@voltro/plugin-comments 0.83.1 → 0.84.0

package/CHANGELOG.md

@@ -39,6 +39,648 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.84.0] — 2026-10-07
+
+### ⚠ BREAKING
+
+- **CRDT documents hard-compact into epochs without losing or doubling edits** — `@voltro/local-first`, `@voltro/runtime`, `@voltro/cli`
+
+  Past `crdt.rebaseMaxBytes` (default 4 MiB, `0` = never) the write path rewrites a document as a new epoch — same content, no history — after archiving the old lineage as a version. Subscriptions replace the cell instead of sending an increment across epochs, `createSyncClient` and the CRDT hooks replace their local state instead of merging two lineages (`onEpochChange`), and an update made on an archived lineage is carried over for text (`CrdtBackend.translate`) or refused as `crdt.staleLineage` for structured content, never merged into a doubled document. `useCrdtDoc` folds unsent edits restored after a reload into the document it renders. Migration: `rebaseText(state)` is replaced by `rebase(state, epoch)`, and a custom `CrdtBackend` implements `restoreTo`, `rebase`, `epochOf`, `authorsOf`, `translate`, `counterValue` and `counterAdd` (text handles add `undo`/`redo`, doc handles `epoch()`, `schemaVersion()` and `setSchemaVersion(version)`) — the `0.84.0/06_crdt-backend-epochs-and-history` codemod lists the affected files. Env override: `VOLTRO_CRDT_REBASE_MAX_BYTES`.
+- **Last-write-wins orders by hybrid logical clock stamps** — `@voltro/local-first`
+
+  `createHybridClock({ node })` issues stamps that never run backwards and order a write made after seeing another one after it, even when the two devices' clocks disagree — ordered by wall clocks, the device whose clock runs fast wins every race. `FieldValue.updatedAt` is now `number | HlcStamp`, and `lastWriteWins` compares stamps causally (a plain millisecond epoch still works and compares as that millisecond). `receive(stamp)` folds a remote stamp in; `maxDriftMs` refuses one from a clock too far ahead instead of adopting it. Migration: writing a number still compiles; code that reads `updatedAt` as a number must narrow it — the `0.84.0/05_field-value-updated-at-accepts-hlc-stamps` codemod lists the affected files.
+- **Retry Inspect creation with a stable request identity** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  Inspect row creation requires a stable `requestId` alongside `table` and `row`. Creation and its receipt commit atomically; retrying unchanged input with the same identity returns the original record identity without inserting again. A changed payload with that identity returns HTTP 409. Responses contain the creation receipt and a current row observation, which can be null if the row was deleted.
+
+  The shared data explorer retains this identity while its creation dialog stays open, and both dashboard adapters forward it. Custom `DataViewerPage.useInsertRow` providers must forward the supplied identity unchanged. Custom Inspect callers must allocate one identity per intended creation and reuse it on uncertain retries. The shared local and Cloud data explorer now persists metadata-only creation identities across dialog closure and reload, observes without replay, and requires an acknowledged created or withdrawn outcome before another creation in that table. Custom insert providers must return the matching receipt instead of void; connect creationRecovery for persistent recovery. Both hosts wire read-only observations and terminal withdrawal to the same mutation gateway.
+
+  Development Inspect also exposes read-only creation observations and an authenticated withdrawal endpoint. Withdrawal atomically fences delayed creation when it wins, or reports an already committed record without deleting it. A missing receipt is not treated as proof that no request can still complete.
+
+  Shared dashboard hosts can validate matching creation observations and derive a mutation-gateway recovery scope through the exported creation contract helpers. The metadata journal persists no row payloads and refuses dispatch when storage or browser locking is unavailable; both hosts connect it to the shared visible recovery actions.
+
+  **`voltro update` carries you across this** — codemod `0.84.0/02_inspect-creation-intent`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.84.0).
+- **outboxPersistence keeps one queue per signed-in subject** — `@voltro/local-first`
+
+  `outboxPersistence(adapter, now)` is now `outboxPersistence(adapter, { now?, partition? })`. With `partition` (for example a mirror source's `partitionKey`), each queued write is stored under the subject that made it: `load` returns only the current subject's writes and `save` replaces only those, so a write queued before a sign-out is never replayed under the next person's identity and waits for its own subject to sign in again. Saves are serialised. Migration: the `0.84.0/04_outbox-persistence-takes-options` codemod rewrites a positional clock into `{ now }`.
+- **Reject stale release confirmations across replicas** — `@voltro/plugin-releases`, `@voltro/devtools-ui`, `@voltro/cli`
+
+  Release confirmations carry the exact target ID and observed revision. A stale confirmation is rejected with HTTP 409 even when the dashboard has not received the concurrent change yet. Every management write advances the target revision inside the same transaction as release state and its audit event; rejected transactions leave all three unchanged. Management mutations with an ambiguous app name must select a target instead of silently modifying the first platform.
+
+  The declarative schema adds a revision column with default zero to existing release targets. Automation can supply `expectedTarget: { id, revision }` from the Inspect overview; single-target calls may omit the expectation.
+
+  `voltro release` accepts `--target-id` together with `--expected-revision` on management actions. It preserves these values through dry runs and committed requests, refuses partial/invalid expectations before artefact upload, and never refreshes a stale expectation automatically. CLI rollout percentages now match the server's whole-number requirement.
+
+  Release events identify their platform target and channel in the dashboard. Custom event providers must preserve the nullable `channelId` and `channelName` fields. Missing target or channel metadata remains identifiable by its stored ID.
+
+  **`voltro update` carries you across this** — codemod `0.84.0/03_release-target-confirmations`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.84.0).
+- **SQLite decimal columns use exact fixed-point storage** — `@voltro/database`, `@voltro/cli`
+
+  `decimal()` and `numeric()` now use exact encoded TEXT storage on SQLite, native Turso and libSQL. Existing NUMERIC columns are refused before application readiness, including when automatic migration is disabled. Migration: stop all readers and writers, back up and review existing values, then publish an explicit offline conversion through the server-only database conversion API and a nontransactional `before-schema` file migration. Review custom SQL and external readers for the physical format change; lost precision in existing NUMERIC data cannot be reconstructed automatically. Native decimal storage on PostgreSQL, MySQL, MariaDB and MSSQL is unchanged.
+
+  **`voltro update` carries you across this** — codemod `0.84.0/01_sqlite-decimals-use-exact-storage`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.84.0).
+- **Direct storage metadata counter rows use decimal strings** — `@voltro/plugin-storage`, `@voltro/cli`
+
+  The exported `storageObjectLifecycleTables` descriptor now types its shared-object `reservations` counter as a decimal string because the column uses `bigint()`. Review custom framework-metadata reads and writes for exact integer handling; the manual upgrade note identifies direct descriptor and raw-table references. The supported storage service still exposes numeric sizes and usage within `Number.MAX_SAFE_INTEGER`. Reconcile existing framework tables through the normal schema plan/apply workflow; no database changes or source rewrites are performed by the note.
+
+  **`voltro update` carries you across this** — codemod `0.84.0/03_storage-metadata-bigint`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.84.0).
+
+### Added
+
+- **The query mirror plugs into the api mount and derives what to mirror** — `@voltro/client`, `@voltro/web`, `@voltro/react-native`, `@voltro/cli`, `@voltro/local-first`
+
+  The local-first query mirror could be built but not handed to the subscription cache, so offline reads and delta-resume after a reload never ran in an app. Declare it on the api in the web app's `app.config.ts` as `apis.<name>.mirror: createMirrorSource({ … })` (on React Native, `mirror` on the `MobileApiBinding`). The runtime resolves the source once per connection generation and hands it the api's descriptors: without `tags`, every query whose `source` tables are all `localFirst()` tables (per the generated `localFirstTables` passed as `metadata`) is mirrored, and a query that also reads a table that did not opt in is not. `remember({ subjectId, tenantId })` after a sign-in stores who is signed in on the device, so a cold start without network still renders that subject's rows; `forget()` on sign-out purges them. `warm: [[tag, input]]` keeps queries subscribed for the whole generation, so they are readable offline before any screen opened them; `warm: 'all'` does that for every query of the sync set whose input accepts `{}`. A source that throws mirrors nothing, the connection still comes up, and the failure is recorded as a `runtime.mirror` client diagnostic. The client-side golden churn is additive: an optional parameter and new optional fields.
+- **queryOnce is importable without the React hooks** — `@voltro/client`, `@voltro/workflow`, `@voltro/database`, `@voltro/cli`
+
+  `@voltro/client/query` exports `queryOnce` (a query's first value over an api handle) without pulling the package root's React hooks, so a Node or tooling consumer can call it. `@voltro/workflow` now exports `reserveWorkflowRestartInTransaction` beside its sibling `withdrawWorkflowRestartInTransaction`. Internally, tests that reached into sibling packages' source now import their published entry points, which makes the cli and database typechecks clean.
+- **Compose baselines support optional production environment variables** — `@voltro/cli`
+
+  Declare per-app `optionalProductionEnv` names in `project.json` and run `voltro baseline sync` to pass project-prefixed host variables into production API and web services without requiring them on every deployment. Unset or empty values become empty strings, so a field-encryption previous key can be supplied only during rotation. `productionSecrets` stays required; optional declarations cannot override required or baseline-owned bindings.
+- **A conformance suite makes any CRDT backend a drop-in** — `@voltro/testing`
+
+  `crdtBackendConformance(name, { backend })` from `@voltro/testing/crdt` registers the executable contract every `CrdtBackend` must meet — merge commutativity, idempotence and identity, collaborative undo, the remote/local fold signal, incremental updates, queued local updates coalescing without loss, compaction keeping mergeability, `restoreTo`, `rebase` with epochs and fresh authors, `translate` across lineages, the content schema version surviving a rebase and commuting counters. The Yjs and Loro backends pass it; an Automerge or in-house backend that passes it plugs into the server merge, the sync client, the hooks, history and counters unchanged.
+- **CRDT documents migrate their content when the editor schema changes** — `@voltro/local-first`, `@voltro/runtime`, `@voltro/cli`
+
+  `crdt.migrations` in the api's `app.config.ts` declares, per table and CRDT column, versioned `{ version, migrate(doc) }` steps. The write path runs a document's due steps in order inside the same compare-and-swap as the merge, so each document is migrated exactly once however many writes or replicas race, and the migration syncs to clients as an ordinary edit that merges with edits made against the old content. `migrateCrdtColumn(store, { table, column, batchSize? })` from `@voltro/runtime` migrates every document still behind and returns `{ scanned, migrated }`. Each document records its version (`crdtSchemaVersionOf`), which survives hard compaction. `renameEditorNodes(doc, { from, to, field? })` from `@voltro/local-first` (server-safe, no Tiptap) renames an editor node type on Yjs and Loro, keeping attributes and children. On Loro the node keeps its identity; on Yjs, where a node is replaced by a copy, the rename records what replaced what and the write path carries an edit a client made offline against the original — text, deletions, formatting, attributes, new child nodes — into the copy, once (`CrdtBackend.carryReplaced`, optional for custom backends); `applyCrdtMigrations` and `latestCrdtSchemaVersion` are exported for custom tooling.
+- **A CRDT panel shows documents approaching their limits in both dashboards** — `@voltro/cli`, `@voltro/devtools-ui`, `@voltro/runtime`
+
+  `GET /_voltro/inspect/crdt` (both boot paths, inspect-token protected) reports, per `crdtText()` / `crdtDoc()` / `crdtCounter()` / `crdtSealed()` column, the largest documents with their size, how close each is to the next server limit, their epoch, how many writer sessions their history carries and how many archived versions they keep, plus the limits in force — sizes only, never document content. `@voltro/devtools-ui` renders it as `CrdtPage` (a new `crdt` inspect feature), shown by the local devtools dashboard and the Cloud dashboard. `describeCrdtState` (`@voltro/runtime`) is the size-only reader behind it.
+- **Loro ships as a second CRDT backend** — `@voltro/local-first`, `@voltro/runtime`, `@voltro/cli`, `@voltro/testing`
+
+  `loroBackend` from `@voltro/local-first/loro` (with `loro-crdt` as an optional peer dependency) is a complete `CrdtBackend` and passes the same conformance suite as Yjs. Select it on both sides: `crdt: { backend: loroBackend }` in the api's `app.config.ts` for the server merge, history, epochs and inspection, and `setDefaultCrdtBackend(loroBackend)` in the client entry. `useCrdtText`, `useCrdtDoc`, `useCrdtCounter`, sealed columns, version history, epochs and content migrations work on it unchanged. The two backends' bytes do not mix: an update from the other backend is refused as `crdt.updateNotDecodable`. A Loro change depends on everything its writer had seen, so client edits travel up as whole document states and an update missing its dependencies is refused instead of being merged without them. The rich-text editor runs on Loro too: `useCrdtEditor` takes a `binding` (`yjsEditorBinding` by default, `loroEditorBinding` from `@voltro/local-first/loro-editor` over `loro-prosemirror`), with carets over the same awareness transport and collaborative undo on both. The Loro binding gives an empty document the schema's skeleton as a change every client writes byte-identically, so two people typing into a new document offline both keep their text. A binding refuses a document of the other backend with an error naming the right one.
+- **crdtSealed() columns keep collaborative content end-to-end encrypted** — `@voltro/database`, `@voltro/runtime`, `@voltro/local-first`
+
+  A `crdtSealed()` column stores an append-only log of CRDT updates the client encrypted with AES-GCM under a key the server never sees (`generateSealKey` / `importSealKey` / `exportSealKey`). `useCrdtText`, `useCrdtDoc` and `useCrdtCounter` take `seal: { key }`: writes leave the client sealed, delivered logs are opened and merged locally, a frame that does not authenticate reports through `onSealError`, and edits not yet sent are kept sealed in the device's storage too. The clients compact the log, since only they can read it: softly once it outgrows `compactAboveBytes` (a sealed snapshot replacing the frames it covers, keeping every frame appended meanwhile), and hard once the document outgrows `rebaseAboveBytes` (default 4 MiB) — rebased into a new epoch and replacing the whole log, which the server archives as a `rebase` version. Each frame names its lineage epoch in cleartext, so the server appends only frames of the current epoch and refuses older ones as `crdt.staleLineage`; a client that typed offline on the archived lineage carries its edit over itself. A snapshot whose covered bytes changed meanwhile is refused as `crdt.sealedSnapshotStale`, so two clients compacting at once never cut each other's frames. The server checks framing and size limits only, appends with the same compare-and-swap as open folds, and refuses a malformed frame as `crdt.sealedFrameInvalid`; `restoreCrdtVersion` refuses a sealed column as `crdt.sealedRestoreIsClientSide`. `openSealedLog`, `sealUpdate`, `sealSnapshot`, `sealHardCompaction` and the log codec (`applySealedFrame`, `decodeSealedLog`, `sealedLogEpoch`) are exported for custom bindings.
+- **Sealed CRDT versions restore on the client, and the CRDT hooks gain restore()** — `@voltro/runtime`, `@voltro/local-first`
+
+  `prepareSealedCrdtRestore(store, { versionId })` is the server's half of restoring a `crdtSealed()` cell: it archives the current log as a `restore` version, so the restore stays undoable, and returns the version's ciphertext. The client opens it with `openSealedLog` and passes the plaintext to the new `restore(target)` of `useCrdtText` or `useCrdtDoc`, which writes the restore as an ordinary edit — merged with concurrent edits and sealed like typing. An open column's history bytes never leave the server: `prepareSealedCrdtRestore` refuses one with `crdt.openRestoreIsServerSide`, and `restoreCrdtVersion` restores it on the server as before.
+- **Collaborative undo for useCrdtText and a converging crdtCounter() column** — `@voltro/local-first`, `@voltro/database`
+
+  `useCrdtText` returns `undo()` / `redo()` / `canUndo` / `canRedo`: they revert this user's own recent edits (typing within `undoCaptureMs` is one step) and never a peer's, and the reverting change syncs like typing. `crdtCounter()` is a column that any number of clients increment and decrement concurrently, offline too, without losing a step — each writer keeps its own tally and the value is the sum — bound with `useCrdtCounter({ cell, remote, push })` (`value`, `add(n)`) and read with `crdtCounterValue(state)`.
+- **CRDT cells keep a version history that can be restored** — `@voltro/runtime`, `@voltro/cli`, `@voltro/local-first`
+
+  The new framework table `_voltro_crdt_versions` keeps a `crdtText()` / `crdtDoc()` / `crdtCounter()` cell's history: named snapshots (`snapshotCrdt`), the state before every restore, and the lineage every hard compaction archived. `listCrdtVersions` lists them without their bytes, and `restoreCrdtVersion` writes a version's content back as an ordinary CRDT edit (`CrdtBackend.restoreTo`, for text, rich text, maps and arrays) that merges with concurrent edits and is itself undoable. Every function reads the cell's row through the store it is given first, so tenant scope and row filters decide whose history is visible. `crdtCellStats` reports a cell's size, epoch, author count, history length and limits.
+- **The server bounds and validates what a client writes into a CRDT column** — `@voltro/runtime`, `@voltro/cli`, `@voltro/local-first`
+
+  A CRDT update is the client's own bytes. `crdt.maxUpdateBytes` (default 1 MiB) bounds one incoming update, `crdt.maxDocumentBytes` (default 16 MiB) the merged document after compaction, and `crdt.validate` runs the app's own check of every merged document (return a message key to refuse). Each refusal is a typed `ValidationError` with the column as `field` (`crdt.updateTooLarge`, `crdt.documentTooLarge`, `crdt.updateNotDecodable`, or the app's key); an oversized update inside a transaction is refused before commit. Bytes that are not a CRDT update are now this typed refusal instead of an untyped error. On the client, `createSyncClient` treats a `ValidationError` / `ValidationErrors` / `BusinessRuleViolation` as final (`isRefusal`): the write and the same cell's queued writes are dropped, the cell falls back to the server's state, the unsent copy is discarded, and `onRefused` / `lastRefusal()` / the hooks' `refused` report it — instead of retrying forever. Env overrides: `VOLTRO_CRDT_MAX_UPDATE_BYTES`, `VOLTRO_CRDT_MAX_DOCUMENT_BYTES`.
+- **useLocalQuery filters and sorts the device's replica of a table, offline** — `@voltro/client`, `@voltro/testing`
+
+  `useLocalQuery(api, table, { where, orderBy, limit })` queries every row of `table` the api's cache holds — from each single-table query, from the durable mirror after an offline reload, and every queued write's preview — instantly and offline, for any filter, without a declared query. It only sees rows the server already sent this subject, so tenant scope and row filters still apply. `SubscriptionCache.rowsOf(table)` / `subscribeAny` are the reads behind it, and `runLocalQuery` is the pure query. The mirror's `warm: 'all'` keeps every local-first list warm, so the replica is the whole readable table.
+- **Use guarded source capture for MySQL and MariaDB Timeline** — `@voltro/cli`
+
+  MySQL and MariaDB Timeline recording now uses a guarded source journal across connections and replicas instead of local change notifications. Migration setup prepares its contract, schema changes retire old history, and dev/serve hosts share the scoped recorder. Complete frames are acknowledged before publication; missing evidence, expiry or interruption starts a fresh recorder identity. Initial setup requires a suitably privileged migration identity for the fixed-schema generation helper; ordinary serving can use schema-scoped rights without global PROCESS. If optional capture preparation fails, startup warns and continues with history unavailable rather than presenting incomplete replay.
+
+  Preparation follows the configured workflow runner storage, so the first app start does not invalidate capture by creating missing runtime tables. Create-only migration and schema apply/deploy use the shared SQL-client backend selection.
+- **useOutbox({ api }) is an offline write lane with previews that survive a reload** — `@voltro/client`, `@voltro/testing`
+
+  `useOutbox` takes `api: '<name>'`. Bound to an api, `send` defaults to that api's own mutation for the entry's tag with the entry id as the idempotency key, so a resend after a lost answer runs the mutation once; every queued write previews through the mutation's declared `targets` on every query of its table — including queries opened later and rows rendered from the mirror after a reload — until it is sent (the server's echo then replaces the preview) or conflicts (reverted); connectivity follows the api's transport; and a sign-in or tenant switch drops the previous subject's queue from memory and loads the next one's. A transiently failed write is now retried after `retryDelay(attempts)` (default `defaultOutboxRetryDelay`) rather than only on the next online edge, which never comes when the server is down and the network is up. `stamp: clock.now` records a hybrid logical clock stamp on each entry. `useApiOnline(name?)` answers whether a write can reach the server: the browser's signal and the api's transport. The HTTP drain (`drainOutboxOverHttp`, the service worker's) now sends the entry id as the idempotency key too. A `navigator` without `onLine` (React Native, Node) no longer reads as offline. The client golden churn is additive: an optional parameter and optional fields.
+- **Expose reviewed offline SQLite decimal conversion** — `@voltro/database`
+
+  The server-only `@voltro/database/sql` entry point exposes source capture, reviewed staging, publication, rollback and cleanup operations for exact SQLite-family decimal storage, together with their input types and canonical decision identity helper. Repeated migration execution verifies retained artifacts instead of replacing later live writes.
+
+  Conversion requires stopped application readers and writers and a nontransactional before-schema file migration. It does not automatically convert existing NUMERIC columns or recover precision already lost in a NUMERIC source. The bilingual migration guide documents that boundary and the repeatable review-input contract.
+
+### Changed
+
+- **CRDT sync retries on its own clock and follows the api's transport** — `@voltro/local-first`
+
+  `createSyncClient` now retries a failed write after `retryDelay(attempts)`, by default `defaultRetryDelay` (exponential from 1 s, capped at 30 s, jittered), instead of five back-to-back attempts followed by a wait for the next `setOnline(true)` or edit; edits queued while the server was away and the network stayed up used to wait for the user's next keystroke. `maxAttempts` now defaults to unbounded. `useCrdtText` and `useCrdtDoc` follow connectivity by themselves — the browser's `online`/`offline` signal AND the api's own transport, so a server that is down while the network is up holds the queue too (`api: 'app'` names the api; omitted, any mounted api). A changed `online` option is applied to the live client instead of rebuilding it, so an unsent edit is no longer dropped when connectivity flips. `useCrdtDoc` now also shows unsent edits handed over after a reload in the document it renders, instead of only after the server echoed them back. Remove hand-written window listeners that only called `setOnline`, and any retry spacing inside `push`.
+- **CRDT edits upload as increments, so large documents stay editable** — `@voltro/local-first`, `@voltro/runtime`, `@voltro/testing`
+
+  `useCrdtText`, `useCrdtDoc` and `useCrdtCounter` sent the whole local document on every push, so the upload grew with the document and one larger than `crdt.maxUpdateBytes` (default 1 MiB) could no longer be edited at all. The sync queue still holds whole local states, so offline edits coalesce as before, but a push now sends only their increment over the last state the server delivered — on Yjs and on Loro. An increment over a state the cell no longer holds, for example after a database was restored from an older backup, is refused as `crdt.updateNotDecodable` instead of being stored as changes no reader can see, and the client then sends its whole state. `SyncClient.getRemoteState(cell)` returns the last delivered state; a custom `CrdtBackend` whose `merge` keeps changes with missing dependencies (as Yjs does) implements the optional `missingDependencies(state)`, which the conformance suite checks.
+
+### Fixed
+
+- **Accept final agentic flow results on strict structured-output providers** — `@voltro/plugin-ai-flows`
+
+  Agentic flow planners now use the same closed structured-output envelope as structured tools for their final result. The engine returns and stores the original deliverable object, and refuses malformed or non-object results.
+- **Commit release state and audit events atomically** — `@voltro/plugin-releases`
+
+  Release management mutations now share one store transaction across their state, channel pointers, retention changes and audit event in both RPC and Inspect. A failed event write no longer leaves a partially applied rollout or rollback. Inspect reports internal persistence failures as HTTP 500 rather than invalid input.
+
+  Plugin mutation executors receive the optional request transaction as `PluginRouteContext.mutationStore`. Releases reuses it so later caller failures also roll back release writes; Inspect and direct calls open their own transaction.
+- **Roll back failed SQLite-family table rewrites atomically** — `@voltro/database`, `@voltro/sql-turso`
+
+  SQLite-family table rewrites now keep copying, replacement and index recreation inside one atomic operation. Failed statements and invalid foreign keys roll back the replacement without losing the original table or cascading child rows. Each rewrite creates a fresh working table and records its atomic execution mode before DDL, preserving unrelated staging-shaped tables on both first execution and retry. Native Turso additionally checks relationships before committing; libSQL uses its atomic migration batch through both direct and supervised worker transports. Rewrites reject enclosing transactions before changing data, because foreign-key settings must be changed before their own transaction starts. Whole migration plans still use the existing resume ledger; this does not enable encoded decimal storage or perform automatic decimal conversion.
+
+  Atomic rewrites prepare statements afresh, so a retry after resolving a schema conflict does not reuse a cached preparation failure from the rolled-back attempt.
+- **Share binlog CDC control queries and report both owned connections** — `@voltro/sql-mysql`, `@voltro/cli`
+
+  MySQL and MariaDB CDC share one control connection for metadata, persisted-offset validation and watchdog probes instead of retaining an additional SQL pool. Together with the replication stream, CDC owns two connections outside the primary pool; the boot report now counts both. Recovery awaits the old reader and control connection before replacement, and shutdown cancels retry backoff and releases owned connections. Custom binlog-position resolvers remain supported.
+- **Keep binlog reconnects within their connection budget** — `@voltro/sql-mysql`
+
+  MySQL and MariaDB CDC reconnects terminate the previous replication thread on the server before attaching its replacement, including after the control connection is lost. Shutdown and reconnect cleanup are serialized, preventing overlapping readers from exceeding the two-connection CDC budget.
+- **SQL readiness answers when connection acquisition stalls** — `@voltro/cli`
+
+  Bound the SQL readiness ping to ten seconds even when the database driver leaves pool acquisition unbounded. Concurrent and repeated probes share one outstanding ping, return HTTP 503 on timeout, and recover after the pool serves queries again.
+- **Browser loader integration retains callable client declarations** — `@voltro/client`
+
+  The published client query entry retains its TypeScript declaration for browser loader integration. Application loaders continue to read through `ctx.query`.
+- **Retain browser-loader query declarations** — `@voltro/client`, `@voltro/web`
+
+  The `@voltro/client/query` entry and the existing Client and Web root exports now retain the browser loader helper in their shipped declarations and API reports. Its release annotation previously removed the exported helper during declaration rollup.
+- **Changelog package filters include every affected package**
+
+  Release notes retain all affected package labels, including entries with multiple packages. Package filters on the public changelog include these changes consistently.
+- **New string columns respect the store charset before table conversion** — `@voltro/database`
+
+  MySQL and MariaDB migration plans stamp the declared character set on newly added string columns and backfill enforcement, including columns added before the same table's conversion. A mixed add-and-convert plan converges in one apply.
+- **Foreign-key operations wait for table creation and charset conversion** — `@voltro/database`
+
+  New foreign-key tables and their descendants wait for their parent's charset conversion even when the same plan changes its columns. Adding a foreign key waits for both endpoints to exist in the target charset, including constraints deferred from cyclic table creation.
+- **Compose baselines support workspaces without a web app** — `@voltro/cli`
+
+  Generated development and production Compose files omit the web reverse proxy when no web app is declared. API-only workspaces now pass Compose validation instead of failing on an empty reverse-proxy dependency list; each API keeps its own database and sibling API addresses.
+- **Compose dependency volumes remain distinct for every package path** — `@voltro/cli`
+
+  The `compose` baseline validates discovered workspace package paths before replacing generated files and assigns bounded, deterministic dependency-volume names with a path hash. Distinct valid paths containing dots, underscores or dashes no longer collide. Run `voltro baseline sync` after upgrading; the next startup uses fresh dependency volumes and leaves former dependency volumes unused. Preserve database volumes when cleaning up; `docker compose down -v` would also remove database data.
+- **Compose baselines refuse malformed apps and generated-variable collisions** — `@voltro/cli`
+
+  `voltro baseline sync` validates app manifest structures before writing generated files and refuses baseline-owned environment names in both `productionSecrets` and `optionalProductionEnv`, including database settings, runtime settings, web origins and sibling API addresses. Invalid declarations now name the manifest field to correct instead of silently omitting an app or producing duplicate YAML keys.
+- **Compose prepares workspace dependencies before development startup** — `@voltro/cli`
+
+  The `compose` development baseline now runs a frozen install and builds the transitive workspace dependencies of every generated API/web app before migration or app startup. Shared dependencies build once in dependency order; packages without a build script are skipped, while generated apps and the workspace root are excluded. Preparation failures block startup. After upgrading, run `voltro baseline sync`; remove dependency-build replacements from custom overlays while retaining unrelated application settings. Preparation runs at startup and does not watch library sources. The `compose-mariadb` template gains the same preparation barrier for its default app paths; review and back up existing service customizations before reapplying it with `voltro baseline set compose-mariadb`, because its sync command only refreshes Dockerfiles. Both Compose production templates skip source-only dependencies and exclude the root aggregate build.
+- **Resolve content loaders in compiled server bundles** — `@voltro/cli`, `@voltro/content`
+
+  Compiled web server bundles now include the lazy content rendering pipeline rather than retaining a relative import to an absent server loader. Published content packages use a Node-resolvable JavaScript filename. Browser builds continue to exclude the filesystem, markdown renderer and highlighting pipeline.
+- **CRDT folds stay lossless across replicas** — `@voltro/runtime`, `@voltro/database`
+
+  A `crdtText()` / `crdtDoc()` write is read, merged and written back. Writers in one process were serialised, but two replicas folding the same row could both merge into the same base, and the later write could drop the earlier edit when the row stayed contended. The write is now a compare-and-swap: it only lands if the stored state is still the one it merged into, otherwise it re-reads and re-merges, and a fold that keeps losing is refused (the client's sync queue retries it) rather than written over another replica's edit. The in-memory store now compares bytes by content in predicates, as SQL does.
+- **Keep CRDT inspection bounded and recover from invalid reads** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  Validate complete CRDT inspection responses before rendering so malformed nested facts show a recoverable error instead of crashing the dashboard. Count document versions in the store instead of loading every history ID for each displayed document.
+- **Keep CTE references local in tenant namespace queries** — `@voltro/database`
+
+  SELECT compilation now carries lexical CTE names through joins, compound branches and membership/existence subqueries. Only physical tables receive the tenant namespace qualifier, so a CTE cannot accidentally resolve to a similarly named tenant table. Compound queries also retain their own WITH declarations instead of discarding them.
+- **Refresh dashboard app reachability independently** — `@voltro/cli`
+
+  Probe discovered and registered dashboard apps independently and refresh their reachability automatically. Preserve healthy peer observations when the registry changes, cancel outdated requests on credential changes or navigation, and label unknown app types without counting them as web apps.
+- **Recover independent app overview observations** — `@voltro/cli`
+
+  Recover individual app overview observations independently without hiding healthy routes or discarding RPC drafts during metadata outages. Cancel obsolete reads when app credentials change, reject invalid invocation snapshots, and deduplicate live-event replay per process. Show unavailable latency explicitly when counters have no duration measurements.
+
+  Use the shared labelled event-channel selector with empty-filter recovery, keyboard-expandable payloads and mobile route tabs. Label the actual invocation observation window and remove misleading growth indicators from static inventory counts.
+
+  Distinguish missing applications from initial discovery and registry failures, with a persistent return link and automatic recovery. Abort shared discovery reads when the last subscriber leaves and reject their late replies.
+
+  Include SPA in route filters, localize remaining metadata/table labels and make route tooltips and table scroll areas keyboard-accessible.
+- **Preserve RPC drafts during temporary definition read failures** — `@voltro/devtools-ui`
+
+  Preserve open RPC execution drafts and pending results across temporary definition-read failures while hiding stale controls; inspection-context changes still reset the editor and recovery never repeats an invocation.
+- **Shared table updates observe every known replica** — `@voltro/cli`
+
+  The local dashboard combines shared-store change feeds from all known app replicas, so writes through another replica update the visible table promptly instead of waiting for the periodic snapshot refresh. Row reads still honor the selected responder and writes execute once. Fleet membership changes update the feeds; missing inventory or disconnected members remain visible as reconnecting.
+- **Dashboard live streams recover through known fleet entry points** — `@voltro/cli`
+
+  Local dashboard live streams now reuse the authorized fleet routes learned by ordinary reads. When an entry point stops, change notifications can reconnect through a remaining replica instead of waiting for periodic snapshots. Explicit replica selections, credential isolation and target checks remain enforced; unavailable selected processes stay unavailable and failed writes are not replayed.
+- **Unconfirmed data cell saves show recovery context** — `@voltro/devtools-ui`
+
+  Failed inline saves explain that the change may already be stored, retain the draft, and request a fresh row snapshot. The last observed value and expandable error details help review the outcome. Explicit retries preserve the original compare-and-set expectation.
+
+  Editor controls wrap within narrow columns instead of being clipped by a fixed editor minimum width.
+- **Data cell save state survives read outages** — `@voltro/devtools-ui`
+
+  Inline cell edits keep their pending-save lock when a temporary row or schema read failure hides the grid. Returning editors cannot submit a duplicate request, and save errors received while hidden reappear with the original draft.
+- **Local data drafts survive app-metadata outages** — `@voltro/cli`
+
+  The local data explorer keeps its editor mounted when app-metadata reads fail, including a temporary outage of every API replica. The error stays visible while automatic retries restore the data view and its unfinished cell draft. Changing the app, endpoint or Inspect credentials resets the editor context. Retained routing information does not grant permissions or present failed observations as current data.
+- **Treat database-generated columns as read-only in the data explorer** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  The shared data explorer preserves generated-column metadata, displays computed values without edit controls, and omits them from row creation. Inspect writes reject generated inputs explicitly instead of relying on silent stripping or database errors.
+- **Inline data drafts survive temporary read failures** — `@voltro/devtools-ui`
+
+  The data explorer retains an inline cell's draft when a temporary row or table metadata failure rebuilds the grid. Recovery preserves unfinished input without submitting it or resetting it to the database value. Saving still compares against the original value, so external changes remain protected by conflict detection.
+- **Resolve database command roots without treating migration IDs as paths** — `@voltro/cli`
+
+  Database commands honor an explicit `--root` in either supported spelling. File-migration rollback resolves the app configuration and migration directory from that root, or the current directory when omitted, instead of interpreting the positional migration ID as an app path.
+- **Match decimal relation keys across column scales** — `@voltro/database`
+
+  The batched eager loader now associates equivalent decimal keys even when related columns return different scales. One, many and junction relationships compare exact decimal values without converting them to floating-point numbers. Returned rows retain their original values, and text keys keep their exact string identity.
+- **Preserve encoded decimal schema identity** — `@voltro/database`
+
+  Preserve internal SQLite-family decimal encoding, precision and scale through schema introspection and snapshot reconstruction. Block representation or encoded-shape changes that require explicit data conversion instead of treating them as ordinary type casts. Ordinary decimal declarations still use their existing storage.
+- **Failed deploy undo reports every completed schema reversal** — `@voltro/cli`
+
+  When undo cannot complete, `revertedOperations` retains the schema reversals already performed, including foreign-key removals and completed character-set conversions. The failing operation is excluded, so the report accurately names what was undone and what still needs repair.
+- **Soft-drop deploy undo preserves rows without blocking parent restoration** — `@voltro/cli`
+
+  On MySQL and MariaDB with `VOLTRO_SOFT_DROP=1`, a failed deploy removes outgoing foreign keys from newly created app tables before retaining them as snapshots, allowing active parent tables to regain their original character sets. The undo verifies baseline columns separately from newly retained snapshot columns and removes newly created framework tables before charset restoration.
+- **Reduce repeated binding resolution in Doctor source scans** — `@voltro/cli`
+
+  Doctor indexes identifier names per source-file AST and skips form binding resolution when a submit path is absent. Declaration identity, shadowed bindings, complete file lists, and JSON findings remain unchanged.
+- **Reduce overhead for immediate event publication** — `@voltro/runtime`
+
+  Event publication without a transaction or durable audience avoids an extra Effect generator. Validation and delivery remain lazy until execution; encoded size limits, transaction ordering, durable acknowledgements and both await and yield styles are preserved.
+- **Gateway BYOK costs follow nested routing receipts** — `@voltro/ai`
+
+  `gatewayCostUsd` reads the final successful provider attempt of the final successful model attempt from `gateway.routing.modelAttempts[].providerAttempts`, so BYOK calls include the reported `marketCost` and gateway-credit fallbacks keep the gateway charge.
+- **Keep global logs stable while pausing and reconnecting** — `@voltro/cli`
+
+  The local dashboard's global Logs page pauses the display while continuing to receive a bounded buffer. Resuming shows the latest captured entries without reopening streams. Replay identities prevent duplicate records after reconnects, and clearing rows preserves those identities so cleared records stay cleared. Unchanged app subscriptions remain open when another app appears. Connection failures retain captured logs and show automatic recovery status.
+- **Isolate global metrics observations and recover failed sources** — `@voltro/cli`, `@voltro/devtools-ui`
+
+  Keep global dashboard invocation metrics responsive when another app is slow or newly discovered. Poll each app independently, preserve unchanged observations, and abort requests on app, credential, or navigation changes so late replies cannot replace the current source.
+
+  Reuse the shared invocation snapshot validator in the global page, reject malformed observations per source, preserve sort focus, and keep mobile tables keyboard-accessible.
+- **Keep inspect creation receipts in their own deployment** — `@voltro/data-transfer`
+
+  Default logical exports omit inspect creation receipts, and logical imports preserve the destination's own receipts. A creation accepted elsewhere must not suppress or replay a command in the destination. Native disaster-recovery backups retain their existing behavior.
+- **Count inspected rows without loading every matching ID** — `@voltro/cli`
+
+  Calculate Data explorer totals with a filtered store-side COUNT instead of loading every matching ID. Pagination still reports the complete filtered total, and requests without a count skip the extra query. Invalid count results fail explicitly instead of producing a misleading total.
+
+  Wire read-only creation-outcome observations in production startup as well, preserving receipt visibility without enabling arbitrary production data writes.
+- **Loro apps run under voltro dev, and the collab template can switch to Loro** — `@voltro/cli`
+
+  Under `voltro dev` the browser resolved `loro-crdt` to its `bundler` build, which imports its WebAssembly as an ES module Vite cannot load, so every page using the Loro backend failed with "Cannot read properties of undefined (reading 'memory')"; `voltro build` was unaffected. `voltro dev` and `voltro build` now resolve every browser-side import of `loro-crdt` — the app's, `@voltro/local-first/loro`'s and `loro-prosemirror`'s — to its `browser` build, so there is one Loro instance, while server-side code keeps the Node build. The `api-collab` and `frontend-collab` templates choose their CRDT backend in one `lib/crdt.ts` file per app, and their README shows the switch to Loro.
+- **Exact bigint sums and extrema in the memory store** — `@voltro/runtime`
+
+  The memory store now sums declared `bigint` values without losing decimal-string precision, includes them in floating-point averages, and compares their minimum and maximum numerically. Storage statistics retain their byte totals when metadata uses `bigint`, including inside transactions.
+- **Install SQL Server driver dependencies in standalone workspaces** — `@voltro/cli`
+
+  `voltro add mssql` declares a missing SQL Server driver at the running CLI's lockstep version so an ordinary app can install it without local framework packages. Existing driver ranges are preserved. The completion message describes both shipped SQL Server patches.
+- **Stop reporting SQL Server CDC retries after reader shutdown** — `@voltro/sql-mssql`
+
+  A stopped Change Tracking reader no longer reports a late in-flight poll failure as a retry or calls its error consumer. Active reader failures continue to be reported.
+- **SQL Server deploy prepares workflow storage before serving** — `@voltro/cli`
+
+  SQL Server schema apply and deploy now prepare runtime-owned workflow storage before Timeline capture activation, allowing an already provisioned app to start with automatic migrations disabled and a serving identity without schema DDL rights. Timeline cleanup waits for in-flight SQL before rollback, preventing interrupted observers from leaving leases behind during shutdown.
+- **Preserve exact SQL Server decimal row values** — `@voltro/sql-mssql`, `@voltro/database`
+
+  Preserve exact DECIMAL and NUMERIC strings in SQL Server mutation results and bulk change-event row images. Conversion occurs only when returning captured write results, retaining numeric storage and SQL arithmetic, NULL values, trigger compatibility, and MERGE action metadata.
+
+  Change Tracking reads use the same lossless final projection, including decimal columns added while the reader is running. Typed row SELECT projections also preserve declared decimal fields, including aliases and DISTINCT pagination, while filtering, ordering and nested SQL calculations remain numeric. Raw SQL, direct aggregate results, set operations and eager JSON projections remain outside this conversion boundary.
+- **Await SQL Server cancellation before pooled connection reuse** — `@voltro/sql-mssql`, `@voltro/cli`
+
+  Interrupted SQL Server queries and procedures cancel their request and await its completion before pooled reuse or transaction rollback. Normal SQL failures still propagate, and cancellation does not wait for the query's full duration. The CLI ships the driver patch alongside the cluster patch. Existing SQL Server projects must rerun `voltro add mssql` and `pnpm install` at their pnpm workspace root to receive it; `voltro update` includes these migration steps.
+- **Use native SQL Server renames for retained schema snapshots** — `@voltro/database`
+
+  SQL Server soft-drop now reuses the native table and column rename paths instead of emitting unsupported ALTER TABLE RENAME syntax. Checked columns retain their rewritten constraints and state. Recorded snapshots restore original table/column names and retained values through the existing restoration path.
+- **Retire SQL Server Timeline capture within atomic schema deployments** — `@voltro/cli`
+
+  SQL Server Timeline retirement now joins an existing atomic schema-migration transaction, so real schema changes and soft-drop snapshots no longer fail the independent read-frame guard. Rollback restores capture ownership, triggers and application schema together. Serving replay frames continue to require a fresh transaction.
+- **Reject orphan Timeline capture before SQL Server migrations** — `@voltro/cli`
+
+  SQL Server migration preparation detects leftover Timeline capture triggers even when private capture tables are missing and the serving schema resolves application tables through dbo fallback. Inconsistent ownership blocks application DDL; unrelated triggers on shadowed tables remain untouched.
+- **SQL Server writes work with Timeline capture triggers** — `@voltro/sql-mssql`
+
+  SQL Server writes now capture returned row images with OUTPUT INTO, preserving normal writes, generated values, bulk rollback and MERGE upserts when Timeline or other DML triggers are enabled.
+- **Read MySQL bulk inserts back through explicit primary keys** — `@voltro/sql-mysql`
+
+  MySQL `insertMany` now uses declared named and composite primary keys instead of assuming that a missing `id` means AUTO_INCREMENT. Batched readback preserves input order and database defaults, including keys whose database formatting differs from the input. All insert chunks and their readback share one transaction, and change events are emitted only after the complete operation succeeds. Missing explicit key components are rejected before writing. Ordinary `id` recovery and MariaDB's native RETURNING path retain their existing behavior.
+- **Recover single MySQL inserts by their declared primary key** — `@voltro/sql-mysql`
+
+  Single MySQL inserts now share explicit-key readback with bulk inserts. A previous AUTO_INCREMENT operation on the connection can no longer select a stale `id`, and an ordinary non-key `id` column cannot cause the wrong row to be returned. Named and composite keys identify the persisted row independently of nullable non-key values; database defaults and namespace isolation are preserved. Ordinary AUTO_INCREMENT recovery and MariaDB RETURNING retain their existing behavior.
+- **An empty agent inventory disables planner delegation** — `@voltro/plugin-ai-flows`
+
+  An explicit empty `EngineDeps.listAgents` result removes `run_agent` from planner tools. Failed listing refuses planning without widening allowed refs, and reserved tool names remain protected. An absent callback retains the plan-ref fallback.
+- **Keep workspace Radix hooks on one React instance during prerender** — `@voltro/cli`
+
+  The build-time prerender and source middleware loaders now resolve Radix primitives through the same React deduplication as development. Building a dashboard that imports UI primitives from another workspace installation no longer fails with a null React hook dispatcher during static rendering.
+- **Distinguish uncertain record saves and deletions** — `@voltro/devtools-ui`
+
+  Record dialogs now explain when a save or deletion was not confirmed, retain the draft and original compare-and-set expectations, and refresh the table observation after an uncertain response. Closing the dialog does not undo a committed write. Retries continue to reject intervening changes instead of adopting refreshed values as their expectation.
+
+  Late record and bulk-delete completions no longer close a newer dialog or clear a newer selection after a view change. Bulk deletion now explains unconfirmed outcomes and preserves original retry expectations. A successful batch retires only the submitted selection.
+- **Reject mismatched decimal storage in typed readers** — `@voltro/database`
+
+  SQLite-family typed decimal reads now reject physical encoded keys when the application schema does not describe that representation, rather than expose those keys as decimal values. Explicitly encoded row decoding and logical query results retain their existing behavior. This check does not replace coordinated reader/writer exclusion during a storage migration or activate encoded storage.
+- **Recheck observed release channel state before confirmation** — `@voltro/devtools-ui`
+
+  An open rollout, rollback or policy confirmation now becomes unavailable when the dashboard observes a changed channel state. The draft remains visible with an explanation; cancel and reopen the action to review the current target. Identical polling snapshots keep confirmations usable. This UI check does not provide server-side compare-and-swap semantics.
+- **Validate release forms and isolate pending target actions** — `@voltro/devtools-ui`
+
+  The shared Releases dashboard rejects empty percentages and values outside 0–100 before submitting a rollout. Empty input is no longer converted to zero. An inline message explains the permitted range; explicit whole values, including zero and 100 remain supported. Pending actions lock their draft and prevent rapid duplicate submissions. A failed request preserves the draft for review and an explicit retry.
+
+  The canonical promote/rollout input schemas now reject fractional percentages before storage, matching the integer rollout column. Inspect reports HTTP 400 instead of a PostgreSQL persistence error for these invalid inputs.
+- **Validate release inspect actions before execution** — `@voltro/plugin-releases`
+
+  Release inspect write endpoints now decode inputs through the corresponding RPC descriptor schemas. Malformed field types return HTTP 400 before changing release state or writing audit events, instead of reaching the executor unchecked.
+- **Rendered-page styles, font caching and accessible code content** — `@voltro/cli`, `@voltro/content`, `@voltro/ui-shadcn`
+
+  Rendered pages include their static CSS dependencies before hydration, including locale variants and SSR/ISR shells. Fingerprinted generated fonts receive immutable caching. Markdown heading permalinks remain keyboard-accessible with meaningful names, and offscreen code blocks defer optional highlighting with corrected light-theme syntax contrast.
+
+  Islands entry shells also retain generated font definitions and preloads, so SSR sign-in pages use the configured fonts before hydration.
+
+  Production SSR streams negotiate Brotli/Gzip with per-chunk flushes, preserving initial-shell and deferred-boundary delivery without buffering the complete document.
+
+  Shared code CSS preserves light-theme inline colors alongside variable-based output, with dark-theme overrides retained.
+- **Wake queued schedules when completion arrives during a turn check** — `@voltro/runtime`
+
+  Queued schedules retain run-ledger notifications received while reading a blocker and immediately re-check before waiting. A completion arriving at that boundary no longer adds a full polling interval; ordering, conditional turn-taking and the polling fallback remain enforced.
+- **Expand integer columns without destructive migration authorization** — `@voltro/database`
+
+  Changing an `integer()` column to `bigint()` now plans a safe, value-preserving schema expansion. Existing rows and defaults are retained. SQLite and Turso already store integers in 64 bits, so this declaration change needs no DDL there. Reducing a `bigint()` column to `integer()` still requires explicit migration authorization.
+
+  SQL Server integer-range migrations preserve named defaults, CHECK trust and enabled state, and ordinary row-store index definitions inside the schema transaction. Foreign keys, schema-bound expressions, user-created statistics, and unsupported partitioned, compressed or non-row-store indexes are refused before removing any dependency and require a reviewed file migration. Explicit SQL Server `USING` transforms are refused instead of being silently ignored; PostgreSQL continues to apply the declared expression.
+- **Require patched image processing dependencies** — `@voltro/cli`, `@voltro/plugin-storage`
+
+  Require sharp 0.35.5 or later for image processing to resolve the high-severity librsvg dependency advisory GHSA-wq5f-xc86-pv6w.
+- **Scope SQL callback upserts to their complete conflict keys** — `@voltro/sql-postgres`, `@voltro/sql-mysql`, `@voltro/sql-mssql`
+
+  Postgres, MySQL, MariaDB and SQL Server now update the existing row through all declared conflict columns instead of assuming a text `id`. This fixes explicit and composite keys and prevents numeric IDs from producing an unfiltered update. The same key handling covers MySQL/MariaDB partial-insert fallbacks and SQL Server recovery when another writer wins an insert race. Existing transaction and concurrency contracts are unchanged.
+- **SQL Server accepts Uint8Array binary parameters without conversion errors** — `@voltro/sql-mssql`
+
+  SQL Server now binds plain `Uint8Array` values as binary parameters, including subarrays, empty bytes, and payloads larger than 8,000 bytes. The adapter preserves each view's offset and length, retains existing `Buffer` support, and applies the same conversion to store writes and raw SQL instead of rejecting valid byte values with `EPARAM`.
+- **Connect SQL Server Timeline to shared capture hosts and migrations** — `@voltro/cli`
+
+  Select coherent SQL Server source capture at the shared Timeline host boundary. Schema preparation installs its persisted capture contract; schema maintenance retires it before application DDL. Serving reads existing activation and can recover after later provisioning without installing schema objects itself.
+
+  Missing database Change Tracking or capture permissions leave Timeline unavailable while optional preparation reports a warning and application startup continues. Document the prerequisites, namespace resolution and bounded replay contract in English and German and regenerate shipped agent guidance.
+- **Reuse prepared SQL Server Timeline contracts without schema DDL rights** — `@voltro/cli`
+
+  Validate an existing ready capture contract before entering migration-side ownership checks. An unchanged contract can be reused with the serving account's object permissions, without schema-wide VIEW DEFINITION or DDL rights. Changed or unavailable contracts still require the migration identity for repair.
+- **Scope SQLite callback upserts to their conflict keys** — `@voltro/sql-sqlite`
+
+  SQLite-family callback upserts now address the existing row through every declared conflict column rather than assuming a text `id`. This supports explicit and composite keys and prevents numeric IDs from producing an unfiltered update. Key values continue through the registered column codecs, including decimals.
+- **Execute recursive tree queries on SQLite and libSQL** — `@voltro/database`
+
+  Recursive SQLite compound terms now reference the recursive relation directly instead of wrapping it in a derived table that the engine rejects as circular. Nonrecursive anchor pagination, compound limits and outer pagination remain supported. Recursive branch-local ordering or pagination fails explicitly instead of changing meaning. The bilingual guide now selects the CTE result and identifies native Turso's unsupported recursive capability.
+- **Match SQLite write conditions and keys to their column codecs** — `@voltro/database`, `@voltro/sql-sqlite`
+
+  Encode SQLite-family row keys and conflict lookup values consistently with inserts, including timestamp keys used by updates, JSON patches, deletes and insert-ignore. Schema-aware bulk predicates also support internally marked exact decimal storage without changing ordinary decimal schema emission.
+- **SQLite set operations preserve branch queries and pagination** — `@voltro/database`
+
+  SQLite-family UNION, UNION ALL, INTERSECT and EXCEPT now compile executable compound queries. Input filters, ordering and pagination remain scoped to each branch, including nested operations. An outer offset without a limit also compiles correctly.
+- **SQLite replica rebalancing keeps database traffic responsive** — `@voltro/workflow`
+
+  SQLite-backed workflow runners now admit individual shard releases one at a time, avoiding a burst of lock-row deletes when replicas join or restart. This prevents shard-release fan-out from delaying dashboard live refreshes and application writes over remote libSQL. Waiting releases remain cancellable, and release failures do not block later releases.
+- **Answer missing enumerated static paths with 404** — `@voltro/cli`
+
+  Production web serving now returns the scoped not-found page with HTTP 404 when a static route exports `getStaticPaths` but the requested document was not generated. Published paths still serve their built HTML, and dynamic static routes without enumeration retain client-side fallback.
+- **Storage metadata supports files and tenant usage beyond 2 GiB** — `@voltro/plugin-storage`
+
+  Storage reference sizes, database blob sizes, tenant byte/count counters, and shared-object reservation counters now use 64-bit SQL integers. Existing framework tables widen through schema reconciliation while the storage API retains exact JavaScript numbers up to `Number.MAX_SAFE_INTEGER`; reservations beyond that ceiling are rejected without consuming quota. Metadata failures retain the operation phase, safe database error codes, and retry classification without exposing SQL or row contents, so numeric overflow can be distinguished from a recoverable provider acknowledgement loss.
+- **Explain storage encoding changes in rollout guidance** — `@voltro/database`
+
+  Clarify that a storage change with an unchanged logical column type can change read semantics, not only column bounds. Rollout guidance now distinguishes parameter changes from encoding changes and requires verified conversion with compatible readers/writers or a deployment without overlap.
+- **Storage statistics preserve tenant and visibility groups on SQL stores** — `@voltro/plugin-storage`
+
+  Storage inventory statistics now retain tenant and visibility keys alongside SQL aggregates, so each tenant receives its own byte/count totals and public/private counts remain accurate. Totals that exceed the exact JavaScript number range fail with a typed `StorageError` instead of reporting rounded values.
+- **Preserve native timestamp precision in predicate bindings** — `@voltro/database`
+
+  Temporal predicate strings with more than three fractional digits stay exact during SQL binding instead of passing through a millisecond Date. Guarded migration rewrites can compare unchanged imported timestamps without false contention and still reject competing sub-millisecond changes. Ordinary epoch-millisecond and ISO instant coercion remains unchanged.
+- **Release native libSQL locks after failed statements** — `@voltro/sql-turso`
+
+  The libSQL backend now receives a temporary stable-driver patch through its SDK dependency. Failed native statements release their locks without reopening the connection or discarding session state. Application imports and configuration remain unchanged, including embedded replicas; no consumer override is required.
+
+  The SDK implementation is unchanged. Its package metadata selects the patched native driver, tested across all nine upstream platform targets. This temporary distribution will be removed once an official compatible release passes the SDK, embedded-replica, lock-recovery and clean-installation checks. The separate local Turso Rust engine is unaffected.
+- **Keep decimal parity checks aligned with the migrated schema** — `@voltro/testing`
+
+  Keep the dialect parity schema-evolution fixture's registered descriptors in sync with each accepted migration, so typed decimal writes use the correct physical encoding. Verify that SQLite-family precision changes require explicit conversion, preserve the existing schema and exact values, and continue checking later enum, backfill and constraint migrations.
+- **Carry the declared store charset into Timeline cluster preparation** — `@voltro/cli`
+
+  Timeline preparation during schema apply, create-only migration and development boot now passes the store's declared MySQL-family charset to the shared cluster migration gate. Newly created workflow storage uses that charset without changing the database default or rewriting existing storage during serving boot.
+- **Keep Timeline data visible on narrow screens** — `@voltro/devtools-ui`
+
+  Timeline uses a compact table selector on narrow screens and keeps sequence navigation together above the data. Large table names no longer wrap into multiple rows of buttons on mobile; desktop table buttons and full event details remain available.
+- **Keep native Timeline restores inside their target database** — `@voltro/cli`
+
+  MySQL/MariaDB Timeline triggers restore into the selected target without retaining source-schema references. Migration phases verify their connection context before changing objects, and rebuilding copied generation intents retires only matching target helpers while preserving the source contract.
+- **Timeline explains protected values and adapts event colors to the theme** — `@voltro/devtools-ui`
+
+  Timeline cells explain server-only, encrypted and sensitive masking in English and German instead of displaying internal marker objects. Operation badges use readable text colors in light and dark themes.
+
+  Table selection and the scrubber share a compact control area so reconstructed rows appear sooner on narrow screens. Long table lists stay scrollable and selected table controls expose their state to assistive technology.
+- **Share native Turso namespace attachments across pool connections** — `@voltro/sql-turso`
+
+  Keep native Turso tenant attachments consistent across the connection pool. Store and migration ATTACH statements now publish the engine-resolved file mapping; stale and newly constructed connections synchronize before subsequent queries. DETACH and reattachment invalidate cached statements. Failed provisioning preserves existing mappings, and private in-memory attachments are rejected on multi-connection pools instead of silently splitting tenant data across independent databases.
+- **Enable supported generated columns on Turso backends** — `@voltro/database`, `@voltro/sql-turso`
+
+  Native Turso now enables VIRTUAL generated columns with MVCC. The schema emitter no longer rejects generated columns for every Turso backend, allowing VIRTUAL columns locally and both STORED and VIRTUAL columns through libSQL. The native engine still rejects STORED generated columns; the requested storage mode is never silently changed.
+- **Manual upgrade notes include tracked SQL scripts** — `@voltro/cli`
+
+  Manual upgrade checks now scan tracked `.sql` files alongside source, shell scripts, configuration and runbooks. Direct database references in SQL scripts are located for review instead of silently missing an applicable upgrade note; scripts are never rewritten by these checks.
+- **Verify physical decimal compatibility independently of automatic migration** — `@voltro/database`, `@voltro/cli`
+
+  SQLite-family applications now verify physical decimal markers before accepting schema compatibility, even with a matching recorded fingerprint or automatic migration disabled. Mismatched representation, precision or scale is rejected for empty tables as well as populated ones. Development, source serve and compiled serve share the read-only check; disabling migration still prevents automatic schema changes. This does not update already-running binaries, perform conversion or activate encoded decimal storage.
+
+### Internal (no consumer-facing effect)
+
+- **Declare the SQLite dependency of the media replay fixture**
+
+  The process-restart fixture resolves its SQLite driver through an explicit test dependency instead of assuming a neighboring package has already been built. This keeps clean-checkout typechecking independent of stale local build output.
+- **Numeric formatting bounds excessive precision**
+
+  Project-owned dependency installations cap numeric formatting precision at the supported ECMAScript range, preserving normal CLI help and SQL Server diagnostic formatting. Patch integrity and installed formatter behavior are verified before a patched advisory is classified as remediated.
+- **Verify completed client mounting and offline transport loss** — `@voltro/cli`
+
+  Browser validation waits for the completed client mount and verifies offline navigation after the test origin becomes unreachable, including service-worker requests that a page's emulated offline state may leave connected. Background Sync validation observes either the queued tag or its actual worker delivery.
+- **Normalize generated Atom headline whitespace** — `@voltro/cli`
+
+  Generated release-feed headlines trim trailing whitespace after fallback-body truncation, with artifact-level regressions for XML escaping and truncation.
+- **Classify owned migration and statement-local DDL sites** — `@voltro/cli`
+
+  The derived DDL-site guard records the existing decimal migration machinery, SQL Server capture migration pipeline and statement-local tempdb output collector with explicit ownership reasons. Unknown sites and stale entries remain failures.
+- **Preserve CLI resource isolation during development** — `@voltro/cli`
+
+  Internal validation scheduling now isolates sustained CLI and database workloads. Published behavior is unchanged.
+- **Align codemod metadata with the complete registry** — `@voltro/cli`
+
+  Regenerate the package manifest from the current codemod registry so release validation includes every registered migration.
+- **Keep cold-start reference measurements separate** — `@voltro/cli`
+
+  Structural cold-start measurements can be refreshed without replacing the recorded latency measurement or its reference machine.
+- **Preserve collection runner diagnostics and isolate process checks** — `@voltro/cli`
+
+  Collection verification retains runner startup errors and configured writable caches. Checks that launch real application processes execute serially while preserving their lifecycle and connection-budget assertions.
+- **Acquire the Compose env audit image when missing** — `@voltro/cli`
+
+  The real Compose environment byte-preservation fixture pulls its declared Node image when absent instead of requiring an undocumented preloaded image. Existing cached images are reused and all actual container assertions remain unchanged.
+- **Keep CRDT replica test workers outside shipped-source coverage** — `@voltro/integration-harness`
+
+  Place the process-backed CRDT replica helper in the existing test-fixture directory and update its integration-test launcher. Coverage continues to reject newly shipped source in suite-only packages while measuring the actual library packages.
+- **Validate exact decimal conversion sources** — `@voltro/database`
+
+  Add an internal exact-decimal conversion boundary that validates shape changes without rounding and requires an explicit source-value decision for NUMERIC data that may already have lost precision. Ordinary storage and migration activation remain unchanged.
+
+  The internal owned conversion lifecycle now publishes a reviewed stage and can atomically restore original declared values while the published rows remain unchanged. It verifies retained artifacts, preserves later writes on completed-operation retries, and refuses stale rollback after external data changes. Explicit finalization atomically removes verified retained artifacts, closes the rollback window for published conversions, and preserves the completion receipt so retries cannot delete newly reused artifact names. Public conversion activation remains pending.
+
+  Retained copies and conversion stages preserve accessible implicit rowids without narrowing them through JavaScript numbers. Conversion and rollback retain AUTOINCREMENT high-water marks, including native Turso sequence allocation, and refuse rollback when row identity or allocation state has advanced.
+- **Preserve ungrouped aliased rows in exact decimal queries** — `@voltro/database`
+
+  Use the row-preserving projection pipeline for explicitly encoded decimal queries containing only aliased columns. Preserve duplicates, exact ordering, filtering, DISTINCT and pagination without requiring GROUP BY. Ordinary schema emission is unchanged; this does not enable encoded decimal storage by default.
+- **Route encoded decimal eager reads through schema-aware queries** — `@voltro/database`
+
+  Keep the SQLite JSON eager-load optimization off for explicitly encoded decimal sources, nested relation targets and junction tables. The existing batched relation loader applies exact predicates and logical row decoding through ordinary store queries. Ordinary decimal schema emission and other dialects are unchanged.
+- **Bound exact decimal result decoding plans** — `@voltro/database`
+
+  Decode explicitly encoded row and window results through parallel relational stages in their enclosing SQL scope. Reuse exact sign and shape validation, preserve physical sort keys and bound parameter order, and avoid correlated result subqueries that multiply native Turso preparation memory. Do not carry unused or duplicate window ordering keys. Ordinary decimal schema emission and storage activation remain unchanged.
+- **Route explicitly encoded SQLite decimal query results** — `@voltro/database`, `@voltro/sql-sqlite`, `@voltro/voltro`
+
+  Connect explicitly marked decimal schemas to exact SELECT lowering and projection-aware decoding, preserving ordinary NUMERIC columns, aggregate result types and namespace/CTE scope. Ordinary decimal schema emission remains unchanged pending complete storage adoption.
+
+  The optional query descriptor added to `decodeRowsFromSchema` preserves existing three-argument callers. Other API report changes are documentation and formatting only.
+- **Connect physical decimal metadata to SQLite row codecs** — `@voltro/database`, `@voltro/sql-sqlite`
+
+  Encode and strictly decode explicitly marked internal decimal columns at the SQLite-family row boundary. Ordinary decimal storage remains unchanged; general query and migration activation remain pending.
+- **Flatten exact decimal window CTE composition** — `@voltro/database`
+
+  Compose window calculation stages in their parent CTE scope and keep decimal window outputs physically encoded across that boundary. This avoids repeated encoding and reduces native Turso statement preparation cost. Isolate generated stage names case-insensitively and preserve bound parameter order. Ordinary decimal schema emission remains unchanged.
+- **Compose exact decimal queries through derived CTE sources** — `@voltro/database`
+
+  The internal exact-decimal compiler preserves multiple decimal columns and ordinary fields through nonrecursive CTE declarations, including forward references, joins, membership queries, aggregates and set operations. Dependency-driven query-local output metadata and unique lexical names preserve nested scope without changing the table registry. Nonrecursive dependency cycles fail explicitly. Flat encoding stages avoid native Turso and libSQL nested-CTE failures. Recursive composition and ordinary storage adoption remain separate work.
+- **Preserve exact decimal values at derived source boundaries** — `@voltro/database`
+
+  Add SQL encoding for logical decimal result sources without floating-point conversion. Source-local stages work across SQLite, native Turso and libSQL, preserve nulls and reject malformed values, overflow and nonzero excess fractional digits. This is an internal boundary for subsequent CTE integration; ordinary decimal storage is unchanged.
+- **Verify an exact SQLite decimal physical schema and validation boundary** — `@voltro/database`
+
+  Add internal physical type, default and CHECK helpers for the candidate sortable decimal representation. Precision and scale live in the TEXT-affinity type name because native Turso omits custom type arguments from schema introspection. Constraints reject malformed keys, numeric writes, out-of-range values and NUL suffixes. Normal schema generation, store encoding and migration behavior remain unchanged until the complete storage contract is integrated.
+- **Compose exact decimal compound queries across SQLite clients** — `@voltro/database`
+
+  The internal exact-decimal query compiler now composes set operations across different decimal scales without floating-point conversion. Numeric deduplication, ordering, branch pagination and aggregate results retain exact values. Flatter result stages avoid libSQL parser stack exhaustion. Ordinary decimal storage remains unchanged pending the complete migration and storage contract.
+- **Compose exact decimal membership and existence subqueries** — `@voltro/database`
+
+  The internal exact-decimal query compiler supports non-correlated IN, NOT IN, EXISTS and NOT EXISTS in source predicates and aggregate filters. Shared output metadata preserves cross-scale membership and SQL NULL semantics without numeric casts. Shallower column decoding avoids libSQL parser stack exhaustion. Ordinary storage remains unchanged pending full adoption.
+- **Keep framework table metadata bound to first-party source** — `@voltro/cli`
+
+  Framework table nullability metadata stays tied to first-party source declarations. Compiled native database workers retain their existing relocation and exact-value guarantees.
+- **Execute real Helm chart rendering in CI** — `@voltro/cli`
+
+  Install pinned Helm in CI so Kubernetes chart rendering tests execute against the real tool instead of reporting an unavailable-tool diagnostic.
+- **Verify media prompt changes across process restart** — `@voltro/ai`
+
+  Add a persistent SQL regression that kills the original media workflow process and resumes its journaled enqueue in a fresh process with a corrected prompt, with an offline provider and a new-execution control.
+- **Resolve Timeline tests from their dedicated SQL Server fixture** — `@voltro/cli`
+
+  SQL Server Timeline integration tests reuse the dedicated test stack credential when no explicit test override is configured. No copied credential, runtime authentication change or availability skip is introduced.
+- **Native restore coverage shares SQL Server fixture configuration** — `@voltro/cli`
+
+  Native SQL restore coverage reads the shared SQL Server fixture configuration consistently with the other integration checks.
+- **Run native SQL tests with the declared fixture and capability lanes** — `@voltro/sql-mssql`, `@voltro/sql-turso`
+
+  SQL Server row-image, decimal-query and Change Tracking regressions borrow the shared test-stack credential instead of skipping when its optional environment override is absent. Decimal conversion registers only applicable native Turso schemas; existing real-engine rejection suites retain the unsupported syntax checks. The skipped-test gate remains unchanged.
+- **Preserve scheduled validation evidence across concurrent updates** — `@voltro/cli`
+
+  Scheduled validation runs retain their results while newer updates are checked independently. Superseded ordinary checks still cancel within their event lane.
+- **Match the production deploy fixture pool to SQL workflow startup** — `@voltro/cli`
+
+  Run the production deploy integration fixture with the three connections required by SQL workflow startup, preserving the real production storage and deploy assertions.
+- **Protect retained decimal-conversion witnesses** — `@voltro/database`
+
+  Internal conversion source, stage and publication snapshots refuse row writes and retain their exact protection schema. Staging, retries, rollback and cleanup verify artifact protection. Cutover and rollback compare live values and rowids directly against protected snapshots, retaining allocation-watermark guards.
+
+  Content and physical-identity capture are paged. Durable identity and validated conversion-decision receipts store counts and digests rather than row arrays. Staging, publication, rollback and cleanup bind protected-source validation to the schema epoch inside the write transaction, preserving exact artifact ownership and late-change refusal without row-sized snapshot predicates. Initial source capture validates and copies through one pinned transaction, avoiding a row-sized SQL predicate between separate preflight and write phases. Stage validation balances conjunctions so larger reviewed sets do not exceed native Turso's expression-depth limit. Stage protection is removed only inside the guarded publication transaction; failed publication restores it and successful publication leaves the live table writable. Older mutable internal stages are refused rather than reused for image receipt capture.
+
+  Publication carries the schema epoch captured before complete protected-source and stage validation. It no longer repeats every reviewed row predicate in its write batch, and never resets the epoch after validation. The replaced row-literal guard builders and their whole-row collection branches are removed; snapshot verification uses the current paged digest readers.
+
+  Public conversion activation remains pending. Per-row stage statements and in-memory conversion-review/staging payloads still require bounded representation work.
+
+  Stage content checks now group at most 32 predicates per SQL statement, including all groups during creation and reuse. This bounds expression growth with row count; total staging arrays and individual wide keys remain separate limits.
+
+  Stage row decisions and grouped validations are generated incrementally from the sorted review instead of retaining duplicate full-table maps and SQL arrays. The reviewed cells remain materialized.
+
+  Stage creation now executes generated statements incrementally on one pinned transaction connection. Failure rolls back rows, schema, protection and ownership together; the foreign-key checks remain inside that transaction. The reviewed-cell input remains materialized.
+
+  Decimal source observations use bounded keyset pages with an overlap row, preserving exact typed composite identities and rejecting duplicates at page boundaries. Returned reviewed-cell arrays still require bounded storage work.
+
+  Retained-source coverage consumes observation pages directly and aborts before fetching later pages when validation fails. Explicit reviewed decisions remain indexed until complete coverage is proven; no full observed-cell list or separate observed-identity set is retained by this path.
+
+  Decision normalization is shared per cell, and witnesses can consume validated decisions incrementally while preserving the existing digest. Duplicate or unordered streamed identities invalidate the witness instead of accepting a partial prefix.
+
+  An internal transaction-owned review importer stores individually normalized decisions under an exact canonical index, hashes bounded pages, rejects duplicate imports and seals accepted rows against DML. Integration with source/stage lifecycle and ordinary migrations remains pending.
+
+  Stored-review verification checks the exact ownership receipt, both schemas and protection sets, canonical row keys/observations, bounded content hash and a stable schema epoch. Empty forged sort keys cannot hide before the first page. Ownership rows receive their own DML protection.
+
+  The internal stored-review verifier can now match retained-source observations through indexed batches of at most 128 decisions. It verifies the persisted receipt before coverage and rejects missing, extra, stale, shape-mismatched or ambiguous source decisions, plus schema changes during coverage. This prerequisite does not yet replace the normal conversion path’s in-memory review arrays.
+
+  Stored decisions can also be consumed as complete rows across page boundaries using the same canonical scanner. Consumers run inside the pinned transaction, preserve callback errors, and reject schema changes during consumption; stage lifecycle adoption remains pending.
+
+  Review stores can be reopened from the reviewed owner and witness after closing and recreating the client. Reopening verifies known complete table/index/protection definitions, including native Turso’s canonical trigger spelling, instead of accepting the schema claimed by a mutable receipt. Normal migration lifecycle adoption remains pending.
+
+  Retained decimal sources now create or reopen a deterministically owned review store inside source preparation’s transaction and use its bounded source-coverage verifier. The source receipt binds the review artifact identity. Publication artifact catalogs and atomic cleanup include both review tables. Stage array consumption and later publication-resume content verification are still being completed.
+
+  Decimal stage insertion and row validation now consume the retained source’s persisted review directly, including complete rows spanning decision pages. Stage manifests use that accepted witness, final validation uses a pinned transaction, and the obsolete array-row generator is removed.
+
+  Publication retry, rollback and cleanup now verify persisted review contents against the submitted review witness, not only artifact catalogs. Verification shares the protected-snapshot connection and pre-write schema epoch. Native Turso’s known trigger serialization after table rename is recognized independently from the original stored schema receipt; arbitrary catalog changes remain rejected.
+
+  Internal decimal migration reviews now accept repeatable iterables in unique canonical decision order. Source retry and publication identities hash normalized decisions incrementally rather than creating sorted arrays. Initial import verifies that its second read matches the first witness and rolls back one-shot or unstable input; ordinary file-migration wiring remains pending.
+
+  Removed the superseded in-memory review coverage map and array normalizer. Composite-key coverage regressions now execute the persisted-store verifier against real adapters; cell normalization and streaming witness tests remain.
+
+  An internally reviewed SQLite decimal publication can be applied again after a completed rollback. The previous owned receipt and retained artifacts are checked and retired before a fresh source capture. Reapplication validates the current source against the reviewed cells, preserves intervening unrelated field updates, and refuses stale conversion decisions without overwriting live values.
+
+  Internal retained decimal source and review artifacts use the reserved framework table namespace. Ordinary schema planning therefore keeps the recovery receipts and snapshots instead of treating them as undeclared application tables to drop.
+- **Share dedicated SQL Server test fixture credentials** — `@voltro/database`, `@voltro/cli`
+
+  Share dedicated SQL Server fixture credentials across integration suites and execute soft-drop restoration whenever the test service is reachable; retain explicit connection overrides through Turbo.
+- **Indexed source maps use bounded section offsets**
+
+  Source-map processing uses the repaired dependency version that rejects invalid indexed section offsets instead of blocking the event loop.
+- **Prepare a bounded SQL Server Timeline capture plan** — `@voltro/cli`
+
+  Generate schema-aware transactional capture triggers gated by owned, ready metadata and a matching live observer window. Apply the image budget to the complete before/after pair after privacy masking; incomplete events retain neither image. Real SQL Server tests cover bulk writes, rollback, identity changes and composed Inspect replay using the generated plan and decoder. Guarded installation, continuity checks and ordinary host activation remain separate work; no serving path installs this plan automatically.
+- **Prepare SQL Server Timeline physical catalog validation** — `@voltro/cli`
+
+  Add a schema-scoped catalog fingerprint for application and capture tables. Record column shape, defaults, computed expressions, indexes, constraints and trigger definitions without incorporating mutable data or identity counters. Reject missing tables and opaque metadata. Object-scoped VIEW DEFINITION is required for this reader. Ownership validation, installation and serving activation remain separate prerequisites.
+- **Fence SQL Server Timeline reads against concurrent table resets** — `@voltro/cli`
+
+  Add an internal generation guard around unpublished coherent reads. Reject stale generations and concurrent table or journal resets. Refuse admission until a committed tracking version is later than every tracked table's start version: freshly enabled Change Tracking alone cannot distinguish all resets. Real SQL Server tests cover concurrent truncation, tracking interruption and table replacement. Migration preparation and serving activation remain pending.
+- **Prepare SQL Server Timeline continuity checks** — `@voltro/cli`
+
+  Add a read-only internal generation reader combining tracked-table identity and Change Tracking start version with the database recovery fork. Missing or invisible metadata cannot establish continuity. Native SQL Server probes verify ordinary writes, TRUNCATE, tracking gaps, table replacement and full backup restoration. Permission checks, migration-owned preparation and guarded serving activation remain separate work; this does not enable a serving capture path.
+- **Prepare guarded SQL Server Timeline source reads** — `@voltro/cli`
+
+  Read journal events and snapshot rows through one transaction-bound reader. Check the observer contract, catalog, generation and live pruning receipts on both sides of the snapshot, rejecting expiry during a row read. Failed reads do not acknowledge or consume events. Recorder session publication and ordinary backend activation remain pending.
+- **Compose SQL Server Timeline installation and namespace discovery** — `@voltro/cli`
+
+  Compose owned capture retirement, preparation and persisted activation under the caller's migration coordinator. Reuse a valid active contract without resetting its observers; retire stale capture before rebuilding. Resolve physical table schemas through SQL Server object lookup, including default-schema fallback, and reject mixed or unavailable namespaces.
+
+  Ordinary migration and serving backend selection remain unchanged.
+- **Prepare SQL Server Timeline journal frames** — `@voltro/cli`
+
+  Add an internal SQL Server journal reader using the coherent read transaction. Share retained-history validation with MySQL/MariaDB, including visible source positions, acknowledged pruning and complete row images. Actual Inspect tests keep a historical replay stable across committed updates, inserts and deletes. Capture provisioning, continuity guards and ordinary host activation remain separate work; this does not enable SQL Server source capture in serving paths.
+- **Preserve migration lock scope in SQL Server Timeline sessions** — `@voltro/cli`
+
+  Allow SQL Server Timeline maintenance and recorder sessions to use the migration coordinator's configured lock scope independently of physical table schema. Propagate that scope through admission, acknowledgements, retention and closure. Ordinary backend selection remains unchanged while its integration is prepared.
+- **Prepare SQL Server Timeline observer admission** — `@voltro/cli`
+
+  Add tracked lease storage and migration-coordinated observer admission and closure. Validate the ready epoch, generation and physical catalog before opening immutable server-clock capture windows. Drain in-flight writers, retain history protected by another live observer, and establish a fresh baseline after observer/window expiry. Closing is idempotent and scoped to its observer. ACK, retention and session publication remain pending; ordinary serving and migration backend selection are unchanged.
+- **Prepare SQL Server Timeline observer acknowledgements and retention** — `@voltro/cli`
+
+  Add revision-fenced acknowledgements, immutable renewal windows and bounded journal retention for the internal SQL Server Timeline foundation. Expired observers cannot renew; retention invalidates lagging observers before deleting unseen events. Surviving observers receive explicit pruning receipts, including when collection occurs between reading and acknowledging a frame.
+
+  Source/session publication and final activation remain pending. Ordinary dashboard backend selection and migration hooks are unchanged.
+- **Prepare persisted SQL Server Timeline activation contracts** — `@voltro/cli`
+
+  Persist the prepared generation and physical catalog contract when activating owned Timeline storage. Reject drift between preparation and activation, and discover serving contracts without adopting the current generation on failure. Retirement clears activation. Extend the unactivated internal storage plan to carry the contract; ordinary migration and backend selection remain unchanged.
+- **Persist and retire SQL Server Timeline capture plans** — `@voltro/cli`
+
+  Store the hashed capture plan with internal metadata so migration retirement does not require an obsolete application registry. Validate it before touching triggers. Retire under the migration coordinator: rotate the epoch, clear capture windows and history, and remove only verified triggers in one transaction after in-flight writers drain. Preparing a changed plan is allowed only after explicit retirement. Native tests cover plan changes, removed tables, failed subsequent DDL and altered-trigger refusal. Serving activation remains pending.
+- **Prepare a coherent SQL Server Timeline read boundary** — `@voltro/cli`
+
+  Add an internal driver-owned read transaction for SQL Server Timeline source work. Bind isolation, lock timeout and observer deadlock priority to each read RPC, reject nested transactions, and discard conflicting frames completely. Real SQL Server tests cover pooled state, interruption, caller transaction ownership and a coherent retry after concurrent writes. This does not activate SQL Server Timeline source capture or change ordinary host behavior.
+- **Prepare scoped SQL Server Timeline recorder sessions** — `@voltro/cli`
+
+  Serialize coherent source reads, decode complete batches and acknowledge them before recorder publication. Scope closure and failed or interrupted reads retire the recorder identity and close the observer lease. Internal polling renews the observer and collects changes while the session is open.
+
+  Ordinary backend wiring, snapshot projection and final activation remain pending.
+- **Prepare schema-aware SQL Server Timeline images** — `@voltro/cli`
+
+  Add internal SQL Server image expressions and decoder support for exact decimal and bigint text, UTC timestamps, JSON scalars, unusual column names and masked fields. Reject malformed JSON and non-null unsupported storage before capture publication. This prepares generic source capture; migration provisioning, complete-event size limits and ordinary host activation remain separate work.
+- **Compose guarded SQL Server Timeline schema preparation** — `@voltro/cli`
+
+  Compose application, storage and trigger guards into migration-coordinated capture preparation. Create missing matching objects, enable table tracking and commit the control update required by the generation fence. Stay preparing; ready capture must be retired explicitly. Native tests cover retry, concurrent preparation, missing-trigger recovery and rollback on denied trigger creation. Recognize SQL Server's own tracking child objects while rejecting unexpected dependencies. Preserve original failures alongside transaction-cleanup failures. Observer admission, retention and serving activation remain pending.
+- **Rediscover SQL Server Timeline activation after session invalidation** — `@voltro/cli`
+
+  Resolve persisted activation when opening a new observer instead of retaining a fixed startup contract. Running recorder sessions can establish a new baseline after migration or later provisioning without serving-side DDL. Require callers to provide the migration lock scope explicitly. Ordinary backend wiring remains pending.
+- **Prepare SQL Server Timeline snapshot projection** — `@voltro/cli`
+
+  Read Timeline snapshot pages through the coherent source transaction using the journal's exact scalar encoding, privacy rules and row decoder. Unsupported, malformed or oversized images reject the entire snapshot. Scoped recorder sessions now expose table reads backed by this projection.
+
+  Final activation and ordinary backend wiring remain pending.
+- **Guard SQL Server Timeline storage adoption** — `@voltro/cli`
+
+  Add a read-only migration-side guard for existing capture storage. Require complete metadata visibility, the expected private table shape and primary keys, and one valid framework owner record. Refuse collisions, incomplete storage, altered identity settings and unexpected dependent objects without repairing or deleting them. Trigger ownership and guarded installation remain separate prerequisites; serving capture is not activated.
+- **Validate SQL Server Timeline application-table prerequisites** — `@voltro/cli`
+
+  Add a read-only, schema-scoped preflight for capture identity and projected columns. Reject nullable, computed, nonunique, disabled, filtered or compound identities, and reject storage types incompatible with the image encoders. A unique id index may contain included columns, but Change Tracking also needs an enabled primary key. Native SQL Server tests cover these constraints and same-name tables in other schemas. Exact physical-shape fingerprints, private storage ownership and installation remain prerequisites to serving activation.
+- **Validate SQL Server Timeline trigger ownership** — `@voltro/cli`
+
+  Validate application capture triggers against their recorded generated plan before migration-side adoption. Reject changed bodies, parents, execution options, disabled triggers and colliding objects without modifying them. A ready capture requires all triggers; a preparing installation may have missing ones. Plan upgrades still require explicit retirement. This does not install triggers or activate serving capture.
+
+---
+
 ## [0.83.1] — 2026-10-04
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-comments",
-  "version": "0.83.1",
+  "version": "0.84.0",
   "description": "Comment threads on any anchor your app can name — replies, resolve/reopen, reactions, per-subject unread — live over the existing reactivity channel, with no second push mechanism. Access delegates to your app's own guard (access.viaEntity) or a scope and fails closed when neither is declared; @-mentions are re-filtered to the caller's tenant on search and re-validated at create, then delivered through plugin-notifications when it is installed. useComments / useThread / useMentionSearch in /web, an ejectable <CommentsThread> in @voltro/ui, plus inspect endpoints and a dashboard panel.",
   "keywords": [
     "voltro",
@@ -48,10 +48,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/client": "0.83.1",
-    "@voltro/database": "0.83.1",
-    "@voltro/plugin-notifications": "0.83.1",
-    "@voltro/protocol": "0.83.1"
+    "@voltro/client": "0.84.0",
+    "@voltro/database": "0.84.0",
+    "@voltro/plugin-notifications": "0.84.0",
+    "@voltro/protocol": "0.84.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2",