@nylorun/runtime 0.21.0-beta → 0.21.1-beta

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.21.1-beta
+
+### Patch Changes
+
+- 070674d: **One source of truth for the manifest and Harness API schemas.**
+
+  - `@nylorun/core`: `Agent.from` (`agentFrom`) checks a manifest with `AgentManifestSchema`, the Runtime's own check, instead of a validator of its own, and refuses with `agent.build-failed` and the schema's messages (each prefixed with its path, such as `capabilities.0.tools.0.name: …`). It now refuses what the Runtime refuses at registration and it let through, such as unknown fields (it dropped them) or a tool or MCP server name that not every model provider accepts. The schema names a top-level `model` or `schemaVersion` and a capability's `model` as before, and the skill whose `files` are wrong (`Skill 'triage' files must include SKILL.md`). The rebuilt manifest is a frozen copy; the object passed in is no longer frozen. `AgentManifestSchema` and `WorkflowManifestSchema` are no longer force-cast to their types: the build checks that each accepts exactly `AgentManifest` and `WorkflowManifest`. `@nylorun/core/contracts` exports `McpServerManifestSchema`, `HEADER_NAME_PATTERN` and `LOOPBACK_HOSTS`. The Harness API's types (`@nylorun/core/harness-api`) are inferred from the schemas that validate its frames, so they match them: `TurnStart.manifest`, `TurnStart.checkpoint` and `RunRouting.rootManifest` are `object`, `WorkspaceCall.tool` is a sandbox tool name, `ABORT_REASONS` is a tuple, and properties are no longer `readonly` (arrays that were stay so).
+  - `@nylorun/harness`: `runDurable` checks the manifest once, when it rebuilds the agent, instead of twice. The unpublished, stale `schemas/manifest.schema.json` (manifest `schemaVersion` 2) is gone; `z.toJSONSchema(AgentManifestSchema)` is the manifest's JSON Schema.
+  - `@nylorun/agents`: a plugin's MCP servers are checked with core's `McpServerManifestSchema`, header-name pattern and loopback hosts. A server whose key is not a name every model provider accepts is skipped with a `plugin.mcp-server-skipped` warning, since the Runtime would refuse the manifest declaring it.
+  - `@nylorun/runtime`: the stack configuration reads its four listeners (`NYLORUN_LISTEN_*`, `NYLORUN_GATES_LISTEN_*`, `NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_EGRESS_LISTEN_*`) with one parser; the variables and their errors are unchanged.
+
+- 34d1a81: A commit can no longer lose its wake. A transaction that asks for an advance writes the wake to the Session Store's wake outbox (`Tx.wake`, migration `0017_wake_outbox` adds `nylorun.wakes`) and sends it to Durable Session Execution after commit, with an idempotency key (the wake's dedupe key, or one made from its row), deleting the row once Restate accepted it. A send that fails, or that a crash between the commit and the send cut off, is sent again by the Tenant sweep under the same key: on a process's first pass for any row, then for rows older than 2 s. Restate deduplicates the repeat, so a wake whose answer was lost runs one advance. The sweep's orphan scan no longer delivers lost wakes: it runs on a process's first pass and then once a minute, as the backstop for what the execution itself lost (Restate state wiped, an invocation killed, an in-process execution's queue). Restate owns when a session runs (wakes, one advance per session, retries, timers); the Session Store owns what happened (checkpoint, effect journal, events, the lease's epoch and the outbox), as `src/CONTEXT.md` and `adapters/execution/restate.ts` now describe. A Runtime of the previous beta refuses the migrated database (`schema-too-new`); while processes of both run, the old ones send wakes as before.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [417f336]
+- Updated dependencies [6fecd4c]
+- Updated dependencies [7780b2f]
+- Updated dependencies [070674d]
+- Updated dependencies
+  - @nylorun/core@0.18.0-beta
+  - @nylorun/harness@0.25.0-beta
+
 ## 0.21.0-beta
 
 ### Major Changes

package/README.md

@@ -42,8 +42,10 @@ whose key the admin key derives (the only derived key). Management keys come fro
 rotates and deletes the Tenant's application keys (`PUT /v1/tenant/keys/{keyId}`); a rotated
 or deleted key stops authenticating at once. A database written by a Runtime that kept several Tenants in one
 database (`tenant_<id>` schemas), or by a pre-release build of one Tenant per database
-(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time and holds the Tenant's sweep
-timer (Durable Session Execution); every session's events are relayed from the record to
+(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time, delivers its wakes and holds
+its timers and the Tenant's sweep (Durable Session Execution), and journals no effect:
+checkpoints, effects, events and the wake outbox are the Session Store's, and a wake is
+written to the outbox in the transaction that causes it, so a commit never loses it; every session's events are relayed from the record to
 its own S2 stream, which history and SSE read (Durable Streams). One image runs every **service**,
 and `--service` picks what a process runs: `core` serves the Runtime API, the
 Management API and SSE and runs the stream relay, `loop` runs advances (the Worker), and

package/dist/adapters/execution/restate.js

@@ -25,7 +25,32 @@
  *   What a run answers arms its timers and its retry.
  *
  * Wakes, sandbox reconciles, timers and sweep arming go through the ingress as one-way
- * sends, so an API node can call them without ever calling `start`.
+ * sends, so an API node can call them without ever calling `start`. A wake a commit asked for
+ * comes from the Session Store's wake outbox (`Tx.wake`) with an idempotency key, so a send
+ * repeated after its answer was lost causes no second advance.
+ *
+ * ## What Restate owns, and what the Session Store owns
+ *
+ * Restate owns when a session runs: it delivers each wake at least once, deduped by its
+ * key for `dedupeRetentionMs`; runs at most one invocation per key at a time; retries an
+ * invocation whose attempt failed, so an advance whose Worker died runs again and takes the
+ * session over (§11.4); and keeps every timer: the busy re-wake, `NylorunTimer`,
+ * `NylorunSandbox` and the `NylorunTenant` sweep chain. The Session Store (Postgres) owns
+ * what happened: the checkpoint, the effect journal (`harness-api/record.ts`), the events
+ * (the Record), and the wake outbox that hands each committed wake to Restate. Restate
+ * journals no effect: an effect's intent and outcome commit with the session's events in
+ * one transaction, under the advance's lease, and remote harnesses and pod engines write
+ * them too, over the Harness API.
+ *
+ * Two Session Store mechanisms overlap Restate on purpose:
+ *
+ * - **The lease and its epoch** (§10.6). Restate's one invocation per key holds for an
+ *   attempt, not for the code it started: an attempt that ends (abort timeout, a dropped
+ *   connection) is retried while the previous attempt's handler may still run on its Worker,
+ *   and a remote harness or pod engine may still hold the run. The epoch fences their writes,
+ *   and `busy` answers the overlap.
+ * - **The advance deadline** (`tenant/worker.ts`). Restate's abort timeout does not stop a
+ *   running handler, so the Worker bounds each advance itself, below `timeouts`.
  */
 import { createServer } from "node:http2";
 import * as restate from "@restatedev/restate-sdk";

package/dist/core/flow-host.d.ts

@@ -1,8 +1,7 @@
 import type { EffectOutcome } from "@nylorun/core/contracts";
 import { type JsonValue, type WorkflowManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { Wake } from "../execution/types.js";
-import type { EffectDoc, Tx } from "../store/types.js";
+import type { EffectDoc, Tx, WakeDelivery } from "../store/types.js";
 import { type FlowLimits } from "./limits.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export declare function deriveSessionId(workflowSessionId: string, path: string, ...parts: string[]): string;
@@ -99,7 +98,7 @@ export type CascadeCancelPlan = {
     readonly agentSessionIds: string[];
 };
 /** Wakes a session after commit (`DurableExecution.wake` through the Tenant context). */
-type Schedule = (sessionId: string, wake: Wake) => void | Promise<void>;
+type Schedule = WakeDelivery;
 /** Effect documents as the flow host writes them. */
 export type FlowEffect = EffectDoc & {
     agentSessionId?: string;

package/dist/core/flow-host.js

@@ -4,7 +4,8 @@
  * Every function that touches state takes the caller's transaction `t: Tx` and
  * is async. Nothing here publishes, notifies or schedules directly (seam rule
  * 1): events go through `t.event(...)`, which the store publishes after
- * commit, and wakes go through `t.afterCommit(() => schedule(id, wake))`. Functions
+ * commit, and wakes go through `t.wake(id, wake, schedule)`, the wake outbox, which
+ * calls `schedule` after commit. Functions
  * that rewrite a session-scoped document lock that session first with
  * `t.lockSession` (a no-op when the caller already holds it).
  *
@@ -35,8 +36,9 @@
  * - `foreignInteractionConflict({ t, workflowSessionId, interactionId }): Promise<{ status: 409; message; ownerSessionId } | undefined>`
  * - `wakeForQueuedEffects({ t, workflowSessionId, turnId, limits, schedule }): Promise<boolean>`
  *
- * `schedule: (sessionId, wake) => void | Promise<void>` runs after commit, never inside `t`;
- * `wake` carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key.
+ * `schedule` (a `WakeDelivery`, the Tenant's `ctx.wake`) runs after commit, never inside `t`;
+ * `wake` carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key. A
+ * wake `schedule` does not deliver stays in the outbox for the Tenant sweep (`Tx.wake`).
  *
  * An `agent` effect settles only from the linked turn it started. A linked agent session is
  * reused by every iteration of a Loop (its id derives from the workflow and the path), so its
@@ -138,8 +140,9 @@ export async function recordVerdict(t, request, value) {
         ...(verdict.data !== undefined ? { data: verdict.data } : {}),
     });
 }
-function scheduleAfterCommit(t, schedule, id, wake) {
-    t.afterCommit(() => schedule(id, wake));
+/** Writes the wake to the outbox; `schedule` delivers it after commit. */
+function requestWake(t, schedule, id, wake) {
+    return t.wake(id, wake, schedule);
 }
 /** Active agent turns + tool nodes in flight for one workflow turn. */
 export async function countActiveFlowWork(t, workflowSessionId, turnId) {
@@ -242,7 +245,7 @@ export async function wakeLinkedWorkflow(input) {
     await settleAgentEffect({ t, effect, outcome });
     workflow.status = "runnable";
     await t.put("sessions", workflow.id, workflow);
-    scheduleAfterCommit(t, input.schedule, workflow.id, {
+    await requestWake(t, input.schedule, workflow.id, {
         reason: "linked",
         dedupeKey: `linked:${link.turnId}:${link.effectId}`,
     });
@@ -471,7 +474,7 @@ export async function wakeForQueuedEffects(input) {
         workflow.status = "runnable";
         await t.put("sessions", workflow.id, workflow);
     }
-    scheduleAfterCommit(t, input.schedule, input.workflowSessionId, {
+    await requestWake(t, input.schedule, input.workflowSessionId, {
         reason: "flow",
     });
     return true;

package/dist/execution/types.d.ts

@@ -3,7 +3,10 @@
  *
  * Durable Session Execution decides when to look at a session again. It never
  * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). Restate is the supported implementation
+ * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
+ * key, retries, timers, the sweep chain); the Session Store owns the record (the
+ * checkpoint, the effect journal, the events) and the wake outbox that bridges the
+ * two. Restate is the supported implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -15,11 +18,14 @@
  *   Different keys may run concurrently.
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
- *   are sent after the Session Store transaction that caused them commits
- *   (`Tx.afterCommit`), never inside it.
+ *   are sent after the Session Store transaction that caused them commits, never
+ *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   wake is sent after commit, or by the Tenant sweep when that send failed or a
+ *   crash cut it off. A wake may therefore be sent more than once, always with the
+ *   same `dedupeKey`.
  * - **Dedupe.** Wakes carrying the same `dedupeKey` for the same key cause at
  *   most one advance for that cause (within the implementation's retention
- *   window, at least 24 hours for Restate).
+ *   window, at least 24 hours for Restate). Every wake from the outbox has one.
  * - **Busy re-wake.** An advance that returns `busy` is re-run for the same key
  *   after `retryAfterMs`.
  * - **Retries on infrastructure errors.** A handler that throws is retried with
@@ -27,7 +33,9 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
+ *   armed Tenant is a no-op. The sweep sends the outbox's undelivered wakes and,
+ *   as a backstop for what an implementation lost, re-wakes orphaned sessions
+ *   (`tenant/sweep.ts`).
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A

package/dist/execution/types.js

@@ -3,7 +3,10 @@
  *
  * Durable Session Execution decides when to look at a session again. It never
  * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). Restate is the supported implementation
+ * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
+ * key, retries, timers, the sweep chain); the Session Store owns the record (the
+ * checkpoint, the effect journal, the events) and the wake outbox that bridges the
+ * two. Restate is the supported implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -15,11 +18,14 @@
  *   Different keys may run concurrently.
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
- *   are sent after the Session Store transaction that caused them commits
- *   (`Tx.afterCommit`), never inside it.
+ *   are sent after the Session Store transaction that caused them commits, never
+ *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   wake is sent after commit, or by the Tenant sweep when that send failed or a
+ *   crash cut it off. A wake may therefore be sent more than once, always with the
+ *   same `dedupeKey`.
  * - **Dedupe.** Wakes carrying the same `dedupeKey` for the same key cause at
  *   most one advance for that cause (within the implementation's retention
- *   window, at least 24 hours for Restate).
+ *   window, at least 24 hours for Restate). Every wake from the outbox has one.
  * - **Busy re-wake.** An advance that returns `busy` is re-run for the same key
  *   after `retryAfterMs`.
  * - **Retries on infrastructure errors.** A handler that throws is retried with
@@ -27,7 +33,9 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
+ *   armed Tenant is a no-op. The sweep sends the outbox's undelivered wakes and,
+ *   as a backstop for what an implementation lost, re-wakes orphaned sessions
+ *   (`tenant/sweep.ts`).
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A

package/dist/host/create-host.d.ts

@@ -1,7 +1,7 @@
 import type { ResourceServerConfig } from "../tenant/resource-server.js";
 import type { Logger, TenantModule } from "../tenant/types.js";
 import type { HostConfigFile } from "./config.js";
-import type { ContainerListen } from "./stack-config.js";
+import { type ContainerListen } from "./stack-config.js";
 export interface CreateHostOptions {
     hostRoot: string;
     module: TenantModule;

package/dist/host/create-host.js

@@ -1,7 +1,8 @@
 import { createServer, } from "node:http";
 import { getRequestListener, RequestError } from "@hono/node-server";
 import { createHostApp } from "./app.js";
-import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, isLoopbackHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
+import { isLoopbackHost } from "./stack-config.js";
+import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
 export function createHost(options) {
     const { module, config, logger, coreVersion } = options;
     const pid = options.pid ?? process.pid;

package/dist/host/http.d.ts

@@ -54,4 +54,3 @@ export declare function adminKeyMatches(presented: string | undefined, adminKey:
 export declare function headerValue(incoming: IncomingMessage, name: string): string | undefined;
 /** A JSON request body, capped at `limit` bytes (413); `undefined` when there is none. */
 export declare function readJsonBody(request: Request, limit?: number): Promise<unknown>;
-export declare function isLoopbackHost(host: string): boolean;

package/dist/host/http.js

@@ -191,9 +191,3 @@ export async function readJsonBody(request, limit = 1024 * 1024) {
         throw Object.assign(new Error("Invalid JSON"), { status: 400 });
     }
 }
-export function isLoopbackHost(host) {
-    const normalized = host.trim().toLowerCase();
-    return (normalized === "127.0.0.1" ||
-        normalized === "::1" ||
-        normalized === "localhost");
-}

package/dist/host/stack-config.d.ts

@@ -237,6 +237,8 @@ export declare function parseServices(argv: readonly string[]): ServiceSelection
  * IPv6 literals must be bracketed (`[::1]:4000`).
  */
 export declare function normalizeAllowedHost(name: string, entry: string): string;
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export declare function isLoopbackHost(host: string): boolean;
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export declare function parseStackConfig(env: EnvSnapshot, argv: readonly string[]): StackConfig;
 /** Endpoint summary for logs: which endpoints are set, never their values. */

package/dist/host/stack-config.js

@@ -179,9 +179,10 @@ export function normalizeAllowedHost(name, entry) {
 function loopbackForms(port) {
     return [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`];
 }
-function isLoopbackAddress(host) {
-    const value = host.toLowerCase();
-    return value === "127.0.0.1" || value === "::1" || value === "localhost";
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
 function parseUrl(env, name, protocols) {
     const raw = read(env, name);
@@ -198,32 +199,37 @@ function parseUrl(env, name, protocols) {
         throw new StackConfigError(`${name} must use ${protocols.map((p) => p.replace(/:$/, "")).join(" or ")}; got ${url.protocol.replace(/:$/, "")}`);
     return raw;
 }
-function parseListen(env) {
-    const rawHost = read(env, "NYLORUN_LISTEN_HOST");
-    const rawPort = read(env, "NYLORUN_LISTEN_PORT");
-    const rawAllowed = read(env, "NYLORUN_ALLOWED_HOSTS");
-    if (rawHost === undefined && rawPort === undefined && rawAllowed === undefined)
-        return undefined;
-    const host = rawHost ?? DEFAULT_CONTAINER_LISTEN_HOST;
+function parseListener(env, prefix, defaultPort, hosts) {
+    const hostName = `${prefix}LISTEN_HOST`;
+    const host = read(env, hostName) ?? DEFAULT_CONTAINER_LISTEN_HOST;
     if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_LISTEN_HOST is not an address: ${host}`);
-    const port = rawPort === undefined
-        ? DEFAULT_CONTAINER_LISTEN_PORT
-        : parsePort("NYLORUN_LISTEN_PORT", rawPort);
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_ALLOWED_HOSTS is required when NYLORUN_LISTEN_HOST is ${host}: list the Host headers clients send, e.g. runtime:${port},localhost:<published port>`);
+        throw new StackConfigError(`${hostName} is not an address: ${host}`);
+    const portName = `${prefix}LISTEN_PORT`;
+    const rawPort = read(env, portName);
+    const port = rawPort === undefined ? defaultPort : parsePort(portName, rawPort);
+    if (!hosts)
+        return { host, port };
+    const allowedName = `${prefix}ALLOWED_HOSTS`;
+    const explicit = (read(env, allowedName) ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+        .map((entry) => normalizeAllowedHost(allowedName, entry));
+    if (explicit.length === 0 && !isLoopbackHost(host))
+        throw new StackConfigError(`${allowedName} is required when ${hostName} is ${host}: list the Host headers ${hosts.senders}, e.g. ${hosts.example(port)}`);
     // Loopback forms of the listen port serve probes from inside the container
     // (health checks). A browser on the Docker host never sends them: it sends
     // the published port.
-    const allowedHosts = [...new Set([...explicit, ...loopbackForms(port)])];
-    return { host, port, allowedHosts };
+    return { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] };
+}
+/** The API's listener (`NYLORUN_LISTEN_*`, `NYLORUN_ALLOWED_HOSTS`): none when none is set. */
+function parseListen(env) {
+    if (["NYLORUN_LISTEN_HOST", "NYLORUN_LISTEN_PORT", "NYLORUN_ALLOWED_HOSTS"].every((name) => read(env, name) === undefined))
+        return undefined;
+    return parseListener(env, "NYLORUN_", DEFAULT_CONTAINER_LISTEN_PORT, {
+        senders: "clients send",
+        example: (port) => `runtime:${port},localhost:<published port>`,
+    });
 }
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
 function parseIdentityKeys(env) {
@@ -398,30 +404,14 @@ function parseSandboxes(env) {
  * (required with `NYLORUN_HARNESS=remote`; optional when only sandbox pods connect).
  */
 function parseHarnessListener(env, tokenRequired = true) {
-    const host = read(env, "NYLORUN_HARNESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_HARNESS_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_HARNESS_LISTEN_PORT
-        : parsePort("NYLORUN_HARNESS_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_HARNESS_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_HARNESS_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_ALLOWED_HOSTS is required when NYLORUN_HARNESS_LISTEN_HOST is ${host}: list the Host headers harnesses send, e.g. runtime:${port}`);
+    const listen = parseListener(env, "NYLORUN_HARNESS_", DEFAULT_HARNESS_LISTEN_PORT, {
+        senders: "harnesses send",
+        example: (port) => `runtime:${port}`,
+    });
     const token = tokenRequired || read(env, "NYLORUN_HARNESS_TOKEN") !== undefined
         ? parseHarnessToken(env, "with NYLORUN_HARNESS=remote: the credential harnesses present")
         : undefined;
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        ...(token ? { token } : {}),
-    };
+    return { listen, ...(token ? { token } : {}) };
 }
 /** What a harness process must not hold: it runs next to agent code. */
 const HARNESS_REFUSED = ["NYLORUN_DATABASE_URL", "NYLORUN_GATES_TOKEN", "NYLORUN_KEYS_URL"];
@@ -491,43 +481,22 @@ function parsePodHost(env, url) {
 }
 /** `StackConfig.gates` from `NYLORUN_GATES_*`. */
 function parseGates(env) {
-    const host = read(env, "NYLORUN_GATES_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_GATES_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_GATES_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_GATES_LISTEN_PORT
-        : parsePort("NYLORUN_GATES_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_GATES_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_GATES_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_GATES_ALLOWED_HOSTS is required when NYLORUN_GATES_LISTEN_HOST is ${host}: list the Host headers the loop sends, e.g. gateway:${port}`);
+    const listen = parseListener(env, "NYLORUN_GATES_", DEFAULT_GATES_LISTEN_PORT, {
+        senders: "the loop sends",
+        example: (port) => `gateway:${port}`,
+    });
     const token = read(env, "NYLORUN_GATES_TOKEN");
     if (token === undefined)
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        token,
-    };
+    return { listen, token };
 }
 /** The prefix of the credential resolver's variables (removed in protocol 10). */
 const REMOVED_RESOLVER_PREFIX = "NYLORUN_RESOLVER_";
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
-    const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_EGRESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_EGRESS_LISTEN_PORT");
-    const port = rawPort === undefined ? DEFAULT_EGRESS_LISTEN_PORT : parsePort("NYLORUN_EGRESS_LISTEN_PORT", rawPort);
-    return { listen: { host, port } };
+    return { listen: parseListener(env, "NYLORUN_EGRESS_", DEFAULT_EGRESS_LISTEN_PORT) };
 }
 /** `StackConfig.modelGate` from `NYLORUN_GATES_URL` and `NYLORUN_GATES_TOKEN`. */
 function parseModelGate(env) {

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.21.0-beta",
+    "version": "0.21.1-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.21.0-beta",
+    "version": "0.21.1-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,

package/dist/store/postgres/drizzle/0017_wake_outbox.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "nylorun"."wakes" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"session_id" text COLLATE "C" NOT NULL,
+	"reason" text NOT NULL,
+	"dedupe_key" text,
+	"created_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "wakes_created_at" ON "nylorun"."wakes" USING btree ("created_at");

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1791395759051,
       "tag": "0016_mcp_oauth_removed",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1791455573196,
+      "tag": "0017_wake_outbox",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/schema.d.ts

@@ -3340,6 +3340,109 @@ export declare const controlSignals: import("drizzle-orm/pg-core").PgTableWithCo
     };
     dialect: 'pg';
 }>;
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export declare const wakes: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "wakes";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        dedupeKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "dedupeKey";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "wakes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 /**
  * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
  * Written only by the record module; not published to the stream relay.

package/dist/store/postgres/schema.js

@@ -421,6 +421,22 @@ export const controlSignals = nylorun.table("control_signals", {
     index("control_signals_created_at").on(t.createdAt),
     check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset')`),
 ]);
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export const wakes = nylorun.table("wakes", {
+    id: textC().primaryKey(),
+    sessionId: textC().notNull(),
+    reason: text().notNull(),
+    dedupeKey: text(),
+    createdAt: timestamp({ withTimezone: true, mode: "date" })
+        .notNull()
+        .default(sql `clock_timestamp()`),
+}, (t) => [index("wakes_created_at").on(t.createdAt)]);
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**

package/dist/store/postgres/store.js

@@ -49,6 +49,7 @@
  * `timestamptz`.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
 import { and, count, eq, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
 import { appendEvent, appendSandboxEvent } from "../../record/index.js";
 import { OwnershipLostError, PrincipalRoleConflict } from "../ownership.js";
@@ -57,7 +58,7 @@ import { database, driverError } from "./db.js";
 import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
 import { createPostgresRecordReader } from "./record.js";
 import { postgresRecordWriter, postgresSandboxRecordWriter } from "./record-writer.js";
-import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, } from "./schema.js";
+import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, wakes, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -110,7 +111,7 @@ class PostgresSessionStore {
         let t;
         // Wrapped so `begin` does not treat an array result as queries to await.
         const run = this.db.transaction(async (db) => {
-            t = new PostgresTx(db, this.tenantId, this.now);
+            t = new PostgresTx(db, this.tenantId, this.now, this.deleteWake);
             try {
                 return { value: await this.active.run(this, () => fn(t)) };
             }
@@ -153,6 +154,10 @@ class PostgresSessionStore {
         }
         return result.value;
     }
+    /** Deletes a delivered outbox request, outside any transaction (`Tx.wake`). */
+    deleteWake = async (id) => {
+        await this.db.delete(wakes).where(eq(wakes.id, id));
+    };
     onCommit(listener) {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
@@ -256,21 +261,27 @@ const SIGNING_KEY_STAMP = {
 };
 /** The audit columns a row has (`ord` only orders them). */
 const { ord: _ord, ...AUDIT } = getTableColumns(vaultAudit);
-const SESSION_TABLES = [sessions, commands, effects, links];
+const SESSION_TABLES = [sessions, commands, effects, links, wakes];
+/** An outbox row as it is delivered: the wake's own dedupe key, or one made from the row id. */
+function outboxWake(id, reason, dedupeKey) {
+    return { reason, dedupeKey: dedupeKey ?? `wake:${id}` };
+}
 /** The inserted row's `column` (`ON CONFLICT … DO UPDATE`). */
 const excluded = (column) => sql.raw(`excluded.${column}`);
 class PostgresTx {
     db;
     tenantId;
     now;
+    deleteWake;
     closed = false;
     events = [];
     generations = [];
     callbacks = [];
-    constructor(db, tenantId, now) {
+    constructor(db, tenantId, now, deleteWake) {
         this.db = db;
         this.tenantId = tenantId;
         this.now = now;
+        this.deleteWake = deleteWake;
     }
     check() {
         if (this.closed)
@@ -345,6 +356,45 @@ class PostgresTx {
         this.check();
         this.callbacks.push(fn);
     }
+    // --- wake outbox ---------------------------------------------------------
+    async wake(sessionId, wake, deliver) {
+        this.check();
+        const id = randomUUID();
+        await this.db.insert(wakes).values({
+            id,
+            sessionId,
+            reason: wake.reason,
+            dedupeKey: wake.dedupeKey ?? null,
+        });
+        const delivered = outboxWake(id, wake.reason, wake.dedupeKey ?? null);
+        // A rejection goes to the store's error hook (as every callback's), and the row stays.
+        this.callbacks.push(async () => {
+            if ((await deliver(sessionId, delivered)) === false)
+                return;
+            await this.deleteWake(id);
+        });
+    }
+    async pendingWakes(before, limit) {
+        this.check();
+        const rows = await this.db
+            .select()
+            .from(wakes)
+            .where(lt(wakes.createdAt, before))
+            .orderBy(wakes.createdAt, wakes.id)
+            .limit(limit);
+        return rows.map((row) => ({
+            id: row.id,
+            sessionId: row.sessionId,
+            wake: outboxWake(row.id, row.reason, row.dedupeKey),
+            createdAt: row.createdAt.toISOString(),
+        }));
+    }
+    async deleteWakes(ids) {
+        this.check();
+        if (ids.length === 0)
+            return;
+        await this.db.delete(wakes).where(inArray(wakes.id, [...ids]));
+    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();

package/dist/store/types.d.ts

@@ -25,16 +25,18 @@
  *    generation, `streams/basin.ts`), and the cursor is
  *    `base64url("<sessionId>:<seq>")` (see `record/cursor.ts`).
  * 4. **No external I/O inside `fn`.** No model, tool, MCP, sandbox, Restate or
- *    S2 call, and no `fetch`, runs inside a transaction. Wakes go
- *    through `afterCommit`, and events are delivered to commit listeners after
- *    commit (seam rule 1 and 2).
+ *    S2 call, and no `fetch`, runs inside a transaction. A wake is written in the
+ *    transaction (`Tx.wake`, the wake outbox) and delivered after commit, and events
+ *    are delivered to commit listeners after commit (seam rule 1 and 2).
  * 5. **No nested transactions.** Calling `store.tx` from inside `fn` rejects.
  *    A `Tx` must not be used after its `tx` call settles.
  * 6. **Post-commit order.** After a commit, the store first calls every commit
  *    listener once with the transaction's events (in allocation order), then runs the `afterCommit` callbacks in registration
  *    order and awaits them. Listener and callback failures are reported to the
  *    store's error hook; they never reject `tx`, because the commit stands.
- *    Recovery from a lost post-commit step is the Tenant sweep's job.
+ *    Recovery from a lost post-commit step is the Tenant sweep's job: a wake's
+ *    delivery is a callback too, and its outbox row is what the sweep delivers
+ *    again (`Tx.wake`).
  * 7. **Documents are values.** `get` and queries return fresh copies; mutating
  *    them changes nothing until `put`.
  * 8. **Ownership columns are store-managed.** `owner`, `epoch` and
@@ -56,6 +58,7 @@
  */
 import type { KeyRole } from "@nylorun/core/compatibility";
 import type { RecordReader } from "../streams/relay/types.js";
+import type { Wake } from "../execution/types.js";
 import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
@@ -271,6 +274,24 @@ export interface SessionStore {
     followSignals(onSignal: (signal: ControlSignal) => void, options?: FollowSignalsOptions): Promise<SignalFollower>;
     close(): Promise<void>;
 }
+/** A wake as the outbox delivers it: its `dedupeKey` is the request's idempotency key. */
+export type OutboxWake = Wake & {
+    dedupeKey: string;
+};
+/**
+ * Hands an outbox request to Durable Session Execution (`Tx.wake`). Resolving means the
+ * execution accepted it; `false` means it was not delivered and stays in the outbox, as a
+ * rejection does, without an error.
+ */
+export type WakeDelivery = (sessionId: string, wake: OutboxWake) => boolean | void | Promise<boolean | void>;
+/** A wake outbox request not yet delivered (`Tx.pendingWakes`). */
+export interface PendingWake {
+    id: string;
+    sessionId: string;
+    wake: OutboxWake;
+    /** ISO time it was written. */
+    createdAt: string;
+}
 /**
  * A signal on the control bus (D21, D48): one process tells the others with the Tenant open.
  * Signals are not events: they are never recorded in a session's log or streamed, and a
@@ -345,8 +366,28 @@ export interface Tx {
      * cursor is final.
      */
     event<T extends EventType>(sessionId: string, turnId: string | null, type: T, payload: EventPayload<T>): Promise<SessionEventOf<T>>;
-    /** Runs `fn` after a successful commit (never on rollback). Used for wakes. */
+    /**
+     * Runs `fn` after a successful commit (never on rollback): a sandbox signal or a host
+     * revocation. Nothing writes it down, so a crash after commit loses it. A wake goes
+     * through `wake`, which does.
+     */
     afterCommit(fn: () => void | Promise<void>): void;
+    /**
+     * Asks for an advance of `sessionId` once this transaction commits. The request is a row
+     * of the wake outbox written in this transaction, so it commits, or rolls back, with what
+     * caused it: a commit never loses its wake. After commit, in `afterCommit` order, the
+     * store calls `deliver` (`DurableExecution.wake`, through the Tenant) and deletes the row
+     * once it resolves to anything but `false`. A request `deliver` declines (`false`) or
+     * rejects, or one a crash cut off, stays in the outbox until the Tenant sweep delivers it
+     * (`pendingWakes`, `deleteWakes`). `deliver` gets the request's idempotency key as
+     * `dedupeKey`: the wake's own, or `wake:<row id>` without one, so a request delivered
+     * twice still causes one advance.
+     */
+    wake(sessionId: string, wake: Wake, deliver: WakeDelivery): Promise<void>;
+    /** Outbox requests written before `before`, oldest first. */
+    pendingWakes(before: Date, limit: number): Promise<PendingWake[]>;
+    /** Deletes delivered outbox requests. */
+    deleteWakes(ids: readonly string[]): Promise<void>;
     /**
      * Locks the session and takes ownership when it has no owner or the owner's
      * lease ended at or before `now`; then increments `epoch` and sets the lease

package/dist/tenant/advance.js

@@ -473,10 +473,7 @@ async function settle(ctx, lease, s, result, updates = [], cursor) {
             await slimModelEffects(t, id, s.activeTurnId);
             await t.put("sessions", id, current);
             const segment = finished.segment + 1;
-            t.afterCommit(() => ctx.wake(id, {
-                reason: "rollover",
-                dedupeKey: `rollover:${s.activeTurnId}:${segment}`,
-            }));
+            await t.wake(id, { reason: "rollover", dedupeKey: `rollover:${s.activeTurnId}:${segment}` }, ctx.wake);
             return siblings;
         }
         const flow = isWorkflowManifest(current.manifest);

package/dist/tenant/commands.js

@@ -1,11 +1,11 @@
 /**
  * The session command service: `message`, `approve`/`respond` and `cancel`,
  * with per-session idempotency keys. A command locks its session and commits its state
- * change, events and wakes in one transaction (the store publishes the events and runs the
- * `afterCommit` wakes), then aborts a cancelled advance and cascades workflow cancels to the
- * linked agent sessions, one transaction each.
+ * change, events and wakes in one transaction (the store publishes the events and delivers the
+ * wakes from its outbox after commit, `Tx.wake`), then aborts a cancelled advance and cascades
+ * workflow cancels to the linked agent sessions, one transaction each.
  *
- * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
+ * Wakes (`t.wake`, architecture §12.3) carry the command type as the reason and a dedupe
  * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
  * (every accepted one writes a new checkpoint segment), except that a workflow's `approve` and
  * `respond` name `<type>:<turnId>:<interactionId>`: a flow resumes in the same segment.
@@ -231,7 +231,7 @@ export async function command(ctx, id, input, scope) {
                 reason: command.type,
                 dedupeKey: `${command.type}:${s.activeTurnId}:${cause}`,
             };
-            t.afterCommit(() => ctx.wake(id, commandWake));
+            await t.wake(id, commandWake, ctx.wake);
             event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
         }
         await t.put("sessions", id, s);

package/dist/tenant/context.d.ts

@@ -5,9 +5,10 @@
  *
  * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
  * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
- * commit), and advances through `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
- * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
- * tx.
+ * commit), and advances through `await t.wake(id, { reason, dedupeKey }, ctx.wake)`, which
+ * writes the wake to the outbox in the transaction and delivers it after commit. It never
+ * publishes or notifies itself; `runtime.ts` wires the streams with `wireStreams()`. No
+ * external I/O runs inside a tx.
  *
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
@@ -211,11 +212,13 @@ export interface TenantContext {
     /** How long an advance's ownership lease lasts; the heartbeat renews it. */
     readonly ownerLeaseMs: number;
     /**
-     * Seam: request an advance of a session (`DurableExecution.wake`). Call it from
-     * `t.afterCommit`, never inside a tx. Dropped while the Tenant is closing; the sweep
-     * re-wakes anything left runnable.
+     * Seam: hand a wake to `DurableExecution.wake`, outside any tx. Business code passes it to
+     * `t.wake` (the outbox), which calls it after commit; the sweep calls it for outbox rows
+     * left undelivered and for orphaned sessions. Resolves `true` once the execution accepted
+     * the wake, `false` while the Tenant is closing: the wake is not sent, and its outbox row
+     * stays for the next sweep.
      */
-    wake(sessionId: string, wake: Wake): Promise<void>;
+    wake(sessionId: string, wake: Wake): Promise<boolean>;
     /**
      * Seam: abort the advance of a session running in this process, if any. With `turnId`, only
      * an advance of that turn (a cancel signal names the turn it cancelled).

package/dist/tenant/runtime.js

@@ -261,8 +261,9 @@ export class TenantRuntime {
                 ownerLeaseMs: config.ownerLeaseMs ?? DEFAULT_OWNER_LEASE_MS,
                 wake: async (sessionId, wake) => {
                     if (ctx.closing || ctx.closed)
-                        return;
+                        return false;
                     await execution.wake(config.tenantId, sessionId, wake);
+                    return true;
                 },
                 abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
                 ...(hooks.pods ? { pods: hooks.pods } : {}),

package/dist/tenant/sweep.d.ts

@@ -1,5 +1,19 @@
 import type { TenantContext } from "./context.js";
+/**
+ * How old a wake outbox row is before the sweep delivers it: longer than a delivery after
+ * commit takes, so the sweep seldom sends a wake its commit is still sending. Sending one
+ * twice is harmless either way (the idempotency key).
+ */
+export declare const WAKE_GRACE_MS = 2000;
+/** How often the orphan scan runs after the first pass of a Tenant opened on this process. */
+export declare const ORPHAN_SCAN_MS = 60000;
 export declare function sweep(ctx: TenantContext): Promise<void>;
+/**
+ * Deliver the wake outbox rows written before `before` (oldest first, one batch) and delete
+ * the delivered ones. A row the Tenant declines (it is closing) stays. Returns the ids of the
+ * rows delivered.
+ */
+export declare function deliverPendingWakes(ctx: Pick<TenantContext, "store" | "wake">, before?: Date): Promise<string[]>;
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export declare function reconcileLinkedAgents(ctx: Pick<TenantContext, "store" | "wake">): Promise<void>;
 /** Wake `running`/`runnable` sessions without a live owner. Returns the ids woken. */

package/dist/tenant/sweep.js

@@ -1,21 +1,32 @@
 /**
  * The Tenant sweep (architecture §12.3, "Timers"): one self-re-arming pass per Tenant, armed
  * with `DurableExecution.armSweep` when the Tenant opens. It replaces every in-process timer
- * and startup scan the Tenant runtime used to keep:
+ * and startup scan the Tenant runtime used to keep. It reconciles the Session Store with what
+ * Durable Session Execution was asked to do; it never decides when a session advances:
  *
- * 1. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
+ * 1. **Wakes.** Wake outbox rows (`Tx.wake`) are delivered again and deleted: a delivery
+ *    after commit that failed, or that a crash between the commit and the send cut off. The
+ *    first pass on this process takes every row, so a previous process's are not left
+ *    waiting; later passes take the rows older than `WAKE_GRACE_MS`. Each row carries the
+ *    idempotency key it was first sent with, so a wake the execution did accept before the
+ *    crash, or one still being sent after its commit, causes no second advance.
+ * 2. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
  *    are completed and the workflow is woken (a crash between the two, or data written by an
- *    older Runtime). One transaction per effect, child session locked before its workflow.
- * 2. **Orphaned sessions.** `running` or `runnable` sessions with no owner, or an owner whose
- *    lease expired, are woken with reason `recover`: a wake lost between commit and send, or
- *    a Worker that died mid-advance (the advance then takes over, §11.4).
- * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
+ *    older Runtime).
+ * 3. **Orphaned sessions.** On this process's first pass for the Tenant, then at most every
+ *    `ORPHAN_SCAN_MS`: `running` or `runnable` sessions with no owner, or an owner whose lease
+ *    expired, are woken with reason `recover`. Neither a lost wake (step 1) nor a Worker that
+ *    died mid-advance (the execution retries that advance, which takes over, §11.4) needs it:
+ *    it is the backstop for what the execution itself lost or ended without an advance, such
+ *    as an in-process execution's queue when its process stopped, an advance for a Tenant not
+ *    open on its Worker, an invocation an operator killed, or Restate's state wiped (§17.11).
+ * 4. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
  *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
  *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
  *    workspaces). Idle MCP connections of the in-process harness are closed.
- * 4. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
+ * 5. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
  *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
- * 5. **Hooks.** Callbacks registered with `ctx.onSweep`.
+ * 6. **Hooks.** Callbacks registered with `ctx.onSweep`.
  *
  * Every step runs one transaction per session it changes (a linked agent and its workflow
  * share one, child first), so the sweep follows the lock order in `store/types.ts`. A failing
@@ -26,13 +37,41 @@ import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-
 const BATCH = 100;
 /** How long a control signal is kept after it was written. */
 const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
+/**
+ * How old a wake outbox row is before the sweep delivers it: longer than a delivery after
+ * commit takes, so the sweep seldom sends a wake its commit is still sending. Sending one
+ * twice is harmless either way (the idempotency key).
+ */
+export const WAKE_GRACE_MS = 2000;
+/** How often the orphan scan runs after the first pass of a Tenant opened on this process. */
+export const ORPHAN_SCAN_MS = 60_000;
+/** Each open Tenant's sweep state on this process: when its orphan scan last ran. */
+const passes = new WeakMap();
 export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
         return;
     const now = new Date();
+    const first = !passes.has(ctx);
+    const pass = passes.get(ctx) ?? {};
+    passes.set(ctx, pass);
+    const scanOrphans = pass.orphansAt === undefined || now.getTime() - pass.orphansAt >= ORPHAN_SCAN_MS;
     const steps = [
+        [
+            "wakes",
+            () => deliverPendingWakes(ctx, first ? now : new Date(now.getTime() - WAKE_GRACE_MS)),
+        ],
         ["linked", () => reconcileLinkedAgents(ctx)],
-        ["orphans", () => wakeOrphanedSessions(ctx, now)],
+        ...(scanOrphans
+            ? [
+                [
+                    "orphans",
+                    async () => {
+                        await wakeOrphanedSessions(ctx, now);
+                        pass.orphansAt = now.getTime();
+                    },
+                ],
+            ]
+            : []),
         [
             "sandboxes",
             () => ctx.sandbox.sweep({
@@ -68,6 +107,26 @@ export async function sweep(ctx) {
     if (failure)
         throw failure.error;
 }
+/**
+ * Deliver the wake outbox rows written before `before` (oldest first, one batch) and delete
+ * the delivered ones. A row the Tenant declines (it is closing) stays. Returns the ids of the
+ * rows delivered.
+ */
+export async function deliverPendingWakes(ctx, before = new Date()) {
+    const pending = await ctx.store.tx((t) => t.pendingWakes(before, BATCH));
+    const delivered = [];
+    try {
+        for (const row of pending)
+            if ((await ctx.wake(row.sessionId, row.wake)) !== false)
+                delivered.push(row.id);
+    }
+    finally {
+        // Delivered ones go even when a later one fails, so they are not sent again.
+        if (delivered.length > 0)
+            await ctx.store.tx((t) => t.deleteWakes(delivered));
+    }
+    return delivered;
+}
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export async function reconcileLinkedAgents(ctx) {
     const { store } = ctx;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.21.0-beta";
+export declare const RUNTIME_VERSION = "0.21.1-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.21.0-beta";
+export const RUNTIME_VERSION = "0.21.1-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.21.0-beta",
+  "version": "0.21.1-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.31.0",
-    "@nylorun/core": "0.17.0-beta",
-    "@nylorun/harness": "0.24.0-beta",
+    "@nylorun/core": "0.18.0-beta",
+    "@nylorun/harness": "0.25.0-beta",
     "@restatedev/restate-sdk": "1.17.2",
     "@s2-dev/streamstore": "0.28.0",
     "aws4fetch": "1.0.20",