => {
+					if (typeof transaction.getActionInvocationForUpdate !== "function" || typeof transaction.updateLeasedActionInvocation !== "function" || options.outbox && typeof transaction.appendEventWithOutbox !== "function") throw new Error("Action finalization requires atomic invocation locking and transaction-scoped lease fencing.");
+					hasFencedAdapterWrites = typeof options.store.writeAdapterInvocation === "function" && typeof transaction.writeAdapterInvocation === "function";
+				});
+			}
+		} catch (error) {
+			return interruptedNonIdempotent(caughtError({
+				actionId: action.actionId,
+				source: "execution"
+			}, error));
+		}
+		const replayCheckpoint = action.finalize && (resumingRunningInvocation || invocation.attemptCount > 1) ? invocation.finalizationCheckpoint : void 0;
+		if (replayCheckpoint) {
+			if (replayCheckpoint.protocol !== "atomic-after-adapters-v1" || replayCheckpoint.actionVersion !== action.version || replayCheckpoint.steps.length !== (action.adapterSteps ?? []).length || replayCheckpoint.steps.some((step, index) => step.adapterType !== action.adapterSteps[index]?.adapterType || step.operation !== action.adapterSteps[index]?.operation) || invocation.pendingCompletion) return interruptedNonIdempotent("Finalization checkpoint protocol, action version, step identity or handoff is incompatible with replay.");
+		}
+		if (action.finalize && !replayCheckpoint && (resumingRunningInvocation || invocation.attemptCount > 1) && hasDurableProviderEffect) return interruptedNonIdempotent("Finalizing action recovery requires a preparation checkpoint; reconciliation is required.");
 		if (action.admitSubmission !== void 0 && !isAdmissionTime(invocation.admittedAt)) return hostOperation(() => failExecution(invocation, "failed", `Invocation of ${action.actionId} was not admitted at submission; an action that declares admitSubmission runs only on invocations its check admitted.`));
 		if (action.kind === "saga") return hostOperation(() => failExecution(invocation, "failed", `Saga action ${invocation.actionId} requires a durable PlatformActionDispatcher and cannot execute as an atomic Host action.`));
 		async function interruptedNonIdempotent(message) {
@@ -1800,8 +2141,9 @@ function createGovernedActionHost(options) {
 			}
 			return hostOperation(() => failExecution(invocation, "failed", message));
 		}
-		if (resumingRunningInvocation && invocation.attemptCount === 0 && !invocation.leaseOwner && !action.idempotent) return interruptedNonIdempotent(`Interrupted inline action ${invocation.actionId} is not declared idempotent; manual reconciliation is required.`);
-		if (invocation.attemptCount > 1 && !action.idempotent) return interruptedNonIdempotent(`Interrupted action ${invocation.actionId} is not declared idempotent; manual reconciliation is required.`);
+		const canReplayNonIdempotent = !!replayCheckpoint && !hasNonSucceededAdapterRow && (!executionLease || hasFencedAdapterWrites);
+		if (resumingRunningInvocation && invocation.attemptCount === 0 && !invocation.leaseOwner && !action.idempotent && !canReplayNonIdempotent) return interruptedNonIdempotent(`Interrupted inline action ${invocation.actionId} is not declared idempotent; manual reconciliation is required.`);
+		if (invocation.attemptCount > 1 && !action.idempotent && !canReplayNonIdempotent && invocation.deferredBeforeEffectAttempt !== invocation.attemptCount - 1) return interruptedNonIdempotent(`Interrupted action ${invocation.actionId} is not declared idempotent; manual reconciliation is required.`);
 		if (invocation.status !== "running") await hostOperation(() => options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "running" }));
 		emitPlatformHostTelemetry(options.telemetry, {
 			kind: "event",
@@ -2002,144 +2344,229 @@ function createGovernedActionHost(options) {
 					}))));
 				}
 			}
+			const preparedInputs = /* @__PURE__ */ new Map();
+			let preparation = replayCheckpoint;
 			let data;
+			let finalizationInput;
 			let domainEvents = [];
 			let pendingTransitionEvent;
+			let handlerStagedInvocations = replayCheckpoint?.stagedInvocations ?? [];
 			try {
-				const runHandler = async (db, transaction) => {
-					if (options.outbox && !transaction?.appendEventWithOutbox) throw new HostError("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
-					const binding = action.stateMachine;
-					let replayedTransition;
-					let pendingStateTransition;
-					let validatedTransition;
-					if (binding) {
-						const machine = stateMachineResolver(binding.entityType);
-						const entityId = binding.getEntityId(parsed.data);
-						const getEntityState = transaction?.getEntityState ? transaction.getEntityState.bind(transaction) : options.store.getEntityState.bind(options.store);
-						const currentState = entityId ? await hostOperation(() => getEntityState(tenantId, spaceId, binding.entityType, entityId)) ?? initialState(machine) : initialState(machine);
-						const targetState = typeof binding.targetState === "function" ? binding.targetState(parsed.data) : binding.targetState;
-						if (targetState !== "") {
-							const transition = await evaluateStateMachineTransition(machine, binding.entityType, currentState, targetState, action.actionId, {
-								entity: {
-									...entityId ? { id: entityId } : {},
-									state: currentState
-								},
-								actionInvocationId,
-								actorId: invocation.actorId,
-								parameters: parsed.data,
-								db
-							});
-							validatedTransition = {
-								entityId,
-								currentState,
-								targetState,
-								valid: transition.valid
-							};
-							let replayingAppliedTransition = false;
-							if (action.idempotent && currentState === targetState && !transition.valid && entityId) {
-								let source;
-								if (transaction?.getEntityStateSource) source = await hostOperation(() => transaction.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId));
-								else if (options.store.getEntityStateSource) source = await hostOperation(() => options.store.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId));
-								else {
-									const eventStore = options.store;
-									const listEvents = transaction?.listEvents?.bind(transaction) ?? eventStore.listEvents?.bind(eventStore);
-									const events = listEvents ? await hostOperation(() => listEvents(tenantId, spaceId)) : [];
-									let latest;
-									for (const event of events) if (event.tenantId === tenantId && event.spaceId === spaceId && event.subjectType === binding.entityType && event.subjectId === entityId && typeof event.payload?.toState === "string" && (!latest || event.sequence > latest.sequence)) latest = event;
-									if (latest && typeof latest.actionInvocationId === "string") source = {
-										state: latest.payload.toState,
-										actionInvocationId: latest.actionInvocationId
+				if (replayCheckpoint) {
+					data = structuredClone(replayCheckpoint.result);
+					finalizationInput = structuredClone({
+						params: replayCheckpoint.params,
+						handlerData: replayCheckpoint.handlerData
+					});
+					domainEvents = structuredClone(replayCheckpoint.handlerEvents);
+					pendingTransitionEvent = structuredClone(replayCheckpoint.stateTransition);
+				} else {
+					const runHandler = async (db, transaction) => {
+						if (options.outbox && !transaction?.appendEventWithOutbox) throw new HostError("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
+						if (action.finalize) {
+							const current = await transaction.getActionInvocationForUpdate(actionInvocationId, tenantId, spaceId);
+							if (!current || current.status !== "running" || current.finalizationCheckpoint || (executionLease ? current.leaseOwner !== executionLease.leaseOwner || current.leaseToken !== executionLease.leaseToken : !!current.leaseOwner)) throw new RecoverableFinalizationError(`Invocation preparation ownership changed: ${actionInvocationId}`);
+						}
+						const binding = action.stateMachine;
+						let replayedTransition;
+						let pendingStateTransition;
+						let validatedTransition;
+						if (binding) {
+							const machine = stateMachineResolver(binding.entityType);
+							const entityId = binding.getEntityId(parsed.data);
+							const getEntityState = transaction?.getEntityState ? transaction.getEntityState.bind(transaction) : options.store.getEntityState.bind(options.store);
+							const currentState = entityId ? await hostOperation(() => getEntityState(tenantId, spaceId, binding.entityType, entityId)) ?? initialState(machine) : initialState(machine);
+							const targetState = typeof binding.targetState === "function" ? binding.targetState(parsed.data) : binding.targetState;
+							if (targetState !== "") {
+								const transition = await evaluateStateMachineTransition(machine, binding.entityType, currentState, targetState, action.actionId, {
+									entity: {
+										...entityId ? { id: entityId } : {},
+										state: currentState
+									},
+									actionInvocationId,
+									actorId: invocation.actorId,
+									parameters: parsed.data,
+									db
+								});
+								validatedTransition = {
+									entityId,
+									currentState,
+									targetState,
+									valid: transition.valid
+								};
+								let replayingAppliedTransition = false;
+								if (action.idempotent && currentState === targetState && !transition.valid && entityId) {
+									let source;
+									if (transaction?.getEntityStateSource) source = await hostOperation(() => transaction.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId));
+									else if (options.store.getEntityStateSource) source = await hostOperation(() => options.store.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId));
+									else {
+										const eventStore = options.store;
+										const listEvents = transaction?.listEvents?.bind(transaction) ?? eventStore.listEvents?.bind(eventStore);
+										const events = listEvents ? await hostOperation(() => listEvents(tenantId, spaceId)) : [];
+										let latest;
+										for (const event of events) if (event.tenantId === tenantId && event.spaceId === spaceId && event.subjectType === binding.entityType && event.subjectId === entityId && typeof event.payload?.toState === "string" && (!latest || event.sequence > latest.sequence)) latest = event;
+										if (latest && typeof latest.actionInvocationId === "string") source = {
+											state: latest.payload.toState,
+											actionInvocationId: latest.actionInvocationId
+										};
+									}
+									replayingAppliedTransition = source?.actionInvocationId === actionInvocationId && source.state === currentState;
+								}
+								const pending = invocation.pendingStateTransition;
+								if (replayingAppliedTransition && pending && pending.entityType === binding.entityType && pending.entityId === entityId && pending.toState === currentState) replayedTransition = pending;
+								if (action.idempotent && transition.valid && entityId && action.eventPhase === "after_adapters") {
+									pendingStateTransition = {
+										entityType: binding.entityType,
+										entityId,
+										fromState: currentState,
+										toState: targetState
 									};
+									if (!transaction) await hostOperation(() => options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition }));
 								}
-								replayingAppliedTransition = source?.actionInvocationId === actionInvocationId && source.state === currentState;
+								if (!transition.valid && !replayingAppliedTransition) throw transition.error != null ? new Error(transition.error) : new HostError("Invalid state transition");
 							}
-							const pending = invocation.pendingStateTransition;
-							if (replayingAppliedTransition && pending && pending.entityType === binding.entityType && pending.entityId === entityId && pending.toState === currentState) replayedTransition = pending;
-							if (action.idempotent && transition.valid && entityId && action.eventPhase === "after_adapters") {
-								pendingStateTransition = {
+						}
+						const handlerResult = action.handler ? await action.handler({
+							actionInvocationId,
+							tenantId,
+							spaceId,
+							actorId: invocation.actorId,
+							actorType: invocation.actorType,
+							correlationId: invocation.correlationId,
+							...invocation.causationId ? { causationId: invocation.causationId } : {},
+							...invocation.provenance ? { provenance: invocation.provenance } : {},
+							...isAdmissionTime(invocation.admittedAt) ? { admittedAt: invocation.admittedAt } : {},
+							db,
+							services: options.services,
+							...action.finalize ? { finalizationProtocol: "atomic-after-adapters-v1" } : {}
+						}, parsed.data) : {
+							success: true,
+							data: {}
+						};
+						if (!handlerResult.success) throw handlerResult.error != null ? new Error(handlerResult.error) : new HostError("Action handler failed");
+						const handlerData = handlerResult.data ?? {};
+						const rawStagedInvocations = handlerResult.stagedInvocations ?? [];
+						const stagedRecords = prepareStagedInvocationBatch({
+							parent: invocation,
+							parentAction: action,
+							requests: rawStagedInvocations,
+							resolveAction: actionResolver,
+							redactParameters: options.redactActionParameters,
+							now: now()
+						});
+						handlerStagedInvocations = stagedRecords.map((record) => ({
+							key: record.key,
+							actionId: record.actionId,
+							parameters: structuredClone(record.parameters)
+						}));
+						if (stagedRecords.length > 0 && action.eventPhase !== "after_adapters") {
+							if (!transaction?.stageInvocations) throw new Error("Staged descendant invocations require an atomic staging transaction.");
+							await transaction.stageInvocations(stagedRecords);
+						}
+						if (action.resultSchema && !action.finalize) {
+							const publicResult = withoutPrivateHostFields(handlerData, eventResultFields);
+							const parsedResult = action.resultSchema.safeParse(publicResult);
+							if (!parsedResult.success) throw new HostError(`Action result validation failed at ${parsedResult.error.issues.map((issue) => issue.path.map(String).join(".") || "result").join(", ")}`);
+						}
+						const preparedFinalizationInput = action.finalize ? {
+							params: normalizeFinalizationJson(parsed.data),
+							handlerData: normalizeFinalizationJson(withoutPrivateHostFields(handlerData, eventResultFields))
+						} : void 0;
+						const extractedEvents = extractEvents(handlerData);
+						const events = action.finalize ? normalizeFinalizationJson(extractedEvents) : extractedEvents;
+						const undeclaredEvent = events.find((event) => !action.emitsEvents.includes(event.eventType));
+						if (undeclaredEvent) throw new HostError(`${action.actionId} emitted undeclared event type ${undeclaredEvent.eventType}`);
+						if (action.eventPhase !== "after_adapters") for (const [index, event] of events.entries()) await hostOperation(() => appendEvent(invocation, event, `domain:${index}`, action.version, transaction));
+						let transitionEvent;
+						if (binding && validatedTransition?.entityId && (validatedTransition.valid || replayedTransition)) {
+							const { entityId, currentState, targetState } = validatedTransition;
+							if (!events.some((event) => event.eventType === "StateTransitioned" && event.subjectType === binding.entityType && event.subjectId === entityId)) transitionEvent = {
+								eventType: "StateTransitioned",
+								subjectType: binding.entityType,
+								subjectId: entityId,
+								payload: {
 									entityType: binding.entityType,
 									entityId,
-									fromState: currentState,
-									toState: targetState
-								};
-								if (!transaction) await hostOperation(() => options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition }));
-							}
-							if (!transition.valid && !replayingAppliedTransition) throw transition.error != null ? new Error(transition.error) : new HostError("Invalid state transition");
+									fromState: replayedTransition?.fromState ?? currentState,
+									toState: targetState,
+									causedByAction: action.actionId
+								}
+							};
 						}
-					}
-					const handlerResult = action.handler ? await action.handler({
-						actionInvocationId,
-						tenantId,
-						spaceId,
-						actorId: invocation.actorId,
-						actorType: invocation.actorType,
-						correlationId: invocation.correlationId,
-						...invocation.causationId ? { causationId: invocation.causationId } : {},
-						...invocation.provenance ? { provenance: invocation.provenance } : {},
-						...isAdmissionTime(invocation.admittedAt) ? { admittedAt: invocation.admittedAt } : {},
-						db,
-						services: options.services
-					}, parsed.data) : {
-						success: true,
-						data: {}
-					};
-					if (!handlerResult.success) throw handlerResult.error != null ? new Error(handlerResult.error) : new HostError("Action handler failed");
-					const handlerData = handlerResult.data ?? {};
-					if (action.resultSchema) {
-						const publicResult = withoutPrivateHostFields(handlerData, eventResultFields);
-						const parsedResult = action.resultSchema.safeParse(publicResult);
-						if (!parsedResult.success) throw new HostError(`Action result validation failed at ${parsedResult.error.issues.map((issue) => issue.path.map(String).join(".") || "result").join(", ")}`);
-					}
-					const events = extractEvents(handlerData);
-					const undeclaredEvent = events.find((event) => !action.emitsEvents.includes(event.eventType));
-					if (undeclaredEvent) throw new HostError(`${action.actionId} emitted undeclared event type ${undeclaredEvent.eventType}`);
-					if (action.eventPhase !== "after_adapters") for (const [index, event] of events.entries()) await hostOperation(() => appendEvent(invocation, event, `domain:${index}`, action.version, transaction));
-					let transitionEvent;
-					if (binding && validatedTransition?.entityId && (validatedTransition.valid || replayedTransition)) {
-						const { entityId, currentState, targetState } = validatedTransition;
-						if (!events.some((event) => event.eventType === "StateTransitioned" && event.subjectType === binding.entityType && event.subjectId === entityId)) transitionEvent = {
-							eventType: "StateTransitioned",
-							subjectType: binding.entityType,
-							subjectId: entityId,
-							payload: {
-								entityType: binding.entityType,
-								entityId,
-								fromState: replayedTransition?.fromState ?? currentState,
-								toState: targetState,
-								causedByAction: action.actionId
+						if (transitionEvent && action.eventPhase !== "after_adapters") await hostOperation(() => appendEvent(invocation, transitionEvent, "state:transition", 1, transaction));
+						if (transaction && pendingStateTransition) await hostOperation(() => transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition }));
+						if (preparedFinalizationInput) {
+							const skipped = [];
+							for (const [index, step] of (action.adapterSteps ?? []).entries()) {
+								const input = step.getInput(structuredClone(preparedFinalizationInput.params), structuredClone(preparedFinalizationInput.handlerData));
+								preparedInputs.set(index, input);
+								if (!input) skipped.push(index);
 							}
+							preparation = normalizeFinalizationJson({
+								protocol: "atomic-after-adapters-v1",
+								actionVersion: action.version,
+								steps: (action.adapterSteps ?? []).map(({ adapterType, operation }) => ({
+									adapterType,
+									operation
+								})),
+								...preparedFinalizationInput,
+								handlerEvents: events,
+								result: preparedFinalizationInput.handlerData,
+								...transitionEvent ? { stateTransition: transitionEvent } : {},
+								skipped,
+								...handlerStagedInvocations.length > 0 ? { stagedInvocations: handlerStagedInvocations } : {}
+							});
+							if (new TextEncoder().encode(canonicalJson(preparation)).byteLength > 262144) throw new HostError("Finalization checkpoint exceeds 256 KiB.");
+							if (executionLease) {
+								if (!await transaction.updateLeasedActionInvocation({
+									id: actionInvocationId,
+									tenantId,
+									spaceId,
+									workerId: executionLease.leaseOwner,
+									leaseToken: executionLease.leaseToken,
+									patch: { finalizationCheckpoint: preparation }
+								})) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
+							} else await transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, { finalizationCheckpoint: preparation });
+						}
+						return {
+							data: handlerData,
+							domainEvents: events,
+							pendingTransitionEvent: transitionEvent,
+							finalizationInput: preparedFinalizationInput
 						};
-					}
-					if (transitionEvent && action.eventPhase !== "after_adapters") await hostOperation(() => appendEvent(invocation, transitionEvent, "state:transition", 1, transaction));
-					if (transaction && pendingStateTransition) await hostOperation(() => transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition }));
-					return {
-						data: handlerData,
-						domainEvents: events,
-						pendingTransitionEvent: transitionEvent
 					};
-				};
-				const atomicStore = asAtomicMutationStore(options.store);
-				let callbackFailure;
-				const run = async (db, transaction) => {
-					callbackFailure = void 0;
-					try {
-						return await runHandler(db, transaction);
-					} catch (error) {
-						callbackFailure = { error };
-						throw error;
-					}
-				};
-				const executed = await (async () => {
-					try {
-						return atomicStore ? await atomicStore.transactionWithEvents((transaction) => run(transaction.db, transaction)) : await options.store.transaction((db) => run(db));
-					} catch (error) {
-						if (callbackFailure) throw callbackFailure.error;
-						return hostOperation(() => Promise.reject(error));
-					}
-				})();
-				data = executed.data;
-				domainEvents = executed.domainEvents;
-				pendingTransitionEvent = executed.pendingTransitionEvent;
+					const atomicStore = asAtomicMutationStore(options.store);
+					let callbackFailure;
+					const run = async (db, transaction) => {
+						callbackFailure = void 0;
+						try {
+							return await runHandler(db, transaction);
+						} catch (error) {
+							callbackFailure = { error };
+							throw error;
+						}
+					};
+					const executed = await (async () => {
+						try {
+							return atomicStore ? await atomicStore.transactionWithEvents((transaction) => run(transaction.db, transaction)) : await options.store.transaction((db) => run(db));
+						} catch (error) {
+							if (callbackFailure) throw callbackFailure.error;
+							if (action.finalize) throw new RecoverableFinalizationError(caughtError({
+								actionId: action.actionId,
+								source: "execution"
+							}, error));
+							return hostOperation(() => Promise.reject(error));
+						}
+					})();
+					data = executed.data;
+					finalizationInput = executed.finalizationInput;
+					domainEvents = executed.domainEvents;
+					pendingTransitionEvent = executed.pendingTransitionEvent;
+					if (preparation) invocation = {
+						...invocation,
+						finalizationCheckpoint: preparation
+					};
+				}
 			} catch (error) {
 				if (error instanceof RecoverableFinalizationError) throw error;
 				if (isReconciliationRequiredError(error)) {
@@ -2164,6 +2591,7 @@ function createGovernedActionHost(options) {
 					source: "handler"
 				}, error)));
 			}
+			const finalizationSteps = [];
 			let pendingHandoff = invocation.pendingCompletion;
 			for (const [stepIndex, step] of (action.adapterSteps ?? []).entries()) {
 				const adapterInvocationId = lifecycleId("adp", actionInvocationId, String(stepIndex));
@@ -2233,8 +2661,16 @@ function createGovernedActionHost(options) {
 					}, error));
 				}
 				if (previousAdapterInvocation?.status === "ambiguous") return await settleUnknownOutcome(stepIndex, recordedAdapterReconciliation(previousAdapterInvocation), previousAdapterInvocation.reconciliation?.adapterEventSubject);
-				const input = step.getInput(parsed.data, data);
-				if (!input) continue;
+				const input = action.finalize ? preparation.skipped.includes(stepIndex) ? void 0 : replayCheckpoint ? step.getInput(structuredClone(replayCheckpoint.params), structuredClone(replayCheckpoint.handlerData)) : preparedInputs.get(stepIndex) : step.getInput(parsed.data, data);
+				if (!input) {
+					if (action.finalize) finalizationSteps.push({
+						stepIndex,
+						adapterType: step.adapterType,
+						operation: step.operation,
+						status: "skipped"
+					});
+					continue;
+				}
 				const adapter = adapters.require(step.adapterType, step.operation);
 				const adapterEventSubject = options.adapterEventSubject?.(action.actionId, parsed.data, data) ?? {
 					subjectType: "AdapterInvocation",
@@ -2390,8 +2826,9 @@ function createGovernedActionHost(options) {
 				let thrownOutcome;
 				let adapterDeadlineTimer;
 				try {
-					const adapterController = options.adapterDeadlineMs ? new AbortController() : void 0;
-					const deadlineMs = options.adapterDeadlineMs ? now().getTime() + options.adapterDeadlineMs : void 0;
+					const effectiveDeadlineMs = step.deadlineMs ?? options.adapterDeadlineMs;
+					const adapterController = effectiveDeadlineMs ? new AbortController() : void 0;
+					const deadlineMs = effectiveDeadlineMs ? now().getTime() + effectiveDeadlineMs : void 0;
 					if (adapterController && deadlineMs) {
 						const remaining = deadlineMs - now().getTime();
 						if (remaining <= 0) throw new HostError(`Adapter deadline already expired before execution: ${step.adapterType}:${step.operation}`);
@@ -2576,6 +3013,7 @@ function createGovernedActionHost(options) {
 							...pendingCompletion ? { pendingCompletion } : {}
 						}, action.actionId);
 					}
+					if (action.finalize) output = normalizeFinalizationJson(output);
 					successOutput = output;
 					if (handoff) {
 						const reference = typeof handoff.externalReference === "string" ? handoff.externalReference.trim() : "";
@@ -2809,7 +3247,8 @@ function createGovernedActionHost(options) {
 					return hostOperation(() => failExecution(invocation, "failed", message));
 				}
 			}
-			const result = withoutPrivateHostFields(data, eventResultFields);
+			if (action.finalize && pendingHandoff) return settleAppliedEffect("Finalizing actions cannot finalize accepted external operations.", pendingHandoff);
+			let result = action.finalize ? { ...replayCheckpoint?.result ?? finalizationInput.handlerData } : withoutPrivateHostFields(data, eventResultFields);
 			const parked = pendingHandoff ? {
 				...pendingHandoff,
 				parkedAt: now()
@@ -2823,25 +3262,96 @@ function createGovernedActionHost(options) {
 				result
 			};
 			let verdictWritten = true;
+			let finalizationCallbackFailure;
 			try {
 				const atomicStore = asAtomicMutationStore(options.store);
 				if (action.eventPhase === "after_adapters" && atomicStore) {
-					await hostOperation(() => atomicStore.transactionWithEvents(async (transaction) => {
-						for (const [index, event] of domainEvents.entries()) await appendEvent(invocation, event, `domain:${index}`, action.version, transaction);
-						if (pendingTransitionEvent) await appendEvent(invocation, pendingTransitionEvent, "state:transition", 1, transaction);
-						if (executionLease) {
-							if (!transaction.updateLeasedActionInvocation) throw new HostError("Leased atomic finalization requires transaction-scoped fencing support.");
-							if (!await transaction.updateLeasedActionInvocation({
-								id: actionInvocationId,
-								tenantId,
-								spaceId,
-								workerId: executionLease.leaseOwner,
-								leaseToken: executionLease.leaseToken,
-								patch: finalPatch
-							})) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
-						} else verdictWritten = await writeInlineInvocation(invocation, finalPatch, transaction, onPreservedReconciliation);
-					}));
-					if (!pendingHandoff && verdictWritten) emitInvocationStatusTelemetry(invocation, "completed", options.telemetry, now());
+					if (action.finalize) for (const [stepIndex, step] of (action.adapterSteps ?? []).entries()) {
+						if (finalizationSteps.some((entry) => entry.stepIndex === stepIndex)) continue;
+						const row = await options.store.getAdapterInvocation(lifecycleId("adp", actionInvocationId, String(stepIndex)), adapterInvocationScope);
+						if (row?.status !== "succeeded" || row.output === void 0) {
+							const error = /* @__PURE__ */ new Error("Finalization requires successful stored adapter output.");
+							finalizationCallbackFailure = { error };
+							throw error;
+						}
+						finalizationSteps.push({
+							stepIndex,
+							adapterType: step.adapterType,
+							operation: step.operation,
+							status: "succeeded",
+							adapterInvocationId: row.id,
+							output: finalizationJson(row.output)
+						});
+					}
+					const finalizeSuccess = () => atomicStore.transactionWithEvents(async (transaction) => {
+						try {
+							let finalized;
+							async function assertFinalizationOwner() {
+								const current = await transaction.getActionInvocationForUpdate(actionInvocationId, tenantId, spaceId);
+								if (!current || current.status !== "running" || (executionLease ? current.leaseOwner !== executionLease.leaseOwner || current.leaseToken !== executionLease.leaseToken : !!current.leaseOwner)) throw new RecoverableFinalizationError(`Invocation lease lost or no longer running: ${actionInvocationId}`);
+							}
+							if (action.finalize) {
+								await assertFinalizationOwner();
+								finalized = validateFinalization(await action.finalize({
+									actionInvocationId,
+									tenantId,
+									spaceId,
+									actorId: invocation.actorId,
+									actorType: invocation.actorType,
+									correlationId: invocation.correlationId,
+									causationId: invocation.causationId,
+									provenance: invocation.provenance ? structuredClone(invocation.provenance) : void 0,
+									db: transaction.db
+								}, {
+									...structuredClone(finalizationInput),
+									adapterOutputs: structuredClone(finalizationSteps.sort((a, b) => a.stepIndex - b.stepIndex))
+								}), action, eventResultFields, options.eventContracts);
+								result = withoutPrivateHostFields({
+									...result,
+									...finalized.resultPatch
+								}, eventResultFields);
+								if (action.resultSchema && !action.resultSchema.safeParse(result).success) throw new Error("Finalization merged result does not match resultSchema.");
+								finalPatch.result = result;
+							}
+							const stagedRequests = [...handlerStagedInvocations, ...finalized?.stagedInvocations ?? []];
+							if (stagedRequests.length > 0) {
+								if (!transaction.stageInvocations) throw new Error("Staged descendant invocations require an atomic staging transaction.");
+								await transaction.stageInvocations(prepareStagedInvocationBatch({
+									parent: invocation,
+									parentAction: action,
+									requests: stagedRequests,
+									resolveAction: actionResolver,
+									redactParameters: options.redactActionParameters,
+									redactedKeys: handlerStagedInvocations.map((request) => request.key),
+									now: now()
+								}));
+							}
+							for (const [index, event] of domainEvents.entries()) await appendEvent(invocation, event, `domain:${index}`, action.version, transaction);
+							for (const [index, event] of (finalized?.events ?? []).entries()) await appendEvent(invocation, event, `finalize:${index}`, action.version, transaction);
+							if (pendingTransitionEvent) await appendEvent(invocation, pendingTransitionEvent, "state:transition", 1, transaction);
+							if (action.finalize) await assertFinalizationOwner();
+							if (executionLease) {
+								if (!transaction.updateLeasedActionInvocation) throw new HostError("Leased atomic finalization requires transaction-scoped fencing support.");
+								if (!await transaction.updateLeasedActionInvocation({
+									id: actionInvocationId,
+									tenantId,
+									spaceId,
+									workerId: executionLease.leaseOwner,
+									leaseToken: executionLease.leaseToken,
+									patch: finalPatch
+								})) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
+							} else verdictWritten = await writeInlineInvocation(invocation, finalPatch, transaction, onPreservedReconciliation);
+						} catch (error) {
+							finalizationCallbackFailure = { error };
+							throw error;
+						}
+					});
+					if (action.finalize) await finalizeSuccess();
+					else await hostOperation(finalizeSuccess);
+					if (!pendingHandoff && verdictWritten) {
+						if (action.finalize) rememberVerdict(finalPatch);
+						emitInvocationStatusTelemetry(invocation, "completed", options.telemetry, now());
+					}
 				} else {
 					if (action.eventPhase === "after_adapters") {
 						for (const [index, event] of domainEvents.entries()) await hostOperation(() => appendEvent(invocation, event, `domain:${index}`, action.version));
@@ -2850,6 +3360,33 @@ function createGovernedActionHost(options) {
 					await hostOperation(() => persistExecutionInvocation(invocation, finalPatch));
 				}
 			} catch (error) {
+				if (isReconciliationRequiredError(error) && error.message.startsWith("Staged invocation batch drift")) {
+					const message = caughtError({
+						actionId: action.actionId,
+						source: "execution"
+					}, error);
+					await hostOperation(() => persistExecutionInvocation(invocation, {
+						status: "reconciliation_required",
+						error: message
+					}));
+					return withConsistency({
+						actionInvocationId,
+						status: "reconciliation_required",
+						error: message
+					}, action.actionId);
+				}
+				if (action.finalize) {
+					if (error instanceof RecoverableFinalizationError) throw error;
+					if (!finalizationCallbackFailure || finalizationCallbackFailure.error !== error) throw new RecoverableFinalizationError(caughtError({
+						actionId: action.actionId,
+						source: "execution"
+					}, error));
+					const message = caughtError({
+						actionId: action.actionId,
+						source: "execution"
+					}, error);
+					return hasDurableProviderEffect ? settleAppliedEffect(message) : hostOperation(() => failExecution(invocation, "failed", message));
+				}
 				if (action.eventPhase === "after_adapters") throw new RecoverableFinalizationError(errorMessage(error));
 				throw error;
 			}
@@ -2864,7 +3401,13 @@ function createGovernedActionHost(options) {
 		} catch (error) {
 			if (error instanceof RecoverableFinalizationError) throw error;
 			if (retryableGovernance && isRetryableExecutionError(error)) {
-				const reason = executionReasonOverride === "approval_resume" ? "approval resume" : !invocation.leaseOwner || invocation.leaseToken === void 0 ? "not leased" : !action.idempotent ? "action not idempotent" : invocation.attemptCount >= retryableExecutionMaxAttempts ? `attempts exhausted (${invocation.attemptCount}/${retryableExecutionMaxAttempts})` : void 0;
+				let reason = executionReasonOverride === "approval_resume" ? "approval resume" : !invocation.leaseOwner || invocation.leaseToken === void 0 ? "not leased" : invocation.attemptCount >= retryableExecutionMaxAttempts ? `attempts exhausted (${invocation.attemptCount}/${retryableExecutionMaxAttempts})` : void 0;
+				if (!reason && !action.idempotent) try {
+					await persistExecutionInvocation(invocation, { deferredBeforeEffectAttempt: invocation.attemptCount });
+				} catch (markerError) {
+					if (markerError instanceof RecoverableFinalizationError) throw markerError;
+					reason = "pre-effect marker could not be recorded";
+				}
 				if (!reason) throw error;
 				return hostOperation(() => failExecution(invocation, "failed", caughtError({
 					actionId: invocation.actionId,
@@ -3128,8 +3671,282 @@ function createGovernedActionHost(options) {
 		actionResult,
 		withConsistency
 	});
+	async function dispatchStagedInvocations(input) {
+		if (!stagedStore) throw new Error("This Platform Host store does not support staged descendant invocations.");
+		const leaseDurationMs = input.leaseDurationMs ?? 3e4;
+		const submissionTimeoutMs = input.submissionTimeoutMs ?? 1e4;
+		const maxAttempts = input.maxAttempts ?? 10;
+		for (const [name, value] of [
+			["leaseDurationMs", leaseDurationMs],
+			["submissionTimeoutMs", submissionTimeoutMs],
+			["maxAttempts", maxAttempts]
+		]) if (!Number.isInteger(value) || value <= 0) throw new Error(`${name} must be a positive integer.`);
+		const cancelled = await stagedStore.cancelStagedInvocationsForFailedParents({
+			...input.tenantId ? { tenantId: input.tenantId } : {},
+			...input.spaceId ? { spaceId: input.spaceId } : {},
+			now: now()
+		});
+		const records = await stagedStore.claimStagedInvocations({
+			workerId: input.workerId,
+			leaseDurationMs,
+			limit: input.limit ?? 10,
+			...input.tenantId ? { tenantId: input.tenantId } : {},
+			...input.spaceId ? { spaceId: input.spaceId } : {},
+			now: now()
+		});
+		const result = {
+			claimed: records.length,
+			dispatched: 0,
+			rejected: 0,
+			failed: 0,
+			deadLettered: 0,
+			cancelled
+		};
+		const sweep = {
+			store: stagedStore,
+			input,
+			leaseDurationMs,
+			submissionTimeoutMs,
+			maxAttempts
+		};
+		for (const record of records) {
+			let outcome;
+			try {
+				outcome = await dispatchStagedRow(record, sweep);
+			} catch (error) {
+				reportStagedError(input, error);
+				outcome = "unsettled";
+			}
+			if (outcome === "dispatched") result.dispatched += 1;
+			else if (outcome === "rejected") result.rejected += 1;
+			else {
+				result.failed += 1;
+				if (outcome === "dead_lettered") result.deadLettered += 1;
+			}
+		}
+		return result;
+	}
+	/**
+	* Settle one claimed row through a single sequence:
+	*
+	* 1. Renew the claim's lease, then look the child up by staged origin. An
+	*    earlier attempt's creation still in flight holds an older lease token
+	*    and fails the creation fence, so this lookup is authoritative for
+	*    earlier attempts. A child found here goes to step 4: no
+	*    pre-submission checks, no governance.
+	* 2. No child: pre-submission checks and the shared submission pipeline.
+	* 3. Unless this attempt's own create returned the child, rotate the lease
+	*    token. Only this attempt's own timed-out submission could still create
+	*    the child, it holds the old token, and the store orders the rotation
+	*    after any create the fence already admitted. The lookup that follows is
+	*    authoritative; a child found there goes to step 4, otherwise the
+	*    outcome is classified as rejected, retry or dead letter.
+	* 4. A known child that is pending is handed to the configured dispatcher
+	*    again under its stable workflow id; the stage settles with its id.
+	*
+	* Each settlement is one compare-and-set on the current owner and token. A
+	* lookup that fails settles the row for retry, never terminally.
+	*/
+	async function dispatchStagedRow(record, sweep) {
+		const { store, input, leaseDurationMs, maxAttempts } = sweep;
+		const claimLease = {
+			id: record.id,
+			workerId: input.workerId,
+			leaseToken: record.leaseToken
+		};
+		if (!await store.renewStagedInvocationLease({
+			...claimLease,
+			leaseDurationMs,
+			now: now()
+		})) return "unsettled";
+		const prior = await lookUpStagedChild(record, sweep);
+		if (prior.kind === "unreadable") return settleStagedRetry(record, claimLease, sweep, {
+			error: STAGED_ERROR.lookup,
+			terminal: false
+		});
+		if (prior.kind === "found") return settleExistingStagedChild(record, claimLease, prior.child, sweep);
+		const known = {};
+		let failure;
+		let submitted = false;
+		const stopHeartbeat = startStagedHeartbeat(store, claimLease, input, leaseDurationMs);
+		try {
+			await withSubmissionTimeout(submitStagedChild(record, claimLease, (child) => {
+				known.child = child;
+			}), sweep.submissionTimeoutMs);
+			submitted = true;
+		} catch (error) {
+			failure = error;
+		} finally {
+			await stopHeartbeat();
+		}
+		const createdChild = known.child;
+		if (createdChild) {
+			if (submitted || !options.dispatcher) return settleStagedDispatched(claimLease, createdChild.id, sweep);
+			return settleStagedRetry(record, claimLease, sweep, {
+				error: STAGED_ERROR.handoff,
+				childInvocationId: createdChild.id,
+				terminal: record.attemptCount >= maxAttempts
+			});
+		}
+		const rotatedToken = await store.rotateStagedInvocationLease({
+			...claimLease,
+			leaseDurationMs,
+			now: now()
+		});
+		if (rotatedToken === void 0) return "unsettled";
+		const lease = {
+			...claimLease,
+			leaseToken: rotatedToken
+		};
+		const after = await lookUpStagedChild(record, sweep);
+		if (after.kind === "unreadable") return settleStagedRetry(record, lease, sweep, {
+			error: STAGED_ERROR.lookup,
+			terminal: false
+		});
+		if (after.kind === "found") return settleExistingStagedChild(record, lease, after.child, sweep);
+		if (isDefinitiveStagedRefusal(failure)) return await store.markStagedInvocationRejected({
+			...lease,
+			error: STAGED_ERROR.refused,
+			now: now()
+		}) ? "rejected" : "unsettled";
+		return settleStagedRetry(record, lease, sweep, {
+			error: STAGED_ERROR.dispatch,
+			terminal: record.attemptCount >= maxAttempts
+		});
+	}
+	/** Pre-submission checks, then the shared submission pipeline under the claim's lease. */
+	async function submitStagedChild(record, lease, onChild) {
+		const parent = await options.store.getActionInvocation(record.parentInvocationId, record.tenantId, record.spaceId);
+		if (!parent || parent.status !== "completed") throw new Error("Staged parent is not completed.");
+		const child = actionResolver(record.actionId);
+		if (!child) throw new StagedDispatchRejectionError("Staged action is no longer registered.");
+		if (child.execution?.authorityMoment === "capture") throw new StagedDispatchRejectionError("Staged action now requires capture-time authority.");
+		if (!child.schema.safeParse(structuredClone(record.parameters)).success) throw new StagedDispatchRejectionError("Staged parameters no longer match the registered action.");
+		return submitActionInternal({
+			actionId: record.actionId,
+			parameters: structuredClone(record.parameters),
+			tenantId: parent.tenantId,
+			spaceId: parent.spaceId,
+			actorId: parent.actorId,
+			actorType: parent.actorType,
+			correlationId: parent.correlationId,
+			causationId: parent.id,
+			provenance: {
+				source: "worker",
+				correlationId: parent.correlationId,
+				causationId: parent.id
+			},
+			executionReason: "staged_dispatch"
+		}, {
+			staged: {
+				id: record.id,
+				origin: {
+					parentInvocationId: parent.id,
+					stageKey: record.key
+				},
+				workerId: lease.workerId,
+				leaseToken: lease.leaseToken,
+				onChild
+			},
+			parametersAlreadyRedacted: true
+		});
+	}
+	async function lookUpStagedChild(record, sweep) {
+		try {
+			const child = await sweep.store.getActionInvocationByStagedOrigin(record.tenantId, record.spaceId, {
+				parentInvocationId: record.parentInvocationId,
+				stageKey: record.key
+			});
+			return child ? {
+				kind: "found",
+				child
+			} : { kind: "absent" };
+		} catch (error) {
+			reportStagedError(sweep.input, error);
+			return { kind: "unreadable" };
+		}
+	}
+	async function settleExistingStagedChild(record, lease, child, sweep) {
+		if (options.dispatcher && child.status === "pending") {
+			const stopHeartbeat = startStagedHeartbeat(sweep.store, lease, sweep.input, sweep.leaseDurationMs);
+			let handedOff = false;
+			try {
+				await withSubmissionTimeout(handOffExistingStagedChild(child), sweep.submissionTimeoutMs);
+				handedOff = true;
+			} catch {} finally {
+				await stopHeartbeat();
+			}
+			if (!handedOff) return settleStagedRetry(record, lease, sweep, {
+				error: STAGED_ERROR.handoff,
+				childInvocationId: child.id,
+				terminal: record.attemptCount >= sweep.maxAttempts
+			});
+		}
+		return settleStagedDispatched(lease, child.id, sweep);
+	}
+	async function settleStagedDispatched(lease, childInvocationId, sweep) {
+		return await sweep.store.markStagedInvocationDispatched({
+			...lease,
+			childInvocationId,
+			now: now()
+		}) ? "dispatched" : "unsettled";
+	}
+	async function settleStagedRetry(record, lease, sweep, settlement) {
+		if (!await sweep.store.markStagedInvocationFailed({
+			...lease,
+			error: settlement.error,
+			availableAt: new Date(now().getTime() + (sweep.input.retryDelayMs?.(record.attemptCount) ?? 1e3)),
+			deadLetter: settlement.terminal,
+			...settlement.childInvocationId ? { childInvocationId: settlement.childInvocationId } : {},
+			now: now()
+		})) return "unsettled";
+		return settlement.terminal ? "dead_lettered" : "retry";
+	}
+	function isDefinitiveStagedRefusal(error) {
+		return error instanceof SubmissionRefusalError || error instanceof StagedDispatchRejectionError || error instanceof ActionAdmissionError && (error.refusal === "refused" || error.refusal === "invalid_parameters");
+	}
+	function reportStagedError(input, error) {
+		try {
+			input.onError?.(error);
+		} catch {}
+	}
+	/** Renew one lease token while a slow step runs; the returned stop awaits a renewal in flight. */
+	function startStagedHeartbeat(store, lease, input, leaseDurationMs) {
+		const intervalMs = input.leaseRenewalIntervalMs ?? Math.max(1, Math.floor(leaseDurationMs / 3));
+		let stopped = false;
+		let timer;
+		let running;
+		const schedule = () => {
+			if (!stopped) timer = setTimeout(tick, intervalMs);
+		};
+		const tick = () => {
+			running = store.renewStagedInvocationLease({
+				...lease,
+				leaseDurationMs,
+				now: now()
+			}).then(() => void 0).catch(() => void 0).finally(schedule);
+		};
+		schedule();
+		return async () => {
+			stopped = true;
+			if (timer) clearTimeout(timer);
+			await running;
+		};
+	}
+	async function withSubmissionTimeout(submission, timeoutMs) {
+		let timer;
+		try {
+			return await Promise.race([submission, new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new StagedSubmissionTimeoutError("Staged invocation submission timed out.")), timeoutMs);
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
 	return {
 		submitAction,
+		hasStagedInvocationActions: declaresStaging,
+		...stagedStore ? { dispatchStagedInvocations } : {},
 		executeInvocation,
 		resumeApprovedInvocation,
 		recordExecutionAttestation,
@@ -3459,6 +4276,7 @@ function emitRelayTelemetry(telemetry, name, occurredAt, workerId, attributes) {
 var MemoryPlatformHostStore = class {
 	db;
 	transactionalOutbox;
+	transactionalStagedInvocations;
 	adapterCommit;
 	transactionTail = Promise.resolve();
 	invocations = [];
@@ -3469,6 +4287,7 @@ var MemoryPlatformHostStore = class {
 	executionAttestations = [];
 	externalReconciliations = [];
 	outbox = [];
+	stagedInvocations = [];
 	/**
 	* Requeue evidence is append-only audit history, so unlike the ledger
 	* arrays above, which tests have always inspected and seeded directly, it
@@ -3479,6 +4298,7 @@ var MemoryPlatformHostStore = class {
 	constructor(db, transactionProvider) {
 		this.db = db;
 		this.transactionalOutbox = transactionProvider !== void 0;
+		this.transactionalStagedInvocations = transactionProvider !== void 0;
 		if (transactionProvider) this.transactionWithEvents = (run) => this.runTransactionWithEvents(run, transactionProvider);
 	}
 	async transaction(run) {
@@ -3504,6 +4324,7 @@ var MemoryPlatformHostStore = class {
 			const conditionalAdapters = [];
 			const leasedUpdates = [];
 			const pendingReconciliations = [];
+			const pendingStagedBatches = [];
 			const appendPending = async (event, metadata) => {
 				if (this.events.some((candidate) => candidate.id === event.id) || pendingEvents.some((candidate) => candidate.event.id === event.id)) return;
 				pendingEvents.push({
@@ -3560,6 +4381,9 @@ var MemoryPlatformHostStore = class {
 				appendExternalReconciliation: async (record) => {
 					pendingReconciliations.push(record);
 				},
+				stageInvocations: async (records) => {
+					pendingStagedBatches.push(records.map(cloneStagedInvocationRecord));
+				},
 				updateActionInvocation: async (id, tenantId, spaceId, patch) => {
 					pendingUpdates.push({
 						id,
@@ -3613,6 +4437,15 @@ var MemoryPlatformHostStore = class {
 				rememberAppend(this.externalReconciliations, record.id);
 				await this.appendExternalReconciliation(record);
 			}
+			for (const records of pendingStagedBatches) {
+				const appended = this.applyStagedBatch(records);
+				if (appended.length > 0) undoLedgerWrites.push(() => {
+					for (const id of appended) {
+						const index = this.stagedInvocations.findIndex((record) => record.id === id);
+						if (index !== -1) this.stagedInvocations.splice(index, 1);
+					}
+				});
+			}
 			for (const [id, patch, scope] of pendingAdapterUpdates) {
 				const record = await this.getAdapterInvocation(id, scope);
 				if (!record) throw new Error(`AdapterInvocation not found: ${id}`);
@@ -3663,13 +4496,59 @@ var MemoryPlatformHostStore = class {
 		this.invocations.push(record);
 		return record;
 	}
+	async createActionInvocationForStagedLease(input) {
+		const { invocation, now = /* @__PURE__ */ new Date() } = input;
+		const existing = this.invocations.find((record) => record.tenantId === invocation.tenantId && record.spaceId === invocation.spaceId && record.stagedOrigin?.parentInvocationId === invocation.stagedOrigin.parentInvocationId && record.stagedOrigin.stageKey === invocation.stagedOrigin.stageKey);
+		if (existing) return {
+			kind: "existing",
+			invocation: existing
+		};
+		if (!this.stagedInvocations.find((record) => record.id === input.stageId && record.tenantId === invocation.tenantId && record.spaceId === invocation.spaceId && record.parentInvocationId === invocation.stagedOrigin.parentInvocationId && record.key === invocation.stagedOrigin.stageKey && record.actionId === invocation.actionId && record.status === "pending" && record.leaseOwner === input.workerId && record.leaseToken === input.leaseToken && record.leaseExpiresAt !== void 0 && record.leaseExpiresAt > now)) return { kind: "lease_lost" };
+		const createdAt = /* @__PURE__ */ new Date();
+		const record = {
+			...invocation,
+			attemptCount: 0,
+			leaseToken: 0,
+			createdAt,
+			updatedAt: createdAt
+		};
+		this.invocations.push(record);
+		return {
+			kind: "created",
+			invocation: record
+		};
+	}
+	applyStagedBatch(records) {
+		if (records.length === 0) return [];
+		const first = records[0];
+		const existing = this.stagedInvocations.filter((record) => record.tenantId === first.tenantId && record.spaceId === first.spaceId && record.parentInvocationId === first.parentInvocationId);
+		if (existing.length > 0) {
+			if (!(existing.length === records.length && records.every((record) => {
+				const stored = existing.find((candidate) => candidate.key === record.key);
+				return stored !== void 0 && stored.batchDigest === record.batchDigest && stagedInvocationRequestIdentity(stored) === stagedInvocationRequestIdentity(record);
+			}))) throw new ReconciliationRequiredError(`Staged invocation batch drift for parent ${first.parentInvocationId}.`);
+			return [];
+		}
+		const keys = records.map((record) => record.key);
+		if (new Set(keys).size !== keys.length || records.some((record) => record.tenantId !== first.tenantId || record.spaceId !== first.spaceId || record.parentInvocationId !== first.parentInvocationId || record.batchDigest !== first.batchDigest)) throw new Error(`Invalid staged invocation batch for parent ${first.parentInvocationId}.`);
+		for (const record of records) this.stagedInvocations.push(cloneStagedInvocationRecord(record));
+		return records.map((record) => record.id);
+	}
 	async getActionInvocation(id, tenantId, spaceId) {
 		return this.invocations.find((record) => record.id === id && record.tenantId === tenantId && record.spaceId === spaceId);
 	}
+	async getActionInvocationByStagedOrigin(tenantId, spaceId, origin) {
+		return this.invocations.find((record) => record.tenantId === tenantId && record.spaceId === spaceId && record.stagedOrigin?.parentInvocationId === origin.parentInvocationId && record.stagedOrigin.stageKey === origin.stageKey);
+	}
 	async updateActionInvocation(id, tenantId, spaceId, patch) {
 		const record = this.invocations.find((row) => row.id === id && row.tenantId === tenantId && row.spaceId === spaceId);
 		if (!record) throw new Error(`ActionInvocation not found: ${id}`);
 		Object.assign(record, patch, { updatedAt: /* @__PURE__ */ new Date() });
+		if (Object.hasOwn(patch, "finalizationCheckpoint")) {
+			if (patch.finalizationCheckpoint) record.finalizationCheckpoint = structuredClone(patch.finalizationCheckpoint);
+			else delete record.finalizationCheckpoint;
+		}
+		if (Object.hasOwn(patch, "deferredBeforeEffectAttempt") && patch.deferredBeforeEffectAttempt === void 0) delete record.deferredBeforeEffectAttempt;
 		if (Object.hasOwn(patch, "pendingStateTransition")) {
 			if (patch.pendingStateTransition) record.pendingStateTransition = { ...patch.pendingStateTransition };
 			else delete record.pendingStateTransition;
@@ -3990,6 +4869,96 @@ var MemoryPlatformHostStore = class {
 		record.updatedAt = current;
 		return true;
 	}
+	async claimStagedInvocations(input) {
+		while (this.adapterCommit) await this.adapterCommit;
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const eligible = this.stagedInvocations.filter((record) => {
+			return this.invocations.find((candidate) => candidate.id === record.parentInvocationId && candidate.tenantId === record.tenantId && candidate.spaceId === record.spaceId)?.status === "completed" && record.status === "pending" && record.availableAt <= current && (!record.leaseExpiresAt || record.leaseExpiresAt <= current) && (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId);
+		}).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime() || left.id.localeCompare(right.id)).slice(0, Math.max(1, Math.min(input.limit ?? 100, 1e3)));
+		for (const record of eligible) {
+			record.leaseOwner = input.workerId;
+			record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+			record.leaseToken += 1;
+			record.attemptCount += 1;
+			record.updatedAt = current;
+		}
+		return eligible.map(cloneStagedInvocationRecord);
+	}
+	async markStagedInvocationDispatched(input) {
+		return this.settleStagedInvocation(input, "dispatched", input.childInvocationId, void 0);
+	}
+	async markStagedInvocationRejected(input) {
+		return this.settleStagedInvocation(input, "rejected", void 0, input.error);
+	}
+	async markStagedInvocationFailed(input) {
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record) return false;
+		record.status = input.deadLetter ? "dead_lettered" : "pending";
+		record.lastError = input.error;
+		if (input.childInvocationId) record.childInvocationId = input.childInvocationId;
+		record.availableAt = new Date(input.availableAt);
+		record.updatedAt = input.now ?? /* @__PURE__ */ new Date();
+		delete record.leaseOwner;
+		delete record.leaseExpiresAt;
+		return true;
+	}
+	async renewStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return false;
+		record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		record.updatedAt = current;
+		return true;
+	}
+	/** Await-free, like the fenced create above, so a create runs wholly before or after it. */
+	async rotateStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return void 0;
+		record.leaseToken += 1;
+		record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		record.updatedAt = current;
+		return record.leaseToken;
+	}
+	async cancelStagedInvocationsForFailedParents(input = {}) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		let cancelled = 0;
+		for (const record of this.stagedInvocations) {
+			if (record.status !== "pending" || input.tenantId && record.tenantId !== input.tenantId || input.spaceId && record.spaceId !== input.spaceId) continue;
+			const parent = this.invocations.find((candidate) => candidate.id === record.parentInvocationId && candidate.tenantId === record.tenantId && candidate.spaceId === record.spaceId);
+			if (!parent || ![
+				"failed",
+				"blocked_by_policy",
+				"validation_failed"
+			].includes(parent.status)) continue;
+			record.status = "cancelled";
+			record.lastError = `Parent invocation ended with ${parent.status}.`;
+			record.updatedAt = current;
+			delete record.leaseOwner;
+			delete record.leaseExpiresAt;
+			cancelled += 1;
+		}
+		return cancelled;
+	}
+	async listStagedInvocations(input) {
+		return this.stagedInvocations.filter((record) => record.tenantId === input.tenantId && record.spaceId === input.spaceId && (input.parentInvocationId === void 0 || record.parentInvocationId === input.parentInvocationId) && (!input.statuses?.length || input.statuses.includes(record.status))).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime() || left.id.localeCompare(right.id)).map(cloneStagedInvocationRecord);
+	}
+	leasedStagedInvocation(id, workerId, leaseToken) {
+		return this.stagedInvocations.find((record) => record.id === id && record.status === "pending" && record.leaseOwner === workerId && record.leaseToken === leaseToken);
+	}
+	/** Mirrors PostgreSQL: a missing child id keeps the recorded one; `lastError` is replaced. */
+	settleStagedInvocation(input, status, childInvocationId, lastError) {
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record) return false;
+		record.status = status;
+		if (childInvocationId !== void 0) record.childInvocationId = childInvocationId;
+		if (lastError !== void 0) record.lastError = lastError;
+		else delete record.lastError;
+		record.updatedAt = input.now ?? /* @__PURE__ */ new Date();
+		delete record.leaseOwner;
+		delete record.leaseExpiresAt;
+		return true;
+	}
 	async listEvents(tenantId, spaceId) {
 		return this.events.filter((event) => event.tenantId === tenantId && event.spaceId === spaceId).sort((left, right) => left.sequence - right.sequence);
 	}
@@ -4083,10 +5052,12 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 	sql;
 	transactionWithEvents;
 	transactionalOutbox;
+	transactionalStagedInvocations;
 	constructor(db, sql, transactionProvider) {
 		this.db = db;
 		this.sql = sql;
 		this.transactionalOutbox = transactionProvider !== void 0;
+		this.transactionalStagedInvocations = transactionProvider !== void 0;
 		if (transactionProvider) this.transactionWithEvents = async (run) => transactionProvider.run(async ({ db, sql }) => {
 			const scoped = new PostgresPlatformHostStore(db, sql);
 			return run({
@@ -4112,7 +5083,8 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 				updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input),
 				updateAdapterInvocation: (id, patch, scope) => scoped.updateAdapterInvocation(id, patch, scope),
 				writeAdapterInvocation: (input) => scoped.writeAdapterInvocation(input),
-				appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record)
+				appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record),
+				stageInvocations: (records) => scoped.stageInvocations(records)
 			});
 		});
 	}
@@ -4306,6 +5278,48 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 				sql: `
 				ALTER TABLE fabric_platform.adapter_invocations ADD COLUMN IF NOT EXISTS reconciliation jsonb;
 			`
+			},
+			{
+				version: 9,
+				name: "pre_effect_governance_deferral",
+				sql: `ALTER TABLE fabric_platform.action_invocations ADD COLUMN IF NOT EXISTS deferred_before_effect_attempt integer;`
+			},
+			{
+				version: 10,
+				name: "finalization_preparation_checkpoint",
+				sql: `ALTER TABLE fabric_platform.action_invocations ADD COLUMN IF NOT EXISTS finalization_checkpoint jsonb;`
+			},
+			{
+				version: 11,
+				name: "staged_descendant_invocations",
+				sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN IF NOT EXISTS staged_parent_invocation_id text,
+					ADD COLUMN IF NOT EXISTS staged_stage_key text;
+				CREATE UNIQUE INDEX IF NOT EXISTS action_invocations_staged_origin_idx
+					ON fabric_platform.action_invocations
+					(tenant_id, space_id, staged_parent_invocation_id, staged_stage_key)
+					WHERE staged_parent_invocation_id IS NOT NULL AND staged_stage_key IS NOT NULL;
+				CREATE TABLE IF NOT EXISTS fabric_platform.staged_invocations (
+					id text PRIMARY KEY,
+					tenant_id text NOT NULL, space_id text NOT NULL,
+					parent_invocation_id text NOT NULL, parent_action_id text NOT NULL,
+					stage_key text NOT NULL, action_id text NOT NULL,
+					expected_action_version integer NOT NULL,
+					parameters jsonb NOT NULL, parameter_digest text NOT NULL, batch_digest text NOT NULL,
+					status text NOT NULL, child_invocation_id text,
+					attempt_count integer NOT NULL DEFAULT 0,
+					available_at timestamptz NOT NULL,
+					lease_owner text, lease_expires_at timestamptz,
+					lease_token bigint NOT NULL DEFAULT 0,
+					last_error text, created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL,
+					UNIQUE (tenant_id, space_id, parent_invocation_id, stage_key)
+				);
+				CREATE INDEX IF NOT EXISTS staged_invocations_claim_idx
+					ON fabric_platform.staged_invocations (status, available_at, lease_expires_at, created_at);
+				CREATE INDEX IF NOT EXISTS staged_invocations_parent_idx
+					ON fabric_platform.staged_invocations (tenant_id, space_id, parent_invocation_id, created_at);
+			`
 			}
 		]);
 	}
@@ -4321,11 +5335,11 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		try {
 			result = await this.sql.query(`INSERT INTO fabric_platform.action_invocations
 				 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
-					  parameters,result,correlation_id,causation_id,idempotency_key,
-					  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
-					  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
-					  authorization_binding_id,error,runtime_evidence,${admittedColumn}created_at,updated_at)
-					 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,${admittedValue}$24,$24)
+				  parameters,result,correlation_id,causation_id,idempotency_key,
+				  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
+				  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
+				  authorization_binding_id,error,runtime_evidence,${admittedColumn}created_at,updated_at)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,${admittedValue}$24,$24)
 				 ON CONFLICT (tenant_id,space_id,action_id,idempotency_key)
 				 WHERE idempotency_key IS NOT NULL DO UPDATE SET id=fabric_platform.action_invocations.id
 				 RETURNING *`, [
@@ -4361,6 +5375,140 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		}
 		return toActionRecord(result.rows[0]);
 	}
+	async createActionInvocationForStagedLease(input) {
+		const { invocation } = input;
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const admitted = invocation.admittedAt !== void 0;
+		const admittedColumn = admitted ? ",admitted_at" : "";
+		const admittedValue = admitted ? ",$30" : "";
+		const values = [
+			invocation.id,
+			invocation.tenantId,
+			invocation.spaceId,
+			invocation.actionId,
+			invocation.actionVersion,
+			invocation.actorId,
+			invocation.actorType,
+			invocation.status,
+			JSON.stringify(invocation.parameters),
+			JSON.stringify(invocation.result),
+			invocation.correlationId,
+			invocation.causationId ?? null,
+			invocation.idempotencyKey ?? null,
+			invocation.parameterDigest ?? null,
+			invocation.parameterDigestAlgorithm ?? null,
+			invocation.idempotencyActorId ?? null,
+			invocation.idempotencyAuthorizationBindingId ?? null,
+			invocation.provenance ? JSON.stringify(invocation.provenance) : null,
+			invocation.authorizationBinding ? JSON.stringify(invocation.authorizationBinding) : null,
+			invocation.executionReason ?? null,
+			invocation.authorizationBindingId ?? null,
+			invocation.error ?? null,
+			invocation.runtimeEvidence ? JSON.stringify(invocation.runtimeEvidence) : null,
+			invocation.stagedOrigin.parentInvocationId,
+			invocation.stagedOrigin.stageKey,
+			input.stageId,
+			input.workerId,
+			input.leaseToken,
+			current,
+			...admitted ? [invocation.admittedAt] : []
+		];
+		let result;
+		try {
+			result = await this.sql.query(`WITH fence AS (
+					SELECT stage.id
+					FROM fabric_platform.staged_invocations AS stage
+					WHERE stage.id=$26 AND stage.tenant_id=$2 AND stage.space_id=$3
+					  AND stage.parent_invocation_id=$24 AND stage.stage_key=$25 AND stage.action_id=$4
+					  AND stage.status='pending' AND stage.lease_owner=$27 AND stage.lease_token=$28
+					  AND stage.lease_expires_at IS NOT NULL AND stage.lease_expires_at > $29
+					FOR SHARE
+				)
+				 INSERT INTO fabric_platform.action_invocations
+				 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
+				  parameters,result,correlation_id,causation_id,idempotency_key,parameter_digest,
+				  parameter_digest_algorithm,idempotency_actor_id,idempotency_authorization_binding_id,
+				  invocation_provenance,authorization_binding,execution_reason,authorization_binding_id,error,
+				  runtime_evidence,staged_parent_invocation_id,staged_stage_key${admittedColumn},created_at,updated_at)
+				 SELECT $1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,
+				        $18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,$24,$25${admittedValue},$29,$29
+				 FROM fence
+				 ON CONFLICT (tenant_id,space_id,staged_parent_invocation_id,staged_stage_key)
+				 WHERE staged_parent_invocation_id IS NOT NULL AND staged_stage_key IS NOT NULL
+				 DO UPDATE SET id=fabric_platform.action_invocations.id
+				 RETURNING *`, values);
+		} catch (error) {
+			if (error?.code === "42703" || error?.code === "42P01") throw new Error("A staged child needs PostgreSQL migration 11 (staged_descendant_invocations); run ensureSchema() before dispatching staged invocations.", { cause: error });
+			throw error;
+		}
+		if (result.rows[0]) {
+			const record = toActionRecord(result.rows[0]);
+			return {
+				kind: record.id === invocation.id ? "created" : "existing",
+				invocation: record
+			};
+		}
+		const existing = await this.getActionInvocationByStagedOrigin(invocation.tenantId, invocation.spaceId, invocation.stagedOrigin);
+		return existing ? {
+			kind: "existing",
+			invocation: existing
+		} : { kind: "lease_lost" };
+	}
+	async stageInvocations(records) {
+		if (records.length === 0) return;
+		const first = records[0];
+		if (!(await this.sql.query(`SELECT id FROM fabric_platform.action_invocations
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3 FOR UPDATE`, [
+			first.parentInvocationId,
+			first.tenantId,
+			first.spaceId
+		])).rows[0]) throw new Error(`ActionInvocation not found: ${first.parentInvocationId}`);
+		const current = await this.sql.query(`SELECT * FROM fabric_platform.staged_invocations
+			 WHERE tenant_id=$1 AND space_id=$2 AND parent_invocation_id=$3
+			 ORDER BY stage_key`, [
+			first.tenantId,
+			first.spaceId,
+			first.parentInvocationId
+		]);
+		if (current.rows.length > 0) {
+			const stored = current.rows.map(toStagedInvocationRecord);
+			if (!(stored.length === records.length && records.every((record) => {
+				const candidate = stored.find((item) => item.key === record.key);
+				return candidate !== void 0 && candidate.batchDigest === record.batchDigest && stagedInvocationRequestIdentity(candidate) === stagedInvocationRequestIdentity(record);
+			}))) throw new ReconciliationRequiredError(`Staged invocation batch drift for parent ${first.parentInvocationId}.`);
+			return;
+		}
+		for (const record of records) {
+			if (record.tenantId !== first.tenantId || record.spaceId !== first.spaceId || record.parentInvocationId !== first.parentInvocationId || record.batchDigest !== first.batchDigest) throw new Error(`Invalid staged invocation batch for parent ${first.parentInvocationId}.`);
+			await this.sql.query(`INSERT INTO fabric_platform.staged_invocations
+				 (id,tenant_id,space_id,parent_invocation_id,parent_action_id,stage_key,action_id,
+				  expected_action_version,parameters,parameter_digest,batch_digest,status,child_invocation_id,
+				  attempt_count,available_at,lease_owner,lease_expires_at,lease_token,last_error,created_at,updated_at)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, [
+				record.id,
+				record.tenantId,
+				record.spaceId,
+				record.parentInvocationId,
+				record.parentActionId,
+				record.key,
+				record.actionId,
+				record.expectedActionVersion,
+				JSON.stringify(record.parameters),
+				record.parameterDigest,
+				record.batchDigest,
+				record.status,
+				record.childInvocationId ?? null,
+				record.attemptCount,
+				record.availableAt,
+				record.leaseOwner ?? null,
+				record.leaseExpiresAt ?? null,
+				record.leaseToken,
+				record.lastError ?? null,
+				record.createdAt,
+				record.updatedAt
+			]);
+		}
+	}
 	async getActionInvocation(id, tenantId, spaceId) {
 		const result = await this.sql.query(`SELECT * FROM fabric_platform.action_invocations
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`, [
@@ -4370,6 +5518,17 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		]);
 		return result.rows[0] ? toActionRecord(result.rows[0]) : void 0;
 	}
+	async getActionInvocationByStagedOrigin(tenantId, spaceId, origin) {
+		const result = await this.sql.query(`SELECT * FROM fabric_platform.action_invocations
+			 WHERE tenant_id=$1 AND space_id=$2
+			   AND staged_parent_invocation_id=$3 AND staged_stage_key=$4`, [
+			tenantId,
+			spaceId,
+			origin.parentInvocationId,
+			origin.stageKey
+		]);
+		return result.rows[0] ? toActionRecord(result.rows[0]) : void 0;
+	}
 	async updateActionInvocation(id, tenantId, spaceId, patch) {
 		await this.sql.query(`UPDATE fabric_platform.action_invocations SET
 			 status=COALESCE($4,status), result=COALESCE($5::jsonb,result),
@@ -4379,6 +5538,8 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $12::boolean THEN $13::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $12::boolean THEN ($13::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE external_completion END,
+			 ${Object.hasOwn(patch, "finalizationCheckpoint") ? `finalization_checkpoint=$${18 + (Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? 2 : 0)}::jsonb,` : ""}
+			 ${Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? "deferred_before_effect_attempt=CASE WHEN $18::boolean THEN $19::integer ELSE deferred_before_effect_attempt END," : ""}
 			 pending_state_transition=CASE WHEN $16::boolean THEN $17::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
@@ -4402,7 +5563,9 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			Object.hasOwn(patch, "externalCompletion"),
 			patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
 			Object.hasOwn(patch, "pendingStateTransition"),
-			patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
+			patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null,
+			...Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? [true, patch.deferredBeforeEffectAttempt ?? null] : [],
+			...Object.hasOwn(patch, "finalizationCheckpoint") ? [patch.finalizationCheckpoint ? JSON.stringify(patch.finalizationCheckpoint) : null] : []
 		]);
 	}
 	async recordHitlDecision(actionInvocationId, tenantId, spaceId, decision) {
@@ -4896,6 +6059,139 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			input.outboxId ?? null
 		])).rows.map((row) => toOutboxRequeueRecord(row, ""));
 	}
+	async claimStagedInvocations(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		const limit = Math.max(1, Math.min(input.limit ?? 100, 1e3));
+		return (await this.sql.query(`WITH claimable AS (
+				SELECT stage.id
+				FROM fabric_platform.staged_invocations AS stage
+				JOIN fabric_platform.action_invocations AS parent
+				  ON parent.id=stage.parent_invocation_id
+				 AND parent.tenant_id=stage.tenant_id AND parent.space_id=stage.space_id
+				WHERE stage.status='pending' AND parent.status='completed'
+				  AND stage.available_at <= $1
+				  AND (stage.lease_expires_at IS NULL OR stage.lease_expires_at <= $1)
+				  AND ($2::text IS NULL OR stage.tenant_id=$2)
+				  AND ($3::text IS NULL OR stage.space_id=$3)
+				ORDER BY stage.created_at,stage.id
+				FOR UPDATE OF stage SKIP LOCKED LIMIT $4
+			)
+			UPDATE fabric_platform.staged_invocations AS stage
+			SET lease_owner=$5, lease_expires_at=$6, lease_token=stage.lease_token+1,
+			    attempt_count=stage.attempt_count+1, updated_at=$1
+			FROM claimable WHERE stage.id=claimable.id
+			RETURNING stage.*`, [
+			current,
+			input.tenantId ?? null,
+			input.spaceId ?? null,
+			limit,
+			input.workerId,
+			leaseExpiresAt
+		])).rows.map(toStagedInvocationRecord);
+	}
+	async markStagedInvocationDispatched(input) {
+		return this.settleStagedInvocation(input.id, input.workerId, input.leaseToken, "dispatched", input.now ?? /* @__PURE__ */ new Date(), input.childInvocationId, null);
+	}
+	async markStagedInvocationRejected(input) {
+		return this.settleStagedInvocation(input.id, input.workerId, input.leaseToken, "rejected", input.now ?? /* @__PURE__ */ new Date(), null, input.error);
+	}
+	async markStagedInvocationFailed(input) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET status=$4, last_error=$5, available_at=$6,
+			     child_invocation_id=COALESCE($7,child_invocation_id),
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$8
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3 RETURNING id`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			input.deadLetter ? "dead_lettered" : "pending",
+			input.error,
+			input.availableAt,
+			input.childInvocationId ?? null,
+			input.now ?? /* @__PURE__ */ new Date()
+		])).rows.length === 1;
+	}
+	async renewStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET lease_expires_at=$4, updated_at=$5
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3
+			   AND lease_expires_at IS NOT NULL AND lease_expires_at > $5 RETURNING id`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			new Date(current.getTime() + input.leaseDurationMs),
+			current
+		])).rows.length === 1;
+	}
+	/**
+	* The UPDATE needs a row lock that conflicts with the `FOR SHARE` lock the
+	* fenced child insert takes on this row, so it waits for an in-flight
+	* insert to commit. A fenced insert under the old token that reaches the
+	* row while this rotation is uncommitted waits for it, rechecks the new row
+	* version and inserts nothing (live tests "orders a token rotation after an
+	* in-flight fenced create ..." and "refuses a fenced create under the old
+	* token once a token rotation is ordered before it").
+	*/
+	async rotateStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const result = await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET lease_token=lease_token+1, lease_expires_at=$4, updated_at=$5
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3
+			   AND lease_expires_at IS NOT NULL AND lease_expires_at > $5
+			 RETURNING lease_token`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			new Date(current.getTime() + input.leaseDurationMs),
+			current
+		]);
+		return result.rows[0] ? Number(result.rows[0].lease_token) : void 0;
+	}
+	async cancelStagedInvocationsForFailedParents(input = {}) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations AS stage
+			 SET status='cancelled', last_error='Parent invocation ended with ' || parent.status || '.',
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$3
+			 FROM fabric_platform.action_invocations AS parent
+			 WHERE parent.id=stage.parent_invocation_id
+			   AND parent.tenant_id=stage.tenant_id AND parent.space_id=stage.space_id
+			   AND parent.status IN ('failed','blocked_by_policy','validation_failed')
+			   AND stage.status='pending'
+			   AND ($1::text IS NULL OR stage.tenant_id=$1)
+			   AND ($2::text IS NULL OR stage.space_id=$2)
+			 RETURNING stage.id`, [
+			input.tenantId ?? null,
+			input.spaceId ?? null,
+			input.now ?? /* @__PURE__ */ new Date()
+		])).rows.length;
+	}
+	async listStagedInvocations(input) {
+		return (await this.sql.query(`SELECT * FROM fabric_platform.staged_invocations
+			 WHERE tenant_id=$1 AND space_id=$2
+			   AND ($3::text IS NULL OR parent_invocation_id=$3)
+			   AND ($4::text[] IS NULL OR status=ANY($4::text[]))
+			 ORDER BY created_at,id`, [
+			input.tenantId,
+			input.spaceId,
+			input.parentInvocationId ?? null,
+			input.statuses?.length ? [...input.statuses] : null
+		])).rows.map(toStagedInvocationRecord);
+	}
+	async settleStagedInvocation(id, workerId, leaseToken, status, now, childInvocationId, lastError) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET status=$4, child_invocation_id=COALESCE($5,child_invocation_id), last_error=$6,
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$7
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3 RETURNING id`, [
+			id,
+			workerId,
+			leaseToken,
+			status,
+			childInvocationId,
+			lastError,
+			now
+		])).rows.length === 1;
+	}
 	async nextEventSequence(tenantId, spaceId) {
 		const result = await this.sql.query(`INSERT INTO fabric_platform.event_sequences (tenant_id,space_id,next_sequence)
 			 VALUES ($1,$2,1) ON CONFLICT (tenant_id,space_id) DO UPDATE
@@ -5032,6 +6328,8 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $14::boolean THEN ($15::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $16::boolean THEN $17::jsonb ELSE external_completion END,
+			 ${Object.hasOwn(patch, "finalizationCheckpoint") ? `finalization_checkpoint=$${20 + (Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? 2 : 0)}::jsonb,` : ""}
+			 ${Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? "deferred_before_effect_attempt=CASE WHEN $20::boolean THEN $21::integer ELSE deferred_before_effect_attempt END," : ""}
 			 pending_state_transition=CASE WHEN $18::boolean THEN $19::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
@@ -5059,7 +6357,9 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			Object.hasOwn(patch, "externalCompletion"),
 			patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
 			Object.hasOwn(patch, "pendingStateTransition"),
-			patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
+			patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null,
+			...Object.hasOwn(patch, "deferredBeforeEffectAttempt") ? [true, patch.deferredBeforeEffectAttempt ?? null] : [],
+			...Object.hasOwn(patch, "finalizationCheckpoint") ? [patch.finalizationCheckpoint ? JSON.stringify(patch.finalizationCheckpoint) : null] : []
 		])).rows.length === 1;
 	}
 	async renewActionInvocationLease(input) {
@@ -5146,16 +6446,22 @@ function toActionRecord(row) {
 		...row.parameter_digest_algorithm ? { parameterDigestAlgorithm: String(row.parameter_digest_algorithm) } : {},
 		...row.idempotency_actor_id ? { idempotencyActorId: String(row.idempotency_actor_id) } : {},
 		...row.idempotency_authorization_binding_id ? { idempotencyAuthorizationBindingId: String(row.idempotency_authorization_binding_id) } : {},
+		...row.staged_parent_invocation_id && row.staged_stage_key ? { stagedOrigin: {
+			parentInvocationId: String(row.staged_parent_invocation_id),
+			stageKey: String(row.staged_stage_key)
+		} } : {},
 		...row.invocation_provenance ? { provenance: row.invocation_provenance } : {},
 		...row.authorization_binding ? { authorizationBinding: row.authorization_binding } : {},
 		...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
 		...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
 		...row.adapter_reconciliation ? { adapterReconciliation: row.adapter_reconciliation } : {},
+		...row.finalization_checkpoint ? { finalizationCheckpoint: row.finalization_checkpoint } : {},
 		...row.pending_state_transition ? { pendingStateTransition: row.pending_state_transition } : {},
 		...row.pending_completion ? { pendingCompletion: toPendingCompletion(row.pending_completion) } : {},
 		...row.external_completion ? { externalCompletion: toExternalCompletion(row.external_completion) } : {},
 		...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},
 		attemptCount: Number(row.attempt_count ?? 0),
+		...row.deferred_before_effect_attempt == null ? {} : { deferredBeforeEffectAttempt: Number(row.deferred_before_effect_attempt) },
 		leaseToken: Number(row.lease_token ?? 0),
 		...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
 		...row.lease_expires_at ? { leaseExpiresAt: new Date(row.lease_expires_at) } : {},
@@ -5173,6 +6479,31 @@ function toActionRecord(row) {
 		updatedAt: new Date(row.updated_at)
 	};
 }
+function toStagedInvocationRecord(row) {
+	return {
+		id: String(row.id),
+		tenantId: String(row.tenant_id),
+		spaceId: String(row.space_id),
+		parentInvocationId: String(row.parent_invocation_id),
+		parentActionId: String(row.parent_action_id),
+		key: String(row.stage_key),
+		actionId: String(row.action_id),
+		expectedActionVersion: Number(row.expected_action_version),
+		parameters: row.parameters,
+		parameterDigest: String(row.parameter_digest),
+		batchDigest: String(row.batch_digest),
+		status: String(row.status),
+		...row.child_invocation_id ? { childInvocationId: String(row.child_invocation_id) } : {},
+		attemptCount: Number(row.attempt_count),
+		availableAt: new Date(row.available_at),
+		...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
+		...row.lease_expires_at ? { leaseExpiresAt: new Date(row.lease_expires_at) } : {},
+		leaseToken: Number(row.lease_token ?? 0),
+		...row.last_error ? { lastError: String(row.last_error) } : {},
+		createdAt: new Date(row.created_at),
+		updatedAt: new Date(row.updated_at)
+	};
+}
 function toObligationRecord(row) {
 	return {
 		id: String(row.id),
@@ -5312,6 +6643,23 @@ function createStoreBackedActionDispatcher() {
 async function runPlatformActionWorkerCycle(options) {
 	const leaseDurationMs = options.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS;
 	emitWorkerTelemetry(options.telemetry, "worker.cycle.started", options.workerId);
+	let staged;
+	if ((options.dispatchStagedInvocations === true || options.dispatchStagedInvocations !== false && options.host.hasStagedInvocationActions === true) && typeof options.host.dispatchStagedInvocations === "function") try {
+		staged = await options.host.dispatchStagedInvocations({
+			workerId: options.workerId,
+			...options.stagedInvocationBatchSize !== void 0 ? { limit: options.stagedInvocationBatchSize } : {},
+			...options.stagedInvocationLeaseDurationMs !== void 0 ? { leaseDurationMs: options.stagedInvocationLeaseDurationMs } : {},
+			...options.stagedInvocationLeaseRenewalIntervalMs !== void 0 ? { leaseRenewalIntervalMs: options.stagedInvocationLeaseRenewalIntervalMs } : {},
+			...options.stagedInvocationSubmissionTimeoutMs !== void 0 ? { submissionTimeoutMs: options.stagedInvocationSubmissionTimeoutMs } : {},
+			...options.stagedInvocationMaxAttempts !== void 0 ? { maxAttempts: options.stagedInvocationMaxAttempts } : {},
+			...options.stagedInvocationRetryDelayMs ? { retryDelayMs: options.stagedInvocationRetryDelayMs } : {},
+			...options.tenantId ? { tenantId: options.tenantId } : {},
+			...options.spaceId ? { spaceId: options.spaceId } : {},
+			...options.onError ? { onError: (error) => options.onError?.(error) } : {}
+		});
+	} catch (error) {
+		options.onError?.(error);
+	}
 	if (options.sweepOverdueCompletions !== false && typeof options.host.reconcileOverdueCompletions === "function") try {
 		await options.host.reconcileOverdueCompletions({
 			...options.tenantId ? { tenantId: options.tenantId } : {},
@@ -5369,9 +6717,20 @@ async function runPlatformActionWorkerCycle(options) {
 		completed,
 		failed,
 		...waitingForApproval > 0 ? { waitingForApproval } : {},
-		...deferred > 0 ? { deferred } : {}
+		...deferred > 0 ? { deferred } : {},
+		...staged && Object.values(staged).some((value) => value > 0) ? { staged } : {}
 	};
-	emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, result);
+	emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, {
+		claimed: result.claimed,
+		completed: result.completed,
+		failed: result.failed,
+		...result.waitingForApproval !== void 0 ? { waitingForApproval: result.waitingForApproval } : {},
+		...result.deferred !== void 0 ? { deferred: result.deferred } : {},
+		...result.staged ? {
+			stagedClaimed: result.staged.claimed,
+			stagedDispatched: result.staged.dispatched
+		} : {}
+	});
 	return result;
 }
 function startLeaseHeartbeat(options, invocation, leaseDurationMs) {
@@ -5629,15 +6988,16 @@ async function adapterProbe(subject) {
 	};
 }
 /**
-* The suite any deployment of the host must pass before it claims isolation.
+* The suite a deployment of the host must pass before it claims isolation.
 *
-* Eight checks: an invocation cannot be read, executed, or completed under
+* Nine checks: an invocation cannot be read, executed, or completed under
 * another tenant's scope; an idempotency key is a tenant's own, so the same
 * key in two tenants is two invocations; a tenant's event stream carries no
 * other tenant's events; a worker scoped to one tenant does not claim another's
-* work; an adapter checkpoint cannot be read or written under another tenant,
-* space, or owning invocation; and, when the subject lends a read, a viewer in
-* the other tenant sees nothing of ours.
+* work; staged listing and claiming retain tenant and space scope; an adapter
+* checkpoint cannot be read or written under another tenant, space, or owning
+* invocation; and, when the subject lends a read, a viewer in the other tenant
+* sees nothing of ours.
 */
 function tenantIsolationChecks() {
 	return [
@@ -5681,6 +7041,103 @@ function tenantIsolationChecks() {
 				return ["one idempotency key: one invocation within a tenant, two across tenants"];
 			}
 		},
+		{
+			id: "fabric.tenancy.staged-invocation-scoped.v1",
+			async run(subject) {
+				await subject.reset?.();
+				const store = subject.store;
+				if (store.transactionalStagedInvocations !== true || typeof store.transactionWithEvents !== "function" || typeof store.listStagedInvocations !== "function" || typeof store.claimStagedInvocations !== "function") return ["skipped: store does not expose transactional staged invocations"];
+				const suffix = globalThis.crypto.randomUUID();
+				const probeTenant = `iso-stage-tenant-${suffix}`;
+				const otherProbeTenant = `iso-stage-tenant-other-${suffix}`;
+				const probeSpace = `iso-stage-space-${suffix}`;
+				const otherProbeSpace = `iso-stage-space-other-${suffix}`;
+				const parents = [
+					{
+						id: `iso_stage_parent_ours_${suffix}`,
+						tenantId: probeTenant,
+						spaceId: probeSpace,
+						actorId: subject.ours.actorId,
+						actorType: subject.ours.actorType
+					},
+					{
+						id: `iso_stage_parent_theirs_${suffix}`,
+						tenantId: otherProbeTenant,
+						spaceId: probeSpace,
+						actorId: subject.theirs.actorId,
+						actorType: subject.theirs.actorType
+					},
+					{
+						id: `iso_stage_parent_space_${suffix}`,
+						tenantId: probeTenant,
+						spaceId: otherProbeSpace,
+						actorId: subject.ours.actorId,
+						actorType: subject.ours.actorType
+					}
+				];
+				for (const parent of parents) await store.createActionInvocation({
+					...parent,
+					actionId: subject.actionId,
+					actionVersion: 1,
+					status: "completed",
+					parameters: {},
+					result: {},
+					correlationId: suffix
+				});
+				const now = /* @__PURE__ */ new Date();
+				const records = parents.map((parent, index) => ({
+					id: `iso_stage_${index}_${suffix}`,
+					tenantId: parent.tenantId,
+					spaceId: parent.spaceId,
+					parentInvocationId: parent.id,
+					parentActionId: subject.actionId,
+					key: "child",
+					actionId: subject.actionId,
+					expectedActionVersion: 1,
+					parameters: {},
+					parameterDigest: `digest-${index}`,
+					batchDigest: `batch-${index}`,
+					status: "pending",
+					attemptCount: 0,
+					availableAt: now,
+					leaseToken: 0,
+					createdAt: now,
+					updatedAt: now
+				}));
+				try {
+					await store.transactionWithEvents(async (transaction) => {
+						if (!transaction.stageInvocations) fail$1("transactionalStagedInvocations did not supply stageInvocations");
+						for (const record of records) await transaction.stageInvocations([record]);
+					});
+					const ours = await store.listStagedInvocations({
+						tenantId: probeTenant,
+						spaceId: probeSpace
+					});
+					if (!ours.some((record) => record.id === records[0].id)) fail$1("our staged invocation was not listable under our scope, so the check proves nothing");
+					if (ours.some((record) => record.id === records[1].id || record.id === records[2].id)) fail$1("staged invocation listing crossed tenant or space");
+					if ((await store.listStagedInvocations({
+						tenantId: otherProbeTenant,
+						spaceId: probeSpace,
+						parentInvocationId: parents[0].id
+					})).length !== 0) fail$1("a staged invocation was listable under another tenant's scope");
+					const claimed = await store.claimStagedInvocations({
+						workerId: `iso-stage-worker-${suffix}`,
+						tenantId: probeTenant,
+						spaceId: probeSpace,
+						leaseDurationMs: 6e4,
+						now
+					});
+					if (!claimed.some((record) => record.id === records[0].id)) fail$1("our staged invocation was not claimable under our scope, so the check proves nothing");
+					if (claimed.some((record) => record.tenantId !== probeTenant || record.spaceId !== probeSpace)) fail$1("staged invocation claim crossed tenant or space");
+					return ["staged listing and claiming retained both tenant and space scope"];
+				} finally {
+					for (const parent of parents) await store.updateActionInvocation(parent.id, parent.tenantId, parent.spaceId, {
+						status: "failed",
+						error: "tenant isolation probe; retired"
+					});
+				}
+			}
+		},
 		{
 			id: "fabric.tenancy.events-scoped.v1",
 			async run(subject) {
@@ -6475,6 +7932,6 @@ async function runEventAppendChecks(subject) {
 	};
 }
 //#endregion
-export { ActionAdmissionError, ExternalCompletionError, IdempotencyConflictError, MemoryPlatformHostStore, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, PostgresPlatformHostStore, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, eventAppendChecks, getPlatformHostHealthSnapshot, outboxActorDisclosure, runEventAppendChecks, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
+export { ActionAdmissionError, ExternalCompletionError, IdempotencyConflictError, MAX_STAGED_INVOCATIONS, MAX_STAGED_INVOCATION_BATCH_BYTES, MAX_STAGED_INVOCATION_BYTES, MAX_STAGED_INVOCATION_KEY_LENGTH, MemoryPlatformHostStore, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, PostgresPlatformHostStore, STAGED_INVOCATION_KEY_PATTERN, SubmissionRefusalError, applyPostgresMigrations, asStagedInvocationStore, canonicalJson, cloneOutboxRecord, cloneStagedInvocationRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, eventAppendChecks, getPlatformHostHealthSnapshot, outboxActorDisclosure, prepareStagedInvocationBatch, runEventAppendChecks, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, stagedInvocationRequestIdentity, tenantIsolationChecks, toEnterpriseEventEnvelope };
 
 //# sourceMappingURL=index.js.map