@voltro/runtime 0.70.0 → 0.71.1

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { CaughtUpVerdict } from '@voltro/database';
 import { ChangeEvent } from '@voltro/database';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
+import { ColumnBuilder } from '@voltro/database';
 import { ConnectionCredential } from '@voltro/protocol';
 import { ConnectionInfo } from '@voltro/protocol';
 import { ConnectionInfoMiddleware } from '@voltro/protocol';
@@ -35,6 +36,7 @@ import { extractDbCause } from '@voltro/database';
 import { Fiber } from 'effect';
 import { FieldBinding } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
+import { FieldDefinitions } from '@voltro/database';
 import * as http from 'node:http';
 import { HttpClient } from '@effect/platform';
 import { HttpRequestInterceptor } from '@voltro/protocol';
@@ -62,6 +64,7 @@ import { MutationIdempotencyScope } from '@voltro/protocol';
 import { NoRowFound } from '@voltro/protocol';
 import { PendingApproval } from '@voltro/protocol';
 import { PluginHttpRoute } from '@voltro/protocol';
+import { PluginHttpRouteByteStream } from '@voltro/protocol';
 import { PluginRefOrphanPolicy } from '@voltro/database';
 import { Predicate } from '@voltro/database';
 import { PublicApiSpec } from '@voltro/protocol';
@@ -99,6 +102,7 @@ import { SubjectService } from '@voltro/protocol';
 import { SubscriptionEvent } from '@voltro/protocol';
 import { sweepRetention } from '@voltro/database';
 import { SyncLogger } from '@voltro/logger';
+import { Table } from '@voltro/database';
 import { TableLike } from '@voltro/database';
 import { TableName } from '@voltro/protocol';
 import { TableValidationFailed } from '@voltro/protocol';
@@ -113,8 +117,13 @@ import { ValidationError } from '@voltro/protocol';
 import { ValidationErrors } from '@voltro/protocol';
 import { VersionConflict } from '@voltro/database';
 import { WebSocketGatewayRoute } from '@voltro/protocol';
+import { WorkflowControlRequest } from '@voltro/workflow';
+import { WorkflowControlResult as WorkflowControlResult_2 } from '@voltro/protocol';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
+import { WorkflowQueuedCancellationResult } from '@voltro/protocol';
 import { WorkflowRunHandle } from '@voltro/protocol';
+import { WorkflowRunSnapshot as WorkflowRunSnapshot_2 } from '@voltro/protocol';
+import { WorkflowStartResolution } from '@voltro/workflow';
 import { WorkflowUpdateResult } from '@voltro/protocol';
 
 /** Typed denial — declare on an rpc `error:` union so a refusal surfaces to the
@@ -1067,6 +1076,14 @@ export declare interface AppAccess {
 }
 
 export declare interface AppContext {
+    /** Run database work with a freshly transaction-bound context. Reuses an
+     * existing mutation transaction (no savepoint). The callback may be retried;
+     * keep external I/O out of it and use its store/workflows, not captured ones.
+     * A system context may select a tenant before opening the transaction;
+     * nested transactions cannot change tenants. */
+    readonly transaction: <A>(work: (context: AppContext) => Promise<A>, options?: {
+        readonly tenantId?: string;
+    }) => Promise<A>;
     readonly store: FluentStore;
     /**
      * The same store, scoped to ONE tenant.
@@ -2423,6 +2440,33 @@ export declare interface CoordinatedScheduleDeps {
      * opt a task out of backing off entirely — which is the right call only for a
      * task whose work cannot announce itself.
      */
+    /**
+     * Drive this task from OUTSIDE instead of from a timer — see
+     * `externalizedTasks.ts`.
+     *
+     * When set, the task arms nothing and instead registers itself so the
+     * external trigger endpoint can run one tick on demand. A cadence no platform
+     * scheduler can express is REFUSED, loudly, and the timer is armed as usual:
+     * a task silently left ticking while the deployment believes it was
+     * externalised is worse than one that was never externalised.
+     */
+    readonly externalize?: boolean;
+    /**
+     * The gate an EXTERNALLY driven tick claims through. Defaults to
+     * `coordinator`, which is right only when that is store-backed.
+     *
+     * It is a separate field because the two gates answer different questions.
+     * `coordinator` gates a TIMER tick, and `singleCoordinator` answers `true`
+     * unconditionally for a very good reason: one process's timer cannot race
+     * itself, so there is nothing to gate and a claim row per tick would be pure
+     * cost — at 250 ms, four rows a second, forever. An externally driven tick is
+     * the opposite case: the duplicate does not come from a second replica, it
+     * comes from the same platform delivering once more, and a one-pod deployment
+     * is fully exposed to it. Sharing one field would have meant either a dedupe
+     * that silently does nothing on the simplest deployment, or a write storm on
+     * every fast task.
+     */
+    readonly externalClaim?: Coordinator;
     readonly maxIdleIntervalMs?: number;
     /**
      * **Stop ticking entirely** on an idle tick with no known deadline, and come
@@ -2771,6 +2815,18 @@ export declare const countRunningWorkflows: (store: DataStore) => Promise<number
 
 export declare const crdtCompactMaxBytes: () => number;
 
+/**
+ * The cron expression that fires `intervalMs` apart, or `undefined` when no
+ * five-field expression does.
+ *
+ * Cron is not an interval language: it fires at MATCHING instants, so only
+ * cadences that tile the hour (or the day) evenly can be expressed. Seven
+ * minutes cannot — `*\/7 * * * *` fires at :00 :07 … :56 and then again at :00,
+ * four minutes later. Refusing is the honest answer; emitting it would produce a
+ * schedule that is subtly wrong once an hour, forever.
+ */
+export declare const cronForInterval: (intervalMs: number) => string | undefined;
+
 /**
  * Every firing instant of `def` in `(from, to]`, oldest first, bounded by
  * `cap + 1` entries.
@@ -3077,6 +3133,28 @@ export declare const DEFAULT_CRDT_COMPACT_MAX_BYTES: number;
  */
 export declare const DEFAULT_DELIVERY_CONCURRENCY = 8;
 
+/** How often unfired occurrences are reconciled. Coarse on purpose: it exists
+ *  to make silence visible, not to be a second clock. */
+export declare const DEFAULT_EXTERNAL_RECONCILE_MS: number;
+
+/**
+ * How much later than its own occurrence an external trigger may arrive and
+ * still be attributed to it.
+ *
+ * The number exists because a platform scheduler is not punctual, and that is
+ * not a defect in it: a k8s CronJob waits on the controller, on scheduling, on
+ * an image pull, and a Job with `backoffLimit` retries minutes later. EVERY one
+ * of those arrivals means the same occurrence, and the exactly-once property
+ * depends on all of them snapping to one `scheduledAt`.
+ *
+ * It is bounded on the other side by the schedule's own period (see
+ * `triggerExternal`), so an arrival can never be attributed to an occurrence
+ * older than the previous one. That bound is the half that matters for safety:
+ * a CronJob carrying a cron expression the app no longer declares must be
+ * REJECTED, not silently accepted as a very late firing of something else.
+ */
+export declare const DEFAULT_EXTERNAL_TRIGGER_SKEW_MS: number;
+
 /** 180 days + subdomains. Deliberately NOT `preload`: preload is effectively
  *  irreversible for a domain, so it must be a deployment decision, never a
  *  framework default. */
@@ -3328,7 +3406,7 @@ export declare const defineExperiment: (input: ExperimentDefinitionInput) => Exp
  * delivery is at-least-once, so a process that dies between "the remote
  * accepted it" and "we marked it delivered" will retry.
  */
-export declare const defineOutboxHandler: (definition: OutboxHandlerDefinition) => OutboxHandlerDefinition;
+export declare const defineOutboxHandler: <R = never>(definition: OutboxHandlerDefinition<R>) => OutboxHandlerDefinition<R>;
 
 /** Declare a reaction. Validates that the MANDATORY guard is present — an
  *  ungated reaction is a spend-storm footgun, so this fails LOUD at boot. */
@@ -3624,9 +3702,13 @@ export declare interface DispatcherDependencies {
  *  invisible to a waker looking under the other's key. */
 export declare const DORMANCY_WAKEUP_TENANT = "default";
 
-export declare interface DrainDeps {
+export declare interface DrainDeps<R = never> {
     readonly store: Pick<DataStore, 'query' | 'update' | 'updateMany' | 'insert' | 'delete'>;
-    readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition>;
+    readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition<R>>;
+    /** Execute with the application's services. Required by drainOutbox when R
+     * is not never. A service-free standalone drain uses Effect.runPromise.
+     * Row identity is metadata, not a restored authorization decision. */
+    readonly runEffect?: (effect: Effect.Effect<unknown, unknown, R>, ctx: OutboxHandlerContext) => Promise<unknown>;
     readonly now?: () => Date;
     /** Max rows per drain pass. */
     readonly batchSize?: number;
@@ -3689,7 +3771,9 @@ export declare const drainForShutdown: (options: {
     }) => void;
 }) => void;
 
-export declare const drainOutbox: (deps: DrainDeps) => Promise<DrainResult>;
+export declare const drainOutbox: <R = never>(deps: DrainDeps<R> & ([R] extends [never] ? unknown : {
+    readonly runEffect: NonNullable<DrainDeps<R>["runEffect"]>;
+})) => Promise<DrainResult>;
 
 export declare interface DrainResult {
     readonly delivered: number;
@@ -4156,7 +4240,7 @@ export declare interface EventPublishContext {
      * A display reacting to a game start the database rolled back is not a race
      * that is unlikely, it is one that happens on every constraint violation.
      */
-    readonly deferToCommit?: ((deliver: () => void) => void) | undefined;
+    readonly deferToCommit?: ((deliver: () => Promise<void>) => void) | undefined;
     /**
      * The DURABLE audience — the workflow-trigger path.
      *
@@ -4165,11 +4249,11 @@ export declare interface EventPublishContext {
      * starts whatever workflows are triggered by it. Absent when the app declares
      * no triggers, so an app that only fans out to clients pays nothing.
      *
-     * Deliberately fire-and-forget from `publish`'s point of view: a trigger that
-     * fails must not fail the mutation that published, for the same reason a
-     * broker outage does not. The trigger's own delivery row records the failure.
+     * Completion acknowledges this audience's write, not completion of triggered
+     * workflows or HTTP delivery. A persistence failure rejects publication. In a
+     * mutation the receipt is deferred; the post-commit drain must await delivery.
      */
-    readonly onPublished?: ((eventName: string, payload: unknown, descriptor: unknown) => void) | undefined;
+    readonly onPublished?: ((eventName: string, payload: unknown, descriptor: unknown) => void | Promise<void>) | undefined;
 }
 
 export declare interface EventPublisher {
@@ -4224,6 +4308,7 @@ export declare interface EventsFacadeOptions {
     readonly subject?: Subject;
     readonly traceId?: string;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly startWorkflow: (workflowName: string, payload: unknown, callerContext: WorkflowCallerContext) => Promise<WorkflowRunHandle>;
     readonly emit?: (channel: 'workflowDomainEvents' | 'workflowEventDeliveries', event: {
         readonly op: 'insert' | 'update';
@@ -4774,11 +4859,91 @@ export declare interface ExperimentVariantSpec {
     readonly weight?: number;
 }
 
+/**
+ * How far AHEAD of now an external trigger's stated instant may be.
+ *
+ * The skew budget is one-directional — it forgives a LATE arrival, which is the
+ * only kind a platform scheduler produces. Nothing bounded an EARLY one, and
+ * the gap was reachable: a caller stating `at` a month out had that future
+ * occurrence snapped, claimed and run, and the real firing was then answered as
+ * a duplicate and its work silently never happened. One wrong value in a
+ * manifest and a schedule loses a firing with nothing in the ledger saying so.
+ *
+ * A minute covers the clock drift between a job pod and the app; beyond that it
+ * is not drift, it is a caller asserting a time it cannot know.
+ */
+export declare const EXTERNAL_TRIGGER_AHEAD_TOLERANCE_MS = 60000;
+
+/** Why a task cannot be externalised, in words an operator can act on. */
+export declare const externalizationRefusal: (name: string, intervalMs: number) => string | undefined;
+
+export declare interface ExternalizedTask {
+    readonly name: string;
+    readonly intervalMs: number;
+    /** The five-field expression a manifest for this task carries. */
+    readonly cron: string;
+    /** Run one tick now. Claims the same bucket a timer tick would, so a
+     *  redelivery inside one interval is a no-op rather than a second run. */
+    readonly run: () => Promise<'ran' | 'deduplicated'>;
+}
+
+export declare const externalizedTask: (name: string) => ExternalizedTask | undefined;
+
+export declare const externalizedTaskNames: () => ReadonlyArray<string>;
+
 /** Build an Effect `ExternalSpan` parent from a `traceparent` header so
  *  inbound HTTP work continues the caller's trace. Returns undefined
  *  when the header is missing/invalid (no parent → a fresh root span). */
 export declare const externalSpanFromTraceparent: (header: string | undefined | null) => Tracer.ExternalSpan | undefined;
 
+/** What an external trigger did. Every arm is a deliberate answer to the
+ *  caller — a job pod whose exit code an operator's alerting reads. */
+export declare type ExternalTriggerOutcome = 
+/** The occurrence was claimed by THIS request; the handler is now running.
+*  `runId` is `undefined` only when the ledger write itself failed — the run
+*  still happens (see `runQueued`'s note on the same trade). */
+    {
+    readonly kind: 'accepted';
+    readonly runId: string | undefined;
+    readonly scheduledAt: Date;
+}
+/** Someone already claimed this occurrence — a retry, a second delivery, or
+*  another replica's CronJob. NOT an error: it is the guarantee working. */
+| {
+    readonly kind: 'duplicate';
+    readonly runId: string | undefined;
+    readonly scheduledAt: Date;
+}
+/** The arrival snapped to no occurrence within the skew budget. Almost always
+*  an out-of-date manifest: the cron expression in the cluster is no longer
+*  the one in the code. */
+| {
+    readonly kind: 'noOccurrence';
+    readonly arrivalAt: Date;
+    readonly skewMs: number;
+    readonly cron: string;
+    readonly timezone: string;
+}
+/** The stated instant is further ahead than clock drift explains. Refused
+*  rather than honoured: claiming an occurrence before it is due turns the
+*  real firing into a duplicate and loses its work. */
+| {
+    readonly kind: 'ahead';
+    readonly arrivalAt: Date;
+    readonly now: Date;
+    readonly toleranceMs: number;
+} | {
+    readonly kind: 'unknownSchedule';
+    readonly name: string;
+}
+/** The schedule is driven by the in-app timer. Firing it from outside as well
+*  would run it twice, so this is refused rather than honoured. */
+| {
+    readonly kind: 'notExternal';
+    readonly name: string;
+    readonly trigger: ScheduleTrigger;
+};
+
 export { extractDbCause }
 
 export declare interface FieldChange {
@@ -5113,7 +5278,7 @@ export declare interface GroupState {
 }
 
 /** What a user handler may return. */
-export declare type HandlerBody = void | Promise<unknown> | Effect.Effect<unknown, unknown, never>;
+export declare type HandlerBody<R = never> = void | Promise<unknown> | Effect.Effect<unknown, unknown, R>;
 
 /**
  * Deterministic hash of a string into the unit interval `[0, 1)` — FNV-1a
@@ -5274,6 +5439,9 @@ export declare class InMemoryDataStore implements DataStore {
     insertIgnore(table: string, row: Row, options: {
         conflictColumns: ReadonlyArray<string>;
     }): Promise<Row>;
+    insertIgnoreWithOutcome(table: string, row: Row, options: {
+        conflictColumns: ReadonlyArray<string>;
+    }): Promise<InsertIgnoreResult>;
     transactional<T>(work: (tx: DataStore) => Promise<T>): Promise<T>;
     onChange(listener: (event: ChangeEvent) => void): () => void;
     /** Cross-instance reactivity seam — emit an externally-sourced event to
@@ -5304,14 +5472,18 @@ export declare interface InspectRoute {
      *  rpc server reads it (UTF-8) and passes it as the 4th arg; GET
      *  callers pass undefined. Body parsing — JSON, validation —
      *  happens in the handler. */
-    readonly handle: (url: string, headers: Readonly<Record<string, string>>, method: string, body?: string) => {
+    readonly handle: (url: string, headers: Readonly<Record<string, string>>, method: string, body?: string, 
+    /** Aborted when the HTTP request disconnects or the server shuts down. */
+    signal?: AbortSignal) => {
         readonly status: number;
         readonly contentType: string;
+        readonly byteStream?: PluginHttpRouteByteStream;
         readonly body: string;
         readonly headers?: Readonly<Record<string, string>>;
     } | Promise<{
         readonly status: number;
         readonly contentType: string;
+        readonly byteStream?: PluginHttpRouteByteStream;
         readonly body: string;
         readonly headers?: Readonly<Record<string, string>>;
     } | null> | null;
@@ -5325,6 +5497,8 @@ export { InspectStore }
  * stream. The cli's dev.ts wires this with its inspect bus.
  */
 export declare interface InspectStream {
+    readonly replicaId?: string;
+    readonly select?: (url: string, headers: Readonly<Record<string, string>>) => Stream.Stream<Uint8Array, unknown> | undefined;
     /** Same shape as the inspect auth resolver — returns ok or reason. */
     readonly authorize: (headers: Readonly<Record<string, string>>) => {
         readonly ok: true;
@@ -5949,7 +6123,13 @@ export declare const makeConnectionState: (connection: RpcConnection, afterCommi
  * handle is tracked by the caller (the CLI) so `onDeactivate` can stop
  * every task a plugin armed.
  */
-export declare const makeCoordinatedScheduler: (deps: CoordinatedScheduleDeps) => PluginScheduleCoordinated;
+export declare const makeCoordinatedScheduler: (deps: CoordinatedScheduleDeps & {
+    /** Decides, per task, whether the platform drives it instead of a timer.
+     *  Bound here rather than passed by each caller: every framework and plugin
+     *  periodic task goes through this factory, so this is the one place the
+     *  policy can be applied without a caller being forgotten. */
+    readonly externalizeTask?: (name: string) => boolean;
+}) => PluginScheduleCoordinated;
 
 /**
  * Build a request-scoped loader. One instance per AppContext — see the module
@@ -6090,8 +6270,6 @@ export declare const makeOriginGuardExemption: (input: {
 
 export declare const makeOutboxFacade: (deps: OutboxFacadeDeps) => OutboxFacade;
 
-export declare const makePostCommitWorkflowFacade: (base: WorkflowsAppContext, afterCommit: (work: () => Promise<unknown>) => void) => WorkflowsAppContext;
-
 /**
  * A `WakeAdapter` that brings a single-node app process up via an
  * `AppSupervisor`. `wake` is idempotent — `start()` no-ops when the app
@@ -6187,6 +6365,8 @@ export declare const makeSubmitTokenExecutor: (deps: ConnectionBuiltinDeps) => (
 
 export declare const makeSubscriptionOutbox: <T = ReadonlyArray<Row>>(options: SubscriptionBackpressureOptions) => SubscriptionOutbox<T>;
 
+export declare const makeTransactionalWorkflowFacade: (base: WorkflowsAppContext, enqueueStart: WorkflowStartEnqueue) => WorkflowsAppContext;
+
 /**
  * The factory the serve entrypoints inject into `makeMutationRunner`'s
  * `undoCapture` dep. Collects changes from the wrapped tx; `persist` writes ONE
@@ -6222,9 +6402,9 @@ export declare const makeWorkflowFacadeWithCallerContext: (base: WorkflowsAppCon
 
 export declare const makeWorkflowHandlers: (workflows: ReadonlyArray<DiscoveredWorkflowLike>, facade?: WorkflowsAppContext) => Record<string, (input: unknown) => Effect.Effect<WorkflowRunHandle, unknown, unknown>>;
 
-export declare const makeWorkflowLayers: <Context>(workflows: ReadonlyArray<DiscoveredWorkflowLike<Context>>, options: WorkflowLayerOptions<Context>, wrapExecute?: (workflow: DiscoveredWorkflowLike<Context>, execute: (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>, callerContext: ResolvedWorkflowCallerContext) => (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>) => ReadonlyArray<Layer.Layer<unknown, unknown, unknown>>;
+export declare const makeWorkflowLayers: <Context>(workflows: ReadonlyArray<DiscoveredWorkflowLike<Context>>, options: WorkflowLayerOptions<Context>, wrapExecute?: (workflow: DiscoveredWorkflowLike<Context>, execute: (payload: never, executionId: string, generation?: string) => Effect.Effect<unknown, unknown, unknown>, callerContext: ResolvedWorkflowCallerContext) => (payload: never, executionId: string) => Effect.Effect<unknown, unknown, unknown>) => ReadonlyArray<Layer.Layer<unknown, unknown, unknown>>;
 
-export declare const makeWorkflowRunHandle: (workflowName: string, executionId: string) => WorkflowRunHandle;
+export declare const makeWorkflowRunHandle: (workflowName: string, executionId: string, status: "running" | "succeeded") => WorkflowRunHandle;
 
 /**
  * Build the shared WORKFLOW START runner — the third member of the family,
@@ -6500,6 +6680,9 @@ export declare type MetricSampleType = 'counter' | 'gauge' | 'histogram' | 'summ
  *  into the OTel MeterProvider when a `metricReader` is configured. */
 export declare type MetricsMode = 'off' | 'console' | 'otlp' | 'memory';
 
+/** The lowest cadence any platform scheduler can express. */
+export declare const MIN_EXTERNALIZABLE_INTERVAL_MS = 60000;
+
 /**
  * Ordering token for one mirrored write.
  *
@@ -6531,6 +6714,10 @@ export declare const missingRowError: (info: NoRowFoundInfo, onMissing: OnMissin
 
 export declare interface MutationLifecycle {
     readonly afterCommit: (work: () => Promise<unknown>) => void;
+    /** Already selected physical, namespace-bound nontransactional store.
+     * Required by contexts delivering durable events after commit; never resolve
+     * placement again or reuse the transaction for that delivery. */
+    readonly committedStore?: unknown;
 }
 
 export declare interface MutationLike {
@@ -6568,6 +6755,9 @@ export declare interface MutationOutputCodec<Output> {
 
 export declare interface MutationRunnerDeps {
     readonly store: TransactionalStore;
+    /** Select and provision the request's physical store before opening its
+     * transaction. Resolved once, including across retries and post-commit folds. */
+    readonly resolveStore?: (request: ServeRequestContext) => Promise<TransactionalStore> | TransactionalStore;
     /**
      * How many times a mutation's transaction runs before a replayable failure
      * (contention, a transaction-read conflict) surfaces. Resolved by the CLI
@@ -7109,6 +7299,11 @@ export declare interface OutboxFacadeDeps {
 }
 
 export declare interface OutboxHandlerContext {
+    /** Stable identity of this delivery intent, preserved across retries. */
+    readonly outboxId: string;
+    /** Caller-supplied enqueue key, or null. Unlike outboxId this can be reused
+     * for a distinct intent after an earlier intent has been delivered. */
+    readonly idempotencyKey: string | null;
     readonly payload: Record<string, unknown>;
     readonly attempt: number;
     readonly subjectId: string | null;
@@ -7116,9 +7311,9 @@ export declare interface OutboxHandlerContext {
     readonly traceId: string | null;
 }
 
-export declare interface OutboxHandlerDefinition {
+export declare interface OutboxHandlerDefinition<R = never> {
     readonly effect: string;
-    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown>;
+    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
     /** Give up after this many attempts, then dead-letter. Default 8. */
     readonly maxAttempts?: number;
 }
@@ -7784,6 +7979,13 @@ export declare interface ReadClassification {
     readonly restricting: ReadonlySet<string>;
 }
 
+/** First-or-null for a boot DataStore or a query-only tuple source. It invokes
+ * the supplied query path, preserving that path's filters and codecs. A raw
+ * driver remains raw; this helper does not add request scoping. */
+export declare const readMaybeOne: <R = Row>(store: Pick<DataStore, "query">, query: QueryDescriptor<R> | {
+    readonly descriptor: QueryDescriptor<R>;
+}) => Promise<R | null>;
+
 /**
  * The ceiling, tunable per deployment via `VOLTRO_POLL_CEILING_MS`.
  *
@@ -7912,6 +8114,10 @@ export declare const recordEventPublished: (event: string) => void;
 /** Subscriber attached (+1) or detached (-1). */
 export declare const recordEventSubscribers: (event: string, delta: number) => void;
 
+export declare const recordExternalMissed: (name: string, count?: number) => void;
+
+export declare const recordExternalTrigger: (name: string, outcome: "accepted" | "duplicate" | "noOccurrence" | "ahead" | "notExternal" | "unknownSchedule") => void;
+
 /**
  * Record one emitted event into the identity's ring. Snapshots RESET the ring
  * (the snapshot's revision becomes the new replay base — a client holding an
@@ -7970,6 +8176,26 @@ export declare const recordReads: <A>(procedure: string, fn: () => Promise<A>, d
  */
 export declare const recordSample: (s: RecordedSample) => void;
 
+export declare const recordScheduleQueued: (name: string, delta: number) => void;
+
+/**
+ * A firing whose replica stopped reporting, and what became of it.
+ *
+ * `adopted` — the firing behind it took it over and ran it. Expected on a
+ * rolling deploy; a deployment seeing it constantly is losing replicas mid-wait,
+ * which is a different problem from a queue that is merely behind.
+ *
+ * `abandoned` — it was silent past the adoption bound, so it was recorded
+ * `missed` and its work will NOT run. That is the one an alert should watch: a
+ * `queue` schedule is chosen precisely because every firing matters.
+ */
+export declare const recordScheduleQueueRecovery: (name: string, outcome: "adopted" | "abandoned") => void;
+
+/** How long a firing sat in the line before it started. The lateness a `queue`
+ *  schedule accumulates is invisible in the duration histogram — that one starts
+ *  at `firedAt`, which is precisely after this. */
+export declare const recordScheduleQueueWait: (name: string, waitedMs: number) => void;
+
 /**
  * Record one schedule firing into the registry: the run counter (by name +
  * status), the duration histogram, and — on success — the last-success gauge.
@@ -8145,6 +8371,8 @@ export declare const registerConnectionStream: (clientId: number, interrupt: ()
  */
 export declare const registerDefaultTupleSource: (source: TupleSource) => boolean;
 
+export declare const registerExternalizedTask: (task: ExternalizedTask) => void;
+
 export { registerRetention }
 
 /**
@@ -8380,6 +8608,9 @@ export declare class ReplicatedDataStore implements DataStore {
     insertIgnore(table: string, row: Row, options: {
         conflictColumns: ReadonlyArray<string>;
     }): Promise<Row>;
+    insertIgnoreWithOutcome(table: string, row: Row, options: {
+        conflictColumns: ReadonlyArray<string>;
+    }): Promise< InsertIgnoreResult>;
     transactional<T>(work: (tx: DataStore) => Promise<T>): Promise<T>;
     onChange(listener: (event: ChangeEvent) => void): () => void;
     /** Cross-instance reactivity seam — delegates to the primary, where the
@@ -8443,6 +8674,25 @@ export declare interface ReplicatedDataStoreOptions {
     readonly now?: () => number;
 }
 
+declare const Request_2: Schema.Struct<{
+    id: Schema.filter<Schema.filter<typeof Schema.String>>;
+    name: Schema.filter<Schema.filter<typeof Schema.String>>;
+    from: typeof Schema.DateFromSelf;
+    to: typeof Schema.DateFromSelf;
+    occurrences: Schema.Array$<Schema.filter<typeof Schema.Number>>;
+    status: Schema.Literal<["queued", "running", "completed", "interrupted"]>;
+    owner: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    createdAt: typeof Schema.DateFromSelf;
+    updatedAt: typeof Schema.DateFromSelf;
+    cursor: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    activeIndex: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.Number>>>;
+    results: Schema.Array$<Schema.Struct<{
+        runId: Schema.filter<Schema.filter<typeof Schema.String>>;
+        status: Schema.Literal<["succeeded", "failed", "skipped", "missed"]>;
+    }>>;
+    error: Schema.NullOr<typeof Schema.String>;
+}>;
+
 export declare interface ResendOptions {
     /** Operator's note, recorded on the resulting attempt row. */
     readonly reason?: string;
@@ -8607,8 +8857,9 @@ export declare interface ResolvedReactiveConfig {
 /**
  * A `WorkflowCallerContext` after the engine has filled in what a workflow
  * always needs. A run started by a request carries the caller's subject; a
- * BOOTSTRAP run — one resumed after a restart with no recorded start context —
- * carries `SYSTEM_SUBJECT`.
+ * deliberate system start carries a persisted system identity. Hosts without
+ * a context resolver run explicitly in system mode; a configured resolver
+ * returning no identity is an error, not a system grant.
  *
  * The engine resolves this so `buildContext` never has to. When each boot path
  * supplied its own fallback, `voltro dev` used the dev REQUEST fallback
@@ -8738,6 +8989,10 @@ export declare type ResolveSubjectFn = (input: {
  */
 export declare const resolveTimelineMode: (env?: Record<string, string | undefined>) => TimelineMode;
 
+/** Select identity before opening a transaction, never while one owns writes.
+ * Only the framework's system subject may select a different tenant. */
+export declare const resolveTransactionSubject: (subject: Subject, tenantId: string | undefined, transactionActive: boolean) => Subject;
+
 /**
  * Resolve the trusted-proxy configuration.
  *
@@ -9630,6 +9885,24 @@ export declare const SCHEDULE_SUBJECT: Subject;
  *  from the last-fired-at row). */
 export declare type ScheduleBackfillPolicy = 'skip' | 'latest' | 'all';
 
+export declare type ScheduleBackfillRequest = typeof Request_2.Type;
+
+export declare const scheduleBackfillRequestsTable: Table<"_voltro_schedule_backfill_requests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly name: ColumnBuilder<string, "text", boolean>;
+    readonly from: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly to: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly occurrences: ColumnBuilder<unknown, "json", boolean>;
+    readonly status: ColumnBuilder<"completed" | "running" | "queued" | "interrupted", "text", boolean>;
+    readonly owner: ColumnBuilder<string | null, "text", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly updatedAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly cursor: ColumnBuilder<number, "integer", boolean>;
+    readonly activeIndex: ColumnBuilder<number | null, "integer", boolean>;
+    readonly results: ColumnBuilder<unknown, "json", boolean>;
+    readonly error: ColumnBuilder<string | null, "text", boolean>;
+}>, true, never>;
+
 /** Context handed to a schedule handler. Mirrors a mutation
  *  executor's `ctx` — same store, same plugin interceptors — plus the
  *  firing metadata. A schedule is "a mutation the clock invokes." */
@@ -9740,16 +10013,18 @@ export declare type ScheduleFireInterceptor = (next: () => Promise<void>, ctx: S
  * thing that silently did nothing. Same bridge a file-based migration's `up`
  * has carried since it shipped.
  *
- * `R = never`: the effect must carry its own requirements. Everything a
- * schedule needs is on `ctx.app`.
+ * The app supplies its outbound HttpClient, including its tracing and SSRF
+ * policy. Other requirements must be provided by the handler.
  */
-export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<void> | Effect.Effect<unknown, unknown, never>;
+export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<void> | Effect.Effect<unknown, unknown, HttpClient.HttpClient>;
 
 /** What happens when a firing arrives while the previous run of the
  *  same schedule is still in flight. */
 export declare type ScheduleOverlapPolicy = 'skip' | 'queue' | 'parallel';
 
 export declare interface SchedulerDeps {
+    /** App-owned service environment; the signal interrupts Effect work on timeout. */
+    readonly runEffect?: (effect: Extract<ReturnType<ScheduleHandler>, Effect.Effect<unknown, unknown, unknown>>, signal: AbortSignal) => Promise<unknown>;
     readonly store: DataStore;
     readonly coordinator: Coordinator;
     /** Default trigger when a schedule doesn't override it. Schedules
@@ -9781,6 +10056,32 @@ export declare interface SchedulerDeps {
      * turning the beat into a spin.
      */
     readonly runHeartbeatMs?: number;
+    /**
+     * How long an abandoned `queue` waiter stays adoptable, measured from its last
+     * beat. Omitted → {@link DEFAULT_QUEUE_ADOPTION_WINDOW_MS}. Both boot paths
+     * pass the resolved `scheduling.queueAdoptionWindowMs`.
+     */
+    readonly queueAdoptionWindowMs?: number;
+    /** How late an external trigger may arrive and still be attributed to its
+     *  occurrence. Default `DEFAULT_EXTERNAL_TRIGGER_SKEW_MS`; always additionally
+     *  bounded by the schedule's own period. */
+    readonly externalTriggerSkewMs?: number;
+    /**
+     * What to do about an occurrence of an `external` schedule that nobody
+     * triggered. Default `'record'`.
+     *
+     *   - `'record'`  — write a `missed` row and count it. The ledger then tells
+     *                   "the platform stopped firing" apart from "this schedule
+     *                   had nothing to do", which in `external` mode look
+     *                   identical otherwise: there is no timer to notice.
+     *   - `'record-and-run'` — also run it. Opt-in, because the whole premise of
+     *                   this mode is that the PLATFORM owns the clock, and a
+     *                   framework that quietly fires anyway has taken it back.
+     *   - `'off'`     — neither.
+     */
+    readonly externalMissedPolicy?: 'record' | 'record-and-run' | 'off';
+    /** How often the external-schedule reconciliation runs. Default 5 minutes. */
+    readonly externalReconcileMs?: number;
     readonly log: SchedulerLogger;
     /** Notify on every run-row insert/update so the SSE bridge can
      *  mirror schedule runs to the cloud dashboard in real time. */
@@ -9802,6 +10103,23 @@ export declare interface SchedulerDeps {
      *  a single-tenant / self-host app; the orchestrator (P3) resolves it
      *  to a deployment. Only consulted in `dormancy: 'sleep'`. */
     readonly dormancyTenantId?: string;
+    /**
+     * How the run ledger announces a change — `store.onChange`, narrowed to what
+     * this engine needs. Both boot paths pass it.
+     *
+     * It shortens a `queue` firing's wait: the blocker clearing is an UPDATE on
+     * `_voltro_schedule_runs`, so a waiter can re-check on the event instead of on
+     * its next poll. It does NOT replace the poll, and the reason is the same
+     * asymmetry the coordinated-task runner documents: the blocking run usually
+     * finishes on ANOTHER replica, and that replica's change event reaches this
+     * process only where CDC or a broadcast transport carries it. Where it does
+     * not, the poll is the whole answer — so the floor stays what it was and this
+     * buys latency, not a longer interval.
+     */
+    readonly onChange?: (listener: (event: {
+        readonly table: string;
+        readonly op: string;
+    }) => void) => () => void;
     /**
      * Optional interceptor wrapping every firing of every schedule.
      * Composed across plugins by the CLI (`composeScheduleFireInterceptors`
@@ -9817,9 +10135,35 @@ export declare interface SchedulerDeps {
 
 export declare interface SchedulerHandle {
     /** Fire a schedule immediately, bypassing the cron clock + the
-     *  coordinator. Used by the manual "Run now" dashboard button + the
-     *  `external` HTTP trigger endpoint. Returns the recorded run id. */
+     *  coordinator. Waits for handler completion and returns the recorded run id. */
     fireNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
+    /** Start immediately and return once the run is recorded, before its handler completes. */
+    startNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
+    /**
+     * The `external` trigger driver's front door: an outside scheduler says "the
+     * cadence says now" and this decides what that means.
+     *
+     * Three things happen here that `fireNow` deliberately does not do, and each
+     * is the reason this is a separate method rather than a flag on that one:
+     *
+     *   1. **The arrival is snapped to an occurrence** of the declared cron
+     *      expression, so `scheduledAt` is derived from the CODE and not from the
+     *      caller's clock. Two deliveries of the same firing therefore carry the
+     *      same instant.
+     *   2. **That instant is claimed** through the store-backed gate, whatever
+     *      coordination the deployment declared. So a redelivery is a no-op
+     *      instead of a second run — which is what makes a platform scheduler's
+     *      at-least-once delivery safe to build on. k8s states plainly that a
+     *      CronJob may create a Job twice for one scheduled time.
+     *   3. **It returns as soon as the RUN ROW exists**, not when the handler is
+     *      done. A schedule may legitimately run for `maxRuntimeMs` (30 minutes
+     *      by default) and no HTTP hop between a job pod and this process will
+     *      hold a connection that long. The caller polls `runStatus`.
+     */
+    triggerExternal(name: string, arrivalAt: Date): Promise<ExternalTriggerOutcome>;
+    /** One run's terminal-or-not state, for a caller polling an accepted trigger
+     *  to completion. `undefined` when no such run exists. */
+    runStatus(runId: string): Promise<ScheduleRunStatus | undefined>;
     /** Fire from a cluster-cron tick. `@effect/cluster` has already
      *  guaranteed exactly-once across the fleet (this runner owns the
      *  shard), so we bypass the in-app coordinator + record the run
@@ -9852,6 +10196,12 @@ export declare interface SchedulerHandle {
         readonly fired: number;
         readonly runIds: ReadonlyArray<string | null>;
     }>;
+    /** Persist an operator range and return its receipt before sequential execution completes. */
+    startBackfillRange(name: string, from: Date, to: Date, options: {
+        readonly cap: number;
+        readonly requestId: string;
+    }): Promise<ScheduleBackfillRequest>;
+    backfillRequest(requestId: string): Promise<ScheduleBackfillRequest | undefined>;
     /** Stop all timers + abort in-flight watchdogs. */
     shutdown(): Promise<void>;
 }
@@ -9882,6 +10232,20 @@ export declare interface ScheduleRunRecord {
     readonly completedAtSec?: number;
 }
 
+/** One run, as a poller sees it. */
+export declare interface ScheduleRunStatus {
+    readonly runId: string;
+    readonly name: string;
+    readonly status: string;
+    readonly trigger: string;
+    readonly scheduledAt: Date | null;
+    readonly firedAt: Date | null;
+    readonly completedAt: Date | null;
+    readonly durationMs: number | null;
+    readonly errorTag: string | null;
+    readonly errorMessage: string | null;
+}
+
 /** Trigger driver — `self` runs an in-app supervised timer; `external`
  *  exposes an HTTP endpoint that an outside scheduler (k8s CronJob,
  *  AWS EventBridge, GCP Cloud Scheduler, …) invokes. */
@@ -10336,7 +10700,9 @@ export declare const setTimelineRecorderForTest: (recorder: TimelineRecorder | u
  * `undefined` means the body was synchronous and has already run. Anything else
  * is a promise the caller disposes of as its context requires.
  */
-export declare const settleHandlerBody: (body: HandlerBody) => Promise<unknown> | undefined;
+export declare function settleHandlerBody(body: HandlerBody): Promise<unknown> | undefined;
+
+export declare function settleHandlerBody<R>(body: HandlerBody<R>, run: (effect: Effect.Effect<unknown, unknown, R>) => Promise<unknown>): Promise<unknown> | undefined;
 
 /**
  * Register (or clear) the process-global tuple source. Last write wins.
@@ -10945,8 +11311,9 @@ export { sweepRetention }
  */
 export declare const synthesizeInverse: (cs: ChangeSet) => ReadonlyArray<InverseOp>;
 
-/** The Subject non-request work runs as: a schedule firing, a workflow resumed
- *  after a restart, a `*.subscribe.ts` handler. `tenantId: null` means
+/** The Subject system work runs as: a schedule firing, an explicitly system-started
+ *  workflow, a `*.subscribe.ts` handler. User-started workflows restore their
+ *  recorded identity; a missing context refuses execution. `tenantId: null` means
  *  `applyTenantScope` adds no tenant filter, so system work sees every tenant
  *  rather than one arbitrary one. See this file's header for why it is a single
  *  shared value. */
@@ -11013,6 +11380,14 @@ export { TenantRowNotFound }
 
 export { TenantScopeViolation }
 
+/** The statuses a run never leaves — where a poller stops.
+ *
+ *  `skipped` is terminal and is NOT a failure: it means the overlap policy
+ *  found the previous occurrence still running, which is the policy doing its
+ *  job. A caller that maps it to a non-zero exit turns correct behaviour into
+ *  a page. */
+export declare const TERMINAL_RUN_STATUSES: ReadonlySet<string>;
+
 export declare type TimeBucket = 'minute' | 'hour' | 'day' | 'week' | 'month';
 
 export declare interface TimelineEvent {
@@ -11478,6 +11853,8 @@ export declare class UndoStack<E> {
  */
 export declare const undoSurfaceEnabled: (env?: Record<string, string | undefined>) => boolean;
 
+export declare const unregisterExternalizedTask: (name: string) => void;
+
 /** One `source:` entry that resolves to no declared table. */
 export declare interface UnresolvedSource {
     /** The procedure that declares it. */
@@ -11850,8 +12227,7 @@ export declare const withServerTracer: <A, E, R>(effect: Effect.Effect<A, E, R>)
 
 /**
  * What the gate decided. `passthrough` is the common case — no controls
- * declared — and is distinct from `start` so the facade can skip the commit
- * bookkeeping entirely rather than calling a no-op.
+ * declared — and is distinct from a durably reserved admission.
  */
 export declare type WorkflowAdmissionOutcome = {
     readonly kind: 'passthrough';
@@ -11860,11 +12236,12 @@ export declare type WorkflowAdmissionOutcome = {
     /** What to start WITH. Differs from the caller's payload only for a batch
      *  that filled up on this arrival. */
     readonly payload: unknown;
-    /** Called once the engine returns an execution id: links the ledger row,
-     *  consumes any batched intents, evicts a singleton incumbent. */
-    readonly commit: (executionId: string) => Promise<void>;
+    /** Dispatch the resident submission and return its durably acknowledged
+     * execution ID. Recovery owns retries; callers must not execute separately. */
+    readonly accept: () => Promise<string>;
 } | {
     readonly kind: 'queued';
+    readonly receiptId: string;
     readonly intentId: string;
     readonly mode: string;
     readonly dueAt: number;
@@ -11880,9 +12257,8 @@ export declare interface WorkflowAdmissionRequest {
     readonly workflowName: string;
     readonly payload: unknown;
     readonly callerContext: WorkflowCallerContext | undefined;
-    /** `true` for `run(...)` and `start(..., { wait: true })` — a caller blocking
-     *  for the RESULT. A deferring control has no coherent answer for one, so the
-     *  gate refuses it by name rather than doing something surprising. */
+    /** `true` for `run(...)` and `start(..., { wait: true })`. Admission still
+     * applies normally; queued results are followed through the caller receipt. */
     readonly waiting: boolean;
 }
 
@@ -11891,26 +12267,33 @@ export declare interface WorkflowCallerContext {
     readonly traceId?: string | null;
     readonly source?: string | null;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly parentClosePolicy?: WorkflowParentClosePolicy | null;
 }
 
 export declare interface WorkflowChildOptions {
     readonly wait?: boolean;
+    /* Excluded from this release type: enqueueStart */
     readonly parentClosePolicy?: WorkflowParentClosePolicy;
     /* Excluded from this release type: callerContext */
 }
 
-/**
- * Reject a blocking caller on a workflow whose flow control can DEFER.
- *
- * `run(...)` and `start({ wait: true })` block for the run's RESULT, and there
- * is no result to return for a start that was collapsed into a future run.
- * Silently starting it anyway would break the declared limit; silently
- * returning nothing would break the caller's type. So it is an error that names
- * both halves.
- */
-export declare class WorkflowDeferredResultError extends Error {
-    constructor(workflowName: string, method: string, mode: string);
+export declare interface WorkflowControlOptions {
+    /** Reuse for retries of the same control intent. Requires a resident control
+     * adapter; the identity remains bound to its original execution generation. */
+    readonly requestId: string;
+    /** Stored with first acceptance; retries retain the original cause. */
+    readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+}
+
+/** Control acceptance and execution outcome are independent facts. A resolved
+ * engine command alone supplies neither durable acceptance nor completion. */
+export declare type WorkflowControlResult = WorkflowControlResult_2;
+
+export declare interface WorkflowControlTarget extends WorkflowControlOptions {
+    readonly operation: 'cancel' | 'resume';
+    readonly workflowName: string;
+    readonly executionId: string;
 }
 
 export declare interface WorkflowDefinitionLike {
@@ -11973,6 +12356,30 @@ export declare interface WorkflowEventTriggerResult {
 }
 
 export declare interface WorkflowFacadeOptions {
+    readonly cancelQueued?: (input: WorkflowQueuedControlTarget & {
+        readonly callerContext: WorkflowCallerContext | undefined;
+        readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+    }) => Promise<WorkflowQueuedCancellationResult>;
+    readonly readQueuedCancellation?: (input: WorkflowQueuedControlTarget & {
+        readonly callerContext: WorkflowCallerContext | undefined;
+    }) => Promise<WorkflowQueuedCancellationResult>;
+    /** Read-only resident receipt observation; must not submit an engine command. */
+    readonly readControl?: (target: WorkflowControlTarget) => Promise<WorkflowControlResult>;
+    /** Resident control owner. When configured it owns acceptance, dispatch and
+     * observation completely; the facade must not issue a second engine command
+     * or substitute an engine-only observation when this adapter fails. */
+    readonly control?: (input: {
+        readonly operation: 'cancel' | 'resume';
+        readonly workflowName: string;
+        readonly executionId: string;
+        readonly requestId?: string;
+        readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+    }) => Promise<WorkflowControlResult>;
+    readonly resolveQueuedStart?: (input: {
+        readonly receiptId: string;
+        readonly workflowName: string;
+        readonly callerContext: WorkflowCallerContext | undefined;
+    }) => Promise<WorkflowStartResolution>;
     readonly workflows: ReadonlyArray<DiscoveredWorkflowLike>;
     readonly runEffect: <A>(effect: Effect.Effect<A, unknown, unknown>) => Promise<A>;
     readonly rememberStartContext?: (workflowName: string, executionId: string, context: WorkflowCallerContext) => void | Promise<void>;
@@ -12043,6 +12450,7 @@ export declare interface WorkflowFacadeOptions {
         /** Epoch ms. Always strictly in the future — the facade handles the past. */
         readonly at: number;
     }) => Promise<{
+        readonly receiptId: string;
         readonly intentId: string;
         readonly dueAt: number;
     }>;
@@ -12051,7 +12459,10 @@ export declare interface WorkflowFacadeOptions {
 export declare interface WorkflowLayerExecutionContext {
     readonly workflowName: string;
     readonly executionId: string;
+    /** This body's committed entry generation, not its parent's generation. */
+    readonly generation?: string;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly parentClosePolicy?: WorkflowParentClosePolicy | null;
 }
 
@@ -12068,8 +12479,8 @@ export declare interface WorkflowLayerOptions<Context> {
      * cookie one layer down. This hook is what re-establishes the authority, from
      * the app's live source, on every execution attempt.
      *
-     * Called ONLY for a run that has a recorded caller. A bootstrap run — no
-     * recorded context — is `SYSTEM_SUBJECT` and is not put through it:
+     * Called ONLY for a non-system caller. An explicitly recorded system start
+     * (or a host without a context resolver) is not put through it:
      * `SYSTEM_SUBJECT` already states its own authority, and running it through
      * an app resolver keyed on a null id would be asking a question with no
      * answer.
@@ -12111,6 +12522,17 @@ export declare class WorkflowPayloadError extends Error {
     missingFields: ReadonlyArray<string>, detail: string);
 }
 
+export declare interface WorkflowQueuedControlOptions {
+    readonly callerContext?: WorkflowCallerContext;
+    readonly cause?: NonNullable<WorkflowControlRequest['cause']>;
+}
+
+export declare interface WorkflowQueuedControlTarget {
+    readonly workflowName: string;
+    readonly receiptId: string;
+    readonly requestId: string;
+}
+
 /**
  * A blocking caller hit a `rateLimit` cap.
  *
@@ -12190,7 +12612,7 @@ export declare interface WorkflowRunOptions {
 export declare interface WorkflowRunRecord {
     readonly name: string;
     /** Terminal outcome only. `failed` is the dead-letter state (no framework retry). */
-    readonly status: 'succeeded' | 'failed';
+    readonly status: 'succeeded' | 'failed' | 'cancelled';
     readonly durationMs: number;
     /** UNIX SECONDS of completion — set only on success (drives the last-success
      *  gauge). Omit on failure so the gauge keeps pointing at the last real success. */
@@ -12203,17 +12625,9 @@ export declare interface WorkflowRunRecord {
  *  stored column exactly. */
 export declare type WorkflowRunRecordStatus = 'running' | 'succeeded' | 'failed' | 'cancelled' | 'suspended';
 
-export declare interface WorkflowRunSnapshot<Success = unknown> {
-    readonly id: string;
-    readonly workflowName: string;
-    readonly executionId: string;
-    readonly status: WorkflowRunStatus;
+export declare type WorkflowRunSnapshot<Success = unknown> = Omit<WorkflowRunSnapshot_2, 'output'> & {
     readonly output?: Success;
-    readonly error?: {
-        readonly tag: string | null;
-        readonly message: string;
-    };
-}
+};
 
 export declare type WorkflowRunStatus = 'running' | 'succeeded' | 'failed' | 'cancelled' | 'suspended' | 'unknown';
 
@@ -12250,8 +12664,12 @@ export declare interface WorkflowsAppContext {
     query<Success = unknown>(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot<Success>>;
     wait<Success = unknown>(handle: WorkflowRunHandle, options?: WorkflowWaitOptions): Promise<WorkflowRunSnapshot<Success>>;
     wait<Success = unknown>(workflowName: string, executionId: string, options?: WorkflowWaitOptions): Promise<WorkflowRunSnapshot<Success>>;
-    cancel(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot>;
-    resume(workflowName: string, executionId: string): Promise<WorkflowRunSnapshot>;
+    cancel(workflowName: string, executionId: string, options?: WorkflowControlOptions): Promise<WorkflowControlResult>;
+    resume(workflowName: string, executionId: string, options?: WorkflowControlOptions): Promise<WorkflowControlResult>;
+    /** Observe the original resident request without submitting or retrying it. */
+    readControl(target: WorkflowControlTarget): Promise<WorkflowControlResult>;
+    cancelQueued(target: WorkflowQueuedControlTarget, options?: WorkflowQueuedControlOptions): Promise<WorkflowQueuedCancellationResult>;
+    readQueuedCancellation(target: WorkflowQueuedControlTarget, options?: Pick<WorkflowQueuedControlOptions, 'callerContext'>): Promise<WorkflowQueuedCancellationResult>;
     signal(target: WorkflowSignalTarget, signalName: string, payload?: unknown): Promise<{
         readonly eventId: string;
     }>;
@@ -12288,6 +12706,20 @@ export declare class WorkflowSingletonHeldError extends Error {
     constructor(workflowName: string, executionId: string);
 }
 
+/** Persist a validated start through the business transaction's store. The
+ * returned identity is provisional until that transaction commits. */
+export declare type WorkflowStartEnqueue = (input: {
+    readonly workflowName: string;
+    /** Encoded using the arrival schema, not the decoded in-process payload. */
+    readonly payload: unknown;
+    readonly callerContext: WorkflowCallerContext | undefined;
+    readonly at: number;
+}) => Promise<{
+    readonly receiptId: string;
+    readonly intentId: string;
+    readonly dueAt: number;
+}>;
+
 /** The slice of a `workflow()` definition the start runner reads — its name
  *  and its resolved access decision (`workflowAccessDescriptor` produces it). */
 export declare interface WorkflowStartLike {
@@ -12295,8 +12727,23 @@ export declare interface WorkflowStartLike {
     readonly guards?: ReadonlyArray<AnyCheckSpec> | undefined;
 }
 
+export declare class WorkflowStartNotExecuted extends WorkflowStartNotExecuted_base {
+}
+
+declare const WorkflowStartNotExecuted_base: Schema.TaggedErrorClass<WorkflowStartNotExecuted, "WorkflowStartNotExecuted", {
+    readonly _tag: Schema.tag<"WorkflowStartNotExecuted">;
+} & {
+    workflowName: typeof Schema.String;
+    handleId: typeof Schema.String;
+    reason: Schema.Literal<["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
+    failureId: Schema.NullOr<typeof Schema.String>;
+    incumbentExecutionId: Schema.NullOr<typeof Schema.String>;
+}>;
+
 export declare interface WorkflowStartOptions {
+    /* Excluded from this release type: preparedExecutionId */
     readonly wait?: boolean;
+    /* Excluded from this release type: enqueueStart */
     /**
      * Delayed one-off start: park this start DURABLY and let it arrive at `at`.
      *
@@ -12316,9 +12763,9 @@ export declare interface WorkflowStartOptions {
      * handle has `status: 'queued'` with `deferral: { mode: 'delayed', dueAt }`.
      *
      * An `at` in the past (or now) starts immediately — the caller said "no
-     * earlier than", and that is already true. Combining `at` with
-     * `wait: true` is refused: there is no result to block on for a start that
-     * exists only as a future row.
+     * earlier than", and that is already true. With `wait: true`, follow the
+     * durable caller receipt through the delayed arrival and any further
+     * admission deferral, then wait for the accepted execution's result.
      */
     readonly at?: Date;
     /* Excluded from this release type: callerContext */
@@ -12341,6 +12788,7 @@ export declare interface WorkflowUpdateOptions {
 export declare interface WorkflowWaitOptions {
     readonly pollIntervalMs?: number;
     readonly timeoutMs?: number;
+    /* Excluded from this release type: callerContext */
 }
 
 /**