@nylorun/runtime 0.21.0-beta → 0.22.0-beta

package/dist/store/postgres/schema.d.ts

@@ -1048,14 +1048,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "headers" | "model";
+            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "headers", "model"];
+            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -3340,6 +3340,109 @@ export declare const controlSignals: import("drizzle-orm/pg-core").PgTableWithCo
     };
     dialect: 'pg';
 }>;
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export declare const wakes: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "wakes";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        dedupeKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "dedupeKey";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "wakes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 /**
  * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
  * Written only by the record module; not published to the stream relay.

package/dist/store/postgres/schema.js

@@ -129,7 +129,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "headers", "model"] }).notNull(),
+    type: text({ enum: ["bearer", "headers", "environment_secret", "environment_variable", "model"] }).notNull(),
     /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),
@@ -421,6 +421,22 @@ export const controlSignals = nylorun.table("control_signals", {
     index("control_signals_created_at").on(t.createdAt),
     check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset')`),
 ]);
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export const wakes = nylorun.table("wakes", {
+    id: textC().primaryKey(),
+    sessionId: textC().notNull(),
+    reason: text().notNull(),
+    dedupeKey: text(),
+    createdAt: timestamp({ withTimezone: true, mode: "date" })
+        .notNull()
+        .default(sql `clock_timestamp()`),
+}, (t) => [index("wakes_created_at").on(t.createdAt)]);
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**

package/dist/store/postgres/store.js

@@ -49,6 +49,7 @@
  * `timestamptz`.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
 import { and, count, eq, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
 import { appendEvent, appendSandboxEvent } from "../../record/index.js";
 import { OwnershipLostError, PrincipalRoleConflict } from "../ownership.js";
@@ -57,7 +58,7 @@ import { database, driverError } from "./db.js";
 import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
 import { createPostgresRecordReader } from "./record.js";
 import { postgresRecordWriter, postgresSandboxRecordWriter } from "./record-writer.js";
-import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, } from "./schema.js";
+import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, wakes, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -110,7 +111,7 @@ class PostgresSessionStore {
         let t;
         // Wrapped so `begin` does not treat an array result as queries to await.
         const run = this.db.transaction(async (db) => {
-            t = new PostgresTx(db, this.tenantId, this.now);
+            t = new PostgresTx(db, this.tenantId, this.now, this.deleteWake);
             try {
                 return { value: await this.active.run(this, () => fn(t)) };
             }
@@ -153,6 +154,10 @@ class PostgresSessionStore {
         }
         return result.value;
     }
+    /** Deletes a delivered outbox request, outside any transaction (`Tx.wake`). */
+    deleteWake = async (id) => {
+        await this.db.delete(wakes).where(eq(wakes.id, id));
+    };
     onCommit(listener) {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
@@ -256,21 +261,27 @@ const SIGNING_KEY_STAMP = {
 };
 /** The audit columns a row has (`ord` only orders them). */
 const { ord: _ord, ...AUDIT } = getTableColumns(vaultAudit);
-const SESSION_TABLES = [sessions, commands, effects, links];
+const SESSION_TABLES = [sessions, commands, effects, links, wakes];
+/** An outbox row as it is delivered: the wake's own dedupe key, or one made from the row id. */
+function outboxWake(id, reason, dedupeKey) {
+    return { reason, dedupeKey: dedupeKey ?? `wake:${id}` };
+}
 /** The inserted row's `column` (`ON CONFLICT … DO UPDATE`). */
 const excluded = (column) => sql.raw(`excluded.${column}`);
 class PostgresTx {
     db;
     tenantId;
     now;
+    deleteWake;
     closed = false;
     events = [];
     generations = [];
     callbacks = [];
-    constructor(db, tenantId, now) {
+    constructor(db, tenantId, now, deleteWake) {
         this.db = db;
         this.tenantId = tenantId;
         this.now = now;
+        this.deleteWake = deleteWake;
     }
     check() {
         if (this.closed)
@@ -345,6 +356,45 @@ class PostgresTx {
         this.check();
         this.callbacks.push(fn);
     }
+    // --- wake outbox ---------------------------------------------------------
+    async wake(sessionId, wake, deliver) {
+        this.check();
+        const id = randomUUID();
+        await this.db.insert(wakes).values({
+            id,
+            sessionId,
+            reason: wake.reason,
+            dedupeKey: wake.dedupeKey ?? null,
+        });
+        const delivered = outboxWake(id, wake.reason, wake.dedupeKey ?? null);
+        // A rejection goes to the store's error hook (as every callback's), and the row stays.
+        this.callbacks.push(async () => {
+            if ((await deliver(sessionId, delivered)) === false)
+                return;
+            await this.deleteWake(id);
+        });
+    }
+    async pendingWakes(before, limit) {
+        this.check();
+        const rows = await this.db
+            .select()
+            .from(wakes)
+            .where(lt(wakes.createdAt, before))
+            .orderBy(wakes.createdAt, wakes.id)
+            .limit(limit);
+        return rows.map((row) => ({
+            id: row.id,
+            sessionId: row.sessionId,
+            wake: outboxWake(row.id, row.reason, row.dedupeKey),
+            createdAt: row.createdAt.toISOString(),
+        }));
+    }
+    async deleteWakes(ids) {
+        this.check();
+        if (ids.length === 0)
+            return;
+        await this.db.delete(wakes).where(inArray(wakes.id, [...ids]));
+    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();

package/dist/store/types.d.ts

@@ -25,16 +25,18 @@
  *    generation, `streams/basin.ts`), and the cursor is
  *    `base64url("<sessionId>:<seq>")` (see `record/cursor.ts`).
  * 4. **No external I/O inside `fn`.** No model, tool, MCP, sandbox, Restate or
- *    S2 call, and no `fetch`, runs inside a transaction. Wakes go
- *    through `afterCommit`, and events are delivered to commit listeners after
- *    commit (seam rule 1 and 2).
+ *    S2 call, and no `fetch`, runs inside a transaction. A wake is written in the
+ *    transaction (`Tx.wake`, the wake outbox) and delivered after commit, and events
+ *    are delivered to commit listeners after commit (seam rule 1 and 2).
  * 5. **No nested transactions.** Calling `store.tx` from inside `fn` rejects.
  *    A `Tx` must not be used after its `tx` call settles.
  * 6. **Post-commit order.** After a commit, the store first calls every commit
  *    listener once with the transaction's events (in allocation order), then runs the `afterCommit` callbacks in registration
  *    order and awaits them. Listener and callback failures are reported to the
  *    store's error hook; they never reject `tx`, because the commit stands.
- *    Recovery from a lost post-commit step is the Tenant sweep's job.
+ *    Recovery from a lost post-commit step is the Tenant sweep's job: a wake's
+ *    delivery is a callback too, and its outbox row is what the sweep delivers
+ *    again (`Tx.wake`).
  * 7. **Documents are values.** `get` and queries return fresh copies; mutating
  *    them changes nothing until `put`.
  * 8. **Ownership columns are store-managed.** `owner`, `epoch` and
@@ -56,6 +58,7 @@
  */
 import type { KeyRole } from "@nylorun/core/compatibility";
 import type { RecordReader } from "../streams/relay/types.js";
+import type { Wake } from "../execution/types.js";
 import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
@@ -271,6 +274,24 @@ export interface SessionStore {
     followSignals(onSignal: (signal: ControlSignal) => void, options?: FollowSignalsOptions): Promise<SignalFollower>;
     close(): Promise<void>;
 }
+/** A wake as the outbox delivers it: its `dedupeKey` is the request's idempotency key. */
+export type OutboxWake = Wake & {
+    dedupeKey: string;
+};
+/**
+ * Hands an outbox request to Durable Session Execution (`Tx.wake`). Resolving means the
+ * execution accepted it; `false` means it was not delivered and stays in the outbox, as a
+ * rejection does, without an error.
+ */
+export type WakeDelivery = (sessionId: string, wake: OutboxWake) => boolean | void | Promise<boolean | void>;
+/** A wake outbox request not yet delivered (`Tx.pendingWakes`). */
+export interface PendingWake {
+    id: string;
+    sessionId: string;
+    wake: OutboxWake;
+    /** ISO time it was written. */
+    createdAt: string;
+}
 /**
  * A signal on the control bus (D21, D48): one process tells the others with the Tenant open.
  * Signals are not events: they are never recorded in a session's log or streamed, and a
@@ -345,8 +366,28 @@ export interface Tx {
      * cursor is final.
      */
     event<T extends EventType>(sessionId: string, turnId: string | null, type: T, payload: EventPayload<T>): Promise<SessionEventOf<T>>;
-    /** Runs `fn` after a successful commit (never on rollback). Used for wakes. */
+    /**
+     * Runs `fn` after a successful commit (never on rollback): a sandbox signal or a host
+     * revocation. Nothing writes it down, so a crash after commit loses it. A wake goes
+     * through `wake`, which does.
+     */
     afterCommit(fn: () => void | Promise<void>): void;
+    /**
+     * Asks for an advance of `sessionId` once this transaction commits. The request is a row
+     * of the wake outbox written in this transaction, so it commits, or rolls back, with what
+     * caused it: a commit never loses its wake. After commit, in `afterCommit` order, the
+     * store calls `deliver` (`DurableExecution.wake`, through the Tenant) and deletes the row
+     * once it resolves to anything but `false`. A request `deliver` declines (`false`) or
+     * rejects, or one a crash cut off, stays in the outbox until the Tenant sweep delivers it
+     * (`pendingWakes`, `deleteWakes`). `deliver` gets the request's idempotency key as
+     * `dedupeKey`: the wake's own, or `wake:<row id>` without one, so a request delivered
+     * twice still causes one advance.
+     */
+    wake(sessionId: string, wake: Wake, deliver: WakeDelivery): Promise<void>;
+    /** Outbox requests written before `before`, oldest first. */
+    pendingWakes(before: Date, limit: number): Promise<PendingWake[]>;
+    /** Deletes delivered outbox requests. */
+    deleteWakes(ids: readonly string[]): Promise<void>;
     /**
      * Locks the session and takes ownership when it has no owner or the owner's
      * lease ended at or before `now`; then increments `epoch` and sets the lease

package/dist/tenant/advance.js

@@ -473,10 +473,7 @@ async function settle(ctx, lease, s, result, updates = [], cursor) {
             await slimModelEffects(t, id, s.activeTurnId);
             await t.put("sessions", id, current);
             const segment = finished.segment + 1;
-            t.afterCommit(() => ctx.wake(id, {
-                reason: "rollover",
-                dedupeKey: `rollover:${s.activeTurnId}:${segment}`,
-            }));
+            await t.wake(id, { reason: "rollover", dedupeKey: `rollover:${s.activeTurnId}:${segment}` }, ctx.wake);
             return siblings;
         }
         const flow = isWorkflowManifest(current.manifest);

package/dist/tenant/commands.js

@@ -1,11 +1,11 @@
 /**
  * The session command service: `message`, `approve`/`respond` and `cancel`,
  * with per-session idempotency keys. A command locks its session and commits its state
- * change, events and wakes in one transaction (the store publishes the events and runs the
- * `afterCommit` wakes), then aborts a cancelled advance and cascades workflow cancels to the
- * linked agent sessions, one transaction each.
+ * change, events and wakes in one transaction (the store publishes the events and delivers the
+ * wakes from its outbox after commit, `Tx.wake`), then aborts a cancelled advance and cascades
+ * workflow cancels to the linked agent sessions, one transaction each.
  *
- * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
+ * Wakes (`t.wake`, architecture §12.3) carry the command type as the reason and a dedupe
  * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
  * (every accepted one writes a new checkpoint segment), except that a workflow's `approve` and
  * `respond` name `<type>:<turnId>:<interactionId>`: a flow resumes in the same segment.
@@ -231,7 +231,7 @@ export async function command(ctx, id, input, scope) {
                 reason: command.type,
                 dedupeKey: `${command.type}:${s.activeTurnId}:${cause}`,
             };
-            t.afterCommit(() => ctx.wake(id, commandWake));
+            await t.wake(id, commandWake, ctx.wake);
             event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
         }
         await t.put("sessions", id, s);

package/dist/tenant/context.d.ts

@@ -5,9 +5,10 @@
  *
  * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
  * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
- * commit), and advances through `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
- * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
- * tx.
+ * commit), and advances through `await t.wake(id, { reason, dedupeKey }, ctx.wake)`, which
+ * writes the wake to the outbox in the transaction and delivers it after commit. It never
+ * publishes or notifies itself; `runtime.ts` wires the streams with `wireStreams()`. No
+ * external I/O runs inside a tx.
  *
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
@@ -211,11 +212,13 @@ export interface TenantContext {
     /** How long an advance's ownership lease lasts; the heartbeat renews it. */
     readonly ownerLeaseMs: number;
     /**
-     * Seam: request an advance of a session (`DurableExecution.wake`). Call it from
-     * `t.afterCommit`, never inside a tx. Dropped while the Tenant is closing; the sweep
-     * re-wakes anything left runnable.
+     * Seam: hand a wake to `DurableExecution.wake`, outside any tx. Business code passes it to
+     * `t.wake` (the outbox), which calls it after commit; the sweep calls it for outbox rows
+     * left undelivered and for orphaned sessions. Resolves `true` once the execution accepted
+     * the wake, `false` while the Tenant is closing: the wake is not sent, and its outbox row
+     * stays for the next sweep.
      */
-    wake(sessionId: string, wake: Wake): Promise<void>;
+    wake(sessionId: string, wake: Wake): Promise<boolean>;
     /**
      * Seam: abort the advance of a session running in this process, if any. With `turnId`, only
      * an advance of that turn (a cancel signal names the turn it cancelled).

package/dist/tenant/runtime.js

@@ -261,8 +261,9 @@ export class TenantRuntime {
                 ownerLeaseMs: config.ownerLeaseMs ?? DEFAULT_OWNER_LEASE_MS,
                 wake: async (sessionId, wake) => {
                     if (ctx.closing || ctx.closed)
-                        return;
+                        return false;
                     await execution.wake(config.tenantId, sessionId, wake);
+                    return true;
                 },
                 abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
                 ...(hooks.pods ? { pods: hooks.pods } : {}),

package/dist/tenant/sessions.js

@@ -136,7 +136,12 @@ export async function putSession(ctx, id, body, access, options = {}) {
             return prior;
         }
         await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections, { opaque });
+        const environment = await ctx.vault.sessionEnvironment(t, vaultIds);
+        if (environment.conflict)
+            fail(409, environment.conflict, { code: "credential_conflict" });
         if (prior) {
+            if (prior.sandboxId !== undefined)
+                await assertSandboxSecrets(ctx, t, prior.sandboxId, id, body.ownerUserId, environment.secretHosts);
             if (sessionIdentity(prior.creation) !== sessionIdentity(body))
                 fail(409, "Session already exists with different creation parameters");
             prior.vaultIds = vaultIds;
@@ -156,6 +161,8 @@ export async function putSession(ctx, id, body, access, options = {}) {
         checkPlacement(await readSandboxConfig(t), sandbox.kind);
         if (sandbox.kind === "pod")
             await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
+        if (sandbox.sandboxId !== undefined)
+            await assertSandboxSecrets(ctx, t, sandbox.sandboxId, id, body.ownerUserId, environment.secretHosts);
         const pinned = sandbox.manifest === undefined ? platformTools(definition) : sandbox;
         const created = {
             id,
@@ -186,6 +193,25 @@ export async function putSession(ctx, id, body, access, options = {}) {
         return created;
     });
 }
+/**
+ * A sandbox's shell secrets must be unambiguous (R2c, D50): egress-gate sets the header from the
+ * one `environment_secret` bound to a host among the sessions using the sandbox. So while any of
+ * them has secrets, they all have one owner, and no host is bound to two credentials.
+ */
+async function assertSandboxSecrets(ctx, t, sandboxId, sessionId, ownerUserId, secretHosts) {
+    const conflict = (message) => fail(409, message, { code: "credential_conflict" });
+    const mine = Object.keys(secretHosts).length > 0;
+    for (const other of await t.sessionsOnSandbox(sandboxId)) {
+        if (other.id === sessionId)
+            continue;
+        const theirs = (await ctx.vault.sessionEnvironment(t, other.vaultIds ?? [])).secretHosts;
+        if (other.ownerUserId !== ownerUserId && (mine || Object.keys(theirs).length > 0))
+            conflict(`Sandbox ${sandboxId} serves environment_secret credentials of one owner at a time`);
+        for (const [host, credentialId] of Object.entries(secretHosts))
+            if (theirs[host] !== undefined && theirs[host] !== credentialId)
+                conflict(`Two environment_secret credentials would be bound to ${host} in sandbox ${sandboxId}`);
+    }
+}
 function isShare(value) {
     return typeof value === "object" && value !== null && "session" in value;
 }

package/dist/tenant/sweep.d.ts

@@ -1,5 +1,19 @@
 import type { TenantContext } from "./context.js";
+/**
+ * How old a wake outbox row is before the sweep delivers it: longer than a delivery after
+ * commit takes, so the sweep seldom sends a wake its commit is still sending. Sending one
+ * twice is harmless either way (the idempotency key).
+ */
+export declare const WAKE_GRACE_MS = 2000;
+/** How often the orphan scan runs after the first pass of a Tenant opened on this process. */
+export declare const ORPHAN_SCAN_MS = 60000;
 export declare function sweep(ctx: TenantContext): Promise<void>;
+/**
+ * Deliver the wake outbox rows written before `before` (oldest first, one batch) and delete
+ * the delivered ones. A row the Tenant declines (it is closing) stays. Returns the ids of the
+ * rows delivered.
+ */
+export declare function deliverPendingWakes(ctx: Pick<TenantContext, "store" | "wake">, before?: Date): Promise<string[]>;
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export declare function reconcileLinkedAgents(ctx: Pick<TenantContext, "store" | "wake">): Promise<void>;
 /** Wake `running`/`runnable` sessions without a live owner. Returns the ids woken. */

package/dist/tenant/sweep.js

@@ -1,21 +1,32 @@
 /**
  * The Tenant sweep (architecture §12.3, "Timers"): one self-re-arming pass per Tenant, armed
  * with `DurableExecution.armSweep` when the Tenant opens. It replaces every in-process timer
- * and startup scan the Tenant runtime used to keep:
+ * and startup scan the Tenant runtime used to keep. It reconciles the Session Store with what
+ * Durable Session Execution was asked to do; it never decides when a session advances:
  *
- * 1. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
+ * 1. **Wakes.** Wake outbox rows (`Tx.wake`) are delivered again and deleted: a delivery
+ *    after commit that failed, or that a crash between the commit and the send cut off. The
+ *    first pass on this process takes every row, so a previous process's are not left
+ *    waiting; later passes take the rows older than `WAKE_GRACE_MS`. Each row carries the
+ *    idempotency key it was first sent with, so a wake the execution did accept before the
+ *    crash, or one still being sent after its commit, causes no second advance.
+ * 2. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
  *    are completed and the workflow is woken (a crash between the two, or data written by an
- *    older Runtime). One transaction per effect, child session locked before its workflow.
- * 2. **Orphaned sessions.** `running` or `runnable` sessions with no owner, or an owner whose
- *    lease expired, are woken with reason `recover`: a wake lost between commit and send, or
- *    a Worker that died mid-advance (the advance then takes over, §11.4).
- * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
+ *    older Runtime).
+ * 3. **Orphaned sessions.** On this process's first pass for the Tenant, then at most every
+ *    `ORPHAN_SCAN_MS`: `running` or `runnable` sessions with no owner, or an owner whose lease
+ *    expired, are woken with reason `recover`. Neither a lost wake (step 1) nor a Worker that
+ *    died mid-advance (the execution retries that advance, which takes over, §11.4) needs it:
+ *    it is the backstop for what the execution itself lost or ended without an advance, such
+ *    as an in-process execution's queue when its process stopped, an advance for a Tenant not
+ *    open on its Worker, an invocation an operator killed, or Restate's state wiped (§17.11).
+ * 4. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
  *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
  *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
  *    workspaces). Idle MCP connections of the in-process harness are closed.
- * 4. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
+ * 5. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
  *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
- * 5. **Hooks.** Callbacks registered with `ctx.onSweep`.
+ * 6. **Hooks.** Callbacks registered with `ctx.onSweep`.
  *
  * Every step runs one transaction per session it changes (a linked agent and its workflow
  * share one, child first), so the sweep follows the lock order in `store/types.ts`. A failing
@@ -26,13 +37,41 @@ import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-
 const BATCH = 100;
 /** How long a control signal is kept after it was written. */
 const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
+/**
+ * How old a wake outbox row is before the sweep delivers it: longer than a delivery after
+ * commit takes, so the sweep seldom sends a wake its commit is still sending. Sending one
+ * twice is harmless either way (the idempotency key).
+ */
+export const WAKE_GRACE_MS = 2000;
+/** How often the orphan scan runs after the first pass of a Tenant opened on this process. */
+export const ORPHAN_SCAN_MS = 60_000;
+/** Each open Tenant's sweep state on this process: when its orphan scan last ran. */
+const passes = new WeakMap();
 export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
         return;
     const now = new Date();
+    const first = !passes.has(ctx);
+    const pass = passes.get(ctx) ?? {};
+    passes.set(ctx, pass);
+    const scanOrphans = pass.orphansAt === undefined || now.getTime() - pass.orphansAt >= ORPHAN_SCAN_MS;
     const steps = [
+        [
+            "wakes",
+            () => deliverPendingWakes(ctx, first ? now : new Date(now.getTime() - WAKE_GRACE_MS)),
+        ],
         ["linked", () => reconcileLinkedAgents(ctx)],
-        ["orphans", () => wakeOrphanedSessions(ctx, now)],
+        ...(scanOrphans
+            ? [
+                [
+                    "orphans",
+                    async () => {
+                        await wakeOrphanedSessions(ctx, now);
+                        pass.orphansAt = now.getTime();
+                    },
+                ],
+            ]
+            : []),
         [
             "sandboxes",
             () => ctx.sandbox.sweep({
@@ -68,6 +107,26 @@ export async function sweep(ctx) {
     if (failure)
         throw failure.error;
 }
+/**
+ * Deliver the wake outbox rows written before `before` (oldest first, one batch) and delete
+ * the delivered ones. A row the Tenant declines (it is closing) stays. Returns the ids of the
+ * rows delivered.
+ */
+export async function deliverPendingWakes(ctx, before = new Date()) {
+    const pending = await ctx.store.tx((t) => t.pendingWakes(before, BATCH));
+    const delivered = [];
+    try {
+        for (const row of pending)
+            if ((await ctx.wake(row.sessionId, row.wake)) !== false)
+                delivered.push(row.id);
+    }
+    finally {
+        // Delivered ones go even when a later one fails, so they are not sent again.
+        if (delivered.length > 0)
+            await ctx.store.tx((t) => t.deleteWakes(delivered));
+    }
+    return delivered;
+}
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export async function reconcileLinkedAgents(ctx) {
     const { store } = ctx;