@voltro/runtime 0.69.1 → 0.71.0

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { CaughtUpVerdict } from '@voltro/database';
 import { ChangeEvent } from '@voltro/database';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
+import { ColumnBuilder } from '@voltro/database';
 import { ConnectionCredential } from '@voltro/protocol';
 import { ConnectionInfo } from '@voltro/protocol';
 import { ConnectionInfoMiddleware } from '@voltro/protocol';
@@ -35,6 +36,7 @@ import { extractDbCause } from '@voltro/database';
 import { Fiber } from 'effect';
 import { FieldBinding } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
+import { FieldDefinitions } from '@voltro/database';
 import * as http from 'node:http';
 import { HttpClient } from '@effect/platform';
 import { HttpRequestInterceptor } from '@voltro/protocol';
@@ -43,6 +45,7 @@ import { IdempotencyStore } from '@voltro/protocol';
 import { IdScheme } from '@voltro/database';
 import { InMemoryMetricExporter } from '@opentelemetry/sdk-metrics';
 import { InMemorySpanExporter } from '@opentelemetry/sdk-trace-base';
+import { InsertIgnoreResult } from '@voltro/database';
 import { InspectedStep } from '@voltro/workflow';
 import { InspectedWorkflow } from '@voltro/workflow';
 import { InspectStore } from '@voltro/workflow';
@@ -61,8 +64,10 @@ import { MutationIdempotencyScope } from '@voltro/protocol';
 import { NoRowFound } from '@voltro/protocol';
 import { PendingApproval } from '@voltro/protocol';
 import { PluginHttpRoute } from '@voltro/protocol';
+import { PluginHttpRouteByteStream } from '@voltro/protocol';
 import { PluginRefOrphanPolicy } from '@voltro/database';
 import { Predicate } from '@voltro/database';
+import { PublicApiSpec } from '@voltro/protocol';
 import { Query } from '@voltro/database';
 import { QueryDescriptor } from '@voltro/database';
 import { Redis } from 'ioredis';
@@ -97,6 +102,7 @@ import { SubjectService } from '@voltro/protocol';
 import { SubscriptionEvent } from '@voltro/protocol';
 import { sweepRetention } from '@voltro/database';
 import { SyncLogger } from '@voltro/logger';
+import { Table } from '@voltro/database';
 import { TableLike } from '@voltro/database';
 import { TableName } from '@voltro/protocol';
 import { TableValidationFailed } from '@voltro/protocol';
@@ -111,8 +117,13 @@ import { ValidationError } from '@voltro/protocol';
 import { ValidationErrors } from '@voltro/protocol';
 import { VersionConflict } from '@voltro/database';
 import { WebSocketGatewayRoute } from '@voltro/protocol';
+import { WorkflowControlRequest } from '@voltro/workflow';
+import { WorkflowControlResult as WorkflowControlResult_2 } from '@voltro/protocol';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
+import { WorkflowQueuedCancellationResult } from '@voltro/protocol';
 import { WorkflowRunHandle } from '@voltro/protocol';
+import { WorkflowRunSnapshot as WorkflowRunSnapshot_2 } from '@voltro/protocol';
+import { WorkflowStartResolution } from '@voltro/workflow';
 import { WorkflowUpdateResult } from '@voltro/protocol';
 
 /** Typed denial — declare on an rpc `error:` union so a refusal surfaces to the
@@ -887,6 +898,20 @@ export declare interface ApiKeyActor {
     readonly input: IssueInput;
 }
 
+/** What one boot's actor backfill did. */
+export declare interface ApiKeyActorBackfillResult {
+    /** Keys the store lists. */
+    readonly keys: number;
+    /** Keys that had no `actors` row and got one on this boot. */
+    readonly planted: number;
+    /** Keys whose row could not be written — the app's `ensureActor` refused, or
+     *  the built-in row does not fit a declared `actors`. One entry per key. */
+    readonly failed: ReadonlyArray<{
+        readonly id: string;
+        readonly reason: string;
+    }>;
+}
+
 /** Admin-gated management routes (issue / list / revoke) for the built-in keys.
  *  Mounted under `basePath` (default `/v1/api-keys`) when `apiKeys` is on. */
 export declare const apiKeyManagementRoutes: (service: ApiKeyServiceShape, basePath?: string) => ReadonlyArray<RestRouteDescriptor<any, any>>;
@@ -1051,6 +1076,14 @@ export declare interface AppAccess {
 }
 
 export declare interface AppContext {
+    /** Run database work with a freshly transaction-bound context. Reuses an
+     * existing mutation transaction (no savepoint). The callback may be retried;
+     * keep external I/O out of it and use its store/workflows, not captured ones.
+     * A system context may select a tenant before opening the transaction;
+     * nested transactions cannot change tenants. */
+    readonly transaction: <A>(work: (context: AppContext) => Promise<A>, options?: {
+        readonly tenantId?: string;
+    }) => Promise<A>;
     readonly store: FluentStore;
     /**
      * The same store, scoped to ONE tenant.
@@ -2407,6 +2440,33 @@ export declare interface CoordinatedScheduleDeps {
      * opt a task out of backing off entirely — which is the right call only for a
      * task whose work cannot announce itself.
      */
+    /**
+     * Drive this task from OUTSIDE instead of from a timer — see
+     * `externalizedTasks.ts`.
+     *
+     * When set, the task arms nothing and instead registers itself so the
+     * external trigger endpoint can run one tick on demand. A cadence no platform
+     * scheduler can express is REFUSED, loudly, and the timer is armed as usual:
+     * a task silently left ticking while the deployment believes it was
+     * externalised is worse than one that was never externalised.
+     */
+    readonly externalize?: boolean;
+    /**
+     * The gate an EXTERNALLY driven tick claims through. Defaults to
+     * `coordinator`, which is right only when that is store-backed.
+     *
+     * It is a separate field because the two gates answer different questions.
+     * `coordinator` gates a TIMER tick, and `singleCoordinator` answers `true`
+     * unconditionally for a very good reason: one process's timer cannot race
+     * itself, so there is nothing to gate and a claim row per tick would be pure
+     * cost — at 250 ms, four rows a second, forever. An externally driven tick is
+     * the opposite case: the duplicate does not come from a second replica, it
+     * comes from the same platform delivering once more, and a one-pod deployment
+     * is fully exposed to it. Sharing one field would have meant either a dedupe
+     * that silently does nothing on the simplest deployment, or a write storm on
+     * every fast task.
+     */
+    readonly externalClaim?: Coordinator;
     readonly maxIdleIntervalMs?: number;
     /**
      * **Stop ticking entirely** on an idle tick with no known deadline, and come
@@ -2755,6 +2815,18 @@ export declare const countRunningWorkflows: (store: DataStore) => Promise<number
 
 export declare const crdtCompactMaxBytes: () => number;
 
+/**
+ * The cron expression that fires `intervalMs` apart, or `undefined` when no
+ * five-field expression does.
+ *
+ * Cron is not an interval language: it fires at MATCHING instants, so only
+ * cadences that tile the hour (or the day) evenly can be expressed. Seven
+ * minutes cannot — `*\/7 * * * *` fires at :00 :07 … :56 and then again at :00,
+ * four minutes later. Refusing is the honest answer; emitting it would produce a
+ * schedule that is subtly wrong once an hour, forever.
+ */
+export declare const cronForInterval: (intervalMs: number) => string | undefined;
+
 /**
  * Every firing instant of `def` in `(from, to]`, oldest first, bounded by
  * `cap + 1` entries.
@@ -3061,6 +3133,28 @@ export declare const DEFAULT_CRDT_COMPACT_MAX_BYTES: number;
  */
 export declare const DEFAULT_DELIVERY_CONCURRENCY = 8;
 
+/** How often unfired occurrences are reconciled. Coarse on purpose: it exists
+ *  to make silence visible, not to be a second clock. */
+export declare const DEFAULT_EXTERNAL_RECONCILE_MS: number;
+
+/**
+ * How much later than its own occurrence an external trigger may arrive and
+ * still be attributed to it.
+ *
+ * The number exists because a platform scheduler is not punctual, and that is
+ * not a defect in it: a k8s CronJob waits on the controller, on scheduling, on
+ * an image pull, and a Job with `backoffLimit` retries minutes later. EVERY one
+ * of those arrivals means the same occurrence, and the exactly-once property
+ * depends on all of them snapping to one `scheduledAt`.
+ *
+ * It is bounded on the other side by the schedule's own period (see
+ * `triggerExternal`), so an arrival can never be attributed to an occurrence
+ * older than the previous one. That bound is the half that matters for safety:
+ * a CronJob carrying a cron expression the app no longer declares must be
+ * REJECTED, not silently accepted as a very late firing of something else.
+ */
+export declare const DEFAULT_EXTERNAL_TRIGGER_SKEW_MS: number;
+
 /** 180 days + subdomains. Deliberately NOT `preload`: preload is effectively
  *  irreversible for a domain, so it must be a deployment decision, never a
  *  framework default. */
@@ -3312,7 +3406,7 @@ export declare const defineExperiment: (input: ExperimentDefinitionInput) => Exp
  * delivery is at-least-once, so a process that dies between "the remote
  * accepted it" and "we marked it delivered" will retry.
  */
-export declare const defineOutboxHandler: (definition: OutboxHandlerDefinition) => OutboxHandlerDefinition;
+export declare const defineOutboxHandler: <R = never>(definition: OutboxHandlerDefinition<R>) => OutboxHandlerDefinition<R>;
 
 /** Declare a reaction. Validates that the MANDATORY guard is present — an
  *  ungated reaction is a spend-storm footgun, so this fails LOUD at boot. */
@@ -3608,9 +3702,13 @@ export declare interface DispatcherDependencies {
  *  invisible to a waker looking under the other's key. */
 export declare const DORMANCY_WAKEUP_TENANT = "default";
 
-export declare interface DrainDeps {
+export declare interface DrainDeps<R = never> {
     readonly store: Pick<DataStore, 'query' | 'update' | 'updateMany' | 'insert' | 'delete'>;
-    readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition>;
+    readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition<R>>;
+    /** Execute with the application's services. Required by drainOutbox when R
+     * is not never. A service-free standalone drain uses Effect.runPromise.
+     * Row identity is metadata, not a restored authorization decision. */
+    readonly runEffect?: (effect: Effect.Effect<unknown, unknown, R>, ctx: OutboxHandlerContext) => Promise<unknown>;
     readonly now?: () => Date;
     /** Max rows per drain pass. */
     readonly batchSize?: number;
@@ -3673,7 +3771,9 @@ export declare const drainForShutdown: (options: {
     }) => void;
 }) => void;
 
-export declare const drainOutbox: (deps: DrainDeps) => Promise<DrainResult>;
+export declare const drainOutbox: <R = never>(deps: DrainDeps<R> & ([R] extends [never] ? unknown : {
+    readonly runEffect: NonNullable<DrainDeps<R>["runEffect"]>;
+})) => Promise<DrainResult>;
 
 export declare interface DrainResult {
     readonly delivered: number;
@@ -3749,6 +3849,14 @@ export declare interface EffectStoreOps {
     readonly insertIgnore: (table: string, row: Row, options: {
         readonly conflictColumns: ReadonlyArray<string>;
     }) => Effect.Effect<Row, StoreError>;
+    /**
+     * `insertIgnore`, plus whether it inserted or found the row there — the
+     * Effect form of `insertIgnoreRowOutcome`, on this service and on the
+     * `transaction` view, for the same reason `upsertWithOutcome` is on both.
+     */
+    readonly insertIgnoreWithOutcome: (table: string, row: Row, options: {
+        readonly conflictColumns: ReadonlyArray<string>;
+    }) => Effect.Effect<InsertIgnoreResult, StoreError>;
     /**
      * The single-row reads, on the typed channel — the same three `ctx.store`
      * offers, taking a builder or a descriptor.
@@ -4132,7 +4240,7 @@ export declare interface EventPublishContext {
      * A display reacting to a game start the database rolled back is not a race
      * that is unlikely, it is one that happens on every constraint violation.
      */
-    readonly deferToCommit?: ((deliver: () => void) => void) | undefined;
+    readonly deferToCommit?: ((deliver: () => Promise<void>) => void) | undefined;
     /**
      * The DURABLE audience — the workflow-trigger path.
      *
@@ -4141,11 +4249,11 @@ export declare interface EventPublishContext {
      * starts whatever workflows are triggered by it. Absent when the app declares
      * no triggers, so an app that only fans out to clients pays nothing.
      *
-     * Deliberately fire-and-forget from `publish`'s point of view: a trigger that
-     * fails must not fail the mutation that published, for the same reason a
-     * broker outage does not. The trigger's own delivery row records the failure.
+     * Completion acknowledges this audience's write, not completion of triggered
+     * workflows or HTTP delivery. A persistence failure rejects publication. In a
+     * mutation the receipt is deferred; the post-commit drain must await delivery.
      */
-    readonly onPublished?: ((eventName: string, payload: unknown, descriptor: unknown) => void) | undefined;
+    readonly onPublished?: ((eventName: string, payload: unknown, descriptor: unknown) => void | Promise<void>) | undefined;
 }
 
 export declare interface EventPublisher {
@@ -4200,6 +4308,7 @@ export declare interface EventsFacadeOptions {
     readonly subject?: Subject;
     readonly traceId?: string;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly startWorkflow: (workflowName: string, payload: unknown, callerContext: WorkflowCallerContext) => Promise<WorkflowRunHandle>;
     readonly emit?: (channel: 'workflowDomainEvents' | 'workflowEventDeliveries', event: {
         readonly op: 'insert' | 'update';
@@ -4750,11 +4859,91 @@ export declare interface ExperimentVariantSpec {
     readonly weight?: number;
 }
 
+/**
+ * How far AHEAD of now an external trigger's stated instant may be.
+ *
+ * The skew budget is one-directional — it forgives a LATE arrival, which is the
+ * only kind a platform scheduler produces. Nothing bounded an EARLY one, and
+ * the gap was reachable: a caller stating `at` a month out had that future
+ * occurrence snapped, claimed and run, and the real firing was then answered as
+ * a duplicate and its work silently never happened. One wrong value in a
+ * manifest and a schedule loses a firing with nothing in the ledger saying so.
+ *
+ * A minute covers the clock drift between a job pod and the app; beyond that it
+ * is not drift, it is a caller asserting a time it cannot know.
+ */
+export declare const EXTERNAL_TRIGGER_AHEAD_TOLERANCE_MS = 60000;
+
+/** Why a task cannot be externalised, in words an operator can act on. */
+export declare const externalizationRefusal: (name: string, intervalMs: number) => string | undefined;
+
+export declare interface ExternalizedTask {
+    readonly name: string;
+    readonly intervalMs: number;
+    /** The five-field expression a manifest for this task carries. */
+    readonly cron: string;
+    /** Run one tick now. Claims the same bucket a timer tick would, so a
+     *  redelivery inside one interval is a no-op rather than a second run. */
+    readonly run: () => Promise<'ran' | 'deduplicated'>;
+}
+
+export declare const externalizedTask: (name: string) => ExternalizedTask | undefined;
+
+export declare const externalizedTaskNames: () => ReadonlyArray<string>;
+
 /** Build an Effect `ExternalSpan` parent from a `traceparent` header so
  *  inbound HTTP work continues the caller's trace. Returns undefined
  *  when the header is missing/invalid (no parent → a fresh root span). */
 export declare const externalSpanFromTraceparent: (header: string | undefined | null) => Tracer.ExternalSpan | undefined;
 
+/** What an external trigger did. Every arm is a deliberate answer to the
+ *  caller — a job pod whose exit code an operator's alerting reads. */
+export declare type ExternalTriggerOutcome = 
+/** The occurrence was claimed by THIS request; the handler is now running.
+*  `runId` is `undefined` only when the ledger write itself failed — the run
+*  still happens (see `runQueued`'s note on the same trade). */
+    {
+    readonly kind: 'accepted';
+    readonly runId: string | undefined;
+    readonly scheduledAt: Date;
+}
+/** Someone already claimed this occurrence — a retry, a second delivery, or
+*  another replica's CronJob. NOT an error: it is the guarantee working. */
+| {
+    readonly kind: 'duplicate';
+    readonly runId: string | undefined;
+    readonly scheduledAt: Date;
+}
+/** The arrival snapped to no occurrence within the skew budget. Almost always
+*  an out-of-date manifest: the cron expression in the cluster is no longer
+*  the one in the code. */
+| {
+    readonly kind: 'noOccurrence';
+    readonly arrivalAt: Date;
+    readonly skewMs: number;
+    readonly cron: string;
+    readonly timezone: string;
+}
+/** The stated instant is further ahead than clock drift explains. Refused
+*  rather than honoured: claiming an occurrence before it is due turns the
+*  real firing into a duplicate and loses its work. */
+| {
+    readonly kind: 'ahead';
+    readonly arrivalAt: Date;
+    readonly now: Date;
+    readonly toleranceMs: number;
+} | {
+    readonly kind: 'unknownSchedule';
+    readonly name: string;
+}
+/** The schedule is driven by the in-app timer. Firing it from outside as well
+*  would run it twice, so this is refused rather than honoured. */
+| {
+    readonly kind: 'notExternal';
+    readonly name: string;
+    readonly trigger: ScheduleTrigger;
+};
+
 export { extractDbCause }
 
 export declare interface FieldChange {
@@ -5089,7 +5278,7 @@ export declare interface GroupState {
 }
 
 /** What a user handler may return. */
-export declare type HandlerBody = void | Promise<unknown> | Effect.Effect<unknown, unknown, never>;
+export declare type HandlerBody<R = never> = void | Promise<unknown> | Effect.Effect<unknown, unknown, R>;
 
 /**
  * Deterministic hash of a string into the unit interval `[0, 1)` — FNV-1a
@@ -5250,6 +5439,9 @@ export declare class InMemoryDataStore implements DataStore {
     insertIgnore(table: string, row: Row, options: {
         conflictColumns: ReadonlyArray<string>;
     }): Promise<Row>;
+    insertIgnoreWithOutcome(table: string, row: Row, options: {
+        conflictColumns: ReadonlyArray<string>;
+    }): Promise<InsertIgnoreResult>;
     transactional<T>(work: (tx: DataStore) => Promise<T>): Promise<T>;
     onChange(listener: (event: ChangeEvent) => void): () => void;
     /** Cross-instance reactivity seam — emit an externally-sourced event to
@@ -5280,14 +5472,18 @@ export declare interface InspectRoute {
      *  rpc server reads it (UTF-8) and passes it as the 4th arg; GET
      *  callers pass undefined. Body parsing — JSON, validation —
      *  happens in the handler. */
-    readonly handle: (url: string, headers: Readonly<Record<string, string>>, method: string, body?: string) => {
+    readonly handle: (url: string, headers: Readonly<Record<string, string>>, method: string, body?: string, 
+    /** Aborted when the HTTP request disconnects or the server shuts down. */
+    signal?: AbortSignal) => {
         readonly status: number;
         readonly contentType: string;
+        readonly byteStream?: PluginHttpRouteByteStream;
         readonly body: string;
         readonly headers?: Readonly<Record<string, string>>;
     } | Promise<{
         readonly status: number;
         readonly contentType: string;
+        readonly byteStream?: PluginHttpRouteByteStream;
         readonly body: string;
         readonly headers?: Readonly<Record<string, string>>;
     } | null> | null;
@@ -5301,6 +5497,8 @@ export { InspectStore }
  * stream. The cli's dev.ts wires this with its inspect bus.
  */
 export declare interface InspectStream {
+    readonly replicaId?: string;
+    readonly select?: (url: string, headers: Readonly<Record<string, string>>) => Stream.Stream<Uint8Array, unknown> | undefined;
     /** Same shape as the inspect auth resolver — returns ok or reason. */
     readonly authorize: (headers: Readonly<Record<string, string>>) => {
         readonly ok: true;
@@ -5925,7 +6123,13 @@ export declare const makeConnectionState: (connection: RpcConnection, afterCommi
  * handle is tracked by the caller (the CLI) so `onDeactivate` can stop
  * every task a plugin armed.
  */
-export declare const makeCoordinatedScheduler: (deps: CoordinatedScheduleDeps) => PluginScheduleCoordinated;
+export declare const makeCoordinatedScheduler: (deps: CoordinatedScheduleDeps & {
+    /** Decides, per task, whether the platform drives it instead of a timer.
+     *  Bound here rather than passed by each caller: every framework and plugin
+     *  periodic task goes through this factory, so this is the one place the
+     *  policy can be applied without a caller being forgotten. */
+    readonly externalizeTask?: (name: string) => boolean;
+}) => PluginScheduleCoordinated;
 
 /**
  * Build a request-scoped loader. One instance per AppContext — see the module
@@ -6066,8 +6270,6 @@ export declare const makeOriginGuardExemption: (input: {
 
 export declare const makeOutboxFacade: (deps: OutboxFacadeDeps) => OutboxFacade;
 
-export declare const makePostCommitWorkflowFacade: (base: WorkflowsAppContext, afterCommit: (work: () => Promise<unknown>) => void) => WorkflowsAppContext;
-
 /**
  * A `WakeAdapter` that brings a single-node app process up via an
  * `AppSupervisor`. `wake` is idempotent — `start()` no-ops when the app
@@ -6163,6 +6365,8 @@ export declare const makeSubmitTokenExecutor: (deps: ConnectionBuiltinDeps) => (
 
 export declare const makeSubscriptionOutbox: <T = ReadonlyArray<Row>>(options: SubscriptionBackpressureOptions) => SubscriptionOutbox<T>;
 
+export declare const makeTransactionalWorkflowFacade: (base: WorkflowsAppContext, enqueueStart: WorkflowStartEnqueue) => WorkflowsAppContext;
+
 /**
  * The factory the serve entrypoints inject into `makeMutationRunner`'s
  * `undoCapture` dep. Collects changes from the wrapped tx; `persist` writes ONE
@@ -6198,9 +6402,9 @@ export declare const makeWorkflowFacadeWithCallerContext: (base: WorkflowsAppCon
 
 export declare const makeWorkflowHandlers: (workflows: ReadonlyArray<DiscoveredWorkflowLike>, facade?: WorkflowsAppContext) => Record<string, (input: unknown) => Effect.Effect<WorkflowRunHandle, unknown, unknown>>;
 
-export declare const makeWorkflowLayers: <Context>(workflows: ReadonlyArray<DiscoveredWorkflowLike<Context>>, options: WorkflowLayerOptions<Context>, wrapExecute?: (workflow: DiscoveredWorkflowLike<Context>, execute: (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>, callerContext: ResolvedWorkflowCallerContext) => (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>) => ReadonlyArray<Layer.Layer<unknown, unknown, unknown>>;
+export declare const makeWorkflowLayers: <Context>(workflows: ReadonlyArray<DiscoveredWorkflowLike<Context>>, options: WorkflowLayerOptions<Context>, wrapExecute?: (workflow: DiscoveredWorkflowLike<Context>, execute: (payload: never, executionId: string, generation?: string) => Effect.Effect<unknown, unknown, unknown>, callerContext: ResolvedWorkflowCallerContext) => (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>) => ReadonlyArray<Layer.Layer<unknown, unknown, unknown>>;
 
-export declare const makeWorkflowRunHandle: (workflowName: string, executionId: string) => WorkflowRunHandle;
+export declare const makeWorkflowRunHandle: (workflowName: string, executionId: string, status: "running" | "succeeded") => WorkflowRunHandle;
 
 /**
  * Build the shared WORKFLOW START runner — the third member of the family,
@@ -6476,6 +6680,9 @@ export declare type MetricSampleType = 'counter' | 'gauge' | 'histogram' | 'summ
  *  into the OTel MeterProvider when a `metricReader` is configured. */
 export declare type MetricsMode = 'off' | 'console' | 'otlp' | 'memory';
 
+/** The lowest cadence any platform scheduler can express. */
+export declare const MIN_EXTERNALIZABLE_INTERVAL_MS = 60000;
+
 /**
  * Ordering token for one mirrored write.
  *
@@ -6507,6 +6714,10 @@ export declare const missingRowError: (info: NoRowFoundInfo, onMissing: OnMissin
 
 export declare interface MutationLifecycle {
     readonly afterCommit: (work: () => Promise<unknown>) => void;
+    /** Already selected physical, namespace-bound nontransactional store.
+     * Required by contexts delivering durable events after commit; never resolve
+     * placement again or reuse the transaction for that delivery. */
+    readonly committedStore?: unknown;
 }
 
 export declare interface MutationLike {
@@ -6544,6 +6755,9 @@ export declare interface MutationOutputCodec<Output> {
 
 export declare interface MutationRunnerDeps {
     readonly store: TransactionalStore;
+    /** Select and provision the request's physical store before opening its
+     * transaction. Resolved once, including across retries and post-commit folds. */
+    readonly resolveStore?: (request: ServeRequestContext) => Promise<TransactionalStore> | TransactionalStore;
     /**
      * How many times a mutation's transaction runs before a replayable failure
      * (contention, a transaction-read conflict) surfaces. Resolved by the CLI
@@ -7085,6 +7299,11 @@ export declare interface OutboxFacadeDeps {
 }
 
 export declare interface OutboxHandlerContext {
+    /** Stable identity of this delivery intent, preserved across retries. */
+    readonly outboxId: string;
+    /** Caller-supplied enqueue key, or null. Unlike outboxId this can be reused
+     * for a distinct intent after an earlier intent has been delivered. */
+    readonly idempotencyKey: string | null;
     readonly payload: Record<string, unknown>;
     readonly attempt: number;
     readonly subjectId: string | null;
@@ -7092,9 +7311,9 @@ export declare interface OutboxHandlerContext {
     readonly traceId: string | null;
 }
 
-export declare interface OutboxHandlerDefinition {
+export declare interface OutboxHandlerDefinition<R = never> {
     readonly effect: string;
-    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown>;
+    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
     /** Give up after this many attempts, then dead-letter. Default 8. */
     readonly maxAttempts?: number;
 }
@@ -7208,6 +7427,29 @@ export declare const pendingApprovalsFor: (store: DataStore, subject: Subject |
     readonly now?: () => number;
 }) => Promise<ReadonlyArray<PendingApproval>>;
 
+/**
+ * Plant the `actors` row of every key that has none — at boot, on both boot
+ * paths, idempotent.
+ *
+ * Keys issued before the actor row existed keep authenticating and fail on the
+ * audit foreign key at their first stamped write. A note told each operator to
+ * run a loop once; it was printed to the wrong group in one release and did not
+ * run where it said to in the next, so the loop lives here now: the framework
+ * owns both tables, knows the row's shape through the same `ensureActor` the
+ * issue path uses (the app's own, when declared), and can tell which keys are
+ * missing in one read. When nothing is missing this costs two queries.
+ *
+ * Never throws: a key whose row cannot be written is reported, not fatal — the
+ * boot line says which, and the key fails exactly where it failed before.
+ */
+export declare const plantMissingApiKeyActors: (input: {
+    readonly apiKeyStore: Pick<ApiKeyStore, "ensureActor">;
+    /** Every key the store holds — the framework store lists all for `null`. */
+    readonly keys: () => Promise<ReadonlyArray<ApiKeyRow>>;
+    /** The store the actor rows live in, for the one read that finds the gaps. */
+    readonly store: Pick<DataStore, "query">;
+}) => Promise<ApiKeyActorBackfillResult>;
+
 /** One resolved rule: "when <targetTable> loses a row, do <policy> to <table.column>". */
 export declare interface PluginRefRule {
     readonly table: string;
@@ -7737,6 +7979,13 @@ export declare interface ReadClassification {
     readonly restricting: ReadonlySet<string>;
 }
 
+/** First-or-null for a boot DataStore or a query-only tuple source. It invokes
+ * the supplied query path, preserving that path's filters and codecs. A raw
+ * driver remains raw; this helper does not add request scoping. */
+export declare const readMaybeOne: <R = Row>(store: Pick<DataStore, "query">, query: QueryDescriptor<R> | {
+    readonly descriptor: QueryDescriptor<R>;
+}) => Promise<R | null>;
+
 /**
  * The ceiling, tunable per deployment via `VOLTRO_POLL_CEILING_MS`.
  *
@@ -7865,6 +8114,10 @@ export declare const recordEventPublished: (event: string) => void;
 /** Subscriber attached (+1) or detached (-1). */
 export declare const recordEventSubscribers: (event: string, delta: number) => void;
 
+export declare const recordExternalMissed: (name: string, count?: number) => void;
+
+export declare const recordExternalTrigger: (name: string, outcome: "accepted" | "duplicate" | "noOccurrence" | "ahead" | "notExternal" | "unknownSchedule") => void;
+
 /**
  * Record one emitted event into the identity's ring. Snapshots RESET the ring
  * (the snapshot's revision becomes the new replay base — a client holding an
@@ -7923,6 +8176,26 @@ export declare const recordReads: <A>(procedure: string, fn: () => Promise<A>, d
  */
 export declare const recordSample: (s: RecordedSample) => void;
 
+export declare const recordScheduleQueued: (name: string, delta: number) => void;
+
+/**
+ * A firing whose replica stopped reporting, and what became of it.
+ *
+ * `adopted` — the firing behind it took it over and ran it. Expected on a
+ * rolling deploy; a deployment seeing it constantly is losing replicas mid-wait,
+ * which is a different problem from a queue that is merely behind.
+ *
+ * `abandoned` — it was silent past the adoption bound, so it was recorded
+ * `missed` and its work will NOT run. That is the one an alert should watch: a
+ * `queue` schedule is chosen precisely because every firing matters.
+ */
+export declare const recordScheduleQueueRecovery: (name: string, outcome: "adopted" | "abandoned") => void;
+
+/** How long a firing sat in the line before it started. The lateness a `queue`
+ *  schedule accumulates is invisible in the duration histogram — that one starts
+ *  at `firedAt`, which is precisely after this. */
+export declare const recordScheduleQueueWait: (name: string, waitedMs: number) => void;
+
 /**
  * Record one schedule firing into the registry: the run counter (by name +
  * status), the duration histogram, and — on success — the last-success gauge.
@@ -8098,6 +8371,8 @@ export declare const registerConnectionStream: (clientId: number, interrupt: ()
  */
 export declare const registerDefaultTupleSource: (source: TupleSource) => boolean;
 
+export declare const registerExternalizedTask: (task: ExternalizedTask) => void;
+
 export { registerRetention }
 
 /**
@@ -8333,6 +8608,9 @@ export declare class ReplicatedDataStore implements DataStore {
     insertIgnore(table: string, row: Row, options: {
         conflictColumns: ReadonlyArray<string>;
     }): Promise<Row>;
+    insertIgnoreWithOutcome(table: string, row: Row, options: {
+        conflictColumns: ReadonlyArray<string>;
+    }): Promise< InsertIgnoreResult>;
     transactional<T>(work: (tx: DataStore) => Promise<T>): Promise<T>;
     onChange(listener: (event: ChangeEvent) => void): () => void;
     /** Cross-instance reactivity seam — delegates to the primary, where the
@@ -8396,6 +8674,25 @@ export declare interface ReplicatedDataStoreOptions {
     readonly now?: () => number;
 }
 
+declare const Request_2: Schema.Struct<{
+    id: Schema.filter<Schema.filter<typeof Schema.String>>;
+    name: Schema.filter<Schema.filter<typeof Schema.String>>;
+    from: typeof Schema.DateFromSelf;
+    to: typeof Schema.DateFromSelf;
+    occurrences: Schema.Array$<Schema.filter<typeof Schema.Number>>;
+    status: Schema.Literal<["queued", "running", "completed", "interrupted"]>;
+    owner: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    createdAt: typeof Schema.DateFromSelf;
+    updatedAt: typeof Schema.DateFromSelf;
+    cursor: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    activeIndex: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.Number>>>;
+    results: Schema.Array$<Schema.Struct<{
+        runId: Schema.filter<Schema.filter<typeof Schema.String>>;
+        status: Schema.Literal<["succeeded", "failed", "skipped", "missed"]>;
+    }>>;
+    error: Schema.NullOr<typeof Schema.String>;
+}>;
+
 export declare interface ResendOptions {
     /** Operator's note, recorded on the resulting attempt row. */
     readonly reason?: string;
@@ -8560,8 +8857,9 @@ export declare interface ResolvedReactiveConfig {
 /**
  * A `WorkflowCallerContext` after the engine has filled in what a workflow
  * always needs. A run started by a request carries the caller's subject; a
- * BOOTSTRAP run — one resumed after a restart with no recorded start context —
- * carries `SYSTEM_SUBJECT`.
+ * deliberate system start carries a persisted system identity. Hosts without
+ * a context resolver run explicitly in system mode; a configured resolver
+ * returning no identity is an error, not a system grant.
  *
  * The engine resolves this so `buildContext` never has to. When each boot path
  * supplied its own fallback, `voltro dev` used the dev REQUEST fallback
@@ -8691,6 +8989,10 @@ export declare type ResolveSubjectFn = (input: {
  */
 export declare const resolveTimelineMode: (env?: Record<string, string | undefined>) => TimelineMode;
 
+/** Select identity before opening a transaction, never while one owns writes.
+ * Only the framework's system subject may select a different tenant. */
+export declare const resolveTransactionSubject: (subject: Subject, tenantId: string | undefined, transactionActive: boolean) => Subject;
+
 /**
  * Resolve the trusted-proxy configuration.
  *
@@ -9583,6 +9885,24 @@ export declare const SCHEDULE_SUBJECT: Subject;
  *  from the last-fired-at row). */
 export declare type ScheduleBackfillPolicy = 'skip' | 'latest' | 'all';
 
+export declare type ScheduleBackfillRequest = typeof Request_2.Type;
+
+export declare const scheduleBackfillRequestsTable: Table<"_voltro_schedule_backfill_requests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly name: ColumnBuilder<string, "text", boolean>;
+    readonly from: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly to: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly occurrences: ColumnBuilder<unknown, "json", boolean>;
+    readonly status: ColumnBuilder<"completed" | "running" | "queued" | "interrupted", "text", boolean>;
+    readonly owner: ColumnBuilder<string | null, "text", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly updatedAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly cursor: ColumnBuilder<number, "integer", boolean>;
+    readonly activeIndex: ColumnBuilder<number | null, "integer", boolean>;
+    readonly results: ColumnBuilder<unknown, "json", boolean>;
+    readonly error: ColumnBuilder<string | null, "text", boolean>;
+}>, true, never>;
+
 /** Context handed to a schedule handler. Mirrors a mutation
  *  executor's `ctx` — same store, same plugin interceptors — plus the
  *  firing metadata. A schedule is "a mutation the clock invokes." */
@@ -9693,16 +10013,18 @@ export declare type ScheduleFireInterceptor = (next: () => Promise<void>, ctx: S
  * thing that silently did nothing. Same bridge a file-based migration's `up`
  * has carried since it shipped.
  *
- * `R = never`: the effect must carry its own requirements. Everything a
- * schedule needs is on `ctx.app`.
+ * The app supplies its outbound HttpClient, including its tracing and SSRF
+ * policy. Other requirements must be provided by the handler.
  */
-export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<void> | Effect.Effect<unknown, unknown, never>;
+export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<void> | Effect.Effect<unknown, unknown, HttpClient.HttpClient>;
 
 /** What happens when a firing arrives while the previous run of the
  *  same schedule is still in flight. */
 export declare type ScheduleOverlapPolicy = 'skip' | 'queue' | 'parallel';
 
 export declare interface SchedulerDeps {
+    /** App-owned service environment; the signal interrupts Effect work on timeout. */
+    readonly runEffect?: (effect: Extract<ReturnType<ScheduleHandler>, Effect.Effect<unknown, unknown, unknown>>, signal: AbortSignal) => Promise<unknown>;
     readonly store: DataStore;
     readonly coordinator: Coordinator;
     /** Default trigger when a schedule doesn't override it. Schedules
@@ -9734,6 +10056,32 @@ export declare interface SchedulerDeps {
      * turning the beat into a spin.
      */
     readonly runHeartbeatMs?: number;
+    /**
+     * How long an abandoned `queue` waiter stays adoptable, measured from its last
+     * beat. Omitted → {@link DEFAULT_QUEUE_ADOPTION_WINDOW_MS}. Both boot paths
+     * pass the resolved `scheduling.queueAdoptionWindowMs`.
+     */
+    readonly queueAdoptionWindowMs?: number;
+    /** How late an external trigger may arrive and still be attributed to its
+     *  occurrence. Default `DEFAULT_EXTERNAL_TRIGGER_SKEW_MS`; always additionally
+     *  bounded by the schedule's own period. */
+    readonly externalTriggerSkewMs?: number;
+    /**
+     * What to do about an occurrence of an `external` schedule that nobody
+     * triggered. Default `'record'`.
+     *
+     *   - `'record'`  — write a `missed` row and count it. The ledger then tells
+     *                   "the platform stopped firing" apart from "this schedule
+     *                   had nothing to do", which in `external` mode look
+     *                   identical otherwise: there is no timer to notice.
+     *   - `'record-and-run'` — also run it. Opt-in, because the whole premise of
+     *                   this mode is that the PLATFORM owns the clock, and a
+     *                   framework that quietly fires anyway has taken it back.
+     *   - `'off'`     — neither.
+     */
+    readonly externalMissedPolicy?: 'record' | 'record-and-run' | 'off';
+    /** How often the external-schedule reconciliation runs. Default 5 minutes. */
+    readonly externalReconcileMs?: number;
     readonly log: SchedulerLogger;
     /** Notify on every run-row insert/update so the SSE bridge can
      *  mirror schedule runs to the cloud dashboard in real time. */
@@ -9755,6 +10103,23 @@ export declare interface SchedulerDeps {
      *  a single-tenant / self-host app; the orchestrator (P3) resolves it
      *  to a deployment. Only consulted in `dormancy: 'sleep'`. */
     readonly dormancyTenantId?: string;
+    /**
+     * How the run ledger announces a change — `store.onChange`, narrowed to what
+     * this engine needs. Both boot paths pass it.
+     *
+     * It shortens a `queue` firing's wait: the blocker clearing is an UPDATE on
+     * `_voltro_schedule_runs`, so a waiter can re-check on the event instead of on
+     * its next poll. It does NOT replace the poll, and the reason is the same
+     * asymmetry the coordinated-task runner documents: the blocking run usually
+     * finishes on ANOTHER replica, and that replica's change event reaches this
+     * process only where CDC or a broadcast transport carries it. Where it does
+     * not, the poll is the whole answer — so the floor stays what it was and this
+     * buys latency, not a longer interval.
+     */
+    readonly onChange?: (listener: (event: {
+        readonly table: string;
+        readonly op: string;
+    }) => void) => () => void;
     /**
      * Optional interceptor wrapping every firing of every schedule.
      * Composed across plugins by the CLI (`composeScheduleFireInterceptors`
@@ -9770,9 +10135,35 @@ export declare interface SchedulerDeps {
 
 export declare interface SchedulerHandle {
     /** Fire a schedule immediately, bypassing the cron clock + the
-     *  coordinator. Used by the manual "Run now" dashboard button + the
-     *  `external` HTTP trigger endpoint. Returns the recorded run id. */
+     *  coordinator. Waits for handler completion and returns the recorded run id. */
     fireNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
+    /** Start immediately and return once the run is recorded, before its handler completes. */
+    startNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
+    /**
+     * The `external` trigger driver's front door: an outside scheduler says "the
+     * cadence says now" and this decides what that means.
+     *
+     * Three things happen here that `fireNow` deliberately does not do, and each
+     * is the reason this is a separate method rather than a flag on that one:
+     *
+     *   1. **The arrival is snapped to an occurrence** of the declared cron
+     *      expression, so `scheduledAt` is derived from the CODE and not from the
+     *      caller's clock. Two deliveries of the same firing therefore carry the
+     *      same instant.
+     *   2. **That instant is claimed** through the store-backed gate, whatever
+     *      coordination the deployment declared. So a redelivery is a no-op
+     *      instead of a second run — which is what makes a platform scheduler's
+     *      at-least-once delivery safe to build on. k8s states plainly that a
+     *      CronJob may create a Job twice for one scheduled time.
+     *   3. **It returns as soon as the RUN ROW exists**, not when the handler is
+     *      done. A schedule may legitimately run for `maxRuntimeMs` (30 minutes
+     *      by default) and no HTTP hop between a job pod and this process will
+     *      hold a connection that long. The caller polls `runStatus`.
+     */
+    triggerExternal(name: string, arrivalAt: Date): Promise<ExternalTriggerOutcome>;
+    /** One run's terminal-or-not state, for a caller polling an accepted trigger
+     *  to completion. `undefined` when no such run exists. */
+    runStatus(runId: string): Promise<ScheduleRunStatus | undefined>;
     /** Fire from a cluster-cron tick. `@effect/cluster` has already
      *  guaranteed exactly-once across the fleet (this runner owns the
      *  shard), so we bypass the in-app coordinator + record the run
@@ -9805,6 +10196,12 @@ export declare interface SchedulerHandle {
         readonly fired: number;
         readonly runIds: ReadonlyArray<string | null>;
     }>;
+    /** Persist an operator range and return its receipt before sequential execution completes. */
+    startBackfillRange(name: string, from: Date, to: Date, options: {
+        readonly cap: number;
+        readonly requestId: string;
+    }): Promise<ScheduleBackfillRequest>;
+    backfillRequest(requestId: string): Promise<ScheduleBackfillRequest | undefined>;
     /** Stop all timers + abort in-flight watchdogs. */
     shutdown(): Promise<void>;
 }
@@ -9835,6 +10232,20 @@ export declare interface ScheduleRunRecord {
     readonly completedAtSec?: number;
 }
 
+/** One run, as a poller sees it. */
+export declare interface ScheduleRunStatus {
+    readonly runId: string;
+    readonly name: string;
+    readonly status: string;
+    readonly trigger: string;
+    readonly scheduledAt: Date | null;
+    readonly firedAt: Date | null;
+    readonly completedAt: Date | null;
+    readonly durationMs: number | null;
+    readonly errorTag: string | null;
+    readonly errorMessage: string | null;
+}
+
 /** Trigger driver — `self` runs an in-app supervised timer; `external`
  *  exposes an HTTP endpoint that an outside scheduler (k8s CronJob,
  *  AWS EventBridge, GCP Cloud Scheduler, …) invokes. */
@@ -10161,6 +10572,12 @@ export declare interface ServeRequestContext {
     readonly subject: unknown;
     readonly traceId: string;
     readonly spanId?: string;
+    /** `'rest'` when the request came through the `publicApi` projection —
+     *  carried onto the plugin interceptor meta so a per-endpoint policy on
+     *  the projection can apply to exactly those calls. Absent on the wire. */
+    readonly surface?: 'rest';
+    /** The descriptor's `publicApi` spec, on a projected call. */
+    readonly publicApi?: PublicApiSpec;
     /**
      * Caller-side cancellation (the gRPC deadline / client-cancel path).
      * Honoured at the ONE place the executor effect runs to a promise, so an
@@ -10222,6 +10639,9 @@ export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown,
      * written; a change-set carry (the rows/ids) is a separate, heavier seam.
      */
     readonly target?: ReadonlyArray<string>;
+    /** See `ServeRequestContext.surface` — present on a REST-projected call. */
+    readonly surface?: 'rest';
+    readonly publicApi?: PublicApiSpec;
 }) => Effect.Effect<unknown, unknown, never>;
 
 /** The published tracer, or `undefined` when tracing is off / no server booted. */
@@ -10280,7 +10700,9 @@ export declare const setTimelineRecorderForTest: (recorder: TimelineRecorder | u
  * `undefined` means the body was synchronous and has already run. Anything else
  * is a promise the caller disposes of as its context requires.
  */
-export declare const settleHandlerBody: (body: HandlerBody) => Promise<unknown> | undefined;
+export declare function settleHandlerBody(body: HandlerBody): Promise<unknown> | undefined;
+
+export declare function settleHandlerBody<R>(body: HandlerBody<R>, run: (effect: Effect.Effect<unknown, unknown, R>) => Promise<unknown>): Promise<unknown> | undefined;
 
 /**
  * Register (or clear) the process-global tuple source. Last write wins.
@@ -10889,8 +11311,9 @@ export { sweepRetention }
  */
 export declare const synthesizeInverse: (cs: ChangeSet) => ReadonlyArray<InverseOp>;
 
-/** The Subject non-request work runs as: a schedule firing, a workflow resumed
- *  after a restart, a `*.subscribe.ts` handler. `tenantId: null` means
+/** The Subject system work runs as: a schedule firing, an explicitly system-started
+ *  workflow, a `*.subscribe.ts` handler. User-started workflows restore their
+ *  recorded identity; a missing context refuses execution. `tenantId: null` means
  *  `applyTenantScope` adds no tenant filter, so system work sees every tenant
  *  rather than one arbitrary one. See this file's header for why it is a single
  *  shared value. */
@@ -10957,6 +11380,14 @@ export { TenantRowNotFound }
 
 export { TenantScopeViolation }
 
+/** The statuses a run never leaves — where a poller stops.
+ *
+ *  `skipped` is terminal and is NOT a failure: it means the overlap policy
+ *  found the previous occurrence still running, which is the policy doing its
+ *  job. A caller that maps it to a non-zero exit turns correct behaviour into
+ *  a page. */
+export declare const TERMINAL_RUN_STATUSES: ReadonlySet<string>;
+
 export declare type TimeBucket = 'minute' | 'hour' | 'day' | 'week' | 'month';
 
 export declare interface TimelineEvent {
@@ -11422,6 +11853,8 @@ export declare class UndoStack<E> {
  */
 export declare const undoSurfaceEnabled: (env?: Record<string, string | undefined>) => boolean;
 
+export declare const unregisterExternalizedTask: (name: string) => void;
+
 /** One `source:` entry that resolves to no declared table. */
 export declare interface UnresolvedSource {
     /** The procedure that declares it. */
@@ -11794,8 +12227,7 @@ export declare const withServerTracer: <A, E, R>(effect: Effect.Effect<A, E, R>)
 
 /**
  * What the gate decided. `passthrough` is the common case — no controls
- * declared — and is distinct from `start` so the facade can skip the commit
- * bookkeeping entirely rather than calling a no-op.
+ * declared — and is distinct from a durably reserved admission.
  */
 export declare type WorkflowAdmissionOutcome = {
     readonly kind: 'passthrough';
@@ -11804,11 +12236,12 @@ export declare type WorkflowAdmissionOutcome = {
     /** What to start WITH. Differs from the caller's payload only for a batch
      *  that filled up on this arrival. */
     readonly payload: unknown;
-    /** Called once the engine returns an execution id: links the ledger row,
-     *  consumes any batched intents, evicts a singleton incumbent. */
-    readonly commit: (executionId: string) => Promise<void>;
+    /** Dispatch the resident submission and return its durably acknowledged
+     * execution ID. Recovery owns retries; callers must not execute separately. */
+    readonly accept: () => Promise<string>;
 } | {
     readonly kind: 'queued';
+    readonly receiptId: string;
     readonly intentId: string;
     readonly mode: string;
     readonly dueAt: number;
@@ -11824,9 +12257,8 @@ export declare interface WorkflowAdmissionRequest {
     readonly workflowName: string;
     readonly payload: unknown;
     readonly callerContext: WorkflowCallerContext | undefined;
-    /** `true` for `run(...)` and `start(..., { wait: true })` — a caller blocking
-     *  for the RESULT. A deferring control has no coherent answer for one, so the
-     *  gate refuses it by name rather than doing something surprising. */
+    /** `true` for `run(...)` and `start(..., { wait: true })`. Admission still
+     * applies normally; queued results are followed through the caller receipt. */
     readonly waiting: boolean;
 }
 
@@ -11835,26 +12267,33 @@ export declare interface WorkflowCallerContext {
     readonly traceId?: string | null;
     readonly source?: string | null;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly parentClosePolicy?: WorkflowParentClosePolicy | null;
 }
 
 export declare interface WorkflowChildOptions {
     readonly wait?: boolean;
+    /* Excluded from this release type: enqueueStart */
     readonly parentClosePolicy?: WorkflowParentClosePolicy;
     /* Excluded from this release type: callerContext */
 }
 
-/**
- * Reject a blocking caller on a workflow whose flow control can DEFER.
- *
- * `run(...)` and `start({ wait: true })` block for the run's RESULT, and there
- * is no result to return for a start that was collapsed into a future run.
- * Silently starting it anyway would break the declared limit; silently
- * returning nothing would break the caller's type. So it is an error that names
- * both halves.
- */
-export declare class WorkflowDeferredResultError extends Error {
-    constructor(workflowName: string, method: string, mode: string);
+export declare interface WorkflowControlOptions {
+    /** Reuse for retries of the same control intent. Requires a resident control
+     * adapter; the identity remains bound to its original execution generation. */
+    readonly requestId: string;
+    /** Stored with first acceptance; retries retain the original cause. */
+    readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+}
+
+/** Control acceptance and execution outcome are independent facts. A resolved
+ * engine command alone supplies neither durable acceptance nor completion. */
+export declare type WorkflowControlResult = WorkflowControlResult_2;
+
+export declare interface WorkflowControlTarget extends WorkflowControlOptions {
+    readonly operation: 'cancel' | 'resume';
+    readonly workflowName: string;
+    readonly executionId: string;
 }
 
 export declare interface WorkflowDefinitionLike {
@@ -11917,6 +12356,30 @@ export declare interface WorkflowEventTriggerResult {
 }
 
 export declare interface WorkflowFacadeOptions {
+    readonly cancelQueued?: (input: WorkflowQueuedControlTarget & {
+        readonly callerContext: WorkflowCallerContext | undefined;
+        readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+    }) => Promise<WorkflowQueuedCancellationResult>;
+    readonly readQueuedCancellation?: (input: WorkflowQueuedControlTarget & {
+        readonly callerContext: WorkflowCallerContext | undefined;
+    }) => Promise<WorkflowQueuedCancellationResult>;
+    /** Read-only resident receipt observation; must not submit an engine command. */
+    readonly readControl?: (target: WorkflowControlTarget) => Promise<WorkflowControlResult>;
+    /** Resident control owner. When configured it owns acceptance, dispatch and
+     * observation completely; the facade must not issue a second engine command
+     * or substitute an engine-only observation when this adapter fails. */
+    readonly control?: (input: {
+        readonly operation: 'cancel' | 'resume';
+        readonly workflowName: string;
+        readonly executionId: string;
+        readonly requestId?: string;
+        readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+    }) => Promise<WorkflowControlResult>;
+    readonly resolveQueuedStart?: (input: {
+        readonly receiptId: string;
+        readonly workflowName: string;
+        readonly callerContext: WorkflowCallerContext | undefined;
+    }) => Promise<WorkflowStartResolution>;
     readonly workflows: ReadonlyArray<DiscoveredWorkflowLike>;
     readonly runEffect: <A>(effect: Effect.Effect<A, unknown, unknown>) => Promise<A>;
     readonly rememberStartContext?: (workflowName: string, executionId: string, context: WorkflowCallerContext) => void | Promise<void>;
@@ -11987,6 +12450,7 @@ export declare interface WorkflowFacadeOptions {
         /** Epoch ms. Always strictly in the future — the facade handles the past. */
         readonly at: number;
     }) => Promise<{
+        readonly receiptId: string;
         readonly intentId: string;
         readonly dueAt: number;
     }>;
@@ -11995,7 +12459,10 @@ export declare interface WorkflowFacadeOptions {
 export declare interface WorkflowLayerExecutionContext {
     readonly workflowName: string;
     readonly executionId: string;
+    /** This body's committed entry generation, not its parent's generation. */
+    readonly generation?: string;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly parentClosePolicy?: WorkflowParentClosePolicy | null;
 }
 
@@ -12012,8 +12479,8 @@ export declare interface WorkflowLayerOptions<Context> {
      * cookie one layer down. This hook is what re-establishes the authority, from
      * the app's live source, on every execution attempt.
      *
-     * Called ONLY for a run that has a recorded caller. A bootstrap run — no
-     * recorded context — is `SYSTEM_SUBJECT` and is not put through it:
+     * Called ONLY for a non-system caller. An explicitly recorded system start
+     * (or a host without a context resolver) is not put through it:
      * `SYSTEM_SUBJECT` already states its own authority, and running it through
      * an app resolver keyed on a null id would be asking a question with no
      * answer.
@@ -12055,6 +12522,17 @@ export declare class WorkflowPayloadError extends Error {
     missingFields: ReadonlyArray<string>, detail: string);
 }
 
+export declare interface WorkflowQueuedControlOptions {
+    readonly callerContext?: WorkflowCallerContext;
+    readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+}
+
+export declare interface WorkflowQueuedControlTarget {
+    readonly workflowName: string;
+    readonly receiptId: string;
+    readonly requestId: string;
+}
+
 /**
  * A blocking caller hit a `rateLimit` cap.
  *
@@ -12134,7 +12612,7 @@ export declare interface WorkflowRunOptions {
 export declare interface WorkflowRunRecord {
     readonly name: string;
     /** Terminal outcome only. `failed` is the dead-letter state (no framework retry). */
-    readonly status: 'succeeded' | 'failed';
+    readonly status: 'succeeded' | 'failed' | 'cancelled';
     readonly durationMs: number;
     /** UNIX SECONDS of completion — set only on success (drives the last-success
      *  gauge). Omit on failure so the gauge keeps pointing at the last real success. */
@@ -12147,17 +12625,9 @@ export declare interface WorkflowRunRecord {
  *  stored column exactly. */
 export declare type WorkflowRunRecordStatus = 'running' | 'succeeded' | 'failed' | 'cancelled' | 'suspended';
 
-export declare interface WorkflowRunSnapshot<Success = unknown> {
-    readonly id: string;
-    readonly workflowName: string;
-    readonly executionId: string;
-    readonly status: WorkflowRunStatus;
+export declare type WorkflowRunSnapshot<Success = unknown> = Omit<WorkflowRunSnapshot_2, 'output'> & {
     readonly output?: Success;
-    readonly error?: {
-        readonly tag: string | null;
-        readonly message: string;
-    };
-}
+};
 
 export declare type WorkflowRunStatus = 'running' | 'succeeded' | 'failed' | 'cancelled' | 'suspended' | 'unknown';
 
@@ -12194,8 +12664,12 @@ export declare interface WorkflowsAppContext {
     query<Success = unknown>(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot<Success>>;
     wait<Success = unknown>(handle: WorkflowRunHandle, options?: WorkflowWaitOptions): Promise<WorkflowRunSnapshot<Success>>;
     wait<Success = unknown>(workflowName: string, executionId: string, options?: WorkflowWaitOptions): Promise<WorkflowRunSnapshot<Success>>;
-    cancel(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot>;
-    resume(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot>;
+    cancel(workflowName: string, executionId: string, options?: WorkflowControlOptions): Promise<WorkflowControlResult>;
+    resume(workflowName: string, executionId: string, options?: WorkflowControlOptions): Promise<WorkflowControlResult>;
+    /** Observe the original resident request without submitting or retrying it. */
+    readControl(target: WorkflowControlTarget): Promise<WorkflowControlResult>;
+    cancelQueued(target: WorkflowQueuedControlTarget, options?: WorkflowQueuedControlOptions): Promise<WorkflowQueuedCancellationResult>;
+    readQueuedCancellation(target: WorkflowQueuedControlTarget, options?: Pick<WorkflowQueuedControlOptions, 'callerContext'>): Promise<WorkflowQueuedCancellationResult>;
     signal(target: WorkflowSignalTarget, signalName: string, payload?: unknown): Promise<{
         readonly eventId: string;
     }>;
@@ -12232,6 +12706,20 @@ export declare class WorkflowSingletonHeldError extends Error {
     constructor(workflowName: string, executionId: string);
 }
 
+/** Persist a validated start through the business transaction's store. The
+ * returned identity is provisional until that transaction commits. */
+export declare type WorkflowStartEnqueue = (input: {
+    readonly workflowName: string;
+    /** Encoded using the arrival schema, not the decoded in-process payload. */
+    readonly payload: unknown;
+    readonly callerContext: WorkflowCallerContext | undefined;
+    readonly at: number;
+}) => Promise<{
+    readonly receiptId: string;
+    readonly intentId: string;
+    readonly dueAt: number;
+}>;
+
 /** The slice of a `workflow()` definition the start runner reads — its name
  *  and its resolved access decision (`workflowAccessDescriptor` produces it). */
 export declare interface WorkflowStartLike {
@@ -12239,8 +12727,23 @@ export declare interface WorkflowStartLike {
     readonly guards?: ReadonlyArray<AnyCheckSpec> | undefined;
 }
 
+export declare class WorkflowStartNotExecuted extends WorkflowStartNotExecuted_base {
+}
+
+declare const WorkflowStartNotExecuted_base: Schema.TaggedErrorClass<WorkflowStartNotExecuted, "WorkflowStartNotExecuted", {
+    readonly _tag: Schema.tag<"WorkflowStartNotExecuted">;
+} & {
+    workflowName: typeof Schema.String;
+    handleId: typeof Schema.String;
+    reason: Schema.Literal<["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
+    failureId: Schema.NullOr<typeof Schema.String>;
+    incumbentExecutionId: Schema.NullOr<typeof Schema.String>;
+}>;
+
 export declare interface WorkflowStartOptions {
+    /* Excluded from this release type: preparedExecutionId */
     readonly wait?: boolean;
+    /* Excluded from this release type: enqueueStart */
     /**
      * Delayed one-off start: park this start DURABLY and let it arrive at `at`.
      *
@@ -12260,9 +12763,9 @@ export declare interface WorkflowStartOptions {
      * handle has `status: 'queued'` with `deferral: { mode: 'delayed', dueAt }`.
      *
      * An `at` in the past (or now) starts immediately — the caller said "no
-     * earlier than", and that is already true. Combining `at` with
-     * `wait: true` is refused: there is no result to block on for a start that
-     * exists only as a future row.
+     * earlier than", and that is already true. With `wait: true`, follow the
+     * durable caller receipt through the delayed arrival and any further
+     * admission deferral, then wait for the accepted execution's result.
      */
     readonly at?: Date;
     /* Excluded from this release type: callerContext */
@@ -12285,6 +12788,7 @@ export declare interface WorkflowUpdateOptions {
 export declare interface WorkflowWaitOptions {
     readonly pollIntervalMs?: number;
     readonly timeoutMs?: number;
+    /* Excluded from this release type: callerContext */
 }
 
 /**