@voltro/plugin-rooms 0.87.0 → 0.89.0

package/CHANGELOG.md

@@ -41,6 +41,269 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.89.0] — 2026-11-05
+
+### ⚠ BREAKING
+
+- **describeIfReachable moves to @voltro/testing/reachable** — `@voltro/testing`, `@voltro/cli`
+
+  The root of `@voltro/testing` imported `vitest` for `describeIfReachable` / `describeIfAvailable`. With two vitest snapshots in one lockfile (they can differ by nothing more than an optional peer of vite), every test that imported `@voltro/testing` loaded the second instance, and the app's own `expect(...).rejects.toThrow('…')` then reported `but got ''`. The root entry now imports no test runner. Migration: import `describeIfReachable` and `describeIfAvailable` from `@voltro/testing/reachable`; `voltro update` rewrites the imports. `isTcpReachable`, `ReachableTarget` and `reportEngineVersion` stay on the root.
+
+### Added
+
+- **Retain exact historical CMS deployment receipts** — `@voltro/cms`
+
+  Record the original atomic deployment request and result with a signed receipt in its existing activation-history row. The private receipt endpoint can return that exact result after another activation, with the current epochs and whether it is still current. Missing legacy receipts remain unknown; reads never reconstruct history or activate output. Current-only confirmation and public serving admission remain unchanged.
+
+  Apply the additive nullable activation-history column before starting the updated publisher. Existing custom deployment services can omit the optional receipt port and keep their original routes; existing probe, confirmation and acknowledgement wire formats are unchanged.
+- **Fence unresolved CMS output publication requests** — `@voltro/cms`
+
+  Native private publication fencing makes an original unresolved request ineligible for future commit and exact-current acknowledgement, while preserving the actual application, policy and activation history. An already-current result is returned unchanged. Fencing never proves an earlier commit did not occur.
+
+  Apply the normal nullable deployment-head schema plan for `app` and `renderPolicyDigest` before use. Never-bound namespaces gain only an unbound revision; they receive no fabricated application, build or serving authority. Upgrade readers and writers together before creating these heads, and regenerate private clients from the mounted descriptors. Custom services can omit the new port; their mounts expose no fence operation.
+- **Inspect epochs against a retained CMS target** — `@voltro/cms`
+
+  Private output inspection accepts an optional target ID. Native services first verify that retained target in their fixed namespace before returning current epochs, without reopening source contracts, physical custody or publication. Existing empty-body inspection stays unchanged. The optional service port keeps custom implementations compatible; a custom mount without it refuses the new selector instead of falling back to unrelated epochs.
+- **voltro doctor names two copies of @ai-sdk/provider** — `@voltro/cli`
+
+  Each `ai` and `@ai-sdk/*` release pins its `@ai-sdk/provider` exactly, and `@voltro/ai` resolves its provider packages by caret, so an app pinning an older `ai` could hold two copies and `tsc` reported `Type 'LanguageModelV4' is not assignable to type 'LanguageModel'`. `voltro doctor` (and `--json`, field `aiProviderSkew`) now lists every package with the provider version it loads when there is more than one, and names the alignment. Measured: `ai` 7.0.156 beside `@voltro/ai` 0.88.0 resolves 4.0.34 and 4.0.35; 7.0.162 resolves one.
+
+### Changed
+
+- **The db pool boot line names the connection the workflow runner holds** — `@voltro/cli`
+
+  With SQL runner storage on postgres or mysql/mariadb, the workflow runner holds one pool connection for its shard-lock session for the life of the process. The `db pool:` line said `max=5` while the app was served by 4. It now adds `1 of the 5 pooled connections is held for the life of the process (the workflow runner's shard-lock session), so 4 serve the app` after the fleet arithmetic, which is unchanged.
+
+### Fixed
+
+- **voltro add patches removes the patch files of the version left** — `@voltro/cli`
+
+  Retiring a `patchedDependencies` entry for an earlier Effect version left its file in `patches/`, and a leftover is not inert: patch-package (npm, or a root `postinstall` beside pnpm) applies every file there and reports it as unrecognised. `voltro add patches` now removes the framework's own patch files for another version of the same major once nothing references them, in each package manager's naming. A file still named in `pnpm-workspace.yaml` or `package.json`, a patch for another Effect major and a file of your own naming stay.
+- **voltro agents-md --force keeps symlinks and app guides it never wrote** — `@voltro/cli`
+
+  A forced refresh followed a symlinked app guide (`apps/api/CLAUDE.md` → `../../AGENTS.md`) and replaced the repo-root core guide it had just refreshed, and on flat layouts it replaced hand-written app `CLAUDE.md` files that carried no keep marker. A symbolic link is now never written through, and a nested guide that does not start with the heading the command seeds (`# api — agent notes`, `# web — agent notes`, `# database — agent notes`) is reported as protected instead of overwritten.
+- **Keep known CMS rollback independent of expired build snapshots** — `@voltro/cms`
+
+  Roll back a previously activated complete native output using its retained contracts after the private build snapshot expires. Preserve current publisher, region, graph, rights, policy and CAS checks; expired unactivated targets and new forward activation still refuse.
+
+  The deployment-reader callback gains an optional third mode argument. Existing two-argument readers remain assignable and existing calls remain valid; the returned contract is unchanged.
+- **Keep visible movement labels in accessible names** — `@voltro/cms`
+
+  CMS movement controls keep the complete visible action together in their contextual accessible names, so speech input can find them by the words shown. Localized controls retain their explicit label callbacks.
+- **Reject Git deletion markers in CMS rollback previews** — `@voltro/cli`
+
+  Reject the all-zero Git deletion marker before a CMS rollback is queued. The CLI now matches the API's existing commit validation while preserving image rollback previews.
+- **voltro update reviews many test files without running out of memory** — `@voltro/cli`
+
+  The syntax reviews `voltro update` prints parsed every matching file with its own copy of the TypeScript standard library, so a workspace with a few hundred test files importing `@voltro/testing` exhausted Node's default heap in the request-harness review (`JavaScript heap out of memory`, exit 134), including under `--codemods-only --dry-run`. The reviews read local bindings and imports only and now load no standard library: the same tree completes in seconds with about 140 MB and lists the same call sites.
+- **voltro update --codemods-only names dependencies below the framework's peers** — `@voltro/cli`
+
+  `--codemods-only` promises not to edit dependencies, so it skipped peer alignment without a word — on the recovery path after a `--no-install` update, an app's own dependency below a framework peer (a direct `ioredis ^5` against `@voltro/kv`'s optional `ioredis ^6.0.0`) surfaced only in `pnpm peers check`. It now prints each one under `Peer review` with its manifest and the framework package requiring it, and still changes nothing.
+- **Scaffolds show the object cache form; comments no longer stop voltro add redis** — `@voltro/cli`
+
+  The api templates still showed the refused scalar form in commented-out examples (`// cache: 'redis' as const`, `// kv: 'redis' as const`) and in two explanations; they now show `{ backend: 'redis' as const }`. `voltro add redis` treated a `cache:` that appeared only in a comment as an existing declaration and declared nothing, which is every config scaffolded from the api template; it now reads declarations only. The upgrade lists commented-out scalar examples in code so they can be rewritten before someone uncomments one.
+- **voltro dev waits for the api's own drain deadline before SIGKILL** — `@voltro/cli`
+
+  On a restart the dev supervisor sent SIGKILL 1.5 seconds after SIGTERM. The api child bounds its own drain by `VOLTRO_SHUTDOWN_GRACE_MS` (10 seconds by default), and an app with workflows legitimately takes longer than 1.5 seconds against a remote or pooled database: its runner hands every shard back, two round trips per shard. Such restarts logged `child ignored SIGTERM — escalated to SIGKILL` every time, and the teardown after the cut (CDC detach, trace flush, the startups' `onShutdown`, pool close) never ran. The child now reports its deadline to the supervisor, which waits one second past it. The child logs `drained in …ms`, or `drain deadline exceeded` when it does not finish.
+- **A lazy boundary still loading after hydration keeps its server HTML** — `@voltro/web`
+
+  A server-rendered page whose layout code-splits part of itself behind `lazy()` + `<Suspense>` blanked once on every first load and mounted that part afresh: its iframes reloaded, inputs and scroll positions inside it started over. Hydration keeps such a boundary's server HTML while its chunk loads, but the framework's own work right after hydration — adopting the server's loader data, mounting the route announcer and the development chrome, the API runtime arriving or changing its version — re-rendered the page as an urgent update, and React discards the server HTML of a boundary an urgent update reaches. That work now runs as transitions, which wait for the boundary. The route announcer also no longer speaks on the first load (it did when the route meta settled after hydration, and in development on StrictMode's second effect run); it announces navigations only, as documented.
+- **Pages and layouts with a loader never render without their data** — `@voltro/web`
+
+  `useLoaderData()` promises a page that declares a `loader` its result, yet a first load without server data rendered the page once with `undefined` before the loader settled: a client-rendered app, a `renderMode: 'spa'` page with its own loader under a server-rendered layout (it received the server's placeholder), a second `<Router>` in the same process (component tests) and, behind a `Pending` skeleton swap, a layout with a loader that differs from the previous route's. A page reading `data.title` threw into its error boundary, and that boundary stayed up after the data arrived because the pathname had not changed. The router now renders a page or layout only with its own loader result; until then the route's `Pending` skeleton stands in for it and everything inside it, or nothing when the route has none. Hydration of server-rendered pages is unchanged. A page that drew its own loading state from an absent value never sees one now: export `Pending` (or `loading.tsx`) for that.
+- **Avoid duplicate reads when reopening application archives** — `@voltro/cli`
+
+  Reopening a retained application reuses the complete inventory verified during that call when checking its exact directory contents. Every new open still rehashes all retained source, executable and web bytes and rejects corruption, symlinks and extra files.
+- **Reduce allocation while verifying retained runtime bytes** — `@voltro/cli`
+
+  Verify the complete Node executable before and after retained execution with one bounded reusable read buffer. Keep the fresh byte hash, no-follow file admission and 256-MiB limit; no runtime pin is cached between calls.
+- **A replica that loses a schedule claim no longer counts a failed insert** — `@voltro/runtime`
+
+  Replicas that share schedules decide each firing with a claim row. The losing replica found out through a failing INSERT (the primary-key conflict), so every lost race raised `voltro_db_errors_total{op="insert"}` with no log line naming it, and the database logged a duplicate-key error for it. The claim is now an insert that is ignored on conflict. The winner is decided exactly as before; a lost race is no longer a statement failure.
+- **voltro update re-keys the Effect patches for a release on a newer Effect** — `@voltro/cli`
+
+  pnpm patch entries name an exact version, and pnpm refuses an install whose entry matches nothing. An update to a release on a newer Effect therefore failed its own install with `ERR_PNPM_UNUSED_PATCH` over the driver patch an earlier `voltro add patches` wrote, and the codemod naming the repair only runs after that install. `voltro update` now reads the Effect version the target's patches are keyed to, moves the lockstep overrides to it and retires the earlier CLI's patch entries before installing; afterwards the installed CLI writes the target's patches and the update installs once more. A failed first install restores `pnpm-workspace.yaml` byte for byte, a patch you created yourself keeps its key, and a custom Effect override stops the update before anything is written. `voltro add patches` also accepts the `4.1.0` overrides an earlier release wrote instead of refusing them as custom. An update started by a CLI without this repair still needs the manual order in the update documentation.
+- **voltro update keeps the old release-age exclusion until the install is done** — `@voltro/cli`
+
+  `voltro update` moved each `minimumReleaseAgeExclude` entry from the release being left to the target before installing. pnpm checks the lockfile's existing entries against its release-age window too, so while the release being left was still inside the window — an update the day after a release — the install refused the lockfile with `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`, and the update's message suggested waiting for a registry instead. The entry being left now stays beside the target until the install has replaced the lockfile and is removed afterwards; the preview and the result say so. A failed install still restores the file byte for byte. When the refusal comes from pnpm's default window without exclusions, the message names the window and the two versions to exclude.
+- **Preserve existing rules for generated web files** — `@voltro/cli`
+
+  Web generation recognizes rooted and unrooted rules for the `.framework` directory and leaves `.gitignore` unchanged when that directory is already covered.
+- **A workflow finalizer observes the terminal exit once, not a success per replay** — `@voltro/cli`, `@voltro/workflow`
+
+  On Effect 4.1.0 a body that suspended and ran again registered its `addFinalizer` callback twice, and the superseded registration was called with `Exit.succeed(undefined)` whatever the outcome — after a failed or interrupted workflow too, so a finalizer that treats success as commit committed a failed run. The shipped Effect patch now skips finalizers of a run that suspended: the run that reaches the terminal state calls its finalizer once with the real exit; compensations still run once on failure. Run `voltro add patches` and install to pick up the refreshed patch.
+- **A backlog of due workflows no longer takes the whole connection pool** — `@voltro/workflow`, `@voltro/cli`, `@voltro/database`, `@voltro/sql-postgres`, `@voltro/sql-mysql`, `@voltro/sql-mssql`
+
+  A runner that took over shards with many due executions resumed all of them at once, and their journal writes filled the pool the app shares. With a pool of 5, 1,000 due executions and a 20 ms round trip, a `SELECT 1` waited up to 9.8 s for a connection and the runner's storage sync timed out after 5 s. The engine now admits at most half of the connections the process does not hold for life to its journal at once (at least 1). In the same measurement the longest wait was 1.6 s, no timeout occurred, and the backlog took about 40 % longer to drain. A journal write made inside a SQL transaction is never held back, so the bound cannot deadlock against connections that transactions hold. The `db pool:` boot line states the bound. The postgres, mysql/mariadb and mssql adapters now register their effective pool size, including the driver default of 10 when `DB_MAX_CONNECTIONS` is unset.
+- **Workflow journal rows written before Effect 4 no longer stall the runner** — `@voltro/workflow`
+
+  A database whose workflow journal holds rows from a release before 0.85.0 carries two shapes Effect 3 wrote and Effect 4's codecs refuse: a void result without its `value` key — every interrupt recorded then has it — and a failure cause as a tree. Effect 4 loads an execution's persisted interrupt whenever the execution activates, so a boot with such an interrupt and a pending message logged `Defect building entity handlers` every few seconds for that execution, its message never received a reply, and other workflows on the same runner did not finish meanwhile. Polling such a run failed on the cause tree, and restart tooling read it as an unrecognized reply. The engine now reads both shapes as their Effect 4 form on every dialect; rows are not rewritten, and rows written today are unchanged. A stray step message of a run that already ended is answered without running the step again.
+- **voltro workflows run commands accept the execution id start prints** — `@voltro/cli`
+
+  `voltro workflows start` prints the run handle's execution id, and `discard` (like `show`, `retry`, `cancel`, `suspend`, `resume`, `signal` and `update`) answered "Workflow run target not found" for it; only the run id from `list` worked. An id that names a run's execution is now resolved to that run first.
+
+---
+
+## [0.88.0] — 2026-11-02
+
+### ⚠ BREAKING
+
+- **Direct computed-cache key callers handle unencodable subjects** — `@voltro/runtime`, `@voltro/voltro`
+
+  `computedCacheKey()` can return `bypass: 'subject-not-encodable'` for claims that cannot safely identify a cache entry. Direct consumers with exhaustive bypass switches must handle this case by running without caching. `voltro update` identifies the direct imports to review. Queries using the native `cache:` declaration and `invoke()` tests need no manual key or code change.
+- **The framework runs on effect 4.1.0** — `@voltro/cli`, `@voltro/devtools`, `@voltro/runtime`, `@voltro/database`, `@voltro/voltro`, `@voltro/sql-sqlite`, `@voltro/sql-mysql`, `@voltro/sql-mssql`, `@voltro/sql-postgres`
+
+  Every `@voltro/*` package now pins `effect` and its `@effect/*` companions to 4.1.0. Apps pin the same version and run `voltro add patches`: it writes the 4.1.0 patch files, retires the `patchedDependencies` entries an earlier CLI shipped for 4.0.1 (pnpm refuses an install over an unused patch) and moves the lockstep overrides. Two former patch fixes ship upstream in 4.1.0 (SQL Server request cancellation, the SQL Server message-storage MERGE). On SQL Server the shared transaction key now applies to every client in the process, not only the first one built.
+
+  `chunkRowsForInsert` from `@voltro/database` returns non-empty chunks (`NonEmptyReadonlyArray`), the shape effect 4.1's `sql.insert` requires; an empty input yields no chunk instead of one empty chunk.
+
+  SQL statement spans are named after their database, following the OpenTelemetry database conventions: the database name, else the server address, else the system name (`postgresql`, `mysql`, `microsoft.sql_server`, `sqlite`). Before, every statement span was `sql.execute`. Trace queries and dashboards that match that name should match the `db.query.text` attribute instead; the devtools trace panel and durable-trace sampling already do.
+
+  **`voltro update` carries you across this** — codemod `0.88.0/01_effect-4-1`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.88.0).
+- **Runtime patch pins preserve third-party Effect majors** — `@voltro/cli`
+
+  `voltro add patches` scopes Effect pins to their current major instead of replacing unrelated libraries' Effect 3 dependencies. It migrates exact pins previously shipped by the framework, preserves unrelated policies, and refuses conflicting custom policies before writing files. In pnpm workspaces it names competing nonempty root `resolutions` or `pnpm.overrides` and explains their explicit reconciliation. Peer repair refuses cross-major global policy changes. Bun workspaces require Bun >=1.4.4 and a supported `packageManager` pin or `engines.bun` floor; upgrade the actual tool and older declarations before retrying, because Bun 1.2.0 ignored the scoped companion pin. `voltro update` carries the review as `0.88.0/06_effect-override-scope`.
+- **Keep test runners out of production KV and workflow dependency closures** — `@voltro/kv`, `@voltro/workflow`
+
+  The test-only HotStore and workflow conformance suites now require their caller to supply runner operations. Pass `{ describe, it, expect }` as the third argument to `hotStoreConformance`, and `{ describe, test, expect, beforeAll, afterEach }` as the second argument to `runClusterEngineSuite` and `runJournalEncryptionSuite`. The exported structural runner interfaces have no dependency on Vitest. Both production packages remove their optional Vitest peer; an application's development runner can no longer enter a production deployment through those peer links. Keep Vitest in the test application's own devDependencies. Runtime KV/workflow calls and `runHotStoreSqlParity` are unchanged. `voltro update` identifies direct suite imports for review.
+- **REST test handlers publish events under the request tenant** — `@voltro/testing`, `@voltro/cli`
+
+  When crossing 0.87.0, custom `makeTestApp({ restRoutes })` handlers receive a request-scoped `ctx.app` instead of the root fixture context. Event assertions must subscribe to that request tenant: the default anonymous request uses `acme` or `x-tenant`; an explicit `anonymous: 'no-tenant'` uses `''`, distinct from the event bus subscriber's default `null`. Pass the app's anonymous policy, select the subscriber tenant explicitly and assert delivered payloads even when HTTP success and `notified` already pass. Direct `invoke` retains its supplied context identity, and projected `publicApi` handlers already use request-scoped invocation. Plugin HTTP routes are not mounted by this request harness. `voltro update` locates raw request harness calls and prints the review steps.
+
+### Added
+
+- **voltro add patches --ai accepts ai 7.0.156** — `@voltro/cli`, `@voltro/ai`
+
+  `voltro add patches --ai 7.0.156` wires the AI SDK declaration correction for `@ai-sdk/provider-utils` 5.0.70, regenerated with the original build from the release commit; JavaScript stays byte-identical to the published package. 7.0.105 and 7.0.132 remain selectable. `@voltro/ai` is built and tested against ai 7.0.156.
+- **The retained invoice observations table is exported from the billing package** — `@voltro/plugin-billing`
+
+  `billingRetainedInvoiceObservationsTable` is exported from `@voltro/plugin-billing` beside the other billing tables, so an app can reference it.
+- **plugin-billing accepts stripe 23** — `@voltro/plugin-billing`
+
+  The `stripe` peer range is `^22.6.1 || ^23.0.1`. stripe 23 pins Stripe API version `2026-09-30.endive`; the plugin still sends no `apiVersion` of its own, so the SDK's pinned version applies.
+
+### Changed
+
+- **A booting server holds requests until the app is ready instead of answering 503** — `@voltro/runtime`, `@voltro/voltro`
+
+  `voltro serve`, `voltro start` and `voltro dev` used to answer every request that arrived before the boot finished with a plain-text `503 starting`. On a platform that scales to zero, that request is the visitor who woke the instance, and a browser does not act on `Retry-After` for a navigation. Requests and WebSocket upgrades that arrive while the app boots now wait and are handed to the app in arrival order once it is ready. The wait is bounded by `VOLTRO_BOOT_HOLD_MS` (default `30000`, at most five minutes, `0` restores the immediate `503`) and by 512 waiting requests. A request the wait cannot cover still gets `503` with `Retry-After: 1`, and a browser navigation gets a minimal page that reloads itself. `/internal/startup` reports waiting requests as `held`, and `bindBootListener` accepts `holdMs` and `maxHeld`. Probes are unchanged, so nothing changes under Kubernetes.
+- **DocsLayout navigation nests collapsible groups with page counts** — `@voltro/ui-shadcn`
+
+  `DocsLayout` renders its sidebar as one tree: headerless groups are flat start links, other groups and sub-groups are collapsible rows with page counts, `DocsNavSubGroup` accepts nested `subgroups` and `trailingEntries`, the current page's link carries `aria-current="page"` (forwarded through `ShellLinkProps`), and the rail scrolls the active link into view after navigation.
+- **Native Redis connections use ioredis 6 and keep the RESP2 protocol** — `@voltro/kv`, `@voltro/runtime`, `@voltro/cli`
+
+  The native Redis transport moved to ioredis 6, which defaults to RESP3. Registry connections set `protocol: 2`, so command replies, Pub/Sub and Lua results keep their shapes.
+- **Connection drivers install only with the server runtime** — `@voltro/kv`, `@voltro/runtime`
+
+  `ioredis`, `@upstash/redis` and `@nats-io/transport-node` are optional peers of `@voltro/kv` and dependencies of `@voltro/runtime`. API apps keep all three without a step; web apps and SDKs that reach `@voltro/kv` only through types no longer download server drivers. Code that opens a connection without `@voltro/runtime` adds its driver, and a missing driver now fails naming the package.
+- **The mobile template targets Expo SDK 58** — `@voltro/cli`
+
+  New mobile apps scaffold on Expo SDK 58 with React Native 0.88.1 and React 19.3.0, using the versions SDK 58 bundles for its native modules.
+- **plugin-sentry runs on Sentry 11 and exports server spans over OTLP** — `@voltro/plugin-sentry`
+
+  Sentry 11 removed `SentrySpanProcessor`. The plugin now exports the framework's spans to the OTLP endpoint Sentry derives from the DSN and links errors and logs to the active span with `openTelemetryIntegration()`; the Sentry SDK records no spans of its own. `tracesSampleRate` keeps its meaning and is applied per trace id at the export. Server traces need the optional `@opentelemetry/sdk-trace-base` and `@opentelemetry/exporter-trace-otlp-http` packages (they replace `@sentry/opentelemetry`); without them the plugin warns and reports errors and breadcrumbs only. `init.tracesSampleRate` and `init.enableOpenTelemetrySetup` are ignored, and `init.skipOpenTelemetrySetup` no longer exists in Sentry 11.
+
+### Fixed
+
+- **Deferred workflow starts retain their original caller receipt** — `@voltro/workflow`, `@voltro/cli`
+
+  A controlled workflow start now returns its existing queued receipt when another replica exhausts submission retries, or shared capacity moves, before its acceptance callback dispatches. It no longer reports an ordinary start failure while the committed submission remains unresolved. Execution identity, caller input, capacity ownership and retry limits stay unchanged; definite rejection and invalid ownership still fail explicitly.
+
+- **Aggregate counters are non-negative safe integers on every dialect** — `@voltro/database`
+
+  A `count()` / `countDistinct()` / ranking counter now decodes to a number only when it is a non-negative safe integer; a fractional, negative, non-numeric or larger value is refused instead of passed through or rounded. SQLite and Turso decode counters too when the queried table has decimal columns, where they used to stay strings.
+- **Cache clear honors connection namespace prefixes** — `@voltro/kv`, `@voltro/cache`
+
+  Clearing a cache through a named, namespaced Redis connection now binds logical cache keys to that connection's physical namespace. Redis-family engines and the local transport preserve neighboring caches and invalidation fences, while refusing foreign prefixes and forged key sets. The existing atomic cache command format remains unchanged.
+- **Cache commands use the selected app's configuration and connections** — `@voltro/cli`
+
+  `voltro cache status`, `flush` and `invalidate` resolve `app.config.ts`, environment overrides and named Redis connections exactly like Dev and Serve, including an optional target app directory. Invalid configuration fails instead of silently reporting memory, in-process transports refuse CLI mutation, and diagnostics omit endpoint URLs and credentials.
+- **Generated cache examples boot and upgrade reviews name affected lines** — `@voltro/cli`
+
+  The seeded core API example now uses an object cache declaration. Forced guide refresh discovers both flat and project-grouped app layouts, replacing stale nested examples without executing configs or crossing an app boundary. The shared cache/KV migration review lists authored code locations, including asserted backend literals, and a new review reaches applications that already crossed the original migration. It also identifies stale core guides for refresh; protected hand-maintained guides stay under their owner's control.
+- **Subject query caches follow current authority** — `@voltro/runtime`, `@voltro/testing`
+
+  Subject-scoped computed queries key the complete subject claims and raw and resolved permission sets. Removing an admin grant, changing roles or switching tenant or credential type cannot reuse a result admitted under earlier authority. Authentication refreshes before lookup, and a change while a read is pending refuses retention and delivery. Connection-local state is never covered by subject scope; handlers that read it do not retain their results. The same decisions apply to `invoke` tests, memory caches and Redis caches.
+- **Preserve connection declaration errors across module boundaries** — `@voltro/kv`
+
+  Redis, NATS, Storage, Analytics and SQL registries retain typed configuration diagnostics across module and VM boundaries instead of mislabeling them as dynamic credential failures. Errors returned by credential resolvers remain redacted.
+- **Bind demo API tenants consistently in browser and server renders** — `@voltro/cli`
+
+  The fullstack, admin, SSR API and public status templates now send their explicit demo tenant to header-based anonymous APIs. SSR API and status pages use the same binding for server-side RPC reads, so a fresh scaffold renders successfully and its browser subscriptions select the same data. API refusals for missing tenants and access checks remain enforced. These demo bindings select rows and do not authenticate users; private production data requires verified authentication. Fresh-consumer diagnostics retain uppercase error log lines.
+- **Two voltro dev processes starting together mint one set of secrets, not two** — `@voltro/cli`
+
+  `voltro dev` mints missing project secrets into `.env.local`. Two processes on one project starting at the same time (two local replicas, a dev server beside a test boot) each minted their own values; with field encryption the database recorded one key and refused the second process at boot. Minting now runs under a lock and adopts a value another process wrote meanwhile; a lock left by a crashed mint is taken over.
+- **Event warnings follow workspace package exports** — `@voltro/cli`
+
+  Development event wiring warnings now recognise sibling `useEvent` consumers imported through package exports, TypeScript path aliases, named and namespace re-exports, and static local aliases. Each subscription is matched to its descriptor so an unused import or another API's same-named module does not hide a missing consumer. Workspace discovery supports declared pnpm, npm, Yarn and Bun members and excludes nested projects and build output.
+- **Index audit preserves partial row coverage and uniqueness** — `@voltro/database`
+
+  The index audit recommends dropping an index only when another B-tree index preserves its row coverage and uniqueness. Partial unique indexes no longer make full indexes appear redundant; specialized index methods and unproved predicate relationships are excluded, and recommendations name only the safe replacement direction.
+- **Migration logs identify which operations their count includes** — `@voltro/database`
+
+  Development auto-migration logs now identify their applied-operation count as the planner pass, excluding framework bootstrap and file-based migrations. A schema plan taken before boot can include work completed by those earlier stages; run a new plan after boot to verify that no operations remain.
+- **Filter completed workflow pool owners before recovery transport** — `@voltro/cli`, `@voltro/voltro`, `@voltro/workflow`
+
+  Pool release recovery now persists its terminal settlement on submission and restart owners and filters those markers through indexed SQL predicates. Finished owner history no longer crosses the wire on every idle pass or after process restart. Lost release acknowledgements, held owners and missing evidence remain recoverable and reported; immutable owners and permit tombstones remain for receipt and replay safety. Normal framework schema migration adds two nullable settlement markers and their indexes; existing history is checked once in bounded pages. Settlement indexes use explicit short names within SQL identifier limits. Reconciliation cadence is unchanged.
+- **Presence transport warnings follow actual subscription readiness** — `@voltro/plugin-presence`
+
+  Presence reports pending binding or subscription acquisition without a false missing-provider warning after five seconds. It reports cross-instance readiness only after acquiring the broadcast subscription, while local-only bindings and failed subscriptions still warn. Closing or replacing a binding prevents stale callbacks and releases subscriptions acquired afterward.
+- **Self-updates finish after the old CLI installation is removed** — `@voltro/cli`, `@voltro/runtime`
+
+  `voltro update` loads its completion helpers before installing the target version, so removing the running CLI package no longer turns a successful upgrade into a missing-module failure. Error reporting uses the shared lightweight `@voltro/runtime/boot-refusal` entry loaded before dispatch; genuine failures keep their original message and exit code without loading the server dependency graph for help or version commands.
+- **Compiled API servers start without a source-analysis dependency** — `@voltro/cli`
+
+  The development event-consumer audit loads its source compiler only when scanning. A compiled API server can start after relocation without app sources or a direct `ts-morph` dependency. Package-export consumer discovery keeps its existing scope and does not execute application modules.
+- **SignalHeader centers its brand in the masthead** — `@voltro/ui-shadcn`
+
+  The `SignalHeader` brand slot is a centered flex row, so a brand link no longer sits on the text baseline and renders a few pixels above the masthead's center.
+- **Update reports changed runtime patch assets before boot** — `@voltro/cli`
+
+  `voltro update` compares configured pnpm Effect and SQL-driver patches with the target CLI's assets during its codemod step, including `--codemods-only`. Changed bytes produce refresh and install instructions even without workflows. Same-version checks also report drift. Custom patch paths are named and files remain untouched.
+- **Upgrade reviews omit locator counts and unchanged REST type plumbing** — `@voltro/cli`
+
+  The aggregate review excludes locator chains and local locator aliases while retaining uncertain query receivers. The idempotency review lists REST context constructions, context factories and guard definitions instead of every context or guard parameter annotation. Aliased imported calls in JavaScript custom hosts remain visible.
+
+### Internal (no consumer-facing effect)
+
+- **Effect audits distinguish regression data from executable legacy APIs**
+
+  Effect migration audits allow test data to describe a foreign dependency's retained major. Removed package imports and obsolete bound API calls remain findings in tests and application code, while production migration-residue checks remain unchanged.
+- **The doctor's table nullability manifest covers the billing history tables** — `@voltro/cli`
+
+  The generated nullability manifest `voltro doctor` reads was missing the invoice-history and customer-account tables the billing plugin added; it is regenerated from the declarations.
+- **Installation checks refuse ambient workspaces and source overrides**
+
+  Installation checks require standalone directories before creating projects. Artifact consumers use shipped template and documentation assets without inheriting maintainer source overrides or Node module loaders. Registry, package-manager and explicit application settings remain available.
+- **Installation checks require healthy applications and usable modules**
+
+  Installation checks require API readiness, successful web responses and transformed JavaScript modules while the development process remains running. HTTP errors and HTML fallbacks cannot satisfy those checks. Diagnostics distinguish application startup from shutdown.
+- **Keep CLI fixture temporary roots and child outcomes explicit**
+
+  Automatic sidecar tests inspect the actual operating-system temporary directory and release their bound owner even when an assertion fails. Schema-boot fixtures retain the child's exit signal and assert the real exit tuple alongside readiness and migration counts, so a signal cannot become a false successful process result. Production security and signal guards remain unchanged.
+
+  Workflow recovery tests distinguish the recorded failure budget from concurrent dispatches already in flight. They retain the same prepared execution identity, require one body execution, and verify that stopped or accepted submissions cannot dispatch again.
+- **Native SQL checks isolate schema ownership across fixtures**
+
+  Wallet and shop checks own separate server databases so concurrent schema creation cannot contend with another fixture's live writes. Independent pools within a fixture still share the real database. Cleanup closes all acquired pools before dropping only the owned namespace, and a native regression verifies isolation with identical wallet identities.
+- **Native reload checks retain manifests published during SQL observation**
+
+  Native geometry checks establish the expected-version receiver before reload activation. A real transport regression holds the consumer until the new manifest arrives, so asynchronous SQL observation cannot hide a missed publication. Frame deadlines retain their original call sites.
+- **Native snapshot probes join their scheduled driver**
+
+  Held-source stream probes quiesce and join the actual Host driver before directly pumping its captured graph. This prevents a scheduled turn from concurrently entering that graph and closing the fixture's native Session. Listener, SQL, controller, wire delivery, rights withdrawal and final cleanup assertions remain active; ordinary stream cases retain the running driver.
+- **Bound the reviewed Sentry tool exception and retain every dependency instance**
+
+  The owner-reviewed exception accepts only sentry 0.45.0 under FSL-1.1-Apache-2.0 as unmodified external tooling for the Sentry integration. This does not classify FSL as permissive or remove its competing-use restriction. The runtime license walk checks every resolved instance, so an accepted version cannot hide a second version or license. Generated notices and the SBOM use actual package identities. Containment checks cover framework, workspace and scaffold patch files plus declared patches with arbitrary filenames; the API bundler leaves the tool external.
+- **Stack scaffold checks require major-scoped runtime alignment**
+
+  The normal stack scaffold regression parses its generated workspace policy and verifies both Effect 4 selectors while refusing unqualified Effect and companion pins. Patch declaration and actual patch-byte checks remain, so the regression follows the preserved foreign-major contract instead of demanding its earlier unsafe global override. Its synthetic workspace declares its own pnpm version, making Compose baseline coverage independent of the test runner's package-manager environment.
+- **Dependency security checks verify installed source remediations**
+
+  Dependency security checks accept a reviewed source remediation only after verifying exact patch and implementation hashes, patched references in every lockfile document, actual caller resolution and runtime behavior. Deepmerge's returned-object prototype protection preserves ordinary configuration merging. Unaffected dependency graphs receive no exception, and a local source remediation is never reported as an upstream fixed version.
+
+---
+
 ## [0.87.0] — 2026-10-31
 
 ### ⚠ BREAKING
@@ -3231,6 +3494,15 @@ _Changes staged for the next release accumulate here (rolled up from
 - **Prepare the exact XYFlow type correction before normal installation** — `@voltro/cli`
 
   `voltro add patches --xyflow 12.12.0` prepares the original XYFlow declaration correction and its complete license/notice before a normal package-manager or UI installation. Existing conflicting project patch assets are preserved and rejected before writes.
+- **Dispatchers drain accepted reads before store disposal** — `@voltro/runtime`, `@voltro/cli`
+
+  Runtime adds `Dispatcher.closeAndDrain()` to join accepted reads and deliveries before store disposal. Normal Dev and Serve API shutdown await it; synchronous `close()` remains available.
+- **Workflow cluster hosts declare shard groups and ClusterCron routing groups** — `@voltro/workflow`, `@voltro/cli`
+
+  Workflow cluster hosts can explicitly declare available/assigned shard groups and ClusterCron routing groups. Omitted settings retain existing routing; persistent journal migration is a separate prerequisite for changing groups.
+- **PostgreSQL workflow hosts can persist routing-generation admission** — `@voltro/workflow`, `@voltro/cli`
+
+  PostgreSQL workflow engine hosts can opt into persisted routing-generation admission with `journalRouting`; actual durable MessageStorage operations use the ownership guard. Full API-role wiring and maintenance rollout remain separate requirements.
 
 ### Changed
 
@@ -24321,9 +24593,3 @@ public registry yet.
 
 Subsequent releases record their deltas from here under dated headings, with
 `⚠ BREAKING` first.
-
-- Runtime adds `Dispatcher.closeAndDrain()` to join accepted reads and deliveries before store disposal. Normal Dev and Serve API shutdown await it; synchronous `close()` remains available.
-
-- Workflow cluster hosts can explicitly declare available/assigned shard groups and ClusterCron routing groups. Omitted settings retain existing routing; persistent journal migration is a separate prerequisite for changing groups.
-
-- PostgreSQL workflow engine hosts can opt into persisted routing-generation admission with `journalRouting`; actual durable MessageStorage operations use the ownership guard. Full API-role wiring and maintenance rollout remain separate requirements.