@humwick/server 0.0.0-stage → 0.130.0

package/node_modules/@humwick/kernel/timers.pilot.ts

@@ -0,0 +1,1411 @@
+import { z } from "zod";
+import { type EntityStore, type Grant, type HostCommandRun, type ModuleCtx, type StepResult, OpError, defineModule } from "./contract";
+
+/**
+ * The timers pilot module: a Timers CRUD (`create`/`get`/`list`/`cancel`) served through the module
+ * host — default-deny authz, I/O validation, scope-tagged persistence and events, and atomic
+ * commit/rollback — plus DURABLE FIRING riding on the K7 workflow runtime (M3). Creating a timer
+ * enqueues a one-shot `fire` workflow that sleeps until `fireAt` and then, on a wakeup pass, flips
+ * the timer `scheduled → fired` and emits `timers.fired`. Firing is a `sleeping` journal row a
+ * wakeup pass claims — never a live `setTimeout` — so it is crash-durable and clock-deterministic.
+ *
+ * ── Command timers (Phase-2 P2-2, #1409) ────────────────────────────────────────────────────────
+ * A timer may carry a `command` spec. Instead of the plain `scheduled → fired` flip, its firing
+ * workflow issues a durable P3 command (`ctx.commands.issue("run-command", …)`) at the deadline and
+ * parks `waiting` on that command's terminal status (`waitFor:{kind:"command"}`). The orchestrator —
+ * NOT this process — execs the shell; the kernel only dispatches an authz-gated command and awaits
+ * it. The command's `idempotencyKey` is the timer id, so a re-driven `fire` step (a crash after the
+ * issue but before the journal memo) dedupes onto the SAME orchestrator command and never
+ * double-dispatches. The completion relay message rides the P2-3 outbox — see the `await` step.
+ *
+ * ── Relay-dispatch transactional outbox (Phase-2 P2-3, #1409) ────────────────────────────────────
+ * A timer that carries a `message` spec dispatches a Relay message on fire. The firing step does NOT
+ * call `sendMessageService` (the kernel must not import src, and a raw send would be a non-durable
+ * dual-write); instead it writes a `relaySend` OUTBOX row INSIDE its atomic step-commit. That single
+ * transaction commits the fired flip + `timers.fired` event + outbox row together or not at all, so the
+ * DECISION to send is journal-atomic exactly-once. A src-side drainer (`kernel-timers-outbox.ts`) then
+ * scans pending rows, calls `sendMessageService`, and marks each sent — at-least-once delivery deduped
+ * to effectively-once by the run-scoped `base:run:N` idempotency key `sendMessageService` already
+ * honors, identical to legacy `fireClaimedTimer`. Closes BOTH parity seams: the message-timer send and
+ * the command-timer completion send.
+ *
+ * SECURITY (R1): the command runs under the timer's FROZEN create-time identity snapshot
+ * (`command.identity`), reconstructed src-side into a cwd-constrained component token that
+ * `dispatchCommand`'s #968 gate binds the command cwd to. The kernel carries the snapshot opaquely;
+ * it never fabricates authority. See `src/services/kernel-timers-command.ts`.
+ *
+ * ── Recurring/interval + failure backoff (Phase-2 P2-5, #1409) ───────────────────────────────────
+ * A timer carrying `everyMs` is RECURRING: firing is a LOOPING workflow (arm→fire→arm) that reschedules
+ * the next deadline deterministically from durable state — `max(now+everyMs, prevFireAt+everyMs)`, no
+ * drift, no live `setTimeout` — and disables at `maxRuns`/`expiresAt` (parity with legacy
+ * `completeScheduledTimerRun`). The run number `N` a fire dispatches under lives in the firing workflow's
+ * MEMOIZED state (`state.run`, reconstructed by the journal fold), so a crash-recovery re-drive of run N
+ * recomputes the SAME N → the `base:run:N` outbox dedup holds → exactly-once send (G3). A fire that
+ * ERRORS is a timer-run-level failure: it bumps `consecutiveFailures`, reschedules at `now+retryMs`, and
+ * disables after `maxFailures` (parity with legacy `recordScheduledTimerFailure`) — distinct from the M3
+ * per-step retry.
+ *
+ * Cutover note (#1408): this proves kernel-served firing at the module's own semantic level
+ * (schedule/cancel/list/fire/command/relay-send/recurring). It is NOT yet a full functional replacement
+ * for the legacy prod timers in `src/db/scheduled-timers.ts`: the MCP write surface for recurring params
+ * remains deferred create-path parity work (P2-7) before a real prod cutover. Relay message dispatch
+ * (message + command-completion sends) is covered by the P2-3 outbox above.
+ */
+
+// `disabled` (P2-5) is the terminal state a recurring/one-shot timer lands in when it stops WITHOUT a
+// clean fire — it expired before delivery, or its FIRE failed `SCHEDULER_MAX_FAILURES` times (the
+// legacy `enabled=0 + last_error` disable). `fired` remains "completed a run" (one-shot fired, or a
+// recurring timer reached `maxRuns` / would run past `expiresAt` AFTER a successful run). `cancelled`
+// stays user-initiated. Only `scheduled` is active/armed — the fire step's cancel-safe guard keys on it.
+const statusSchema = z.enum(["scheduled", "fired", "cancelled", "disabled"]);
+
+/** Ceiling on a command-timer shell string, mirroring the legacy `cleanCommand` 8000-char cap
+ * (`scheduler-command.ts`). Bounds the durable-command payload the kernel path can persist. */
+const MAX_COMMAND_CHARS = 8_000;
+
+/** The grant a command timer's creator must hold — the kernel spelling of the legacy `command:write`
+ * scope `normalizeScheduleCommand` requires. `command:write` is a valid flat {@link Grant}, so the op
+ * can enforce it from `ctx.principal.grants` (the invoker-resolved principal) with no contract change. */
+const COMMAND_WRITE_GRANT: Grant = "command:write";
+
+/** The admin grant that lets a principal cross creators on `list`/`cancel` (mirrors the legacy
+ * `canAdministerTimers`: `actor.kind === "system" || hasScope("system:admin")`). The kernel Principal
+ * carries no actor-kind, so the MCP binding maps a system/admin token to this grant. */
+const TIMERS_ADMIN_GRANT: Grant = "system:admin";
+
+/** The grant the P2-3 relay-outbox drainer holds. A system-only capability distinct from the
+ * creator-facing `timers:read`/`timers:write` — the drain ops (`drainRelaySends`/`markRelaySendSent`)
+ * cross creators to see every pending send, so an ordinary timer creator must NOT be able to invoke
+ * them. The src supervisor injects an identity carrying exactly this grant; the ops are never exposed
+ * over any transport (see `expose`). */
+const TIMERS_DRAIN_GRANT: Grant = "timers:admin";
+
+/** The grant that lets a principal create an UNBOUNDED recurring timer (no `maxRuns`/`expiresAt`) —
+ * the kernel spelling of the legacy `schedule:persistent` scope `canCreatePersistentTimer` honors. A
+ * `system:admin` principal also qualifies (mirrors `canAdministerTimers`). The scope→grant mapping the
+ * MCP binding performs is the deferred P2-7 create-path seam (gates G1/G2); the `create` op enforces
+ * the RULE from `ctx.principal.grants` here, with no contract change. */
+const SCHEDULE_PERSISTENT_GRANT: Grant = "schedule:admin";
+
+/** The frozen create-time creator identity a timer's external effects fire under (R1). Mirrors the
+ * legacy `persistedAuthContext` snapshot (createdBy/kind/scopes/constraints). BOTH parity seams carry
+ * it: a command timer's `run-command` exec (P2-2) AND a message/command timer's relay-send outbox
+ * (P2-3), so the src side reconstructs the SAME `ComponentToken` the creator held — never a widened
+ * one. The kernel treats `constraints` as an OPAQUE JSON blob — it never imports the src
+ * `TokenConstraints` type — and hands it verbatim to the src translator/drainer.
+ *
+ * SECURITY (P2-4 / C2 residual #1): this snapshot is the SERVER-resolved authority — the `create` op
+ * builds it from `ctx.principal` (createdBy = the authenticated actor; createdByScopes = the invoker
+ * -resolved grants) + the token's real cwd constraint, NEVER from client input. See `create.handler`. */
+const frozenIdentitySchema = z.object({
+  createdBy: z.string(),
+  createdByKind: z.string(),
+  createdByScopes: z.array(z.string()),
+  createdByConstraints: z.record(z.string(), z.unknown()).optional(),
+  createdAt: z.number().int(),
+});
+
+/** A command timer's persisted payload: the shell command + where/how it runs + the FROZEN creator
+ * identity. This is the ENTITY / `run-command` shape — the server-built `identity` is present. The
+ * client-facing create INPUT uses {@link commandRequestSchema} instead (no server-owned identity). */
+const commandSpecSchema = z.object({
+  command: z.string().min(1).max(MAX_COMMAND_CHARS),
+  cwd: z.string().min(1),
+  env: z.record(z.string(), z.string()).optional(),
+  timeoutMs: z.number().int().positive(),
+  orchestratorId: z.string().min(1),
+  identity: frozenIdentitySchema,
+});
+
+/** The client-facing command spec on the `create` op input: the exec request WITHOUT any creator
+ * identity. G1 (#1409): NO identity field is accepted from op input at all — createdBy / kind / scopes
+ * / constraints are ALL server-resolved by the op from `ctx.principal` (its `actor`, `grants`, and the
+ * trusted `resolvedIdentity` the host binding attaches from the authenticated token) + the kernel clock.
+ * A client thus cannot name a creator, broaden its scopes, or supply a wider cwd constraint — even a
+ * hostile `identity`/`createdByConstraints` key on the wire is an unknown Zod strips before the handler
+ * runs. See `freezeIdentity` / `freezeCommandTimer`. */
+const commandRequestSchema = z.object({
+  command: z.string().min(1).max(MAX_COMMAND_CHARS),
+  cwd: z.string().min(1),
+  env: z.record(z.string(), z.string()).optional(),
+  timeoutMs: z.number().int().positive(),
+  orchestratorId: z.string().min(1),
+});
+
+/** ── Relay-dispatch outbox (P2-3, #1409) ─────────────────────────────────────────────────────────
+ * The fully-resolved relay send a timer fires, persisted so a MESSAGE timer (and a command timer's
+ * completion) can dispatch a Relay message at parity with legacy `sendMessageService`. The kernel
+ * NEVER sends: it writes the send as an outbox row IN the atomic step-commit tx (journal-atomic
+ * exactly-once on the DECISION to send), and a src-side drainer performs the effect, deduped by the
+ * run-scoped `idempotencyKey` (`base:run:N`) `sendMessageService` already honors. See the `fire`/
+ * `await` steps + `src/services/kernel-timers-outbox.ts`. */
+
+/** The client-facing message spec on `create`: WHERE/WHAT to send, plus the same server-resolved
+ * authority hints the command request carries. `from` defaults to the resolved creator; `body` is
+ * required for a pure message timer (validated in the handler) but optional for a command timer, whose
+ * completion body defaults from the command outcome. `idempotencyKey` is the OPTIONAL delivery-dedup
+ * BASE — the outbox stamps `base:run:N` from it (falling back to `scheduler:<id>`), matching legacy. */
+const messageRequestSchema = z.object({
+  to: z.string().min(1),
+  from: z.string().min(1).optional(),
+  kind: z.string().min(1).optional(),
+  channel: z.string().min(1).optional(),
+  subject: z.string().min(1).optional(),
+  body: z.string().min(1).optional(),
+  claimable: z.boolean().optional(),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  meta: z.record(z.string(), z.unknown()).optional(),
+  idempotencyKey: z.string().min(1).optional(),
+  // G1 (#1409): NO creator identity is accepted from op input — the send fires under the server-resolved
+  // frozen identity (`freezeIdentity` from `ctx.principal`), never a client-named one.
+});
+
+/** A timer's persisted relay-send spec: the resolved send + the FROZEN creator identity the drainer
+ * fires under (R1 — mirrors legacy `persistedAuthContext`, so the component send gate runs under the
+ * creator's real reach, not a widened one). `from` and `identity` are server-resolved. */
+const messageSpecSchema = z.object({
+  from: z.string().min(1),
+  to: z.string().min(1),
+  kind: z.string().min(1).optional(),
+  channel: z.string().min(1).optional(),
+  subject: z.string().min(1).optional(),
+  body: z.string().min(1).optional(),
+  claimable: z.boolean().optional(),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  meta: z.record(z.string(), z.unknown()).optional(),
+  idempotencyKey: z.string().min(1).optional(),
+  /** D1 (#1409): the legacy `scheduler.correlationId` (`timer:<id>`) the fired message's payload/meta
+   *  `scheduler` block carries, so a kernel-fired message is byte-identical to a legacy-fired one for a
+   *  consumer keying off it. Server-derived at create (`timer:<id>`); the migrate op carries the legacy
+   *  row's persisted value verbatim. Absent → the outbox falls back to `timer:<timerId>` (see
+   *  `messageOutboxInput`), so a correlationId is ALWAYS stamped. */
+  correlationId: z.string().min(1).optional(),
+  identity: frozenIdentitySchema,
+});
+
+const relaySendStatusSchema = z.enum(["pending", "sent"]);
+
+/** ── T-0 apply fencing (#1409 hardening) ─────────────────────────────────────────────────────────
+ * The durable per-timer LAST-APPLIED-FENCE record for the ingress apply seam. The fence token is the
+ * ingress log's `seq` — globally monotone and never reused, hence STRICTLY monotone per timer. A
+ * fenced `migrate`/`cancelMirror` whose `fence` is LOWER than this row's is refused AT THE KERNEL
+ * WRITE (`fenced: true`, no entity mutation, no workflow start, no event): a live-but-lease-expired
+ * applier resuming a stale create after a newer cancel already applied can never arm the timer.
+ * A fenced cancel of an ABSENT entity still writes this row — the durable KERNEL TOMBSTONE that
+ * refuses the stale create ("a cancel has already been applied for this timerId at fence ≥ mine").
+ * Cross-process safety: the row is read-checked in the handler and (re-)written in the op's atomic
+ * commit, whose optimistic-version CAS / PK-conflict aborts a raced flush — the loser retries,
+ * re-reads the newer fence, and refuses cleanly. Equal fences (a same-intent crash re-drive)
+ * proceed idempotently. Unfenced calls (no `fence` input — the pre-activation shadow mirror and the
+ * P2-6 migration script, which run under LEGACY authority) neither check nor touch this record.
+ *
+ * SECOND-PASS HARDENING (#1409, T1175): the CAS covers ALL side effects of an apply, not just the
+ * entity — `migrate`'s firing-workflow enqueue is ENLISTED in the same atomic op commit
+ * (`enlist: "op-commit"`), so the instance seed sits in the very transaction this fence's
+ * CAS/PK-conflict aborts. A migrate that read a stale fence and loses the flush race commits
+ * NOTHING (no entity, no event, no fence, no workflow instance); a later same-id create therefore
+ * has no orphan to dedupe onto and can never fire at a rolled-back migrate's stale deadline. */
+const applyFenceSchema = z.object({
+  /** The timer id this fence guards (the entity key). */
+  id: z.string(),
+  /** The highest ingress fence (log seq) whose apply committed for this timer. */
+  fence: z.number().int().positive(),
+  /** Which op applied at that fence — `cancel` on an absent entity IS the durable tombstone. */
+  op: z.enum(["create", "cancel"]),
+  updatedAt: z.number().int(),
+});
+
+/** The transactional-outbox entity: one fully-resolved, ready-to-dispatch Relay send. Written INSIDE
+ * the firing step's atomic commit (so the decision to send is journal-atomic exactly-once) and drained
+ * by the src side, which flips `status` to `sent` after `sendMessageService` returns. Delivery is
+ * at-least-once (a crash between send and mark re-drains) but deduped to effectively-once by
+ * `idempotencyKey` (`base:run:N`) — the exact key `sendMessageService` dedupes on. `identity` is the
+ * frozen creator snapshot the drainer reconstructs the send AuthContext from. */
+const relaySendSchema = z.object({
+  id: z.string(),
+  /** The timer that produced this send — for tracing/observability + the drainer's per-row context. */
+  timerId: z.string(),
+  /** The run-scoped delivery-dedup key `sendMessageService` honors: a re-drain re-presents the SAME
+   *  key, so a crash between the send and the `sent` mark never doubles the message. */
+  idempotencyKey: z.string(),
+  status: relaySendStatusSchema.default("pending"),
+  from: z.string(),
+  to: z.string(),
+  kind: z.string().optional(),
+  channel: z.string().optional(),
+  subject: z.string().optional(),
+  body: z.string(),
+  claimable: z.boolean().optional(),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  meta: z.record(z.string(), z.unknown()).optional(),
+  /** The frozen creator identity the drainer fires the send under (R1). */
+  identity: frozenIdentitySchema,
+  /** Set by the drainer once the send lands — observability only; dedup is by `idempotencyKey`. */
+  sentMessageId: z.number().int().optional(),
+  createdAt: z.number().int(),
+});
+
+const timerSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  /** The actor id (from `ctx.principal.actor`) that created the timer — the per-creator ownership key
+   * `list`/`cancel`/`get` filter on for a non-admin principal (C2). Server-stamped; never client input. */
+  createdBy: z.string(),
+  /** Epoch milliseconds at which the timer is due to fire. For a recurring timer this is the CURRENT
+   *  run's deadline; the fire step advances it deterministically for each subsequent run. */
+  fireAt: z.number().int(),
+  status: statusSchema.default("scheduled"),
+  /** ── Recurring/interval (P2-5) ─────────────────────────────────────────────────────────────────
+   *  Present iff this is a RECURRING timer: the fixed interval between runs. Firing loops arm→fire→arm
+   *  (a looping workflow), rescheduling `fireAt` to `max(now+everyMs, prevFireAt+everyMs)` — computed
+   *  from durable state, never the wall clock, so it cannot drift. Command timers may NOT be recurring
+   *  (legacy parity); enforced at `create`. */
+  everyMs: z.number().int().positive().optional(),
+  /** A recurring timer disables (terminal `fired`) once it has completed this many runs. */
+  maxRuns: z.number().int().positive().optional(),
+  /** Epoch ms after which the timer stops: it disables before firing a run past this, and a fire whose
+   *  deadline is already past `expiresAt` disables WITHOUT firing (legacy `fireClaimedTimer` expiry). */
+  expiresAt: z.number().int().optional(),
+  /** Runs COMPLETED so far (bumped on each successful fire) — the observability counter, parity with
+   *  legacy `run_count`. NOTE: the durable, re-drive-stable run NUMBER a fire dispatches under lives in
+   *  the firing workflow's memoized `state.run` (the journal fold), NOT here — this is a projection. */
+  runCount: z.number().int().nonnegative().default(0),
+  /** Consecutive FIRE failures (parity with legacy `consecutive_failures`): bumped when a fire errors,
+   *  reset to 0 on a successful run. The timer disables after `maxFailures` consecutive failures. */
+  consecutiveFailures: z.number().int().nonnegative().default(0),
+  /** The last fire error (parity with legacy `last_error`); cleared on a successful run. */
+  lastError: z.string().optional(),
+  /** Present iff this is a command timer: firing dispatches this command and awaits it (see above). */
+  command: commandSpecSchema.optional(),
+  /** Present iff the timer dispatches a Relay message on fire (P2-3): the resolved send + frozen
+   *  creator identity. A MESSAGE timer carries it as its whole effect; a COMMAND timer may carry it as
+   *  the completion send composed once the command settles. Absent → firing is a pure status flip
+   *  (the pre-P2-3 pilot behavior, preserved). */
+  message: messageSpecSchema.optional(),
+});
+
+const configSchema = z.object({
+  /** Per-creator active (scheduled) timer quota — the kernel spelling of legacy
+   * `SCHEDULER_MAX_ACTIVE_TIMERS` (default 100). env-backed, so it must coerce from a string. */
+  maxTimers: z.coerce.number().int().positive().default(100),
+  /** Max lead time a timer may be scheduled ahead — the kernel spelling of the legacy command
+   * `afterMs ≤ 24h` ceiling, applied to EVERY timer so the kernel path can't evade it. */
+  maxFireAheadMs: z.coerce.number().int().positive().default(24 * 60 * 60 * 1000),
+  /** Minimum interval a RECURRING timer may specify — the kernel spelling of legacy
+   * `SCHEDULER_MIN_RECURRING_INTERVAL_MS` (default 60s). Enforced at `create` (P2-5 SCOPE 4). */
+  minRecurringIntervalMs: z.coerce.number().int().positive().default(60 * 1000),
+  /** Backoff before a FAILED fire's next attempt — the kernel spelling of legacy `SCHEDULER_RETRY_MS`
+   * (default 60s). A fire error reschedules the SAME run at `now + retryMs` (P2-5 SCOPE 3). */
+  retryMs: z.coerce.number().int().positive().default(60 * 1000),
+  /** Consecutive fire failures that disable a timer — the kernel spelling of legacy
+   * `SCHEDULER_MAX_FAILURES` (default 3) (P2-5 SCOPE 3). */
+  maxFailures: z.coerce.number().int().positive().default(3),
+  /** Label applied to a created timer when the caller supplies none. */
+  defaultLabel: z.string().min(1).default("timer"),
+});
+
+export type Timer = z.output<typeof timerSchema>;
+export type TimerCommandSpec = z.output<typeof commandSpecSchema>;
+export type TimerMessageSpec = z.output<typeof messageSpecSchema>;
+export type RelaySend = z.output<typeof relaySendSchema>;
+export type TimerApplyFence = z.output<typeof applyFenceSchema>;
+export type TimersConfig = z.output<typeof configSchema>;
+
+/** Does the opaque constraint blob pin the cwd(s) a command may run in? Mirrors the bridge's
+ * `hasCwdConstraint` / `dispatch-command`'s #968 precondition: an UNCONSTRAINED creator identity would
+ * clear the fire-time authz WITHOUT the cwd gate ever running, so a command timer must carry one at
+ * create. Kept structural (no src `TokenConstraints` import) — checks the two known cwd axes. */
+function hasCwdConstraint(constraints: Record<string, unknown> | undefined): boolean {
+  if (!constraints) return false;
+  const cwd = constraints.cwd;
+  const prefixes = constraints.cwdPrefixes;
+  return (typeof cwd === "string" && cwd.length > 0) || (Array.isArray(prefixes) && prefixes.length > 0);
+}
+
+/** A principal may cross creators (see/cancel any timer) iff it holds the admin grant (C2). Mirrors
+ * legacy `canAdministerTimers`; the MCP binding maps a `system` actor / `system:admin` scope onto it. */
+function isTimersAdmin(ctx: ModuleCtx): boolean {
+  return ctx.principal.grants.has(TIMERS_ADMIN_GRANT);
+}
+
+/** The per-creator ownership filter a non-admin op applies from the authenticated actor (C2). An admin
+ * returns `undefined` (no restriction). This is the op-level `where: {createdBy}` the design mandates. */
+function creatorFilter(ctx: ModuleCtx): { createdBy: string } | undefined {
+  return isTimersAdmin(ctx) ? undefined : { createdBy: ctx.principal.actor };
+}
+
+/** May this principal create an UNBOUNDED recurring timer (no `maxRuns`/`expiresAt`)? Mirrors legacy
+ * `canCreatePersistentTimer`: an admin, or a holder of the persistent grant (P2-5 SCOPE 4). */
+function canCreatePersistentTimer(ctx: ModuleCtx): boolean {
+  return isTimersAdmin(ctx) || ctx.principal.grants.has(SCHEDULE_PERSISTENT_GRANT);
+}
+
+/** Human-readable message from any thrown value (inlined; the kernel never imports the src SDK). */
+function errMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * Server-resolve + FREEZE a creator identity from the authenticated principal (G1/G2, #1409). Every
+ * field is server-sourced — NONE from client op input:
+ *   • `createdBy`  = `ctx.principal.actor` (the authenticated actor);
+ *   • `createdAt`  = the kernel clock;
+ *   • `createdByKind` / `createdByScopes` / `createdByConstraints` = the trusted
+ *     `ctx.principal.resolvedIdentity` the host binding attached from the authenticated TOKEN.
+ * So a client can neither name a different creator, broaden its scopes, nor widen its cwd constraint
+ * (G1 — a hostile `createdByConstraints:["/"] ` on the wire never reaches here). The frozen snapshot
+ * reconstructs the SAME create-time authority legacy `persistedAuthContext` did — shared by both parity
+ * seams (command exec P2-2 and relay send P2-3).
+ *
+ * G2 (#1409): `createdByScopes` is the creator's REAL transport scopes (`resolvedIdentity.scopes`,
+ * e.g. `message:send`) — NOT the flat kernel grants, which the grammar cannot spell `message:send` in.
+ * That is what lets the P2-3 outbox drainer's `sendMessageService` authorize under the creator's
+ * message-send scope instead of failing closed at fire time. When no `resolvedIdentity` rides the
+ * principal (a system/test caller that mints no durable send), it falls back to the principal grants.
+ */
+function freezeIdentity(ctx: ModuleCtx, createdBy: string, now: number): z.output<typeof frozenIdentitySchema> {
+  const resolved = ctx.principal.resolvedIdentity;
+  const constraints = resolved?.constraints;
+  return {
+    createdBy,
+    createdByKind: resolved?.kind ?? "component",
+    createdByScopes: resolved?.scopes ? [...resolved.scopes] : ([...ctx.principal.grants] as string[]),
+    ...(constraints ? { createdByConstraints: { ...constraints } } : {}),
+    createdAt: now,
+  };
+}
+
+/**
+ * Server-resolve + FREEZE a command timer's exec spec + creator identity. Preconditions mirror the
+ * legacy `normalizeScheduleCommand` + `assertScheduleCommandAuthorized`:
+ *   • the caller MUST hold the `command:write` grant (else no command timer at all), and
+ *   • the frozen identity MUST carry a cwd constraint (else the fire-time #968 gate would not fire).
+ * Throws a typed {@link OpError} (fail-closed) on either.
+ */
+function freezeCommandTimer(
+  ctx: ModuleCtx,
+  request: z.output<typeof commandRequestSchema>,
+  createdBy: string,
+  now: number,
+): z.output<typeof commandSpecSchema> {
+  if (!ctx.principal.grants.has(COMMAND_WRITE_GRANT)) {
+    throw new OpError("unauthorized", 403, "command timers require the 'command:write' grant");
+  }
+  // The cwd constraint is read from the SERVER-resolved identity (`ctx.principal.resolvedIdentity`),
+  // never from client input (G1) — so an unconstrained creator cannot create a command timer, and a
+  // client cannot fabricate a wide constraint to clear this gate.
+  if (!hasCwdConstraint(ctx.principal.resolvedIdentity?.constraints)) {
+    throw new OpError("unauthorized", 403, "command timers require a cwd-constrained creator identity");
+  }
+  return {
+    command: request.command,
+    cwd: request.cwd,
+    ...(request.env ? { env: request.env } : {}),
+    timeoutMs: request.timeoutMs,
+    orchestratorId: request.orchestratorId,
+    identity: freezeIdentity(ctx, createdBy, now),
+  };
+}
+
+/**
+ * Server-resolve + FREEZE a timer's relay-send spec (P2-3). `from` resolves server-side (the wire
+ * `from`, else the resolved creator) and `identity` is frozen from the authenticated principal, so the
+ * drainer fires the send under the creator's REAL reach — the component send gate runs exactly as it
+ * did for legacy `persistedAuthContext`. A message timer (no command) additionally REQUIRES a body; a
+ * command timer's completion body may be absent (it defaults from the command outcome at settle).
+ */
+function freezeMessageTimer(
+  ctx: ModuleCtx,
+  request: z.output<typeof messageRequestSchema>,
+  createdBy: string,
+  now: number,
+  requireBody: boolean,
+  correlationId: string,
+): z.output<typeof messageSpecSchema> {
+  if (requireBody && (request.body === undefined || request.body.length === 0)) {
+    throw new OpError("invalid_input", 400, "a message timer requires message.body");
+  }
+  return {
+    from: request.from ?? createdBy,
+    to: request.to,
+    ...(request.kind ? { kind: request.kind } : {}),
+    ...(request.channel ? { channel: request.channel } : {}),
+    ...(request.subject ? { subject: request.subject } : {}),
+    ...(request.body ? { body: request.body } : {}),
+    ...(request.claimable !== undefined ? { claimable: request.claimable } : {}),
+    ...(request.payload ? { payload: request.payload } : {}),
+    ...(request.meta ? { meta: request.meta } : {}),
+    ...(request.idempotencyKey ? { idempotencyKey: request.idempotencyKey } : {}),
+    // D1 (#1409): stamp legacy's `timer:<id>` correlation id so the fired message is byte-identical.
+    correlationId,
+    identity: freezeIdentity(ctx, createdBy, now),
+  };
+}
+
+/** ── Recurring reschedule + failure backoff math (P2-5) — PURE, mirroring legacy exactly ───────────
+ * These derive the NEXT deadline from DURABLE state (the timer entity + the workflow's memoized run
+ * number), never the wall clock, so a re-drive recomputes an identical result. Exported for direct
+ * unit tests (parity with `completeScheduledTimerRun` / `recordScheduledTimerFailure`). */
+
+/** The next recurring run's absolute deadline: `max(now+everyMs, prevFireAt+everyMs)`. Mirrors legacy
+ *  `completeScheduledTimerRun`'s `candidateNextRunAt` — a late wakeup schedules the next run `everyMs`
+ *  after NOW (self-correcting), never in the past, and an on-time run stays perfectly on the grid (no
+ *  drift, since it derives from `prevFireAt`, not the actual — possibly late — wakeup time). */
+export function nextRecurringFireAt(everyMs: number, now: number, prevFireAt: number): number {
+  return Math.max(now + everyMs, prevFireAt + everyMs);
+}
+
+/** Whether a recurring timer keeps looping after completing run `runsCompleted`, and its next deadline.
+ *  Mirrors legacy `completeScheduledTimerRun`'s disable logic: a non-recurring timer is always terminal;
+ *  a recurring one disables at `maxRuns` or when its next deadline would fall past `expiresAt`. */
+export type RecurringContinuation =
+  | { readonly kind: "continue"; readonly nextFireAt: number; readonly nextRun: number }
+  | { readonly kind: "terminal" };
+
+export function recurringContinuation(input: {
+  everyMs: number | undefined;
+  now: number;
+  prevFireAt: number;
+  runsCompleted: number;
+  maxRuns: number | undefined;
+  expiresAt: number | undefined;
+}): RecurringContinuation {
+  if (input.everyMs === undefined) return { kind: "terminal" };
+  const nextFireAt = nextRecurringFireAt(input.everyMs, input.now, input.prevFireAt);
+  const reachedMaxRuns = input.maxRuns !== undefined && input.runsCompleted >= input.maxRuns;
+  const expiredBeforeNext = input.expiresAt !== undefined && nextFireAt > input.expiresAt;
+  if (reachedMaxRuns || expiredBeforeNext) return { kind: "terminal" };
+  return { kind: "continue", nextFireAt, nextRun: input.runsCompleted + 1 };
+}
+
+/** The outcome of a FAILED fire: retry after `retryMs` (same run number), or disable once
+ *  `consecutiveFailures` reaches `maxFailures`. Mirrors legacy `recordScheduledTimerFailure`. */
+export type FailureOutcome =
+  | { readonly kind: "retry"; readonly nextFireAt: number; readonly failures: number }
+  | { readonly kind: "disable"; readonly failures: number };
+
+export function failureBackoff(input: {
+  now: number;
+  consecutiveFailures: number;
+  retryMs: number;
+  maxFailures: number;
+}): FailureOutcome {
+  const failures = input.consecutiveFailures + 1;
+  if (failures >= input.maxFailures) return { kind: "disable", failures };
+  return { kind: "retry", nextFireAt: input.now + input.retryMs, failures };
+}
+
+/** The run-scoped delivery-dedup key `sendMessageService` honors (`base:run:N`). Mirrors legacy
+ *  `timerRunIdempotencyKey`: base is the caller's `idempotencyKey`, else `scheduler:<timerId>`. */
+function relaySendKey(message: z.output<typeof messageSpecSchema>, timerId: string, run: number): string {
+  const base = message.idempotencyKey ?? `scheduler:${timerId}`;
+  return `${base}:run:${run}`;
+}
+
+/** Stamp the legacy `scheduler` correlation block onto a send's payload/meta so a drained message is
+ *  observably a timer fire (parity with `fireClaimedTimer`). Non-mutating. */
+function withScheduler(
+  base: Record<string, unknown> | undefined,
+  scheduler: Record<string, unknown>,
+): Record<string, unknown> {
+  return { ...(base ?? {}), scheduler };
+}
+
+/** A durable command result the completion send summarizes (the `run-command` decl's result shape). */
+type CommandRunResult = { exitCode: number | null; timedOut: boolean; stdoutTail: string; stderrTail: string };
+
+/** A human completion line for a command timer whose configured `message.body` was omitted. Mirrors
+ *  the shape of legacy `commandSummary` (status + exit code) over the kernel command result. */
+function commandCompletionBody(result: CommandRunResult | undefined): string {
+  if (!result) return "Background command completed";
+  const label = result.timedOut ? "timed out" : result.exitCode === 0 ? "succeeded" : "failed";
+  const code = result.exitCode === null || result.exitCode === undefined ? "" : ` (exit ${result.exitCode})`;
+  return `Background command ${label}${code}`;
+}
+
+/** Build the fully-resolved outbox row for a MESSAGE timer's send. `run` is the DURABLE, re-drive-stable
+ *  run number (`state.run` from the firing workflow's journal fold — 1, 2, 3, … for a recurring timer);
+ *  the `scheduler` stamp + `base:run:N` key mirror legacy `fireClaimedTimer`. */
+function messageOutboxInput(
+  ctx: ModuleCtx,
+  timer: Timer,
+  message: z.output<typeof messageSpecSchema>,
+  run: number,
+): z.input<typeof relaySendSchema> {
+  // D1 (#1409): stamp `correlationId` (`timer:<id>`) alongside `timerId`/`run` so the delivered
+  // message's `scheduler` block is byte-identical to legacy `fireClaimedTimer`. Always present: the
+  // frozen `message.correlationId` when set (native create / migrate), else derived from the timer id.
+  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run };
+  return {
+    id: ctx.rng.uuid(),
+    timerId: timer.id,
+    idempotencyKey: relaySendKey(message, timer.id, run),
+    status: "pending",
+    from: message.from,
+    to: message.to,
+    ...(message.kind ? { kind: message.kind } : {}),
+    ...(message.channel ? { channel: message.channel } : {}),
+    ...(message.subject ? { subject: message.subject } : {}),
+    body: message.body ?? "",
+    ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
+    payload: withScheduler(message.payload, scheduler),
+    meta: withScheduler(message.meta, scheduler),
+    identity: message.identity,
+    createdAt: ctx.clock.now(),
+  };
+}
+
+/** Project a pure MESSAGE send into the shared immutable fire/outbox payload. */
+function authoritySendPayload(timer: Timer, message: z.output<typeof messageSpecSchema>, run: number) {
+  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run };
+  const idempotencyKey = relaySendKey(message, timer.id, run);
+  return {
+    idempotencyKey,
+    sendPayload: {
+      input: {
+        from: message.from,
+        to: message.to,
+        ...(message.kind ? { kind: message.kind } : {}),
+        ...(message.channel ? { channel: message.channel } : {}),
+        ...(message.subject ? { subject: message.subject } : {}),
+        body: message.body ?? "",
+        ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
+        payload: withScheduler(message.payload, scheduler),
+        meta: withScheduler(message.meta, scheduler),
+        idempotencyKey,
+      },
+      identity: { ...message.identity, deliveryFrom: message.from },
+    },
+  };
+}
+
+/** Build the fully-resolved outbox row for a COMMAND timer's completion send. The body defaults from
+ *  the command outcome when the timer configured none; the `scheduler`/`commandResult` blocks carry the
+ *  result so the message is observably a settled background command (parity with legacy
+ *  `fireScheduledCommandWake`). */
+function commandCompletionOutboxInput(
+  ctx: ModuleCtx,
+  timer: Timer,
+  message: z.output<typeof messageSpecSchema>,
+  run: number,
+  commandId: string | null,
+  result: CommandRunResult | undefined,
+): z.input<typeof relaySendSchema> {
+  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run, ...(commandId ? { commandId } : {}) };
+  return {
+    id: ctx.rng.uuid(),
+    timerId: timer.id,
+    idempotencyKey: relaySendKey(message, timer.id, run),
+    status: "pending",
+    from: message.from,
+    to: message.to,
+    ...(message.kind ? { kind: message.kind } : {}),
+    ...(message.channel ? { channel: message.channel } : {}),
+    ...(message.subject ? { subject: message.subject } : {}),
+    body: message.body ?? commandCompletionBody(result),
+    ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
+    payload: withScheduler(message.payload, { ...scheduler, command: result ?? null }),
+    meta: withScheduler(message.meta, scheduler),
+    identity: message.identity,
+    createdAt: ctx.clock.now(),
+  };
+}
+
+/** The firing workflow state. `commandId` is null until a command timer's `fire` step has issued its
+ * P3 command; the `await` step reads it back to settle firing.
+ *
+ * `run` is the CRUX of P2-5's exactly-once (G3): the run number the CURRENT iteration fires under. It is
+ * carried in the workflow state — which is memoized in the durable journal and reconstructed by the
+ * fold — so a crash-recovery RE-DRIVE of a given run recomputes the SAME `run`, hence the SAME
+ * `base:run:N` outbox dedup key, hence NO double-send. It is NOT a live counter: the `fire` step reads
+ * `run` from folded state to stamp the send, and only the COMMITTED transition to the next `arm`
+ * advances it to `run+1` for the next iteration. A one-shot timer simply never advances past run 1. */
+type FireState = {
+  id: string;
+  /** F is null for native/shadow workflows; authority generations carry exact F/G/R. */
+  fence: number | null;
+  generation: number;
+  fireAt: number;
+  commandId: string | null;
+  run: number;
+};
+
+/** The manifest handler receives the un-parameterized `ModuleCtx` (the manifest type is not yet
+ * available at its own declaration site), so a module narrows its own entities/config here. */
+function timerStore(ctx: ModuleCtx): EntityStore<{ schema: typeof timerSchema }> {
+  return (ctx.entities as unknown as { readonly timer: EntityStore<{ schema: typeof timerSchema }> }).timer;
+}
+
+/** The relay-send outbox store (P2-3). Written by the firing steps in-tx; read/marked by the src drainer. */
+function relaySendStore(ctx: ModuleCtx): EntityStore<{ schema: typeof relaySendSchema }> {
+  return (ctx.entities as unknown as { readonly relaySend: EntityStore<{ schema: typeof relaySendSchema }> }).relaySend;
+}
+
+/** The per-timer apply-fence store (T-0 hardening). Read-checked + upserted by `migrate`/`cancelMirror`. */
+function applyFenceStore(ctx: ModuleCtx): EntityStore<{ schema: typeof applyFenceSchema }> {
+  return (ctx.entities as unknown as { readonly applyFence: EntityStore<{ schema: typeof applyFenceSchema }> }).applyFence;
+}
+
+/** Raise the durable fence to `fence` for `op` — a no-op at equality (same-intent re-drive). Runs in
+ *  the op's atomic commit: a concurrent raced write aborts the WHOLE op via the flush CAS/PK conflict,
+ *  so the fence can never regress and a stale write can never slip past a newer one. */
+async function raiseApplyFence(
+  ctx: ModuleCtx,
+  gate: TimerApplyFence | undefined,
+  id: string,
+  fence: number,
+  op: "create" | "cancel",
+): Promise<void> {
+  const fences = applyFenceStore(ctx);
+  if (!gate) await fences.create({ id, fence, op, updatedAt: ctx.clock.now() });
+  else if (fence > gate.fence) await fences.update(id, { fence, op, updatedAt: ctx.clock.now() });
+}
+
+function timersConfig(ctx: ModuleCtx): TimersConfig {
+  return ctx.config as unknown as TimersConfig;
+}
+
+/**
+ * Handle a FAILED fire at the TIMER-RUN level (SCOPE 3) — distinct from the M3 per-step retry. Bumps
+ * `consecutiveFailures` on the entity (read fresh, so a re-drive after a rolled-back commit recomputes
+ * the SAME count), and either reschedules the SAME run at `now + retryMs` (looping back to `arm`) or
+ * disables the timer once `maxFailures` consecutive failures accumulate. The failure bookkeeping commits
+ * atomically with the step's journal memo. The run number is NOT advanced — a retry re-fires under the
+ * same `state.run`, so its eventual send keeps the same `base:run:N` key (parity with legacy, which
+ * leaves `run_count` untouched on `recordScheduledTimerFailure`).
+ */
+async function applyFireFailure(
+  ctx: ModuleCtx,
+  timer: Timer,
+  state: FireState,
+  now: number,
+  error: unknown,
+): Promise<StepResult<FireState>> {
+  const cfg = timersConfig(ctx);
+  const outcome = failureBackoff({
+    now,
+    consecutiveFailures: timer.consecutiveFailures,
+    retryMs: cfg.retryMs,
+    maxFailures: cfg.maxFailures,
+  });
+  const store = timerStore(ctx);
+  if (outcome.kind === "disable") {
+    await store.update(state.id, { status: "disabled", consecutiveFailures: outcome.failures, lastError: errMessage(error) });
+    return { state, next: "done" };
+  }
+  await store.update(state.id, { consecutiveFailures: outcome.failures, lastError: errMessage(error) });
+  return { state: { ...state, fireAt: outcome.nextFireAt }, next: "arm" };
+}
+
+export const timers = defineModule({
+  id: "timers",
+  title: "Timers & Schedules",
+  description: "Kernel-served timers pilot: durable message + command firing on the K7 workflow runtime.",
+  config: {
+    schema: configSchema,
+    env: {
+      maxTimers: "TIMERS_MAX_TIMERS",
+      minRecurringIntervalMs: "TIMERS_MIN_RECURRING_INTERVAL_MS",
+      retryMs: "TIMERS_RETRY_MS",
+      maxFailures: "TIMERS_MAX_FAILURES",
+    },
+    overridableAt: {
+      maxTimers: ["host"],
+      minRecurringIntervalMs: ["host"],
+      retryMs: ["host"],
+      maxFailures: ["host"],
+      defaultLabel: ["instance", "host"],
+    },
+  },
+  entities: {
+    timer: {
+      schema: timerSchema,
+      // `createdBy` is indexed so the per-creator ownership filter (C2) on list/cancel/get is a keyed
+      // lookup, not a scan; `status` backs the active-quota count + status filter.
+      indexes: ["status", "createdBy"],
+    },
+    // The relay-dispatch transactional outbox (P2-3). A firing step writes one `pending` row IN its
+    // atomic step-commit (journal-atomic exactly-once on the send DECISION); the src drainer scans
+    // `pending` rows, calls `sendMessageService`, and flips them `sent`. `status` is indexed so the
+    // drainer's pending scan is a keyed lookup, not a table scan.
+    relaySend: {
+      schema: relaySendSchema,
+      indexes: ["status"],
+    },
+    // The per-timer durable last-applied-fence / tombstone record for the T-0 ingress apply seam
+    // (see `applyFenceSchema`). Point-read by id only — no secondary indexes.
+    applyFence: {
+      schema: applyFenceSchema,
+    },
+  },
+  events: {
+    "timers.created": z.object({ id: z.string(), label: z.string(), fireAt: z.number().int() }),
+    "timers.fired": z.object({ id: z.string(), firedAt: z.number().int(), run: z.number().int() }),
+    "timers.cancelled": z.object({ id: z.string() }),
+  },
+  commands: {
+    // The durable P3 shell command a command timer fires. The relay process NEVER execs — this
+    // dispatches onto the orchestrator command bus (src `dispatchCommand`), which the runner claims
+    // and runs as `bash -lc` at `cwd`, cwd-pinned + cgroup-reaped + timeout-bounded (the pre-existing
+    // legacy exec surface; the kernel neither moves nor widens it). `grant:"command:run-command"`
+    // maps src-side to — and never widens beyond — the legacy `command:write` + cwd-constrained authz
+    // (`dispatchCommand`'s #968 gate). `idempotencyKey` is the TIMER ID: a re-driven `fire` step
+    // dedupes onto the same command instead of double-dispatching (exactly-once boundary, #1408).
+    "run-command": {
+      input: z.object({
+        timerId: z.string().min(1),
+        command: z.string().min(1),
+        cwd: z.string().min(1),
+        env: z.record(z.string(), z.string()).optional(),
+        timeoutMs: z.number().int().positive(),
+        orchestratorId: z.string().min(1),
+        identity: frozenIdentitySchema,
+      }),
+      result: z.object({
+        exitCode: z.number().nullable(),
+        timedOut: z.boolean(),
+        stdoutTail: z.string(),
+        stderrTail: z.string(),
+      }),
+      target: "runner",
+      grant: "command:run-command",
+      idempotencyKey: (input) => input.timerId,
+      // Static declared ceiling (≤ 24h, matching the legacy COMMAND_MAX_MS). The ACTUAL per-run exec
+      // timeout rides in `input.timeoutMs`; this is the coarse manifest-level bound.
+      timeoutMs: 24 * 60 * 60 * 1000,
+      whenDegraded: "queue",
+    },
+  },
+  workflows: {
+    // Durable firing for a single timer — a LOOPING workflow (P2-5). `create` starts it with the timer
+    // id + fireAt + run 1.
+    //   arm  → parks the instance `sleeping` until the absolute `fireAt` (in state), never a setTimeout.
+    //   fire → on the wakeup pass at/after fireAt, reads the timer and — only if still `scheduled`:
+    //          • past its `expiresAt` → disables WITHOUT firing (legacy expiry-before-delivery).
+    //          • a COMMAND timer issues its P3 `run-command` and parks `waiting` on it (→ `await`); a
+    //            dispatch ERROR is a timer-run failure → backoff/disable (SCOPE 3). Command timers are
+    //            NEVER recurring (legacy parity), so they always settle to `done` via `await`.
+    //          • a MESSAGE/plain timer flips status + emits `timers.fired` (+ writes the P2-3 outbox
+    //            row) in ONE atomic step commit, then — if it is a RECURRING interval still under
+    //            `maxRuns`/`expiresAt` — loops back to `arm` with the NEXT deadline and run number `N+1`;
+    //            otherwise it disables (terminal `fired`).
+    // Cancel-safe + idempotent by construction: the timer entity is the source of truth, so a timer
+    // cancelled (or already terminal) before a deadline simply no-ops when its firing workflow wakes.
+    //
+    // G3 (exactly-once): the run number `N` a fire dispatches under is `state.run` — carried in the
+    // DURABLE workflow state (memoized in the journal, reconstructed by the fold), NOT a live counter.
+    // A re-drive of run N recomputes the SAME N (its `arm` memo pins `state.run` before `fire` re-runs),
+    // so the `base:run:N` outbox dedup holds → no double-send. A fresh run only ever gets `N` from the
+    // PREVIOUS fire's COMMITTED transition to `run+1`, so distinct committed runs get distinct N.
+    fire: {
+      // `initialRun` (optional, default 1) is the run number the FIRST fire dispatches under. The
+      // create path never supplies it (→ run 1, unchanged behavior). The P2-6 migrate-at-cutover op
+      // seeds it to `legacyRunCount + 1` so a mid-stream recurring timer's kernel run numbering
+      // CONTINUES the legacy sequence instead of restarting at 1 — that alignment is what makes the
+      // §4.2 dual-read `base:run:N` dedup hold for a migrated recurring timer during the bake window.
+      input: z.object({
+        id: z.string(),
+        fireAt: z.number().int(),
+        initialRun: z.number().int().positive().optional(),
+        fence: z.number().int().nonnegative().nullable().optional(),
+        generation: z.number().int().nonnegative().optional(),
+        run: z.number().int().positive().optional(),
+      }),
+      state: z.object({
+        id: z.string(),
+        fence: z.number().int().nonnegative().nullable(),
+        generation: z.number().int().nonnegative(),
+        fireAt: z.number().int(),
+        commandId: z.string().nullable(),
+        run: z.number().int().positive(),
+      }),
+      init: (input) => ({
+        id: input.id,
+        fence: input.fence ?? null,
+        generation: input.generation ?? 0,
+        fireAt: input.fireAt,
+        commandId: null,
+        run: input.run ?? input.initialRun ?? 1,
+      }),
+      start: "arm",
+      steps: {
+        arm: {
+          run: async (_ctx, state: FireState): Promise<StepResult<FireState>> => {
+            // Deterministic: the deadline comes from state (the current run's fireAt), never the clock.
+            return { state, next: "fire", sleepUntil: state.fireAt };
+          },
+        },
+        fire: {
+          run: async (ctx, state: FireState): Promise<StepResult<FireState>> => {
+            const store = timerStore(ctx);
+            const timer = await store.get(state.id);
+            // Cancelled or already terminal before the deadline: no-op (cancel-safe firing).
+            if (!timer || timer.status !== "scheduled") return { state, next: "done" };
+            const now = ctx.clock.now();
+            // Expiry-before-delivery (legacy `fireClaimedTimer`): a timer past its expiry disables WITHOUT
+            // firing this run — no flip to `fired`, no event, no send.
+            if (timer.expiresAt !== undefined && timer.expiresAt <= now) {
+              await store.update(state.id, { status: "disabled", lastError: "timer expired before delivery" });
+              if (state.fence !== null) {
+                if (!timer.message) throw new TypeError("authority workflow requires a pure MESSAGE timer");
+                ctx.messageAuthority.decideFire({
+                  timer: { timerId: timer.id, message: timer.message },
+                  fence: state.fence,
+                  generation: state.generation,
+                  run: state.run,
+                  engine: "kernel",
+                  decision: "expired",
+                  fireAt: state.fireAt,
+                  lifecycle: "disabled",
+                  nextRun: null,
+                  nextRunAt: null,
+                  decidedAt: now,
+                  sendPayload: null,
+                  idempotencyKey: null,
+                });
+              }
+              return { state, next: "done" };
+            }
+            if (timer.command) {
+              // Command timer: dispatch the authz-gated P3 command and park on its terminal status. The
+              // issue is idempotency-keyed on the timer id (see the decl), so a crash-and-re-drive of THIS
+              // step dedupes onto the same orchestrator command — never a second dispatch. A dispatch
+              // ERROR is a TIMER-RUN failure (distinct from M3 per-step retry): back off + disable after
+              // `maxFailures` (SCOPE 3), rather than terminating the whole firing workflow.
+              let run: HostCommandRun;
+              try {
+                run = await ctx.commands.issue(
+                  "run-command",
+                  {
+                    timerId: timer.id,
+                    command: timer.command.command,
+                    cwd: timer.command.cwd,
+                    ...(timer.command.env ? { env: timer.command.env } : {}),
+                    timeoutMs: timer.command.timeoutMs,
+                    orchestratorId: timer.command.orchestratorId,
+                    identity: timer.command.identity,
+                  },
+                  { host: timer.command.orchestratorId },
+                );
+              } catch (error) {
+                return applyFireFailure(ctx, timer, state, now, error);
+              }
+              // A successful dispatch clears any prior failure streak (parity: success resets it).
+              if (timer.consecutiveFailures > 0) {
+                await store.update(state.id, { consecutiveFailures: 0, lastError: undefined });
+              }
+              return { state: { ...state, commandId: run.id }, next: "await", waitFor: { kind: "command", commandId: run.id } };
+            }
+            // Message/plain timer: decide the recurring continuation from DURABLE state (this run number
+            // = runs completed once it lands), then flip + emit AND — if it carries a resolved send —
+            // write the relay-dispatch outbox row (P2-3), all in ONE atomic step commit. The outbox
+            // `create` buffers into the same K4 session `commitStepAttempt` flushes with the journal memo,
+            // so the DECISION to send is journal-atomic exactly-once: a fault between the step effects and
+            // the commit rolls the whole tx back (no flip, no event, NO outbox row, NO run advance); a
+            // re-drive re-runs THIS run (same `state.run`) atomically. The src drainer performs the actual
+            // send, deduped effectively-once by `base:run:N`.
+            const cont = recurringContinuation({
+              everyMs: timer.everyMs,
+              now,
+              prevFireAt: state.fireAt,
+              runsCompleted: state.run,
+              maxRuns: timer.maxRuns,
+              expiresAt: timer.expiresAt,
+            });
+            await store.update(state.id, {
+              status: cont.kind === "terminal" ? "fired" : "scheduled",
+              ...(cont.kind === "continue" ? { fireAt: cont.nextFireAt } : {}),
+              runCount: state.run,
+              consecutiveFailures: 0,
+              lastError: undefined,
+            });
+            await ctx.events.emit("timers.fired", { id: state.id, firedAt: now, run: state.run });
+            if (timer.message) {
+              if (state.fence === null) {
+                await relaySendStore(ctx).create(messageOutboxInput(ctx, timer, timer.message, state.run));
+              } else {
+                const send = authoritySendPayload(timer, timer.message, state.run);
+                ctx.messageAuthority.decideFire({
+                  timer: { timerId: timer.id, message: timer.message },
+                  fence: state.fence,
+                  generation: state.generation,
+                  run: state.run,
+                  engine: "kernel",
+                  decision: "dispatch",
+                  fireAt: state.fireAt,
+                  lifecycle: cont.kind === "continue" ? "scheduled" : "fired",
+                  nextRun: cont.kind === "continue" ? cont.nextRun : null,
+                  nextRunAt: cont.kind === "continue" ? cont.nextFireAt : null,
+                  decidedAt: now,
+                  sendPayload: send.sendPayload,
+                  idempotencyKey: send.idempotencyKey,
+                });
+              }
+            }
+            // Recurring: loop back to `arm` with the next deadline + the NEXT run number. The advance to
+            // `run+1` is only durable once THIS transition commits, so a re-drive of this run never sees it.
+            if (cont.kind === "continue") {
+              return { state: { ...state, fireAt: cont.nextFireAt, run: cont.nextRun }, next: "arm" };
+            }
+            return { state, next: "done" };
+          },
+        },
+        await: {
+          run: async (ctx, state: FireState): Promise<StepResult<FireState>> => {
+            // Reached only by a command timer (never recurring), once the wait evaluator reports terminal.
+            const store = timerStore(ctx);
+            const timer = await store.get(state.id);
+            // Still cancel-safe: a cancel between issue and settle → no fired flip, no event, no send.
+            if (timer && timer.status === "scheduled") {
+              await store.update(state.id, { status: "fired", runCount: state.run });
+              await ctx.events.emit("timers.fired", { id: state.id, firedAt: ctx.clock.now(), run: state.run });
+              // P2-3 (completion seam now CLOSED): if the command timer carries a completion send, write
+              // its outbox row IN this same atomic commit. The command result ({exitCode, timedOut,
+              // stdoutTail, stderrTail}) is durable and read back via `ctx.commands.status(commandId)`;
+              // the completion body/payload compose from it. Same journal-atomic exactly-once guarantee
+              // as the message path — the outbox row commits with the fired flip + event or not at all.
+              if (timer.message) {
+                const run = state.commandId ? await ctx.commands.status(state.commandId) : undefined;
+                const result = run?.result as CommandRunResult | undefined;
+                await relaySendStore(ctx).create(
+                  commandCompletionOutboxInput(ctx, timer, timer.message, state.run, state.commandId, result),
+                );
+              }
+            }
+            return { state, next: "done", output: { id: state.id, commandId: state.commandId } };
+          },
+        },
+      },
+    },
+  },
+  ops: {
+    create: {
+      kind: "mutation",
+      idempotent: false,
+      grant: "timers:write",
+      summary: "Create a scheduled timer.",
+      emits: ["timers.created"],
+      http: { method: "POST", path: "/timers" },
+      // `command` (optional) makes this a COMMAND timer (see the module header + `run-command` decl).
+      // `message` (optional) makes firing dispatch a Relay message via the P2-3 outbox: on a plain
+      // timer it is the whole effect; on a command timer it is the completion send. Both freeze a
+      // server-resolved identity the drainer fires under.
+      // P2-4 (C2 residual #1): the create input carries NO client-owned frozen identity — the op
+      // SERVER-RESOLVES it from the authenticated principal (`ctx.principal`) + the token's real cwd
+      // constraint. A client cannot name/broaden its own authority; the fire-time reconstruction binds
+      // the command cwd to the creator's REAL constraint via `dispatchCommand`'s #968 gate (R1).
+      // `everyMs` (optional) makes this a RECURRING interval timer (P2-5): firing loops arm→fire→arm,
+      // rescheduling `fireAt` deterministically. `maxRuns`/`expiresAt` bound it. Command timers may NOT
+      // be recurring; a recurring timer needs a bound (`maxRuns`/`expiresAt`) or the persistent grant.
+      input: z.object({
+        label: z.string().min(1).optional(),
+        fireAt: z.number().int(),
+        everyMs: z.number().int().positive().optional(),
+        maxRuns: z.number().int().positive().optional(),
+        expiresAt: z.number().int().optional(),
+        command: commandRequestSchema.optional(),
+        message: messageRequestSchema.optional(),
+      }),
+      output: timerSchema,
+      handler: async (ctx, input) => {
+        const cfg = timersConfig(ctx);
+        const now = ctx.clock.now();
+        const createdBy = ctx.principal.actor;
+
+        // Quota / limit re-expression (C2 threat 3), so the kernel path can't be used to evade the
+        // legacy scheduler's DoS ceilings:
+        //  • afterMs ≤ 24h  → the timer may not be scheduled further than `maxFireAheadMs` ahead.
+        if (input.fireAt > now + cfg.maxFireAheadMs) {
+          throw new OpError("invalid_input", 400, `fireAt is more than ${cfg.maxFireAheadMs}ms ahead of now`);
+        }
+
+        // SCOPE 4 — recurring/interval validation parity (legacy `scheduleTimer`):
+        //  • command timers may NOT be recurring;
+        //  • `everyMs >= minRecurringIntervalMs`;
+        //  • a recurring timer needs a bound (`maxRuns`/`expiresAt`) OR the persistent grant;
+        //  • `expiresAt` (any timer) must be after the first run.
+        if (input.everyMs !== undefined) {
+          if (input.command) {
+            throw new OpError("invalid_input", 400, "everyMs is not supported with command timers");
+          }
+          if (input.everyMs < cfg.minRecurringIntervalMs) {
+            throw new OpError("invalid_input", 400, `everyMs must be at least ${cfg.minRecurringIntervalMs}`);
+          }
+          if (input.maxRuns === undefined && input.expiresAt === undefined && !canCreatePersistentTimer(ctx)) {
+            throw new OpError("unauthorized", 403, "recurring timers require maxRuns, expiresAt, or the schedule:persistent grant");
+          }
+        }
+        if (input.expiresAt !== undefined && input.expiresAt <= input.fireAt) {
+          throw new OpError("invalid_input", 400, "expiresAt must be after the first run");
+        }
+
+        //  • SCHEDULER_MAX_ACTIVE_TIMERS per creator → count this creator's active (scheduled) timers.
+        //    The entity page caps at 200; `min` keeps the count within it (the default quota is 100).
+        const active = await timerStore(ctx).list({ where: { status: "scheduled", createdBy }, limit: Math.min(cfg.maxTimers, 200) });
+        if (active.items.length >= cfg.maxTimers) {
+          throw new OpError("quota_exceeded", 429, `active timer quota exceeded (${cfg.maxTimers})`);
+        }
+
+        // SCOPE 1 — server-resolve + FREEZE the command-timer identity from the authenticated principal.
+        // A command timer additionally requires the `command:write` grant AND a cwd-constrained creator
+        // identity at create (mirroring legacy `normalizeScheduleCommand` + `assertScheduleCommandAuthorized`),
+        // so an unconstrained / non-command-write caller cannot create a command timer AT ALL.
+        const command = input.command ? freezeCommandTimer(ctx, input.command, createdBy, now) : undefined;
+
+        // The timer id is generated up-front so the frozen message can carry the `timer:<id>`
+        // correlation id (D1) — byte-parity with legacy `insertScheduledTimer`, which derives the same.
+        const id = ctx.rng.uuid();
+
+        // SCOPE 1 (P2-3) — server-resolve + FREEZE the relay-send spec. A pure message timer REQUIRES a
+        // body; a command timer's completion body may be omitted (it defaults from the command outcome).
+        const message = input.message
+          ? freezeMessageTimer(ctx, input.message, createdBy, now, /*requireBody*/ !command, `timer:${id}`)
+          : undefined;
+
+        const label = input.label ?? cfg.defaultLabel;
+        const created = await timerStore(ctx).create({
+          id,
+          label,
+          createdBy,
+          fireAt: input.fireAt,
+          ...(input.everyMs !== undefined ? { everyMs: input.everyMs } : {}),
+          ...(input.maxRuns !== undefined ? { maxRuns: input.maxRuns } : {}),
+          ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+          ...(command ? { command } : {}),
+          ...(message ? { message } : {}),
+        });
+        await ctx.events.emit("timers.created", { id, label, fireAt: input.fireAt });
+        // Enqueue durable firing, ENLISTED in this op's atomic commit (T-0 #1409 finding 1): the
+        // instance seed executes INSIDE the same transaction as the entity + event flush, so the
+        // timer and its firing workflow commit together or not at all — an op that rolls back
+        // (validation failure, version conflict) leaves NO orphaned instance keyed to this id for
+        // any later create/migrate of the same id to dedupe onto. The drive runs after the commit;
+        // a crash before it leaves a durable `pending` instance the recovery pass converges.
+        // Idempotency key = timer id, so a retried create dedupes onto the same instance.
+        await ctx.workflows.start("fire", { id, fireAt: input.fireAt }, { idempotencyKey: id, enlist: "op-commit" });
+        return created;
+      },
+    },
+    get: {
+      kind: "query",
+      grant: "timers:read",
+      summary: "Fetch a timer by id.",
+      http: { method: "GET", path: "/timers/{id}" },
+      input: z.object({ id: z.string() }),
+      output: timerSchema,
+      handler: async (ctx, input) => {
+        const timer = await timerStore(ctx).get(input.id);
+        // Per-creator ownership (C2): a non-admin principal cannot even OBSERVE another creator's timer.
+        // Report the same 404 as a genuinely-missing id, so a non-owner cannot probe existence.
+        const owner = creatorFilter(ctx);
+        if (!timer || (owner && timer.createdBy !== owner.createdBy)) {
+          throw new OpError("not_found", 404, `timer '${input.id}' was not found`);
+        }
+        return timer;
+      },
+    },
+    list: {
+      kind: "query",
+      grant: "timers:read",
+      summary: "List timers, optionally filtered by status.",
+      http: { method: "GET", path: "/timers" },
+      input: z.object({
+        status: statusSchema.optional(),
+        // Coerced: over HTTP this arrives as a query-string value; in-process callers may still
+        // pass a number. `z.coerce.number` accepts both, so the transport stays type-agnostic.
+        limit: z.coerce.number().int().min(1).max(200).optional(),
+        cursor: z.string().optional(),
+      }),
+      output: z.object({ items: z.array(timerSchema), cursor: z.string().optional() }),
+      handler: async (ctx, input) => {
+        // Per-creator ownership (C2): a non-admin principal only ever sees its OWN timers — the op
+        // applies a `where: {createdBy}` filter from `ctx.principal.actor`; an admin (system:admin)
+        // crosses creators. Merged with the optional status filter.
+        const where = { ...creatorFilter(ctx), ...(input.status ? { status: input.status } : {}) };
+        const page = await timerStore(ctx).list({
+          limit: input.limit,
+          cursor: input.cursor,
+          ...(Object.keys(where).length ? { where } : {}),
+        });
+        return { items: [...page.items], ...(page.cursor ? { cursor: page.cursor } : {}) };
+      },
+    },
+    cancel: {
+      kind: "mutation",
+      idempotent: true,
+      grant: "timers:write",
+      summary: "Cancel a scheduled timer.",
+      emits: ["timers.cancelled"],
+      http: { method: "DELETE", path: "/timers/{id}" },
+      input: z.object({ id: z.string() }),
+      output: timerSchema,
+      handler: async (ctx, input) => {
+        const store = timerStore(ctx);
+        const timer = await store.get(input.id);
+        // Per-creator ownership (C2): a non-admin principal cannot cancel another creator's timer, and
+        // gets the SAME 404 a missing id yields (no existence disclosure). Admin (system:admin) crosses.
+        const owner = creatorFilter(ctx);
+        if (!timer || (owner && timer.createdBy !== owner.createdBy)) {
+          throw new OpError("not_found", 404, `timer '${input.id}' was not found`);
+        }
+        // Idempotent: a repeat cancel is a no-op that emits nothing and mutates nothing.
+        if (timer.status === "cancelled") return timer;
+        const cancelled = await store.update(input.id, { status: "cancelled" });
+        await ctx.events.emit("timers.cancelled", { id: input.id });
+        return cancelled;
+      },
+    },
+    // ── P2-6 migrate-at-cutover surface (SYSTEM-only; the src migration script invokes this) ───────
+    // The one-time forward migration (§4.2, RATIFIED disjoint-tables model) copies an ACTIVE legacy
+    // `scheduled_timers` row into the kernel timer entity + enqueues its `fire` workflow. Like the drain
+    // ops it is drainer-only (`timers:admin`) and never exposed over any transport, so it lands as a
+    // prod no-op until the cutover script runs it. The src side (`kernel-timers-migrate.ts`) owns the
+    // legacy→kernel field mapping; this op just faithfully UPSERTS the resolved entity.
+    //
+    // IDEMPOTENT (the crux, keyed on the LEGACY timer id): the kernel timer id IS the legacy id, so a
+    // re-run finds the entity already present and does NOT create a duplicate. It ALWAYS (re-)starts the
+    // fire workflow with `idempotencyKey = id`, which the runtime dedupes onto the existing instance —
+    // so a crash BETWEEN the entity create and the workflow start converges on re-run (the entity is
+    // there, the still-missing instance gets started). Safe to re-run / resume after a crash.
+    //
+    // FENCED (T-0 hardening, #1409): an optional `fence` (the caller's ingress seq) makes the write
+    // refuse when stale — `fence <` the per-timer `applyFence` record (e.g. a cancel tombstone) returns
+    // `{fenced: true}` with NO entity write, NO workflow start, NO event. Equal fence = same-intent
+    // re-drive, proceeds idempotently. And when the staleness is only discovered AT FLUSH (both ops
+    // read the old fence; the other committed first), the lost CAS aborts the WHOLE commit — including
+    // the enlisted workflow seed — so the losing migrate leaves nothing at all behind (second-pass
+    // hardening, T1175). See `applyFenceSchema` for the full contract.
+    //
+    // SECURITY (server-trusted snapshot — sidesteps G1's client-input concern): `command.identity` /
+    // `message.identity` here are the LEGACY row's PERSISTED create-time identity (the server-resolved
+    // snapshot `insertScheduledTimer` froze), carried verbatim — NOT client input at migrate time. So no
+    // creator-facing re-validation (quota / persistent-grant / cwd-constraint) runs: those gated the
+    // legacy row at ITS create, and this copies that already-trusted state. The fire-time #968 cwd gate
+    // still binds a command's cwd to `command.identity` exactly as for a natively-created kernel timer.
+    migrate: {
+      kind: "mutation",
+      idempotent: true,
+      grant: TIMERS_DRAIN_GRANT,
+      summary: "Forward-migrate one active legacy timer into the kernel entity + enqueue firing (P2-6; system-only).",
+      emits: ["timers.created"],
+      expose: { http: false, mcp: false, cli: false },
+      input: z.object({
+        id: z.string().min(1),
+        label: z.string().min(1),
+        createdBy: z.string().min(1),
+        fireAt: z.number().int(),
+        everyMs: z.number().int().positive().optional(),
+        maxRuns: z.number().int().positive().optional(),
+        expiresAt: z.number().int().optional(),
+        // Runs the legacy timer already COMPLETED. The kernel entity carries it as its projection and
+        // the fire workflow starts at `runCount + 1`, so the migrated timer's next run number CONTINUES
+        // the legacy sequence (dual-read dedup parity for recurring timers).
+        runCount: z.number().int().nonnegative().default(0),
+        // Failure-backoff state must SURVIVE migration (#1409): a legacy timer mid-backoff (e.g. 2 of 3
+        // consecutive failures) migrates with its streak intact, so the kernel keeps disabling it after
+        // `maxFailures` rather than resetting to 0 and re-granting it a full retry budget.
+        consecutiveFailures: z.number().int().nonnegative().default(0),
+        lastError: z.string().optional(),
+        command: commandSpecSchema.optional(),
+        message: messageSpecSchema.optional(),
+        // T-0 apply fence (#1409 hardening): the caller's ingress seq. When present, a stale write
+        // (fence < the stored per-timer fence) is REFUSED before any effect — see `applyFenceSchema`.
+        fence: z.number().int().positive().optional(),
+        // Stage 5 authority snapshot. These are supplied together only when a real authority row
+        // exists; shadow/fence-only ingress intentionally omits them and retains its old workflow.
+        generation: z.number().int().nonnegative().optional(),
+        run: z.number().int().positive().optional(),
+      }),
+      output: z.object({ timer: timerSchema.optional(), created: z.boolean(), fenced: z.boolean() }),
+      handler: async (ctx, input) => {
+        const authorityApply = input.generation !== undefined || input.run !== undefined;
+        if (authorityApply && (input.fence === undefined || input.generation === undefined || input.run === undefined || !input.message || input.command)) {
+          throw new OpError("invalid_input", 400, "authority migrate requires a pure MESSAGE timer with exact fence/generation/run");
+        }
+        // Fence check FIRST — before the entity write AND before the workflow start (which commits in
+        // its own transaction): a stale fenced migrate must have NO effect at all. The read-check is
+        // raced-safe because the fence upsert below flushes in this op's atomic commit (CAS-guarded);
+        // a loser aborts wholesale and its retry re-reads the newer fence here.
+        const gate = input.fence !== undefined ? await applyFenceStore(ctx).get(input.id) : undefined;
+        if (input.fence !== undefined && gate !== undefined && input.fence < gate.fence) {
+          return { created: false, fenced: true };
+        }
+        const store = timerStore(ctx);
+        const existing = await store.get(input.id);
+        let timer = existing;
+        const created = existing === undefined;
+        if (!existing) {
+          timer = await store.create({
+            id: input.id,
+            label: input.label,
+            createdBy: input.createdBy,
+            fireAt: input.fireAt,
+            runCount: input.runCount,
+            consecutiveFailures: input.consecutiveFailures,
+            ...(input.lastError !== undefined ? { lastError: input.lastError } : {}),
+            ...(input.everyMs !== undefined ? { everyMs: input.everyMs } : {}),
+            ...(input.maxRuns !== undefined ? { maxRuns: input.maxRuns } : {}),
+            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+            ...(input.command ? { command: input.command } : {}),
+            ...(input.message ? { message: input.message } : {}),
+          });
+          await ctx.events.emit("timers.created", { id: input.id, label: input.label, fireAt: input.fireAt });
+        } else if (input.fence !== undefined && (gate === undefined || input.fence > gate.fence)) {
+          // Higher-F apply is convergence, not create-only mirroring. Write every timer field,
+          // including explicit undefined values that clear fields removed by the new intent.
+          timer = await store.update(input.id, {
+            label: input.label,
+            createdBy: input.createdBy,
+            fireAt: input.fireAt,
+            status: "scheduled",
+            everyMs: input.everyMs,
+            maxRuns: input.maxRuns,
+            expiresAt: input.expiresAt,
+            runCount: input.runCount,
+            consecutiveFailures: input.consecutiveFailures,
+            lastError: input.lastError,
+            command: input.command,
+            message: input.message,
+          });
+        }
+        // ALWAYS (re-)enqueue firing, idempotently AND — the T-0 #1409 finding-1 crux — ENLISTED in
+        // this op's atomic commit: the instance seed executes INSIDE the same transaction that
+        // flushes the entity and the applyFence CAS below. A migrate that read a stale fence and
+        // LOSES that CAS at flush (a concurrent newer cancel/create committed first) therefore
+        // rolls back the workflow seed WITH the entity and the fence — a fence-losing migrate
+        // commits NOTHING: no entity, no event, no fence write, no instance. That closes the
+        // orphaned-workflow adoption hole: an instance keyed `idempotencyKey = id` can only exist
+        // if the op that seeded it COMMITTED, i.e. its entity + fence exist at that fence — so a
+        // later create can never dedupe onto a rolled-back migrate's workflow and fire at a stale
+        // deadline. The drive runs post-commit; a crash before it leaves a durable `pending`
+        // instance which the ingress re-drive (equal fence, idempotent) or `recover()` converges.
+        // The first run number continues the legacy sequence (`runCount + 1`); the workflow input
+        // is validated EAGERLY at this call (typed `invalid_input` on failure — finding 2), so a
+        // deterministically-rejectable row aborts here before anything is buffered.
+        await ctx.workflows.start(
+          "fire",
+          authorityApply
+            ? { id: input.id, fence: input.fence!, generation: input.generation!, fireAt: input.fireAt, run: input.run! }
+            : { id: input.id, fireAt: input.fireAt, initialRun: input.runCount + 1 },
+          {
+            idempotencyKey: authorityApply ? `${input.id}:generation:${input.generation}` : input.id,
+            enlist: "op-commit",
+          },
+        );
+        if (input.fence !== undefined) {
+          await raiseApplyFence(ctx, gate, input.id, input.fence, "create");
+          if (authorityApply) {
+            ctx.messageAuthority.applyFence({
+              timer: { timerId: input.id, message: input.message! },
+              fence: input.fence,
+              updatedAt: ctx.clock.now(),
+            });
+          }
+        }
+        return { timer: timer!, created, fenced: false };
+      },
+    },
+    // ── P2-7 live CANCEL ingress (#1414; SYSTEM-only) — the `migrate` (create) counterpart ─────────
+    // When a legacy timer is CANCELLED via the legacy path (`cancelTimer`), the src ingress mirrors that
+    // cancel into the kernel so the kernel copy STOPS firing — otherwise the mirror stays `scheduled` and
+    // keeps firing autonomously until it independently hits `maxRuns`/`expiresAt` (the #1414 phantom-fire).
+    // Like `migrate`/the drain ops it is drainer-only (`timers:admin`) and never exposed over any transport
+    // (`expose` all false): the ordinary creator-facing `cancel` op requires `timers:write` AND applies the
+    // C2 per-creator filter, so it cannot serve a cross-creator SYSTEM ingress. This op crosses creators by
+    // construction (system-trusted) — it is the src→kernel cancel seam, mirroring how `migrate` is the
+    // create seam.
+    //
+    // Only an ARMED (`scheduled`) timer transitions to `cancelled` (flipping the fire step's cancel-safe
+    // guard, which keys on `status === "scheduled"`). Idempotent + terminal-safe: an already-`cancelled`,
+    // `fired`, or `disabled` timer is a no-op (never resurrects a terminal row). A not-yet-mirrored id (a
+    // create-mirror miss, or a command timer the create-mirror deliberately skipped) never MANUFACTURES a
+    // kernel TIMER row — but a FENCED cancel of an absent entity DOES durably record its fence as the
+    // kernel TOMBSTONE (T-0 hardening), so a stale lower-fence create can never arm the timer afterwards.
+    // An unfenced absent-entity cancel stays a pure best-effort no-op (pre-activation seams).
+    cancelMirror: {
+      kind: "mutation",
+      idempotent: true,
+      grant: TIMERS_DRAIN_GRANT,
+      summary: "Cancel a migrated timer's kernel mirror when its legacy row is cancelled (P2-7; system-only).",
+      emits: ["timers.cancelled"],
+      expose: { http: false, mcp: false, cli: false },
+      input: z.object({
+        id: z.string().min(1),
+        // T-0 apply fence (#1409 hardening): the caller's ingress seq — see `migrate` and `applyFenceSchema`.
+        fence: z.number().int().positive().optional(),
+      }),
+      output: z.object({ cancelled: z.boolean(), fenced: z.boolean() }),
+      handler: async (ctx, input) => {
+        // Stale-fence refusal first (same contract as `migrate`): a cancel that lost to a NEWER applied
+        // intent must not touch the entity nor regress the fence.
+        const gate = input.fence !== undefined ? await applyFenceStore(ctx).get(input.id) : undefined;
+        if (input.fence !== undefined && gate !== undefined && input.fence < gate.fence) {
+          return { cancelled: false, fenced: true };
+        }
+        const store = timerStore(ctx);
+        const timer = await store.get(input.id);
+        if (!timer) {
+          // ABSENT entity: the fenced cancel's fence row IS the durable kernel tombstone — the whole
+          // point of the T-0 hardening (an absent-entity cancel must NOT be a silent no-op).
+          if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
+          return { cancelled: false, fenced: false };
+        }
+        if (timer.status !== "scheduled") {
+          if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
+          return { cancelled: false, fenced: false };
+        }
+        await store.update(input.id, { status: "cancelled" });
+        await ctx.events.emit("timers.cancelled", { id: input.id });
+        if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
+        return { cancelled: true, fenced: false };
+      },
+    },
+    // ── P2-3 relay-outbox drain surface (SYSTEM-only; the src drainer invokes these) ───────────────
+    // The kernel emits the send INTENT (the in-tx outbox row); the src side performs the EFFECT. These
+    // two ops are the narrow, authz-gated seam it does that through — no `kernel/`→`src/` import, and no
+    // ad-hoc entity-store leak. They require the drainer-only `timers:admin` grant and are never exposed
+    // over any transport (`expose` all false), so an ordinary caller can neither read nor settle the
+    // outbox. Marking a row sent is idempotent, which is exactly what makes the at-least-once drain safe
+    // (a crash between `sendMessageService` returning and the mark landing re-drains + re-sends, deduped
+    // by `base:run:N`; the second mark is a no-op).
+    drainRelaySends: {
+      kind: "query",
+      grant: TIMERS_DRAIN_GRANT,
+      summary: "List pending relay-send outbox rows (P2-3 drainer; system-only).",
+      expose: { http: false, mcp: false, cli: false },
+      input: z.object({
+        limit: z.coerce.number().int().min(1).max(200).optional(),
+        cursor: z.string().optional(),
+      }),
+      output: z.object({ items: z.array(relaySendSchema), cursor: z.string().optional() }),
+      handler: async (ctx, input) => {
+        const page = await relaySendStore(ctx).list({
+          where: { status: "pending" },
+          ...(input.limit !== undefined ? { limit: input.limit } : {}),
+          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),
+        });
+        return { items: [...page.items], ...(page.cursor ? { cursor: page.cursor } : {}) };
+      },
+    },
+    markRelaySendSent: {
+      kind: "mutation",
+      idempotent: true,
+      grant: TIMERS_DRAIN_GRANT,
+      summary: "Mark a relay-send outbox row sent (P2-3 drainer; system-only).",
+      expose: { http: false, mcp: false, cli: false },
+      input: z.object({ id: z.string(), messageId: z.number().int().optional() }),
+      output: relaySendSchema,
+      handler: async (ctx, input) => {
+        const store = relaySendStore(ctx);
+        const row = await store.get(input.id);
+        if (!row) throw new OpError("not_found", 404, `relay send '${input.id}' was not found`);
+        // Idempotent: a re-mark (a re-drained row already settled, or a duplicate drain) is a no-op.
+        if (row.status === "sent") return row;
+        return store.update(input.id, {
+          status: "sent",
+          ...(input.messageId !== undefined ? { sentMessageId: input.messageId } : {}),
+        });
+      },
+    },
+  },
+});