@voltro/runtime 0.83.1 → 0.85.0

package/dist/index.d.ts

@@ -4,6 +4,7 @@ import { AnyGuardSpec } from '@voltro/protocol';
 import { AuthMiddleware } from '@voltro/protocol';
 import { AuthStrategy } from '@voltro/protocol';
 import { CaughtUpVerdict } from '@voltro/database';
+import { Cause } from 'effect';
 import { ChangeEvent } from '@voltro/database';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
@@ -18,6 +19,8 @@ import { ConstraintFacts } from '@voltro/database';
 import { ConstraintKind } from '@voltro/database';
 import { ConstraintViolation } from '@voltro/protocol';
 import { Context } from 'effect';
+import { CrdtBackend } from '@voltro/local-first';
+import { CrdtMigration } from '@voltro/local-first';
 import { createServer } from 'node:http';
 import { Cron } from 'effect';
 import { DataStore } from '@voltro/database';
@@ -40,7 +43,7 @@ import { FieldBinding } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
 import { FieldDefinitions } from '@voltro/database';
 import * as http from 'node:http';
-import { HttpClient } from '@effect/platform';
+import { HttpClient } from 'effect/http';
 import { HttpRequestInterceptor } from '@voltro/protocol';
 import { HttpRouteObserver } from '@voltro/protocol';
 import { IdempotencyStore } from '@voltro/protocol';
@@ -64,7 +67,6 @@ import { listRetentionConflicts } from '@voltro/database';
 import { listRetentions } from '@voltro/database';
 import { Membership } from '@voltro/protocol';
 import { Metric } from 'effect';
-import { MetricBoundaries } from 'effect';
 import { MetricReader } from '@opentelemetry/sdk-metrics';
 import { MutationIdempotencyScope } from '@voltro/protocol';
 import { NoRowFound } from '@voltro/protocol';
@@ -89,8 +91,8 @@ import { retentionTtlMsFromEnv } from '@voltro/database';
 import { Row } from '@voltro/database';
 import { RowKey } from '@voltro/database';
 import { RowPatch } from '@voltro/protocol';
-import { Rpc } from '@effect/rpc';
-import { RpcGroup } from '@effect/rpc';
+import { Rpc } from 'effect/rpc';
+import { RpcGroup } from 'effect/rpc';
 import { RpcInterceptor } from '@voltro/protocol';
 import { RuleReadStore } from '@voltro/database';
 import { Sampler } from '@opentelemetry/sdk-trace-base';
@@ -102,7 +104,7 @@ import { ServerOnlyColumnWrite } from '@voltro/protocol';
 import { ServerResponse } from 'node:http';
 import { SpanProcessor } from '@opentelemetry/sdk-trace-base';
 import { spawn } from 'node:child_process';
-import { SqlClient } from '@effect/sql';
+import { SqlClient } from 'effect/sql';
 import { StoredTableShape } from '@voltro/database';
 import { StoreError } from '@voltro/protocol';
 import { StoreOperationFailed } from '@voltro/protocol';
@@ -143,19 +145,18 @@ import { WorkflowRunHandle } from '@voltro/protocol';
 import { WorkflowRunSnapshot as WorkflowRunSnapshot_2 } from '@voltro/protocol';
 import { WorkflowStartResolution } from '@voltro/workflow';
 import { WorkflowUpdateResult } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
 
 /** Typed denial — declare on an rpc `error:` union so a refusal surfaces to the
  *  client typed + pattern-matchable (never a bare 500). */
 export declare class AccessDenied extends AccessDenied_base {
 }
 
-declare const AccessDenied_base: Schema.TaggedErrorClass<AccessDenied, "AccessDenied", {
-    readonly _tag: Schema.tag<"AccessDenied">;
-} & {
-    action: typeof Schema.String;
-    resourceType: typeof Schema.String;
-    resourceId: typeof Schema.String;
-}>;
+declare const AccessDenied_base: Schema.Class<AccessDenied, Schema.TaggedStruct<"AccessDenied", {
+    readonly action: Schema.String;
+    readonly resourceType: Schema.String;
+    readonly resourceId: Schema.String;
+}>, YieldableError>;
 
 /**
  * Exported so the rpc boundary can stamp `ChangeEvent.subjectId` with the SAME
@@ -372,13 +373,11 @@ declare class AggregateError_2 extends AggregateError_base {
 }
 export { AggregateError_2 as AggregateError }
 
-declare const AggregateError_base: Schema.TaggedErrorClass<AggregateError_2, "AggregateError", {
-    readonly _tag: Schema.tag<"AggregateError">;
-} & {
-    name: typeof Schema.String;
-    operation: typeof Schema.String;
-    cause: typeof Schema.String;
-}>;
+declare const AggregateError_base: Schema.Class<AggregateError_2, Schema.TaggedStruct<"AggregateError", {
+    readonly name: Schema.String;
+    readonly operation: Schema.String;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 export declare type AggregateFailure = AggregateStale | AggregateNotFound | AggregateError_2;
 
@@ -401,7 +400,10 @@ export declare interface AggregateHandle<Row> {
 export declare class AggregateMaintainer {
     private readonly shape;
     private state;
+    private extrema;
     private readonly groups;
+    private readonly positions;
+    private nextPosition;
     constructor(shape: AggregateShape);
     /** Seed from the full base row-set (boot / after a rescan-from-scratch). */
     seed(baseRows: ReadonlyArray<Row_4>): void;
@@ -412,6 +414,11 @@ export declare class AggregateMaintainer {
     applyChange(delta: CdcDelta): ReadonlyArray<string>;
     /** Rebuild the flagged groups from the current base rows (min/max recovery). */
     resolveRescan(rescanGroups: ReadonlyArray<string>, baseRows: ReadonlyArray<Row_4>): void;
+    /** Read only the requested live groups, with insertion-order identities.
+     * A group deleted and reinserted receives a new position, matching materialize. */
+    materializeGroups(keys: ReadonlyArray<string>): ReadonlyArray<MaintainedGroup & {
+        readonly rowIndex: number;
+    }>;
     /** The current materialized result — one entry per non-empty group. */
     materialize(): ReadonlyArray<MaintainedGroup>;
     private groupValues;
@@ -438,11 +445,9 @@ export declare interface AggregateMeta {
 export declare class AggregateNotFound extends AggregateNotFound_base {
 }
 
-declare const AggregateNotFound_base: Schema.TaggedErrorClass<AggregateNotFound, "AggregateNotFound", {
-    readonly _tag: Schema.tag<"AggregateNotFound">;
-} & {
-    name: typeof Schema.String;
-}>;
+declare const AggregateNotFound_base: Schema.Class<AggregateNotFound, Schema.TaggedStruct<"AggregateNotFound", {
+    readonly name: Schema.String;
+}>, YieldableError>;
 
 export declare interface AggregateQuery {
     readonly event: string;
@@ -520,7 +525,7 @@ export declare type AggregateRefreshPolicy = string | {
 export declare class AggregateRegistry extends AggregateRegistry_base {
 }
 
-declare const AggregateRegistry_base: Context.TagClass<AggregateRegistry, "@voltro/AggregateRegistry", {
+declare const AggregateRegistry_base: Context.ServiceClass<AggregateRegistry, "@voltro/AggregateRegistry", {
     /** Resolve a typed handle from the definition. The cli registers
      *  every discovered aggregate at boot; calling this with an unknown
      *  def returns a handle whose methods all fail with
@@ -546,13 +551,11 @@ export declare interface AggregateShape {
 export declare class AggregateStale extends AggregateStale_base {
 }
 
-declare const AggregateStale_base: Schema.TaggedErrorClass<AggregateStale, "AggregateStale", {
-    readonly _tag: Schema.tag<"AggregateStale">;
-} & {
-    name: typeof Schema.String;
-    ageMs: typeof Schema.Number;
-    maxAgeMs: typeof Schema.Number;
-}>;
+declare const AggregateStale_base: Schema.Class<AggregateStale, Schema.TaggedStruct<"AggregateStale", {
+    readonly name: Schema.String;
+    readonly ageMs: Schema.Number;
+    readonly maxAgeMs: Schema.Number;
+}>, YieldableError>;
 
 export declare interface AnalyticsBucket {
     readonly bucketStart: Date;
@@ -568,12 +571,10 @@ export declare interface AnalyticsBucket {
 export declare class AnalyticsCapabilityNotSupported extends AnalyticsCapabilityNotSupported_base {
 }
 
-declare const AnalyticsCapabilityNotSupported_base: Schema.TaggedErrorClass<AnalyticsCapabilityNotSupported, "AnalyticsCapabilityNotSupported", {
-    readonly _tag: Schema.tag<"AnalyticsCapabilityNotSupported">;
-} & {
-    provider: typeof Schema.String;
-    capability: typeof Schema.String;
-}>;
+declare const AnalyticsCapabilityNotSupported_base: Schema.Class<AnalyticsCapabilityNotSupported, Schema.TaggedStruct<"AnalyticsCapabilityNotSupported", {
+    readonly provider: Schema.String;
+    readonly capability: Schema.String;
+}>, YieldableError>;
 
 /**
  * The underlying sink raised an error. `cause` is stringified for
@@ -582,13 +583,11 @@ declare const AnalyticsCapabilityNotSupported_base: Schema.TaggedErrorClass<Anal
 export declare class AnalyticsError extends AnalyticsError_base {
 }
 
-declare const AnalyticsError_base: Schema.TaggedErrorClass<AnalyticsError, "AnalyticsError", {
-    readonly _tag: Schema.tag<"AnalyticsError">;
-} & {
-    provider: typeof Schema.String;
-    operation: typeof Schema.String;
-    cause: typeof Schema.String;
-}>;
+declare const AnalyticsError_base: Schema.Class<AnalyticsError, Schema.TaggedStruct<"AnalyticsError", {
+    readonly provider: Schema.String;
+    readonly operation: Schema.String;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 /**
  * One analytics event. `properties` must be JSON-serialisable —
@@ -786,7 +785,7 @@ export declare interface AnalyticsMirrorUpsert {
 export declare class AnalyticsSink extends AnalyticsSink_base {
 }
 
-declare const AnalyticsSink_base: Context.TagClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
+declare const AnalyticsSink_base: Context.ServiceClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
 
 /**
  * The runtime contract every analytics provider implements. Plugins
@@ -1674,7 +1673,7 @@ export declare interface AttachFinopsOptions {
 /** The descriptor shape the audit needs — a `defineQuery` result carries it. */
 export declare interface AuditableQuery {
     readonly name: string;
-    readonly output: Schema.Schema.Any;
+    readonly output: Schema.Top;
     /** Declared source table(s) — the tables whose serverOnly columns must not leak. */
     readonly source?: string | ReadonlyArray<string> | undefined;
 }
@@ -1844,7 +1843,7 @@ export declare const bindMutation: <Input, Output, E = never>(execute: (input: I
  * schema keeps exactly the old behaviour rather than collapsing errors it
  * cannot classify.
  */
-declaredError?: Schema.Schema.All, idempotencyScope?: MutationIdempotencyScope) => Effect.Effect<Output, E, SubjectService | ConnectionInfo>;
+declaredError?: Schema.Top, idempotencyScope?: MutationIdempotencyScope) => Effect.Effect<Output, E, SubjectService | ConnectionInfo>;
 
 /**
  * Bind a non-reactive server→client stream (A3). The executor builds a
@@ -1876,7 +1875,7 @@ guards?: ReadonlyArray<unknown> | undefined,
 guardInput?: unknown) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
 
 /**
- * Build a `Stream<SubscriptionEvent<T>>` that an @effect/rpc streaming
+ * Build a `Stream<SubscriptionEvent<T>>` that an effect/rpc streaming
  * handler can return directly. The descriptor is built by the route's
  * executor from the input + the per-call `RuntimeContext` (subject +
  * traceId) we derive from the auth-middleware's resolved subject.
@@ -2185,7 +2184,7 @@ export declare interface CircuitBreakerOptions {
     /** Consecutive failures before the breaker opens. */
     readonly failureThreshold: number;
     /** Wait before transitioning open → half-open (Duration or string). */
-    readonly resetTimeout: Duration.DurationInput;
+    readonly resetTimeout: Duration.Input;
     /** Successes required in half-open before closing again. Default 1. */
     readonly halfOpenSuccessThreshold?: number;
     /** Predicate: does this error count toward the threshold? Default: all
@@ -2203,14 +2202,12 @@ export declare interface CircuitBreakerOptions {
 export declare class CircuitOpen extends CircuitOpen_base {
 }
 
-declare const CircuitOpen_base: Schema.TaggedErrorClass<CircuitOpen, "CircuitOpen", {
-    readonly _tag: Schema.tag<"CircuitOpen">;
-} & {
+declare const CircuitOpen_base: Schema.Class<CircuitOpen, Schema.TaggedStruct<"CircuitOpen", {
     /** Breaker name (the `name` option, or `'circuit'` when unnamed). */
-    name: typeof Schema.String;
+    readonly name: Schema.String;
     /** Best-effort ms until the breaker next admits a probe call. */
-    retryAfterMs: typeof Schema.Number;
-}>;
+    readonly retryAfterMs: Schema.Number;
+}>, Cause.YieldableError>;
 
 export declare type CircuitState = 'closed' | 'open' | 'half-open';
 
@@ -2744,7 +2741,7 @@ export declare type CoordinationOutcome = 'single' | 'wonLock' | 'lostLock' | 'e
  *  instance should run the firing. Implementations:
  *    - SingleCoordinator        → always true (one process)
  *    - AdvisoryLockCoordinator  → postgres advisory lock (wired in CLI)
- *    - ClusterCoordinator       → @effect/cluster shard (future)
+ *    - ClusterCoordinator       → effect/cluster shard (future)
  */
 export declare interface Coordinator {
     readonly kind: 'single' | 'advisoryLock' | 'cluster';
@@ -2983,7 +2980,7 @@ export declare interface CostEvent {
 export declare class CostRegistry extends CostRegistry_base {
 }
 
-declare const CostRegistry_base: Context.TagClass<CostRegistry, "@voltro/CostRegistry", CostRegistryApi>;
+declare const CostRegistry_base: Context.ServiceClass<CostRegistry, "@voltro/CostRegistry", CostRegistryApi>;
 
 export declare interface CostRegistryApi {
     /** Per-tenant compute-cost attribution — the chargeback feed. */
@@ -3000,8 +2997,8 @@ export declare interface CostRegistryApi {
     readonly subscribe: (listener: (s: CostBudgetSignal) => void) => () => void;
 }
 
-/** Define a cumulative counter. Increment with `incrementMetric` / `Metric.increment`. */
-export declare const counter: (name: string, description?: string) => Metric.Metric.Counter<number>;
+/** Define a cumulative counter. Increment with `incrementMetric` / `Metric.update(metric, 1)`. */
+export declare const counter: (name: string, description?: string) => Metric.Counter<number>;
 
 /**
  * Count workflows actively EXECUTING (`_voltro_workflow_runs.status =
@@ -3011,8 +3008,98 @@ export declare const counter: (name: string, description?: string) => Metric.Met
  */
 export declare const countRunningWorkflows: (store: DataStore) => Promise<number>;
 
+export declare const CRDT_VERSIONS_TABLE = "_voltro_crdt_versions";
+
+export declare interface CrdtAdmission {
+    readonly maxUpdateBytes?: number | null;
+    readonly maxDocumentBytes?: number | null;
+    readonly rebaseMaxBytes?: number | null;
+    /** Content migrations per table and column — see `crdt.migrations`. */
+    readonly migrations?: Readonly<Record<string, Readonly<Record<string, ReadonlyArray<CrdtMigration>>>>> | null;
+    readonly validate?: CrdtValidator | null;
+}
+
+/** A CRDT backend the server can be configured with (`crdt.backend`). */
+export declare type CrdtBackendChoice = CrdtBackend;
+
+/** A CRDT cell: table + row id + column. */
+export declare interface CrdtCellRef {
+    readonly table: string;
+    readonly id: string;
+    readonly column: string;
+}
+
+/** What a CRDT cell looks like from the inside — the data an inspector panel
+ *  or an alert reads to see a document approaching its limits. */
+export declare interface CrdtCellStats {
+    /** Stored bytes of the encoded state. */
+    readonly bytes: number;
+    /** The epoch it was last rebased into (`null`: never). */
+    readonly epoch: string | null;
+    /** How many writer sessions its history holds — what grows it. */
+    readonly authors: number;
+    /** Archived versions (snapshots, restores, rebases). */
+    readonly versions: number;
+    /** The limits the write path applies to it. */
+    readonly limits: {
+        readonly compactMaxBytes: number;
+        readonly rebaseMaxBytes: number;
+        readonly maxDocumentBytes: number;
+        readonly maxUpdateBytes: number;
+    };
+}
+
+/** The cell's size, epoch, author count and history length, through the
+ *  caller's scope. `undefined` when the row is not visible. */
+export declare const crdtCellStats: (store: CrdtHistoryStore, cell: CrdtCellRef) => Promise<CrdtCellStats | undefined>;
+
 export declare const crdtCompactMaxBytes: () => number;
 
+/** The slice of a store these functions use — `ctx.store` satisfies it. */
+export declare interface CrdtHistoryStore {
+    readonly query: (descriptor: never) => Promise<ReadonlyArray<unknown>>;
+    readonly insert: (table: never, row: never) => Promise<unknown>;
+    readonly update: (table: never, id: never, patch: never) => Promise<unknown>;
+}
+
+/** The effective per-document limit in bytes (`0` = unlimited). */
+export declare const crdtMaxDocumentBytes: () => number;
+
+/** The effective per-update limit in bytes (`0` = unlimited). */
+export declare const crdtMaxUpdateBytes: () => number;
+
+/** The content migrations declared for a CRDT column (`crdt.migrations`). */
+export declare const crdtMigrationsFor: (table: string, column: string) => ReadonlyArray<CrdtMigration>;
+
+/** The effective hard-compaction threshold in bytes (`0` = never). */
+export declare const crdtRebaseMaxBytes: () => number;
+
+/** Refuse a write by returning a message key (`'doc.tooLong'`); accept with
+ *  `undefined`. Runs on the server, synchronously, on the write path. */
+export declare type CrdtValidator = (write: CrdtWriteToValidate) => string | undefined;
+
+/** One version as a history list shows it — never the bytes. */
+export declare interface CrdtVersion {
+    readonly id: string;
+    readonly reason: 'snapshot' | 'restore' | 'rebase';
+    readonly label: string | null;
+    readonly epoch: string | null;
+    readonly createdBy: string | null;
+    readonly createdAt: Date;
+}
+
+/** What `crdt.validate` is handed for every merged CRDT write. */
+export declare interface CrdtWriteToValidate {
+    readonly table: string;
+    readonly column: string;
+    /** The merged state about to be stored. */
+    readonly state: Uint8Array;
+    /** The stored state before this write, `undefined` on the first. */
+    readonly previous: Uint8Array | undefined;
+    /** The client's incoming update. */
+    readonly update: Uint8Array;
+}
+
 /**
  * The cron expression that fires `intervalMs` apart, or `undefined` when no
  * five-field expression does.
@@ -3332,6 +3419,15 @@ export declare const DEFAULT_COMPRESSION_MIN_BYTES = 1024;
 
 export declare const DEFAULT_CRDT_COMPACT_MAX_BYTES: number;
 
+export declare const DEFAULT_CRDT_MAX_DOCUMENT_BYTES: number;
+
+export declare const DEFAULT_CRDT_MAX_UPDATE_BYTES: number;
+
+/** Above this, a merged document is HARD-compacted into a new epoch (its old
+ *  lineage archived first). Soft compaction keeps every struct of a document
+ *  edited by many sessions; this is what bounds it. */
+export declare const DEFAULT_CRDT_REBASE_MAX_BYTES: number;
+
 /**
  * How many subscribers one change event is delivered to CONCURRENTLY.
  *
@@ -3684,6 +3780,14 @@ export declare const deliveredRowCount: (value: unknown) => number;
  */
 export declare const deriveKey: (passphrase: string) => Buffer;
 
+/** Size-only facts about a stored CRDT state — its epoch and how many writer
+ *  sessions its history carries. For inspection; `undefined` when the bytes
+ *  do not decode (an `.encrypted()` column stores ciphertext). */
+export declare const describeCrdtState: (state: Uint8Array) => {
+    readonly epoch: string | null;
+    readonly authors: number;
+} | undefined;
+
 export declare const describeOtelReasons: (why: OtelNeededBecause) => ReadonlyArray<string>;
 
 /**
@@ -3876,6 +3980,8 @@ export declare class Dispatcher {
     /** Query labels already warned about for an undeclared raw read, so a hot
      *  subscription logs once rather than once per subscriber. */
     private readonly rawReadWarned;
+    private changeEpoch;
+    private readonly committedReads;
     /** The CRDT-managed columns of `table` (empty when it has none) — what a
      *  subscription's backpressure outbox folds incrementally. */
     crdtColumnsFor(table: string): ReadonlySet<string>;
@@ -4106,7 +4212,7 @@ export declare interface DrainDeps<R = never> {
  * inject `exit` and drive a finalizer that genuinely never finishes.
  */
 export declare const drainForShutdown: (options: {
-    readonly fibers: ReadonlyArray<Fiber.RuntimeFiber<void, unknown>>;
+    readonly fibers: ReadonlyArray<Fiber.Fiber<void, unknown>>;
     readonly hooks: ReadonlyArray<() => void | Promise<void>>;
     readonly deadlineMs: number;
     readonly exit: () => void;
@@ -4196,7 +4302,7 @@ export declare const effectiveRelations: (subject: RebacSubject, resource: Rebac
 export declare class EffectStore extends EffectStore_base {
 }
 
-declare const EffectStore_base: Context.TagClass<EffectStore, "@voltro/EffectStore", EffectStoreOps>;
+declare const EffectStore_base: Context.ServiceClass<EffectStore, "@voltro/EffectStore", EffectStoreOps>;
 
 export declare interface EffectStoreOps {
     /** Typed the same way `FluentStore.query` is — the row type rides in on the
@@ -4450,6 +4556,8 @@ export declare class EventBus {
      * sacrificed under pressure, never delivery.
      */
     private evictIfOverCapacity;
+    /** Select a bounded batch, preserving insertion order for equal timestamps. */
+    private coldestIdleRoutes;
     /**
      * Drop what the ring may no longer replay.
      *
@@ -4655,7 +4763,7 @@ export declare interface EventPublishContext {
 }
 
 export declare interface EventPublisher {
-    publish<Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>): AwaitableEffect<EventPublishResult, EventPublishError>;
+    publish<Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>): AwaitableEffect<EventPublishResult, EventPublishError>;
 }
 
 export declare type EventPublishError = EventPayloadInvalid | EventKeyInvalid | EventPayloadTooLarge;
@@ -4740,9 +4848,9 @@ export declare const exchangeAuthorizationCode: (definition: OAuth2ConnectionDef
  *  `defineMutation` / `defineAction` result carries all of it. */
 export declare interface ExecutorDescriptor {
     readonly kind: 'query' | 'mutation' | 'action';
-    readonly input: Schema.Schema.Any;
-    readonly output: Schema.Schema.Any;
-    readonly error: Schema.Schema.All;
+    readonly input: Schema.Top;
+    readonly output: Schema.Top;
+    readonly error: Schema.Top;
 }
 
 /** The failure type of an executor's return, when it returns an Effect. A
@@ -4910,7 +5018,7 @@ export declare type ExpectationInvariant = {
 export declare class ExpectationRegistry extends ExpectationRegistry_base {
 }
 
-declare const ExpectationRegistry_base: Context.TagClass<ExpectationRegistry, "@voltro/ExpectationRegistry", ExpectationRegistryApi>;
+declare const ExpectationRegistry_base: Context.ServiceClass<ExpectationRegistry, "@voltro/ExpectationRegistry", ExpectationRegistryApi>;
 
 export declare interface ExpectationRegistryApi {
     /** Snapshot every registered expectation's current state — the inspect feed. */
@@ -5174,7 +5282,7 @@ export declare type ExperimentMetricKind = ExperimentMetric['kind'];
 export declare class ExperimentRegistry extends ExperimentRegistry_base {
 }
 
-declare const ExperimentRegistry_base: Context.TagClass<ExperimentRegistry, "@voltro/ExperimentRegistry", ExperimentRegistryApi>;
+declare const ExperimentRegistry_base: Context.ServiceClass<ExperimentRegistry, "@voltro/ExperimentRegistry", ExperimentRegistryApi>;
 
 export declare interface ExperimentRegistryApi {
     /** Snapshot every registered experiment's current result — the inspect feed. */
@@ -5264,6 +5372,12 @@ export declare interface ExperimentVariantSpec {
     readonly weight?: number;
 }
 
+export declare const exponentialBoundaries: (options: {
+    readonly start: number;
+    readonly factor: number;
+    readonly count: number;
+}) => ReadonlyArray<number>;
+
 /**
  * How far AHEAD of now an external trigger's stated instant may be.
  *
@@ -5352,12 +5466,12 @@ export declare type ExternalTriggerOutcome =
 export { extractDbCause }
 
 /** The literal `_tag`s of a failure type. `any` contributes none (nothing can
- *  be proven about it); `UnknownException` — Effect's wrapper for a failure it
+ *  be proven about it); `UnknownError` — Effect's wrapper for a failure it
  *  could not type, e.g. `Effect.tryPromise` without `catch` — counts as
  *  untagged, which is what it means. */
 declare type FailureTag<E> = 0 extends (1 & E) ? never : E extends {
     readonly _tag: infer T;
-} ? T extends 'UnknownException' ? never : T extends string ? T : never : never;
+} ? T extends 'UnknownError' ? never : T extends string ? T : never : never;
 
 export declare interface FieldChange {
     readonly from: unknown;
@@ -5558,14 +5672,9 @@ export declare interface FluentStoreBackend {
  * rbac role-derived scopes) via `hasEffectiveScope` — so `admin:full` sees every
  * such column, exactly as it satisfies every guard.
  *
- * SUBJECT-INDEPENDENCE is deliberate and load-bearing: when the table declares
- * NO `.readableBy(...)` column, this returns exactly `serverOnlyColumnNames` —
- * the same set for every subject — so the Dispatcher's per-subscriber strip
- * collapses to Part A's behaviour and its read/diff memo still shares one array
- * across all subscribers of a change. Only a table that actually carries a
- * `.readableBy(...)` column pays the per-subject cost (different subjects get
- * different stripped arrays, the same accepted cost `.serverOnly()` already has
- * whenever it strips anything).
+ * With no `.readableBy(...)` metadata every subject resolves the same column
+ * list. The dispatch-local strip memo can then share ordinary stripped rows;
+ * this helper itself neither clones rows nor caches mutable metadata or scopes.
  *
  * An unknown / unregistered table forbids nothing (returns `[]`) rather than
  * throwing — same posture as `serverOnlyColumnNames`.
@@ -5635,7 +5744,7 @@ export declare const frameworkDeviceStrategy: (service: DeviceServiceShape, opts
 }) => AuthStrategy;
 
 /** Define a gauge (set with `setMetric`). */
-export declare const gauge: (name: string, description?: string) => Metric.Metric.Gauge<number>;
+export declare const gauge: (name: string, description?: string) => Metric.Gauge<number>;
 
 /** Generate a fresh token `<prefix><40-char-base64url>`. */
 export declare const generateApiKeyToken: (prefix?: string) => string;
@@ -5746,7 +5855,7 @@ export declare interface HealthConfigInput {
 }
 
 /** Define a histogram. `boundaries` default to the framework duration buckets. */
-export declare const histogramMetric: (name: string, boundaries?: MetricBoundaries.MetricBoundaries, description?: string) => Metric.Metric.Histogram<number>;
+export declare const histogramMetric: (name: string, boundaries?: ReadonlyArray<number>, description?: string) => Metric.Histogram<number>;
 
 /**
  * Full-lineage provenance from versioning history rows (oldest-first input).
@@ -5783,7 +5892,7 @@ export declare interface HttpSecretsOptions {
 
 /**
  * WS-rpc idempotency store + TTL, passed to `bindMutation` as a closure param by
- * the boot path (`serveApi`/`dev`) — NOT a service. @effect/rpc runs a handler in
+ * the boot path (`serveApi`/`dev`) — NOT a service. effect/rpc runs a handler in
  * a NARROWED context (only the middleware `provides` + declared deps), so a plain
  * merged service is invisible to `Effect.serviceOption` inside the handler; the
  * store+ttl are boot-time constants the bind site already holds, so a closure is
@@ -5843,6 +5952,7 @@ export declare class IndexedMatcher implements Matcher {
     private readonly columnByTable;
     private readonly rangeByTable;
     private readonly tupleByTable;
+    private readonly compositeByTable;
     private readonly unindexedByTable;
     private readonly subscriptions;
     register(sub: SubscriptionRecord): void;
@@ -6351,7 +6461,7 @@ export declare interface KvFacade {
      *  the backend `KvStore` (R = never), so both boot paths hand it to handlers
      *  as `Layer.succeed(Kv, service)` — enabling `yield* Kv` in Effect handlers
      *  exactly like `Layer.succeed(Cache, cacheService)` does for the cache. */
-    readonly service: Kv;
+    readonly service: Effect.Success<typeof Kv>;
     /** The resolved backend kind — for boot logging. */
     readonly backend: 'database' | 'redis' | 'memory';
     /** Tear down the managed runtime (closes a pooled redis connection). */
@@ -6405,6 +6515,12 @@ export declare interface LevelReactionDefinition extends ReactionBase {
     readonly guards?: Omit<ReactionGuards, 'dedupeKey'>;
 }
 
+export declare const linearBoundaries: (options: {
+    readonly start: number;
+    readonly width: number;
+    readonly count: number;
+}) => ReadonlyArray<number>;
+
 export declare class LinearScanMatcher implements Matcher {
     private readonly byTable;
     register(sub: SubscriptionRecord): void;
@@ -6417,6 +6533,10 @@ export declare class LinearScanMatcher implements Matcher {
 /** Every connection the app declares, projected for ONE subject. */
 export declare const listConnectionStates: (store: VaultStore, registry: ConnectionRegistry, subjectId: string) => Promise<ReadonlyArray<ConnectionState_2>>;
 
+/** The cell's versions, newest first — without their bytes. Empty when the
+ *  row is not visible to the caller. */
+export declare const listCrdtVersions: (store: CrdtHistoryStore, cell: CrdtCellRef) => Promise<ReadonlyArray<CrdtVersion>>;
+
 export declare const listResourcePolicies: () => ReadonlyArray<ResourcePolicy>;
 
 export { listRetentionConflicts }
@@ -6755,7 +6875,7 @@ export declare const makeListConnectionsExecutor: (deps: ConnectionBuiltinDeps)
  * round-trip it — a guard for exotic schemas; for a value the handler actually
  * produced, `encodeUnknownSync` never throws. `undefined` schema → no codec.
  */
-export declare const makeMutationOutputCodec: (outputSchema: Schema.Schema.AnyNoContext | undefined) => MutationOutputCodec<unknown> | undefined;
+export declare const makeMutationOutputCodec: (outputSchema: Schema.Top | undefined) => MutationOutputCodec<unknown> | undefined;
 
 /**
  * Build the shared mutation runner. Used by BOTH the rpc WS handler and
@@ -7208,10 +7328,9 @@ export declare const mergeCookieHeader: (existing: string | undefined, patch: Re
  */
 export declare const mergeFleetObservations: <T>(rows: ReadonlyArray<ReplicaObservationRow>, members: ReadonlyArray<FleetMember>, staleAfterMs?: number) => FleetMergeResult<T>;
 
-export { MetricBoundaries }
-
 export declare interface MetricBucketPoint {
-    /** Upper bound (Prometheus `le`); `Infinity` for the catch-all bucket. */
+    /** Upper bound (Prometheus `le`). Effect 4 reports the declared boundaries only;
+     *  the catch-all is the sample's `count` (the Prometheus exporter writes `+Inf` from it). */
     readonly le: number;
     /** Cumulative count ≤ le. */
     readonly count: number;
@@ -7245,6 +7364,25 @@ export declare type MetricSampleType = 'counter' | 'gauge' | 'histogram' | 'summ
  *  into the OTel MeterProvider when a `metricReader` is configured. */
 export declare type MetricsMode = 'off' | 'console' | 'otlp' | 'memory';
 
+/**
+ * Bring every stored document of a CRDT column to the latest content schema
+ * (`crdt.migrations`) — the batch half of a migration. Documents are migrated
+ * on their next write anyway; this does it now, so readers that never write
+ * see the new shape too. Each row is touched with an EMPTY update, which runs
+ * the write path's fold — and with it the migrations, under the same
+ * compare-and-swap, so running this from two replicas at once migrates each
+ * document once. Rows are read through the store it is given, so tenant scope
+ * applies; run it with a system store to cover every tenant.
+ */
+export declare const migrateCrdtColumn: (store: CrdtHistoryStore, options: {
+    readonly table: string;
+    readonly column: string;
+    readonly batchSize?: number;
+}) => Promise<{
+    readonly scanned: number;
+    readonly migrated: number;
+}>;
+
 /** The lowest cadence any platform scheduler can express. */
 export declare const MIN_EXTERNALIZABLE_INTERVAL_MS = 60000;
 
@@ -7686,12 +7824,10 @@ export declare class OptimisticLockError extends OptimisticLockError_base {
     get message(): string;
 }
 
-declare const OptimisticLockError_base: Schema.TaggedErrorClass<OptimisticLockError, "OptimisticLockError", {
-    readonly _tag: Schema.tag<"OptimisticLockError">;
-} & {
-    table: typeof Schema.String;
-    expected: typeof Schema.Number;
-}>;
+declare const OptimisticLockError_base: Schema.Class<OptimisticLockError, Schema.TaggedStruct<"OptimisticLockError", {
+    readonly table: Schema.String;
+    readonly expected: Schema.Number;
+}>, YieldableError>;
 
 export declare interface OrchestratorTickDeps {
     readonly store: DataStore;
@@ -7761,7 +7897,7 @@ export declare interface OriginGuardConfig {
 export declare type OriginGuardMode = 'off' | 'same-origin';
 
 /**
- * Map an `import('@effect/opentelemetry')` rejection to what the reader needs.
+ * Map an `import('@effect/opentelemetry/NodeSdk')` rejection to what the reader needs.
  *
  * Exported so the branch is testable without uninstalling the package. Only a
  * module-NOT-FOUND becomes the install instruction: anything else is a real
@@ -8023,7 +8159,7 @@ export declare interface PatConnectionDefinition extends ConnectionDefinitionCom
  * validity — but `voltro doctor`'s static `workflows.start` audit calls the same
  * function, so the two cannot disagree about what a payload requires.
  */
-export declare const payloadPropertyNames: (schema: Schema.Schema.Any) => {
+export declare const payloadPropertyNames: (schema: Schema.Top) => {
     readonly required: ReadonlyArray<string>;
     readonly optional: ReadonlyArray<string>;
 };
@@ -8117,17 +8253,31 @@ export declare interface PluginRefRule {
 }
 
 /** The store surface the enforcement needs. */
-export declare interface PluginRefStore {
-    query: (descriptor: unknown) => Promise<ReadonlyArray<Record<string, unknown>>>;
-    update: (table: string, id: string, patch: Record<string, unknown>) => Promise<unknown>;
-    delete: (table: string, id: string) => Promise<unknown>;
-}
+export declare type PluginRefStore = Pick<DataStore, 'updateMany' | 'deleteMany'>;
 
 /** The signature a plugin sees on its bind-ctx. */
 export declare type PluginScheduleCoordinated = (name: string, intervalMs: number, effect: CoordinatedEffect, options?: CoordinatedTaskOptions) => CoordinatedScheduleHandle;
 
 export declare const powerOfTwoSelector: (options?: P2COptions) => ReplicaSelector;
 
+/**
+ * The server's half of restoring a SEALED (`crdtSealed()`) cell. The server
+ * cannot read the content, so it cannot compute the restore — it archives the
+ * current log as a `restore` version (the restore stays undoable) and hands
+ * out the version's ciphertext. The client opens it with `openSealedLog` and
+ * calls the hook's `restore(target)`, which writes the change as an ordinary
+ * sealed edit. The cell's row is read through the caller's store first, as
+ * for every history read. An open column is refused — `restoreCrdtVersion`
+ * restores it on the server, and its history bytes stay `serverOnly()`.
+ */
+export declare const prepareSealedCrdtRestore: (store: CrdtHistoryStore, input: {
+    readonly versionId: string;
+    readonly createdBy?: string;
+}) => Promise<{
+    readonly undoPoint: CrdtVersion;
+    readonly versionLog: Uint8Array;
+} | undefined>;
+
 /**
  * Whether a `Referrer-Policy` value leaves the `Origin` header intact on a
  * same-origin state-changing request.
@@ -8293,7 +8443,7 @@ export declare interface PublicDevice {
  * Returns the assigned serial so a caller (and the tests) can observe ordering
  * without reaching into the bus.
  */
-export declare const publishEvent: <Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(ctx: EventPublishContext, descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>) => Effect.Effect<{
+export declare const publishEvent: <Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(ctx: EventPublishContext, descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>) => Effect.Effect<{
     readonly n: number;
     readonly deferred: boolean;
 }, EventPublishError>;
@@ -8324,7 +8474,7 @@ export declare interface PumpOptions {
  * computed). The three used to carry the same loop inline; a diagnostic added
  * to one of them would have been absent from the other two.
  *
- * **The stall diagnostic.** `@effect/rpc` delivers a stream as `Chunk`
+ * **The stall diagnostic.** `effect/rpc` delivers a stream as `Chunk`
  * messages and waits for the client's `Ack` of each before writing the next.
  * The typed client acknowledges by itself; a hand-rolled socket client that
  * only listens receives exactly one Chunk per subscription — the snapshot — and
@@ -8553,6 +8703,17 @@ export declare type ReactionOp = 'insert' | 'update' | 'delete';
 
 export declare type ReactionOutcome = 'acted' | 'skipped-op' | 'skipped-when' | 'skipped-dedupe' | 'skipped-ratelimit' | 'skipped-budget';
 
+/**
+ * The DURABLE rate key for one firing: reaction, partition, and time bucket.
+ *
+ * A fixed window keeps one durable bucket cursor and unique slot claims,
+ * rather than retaining every event timestamp. The transaction-owned cursor
+ * avoids probing every previously occupied slot; the UNIQUE remains the final
+ * arbiter. JSON encoding preserves arbitrary names/partitions without NUL in
+ * SQL text. Up to 2× the limit may fire across a bucket boundary.
+ */
+export declare const reactionRateBucketKey: (reactionName: string, partition: string, windowMs: number, now: number) => string;
+
 /**
  * A per-key sliding-window rate limiter — IN-MEMORY, PER PROCESS.
  *
@@ -8562,10 +8723,11 @@ export declare type ReactionOutcome = 'acted' | 'skipped-op' | 'skipped-when' |
  * the runner logs once when it falls back, because "my limit is 3× what I
  * declared" is not something anyone discovers by reading config.
  *
- * Prefer {@link ReactionRunDeps.claimRateSlot}.
+ * Prefer {@link ReactionRunDeps.claimRate}.
  */
 export declare class ReactionRateLimiter {
     private readonly hits;
+    private sweep;
     allow(key: string, limit: number, windowMs: number, now: number): boolean;
 }
 
@@ -8596,13 +8758,13 @@ export declare interface ReactionRunDeps {
      *  requireAiBudget). Only consulted when `guards.costBudgetUsd` is set. */
     readonly checkBudget?: (tenantId: string | null, budgetUsd: number) => boolean | Promise<boolean>;
     /**
-     * Atomically claim ONE rate slot. `true` = we got it and may fire.
+     * Atomically reserve ONE slot in a rate bucket. `true` = we may fire.
      *
      * Injected by the serve layer over the shared store, so the cap holds across
      * replicas. Absent → the runner falls back to {@link ReactionRateLimiter},
      * which is per-process and therefore N× on N replicas.
      */
-    readonly claimRateSlot?: (key: string) => Promise<boolean>;
+    readonly claimRate?: (key: string, limit: number, expiresAt: Date) => Promise<boolean>;
     readonly rateLimiter?: ReactionRateLimiter;
     readonly now?: () => number;
 }
@@ -8649,7 +8811,7 @@ export declare interface ReactiveConfigInput {
         readonly oversizedEventBytes?: number;
         /** How long a delivery may sit unaccepted by the transport before the
          *  server says so — a WARN naming the subscription and the missing
-         *  `@effect/rpc` `Ack`, plus `voltro_subscription_stalled_total`.
+         *  `effect/rpc` `Ack`, plus `voltro_subscription_stalled_total`.
          *  Default 5_000 ms. */
         readonly stallWarnAfterMs?: number;
     };
@@ -9133,6 +9295,8 @@ export declare interface RegistryTableLike {
         };
         /** `crdtText()` column — server-merged on write (see crdtColumns above). */
         readonly crdtManaged?: boolean;
+        /** `crdtSealed()` column — an append-only log of encrypted frames. */
+        readonly crdtSealed?: boolean;
     }>;
     readonly appliedMixins?: ReadonlyArray<{
         readonly id?: string;
@@ -9162,13 +9326,13 @@ export declare interface RegistryTableLike {
      * registry indexes this so the MutationStore can look it up in
      * O(1) per write without touching the original Table object.
      */
-    readonly insertSchema?: Schema.Schema.Any;
+    readonly insertSchema?: Schema.Top;
     /**
      * Optional `effect/Schema` the framework decodes a patch against
      * BEFORE every UPDATE. Set via `table().validatePatch(schema)`
      * (already `Schema.partial`-wrapped by the table builder).
      */
-    readonly validatePatchSchema?: Schema.Schema.Any;
+    readonly validatePatchSchema?: Schema.Top;
 }
 
 /** Rebuild checkable guards from the row. The stored resource id becomes a
@@ -9385,22 +9549,22 @@ export declare interface ReplicatedDataStoreOptions {
 }
 
 declare const Request_2: Schema.Struct<{
-    id: Schema.filter<Schema.filter<typeof Schema.String>>;
-    name: Schema.filter<Schema.filter<typeof Schema.String>>;
-    from: typeof Schema.DateFromSelf;
-    to: typeof Schema.DateFromSelf;
-    occurrences: Schema.Array$<Schema.filter<typeof Schema.Number>>;
-    status: Schema.Literal<["queued", "running", "completed", "interrupted"]>;
-    owner: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.String>>>;
-    createdAt: typeof Schema.DateFromSelf;
-    updatedAt: typeof Schema.DateFromSelf;
-    cursor: Schema.filter<Schema.filter<typeof Schema.Number>>;
-    activeIndex: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.Number>>>;
-    results: Schema.Array$<Schema.Struct<{
-        runId: Schema.filter<Schema.filter<typeof Schema.String>>;
-        status: Schema.Literal<["succeeded", "failed", "skipped", "missed"]>;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly from: Schema.Date;
+    readonly to: Schema.Date;
+    readonly occurrences: Schema.$Array<Schema.Number>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "completed", "interrupted"]>;
+    readonly owner: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+    readonly cursor: Schema.Number;
+    readonly activeIndex: Schema.NullOr<Schema.Number>;
+    readonly results: Schema.$Array<Schema.Struct<{
+        readonly runId: Schema.String;
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "skipped", "missed"]>;
     }>>;
-    error: Schema.NullOr<typeof Schema.String>;
+    readonly error: Schema.NullOr<Schema.String>;
 }>;
 
 export declare interface ResendOptions {
@@ -9760,6 +9924,17 @@ export declare interface ResourcePolicy {
     readonly implies?: Readonly<Record<string, ReadonlyArray<string>>>;
 }
 
+/**
+ * Bring a version back: the cell's content becomes the version's, written as
+ * an ordinary CRDT edit (concurrent edits still merge), after archiving the
+ * state it replaces as a `restore` version. `undefined` when the version or
+ * its row is not visible to the caller.
+ */
+export declare const restoreCrdtVersion: (store: CrdtHistoryStore, input: {
+    readonly versionId: string;
+    readonly createdBy?: string;
+}) => Promise<CrdtVersion | undefined>;
+
 /**
  * Mark everything read inside `fn` as RESTRICTING.
  *
@@ -9931,13 +10106,6 @@ export declare interface RevalidationMessage {
 
 export declare type RevalidationPublisher = (message: RevalidationMessage) => Promise<void>;
 
-/**
- * Reverse ONE recorded event over an in-memory row-set (to step BACK across it):
- *   - insert → the row was added, so remove it (by new.id).
- *   - update → restore the row to its `old` image (by id).
- *   - delete → the row was removed, so add `old` back.
- * Pure. Applied newest-first to walk from "now" to a past point.
- */
 export declare const reverseEventOverRows: (rows: ReadonlyArray<Row_2>, e: TimelineEvent) => ReadonlyArray<Row_2>;
 
 /** The ids that were visible before but are not now — what a live-revocation
@@ -10105,16 +10273,15 @@ export declare interface RowFilter<Ctx = unknown> {
  * the fix, rather than degrading to an unfiltered or empty answer.
  */
 export declare class RowFilterDeclarationViolated extends RowFilterDeclarationViolated_base {
+    get message(): string;
 }
 
-declare const RowFilterDeclarationViolated_base: Schema.TaggedErrorClass<RowFilterDeclarationViolated, "RowFilterDeclarationViolated", {
-    readonly _tag: Schema.tag<"RowFilterDeclarationViolated">;
-} & {
+declare const RowFilterDeclarationViolated_base: Schema.Class<RowFilterDeclarationViolated, Schema.TaggedStruct<"RowFilterDeclarationViolated", {
     /** The table the predicate narrowed. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** The declared set, for the message. */
-    declared: Schema.Array$<typeof Schema.String>;
-}>;
+    readonly declared: Schema.$Array<Schema.String>;
+}>, YieldableError>;
 
 /**
  * Could the registered filter narrow ANY of `tables`?
@@ -10162,12 +10329,10 @@ export declare type RowFilterScope = (table: string) => Predicate | undefined;
 export declare class RowFilterUnavailable extends RowFilterUnavailable_base {
 }
 
-declare const RowFilterUnavailable_base: Schema.TaggedErrorClass<RowFilterUnavailable, "RowFilterUnavailable", {
-    readonly _tag: Schema.tag<"RowFilterUnavailable">;
-} & {
+declare const RowFilterUnavailable_base: Schema.Class<RowFilterUnavailable, Schema.TaggedStruct<"RowFilterUnavailable", {
     /** `String(originalError)` — the last failure after retries were exhausted. */
-    cause: typeof Schema.String;
-}>;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 /** One `_voltro_row_history` row, structurally (from @voltro/plugin-row-history). */
 export declare interface RowHistoryEntry {
@@ -10202,7 +10367,7 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly handlersLayer: Layer.Layer<Rpc.ToHandler<Rpcs>>;
     /** Optional handlers layer dedicated to the one-shot HTTP rpc surface
      *  (`POST /rpc`, used by SSR web-router loaders). The HTTP JSON protocol
-     *  BUFFERS the whole response (the @effect/rpc client `await`s `r.json()`),
+     *  BUFFERS the whole response (the effect/rpc client `await`s `r.json()`),
      *  so a reactive query's never-ending stream would hang the request. The
      *  caller supplies a variant here whose query handlers complete after the
      *  FIRST snapshot (`Stream.take(1)`); the WS `handlersLayer` keeps the live
@@ -10445,11 +10610,11 @@ export declare const runOrchestratorTick: (deps: OrchestratorTickDeps) => Promis
 
 /**
  * Run a fully-provided handler Effect to a Promise, REJECTING WITH THE RAW
- * typed failure value — NOT Effect's opaque `FiberFailure` wrapper.
+ * typed failure value — the value itself, never a runtime envelope.
  *
  * Why this exists: the rpc encoder matches a rejected handler's thrown value
- * against the descriptor's `error:` schema. `Effect.runPromise` rejects with a
- * `FiberFailure` that wraps the cause, so a typed `Effect.fail(MyTaggedError)`
+ * against the descriptor's `error:` schema. a runtime that rejected with
+ * an envelope around the cause made a typed `Effect.fail(MyTaggedError)`
  * from an Effect-form mutation/action NEVER matches the schema and dumps on the
  * wire as a `Die`/`ExitEncoded` defect instead of the declared tagged error
  * (the async-handler path already throws the raw value, so it worked there —
@@ -10482,7 +10647,7 @@ export declare interface RuntimeContext {
     readonly subject: Subject;
     /** Trace identifier — the active span's W3C trace id (32 hex) when
      *  tracing is active; a per-call uuid otherwise. Shared across the
-     *  whole frontend→api→api chain via `@effect/rpc` + `traceparent`. */
+     *  whole frontend→api→api chain via `effect/rpc` + `traceparent`. */
     readonly traceId: string;
     /** The active span's id (16 hex), when tracing is active. Used to
      *  build the outbound `traceparent` header for cross-api hops. */
@@ -10848,7 +11013,7 @@ export declare interface SchedulerDeps {
     readonly onRunEvent?: (op: 'insert' | 'update', row: Record<string, unknown>) => void;
     /** When `false`, the engine registers schedules (so `fireNow` +
      *  `fireFromCluster` work) but does NOT arm in-app timers. Used by
-     *  `cluster` coordination, where `@effect/cluster`'s `ClusterCron`
+     *  `cluster` coordination, where `effect/cluster`'s `ClusterCron`
      *  drives the clock + guarantees once-only — the in-app timer would
      *  double-fire. Default `true`. */
     readonly armSelf?: boolean;
@@ -10924,7 +11089,7 @@ export declare interface SchedulerHandle {
     /** One run's terminal-or-not state, for a caller polling an accepted trigger
      *  to completion. `undefined` when no such run exists. */
     runStatus(runId: string): Promise<ScheduleRunStatus | undefined>;
-    /** Fire from a cluster-cron tick. `@effect/cluster` has already
+    /** Fire from a cluster-cron tick. `effect/cluster` has already
      *  guaranteed exactly-once across the fleet (this runner owns the
      *  shard), so we bypass the in-app coordinator + record the run
      *  with `coordinationOutcome: 'cluster'`. Overlap policy still
@@ -11050,6 +11215,8 @@ export declare interface SchemaInfo {
      * so concurrent clients converge. Empty set for the common non-CRDT table.
      */
     readonly crdtColumns: ReadonlySet<string>;
+    /** End-to-end-sealed CRDT columns (`crdtSealed()`): appended, never merged. */
+    readonly sealedColumns: ReadonlySet<string>;
     /**
      * Columns that a query predicate can hit and benefit from an index:
      *   - column-level `.index()`-flagged columns
@@ -11067,9 +11234,9 @@ export declare interface SchemaInfo {
         readonly fields: ReadonlyArray<string>;
     }>;
     /** Optional pre-INSERT row decoder (from `table().validate(...)`). */
-    readonly insertSchema?: Schema.Schema.Any;
+    readonly insertSchema?: Schema.Top;
     /** Optional pre-UPDATE partial-patch decoder (from `table().validatePatch(...)`). */
-    readonly validatePatchSchema?: Schema.Schema.Any;
+    readonly validatePatchSchema?: Schema.Top;
     /**
      * Resolved id-scheme for the table's primary-key column. `undefined`
      * for tables that have no `id`-typed column — a natural or composite
@@ -11097,7 +11264,7 @@ export declare interface SchemaInfo {
  * the common composition nodes so a column nested under `{ refs: [{ … }] }` or
  * behind a `NullOr` is still seen. Cycle-guarded via a seen-set on Suspend.
  */
-export declare const schemaPropertyNames: (schema: Schema.Schema.Any) => ReadonlySet<string>;
+export declare const schemaPropertyNames: (schema: Schema.Top) => ReadonlySet<string>;
 
 export declare interface SchemaRegistry {
     readonly tables: ReadonlyMap<string, SchemaInfo>;
@@ -11167,6 +11334,8 @@ export declare interface SchemaRegistry {
      * CRDT merge (`mergeCrdtStates`) before an INSERT/UPDATE persists.
      */
     crdtColumns(table: string): ReadonlySet<string>;
+    /** `crdtSealed()` columns of a table — see `SchemaInfo.sealedColumns`. */
+    sealedColumns(table: string): ReadonlySet<string>;
     /**
      * Optional pre-INSERT schema decoder for a table. `undefined` when
      * the table didn't ship `.validate(schema)`. The MutationStore runs
@@ -11174,7 +11343,7 @@ export declare interface SchemaRegistry {
      * INSERT — a decode failure becomes a `TableValidationFailed`
      * typed error on the mutation's error channel.
      */
-    insertSchema(table: string): Schema.Schema.Any | undefined;
+    insertSchema(table: string): Schema.Top | undefined;
     /**
      * Optional pre-UPDATE partial-patch decoder for a table. `undefined`
      * when the table didn't ship `.validatePatch(schema)`. The
@@ -11182,7 +11351,7 @@ export declare interface SchemaRegistry {
      * the underlying UPDATE — a decode failure becomes a
      * `TableValidationFailed` typed error on the mutation's error channel.
      */
-    validatePatchSchema(table: string): Schema.Schema.Any | undefined;
+    validatePatchSchema(table: string): Schema.Top | undefined;
 }
 
 declare interface ScopeCtx {
@@ -11477,6 +11646,14 @@ export declare const setBufferedBytes: (label: string, bytes: number) => void;
  *  Called by the CLI at boot; tests call it directly. */
 export declare const setConnectionResolver: (resolver: ConnectionResolver | undefined) => void;
 
+/** Boot/test override — the slot `wireCrdtTunables` writes. Fields left out
+ *  keep env/default resolution. */
+export declare const setCrdtAdmission: (admission: CrdtAdmission | null) => void;
+
+/** Boot wiring for `crdt.backend` — every default call site (the merge, the
+ *  history, the inspection) follows it. `null` restores Yjs. */
+export declare const setCrdtBackend: (backend: CrdtBackendChoice | null) => void;
+
 /** Boot/test override — the slot `wireCrdtTunables` writes. `null` restores
  *  env/default resolution. */
 export declare const setCrdtCompactMaxBytes: (maxBytes: number | null) => void;
@@ -11623,6 +11800,15 @@ export declare interface SnapshotCacheBinding {
     readonly swrMs: number | undefined;
 }
 
+/**
+ * Archive the cell's current state as a named version. `undefined` when the
+ * row is not visible to the caller.
+ */
+export declare const snapshotCrdt: (store: CrdtHistoryStore, cell: CrdtCellRef & {
+    readonly label?: string;
+    readonly createdBy?: string;
+}) => Promise<CrdtVersion | undefined>;
+
 /** Snapshot the whole registry, normalized to `MetricSample[]` — plus the
  *  socket-backpressure counters (`subscriptionSocketMetrics.ts`), appended
  *  HERE so every reader (Prometheus exporter, inspect Metrics panel) sees
@@ -12984,6 +13170,8 @@ export declare const _voltroConnectionGrantsTable: TableLike;
  */
 export declare const _voltroConnectionsTable: TableLike;
 
+export declare const _voltroCrdtVersionsTable: TableLike;
+
 /** `_voltro_rebac_tuples` — the relationship tuples `can()` reads. One row =
  *  "`subjectId` has `relation` on `<resourceType>:<resourceId>`". Grant by
  *  inserting; revoke by deleting (a delete is the live-revocation trigger). */
@@ -13255,9 +13443,9 @@ export declare interface WorkflowControlTarget extends WorkflowControlOptions {
 
 export declare interface WorkflowDefinitionLike {
     readonly name: string;
-    readonly payloadSchema: Schema.Schema.Any;
-    readonly successSchema: Schema.Schema.Any;
-    readonly errorSchema: Schema.Schema.All;
+    readonly payloadSchema: Schema.Top;
+    readonly successSchema: Schema.Top;
+    readonly errorSchema: Schema.Top;
     execute(payload: never, options?: {
         readonly discard?: boolean;
     }): Effect.Effect<unknown, unknown, unknown>;
@@ -13782,15 +13970,13 @@ export declare interface WorkflowStartLike {
 export declare class WorkflowStartNotExecuted extends WorkflowStartNotExecuted_base {
 }
 
-declare const WorkflowStartNotExecuted_base: Schema.TaggedErrorClass<WorkflowStartNotExecuted, "WorkflowStartNotExecuted", {
-    readonly _tag: Schema.tag<"WorkflowStartNotExecuted">;
-} & {
-    workflowName: typeof Schema.String;
-    handleId: typeof Schema.String;
-    reason: Schema.Literal<["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
-    failureId: Schema.NullOr<typeof Schema.String>;
-    incumbentExecutionId: Schema.NullOr<typeof Schema.String>;
-}>;
+declare const WorkflowStartNotExecuted_base: Schema.Class<WorkflowStartNotExecuted, Schema.TaggedStruct<"WorkflowStartNotExecuted", {
+    readonly workflowName: Schema.String;
+    readonly handleId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
+    readonly failureId: Schema.NullOr<Schema.String>;
+    readonly incumbentExecutionId: Schema.NullOr<Schema.String>;
+}>, Cause.YieldableError>;
 
 /**
  * What a start handle has become, read once and without waiting.