@humwick/server 0.130.0 → 0.130.2

package/node_modules/@humwick/kernel/timers.pilot.ts

@@ -1,1411 +0,0 @@
-import { z } from "zod";
-import { type EntityStore, type Grant, type HostCommandRun, type ModuleCtx, type StepResult, OpError, defineModule } from "./contract";
-
-/**
- * The timers pilot module: a Timers CRUD (`create`/`get`/`list`/`cancel`) served through the module
- * host — default-deny authz, I/O validation, scope-tagged persistence and events, and atomic
- * commit/rollback — plus DURABLE FIRING riding on the K7 workflow runtime (M3). Creating a timer
- * enqueues a one-shot `fire` workflow that sleeps until `fireAt` and then, on a wakeup pass, flips
- * the timer `scheduled → fired` and emits `timers.fired`. Firing is a `sleeping` journal row a
- * wakeup pass claims — never a live `setTimeout` — so it is crash-durable and clock-deterministic.
- *
- * ── Command timers (Phase-2 P2-2, #1409) ────────────────────────────────────────────────────────
- * A timer may carry a `command` spec. Instead of the plain `scheduled → fired` flip, its firing
- * workflow issues a durable P3 command (`ctx.commands.issue("run-command", …)`) at the deadline and
- * parks `waiting` on that command's terminal status (`waitFor:{kind:"command"}`). The orchestrator —
- * NOT this process — execs the shell; the kernel only dispatches an authz-gated command and awaits
- * it. The command's `idempotencyKey` is the timer id, so a re-driven `fire` step (a crash after the
- * issue but before the journal memo) dedupes onto the SAME orchestrator command and never
- * double-dispatches. The completion relay message rides the P2-3 outbox — see the `await` step.
- *
- * ── Relay-dispatch transactional outbox (Phase-2 P2-3, #1409) ────────────────────────────────────
- * A timer that carries a `message` spec dispatches a Relay message on fire. The firing step does NOT
- * call `sendMessageService` (the kernel must not import src, and a raw send would be a non-durable
- * dual-write); instead it writes a `relaySend` OUTBOX row INSIDE its atomic step-commit. That single
- * transaction commits the fired flip + `timers.fired` event + outbox row together or not at all, so the
- * DECISION to send is journal-atomic exactly-once. A src-side drainer (`kernel-timers-outbox.ts`) then
- * scans pending rows, calls `sendMessageService`, and marks each sent — at-least-once delivery deduped
- * to effectively-once by the run-scoped `base:run:N` idempotency key `sendMessageService` already
- * honors, identical to legacy `fireClaimedTimer`. Closes BOTH parity seams: the message-timer send and
- * the command-timer completion send.
- *
- * SECURITY (R1): the command runs under the timer's FROZEN create-time identity snapshot
- * (`command.identity`), reconstructed src-side into a cwd-constrained component token that
- * `dispatchCommand`'s #968 gate binds the command cwd to. The kernel carries the snapshot opaquely;
- * it never fabricates authority. See `src/services/kernel-timers-command.ts`.
- *
- * ── Recurring/interval + failure backoff (Phase-2 P2-5, #1409) ───────────────────────────────────
- * A timer carrying `everyMs` is RECURRING: firing is a LOOPING workflow (arm→fire→arm) that reschedules
- * the next deadline deterministically from durable state — `max(now+everyMs, prevFireAt+everyMs)`, no
- * drift, no live `setTimeout` — and disables at `maxRuns`/`expiresAt` (parity with legacy
- * `completeScheduledTimerRun`). The run number `N` a fire dispatches under lives in the firing workflow's
- * MEMOIZED state (`state.run`, reconstructed by the journal fold), so a crash-recovery re-drive of run N
- * recomputes the SAME N → the `base:run:N` outbox dedup holds → exactly-once send (G3). A fire that
- * ERRORS is a timer-run-level failure: it bumps `consecutiveFailures`, reschedules at `now+retryMs`, and
- * disables after `maxFailures` (parity with legacy `recordScheduledTimerFailure`) — distinct from the M3
- * per-step retry.
- *
- * Cutover note (#1408): this proves kernel-served firing at the module's own semantic level
- * (schedule/cancel/list/fire/command/relay-send/recurring). It is NOT yet a full functional replacement
- * for the legacy prod timers in `src/db/scheduled-timers.ts`: the MCP write surface for recurring params
- * remains deferred create-path parity work (P2-7) before a real prod cutover. Relay message dispatch
- * (message + command-completion sends) is covered by the P2-3 outbox above.
- */
-
-// `disabled` (P2-5) is the terminal state a recurring/one-shot timer lands in when it stops WITHOUT a
-// clean fire — it expired before delivery, or its FIRE failed `SCHEDULER_MAX_FAILURES` times (the
-// legacy `enabled=0 + last_error` disable). `fired` remains "completed a run" (one-shot fired, or a
-// recurring timer reached `maxRuns` / would run past `expiresAt` AFTER a successful run). `cancelled`
-// stays user-initiated. Only `scheduled` is active/armed — the fire step's cancel-safe guard keys on it.
-const statusSchema = z.enum(["scheduled", "fired", "cancelled", "disabled"]);
-
-/** Ceiling on a command-timer shell string, mirroring the legacy `cleanCommand` 8000-char cap
- * (`scheduler-command.ts`). Bounds the durable-command payload the kernel path can persist. */
-const MAX_COMMAND_CHARS = 8_000;
-
-/** The grant a command timer's creator must hold — the kernel spelling of the legacy `command:write`
- * scope `normalizeScheduleCommand` requires. `command:write` is a valid flat {@link Grant}, so the op
- * can enforce it from `ctx.principal.grants` (the invoker-resolved principal) with no contract change. */
-const COMMAND_WRITE_GRANT: Grant = "command:write";
-
-/** The admin grant that lets a principal cross creators on `list`/`cancel` (mirrors the legacy
- * `canAdministerTimers`: `actor.kind === "system" || hasScope("system:admin")`). The kernel Principal
- * carries no actor-kind, so the MCP binding maps a system/admin token to this grant. */
-const TIMERS_ADMIN_GRANT: Grant = "system:admin";
-
-/** The grant the P2-3 relay-outbox drainer holds. A system-only capability distinct from the
- * creator-facing `timers:read`/`timers:write` — the drain ops (`drainRelaySends`/`markRelaySendSent`)
- * cross creators to see every pending send, so an ordinary timer creator must NOT be able to invoke
- * them. The src supervisor injects an identity carrying exactly this grant; the ops are never exposed
- * over any transport (see `expose`). */
-const TIMERS_DRAIN_GRANT: Grant = "timers:admin";
-
-/** The grant that lets a principal create an UNBOUNDED recurring timer (no `maxRuns`/`expiresAt`) —
- * the kernel spelling of the legacy `schedule:persistent` scope `canCreatePersistentTimer` honors. A
- * `system:admin` principal also qualifies (mirrors `canAdministerTimers`). The scope→grant mapping the
- * MCP binding performs is the deferred P2-7 create-path seam (gates G1/G2); the `create` op enforces
- * the RULE from `ctx.principal.grants` here, with no contract change. */
-const SCHEDULE_PERSISTENT_GRANT: Grant = "schedule:admin";
-
-/** The frozen create-time creator identity a timer's external effects fire under (R1). Mirrors the
- * legacy `persistedAuthContext` snapshot (createdBy/kind/scopes/constraints). BOTH parity seams carry
- * it: a command timer's `run-command` exec (P2-2) AND a message/command timer's relay-send outbox
- * (P2-3), so the src side reconstructs the SAME `ComponentToken` the creator held — never a widened
- * one. The kernel treats `constraints` as an OPAQUE JSON blob — it never imports the src
- * `TokenConstraints` type — and hands it verbatim to the src translator/drainer.
- *
- * SECURITY (P2-4 / C2 residual #1): this snapshot is the SERVER-resolved authority — the `create` op
- * builds it from `ctx.principal` (createdBy = the authenticated actor; createdByScopes = the invoker
- * -resolved grants) + the token's real cwd constraint, NEVER from client input. See `create.handler`. */
-const frozenIdentitySchema = z.object({
-  createdBy: z.string(),
-  createdByKind: z.string(),
-  createdByScopes: z.array(z.string()),
-  createdByConstraints: z.record(z.string(), z.unknown()).optional(),
-  createdAt: z.number().int(),
-});
-
-/** A command timer's persisted payload: the shell command + where/how it runs + the FROZEN creator
- * identity. This is the ENTITY / `run-command` shape — the server-built `identity` is present. The
- * client-facing create INPUT uses {@link commandRequestSchema} instead (no server-owned identity). */
-const commandSpecSchema = z.object({
-  command: z.string().min(1).max(MAX_COMMAND_CHARS),
-  cwd: z.string().min(1),
-  env: z.record(z.string(), z.string()).optional(),
-  timeoutMs: z.number().int().positive(),
-  orchestratorId: z.string().min(1),
-  identity: frozenIdentitySchema,
-});
-
-/** The client-facing command spec on the `create` op input: the exec request WITHOUT any creator
- * identity. G1 (#1409): NO identity field is accepted from op input at all — createdBy / kind / scopes
- * / constraints are ALL server-resolved by the op from `ctx.principal` (its `actor`, `grants`, and the
- * trusted `resolvedIdentity` the host binding attaches from the authenticated token) + the kernel clock.
- * A client thus cannot name a creator, broaden its scopes, or supply a wider cwd constraint — even a
- * hostile `identity`/`createdByConstraints` key on the wire is an unknown Zod strips before the handler
- * runs. See `freezeIdentity` / `freezeCommandTimer`. */
-const commandRequestSchema = z.object({
-  command: z.string().min(1).max(MAX_COMMAND_CHARS),
-  cwd: z.string().min(1),
-  env: z.record(z.string(), z.string()).optional(),
-  timeoutMs: z.number().int().positive(),
-  orchestratorId: z.string().min(1),
-});
-
-/** ── Relay-dispatch outbox (P2-3, #1409) ─────────────────────────────────────────────────────────
- * The fully-resolved relay send a timer fires, persisted so a MESSAGE timer (and a command timer's
- * completion) can dispatch a Relay message at parity with legacy `sendMessageService`. The kernel
- * NEVER sends: it writes the send as an outbox row IN the atomic step-commit tx (journal-atomic
- * exactly-once on the DECISION to send), and a src-side drainer performs the effect, deduped by the
- * run-scoped `idempotencyKey` (`base:run:N`) `sendMessageService` already honors. See the `fire`/
- * `await` steps + `src/services/kernel-timers-outbox.ts`. */
-
-/** The client-facing message spec on `create`: WHERE/WHAT to send, plus the same server-resolved
- * authority hints the command request carries. `from` defaults to the resolved creator; `body` is
- * required for a pure message timer (validated in the handler) but optional for a command timer, whose
- * completion body defaults from the command outcome. `idempotencyKey` is the OPTIONAL delivery-dedup
- * BASE — the outbox stamps `base:run:N` from it (falling back to `scheduler:<id>`), matching legacy. */
-const messageRequestSchema = z.object({
-  to: z.string().min(1),
-  from: z.string().min(1).optional(),
-  kind: z.string().min(1).optional(),
-  channel: z.string().min(1).optional(),
-  subject: z.string().min(1).optional(),
-  body: z.string().min(1).optional(),
-  claimable: z.boolean().optional(),
-  payload: z.record(z.string(), z.unknown()).optional(),
-  meta: z.record(z.string(), z.unknown()).optional(),
-  idempotencyKey: z.string().min(1).optional(),
-  // G1 (#1409): NO creator identity is accepted from op input — the send fires under the server-resolved
-  // frozen identity (`freezeIdentity` from `ctx.principal`), never a client-named one.
-});
-
-/** A timer's persisted relay-send spec: the resolved send + the FROZEN creator identity the drainer
- * fires under (R1 — mirrors legacy `persistedAuthContext`, so the component send gate runs under the
- * creator's real reach, not a widened one). `from` and `identity` are server-resolved. */
-const messageSpecSchema = z.object({
-  from: z.string().min(1),
-  to: z.string().min(1),
-  kind: z.string().min(1).optional(),
-  channel: z.string().min(1).optional(),
-  subject: z.string().min(1).optional(),
-  body: z.string().min(1).optional(),
-  claimable: z.boolean().optional(),
-  payload: z.record(z.string(), z.unknown()).optional(),
-  meta: z.record(z.string(), z.unknown()).optional(),
-  idempotencyKey: z.string().min(1).optional(),
-  /** D1 (#1409): the legacy `scheduler.correlationId` (`timer:<id>`) the fired message's payload/meta
-   *  `scheduler` block carries, so a kernel-fired message is byte-identical to a legacy-fired one for a
-   *  consumer keying off it. Server-derived at create (`timer:<id>`); the migrate op carries the legacy
-   *  row's persisted value verbatim. Absent → the outbox falls back to `timer:<timerId>` (see
-   *  `messageOutboxInput`), so a correlationId is ALWAYS stamped. */
-  correlationId: z.string().min(1).optional(),
-  identity: frozenIdentitySchema,
-});
-
-const relaySendStatusSchema = z.enum(["pending", "sent"]);
-
-/** ── T-0 apply fencing (#1409 hardening) ─────────────────────────────────────────────────────────
- * The durable per-timer LAST-APPLIED-FENCE record for the ingress apply seam. The fence token is the
- * ingress log's `seq` — globally monotone and never reused, hence STRICTLY monotone per timer. A
- * fenced `migrate`/`cancelMirror` whose `fence` is LOWER than this row's is refused AT THE KERNEL
- * WRITE (`fenced: true`, no entity mutation, no workflow start, no event): a live-but-lease-expired
- * applier resuming a stale create after a newer cancel already applied can never arm the timer.
- * A fenced cancel of an ABSENT entity still writes this row — the durable KERNEL TOMBSTONE that
- * refuses the stale create ("a cancel has already been applied for this timerId at fence ≥ mine").
- * Cross-process safety: the row is read-checked in the handler and (re-)written in the op's atomic
- * commit, whose optimistic-version CAS / PK-conflict aborts a raced flush — the loser retries,
- * re-reads the newer fence, and refuses cleanly. Equal fences (a same-intent crash re-drive)
- * proceed idempotently. Unfenced calls (no `fence` input — the pre-activation shadow mirror and the
- * P2-6 migration script, which run under LEGACY authority) neither check nor touch this record.
- *
- * SECOND-PASS HARDENING (#1409, T1175): the CAS covers ALL side effects of an apply, not just the
- * entity — `migrate`'s firing-workflow enqueue is ENLISTED in the same atomic op commit
- * (`enlist: "op-commit"`), so the instance seed sits in the very transaction this fence's
- * CAS/PK-conflict aborts. A migrate that read a stale fence and loses the flush race commits
- * NOTHING (no entity, no event, no fence, no workflow instance); a later same-id create therefore
- * has no orphan to dedupe onto and can never fire at a rolled-back migrate's stale deadline. */
-const applyFenceSchema = z.object({
-  /** The timer id this fence guards (the entity key). */
-  id: z.string(),
-  /** The highest ingress fence (log seq) whose apply committed for this timer. */
-  fence: z.number().int().positive(),
-  /** Which op applied at that fence — `cancel` on an absent entity IS the durable tombstone. */
-  op: z.enum(["create", "cancel"]),
-  updatedAt: z.number().int(),
-});
-
-/** The transactional-outbox entity: one fully-resolved, ready-to-dispatch Relay send. Written INSIDE
- * the firing step's atomic commit (so the decision to send is journal-atomic exactly-once) and drained
- * by the src side, which flips `status` to `sent` after `sendMessageService` returns. Delivery is
- * at-least-once (a crash between send and mark re-drains) but deduped to effectively-once by
- * `idempotencyKey` (`base:run:N`) — the exact key `sendMessageService` dedupes on. `identity` is the
- * frozen creator snapshot the drainer reconstructs the send AuthContext from. */
-const relaySendSchema = z.object({
-  id: z.string(),
-  /** The timer that produced this send — for tracing/observability + the drainer's per-row context. */
-  timerId: z.string(),
-  /** The run-scoped delivery-dedup key `sendMessageService` honors: a re-drain re-presents the SAME
-   *  key, so a crash between the send and the `sent` mark never doubles the message. */
-  idempotencyKey: z.string(),
-  status: relaySendStatusSchema.default("pending"),
-  from: z.string(),
-  to: z.string(),
-  kind: z.string().optional(),
-  channel: z.string().optional(),
-  subject: z.string().optional(),
-  body: z.string(),
-  claimable: z.boolean().optional(),
-  payload: z.record(z.string(), z.unknown()).optional(),
-  meta: z.record(z.string(), z.unknown()).optional(),
-  /** The frozen creator identity the drainer fires the send under (R1). */
-  identity: frozenIdentitySchema,
-  /** Set by the drainer once the send lands — observability only; dedup is by `idempotencyKey`. */
-  sentMessageId: z.number().int().optional(),
-  createdAt: z.number().int(),
-});
-
-const timerSchema = z.object({
-  id: z.string(),
-  label: z.string(),
-  /** The actor id (from `ctx.principal.actor`) that created the timer — the per-creator ownership key
-   * `list`/`cancel`/`get` filter on for a non-admin principal (C2). Server-stamped; never client input. */
-  createdBy: z.string(),
-  /** Epoch milliseconds at which the timer is due to fire. For a recurring timer this is the CURRENT
-   *  run's deadline; the fire step advances it deterministically for each subsequent run. */
-  fireAt: z.number().int(),
-  status: statusSchema.default("scheduled"),
-  /** ── Recurring/interval (P2-5) ─────────────────────────────────────────────────────────────────
-   *  Present iff this is a RECURRING timer: the fixed interval between runs. Firing loops arm→fire→arm
-   *  (a looping workflow), rescheduling `fireAt` to `max(now+everyMs, prevFireAt+everyMs)` — computed
-   *  from durable state, never the wall clock, so it cannot drift. Command timers may NOT be recurring
-   *  (legacy parity); enforced at `create`. */
-  everyMs: z.number().int().positive().optional(),
-  /** A recurring timer disables (terminal `fired`) once it has completed this many runs. */
-  maxRuns: z.number().int().positive().optional(),
-  /** Epoch ms after which the timer stops: it disables before firing a run past this, and a fire whose
-   *  deadline is already past `expiresAt` disables WITHOUT firing (legacy `fireClaimedTimer` expiry). */
-  expiresAt: z.number().int().optional(),
-  /** Runs COMPLETED so far (bumped on each successful fire) — the observability counter, parity with
-   *  legacy `run_count`. NOTE: the durable, re-drive-stable run NUMBER a fire dispatches under lives in
-   *  the firing workflow's memoized `state.run` (the journal fold), NOT here — this is a projection. */
-  runCount: z.number().int().nonnegative().default(0),
-  /** Consecutive FIRE failures (parity with legacy `consecutive_failures`): bumped when a fire errors,
-   *  reset to 0 on a successful run. The timer disables after `maxFailures` consecutive failures. */
-  consecutiveFailures: z.number().int().nonnegative().default(0),
-  /** The last fire error (parity with legacy `last_error`); cleared on a successful run. */
-  lastError: z.string().optional(),
-  /** Present iff this is a command timer: firing dispatches this command and awaits it (see above). */
-  command: commandSpecSchema.optional(),
-  /** Present iff the timer dispatches a Relay message on fire (P2-3): the resolved send + frozen
-   *  creator identity. A MESSAGE timer carries it as its whole effect; a COMMAND timer may carry it as
-   *  the completion send composed once the command settles. Absent → firing is a pure status flip
-   *  (the pre-P2-3 pilot behavior, preserved). */
-  message: messageSpecSchema.optional(),
-});
-
-const configSchema = z.object({
-  /** Per-creator active (scheduled) timer quota — the kernel spelling of legacy
-   * `SCHEDULER_MAX_ACTIVE_TIMERS` (default 100). env-backed, so it must coerce from a string. */
-  maxTimers: z.coerce.number().int().positive().default(100),
-  /** Max lead time a timer may be scheduled ahead — the kernel spelling of the legacy command
-   * `afterMs ≤ 24h` ceiling, applied to EVERY timer so the kernel path can't evade it. */
-  maxFireAheadMs: z.coerce.number().int().positive().default(24 * 60 * 60 * 1000),
-  /** Minimum interval a RECURRING timer may specify — the kernel spelling of legacy
-   * `SCHEDULER_MIN_RECURRING_INTERVAL_MS` (default 60s). Enforced at `create` (P2-5 SCOPE 4). */
-  minRecurringIntervalMs: z.coerce.number().int().positive().default(60 * 1000),
-  /** Backoff before a FAILED fire's next attempt — the kernel spelling of legacy `SCHEDULER_RETRY_MS`
-   * (default 60s). A fire error reschedules the SAME run at `now + retryMs` (P2-5 SCOPE 3). */
-  retryMs: z.coerce.number().int().positive().default(60 * 1000),
-  /** Consecutive fire failures that disable a timer — the kernel spelling of legacy
-   * `SCHEDULER_MAX_FAILURES` (default 3) (P2-5 SCOPE 3). */
-  maxFailures: z.coerce.number().int().positive().default(3),
-  /** Label applied to a created timer when the caller supplies none. */
-  defaultLabel: z.string().min(1).default("timer"),
-});
-
-export type Timer = z.output<typeof timerSchema>;
-export type TimerCommandSpec = z.output<typeof commandSpecSchema>;
-export type TimerMessageSpec = z.output<typeof messageSpecSchema>;
-export type RelaySend = z.output<typeof relaySendSchema>;
-export type TimerApplyFence = z.output<typeof applyFenceSchema>;
-export type TimersConfig = z.output<typeof configSchema>;
-
-/** Does the opaque constraint blob pin the cwd(s) a command may run in? Mirrors the bridge's
- * `hasCwdConstraint` / `dispatch-command`'s #968 precondition: an UNCONSTRAINED creator identity would
- * clear the fire-time authz WITHOUT the cwd gate ever running, so a command timer must carry one at
- * create. Kept structural (no src `TokenConstraints` import) — checks the two known cwd axes. */
-function hasCwdConstraint(constraints: Record<string, unknown> | undefined): boolean {
-  if (!constraints) return false;
-  const cwd = constraints.cwd;
-  const prefixes = constraints.cwdPrefixes;
-  return (typeof cwd === "string" && cwd.length > 0) || (Array.isArray(prefixes) && prefixes.length > 0);
-}
-
-/** A principal may cross creators (see/cancel any timer) iff it holds the admin grant (C2). Mirrors
- * legacy `canAdministerTimers`; the MCP binding maps a `system` actor / `system:admin` scope onto it. */
-function isTimersAdmin(ctx: ModuleCtx): boolean {
-  return ctx.principal.grants.has(TIMERS_ADMIN_GRANT);
-}
-
-/** The per-creator ownership filter a non-admin op applies from the authenticated actor (C2). An admin
- * returns `undefined` (no restriction). This is the op-level `where: {createdBy}` the design mandates. */
-function creatorFilter(ctx: ModuleCtx): { createdBy: string } | undefined {
-  return isTimersAdmin(ctx) ? undefined : { createdBy: ctx.principal.actor };
-}
-
-/** May this principal create an UNBOUNDED recurring timer (no `maxRuns`/`expiresAt`)? Mirrors legacy
- * `canCreatePersistentTimer`: an admin, or a holder of the persistent grant (P2-5 SCOPE 4). */
-function canCreatePersistentTimer(ctx: ModuleCtx): boolean {
-  return isTimersAdmin(ctx) || ctx.principal.grants.has(SCHEDULE_PERSISTENT_GRANT);
-}
-
-/** Human-readable message from any thrown value (inlined; the kernel never imports the src SDK). */
-function errMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-/**
- * Server-resolve + FREEZE a creator identity from the authenticated principal (G1/G2, #1409). Every
- * field is server-sourced — NONE from client op input:
- *   • `createdBy`  = `ctx.principal.actor` (the authenticated actor);
- *   • `createdAt`  = the kernel clock;
- *   • `createdByKind` / `createdByScopes` / `createdByConstraints` = the trusted
- *     `ctx.principal.resolvedIdentity` the host binding attached from the authenticated TOKEN.
- * So a client can neither name a different creator, broaden its scopes, nor widen its cwd constraint
- * (G1 — a hostile `createdByConstraints:["/"] ` on the wire never reaches here). The frozen snapshot
- * reconstructs the SAME create-time authority legacy `persistedAuthContext` did — shared by both parity
- * seams (command exec P2-2 and relay send P2-3).
- *
- * G2 (#1409): `createdByScopes` is the creator's REAL transport scopes (`resolvedIdentity.scopes`,
- * e.g. `message:send`) — NOT the flat kernel grants, which the grammar cannot spell `message:send` in.
- * That is what lets the P2-3 outbox drainer's `sendMessageService` authorize under the creator's
- * message-send scope instead of failing closed at fire time. When no `resolvedIdentity` rides the
- * principal (a system/test caller that mints no durable send), it falls back to the principal grants.
- */
-function freezeIdentity(ctx: ModuleCtx, createdBy: string, now: number): z.output<typeof frozenIdentitySchema> {
-  const resolved = ctx.principal.resolvedIdentity;
-  const constraints = resolved?.constraints;
-  return {
-    createdBy,
-    createdByKind: resolved?.kind ?? "component",
-    createdByScopes: resolved?.scopes ? [...resolved.scopes] : ([...ctx.principal.grants] as string[]),
-    ...(constraints ? { createdByConstraints: { ...constraints } } : {}),
-    createdAt: now,
-  };
-}
-
-/**
- * Server-resolve + FREEZE a command timer's exec spec + creator identity. Preconditions mirror the
- * legacy `normalizeScheduleCommand` + `assertScheduleCommandAuthorized`:
- *   • the caller MUST hold the `command:write` grant (else no command timer at all), and
- *   • the frozen identity MUST carry a cwd constraint (else the fire-time #968 gate would not fire).
- * Throws a typed {@link OpError} (fail-closed) on either.
- */
-function freezeCommandTimer(
-  ctx: ModuleCtx,
-  request: z.output<typeof commandRequestSchema>,
-  createdBy: string,
-  now: number,
-): z.output<typeof commandSpecSchema> {
-  if (!ctx.principal.grants.has(COMMAND_WRITE_GRANT)) {
-    throw new OpError("unauthorized", 403, "command timers require the 'command:write' grant");
-  }
-  // The cwd constraint is read from the SERVER-resolved identity (`ctx.principal.resolvedIdentity`),
-  // never from client input (G1) — so an unconstrained creator cannot create a command timer, and a
-  // client cannot fabricate a wide constraint to clear this gate.
-  if (!hasCwdConstraint(ctx.principal.resolvedIdentity?.constraints)) {
-    throw new OpError("unauthorized", 403, "command timers require a cwd-constrained creator identity");
-  }
-  return {
-    command: request.command,
-    cwd: request.cwd,
-    ...(request.env ? { env: request.env } : {}),
-    timeoutMs: request.timeoutMs,
-    orchestratorId: request.orchestratorId,
-    identity: freezeIdentity(ctx, createdBy, now),
-  };
-}
-
-/**
- * Server-resolve + FREEZE a timer's relay-send spec (P2-3). `from` resolves server-side (the wire
- * `from`, else the resolved creator) and `identity` is frozen from the authenticated principal, so the
- * drainer fires the send under the creator's REAL reach — the component send gate runs exactly as it
- * did for legacy `persistedAuthContext`. A message timer (no command) additionally REQUIRES a body; a
- * command timer's completion body may be absent (it defaults from the command outcome at settle).
- */
-function freezeMessageTimer(
-  ctx: ModuleCtx,
-  request: z.output<typeof messageRequestSchema>,
-  createdBy: string,
-  now: number,
-  requireBody: boolean,
-  correlationId: string,
-): z.output<typeof messageSpecSchema> {
-  if (requireBody && (request.body === undefined || request.body.length === 0)) {
-    throw new OpError("invalid_input", 400, "a message timer requires message.body");
-  }
-  return {
-    from: request.from ?? createdBy,
-    to: request.to,
-    ...(request.kind ? { kind: request.kind } : {}),
-    ...(request.channel ? { channel: request.channel } : {}),
-    ...(request.subject ? { subject: request.subject } : {}),
-    ...(request.body ? { body: request.body } : {}),
-    ...(request.claimable !== undefined ? { claimable: request.claimable } : {}),
-    ...(request.payload ? { payload: request.payload } : {}),
-    ...(request.meta ? { meta: request.meta } : {}),
-    ...(request.idempotencyKey ? { idempotencyKey: request.idempotencyKey } : {}),
-    // D1 (#1409): stamp legacy's `timer:<id>` correlation id so the fired message is byte-identical.
-    correlationId,
-    identity: freezeIdentity(ctx, createdBy, now),
-  };
-}
-
-/** ── Recurring reschedule + failure backoff math (P2-5) — PURE, mirroring legacy exactly ───────────
- * These derive the NEXT deadline from DURABLE state (the timer entity + the workflow's memoized run
- * number), never the wall clock, so a re-drive recomputes an identical result. Exported for direct
- * unit tests (parity with `completeScheduledTimerRun` / `recordScheduledTimerFailure`). */
-
-/** The next recurring run's absolute deadline: `max(now+everyMs, prevFireAt+everyMs)`. Mirrors legacy
- *  `completeScheduledTimerRun`'s `candidateNextRunAt` — a late wakeup schedules the next run `everyMs`
- *  after NOW (self-correcting), never in the past, and an on-time run stays perfectly on the grid (no
- *  drift, since it derives from `prevFireAt`, not the actual — possibly late — wakeup time). */
-export function nextRecurringFireAt(everyMs: number, now: number, prevFireAt: number): number {
-  return Math.max(now + everyMs, prevFireAt + everyMs);
-}
-
-/** Whether a recurring timer keeps looping after completing run `runsCompleted`, and its next deadline.
- *  Mirrors legacy `completeScheduledTimerRun`'s disable logic: a non-recurring timer is always terminal;
- *  a recurring one disables at `maxRuns` or when its next deadline would fall past `expiresAt`. */
-export type RecurringContinuation =
-  | { readonly kind: "continue"; readonly nextFireAt: number; readonly nextRun: number }
-  | { readonly kind: "terminal" };
-
-export function recurringContinuation(input: {
-  everyMs: number | undefined;
-  now: number;
-  prevFireAt: number;
-  runsCompleted: number;
-  maxRuns: number | undefined;
-  expiresAt: number | undefined;
-}): RecurringContinuation {
-  if (input.everyMs === undefined) return { kind: "terminal" };
-  const nextFireAt = nextRecurringFireAt(input.everyMs, input.now, input.prevFireAt);
-  const reachedMaxRuns = input.maxRuns !== undefined && input.runsCompleted >= input.maxRuns;
-  const expiredBeforeNext = input.expiresAt !== undefined && nextFireAt > input.expiresAt;
-  if (reachedMaxRuns || expiredBeforeNext) return { kind: "terminal" };
-  return { kind: "continue", nextFireAt, nextRun: input.runsCompleted + 1 };
-}
-
-/** The outcome of a FAILED fire: retry after `retryMs` (same run number), or disable once
- *  `consecutiveFailures` reaches `maxFailures`. Mirrors legacy `recordScheduledTimerFailure`. */
-export type FailureOutcome =
-  | { readonly kind: "retry"; readonly nextFireAt: number; readonly failures: number }
-  | { readonly kind: "disable"; readonly failures: number };
-
-export function failureBackoff(input: {
-  now: number;
-  consecutiveFailures: number;
-  retryMs: number;
-  maxFailures: number;
-}): FailureOutcome {
-  const failures = input.consecutiveFailures + 1;
-  if (failures >= input.maxFailures) return { kind: "disable", failures };
-  return { kind: "retry", nextFireAt: input.now + input.retryMs, failures };
-}
-
-/** The run-scoped delivery-dedup key `sendMessageService` honors (`base:run:N`). Mirrors legacy
- *  `timerRunIdempotencyKey`: base is the caller's `idempotencyKey`, else `scheduler:<timerId>`. */
-function relaySendKey(message: z.output<typeof messageSpecSchema>, timerId: string, run: number): string {
-  const base = message.idempotencyKey ?? `scheduler:${timerId}`;
-  return `${base}:run:${run}`;
-}
-
-/** Stamp the legacy `scheduler` correlation block onto a send's payload/meta so a drained message is
- *  observably a timer fire (parity with `fireClaimedTimer`). Non-mutating. */
-function withScheduler(
-  base: Record<string, unknown> | undefined,
-  scheduler: Record<string, unknown>,
-): Record<string, unknown> {
-  return { ...(base ?? {}), scheduler };
-}
-
-/** A durable command result the completion send summarizes (the `run-command` decl's result shape). */
-type CommandRunResult = { exitCode: number | null; timedOut: boolean; stdoutTail: string; stderrTail: string };
-
-/** A human completion line for a command timer whose configured `message.body` was omitted. Mirrors
- *  the shape of legacy `commandSummary` (status + exit code) over the kernel command result. */
-function commandCompletionBody(result: CommandRunResult | undefined): string {
-  if (!result) return "Background command completed";
-  const label = result.timedOut ? "timed out" : result.exitCode === 0 ? "succeeded" : "failed";
-  const code = result.exitCode === null || result.exitCode === undefined ? "" : ` (exit ${result.exitCode})`;
-  return `Background command ${label}${code}`;
-}
-
-/** Build the fully-resolved outbox row for a MESSAGE timer's send. `run` is the DURABLE, re-drive-stable
- *  run number (`state.run` from the firing workflow's journal fold — 1, 2, 3, … for a recurring timer);
- *  the `scheduler` stamp + `base:run:N` key mirror legacy `fireClaimedTimer`. */
-function messageOutboxInput(
-  ctx: ModuleCtx,
-  timer: Timer,
-  message: z.output<typeof messageSpecSchema>,
-  run: number,
-): z.input<typeof relaySendSchema> {
-  // D1 (#1409): stamp `correlationId` (`timer:<id>`) alongside `timerId`/`run` so the delivered
-  // message's `scheduler` block is byte-identical to legacy `fireClaimedTimer`. Always present: the
-  // frozen `message.correlationId` when set (native create / migrate), else derived from the timer id.
-  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run };
-  return {
-    id: ctx.rng.uuid(),
-    timerId: timer.id,
-    idempotencyKey: relaySendKey(message, timer.id, run),
-    status: "pending",
-    from: message.from,
-    to: message.to,
-    ...(message.kind ? { kind: message.kind } : {}),
-    ...(message.channel ? { channel: message.channel } : {}),
-    ...(message.subject ? { subject: message.subject } : {}),
-    body: message.body ?? "",
-    ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
-    payload: withScheduler(message.payload, scheduler),
-    meta: withScheduler(message.meta, scheduler),
-    identity: message.identity,
-    createdAt: ctx.clock.now(),
-  };
-}
-
-/** Project a pure MESSAGE send into the shared immutable fire/outbox payload. */
-function authoritySendPayload(timer: Timer, message: z.output<typeof messageSpecSchema>, run: number) {
-  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run };
-  const idempotencyKey = relaySendKey(message, timer.id, run);
-  return {
-    idempotencyKey,
-    sendPayload: {
-      input: {
-        from: message.from,
-        to: message.to,
-        ...(message.kind ? { kind: message.kind } : {}),
-        ...(message.channel ? { channel: message.channel } : {}),
-        ...(message.subject ? { subject: message.subject } : {}),
-        body: message.body ?? "",
-        ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
-        payload: withScheduler(message.payload, scheduler),
-        meta: withScheduler(message.meta, scheduler),
-        idempotencyKey,
-      },
-      identity: { ...message.identity, deliveryFrom: message.from },
-    },
-  };
-}
-
-/** Build the fully-resolved outbox row for a COMMAND timer's completion send. The body defaults from
- *  the command outcome when the timer configured none; the `scheduler`/`commandResult` blocks carry the
- *  result so the message is observably a settled background command (parity with legacy
- *  `fireScheduledCommandWake`). */
-function commandCompletionOutboxInput(
-  ctx: ModuleCtx,
-  timer: Timer,
-  message: z.output<typeof messageSpecSchema>,
-  run: number,
-  commandId: string | null,
-  result: CommandRunResult | undefined,
-): z.input<typeof relaySendSchema> {
-  const scheduler = { timerId: timer.id, correlationId: message.correlationId ?? `timer:${timer.id}`, run, ...(commandId ? { commandId } : {}) };
-  return {
-    id: ctx.rng.uuid(),
-    timerId: timer.id,
-    idempotencyKey: relaySendKey(message, timer.id, run),
-    status: "pending",
-    from: message.from,
-    to: message.to,
-    ...(message.kind ? { kind: message.kind } : {}),
-    ...(message.channel ? { channel: message.channel } : {}),
-    ...(message.subject ? { subject: message.subject } : {}),
-    body: message.body ?? commandCompletionBody(result),
-    ...(message.claimable !== undefined ? { claimable: message.claimable } : {}),
-    payload: withScheduler(message.payload, { ...scheduler, command: result ?? null }),
-    meta: withScheduler(message.meta, scheduler),
-    identity: message.identity,
-    createdAt: ctx.clock.now(),
-  };
-}
-
-/** The firing workflow state. `commandId` is null until a command timer's `fire` step has issued its
- * P3 command; the `await` step reads it back to settle firing.
- *
- * `run` is the CRUX of P2-5's exactly-once (G3): the run number the CURRENT iteration fires under. It is
- * carried in the workflow state — which is memoized in the durable journal and reconstructed by the
- * fold — so a crash-recovery RE-DRIVE of a given run recomputes the SAME `run`, hence the SAME
- * `base:run:N` outbox dedup key, hence NO double-send. It is NOT a live counter: the `fire` step reads
- * `run` from folded state to stamp the send, and only the COMMITTED transition to the next `arm`
- * advances it to `run+1` for the next iteration. A one-shot timer simply never advances past run 1. */
-type FireState = {
-  id: string;
-  /** F is null for native/shadow workflows; authority generations carry exact F/G/R. */
-  fence: number | null;
-  generation: number;
-  fireAt: number;
-  commandId: string | null;
-  run: number;
-};
-
-/** The manifest handler receives the un-parameterized `ModuleCtx` (the manifest type is not yet
- * available at its own declaration site), so a module narrows its own entities/config here. */
-function timerStore(ctx: ModuleCtx): EntityStore<{ schema: typeof timerSchema }> {
-  return (ctx.entities as unknown as { readonly timer: EntityStore<{ schema: typeof timerSchema }> }).timer;
-}
-
-/** The relay-send outbox store (P2-3). Written by the firing steps in-tx; read/marked by the src drainer. */
-function relaySendStore(ctx: ModuleCtx): EntityStore<{ schema: typeof relaySendSchema }> {
-  return (ctx.entities as unknown as { readonly relaySend: EntityStore<{ schema: typeof relaySendSchema }> }).relaySend;
-}
-
-/** The per-timer apply-fence store (T-0 hardening). Read-checked + upserted by `migrate`/`cancelMirror`. */
-function applyFenceStore(ctx: ModuleCtx): EntityStore<{ schema: typeof applyFenceSchema }> {
-  return (ctx.entities as unknown as { readonly applyFence: EntityStore<{ schema: typeof applyFenceSchema }> }).applyFence;
-}
-
-/** Raise the durable fence to `fence` for `op` — a no-op at equality (same-intent re-drive). Runs in
- *  the op's atomic commit: a concurrent raced write aborts the WHOLE op via the flush CAS/PK conflict,
- *  so the fence can never regress and a stale write can never slip past a newer one. */
-async function raiseApplyFence(
-  ctx: ModuleCtx,
-  gate: TimerApplyFence | undefined,
-  id: string,
-  fence: number,
-  op: "create" | "cancel",
-): Promise<void> {
-  const fences = applyFenceStore(ctx);
-  if (!gate) await fences.create({ id, fence, op, updatedAt: ctx.clock.now() });
-  else if (fence > gate.fence) await fences.update(id, { fence, op, updatedAt: ctx.clock.now() });
-}
-
-function timersConfig(ctx: ModuleCtx): TimersConfig {
-  return ctx.config as unknown as TimersConfig;
-}
-
-/**
- * Handle a FAILED fire at the TIMER-RUN level (SCOPE 3) — distinct from the M3 per-step retry. Bumps
- * `consecutiveFailures` on the entity (read fresh, so a re-drive after a rolled-back commit recomputes
- * the SAME count), and either reschedules the SAME run at `now + retryMs` (looping back to `arm`) or
- * disables the timer once `maxFailures` consecutive failures accumulate. The failure bookkeeping commits
- * atomically with the step's journal memo. The run number is NOT advanced — a retry re-fires under the
- * same `state.run`, so its eventual send keeps the same `base:run:N` key (parity with legacy, which
- * leaves `run_count` untouched on `recordScheduledTimerFailure`).
- */
-async function applyFireFailure(
-  ctx: ModuleCtx,
-  timer: Timer,
-  state: FireState,
-  now: number,
-  error: unknown,
-): Promise<StepResult<FireState>> {
-  const cfg = timersConfig(ctx);
-  const outcome = failureBackoff({
-    now,
-    consecutiveFailures: timer.consecutiveFailures,
-    retryMs: cfg.retryMs,
-    maxFailures: cfg.maxFailures,
-  });
-  const store = timerStore(ctx);
-  if (outcome.kind === "disable") {
-    await store.update(state.id, { status: "disabled", consecutiveFailures: outcome.failures, lastError: errMessage(error) });
-    return { state, next: "done" };
-  }
-  await store.update(state.id, { consecutiveFailures: outcome.failures, lastError: errMessage(error) });
-  return { state: { ...state, fireAt: outcome.nextFireAt }, next: "arm" };
-}
-
-export const timers = defineModule({
-  id: "timers",
-  title: "Timers & Schedules",
-  description: "Kernel-served timers pilot: durable message + command firing on the K7 workflow runtime.",
-  config: {
-    schema: configSchema,
-    env: {
-      maxTimers: "TIMERS_MAX_TIMERS",
-      minRecurringIntervalMs: "TIMERS_MIN_RECURRING_INTERVAL_MS",
-      retryMs: "TIMERS_RETRY_MS",
-      maxFailures: "TIMERS_MAX_FAILURES",
-    },
-    overridableAt: {
-      maxTimers: ["host"],
-      minRecurringIntervalMs: ["host"],
-      retryMs: ["host"],
-      maxFailures: ["host"],
-      defaultLabel: ["instance", "host"],
-    },
-  },
-  entities: {
-    timer: {
-      schema: timerSchema,
-      // `createdBy` is indexed so the per-creator ownership filter (C2) on list/cancel/get is a keyed
-      // lookup, not a scan; `status` backs the active-quota count + status filter.
-      indexes: ["status", "createdBy"],
-    },
-    // The relay-dispatch transactional outbox (P2-3). A firing step writes one `pending` row IN its
-    // atomic step-commit (journal-atomic exactly-once on the send DECISION); the src drainer scans
-    // `pending` rows, calls `sendMessageService`, and flips them `sent`. `status` is indexed so the
-    // drainer's pending scan is a keyed lookup, not a table scan.
-    relaySend: {
-      schema: relaySendSchema,
-      indexes: ["status"],
-    },
-    // The per-timer durable last-applied-fence / tombstone record for the T-0 ingress apply seam
-    // (see `applyFenceSchema`). Point-read by id only — no secondary indexes.
-    applyFence: {
-      schema: applyFenceSchema,
-    },
-  },
-  events: {
-    "timers.created": z.object({ id: z.string(), label: z.string(), fireAt: z.number().int() }),
-    "timers.fired": z.object({ id: z.string(), firedAt: z.number().int(), run: z.number().int() }),
-    "timers.cancelled": z.object({ id: z.string() }),
-  },
-  commands: {
-    // The durable P3 shell command a command timer fires. The relay process NEVER execs — this
-    // dispatches onto the orchestrator command bus (src `dispatchCommand`), which the runner claims
-    // and runs as `bash -lc` at `cwd`, cwd-pinned + cgroup-reaped + timeout-bounded (the pre-existing
-    // legacy exec surface; the kernel neither moves nor widens it). `grant:"command:run-command"`
-    // maps src-side to — and never widens beyond — the legacy `command:write` + cwd-constrained authz
-    // (`dispatchCommand`'s #968 gate). `idempotencyKey` is the TIMER ID: a re-driven `fire` step
-    // dedupes onto the same command instead of double-dispatching (exactly-once boundary, #1408).
-    "run-command": {
-      input: z.object({
-        timerId: z.string().min(1),
-        command: z.string().min(1),
-        cwd: z.string().min(1),
-        env: z.record(z.string(), z.string()).optional(),
-        timeoutMs: z.number().int().positive(),
-        orchestratorId: z.string().min(1),
-        identity: frozenIdentitySchema,
-      }),
-      result: z.object({
-        exitCode: z.number().nullable(),
-        timedOut: z.boolean(),
-        stdoutTail: z.string(),
-        stderrTail: z.string(),
-      }),
-      target: "runner",
-      grant: "command:run-command",
-      idempotencyKey: (input) => input.timerId,
-      // Static declared ceiling (≤ 24h, matching the legacy COMMAND_MAX_MS). The ACTUAL per-run exec
-      // timeout rides in `input.timeoutMs`; this is the coarse manifest-level bound.
-      timeoutMs: 24 * 60 * 60 * 1000,
-      whenDegraded: "queue",
-    },
-  },
-  workflows: {
-    // Durable firing for a single timer — a LOOPING workflow (P2-5). `create` starts it with the timer
-    // id + fireAt + run 1.
-    //   arm  → parks the instance `sleeping` until the absolute `fireAt` (in state), never a setTimeout.
-    //   fire → on the wakeup pass at/after fireAt, reads the timer and — only if still `scheduled`:
-    //          • past its `expiresAt` → disables WITHOUT firing (legacy expiry-before-delivery).
-    //          • a COMMAND timer issues its P3 `run-command` and parks `waiting` on it (→ `await`); a
-    //            dispatch ERROR is a timer-run failure → backoff/disable (SCOPE 3). Command timers are
-    //            NEVER recurring (legacy parity), so they always settle to `done` via `await`.
-    //          • a MESSAGE/plain timer flips status + emits `timers.fired` (+ writes the P2-3 outbox
-    //            row) in ONE atomic step commit, then — if it is a RECURRING interval still under
-    //            `maxRuns`/`expiresAt` — loops back to `arm` with the NEXT deadline and run number `N+1`;
-    //            otherwise it disables (terminal `fired`).
-    // Cancel-safe + idempotent by construction: the timer entity is the source of truth, so a timer
-    // cancelled (or already terminal) before a deadline simply no-ops when its firing workflow wakes.
-    //
-    // G3 (exactly-once): the run number `N` a fire dispatches under is `state.run` — carried in the
-    // DURABLE workflow state (memoized in the journal, reconstructed by the fold), NOT a live counter.
-    // A re-drive of run N recomputes the SAME N (its `arm` memo pins `state.run` before `fire` re-runs),
-    // so the `base:run:N` outbox dedup holds → no double-send. A fresh run only ever gets `N` from the
-    // PREVIOUS fire's COMMITTED transition to `run+1`, so distinct committed runs get distinct N.
-    fire: {
-      // `initialRun` (optional, default 1) is the run number the FIRST fire dispatches under. The
-      // create path never supplies it (→ run 1, unchanged behavior). The P2-6 migrate-at-cutover op
-      // seeds it to `legacyRunCount + 1` so a mid-stream recurring timer's kernel run numbering
-      // CONTINUES the legacy sequence instead of restarting at 1 — that alignment is what makes the
-      // §4.2 dual-read `base:run:N` dedup hold for a migrated recurring timer during the bake window.
-      input: z.object({
-        id: z.string(),
-        fireAt: z.number().int(),
-        initialRun: z.number().int().positive().optional(),
-        fence: z.number().int().nonnegative().nullable().optional(),
-        generation: z.number().int().nonnegative().optional(),
-        run: z.number().int().positive().optional(),
-      }),
-      state: z.object({
-        id: z.string(),
-        fence: z.number().int().nonnegative().nullable(),
-        generation: z.number().int().nonnegative(),
-        fireAt: z.number().int(),
-        commandId: z.string().nullable(),
-        run: z.number().int().positive(),
-      }),
-      init: (input) => ({
-        id: input.id,
-        fence: input.fence ?? null,
-        generation: input.generation ?? 0,
-        fireAt: input.fireAt,
-        commandId: null,
-        run: input.run ?? input.initialRun ?? 1,
-      }),
-      start: "arm",
-      steps: {
-        arm: {
-          run: async (_ctx, state: FireState): Promise<StepResult<FireState>> => {
-            // Deterministic: the deadline comes from state (the current run's fireAt), never the clock.
-            return { state, next: "fire", sleepUntil: state.fireAt };
-          },
-        },
-        fire: {
-          run: async (ctx, state: FireState): Promise<StepResult<FireState>> => {
-            const store = timerStore(ctx);
-            const timer = await store.get(state.id);
-            // Cancelled or already terminal before the deadline: no-op (cancel-safe firing).
-            if (!timer || timer.status !== "scheduled") return { state, next: "done" };
-            const now = ctx.clock.now();
-            // Expiry-before-delivery (legacy `fireClaimedTimer`): a timer past its expiry disables WITHOUT
-            // firing this run — no flip to `fired`, no event, no send.
-            if (timer.expiresAt !== undefined && timer.expiresAt <= now) {
-              await store.update(state.id, { status: "disabled", lastError: "timer expired before delivery" });
-              if (state.fence !== null) {
-                if (!timer.message) throw new TypeError("authority workflow requires a pure MESSAGE timer");
-                ctx.messageAuthority.decideFire({
-                  timer: { timerId: timer.id, message: timer.message },
-                  fence: state.fence,
-                  generation: state.generation,
-                  run: state.run,
-                  engine: "kernel",
-                  decision: "expired",
-                  fireAt: state.fireAt,
-                  lifecycle: "disabled",
-                  nextRun: null,
-                  nextRunAt: null,
-                  decidedAt: now,
-                  sendPayload: null,
-                  idempotencyKey: null,
-                });
-              }
-              return { state, next: "done" };
-            }
-            if (timer.command) {
-              // Command timer: dispatch the authz-gated P3 command and park on its terminal status. The
-              // issue is idempotency-keyed on the timer id (see the decl), so a crash-and-re-drive of THIS
-              // step dedupes onto the same orchestrator command — never a second dispatch. A dispatch
-              // ERROR is a TIMER-RUN failure (distinct from M3 per-step retry): back off + disable after
-              // `maxFailures` (SCOPE 3), rather than terminating the whole firing workflow.
-              let run: HostCommandRun;
-              try {
-                run = await ctx.commands.issue(
-                  "run-command",
-                  {
-                    timerId: timer.id,
-                    command: timer.command.command,
-                    cwd: timer.command.cwd,
-                    ...(timer.command.env ? { env: timer.command.env } : {}),
-                    timeoutMs: timer.command.timeoutMs,
-                    orchestratorId: timer.command.orchestratorId,
-                    identity: timer.command.identity,
-                  },
-                  { host: timer.command.orchestratorId },
-                );
-              } catch (error) {
-                return applyFireFailure(ctx, timer, state, now, error);
-              }
-              // A successful dispatch clears any prior failure streak (parity: success resets it).
-              if (timer.consecutiveFailures > 0) {
-                await store.update(state.id, { consecutiveFailures: 0, lastError: undefined });
-              }
-              return { state: { ...state, commandId: run.id }, next: "await", waitFor: { kind: "command", commandId: run.id } };
-            }
-            // Message/plain timer: decide the recurring continuation from DURABLE state (this run number
-            // = runs completed once it lands), then flip + emit AND — if it carries a resolved send —
-            // write the relay-dispatch outbox row (P2-3), all in ONE atomic step commit. The outbox
-            // `create` buffers into the same K4 session `commitStepAttempt` flushes with the journal memo,
-            // so the DECISION to send is journal-atomic exactly-once: a fault between the step effects and
-            // the commit rolls the whole tx back (no flip, no event, NO outbox row, NO run advance); a
-            // re-drive re-runs THIS run (same `state.run`) atomically. The src drainer performs the actual
-            // send, deduped effectively-once by `base:run:N`.
-            const cont = recurringContinuation({
-              everyMs: timer.everyMs,
-              now,
-              prevFireAt: state.fireAt,
-              runsCompleted: state.run,
-              maxRuns: timer.maxRuns,
-              expiresAt: timer.expiresAt,
-            });
-            await store.update(state.id, {
-              status: cont.kind === "terminal" ? "fired" : "scheduled",
-              ...(cont.kind === "continue" ? { fireAt: cont.nextFireAt } : {}),
-              runCount: state.run,
-              consecutiveFailures: 0,
-              lastError: undefined,
-            });
-            await ctx.events.emit("timers.fired", { id: state.id, firedAt: now, run: state.run });
-            if (timer.message) {
-              if (state.fence === null) {
-                await relaySendStore(ctx).create(messageOutboxInput(ctx, timer, timer.message, state.run));
-              } else {
-                const send = authoritySendPayload(timer, timer.message, state.run);
-                ctx.messageAuthority.decideFire({
-                  timer: { timerId: timer.id, message: timer.message },
-                  fence: state.fence,
-                  generation: state.generation,
-                  run: state.run,
-                  engine: "kernel",
-                  decision: "dispatch",
-                  fireAt: state.fireAt,
-                  lifecycle: cont.kind === "continue" ? "scheduled" : "fired",
-                  nextRun: cont.kind === "continue" ? cont.nextRun : null,
-                  nextRunAt: cont.kind === "continue" ? cont.nextFireAt : null,
-                  decidedAt: now,
-                  sendPayload: send.sendPayload,
-                  idempotencyKey: send.idempotencyKey,
-                });
-              }
-            }
-            // Recurring: loop back to `arm` with the next deadline + the NEXT run number. The advance to
-            // `run+1` is only durable once THIS transition commits, so a re-drive of this run never sees it.
-            if (cont.kind === "continue") {
-              return { state: { ...state, fireAt: cont.nextFireAt, run: cont.nextRun }, next: "arm" };
-            }
-            return { state, next: "done" };
-          },
-        },
-        await: {
-          run: async (ctx, state: FireState): Promise<StepResult<FireState>> => {
-            // Reached only by a command timer (never recurring), once the wait evaluator reports terminal.
-            const store = timerStore(ctx);
-            const timer = await store.get(state.id);
-            // Still cancel-safe: a cancel between issue and settle → no fired flip, no event, no send.
-            if (timer && timer.status === "scheduled") {
-              await store.update(state.id, { status: "fired", runCount: state.run });
-              await ctx.events.emit("timers.fired", { id: state.id, firedAt: ctx.clock.now(), run: state.run });
-              // P2-3 (completion seam now CLOSED): if the command timer carries a completion send, write
-              // its outbox row IN this same atomic commit. The command result ({exitCode, timedOut,
-              // stdoutTail, stderrTail}) is durable and read back via `ctx.commands.status(commandId)`;
-              // the completion body/payload compose from it. Same journal-atomic exactly-once guarantee
-              // as the message path — the outbox row commits with the fired flip + event or not at all.
-              if (timer.message) {
-                const run = state.commandId ? await ctx.commands.status(state.commandId) : undefined;
-                const result = run?.result as CommandRunResult | undefined;
-                await relaySendStore(ctx).create(
-                  commandCompletionOutboxInput(ctx, timer, timer.message, state.run, state.commandId, result),
-                );
-              }
-            }
-            return { state, next: "done", output: { id: state.id, commandId: state.commandId } };
-          },
-        },
-      },
-    },
-  },
-  ops: {
-    create: {
-      kind: "mutation",
-      idempotent: false,
-      grant: "timers:write",
-      summary: "Create a scheduled timer.",
-      emits: ["timers.created"],
-      http: { method: "POST", path: "/timers" },
-      // `command` (optional) makes this a COMMAND timer (see the module header + `run-command` decl).
-      // `message` (optional) makes firing dispatch a Relay message via the P2-3 outbox: on a plain
-      // timer it is the whole effect; on a command timer it is the completion send. Both freeze a
-      // server-resolved identity the drainer fires under.
-      // P2-4 (C2 residual #1): the create input carries NO client-owned frozen identity — the op
-      // SERVER-RESOLVES it from the authenticated principal (`ctx.principal`) + the token's real cwd
-      // constraint. A client cannot name/broaden its own authority; the fire-time reconstruction binds
-      // the command cwd to the creator's REAL constraint via `dispatchCommand`'s #968 gate (R1).
-      // `everyMs` (optional) makes this a RECURRING interval timer (P2-5): firing loops arm→fire→arm,
-      // rescheduling `fireAt` deterministically. `maxRuns`/`expiresAt` bound it. Command timers may NOT
-      // be recurring; a recurring timer needs a bound (`maxRuns`/`expiresAt`) or the persistent grant.
-      input: z.object({
-        label: z.string().min(1).optional(),
-        fireAt: z.number().int(),
-        everyMs: z.number().int().positive().optional(),
-        maxRuns: z.number().int().positive().optional(),
-        expiresAt: z.number().int().optional(),
-        command: commandRequestSchema.optional(),
-        message: messageRequestSchema.optional(),
-      }),
-      output: timerSchema,
-      handler: async (ctx, input) => {
-        const cfg = timersConfig(ctx);
-        const now = ctx.clock.now();
-        const createdBy = ctx.principal.actor;
-
-        // Quota / limit re-expression (C2 threat 3), so the kernel path can't be used to evade the
-        // legacy scheduler's DoS ceilings:
-        //  • afterMs ≤ 24h  → the timer may not be scheduled further than `maxFireAheadMs` ahead.
-        if (input.fireAt > now + cfg.maxFireAheadMs) {
-          throw new OpError("invalid_input", 400, `fireAt is more than ${cfg.maxFireAheadMs}ms ahead of now`);
-        }
-
-        // SCOPE 4 — recurring/interval validation parity (legacy `scheduleTimer`):
-        //  • command timers may NOT be recurring;
-        //  • `everyMs >= minRecurringIntervalMs`;
-        //  • a recurring timer needs a bound (`maxRuns`/`expiresAt`) OR the persistent grant;
-        //  • `expiresAt` (any timer) must be after the first run.
-        if (input.everyMs !== undefined) {
-          if (input.command) {
-            throw new OpError("invalid_input", 400, "everyMs is not supported with command timers");
-          }
-          if (input.everyMs < cfg.minRecurringIntervalMs) {
-            throw new OpError("invalid_input", 400, `everyMs must be at least ${cfg.minRecurringIntervalMs}`);
-          }
-          if (input.maxRuns === undefined && input.expiresAt === undefined && !canCreatePersistentTimer(ctx)) {
-            throw new OpError("unauthorized", 403, "recurring timers require maxRuns, expiresAt, or the schedule:persistent grant");
-          }
-        }
-        if (input.expiresAt !== undefined && input.expiresAt <= input.fireAt) {
-          throw new OpError("invalid_input", 400, "expiresAt must be after the first run");
-        }
-
-        //  • SCHEDULER_MAX_ACTIVE_TIMERS per creator → count this creator's active (scheduled) timers.
-        //    The entity page caps at 200; `min` keeps the count within it (the default quota is 100).
-        const active = await timerStore(ctx).list({ where: { status: "scheduled", createdBy }, limit: Math.min(cfg.maxTimers, 200) });
-        if (active.items.length >= cfg.maxTimers) {
-          throw new OpError("quota_exceeded", 429, `active timer quota exceeded (${cfg.maxTimers})`);
-        }
-
-        // SCOPE 1 — server-resolve + FREEZE the command-timer identity from the authenticated principal.
-        // A command timer additionally requires the `command:write` grant AND a cwd-constrained creator
-        // identity at create (mirroring legacy `normalizeScheduleCommand` + `assertScheduleCommandAuthorized`),
-        // so an unconstrained / non-command-write caller cannot create a command timer AT ALL.
-        const command = input.command ? freezeCommandTimer(ctx, input.command, createdBy, now) : undefined;
-
-        // The timer id is generated up-front so the frozen message can carry the `timer:<id>`
-        // correlation id (D1) — byte-parity with legacy `insertScheduledTimer`, which derives the same.
-        const id = ctx.rng.uuid();
-
-        // SCOPE 1 (P2-3) — server-resolve + FREEZE the relay-send spec. A pure message timer REQUIRES a
-        // body; a command timer's completion body may be omitted (it defaults from the command outcome).
-        const message = input.message
-          ? freezeMessageTimer(ctx, input.message, createdBy, now, /*requireBody*/ !command, `timer:${id}`)
-          : undefined;
-
-        const label = input.label ?? cfg.defaultLabel;
-        const created = await timerStore(ctx).create({
-          id,
-          label,
-          createdBy,
-          fireAt: input.fireAt,
-          ...(input.everyMs !== undefined ? { everyMs: input.everyMs } : {}),
-          ...(input.maxRuns !== undefined ? { maxRuns: input.maxRuns } : {}),
-          ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
-          ...(command ? { command } : {}),
-          ...(message ? { message } : {}),
-        });
-        await ctx.events.emit("timers.created", { id, label, fireAt: input.fireAt });
-        // Enqueue durable firing, ENLISTED in this op's atomic commit (T-0 #1409 finding 1): the
-        // instance seed executes INSIDE the same transaction as the entity + event flush, so the
-        // timer and its firing workflow commit together or not at all — an op that rolls back
-        // (validation failure, version conflict) leaves NO orphaned instance keyed to this id for
-        // any later create/migrate of the same id to dedupe onto. The drive runs after the commit;
-        // a crash before it leaves a durable `pending` instance the recovery pass converges.
-        // Idempotency key = timer id, so a retried create dedupes onto the same instance.
-        await ctx.workflows.start("fire", { id, fireAt: input.fireAt }, { idempotencyKey: id, enlist: "op-commit" });
-        return created;
-      },
-    },
-    get: {
-      kind: "query",
-      grant: "timers:read",
-      summary: "Fetch a timer by id.",
-      http: { method: "GET", path: "/timers/{id}" },
-      input: z.object({ id: z.string() }),
-      output: timerSchema,
-      handler: async (ctx, input) => {
-        const timer = await timerStore(ctx).get(input.id);
-        // Per-creator ownership (C2): a non-admin principal cannot even OBSERVE another creator's timer.
-        // Report the same 404 as a genuinely-missing id, so a non-owner cannot probe existence.
-        const owner = creatorFilter(ctx);
-        if (!timer || (owner && timer.createdBy !== owner.createdBy)) {
-          throw new OpError("not_found", 404, `timer '${input.id}' was not found`);
-        }
-        return timer;
-      },
-    },
-    list: {
-      kind: "query",
-      grant: "timers:read",
-      summary: "List timers, optionally filtered by status.",
-      http: { method: "GET", path: "/timers" },
-      input: z.object({
-        status: statusSchema.optional(),
-        // Coerced: over HTTP this arrives as a query-string value; in-process callers may still
-        // pass a number. `z.coerce.number` accepts both, so the transport stays type-agnostic.
-        limit: z.coerce.number().int().min(1).max(200).optional(),
-        cursor: z.string().optional(),
-      }),
-      output: z.object({ items: z.array(timerSchema), cursor: z.string().optional() }),
-      handler: async (ctx, input) => {
-        // Per-creator ownership (C2): a non-admin principal only ever sees its OWN timers — the op
-        // applies a `where: {createdBy}` filter from `ctx.principal.actor`; an admin (system:admin)
-        // crosses creators. Merged with the optional status filter.
-        const where = { ...creatorFilter(ctx), ...(input.status ? { status: input.status } : {}) };
-        const page = await timerStore(ctx).list({
-          limit: input.limit,
-          cursor: input.cursor,
-          ...(Object.keys(where).length ? { where } : {}),
-        });
-        return { items: [...page.items], ...(page.cursor ? { cursor: page.cursor } : {}) };
-      },
-    },
-    cancel: {
-      kind: "mutation",
-      idempotent: true,
-      grant: "timers:write",
-      summary: "Cancel a scheduled timer.",
-      emits: ["timers.cancelled"],
-      http: { method: "DELETE", path: "/timers/{id}" },
-      input: z.object({ id: z.string() }),
-      output: timerSchema,
-      handler: async (ctx, input) => {
-        const store = timerStore(ctx);
-        const timer = await store.get(input.id);
-        // Per-creator ownership (C2): a non-admin principal cannot cancel another creator's timer, and
-        // gets the SAME 404 a missing id yields (no existence disclosure). Admin (system:admin) crosses.
-        const owner = creatorFilter(ctx);
-        if (!timer || (owner && timer.createdBy !== owner.createdBy)) {
-          throw new OpError("not_found", 404, `timer '${input.id}' was not found`);
-        }
-        // Idempotent: a repeat cancel is a no-op that emits nothing and mutates nothing.
-        if (timer.status === "cancelled") return timer;
-        const cancelled = await store.update(input.id, { status: "cancelled" });
-        await ctx.events.emit("timers.cancelled", { id: input.id });
-        return cancelled;
-      },
-    },
-    // ── P2-6 migrate-at-cutover surface (SYSTEM-only; the src migration script invokes this) ───────
-    // The one-time forward migration (§4.2, RATIFIED disjoint-tables model) copies an ACTIVE legacy
-    // `scheduled_timers` row into the kernel timer entity + enqueues its `fire` workflow. Like the drain
-    // ops it is drainer-only (`timers:admin`) and never exposed over any transport, so it lands as a
-    // prod no-op until the cutover script runs it. The src side (`kernel-timers-migrate.ts`) owns the
-    // legacy→kernel field mapping; this op just faithfully UPSERTS the resolved entity.
-    //
-    // IDEMPOTENT (the crux, keyed on the LEGACY timer id): the kernel timer id IS the legacy id, so a
-    // re-run finds the entity already present and does NOT create a duplicate. It ALWAYS (re-)starts the
-    // fire workflow with `idempotencyKey = id`, which the runtime dedupes onto the existing instance —
-    // so a crash BETWEEN the entity create and the workflow start converges on re-run (the entity is
-    // there, the still-missing instance gets started). Safe to re-run / resume after a crash.
-    //
-    // FENCED (T-0 hardening, #1409): an optional `fence` (the caller's ingress seq) makes the write
-    // refuse when stale — `fence <` the per-timer `applyFence` record (e.g. a cancel tombstone) returns
-    // `{fenced: true}` with NO entity write, NO workflow start, NO event. Equal fence = same-intent
-    // re-drive, proceeds idempotently. And when the staleness is only discovered AT FLUSH (both ops
-    // read the old fence; the other committed first), the lost CAS aborts the WHOLE commit — including
-    // the enlisted workflow seed — so the losing migrate leaves nothing at all behind (second-pass
-    // hardening, T1175). See `applyFenceSchema` for the full contract.
-    //
-    // SECURITY (server-trusted snapshot — sidesteps G1's client-input concern): `command.identity` /
-    // `message.identity` here are the LEGACY row's PERSISTED create-time identity (the server-resolved
-    // snapshot `insertScheduledTimer` froze), carried verbatim — NOT client input at migrate time. So no
-    // creator-facing re-validation (quota / persistent-grant / cwd-constraint) runs: those gated the
-    // legacy row at ITS create, and this copies that already-trusted state. The fire-time #968 cwd gate
-    // still binds a command's cwd to `command.identity` exactly as for a natively-created kernel timer.
-    migrate: {
-      kind: "mutation",
-      idempotent: true,
-      grant: TIMERS_DRAIN_GRANT,
-      summary: "Forward-migrate one active legacy timer into the kernel entity + enqueue firing (P2-6; system-only).",
-      emits: ["timers.created"],
-      expose: { http: false, mcp: false, cli: false },
-      input: z.object({
-        id: z.string().min(1),
-        label: z.string().min(1),
-        createdBy: z.string().min(1),
-        fireAt: z.number().int(),
-        everyMs: z.number().int().positive().optional(),
-        maxRuns: z.number().int().positive().optional(),
-        expiresAt: z.number().int().optional(),
-        // Runs the legacy timer already COMPLETED. The kernel entity carries it as its projection and
-        // the fire workflow starts at `runCount + 1`, so the migrated timer's next run number CONTINUES
-        // the legacy sequence (dual-read dedup parity for recurring timers).
-        runCount: z.number().int().nonnegative().default(0),
-        // Failure-backoff state must SURVIVE migration (#1409): a legacy timer mid-backoff (e.g. 2 of 3
-        // consecutive failures) migrates with its streak intact, so the kernel keeps disabling it after
-        // `maxFailures` rather than resetting to 0 and re-granting it a full retry budget.
-        consecutiveFailures: z.number().int().nonnegative().default(0),
-        lastError: z.string().optional(),
-        command: commandSpecSchema.optional(),
-        message: messageSpecSchema.optional(),
-        // T-0 apply fence (#1409 hardening): the caller's ingress seq. When present, a stale write
-        // (fence < the stored per-timer fence) is REFUSED before any effect — see `applyFenceSchema`.
-        fence: z.number().int().positive().optional(),
-        // Stage 5 authority snapshot. These are supplied together only when a real authority row
-        // exists; shadow/fence-only ingress intentionally omits them and retains its old workflow.
-        generation: z.number().int().nonnegative().optional(),
-        run: z.number().int().positive().optional(),
-      }),
-      output: z.object({ timer: timerSchema.optional(), created: z.boolean(), fenced: z.boolean() }),
-      handler: async (ctx, input) => {
-        const authorityApply = input.generation !== undefined || input.run !== undefined;
-        if (authorityApply && (input.fence === undefined || input.generation === undefined || input.run === undefined || !input.message || input.command)) {
-          throw new OpError("invalid_input", 400, "authority migrate requires a pure MESSAGE timer with exact fence/generation/run");
-        }
-        // Fence check FIRST — before the entity write AND before the workflow start (which commits in
-        // its own transaction): a stale fenced migrate must have NO effect at all. The read-check is
-        // raced-safe because the fence upsert below flushes in this op's atomic commit (CAS-guarded);
-        // a loser aborts wholesale and its retry re-reads the newer fence here.
-        const gate = input.fence !== undefined ? await applyFenceStore(ctx).get(input.id) : undefined;
-        if (input.fence !== undefined && gate !== undefined && input.fence < gate.fence) {
-          return { created: false, fenced: true };
-        }
-        const store = timerStore(ctx);
-        const existing = await store.get(input.id);
-        let timer = existing;
-        const created = existing === undefined;
-        if (!existing) {
-          timer = await store.create({
-            id: input.id,
-            label: input.label,
-            createdBy: input.createdBy,
-            fireAt: input.fireAt,
-            runCount: input.runCount,
-            consecutiveFailures: input.consecutiveFailures,
-            ...(input.lastError !== undefined ? { lastError: input.lastError } : {}),
-            ...(input.everyMs !== undefined ? { everyMs: input.everyMs } : {}),
-            ...(input.maxRuns !== undefined ? { maxRuns: input.maxRuns } : {}),
-            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
-            ...(input.command ? { command: input.command } : {}),
-            ...(input.message ? { message: input.message } : {}),
-          });
-          await ctx.events.emit("timers.created", { id: input.id, label: input.label, fireAt: input.fireAt });
-        } else if (input.fence !== undefined && (gate === undefined || input.fence > gate.fence)) {
-          // Higher-F apply is convergence, not create-only mirroring. Write every timer field,
-          // including explicit undefined values that clear fields removed by the new intent.
-          timer = await store.update(input.id, {
-            label: input.label,
-            createdBy: input.createdBy,
-            fireAt: input.fireAt,
-            status: "scheduled",
-            everyMs: input.everyMs,
-            maxRuns: input.maxRuns,
-            expiresAt: input.expiresAt,
-            runCount: input.runCount,
-            consecutiveFailures: input.consecutiveFailures,
-            lastError: input.lastError,
-            command: input.command,
-            message: input.message,
-          });
-        }
-        // ALWAYS (re-)enqueue firing, idempotently AND — the T-0 #1409 finding-1 crux — ENLISTED in
-        // this op's atomic commit: the instance seed executes INSIDE the same transaction that
-        // flushes the entity and the applyFence CAS below. A migrate that read a stale fence and
-        // LOSES that CAS at flush (a concurrent newer cancel/create committed first) therefore
-        // rolls back the workflow seed WITH the entity and the fence — a fence-losing migrate
-        // commits NOTHING: no entity, no event, no fence write, no instance. That closes the
-        // orphaned-workflow adoption hole: an instance keyed `idempotencyKey = id` can only exist
-        // if the op that seeded it COMMITTED, i.e. its entity + fence exist at that fence — so a
-        // later create can never dedupe onto a rolled-back migrate's workflow and fire at a stale
-        // deadline. The drive runs post-commit; a crash before it leaves a durable `pending`
-        // instance which the ingress re-drive (equal fence, idempotent) or `recover()` converges.
-        // The first run number continues the legacy sequence (`runCount + 1`); the workflow input
-        // is validated EAGERLY at this call (typed `invalid_input` on failure — finding 2), so a
-        // deterministically-rejectable row aborts here before anything is buffered.
-        await ctx.workflows.start(
-          "fire",
-          authorityApply
-            ? { id: input.id, fence: input.fence!, generation: input.generation!, fireAt: input.fireAt, run: input.run! }
-            : { id: input.id, fireAt: input.fireAt, initialRun: input.runCount + 1 },
-          {
-            idempotencyKey: authorityApply ? `${input.id}:generation:${input.generation}` : input.id,
-            enlist: "op-commit",
-          },
-        );
-        if (input.fence !== undefined) {
-          await raiseApplyFence(ctx, gate, input.id, input.fence, "create");
-          if (authorityApply) {
-            ctx.messageAuthority.applyFence({
-              timer: { timerId: input.id, message: input.message! },
-              fence: input.fence,
-              updatedAt: ctx.clock.now(),
-            });
-          }
-        }
-        return { timer: timer!, created, fenced: false };
-      },
-    },
-    // ── P2-7 live CANCEL ingress (#1414; SYSTEM-only) — the `migrate` (create) counterpart ─────────
-    // When a legacy timer is CANCELLED via the legacy path (`cancelTimer`), the src ingress mirrors that
-    // cancel into the kernel so the kernel copy STOPS firing — otherwise the mirror stays `scheduled` and
-    // keeps firing autonomously until it independently hits `maxRuns`/`expiresAt` (the #1414 phantom-fire).
-    // Like `migrate`/the drain ops it is drainer-only (`timers:admin`) and never exposed over any transport
-    // (`expose` all false): the ordinary creator-facing `cancel` op requires `timers:write` AND applies the
-    // C2 per-creator filter, so it cannot serve a cross-creator SYSTEM ingress. This op crosses creators by
-    // construction (system-trusted) — it is the src→kernel cancel seam, mirroring how `migrate` is the
-    // create seam.
-    //
-    // Only an ARMED (`scheduled`) timer transitions to `cancelled` (flipping the fire step's cancel-safe
-    // guard, which keys on `status === "scheduled"`). Idempotent + terminal-safe: an already-`cancelled`,
-    // `fired`, or `disabled` timer is a no-op (never resurrects a terminal row). A not-yet-mirrored id (a
-    // create-mirror miss, or a command timer the create-mirror deliberately skipped) never MANUFACTURES a
-    // kernel TIMER row — but a FENCED cancel of an absent entity DOES durably record its fence as the
-    // kernel TOMBSTONE (T-0 hardening), so a stale lower-fence create can never arm the timer afterwards.
-    // An unfenced absent-entity cancel stays a pure best-effort no-op (pre-activation seams).
-    cancelMirror: {
-      kind: "mutation",
-      idempotent: true,
-      grant: TIMERS_DRAIN_GRANT,
-      summary: "Cancel a migrated timer's kernel mirror when its legacy row is cancelled (P2-7; system-only).",
-      emits: ["timers.cancelled"],
-      expose: { http: false, mcp: false, cli: false },
-      input: z.object({
-        id: z.string().min(1),
-        // T-0 apply fence (#1409 hardening): the caller's ingress seq — see `migrate` and `applyFenceSchema`.
-        fence: z.number().int().positive().optional(),
-      }),
-      output: z.object({ cancelled: z.boolean(), fenced: z.boolean() }),
-      handler: async (ctx, input) => {
-        // Stale-fence refusal first (same contract as `migrate`): a cancel that lost to a NEWER applied
-        // intent must not touch the entity nor regress the fence.
-        const gate = input.fence !== undefined ? await applyFenceStore(ctx).get(input.id) : undefined;
-        if (input.fence !== undefined && gate !== undefined && input.fence < gate.fence) {
-          return { cancelled: false, fenced: true };
-        }
-        const store = timerStore(ctx);
-        const timer = await store.get(input.id);
-        if (!timer) {
-          // ABSENT entity: the fenced cancel's fence row IS the durable kernel tombstone — the whole
-          // point of the T-0 hardening (an absent-entity cancel must NOT be a silent no-op).
-          if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
-          return { cancelled: false, fenced: false };
-        }
-        if (timer.status !== "scheduled") {
-          if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
-          return { cancelled: false, fenced: false };
-        }
-        await store.update(input.id, { status: "cancelled" });
-        await ctx.events.emit("timers.cancelled", { id: input.id });
-        if (input.fence !== undefined) await raiseApplyFence(ctx, gate, input.id, input.fence, "cancel");
-        return { cancelled: true, fenced: false };
-      },
-    },
-    // ── P2-3 relay-outbox drain surface (SYSTEM-only; the src drainer invokes these) ───────────────
-    // The kernel emits the send INTENT (the in-tx outbox row); the src side performs the EFFECT. These
-    // two ops are the narrow, authz-gated seam it does that through — no `kernel/`→`src/` import, and no
-    // ad-hoc entity-store leak. They require the drainer-only `timers:admin` grant and are never exposed
-    // over any transport (`expose` all false), so an ordinary caller can neither read nor settle the
-    // outbox. Marking a row sent is idempotent, which is exactly what makes the at-least-once drain safe
-    // (a crash between `sendMessageService` returning and the mark landing re-drains + re-sends, deduped
-    // by `base:run:N`; the second mark is a no-op).
-    drainRelaySends: {
-      kind: "query",
-      grant: TIMERS_DRAIN_GRANT,
-      summary: "List pending relay-send outbox rows (P2-3 drainer; system-only).",
-      expose: { http: false, mcp: false, cli: false },
-      input: z.object({
-        limit: z.coerce.number().int().min(1).max(200).optional(),
-        cursor: z.string().optional(),
-      }),
-      output: z.object({ items: z.array(relaySendSchema), cursor: z.string().optional() }),
-      handler: async (ctx, input) => {
-        const page = await relaySendStore(ctx).list({
-          where: { status: "pending" },
-          ...(input.limit !== undefined ? { limit: input.limit } : {}),
-          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),
-        });
-        return { items: [...page.items], ...(page.cursor ? { cursor: page.cursor } : {}) };
-      },
-    },
-    markRelaySendSent: {
-      kind: "mutation",
-      idempotent: true,
-      grant: TIMERS_DRAIN_GRANT,
-      summary: "Mark a relay-send outbox row sent (P2-3 drainer; system-only).",
-      expose: { http: false, mcp: false, cli: false },
-      input: z.object({ id: z.string(), messageId: z.number().int().optional() }),
-      output: relaySendSchema,
-      handler: async (ctx, input) => {
-        const store = relaySendStore(ctx);
-        const row = await store.get(input.id);
-        if (!row) throw new OpError("not_found", 404, `relay send '${input.id}' was not found`);
-        // Idempotent: a re-mark (a re-drained row already settled, or a duplicate drain) is a no-op.
-        if (row.status === "sent") return row;
-        return store.update(input.id, {
-          status: "sent",
-          ...(input.messageId !== undefined ? { sentMessageId: input.messageId } : {}),
-        });
-      },
-    },
-  },
-});