@voltro/protocol 0.84.0 → 0.86.0

package/dist/index.d.ts

@@ -3,14 +3,16 @@ import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { Layer } from 'effect';
 import { Option } from 'effect';
-import { Rpc } from '@effect/rpc';
-import { RpcMiddleware } from '@effect/rpc';
+import { Rpc } from 'effect/rpc';
+import { RpcMiddleware } from 'effect/rpc';
 import { Schema } from 'effect';
-import { SqlClient } from '@effect/sql';
-import { Stream } from '@effect/rpc/RpcSchema';
+import { SchemaAST } from 'effect';
+import { SqlClient } from 'effect/sql';
+import { Stream } from 'effect/rpc/RpcSchema';
 import { VersionConflict } from '@voltro/database/wire';
+import { YieldableError } from 'effect/Cause';
 
-export declare interface ActionProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All> {
+export declare interface ActionProcedureDescriptor<Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top> {
     readonly kind: 'action';
     readonly name: Name;
     readonly input: Input;
@@ -76,7 +78,7 @@ export declare interface ActionProcedureDescriptor<Name extends string, Input ex
     readonly internal: boolean | undefined;
 }
 
-export declare const actionToRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: ActionProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Schema.All, never>;
+export declare const actionToRpc: <Name extends string, Input extends Schema.Top, Output extends Schema.Top, Err extends Schema.Top>(descriptor: ActionProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Top, never, never>;
 
 export declare const ADMIN_SCOPE = "admin:full";
 
@@ -138,7 +140,11 @@ export declare interface AnyApprovalPolicy {
 export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | AuthenticatedCheckSpec | OpenAccessSpec | ServiceAccessSpec;
 
 /** Any declared event, with the generics erased — for registries and audits. */
-export declare type AnyEventDescriptor = EventDescriptor<string, Schema.Schema.Any, Schema.Schema.Any>;
+/** The erased descriptor every registry holds. `guards` reads the key type
+ *  contravariantly (a policy guard is called WITH the key), so the erased form
+ *  takes `never` there: every concrete descriptor is assignable to it, and a
+ *  consumer that wants to call a guard must narrow first. */
+export declare type AnyEventDescriptor = EventDescriptor<string, Schema.Top, Schema.Top, DeclaredAccess<never>>;
 
 /** A guard is a scope check, a relationship check, or an identity check. */
 export declare type AnyGuardSpec<Input = unknown> = GuardSpec<Input> | PolicyGuardSpec<Input> | AuthenticatedGuardSpec;
@@ -177,17 +183,15 @@ export declare const APIKEY_ISSUE_SELF_SCOPE = "apikeys:issue:self";
 export declare class ApiUnavailable extends ApiUnavailable_base {
 }
 
-declare const ApiUnavailable_base: Schema.TaggedErrorClass<ApiUnavailable, "ApiUnavailable", {
-    readonly _tag: Schema.tag<"ApiUnavailable">;
-} & {
+declare const ApiUnavailable_base: Schema.Class<ApiUnavailable, Schema.TaggedStruct<"ApiUnavailable", {
     /** The binding name on the caller (`apis.<name>`). */
-    api: typeof Schema.String;
+    readonly api: Schema.String;
     /** The rpc tag that was called. */
-    tag: typeof Schema.String;
+    readonly tag: Schema.String;
     /** Why no answer arrived. */
-    reason: Schema.Literal<["timeout", "transport", "closed"]>;
-    message: typeof Schema.String;
-}>;
+    readonly reason: Schema.Literals<readonly ["timeout", "transport", "closed"]>;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /** The subject a decision produces, plus what the decision took away. `removed`
  *  is never non-empty for a `grant`. */
@@ -208,7 +212,7 @@ export declare const applyRowPatch: (prev: ReadonlyArray<PatchRow>, patch: RowPa
  *
  * Builds an id→row map from prev, applies `add` / `replace` (which set the
  * id → next row), then materialises the result strictly in the patch's
- * `order`. A `remove`d id simply isn't in `order`, so it drops out of the
+ * `order` (or prev's sequence when null). A `remove`d id simply isn't in `order`, so it drops out of the
  * output naturally — no key-type juggling to delete it from the map. Any
  * id in `order` that the map doesn't resolve (a desync — the client missed
  * an `add`) is skipped rather than throwing, so one dropped frame degrades
@@ -239,7 +243,7 @@ export declare const applyScopeDecision: (subject: Subject, decision: Exclude<Sc
 }>) => AppliedScopes;
 
 /** The union the `__voltro.approvals.decide` built-in advertises. */
-export declare const ApprovalDecisionErrors: Schema.Union<[typeof ApprovalNotFound, typeof ApprovalSelfApproval, typeof ApprovalExpired, typeof ApprovalNotPending, typeof ApprovalForbidden, typeof ApprovalUnavailable]>;
+export declare const ApprovalDecisionErrors: Schema.Union<readonly [typeof ApprovalNotFound, typeof ApprovalSelfApproval, typeof ApprovalExpired, typeof ApprovalNotPending, typeof ApprovalForbidden, typeof ApprovalUnavailable]>;
 
 /**
  * The union every approval-requiring descriptor advertises on the wire.
@@ -250,31 +254,27 @@ export declare const ApprovalDecisionErrors: Schema.Union<[typeof ApprovalNotFou
  * before the executor MUST be in the error union or it crosses as an untyped
  * defect and the client cannot branch on it.
  */
-export declare const ApprovalErrors: Schema.Union<[typeof ApprovalRequired, typeof ApprovalRejected, typeof ApprovalExpired, typeof ApprovalUnavailable]>;
+export declare const ApprovalErrors: Schema.Union<readonly [typeof ApprovalRequired, typeof ApprovalRejected, typeof ApprovalExpired, typeof ApprovalUnavailable]>;
 
 /** Past `expiresAt`. Fails closed: neither approvable nor executable. */
 export declare class ApprovalExpired extends ApprovalExpired_base {
 }
 
-declare const ApprovalExpired_base: Schema.TaggedErrorClass<ApprovalExpired, "ApprovalExpired", {
-    readonly _tag: Schema.tag<"ApprovalExpired">;
-} & {
-    approvalId: typeof Schema.String;
-    expiredAt: typeof Schema.String;
-}>;
+declare const ApprovalExpired_base: Schema.Class<ApprovalExpired, Schema.TaggedStruct<"ApprovalExpired", {
+    readonly approvalId: Schema.String;
+    readonly expiredAt: Schema.String;
+}>, YieldableError>;
 
 /** The would-be approver does not satisfy the intent's own `approvers` guards. */
 export declare class ApprovalForbidden extends ApprovalForbidden_base {
 }
 
-declare const ApprovalForbidden_base: Schema.TaggedErrorClass<ApprovalForbidden, "ApprovalForbidden", {
-    readonly _tag: Schema.tag<"ApprovalForbidden">;
-} & {
-    approvalId: typeof Schema.String;
+declare const ApprovalForbidden_base: Schema.Class<ApprovalForbidden, Schema.TaggedStruct<"ApprovalForbidden", {
+    readonly approvalId: Schema.String;
     /** The scope whose absence denied them, when the denial was scope-shaped. */
-    required: Schema.NullOr<typeof Schema.String>;
-    message: typeof Schema.String;
-}>;
+    readonly required: Schema.NullOr<Schema.String>;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /** The identity of an approval intent, as a wire string. */
 export declare type ApprovalId = string;
@@ -283,22 +283,18 @@ export declare type ApprovalId = string;
 export declare class ApprovalNotFound extends ApprovalNotFound_base {
 }
 
-declare const ApprovalNotFound_base: Schema.TaggedErrorClass<ApprovalNotFound, "ApprovalNotFound", {
-    readonly _tag: Schema.tag<"ApprovalNotFound">;
-} & {
-    approvalId: typeof Schema.String;
-}>;
+declare const ApprovalNotFound_base: Schema.Class<ApprovalNotFound, Schema.TaggedStruct<"ApprovalNotFound", {
+    readonly approvalId: Schema.String;
+}>, YieldableError>;
 
 /** Already decided (or already consumed) — a decision is made once. */
 export declare class ApprovalNotPending extends ApprovalNotPending_base {
 }
 
-declare const ApprovalNotPending_base: Schema.TaggedErrorClass<ApprovalNotPending, "ApprovalNotPending", {
-    readonly _tag: Schema.tag<"ApprovalNotPending">;
-} & {
-    approvalId: typeof Schema.String;
-    status: typeof Schema.String;
-}>;
+declare const ApprovalNotPending_base: Schema.Class<ApprovalNotPending, Schema.TaggedStruct<"ApprovalNotPending", {
+    readonly approvalId: Schema.String;
+    readonly status: Schema.String;
+}>, YieldableError>;
 
 /**
  * Declare that a mutation/action needs a SECOND human before it takes effect.
@@ -358,13 +354,11 @@ export declare interface ApprovalPolicy<Input = unknown> {
 export declare class ApprovalRejected extends ApprovalRejected_base {
 }
 
-declare const ApprovalRejected_base: Schema.TaggedErrorClass<ApprovalRejected, "ApprovalRejected", {
-    readonly _tag: Schema.tag<"ApprovalRejected">;
-} & {
-    approvalId: typeof Schema.String;
-    decidedBy: Schema.NullOr<typeof Schema.String>;
-    note: Schema.NullOr<typeof Schema.String>;
-}>;
+declare const ApprovalRejected_base: Schema.Class<ApprovalRejected, Schema.TaggedStruct<"ApprovalRejected", {
+    readonly approvalId: Schema.String;
+    readonly decidedBy: Schema.NullOr<Schema.String>;
+    readonly note: Schema.NullOr<Schema.String>;
+}>, YieldableError>;
 
 /**
  * The call was RECORDED as a pending approval and did NOT run.
@@ -377,22 +371,20 @@ declare const ApprovalRejected_base: Schema.TaggedErrorClass<ApprovalRejected, "
 export declare class ApprovalRequired extends ApprovalRequired_base {
 }
 
-declare const ApprovalRequired_base: Schema.TaggedErrorClass<ApprovalRequired, "ApprovalRequired", {
-    readonly _tag: Schema.tag<"ApprovalRequired">;
-} & {
-    approvalId: typeof Schema.String;
-    procedure: typeof Schema.String;
+declare const ApprovalRequired_base: Schema.Class<ApprovalRequired, Schema.TaggedStruct<"ApprovalRequired", {
+    readonly approvalId: Schema.String;
+    readonly procedure: Schema.String;
     /** ISO instant past which this intent can no longer be approved. */
-    expiresAt: typeof Schema.String;
+    readonly expiresAt: Schema.String;
     /** The scope(s) an approver must hold — so the UI can say who to ask. */
-    requiredScopes: Schema.Array$<typeof Schema.String>;
+    readonly requiredScopes: Schema.$Array<Schema.String>;
     /** The declared `reason`, when the descriptor gave one. */
-    reason: Schema.NullOr<typeof Schema.String>;
+    readonly reason: Schema.NullOr<Schema.String>;
     /** True when THIS call created the intent; false when it found the one an
      *  earlier identical call had already recorded. Lets a client tell "I just
      *  asked" from "still waiting". */
-    created: typeof Schema.Boolean;
-}>;
+    readonly created: Schema.Boolean;
+}>, YieldableError>;
 
 export declare const APPROVALS_DECIDE_TAG: "__voltro.approvals.decide";
 
@@ -415,13 +407,13 @@ export declare const APPROVALS_PENDING_TAG: "__voltro.approvals.pending";
  * plus the unconditional self-approval refusal.
  */
 export declare const approvalsDecideDescriptor: MutationProcedureDescriptor<"__voltro.approvals.decide", Schema.Struct<{
-    approvalId: typeof Schema.String;
-    decision: Schema.Literal<["approve", "reject"]>;
-    note: Schema.optional<typeof Schema.String>;
+    readonly approvalId: Schema.String;
+    readonly decision: Schema.Literals<readonly ["approve", "reject"]>;
+    readonly note: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    approvalId: typeof Schema.String;
-    status: Schema.Literal<["approved", "rejected"]>;
-}>, Schema.Union<[typeof ApprovalNotFound, typeof ApprovalSelfApproval, typeof ApprovalExpired, typeof ApprovalNotPending, typeof ApprovalForbidden, typeof ApprovalUnavailable]>>;
+    readonly approvalId: Schema.String;
+    readonly status: Schema.Literals<readonly ["approved", "rejected"]>;
+}>, Schema.Union<readonly [typeof ApprovalNotFound, typeof ApprovalSelfApproval, typeof ApprovalExpired, typeof ApprovalNotPending, typeof ApprovalForbidden, typeof ApprovalUnavailable]>>;
 
 /**
  * The approver IS the requester.
@@ -434,12 +426,10 @@ export declare const approvalsDecideDescriptor: MutationProcedureDescriptor<"__v
 export declare class ApprovalSelfApproval extends ApprovalSelfApproval_base {
 }
 
-declare const ApprovalSelfApproval_base: Schema.TaggedErrorClass<ApprovalSelfApproval, "ApprovalSelfApproval", {
-    readonly _tag: Schema.tag<"ApprovalSelfApproval">;
-} & {
-    approvalId: typeof Schema.String;
-    subjectId: Schema.NullOr<typeof Schema.String>;
-}>;
+declare const ApprovalSelfApproval_base: Schema.Class<ApprovalSelfApproval, Schema.TaggedStruct<"ApprovalSelfApproval", {
+    readonly approvalId: Schema.String;
+    readonly subjectId: Schema.NullOr<Schema.String>;
+}>, YieldableError>;
 
 /**
  * `__voltro.approvals.pending` — the calling subject's approval work.
@@ -457,22 +447,22 @@ declare const ApprovalSelfApproval_base: Schema.TaggedErrorClass<ApprovalSelfApp
  * caller sees an empty list.
  */
 export declare const approvalsPendingQueryDescriptor: QueryProcedureDescriptor<"__voltro.approvals.pending", Schema.Struct<{
-    limit: Schema.optional<typeof Schema.Number>;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    procedure: typeof Schema.String;
-    kind: Schema.Literal<["mutation", "action"]>;
-    requestedBy: Schema.NullOr<typeof Schema.String>;
-    status: Schema.Literal<["pending", "approved", "rejected", "expired", "consumed"]>;
-    reason: Schema.NullOr<typeof Schema.String>;
-    requiredScopes: Schema.Array$<typeof Schema.String>;
-    requestedAt: typeof Schema.String;
-    expiresAt: typeof Schema.String;
-    decidedBy: Schema.NullOr<typeof Schema.String>;
-    decidedAt: Schema.NullOr<typeof Schema.String>;
-    note: Schema.NullOr<typeof Schema.String>;
-    relation: Schema.Literal<["to-decide", "requested"]>;
-}>>, typeof Schema.Never>;
+    readonly limit: Schema.optional<Schema.Number>;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly procedure: Schema.String;
+    readonly kind: Schema.Literals<readonly ["mutation", "action"]>;
+    readonly requestedBy: Schema.NullOr<Schema.String>;
+    readonly status: Schema.Literals<readonly ["pending", "approved", "rejected", "expired", "consumed"]>;
+    readonly reason: Schema.NullOr<Schema.String>;
+    readonly requiredScopes: Schema.$Array<Schema.String>;
+    readonly requestedAt: Schema.String;
+    readonly expiresAt: Schema.String;
+    readonly decidedBy: Schema.NullOr<Schema.String>;
+    readonly decidedAt: Schema.NullOr<Schema.String>;
+    readonly note: Schema.NullOr<Schema.String>;
+    readonly relation: Schema.Literals<readonly ["to-decide", "requested"]>;
+}>>, Schema.Never>;
 
 /** The lifecycle states a `_voltro_approvals` row moves through. */
 export declare type ApprovalStatus = 'pending' | 'approved' | 'rejected' | 'expired' | 'consumed';
@@ -489,12 +479,10 @@ export declare type ApprovalStatus = 'pending' | 'approved' | 'rejected' | 'expi
 export declare class ApprovalUnavailable extends ApprovalUnavailable_base {
 }
 
-declare const ApprovalUnavailable_base: Schema.TaggedErrorClass<ApprovalUnavailable, "ApprovalUnavailable", {
-    readonly _tag: Schema.tag<"ApprovalUnavailable">;
-} & {
-    procedure: typeof Schema.String;
-    message: typeof Schema.String;
-}>;
+declare const ApprovalUnavailable_base: Schema.Class<ApprovalUnavailable, Schema.TaggedStruct<"ApprovalUnavailable", {
+    readonly procedure: Schema.String;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /**
  * Throws `Unauthenticated` when the resolved Subject is anonymous (no
@@ -558,7 +546,7 @@ export declare interface AuthenticatedGuardSpec {
  * an auth resolver before reaching its handler. The application provides
  * the resolver via `Layer.succeed(AuthMiddleware, AuthMiddleware.of(fn))`,
  * where `fn` receives `{headers, payload, rpc, clientId}` and returns an
- * `Effect<Subject, Unauthenticated>` — typically by inspecting headers / Bearer token and
+ * `Effect<Subject, Unauthenticated | RequestedTenantRefused>` — typically by inspecting headers / Bearer token and
  * looking the caller up.
  *
  * `provides: SubjectService` means the resolver's return value is placed
@@ -574,10 +562,7 @@ export declare interface AuthenticatedGuardSpec {
 export declare class AuthMiddleware extends AuthMiddleware_base {
 }
 
-declare const AuthMiddleware_base: RpcMiddleware.TagClass<AuthMiddleware, "@voltro/AuthMiddleware", {
-    readonly provides: typeof SubjectService;
-    readonly failure: typeof Unauthenticated;
-}>;
+declare const AuthMiddleware_base: RpcMiddleware.ServiceClass<AuthMiddleware, "@voltro/AuthMiddleware", SubjectService, Schema.Union<readonly [typeof Unauthenticated, typeof RequestedTenantRefused]>, never, never, false>;
 
 export declare type AuthRouteHandler = (req: AuthRouteRequest) => Promise<AuthRouteResponse>;
 
@@ -741,6 +726,26 @@ export declare type AuthSubjectGuardVerdict = {
  */
 export declare const beginIdempotent: (store: IdempotencyStore, scope: string, key: string, ttlMs: number, now: number, inFlightLeaseMs?: number) => Promise<IdempotencyOutcome>;
 
+/** Bind a process-local authority refresh to an independent subject snapshot.
+ * Neither the resolver nor its credentials become serializable subject fields.
+ * Request and durable-execution hosts use the same identity-preserving refresh. */
+export declare const bindSubjectAuthority: (subject: Subject, resolve: () => Promise<Subject>) => Subject;
+
+/** Bounded insertion-order storage. Appending overwrites one slot when full;
+ * reads never expose its circular physical order or retained array. */
+export declare class BoundedRing<T> implements Iterable<T> {
+    private readonly slots;
+    private head;
+    private size;
+    private readonly capacity;
+    constructor(capacity: number);
+    get length(): number;
+    get(index: number): T | undefined;
+    push(value: T): void;
+    clear(): void;
+    [Symbol.iterator](): IterableIterator<T>;
+}
+
 /**
  * A cross-table business rule was violated inside a mutation's transaction; the
  * write was rolled back.
@@ -754,15 +759,13 @@ export declare const beginIdempotent: (store: IdempotencyStore, scope: string, k
 export declare class BusinessRuleViolation extends BusinessRuleViolation_base {
 }
 
-declare const BusinessRuleViolation_base: Schema.TaggedErrorClass<BusinessRuleViolation, "BusinessRuleViolation", {
-    readonly _tag: Schema.tag<"BusinessRuleViolation">;
-} & {
-    rule: typeof Schema.String;
-    params: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    field: Schema.optional<typeof Schema.String>;
-    message: Schema.optional<typeof Schema.String>;
-    severity: Schema.Literal<["error", "warning"]>;
-}>;
+declare const BusinessRuleViolation_base: Schema.Class<BusinessRuleViolation, Schema.TaggedStruct<"BusinessRuleViolation", {
+    readonly rule: Schema.String;
+    readonly params: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly field: Schema.optional<Schema.String>;
+    readonly message: Schema.optional<Schema.String>;
+    readonly severity: Schema.Literals<readonly ["error", "warning"]>;
+}>, YieldableError>;
 
 /** The result of a cached resolution. `fresh` distinguishes a resolution that
  *  actually ran from a replayed verdict — the audit hook fires on the former
@@ -811,7 +814,10 @@ export declare const checkGuards: (subject: Subject, guards: ReadonlyArray<AnyCh
  * guard has a `resource`, it extracts the resource id from `input` and asks the
  * resolver whether the caller holds each scope on THAT resource. A globally-held
  * scope (or the `admin:full` bypass) still satisfies without a resolver call;
- * only the gap ("no global grant") falls through to the resolver. A failed
+ * only the gap ("no global grant") falls through to the resolver. A guard with
+ * `resourceOnly: true` always requires the resource resolver's verdict, even
+ * for globally-held scopes or `admin:full`, and refuses if its resource or
+ * resolver is unavailable. A failed
  * resolver Effect is treated as a denial (fail-closed).
  *
  * Returns a typed `ScopeError` naming the first unmet scope, or `null` when
@@ -839,11 +845,11 @@ export declare interface ClientDescriptor {
      *  UI (forms, query-bound pickers) and the capability map can introspect
      *  it with no extra fetch. Browser-safe: the schema is already loaded
      *  value-level via the rpc group, so this is the same object by reference. */
-    readonly input?: Schema.Schema.Any | undefined;
+    readonly input?: Schema.Top | undefined;
     /** The procedure's output `Schema` — carried so schema-driven tables
      *  (`<DataTable>` derives its columns from it) + the capability map can
      *  introspect it. Same browser-safety rationale as `input`. */
-    readonly output?: Schema.Schema.Any | undefined;
+    readonly output?: Schema.Top | undefined;
 }
 
 /**
@@ -895,15 +901,15 @@ export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrat
     /** What an unauthenticated caller is — see {@link AnonymousPolicy}.
      *  Default `'no-tenant'`. Ignored when `fallback` is supplied. */
     readonly anonymous?: AnonymousPolicyOrDevTenant;
-    /**
-     * The subject's memberships — the ONE source, strategy-independent. Read
-     * only when a stored tenant selection exists for the subject and names a
-     * tenant other than the credential's, and then on every such request: a
-     * membership revoked a moment ago must not keep a selection alive, and a
-     * switch made a moment ago must be visible on the next call, so there is
-     * no staleness window to configure here. Requires `tenantSelection`.
-     */
+    /** Fresh strategy-independent memberships. Explicit requested tenants are
+     * checked on every resolution, including the credential tenant. Stored
+     * selections read memberships only when they differ from the credential.
+     * Requires `tenantSelection` or `requestedTenant`. */
     readonly memberships?: MembershipsSource;
+    /** Request-local tenant hint, checked against fresh `memberships` before
+     * scopes and guards. Explicit targets bypass the stored selection without
+     * changing it. Invalid hints fail closed, never fall back. */
+    readonly requestedTenant?: RequestedTenantSource;
     /**
      * Where a subject's tenant selection is stored. Read for every matched
      * user / apiKey / serviceAccount subject (one point lookup); a stored
@@ -1044,33 +1050,32 @@ export declare interface ConnectionCredential {
  *  for this connection. Deletes the row; the provider-side grant (if any) is
  *  the provider's to revoke. */
 export declare const connectionDisconnectDescriptor: MutationProcedureDescriptor<"__voltro.connections.disconnect", Schema.Struct<{
-    connectionId: typeof Schema.String;
+    readonly connectionId: Schema.String;
 }>, Schema.Struct<{
-    ok: typeof Schema.Boolean;
-}>, Schema.Union<[typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
+    readonly ok: Schema.Boolean;
+}>, Schema.Union<readonly [typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
 
 /** The provider rejected the token / the handshake failed. `transient`
  *  distinguishes "try again" from "the user must re-consent". */
 export declare class ConnectionHandshakeFailed extends ConnectionHandshakeFailed_base {
+    get message(): string;
 }
 
-declare const ConnectionHandshakeFailed_base: Schema.TaggedErrorClass<ConnectionHandshakeFailed, "ConnectionHandshakeFailed", {
-    readonly _tag: Schema.tag<"ConnectionHandshakeFailed">;
-} & {
-    connectionId: typeof Schema.String;
-    reason: typeof Schema.String;
-    transient: typeof Schema.Boolean;
-}>;
+declare const ConnectionHandshakeFailed_base: Schema.Class<ConnectionHandshakeFailed, Schema.TaggedStruct<"ConnectionHandshakeFailed", {
+    readonly connectionId: Schema.String;
+    readonly reason: Schema.String;
+    readonly transient: Schema.Boolean;
+}>, YieldableError>;
 
 export declare class ConnectionInfo extends ConnectionInfo_base {
 }
 
-declare const ConnectionInfo_base: Context.TagClass<ConnectionInfo, "@voltro/ConnectionInfo", ConnectionInfoValue>;
+declare const ConnectionInfo_base: Context.ServiceClass<ConnectionInfo, "@voltro/ConnectionInfo", ConnectionInfoValue>;
 
 /**
  * Second middleware on every RpcGroup that wants the
  * `ConnectionInfo` service available to handlers. Resolves from the
- * per-call `{clientId}` the @effect/rpc transport passes in. Handlers
+ * per-call `{clientId}` the `effect/rpc` transport passes in. Handlers
  * that re-bind the connection's subject (e.g. `auth.signin` writing
  * an override after a successful credential check) read clientId
  * from this service.
@@ -1082,9 +1087,7 @@ declare const ConnectionInfo_base: Context.TagClass<ConnectionInfo, "@voltro/Con
 export declare class ConnectionInfoMiddleware extends ConnectionInfoMiddleware_base {
 }
 
-declare const ConnectionInfoMiddleware_base: RpcMiddleware.TagClass<ConnectionInfoMiddleware, "@voltro/ConnectionInfoMiddleware", {
-    readonly provides: typeof ConnectionInfo;
-}>;
+declare const ConnectionInfoMiddleware_base: RpcMiddleware.ServiceClass<ConnectionInfoMiddleware, "@voltro/ConnectionInfoMiddleware", ConnectionInfo, Schema.Never, never, never, false>;
 
 export declare interface ConnectionInfoValue {
     /** Per-connection identifier assigned by the rpc transport. Stable for the
@@ -1135,7 +1138,7 @@ export declare interface ConnectionInfoValue {
 /** The two credential shapes a connection can hold. `oauth2` = an
  *  authorization-code grant the framework refreshes; `pat` = a long-lived
  *  personal token the user pastes and the framework only stores. */
-export declare const ConnectionKind: Schema.Literal<["oauth2", "pat"]>;
+export declare const ConnectionKind: Schema.Literals<readonly ["oauth2", "pat"]>;
 
 export declare type ConnectionKind = Schema.Schema.Type<typeof ConnectionKind>;
 
@@ -1145,23 +1148,19 @@ export declare type ConnectionKind = Schema.Schema.Type<typeof ConnectionKind>;
 export declare class ConnectionKindMismatch extends ConnectionKindMismatch_base {
 }
 
-declare const ConnectionKindMismatch_base: Schema.TaggedErrorClass<ConnectionKindMismatch, "ConnectionKindMismatch", {
-    readonly _tag: Schema.tag<"ConnectionKindMismatch">;
-} & {
-    connectionId: typeof Schema.String;
-    expected: Schema.Literal<["oauth2", "pat"]>;
-    actual: Schema.Literal<["oauth2", "pat"]>;
-}>;
+declare const ConnectionKindMismatch_base: Schema.Class<ConnectionKindMismatch, Schema.TaggedStruct<"ConnectionKindMismatch", {
+    readonly connectionId: Schema.String;
+    readonly expected: Schema.Literals<readonly ["oauth2", "pat"]>;
+    readonly actual: Schema.Literals<readonly ["oauth2", "pat"]>;
+}>, YieldableError>;
 
 /** No connection with that id is declared in the app (no `*.connection.ts`). */
 export declare class ConnectionNotDeclared extends ConnectionNotDeclared_base {
 }
 
-declare const ConnectionNotDeclared_base: Schema.TaggedErrorClass<ConnectionNotDeclared, "ConnectionNotDeclared", {
-    readonly _tag: Schema.tag<"ConnectionNotDeclared">;
-} & {
-    connectionId: typeof Schema.String;
-}>;
+declare const ConnectionNotDeclared_base: Schema.Class<ConnectionNotDeclared, Schema.TaggedStruct<"ConnectionNotDeclared", {
+    readonly connectionId: Schema.String;
+}>, YieldableError>;
 
 export declare const CONNECTIONS_LIST_TAG: "__voltro.connections.list";
 
@@ -1174,26 +1173,26 @@ export declare const CONNECTIONS_LIST_TAG: "__voltro.connections.list";
  * comes back `status: 'disconnected'`. A UI can therefore render the whole
  * "connected accounts" settings page from this one subscription.
  */
-export declare const connectionsListQueryDescriptor: QueryProcedureDescriptor<"__voltro.connections.list", Schema.Struct<{}>, Schema.Array$<Schema.Struct<{
+export declare const connectionsListQueryDescriptor: QueryProcedureDescriptor<"__voltro.connections.list", Schema.Struct<{}>, Schema.$Array<Schema.Struct<{
     /** The `defineConnection({ id })` value. */
-    connectionId: typeof Schema.String;
-    kind: Schema.Literal<["oauth2", "pat"]>;
+    readonly connectionId: Schema.String;
+    readonly kind: Schema.Literals<readonly ["oauth2", "pat"]>;
     /** Human label from the declaration; falls back to the id. */
-    label: typeof Schema.String;
-    status: Schema.Literal<["disconnected", "connected", "expired", "revoked", "error"]>;
+    readonly label: Schema.String;
+    readonly status: Schema.Literals<readonly ["disconnected", "connected", "expired", "revoked", "error"]>;
     /** Provider-side account identifier, when the declaration could resolve one. */
-    accountId: Schema.NullOr<typeof Schema.String>;
+    readonly accountId: Schema.NullOr<Schema.String>;
     /** Display name for the connected account ("mario@example.com"). */
-    accountLabel: Schema.NullOr<typeof Schema.String>;
+    readonly accountLabel: Schema.NullOr<Schema.String>;
     /** Granted scopes (oauth2); empty for pat. */
-    scopes: Schema.Array$<typeof Schema.String>;
+    readonly scopes: Schema.$Array<Schema.String>;
     /** Access-token deadline as an ISO string, or null (pat / no expiry). */
-    expiresAt: Schema.NullOr<typeof Schema.String>;
+    readonly expiresAt: Schema.NullOr<Schema.String>;
     /** Last refresh failure message, when `status` is `error` / `revoked`. */
-    lastError: Schema.NullOr<typeof Schema.String>;
+    readonly lastError: Schema.NullOr<Schema.String>;
     /** When the credential was first stored, ISO. Null while disconnected. */
-    connectedAt: Schema.NullOr<typeof Schema.String>;
-}>>, typeof Schema.Never>;
+    readonly connectedAt: Schema.NullOr<Schema.String>;
+}>>, Schema.Never>;
 
 /**
  * `__voltro.connections.start` — begin an oauth2 handshake. Returns the
@@ -1202,36 +1201,36 @@ export declare const connectionsListQueryDescriptor: QueryProcedureDescriptor<"_
  * and talks to no domain table, so it must not be optimistic-patched.
  */
 export declare const connectionStartDescriptor: ActionProcedureDescriptor<"__voltro.connections.start", Schema.Struct<{
-    connectionId: typeof Schema.String;
+    readonly connectionId: Schema.String;
     /** Where the callback should send the browser once the handshake lands.
      *  Same-origin PATH only (validated server-side) — an absolute URL would
      *  make the callback an open redirector. */
-    redirectTo: Schema.optional<typeof Schema.String>;
+    readonly redirectTo: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    authorizeUrl: typeof Schema.String;
-    state: typeof Schema.String;
-}>, Schema.Union<[typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
+    readonly authorizeUrl: Schema.String;
+    readonly state: Schema.String;
+}>, Schema.Union<readonly [typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
 
 /** One declared connection, projected for the calling subject. */
 export declare const ConnectionState: Schema.Struct<{
     /** The `defineConnection({ id })` value. */
-    connectionId: typeof Schema.String;
-    kind: Schema.Literal<["oauth2", "pat"]>;
+    readonly connectionId: Schema.String;
+    readonly kind: Schema.Literals<readonly ["oauth2", "pat"]>;
     /** Human label from the declaration; falls back to the id. */
-    label: typeof Schema.String;
-    status: Schema.Literal<["disconnected", "connected", "expired", "revoked", "error"]>;
+    readonly label: Schema.String;
+    readonly status: Schema.Literals<readonly ["disconnected", "connected", "expired", "revoked", "error"]>;
     /** Provider-side account identifier, when the declaration could resolve one. */
-    accountId: Schema.NullOr<typeof Schema.String>;
+    readonly accountId: Schema.NullOr<Schema.String>;
     /** Display name for the connected account ("mario@example.com"). */
-    accountLabel: Schema.NullOr<typeof Schema.String>;
+    readonly accountLabel: Schema.NullOr<Schema.String>;
     /** Granted scopes (oauth2); empty for pat. */
-    scopes: Schema.Array$<typeof Schema.String>;
+    readonly scopes: Schema.$Array<Schema.String>;
     /** Access-token deadline as an ISO string, or null (pat / no expiry). */
-    expiresAt: Schema.NullOr<typeof Schema.String>;
+    readonly expiresAt: Schema.NullOr<Schema.String>;
     /** Last refresh failure message, when `status` is `error` / `revoked`. */
-    lastError: Schema.NullOr<typeof Schema.String>;
+    readonly lastError: Schema.NullOr<Schema.String>;
     /** When the credential was first stored, ISO. Null while disconnected. */
-    connectedAt: Schema.NullOr<typeof Schema.String>;
+    readonly connectedAt: Schema.NullOr<Schema.String>;
 }>;
 
 export declare type ConnectionState = Schema.Schema.Type<typeof ConnectionState>;
@@ -1251,7 +1250,7 @@ export declare type ConnectionState = Schema.Schema.Type<typeof ConnectionState>
  *   - `error`        — the last refresh failed transiently (5xx / network).
  *     The tokens are retained and the next use retries.
  */
-export declare const ConnectionStatus: Schema.Literal<["disconnected", "connected", "expired", "revoked", "error"]>;
+export declare const ConnectionStatus: Schema.Literals<readonly ["disconnected", "connected", "expired", "revoked", "error"]>;
 
 export declare type ConnectionStatus = Schema.Schema.Type<typeof ConnectionStatus>;
 
@@ -1260,22 +1259,20 @@ export declare type ConnectionStatus = Schema.Schema.Type<typeof ConnectionStatu
 export declare class ConnectionSubjectRequired extends ConnectionSubjectRequired_base {
 }
 
-declare const ConnectionSubjectRequired_base: Schema.TaggedErrorClass<ConnectionSubjectRequired, "ConnectionSubjectRequired", {
-    readonly _tag: Schema.tag<"ConnectionSubjectRequired">;
-} & {
-    connectionId: typeof Schema.String;
-}>;
+declare const ConnectionSubjectRequired_base: Schema.Class<ConnectionSubjectRequired, Schema.TaggedStruct<"ConnectionSubjectRequired", {
+    readonly connectionId: Schema.String;
+}>, YieldableError>;
 
 /**
  * `__voltro.connections.submitToken` — store a pasted personal access token.
  * A mutation (it writes the credential row) targeting no user table.
  */
 export declare const connectionSubmitTokenDescriptor: MutationProcedureDescriptor<"__voltro.connections.submitToken", Schema.Struct<{
-    connectionId: typeof Schema.String;
-    token: typeof Schema.String;
+    readonly connectionId: Schema.String;
+    readonly token: Schema.String;
 }>, Schema.Struct<{
-    ok: typeof Schema.Boolean;
-}>, Schema.Union<[typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
+    readonly ok: Schema.Boolean;
+}>, Schema.Union<readonly [typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
 
 /**
  * The database refused a write because it broke an integrity rule the SCHEMA
@@ -1315,24 +1312,22 @@ export declare class ConstraintViolation extends ConstraintViolation_base {
     get message(): string;
 }
 
-declare const ConstraintViolation_base: Schema.TaggedErrorClass<ConstraintViolation, "ConstraintViolation", {
-    readonly _tag: Schema.tag<"ConstraintViolation">;
-} & {
+declare const ConstraintViolation_base: Schema.Class<ConstraintViolation, Schema.TaggedStruct<"ConstraintViolation", {
     /**
      * Which rule fired. `foreignKey` = the row you referenced does not exist;
      * `foreignKeyInUse` = this row may not go, others still reference it. They
      * are opposite situations with opposite fixes, so a UI branches on them
      * separately.
      */
-    kind: Schema.Literal<["foreignKey", "foreignKeyInUse", "unique", "notNull", "check"]>;
+    readonly kind: Schema.Literals<readonly ["foreignKey", "foreignKeyInUse", "unique", "notNull", "check"]>;
     /** The table the write targeted — the framework's own name for it, not the driver's. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** Which store op was attempted: 'insert' | 'update' | 'delete' | …. */
-    operation: typeof Schema.String;
+    readonly operation: Schema.String;
     /** The constraint / index name, when the dialect names one. */
-    constraint: Schema.optional<typeof Schema.String>;
+    readonly constraint: Schema.optional<Schema.String>;
     /** The column, when the dialect names one instead of (or beside) a constraint. */
-    column: Schema.optional<typeof Schema.String>;
+    readonly column: Schema.optional<Schema.String>;
     /**
      * A fuller sentence, when the FRAMEWORK raised this rather than the driver.
      *
@@ -1347,8 +1342,8 @@ declare const ConstraintViolation_base: Schema.TaggedErrorClass<ConstraintViolat
      * a row value. Absent for everything `classifyConstraintViolation` reads off
      * an error the database reported.
      */
-    detail: Schema.optional<typeof Schema.String>;
-}>;
+    readonly detail: Schema.optional<Schema.String>;
+}>, YieldableError>;
 
 /**
  * A handle to a cluster-coordinated periodic task the plugin armed via
@@ -1418,6 +1413,17 @@ export declare interface CoordinatedTickOutcome {
     readonly nextDueInMs?: number | null;
 }
 
+/** Index reuse for one subscription's immutable snapshots and returned rows.
+ * Arbitrary mutable input must use applyRowPatch. A different base rebuilds
+ * the index; reset releases it on snapshot replacement or owner disposal. */
+export declare const createRowPatchApplier: () => {
+    readonly apply: typeof applyRowPatch;
+    readonly reset: () => void;
+};
+
+/** The latest authenticated authority for a request or live subscription. */
+export declare const currentSubjectAuthority: (subject: Subject) => Subject;
+
 /**
  * What a descriptor CARRIES: the author's guards, or the erased form of their
  * `openAccess:` decision — never both.
@@ -1462,7 +1468,7 @@ export declare const DEFAULT_SCOPE_CACHE_MAX_ENTRIES = 10000;
  *  purpose: the two per-request store reads then expire together. */
 export declare const DEFAULT_SCOPE_CACHE_TTL_MS = 30000;
 
-export declare const defineAction: <const Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All = typeof Schema.Never>(options: {
+export declare const defineAction: <const Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top = typeof Schema.Never>(options: {
     readonly name: Name;
     readonly input: Input;
     readonly output: Output;
@@ -1571,7 +1577,7 @@ export declare const defineAction: <const Name extends string, Input extends Sch
  * })
  * ```
  */
-export declare const defineEvent: <const Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(options: {
+export declare const defineEvent: <const Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(options: {
     /**
      * Wire identifier, `camelCase.dotted` like an rpc tag — and it shares the rpc
      * tag COLLISION SPACE, so a duplicate aborts boot rather than resolving itself
@@ -1668,7 +1674,7 @@ export declare const defineEvent: <const Name extends string, Key extends Schema
     readonly delivery?: EventDeliverySemantics;
 }) => EventDescriptor<Name, Key, Payload>;
 
-export declare const defineMutation: <const Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All = typeof Schema.Never>(options: {
+export declare const defineMutation: <const Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top = typeof Schema.Never>(options: {
     readonly name: Name;
     readonly input: Input;
     readonly output: Output;
@@ -1831,11 +1837,11 @@ export declare const definePluginRoute: (route: PluginRpcRoute) => PluginRpcRout
  * needs resource acquisition (Layer.scoped).
  */
 export declare const definePluginService: <I, S>(identifier: string, implementation: S) => {
-    readonly Tag: Context.Tag<I, S>;
+    readonly Tag: Context.Service<I, S>;
     readonly Live: Layer.Layer<I, never, never>;
 };
 
-export declare const defineQuery: <const Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All = typeof Schema.Never>(options: {
+export declare const defineQuery: <const Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top = typeof Schema.Never>(options: {
     readonly name: Name;
     readonly input: Input;
     readonly output: Output;
@@ -1935,7 +1941,7 @@ export declare const defineQuery: <const Name extends string, Input extends Sche
  * returns a `Stream<Element>` (e.g. an agent run's `AgentEvent`s); the
  * client consumes it via `useAgentStream`. Reusable for ANY push stream.
  */
-export declare const defineStream: <const Name extends string, Input extends Schema.Schema.Any, Element extends Schema.Schema.Any, Error extends Schema.Schema.All = typeof Schema.Never>(options: {
+export declare const defineStream: <const Name extends string, Input extends Schema.Top, Element extends Schema.Top, Error extends Schema.Top = typeof Schema.Never>(options: {
     readonly name: Name;
     readonly input: Input;
     readonly element: Element;
@@ -1995,6 +2001,38 @@ export declare interface DeleteTarget<Input = unknown> extends NestedTargetField
     readonly identify?: ((input: Input) => string | ReadonlyArray<string>) | undefined;
 }
 
+/** The HMR custom event `voltro dev` publishes its activity on. */
+export declare const DEV_ACTIVITY_EVENT = "voltro:dev-activity";
+
+/** What `voltro dev` reports over {@link DEV_ACTIVITY_EVENT}. A `document`
+ *  message describes ONE document request (`id` is per server process); a
+ *  `compile` message says whether Vite is transforming browser modules. */
+export declare type DevActivityMessage = {
+    readonly type: 'document';
+    readonly id: number;
+    /** Path + search exactly as the browser asked for it. */
+    readonly url: string;
+    /** `start` once, when the request arrives; then whichever the server
+     *  is doing as it changes — `compiling` while Vite transforms modules
+     *  for it, `rendering` once a server render runs, `waiting` for
+     *  anything else (Vite's own html, a middleware). */
+    readonly phase: 'start' | 'waiting' | 'compiling' | 'rendering';
+} | {
+    readonly type: 'document';
+    readonly id: number;
+    readonly url: string;
+    readonly phase: 'end';
+    /** `document`: the browser got a page to show. `redirect`: it will ask
+     *  for `location` next. `no-document`: nothing will replace this page
+     *  (204/205, an attachment). `aborted`: the browser went away first. */
+    readonly outcome: 'document' | 'redirect' | 'no-document' | 'aborted';
+    readonly location?: string;
+} | {
+    readonly type: 'compile';
+    readonly consumer: 'client';
+    readonly active: boolean;
+};
+
 /** Pair, list and revoke devices (`devices: true`) for the caller's tenant.
  *  One scope, not three: a device always acts as itself, in the pairer's
  *  tenant, so there is no self / org / other distinction to draw.
@@ -2011,8 +2049,8 @@ export declare const diffRows: (prev: ReadonlyArray<PatchRow>, next: ReadonlyArr
  *   - For each id in next: not in prev → `add`; in prev but content
  *     differs → `replace`; in prev and equal → no op.
  *   - For each id in prev but not in next → `remove`.
- *   - `order` is next's id sequence verbatim, so apply can reconstruct
- *     the exact ordering (including a pure reorder, where `ops` is empty).
+ *   - `order` is null for an unchanged sequence, otherwise next's IDs,
+ *     so apply can reconstruct the exact ordering (including a pure reorder, where `ops` is empty).
  *
  * Throws if any row lacks an `id` — the caller (dispatcher) only diffs
  * id-keyed result sets; a result without ids must ship a full snapshot,
@@ -2064,6 +2102,13 @@ export declare const encodeRestError: (format: RestFormat, error: RestFormatErro
  */
 export declare const encodeRestSuccess: (format: RestFormat, value: unknown, ctx: RestFormatContext) => RestFormatResponse;
 
+export declare interface EnqueueOptions {
+    /** Deduplicate while an earlier intent is still pending, not permanently. */
+    readonly idempotencyKey?: string;
+    readonly maxAttempts?: number;
+    readonly delayMs?: number;
+}
+
 /**
  * The text to SHOW for a failure value — its `message`, else its `_tag`, else
  * `String(value)`.
@@ -2081,8 +2126,8 @@ export declare const errorMessage: (err: unknown) => string;
 /**
  * Read the `_tag` off a thrown error value, or `undefined` when it has none.
  *
- * It lives here, beside `toRpc`, because `toRpc` is what puts the tag on the
- * wire — one file owns both ends of that contract. It used to live in
+ * It lives in protocol because `toRpc` (procedure.ts) is what puts the tag on
+ * the wire — one package owns both ends of that contract. It used to live in
  * `@voltro/client`, and being there had a cost nobody could see from inside the
  * framework: an app's shared error handler lived in a package that pulled only
  * `@voltro/i18n`, so reading a tag meant taking a dependency on the whole client
@@ -2121,7 +2166,7 @@ export declare const EVENT_ROUTE_SEP = "\0";
 
 /** First element of every subscription: the stream is live from here on. */
 export declare const eventAttached: Schema.Struct<{
-    _tag: Schema.Literal<["attached"]>;
+    readonly _tag: Schema.Literal<"attached">;
 }>;
 
 /**
@@ -2154,7 +2199,7 @@ export declare type EventDeliverySemantics = 'each' | 'latest';
  * Type parameters are inferred from the Schemas, and every call site — `publish`,
  * `useEvent`, a workflow trigger — derives its types from this one value.
  */
-export declare interface EventDescriptor<Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any> {
+export declare interface EventDescriptor<Name extends string, Key extends Schema.Top, Payload extends Schema.Top, Guards = DeclaredAccess<GuardedKey<Key>>> {
     readonly kind: 'event';
     readonly name: Name;
     readonly key: Key;
@@ -2163,7 +2208,7 @@ export declare interface EventDescriptor<Name extends string, Key extends Schema
      *  `openAccess:` decision, never both (see `DeclaredAccess`). Re-checked when
      *  the subject changes, not per delivery — see `EventDefinition.guards` for
      *  why that distinction is deliberate. */
-    readonly guards: DeclaredAccess<Schema.Schema.Type<Key>> | undefined;
+    readonly guards: Guards | undefined;
     /** The declared `openAccess:` reason, when there is one — what the boot gate
      *  and `voltro doctor` read. The enforcement paths read `guards`. */
     readonly openAccess: string | undefined;
@@ -2191,60 +2236,54 @@ export declare interface EventDescriptor<Name extends string, Key extends Schema
  * every key — which is a real architecture (a single-threaded actor per room)
  * and not the one this framework has.
  */
-export declare const eventEnvelope: <P extends Schema.Schema.Any>(payload: P) => Schema.Struct<{
-    _tag: Schema.Literal<["event"]>;
+export declare const eventEnvelope: <P extends Schema.Top>(payload: P) => Schema.Struct<{
+    readonly _tag: Schema.Literal<"event">;
     /** Publishing instance id — serials are only comparable within one. */
-    origin: typeof Schema.String;
+    readonly origin: Schema.String;
     /** Monotonic per (origin, event, tenant, key). */
-    n: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    payload: P;
+    readonly n: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly payload: P;
 }>;
 
 /** Told to the subscriber when the SERVER knows it cannot fill a gap. */
 export declare const eventGap: Schema.Struct<{
-    _tag: Schema.Literal<["gap"]>;
+    readonly _tag: Schema.Literal<"gap">;
     /** How many deliveries are known lost. Never a guess: a shortfall is computed
      *  from the requested serial against what the ring still holds. */
-    missed: typeof Schema.Number;
+    readonly missed: Schema.Number;
     /** `buffer` — evicted before this subscriber could be served.
      *  `resume` — the re-attach asked for a serial older than the ring. */
-    reason: Schema.Literal<["buffer", "resume"]>;
+    readonly reason: Schema.Literals<readonly ["buffer", "resume"]>;
 }>;
 
 /** The routing key did not decode against the descriptor's schema. */
 export declare class EventKeyInvalid extends EventKeyInvalid_base {
 }
 
-declare const EventKeyInvalid_base: Schema.TaggedErrorClass<EventKeyInvalid, "EventKeyInvalid", {
-    readonly _tag: Schema.tag<"EventKeyInvalid">;
-} & {
-    event: typeof Schema.String;
-    message: typeof Schema.String;
-}>;
+declare const EventKeyInvalid_base: Schema.Class<EventKeyInvalid, Schema.TaggedStruct<"EventKeyInvalid", {
+    readonly event: Schema.String;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /** The payload did not decode against the descriptor's schema. */
 export declare class EventPayloadInvalid extends EventPayloadInvalid_base {
 }
 
-declare const EventPayloadInvalid_base: Schema.TaggedErrorClass<EventPayloadInvalid, "EventPayloadInvalid", {
-    readonly _tag: Schema.tag<"EventPayloadInvalid">;
-} & {
-    event: typeof Schema.String;
-    message: typeof Schema.String;
-}>;
+declare const EventPayloadInvalid_base: Schema.Class<EventPayloadInvalid, Schema.TaggedStruct<"EventPayloadInvalid", {
+    readonly event: Schema.String;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /** The encoded envelope exceeds `MAX_EVENT_ENVELOPE_BYTES`. */
 export declare class EventPayloadTooLarge extends EventPayloadTooLarge_base {
 }
 
-declare const EventPayloadTooLarge_base: Schema.TaggedErrorClass<EventPayloadTooLarge, "EventPayloadTooLarge", {
-    readonly _tag: Schema.tag<"EventPayloadTooLarge">;
-} & {
-    event: typeof Schema.String;
-    bytes: typeof Schema.Number;
-    limit: typeof Schema.Number;
-}>;
+declare const EventPayloadTooLarge_base: Schema.Class<EventPayloadTooLarge, Schema.TaggedStruct<"EventPayloadTooLarge", {
+    readonly event: Schema.String;
+    readonly bytes: Schema.Number;
+    readonly limit: Schema.Number;
+}>, YieldableError>;
 
 export declare type EventResumePoint = {
     readonly origin: string;
@@ -2253,8 +2292,8 @@ export declare type EventResumePoint = {
 
 /** Where a re-attaching subscriber left off, per origin. */
 export declare const eventResumePoint: Schema.Struct<{
-    origin: typeof Schema.String;
-    n: typeof Schema.Number;
+    readonly origin: Schema.String;
+    readonly n: Schema.Number;
 }>;
 
 export declare const eventRoute: (tenantId: string | null, event: string, key: unknown) => string;
@@ -2277,24 +2316,24 @@ export declare type EventStreamEvent<P> = {
  * What a subscription emits. `attached` first, then `event`s, with `gap`
  * interleaved whenever the server can prove a loss.
  */
-export declare const eventStreamEvent: <P extends Schema.Schema.Any>(payload: P) => Schema.Union<[Schema.Struct<{
-    _tag: Schema.Literal<["attached"]>;
+export declare const eventStreamEvent: <P extends Schema.Top>(payload: P) => Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"attached">;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["event"]>;
+    readonly _tag: Schema.Literal<"event">;
     /** Publishing instance id — serials are only comparable within one. */
-    origin: typeof Schema.String;
+    readonly origin: Schema.String;
     /** Monotonic per (origin, event, tenant, key). */
-    n: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    payload: P;
+    readonly n: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly payload: P;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["gap"]>;
+    readonly _tag: Schema.Literal<"gap">;
     /** How many deliveries are known lost. Never a guess: a shortfall is computed
      *  from the requested serial against what the ring still holds. */
-    missed: typeof Schema.Number;
+    readonly missed: Schema.Number;
     /** `buffer` — evicted before this subscriber could be served.
      *  `resume` — the re-attach asked for a serial older than the ring. */
-    reason: Schema.Literal<["buffer", "resume"]>;
+    readonly reason: Schema.Literals<readonly ["buffer", "resume"]>;
 }>]>;
 
 /**
@@ -2306,11 +2345,11 @@ export declare const eventStreamEvent: <P extends Schema.Schema.Any>(payload: P)
  * the client knows whether it has seen this stream before — the server cannot
  * tell a reconnect from a fresh mount.
  */
-export declare const eventSubscribeInput: <K extends Schema.Schema.Any>(key: K) => Schema.Struct<{
-    key: K;
-    resume: Schema.optional<Schema.Array$<Schema.Struct<{
-        origin: typeof Schema.String;
-        n: typeof Schema.Number;
+export declare const eventSubscribeInput: <K extends Schema.Top>(key: K) => Schema.Struct<{
+    readonly key: K;
+    readonly resume: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly origin: Schema.String;
+        readonly n: Schema.Number;
     }>>>;
 }>;
 
@@ -2323,31 +2362,31 @@ export declare const eventSubscribeInput: <K extends Schema.Schema.Any>(key: K)
  * with `useSubscription` instead of being a second realtime concept in the same
  * app.
  */
-export declare const eventToRpc: <Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(descriptor: EventDescriptor<Name, Key, Payload>, extraErrors?: ReadonlyArray<Schema.Schema.All>) => Rpc.Rpc<Name, Schema.Struct<{
-    key: Key;
-    resume: Schema.optional<Schema.Array$<Schema.Struct<{
-        origin: typeof Schema.String;
-        n: typeof Schema.Number;
+export declare const eventToRpc: <Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(descriptor: EventDescriptor<Name, Key, Payload, ReadonlyArray<unknown>>, extraErrors?: ReadonlyArray<Schema.Top>) => Rpc.Rpc<Name, Schema.Struct<{
+    readonly key: Key;
+    readonly resume: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly origin: Schema.String;
+        readonly n: Schema.Number;
     }>>>;
-}>, Stream<Schema.Union<[Schema.Struct<{
-    _tag: Schema.Literal<["attached"]>;
+}>, Stream<Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"attached">;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["event"]>;
+    readonly _tag: Schema.Literal<"event">;
     /** Publishing instance id — serials are only comparable within one. */
-    origin: typeof Schema.String;
+    readonly origin: Schema.String;
     /** Monotonic per (origin, event, tenant, key). */
-    n: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    payload: Payload;
+    readonly n: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly payload: Payload;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["gap"]>;
+    readonly _tag: Schema.Literal<"gap">;
     /** How many deliveries are known lost. Never a guess: a shortfall is computed
      *  from the requested serial against what the ring still holds. */
-    missed: typeof Schema.Number;
+    readonly missed: Schema.Number;
     /** `buffer` — evicted before this subscriber could be served.
      *  `resume` — the re-attach asked for a serial older than the ring. */
-    reason: Schema.Literal<["buffer", "resume"]>;
-}>]>, Schema.Schema.Any>, typeof Schema.Never, never>;
+    readonly reason: Schema.Literals<readonly ["buffer", "resume"]>;
+}>]>, Schema.Top>, Schema.Never, never, never>;
 
 /**
  * The WEBHOOK audience of a declared event.
@@ -2403,7 +2442,7 @@ export declare interface ExposeAsToolSpec {
  * by the server group (cli/dev.ts) and the generated client group
  * (cli/codegen.ts) so both ends agree on the wire shape.
  */
-export declare type ExtraErrors = ReadonlyArray<Schema.Schema.All>;
+export declare type ExtraErrors = ReadonlyArray<Schema.Top>;
 
 /** Release a claim after the handler errored, so a retry can re-process. */
 export declare const failIdempotent: (store: IdempotencyStore, scope: string, key: string) => Promise<void>;
@@ -2447,6 +2486,14 @@ export declare const findAdvisoryResourceGuards: (procedures: ReadonlyArray<{
 /** Record a completed response for replay. */
 export declare const finishIdempotent: (store: IdempotencyStore, scope: string, key: string, response: IdempotencyResponse, now: number) => Promise<void>;
 
+/**
+ * The schema as the generator should see it: every `Number` node checked
+ * finite, so it is written as `type: number` and keeps its bounds and check
+ * fragments. Decoding is untouched — the view exists only to be generated from.
+ * A node with an encoding is left as it is: the generator reads its encoded side.
+ */
+export declare const finiteNumberView: (ast: SchemaAST.AST, memo?: Map<SchemaAST.AST, SchemaAST.AST>) => SchemaAST.AST;
+
 /**
  * The value a ONE-SHOT read of an rpc resolves to, given the first value it
  * delivered.
@@ -2484,10 +2531,10 @@ export declare const formatEventRoute: (route: string) => string;
  * test pins it against `wireErrorUnion` per kind, so the two cannot drift.
  */
 export declare const FRAMEWORK_WIRE_ERRORS: {
-    readonly query: readonly [typeof ScopeError, typeof Unauthenticated];
-    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated];
-    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof ValidationError, typeof ValidationErrors];
-    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof BusinessRuleViolation, typeof MutationInFlight, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
+    readonly query: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused];
+    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused];
+    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused, typeof ValidationError, typeof ValidationErrors];
+    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused, typeof BusinessRuleViolation, typeof MutationInFlight, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
 };
 
 /** The error values {@link FRAMEWORK_WIRE_ERRORS} admits for `Kind`. */
@@ -2548,8 +2595,19 @@ export declare interface GuardCheckSpec {
      * global-scope check (the extractor is advisory), exactly as before.
      */
     readonly resource?: (input: unknown) => string | undefined;
+    /** Require an explicit resource resolver verdict, even for globally held
+     * scopes and `admin:full`. Missing resolver/resource refuses access. */
+    readonly resourceOnly?: boolean;
 }
 
+/**
+ * The key a guard sees. `Schema.Top` is the wildcard (`EventDescriptor<string,
+ * Schema.Top, infer P>` in a helper's conditional type); its `Type` is
+ * `unknown`, and guards over `unknown` accept no guarded descriptor. The
+ * wildcard reads as `never`, like `AnyEventDescriptor`, so every event fits it.
+ */
+declare type GuardedKey<Key extends Schema.Top> = Schema.Top extends Key ? never : Schema.Schema.Type<Key>;
+
 /** One or more declarative guards on a descriptor. All must pass (AND across
  *  entries; `mode` controls AND/OR WITHIN one entry's scope array). */
 export declare type Guards<Input = unknown> = ReadonlyArray<AnyGuardSpec<Input>>;
@@ -2778,17 +2836,8 @@ export declare const IMPERSONATION_METADATA_KEY: "impersonation";
  * concluded the guard was not being applied. It was; it never got the chance.
  * With a complete payload the picture flipped immediately.
  *
- * That is the more dangerous of the two misreadings — it says "unprotected"
- * about something protected — and it is the one the ordering makes easy. So a
- * guarded procedure says so in the title:
- *
- *     workAreas.create input (guarded — the guard did NOT run: the payload
- *     failed to decode first, so this says nothing about access)
- *     └─ ["type"] └─ is missing
- *
- * It discloses nothing new. That a procedure is guarded is already visible to
- * any caller who sends a VALID payload and receives `ScopeError`, and the
- * message names no scope, no resource and no field type.
+ * The sentence is on the title line because that is the line a person reads
+ * first, and the whole misreading happened before the second line.
  */
 export declare const inputLabel: (procedure?: string, guarded?: boolean) => string;
 
@@ -2918,6 +2967,22 @@ export declare const isWireReachable: (descriptor: {
 
 export declare const JSONAPI_MEDIA_TYPE = "application/vnd.api+json; charset=utf-8";
 
+export declare interface JsonSchemaDocument {
+    readonly schema: Record<string, unknown>;
+    readonly definitions: Record<string, unknown>;
+}
+
+/** The schema and its named definitions, normalised, definitions kept beside the root. */
+export declare const jsonSchemaDocumentOf: (schema: Schema.Top, options?: JsonSchemaOptions) => JsonSchemaDocument;
+
+/** The document as ONE object: the root with its definitions inlined under `$defs`. */
+export declare const jsonSchemaOf: (schema: Schema.Top, options?: JsonSchemaOptions) => Record<string, unknown>;
+
+export declare interface JsonSchemaOptions {
+    /** `false` keeps objects open (no `additionalProperties: false`). Default: closed. */
+    readonly closed?: boolean;
+}
+
 /**
  * Build a scope cache. Hand it to `composeAuthStrategies({ scopeCache })` and
  * keep the handle: `invalidate(scopeCacheKey(subject))` from the mutation that
@@ -2971,17 +3036,34 @@ export declare const missingAccessDecision: (procedure?: string) => ScopeError;
  *  fits several tries. */
 export declare const MUTATION_IN_FLIGHT_RETRY_AFTER_MS = 1000;
 
+/** Transaction-bound context for a plugin's required database contribution.
+ * The executor result is available before the business transaction commits. */
+export declare interface MutationCommitContext extends RpcInterceptorContext {
+    readonly kind: 'mutation';
+    readonly store: DataStore;
+    readonly output: unknown;
+    /** Same enqueue facade as the executor, bound to this replay attempt. */
+    readonly outbox?: OutboxEnqueueFacade;
+    /** Runner invocation time, including guards and rolled-back retries. */
+    readonly startedAt?: number;
+    /** Elapsed milliseconds before required contribution work. */
+    readonly durationMs?: number;
+}
+
+/** Required transactional work, not an external side effect. A failure rolls
+ * back the mutation. The hook may run again after a rolled-back contention
+ * attempt, so all effects must remain on the supplied transaction store. */
+export declare type MutationCommitHook = (context: MutationCommitContext) => Effect.Effect<void, unknown>;
+
 /** A connection-scoped RPC cannot execute or replay without a live WebSocket.
  * This is a transport precondition, not an authorization or membership grant. */
 export declare class MutationConnectionRequired extends MutationConnectionRequired_base {
     get message(): string;
 }
 
-declare const MutationConnectionRequired_base: Schema.TaggedErrorClass<MutationConnectionRequired, "MutationConnectionRequired", {
-    readonly _tag: Schema.tag<"MutationConnectionRequired">;
-} & {
-    traceId: typeof Schema.String;
-}>;
+declare const MutationConnectionRequired_base: Schema.Class<MutationConnectionRequired, Schema.TaggedStruct<"MutationConnectionRequired", {
+    readonly traceId: Schema.String;
+}>, YieldableError>;
 
 /** Ordinary writes deduplicate across reconnects. A connection-side effect
  * (for example joining a room) must execute once for EACH native connection. */
@@ -2991,16 +3073,14 @@ export declare class MutationInFlight extends MutationInFlight_base {
     get message(): string;
 }
 
-declare const MutationInFlight_base: Schema.TaggedErrorClass<MutationInFlight, "MutationInFlight", {
-    readonly _tag: Schema.tag<"MutationInFlight">;
-} & {
-    traceId: typeof Schema.String;
+declare const MutationInFlight_base: Schema.Class<MutationInFlight, Schema.TaggedStruct<"MutationInFlight", {
+    readonly traceId: Schema.String;
     /** How long to wait before replaying the same key — the first call is still
      *  running; a replay before it finishes conflicts again. */
-    retryAfterMs: typeof Schema.Number;
-}>;
+    readonly retryAfterMs: Schema.Number;
+}>, YieldableError>;
 
-export declare interface MutationProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All> {
+export declare interface MutationProcedureDescriptor<Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top> {
     readonly kind: 'mutation';
     readonly name: Name;
     readonly input: Input;
@@ -3071,7 +3151,7 @@ export declare interface MutationSerialization<Input = unknown> {
     readonly maxPending?: number;
 }
 
-export declare const mutationToRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: MutationProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Schema.All, never>;
+export declare const mutationToRpc: <Name extends string, Input extends Schema.Top, Output extends Schema.Top, Err extends Schema.Top>(descriptor: MutationProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Top, never, never>;
 
 export declare interface NestedTargetFields<Input = unknown> {
     /** Dot-path to the nested array within the query VALUE to patch (e.g.
@@ -3131,12 +3211,10 @@ export declare class NoRowFound extends NoRowFound_base {
     get message(): string;
 }
 
-declare const NoRowFound_base: Schema.TaggedErrorClass<NoRowFound, "NoRowFound", {
-    readonly _tag: Schema.tag<"NoRowFound">;
-} & {
-    table: typeof Schema.String;
-    found: typeof Schema.Number;
-}>;
+declare const NoRowFound_base: Schema.Class<NoRowFound, Schema.TaggedStruct<"NoRowFound", {
+    readonly table: Schema.String;
+    readonly found: Schema.Number;
+}>, YieldableError>;
 
 /**
  * A resource guard's refusal when the resource it names does not exist — as
@@ -3156,13 +3234,11 @@ declare const NoRowFound_base: Schema.TaggedErrorClass<NoRowFound, "NoRowFound",
 export declare class NoSuchResource extends NoSuchResource_base {
 }
 
-declare const NoSuchResource_base: Schema.TaggedErrorClass<NoSuchResource, "NoSuchResource", {
-    readonly _tag: Schema.tag<"NoSuchResource">;
-} & {
-    resourceType: Schema.NullOr<typeof Schema.String>;
-    resourceId: typeof Schema.String;
-    message: typeof Schema.String;
-}>;
+declare const NoSuchResource_base: Schema.Class<NoSuchResource, Schema.TaggedStruct<"NoSuchResource", {
+    readonly resourceType: Schema.NullOr<Schema.String>;
+    readonly resourceId: Schema.String;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /**
  * What a plugin contributes to the OTel layer via `contributeObservability`.
@@ -3248,6 +3324,30 @@ export declare const openAccessSpec: (reason: string) => OpenAccessSpec;
  */
 export declare const orderByBearerPrefix: (strategies: ReadonlyArray<AuthStrategy>, headers: Readonly<Record<string, string | undefined>>) => ReadonlyArray<AuthStrategy>;
 
+/** Enqueue-only capability bound to the caller's actual transaction store. */
+export declare interface OutboxEnqueueFacade {
+    /** Returns the stable delivery identity. Delivery happens after commit. */
+    enqueue(effect: string, payload: Record<string, unknown>, options?: EnqueueOptions): Promise<string>;
+}
+
+/** Stable delivery context, shared by app and plugin handlers. */
+export declare interface OutboxHandlerContext {
+    readonly outboxId: string;
+    readonly idempotencyKey: string | null;
+    readonly payload: Record<string, unknown>;
+    readonly attempt: number;
+    readonly subjectId: string | null;
+    readonly tenantId: string | null;
+    readonly traceId: string | null;
+}
+
+/** Delivery happens after commit and may repeat; handlers must be idempotent. */
+export declare interface OutboxHandlerDefinition<R = never> {
+    readonly effect: string;
+    readonly handler: (context: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
+    readonly maxAttempts?: number;
+}
+
 export declare interface Pairing {
     /** The api's base url as the DEVICE reaches it — a LAN address, never `localhost`. */
     readonly api: string;
@@ -3290,7 +3390,7 @@ export declare const parseEventRoute: (route: string) => {
 /** The record from a link, or `null` for anything that is not a pairing link. */
 export declare const parsePairingLink: (url: string) => Pairing | null;
 
-export declare const patchCellSchema: Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>;
+export declare const patchCellSchema: Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>;
 
 /** A single row in a subscription result. Must carry an `id`; everything
  *  else is opaque to the patch layer. */
@@ -3304,34 +3404,37 @@ export declare type PatchRow = Readonly<Record<string, unknown>> & {
 export declare const pathToId: (path: string) => string;
 
 export declare const PendingApproval: Schema.Struct<{
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** The rpc tag whose execution is pending. */
-    procedure: typeof Schema.String;
-    kind: Schema.Literal<["mutation", "action"]>;
+    readonly procedure: Schema.String;
+    readonly kind: Schema.Literals<readonly ["mutation", "action"]>;
     /** Subject id of whoever asked. Never the approver. */
-    requestedBy: Schema.NullOr<typeof Schema.String>;
-    status: Schema.Literal<["pending", "approved", "rejected", "expired", "consumed"]>;
+    readonly requestedBy: Schema.NullOr<Schema.String>;
+    readonly status: Schema.Literals<readonly ["pending", "approved", "rejected", "expired", "consumed"]>;
     /** The declared reason from the descriptor, if any. */
-    reason: Schema.NullOr<typeof Schema.String>;
+    readonly reason: Schema.NullOr<Schema.String>;
     /** Scope(s) an approver must hold. */
-    requiredScopes: Schema.Array$<typeof Schema.String>;
-    requestedAt: typeof Schema.String;
-    expiresAt: typeof Schema.String;
-    decidedBy: Schema.NullOr<typeof Schema.String>;
-    decidedAt: Schema.NullOr<typeof Schema.String>;
+    readonly requiredScopes: Schema.$Array<Schema.String>;
+    readonly requestedAt: Schema.String;
+    readonly expiresAt: Schema.String;
+    readonly decidedBy: Schema.NullOr<Schema.String>;
+    readonly decidedAt: Schema.NullOr<Schema.String>;
     /** The approver's note, when they left one. */
-    note: Schema.NullOr<typeof Schema.String>;
+    readonly note: Schema.NullOr<Schema.String>;
     /**
      * How this row relates to the CALLING subject — the whole point of the feed.
      * `'to-decide'` = they may act on it; `'requested'` = they asked for it.
      * A row is never both: self-approval is refused, so a requester never
      * qualifies as its approver.
      */
-    relation: Schema.Literal<["to-decide", "requested"]>;
+    readonly relation: Schema.Literals<readonly ["to-decide", "requested"]>;
 }>;
 
 export declare type PendingApproval = Schema.Schema.Type<typeof PendingApproval>;
 
+/** The normalisation above, applied to any JSON Schema fragment. */
+export declare const plainJsonSchema: (value: unknown) => unknown;
+
 /**
  * Called once at app boot, after `voltro dev` resolves the plugin
  * list and before the rpc server starts accepting connections. Use
@@ -3404,7 +3507,7 @@ export declare interface PluginBindContext {
      */
     readonly cache?: PluginCacheHandle;
     /**
-     * The framework's already-open `SqlClient` (from `@effect/sql`) — the
+     * The framework's already-open `SqlClient` (from `effect/sql`) — the
      * SAME pool the app's store uses, with its TLS, credentials and schema.
      * For SQL the store's methods cannot express, against tables that are
      * DECLARED (`extendSchema.tables`, or the app's own schema): it never
@@ -3728,7 +3831,7 @@ export declare interface PluginEnvVar {
  * Requires the plugin to ship the schema as a NAMED export from `module`.
  */
 export declare interface PluginErrorSchema {
-    readonly schema: Schema.Schema.All;
+    readonly schema: Schema.Top;
     readonly import: {
         readonly module: string;
         readonly name: string;
@@ -3819,6 +3922,9 @@ export declare interface PluginHttpRoute {
      * handler branches on: exempting `/saml` exempts `POST /saml/anything`.
      */
     readonly originGuard?: 'exempt';
+    readonly cors?: RestCors;
+    /** Bearer-only routes must discard cookie authority before authentication. */
+    readonly credentials?: 'bearer';
 }
 
 /**
@@ -4232,9 +4338,9 @@ export declare interface PluginMigration {
  */
 /**
  * The `sql` parameter the framework hands the migration is the live
- * `SqlClient.SqlClient` from `@effect/sql`. The reference is type-only,
+ * `SqlClient.SqlClient` from `effect/sql`. The reference is type-only,
  * so it adds no runtime dependency — `@voltro/protocol` still ships
- * without pulling `@effect/sql` into a plugin's bundle.
+ * without pulling `effect/sql` into a plugin's bundle.
  */
 export declare type PluginMigrationSqlClient = SqlClient.SqlClient;
 
@@ -4250,7 +4356,7 @@ export declare type PluginMigrationSqlClient = SqlClient.SqlClient;
  * boot log + `/_voltro/inspect/plugins` so operators audit what each
  * plugin asks for before installing.
  */
-export declare type PluginPermission = 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
+export declare type PluginPermission = 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'outbox:handle' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
 
 /** What a plugin collects and uses — folded by `voltro compliance generate`
  *  into PrivacyInfo.xcprivacy and the Play Data-safety answers. A plugin that
@@ -4329,11 +4435,11 @@ export declare interface PluginRpcRoute {
     /** Optional human-readable description; surfaced in the dashboard. */
     readonly description?: string;
     /** Input schema — same `effect/Schema` shape user routes use. */
-    readonly input: Schema.Schema.Any;
+    readonly input: Schema.Top;
     /** Output schema. */
-    readonly output: Schema.Schema.Any;
+    readonly output: Schema.Top;
     /** Optional typed-error schema (TaggedError union). */
-    readonly error?: Schema.Schema.All;
+    readonly error?: Schema.Top;
     /**
      * REACTIVE source table(s) — ONLY for `kind: 'query'`. When set, the
      * framework drives the query REACTIVELY: it re-runs the executor and pushes
@@ -4614,7 +4720,7 @@ export declare const problemDetails: (error: RestFormatError) => Record<string,
 /** A stable, non-resolving URI for an error type: the tag as a URN. */
 export declare const problemTypeOf: (tag: string) => string;
 
-export declare type ProcedureDescriptor = QueryProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All> | MutationProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All> | ActionProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All> | StreamProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All>;
+export declare type ProcedureDescriptor = QueryProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top> | MutationProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top> | ActionProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top> | StreamProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top>;
 
 /** The shape of one procedure, as the pair of peers must agree on it. */
 export declare interface ProcedureLike {
@@ -4639,10 +4745,10 @@ export declare const procedureShapeDigest: (rpc: ProcedureLike) => string;
  */
 export declare type ProcedureWireError<D extends {
     readonly kind: WireProcedureKind;
-    readonly error: Schema.Schema.All;
+    readonly error: Schema.Top;
 }> = Schema.Schema.Type<D['error']> | FrameworkWireError<D['kind']> | RegisteredPluginError;
 
-export declare const PROTOCOL_VERSION: 1;
+export declare const PROTOCOL_VERSION: 2;
 
 export declare type ProtocolVersion = typeof PROTOCOL_VERSION;
 
@@ -4856,7 +4962,7 @@ export declare interface QueryCacheConfig {
     readonly scope: 'subject' | 'tenant' | 'global';
 }
 
-export declare interface QueryProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All> {
+export declare interface QueryProcedureDescriptor<Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top> {
     readonly kind: 'query';
     readonly name: Name;
     readonly input: Input;
@@ -4912,56 +5018,40 @@ export declare interface QueryProcedureDescriptor<Name extends string, Input ext
     readonly internal: boolean | undefined;
 }
 
-export declare const queryToRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<[Schema.Struct<{
-    _tag: Schema.Literal<["snapshot"]>;
-    revision: typeof Schema.Number;
-    data: Output;
-    computed: Schema.optional<typeof Schema.Boolean>;
-    reconciles: Schema.optional<typeof Schema.String>;
+export declare const queryToRpc: <Name extends string, Input extends Schema.Top, Output extends Schema.Top, Err extends Schema.Top>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"snapshot">;
+    readonly revision: Schema.Number;
+    readonly data: Output;
+    readonly computed: Schema.optional<Schema.Boolean>;
+    readonly reconciles: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["delta"]>;
-    revision: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    patch: Schema.Struct<{
-        ops: Schema.Array$<Schema.Union<[Schema.Struct<{
-            op: Schema.Literal<["add"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+    readonly _tag: Schema.Literal<"delta">;
+    readonly revision: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly patch: Schema.Struct<{
+        readonly ops: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+            readonly op: Schema.Literal<"add">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["replace"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+            readonly op: Schema.Literal<"replace">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["remove"]>;
-            path: typeof Schema.String;
+            readonly op: Schema.Literal<"remove">;
+            readonly path: Schema.String;
         }>, Schema.Struct<{
-            op: Schema.Literal<["mergeCells"]>;
-            path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
+            readonly op: Schema.Literal<"mergeCells">;
+            readonly path: Schema.String;
+            readonly value: Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>;
         }>]>>;
-        order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
+        readonly order: Schema.NullOr<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>>;
     }>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["error"]>;
-    error: typeof Schema.Unknown;
-    revision: Schema.optional<typeof Schema.Number>;
-}>]>, Schema.Schema.All>, typeof Schema.Never, never>;
+    readonly _tag: Schema.Literal<"error">;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
+    readonly revision: Schema.optional<Schema.Number>;
+}>]>, Schema.Top>, Schema.Never, never, never>;
 
 /**
  * The RAW mark, unvalidated, or `null`.
@@ -5040,6 +5130,20 @@ export declare type ReactivitySourceValue = string | ReactivityChannel;
 
 export declare const readPairing: (storage: PairingStorage) => Promise<Pairing | null>;
 
+/**
+ * Reauthenticate a live grant through its original strategy chain. Tenant and
+ * principal identity stay bound to the original subscription: changing either
+ * requires a new subscription, never reuse of an already scoped descriptor.
+ * Runtime-owned subjects without a request binding retain their explicit grant.
+ */
+export declare const reauthorizeSubject: (subject: Subject, prepare?: (fresh: Subject) => Promise<void>) => Promise<Subject>;
+
+/** Recheck a live grant through fresh authentication and derived authority. */
+export declare const recheckGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | RequestedTenantRefused | NoSuchResource | null>;
+
+/** Refresh derived authority without replaying unrelated RPC plugin hooks. */
+export declare const refreshEffectiveScopes: (original: Subject, fresh: Subject) => Promise<void>;
+
 /** Every error a plugin registers, as one union (`never` before codegen). */
 export declare type RegisteredPluginError = VoltroPluginErrors[keyof VoltroPluginErrors];
 
@@ -5072,6 +5176,25 @@ export declare const registerPluginAliases: (aliases: Readonly<Record<string, st
  */
 export declare const reportableError: (err: unknown) => Error;
 
+/** An authenticated request cannot use its requested workspace. This is
+ * scoped access refusal, not evidence that the credential or session ended.
+ * Consumers must keep unrelated workspace sessions intact. */
+export declare class RequestedTenantRefused extends RequestedTenantRefused_base {
+}
+
+declare const RequestedTenantRefused_base: Schema.Class<RequestedTenantRefused, Schema.TaggedStruct<"RequestedTenantRefused", {
+    readonly reason: Schema.Literals<readonly ["target-unavailable", "invalid-target", "memberships-unavailable", "not-a-member", "subject-has-no-tenant"]>;
+}>, YieldableError>;
+
+/** A request's tenant hint, read only after a strategy authenticates the caller.
+ * Return null for the credential / stored selection. A non-null target is
+ * checked against fresh memberships on every resolution, including when it
+ * equals the credential's tenant. It never writes a persistent selection.
+ * Do not return a tenant default for an absent hint: that would silently change
+ * the authority of requests which did not select a workspace.
+ */
+export declare type RequestedTenantSource = (subject: Subject, input: AuthStrategyInput) => Promise<string | null> | string | null;
+
 /** Gate a handler on a scope; fails with a typed `ScopeError` if missing.
  *  Checks the EFFECTIVE set so role-derived scopes count. */
 export declare const requireScope: (subject: Subject, scope: string) => Effect.Effect<void, ScopeError>;
@@ -5159,7 +5282,18 @@ declare interface RestByteResponse {
  * headers CDNs purge by. A request that carries a credential (`Authorization`
  * or a cookie) gets `private, no-cache` and no tags, whatever is declared:
  * what a key or a session may see must never land in a shared cache. Every
- * such answer says `Vary: Authorization, Cookie`. Errors are not affected.
+ * such answer says `Vary: Authorization, Cookie`.
+ *
+ * With `audience`, the ANSWER decides instead of the request's cookies: an
+ * answer that is the same for every reader (`'public'`) is shared even when
+ * the request carries cookies (a consent choice, a signed-in reader on a
+ * public page) — the cache serves it to everyone, so it says only
+ * `Vary: Authorization`; an answer for this reader alone (`'private'`: a
+ * members page, a running experiment) is `private, no-store`. A request with
+ * `Authorization` is private either way.
+ *
+ * Any other answer than a 200 (a 404, a 410, a 401) of a route with `cache`
+ * is `private, no-store`: one reader's "not found" can be another's page.
  */
 declare interface RestCache {
     /** Seconds a cache may serve the answer without asking again. */
@@ -5169,6 +5303,22 @@ declare interface RestCache {
     /** Purge tags from the answer as it goes on the wire, and the input.
      *  A tag with whitespace or a comma is dropped (no header can carry it). */
     readonly tags?: (output: unknown, input: unknown) => ReadonlyArray<string>;
+    /** Who may share the answer, decided by the answer and the reader it was
+     *  made for: `'public'` — every reader gets the same, cookies are ignored;
+     *  `'private'` — this reader's alone, never shared. Answer `'private'` for
+     *  a signed-in `subject` whenever anything in the answer depends on who
+     *  reads it. Without it, any cookie makes the answer private. */
+    readonly audience?: (output: unknown, input: unknown, subject: Subject) => 'public' | 'private';
+}
+
+/** Cross-origin browser access for one route. Origins are exact, including opaque `null`. */
+declare interface RestCors {
+    readonly origins: ReadonlyArray<string>;
+    readonly headers?: ReadonlyArray<string>;
+    readonly methods?: ReadonlyArray<RestMethod>;
+    /** Preflight cache lifetime in seconds. */
+    readonly maxAge?: number;
+    readonly exposeHeaders?: ReadonlyArray<string>;
 }
 
 export declare type RestDates = 'iso' | 'epoch-ms';
@@ -5271,6 +5421,13 @@ export declare type RestNaming = 'camelCase' | 'snake_case';
 
 export declare type RestPagination = 'link-header' | 'body-cursor';
 
+/** Uses the mounted rate-limit plugin's store, algorithms and dynamic policy. */
+declare interface RestRateLimit {
+    readonly limit: number;
+    readonly window: string;
+    readonly by?: 'subject' | 'tenant' | 'apiKey' | 'ip' | 'global';
+}
+
 /** A schema-encoded REST body with an application-selected HTTP status and
  *  response headers. The marker keeps ordinary domain objects unambiguous.
  *  `output` still validates/encodes `body`; use `Schema.Void` with a 204 when
@@ -5324,10 +5481,10 @@ declare interface RestRouteDescriptor<I, O> {
      *  before decoding. Omit for routes that take no input. The schema's
      *  decoded `Type` flows to the handler's `input`; its `Encoded` is left
      *  open (`any`) so any `Schema.Struct(...)` is accepted. */
-    readonly input?: Schema.Schema<I, any, never>;
+    readonly input?: Schema.Codec<I, any, never, never>;
     /** Output schema. The handler returns the decoded `Type`; the desugar
      *  encodes it to JSON for the `200` response. */
-    readonly output: Schema.Schema<O, any, never>;
+    readonly output: Schema.Codec<O, any, never, never>;
     readonly handler: (input: I, ctx: RestRouteContext) => Promise<RestHandlerResult<O>> | RestHandlerResult<O>;
     readonly summary?: string;
     readonly description?: string;
@@ -5369,6 +5526,10 @@ declare interface RestRouteDescriptor<I, O> {
      */
     readonly version?: `v${number}`;
     readonly guards?: ReadonlyArray<RestGuard>;
+    readonly cors?: RestCors;
+    /** Only an explicit bearer header may authenticate; cookies are removed before auth and context construction. */
+    readonly credentials?: 'bearer';
+    readonly rateLimit?: RestRateLimit;
     /**
      * This route STREAMS (Server-Sent Events) rather than resolving one value — its
      * handler returns `sse(...)`. Declared on the descriptor, not left implicit in
@@ -5411,10 +5572,10 @@ declare interface RestRouteProjection {
     /** `publicApi.idempotent` — the route honours `Idempotency-Key` (under the
      *  app's idempotency binding); a client sends one per attempt. */
     readonly idempotent: boolean;
-    readonly input: Schema.Schema.All;
+    readonly input: Schema.Top;
     /** The wire names of the input fields bound from the path. */
     readonly pathParams: ReadonlyArray<string>;
-    readonly output: Schema.Schema.All;
+    readonly output: Schema.Top;
     /** The first `source` table, when the procedure declares one. */
     readonly source: string | undefined;
     /** Every failure the operation answers with a typed body, and its status:
@@ -5423,11 +5584,40 @@ declare interface RestRouteProjection {
     readonly errorResponses: ReadonlyArray<{
         readonly status: number;
         readonly tag: string;
-        readonly schema: Schema.Schema.All;
+        readonly schema: Schema.Top;
     }>;
     readonly format: RestFormat;
 }
 
+/**
+ * Default ctx resolver used when the serve pipeline doesn't inject one
+ * (e.g. unit tests). Real mounts pass a resolver that reads the framework's
+ * auth subject + the bound DataStore.
+ */
+declare interface RestServeBindings {
+    /** Bound once from the app's mounted rate-limit plugin. */
+    readonly rateLimit?: (policy: RestRateLimit, ctx: RestRouteContext, route: RestRouteDescriptor<any, any>) => Effect.Effect<void, unknown>;
+    /** Resolve the calling subject from the request headers. */
+    readonly resolveSubject?: (headers: Readonly<Record<string, string>>) => Subject | Promise<Subject>;
+    /** The bound framework DataStore. */
+    readonly store?: unknown;
+    /** Build the full per-request app context after authentication. */
+    readonly buildContext?: (subject: Subject, headers: Readonly<Record<string, string>>) => unknown | Promise<unknown>;
+    /**
+     * HTTP idempotency — when set, a mutating request (POST/PUT/PATCH/DELETE)
+     * carrying the `header` is deduplicated: the first call runs + caches its
+     * response; a replay within `ttlMs` returns the cached response
+     * (`Idempotency-Replayed: true`); an in-flight duplicate gets `409`. Scoped
+     * per (tenant, method, path). The serve path injects the store + config from
+     * `app.config.ts`'s `idempotency` field.
+     */
+    readonly idempotency?: {
+        readonly store: IdempotencyStore;
+        readonly header: string;
+        readonly ttlMs: number;
+    };
+}
+
 /**
  * What a REST handler returns to stream its response instead of resolving one
  * value: `sse((emit) => unsubscribe)`. The route's schema `output` is not used
@@ -5442,25 +5632,25 @@ declare interface RestStreamResponse {
 
 /**
  * Rewrite a descriptor's schema into the shape the profile puts on the wire:
- * `timestampMs` (`DateFromNumber`) becomes an RFC 3339 string under
- * `dates: 'iso'`, and every struct's property names become `snake_case` under
- * `naming: 'snake_case'` — as a transformation, so decoding a wire value yields
- * the descriptor's own typed value and encoding the typed value yields the
- * wire form. `JSONSchema.make` of the result documents the wire (a
- * `format: date-time` string, the snake keys). Classes and other opaque
- * transformations pass through unchanged; a struct inside one keeps its keys.
+ * `timestampMs` becomes an RFC 3339 string under `dates: 'iso'`, and every
+ * struct's property names become `snake_case` under `naming: 'snake_case'` —
+ * as an encoding, so decoding a wire value yields the descriptor's own typed
+ * value and encoding the typed value yields the wire form.
+ * `Schema.toJsonSchemaDocument` of the result documents the wire (a
+ * `format: date-time` string, the snake keys). Classes and other opaque codecs
+ * pass through unchanged; a struct inside one keeps its keys.
  */
-export declare const restViewSchema: (schema: Schema.Schema.All, format: RestFormat) => Schema.Schema.All;
+export declare const restViewSchema: (schema: Schema.Top, format: RestFormat) => Schema.Top;
 
 /** The id of a row, addressed in op paths as `/<id>`. */
 export declare type RowId = string | number;
 
 /** The full delta payload: the per-row ops plus the authoritative id
- *  ordering of the resulting set. */
+ *  ordering when it changes. */
 export declare interface RowPatch {
     readonly ops: ReadonlyArray<RowPatchOp>;
-    /** Id sequence of the resulting (next) row set, in order. */
-    readonly order: ReadonlyArray<RowId>;
+    /** null preserves the previous id sequence; an array supplies the new one. */
+    readonly order: ReadonlyArray<RowId> | null;
 }
 
 /**
@@ -5499,73 +5689,41 @@ export declare type RowPatchOp = {
     readonly value: Readonly<Record<string, unknown>>;
 };
 
-export declare const rowPatchOpSchema: Schema.Union<[Schema.Struct<{
-    op: Schema.Literal<["add"]>;
-    path: typeof Schema.String;
-    value: Schema.refine<{
-        readonly [x: string]: unknown;
-    } & Readonly<Record<string, unknown>> & {
-        readonly id: RowId;
-    }, Schema.Schema<{
-        readonly [x: string]: unknown;
-    }, {
-        readonly [x: string]: unknown;
-    }, never>>;
+export declare const rowPatchOpSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly op: Schema.Literal<"add">;
+    readonly path: Schema.String;
+    readonly value: Schema.refine<PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
 }>, Schema.Struct<{
-    op: Schema.Literal<["replace"]>;
-    path: typeof Schema.String;
-    value: Schema.refine<{
-        readonly [x: string]: unknown;
-    } & Readonly<Record<string, unknown>> & {
-        readonly id: RowId;
-    }, Schema.Schema<{
-        readonly [x: string]: unknown;
-    }, {
-        readonly [x: string]: unknown;
-    }, never>>;
+    readonly op: Schema.Literal<"replace">;
+    readonly path: Schema.String;
+    readonly value: Schema.refine<PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
 }>, Schema.Struct<{
-    op: Schema.Literal<["remove"]>;
-    path: typeof Schema.String;
+    readonly op: Schema.Literal<"remove">;
+    readonly path: Schema.String;
 }>, Schema.Struct<{
-    op: Schema.Literal<["mergeCells"]>;
-    path: typeof Schema.String;
-    value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
+    readonly op: Schema.Literal<"mergeCells">;
+    readonly path: Schema.String;
+    readonly value: Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>;
 }>]>;
 
 export declare const rowPatchSchema: Schema.Struct<{
-    ops: Schema.Array$<Schema.Union<[Schema.Struct<{
-        op: Schema.Literal<["add"]>;
-        path: typeof Schema.String;
-        value: Schema.refine<{
-            readonly [x: string]: unknown;
-        } & Readonly<Record<string, unknown>> & {
-            readonly id: RowId;
-        }, Schema.Schema<{
-            readonly [x: string]: unknown;
-        }, {
-            readonly [x: string]: unknown;
-        }, never>>;
+    readonly ops: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly op: Schema.Literal<"add">;
+        readonly path: Schema.String;
+        readonly value: Schema.refine<PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
     }>, Schema.Struct<{
-        op: Schema.Literal<["replace"]>;
-        path: typeof Schema.String;
-        value: Schema.refine<{
-            readonly [x: string]: unknown;
-        } & Readonly<Record<string, unknown>> & {
-            readonly id: RowId;
-        }, Schema.Schema<{
-            readonly [x: string]: unknown;
-        }, {
-            readonly [x: string]: unknown;
-        }, never>>;
+        readonly op: Schema.Literal<"replace">;
+        readonly path: Schema.String;
+        readonly value: Schema.refine<PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
     }>, Schema.Struct<{
-        op: Schema.Literal<["remove"]>;
-        path: typeof Schema.String;
+        readonly op: Schema.Literal<"remove">;
+        readonly path: Schema.String;
     }>, Schema.Struct<{
-        op: Schema.Literal<["mergeCells"]>;
-        path: typeof Schema.String;
-        value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
+        readonly op: Schema.Literal<"mergeCells">;
+        readonly path: Schema.String;
+        readonly value: Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>;
     }>]>>;
-    order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
+    readonly order: Schema.NullOr<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>>;
 }>;
 
 /**
@@ -5608,6 +5766,10 @@ export declare type RpcInterceptor = (next: Effect.Effect<unknown, unknown>, con
  * them automatically.
  */
 export declare interface RpcInterceptorContext {
+    /** Enqueue a settled invocation outcome on the host's root store, outside
+     * the business transaction. Required transactional success capture must use
+     * MutationCommitContext.outbox instead. Older/custom hosts may omit this. */
+    readonly enqueueOutcome?: OutboxEnqueueFacade['enqueue'];
     /** Procedure tag, e.g. `todos.create`. */
     readonly tag: string;
     /** Discriminator — `'mutation' | 'query' | 'action' | 'workflow'`. */
@@ -5788,12 +5950,10 @@ export declare type ScopeDecision =
 export declare class ScopeError extends ScopeError_base {
 }
 
-declare const ScopeError_base: Schema.TaggedErrorClass<ScopeError, "ScopeError", {
-    readonly _tag: Schema.tag<"ScopeError">;
-} & {
-    required: typeof Schema.String;
-    message: typeof Schema.String;
-}>;
+declare const ScopeError_base: Schema.Class<ScopeError, Schema.TaggedStruct<"ScopeError", {
+    readonly required: Schema.String;
+    readonly message: Schema.String;
+}>, YieldableError>;
 
 /** What `resolveScopes` may return. A bare array is the shorthand for
  *  `{ kind: 'grant', scopes }` — the common case, and the reading an existing
@@ -5863,14 +6023,12 @@ export declare type ServerErrorSource = 'rest' | 'aggregate' | 'subscriber' | 'r
 export declare class ServerOnlyColumnWrite extends ServerOnlyColumnWrite_base {
 }
 
-declare const ServerOnlyColumnWrite_base: Schema.TaggedErrorClass<ServerOnlyColumnWrite, "ServerOnlyColumnWrite", {
-    readonly _tag: Schema.tag<"ServerOnlyColumnWrite">;
-} & {
+declare const ServerOnlyColumnWrite_base: Schema.Class<ServerOnlyColumnWrite, Schema.TaggedStruct<"ServerOnlyColumnWrite", {
     /** The table the write targeted. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** The `.serverOnly()` columns the input tried to set. */
-    columns: Schema.Array$<typeof Schema.String>;
-}>;
+    readonly columns: Schema.$Array<Schema.String>;
+}>, YieldableError>;
 
 /** A service (app) name: what `serviceCallers`, `service.callers` and a service
  *  credential all spell the same way. At most 56 characters: the caller writes
@@ -6005,6 +6163,9 @@ export declare const sessionValueFromHeaders: (headers: Readonly<Record<string,
  */
 export declare const setEffectiveScopes: (subject: Subject, scopes: ReadonlyArray<string>) => void;
 
+/** Register a request's dynamic role/permission resolver for live delivery. */
+export declare const setEffectiveScopesRefresher: (subject: Subject, refresh: (fresh: Subject) => Promise<void>) => void;
+
 /** Register (or clear) the process-global policy-guard resolver. Last write
  *  wins. The runtime installs one backed by the resource-policy registry and
  *  the registered tuple source. */
@@ -6035,6 +6196,34 @@ export declare const shapeDigest: (text: string) => string;
  */
 export declare const sourceKeys: (source: ReactivitySourceValue | ReadonlyArray<ReactivitySourceValue> | undefined) => ReadonlyArray<string>;
 
+export declare type StorageAccessPolicy = typeof StorageAccessPolicySchema.Type;
+
+export declare const StorageAccessPolicySchema: Schema.$Array<Schema.Struct<{
+    readonly owner: Schema.optional<Schema.Boolean>;
+    readonly roles: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly groups: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly tenant: Schema.optional<Schema.Boolean>;
+    readonly apiKey: Schema.optional<Schema.Boolean>;
+    readonly password: Schema.optional<Schema.Boolean>;
+    readonly guard: Schema.optional<Schema.String>;
+}>>;
+
+export declare type StorageAccessRule = typeof StorageAccessRuleSchema.Type;
+
+/** Conditions within one rule are AND; rules within a policy are OR.
+ * Private storage objects also allow their owner. */
+export declare const StorageAccessRuleSchema: Schema.Struct<{
+    readonly owner: Schema.optional<Schema.Boolean>;
+    readonly roles: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly groups: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly tenant: Schema.optional<Schema.Boolean>;
+    readonly apiKey: Schema.optional<Schema.Boolean>;
+    readonly password: Schema.optional<Schema.Boolean>;
+    readonly guard: Schema.optional<Schema.String>;
+}>;
+
 export declare const STORE_SCREENSHOT_PRESET_NAMES: [string, ...string[]];
 
 export declare const STORE_SCREENSHOT_PRESETS: ReadonlyArray<StoreScreenshotPreset>;
@@ -6067,13 +6256,11 @@ export declare class StoreOperationFailed extends StoreOperationFailed_base {
     get message(): string;
 }
 
-declare const StoreOperationFailed_base: Schema.TaggedErrorClass<StoreOperationFailed, "StoreOperationFailed", {
-    readonly _tag: Schema.tag<"StoreOperationFailed">;
-} & {
+declare const StoreOperationFailed_base: Schema.Class<StoreOperationFailed, Schema.TaggedStruct<"StoreOperationFailed", {
     /** Which DataStore op was attempted: 'query' | 'insert' | 'update' | 'delete' | 'hardDelete'. */
-    operation: typeof Schema.String;
+    readonly operation: Schema.String;
     /** The table the op targeted. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /**
      * A BOUNDED description of what went wrong.
      *
@@ -6091,8 +6278,8 @@ declare const StoreOperationFailed_base: Schema.TaggedErrorClass<StoreOperationF
      *     socket address. `wireSafeCause` in `@voltro/database` builds it,
      *     and the reasoning is there. The full detail is logged server-side.
      */
-    cause: typeof Schema.String;
-}>;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 /** The PNG size the store receives: viewport × scale factor. */
 export declare const storeScreenshotPixels: (preset: StoreScreenshotPreset) => {
@@ -6157,7 +6344,7 @@ export declare type StrategyResolution = {
  * run's `AgentEvent`s), one-shot, no table, no snapshot. Backs A3's
  * agent runtime + any other server-push stream.
  */
-export declare interface StreamProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Element extends Schema.Schema.Any, Error extends Schema.Schema.All> {
+export declare interface StreamProcedureDescriptor<Name extends string, Input extends Schema.Top, Element extends Schema.Top, Error extends Schema.Top> {
     readonly kind: 'stream';
     readonly name: Name;
     readonly input: Input;
@@ -6176,50 +6363,40 @@ export declare interface StreamProcedureDescriptor<Name extends string, Input ex
     readonly openAccess: string | undefined;
 }
 
-export declare const streamToRpc: <Name extends string, Input extends Schema.Schema.Any, Element extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: StreamProcedureDescriptor<Name, Input, Element, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Element, Schema.Schema.All>, typeof Schema.Never, never>;
+export declare const streamToRpc: <Name extends string, Input extends Schema.Top, Element extends Schema.Top, Err extends Schema.Top>(descriptor: StreamProcedureDescriptor<Name, Input, Element, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Element, Schema.Top>, Schema.Never, never, never>;
 
 /**
- * Annotate a procedure's input schema so an undeclared field fails the decode
- * instead of vanishing from it.
- *
- * Applies to the schema handed to `Rpc.make` — the PAYLOAD only. Not the
- * success schema, and not `descriptor.input`, which the client still reads
- * unannotated for schema-driven UI (`normalizeDescriptor`).
- *
- * Measured, because none of it follows from the annotation's name: it
- * propagates into NESTED structs and through a UNION's members, and a
- * non-struct payload (`Schema.Void`, a scalar) is unaffected — there is no
- * excess property for it to have.
+ * The payload schema every `Rpc.make` in this package is built with. Excess
+ * keys are refused at every closed object the input reaches, and a decode
+ * failure is reported under the procedure's label (see the header).
  */
-export declare const strictInput: <S extends Schema.Schema.Any>(input: S, procedure?: string, guarded?: boolean) => S;
+export declare const strictInput: <S extends Schema.Top>(input: S, procedure?: string, guarded?: boolean) => S;
 
-export declare const Subject: Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["user"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+export declare const Subject: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["apiKey"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"apiKey">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["serviceAccount"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
+    readonly type: Schema.Literal<"serviceAccount">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
     /** Application actor used for audit columns; null means machine work with
      * no application actor. Identity only, never a permission grant. */
-    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-        exact: true;
-    }>;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["anonymous"]>;
-    id: typeof Schema.Null;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly type: Schema.Literal<"anonymous">;
+    readonly id: Schema.Null;
+    readonly tenantId: Schema.NullOr<Schema.String>;
     /**
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
@@ -6236,21 +6413,21 @@ export declare const Subject: Schema.Union<[Schema.Struct<{
      * must not break an `openAccess` procedure that needs no session at all. The
      * fact travels, and only a guard that actually refuses spends it.
      */
-    credentialRejected: Schema.optional<typeof Schema.String>;
+    readonly credentialRejected: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["system"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"system">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["service"]>;
-    id: typeof Schema.String;
+    readonly type: Schema.Literal<"service">;
+    readonly id: Schema.String;
     /** The calling app's name, as the callee lists it in `serviceCallers`. */
-    service: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly service: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>]>;
 
 export declare type Subject = typeof Subject.Type;
@@ -6260,28 +6437,26 @@ export declare type Subject = typeof Subject.Type;
  * no authority and must not be inferred from user-provided metadata. */
 export declare const subjectAuditActorId: (subject: Subject) => string | null;
 
-export declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["user"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+export declare const SubjectIdentity: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["apiKey"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"apiKey">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["serviceAccount"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-        exact: true;
-    }>;
+    readonly type: Schema.Literal<"serviceAccount">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["anonymous"]>;
-    id: typeof Schema.Null;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly type: Schema.Literal<"anonymous">;
+    readonly id: Schema.Null;
+    readonly tenantId: Schema.NullOr<Schema.String>;
     /**
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
@@ -6298,18 +6473,18 @@ export declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
      * must not break an `openAccess` procedure that needs no session at all. The
      * fact travels, and only a guard that actually refuses spends it.
      */
-    credentialRejected: Schema.optional<typeof Schema.String>;
+    readonly credentialRejected: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["system"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"system">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["service"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    service: typeof Schema.String;
+    readonly type: Schema.Literal<"service">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly service: Schema.String;
 }>]>;
 
 export declare type SubjectIdentity = typeof SubjectIdentity.Type;
@@ -6344,7 +6519,7 @@ export declare const subjectScopes: (subject: Subject) => ReadonlyArray<string>;
 export declare class SubjectService extends SubjectService_base {
 }
 
-declare const SubjectService_base: Context.TagClass<SubjectService, "@voltro/Subject", {
+declare const SubjectService_base: Context.ServiceClass<SubjectService, "@voltro/Subject", {
     readonly type: "user";
     readonly id: string;
     readonly tenantId: string;
@@ -6386,11 +6561,11 @@ declare const SubjectService_base: Context.TagClass<SubjectService, "@voltro/Sub
     readonly type: "service";
     readonly id: string;
     readonly tenantId: null;
+    readonly service: string;
     readonly scopes?: readonly string[] | undefined;
     readonly metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
-    readonly service: string;
 }>;
 
 /** Subscribe to server-primitive errors. Returns an unsubscribe fn. */
@@ -6413,55 +6588,39 @@ export declare type SubscriptionEvent<T> = {
     readonly revision?: number | undefined;
 };
 
-export declare const subscriptionEvent: <D extends Schema.Schema.Any>(data: D) => Schema.Union<[Schema.Struct<{
-    _tag: Schema.Literal<["snapshot"]>;
-    revision: typeof Schema.Number;
-    data: D;
-    computed: Schema.optional<typeof Schema.Boolean>;
-    reconciles: Schema.optional<typeof Schema.String>;
+export declare const subscriptionEvent: <D extends Schema.Top>(data: D) => Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"snapshot">;
+    readonly revision: Schema.Number;
+    readonly data: D;
+    readonly computed: Schema.optional<Schema.Boolean>;
+    readonly reconciles: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["delta"]>;
-    revision: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    patch: Schema.Struct<{
-        ops: Schema.Array$<Schema.Union<[Schema.Struct<{
-            op: Schema.Literal<["add"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+    readonly _tag: Schema.Literal<"delta">;
+    readonly revision: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly patch: Schema.Struct<{
+        readonly ops: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+            readonly op: Schema.Literal<"add">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["replace"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+            readonly op: Schema.Literal<"replace">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["remove"]>;
-            path: typeof Schema.String;
+            readonly op: Schema.Literal<"remove">;
+            readonly path: Schema.String;
         }>, Schema.Struct<{
-            op: Schema.Literal<["mergeCells"]>;
-            path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
+            readonly op: Schema.Literal<"mergeCells">;
+            readonly path: Schema.String;
+            readonly value: Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>;
         }>]>>;
-        order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
+        readonly order: Schema.NullOr<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>>;
     }>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["error"]>;
-    error: typeof Schema.Unknown;
-    revision: Schema.optional<typeof Schema.Number>;
+    readonly _tag: Schema.Literal<"error">;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
+    readonly revision: Schema.optional<Schema.Number>;
 }>]>;
 
 export declare interface SurfaceMismatch {
@@ -6534,21 +6693,20 @@ export declare type TableName = keyof VoltroTableNames extends never ? string :
  * leak the original Schema instance).
  */
 export declare class TableValidationFailed extends TableValidationFailed_base {
+    get message(): string;
 }
 
-declare const TableValidationFailed_base: Schema.TaggedErrorClass<TableValidationFailed, "TableValidationFailed", {
-    readonly _tag: Schema.tag<"TableValidationFailed">;
-} & {
+declare const TableValidationFailed_base: Schema.Class<TableValidationFailed, Schema.TaggedStruct<"TableValidationFailed", {
     /** The table the row targeted. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** Top-level explanation for logs + UI ("user.email failed pattern check"). */
-    summary: typeof Schema.String;
+    readonly summary: Schema.String;
     /** Flat list of `{ path, message }` per failing leaf. Path uses dot-notation. */
-    issues: Schema.Array$<Schema.Struct<{
-        path: typeof Schema.String;
-        message: typeof Schema.String;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly message: Schema.String;
     }>>;
-}>;
+}>, YieldableError>;
 
 export declare type Target<Input = unknown, Row = unknown> = TargetSpec<Input, Row> | ReadonlyArray<TargetSpec<Input, Row>>;
 
@@ -6625,16 +6783,14 @@ export declare type TargetSpec<Input = unknown, Row = unknown> = InsertTarget<In
 export declare class TenantRowNotFound extends TenantRowNotFound_base {
 }
 
-declare const TenantRowNotFound_base: Schema.TaggedErrorClass<TenantRowNotFound, "TenantRowNotFound", {
-    readonly _tag: Schema.tag<"TenantRowNotFound">;
-} & {
+declare const TenantRowNotFound_base: Schema.Class<TenantRowNotFound, Schema.TaggedStruct<"TenantRowNotFound", {
     /** The table the keyed write targeted. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** The primary key the CALLER supplied. Echoing it leaks nothing. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** Human-readable explanation for diagnostics + UI. */
-    reason: typeof Schema.String;
-}>;
+    readonly reason: Schema.String;
+}>, YieldableError>;
 
 /**
  * The subject a `storeForTenant(id)` view runs as — the caller's identity,
@@ -6665,14 +6821,12 @@ export declare const tenantScopedSubject: (subject: Subject, tenantId: string) =
 export declare class TenantScopeViolation extends TenantScopeViolation_base {
 }
 
-declare const TenantScopeViolation_base: Schema.TaggedErrorClass<TenantScopeViolation, "TenantScopeViolation", {
-    readonly _tag: Schema.tag<"TenantScopeViolation">;
-} & {
+declare const TenantScopeViolation_base: Schema.Class<TenantScopeViolation, Schema.TaggedStruct<"TenantScopeViolation", {
     /** The table the violating write targeted. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** Human-readable explanation for diagnostics + UI. */
-    reason: typeof Schema.String;
-}>;
+    readonly reason: Schema.String;
+}>, YieldableError>;
 
 /** The subject types a selection can apply to: those with an id AND a tenant.
  *  `anonymous` has no id to remember a selection under; `system` has no
@@ -6695,14 +6849,12 @@ export declare interface TenantSelectionIdentity {
 export declare class TenantSelectionRefused extends TenantSelectionRefused_base {
 }
 
-declare const TenantSelectionRefused_base: Schema.TaggedErrorClass<TenantSelectionRefused, "TenantSelectionRefused", {
-    readonly _tag: Schema.tag<"TenantSelectionRefused">;
-} & {
-    subjectType: typeof Schema.String;
-    subjectId: Schema.NullOr<typeof Schema.String>;
-    tenantId: typeof Schema.String;
-    reason: Schema.Literal<["not-a-member", "subject-has-no-tenant"]>;
-}>;
+declare const TenantSelectionRefused_base: Schema.Class<TenantSelectionRefused, Schema.TaggedStruct<"TenantSelectionRefused", {
+    readonly subjectType: Schema.String;
+    readonly subjectId: Schema.NullOr<Schema.String>;
+    readonly tenantId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["not-a-member", "subject-has-no-tenant"]>;
+}>, YieldableError>;
 
 /** Where `composeAuthStrategies` finds a stored selection. `@voltro/runtime`'s
  *  `tenantSelectionStore(store)` is the framework's implementation over the
@@ -6716,56 +6868,40 @@ export declare interface TenantSelectionStore {
     readonly clear: (identity: TenantSelectionIdentity) => Promise<void>;
 }
 
-export declare const toRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err> | MutationProcedureDescriptor<Name, Input, Output, Err> | ActionProcedureDescriptor<Name, Input, Output, Err> | StreamProcedureDescriptor<Name, Input, Output, Err>) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<[Schema.Struct<{
-    _tag: Schema.Literal<["snapshot"]>;
-    revision: typeof Schema.Number;
-    data: Output;
-    computed: Schema.optional<typeof Schema.Boolean>;
-    reconciles: Schema.optional<typeof Schema.String>;
+export declare const toRpc: <Name extends string, Input extends Schema.Top, Output extends Schema.Top, Err extends Schema.Top>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err> | MutationProcedureDescriptor<Name, Input, Output, Err> | ActionProcedureDescriptor<Name, Input, Output, Err> | StreamProcedureDescriptor<Name, Input, Output, Err>) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"snapshot">;
+    readonly revision: Schema.Number;
+    readonly data: Output;
+    readonly computed: Schema.optional<Schema.Boolean>;
+    readonly reconciles: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["delta"]>;
-    revision: typeof Schema.Number;
-    emittedAt: typeof Schema.Number;
-    patch: Schema.Struct<{
-        ops: Schema.Array$<Schema.Union<[Schema.Struct<{
-            op: Schema.Literal<["add"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+    readonly _tag: Schema.Literal<"delta">;
+    readonly revision: Schema.Number;
+    readonly emittedAt: Schema.Number;
+    readonly patch: Schema.Struct<{
+        readonly ops: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+            readonly op: Schema.Literal<"add">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["replace"]>;
-            path: typeof Schema.String;
-            value: Schema.refine<{
-                readonly [x: string]: unknown;
-            } & Readonly<Record<string, unknown>> & {
-                readonly id: RowId;
-            }, Schema.Schema<{
-                readonly [x: string]: unknown;
-            }, {
-                readonly [x: string]: unknown;
-            }, never>>;
+            readonly op: Schema.Literal<"replace">;
+            readonly path: Schema.String;
+            readonly value: Schema.refine< PatchRow, Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>>;
         }>, Schema.Struct<{
-            op: Schema.Literal<["remove"]>;
-            path: typeof Schema.String;
+            readonly op: Schema.Literal<"remove">;
+            readonly path: Schema.String;
         }>, Schema.Struct<{
-            op: Schema.Literal<["mergeCells"]>;
-            path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
+            readonly op: Schema.Literal<"mergeCells">;
+            readonly path: Schema.String;
+            readonly value: Schema.$Record<Schema.String, Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>>;
         }>]>>;
-        order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
+        readonly order: Schema.NullOr<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>>;
     }>;
 }>, Schema.Struct<{
-    _tag: Schema.Literal<["error"]>;
-    error: typeof Schema.Unknown;
-    revision: Schema.optional<typeof Schema.Number>;
-}>]>, Schema.Schema.All>, typeof Schema.Never, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Schema.All, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Output, Schema.Schema.All>, typeof Schema.Never, never>;
+    readonly _tag: Schema.Literal<"error">;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
+    readonly revision: Schema.optional<Schema.Number>;
+}>]>, Schema.Top>, Schema.Never, never, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Top, never, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Output, Schema.Top>, Schema.Never, never, never>;
 
 export declare const toSnakeCase: (key: string) => string;
 
@@ -6777,7 +6913,7 @@ export declare const tsMs: (v: unknown) => number;
 
 /**
  * Typed error every handler can throw to signal "you must be signed
- * in to perform this action". The framework's @effect/rpc layer
+ * in to perform this action". The framework's effect/rpc layer
  * preserves the `_tag` across the wire, and `@voltro/client`'s error
  * bus surfaces it to the consuming app so the dashboard can
  * auto-redirect to the sign-in page (cleared session + UI swap).
@@ -6787,14 +6923,13 @@ export declare const tsMs: (v: unknown) => number;
  * resolved at all" — anonymous, expired token, missing cookie, etc.
  */
 export declare class Unauthenticated extends Unauthenticated_base {
+    get message(): string;
 }
 
-declare const Unauthenticated_base: Schema.TaggedErrorClass<Unauthenticated, "Unauthenticated", {
-    readonly _tag: Schema.tag<"Unauthenticated">;
-} & {
+declare const Unauthenticated_base: Schema.Class<Unauthenticated, Schema.TaggedStruct<"Unauthenticated", {
     /** Optional context — e.g. "auth.signin required", "session expired". */
-    reason: Schema.optional<typeof Schema.String>;
-}>;
+    readonly reason: Schema.optional<Schema.String>;
+}>, YieldableError>;
 
 /**
  * Channel keys named by a `source:` that no `reactivityChannel()` declared.
@@ -6823,10 +6958,10 @@ export declare const UNDO_REDO_TAG: "__voltro.undo.redo";
  *  No `target` (it writes whatever tables the change-set touched — its effects
  *  reach the client via those tables' own reactive deltas, not optimistic). */
 export declare const undoApplyDescriptor: MutationProcedureDescriptor<"__voltro.undo.apply", Schema.Struct<{
-    invocationId: typeof Schema.String;
+    readonly invocationId: Schema.String;
 }>, Schema.Struct<{
-    ok: typeof Schema.Boolean;
-}>, Schema.Union<[typeof UndoNotFound, typeof UndoForbidden, typeof UndoConflict]>>;
+    readonly ok: Schema.Boolean;
+}>, Schema.Union<readonly [typeof UndoNotFound, typeof UndoForbidden, typeof UndoConflict]>>;
 
 /** The row changed since the action (a concurrent writer), OR the action
  *  crossed an external side effect — a blind restore would clobber/lie, so
@@ -6835,38 +6970,34 @@ export declare const undoApplyDescriptor: MutationProcedureDescriptor<"__voltro.
 export declare class UndoConflict extends UndoConflict_base {
 }
 
-declare const UndoConflict_base: Schema.TaggedErrorClass<UndoConflict, "UndoConflict", {
-    readonly _tag: Schema.tag<"UndoConflict">;
-} & {
-    invocationId: typeof Schema.String;
-    reason: Schema.Literal<["conflict", "action"]>;
-}>;
+declare const UndoConflict_base: Schema.Class<UndoConflict, Schema.TaggedStruct<"UndoConflict", {
+    readonly invocationId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["conflict", "action"]>;
+}>, YieldableError>;
 
 /** The action belongs to a different subject — undo is per-actor. */
 export declare class UndoForbidden extends UndoForbidden_base {
 }
 
-declare const UndoForbidden_base: Schema.TaggedErrorClass<UndoForbidden, "UndoForbidden", {
-    readonly _tag: Schema.tag<"UndoForbidden">;
-} & {
-    invocationId: typeof Schema.String;
-}>;
+declare const UndoForbidden_base: Schema.Class<UndoForbidden, Schema.TaggedStruct<"UndoForbidden", {
+    readonly invocationId: Schema.String;
+}>, YieldableError>;
 
 /** One undoable action in the calling subject's recent history. The heavy
  *  `changes` payload is server-only — the client list needs only this. */
 export declare const UndoLogEntry: Schema.Struct<{
     /** The invocation id (= the `_voltro_undo_log` row id) to pass to apply/redo. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** Rpc tag of the captured mutation (e.g. `todos.create`). */
-    tag: typeof Schema.String;
+    readonly tag: Schema.String;
     /** Human label ("create todo") — falls back to the tag. */
-    label: Schema.NullOr<typeof Schema.String>;
+    readonly label: Schema.NullOr<Schema.String>;
     /** True once undone (so the UI shows it as redo-able). */
-    undone: typeof Schema.Boolean;
+    readonly undone: Schema.Boolean;
     /** True when the action crossed an external side effect → not undoable. */
-    crossesAction: typeof Schema.Boolean;
+    readonly crossesAction: Schema.Boolean;
     /** Display-only creation time (stringified). */
-    createdAt: typeof Schema.String;
+    readonly createdAt: Schema.String;
 }>;
 
 export declare type UndoLogEntry = Schema.Schema.Type<typeof UndoLogEntry>;
@@ -6875,38 +7006,36 @@ export declare type UndoLogEntry = Schema.Schema.Type<typeof UndoLogEntry>;
  *  first. Reactive (source `_voltro_undo_log`) so the list updates live as the
  *  subject makes + undoes changes. */
 export declare const undoLogQueryDescriptor: QueryProcedureDescriptor<"__voltro.undo.log", Schema.Struct<{
-    limit: Schema.optional<typeof Schema.Number>;
-}>, Schema.Array$<Schema.Struct<{
+    readonly limit: Schema.optional<Schema.Number>;
+}>, Schema.$Array<Schema.Struct<{
     /** The invocation id (= the `_voltro_undo_log` row id) to pass to apply/redo. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** Rpc tag of the captured mutation (e.g. `todos.create`). */
-    tag: typeof Schema.String;
+    readonly tag: Schema.String;
     /** Human label ("create todo") — falls back to the tag. */
-    label: Schema.NullOr<typeof Schema.String>;
+    readonly label: Schema.NullOr<Schema.String>;
     /** True once undone (so the UI shows it as redo-able). */
-    undone: typeof Schema.Boolean;
+    readonly undone: Schema.Boolean;
     /** True when the action crossed an external side effect → not undoable. */
-    crossesAction: typeof Schema.Boolean;
+    readonly crossesAction: Schema.Boolean;
     /** Display-only creation time (stringified). */
-    createdAt: typeof Schema.String;
-}>>, typeof Schema.Never>;
+    readonly createdAt: Schema.String;
+}>>, Schema.Never>;
 
 /** No undo-log row for that invocation (already pruned, or wrong id). */
 export declare class UndoNotFound extends UndoNotFound_base {
 }
 
-declare const UndoNotFound_base: Schema.TaggedErrorClass<UndoNotFound, "UndoNotFound", {
-    readonly _tag: Schema.tag<"UndoNotFound">;
-} & {
-    invocationId: typeof Schema.String;
-}>;
+declare const UndoNotFound_base: Schema.Class<UndoNotFound, Schema.TaggedStruct<"UndoNotFound", {
+    readonly invocationId: Schema.String;
+}>, YieldableError>;
 
 /** `__voltro.undo.redo` — re-apply a previously-undone invocation's forward changes. */
 export declare const undoRedoDescriptor: MutationProcedureDescriptor<"__voltro.undo.redo", Schema.Struct<{
-    invocationId: typeof Schema.String;
+    readonly invocationId: Schema.String;
 }>, Schema.Struct<{
-    ok: typeof Schema.Boolean;
-}>, Schema.Union<[typeof UndoNotFound, typeof UndoForbidden, typeof UndoConflict]>>;
+    readonly ok: Schema.Boolean;
+}>, Schema.Union<readonly [typeof UndoNotFound, typeof UndoForbidden, typeof UndoConflict]>>;
 
 export declare interface UpdateTarget<Input = unknown, Row = unknown, Item = Record<string, unknown>> extends NestedTargetFields<Input> {
     readonly table: string;
@@ -6925,6 +7054,9 @@ export declare interface UpdateTarget<Input = unknown, Row = unknown, Item = Rec
     readonly shapeItem?: ((input: Input, current: Item) => Item) | undefined;
 }
 
+/** Refuse malformed runtime contributions before starting a worker. */
+export declare function validateOutboxHandlerDefinition(value: unknown, owner: string): asserts value is OutboxHandlerDefinition<unknown>;
+
 /**
  * A server-side validation failure pinned to ONE field.
  *
@@ -6936,13 +7068,11 @@ export declare interface UpdateTarget<Input = unknown, Row = unknown, Item = Rec
 export declare class ValidationError extends ValidationError_base {
 }
 
-declare const ValidationError_base: Schema.TaggedErrorClass<ValidationError, "ValidationError", {
-    readonly _tag: Schema.tag<"ValidationError">;
-} & {
-    field: typeof Schema.String;
-    message: typeof Schema.String;
-    params: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-}>;
+declare const ValidationError_base: Schema.Class<ValidationError, Schema.TaggedStruct<"ValidationError", {
+    readonly field: Schema.String;
+    readonly message: Schema.String;
+    readonly params: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>, YieldableError>;
 
 /** Several field-addressed failures at once — one round trip, every field
  *  marked. `issues` is non-empty by construction (`ctx.validation.failAll`
@@ -6950,23 +7080,21 @@ declare const ValidationError_base: Schema.TaggedErrorClass<ValidationError, "Va
 export declare class ValidationErrors extends ValidationErrors_base {
 }
 
-declare const ValidationErrors_base: Schema.TaggedErrorClass<ValidationErrors, "ValidationErrors", {
-    readonly _tag: Schema.tag<"ValidationErrors">;
-} & {
-    issues: Schema.filter<Schema.Array$<Schema.Struct<{
-        field: typeof Schema.String;
-        message: typeof Schema.String;
-        params: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    }>>>;
-}>;
+declare const ValidationErrors_base: Schema.Class<ValidationErrors, Schema.TaggedStruct<"ValidationErrors", {
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly field: Schema.String;
+        readonly message: Schema.String;
+        readonly params: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>, YieldableError>;
 
 /** One field-addressed validation issue: `field` is the form path
  *  (`'email'`, `'address.city'`, `'entries.0.startsAt'`), `message` is a
  *  message id (or verbatim text), `params` feed the message template. */
 export declare const ValidationIssue: Schema.Struct<{
-    field: typeof Schema.String;
-    message: typeof Schema.String;
-    params: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly field: Schema.String;
+    readonly message: Schema.String;
+    readonly params: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>;
 
 export declare type ValidationIssueShape = Schema.Schema.Type<typeof ValidationIssue>;
@@ -7104,7 +7232,7 @@ export declare interface VoltroPlugin {
      * the plugin will surface a config form in the dashboard, or when
      * the plugin reads dynamic config from env / a config file.
      */
-    readonly configSchema?: Schema.Schema.Any;
+    readonly configSchema?: Schema.Top;
     /**
      * Wraps every MUTATION handler call. Composed in declaration order
      * across the plugin list: outermost = first listed in app.config.ts.
@@ -7112,6 +7240,16 @@ export declare interface VoltroPlugin {
      * (schema-only / lifecycle-only plugins are fine).
      */
     readonly interceptMutation?: RpcInterceptor;
+    /** Runs after successful executor and business-rule evaluation, before the
+     * transaction commits. Use only the supplied store for required records or
+     * durable intents. External I/O is prohibited; transaction retries replay
+     * this hook. Requires rpc:intercept:mutation and store:write permissions.
+     * Ordinary RPC interceptors retain their existing outside-transaction scope. */
+    readonly beforeMutationCommit?: MutationCommitHook;
+    /** Post-commit delivery handlers, registered with the shared app worker in
+     * Dev and serve. Requires outbox:handle; effects must not collide with app,
+     * framework or other plugin contributions. Handlers must be idempotent. */
+    readonly outboxHandlers?: ReadonlyArray<OutboxHandlerDefinition<unknown>>;
     /**
      * Wraps every QUERY (streaming subscription handler) call. Same
      * composition semantics as `interceptMutation`. Most observability
@@ -7396,6 +7534,8 @@ export declare interface VoltroPlugin {
      * SDK here). Returns of `undefined`/empty are no-ops.
      */
     readonly contributeObservability?: (ctx: PluginLifecycleContext) => Promise<ObservabilityContribution | undefined> | ObservabilityContribution | undefined;
+    /** Enforce a hand-authored REST route's quota through this plugin. */
+    readonly restRateLimit?: RestServeBindings['rateLimit'];
     /**
      * Told the app's mounted REST surface — hand-authored `restRoutes` AND the
      * routes projected from `publicApi` annotations — once the boot has built it,
@@ -7592,11 +7732,11 @@ export declare const wireAudienceOf: (descriptor: {
  * paths. Pass the same `extraErrors` the lifter receives.
  */
 export declare const wireErrorUnion: (descriptor: {
-    readonly error: Schema.Schema.All;
+    readonly error: Schema.Top;
     readonly guards?: DeclaredAccess | undefined;
     readonly requiresApproval?: AnyApprovalPolicy | undefined;
     readonly idempotencyScope?: MutationIdempotencyScope | undefined;
-}, kind: "query" | "mutation" | "action" | "stream", extraErrors?: ExtraErrors) => Schema.Schema.All;
+}, kind: "query" | "mutation" | "action" | "stream", extraErrors?: ExtraErrors) => Schema.Top;
 
 /** A procedure kind that has a wire error union. */
 export declare type WireProcedureKind = keyof typeof FRAMEWORK_WIRE_ERRORS;
@@ -7730,45 +7870,41 @@ export declare interface WorkflowAccessOptions<Payload = unknown> {
 export declare const WorkflowAccessProperty: unique symbol;
 
 export declare const workflowCancelDescriptor: ActionProcedureDescriptor<"__voltro.workflow.cancel", Schema.Struct<{
-    workflowName: typeof Schema.String;
-    executionId: typeof Schema.String;
-    control: Schema.optional<Schema.Struct<{
-        requestId: typeof Schema.NonEmptyString;
-        cause: Schema.optionalWith<Schema.Struct<{
-            reason: typeof Schema.NonEmptyString;
-            detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-        }>, {
-            exact: true;
-        }>;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.String;
+    readonly control: Schema.optional<Schema.Struct<{
+        readonly requestId: Schema.NonEmptyString;
+        readonly cause: Schema.optionalKey<Schema.Struct<{
+            readonly reason: Schema.NonEmptyString;
+            readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        }>>;
     }>>;
-}>, Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel", "resume"]>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    snapshot: Schema.Struct<{
-        id: typeof Schema.String;
-        workflowName: typeof Schema.String;
-        executionId: typeof Schema.String;
-        status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-        output: Schema.optional<typeof Schema.Unknown>;
-        error: Schema.optional<Schema.Struct<{
-            tag: Schema.NullOr<typeof Schema.String>;
-            message: typeof Schema.String;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly snapshot: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workflowName: Schema.String;
+        readonly executionId: Schema.String;
+        readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+        readonly output: Schema.optional<Schema.Unknown>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly tag: Schema.NullOr<Schema.String>;
+            readonly message: Schema.String;
         }>>;
     }>;
-}>>, typeof Schema.Never>;
+}>, Schema.Never>;
 
 export declare const WorkflowControlInputSchema: Schema.Struct<{
-    workflowName: typeof Schema.String;
-    executionId: typeof Schema.String;
-    control: Schema.optional<Schema.Struct<{
-        requestId: typeof Schema.NonEmptyString;
-        cause: Schema.optionalWith<Schema.Struct<{
-            reason: typeof Schema.NonEmptyString;
-            detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-        }>, {
-            exact: true;
-        }>;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.String;
+    readonly control: Schema.optional<Schema.Struct<{
+        readonly requestId: Schema.NonEmptyString;
+        readonly cause: Schema.optionalKey<Schema.Struct<{
+            readonly reason: Schema.NonEmptyString;
+            readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        }>>;
     }>>;
 }>;
 
@@ -7776,616 +7912,608 @@ export declare type WorkflowControlIntent = Schema.Schema.Type<typeof WorkflowCo
 
 /** Stable caller-owned intent for retry after an uncertain transport result. */
 export declare const WorkflowControlIntentSchema: Schema.Struct<{
-    requestId: typeof Schema.NonEmptyString;
-    cause: Schema.optionalWith<Schema.Struct<{
-        reason: typeof Schema.NonEmptyString;
-        detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    }>, {
-        exact: true;
-    }>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly cause: Schema.optionalKey<Schema.Struct<{
+        readonly reason: Schema.NonEmptyString;
+        readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
 }>;
 
 export declare const workflowControlQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.control", Schema.Struct<{
-    workflowName: typeof Schema.NonEmptyString;
-    executionId: typeof Schema.NonEmptyString;
-    operation: Schema.Literal<["cancel", "resume"]>;
-    requestId: typeof Schema.NonEmptyString;
-}>, Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel", "resume"]>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    snapshot: Schema.Struct<{
-        id: typeof Schema.String;
-        workflowName: typeof Schema.String;
-        executionId: typeof Schema.String;
-        status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-        output: Schema.optional<typeof Schema.Unknown>;
-        error: Schema.optional<Schema.Struct<{
-            tag: Schema.NullOr<typeof Schema.String>;
-            message: typeof Schema.String;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly requestId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly snapshot: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workflowName: Schema.String;
+        readonly executionId: Schema.String;
+        readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+        readonly output: Schema.optional<Schema.Unknown>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly tag: Schema.NullOr<Schema.String>;
+            readonly message: Schema.String;
         }>>;
     }>;
-}>>, typeof Schema.Never>;
+}>, Schema.Never>;
 
 export declare type WorkflowControlReadInput = Schema.Schema.Type<typeof WorkflowControlReadInputSchema>;
 
 export declare const WorkflowControlReadInputSchema: Schema.Struct<{
-    workflowName: typeof Schema.NonEmptyString;
-    executionId: typeof Schema.NonEmptyString;
-    operation: Schema.Literal<["cancel", "resume"]>;
-    requestId: typeof Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly requestId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowControlResult = Schema.Schema.Type<typeof WorkflowControlResultSchema>;
 
 /** Acceptance is not execution completion; null means no resident receipt. */
-export declare const WorkflowControlResultSchema: Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel", "resume"]>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    snapshot: Schema.Struct<{
-        id: typeof Schema.String;
-        workflowName: typeof Schema.String;
-        executionId: typeof Schema.String;
-        status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-        output: Schema.optional<typeof Schema.Unknown>;
-        error: Schema.optional<Schema.Struct<{
-            tag: Schema.NullOr<typeof Schema.String>;
-            message: typeof Schema.String;
+export declare const WorkflowControlResultSchema: Schema.Struct<{
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly snapshot: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workflowName: Schema.String;
+        readonly executionId: Schema.String;
+        readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+        readonly output: Schema.optional<Schema.Unknown>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly tag: Schema.NullOr<Schema.String>;
+            readonly message: Schema.String;
         }>>;
     }>;
-}>>;
+}>;
 
 export declare type WorkflowDomainEventRow = Schema.Schema.Type<typeof WorkflowDomainEventRowSchema>;
 
 export declare const WorkflowDomainEventRowSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    name: typeof Schema.String;
-    payload: typeof Schema.Unknown;
-    source: typeof Schema.String;
-    subject: Schema.NullOr<typeof Schema.Unknown>;
-    traceId: Schema.NullOr<typeof Schema.String>;
-    occurredAt: typeof Schema.Date;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly payload: Schema.Unknown;
+    readonly source: Schema.String;
+    readonly subject: Schema.NullOr<Schema.Unknown>;
+    readonly traceId: Schema.NullOr<Schema.String>;
+    readonly occurredAt: Schema.DateFromString;
 }>;
 
 export declare const WorkflowDomainEventsInputSchema: Schema.Struct<{
-    name: Schema.optional<typeof Schema.String>;
-    limit: Schema.optional<typeof Schema.Number>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.Number>;
 }>;
 
 export declare const workflowDomainEventsQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.domainEvents", Schema.Struct<{
-    name: Schema.optional<typeof Schema.String>;
-    limit: Schema.optional<typeof Schema.Number>;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    name: typeof Schema.String;
-    payload: typeof Schema.Unknown;
-    source: typeof Schema.String;
-    subject: Schema.NullOr<typeof Schema.Unknown>;
-    traceId: Schema.NullOr<typeof Schema.String>;
-    occurredAt: typeof Schema.Date;
-}>>, typeof Schema.Never>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.Number>;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly payload: Schema.Unknown;
+    readonly source: Schema.String;
+    readonly subject: Schema.NullOr<Schema.Unknown>;
+    readonly traceId: Schema.NullOr<Schema.String>;
+    readonly occurredAt: Schema.DateFromString;
+}>>, Schema.Never>;
 
 export declare const WorkflowEventDeliveriesInputSchema: Schema.Struct<{
-    eventId: typeof Schema.String;
+    readonly eventId: Schema.String;
 }>;
 
 export declare const workflowEventDeliveriesQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.event.deliveries", Schema.Struct<{
-    eventId: typeof Schema.String;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    eventId: typeof Schema.String;
-    eventName: typeof Schema.String;
-    triggerId: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    executionId: Schema.NullOr<typeof Schema.String>;
-    status: Schema.Literal<["starting", "started", "skipped", "failed"]>;
-    idempotencyKey: typeof Schema.String;
-    skipped: typeof Schema.Boolean;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    createdAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-}>>, typeof Schema.Never>;
+    readonly eventId: Schema.String;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly eventId: Schema.String;
+    readonly eventName: Schema.String;
+    readonly triggerId: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly status: Schema.Literals<readonly ["starting", "started", "skipped", "failed"]>;
+    readonly idempotencyKey: Schema.String;
+    readonly skipped: Schema.Boolean;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+}>>, Schema.Never>;
 
 export declare type WorkflowEventDeliveryRow = Schema.Schema.Type<typeof WorkflowEventDeliveryRowSchema>;
 
 export declare const WorkflowEventDeliveryRowSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    eventId: typeof Schema.String;
-    eventName: typeof Schema.String;
-    triggerId: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    executionId: Schema.NullOr<typeof Schema.String>;
-    status: Schema.Literal<["starting", "started", "skipped", "failed"]>;
-    idempotencyKey: typeof Schema.String;
-    skipped: typeof Schema.Boolean;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    createdAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
+    readonly id: Schema.String;
+    readonly eventId: Schema.String;
+    readonly eventName: Schema.String;
+    readonly triggerId: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly status: Schema.Literals<readonly ["starting", "started", "skipped", "failed"]>;
+    readonly idempotencyKey: Schema.String;
+    readonly skipped: Schema.Boolean;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
 }>;
 
 export declare type WorkflowParentClosePolicy = Schema.Schema.Type<typeof WorkflowParentClosePolicySchema>;
 
-export declare const WorkflowParentClosePolicySchema: Schema.Literal<["cancel", "terminate", "abandon"]>;
+export declare const WorkflowParentClosePolicySchema: Schema.Literals<readonly ["cancel", "terminate", "abandon"]>;
 
 export declare const workflowQueuedCancelDescriptor: ActionProcedureDescriptor<"__voltro.workflow.queued.cancel", Schema.Struct<{
-    cause: Schema.optionalWith<Schema.Struct<{
-        reason: typeof Schema.NonEmptyString;
-        detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    }>, {
-        exact: true;
-    }>;
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
-}>, Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel"]>;
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    observation: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["pending"]>;
+    readonly cause: Schema.optionalKey<Schema.Struct<{
+        readonly reason: Schema.NonEmptyString;
+        readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literal<"cancel">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly observation: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"pending">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["admission"]>;
-        outcome: Schema.Union<[Schema.Union<[Schema.Struct<{
-            kind: Schema.Literal<["dropped"]>;
-            at: typeof Schema.Number;
-            retryAfterMs: typeof Schema.Number;
+        readonly kind: Schema.Literal<"admission">;
+        readonly outcome: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"dropped">;
+            readonly at: Schema.Number;
+            readonly retryAfterMs: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["skipped"]>;
-            at: typeof Schema.Number;
-            executionId: typeof Schema.String;
-            runId: typeof Schema.String;
+            readonly kind: Schema.Literal<"skipped">;
+            readonly at: Schema.Number;
+            readonly executionId: Schema.String;
+            readonly runId: Schema.String;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["superseded"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"superseded">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["cancelled"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"cancelled">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["abandoned"]>;
-            at: typeof Schema.Number;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"abandoned">;
+            readonly at: Schema.Number;
+            readonly failureId: Schema.NonEmptyString;
         }>]>, Schema.Struct<{
-            kind: Schema.Literal<["rejected"]>;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"rejected">;
+            readonly failureId: Schema.NonEmptyString;
         }>]>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["execution"]>;
-        snapshot: Schema.Struct<{
-            id: typeof Schema.String;
-            workflowName: typeof Schema.String;
-            executionId: typeof Schema.String;
-            status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-            output: Schema.optional<typeof Schema.Unknown>;
-            error: Schema.optional<Schema.Struct<{
-                tag: Schema.NullOr<typeof Schema.String>;
-                message: typeof Schema.String;
+        readonly kind: Schema.Literal<"execution">;
+        readonly snapshot: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly workflowName: Schema.String;
+            readonly executionId: Schema.String;
+            readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+            readonly output: Schema.optional<Schema.Unknown>;
+            readonly error: Schema.optional<Schema.Struct<{
+                readonly tag: Schema.NullOr<Schema.String>;
+                readonly message: Schema.String;
             }>>;
         }>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["unavailable"]>;
-        reason: Schema.Literal<["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
+        readonly kind: Schema.Literal<"unavailable">;
+        readonly reason: Schema.Literals<readonly ["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
     }>]>;
-}>>, typeof Schema.Never>;
+}>, Schema.Never>;
 
 export declare type WorkflowQueuedCancelInput = typeof WorkflowQueuedCancelInputSchema.Type;
 
 export declare const WorkflowQueuedCancelInputSchema: Schema.Struct<{
-    cause: Schema.optionalWith<Schema.Struct<{
-        reason: typeof Schema.NonEmptyString;
-        detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    }>, {
-        exact: true;
-    }>;
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
+    readonly cause: Schema.optionalKey<Schema.Struct<{
+        readonly reason: Schema.NonEmptyString;
+        readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowQueuedCancellationResult = typeof WorkflowQueuedCancellationResultSchema.Type;
 
 /** A queued caller has a receipt before any execution exists. Keep admission
  * evidence separate from an observed execution rather than fabricating IDs. */
-export declare const WorkflowQueuedCancellationResultSchema: Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel"]>;
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    observation: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["pending"]>;
+export declare const WorkflowQueuedCancellationResultSchema: Schema.Struct<{
+    readonly operation: Schema.Literal<"cancel">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly observation: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"pending">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["admission"]>;
-        outcome: Schema.Union<[Schema.Union<[Schema.Struct<{
-            kind: Schema.Literal<["dropped"]>;
-            at: typeof Schema.Number;
-            retryAfterMs: typeof Schema.Number;
+        readonly kind: Schema.Literal<"admission">;
+        readonly outcome: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"dropped">;
+            readonly at: Schema.Number;
+            readonly retryAfterMs: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["skipped"]>;
-            at: typeof Schema.Number;
-            executionId: typeof Schema.String;
-            runId: typeof Schema.String;
+            readonly kind: Schema.Literal<"skipped">;
+            readonly at: Schema.Number;
+            readonly executionId: Schema.String;
+            readonly runId: Schema.String;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["superseded"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"superseded">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["cancelled"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"cancelled">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["abandoned"]>;
-            at: typeof Schema.Number;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"abandoned">;
+            readonly at: Schema.Number;
+            readonly failureId: Schema.NonEmptyString;
         }>]>, Schema.Struct<{
-            kind: Schema.Literal<["rejected"]>;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"rejected">;
+            readonly failureId: Schema.NonEmptyString;
         }>]>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["execution"]>;
-        snapshot: Schema.Struct<{
-            id: typeof Schema.String;
-            workflowName: typeof Schema.String;
-            executionId: typeof Schema.String;
-            status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-            output: Schema.optional<typeof Schema.Unknown>;
-            error: Schema.optional<Schema.Struct<{
-                tag: Schema.NullOr<typeof Schema.String>;
-                message: typeof Schema.String;
+        readonly kind: Schema.Literal<"execution">;
+        readonly snapshot: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly workflowName: Schema.String;
+            readonly executionId: Schema.String;
+            readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+            readonly output: Schema.optional<Schema.Unknown>;
+            readonly error: Schema.optional<Schema.Struct<{
+                readonly tag: Schema.NullOr<Schema.String>;
+                readonly message: Schema.String;
             }>>;
         }>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["unavailable"]>;
-        reason: Schema.Literal<["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
+        readonly kind: Schema.Literal<"unavailable">;
+        readonly reason: Schema.Literals<readonly ["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
     }>]>;
-}>>;
+}>;
 
 export declare const workflowQueuedControlQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.queued.control", Schema.Struct<{
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
-}>, Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel"]>;
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    observation: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["pending"]>;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literal<"cancel">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly observation: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"pending">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["admission"]>;
-        outcome: Schema.Union<[Schema.Union<[Schema.Struct<{
-            kind: Schema.Literal<["dropped"]>;
-            at: typeof Schema.Number;
-            retryAfterMs: typeof Schema.Number;
+        readonly kind: Schema.Literal<"admission">;
+        readonly outcome: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"dropped">;
+            readonly at: Schema.Number;
+            readonly retryAfterMs: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["skipped"]>;
-            at: typeof Schema.Number;
-            executionId: typeof Schema.String;
-            runId: typeof Schema.String;
+            readonly kind: Schema.Literal<"skipped">;
+            readonly at: Schema.Number;
+            readonly executionId: Schema.String;
+            readonly runId: Schema.String;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["superseded"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"superseded">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["cancelled"]>;
-            at: typeof Schema.Number;
+            readonly kind: Schema.Literal<"cancelled">;
+            readonly at: Schema.Number;
         }>, Schema.Struct<{
-            kind: Schema.Literal<["abandoned"]>;
-            at: typeof Schema.Number;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"abandoned">;
+            readonly at: Schema.Number;
+            readonly failureId: Schema.NonEmptyString;
         }>]>, Schema.Struct<{
-            kind: Schema.Literal<["rejected"]>;
-            failureId: typeof Schema.NonEmptyString;
+            readonly kind: Schema.Literal<"rejected">;
+            readonly failureId: Schema.NonEmptyString;
         }>]>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["execution"]>;
-        snapshot: Schema.Struct<{
-            id: typeof Schema.String;
-            workflowName: typeof Schema.String;
-            executionId: typeof Schema.String;
-            status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-            output: Schema.optional<typeof Schema.Unknown>;
-            error: Schema.optional<Schema.Struct<{
-                tag: Schema.NullOr<typeof Schema.String>;
-                message: typeof Schema.String;
+        readonly kind: Schema.Literal<"execution">;
+        readonly snapshot: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly workflowName: Schema.String;
+            readonly executionId: Schema.String;
+            readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+            readonly output: Schema.optional<Schema.Unknown>;
+            readonly error: Schema.optional<Schema.Struct<{
+                readonly tag: Schema.NullOr<Schema.String>;
+                readonly message: Schema.String;
             }>>;
         }>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["unavailable"]>;
-        reason: Schema.Literal<["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
+        readonly kind: Schema.Literal<"unavailable">;
+        readonly reason: Schema.Literals<readonly ["missing-request", "missing-run", "unconfirmed-generation", "unbound-submission"]>;
     }>]>;
-}>>, typeof Schema.Never>;
+}>, Schema.Never>;
 
 export declare type WorkflowQueuedControlTarget = typeof WorkflowQueuedControlTargetSchema.Type;
 
 export declare const WorkflowQueuedControlTargetSchema: Schema.Struct<{
-    workflowName: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowRestartCommand = typeof WorkflowRestartCommandSchema.Type;
 
 export declare const WorkflowRestartCommandSchema: Schema.Struct<{
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowRestartObservation = typeof WorkflowRestartObservationSchema.Type;
 
 /** Pending is a durable reservation, not proof of reset or engine entry.
  * Entered confirms this command's generation; it does not claim run success. */
-export declare const WorkflowRestartObservationSchema: Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["not-found"]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+export declare const WorkflowRestartObservationSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"not-found">;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["withdrawn"]>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    withdrawnAt: Schema.filter<typeof Schema.Number>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly kind: Schema.Literal<"withdrawn">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly withdrawnAt: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["pending"]>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    executionId: Schema.filter<typeof Schema.NonEmptyString>;
-    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    requestedAt: Schema.filter<typeof Schema.Number>;
-    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly kind: Schema.Literal<"pending">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly originalGeneration: Schema.NonEmptyString;
+    readonly requestedAt: Schema.Number;
+    readonly dispatchAttempts: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-}>, Schema.filter<Schema.Struct<{
-    kind: Schema.Literal<["entered"]>;
-    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    executionId: Schema.filter<typeof Schema.NonEmptyString>;
-    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    requestedAt: Schema.filter<typeof Schema.Number>;
-    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"entered">;
+    readonly enteredGeneration: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly originalGeneration: Schema.NonEmptyString;
+    readonly requestedAt: Schema.Number;
+    readonly dispatchAttempts: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-}>>]>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
+}>]>;
 
 export declare type WorkflowRestartResult = typeof WorkflowRestartResultSchema.Type;
 
 /** A refused reservation never reset the journal. Transport failures instead
  * require reading the original target; they are not proof of refusal. */
-export declare const WorkflowRestartResultSchema: Schema.Union<[Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["not-found"]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+export declare const WorkflowRestartResultSchema: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"not-found">;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["withdrawn"]>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    withdrawnAt: Schema.filter<typeof Schema.Number>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly kind: Schema.Literal<"withdrawn">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly withdrawnAt: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["pending"]>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    executionId: Schema.filter<typeof Schema.NonEmptyString>;
-    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    requestedAt: Schema.filter<typeof Schema.Number>;
-    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly kind: Schema.Literal<"pending">;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly originalGeneration: Schema.NonEmptyString;
+    readonly requestedAt: Schema.Number;
+    readonly dispatchAttempts: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-}>, Schema.filter<Schema.Struct<{
-    kind: Schema.Literal<["entered"]>;
-    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
-    executionId: Schema.filter<typeof Schema.NonEmptyString>;
-    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
-    requestedAt: Schema.filter<typeof Schema.Number>;
-    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
-    selection: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["failed-steps"]>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"entered">;
+    readonly enteredGeneration: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly executionId: Schema.NonEmptyString;
+    readonly originalGeneration: Schema.NonEmptyString;
+    readonly requestedAt: Schema.Number;
+    readonly dispatchAttempts: Schema.Number;
+    readonly selection: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"failed-steps">;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["from-step"]>;
-        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+        readonly kind: Schema.Literal<"from-step">;
+        readonly stepName: Schema.NonEmptyString;
     }>]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-}>>]>, Schema.Struct<{
-    kind: Schema.Literal<["not-reserved"]>;
-    reason: Schema.Literal<["admission", "journal"]>;
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
+}>]>, Schema.Struct<{
+    readonly kind: Schema.Literal<"not-reserved">;
+    readonly reason: Schema.Literals<readonly ["admission", "journal"]>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>]>;
 
 export declare type WorkflowRestartSelection = typeof WorkflowRestartSelectionSchema.Type;
 
-export declare const WorkflowRestartSelectionSchema: Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["failed-steps"]>;
+export declare const WorkflowRestartSelectionSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"failed-steps">;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["from-step"]>;
-    stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly kind: Schema.Literal<"from-step">;
+    readonly stepName: Schema.NonEmptyString;
 }>]>;
 
 export declare type WorkflowRestartTarget = typeof WorkflowRestartTargetSchema.Type;
 
 /** Persist before submitting; read this same target after an uncertain reply. */
 export declare const WorkflowRestartTargetSchema: Schema.Struct<{
-    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly runId: Schema.NonEmptyString;
 }>;
 
 export declare const workflowResumeDescriptor: ActionProcedureDescriptor<"__voltro.workflow.resume", Schema.Struct<{
-    workflowName: typeof Schema.String;
-    executionId: typeof Schema.String;
-    control: Schema.optional<Schema.Struct<{
-        requestId: typeof Schema.NonEmptyString;
-        cause: Schema.optionalWith<Schema.Struct<{
-            reason: typeof Schema.NonEmptyString;
-            detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-        }>, {
-            exact: true;
-        }>;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.String;
+    readonly control: Schema.optional<Schema.Struct<{
+        readonly requestId: Schema.NonEmptyString;
+        readonly cause: Schema.optionalKey<Schema.Struct<{
+            readonly reason: Schema.NonEmptyString;
+            readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        }>>;
     }>>;
-}>, Schema.filter<Schema.Struct<{
-    operation: Schema.Literal<["cancel", "resume"]>;
-    kind: Schema.Literal<["accepted", "confirmed", "unknown", "already-terminal"]>;
-    requestId: Schema.NullOr<typeof Schema.NonEmptyString>;
-    snapshot: Schema.Struct<{
-        id: typeof Schema.String;
-        workflowName: typeof Schema.String;
-        executionId: typeof Schema.String;
-        status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-        output: Schema.optional<typeof Schema.Unknown>;
-        error: Schema.optional<Schema.Struct<{
-            tag: Schema.NullOr<typeof Schema.String>;
-            message: typeof Schema.String;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literals<readonly ["cancel", "resume"]>;
+    readonly kind: Schema.Literals<readonly ["accepted", "confirmed", "unknown", "already-terminal"]>;
+    readonly requestId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly snapshot: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workflowName: Schema.String;
+        readonly executionId: Schema.String;
+        readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+        readonly output: Schema.optional<Schema.Unknown>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly tag: Schema.NullOr<Schema.String>;
+            readonly message: Schema.String;
         }>>;
     }>;
-}>>, typeof Schema.Never>;
+}>, Schema.Never>;
 
 export declare type WorkflowRetryCommand = typeof WorkflowRetryCommandSchema.Type;
 
 /** Transport input for one deliberate retry; ownership is resolved server-side.
  * The optional override is encoded with the complete workflow payload schema. */
 export declare const WorkflowRetryCommandSchema: Schema.Struct<{
-    payloadOverride: Schema.optional<typeof Schema.Unknown>;
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-    requestId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly payloadOverride: Schema.optional<Schema.Unknown>;
+    readonly runId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowRetryObservation = typeof WorkflowRetryObservationSchema.Type;
 
 /** Observation of one durable retry intent. Engine acceptance is not workflow
  * completion. A prepared identity alone never proves that execution started. */
-export declare const WorkflowRetryObservationSchema: Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["queued"]>;
-    nextAttemptAt: Schema.NullOr<typeof Schema.Number>;
-    requestId: typeof Schema.NonEmptyString;
-    originalRunId: typeof Schema.NonEmptyString;
-    originalExecutionId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
-}>, Schema.filter<Schema.Struct<{
-    kind: Schema.Literal<["accepted"]>;
-    executionId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
-    originalRunId: typeof Schema.NonEmptyString;
-    originalExecutionId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
-}>>, Schema.filter<Schema.Struct<{
-    kind: Schema.Literal<["unconfirmed"]>;
-    automaticRetryStopped: typeof Schema.Boolean;
-    nextAttemptAt: Schema.NullOr<typeof Schema.Number>;
-    requestId: typeof Schema.NonEmptyString;
-    originalRunId: typeof Schema.NonEmptyString;
-    originalExecutionId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
-}>>, Schema.Struct<{
-    kind: Schema.Literal<["not-started"]>;
-    outcome: Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["dropped"]>;
-        at: typeof Schema.Number;
-        retryAfterMs: typeof Schema.Number;
+export declare const WorkflowRetryObservationSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"queued">;
+    readonly nextAttemptAt: Schema.NullOr<Schema.Number>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly originalRunId: Schema.NonEmptyString;
+    readonly originalExecutionId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"accepted">;
+    readonly executionId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+    readonly originalRunId: Schema.NonEmptyString;
+    readonly originalExecutionId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"unconfirmed">;
+    readonly automaticRetryStopped: Schema.Boolean;
+    readonly nextAttemptAt: Schema.NullOr<Schema.Number>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly originalRunId: Schema.NonEmptyString;
+    readonly originalExecutionId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"not-started">;
+    readonly outcome: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"dropped">;
+        readonly at: Schema.Number;
+        readonly retryAfterMs: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["skipped"]>;
-        at: typeof Schema.Number;
-        executionId: typeof Schema.String;
-        runId: typeof Schema.String;
+        readonly kind: Schema.Literal<"skipped">;
+        readonly at: Schema.Number;
+        readonly executionId: Schema.String;
+        readonly runId: Schema.String;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["superseded"]>;
-        at: typeof Schema.Number;
+        readonly kind: Schema.Literal<"superseded">;
+        readonly at: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["cancelled"]>;
-        at: typeof Schema.Number;
+        readonly kind: Schema.Literal<"cancelled">;
+        readonly at: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["abandoned"]>;
-        at: typeof Schema.Number;
-        failureId: typeof Schema.NonEmptyString;
+        readonly kind: Schema.Literal<"abandoned">;
+        readonly at: Schema.Number;
+        readonly failureId: Schema.NonEmptyString;
     }>]>;
-    requestId: typeof Schema.NonEmptyString;
-    originalRunId: typeof Schema.NonEmptyString;
-    originalExecutionId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+    readonly originalRunId: Schema.NonEmptyString;
+    readonly originalExecutionId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["rejected"]>;
-    failureId: typeof Schema.NonEmptyString;
-    requestId: typeof Schema.NonEmptyString;
-    originalRunId: typeof Schema.NonEmptyString;
-    originalExecutionId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
+    readonly kind: Schema.Literal<"rejected">;
+    readonly failureId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+    readonly originalRunId: Schema.NonEmptyString;
+    readonly originalExecutionId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
 }>]>;
 
 export declare type WorkflowRetryTarget = typeof WorkflowRetryTargetSchema.Type;
 
 /** Persist the request ID before sending. Reuse this target after a lost reply. */
 export declare const WorkflowRetryTargetSchema: Schema.Struct<{
-    runId: Schema.filter<typeof Schema.NonEmptyString>;
-    requestId: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly runId: Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
 }>;
 
 export declare type WorkflowRunEventRow = Schema.Schema.Type<typeof WorkflowRunEventRowSchema>;
 
 export declare const WorkflowRunEventRowSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    runId: typeof Schema.String;
-    eventType: typeof Schema.String;
-    payload: Schema.NullOr<typeof Schema.Unknown>;
-    occurredAt: typeof Schema.Date;
-    stepName: Schema.NullOr<typeof Schema.String>;
-    attempt: Schema.NullOr<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly eventType: Schema.String;
+    readonly payload: Schema.NullOr<Schema.Unknown>;
+    readonly occurredAt: Schema.DateFromString;
+    readonly stepName: Schema.NullOr<Schema.String>;
+    readonly attempt: Schema.NullOr<Schema.Number>;
 }>;
 
 export declare const workflowRunEventsQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.run.events", Schema.Struct<{
     /** `_voltro_workflow_runs.id`; step/event rows reference this id. */
-    runId: typeof Schema.String;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    runId: typeof Schema.String;
-    eventType: typeof Schema.String;
-    payload: Schema.NullOr<typeof Schema.Unknown>;
-    occurredAt: typeof Schema.Date;
-    stepName: Schema.NullOr<typeof Schema.String>;
-    attempt: Schema.NullOr<typeof Schema.Number>;
-}>>, typeof Schema.Never>;
+    readonly runId: Schema.String;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly eventType: Schema.String;
+    readonly payload: Schema.NullOr<Schema.Unknown>;
+    readonly occurredAt: Schema.DateFromString;
+    readonly stepName: Schema.NullOr<Schema.String>;
+    readonly attempt: Schema.NullOr<Schema.Number>;
+}>>, Schema.Never>;
 
 export declare type WorkflowRunHandle = Schema.Schema.Type<typeof WorkflowRunHandleSchema>;
 
 export declare const WorkflowRunHandleSchema: Schema.Struct<{
     /** Stable handle callers pass to `useWorkflowRun(...)`. The durable execution
      *  id for a started run; the durable caller-receipt id for a queued one. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** Workflow tag, e.g. `notes.summarise`. */
-    workflowName: typeof Schema.String;
+    readonly workflowName: Schema.String;
     /**
      * Deterministic durable id derived from workflow name + idempotency key.
      *
@@ -8399,7 +8527,7 @@ export declare const WorkflowRunHandleSchema: Schema.Struct<{
      * For a `skipped` singleton it is the INCUMBENT's execution id — a real,
      * pollable run, which is the entire point of `mode: 'skip'`.
      */
-    executionId: Schema.NullOr<typeof Schema.String>;
+    readonly executionId: Schema.NullOr<Schema.String>;
     /**
      * `running`  — the engine has it; starting is fire-and-return.
      * `succeeded` — a blocking start observed successful completion.
@@ -8415,8 +8543,8 @@ export declare const WorkflowRunHandleSchema: Schema.Struct<{
      * a fresh start; a schedule keyed per day ran once and reported forty-seven
      * "starts" that were replays. See `workflow()`'s `idempotencyKey` doc.
      */
-    status: Schema.Literal<["running", "succeeded", "queued", "dropped", "skipped", "replayed"]>;
-    deferral: Schema.optional<Schema.Struct<{
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "queued", "dropped", "skipped", "replayed"]>;
+    readonly deferral: Schema.optional<Schema.Struct<{
         /** `debounce` | `batch` | `throttle` | `concurrency` | `paused` |
          *  `rateLimit` | `singleton` | `delayed` | `transaction` | `unacknowledged`.
          *
@@ -8424,179 +8552,179 @@ export declare const WorkflowRunHandleSchema: Schema.Struct<{
          *  back. The engine may have it; recovery retries the dispatch and binds the
          *  receipt (`id`) to whatever run results. It is not a failure: do not
          *  report one to a user, follow the receipt. */
-        mode: typeof Schema.String;
+        readonly mode: Schema.String;
         /** Epoch ms this may first be admitted. Null for a drop or a skip. */
-        dueAt: Schema.NullOr<typeof Schema.Number>;
+        readonly dueAt: Schema.NullOr<Schema.Number>;
         /** How long until the rate window reopens. Null unless dropped. */
-        retryAfterMs: Schema.NullOr<typeof Schema.Number>;
+        readonly retryAfterMs: Schema.NullOr<Schema.Number>;
         /** The `_voltro_workflow_pending` row holding this start. Null unless queued. */
-        intentId: Schema.NullOr<typeof Schema.String>;
+        readonly intentId: Schema.NullOr<Schema.String>;
     }>>;
 }>;
 
 export declare const workflowRunQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.run", Schema.Struct<{
     /** `_voltro_workflow_runs.id` OR durable `executionId`. */
-    id: typeof Schema.String;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    tag: typeof Schema.String;
-    executionId: typeof Schema.String;
-    status: Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>;
-    payload: typeof Schema.Unknown;
-    workflowVersion: Schema.NullOr<typeof Schema.String>;
-    workflowPatches: Schema.NullOr<typeof Schema.Unknown>;
-    output: Schema.NullOr<typeof Schema.Unknown>;
-    subject: Schema.NullOr<typeof Schema.Unknown>;
-    source: Schema.NullOr<typeof Schema.String>;
-    errorTag: Schema.NullOr<typeof Schema.String>;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    cancelled: typeof Schema.Boolean;
-    startedAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-    durationMs: Schema.NullOr<typeof Schema.Number>;
-    traceId: Schema.NullOr<typeof Schema.String>;
-    parentExecutionId: Schema.NullOr<typeof Schema.String>;
-    parentClosePolicy: Schema.NullOr<Schema.Literal<["cancel", "terminate", "abandon"]>>;
-}>>, typeof Schema.Never>;
+    readonly id: Schema.String;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly tag: Schema.String;
+    readonly executionId: Schema.String;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>;
+    readonly payload: Schema.Unknown;
+    readonly workflowVersion: Schema.NullOr<Schema.String>;
+    readonly workflowPatches: Schema.NullOr<Schema.Unknown>;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly subject: Schema.NullOr<Schema.Unknown>;
+    readonly source: Schema.NullOr<Schema.String>;
+    readonly errorTag: Schema.NullOr<Schema.String>;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly cancelled: Schema.Boolean;
+    readonly startedAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
+    readonly traceId: Schema.NullOr<Schema.String>;
+    readonly parentExecutionId: Schema.NullOr<Schema.String>;
+    readonly parentClosePolicy: Schema.NullOr<Schema.Literals<readonly ["cancel", "terminate", "abandon"]>>;
+}>>, Schema.Never>;
 
 export declare const WorkflowRunRefSchema: Schema.Struct<{
     /** `_voltro_workflow_runs.id` OR durable `executionId`. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
 }>;
 
 export declare type WorkflowRunRow = Schema.Schema.Type<typeof WorkflowRunRowSchema>;
 
 export declare const WorkflowRunRowSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    tag: typeof Schema.String;
-    executionId: typeof Schema.String;
-    status: Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>;
-    payload: typeof Schema.Unknown;
-    workflowVersion: Schema.NullOr<typeof Schema.String>;
-    workflowPatches: Schema.NullOr<typeof Schema.Unknown>;
-    output: Schema.NullOr<typeof Schema.Unknown>;
-    subject: Schema.NullOr<typeof Schema.Unknown>;
-    source: Schema.NullOr<typeof Schema.String>;
-    errorTag: Schema.NullOr<typeof Schema.String>;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    cancelled: typeof Schema.Boolean;
-    startedAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-    durationMs: Schema.NullOr<typeof Schema.Number>;
-    traceId: Schema.NullOr<typeof Schema.String>;
-    parentExecutionId: Schema.NullOr<typeof Schema.String>;
-    parentClosePolicy: Schema.NullOr<Schema.Literal<["cancel", "terminate", "abandon"]>>;
+    readonly id: Schema.String;
+    readonly tag: Schema.String;
+    readonly executionId: Schema.String;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>;
+    readonly payload: Schema.Unknown;
+    readonly workflowVersion: Schema.NullOr<Schema.String>;
+    readonly workflowPatches: Schema.NullOr<Schema.Unknown>;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly subject: Schema.NullOr<Schema.Unknown>;
+    readonly source: Schema.NullOr<Schema.String>;
+    readonly errorTag: Schema.NullOr<Schema.String>;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly cancelled: Schema.Boolean;
+    readonly startedAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
+    readonly traceId: Schema.NullOr<Schema.String>;
+    readonly parentExecutionId: Schema.NullOr<Schema.String>;
+    readonly parentClosePolicy: Schema.NullOr<Schema.Literals<readonly ["cancel", "terminate", "abandon"]>>;
 }>;
 
 export declare type WorkflowRunsInput = Schema.Schema.Type<typeof WorkflowRunsInputSchema>;
 
 export declare const WorkflowRunsInputSchema: Schema.Struct<{
-    tag: Schema.optional<typeof Schema.String>;
-    status: Schema.optional<Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>>;
-    limit: Schema.optional<typeof Schema.Number>;
+    readonly tag: Schema.optional<Schema.String>;
+    readonly status: Schema.optional<Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>>;
+    readonly limit: Schema.optional<Schema.Number>;
 }>;
 
 export declare type WorkflowRunSnapshot = Schema.Schema.Type<typeof WorkflowRunSnapshotSchema>;
 
 /** Observed execution state, distinct from admission/start handles. */
 export declare const WorkflowRunSnapshotSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    executionId: typeof Schema.String;
-    status: Schema.Union<[Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<["unknown"]>]>;
-    output: Schema.optional<typeof Schema.Unknown>;
-    error: Schema.optional<Schema.Struct<{
-        tag: Schema.NullOr<typeof Schema.String>;
-        message: typeof Schema.String;
+    readonly id: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.String;
+    readonly status: Schema.Union<readonly [Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>, Schema.Literal<"unknown">]>;
+    readonly output: Schema.optional<Schema.Unknown>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly tag: Schema.NullOr<Schema.String>;
+        readonly message: Schema.String;
     }>>;
 }>;
 
 export declare const workflowRunsQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.runs", Schema.Struct<{
-    tag: Schema.optional<typeof Schema.String>;
-    status: Schema.optional<Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>>;
-    limit: Schema.optional<typeof Schema.Number>;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    tag: typeof Schema.String;
-    executionId: typeof Schema.String;
-    status: Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>;
-    payload: typeof Schema.Unknown;
-    workflowVersion: Schema.NullOr<typeof Schema.String>;
-    workflowPatches: Schema.NullOr<typeof Schema.Unknown>;
-    output: Schema.NullOr<typeof Schema.Unknown>;
-    subject: Schema.NullOr<typeof Schema.Unknown>;
-    source: Schema.NullOr<typeof Schema.String>;
-    errorTag: Schema.NullOr<typeof Schema.String>;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    cancelled: typeof Schema.Boolean;
-    startedAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-    durationMs: Schema.NullOr<typeof Schema.Number>;
-    traceId: Schema.NullOr<typeof Schema.String>;
-    parentExecutionId: Schema.NullOr<typeof Schema.String>;
-    parentClosePolicy: Schema.NullOr<Schema.Literal<["cancel", "terminate", "abandon"]>>;
-}>>, typeof Schema.Never>;
+    readonly tag: Schema.optional<Schema.String>;
+    readonly status: Schema.optional<Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>>;
+    readonly limit: Schema.optional<Schema.Number>;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly tag: Schema.String;
+    readonly executionId: Schema.String;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>;
+    readonly payload: Schema.Unknown;
+    readonly workflowVersion: Schema.NullOr<Schema.String>;
+    readonly workflowPatches: Schema.NullOr<Schema.Unknown>;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly subject: Schema.NullOr<Schema.Unknown>;
+    readonly source: Schema.NullOr<Schema.String>;
+    readonly errorTag: Schema.NullOr<Schema.String>;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly cancelled: Schema.Boolean;
+    readonly startedAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
+    readonly traceId: Schema.NullOr<Schema.String>;
+    readonly parentExecutionId: Schema.NullOr<Schema.String>;
+    readonly parentClosePolicy: Schema.NullOr<Schema.Literals<readonly ["cancel", "terminate", "abandon"]>>;
+}>>, Schema.Never>;
 
 export declare type WorkflowRunStatus = Schema.Schema.Type<typeof WorkflowRunStatusSchema>;
 
-export declare const WorkflowRunStatusSchema: Schema.Literal<["running", "succeeded", "failed", "cancelled", "suspended"]>;
+export declare const WorkflowRunStatusSchema: Schema.Literals<readonly ["running", "succeeded", "failed", "cancelled", "suspended"]>;
 
 export declare type WorkflowRunStepRow = Schema.Schema.Type<typeof WorkflowRunStepRowSchema>;
 
 export declare const WorkflowRunStepRowSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    runId: typeof Schema.String;
-    stepName: typeof Schema.String;
-    attempt: typeof Schema.Number;
-    status: Schema.Literal<["running", "succeeded", "failed"]>;
-    input: Schema.NullOr<typeof Schema.Unknown>;
-    retryPolicy: Schema.NullOr<typeof Schema.Unknown>;
-    output: Schema.NullOr<typeof Schema.Unknown>;
-    errorTag: Schema.NullOr<typeof Schema.String>;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    errorCause: Schema.NullOr<typeof Schema.Unknown>;
-    startedAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-    durationMs: Schema.NullOr<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly stepName: Schema.String;
+    readonly attempt: Schema.Number;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed"]>;
+    readonly input: Schema.NullOr<Schema.Unknown>;
+    readonly retryPolicy: Schema.NullOr<Schema.Unknown>;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly errorTag: Schema.NullOr<Schema.String>;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly errorCause: Schema.NullOr<Schema.Unknown>;
+    readonly startedAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
 }>;
 
 export declare const workflowRunStepsQueryDescriptor: QueryProcedureDescriptor<"__voltro.workflow.run.steps", Schema.Struct<{
     /** `_voltro_workflow_runs.id`; step/event rows reference this id. */
-    runId: typeof Schema.String;
-}>, Schema.Array$<Schema.Struct<{
-    id: typeof Schema.String;
-    runId: typeof Schema.String;
-    stepName: typeof Schema.String;
-    attempt: typeof Schema.Number;
-    status: Schema.Literal<["running", "succeeded", "failed"]>;
-    input: Schema.NullOr<typeof Schema.Unknown>;
-    retryPolicy: Schema.NullOr<typeof Schema.Unknown>;
-    output: Schema.NullOr<typeof Schema.Unknown>;
-    errorTag: Schema.NullOr<typeof Schema.String>;
-    errorMessage: Schema.NullOr<typeof Schema.String>;
-    errorCause: Schema.NullOr<typeof Schema.Unknown>;
-    startedAt: typeof Schema.Date;
-    completedAt: Schema.NullOr<typeof Schema.Date>;
-    durationMs: Schema.NullOr<typeof Schema.Number>;
-}>>, typeof Schema.Never>;
+    readonly runId: Schema.String;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly stepName: Schema.String;
+    readonly attempt: Schema.Number;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed"]>;
+    readonly input: Schema.NullOr<Schema.Unknown>;
+    readonly retryPolicy: Schema.NullOr<Schema.Unknown>;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly errorTag: Schema.NullOr<Schema.String>;
+    readonly errorMessage: Schema.NullOr<Schema.String>;
+    readonly errorCause: Schema.NullOr<Schema.Unknown>;
+    readonly startedAt: Schema.DateFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateFromString>;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
+}>>, Schema.Never>;
 
 export declare const WorkflowRunTableRefSchema: Schema.Struct<{
     /** `_voltro_workflow_runs.id`; step/event rows reference this id. */
-    runId: typeof Schema.String;
+    readonly runId: Schema.String;
 }>;
 
 export declare const workflowSignalDescriptor: ActionProcedureDescriptor<"__voltro.workflow.signal", Schema.Struct<{
-    id: typeof Schema.String;
-    signalName: typeof Schema.String;
-    payload: Schema.optional<typeof Schema.Unknown>;
+    readonly id: Schema.String;
+    readonly signalName: Schema.String;
+    readonly payload: Schema.optional<Schema.Unknown>;
 }>, Schema.Struct<{
-    eventId: typeof Schema.String;
-}>, typeof Schema.Never>;
+    readonly eventId: Schema.String;
+}>, Schema.Never>;
 
 export declare const WorkflowSignalInputSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    signalName: typeof Schema.String;
-    payload: Schema.optional<typeof Schema.Unknown>;
+    readonly id: Schema.String;
+    readonly signalName: Schema.String;
+    readonly payload: Schema.optional<Schema.Unknown>;
 }>;
 
 export declare type WorkflowStartDeferral = Schema.Schema.Type<typeof WorkflowStartDeferralSchema>;
@@ -8617,38 +8745,38 @@ export declare const WorkflowStartDeferralSchema: Schema.Struct<{
      *  back. The engine may have it; recovery retries the dispatch and binds the
      *  receipt (`id`) to whatever run results. It is not a failure: do not
      *  report one to a user, follow the receipt. */
-    mode: typeof Schema.String;
+    readonly mode: Schema.String;
     /** Epoch ms this may first be admitted. Null for a drop or a skip. */
-    dueAt: Schema.NullOr<typeof Schema.Number>;
+    readonly dueAt: Schema.NullOr<Schema.Number>;
     /** How long until the rate window reopens. Null unless dropped. */
-    retryAfterMs: Schema.NullOr<typeof Schema.Number>;
+    readonly retryAfterMs: Schema.NullOr<Schema.Number>;
     /** The `_voltro_workflow_pending` row holding this start. Null unless queued. */
-    intentId: Schema.NullOr<typeof Schema.String>;
+    readonly intentId: Schema.NullOr<Schema.String>;
 }>;
 
 export declare type WorkflowStartTerminalOutcome = typeof WorkflowStartTerminalOutcomeSchema.Type;
 
 /** A settled admission outcome is not a terminal execution snapshot. In the
  * skipped case the identities belong to the incumbent, not to a new run. */
-export declare const WorkflowStartTerminalOutcomeSchema: Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["dropped"]>;
-    at: typeof Schema.Number;
-    retryAfterMs: typeof Schema.Number;
+export declare const WorkflowStartTerminalOutcomeSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"dropped">;
+    readonly at: Schema.Number;
+    readonly retryAfterMs: Schema.Number;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["skipped"]>;
-    at: typeof Schema.Number;
-    executionId: typeof Schema.String;
-    runId: typeof Schema.String;
+    readonly kind: Schema.Literal<"skipped">;
+    readonly at: Schema.Number;
+    readonly executionId: Schema.String;
+    readonly runId: Schema.String;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["superseded"]>;
-    at: typeof Schema.Number;
+    readonly kind: Schema.Literal<"superseded">;
+    readonly at: Schema.Number;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["cancelled"]>;
-    at: typeof Schema.Number;
+    readonly kind: Schema.Literal<"cancelled">;
+    readonly at: Schema.Number;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["abandoned"]>;
-    at: typeof Schema.Number;
-    failureId: typeof Schema.NonEmptyString;
+    readonly kind: Schema.Literal<"abandoned">;
+    readonly at: Schema.Number;
+    readonly failureId: Schema.NonEmptyString;
 }>]>;
 
 /**
@@ -8662,7 +8790,7 @@ export declare const WorkflowStartTerminalOutcomeSchema: Schema.Union<[Schema.St
  * step-level retry-policy override, step-level resource scoping,
  * external observability injection.
  *
- * The interceptor runs INSIDE `@effect/workflow`'s replay logic —
+ * The interceptor runs INSIDE `effect/workflow`'s replay logic —
  * on a workflow resume, the framework replays cached Activity
  * outputs without re-running the user effect, and the interceptor
  * is bypassed on replay (only fires on the first execution).
@@ -8692,16 +8820,16 @@ export declare type WorkflowStepInterceptor = <Success, ErrorE, R>(next: Effect.
  * error union with `ScopeError` / `Unauthenticated`, exactly as it does for a
  * mutation, and labels the strict-input refusal as a guarded procedure's.
  */
-export declare const workflowToRpc: <const Name extends string, Payload extends Schema.Schema.Any>(workflow: {
+export declare const workflowToRpc: <const Name extends string, Payload extends Schema.Top>(workflow: {
     readonly name: Name;
     readonly payloadSchema: Payload;
-    readonly errorSchema: Schema.Schema.All;
+    readonly errorSchema: Schema.Top;
 }, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Payload extends Schema.Struct.Fields ? Schema.Struct<Payload> : Payload, Schema.Struct<{
     /** Stable handle callers pass to `useWorkflowRun(...)`. The durable execution
      *  id for a started run; the durable caller-receipt id for a queued one. */
-    id: typeof Schema.String;
+    readonly id: Schema.String;
     /** Workflow tag, e.g. `notes.summarise`. */
-    workflowName: typeof Schema.String;
+    readonly workflowName: Schema.String;
     /**
      * Deterministic durable id derived from workflow name + idempotency key.
      *
@@ -8715,7 +8843,7 @@ export declare const workflowToRpc: <const Name extends string, Payload extends
      * For a `skipped` singleton it is the INCUMBENT's execution id — a real,
      * pollable run, which is the entire point of `mode: 'skip'`.
      */
-    executionId: Schema.NullOr<typeof Schema.String>;
+    readonly executionId: Schema.NullOr<Schema.String>;
     /**
      * `running`  — the engine has it; starting is fire-and-return.
      * `succeeded` — a blocking start observed successful completion.
@@ -8731,8 +8859,8 @@ export declare const workflowToRpc: <const Name extends string, Payload extends
      * a fresh start; a schedule keyed per day ran once and reported forty-seven
      * "starts" that were replays. See `workflow()`'s `idempotencyKey` doc.
      */
-    status: Schema.Literal<["running", "succeeded", "queued", "dropped", "skipped", "replayed"]>;
-    deferral: Schema.optional<Schema.Struct<{
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "queued", "dropped", "skipped", "replayed"]>;
+    readonly deferral: Schema.optional<Schema.Struct<{
         /** `debounce` | `batch` | `throttle` | `concurrency` | `paused` |
          *  `rateLimit` | `singleton` | `delayed` | `transaction` | `unacknowledged`.
          *
@@ -8740,42 +8868,42 @@ export declare const workflowToRpc: <const Name extends string, Payload extends
          *  back. The engine may have it; recovery retries the dispatch and binds the
          *  receipt (`id`) to whatever run results. It is not a failure: do not
          *  report one to a user, follow the receipt. */
-        mode: typeof Schema.String;
+        readonly mode: Schema.String;
         /** Epoch ms this may first be admitted. Null for a drop or a skip. */
-        dueAt: Schema.NullOr<typeof Schema.Number>;
+        readonly dueAt: Schema.NullOr<Schema.Number>;
         /** How long until the rate window reopens. Null unless dropped. */
-        retryAfterMs: Schema.NullOr<typeof Schema.Number>;
+        readonly retryAfterMs: Schema.NullOr<Schema.Number>;
         /** The `_voltro_workflow_pending` row holding this start. Null unless queued. */
-        intentId: Schema.NullOr<typeof Schema.String>;
+        readonly intentId: Schema.NullOr<Schema.String>;
     }>>;
-}>, Schema.Schema.All, never>;
+}>, Schema.Top, never, never>;
 
 export declare const workflowUpdateDescriptor: ActionProcedureDescriptor<"__voltro.workflow.update", Schema.Struct<{
-    id: typeof Schema.String;
-    updateName: typeof Schema.String;
-    payload: Schema.optional<typeof Schema.Unknown>;
-    timeoutMs: Schema.optional<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly updateName: Schema.String;
+    readonly payload: Schema.optional<Schema.Unknown>;
+    readonly timeoutMs: Schema.optional<Schema.Number>;
 }>, Schema.Struct<{
-    eventId: typeof Schema.String;
-    updateId: typeof Schema.String;
-    completedEventId: typeof Schema.String;
-    result: typeof Schema.Unknown;
-}>, typeof Schema.Never>;
+    readonly eventId: Schema.String;
+    readonly updateId: Schema.String;
+    readonly completedEventId: Schema.String;
+    readonly result: Schema.Unknown;
+}>, Schema.Never>;
 
 export declare const WorkflowUpdateInputSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    updateName: typeof Schema.String;
-    payload: Schema.optional<typeof Schema.Unknown>;
-    timeoutMs: Schema.optional<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly updateName: Schema.String;
+    readonly payload: Schema.optional<Schema.Unknown>;
+    readonly timeoutMs: Schema.optional<Schema.Number>;
 }>;
 
 export declare type WorkflowUpdateResult = Schema.Schema.Type<typeof WorkflowUpdateResultSchema>;
 
 export declare const WorkflowUpdateResultSchema: Schema.Struct<{
-    eventId: typeof Schema.String;
-    updateId: typeof Schema.String;
-    completedEventId: typeof Schema.String;
-    result: typeof Schema.Unknown;
+    readonly eventId: Schema.String;
+    readonly updateId: Schema.String;
+    readonly completedEventId: Schema.String;
+    readonly result: Schema.Unknown;
 }>;
 
 /**
@@ -8789,9 +8917,9 @@ export declare const WorkflowUpdateResultSchema: Schema.Struct<{
  * `ExitEncoded` defect tree a mutation used to ship for the same reason.
  */
 export declare const workflowWireErrorUnion: (workflow: {
-    readonly errorSchema: Schema.Schema.All;
+    readonly errorSchema: Schema.Top;
     readonly guards?: DeclaredAccess | undefined;
-}, extraErrors?: ExtraErrors) => Schema.Schema.All;
+}, extraErrors?: ExtraErrors) => Schema.Top;
 
 /**
  * Scope for a WS-rpc MUTATION. Unlike the REST scope (tenant + method + path),