@fabricorg/platform-host 8.2.0 → 8.4.0

package/dist/index.cjs

@@ -36,6 +36,18 @@ var ActionAdmissionError = class extends Error {
 		this.name = "ActionAdmissionError";
 	}
 };
+/** A definitive authorization-boundary refusal before an invocation is created. */
+var SubmissionRefusalError = class extends Error {
+	actionId;
+	refusal;
+	code = "ACTION_SUBMISSION_REFUSED";
+	constructor(actionId, refusal, message) {
+		super(message);
+		this.actionId = actionId;
+		this.refusal = refusal;
+		this.name = "SubmissionRefusalError";
+	}
+};
 /**
 * Why a completion was not applied, typed so a webhook handler can answer
 * the external system correctly: `retryable` means the invocation is still
@@ -129,7 +141,11 @@ function omitUndefinedOptionalFields(value, keys) {
 	return copy;
 }
 function validateFinalization(value, action, privateFields, contracts) {
-	const normalized = omitUndefinedOptionalFields(value, ["events", "resultPatch"]);
+	const normalized = omitUndefinedOptionalFields(value, [
+		"events",
+		"resultPatch",
+		"stagedInvocations"
+	]);
 	if (normalized !== value && normalized && typeof normalized === "object" && !Array.isArray(normalized)) {
 		const record = normalized;
 		if (Array.isArray(record.events)) {
@@ -139,7 +155,7 @@ function validateFinalization(value, action, privateFields, contracts) {
 		}
 	}
 	const result = finalizationJson(normalized);
-	if (!result || typeof result !== "object" || Array.isArray(result) || Object.keys(result).some((key) => key !== "events" && key !== "resultPatch")) throw new Error("Finalization must return only events and resultPatch.");
+	if (!result || typeof result !== "object" || Array.isArray(result) || Object.keys(result).some((key) => key !== "events" && key !== "resultPatch" && key !== "stagedInvocations")) throw new Error("Finalization must return only events, resultPatch and stagedInvocations.");
 	if (result.resultPatch !== void 0) {
 		if (!result.resultPatch || typeof result.resultPatch !== "object" || Array.isArray(result.resultPatch)) throw new Error("Finalization resultPatch must be an object.");
 		if (Object.keys(result.resultPatch).some((key) => privateFields.includes(key))) throw new Error("Finalization resultPatch contains a private result key.");
@@ -1149,6 +1165,120 @@ function createOutboxRequeue(deps) {
 	};
 }
 //#endregion
+//#region src/staged-invocations.ts
+const MAX_STAGED_INVOCATIONS = 32;
+const MAX_STAGED_INVOCATION_KEY_LENGTH = 128;
+const MAX_STAGED_INVOCATION_BYTES = 65536;
+const MAX_STAGED_INVOCATION_BATCH_BYTES = 262144;
+const STAGED_INVOCATION_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+/** Validate and normalize one immutable batch before its parent transaction commits. */
+function prepareStagedInvocationBatch(input) {
+	if (!Array.isArray(input.requests)) throw new Error("stagedInvocations must be an array.");
+	if (input.requests.length > 32) throw new Error(`stagedInvocations exceeds the 32 request limit.`);
+	const normalized = input.requests.map((candidate, index) => {
+		if (!candidate || typeof candidate !== "object" || Array.isArray(candidate) || Object.keys(candidate).some((key) => ![
+			"key",
+			"actionId",
+			"parameters"
+		].includes(key))) throw new Error(`stagedInvocations[${index}] must contain only key, actionId and parameters.`);
+		const request = {
+			key: candidate.key,
+			actionId: candidate.actionId,
+			parameters: candidate.parameters
+		};
+		if (typeof request.key !== "string" || request.key.length === 0 || request.key.length > 128 || !STAGED_INVOCATION_KEY_PATTERN.test(request.key)) throw new Error(`stagedInvocations[${index}] key must match ${STAGED_INVOCATION_KEY_PATTERN} and be at most 128 characters.`);
+		if (!(input.parentAction.stagesInvocations ?? []).includes(request.actionId)) throw new Error(`Action "${input.parentAction.actionId}" may not stage "${String(request.actionId)}".`);
+		const child = input.resolveAction(request.actionId);
+		if (!child) throw new Error(`Staged action "${String(request.actionId)}" is not registered.`);
+		const parameters = finalizationJson(request.parameters);
+		if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) throw new Error(`stagedInvocations[${index}] parameters must be a JSON object.`);
+		if (!child.schema.safeParse(parameters).success) throw new Error(`stagedInvocations[${index}] parameters do not match action "${child.actionId}".`);
+		let redactedParameters = parameters;
+		if (input.redactParameters && !input.redactedKeys?.includes(request.key)) try {
+			redactedParameters = input.redactParameters(child.actionId, structuredClone(parameters));
+		} catch {
+			throw new Error("Staged invocation parameter redaction failed.");
+		}
+		const durableParameters = finalizationJson(redactedParameters);
+		if (!durableParameters || typeof durableParameters !== "object" || Array.isArray(durableParameters) || !child.schema.safeParse(durableParameters).success) throw new Error(`stagedInvocations[${index}] redacted parameters do not match action "${child.actionId}".`);
+		if (byteLength((0, _fabricorg_platform.canonicalJson)({
+			key: request.key,
+			actionId: child.actionId,
+			parameters: durableParameters
+		})) > 65536) throw new Error(`stagedInvocations[${index}] exceeds ${MAX_STAGED_INVOCATION_BYTES} bytes.`);
+		return {
+			key: request.key,
+			actionId: child.actionId,
+			expectedActionVersion: child.version,
+			parameters: durableParameters,
+			parameterDigest: digestParameters(durableParameters)
+		};
+	});
+	for (const [index, request] of normalized.entries()) if (normalized.findIndex((candidate) => candidate.key === request.key) !== index) throw new Error(`stagedInvocations contains duplicate key "${request.key}".`);
+	normalized.sort((left, right) => compareText(left.key, right.key) || compareText(left.actionId, right.actionId));
+	const batchIdentity = normalized.map(({ key, actionId, expectedActionVersion, parameters, parameterDigest }) => ({
+		key,
+		actionId,
+		expectedActionVersion,
+		parameters,
+		parameterDigest
+	}));
+	if (byteLength((0, _fabricorg_platform.canonicalJson)(batchIdentity)) > 262144) throw new Error(`stagedInvocations batch exceeds ${MAX_STAGED_INVOCATION_BATCH_BYTES} bytes.`);
+	const batchDigest = digestParameters({
+		parentInvocationId: input.parent.id,
+		requests: batchIdentity
+	});
+	return normalized.map((request) => ({
+		id: lifecycleId("stg", input.parent.id, request.key),
+		tenantId: input.parent.tenantId,
+		spaceId: input.parent.spaceId,
+		parentInvocationId: input.parent.id,
+		parentActionId: input.parent.actionId,
+		...request,
+		batchDigest,
+		status: "pending",
+		attemptCount: 0,
+		availableAt: new Date(input.now),
+		leaseToken: 0,
+		createdAt: new Date(input.now),
+		updatedAt: new Date(input.now)
+	}));
+}
+function stagedInvocationRequestIdentity(record) {
+	return (0, _fabricorg_platform.canonicalJson)({
+		id: record.id,
+		tenantId: record.tenantId,
+		spaceId: record.spaceId,
+		parentInvocationId: record.parentInvocationId,
+		parentActionId: record.parentActionId,
+		key: record.key,
+		actionId: record.actionId,
+		expectedActionVersion: record.expectedActionVersion,
+		parameters: record.parameters,
+		parameterDigest: record.parameterDigest,
+		batchDigest: record.batchDigest
+	});
+}
+function cloneStagedInvocationRecord(record) {
+	return {
+		...structuredClone(record),
+		availableAt: new Date(record.availableAt),
+		...record.leaseExpiresAt ? { leaseExpiresAt: new Date(record.leaseExpiresAt) } : {},
+		createdAt: new Date(record.createdAt),
+		updatedAt: new Date(record.updatedAt)
+	};
+}
+function asStagedInvocationStore(store) {
+	const candidate = store;
+	return candidate.transactionalStagedInvocations === true && typeof candidate.getActionInvocationByStagedOrigin === "function" && typeof candidate.createActionInvocationForStagedLease === "function" && typeof candidate.claimStagedInvocations === "function" && typeof candidate.markStagedInvocationDispatched === "function" && typeof candidate.markStagedInvocationRejected === "function" && typeof candidate.markStagedInvocationFailed === "function" && typeof candidate.renewStagedInvocationLease === "function" && typeof candidate.rotateStagedInvocationLease === "function" && typeof candidate.cancelStagedInvocationsForFailedParents === "function" && typeof candidate.listStagedInvocations === "function" ? candidate : void 0;
+}
+function byteLength(value) {
+	return new TextEncoder().encode(value).byteLength;
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+//#endregion
 //#region src/host.ts
 const DEFAULT_EXTRACT_EVENTS = (data) => {
 	const value = data._events;
@@ -1173,6 +1303,25 @@ const ADMISSION_FAILED = Object.freeze({ kind: "failed" });
 const ADMISSION_TIMED_OUT = Object.freeze({ kind: "timed_out" });
 /** What an admission refusal's code may look like; anything else is `invalid_decision`. */
 const ADMISSION_REFUSAL_CODE = /^[a-z][A-Za-z0-9_.:-]{0,127}$/;
+var StagedDispatchRejectionError = class extends Error {
+	name = "StagedDispatchRejectionError";
+};
+var StagedDispatchLeaseLostError = class extends Error {
+	name = "StagedDispatchLeaseLostError";
+};
+var StagedDispatcherHandoffError = class extends Error {
+	name = "StagedDispatcherHandoffError";
+};
+var StagedSubmissionTimeoutError = class extends Error {
+	name = "StagedSubmissionTimeoutError";
+};
+/** Fixed stage error texts: a stage records no caught error text and no parameters. */
+const STAGED_ERROR = Object.freeze({
+	dispatch: "Staged invocation dispatch failed.",
+	refused: "Staged invocation submission was definitively refused.",
+	handoff: "Staged child dispatcher handoff was not confirmed.",
+	lookup: "Staged child lookup failed."
+});
 function createGovernedActionHost(options) {
 	const retryableExecutionMaxAttempts = options.retryableExecutionMaxAttempts ?? 5;
 	if (!Number.isInteger(retryableExecutionMaxAttempts) || retryableExecutionMaxAttempts <= 0) throw new Error("retryableExecutionMaxAttempts must be a positive integer.");
@@ -1202,6 +1351,9 @@ function createGovernedActionHost(options) {
 	const configuredActionResolver = options.resolveAction ?? options.registry?.resolveAction;
 	if (!configuredActionResolver) throw new Error("Platform Host requires an explicit module registry or resolveAction function.");
 	const actionResolver = configuredActionResolver;
+	const stagedStore = asStagedInvocationStore(options.store);
+	const declaresStaging = options.registry?.orderedModules?.some((module) => (module.actions ?? []).some((action) => (action.stagesInvocations?.length ?? 0) > 0)) ?? false;
+	if (declaresStaging && (!stagedStore || !asAtomicMutationStore(options.store))) throw new Error("Staged descendant invocations require a store with transactionalStagedInvocations and transactionWithEvents capabilities.");
 	const stateMachineResolver = options.registry?.resolveStateMachine ?? (() => void 0);
 	const eventResultFields = options.eventResultFields ?? ["_events"];
 	const admissionTimeoutMs = options.admissionTimeoutMs ?? DEFAULT_ADMISSION_TIMEOUT_MS;
@@ -1210,8 +1362,12 @@ function createGovernedActionHost(options) {
 		return error instanceof HostError ? errorMessage(error) : redactErrorText(options.redactErrorText, context, errorMessage(error));
 	}
 	async function submitAction(input) {
+		return submitActionInternal(input);
+	}
+	async function submitActionInternal(input, internal = {}) {
 		const read = snapshotSubmission(input);
-		if (read.executionReason && !["initial", "offline_replay"].includes(read.executionReason)) throw new Error(`Unsupported submitted execution reason: ${read.executionReason}`);
+		const submittedExecutionReason = read.executionReason;
+		if (submittedExecutionReason && !["initial", "offline_replay"].includes(submittedExecutionReason) && !(internal.staged && submittedExecutionReason === "staged_dispatch")) throw new Error(`Unsupported submitted execution reason: ${submittedExecutionReason}`);
 		const action = actionResolver(read.actionId);
 		if (!action) throw new Error(`Unknown action: ${read.actionId}`);
 		const declaresAdmission = action.admitSubmission !== void 0;
@@ -1219,15 +1375,15 @@ function createGovernedActionHost(options) {
 		if (action.execution?.connectivity === "online-required" && submission.executionReason === "offline_replay") throw new Error(`Action ${submission.actionId} is online-required and cannot be submitted as an offline replay.`);
 		if (action.execution?.sensitivity === "restricted" && Object.keys(submission.provenance?.auditAttributes ?? {}).length > 0) throw new Error(`Action ${submission.actionId} declares restricted sensitivity; provenance audit attributes must not be durably recorded.`);
 		const authorizationInput = toAuthorizationInput(action, submission);
-		if (!await options.authorization.checkEntitlement(authorizationInput)) throw new Error(`Module "${action.namespace}" is not enabled for tenant ${submission.tenantId}`);
-		if (!await options.authorization.authorize(authorizationInput)) throw new Error(`Actor ${submission.actorId} is not authorized for action ${submission.actionId}`);
+		if (!await options.authorization.checkEntitlement(authorizationInput)) throw new SubmissionRefusalError(action.actionId, "entitlement", `Module "${action.namespace}" is not enabled for tenant ${submission.tenantId}`);
+		if (!await options.authorization.authorize(authorizationInput)) throw new SubmissionRefusalError(action.actionId, "authorization", `Actor ${submission.actorId} is not authorized for action ${submission.actionId}`);
 		if (declaresAdmission && (!submission.parametersArePrivate || !isRecord(submission.parameters))) refuseAdmission(action, submission, "invalid_parameters");
 		const actionInvocationId = (0, _fabricorg_platform.createFabricId)("act");
 		if (submission.correlationId && submission.provenance?.correlationId && submission.correlationId !== submission.provenance.correlationId) throw new Error("Invocation provenance correlationId does not match submission correlationId.");
 		if (submission.causationId && submission.provenance?.causationId && submission.causationId !== submission.provenance.causationId) throw new Error("Invocation provenance causationId does not match submission causationId.");
 		const correlationId = submission.correlationId ?? submission.provenance?.correlationId ?? (0, _fabricorg_platform.createFabricId)("corr");
 		const prepare = () => {
-			const durableParameters = options.redactActionParameters ? options.redactActionParameters(submission.actionId, submission.parameters) : submission.parameters;
+			const durableParameters = !internal.parametersAlreadyRedacted && options.redactActionParameters ? options.redactActionParameters(submission.actionId, submission.parameters) : submission.parameters;
 			const parameterDigest = digestParameters(submission.parameters);
 			if (submission.authorizationBinding) validateAuthorizationBinding(submission, parameterDigest, action.execution?.authorityMoment, now());
 			return {
@@ -1248,7 +1404,7 @@ function createGovernedActionHost(options) {
 		(0, _fabricorg_platform.assertGovernanceRuntimeEvidence)(runtimeEvidence);
 		const admission = declaresAdmission ? await admitSubmission(action, submission) : void 0;
 		const { durableParameters, parameterDigest } = early ?? prepare();
-		const durableInvocation = await options.store.createActionInvocation({
+		const invocationInput = {
 			id: actionInvocationId,
 			tenantId: submission.tenantId,
 			spaceId: submission.spaceId,
@@ -1274,7 +1430,24 @@ function createGovernedActionHost(options) {
 			...submission.executionReason ? { executionReason: submission.executionReason } : {},
 			...submission.authorizationBindingId ? { authorizationBindingId: submission.authorizationBindingId } : {},
 			...admission ? { admittedAt: admission.admittedAt } : {}
-		});
+		};
+		const staged = internal.staged;
+		const durableInvocation = staged ? await (async () => {
+			if (!stagedStore) throw new Error("Staged invocation store capability disappeared.");
+			const created = await stagedStore.createActionInvocationForStagedLease({
+				stageId: staged.id,
+				workerId: staged.workerId,
+				leaseToken: staged.leaseToken,
+				now: now(),
+				invocation: {
+					...invocationInput,
+					stagedOrigin: staged.origin
+				}
+			});
+			if (created.kind === "lease_lost") throw new StagedDispatchLeaseLostError("Staged invocation lease lost before child creation.");
+			staged.onChild(created.invocation);
+			return created.invocation;
+		})() : await options.store.createActionInvocation(invocationInput);
 		emitPlatformHostTelemetry(options.telemetry, {
 			kind: "event",
 			name: "invocation.submitted",
@@ -1308,6 +1481,7 @@ function createGovernedActionHost(options) {
 			}
 		}
 		const durableWorkflowId = `action-invocation-${durableInvocation.id}`;
+		if (internal.staged && durableInvocation.id !== actionInvocationId) return replayExistingStagedInvocation(durableInvocation);
 		if (durableInvocation.id !== actionInvocationId) {
 			if (options.dispatcher && durableInvocation.status === "pending") {
 				const dispatched = await options.dispatcher.dispatch({
@@ -1356,6 +1530,7 @@ function createGovernedActionHost(options) {
 				...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
 			}, submission.actionId);
 		} catch (error) {
+			if (internal.staged) throw new StagedDispatcherHandoffError("Staged child dispatcher handoff failed.");
 			throw error;
 		}
 		return {
@@ -1364,6 +1539,48 @@ function createGovernedActionHost(options) {
 		};
 	}
 	/**
+	* Hand an existing staged child to the dispatcher again under its stable
+	* workflow id, as the public replay branch above does, when the child is
+	* still pending and a dispatcher is configured. Returns undefined when no
+	* handoff is needed. Raw dispatcher errors are replaced by a fixed one.
+	*/
+	async function handOffExistingStagedChild(existing) {
+		if (!options.dispatcher || existing.status !== "pending") return void 0;
+		try {
+			return await options.dispatcher.dispatch({
+				actionInvocationId: existing.id,
+				actionId: existing.actionId,
+				tenantId: existing.tenantId,
+				spaceId: existing.spaceId,
+				workflowId: `action-invocation-${existing.id}`
+			});
+		} catch {
+			throw new StagedDispatcherHandoffError("Staged child dispatcher handoff failed.");
+		}
+	}
+	async function replayExistingStagedInvocation(existing) {
+		const workflowId = `action-invocation-${existing.id}`;
+		const dispatched = await handOffExistingStagedChild(existing);
+		if (dispatched) return withConsistency({
+			actionInvocationId: existing.id,
+			status: existing.status,
+			workflowId: dispatched.workflowId,
+			...dispatched.runId ? { runId: dispatched.runId } : {}
+		}, existing.actionId);
+		return withConsistency({
+			actionInvocationId: existing.id,
+			status: existing.status,
+			workflowId,
+			result: existing.result,
+			...existing.error ? { error: existing.error } : {},
+			...existing.hitlRoute ? { hitlRoute: existing.hitlRoute } : {},
+			...existing.hitlRiskTier ? { hitlRiskTier: existing.hitlRiskTier } : {},
+			...existing.authorizationReconciliation ? { reconciliation: existing.authorizationReconciliation } : {},
+			...existing.adapterReconciliation ? { adapterReconciliation: existing.adapterReconciliation } : {},
+			...existing.pendingCompletion ? { pendingCompletion: existing.pendingCompletion } : {}
+		}, existing.actionId);
+	}
+	/**
 	* Run the action's `admitSubmission` check on a copy of the submission
 	* snapshot's parameters, with the snapshot's scope and actor, bounded by
 	* `admissionTimeoutMs`. Returns when it was admitted; anything but
@@ -1870,6 +2087,13 @@ function createGovernedActionHost(options) {
 		try {
 			(0, _fabricorg_platform.assertAdapterStepDeadlines)(action);
 			(0, _fabricorg_platform.assertActionFinalization)(action);
+			if ((action.stagesInvocations?.length ?? 0) > 0) {
+				const store = asAtomicMutationStore(options.store);
+				if (!stagedStore || !store) throw new Error("Staged descendant invocations require an atomic staging-capable store.");
+				await store.transactionWithEvents(async (transaction) => {
+					if (typeof transaction.stageInvocations !== "function") throw new Error("Staged descendant invocations require transaction-scoped stageInvocations support.");
+				});
+			}
 			if (action.finalize) {
 				const store = asAtomicMutationStore(options.store);
 				if (!store) throw new Error("Action finalization requires atomic mutation transactions.");
@@ -2127,6 +2351,7 @@ function createGovernedActionHost(options) {
 			let finalizationInput;
 			let domainEvents = [];
 			let pendingTransitionEvent;
+			let handlerStagedInvocations = replayCheckpoint?.stagedInvocations ?? [];
 			try {
 				if (replayCheckpoint) {
 					data = structuredClone(replayCheckpoint.result);
@@ -2221,6 +2446,24 @@ function createGovernedActionHost(options) {
 						};
 						if (!handlerResult.success) throw handlerResult.error != null ? new Error(handlerResult.error) : new HostError("Action handler failed");
 						const handlerData = handlerResult.data ?? {};
+						const rawStagedInvocations = handlerResult.stagedInvocations ?? [];
+						const stagedRecords = prepareStagedInvocationBatch({
+							parent: invocation,
+							parentAction: action,
+							requests: rawStagedInvocations,
+							resolveAction: actionResolver,
+							redactParameters: options.redactActionParameters,
+							now: now()
+						});
+						handlerStagedInvocations = stagedRecords.map((record) => ({
+							key: record.key,
+							actionId: record.actionId,
+							parameters: structuredClone(record.parameters)
+						}));
+						if (stagedRecords.length > 0 && action.eventPhase !== "after_adapters") {
+							if (!transaction?.stageInvocations) throw new Error("Staged descendant invocations require an atomic staging transaction.");
+							await transaction.stageInvocations(stagedRecords);
+						}
 						if (action.resultSchema && !action.finalize) {
 							const publicResult = withoutPrivateHostFields(handlerData, eventResultFields);
 							const parsedResult = action.resultSchema.safeParse(publicResult);
@@ -2271,7 +2514,8 @@ function createGovernedActionHost(options) {
 								handlerEvents: events,
 								result: preparedFinalizationInput.handlerData,
 								...transitionEvent ? { stateTransition: transitionEvent } : {},
-								skipped
+								skipped,
+								...handlerStagedInvocations.length > 0 ? { stagedInvocations: handlerStagedInvocations } : {}
 							});
 							if (new TextEncoder().encode((0, _fabricorg_platform.canonicalJson)(preparation)).byteLength > 262144) throw new HostError("Finalization checkpoint exceeds 256 KiB.");
 							if (executionLease) {
@@ -3070,6 +3314,19 @@ function createGovernedActionHost(options) {
 								if (action.resultSchema && !action.resultSchema.safeParse(result).success) throw new Error("Finalization merged result does not match resultSchema.");
 								finalPatch.result = result;
 							}
+							const stagedRequests = [...handlerStagedInvocations, ...finalized?.stagedInvocations ?? []];
+							if (stagedRequests.length > 0) {
+								if (!transaction.stageInvocations) throw new Error("Staged descendant invocations require an atomic staging transaction.");
+								await transaction.stageInvocations(prepareStagedInvocationBatch({
+									parent: invocation,
+									parentAction: action,
+									requests: stagedRequests,
+									resolveAction: actionResolver,
+									redactParameters: options.redactActionParameters,
+									redactedKeys: handlerStagedInvocations.map((request) => request.key),
+									now: now()
+								}));
+							}
 							for (const [index, event] of domainEvents.entries()) await appendEvent(invocation, event, `domain:${index}`, action.version, transaction);
 							for (const [index, event] of (finalized?.events ?? []).entries()) await appendEvent(invocation, event, `finalize:${index}`, action.version, transaction);
 							if (pendingTransitionEvent) await appendEvent(invocation, pendingTransitionEvent, "state:transition", 1, transaction);
@@ -3104,6 +3361,21 @@ function createGovernedActionHost(options) {
 					await hostOperation(() => persistExecutionInvocation(invocation, finalPatch));
 				}
 			} catch (error) {
+				if ((0, _fabricorg_platform.isReconciliationRequiredError)(error) && error.message.startsWith("Staged invocation batch drift")) {
+					const message = caughtError({
+						actionId: action.actionId,
+						source: "execution"
+					}, error);
+					await hostOperation(() => persistExecutionInvocation(invocation, {
+						status: "reconciliation_required",
+						error: message
+					}));
+					return withConsistency({
+						actionInvocationId,
+						status: "reconciliation_required",
+						error: message
+					}, action.actionId);
+				}
 				if (action.finalize) {
 					if (error instanceof RecoverableFinalizationError) throw error;
 					if (!finalizationCallbackFailure || finalizationCallbackFailure.error !== error) throw new RecoverableFinalizationError(caughtError({
@@ -3169,7 +3441,9 @@ function createGovernedActionHost(options) {
 		const entitled = await options.authorization.checkEntitlement(approvalAuthorizationInput);
 		const authorized = options.authorization.authorizeApproval ? await options.authorization.authorizeApproval({
 			...approvalAuthorizationInput,
-			decision
+			actionInvocationId,
+			decision,
+			invocation: structuredClone(invocation)
 		}) : await options.authorization.authorize(approvalAuthorizationInput);
 		if (!entitled || !authorized) return {
 			...actionResult(invocation),
@@ -3400,8 +3674,282 @@ function createGovernedActionHost(options) {
 		actionResult,
 		withConsistency
 	});
+	async function dispatchStagedInvocations(input) {
+		if (!stagedStore) throw new Error("This Platform Host store does not support staged descendant invocations.");
+		const leaseDurationMs = input.leaseDurationMs ?? 3e4;
+		const submissionTimeoutMs = input.submissionTimeoutMs ?? 1e4;
+		const maxAttempts = input.maxAttempts ?? 10;
+		for (const [name, value] of [
+			["leaseDurationMs", leaseDurationMs],
+			["submissionTimeoutMs", submissionTimeoutMs],
+			["maxAttempts", maxAttempts]
+		]) if (!Number.isInteger(value) || value <= 0) throw new Error(`${name} must be a positive integer.`);
+		const cancelled = await stagedStore.cancelStagedInvocationsForFailedParents({
+			...input.tenantId ? { tenantId: input.tenantId } : {},
+			...input.spaceId ? { spaceId: input.spaceId } : {},
+			now: now()
+		});
+		const records = await stagedStore.claimStagedInvocations({
+			workerId: input.workerId,
+			leaseDurationMs,
+			limit: input.limit ?? 10,
+			...input.tenantId ? { tenantId: input.tenantId } : {},
+			...input.spaceId ? { spaceId: input.spaceId } : {},
+			now: now()
+		});
+		const result = {
+			claimed: records.length,
+			dispatched: 0,
+			rejected: 0,
+			failed: 0,
+			deadLettered: 0,
+			cancelled
+		};
+		const sweep = {
+			store: stagedStore,
+			input,
+			leaseDurationMs,
+			submissionTimeoutMs,
+			maxAttempts
+		};
+		for (const record of records) {
+			let outcome;
+			try {
+				outcome = await dispatchStagedRow(record, sweep);
+			} catch (error) {
+				reportStagedError(input, error);
+				outcome = "unsettled";
+			}
+			if (outcome === "dispatched") result.dispatched += 1;
+			else if (outcome === "rejected") result.rejected += 1;
+			else {
+				result.failed += 1;
+				if (outcome === "dead_lettered") result.deadLettered += 1;
+			}
+		}
+		return result;
+	}
+	/**
+	* Settle one claimed row through a single sequence:
+	*
+	* 1. Renew the claim's lease, then look the child up by staged origin. An
+	*    earlier attempt's creation still in flight holds an older lease token
+	*    and fails the creation fence, so this lookup is authoritative for
+	*    earlier attempts. A child found here goes to step 4: no
+	*    pre-submission checks, no governance.
+	* 2. No child: pre-submission checks and the shared submission pipeline.
+	* 3. Unless this attempt's own create returned the child, rotate the lease
+	*    token. Only this attempt's own timed-out submission could still create
+	*    the child, it holds the old token, and the store orders the rotation
+	*    after any create the fence already admitted. The lookup that follows is
+	*    authoritative; a child found there goes to step 4, otherwise the
+	*    outcome is classified as rejected, retry or dead letter.
+	* 4. A known child that is pending is handed to the configured dispatcher
+	*    again under its stable workflow id; the stage settles with its id.
+	*
+	* Each settlement is one compare-and-set on the current owner and token. A
+	* lookup that fails settles the row for retry, never terminally.
+	*/
+	async function dispatchStagedRow(record, sweep) {
+		const { store, input, leaseDurationMs, maxAttempts } = sweep;
+		const claimLease = {
+			id: record.id,
+			workerId: input.workerId,
+			leaseToken: record.leaseToken
+		};
+		if (!await store.renewStagedInvocationLease({
+			...claimLease,
+			leaseDurationMs,
+			now: now()
+		})) return "unsettled";
+		const prior = await lookUpStagedChild(record, sweep);
+		if (prior.kind === "unreadable") return settleStagedRetry(record, claimLease, sweep, {
+			error: STAGED_ERROR.lookup,
+			terminal: false
+		});
+		if (prior.kind === "found") return settleExistingStagedChild(record, claimLease, prior.child, sweep);
+		const known = {};
+		let failure;
+		let submitted = false;
+		const stopHeartbeat = startStagedHeartbeat(store, claimLease, input, leaseDurationMs);
+		try {
+			await withSubmissionTimeout(submitStagedChild(record, claimLease, (child) => {
+				known.child = child;
+			}), sweep.submissionTimeoutMs);
+			submitted = true;
+		} catch (error) {
+			failure = error;
+		} finally {
+			await stopHeartbeat();
+		}
+		const createdChild = known.child;
+		if (createdChild) {
+			if (submitted || !options.dispatcher) return settleStagedDispatched(claimLease, createdChild.id, sweep);
+			return settleStagedRetry(record, claimLease, sweep, {
+				error: STAGED_ERROR.handoff,
+				childInvocationId: createdChild.id,
+				terminal: record.attemptCount >= maxAttempts
+			});
+		}
+		const rotatedToken = await store.rotateStagedInvocationLease({
+			...claimLease,
+			leaseDurationMs,
+			now: now()
+		});
+		if (rotatedToken === void 0) return "unsettled";
+		const lease = {
+			...claimLease,
+			leaseToken: rotatedToken
+		};
+		const after = await lookUpStagedChild(record, sweep);
+		if (after.kind === "unreadable") return settleStagedRetry(record, lease, sweep, {
+			error: STAGED_ERROR.lookup,
+			terminal: false
+		});
+		if (after.kind === "found") return settleExistingStagedChild(record, lease, after.child, sweep);
+		if (isDefinitiveStagedRefusal(failure)) return await store.markStagedInvocationRejected({
+			...lease,
+			error: STAGED_ERROR.refused,
+			now: now()
+		}) ? "rejected" : "unsettled";
+		return settleStagedRetry(record, lease, sweep, {
+			error: STAGED_ERROR.dispatch,
+			terminal: record.attemptCount >= maxAttempts
+		});
+	}
+	/** Pre-submission checks, then the shared submission pipeline under the claim's lease. */
+	async function submitStagedChild(record, lease, onChild) {
+		const parent = await options.store.getActionInvocation(record.parentInvocationId, record.tenantId, record.spaceId);
+		if (!parent || parent.status !== "completed") throw new Error("Staged parent is not completed.");
+		const child = actionResolver(record.actionId);
+		if (!child) throw new StagedDispatchRejectionError("Staged action is no longer registered.");
+		if (child.execution?.authorityMoment === "capture") throw new StagedDispatchRejectionError("Staged action now requires capture-time authority.");
+		if (!child.schema.safeParse(structuredClone(record.parameters)).success) throw new StagedDispatchRejectionError("Staged parameters no longer match the registered action.");
+		return submitActionInternal({
+			actionId: record.actionId,
+			parameters: structuredClone(record.parameters),
+			tenantId: parent.tenantId,
+			spaceId: parent.spaceId,
+			actorId: parent.actorId,
+			actorType: parent.actorType,
+			correlationId: parent.correlationId,
+			causationId: parent.id,
+			provenance: {
+				source: "worker",
+				correlationId: parent.correlationId,
+				causationId: parent.id
+			},
+			executionReason: "staged_dispatch"
+		}, {
+			staged: {
+				id: record.id,
+				origin: {
+					parentInvocationId: parent.id,
+					stageKey: record.key
+				},
+				workerId: lease.workerId,
+				leaseToken: lease.leaseToken,
+				onChild
+			},
+			parametersAlreadyRedacted: true
+		});
+	}
+	async function lookUpStagedChild(record, sweep) {
+		try {
+			const child = await sweep.store.getActionInvocationByStagedOrigin(record.tenantId, record.spaceId, {
+				parentInvocationId: record.parentInvocationId,
+				stageKey: record.key
+			});
+			return child ? {
+				kind: "found",
+				child
+			} : { kind: "absent" };
+		} catch (error) {
+			reportStagedError(sweep.input, error);
+			return { kind: "unreadable" };
+		}
+	}
+	async function settleExistingStagedChild(record, lease, child, sweep) {
+		if (options.dispatcher && child.status === "pending") {
+			const stopHeartbeat = startStagedHeartbeat(sweep.store, lease, sweep.input, sweep.leaseDurationMs);
+			let handedOff = false;
+			try {
+				await withSubmissionTimeout(handOffExistingStagedChild(child), sweep.submissionTimeoutMs);
+				handedOff = true;
+			} catch {} finally {
+				await stopHeartbeat();
+			}
+			if (!handedOff) return settleStagedRetry(record, lease, sweep, {
+				error: STAGED_ERROR.handoff,
+				childInvocationId: child.id,
+				terminal: record.attemptCount >= sweep.maxAttempts
+			});
+		}
+		return settleStagedDispatched(lease, child.id, sweep);
+	}
+	async function settleStagedDispatched(lease, childInvocationId, sweep) {
+		return await sweep.store.markStagedInvocationDispatched({
+			...lease,
+			childInvocationId,
+			now: now()
+		}) ? "dispatched" : "unsettled";
+	}
+	async function settleStagedRetry(record, lease, sweep, settlement) {
+		if (!await sweep.store.markStagedInvocationFailed({
+			...lease,
+			error: settlement.error,
+			availableAt: new Date(now().getTime() + (sweep.input.retryDelayMs?.(record.attemptCount) ?? 1e3)),
+			deadLetter: settlement.terminal,
+			...settlement.childInvocationId ? { childInvocationId: settlement.childInvocationId } : {},
+			now: now()
+		})) return "unsettled";
+		return settlement.terminal ? "dead_lettered" : "retry";
+	}
+	function isDefinitiveStagedRefusal(error) {
+		return error instanceof SubmissionRefusalError || error instanceof StagedDispatchRejectionError || error instanceof ActionAdmissionError && (error.refusal === "refused" || error.refusal === "invalid_parameters");
+	}
+	function reportStagedError(input, error) {
+		try {
+			input.onError?.(error);
+		} catch {}
+	}
+	/** Renew one lease token while a slow step runs; the returned stop awaits a renewal in flight. */
+	function startStagedHeartbeat(store, lease, input, leaseDurationMs) {
+		const intervalMs = input.leaseRenewalIntervalMs ?? Math.max(1, Math.floor(leaseDurationMs / 3));
+		let stopped = false;
+		let timer;
+		let running;
+		const schedule = () => {
+			if (!stopped) timer = setTimeout(tick, intervalMs);
+		};
+		const tick = () => {
+			running = store.renewStagedInvocationLease({
+				...lease,
+				leaseDurationMs,
+				now: now()
+			}).then(() => void 0).catch(() => void 0).finally(schedule);
+		};
+		schedule();
+		return async () => {
+			stopped = true;
+			if (timer) clearTimeout(timer);
+			await running;
+		};
+	}
+	async function withSubmissionTimeout(submission, timeoutMs) {
+		let timer;
+		try {
+			return await Promise.race([submission, new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new StagedSubmissionTimeoutError("Staged invocation submission timed out.")), timeoutMs);
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
 	return {
 		submitAction,
+		hasStagedInvocationActions: declaresStaging,
+		...stagedStore ? { dispatchStagedInvocations } : {},
 		executeInvocation,
 		resumeApprovedInvocation,
 		recordExecutionAttestation,
@@ -3731,6 +4279,7 @@ function emitRelayTelemetry(telemetry, name, occurredAt, workerId, attributes) {
 var MemoryPlatformHostStore = class {
 	db;
 	transactionalOutbox;
+	transactionalStagedInvocations;
 	adapterCommit;
 	transactionTail = Promise.resolve();
 	invocations = [];
@@ -3741,6 +4290,7 @@ var MemoryPlatformHostStore = class {
 	executionAttestations = [];
 	externalReconciliations = [];
 	outbox = [];
+	stagedInvocations = [];
 	/**
 	* Requeue evidence is append-only audit history, so unlike the ledger
 	* arrays above, which tests have always inspected and seeded directly, it
@@ -3751,6 +4301,7 @@ var MemoryPlatformHostStore = class {
 	constructor(db, transactionProvider) {
 		this.db = db;
 		this.transactionalOutbox = transactionProvider !== void 0;
+		this.transactionalStagedInvocations = transactionProvider !== void 0;
 		if (transactionProvider) this.transactionWithEvents = (run) => this.runTransactionWithEvents(run, transactionProvider);
 	}
 	async transaction(run) {
@@ -3776,6 +4327,7 @@ var MemoryPlatformHostStore = class {
 			const conditionalAdapters = [];
 			const leasedUpdates = [];
 			const pendingReconciliations = [];
+			const pendingStagedBatches = [];
 			const appendPending = async (event, metadata) => {
 				if (this.events.some((candidate) => candidate.id === event.id) || pendingEvents.some((candidate) => candidate.event.id === event.id)) return;
 				pendingEvents.push({
@@ -3832,6 +4384,9 @@ var MemoryPlatformHostStore = class {
 				appendExternalReconciliation: async (record) => {
 					pendingReconciliations.push(record);
 				},
+				stageInvocations: async (records) => {
+					pendingStagedBatches.push(records.map(cloneStagedInvocationRecord));
+				},
 				updateActionInvocation: async (id, tenantId, spaceId, patch) => {
 					pendingUpdates.push({
 						id,
@@ -3885,6 +4440,15 @@ var MemoryPlatformHostStore = class {
 				rememberAppend(this.externalReconciliations, record.id);
 				await this.appendExternalReconciliation(record);
 			}
+			for (const records of pendingStagedBatches) {
+				const appended = this.applyStagedBatch(records);
+				if (appended.length > 0) undoLedgerWrites.push(() => {
+					for (const id of appended) {
+						const index = this.stagedInvocations.findIndex((record) => record.id === id);
+						if (index !== -1) this.stagedInvocations.splice(index, 1);
+					}
+				});
+			}
 			for (const [id, patch, scope] of pendingAdapterUpdates) {
 				const record = await this.getAdapterInvocation(id, scope);
 				if (!record) throw new Error(`AdapterInvocation not found: ${id}`);
@@ -3935,9 +4499,50 @@ var MemoryPlatformHostStore = class {
 		this.invocations.push(record);
 		return record;
 	}
+	async createActionInvocationForStagedLease(input) {
+		const { invocation, now = /* @__PURE__ */ new Date() } = input;
+		const existing = this.invocations.find((record) => record.tenantId === invocation.tenantId && record.spaceId === invocation.spaceId && record.stagedOrigin?.parentInvocationId === invocation.stagedOrigin.parentInvocationId && record.stagedOrigin.stageKey === invocation.stagedOrigin.stageKey);
+		if (existing) return {
+			kind: "existing",
+			invocation: existing
+		};
+		if (!this.stagedInvocations.find((record) => record.id === input.stageId && record.tenantId === invocation.tenantId && record.spaceId === invocation.spaceId && record.parentInvocationId === invocation.stagedOrigin.parentInvocationId && record.key === invocation.stagedOrigin.stageKey && record.actionId === invocation.actionId && record.status === "pending" && record.leaseOwner === input.workerId && record.leaseToken === input.leaseToken && record.leaseExpiresAt !== void 0 && record.leaseExpiresAt > now)) return { kind: "lease_lost" };
+		const createdAt = /* @__PURE__ */ new Date();
+		const record = {
+			...invocation,
+			attemptCount: 0,
+			leaseToken: 0,
+			createdAt,
+			updatedAt: createdAt
+		};
+		this.invocations.push(record);
+		return {
+			kind: "created",
+			invocation: record
+		};
+	}
+	applyStagedBatch(records) {
+		if (records.length === 0) return [];
+		const first = records[0];
+		const existing = this.stagedInvocations.filter((record) => record.tenantId === first.tenantId && record.spaceId === first.spaceId && record.parentInvocationId === first.parentInvocationId);
+		if (existing.length > 0) {
+			if (!(existing.length === records.length && records.every((record) => {
+				const stored = existing.find((candidate) => candidate.key === record.key);
+				return stored !== void 0 && stored.batchDigest === record.batchDigest && stagedInvocationRequestIdentity(stored) === stagedInvocationRequestIdentity(record);
+			}))) throw new _fabricorg_platform.ReconciliationRequiredError(`Staged invocation batch drift for parent ${first.parentInvocationId}.`);
+			return [];
+		}
+		const keys = records.map((record) => record.key);
+		if (new Set(keys).size !== keys.length || records.some((record) => record.tenantId !== first.tenantId || record.spaceId !== first.spaceId || record.parentInvocationId !== first.parentInvocationId || record.batchDigest !== first.batchDigest)) throw new Error(`Invalid staged invocation batch for parent ${first.parentInvocationId}.`);
+		for (const record of records) this.stagedInvocations.push(cloneStagedInvocationRecord(record));
+		return records.map((record) => record.id);
+	}
 	async getActionInvocation(id, tenantId, spaceId) {
 		return this.invocations.find((record) => record.id === id && record.tenantId === tenantId && record.spaceId === spaceId);
 	}
+	async getActionInvocationByStagedOrigin(tenantId, spaceId, origin) {
+		return this.invocations.find((record) => record.tenantId === tenantId && record.spaceId === spaceId && record.stagedOrigin?.parentInvocationId === origin.parentInvocationId && record.stagedOrigin.stageKey === origin.stageKey);
+	}
 	async updateActionInvocation(id, tenantId, spaceId, patch) {
 		const record = this.invocations.find((row) => row.id === id && row.tenantId === tenantId && row.spaceId === spaceId);
 		if (!record) throw new Error(`ActionInvocation not found: ${id}`);
@@ -4267,6 +4872,96 @@ var MemoryPlatformHostStore = class {
 		record.updatedAt = current;
 		return true;
 	}
+	async claimStagedInvocations(input) {
+		while (this.adapterCommit) await this.adapterCommit;
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const eligible = this.stagedInvocations.filter((record) => {
+			return this.invocations.find((candidate) => candidate.id === record.parentInvocationId && candidate.tenantId === record.tenantId && candidate.spaceId === record.spaceId)?.status === "completed" && record.status === "pending" && record.availableAt <= current && (!record.leaseExpiresAt || record.leaseExpiresAt <= current) && (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId);
+		}).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime() || left.id.localeCompare(right.id)).slice(0, Math.max(1, Math.min(input.limit ?? 100, 1e3)));
+		for (const record of eligible) {
+			record.leaseOwner = input.workerId;
+			record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+			record.leaseToken += 1;
+			record.attemptCount += 1;
+			record.updatedAt = current;
+		}
+		return eligible.map(cloneStagedInvocationRecord);
+	}
+	async markStagedInvocationDispatched(input) {
+		return this.settleStagedInvocation(input, "dispatched", input.childInvocationId, void 0);
+	}
+	async markStagedInvocationRejected(input) {
+		return this.settleStagedInvocation(input, "rejected", void 0, input.error);
+	}
+	async markStagedInvocationFailed(input) {
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record) return false;
+		record.status = input.deadLetter ? "dead_lettered" : "pending";
+		record.lastError = input.error;
+		if (input.childInvocationId) record.childInvocationId = input.childInvocationId;
+		record.availableAt = new Date(input.availableAt);
+		record.updatedAt = input.now ?? /* @__PURE__ */ new Date();
+		delete record.leaseOwner;
+		delete record.leaseExpiresAt;
+		return true;
+	}
+	async renewStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return false;
+		record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		record.updatedAt = current;
+		return true;
+	}
+	/** Await-free, like the fenced create above, so a create runs wholly before or after it. */
+	async rotateStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record || !record.leaseExpiresAt || record.leaseExpiresAt <= current) return void 0;
+		record.leaseToken += 1;
+		record.leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		record.updatedAt = current;
+		return record.leaseToken;
+	}
+	async cancelStagedInvocationsForFailedParents(input = {}) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		let cancelled = 0;
+		for (const record of this.stagedInvocations) {
+			if (record.status !== "pending" || input.tenantId && record.tenantId !== input.tenantId || input.spaceId && record.spaceId !== input.spaceId) continue;
+			const parent = this.invocations.find((candidate) => candidate.id === record.parentInvocationId && candidate.tenantId === record.tenantId && candidate.spaceId === record.spaceId);
+			if (!parent || ![
+				"failed",
+				"blocked_by_policy",
+				"validation_failed"
+			].includes(parent.status)) continue;
+			record.status = "cancelled";
+			record.lastError = `Parent invocation ended with ${parent.status}.`;
+			record.updatedAt = current;
+			delete record.leaseOwner;
+			delete record.leaseExpiresAt;
+			cancelled += 1;
+		}
+		return cancelled;
+	}
+	async listStagedInvocations(input) {
+		return this.stagedInvocations.filter((record) => record.tenantId === input.tenantId && record.spaceId === input.spaceId && (input.parentInvocationId === void 0 || record.parentInvocationId === input.parentInvocationId) && (!input.statuses?.length || input.statuses.includes(record.status))).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime() || left.id.localeCompare(right.id)).map(cloneStagedInvocationRecord);
+	}
+	leasedStagedInvocation(id, workerId, leaseToken) {
+		return this.stagedInvocations.find((record) => record.id === id && record.status === "pending" && record.leaseOwner === workerId && record.leaseToken === leaseToken);
+	}
+	/** Mirrors PostgreSQL: a missing child id keeps the recorded one; `lastError` is replaced. */
+	settleStagedInvocation(input, status, childInvocationId, lastError) {
+		const record = this.leasedStagedInvocation(input.id, input.workerId, input.leaseToken);
+		if (!record) return false;
+		record.status = status;
+		if (childInvocationId !== void 0) record.childInvocationId = childInvocationId;
+		if (lastError !== void 0) record.lastError = lastError;
+		else delete record.lastError;
+		record.updatedAt = input.now ?? /* @__PURE__ */ new Date();
+		delete record.leaseOwner;
+		delete record.leaseExpiresAt;
+		return true;
+	}
 	async listEvents(tenantId, spaceId) {
 		return this.events.filter((event) => event.tenantId === tenantId && event.spaceId === spaceId).sort((left, right) => left.sequence - right.sequence);
 	}
@@ -4360,10 +5055,12 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 	sql;
 	transactionWithEvents;
 	transactionalOutbox;
+	transactionalStagedInvocations;
 	constructor(db, sql, transactionProvider) {
 		this.db = db;
 		this.sql = sql;
 		this.transactionalOutbox = transactionProvider !== void 0;
+		this.transactionalStagedInvocations = transactionProvider !== void 0;
 		if (transactionProvider) this.transactionWithEvents = async (run) => transactionProvider.run(async ({ db, sql }) => {
 			const scoped = new PostgresPlatformHostStore(db, sql);
 			return run({
@@ -4389,7 +5086,8 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 				updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input),
 				updateAdapterInvocation: (id, patch, scope) => scoped.updateAdapterInvocation(id, patch, scope),
 				writeAdapterInvocation: (input) => scoped.writeAdapterInvocation(input),
-				appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record)
+				appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record),
+				stageInvocations: (records) => scoped.stageInvocations(records)
 			});
 		});
 	}
@@ -4593,6 +5291,38 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 				version: 10,
 				name: "finalization_preparation_checkpoint",
 				sql: `ALTER TABLE fabric_platform.action_invocations ADD COLUMN IF NOT EXISTS finalization_checkpoint jsonb;`
+			},
+			{
+				version: 11,
+				name: "staged_descendant_invocations",
+				sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN IF NOT EXISTS staged_parent_invocation_id text,
+					ADD COLUMN IF NOT EXISTS staged_stage_key text;
+				CREATE UNIQUE INDEX IF NOT EXISTS action_invocations_staged_origin_idx
+					ON fabric_platform.action_invocations
+					(tenant_id, space_id, staged_parent_invocation_id, staged_stage_key)
+					WHERE staged_parent_invocation_id IS NOT NULL AND staged_stage_key IS NOT NULL;
+				CREATE TABLE IF NOT EXISTS fabric_platform.staged_invocations (
+					id text PRIMARY KEY,
+					tenant_id text NOT NULL, space_id text NOT NULL,
+					parent_invocation_id text NOT NULL, parent_action_id text NOT NULL,
+					stage_key text NOT NULL, action_id text NOT NULL,
+					expected_action_version integer NOT NULL,
+					parameters jsonb NOT NULL, parameter_digest text NOT NULL, batch_digest text NOT NULL,
+					status text NOT NULL, child_invocation_id text,
+					attempt_count integer NOT NULL DEFAULT 0,
+					available_at timestamptz NOT NULL,
+					lease_owner text, lease_expires_at timestamptz,
+					lease_token bigint NOT NULL DEFAULT 0,
+					last_error text, created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL,
+					UNIQUE (tenant_id, space_id, parent_invocation_id, stage_key)
+				);
+				CREATE INDEX IF NOT EXISTS staged_invocations_claim_idx
+					ON fabric_platform.staged_invocations (status, available_at, lease_expires_at, created_at);
+				CREATE INDEX IF NOT EXISTS staged_invocations_parent_idx
+					ON fabric_platform.staged_invocations (tenant_id, space_id, parent_invocation_id, created_at);
+			`
 			}
 		]);
 	}
@@ -4608,11 +5338,11 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		try {
 			result = await this.sql.query(`INSERT INTO fabric_platform.action_invocations
 				 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
-					  parameters,result,correlation_id,causation_id,idempotency_key,
-					  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
-					  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
-					  authorization_binding_id,error,runtime_evidence,${admittedColumn}created_at,updated_at)
-					 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,${admittedValue}$24,$24)
+				  parameters,result,correlation_id,causation_id,idempotency_key,
+				  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
+				  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
+				  authorization_binding_id,error,runtime_evidence,${admittedColumn}created_at,updated_at)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,${admittedValue}$24,$24)
 				 ON CONFLICT (tenant_id,space_id,action_id,idempotency_key)
 				 WHERE idempotency_key IS NOT NULL DO UPDATE SET id=fabric_platform.action_invocations.id
 				 RETURNING *`, [
@@ -4648,6 +5378,140 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		}
 		return toActionRecord(result.rows[0]);
 	}
+	async createActionInvocationForStagedLease(input) {
+		const { invocation } = input;
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const admitted = invocation.admittedAt !== void 0;
+		const admittedColumn = admitted ? ",admitted_at" : "";
+		const admittedValue = admitted ? ",$30" : "";
+		const values = [
+			invocation.id,
+			invocation.tenantId,
+			invocation.spaceId,
+			invocation.actionId,
+			invocation.actionVersion,
+			invocation.actorId,
+			invocation.actorType,
+			invocation.status,
+			JSON.stringify(invocation.parameters),
+			JSON.stringify(invocation.result),
+			invocation.correlationId,
+			invocation.causationId ?? null,
+			invocation.idempotencyKey ?? null,
+			invocation.parameterDigest ?? null,
+			invocation.parameterDigestAlgorithm ?? null,
+			invocation.idempotencyActorId ?? null,
+			invocation.idempotencyAuthorizationBindingId ?? null,
+			invocation.provenance ? JSON.stringify(invocation.provenance) : null,
+			invocation.authorizationBinding ? JSON.stringify(invocation.authorizationBinding) : null,
+			invocation.executionReason ?? null,
+			invocation.authorizationBindingId ?? null,
+			invocation.error ?? null,
+			invocation.runtimeEvidence ? JSON.stringify(invocation.runtimeEvidence) : null,
+			invocation.stagedOrigin.parentInvocationId,
+			invocation.stagedOrigin.stageKey,
+			input.stageId,
+			input.workerId,
+			input.leaseToken,
+			current,
+			...admitted ? [invocation.admittedAt] : []
+		];
+		let result;
+		try {
+			result = await this.sql.query(`WITH fence AS (
+					SELECT stage.id
+					FROM fabric_platform.staged_invocations AS stage
+					WHERE stage.id=$26 AND stage.tenant_id=$2 AND stage.space_id=$3
+					  AND stage.parent_invocation_id=$24 AND stage.stage_key=$25 AND stage.action_id=$4
+					  AND stage.status='pending' AND stage.lease_owner=$27 AND stage.lease_token=$28
+					  AND stage.lease_expires_at IS NOT NULL AND stage.lease_expires_at > $29
+					FOR SHARE
+				)
+				 INSERT INTO fabric_platform.action_invocations
+				 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
+				  parameters,result,correlation_id,causation_id,idempotency_key,parameter_digest,
+				  parameter_digest_algorithm,idempotency_actor_id,idempotency_authorization_binding_id,
+				  invocation_provenance,authorization_binding,execution_reason,authorization_binding_id,error,
+				  runtime_evidence,staged_parent_invocation_id,staged_stage_key${admittedColumn},created_at,updated_at)
+				 SELECT $1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,
+				        $18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,$24,$25${admittedValue},$29,$29
+				 FROM fence
+				 ON CONFLICT (tenant_id,space_id,staged_parent_invocation_id,staged_stage_key)
+				 WHERE staged_parent_invocation_id IS NOT NULL AND staged_stage_key IS NOT NULL
+				 DO UPDATE SET id=fabric_platform.action_invocations.id
+				 RETURNING *`, values);
+		} catch (error) {
+			if (error?.code === "42703" || error?.code === "42P01") throw new Error("A staged child needs PostgreSQL migration 11 (staged_descendant_invocations); run ensureSchema() before dispatching staged invocations.", { cause: error });
+			throw error;
+		}
+		if (result.rows[0]) {
+			const record = toActionRecord(result.rows[0]);
+			return {
+				kind: record.id === invocation.id ? "created" : "existing",
+				invocation: record
+			};
+		}
+		const existing = await this.getActionInvocationByStagedOrigin(invocation.tenantId, invocation.spaceId, invocation.stagedOrigin);
+		return existing ? {
+			kind: "existing",
+			invocation: existing
+		} : { kind: "lease_lost" };
+	}
+	async stageInvocations(records) {
+		if (records.length === 0) return;
+		const first = records[0];
+		if (!(await this.sql.query(`SELECT id FROM fabric_platform.action_invocations
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3 FOR UPDATE`, [
+			first.parentInvocationId,
+			first.tenantId,
+			first.spaceId
+		])).rows[0]) throw new Error(`ActionInvocation not found: ${first.parentInvocationId}`);
+		const current = await this.sql.query(`SELECT * FROM fabric_platform.staged_invocations
+			 WHERE tenant_id=$1 AND space_id=$2 AND parent_invocation_id=$3
+			 ORDER BY stage_key`, [
+			first.tenantId,
+			first.spaceId,
+			first.parentInvocationId
+		]);
+		if (current.rows.length > 0) {
+			const stored = current.rows.map(toStagedInvocationRecord);
+			if (!(stored.length === records.length && records.every((record) => {
+				const candidate = stored.find((item) => item.key === record.key);
+				return candidate !== void 0 && candidate.batchDigest === record.batchDigest && stagedInvocationRequestIdentity(candidate) === stagedInvocationRequestIdentity(record);
+			}))) throw new _fabricorg_platform.ReconciliationRequiredError(`Staged invocation batch drift for parent ${first.parentInvocationId}.`);
+			return;
+		}
+		for (const record of records) {
+			if (record.tenantId !== first.tenantId || record.spaceId !== first.spaceId || record.parentInvocationId !== first.parentInvocationId || record.batchDigest !== first.batchDigest) throw new Error(`Invalid staged invocation batch for parent ${first.parentInvocationId}.`);
+			await this.sql.query(`INSERT INTO fabric_platform.staged_invocations
+				 (id,tenant_id,space_id,parent_invocation_id,parent_action_id,stage_key,action_id,
+				  expected_action_version,parameters,parameter_digest,batch_digest,status,child_invocation_id,
+				  attempt_count,available_at,lease_owner,lease_expires_at,lease_token,last_error,created_at,updated_at)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, [
+				record.id,
+				record.tenantId,
+				record.spaceId,
+				record.parentInvocationId,
+				record.parentActionId,
+				record.key,
+				record.actionId,
+				record.expectedActionVersion,
+				JSON.stringify(record.parameters),
+				record.parameterDigest,
+				record.batchDigest,
+				record.status,
+				record.childInvocationId ?? null,
+				record.attemptCount,
+				record.availableAt,
+				record.leaseOwner ?? null,
+				record.leaseExpiresAt ?? null,
+				record.leaseToken,
+				record.lastError ?? null,
+				record.createdAt,
+				record.updatedAt
+			]);
+		}
+	}
 	async getActionInvocation(id, tenantId, spaceId) {
 		const result = await this.sql.query(`SELECT * FROM fabric_platform.action_invocations
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`, [
@@ -4657,6 +5521,17 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 		]);
 		return result.rows[0] ? toActionRecord(result.rows[0]) : void 0;
 	}
+	async getActionInvocationByStagedOrigin(tenantId, spaceId, origin) {
+		const result = await this.sql.query(`SELECT * FROM fabric_platform.action_invocations
+			 WHERE tenant_id=$1 AND space_id=$2
+			   AND staged_parent_invocation_id=$3 AND staged_stage_key=$4`, [
+			tenantId,
+			spaceId,
+			origin.parentInvocationId,
+			origin.stageKey
+		]);
+		return result.rows[0] ? toActionRecord(result.rows[0]) : void 0;
+	}
 	async updateActionInvocation(id, tenantId, spaceId, patch) {
 		await this.sql.query(`UPDATE fabric_platform.action_invocations SET
 			 status=COALESCE($4,status), result=COALESCE($5::jsonb,result),
@@ -5187,6 +6062,139 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 			input.outboxId ?? null
 		])).rows.map((row) => toOutboxRequeueRecord(row, ""));
 	}
+	async claimStagedInvocations(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const leaseExpiresAt = new Date(current.getTime() + input.leaseDurationMs);
+		const limit = Math.max(1, Math.min(input.limit ?? 100, 1e3));
+		return (await this.sql.query(`WITH claimable AS (
+				SELECT stage.id
+				FROM fabric_platform.staged_invocations AS stage
+				JOIN fabric_platform.action_invocations AS parent
+				  ON parent.id=stage.parent_invocation_id
+				 AND parent.tenant_id=stage.tenant_id AND parent.space_id=stage.space_id
+				WHERE stage.status='pending' AND parent.status='completed'
+				  AND stage.available_at <= $1
+				  AND (stage.lease_expires_at IS NULL OR stage.lease_expires_at <= $1)
+				  AND ($2::text IS NULL OR stage.tenant_id=$2)
+				  AND ($3::text IS NULL OR stage.space_id=$3)
+				ORDER BY stage.created_at,stage.id
+				FOR UPDATE OF stage SKIP LOCKED LIMIT $4
+			)
+			UPDATE fabric_platform.staged_invocations AS stage
+			SET lease_owner=$5, lease_expires_at=$6, lease_token=stage.lease_token+1,
+			    attempt_count=stage.attempt_count+1, updated_at=$1
+			FROM claimable WHERE stage.id=claimable.id
+			RETURNING stage.*`, [
+			current,
+			input.tenantId ?? null,
+			input.spaceId ?? null,
+			limit,
+			input.workerId,
+			leaseExpiresAt
+		])).rows.map(toStagedInvocationRecord);
+	}
+	async markStagedInvocationDispatched(input) {
+		return this.settleStagedInvocation(input.id, input.workerId, input.leaseToken, "dispatched", input.now ?? /* @__PURE__ */ new Date(), input.childInvocationId, null);
+	}
+	async markStagedInvocationRejected(input) {
+		return this.settleStagedInvocation(input.id, input.workerId, input.leaseToken, "rejected", input.now ?? /* @__PURE__ */ new Date(), null, input.error);
+	}
+	async markStagedInvocationFailed(input) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET status=$4, last_error=$5, available_at=$6,
+			     child_invocation_id=COALESCE($7,child_invocation_id),
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$8
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3 RETURNING id`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			input.deadLetter ? "dead_lettered" : "pending",
+			input.error,
+			input.availableAt,
+			input.childInvocationId ?? null,
+			input.now ?? /* @__PURE__ */ new Date()
+		])).rows.length === 1;
+	}
+	async renewStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET lease_expires_at=$4, updated_at=$5
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3
+			   AND lease_expires_at IS NOT NULL AND lease_expires_at > $5 RETURNING id`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			new Date(current.getTime() + input.leaseDurationMs),
+			current
+		])).rows.length === 1;
+	}
+	/**
+	* The UPDATE needs a row lock that conflicts with the `FOR SHARE` lock the
+	* fenced child insert takes on this row, so it waits for an in-flight
+	* insert to commit. A fenced insert under the old token that reaches the
+	* row while this rotation is uncommitted waits for it, rechecks the new row
+	* version and inserts nothing (live tests "orders a token rotation after an
+	* in-flight fenced create ..." and "refuses a fenced create under the old
+	* token once a token rotation is ordered before it").
+	*/
+	async rotateStagedInvocationLease(input) {
+		const current = input.now ?? /* @__PURE__ */ new Date();
+		const result = await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET lease_token=lease_token+1, lease_expires_at=$4, updated_at=$5
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3
+			   AND lease_expires_at IS NOT NULL AND lease_expires_at > $5
+			 RETURNING lease_token`, [
+			input.id,
+			input.workerId,
+			input.leaseToken,
+			new Date(current.getTime() + input.leaseDurationMs),
+			current
+		]);
+		return result.rows[0] ? Number(result.rows[0].lease_token) : void 0;
+	}
+	async cancelStagedInvocationsForFailedParents(input = {}) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations AS stage
+			 SET status='cancelled', last_error='Parent invocation ended with ' || parent.status || '.',
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$3
+			 FROM fabric_platform.action_invocations AS parent
+			 WHERE parent.id=stage.parent_invocation_id
+			   AND parent.tenant_id=stage.tenant_id AND parent.space_id=stage.space_id
+			   AND parent.status IN ('failed','blocked_by_policy','validation_failed')
+			   AND stage.status='pending'
+			   AND ($1::text IS NULL OR stage.tenant_id=$1)
+			   AND ($2::text IS NULL OR stage.space_id=$2)
+			 RETURNING stage.id`, [
+			input.tenantId ?? null,
+			input.spaceId ?? null,
+			input.now ?? /* @__PURE__ */ new Date()
+		])).rows.length;
+	}
+	async listStagedInvocations(input) {
+		return (await this.sql.query(`SELECT * FROM fabric_platform.staged_invocations
+			 WHERE tenant_id=$1 AND space_id=$2
+			   AND ($3::text IS NULL OR parent_invocation_id=$3)
+			   AND ($4::text[] IS NULL OR status=ANY($4::text[]))
+			 ORDER BY created_at,id`, [
+			input.tenantId,
+			input.spaceId,
+			input.parentInvocationId ?? null,
+			input.statuses?.length ? [...input.statuses] : null
+		])).rows.map(toStagedInvocationRecord);
+	}
+	async settleStagedInvocation(id, workerId, leaseToken, status, now, childInvocationId, lastError) {
+		return (await this.sql.query(`UPDATE fabric_platform.staged_invocations
+			 SET status=$4, child_invocation_id=COALESCE($5,child_invocation_id), last_error=$6,
+			     lease_owner=NULL, lease_expires_at=NULL, updated_at=$7
+			 WHERE id=$1 AND status='pending' AND lease_owner=$2 AND lease_token=$3 RETURNING id`, [
+			id,
+			workerId,
+			leaseToken,
+			status,
+			childInvocationId,
+			lastError,
+			now
+		])).rows.length === 1;
+	}
 	async nextEventSequence(tenantId, spaceId) {
 		const result = await this.sql.query(`INSERT INTO fabric_platform.event_sequences (tenant_id,space_id,next_sequence)
 			 VALUES ($1,$2,1) ON CONFLICT (tenant_id,space_id) DO UPDATE
@@ -5441,6 +6449,10 @@ function toActionRecord(row) {
 		...row.parameter_digest_algorithm ? { parameterDigestAlgorithm: String(row.parameter_digest_algorithm) } : {},
 		...row.idempotency_actor_id ? { idempotencyActorId: String(row.idempotency_actor_id) } : {},
 		...row.idempotency_authorization_binding_id ? { idempotencyAuthorizationBindingId: String(row.idempotency_authorization_binding_id) } : {},
+		...row.staged_parent_invocation_id && row.staged_stage_key ? { stagedOrigin: {
+			parentInvocationId: String(row.staged_parent_invocation_id),
+			stageKey: String(row.staged_stage_key)
+		} } : {},
 		...row.invocation_provenance ? { provenance: row.invocation_provenance } : {},
 		...row.authorization_binding ? { authorizationBinding: row.authorization_binding } : {},
 		...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
@@ -5470,6 +6482,31 @@ function toActionRecord(row) {
 		updatedAt: new Date(row.updated_at)
 	};
 }
+function toStagedInvocationRecord(row) {
+	return {
+		id: String(row.id),
+		tenantId: String(row.tenant_id),
+		spaceId: String(row.space_id),
+		parentInvocationId: String(row.parent_invocation_id),
+		parentActionId: String(row.parent_action_id),
+		key: String(row.stage_key),
+		actionId: String(row.action_id),
+		expectedActionVersion: Number(row.expected_action_version),
+		parameters: row.parameters,
+		parameterDigest: String(row.parameter_digest),
+		batchDigest: String(row.batch_digest),
+		status: String(row.status),
+		...row.child_invocation_id ? { childInvocationId: String(row.child_invocation_id) } : {},
+		attemptCount: Number(row.attempt_count),
+		availableAt: new Date(row.available_at),
+		...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
+		...row.lease_expires_at ? { leaseExpiresAt: new Date(row.lease_expires_at) } : {},
+		leaseToken: Number(row.lease_token ?? 0),
+		...row.last_error ? { lastError: String(row.last_error) } : {},
+		createdAt: new Date(row.created_at),
+		updatedAt: new Date(row.updated_at)
+	};
+}
 function toObligationRecord(row) {
 	return {
 		id: String(row.id),
@@ -5609,6 +6646,23 @@ function createStoreBackedActionDispatcher() {
 async function runPlatformActionWorkerCycle(options) {
 	const leaseDurationMs = options.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS;
 	emitWorkerTelemetry(options.telemetry, "worker.cycle.started", options.workerId);
+	let staged;
+	if ((options.dispatchStagedInvocations === true || options.dispatchStagedInvocations !== false && options.host.hasStagedInvocationActions === true) && typeof options.host.dispatchStagedInvocations === "function") try {
+		staged = await options.host.dispatchStagedInvocations({
+			workerId: options.workerId,
+			...options.stagedInvocationBatchSize !== void 0 ? { limit: options.stagedInvocationBatchSize } : {},
+			...options.stagedInvocationLeaseDurationMs !== void 0 ? { leaseDurationMs: options.stagedInvocationLeaseDurationMs } : {},
+			...options.stagedInvocationLeaseRenewalIntervalMs !== void 0 ? { leaseRenewalIntervalMs: options.stagedInvocationLeaseRenewalIntervalMs } : {},
+			...options.stagedInvocationSubmissionTimeoutMs !== void 0 ? { submissionTimeoutMs: options.stagedInvocationSubmissionTimeoutMs } : {},
+			...options.stagedInvocationMaxAttempts !== void 0 ? { maxAttempts: options.stagedInvocationMaxAttempts } : {},
+			...options.stagedInvocationRetryDelayMs ? { retryDelayMs: options.stagedInvocationRetryDelayMs } : {},
+			...options.tenantId ? { tenantId: options.tenantId } : {},
+			...options.spaceId ? { spaceId: options.spaceId } : {},
+			...options.onError ? { onError: (error) => options.onError?.(error) } : {}
+		});
+	} catch (error) {
+		options.onError?.(error);
+	}
 	if (options.sweepOverdueCompletions !== false && typeof options.host.reconcileOverdueCompletions === "function") try {
 		await options.host.reconcileOverdueCompletions({
 			...options.tenantId ? { tenantId: options.tenantId } : {},
@@ -5666,9 +6720,20 @@ async function runPlatformActionWorkerCycle(options) {
 		completed,
 		failed,
 		...waitingForApproval > 0 ? { waitingForApproval } : {},
-		...deferred > 0 ? { deferred } : {}
+		...deferred > 0 ? { deferred } : {},
+		...staged && Object.values(staged).some((value) => value > 0) ? { staged } : {}
 	};
-	emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, result);
+	emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, {
+		claimed: result.claimed,
+		completed: result.completed,
+		failed: result.failed,
+		...result.waitingForApproval !== void 0 ? { waitingForApproval: result.waitingForApproval } : {},
+		...result.deferred !== void 0 ? { deferred: result.deferred } : {},
+		...result.staged ? {
+			stagedClaimed: result.staged.claimed,
+			stagedDispatched: result.staged.dispatched
+		} : {}
+	});
 	return result;
 }
 function startLeaseHeartbeat(options, invocation, leaseDurationMs) {
@@ -5926,15 +6991,16 @@ async function adapterProbe(subject) {
 	};
 }
 /**
-* The suite any deployment of the host must pass before it claims isolation.
+* The suite a deployment of the host must pass before it claims isolation.
 *
-* Eight checks: an invocation cannot be read, executed, or completed under
+* Nine checks: an invocation cannot be read, executed, or completed under
 * another tenant's scope; an idempotency key is a tenant's own, so the same
 * key in two tenants is two invocations; a tenant's event stream carries no
 * other tenant's events; a worker scoped to one tenant does not claim another's
-* work; an adapter checkpoint cannot be read or written under another tenant,
-* space, or owning invocation; and, when the subject lends a read, a viewer in
-* the other tenant sees nothing of ours.
+* work; staged listing and claiming retain tenant and space scope; an adapter
+* checkpoint cannot be read or written under another tenant, space, or owning
+* invocation; and, when the subject lends a read, a viewer in the other tenant
+* sees nothing of ours.
 */
 function tenantIsolationChecks() {
 	return [
@@ -5978,6 +7044,103 @@ function tenantIsolationChecks() {
 				return ["one idempotency key: one invocation within a tenant, two across tenants"];
 			}
 		},
+		{
+			id: "fabric.tenancy.staged-invocation-scoped.v1",
+			async run(subject) {
+				await subject.reset?.();
+				const store = subject.store;
+				if (store.transactionalStagedInvocations !== true || typeof store.transactionWithEvents !== "function" || typeof store.listStagedInvocations !== "function" || typeof store.claimStagedInvocations !== "function") return ["skipped: store does not expose transactional staged invocations"];
+				const suffix = globalThis.crypto.randomUUID();
+				const probeTenant = `iso-stage-tenant-${suffix}`;
+				const otherProbeTenant = `iso-stage-tenant-other-${suffix}`;
+				const probeSpace = `iso-stage-space-${suffix}`;
+				const otherProbeSpace = `iso-stage-space-other-${suffix}`;
+				const parents = [
+					{
+						id: `iso_stage_parent_ours_${suffix}`,
+						tenantId: probeTenant,
+						spaceId: probeSpace,
+						actorId: subject.ours.actorId,
+						actorType: subject.ours.actorType
+					},
+					{
+						id: `iso_stage_parent_theirs_${suffix}`,
+						tenantId: otherProbeTenant,
+						spaceId: probeSpace,
+						actorId: subject.theirs.actorId,
+						actorType: subject.theirs.actorType
+					},
+					{
+						id: `iso_stage_parent_space_${suffix}`,
+						tenantId: probeTenant,
+						spaceId: otherProbeSpace,
+						actorId: subject.ours.actorId,
+						actorType: subject.ours.actorType
+					}
+				];
+				for (const parent of parents) await store.createActionInvocation({
+					...parent,
+					actionId: subject.actionId,
+					actionVersion: 1,
+					status: "completed",
+					parameters: {},
+					result: {},
+					correlationId: suffix
+				});
+				const now = /* @__PURE__ */ new Date();
+				const records = parents.map((parent, index) => ({
+					id: `iso_stage_${index}_${suffix}`,
+					tenantId: parent.tenantId,
+					spaceId: parent.spaceId,
+					parentInvocationId: parent.id,
+					parentActionId: subject.actionId,
+					key: "child",
+					actionId: subject.actionId,
+					expectedActionVersion: 1,
+					parameters: {},
+					parameterDigest: `digest-${index}`,
+					batchDigest: `batch-${index}`,
+					status: "pending",
+					attemptCount: 0,
+					availableAt: now,
+					leaseToken: 0,
+					createdAt: now,
+					updatedAt: now
+				}));
+				try {
+					await store.transactionWithEvents(async (transaction) => {
+						if (!transaction.stageInvocations) fail$1("transactionalStagedInvocations did not supply stageInvocations");
+						for (const record of records) await transaction.stageInvocations([record]);
+					});
+					const ours = await store.listStagedInvocations({
+						tenantId: probeTenant,
+						spaceId: probeSpace
+					});
+					if (!ours.some((record) => record.id === records[0].id)) fail$1("our staged invocation was not listable under our scope, so the check proves nothing");
+					if (ours.some((record) => record.id === records[1].id || record.id === records[2].id)) fail$1("staged invocation listing crossed tenant or space");
+					if ((await store.listStagedInvocations({
+						tenantId: otherProbeTenant,
+						spaceId: probeSpace,
+						parentInvocationId: parents[0].id
+					})).length !== 0) fail$1("a staged invocation was listable under another tenant's scope");
+					const claimed = await store.claimStagedInvocations({
+						workerId: `iso-stage-worker-${suffix}`,
+						tenantId: probeTenant,
+						spaceId: probeSpace,
+						leaseDurationMs: 6e4,
+						now
+					});
+					if (!claimed.some((record) => record.id === records[0].id)) fail$1("our staged invocation was not claimable under our scope, so the check proves nothing");
+					if (claimed.some((record) => record.tenantId !== probeTenant || record.spaceId !== probeSpace)) fail$1("staged invocation claim crossed tenant or space");
+					return ["staged listing and claiming retained both tenant and space scope"];
+				} finally {
+					for (const parent of parents) await store.updateActionInvocation(parent.id, parent.tenantId, parent.spaceId, {
+						status: "failed",
+						error: "tenant isolation probe; retired"
+					});
+				}
+			}
+		},
 		{
 			id: "fabric.tenancy.events-scoped.v1",
 			async run(subject) {
@@ -6775,13 +7938,20 @@ async function runEventAppendChecks(subject) {
 exports.ActionAdmissionError = ActionAdmissionError;
 exports.ExternalCompletionError = ExternalCompletionError;
 exports.IdempotencyConflictError = IdempotencyConflictError;
+exports.MAX_STAGED_INVOCATIONS = MAX_STAGED_INVOCATIONS;
+exports.MAX_STAGED_INVOCATION_BATCH_BYTES = MAX_STAGED_INVOCATION_BATCH_BYTES;
+exports.MAX_STAGED_INVOCATION_BYTES = MAX_STAGED_INVOCATION_BYTES;
+exports.MAX_STAGED_INVOCATION_KEY_LENGTH = MAX_STAGED_INVOCATION_KEY_LENGTH;
 exports.MemoryPlatformHostStore = MemoryPlatformHostStore;
 exports.PARAMETER_DIGEST_ALGORITHM = PARAMETER_DIGEST_ALGORITHM;
 exports.PLATFORM_HOST_CONTRACT_VERSION = PLATFORM_HOST_CONTRACT_VERSION;
 exports.PLATFORM_HOST_HEALTH_CONTRACT_VERSION = PLATFORM_HOST_HEALTH_CONTRACT_VERSION;
 exports.PLATFORM_HOST_METRIC_NAMES = PLATFORM_HOST_METRIC_NAMES;
 exports.PostgresPlatformHostStore = PostgresPlatformHostStore;
+exports.STAGED_INVOCATION_KEY_PATTERN = STAGED_INVOCATION_KEY_PATTERN;
+exports.SubmissionRefusalError = SubmissionRefusalError;
 exports.applyPostgresMigrations = applyPostgresMigrations;
+exports.asStagedInvocationStore = asStagedInvocationStore;
 Object.defineProperty(exports, "canonicalJson", {
 	enumerable: true,
 	get: function() {
@@ -6789,6 +7959,7 @@ Object.defineProperty(exports, "canonicalJson", {
 	}
 });
 exports.cloneOutboxRecord = cloneOutboxRecord;
+exports.cloneStagedInvocationRecord = cloneStagedInvocationRecord;
 exports.createDurableSagaParentLifecycle = createDurableSagaParentLifecycle;
 exports.createGovernedActionHost = createGovernedActionHost;
 exports.createStoreBackedActionDispatcher = createStoreBackedActionDispatcher;
@@ -6797,11 +7968,13 @@ exports.emitPlatformHostTelemetry = emitPlatformHostTelemetry;
 exports.eventAppendChecks = eventAppendChecks;
 exports.getPlatformHostHealthSnapshot = getPlatformHostHealthSnapshot;
 exports.outboxActorDisclosure = outboxActorDisclosure;
+exports.prepareStagedInvocationBatch = prepareStagedInvocationBatch;
 exports.runEventAppendChecks = runEventAppendChecks;
 exports.runOutboxRelayCycle = runOutboxRelayCycle;
 exports.runPlatformActionWorker = runPlatformActionWorker;
 exports.runPlatformActionWorkerCycle = runPlatformActionWorkerCycle;
 exports.runTenantIsolationChecks = runTenantIsolationChecks;
+exports.stagedInvocationRequestIdentity = stagedInvocationRequestIdentity;
 exports.tenantIsolationChecks = tenantIsolationChecks;
 exports.toEnterpriseEventEnvelope = toEnterpriseEventEnvelope;