@voltro/data-transfer 0.75.0 → 0.77.0

package/CHANGELOG.md

@@ -39,6 +39,465 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.77.0] — 2026-09-22
+
+### ⚠ BREAKING
+
+- **Flow run rows record a cancellation request as `cancelling` until confirmed** — `@voltro/plugin-ai-flows`, `@voltro/devtools-ui`, `@voltro/cli`
+
+  `cancelFlow` used to write the flow row to `cancelled` before asking the engine, so a receipt reporting `engine: 'unreachable'` or `'unknown'` sat next to a row that read as a stopped run, and a reader of the row alone could not tell the difference. `RunStatus` gains `cancelling`: a live row now records the request as `cancelling` with `cancelledAt` as the request time and reads `cancelled` only once the engine confirmed — through the receipt's `engine: 'cancelled'`, the engine honouring the request at its next step boundary, its own run row turning cancelled, or a repeated confirmed request. Terminal rows are never resubmitted. The plugin documentation now states what a UI renders per `engine` outcome. Migration: extend exhaustive `RunStatus` switches and any filter that treated `cancelled` as the request marker; render `cancelling` as an open request and offer a retry when `engine` was `unreachable` or `unknown`. Only `succeeded`, `failed` and `cancelled` are terminal; `useFlowRun` reports `done` for those alone.
+
+  **`voltro update` carries you across this** — codemod `0.77.0/01_flow-cancelling-row-status`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.77.0).
+
+### Added
+
+- **An `@source` glob that matches no file is now reported** — `@voltro/cli`
+
+  Tailwind generates a utility only when it finds the class in a scanned file, and a `@source` pointing at a directory that does not exist is not an error — it is a set with no members. The build stays green and the page renders with classes that name rules which were never generated. `voltro build` now warns for every `@source` glob that matches nothing, and `voltro doctor` reports the same. The usual cause is scanning a dependency at a path it does not publish: a package that ships only its bundle has no `src/` once installed, so `@source "../node_modules/<pkg>/src/**"` matches everything in a workspace (where the dependency is a symlink to its source tree) and nothing in CI. Scan the one path the package publishes — `@source "../node_modules/<pkg>/dist/*.js"` — and rebuild that dependency after editing it, since its bundle is what you scan.
+
+### Fixed
+
+- **A failing admission placement no longer holds the drain at one tick per second** — `@voltro/cli`
+
+  Physical workflow admission drains every placement on a coordinated tick and backs off to a five-second reconciliation bound when a tick finds nothing to admit. A placement whose recovery failed on every tick — a release census page that threw, a placement that could not be opened — kept the tick at its base interval instead: the failure counted as "not idle", the interval never left one second, and the process wrote one schedule claim per second for as long as the condition lasted, with `scanned: 0` on every drain and every run terminal. Such a tick now reports `idle: true` beside its `placementFailures`, `discoveryProblems` and `releaseFailures`, backs off like a healthy idle tick, and retries the failing placement at the reconciliation bound; it is never disarmed, and the `physical recovery incomplete` warning still names the placement, the phase and the database's own reason. Incomplete discovery is unchanged: a further page is known work.
+
+  Two causes of a permanently failing release census are closed with it. The census pager compared row identities in code-unit order to detect a stalled cursor, while the store had ordered and cursor-filtered the page under its own collation; a correctly ordered page could be refused wholesale, and with it every global pool permit release behind it. The pager now walks a page as the store returns it and refuses only a page that repeats its cursor row or an identity within itself, naming both identities. And a census page that throws no longer pins its cursor: the next tick restarts that placement's census from the beginning, so an owner released behind the cursor since is visited again rather than waiting behind a page that fails on every read.
+- **A file migration body runs under test without a database** — `@voltro/database`
+
+  `makeFileMigrationContext` accepts an in-memory store without a `sql` client, so a migration's `each`, `rewrite` (temporal guards included), `expect`, `skipUnless`, `store`, `log` and a Promise body under `transactional` run in a unit test against the framework's own in-memory store. The surfaces that genuinely need a connection — `raw()`, every `ctx.schema` operation, an Effect body under `transactional` — fail with the new typed `MigrationNeedsSqlClient`, whose message names the operation and what is missing. A placeholder handed in as `sql`, or a SQL-backed store arriving without its client, is refused at construction with the same error. Previously `rewrite` introspected the live schema unconditionally and a database-free test died with `TypeError: onDialectOrElse is not a function` from inside the bundle. `FileMigrationContextInput` is now the union of `FileMigrationContextLiveInput` (client + store) and `FileMigrationContextInMemoryInput` (a store without `run`); the runner's call shape is unchanged.
+- **`voltro data restore` accepts an empty target and names a takeable remedy** — `@voltro/cli`, `@voltro/data-transfer`, `@voltro/database`
+
+  A native restore into a freshly created database was refused because the in-progress marker's table did not exist there, and the refusal said to run `voltro db apply` first — which on that target installs the current declared schema, the very state the artefact is about to replace. The restore now creates that one table itself, index- and trigger-free like the migration ledgers, and writes the marker into it before the first destructive statement; a refusal that remains carries the driver's own reason. `--no-marker` now means no marker on every target, warns every time, and no longer reports afterwards that "the restore artefact removed the in-progress marker and it could NOT be written back" over a run that never wrote one. On sqlite and turso the restore closes its bookkeeping connection before the file copy, removes the replaced file's `-wal` / `-shm` sidecars with it, and reopens bookkeeping afterwards: writes through the old connection landed the old database's WAL frames beside the new file, which SQLite replayed over it on the next open.
+- **Rolling-deploy advisory skips tables the same plan creates** — `@voltro/database`, `@voltro/cli`
+
+  `voltro db plan` and `db apply` no longer flag an operation as unsafe under a rolling deploy when the table it targets is created by the same plan. A fresh deployment against an empty database used to print one "old instances may write values … the new CHECK rejects" line per enum-membership CHECK, because the classifier judged each operation alone and never asked whether the plan's own `create-table` list held the table. No instance on a previous release can touch a table that did not exist a moment earlier, so the rule covers every kind — CHECK, foreign key, unique constraint, `NOT NULL`, type change, JSON validation — not only the one reported. A mixed plan still flags the same operations on pre-existing tables. Every remaining verdict now names its premise (`instances on the previous release …`), and the JSON warning carries a `premise` field, so a deployment with no previous release can tell from the message alone that the advisory does not apply. `classifyRollingDeploySafety` accepts an optional plan context (`{ createdTables }`); `createdTablesOf` builds it from a plan.
+- **The precompiled serve bundle boots with a trace exporter on** — `@voltro/cli`
+
+  `voltro serve` from the bundle `voltro build` writes died at boot whenever a trace exporter was active — `FRAMEWORK_TRACING=console` with `ConsoleSpanExporter is not a constructor`, an `OTEL_EXPORTER_OTLP_ENDPOINT` with `OTLPTraceExporter is not a constructor` — while the ring-only serve, dev and every test path booted fine. The OpenTelemetry SDK packages are CommonJS and are reached through a dynamic `import()`; the bundler splits such an import into a chunk that exposes only `default`, so every named member read off that namespace was `undefined`. The production bundler now routes a dynamic import of an inlined CommonJS package through an ESM facade that carries the same named exports Node gives it, so the console and OTLP exporters, the metrics readers and any other lazily imported CommonJS package construct as they do under development. Both exporters are now booted from a relocated production bundle in the bundle test matrix, and each has to deliver a span.
+
+  The facade has a measured cost, split without remainder against the previous release: the web start bundle grows 14 901 B (0.87 %) and the api serve bundle 28 552 B (0.34 %), both from the re-exported CommonJS surfaces; no file count moves. The remaining growth of the same release (22 B and 35 893 B) is ordinary source change. The artefact budgets are re-pinned to the measured sizes with the same 15 % headroom.
+- **A store failure carries the sentence that explains it** — `@voltro/protocol`, `@voltro/database`, `@voltro/runtime`
+
+  `StoreOperationFailed.cause` reduced every error to its class name, so an eager load on a table with no relations registered arrived as `cause: "Error"` while the refusal's own sentence — naming the table, the missing `relations(...)` declaration and the likely fix — was only recoverable by unwrapping the value by hand. A sentence the framework authored now travels whole in `cause`; anything a driver raised is still reduced to its class and code, because the driver's text carries row data and socket addresses. The error's `message` is now one readable sentence (`query on 'x' failed: …`) instead of a JSON rendering of its fields, so a test reporter, `Cause.pretty` and the undeclared-error envelope all show the diagnosis. And when a statement fails and takes the connection with it, `EffectStore.transactional` now reports the statement's failure (with its code) instead of the rollback's uncoded error that used to replace it. `@voltro/database` exports `authoredError` / `authoredMessageOf` for a hand-written store that wants the same treatment.
+- **A boot missing `@effect/opentelemetry` refuses once and names its cause** — `@voltro/runtime`, `@voltro/cli`
+
+  `@effect/opentelemetry` has been an optional peer of `@voltro/runtime` since 0.33.0, and the note that made it one said to skip the install unless traces or metrics are exported. That scope was too narrow: the tracer layer loads the OpenTelemetry SDK whenever a trace sink is installed, and `voltro dev` arms its in-process trace ring by default — so every `voltro dev` needs the package with no tracing variable set, and `voltro serve` needs it when its inspect trace ring or an exporter is on. Measured against the published 0.75.0 and 0.76.0 with the package absent: identical refusals, unrelated to `VOLTRO_TRACING_PERSIST`. Three things change. The refusal is now a marked boot refusal: printed once without a stack on every boot path, listing each cause that kept the layer active with the switch that removes it (the previous message named `FRAMEWORK_TRACING=off` for a ring that variable does not touch). `voltro doctor` reports `@effect/opentelemetry is not installed` when the installed runtime cannot see it, using the runtime's own lookup path, and fails the run unless `VOLTRO_TRACING_BUFFER=off` is set. And the corrected scope is re-issued as `0.77.0/03_tracing-peer`, printed for every project because tracing is configured outside the repository; the codemod text scan now also reads tracked `.env*` files, where those switches live. The golden churn is `otelImportFailure` gaining an optional second parameter, which no existing call can fail to compile against.
+- **TypeScript 7 upgrade note: typed ESLint alias pair and removed tsconfig options** — `@voltro/cli`
+
+  The 0.76.0 dependency note recommended TypeScript `^7.0.2` and read as though a plain bump were sufficient. It is not for a workspace that lints with typescript-eslint: the current release line declares the peer `"typescript": ">=4.8.4 <6.1.0"` and exits 2 on load under TypeScript 7, before linting anything. TypeScript 7 also removed `"moduleResolution": "node"` (TS5108) and `baseUrl` (TS5102), which the note did not mention. A note under an already-published version reaches nobody who acted on it, so the corrected guidance is re-issued under `0.77.0/02_typescript7-side-by-side`: the side-by-side alias pair (`"@typescript/native": "npm:typescript@^7.0.2"`, `"typescript": "npm:@typescript/typescript6@^6.0.2"`) that keeps `tsc` on 7.0 while typed ESLint resolves the 6.0 API, the two removals with their replacements, and when a plain bump is fine. Gated on any `typescript` declaration or removed option, so it reaches workspaces that bumped, reverted, or have not bumped yet.
+
+### Internal (no consumer-facing effect)
+
+- **A release moves `latest` only once every tarball is downloadable** — `@voltro/cli`
+
+  npm writes a new version into a package's metadata before the tarball behind it is downloadable from the CDN, and a consumer installing on `latest` inside that window sees a resolvable version whose download answers 404. The release now holds the promotion of `latest` until every published tarball answers 200 from the URL its own metadata publishes, and refuses to promote — leaving the previous release in place — if one does not within a bounded wait.
+
+---
+
+## [0.76.0] — 2026-09-21
+
+### ⚠ BREAKING
+
+- **Align i18n peers and generated projects with current dependency majors** — `@voltro/cli`, `@voltro/i18n`, `@voltro/plugin-mail`, `@voltro/ai`, `@voltro/web`
+
+  `@voltro/i18n` now requires `react-intl ^12.0.0`. Align direct declarations before reinstalling. New workspaces, packages and generated TypeScript clients use TypeScript 7, Vite 8 and Vitest 5; JavaScript compiler-API consumers use the official `@typescript/typescript6` compatibility package. Email examples use `react-email` instead of deprecated `@react-email/components`; update both dependencies and imports. Run typechecks, tests, declaration builds and email rendering after upgrading. Gateway catalogs preserve the `evaluation` modality, and the realtime relay rejects models without credential-minting or WebSocket support before provider I/O.
+
+  The browser bundle grows with React 19.3: the `react` group is +8.4 KB raw (react-dom and scheduler), `hooks` +251 B and `router` +184 B, while `index` shrinks 2.7 KB — a net +6.2 KB first load and +8.4 KB islands first load. The React group is the price; the rest is churn.
+
+  **`voltro update` carries you across this** — codemod `0.76.0/04_dependency-toolchain`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.76.0).
+- **Persist explicit workflow retry intents and return durable observations** — `@voltro/runtime`, `@voltro/cli`, `@voltro/devtools-ui`, `@voltro/voltro`
+
+  `ctx.workflows.retry` requires `{ requestId, payloadOverride? }` and returns `WorkflowRetryObservation`. Dev and Serve persist the retry before admission and dispatch a distinct execution; resubmitting the same intent reuses its execution. Inspect retry requires the same request ID and returns the observation. Bulk retries require preview-bound request identities and preserve outcomes in `retries` instead of marking engine acceptance as execution success. The single-run CLI requires `--request-id`.
+
+  Migration: persist one request ID per deliberate retry, reuse it after lost replies, and branch on the observation kind. Read the existing intent instead of creating another to check status. `voltro update` includes `0.76.0/06_durable-workflow-retry` with the caller migration steps.
+
+  Shared workflow pages persist retry references before dispatch and restore them after reload. `useRetryRun` returns `WorkflowRetryObservation` and accepts `WorkflowRetryCommand`; supply `controlScope` and `useRetryReceipt` for recovery. Payloads are not stored in the browser journal.
+
+  Bulk dashboard retries persist the complete preview before submission, share identities with individual retries, and retain every observation in `BulkRunResult.retries`. Custom bulk panels provide `prepareRetries` and `observeRetry`; queued or accepted retries are not counted as completed workflows.
+
+  CLI bulk retry requires a saved `--plan-file` preview before `--commit`. The private, exclusively created file binds process URLs and original run identities to request IDs, including shared identities across replicas. Repeated commits reuse the plan; `--observe` only reads receipts. Changed selectors or process sets refuse dispatch.
+
+  Delayed retry preparation and errors preserve the currently inspected app’s journal when navigating between apps.
+- **Flow cancellation preserves engine acknowledgements and completed results** — `@voltro/plugin-ai-flows`, `@voltro/cli`
+
+  `cancelFlow` returns `FlowCancelReceipt`, retaining the full workflow control receipt for later observation and separating row status from engine acknowledgement. Unknown or accepted interruptions no longer report confirmed cancellation; completed flow rows survive competing cancellation requests. Migration: use `FlowCancelReceipt` from `@voltro/plugin-ai-flows/ir` as the action output schema, handle all engine outcomes, and preserve `control` for read-only request observation. Do not show a stopped-success message for accepted or unknown outcomes.
+
+  **`voltro update` carries you across this** — codemod `0.76.0/01_flow-cancellation-receipts`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.76.0).
+- **Signed private-file links bind to their storage mount** — `@voltro/plugin-storage`
+
+  Bind signed private-file grants to their storage HTTP mount as well as the reference ID. Moving a link to another storage instance is refused even when independent stores contain matching reference IDs. Migration: `GrantTokenPayload` now carries a required `audience`, and `signGrant` takes the mount as a fourth optional argument defaulting to `/_voltro/storage`. Links minted before this release carry no audience and are refused, so regenerate them through the authorized URL-minting flow after updating.
+
+  **`voltro update` carries you across this** — codemod `0.76.0/07_storage-grant-audience`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.76.0).
+- **Budget refusals stay typed and zero checks require headroom** — `@voltro/ai`, `@voltro/workflow`, `@voltro/cli`, `@voltro/voltro`
+
+  `requireAiBudget` exposes `AiBudgetError`: capacity, invalid input and reservation identity conflicts are typed failures; `releaseAiBudget` exposes invalid input too. Zero or omitted `addUsd` checks strictly positive headroom, refusing an exactly exhausted budget without reserving anything. Positive reservations can fill the limit and replay without double spending. Durable budget holds recheck the completed generation after waking instead of immediately parking again, and preserve typed recheck failures. Migration: handle `AiBudgetInvalidInput` and `AiBudgetReservationConflict` beside `AiBudgetExceeded`, widen explicit error-channel annotations to `AiBudgetError`, and do not use a zero preflight as authorization for a free call at an exhausted limit.
+
+  **`voltro update` carries you across this** — codemod `0.76.0/02_budget-refusals`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.76.0).
+- **WebSocket gateways cancel pending setup and bound outbound writes** — `@voltro/protocol`, `@voltro/runtime`, `@voltro/cli`, `@voltro/voltro`
+
+  Gateway connections expose `signal` and `sendAsync`, keep message listeners live during asynchronous setup, reclaim teardown returned after disconnect, and bound active plus queued writes. Defaults are 1 MiB per message, 4 MiB pending bytes and 64 pending messages; declare `limits` on the gateway for larger foreign-protocol frames. Await `sendAsync` for local transport backpressure, not peer delivery confirmation; `send` remains a convenience that closes on overflow. Inbound limits apply before application dispatch, after platform message assembly. Migration: custom `WebSocketGatewayConnection` adapters and test doubles must implement the abort signal and awaitable bounded writer; ordinary gateway callbacks remain source-compatible. `voltro update` explains this contract.
+- **Bulk workflow CLI commits require a saved preview plan** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  `cancel-many` and `replay-many` require `--plan-file PATH` before `--commit`. Save a preview first, then reuse the same options and file to commit exactly those original runs. Existing plans are never overwritten. Cancel plans retain their request IDs and support read-only `--observe`; cancellation acceptance is not reported as confirmation. Redrive plans and the dashboard bulk panel bind the previewed execution identity and refuse a changed execution, without claiming a new retry receipt or workflow completion.
+
+  **`voltro update` carries you across this** — codemod `0.76.0/06_durable-workflow-retry`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.76.0).
+
+### Added
+
+- **Explain workflow admission polling with live diagnostics** — `@voltro/runtime`, `@voltro/cli`
+
+  Expose process-local workflow admission timing, wake and failure diagnostics through flow-control inspection and `voltro workflows flow --format json`. Each responding process keeps its own snapshot; reads do not wake or claim work. Explain physical-discovery recovery polling instead of promising that primary-store notifications eliminate every idle claim. The generic scheduler also exposes bounded, payload-free snapshots through `inspectCoordinatedSchedule`.
+- **Compose durable admission bindings atomically** — `@voltro/workflow`, `@voltro/cli`
+
+  Expose the database-only `reserveAdmissionSubmissionInTransaction` primitive for hosts that must bind admission and start receipts in one existing admission transaction. Internal retry preparation now rolls back capacity, receipt, and execution binding together when any write fails; this does not yet activate a new dashboard retry path.
+
+  Declare the internal retry-intent table through the shared workflow schema assembly so development and deployment migrations agree.
+
+  The shared admission worker recovers pending internal retry preparations in each physical workflow store, retaining deferred deadlines and terminal admission outcomes.
+- **Storage upload input carries an optional operation identity** — `@voltro/devtools-ui`, `@voltro/cli`
+
+  Expose an optional operationId in shared storage upload input and preserve it through the dashboard upload proxy. Validate it before issuing a storage ticket so an explicitly identified upload is never silently converted into an ordinary write.
+- **Dispatch binary Inspect uploads before text decoding** — `@voltro/runtime`, `@voltro/cli`
+
+  Inspect routes can declare exact binary handlers that receive the original byte stream and request cancellation signal. Development and production use this entrance for the replica-bound storage upload relay, preserving the Inspect disable gate and development host guard. Early rejection responses are preserved without prematurely destroying the request socket. Both dashboard hosts use the relay for replica-bound upload transfers.
+- **Add single-replica targeting for Inspect actions** — `@voltro/cli`
+
+  The shared development and production Inspect entrances accept `targetReplica` on the dedicated `/_voltro/inspect/target/` path for a single addressed request, independently of observation collection. Authorization uses the actual method, the receiving process verifies its identity, and forwarding never retries or falls back to another replica. Binary responses preserve bytes and attachment headers without JSON projection. Client adapter and upload-ticket affinity must explicitly carry this target; read selection does not automatically target writes.
+
+  Older dispatchers reject the dedicated path rather than ignoring a target query and executing an untargeted mutation.
+
+  Addressed writes retain the separate write credential for the receiving process to verify. Read-only requests never forward it. A two-process regression covers separate in-memory object stores with colliding reference IDs: downloading and deleting on one replica leaves the other untouched.
+- **Plugin inspection lists data-change, observability and surface hooks** — `@voltro/cli`
+
+  Include data-change, observability, REST-surface and procedure-surface hooks in plugin inspection metadata without invoking them.
+- **Authenticated server-owned realtime voice and text sessions** — `@voltro/ai`
+
+  `defineRealtimeSession` relays normalized voice/text events through an authenticated WebSocket gateway while keeping all provider credentials on the server. Subject/model authorization precedes provider setup; bounded queues, setup/session deadlines and scoped cancellation prevent abandoned sessions. `resolveRealtimeModel` supports Gateway and OpenAI SDK realtime models, and browser-safe event schemas ship at `@voltro/ai/events`. Realtime joins the executable modality set. This uses a dedicated gateway socket, not RPC subscriptions, and provides no tool execution, budget reservation or automatic retry/replay of paid input.
+- **Inspect upload tickets accept a durable operation identity** — `@voltro/plugin-storage`
+
+  Accept an optional operationId for inspect upload tickets and carry it through the binary upload into the existing durable object-write boundary. Renewed tickets reuse the same reference and quota reservation; changed content under the same identity is refused. Identities are scoped by storage instance. Durable admission requires a bound data store with default reference and grant stores.
+- **Streaming transcription with explicit raw-audio and partial-result contracts** — `@voltro/ai`
+
+  `streamTranscribe` exposes the provider's live partial, delta and finalized-segment events followed by one complete result. Its explicit raw-audio format refuses container files, preserves provider send backpressure, and cancels audio/provider work on abort or stream disposal. Browser-safe event and typed error schemas are exported through `@voltro/ai/events`; the existing one-shot file transcription API remains unchanged.
+- **Restore database read shapes in JSON date fixtures** — `@voltro/testing`
+
+  `hydrateFixtureRows(table, rows)` restores strings in declared timestamp and date columns to `Date` before seeding a test store. Text and JSON payloads stay untouched, and invalid dates report their row and column. The helper does not manufacture defaults or claim to emulate SQL constraints and driver behavior.
+- **Describe durable retry observations without conflating acceptance and completion** — `@voltro/protocol`, `@voltro/cli`, `@voltro/runtime`
+
+  Add a shared retry observation schema for queued, accepted, unconfirmed, not-started and rejected intents. Internal resident observations preserve stopped automatic-retry state and reject acceptance of the original execution ID. The dashboard retry action is being migrated to this contract.
+
+  Expose `ctx.workflows.readRetry(runId, requestId)` in development and production runtimes. Reading validates the requested identity and never dispatches another attempt.
+
+  Share validated retry target and command schemas across resident preparation and SDK observations. Reject blank identities before ownership resolution and verify that resident observations match the requested intent.
+
+  Expose a read-authenticated Inspect retry observation endpoint through the shared Dev/Serve router. Reads validate the target and returned evidence without dispatching another attempt.
+
+### Changed
+
+- **Dashboard analytics activity measures real sink operations** — `@voltro/cli`
+
+  Measure actual AnalyticsSink operation executions for dashboard activity instead of unrelated plugin hooks. Track invocation counts, failures and duration for track, aggregate, timeseries and topN in every boot path without recording event names, identities or payloads. Preserve provider initialization, mirroring and disposal semantics.
+- **Dashboard uploads resume under a persisted operation identity** — `@voltro/devtools-ui`, `@voltro/cli`
+
+  Persist unfinished dashboard uploads before sending bytes and reuse their operation identity after reload. Reselect the original file to recover an uncertain result; changing attribution requires explicitly starting another upload. StoragePage now requires uploadScope to isolate attempts by destination. Browser storage failures prevent sending an untracked upload.
+
+  Damaged recovery records can be explicitly discarded after confirmation. Changed or valid records are protected from this recovery action; storage removal failures remain visible.
+
+  Coordinate upload and recovery-discard operations across tabs on the same origin with Web Locks. Refuse concurrent actions and stale attempts. Uploads require Web Locks in a secure browser context (HTTPS or localhost).
+- **Expectation observations carry the full declarative rule** — `@voltro/runtime`, `@voltro/devtools-ui`
+
+  Include the full declarative rule in expectation observations and inspection responses. The dashboard displays both row-count bounds, the checked column and allowed value range, and distinguishes tolerated violation rates from absolute violation counts. Cloud inspection preserves the same rule metadata.
+- **Plugin badges report activation, not live health** — `@voltro/devtools-ui`
+
+  Clarify that plugin activation badges report successful startup activation, not live health or shutdown status.
+
+  Omit unavailable plugin counts during initial loading and failed reads rather than showing zero or a stale count.
+- **Clarify terminal stream events versus the persisted done flag** — `@voltro/ai`
+
+  Document that a resumable consumer can receive its terminal event before `isDone` becomes true, even without a failure. Event persistence precedes `markDone`; consumers finish on the event, while callers requiring the done write await `startResumableProducer`. Reversing this order could let readers miss the final event. This clarifies existing behavior without changing it.
+- **Distinguish stale workflow observations from dead runners** — `@voltro/workflow`
+
+  Workflow debugging guidance no longer recommends terminating a database session from stale heartbeat timestamps, missing runner entries or pooler addresses. These observations show missing progress, not process death. Establish runner lifecycle and exact session ownership before a disruptive recovery action; row-based leases do not prove that an old worker has stopped either.
+
+### Fixed
+
+- **Agent tool panels hide stale snapshots and explain disabled surfaces** — `@voltro/devtools-ui`
+
+  Hide stale agent-tool snapshot timestamps and provenance during loading and failed reads, including falsy error values.
+
+  Give disabled agent surfaces a dedicated explanation instead of unusable search and misleading empty inventories.
+
+  Use a tool-specific search label that describes the fields actually searched.
+- **Handle aggregate dashboard refresh failures and duplicate submissions** — `@voltro/devtools-ui`
+
+  Manual refresh catches request failures, identifies the affected aggregate, and unlocks another attempt. Concurrent submissions are prevented and local hosts reload the snapshot after a processed request. Read failures no longer appear as an empty inventory. Refresh metadata wraps on narrow screens.
+- **Report manual aggregate refresh failures and skipped runs** — `@voltro/cli`
+
+  Manual Inspect refresh returns 409 for an overlapping refresh or an unclaimed coordination slot, and 500 for a failed computation. These outcomes no longer produce a successful receipt. Failed builds preserve the last-good rows and record their error. Scheduled refresh and runtime handle coordination retain their existing skip semantics.
+- **Aggregate inspection and refresh reach serve through the shared router** — `@voltro/cli`
+
+  Expose aggregate inspection and manual refresh through the shared authenticated router in both development and serve deployments. Serve now supplies its actual aggregate registry; write operations retain method-aware authorization.
+- **AI flow inspection reads carry a process observation scope** — `@voltro/plugin-ai-flows`
+
+  Declare AI flow definitions and run inspection as process-scoped observations. Replica-selected reads now carry the required observation envelope instead of failing with HTTP 502. The dashboard keeps run summaries and selected detail payloads associated with the answering replica, including when bound stores are process-local.
+- **AI run details stay closable while their request is pending** — `@voltro/devtools-ui`
+
+  Keep the selected AI run identity and Close details action visible while its detail request is loading or has failed. Closing the detail returns to the available run list without waiting for the request to succeed.
+- **Analytics inspection behaves the same in development and serve** — `@voltro/cli`
+
+  Serve analytics inspection through the common authenticated API inspect router. Development and serve boot paths now expose the configured analytics sink and recent plugin metrics consistently, including explicit unavailable responses when no inspection provider is attached.
+- **Await asynchronous schedule Inspect snapshots before serialization** — `@voltro/cli`
+
+  The schedule-list Inspect endpoint awaits the schedule reader before returning its observation. Asynchronous liveness queries no longer serialize as an empty object and crash the dashboard schedule list. Reader failures return an explicit error response. The shared snapshot builder and Dev/Serve wiring now use the concrete schedule response type, including external-schedule liveness fields.
+- **Cache hit percentages follow the selected dashboard locale** — `@voltro/devtools-ui`
+
+  Format cache hit percentages in the selected dashboard locale, consistently with the hit and miss counters. Hide old observation metadata for every defined read error, including falsy error values, just as old measurements are hidden.
+- **Reverse-ETL health and dead-letter reads keep their replica identity** — `@voltro/plugin-cdc-out`
+
+  Declare process observation scopes for sink health and dead-letter reads so the dashboard can inspect selected replicas without losing responder identity or double-counting shared outbox counters.
+- **Reverse-ETL retries refresh sink health before another attempt** — `@voltro/devtools-ui`
+
+  Refresh sink health and failed deliveries after every Reverse-ETL retry attempt. Keep further retries disabled until a fresh successful failure-list read, including after a lost write response or a loading-state remount. Provide an explicit read retry after connection failures.
+- **Comment threads offer read recovery without losing the search** — `@voltro/devtools-ui`
+
+  Keep thread dismissal available while comment messages load or fail. Add explicit read recovery for failed thread and inventory reads without clearing the current search or page. Inspection section actions remain available independently of their read state.
+- **Aggregate refresh indicators stay hidden during pending or failed reads** — `@voltro/devtools-ui`
+
+  Hide aggregate refresh indicators during pending or failed reads and preserve text error messages instead of replacing them with an unknown error.
+- **Analytics panels separate loading, failed reads and missing data** — `@voltro/devtools-ui`
+
+  Separate loading, failed reads and missing analytics data. Failed or pending reads no longer leave stale provider capabilities and activity visible, and the error state uses accessible feedback and theme-aware colors.
+- **Small compute-budget amounts survive dashboard formatting** — `@voltro/devtools-ui`
+
+  Preserve small nonzero compute-budget amounts in the dashboard. Usage, limits, warning thresholds and tenant attribution use locale-aware significant-digit formatting instead of rounding to four decimal places and incorrectly showing zero.
+- **Experiment rates read as percentages and differences as percentage points** — `@voltro/devtools-ui`
+
+  Display experiment conversion rates as percentages and their absolute differences as percentage points, distinct from relative percentage lift. Preserve small nonzero measurements and negative differences with locale-aware significant-digit formatting. Unknown measurements remain unknown.
+- **Inspect credential badges follow current access observations** — `@voltro/devtools-ui`
+
+  Keep inspect credential configuration badges aligned with current access observations after saving. A saved result no longer masks later credential changes, and fresh observations preserve unfinished input edits.
+- **The inspect credential form admits one save at a time** — `@voltro/devtools-ui`
+
+  Prevent duplicate in-flight saves in the shared inspect credential form even when a host does not publish mutation pending state. Lock token/removal controls until completion, clear successful edits, and retain failed edits for retry.
+- **Plugin hooks count towards the cumulative invocation metrics** — `@voltro/devtools-ui`
+
+  Include recorded plugin hooks in the cumulative invocation metrics overview. Derive invocation counts and latency percentiles from hook-duration histograms and failures from the dedicated hook-error counter, so these measurements are no longer omitted from the shared dashboard.
+- **Route boundaries resolve in root-to-page inheritance order** — `@voltro/devtools-ui`
+
+  Resolve route boundaries from filesystem segments in root-to-page inheritance order. The shared route explorer now includes root and deeply nested layouts, errors, loading and not-found boundaries, including route groups omitted from the URL.
+- **The route inventory distinguishes loading, failure and an empty result** — `@voltro/devtools-ui`
+
+  Distinguish loading, failed reads and confirmed empty results in the shared route inventory. Hide retained route snapshots during pending or failed reads and expose loading/error feedback to assistive technology.
+- **Missing invocation latency reads as unknown instead of zero** — `@voltro/devtools-ui`
+
+  Show unavailable invocation latency as unknown instead of zero when duration histograms are absent, empty, or have no finite boundaries. Keep request counts visible and sort measured p95 values ahead of unknown values in the shared dashboard.
+- **Keep streamed loader handoff scripts out of client recovery renders** — `@voltro/web`
+
+  `<Await>` retains its registry script for server rendering and hydration, then removes it after hydration. Client recovery and hot updates reuse the settled registry value without recreating an executable script, avoiding React 19.3's script warning while preserving streamed layout and page data.
+- **Identify tasks in development claim-change logs** — `@voltro/cli`
+
+  Development store debug records for `_voltro_schedule_claims` include `task` and `bucket` when valid metadata is available. Only these bounded identity fields are projected; full row payloads remain excluded. Records describe delivered row changes, not SQL statement counts: bulk deletes can produce multiple records, and remote change delivery can also appear.
+- **Actions get their own Devtools scope and pending calls stay first** — `@voltro/client`, `@voltro/devtools`, `@voltro/web`
+
+  The Devtools console separates Actions from Mutations and shows their input, result, errors and timing. Pending calls sort above subscriptions and completed events, newest start first. A pending counter remains visible in every scope and opens a filter for running calls. Client invocation events carry an optional `kind` classification; `startMutation` defaults it to `mutation` and `useAction` publishes `action`.
+- **Devtools panels keep consistent spacing in narrow docks** — `@voltro/devtools`
+
+  Webhooks and Traces use full-width section headings and inset content, while the Indexes offline state uses the same content spacing. Long webhook names and descriptions wrap within narrow panels instead of crowding the card edge or truncating their descriptions.
+- **Trace inspection keeps selected records and exposes recorded span details** — `@voltro/devtools`
+
+  Selecting a trace keeps its latest captured version even when polling evicts it from the recent list. The saved selection remains visible until another entry is selected. Trace details show recorded attributes, SQL operations, errors and timing, and identify missing caller context. Subscription delivery latency stays separate from connection lifetime.
+- **Doctor distinguishes query results from per-row reads** — `@voltro/cli`
+
+  The `n-plus-one` check no longer mistakes a single query followed by `map`, `flatMap`, `forEach`, or `reduce` for a query executed per row. Reads inside those callbacks or a real enclosing loop remain findings. Guarded sibling reads and conditional filter-building queries retain their existing sequential-read exemptions.
+- **Environment inspection stops returning declared defaults and examples** — `@voltro/cli`
+
+  Exclude declared defaults and examples from environment inspection responses. Preserve default-satisfaction and missing-required counts while projecting only dashboard metadata and boolean states.
+- **The environment panel separates loading, errors and empty declarations** — `@voltro/devtools-ui`
+
+  Distinguish environment inspection loading, errors, and confirmed empty declarations. Hide stale variable states and counts after read failures and restore them on recovery.
+
+  Improve environment status contrast in light themes and wrap long names and descriptions on narrow screens.
+- **Expectations re-read current rows when a change omits a row image** — `@voltro/runtime`
+
+  Re-evaluate expectations from current rows when a store change omits a required row image. SQL updates no longer inflate row counts or retain stale value-bound violations, and scoped rules correctly detect rows leaving their population. Violation transitions retain the triggering write's provenance.
+- **Expectation null rates and freshness carry their units** — `@voltro/devtools-ui`
+
+  Display expectation null rates as locale-aware percentages without rounding small nonzero rates to zero. Freshness measurements and thresholds both include milliseconds; unknown measurements remain distinct from zero.
+- **Running experiments refresh from current rows on incomplete changes** — `@voltro/runtime`
+
+  Refresh running experiment measurements from current rows when a store change omits a required row image. SQL updates no longer double-count exposure or retain an old variant contribution; counts, sums, averages and conversion rates stay correct when rows move between variants. Update notifications retain the triggering change's provenance.
+- **Apply flag audit filters before the result limit** — `@voltro/plugin-flags`
+
+  Filtered flag history now applies the flag predicate in the database before limiting results. Newer changes to unrelated flags no longer hide the selected flag’s history.
+- **Reconcile unconfirmed flag toggles before allowing another change** — `@voltro/devtools-ui`
+
+  After an unconfirmed flag toggle, the shared dashboard requests fresh state and blocks further writes until a successful new snapshot arrives. Failed reads keep controls blocked with a read-retry action when supported by the host. Audit history refreshes after completed write attempts. A committed change with a lost response is reflected before the next toggle.
+- **Prevent duplicate flag toggles before the next dashboard render** — `@voltro/devtools-ui`
+
+  Flag controls synchronously prevent concurrent submissions across the panel. Rejected requests retain the displayed state and unlock an explicit retry. Successful local toggles request a fresh snapshot after displaying the response.
+- **Commit durable flag toggles and audit entries atomically** — `@voltro/plugin-flags`
+
+  Durable flag toggles now persist the override and audit entry in one transaction before reloading the local registry. Failed or unconfirmed writes return 503 and reconcile from durable state instead of leaving an optimistic local toggle or blindly undoing a potentially committed change. A missing durable store refuses the write. Invalid toggle bodies return 400.
+
+  Concurrent durable toggles lock the override row before reading its previous enabled state, including the first override. Updates preserve targeting and rollout fields.
+
+  First-override contenders now use distinct candidate row IDs so the flag-key conflict handler can arbitrate concurrent creation without a separate primary-key collision.
+
+  Overlapping durable reloads discard superseded responses instead of allowing a delayed earlier snapshot to overwrite newer flag state.
+- **Preserve explicitly supplied gateway media dimensions** — `@voltro/ai`
+
+  Gateway image and video calls no longer silently omit explicitly supplied empty dimension strings. Image size/aspect ratio and video aspect ratio/resolution reach the provider unchanged, including asynchronous video starts. Numeric zeros remain preserved and absent parameters remain absent. This prevents silently choosing provider defaults; it does not make empty dimensions valid or replace application input validation.
+- **Custom consent-store reads accept explicit replica requests** — `@voltro/plugin-governance`
+
+  Label custom consent-store reads with process observations so explicit replica requests work, while retaining shared-store scope for the built-in durable consent adapter.
+- **Governance exports, erasures and sweeps run one at a time** — `@voltro/devtools-ui`
+
+  Serialize subject exports, erasures and retention sweeps within each Governance panel, prevent duplicate submissions before React renders pending state, and refresh status/history after every operation outcome.
+- **Subject export and erasure bodies are validated before data access** — `@voltro/plugin-governance`
+
+  Validate subject export and erasure request bodies before accessing subject data. Reject malformed subject IDs and unknown erasure modes instead of coercing inputs or falling through to deletion.
+- **Offloaded inference recovery retains paid tasks and pending signals** — `@voltro/ai`
+
+  Offloaded inference journals successful results and terminal errors before resuming the workflow, and retries failed signal delivery without another provider call. Polling and artifact-persistence failures retain the confirmed media task, submission attempt and artifact operation IDs. Only an explicit retryable terminal provider status starts a new paid attempt; missing-handle ambiguity remains `unknown` unless the provider guarantees idempotent submission.
+- **Retain a single replica target in dashboard download tickets** — `@voltro/cli`
+
+  Storage download handoffs accept one validated `targetReplica` only on the dedicated Inspect target path and retain it during preparation and streaming. Ambiguous targets, read-selection parameters and unrelated query parameters remain rejected. The local dashboard uses this target for downloads and storage grant, revoke and delete actions instead of dropping the selected replica.
+- **Any defined inspect error counts as a failed section read** — `@voltro/devtools-ui`
+
+  Treat every defined inspect error as a failed read, including falsy error values, so failed sections hide stale contents and show an accessible error state.
+- **Bind Inspect upload tickets to the issuing replica** — `@voltro/plugin-storage`
+
+  Inspect-issued upload tickets carry a signed replica identity. The binary upload handler rejects a ticket presented to a different process before storing bytes, including deployments whose replicas share a signing secret. Ordinary application tickets without the optional replica binding retain their existing behavior. Dashboard transports must route bound uploads to the issuing process; the ticket does not itself perform routing.
+- **Inspection headers hide stale timestamps while a read is pending** — `@voltro/devtools-ui`
+
+  Hide stale timestamps and provenance in shared inspection page headers during loading or failed reads, including falsy error values.
+- **Migration rewrite guards retain full timestamp precision** — `@voltro/database`
+
+  `ctx.rewrite` compares timestamp and date guards at their original database precision while continuing to give callbacks normal decoded rows. A timestamp with microseconds no longer creates permanent false contention, and a concurrent change within one JavaScript millisecond is still rejected. This also covers implicit guards on patched temporal columns. Exhaustion diagnostics no longer assert that another writer must be responsible.
+- **Migration inspection plans against the active database dialect** — `@voltro/cli`
+
+  Use the active database dialect when planning migration inspection snapshots in dev and serve. SQLite timestamp and JSON storage no longer cause phantom type changes in the migrations panel or a false schema-convergence failure after a successful migration.
+- **Migration inspection and db drift share the planner live-table scope** — `@voltro/database`, `@voltro/cli`
+
+  Share the boot planner's live-table selection with migration inspection and `voltro db drift`. Runtime tables created after boot no longer cause false drift against a planner-scoped baseline. Unchanged full-catalog baselines remain accepted, while undeclared application tables and changes to declared tables still count as drift.
+- **Refuse known undersized migration pools before taking the lock** — `@voltro/database`, `@voltro/sql-postgres`
+
+  Direct migration calls now reject a known one-connection pool before reserving the migration lock on PostgreSQL, MySQL, MariaDB and MSSQL. Configure at least two connections for the migrating process. PostgreSQL retains capacity information for prebuilt pools as well as ordinary clients; SQLite stays exempt. Unknown custom-layer capacity and remote pooler exhaustion remain subject to connection-acquisition failures.
+- **Moderation decisions reconcile against a fresh queue read** — `@voltro/devtools-ui`
+
+  Serialize moderation confirmations and refresh after every decision. Unconfirmed writes block further decisions until a fresh successful queue read resolves the current review state, including when reading fails during the write.
+- **Malformed moderation decision bodies are rejected before lookup** — `@voltro/plugin-moderation`
+
+  Reject malformed moderation decision bodies and non-string review IDs before looking up or changing a review.
+- **Finite durable waits suspend inside activities** — `@voltro/workflow`, `@voltro/ai`
+
+  `awaitSignalSuspending` propagates the signal/clock race's suspension to its calling activity. A `mediaStep` nested inside `step` now parks with a finite timeout instead of retrying the suspension as an interrupted operation. Resume reuses the queued inference; elapsed deadlines remain failures and explicit workflow interruption remains cancellation. Suspension may run ordinary Effect finalizers and must not alone be treated as business failure.
+- **Notification, comment and billing panels declare process scopes** — `@voltro/plugin-notifications`, `@voltro/plugin-comments`, `@voltro/plugin-billing`
+
+  Declare process observation scopes for notification delivery/inbox, comment thread, and billing usage dashboard reads so explicit and combined replica selections can load their data without 502 errors.
+- **Queue search covers policies, activity and produced counts** — `@voltro/devtools-ui`
+
+  Apply queue dashboard search consistently to consumer policies, topic activity and produced-message counts. Searching a consumer group or dead-letter topic includes production for its matching source topics. Producer-only topics remain searchable. Explain empty search results and provide a clear-search action.
+- **Queue topics count under their literal names** — `@voltro/plugin-queue`
+
+  Count queue topics by their literal names in process-local inspect metrics. Topics matching JavaScript object properties, including constructor and __proto__, now retain numeric consumed, retry, dead-letter and produced counts and appear correctly in the dashboard's serialized producer statistics.
+- **Replica panels survive a temporary fleet inventory outage** — `@voltro/devtools-ui`
+
+  Keep the last known replica panels mounted when fleet inventory is temporarily unavailable, preserving filters and open-panel state. Mark retained membership explicitly while each panel reports its own read status. Fresh inventory replaces the retained list, including an empty result; app-scoped host boundaries prevent carrying replica state into another app.
+- **Resumable uploads enforce size limits before buffering chunk bodies** — `@voltro/plugin-storage`
+
+  Resumable finalization rejects known oversized uploads using chunk metadata before fetching bodies and checks actual bytes incrementally while assembling. Streaming backends stop reading on overflow; buffered backends stop before subsequent chunks. Database metadata checks and cleanup no longer fetch blob payloads. The existing scan and storage pipeline remains in place; the configured upload limit is not a process-memory cap.
+- **Workflow retry intents are classified as environment-local** — `@voltro/data-transfer`
+
+  `_voltro_workflow_retry_requests` no longer travels in a cross-environment transfer. A retry intent names a run and an execution in the deployment that raised it, so a foreign row binds the target to an operator action nobody asked it to perform and lets a later observation read another deployment's execution. An unclassified framework table travels by default, which is why this is a fix rather than a preference.
+- **Keep schedule inspection usable when snapshots are malformed** — `@voltro/devtools-ui`
+
+  Schedule lists and firing histories validate incoming snapshots before rendering. Malformed responses show a localized error instead of crashing or appearing empty. The local dashboard offers an immediate retry, cancels the previous read, and ignores its late response while retaining automatic polling.
+- **Schema convergence reports unavailable without a live SQL connection** — `@voltro/cli`
+
+  Report schema convergence as unavailable when the migration snapshot has no SQL inspection connection, rather than treating an empty placeholder as a passing database check.
+- **Serialize dashboard search maintenance actions and reload their status** — `@voltro/devtools-ui`
+
+  The search dashboard synchronously prevents duplicate Reindex and Resync submissions, respects pending host operations, and requests fresh index and drift data after completed attempts. Failed attempts retain their confirmation for an explicit retry.
+- **Search maintenance requests are validated before any data access** — `@voltro/plugin-search`
+
+  Validate search maintenance requests before accessing data: reject malformed bodies and repair limits, and only reindex explicitly configured source tables.
+- **Search index status and drift reads declare a process scope** — `@voltro/plugin-search`
+
+  Declare process observation scopes for search index status and drift reads, fixing failed explicit-replica requests in the dashboard while keeping already-aggregated counters separate between replicas.
+- **Production logs delivered row changes at debug level, like development** — `@voltro/cli`
+
+  `voltro serve` emits the same `<op> on <table>` debug line on the store change channel that `voltro dev` emits, through the same bounded projection: the operation, the table, and for the schedule-claim ledger only, its allowlisted task name and bucket. No row payload is ever logged. A change-stream question that was answerable while developing and unanswerable in production is the asymmetry this removes; the line stays off unless the log level asks for it.
+- **Migration history reads use SQL Server pagination syntax** — `@voltro/cli`
+
+  Use SQL Server pagination syntax when reading migration history. The migrations panel and schema-convergence check no longer fail on SQL Server because of an unsupported LIMIT clause.
+- **An uncertain storage upload can be checked without resending bytes** — `@voltro/devtools-ui`
+
+  Add a read-only check after an uncertain storage upload: search the attempted object key and refresh files and statistics without resubmitting bytes. Preserve the selected file and ownership fields for inspection and an explicit later retry.
+- **Preserve storage reads in replica selection** — `@voltro/plugin-storage`, `@voltro/devtools-ui`
+
+  Storage inventory, statistics and grants now return process-scoped Inspect observations. Individual and combined replica reads no longer discard successful storage responses as missing observations. Custom process-local metadata stores are not incorrectly presented as fleet-wide shared state.
+
+  The shared Storage panel presents multiple selected replicas as labelled observations instead of passing non-composable inventories to the generic fleet projection.
+- **Preserve gateway charges when structured output is rejected** — `@voltro/ai`
+
+  Structured generation captures allowlisted consumption before SDK validation, so `AiError.evidence` retains reported gateway charges when JSON or schema validation rejects a paid response. Tool loops sum costs only when every step reports a valid charge; missing prices remain unknown, and a reported zero stays actual zero. Evidence stays isolated per call and excludes response content, headers and private provider metadata.
+- **Honor both turn and SDK cancellation in tool calls** — `@voltro/ai`
+
+  Tool calls combine the caller's turn signal with the SDK invocation signal. An already cancelled turn cannot be overridden by a fresh SDK signal; either source interrupts running Effects and reaches cooperative Promise handlers through `ctx.abortSignal`. The first abort reason is preserved without aborting either source controller.
+- **Recent traces prioritize application activity over routine housekeeping** — `@voltro/cli`, `@voltro/devtools`
+
+  The grouped trace overview excludes successful traces made entirely of recognized framework housekeeping spans before applying the result limit. Errors and application traces remain visible. Show background traces in the embedded console, or use `/_voltro/inspect/traces?includeBackground=1`, to include housekeeping again. The bounded raw span buffer and direct trace-ID lookup remain unchanged.
+- **Database spans retain their request context across runtime boundaries** — `@voltro/runtime`
+
+  Awaited work dispatched through another Effect runtime sharing a tracing layer retains its active parent span, so database calls stay in the request's trace. Concurrent requests and independent tracing layers remain isolated, and explicit parent or root choices take precedence.
+- **Native bundle dependencies resolve through transitive driver packages** — `@voltro/cli`
+
+  Resolve native bundle dependencies through installed transitive driver and plugin dependencies. SQLite serve bundles now find better-sqlite3 under the Effect driver in strict pnpm layouts, including after deployment relocation. Failures while loading a resolved native module remain visible rather than falling back to another copy.
+- **Expired credentials retain their typed RPC failure** — `@voltro/protocol`, `@voltro/runtime`
+
+  RPC authentication rejections now reach HTTP and WebSocket clients as `Unauthenticated`, including rejections from the authentication strategy chain. Auth-refresh handlers can match `_tag` instead of inspecting `InternalError` messages. Unexpected resolver exceptions remain defects. The same middleware handles development and production servers; no configuration change is needed.
+- **Webhook tables and counts hide after a failed snapshot read** — `@voltro/devtools-ui`
+
+  Show initial Webhook loading and hide stale tables and counts after snapshot read failures. Successful reads restore the selected view while subscription drafts and revealed signing secrets remain available during interruptions.
+- **Invalid webhook commands differ from missing deliveries and failures** — `@voltro/cli`
+
+  Webhook Inspect writes reject non-object JSON before dispatch. Subscription policy errors return HTTP 400 with an actionable error and field; missing replay deliveries return HTTP 404. Unexpected internal errors remain HTTP 500 without exposing raw driver details.
+- **Webhook snapshots project explicit fields instead of database rows** — `@voltro/cli`
+
+  Project explicit dashboard fields in Webhook Inspect snapshots instead of spreading database rows. Signing secrets, custom headers, signing configuration, delivery payloads, response bodies and unknown database fields no longer appear in target and delivery responses.
+- **Failed webhook reads surface instead of reporting empty activity** — `@voltro/cli`
+
+  Propagate failed Webhook target, delivery and delivery-history reads instead of reporting empty lists or never-delivered activity. Use bounded error messages without database-driver details so dashboards can show a failed read and recover on their next successful snapshot.
+- **Undeclared webhook storage is distinct from a failed database read** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  Distinguish undeclared Webhook storage from failed database reads. Development and production inspection derive availability from the declared schema; the shared dashboard explains unavailable storage and hides management actions. Existing declared storage remains visible even without current event declarations.
+- **Refuse webhook management actions for missing target IDs** — `@voltro/plugin-webhooks`, `@voltro/cli`
+
+  Webhook target resolution checks explicit IDs before management writes. Pause, resume, deletion, secret rotation, target edits and payload-version changes refuse a missing target with the browser-safe `WebhookTargetNotFound` error instead of acknowledging a no-op or returning an unused secret. Inspect maps this error to HTTP 404. Test deliveries use the same typed error.
+- **Mint compatible webhook signing secrets for subscriptions and rotation** — `@voltro/plugin-webhooks`
+
+  The webhook service now mints Standard Webhooks-compatible secrets when creating or rotating endpoint subscriptions. Grouped subscriptions retain one shared secret. This fixes default outgoing deliveries failing before HTTP dispatch because the service supplied a hex key to the Standard Webhooks signer. Custom and inherited secrets remain unchanged; existing incompatible keys can be replaced through secret rotation and synchronized with the receiver.
+
+  Validate supplied and inherited keys against the effective scheme after event defaults are resolved. Validate the entire subscription group before inserting its first target; incompatible Standard Webhooks keys fail before any target is stored.
+- **Preserve webhook subscription drafts during connection failures** — `@voltro/devtools-ui`
+
+  Keep open webhook subscription forms and their inputs when the configuration source disconnects or reloads. Disable submission until the configuration is available and the selected event still exists, while keeping cancellation available. The same shared behavior applies to local and Cloud dashboard hosts.
+- **Bind durable admission requests to their original payload** — `@voltro/workflow`
+
+  Reusing an admission submission identity with a different encoded payload now fails instead of silently selecting the original payload. Identical JSON content still reuses the reservation regardless of object property order, including after persistence.
+
+### Internal (no consumer-facing effect)
+
+- **Resolve standard library declarations through the JavaScript compiler** — `@voltro/build`
+
+  Declaration rollups use the standard library from the official JavaScript compiler compatibility package alongside the native TypeScript compiler. A real build regression verifies generic standard-library types and a complete self-contained declaration bundle.
+- **Verify durable workflow retry recovery across process crashes** — `@voltro/cli`
+
+  Exercise fresh retry recovery through real Serve processes and SQLite resident and engine stores. Crash before engine submission or after submission without acknowledgement, then verify recovery without another command and repeated submission of the same intent without a duplicate execution. Preserve the original failed run, payload, caller context and resident-store ownership.
+
+---
+
 ## [0.75.0] — 2026-09-19
 
 ### ⚠ BREAKING

package/THIRD-PARTY-NOTICES.md

@@ -9,7 +9,7 @@ Generated from the resolved runtime dependency closure (119 packages).
 
 ---
 
-## @aws-sdk/checksums@3.1000.29
+## @aws-sdk/checksums@3.1001.0
 
 License: Apache-2.0
 
@@ -217,7 +217,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/client-s3@3.1126.0
+## @aws-sdk/client-s3@3.1134.0
 
 License: Apache-2.0
 
@@ -425,7 +425,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/core@3.977.9
+## @aws-sdk/core@3.978.0
 
 License: Apache-2.0
 
@@ -633,7 +633,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-env@3.972.70
+## @aws-sdk/credential-provider-env@3.972.71
 
 License: Apache-2.0
 
@@ -841,13 +841,13 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-http@3.972.72
+## @aws-sdk/credential-provider-http@3.972.73
 
 License: Apache-2.0
 
 _(no bundled license text found in the package; see its npm page.)_
 
-## @aws-sdk/credential-provider-ini@3.973.15
+## @aws-sdk/credential-provider-ini@3.973.16
 
 License: Apache-2.0
 
@@ -1055,13 +1055,13 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-login@3.972.77
+## @aws-sdk/credential-provider-login@3.972.78
 
 License: Apache-2.0
 
 _(no bundled license text found in the package; see its npm page.)_
 
-## @aws-sdk/credential-provider-node@3.972.82
+## @aws-sdk/credential-provider-node@3.972.83
 
 License: Apache-2.0
 
@@ -1269,7 +1269,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-process@3.972.70
+## @aws-sdk/credential-provider-process@3.972.71
 
 License: Apache-2.0
 
@@ -1477,7 +1477,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-sso@3.973.14
+## @aws-sdk/credential-provider-sso@3.973.15
 
 License: Apache-2.0
 
@@ -1685,7 +1685,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/credential-provider-web-identity@3.972.76
+## @aws-sdk/credential-provider-web-identity@3.972.77
 
 License: Apache-2.0
 
@@ -1893,7 +1893,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/lib-storage@3.1126.0
+## @aws-sdk/lib-storage@3.1134.0
 
 License: Apache-2.0
 
@@ -2101,7 +2101,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/middleware-sdk-s3@3.972.75
+## @aws-sdk/middleware-sdk-s3@3.972.76
 
 License: Apache-2.0
 
@@ -2309,13 +2309,13 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/nested-clients@3.997.44
+## @aws-sdk/nested-clients@3.997.45
 
 License: Apache-2.0
 
 _(no bundled license text found in the package; see its npm page.)_
 
-## @aws-sdk/s3-request-presigner@3.1126.0
+## @aws-sdk/s3-request-presigner@3.1134.0
 
 License: Apache-2.0
 
@@ -2731,7 +2731,7 @@ Apache License
    limitations under the License.
 ```
 
-## @aws-sdk/token-providers@3.1116.0
+## @aws-sdk/token-providers@3.1129.0
 
 License: Apache-2.0
 
@@ -3956,7 +3956,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @effect/platform-node@0.108.1
+## @effect/platform-node@0.108.2
 
 License: MIT
 
@@ -8848,7 +8848,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @upstash/redis@1.38.3
+## @upstash/redis@1.38.4
 
 License: MIT
 
@@ -9764,7 +9764,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## jose@6.2.10
+## jose@6.2.12
 
 License: MIT
 

package/dist/index.js

@@ -1,8 +1,8 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
 import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, STAGING_TABLE_PREFIX as f, _voltroDataTransfersTable as p, classifyConstraintViolation as m, derivedRowId as h, ensureTableRegistered as g, eq as _, extractDbCause as v, getTable as y, inSet as b, isNotNull as x, or as S, recordsTable as C, registerTable as ee, streamTable as w, suspendWriteRecorders as te, suspendWriteRecordersEffect as ne, unregisterTable as re } from "@voltro/database";
 import { fingerprintSchema as T } from "@voltro/database/sql";
-import { createCipheriv as E, createDecipheriv as ie, createHash as ae, createHmac as oe, randomBytes as se, randomUUID as ce, scrypt as le } from "node:crypto";
-import { copyFile as D, createReadStream as ue, createWriteStream as O, existsSync as de, rename as fe, statSync as k, unlinkSync as pe } from "node:fs";
+import { createCipheriv as ie, createDecipheriv as ae, createHash as oe, createHmac as se, randomBytes as ce, randomUUID as le, scrypt as ue } from "node:crypto";
+import { copyFile as E, createReadStream as de, createWriteStream as D, existsSync as fe, rename as pe, statSync as O, unlinkSync as k } from "node:fs";
 import { STORAGE_REFS_TABLE as A, fromNodeReadable as me, getObjectStream as j, putObjectStream as he, toNodeReadable as M } from "@voltro/plugin-storage";
 import * as N from "node:zlib";
 import { PassThrough as P, Readable as ge } from "node:stream";
@@ -57,7 +57,7 @@ var Ce = (e) => {
 		return r.classes?.[e] ?? we[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, De = (e, t) => oe("sha256", e).update(t == null ? "∅" : String(t)).digest(), V = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Oe = [
+}, De = (e, t) => se("sha256", e).update(t == null ? "∅" : String(t)).digest(), V = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Oe = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -319,6 +319,7 @@ var Ce = (e) => {
 	["_voltro_workflow_control_requests", "cancel/resume traffic issued against executions HERE — a foreign row claims an operation nobody asked the target to perform"],
 	["_voltro_workflow_queued_cancellations", "cancellations waiting on a run that is queued HERE — a foreign row cancels something the target has not queued"],
 	["_voltro_workflow_restart_requests", "restarts pending against this deployment's generations — a foreign row restarts a generation the target never entered"],
+	["_voltro_workflow_retry_requests", "retry intents an operator raised against runs HERE, keyed by their own request id — a foreign row binds the target to an intent nobody raised against it, and lets a later observation read somebody else's execution"],
 	["_voltro_workflow_parent_closures", "which parents are still waiting on children in flight HERE — a foreign row holds a parent open against a child the target is not running"],
 	["_voltro_workflow_failure_reports", "failures being handed off to a runner HERE — a foreign row makes the target take delivery of somebody else's failure"],
 	["_voltro_cdc_log", "the change rows this deployment captured from its own database — a foreign row replays a change that never happened here"],
@@ -565,7 +566,7 @@ var Ce = (e) => {
 		objectBytes: o,
 		missing: u
 	};
-}), ht = (e) => me("bundle", () => ue(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof G ? t : new G({
+}), ht = (e) => me("bundle", () => de(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof G ? t : new G({
 	reason: `asset index unreadable: ${String(t)}`,
 	path: e
 }))), gt = (e) => n.gen(function* () {
@@ -1441,20 +1442,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
 			return r ?? t;
 		}, T = (e, t, n, r = !1) => {
-			let i = k ? X(t.name) : t.name, a = t.primaryKey, o = w(t.name, n);
+			let i = O ? X(t.name) : t.name, a = t.primaryKey, o = w(t.name, n);
 			return f === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : f === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
-		}, E = (e, t) => e.savepoint ? e.savepoint(t) : t(), ie = 0, ae = (t, n, r) => {
-			r.unclassified && (ie++, !(ie > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (ie === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, oe = (e, t, r = !0) => n.tryPromise({
+		}, ie = (e, t) => e.savepoint ? e.savepoint(t) : t(), ae = 0, oe = (t, n, r) => {
+			r.unclassified && (ae++, !(ae > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (ae === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
+		}, se = (e, t, r = !0) => n.tryPromise({
 			try: e,
 			catch: (e) => On(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), se = (e) => {
+		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, oe(t.entry, t.row, e)), !1)))), ce = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
 				...Object.fromEntries(t.map((e) => [e, null]))
 			};
-		}, ce = (e) => {
+		}, le = (e) => {
 			let t = new Set(e.map((e) => String(e.row[e.entry.primaryKey]))), n = (e) => Object.entries(e.entry.columnTypes).some(([n, r]) => {
 				if (r !== "reference") return !1;
 				let i = e.row[n];
@@ -1482,32 +1483,32 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					primary: t.primary
 				})).sort((e, t) => t.refused - e.refused || e.table.localeCompare(t.table)).slice(0, 100)
 			});
-		}, le = (e, t) => n.gen(function* () {
+		}, ue = (e, t) => n.gen(function* () {
 			let r = t, i = [], a = !0;
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* oe(() => E(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* se(() => ie(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
-					let r = t[n], o = se(r);
-					o !== void 0 && (yield* oe(() => E(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					let r = t[n], o = ce(r);
+					o !== void 0 && (yield* se(() => ie(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* oe(() => E(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
-			if (r.length > 0) return yield* n.fail(ce(r));
-		}), D = (() => {
+			for (let t of i) (yield* se(() => ie(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			if (r.length > 0) return yield* n.fail(le(r));
+		}), E = (() => {
 			let t = e.targetDialect;
 			return t === "postgres" || t === "mysql" || t === "mariadb" || t === "sqlite" || t === "mssql" ? t : void 0;
-		})(), O = qn({
+		})(), D = qn({
 			mode: f,
 			...e.targetDialect === void 0 ? {} : { targetDialect: e.targetDialect },
 			...e.targetSnapshot === void 0 ? {} : { targetSnapshot: e.targetSnapshot },
 			bundleTables: s.tables.map((e) => e.name),
 			isSkipped: W,
 			canRunSql: Mn(e.store)
-		}), de = O.tables, fe = s.tables.filter((e) => !W(e.name) && C(e.name)).map((e) => e.name), k = O.active, pe = !1, A = 0, j = 0, he, M, N = 0, P = 0, ge = (t, r) => n.gen(function* () {
-			if (f === "replace" && !k && !(r && b.truncated)) {
+		}), fe = D.tables, pe = s.tables.filter((e) => !W(e.name) && C(e.name)).map((e) => e.name), O = D.active, k = !1, A = 0, j = 0, he, M, N = 0, P = 0, ge = (t, r) => n.gen(function* () {
+			if (f === "replace" && !O && !(r && b.truncated)) {
 				e.recordInterruption === !0 && (yield* n.tryPromise({
 					try: () => t.insert(d, {
 						id: h("repl", F),
@@ -1559,22 +1560,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					total: h.rowCount
 				});
 				let y = a.length, x = n.gen(function* () {
-					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = me("bundle", () => ue(_).pipe(xt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
+					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = me("bundle", () => de(_).pipe(xt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
 						let n = {
 							entry: h,
 							row: e,
 							reason: ""
 						};
 						try {
-							await E(t, () => T(t, h, e));
+							await ie(t, () => T(t, h, e));
 						} catch (t) {
 							let r = On(t);
-							n.reason = r.reason, ae(h, e, r), a.push(n);
+							n.reason = r.reason, oe(h, e, r), a.push(n);
 						}
 					}, d = yield* n.promise(async () => {
 						let n = e.copyLoader;
 						if (!n || n.dialect !== "postgres") return !1;
-						if (m) return pe || (pe = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
+						if (m) return k || (k = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
 						if (f === "replace") return !0;
 						if (f !== "upsert") return !1;
 						try {
@@ -1659,7 +1660,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					checksum: h.checksum
 				}, yield* J(v, b)));
 			}
-			if (a.length > 0 && (yield* le(t, a)), f === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
+			if (a.length > 0 && (yield* ue(t, a)), f === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
 				column: "startedAt",
 				op: "lte",
 				value: I
@@ -1707,14 +1708,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			sourceFingerprint: s.source.schemaFingerprint ?? null,
 			tablesWritten: 0,
 			rowsWritten: 0,
-			staged: f === "replace" ? k : null
+			staged: f === "replace" ? O : null
 		}).then(() => {
 			ve = !0;
 		}, (t) => {
 			e.onWarn?.(`the import trace could not be written (${String(t?.message ?? t)}).\n  The import continues — this is a record of what happened, not a safety check. Run
   \`voltro db apply\` so the next one is recorded.`);
 		}))), e.traceId !== void 0 && B && (yield* n.promise(() => e.store.update(u, z, {
-			staged: f === "replace" ? k : null,
+			staged: f === "replace" ? O : null,
 			sourceFingerprint: s.source.schemaFingerprint ?? null
 		}).then(() => void 0, () => void 0)));
 		let ye = 0, be = !1;
@@ -1734,17 +1735,17 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			rowsWritten: A,
 			failure: t
 		}).then(() => void 0, () => void 0) : Promise.resolve();
-		if (t = (e) => xe(e), f === "replace" && !k && O.blocker !== void 0 && e.onWarn?.(Nn(O.blocker)), f === "replace" && fe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${fe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
+		if (t = (e) => xe(e), f === "replace" && !O && D.blocker !== void 0 && e.onWarn?.(Nn(D.blocker)), f === "replace" && pe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${pe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
   something that did not happen — and this path already writes through the raw store, without
-  tenant scoping or \`audit()\` stamping, for the same reason.`), k) {
-			e.onWarn?.(`staging ${de.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
-			let t = e.store, r = de.map((e) => e.name), i = h("repl", `staging-${F}`), a = !1;
+  tenant scoping or \`audit()\` stamping, for the same reason.`), O) {
+			e.onWarn?.(`staging ${fe.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
+			let t = e.store, r = fe.map((e) => e.name), i = h("repl", `staging-${F}`), a = !1;
 			if (e.recordInterruption === !0) {
 				yield* n.promise(() => e.store.insert(d, {
 					id: i,
 					startedAt: I,
 					kind: "staging",
-					tables: String(de.length),
+					tables: String(fe.length),
 					capture: L?.dir ?? null,
 					via: e.via ?? "direct",
 					staging: r.map(X).join(","),
@@ -1775,20 +1776,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				let i = m ? r : r.filter((e) => !Ut(b, e));
 				yield* n.tryPromise({
 					try: async () => {
-						await Hn(t, i.map((e) => In(e, D))), await Hn(t, i.map((e) => Fn(e, D)));
+						await Hn(t, i.map((e) => In(e, E))), await Hn(t, i.map((e) => Fn(e, E)));
 					},
 					catch: (e) => new G({ reason: `could not prepare the staging tables, so the import did not start and the target is untouched: ${String(e?.message ?? e)}` })
 				}), yield* R(ge(e.store, !m)), !m && b.truncated === !0 ? c = !0 : yield* n.tryPromise({
-					try: () => Un(t, de, D).then(() => {
+					try: () => Un(t, fe, E).then(() => {
 						c = !0;
 					}),
 					catch: (e) => new G({ reason: String(e?.message ?? e) })
 				}).pipe(n.catchAll((i) => n.gen(function* () {
-					let a = Vn(yield* n.promise(() => Wn(t, zn(e.targetSnapshot, r), D).then((e) => e, () => [])));
+					let a = Vn(yield* n.promise(() => Wn(t, zn(e.targetSnapshot, r), E).then((e) => e, () => [])));
 					return yield* n.fail(new G({ reason: a ?? `the swap failed and the target is UNCHANGED: ${i.reason}` }));
 				}))), !m && c && b.truncated !== !0 && (b.truncated = !0, yield* J(v, b));
 			} finally {
-				s.undo(), c || m ? (M = void 0, yield* n.promise(() => Hn(t, r.map((e) => In(e, D))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
+				s.undo(), c || m ? (M = void 0, yield* n.promise(() => Hn(t, r.map((e) => In(e, E))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
 			}
 		} else m ? yield* n.tryPromise({
 			try: () => e.store.transactional(async (e) => {
@@ -1851,11 +1852,11 @@ async function* vr(e) {
 	yield new Uint8Array(Q);
 	for (let t of await hr(e.dir)) {
 		let n = B(e.dir, t), r = await _e(n);
-		if (yield new Uint8Array(gr(t, r.size)), r.size > 0) for await (let e of ue(n)) yield new Uint8Array(e);
+		if (yield new Uint8Array(gr(t, r.size)), r.size > 0) for await (let e of de(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
 		yield new Uint8Array(_r(t.key, t.contentType, t.size));
-		let n = ae("sha256"), r = 0;
+		let n = oe("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
 			n.update(e), r += e.length, yield new Uint8Array(e);
@@ -1892,7 +1893,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 				let i = c(8).readBigUInt64BE(0), a = ye(n, t);
 				if (a !== n && !a.startsWith(n + be)) throw Error(`archive path '${t}' escapes the destination`);
 				await I(ve(a), { recursive: !0 });
-				let o = O(a);
+				let o = D(a);
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
@@ -1909,7 +1910,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = ae("sha256"), d = new P(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = oe("sha256"), d = new P(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
@@ -1969,10 +1970,10 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 		write: async (n, r, i) => {
 			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = B(e, "assets");
 			await I(c, { recursive: !0 });
-			let l = ae("sha256"), u = 0, d = new s({ transform(e, t, n) {
+			let l = oe("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
 			} }), f = B(c, `.tmp-${Date.now()}-${t.size}`);
-			await o(r, d, O(f));
+			await o(r, d, D(f));
 			let p = l.digest("hex");
 			await a.rename(f, B(c, p)), await a.appendFile(B(c, "index.ndjson"), `${JSON.stringify({
 				key: n,
@@ -1982,7 +1983,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 			})}\n`), t.add(n);
 		}
 	};
-}, Tr = xe(le), Er = Buffer.from("VENC1\0\0\0"), Dr = 32, Or = 16, kr = 7, Ar = 16, jr = 262144, Mr = {
+}, Tr = xe(ue), Er = Buffer.from("VENC1\0\0\0"), Dr = 32, Or = 16, kr = 7, Ar = 16, jr = 262144, Mr = {
 	N: 32768,
 	r: 8,
 	p: 1
@@ -1992,13 +1993,13 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 };
 async function* Ir(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = se(Or), r = se(kr), i = await Tr(t, n, Dr, {
+	let n = ce(Or), r = ce(kr), i = await Tr(t, n, Dr, {
 		...Mr,
 		maxmem: Nr
 	}), a = Buffer.alloc(Pr);
 	Er.copy(a, 0), a.writeUInt32BE(Mr.N, 8), a.writeUInt32BE(Mr.r, 12), a.writeUInt32BE(Mr.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = E("aes-256-gcm", i, Fr(r, o, t));
+		let n = ie("aes-256-gcm", i, Fr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
@@ -2039,7 +2040,7 @@ async function* Lr(e, t) {
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
 		let n = r.subarray(5, 5 + t - Ar), i = r.subarray(5 + t - Ar, 5 + t);
 		r = r.subarray(5 + t);
-		let a = ie("aes-256-gcm", p, Fr(f, m, e));
+		let a = ae("aes-256-gcm", p, Fr(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -2085,7 +2086,7 @@ var Rr = (e, t) => ({
 		tool: r,
 		hint: `'${n}' is not on PATH, so this ran '${r}' instead. If that binary came from Oracle's MySQL client it queries information_schema.COLUMN_STATISTICS, which MariaDB does not have, and the run dies with error 1109 after the first table. Install the MariaDB client package (which ships '${n}') and re-run. Do NOT reach for --column-statistics=0: that flag does not exist on '${n}', so it fixes the wrong client and breaks the right one. Note: a MariaDB 12.x client requires TLS by default, so running '${n}' BY HAND against a server without it fails with "TLS/SSL error: SSL is required" (2026) and needs --skip-ssl. This command is not affected.`
 	} : { tool: r };
-}, Hr = (e) => (process.env.PATH ?? "").split(z).filter((e) => e !== "").some((t) => de(B(t, e))), Ur = (e) => {
+}, Hr = (e) => (process.env.PATH ?? "").split(z).filter((e) => e !== "").some((t) => fe(B(t, e))), Ur = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -2289,21 +2290,28 @@ var Rr = (e, t) => ({
 		});
 	}
 }, Zr = (e) => e.kind === "copy" ? n.async((t) => {
-	let r = `${e.to}.restoring-${ce()}`, i = (e) => {
+	let r = `${e.to}.restoring-${le()}`, i = (e) => {
 		try {
-			pe(r);
+			k(r);
 		} catch {}
 		t(n.fail(new K({
 			tool: "copy",
 			reason: e
 		})));
 	};
-	D(e.from, r, (a) => {
+	E(e.from, r, (a) => {
 		if (a) {
 			i(`copy ${e.from} → ${e.to}: ${a.message}`);
 			return;
 		}
-		fe(r, e.to, (r) => {
+		for (let t of [
+			`${e.to}-wal`,
+			`${e.to}-shm`,
+			`${e.to}-journal`
+		]) try {
+			k(t);
+		} catch {}
+		pe(r, e.to, (r) => {
 			if (r) {
 				i(`copy ${e.from} → ${e.to}: ${r.message}`);
 				return;
@@ -2332,12 +2340,12 @@ var Rr = (e, t) => ({
 		s ??= e;
 	};
 	if (e.stdoutFile && r.stdout) {
-		let t = O(e.stdoutFile);
+		let t = D(e.stdoutFile);
 		t.on("error", (t) => c(`writing ${R(e.stdoutFile)}: ${t.message}`)), r.stdout.on("error", (e) => c(`reading the tool's output: ${e.message}`)), r.stdout.pipe(t);
 	}
 	let l = 0;
 	if (e.stdinFile && r.stdin) {
-		let t = ue(e.stdinFile);
+		let t = de(e.stdinFile);
 		t.on("data", (e) => {
 			l += e.length;
 		}), t.on("error", (t) => {
@@ -2348,7 +2356,7 @@ var Rr = (e, t) => ({
 	}
 	let u = () => {
 		if (e.stdoutFile !== void 0) try {
-			pe(e.stdoutFile);
+			k(e.stdoutFile);
 		} catch {}
 	};
 	r.on("error", (t) => {
@@ -2373,7 +2381,7 @@ var Rr = (e, t) => ({
 	});
 }), Qr = (e) => {
 	try {
-		return String(k(e).size);
+		return String(O(e).size);
 	} catch {
 		return "?";
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/data-transfer",
-  "version": "0.75.0",
+  "version": "0.77.0",
   "description": "Portable export/import for a Voltro app's data + assets — typed-NDJSON row codec, content-addressed assets, framed compression, a resumable chunk ledger, and FK-ordered idempotent import. Dialect-agnostic; the resilient backbone under `voltro data export|import` and native backups.",
   "keywords": [
     "voltro",
@@ -33,11 +33,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.75.0",
-    "@voltro/plugin-storage": "0.75.0"
+    "@voltro/database": "0.77.0",
+    "@voltro/plugin-storage": "0.77.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.1"
+    "effect": "^3.22.2"
   },
   "publishConfig": {
     "access": "public"