@voltro/runtime 0.84.0 → 0.86.0

package/dist/index.d.ts

@@ -4,6 +4,7 @@ import { AnyGuardSpec } from '@voltro/protocol';
 import { AuthMiddleware } from '@voltro/protocol';
 import { AuthStrategy } from '@voltro/protocol';
 import { CaughtUpVerdict } from '@voltro/database';
+import { Cause } from 'effect';
 import { ChangeEvent } from '@voltro/database';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
@@ -29,6 +30,7 @@ import { DialectReplicationAdapter } from '@voltro/database';
 import { Duplex } from 'node:stream';
 import { Duration } from 'effect';
 import { Effect } from 'effect';
+import { EnqueueOptions } from '@voltro/protocol';
 import { EventDeliverySemantics } from '@voltro/protocol';
 import { EventDescriptor } from '@voltro/protocol';
 import { EventKeyInvalid } from '@voltro/protocol';
@@ -42,7 +44,7 @@ import { FieldBinding } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
 import { FieldDefinitions } from '@voltro/database';
 import * as http from 'node:http';
-import { HttpClient } from '@effect/platform';
+import { HttpClient } from 'effect/http';
 import { HttpRequestInterceptor } from '@voltro/protocol';
 import { HttpRouteObserver } from '@voltro/protocol';
 import { IdempotencyStore } from '@voltro/protocol';
@@ -66,11 +68,13 @@ import { listRetentionConflicts } from '@voltro/database';
 import { listRetentions } from '@voltro/database';
 import { Membership } from '@voltro/protocol';
 import { Metric } from 'effect';
-import { MetricBoundaries } from 'effect';
 import { MetricReader } from '@opentelemetry/sdk-metrics';
 import { MutationIdempotencyScope } from '@voltro/protocol';
 import { NoRowFound } from '@voltro/protocol';
 import { NoSuchResource } from '@voltro/protocol';
+import { OutboxEnqueueFacade } from '@voltro/protocol';
+import { OutboxHandlerContext } from '@voltro/protocol';
+import { OutboxHandlerDefinition } from '@voltro/protocol';
 import { PendingApproval } from '@voltro/protocol';
 import { PluginHttpRoute } from '@voltro/protocol';
 import { PluginHttpRouteByteStream } from '@voltro/protocol';
@@ -82,6 +86,7 @@ import { Query } from '@voltro/database';
 import { QueryDescriptor } from '@voltro/database';
 import { Redis } from 'ioredis';
 import { registerRetention } from '@voltro/database';
+import { RequestedTenantRefused } from '@voltro/protocol';
 import { ResourceMissing } from '@voltro/protocol';
 import { RestRouteDescriptor } from '@voltro/protocol/rest';
 import { RetentionConflict } from '@voltro/database';
@@ -91,8 +96,8 @@ import { retentionTtlMsFromEnv } from '@voltro/database';
 import { Row } from '@voltro/database';
 import { RowKey } from '@voltro/database';
 import { RowPatch } from '@voltro/protocol';
-import { Rpc } from '@effect/rpc';
-import { RpcGroup } from '@effect/rpc';
+import { Rpc } from 'effect/rpc';
+import { RpcGroup } from 'effect/rpc';
 import { RpcInterceptor } from '@voltro/protocol';
 import { RuleReadStore } from '@voltro/database';
 import { Sampler } from '@opentelemetry/sdk-trace-base';
@@ -104,7 +109,7 @@ import { ServerOnlyColumnWrite } from '@voltro/protocol';
 import { ServerResponse } from 'node:http';
 import { SpanProcessor } from '@opentelemetry/sdk-trace-base';
 import { spawn } from 'node:child_process';
-import { SqlClient } from '@effect/sql';
+import { SqlClient } from 'effect/sql';
 import { StoredTableShape } from '@voltro/database';
 import { StoreError } from '@voltro/protocol';
 import { StoreOperationFailed } from '@voltro/protocol';
@@ -145,19 +150,18 @@ import { WorkflowRunHandle } from '@voltro/protocol';
 import { WorkflowRunSnapshot as WorkflowRunSnapshot_2 } from '@voltro/protocol';
 import { WorkflowStartResolution } from '@voltro/workflow';
 import { WorkflowUpdateResult } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
 
 /** Typed denial — declare on an rpc `error:` union so a refusal surfaces to the
  *  client typed + pattern-matchable (never a bare 500). */
 export declare class AccessDenied extends AccessDenied_base {
 }
 
-declare const AccessDenied_base: Schema.TaggedErrorClass<AccessDenied, "AccessDenied", {
-    readonly _tag: Schema.tag<"AccessDenied">;
-} & {
-    action: typeof Schema.String;
-    resourceType: typeof Schema.String;
-    resourceId: typeof Schema.String;
-}>;
+declare const AccessDenied_base: Schema.Class<AccessDenied, Schema.TaggedStruct<"AccessDenied", {
+    readonly action: Schema.String;
+    readonly resourceType: Schema.String;
+    readonly resourceId: Schema.String;
+}>, YieldableError>;
 
 /**
  * Exported so the rpc boundary can stamp `ChangeEvent.subjectId` with the SAME
@@ -168,6 +172,7 @@ declare const AccessDenied_base: Schema.TaggedErrorClass<AccessDenied, "AccessDe
 export declare const actingUserId: (subject: StoreMiddlewareContext["subject"]) => string | null;
 
 export declare interface ActionRunnerDeps {
+    readonly outcomeOutbox?: MutationRunnerDeps['outcomeOutbox'];
     /** Build the per-call `AppContext` — NO transactional tx (actions do
      *  external I/O and run outside a txn deliberately). */
     readonly buildContext: (request: ServeRequestContext) => {
@@ -374,13 +379,11 @@ declare class AggregateError_2 extends AggregateError_base {
 }
 export { AggregateError_2 as AggregateError }
 
-declare const AggregateError_base: Schema.TaggedErrorClass<AggregateError_2, "AggregateError", {
-    readonly _tag: Schema.tag<"AggregateError">;
-} & {
-    name: typeof Schema.String;
-    operation: typeof Schema.String;
-    cause: typeof Schema.String;
-}>;
+declare const AggregateError_base: Schema.Class<AggregateError_2, Schema.TaggedStruct<"AggregateError", {
+    readonly name: Schema.String;
+    readonly operation: Schema.String;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 export declare type AggregateFailure = AggregateStale | AggregateNotFound | AggregateError_2;
 
@@ -403,7 +406,10 @@ export declare interface AggregateHandle<Row> {
 export declare class AggregateMaintainer {
     private readonly shape;
     private state;
+    private extrema;
     private readonly groups;
+    private readonly positions;
+    private nextPosition;
     constructor(shape: AggregateShape);
     /** Seed from the full base row-set (boot / after a rescan-from-scratch). */
     seed(baseRows: ReadonlyArray<Row_4>): void;
@@ -414,6 +420,11 @@ export declare class AggregateMaintainer {
     applyChange(delta: CdcDelta): ReadonlyArray<string>;
     /** Rebuild the flagged groups from the current base rows (min/max recovery). */
     resolveRescan(rescanGroups: ReadonlyArray<string>, baseRows: ReadonlyArray<Row_4>): void;
+    /** Read only the requested live groups, with insertion-order identities.
+     * A group deleted and reinserted receives a new position, matching materialize. */
+    materializeGroups(keys: ReadonlyArray<string>): ReadonlyArray<MaintainedGroup & {
+        readonly rowIndex: number;
+    }>;
     /** The current materialized result — one entry per non-empty group. */
     materialize(): ReadonlyArray<MaintainedGroup>;
     private groupValues;
@@ -440,11 +451,9 @@ export declare interface AggregateMeta {
 export declare class AggregateNotFound extends AggregateNotFound_base {
 }
 
-declare const AggregateNotFound_base: Schema.TaggedErrorClass<AggregateNotFound, "AggregateNotFound", {
-    readonly _tag: Schema.tag<"AggregateNotFound">;
-} & {
-    name: typeof Schema.String;
-}>;
+declare const AggregateNotFound_base: Schema.Class<AggregateNotFound, Schema.TaggedStruct<"AggregateNotFound", {
+    readonly name: Schema.String;
+}>, YieldableError>;
 
 export declare interface AggregateQuery {
     readonly event: string;
@@ -497,15 +506,9 @@ export declare interface AggregateReadOptions {
  *   - Interval string (`'5m'`, `'1h'`, `'24h'`): the canonical
  *     simple case.
  *   - Cron expression `{ cron: '0 2 * * *', timezone: 'UTC' }`: for
- *     business-hours / off-peak refresh windows. **Defer to v2** —
- *     emitted from the spec but not yet honoured by the runner.
+ *     business-hours / off-peak refresh windows, in the specified timezone.
  *   - On-change debounced `{ interval: '1h', onChange: ['matches'],
- *     debounceMs: 30_000 }`: near-realtime, source-table-driven. **Defer
- *     to v2** — same status.
- *
- * v1 supports interval only. The other shapes are accepted so consumers
- * can declare them today + see them honoured when v2 lands without
- * touching the spec.
+ *     debounceMs: 30_000 }`: near-realtime, source-table-driven.
  */
 export declare type AggregateRefreshPolicy = string | {
     readonly interval?: string;
@@ -522,7 +525,7 @@ export declare type AggregateRefreshPolicy = string | {
 export declare class AggregateRegistry extends AggregateRegistry_base {
 }
 
-declare const AggregateRegistry_base: Context.TagClass<AggregateRegistry, "@voltro/AggregateRegistry", {
+declare const AggregateRegistry_base: Context.ServiceClass<AggregateRegistry, "@voltro/AggregateRegistry", {
     /** Resolve a typed handle from the definition. The cli registers
      *  every discovered aggregate at boot; calling this with an unknown
      *  def returns a handle whose methods all fail with
@@ -548,13 +551,11 @@ export declare interface AggregateShape {
 export declare class AggregateStale extends AggregateStale_base {
 }
 
-declare const AggregateStale_base: Schema.TaggedErrorClass<AggregateStale, "AggregateStale", {
-    readonly _tag: Schema.tag<"AggregateStale">;
-} & {
-    name: typeof Schema.String;
-    ageMs: typeof Schema.Number;
-    maxAgeMs: typeof Schema.Number;
-}>;
+declare const AggregateStale_base: Schema.Class<AggregateStale, Schema.TaggedStruct<"AggregateStale", {
+    readonly name: Schema.String;
+    readonly ageMs: Schema.Number;
+    readonly maxAgeMs: Schema.Number;
+}>, YieldableError>;
 
 export declare interface AnalyticsBucket {
     readonly bucketStart: Date;
@@ -570,12 +571,10 @@ export declare interface AnalyticsBucket {
 export declare class AnalyticsCapabilityNotSupported extends AnalyticsCapabilityNotSupported_base {
 }
 
-declare const AnalyticsCapabilityNotSupported_base: Schema.TaggedErrorClass<AnalyticsCapabilityNotSupported, "AnalyticsCapabilityNotSupported", {
-    readonly _tag: Schema.tag<"AnalyticsCapabilityNotSupported">;
-} & {
-    provider: typeof Schema.String;
-    capability: typeof Schema.String;
-}>;
+declare const AnalyticsCapabilityNotSupported_base: Schema.Class<AnalyticsCapabilityNotSupported, Schema.TaggedStruct<"AnalyticsCapabilityNotSupported", {
+    readonly provider: Schema.String;
+    readonly capability: Schema.String;
+}>, YieldableError>;
 
 /**
  * The underlying sink raised an error. `cause` is stringified for
@@ -584,13 +583,11 @@ declare const AnalyticsCapabilityNotSupported_base: Schema.TaggedErrorClass<Anal
 export declare class AnalyticsError extends AnalyticsError_base {
 }
 
-declare const AnalyticsError_base: Schema.TaggedErrorClass<AnalyticsError, "AnalyticsError", {
-    readonly _tag: Schema.tag<"AnalyticsError">;
-} & {
-    provider: typeof Schema.String;
-    operation: typeof Schema.String;
-    cause: typeof Schema.String;
-}>;
+declare const AnalyticsError_base: Schema.Class<AnalyticsError, Schema.TaggedStruct<"AnalyticsError", {
+    readonly provider: Schema.String;
+    readonly operation: Schema.String;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 /**
  * One analytics event. `properties` must be JSON-serialisable —
@@ -788,7 +785,7 @@ export declare interface AnalyticsMirrorUpsert {
 export declare class AnalyticsSink extends AnalyticsSink_base {
 }
 
-declare const AnalyticsSink_base: Context.TagClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
+declare const AnalyticsSink_base: Context.ServiceClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
 
 /**
  * The runtime contract every analytics provider implements. Plugins
@@ -1115,7 +1112,9 @@ export declare interface AppAccess {
     readonly hasAny: (scopes: ReadonlyArray<string>) => boolean;
     /** Effect guard — fails with a typed `ScopeError` when the caller lacks
      *  `scope`. `yield* ctx.access.require('notes:write')` at the top of a
-     *  handler mirrors a descriptor `guards:` entry for in-body branching. */
+     *  handler mirrors a descriptor `guards:` entry for in-body branching.
+     *  Reauthenticates bound authority when the Effect executes. Authentication
+     *  or authority-source failures abort rather than becoming scope decisions. */
     readonly require: (scope: string) => Effect.Effect<void, ScopeError>;
     /** The caller's effective scope set (live — reflects rbac resolution). */
     readonly scopes: ReadonlyArray<string>;
@@ -1676,7 +1675,7 @@ export declare interface AttachFinopsOptions {
 /** The descriptor shape the audit needs — a `defineQuery` result carries it. */
 export declare interface AuditableQuery {
     readonly name: string;
-    readonly output: Schema.Schema.Any;
+    readonly output: Schema.Top;
     /** Declared source table(s) — the tables whose serverOnly columns must not leak. */
     readonly source?: string | ReadonlyArray<string> | undefined;
 }
@@ -1801,7 +1800,7 @@ export declare const bindConnectionCredential: (clientId: number, credential: Co
  * interrupt registry subscriptions use — so one reconnect policy, one devtools
  * view, one connection lifecycle for both primitives.
  */
-export declare const bindEvent: (input: BindEventInput) => Stream.Stream<EventStreamEvent<unknown>, ScopeError | Unauthenticated | NoSuchResource, SubjectService | ConnectionInfo>;
+export declare const bindEvent: (input: BindEventInput) => Stream.Stream<EventStreamEvent<unknown>, ScopeError | Unauthenticated | RequestedTenantRefused | NoSuchResource, SubjectService | ConnectionInfo>;
 
 export declare interface BindEventInput {
     readonly bus: EventBus;
@@ -1846,7 +1845,7 @@ export declare const bindMutation: <Input, Output, E = never>(execute: (input: I
  * schema keeps exactly the old behaviour rather than collapsing errors it
  * cannot classify.
  */
-declaredError?: Schema.Schema.All, idempotencyScope?: MutationIdempotencyScope) => Effect.Effect<Output, E, SubjectService | ConnectionInfo>;
+declaredError?: Schema.Top, idempotencyScope?: MutationIdempotencyScope) => Effect.Effect<Output, E, SubjectService | ConnectionInfo>;
 
 /**
  * Bind a non-reactive server→client stream (A3). The executor builds a
@@ -1878,7 +1877,7 @@ guards?: ReadonlyArray<unknown> | undefined,
 guardInput?: unknown) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
 
 /**
- * Build a `Stream<SubscriptionEvent<T>>` that an @effect/rpc streaming
+ * Build a `Stream<SubscriptionEvent<T>>` that an effect/rpc streaming
  * handler can return directly. The descriptor is built by the route's
  * executor from the input + the per-call `RuntimeContext` (subject +
  * traceId) we derive from the auth-middleware's resolved subject.
@@ -2133,6 +2132,8 @@ export declare const canonicalInputKey: (input: unknown) => string;
  * Canonical JSON — object keys sorted recursively, so two structurally equal
  * inputs that differ only in key order digest identically. A retry from a
  * different client build must not mint a second approval.
+ * Preserve own JSON fields such as `__proto__`; a prototype setter must never
+ * discard part of the content that an approval identity binds.
  */
 export declare const canonicalJson: (value: unknown) => string;
 
@@ -2187,7 +2188,7 @@ export declare interface CircuitBreakerOptions {
     /** Consecutive failures before the breaker opens. */
     readonly failureThreshold: number;
     /** Wait before transitioning open → half-open (Duration or string). */
-    readonly resetTimeout: Duration.DurationInput;
+    readonly resetTimeout: Duration.Input;
     /** Successes required in half-open before closing again. Default 1. */
     readonly halfOpenSuccessThreshold?: number;
     /** Predicate: does this error count toward the threshold? Default: all
@@ -2205,14 +2206,12 @@ export declare interface CircuitBreakerOptions {
 export declare class CircuitOpen extends CircuitOpen_base {
 }
 
-declare const CircuitOpen_base: Schema.TaggedErrorClass<CircuitOpen, "CircuitOpen", {
-    readonly _tag: Schema.tag<"CircuitOpen">;
-} & {
+declare const CircuitOpen_base: Schema.Class<CircuitOpen, Schema.TaggedStruct<"CircuitOpen", {
     /** Breaker name (the `name` option, or `'circuit'` when unnamed). */
-    name: typeof Schema.String;
+    readonly name: Schema.String;
     /** Best-effort ms until the breaker next admits a probe call. */
-    retryAfterMs: typeof Schema.Number;
-}>;
+    readonly retryAfterMs: Schema.Number;
+}>, Cause.YieldableError>;
 
 export declare type CircuitState = 'closed' | 'open' | 'half-open';
 
@@ -2746,7 +2745,7 @@ export declare type CoordinationOutcome = 'single' | 'wonLock' | 'lostLock' | 'e
  *  instance should run the firing. Implementations:
  *    - SingleCoordinator        → always true (one process)
  *    - AdvisoryLockCoordinator  → postgres advisory lock (wired in CLI)
- *    - ClusterCoordinator       → @effect/cluster shard (future)
+ *    - ClusterCoordinator       → effect/cluster shard (future)
  */
 export declare interface Coordinator {
     readonly kind: 'single' | 'advisoryLock' | 'cluster';
@@ -2985,7 +2984,7 @@ export declare interface CostEvent {
 export declare class CostRegistry extends CostRegistry_base {
 }
 
-declare const CostRegistry_base: Context.TagClass<CostRegistry, "@voltro/CostRegistry", CostRegistryApi>;
+declare const CostRegistry_base: Context.ServiceClass<CostRegistry, "@voltro/CostRegistry", CostRegistryApi>;
 
 export declare interface CostRegistryApi {
     /** Per-tenant compute-cost attribution — the chargeback feed. */
@@ -3002,8 +3001,8 @@ export declare interface CostRegistryApi {
     readonly subscribe: (listener: (s: CostBudgetSignal) => void) => () => void;
 }
 
-/** Define a cumulative counter. Increment with `incrementMetric` / `Metric.increment`. */
-export declare const counter: (name: string, description?: string) => Metric.Metric.Counter<number>;
+/** Define a cumulative counter. Increment with `incrementMetric` / `Metric.update(metric, 1)`. */
+export declare const counter: (name: string, description?: string) => Metric.Counter<number>;
 
 /**
  * Count workflows actively EXECUTING (`_voltro_workflow_runs.status =
@@ -3985,6 +3984,8 @@ export declare class Dispatcher {
     /** Query labels already warned about for an undeclared raw read, so a hot
      *  subscription logs once rather than once per subscriber. */
     private readonly rawReadWarned;
+    private changeEpoch;
+    private readonly committedReads;
     /** The CRDT-managed columns of `table` (empty when it has none) — what a
      *  subscription's backpressure outbox folds incrementally. */
     crdtColumnsFor(table: string): ReadonlySet<string>;
@@ -4059,6 +4060,9 @@ export declare class Dispatcher {
      * grant comes back.
      */
     private revokeSubscription;
+    /** Remove once, including a pending retry and its active metric. In-flight
+     *  async reads check identity again before emitting or scheduling anything. */
+    private removeComputed;
     /** `revokeSubscription` for the computed path. Same reasoning. */
     private revokeComputed;
     /**
@@ -4069,13 +4073,10 @@ export declare class Dispatcher {
      * Returns an `unsubscribe` the caller MUST invoke on teardown.
      */
     subscribeComputed(computed: ComputedQuery, emit: (event: SubscriptionEvent<unknown>) => void, context: RuntimeContext, label?: string): Promise<() => void>;
-    /** Re-run a computed subscription's handler; emit a fresh snapshot iff
-     *  the value changed. A computed value is an arbitrary payload (a scalar,
-     *  an aggregate object, a non-id-keyed array) — it has no id-keyed row
-     *  set to diff, so an update ships the full value as a `snapshot`, which
-     *  the client materialises as a wholesale base replacement. Best-effort:
-     *  a recompute throw is logged, not propagated, so one failing query
-     *  can't wedge the change stream. */
+    /** Serialize computed reads. A source change during a pending read asks for
+     *  one more read before delivery; an older result cannot overtake newer data.
+     *  Ordinary failures are visible in-band and retry independently of changes.
+     *  Access withdrawal stays terminal and never enters the retry lane. */
     private recomputeComputed;
     /** Live snapshot of all fingerprinted subscriptions — used by the
      *  `/_voltro/inspect/subscriptions` endpoint and DevTools. */
@@ -4215,7 +4216,7 @@ export declare interface DrainDeps<R = never> {
  * inject `exit` and drive a finalizer that genuinely never finishes.
  */
 export declare const drainForShutdown: (options: {
-    readonly fibers: ReadonlyArray<Fiber.RuntimeFiber<void, unknown>>;
+    readonly fibers: ReadonlyArray<Fiber.Fiber<void, unknown>>;
     readonly hooks: ReadonlyArray<() => void | Promise<void>>;
     readonly deadlineMs: number;
     readonly exit: () => void;
@@ -4238,7 +4239,7 @@ export declare interface DrainResult {
     readonly dead: number;
     readonly skipped: number;
     /**
-     * How many rows this pass had to look at. `0` means the queue is EMPTY, which
+     * How many rows this pass had to look at. `0` means the eligible queue is EMPTY, which
      * a caller cannot otherwise tell from "everything delivered" — both leave
      * `delivered` at whatever it was, and only one of them means the poll has
      * nothing left to do.
@@ -4305,7 +4306,7 @@ export declare const effectiveRelations: (subject: RebacSubject, resource: Rebac
 export declare class EffectStore extends EffectStore_base {
 }
 
-declare const EffectStore_base: Context.TagClass<EffectStore, "@voltro/EffectStore", EffectStoreOps>;
+declare const EffectStore_base: Context.ServiceClass<EffectStore, "@voltro/EffectStore", EffectStoreOps>;
 
 export declare interface EffectStoreOps {
     /** Typed the same way `FluentStore.query` is — the row type rides in on the
@@ -4432,14 +4433,7 @@ export declare const enforceApproval: (input: {
     readonly traceId?: string | undefined;
 }) => Promise<void>;
 
-export declare interface EnqueueOptions {
-    /** Drop this enqueue if an undelivered row already carries the same key. */
-    readonly idempotencyKey?: string;
-    /** Override the handler's `maxAttempts` for this one effect. */
-    readonly maxAttempts?: number;
-    /** Delay the first attempt (ms from now). */
-    readonly delayMs?: number;
-}
+export { EnqueueOptions }
 
 /**
  * Attribute the reads that FOLLOW, in this execution context, to `procedure`.
@@ -4559,6 +4553,8 @@ export declare class EventBus {
      * sacrificed under pressure, never delivery.
      */
     private evictIfOverCapacity;
+    /** Select a bounded batch, preserving insertion order for equal timestamps. */
+    private coldestIdleRoutes;
     /**
      * Drop what the ring may no longer replay.
      *
@@ -4764,7 +4760,7 @@ export declare interface EventPublishContext {
 }
 
 export declare interface EventPublisher {
-    publish<Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>): AwaitableEffect<EventPublishResult, EventPublishError>;
+    publish<Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>): AwaitableEffect<EventPublishResult, EventPublishError>;
 }
 
 export declare type EventPublishError = EventPayloadInvalid | EventKeyInvalid | EventPayloadTooLarge;
@@ -4849,9 +4845,9 @@ export declare const exchangeAuthorizationCode: (definition: OAuth2ConnectionDef
  *  `defineMutation` / `defineAction` result carries all of it. */
 export declare interface ExecutorDescriptor {
     readonly kind: 'query' | 'mutation' | 'action';
-    readonly input: Schema.Schema.Any;
-    readonly output: Schema.Schema.Any;
-    readonly error: Schema.Schema.All;
+    readonly input: Schema.Top;
+    readonly output: Schema.Top;
+    readonly error: Schema.Top;
 }
 
 /** The failure type of an executor's return, when it returns an Effect. A
@@ -5019,7 +5015,7 @@ export declare type ExpectationInvariant = {
 export declare class ExpectationRegistry extends ExpectationRegistry_base {
 }
 
-declare const ExpectationRegistry_base: Context.TagClass<ExpectationRegistry, "@voltro/ExpectationRegistry", ExpectationRegistryApi>;
+declare const ExpectationRegistry_base: Context.ServiceClass<ExpectationRegistry, "@voltro/ExpectationRegistry", ExpectationRegistryApi>;
 
 export declare interface ExpectationRegistryApi {
     /** Snapshot every registered expectation's current state — the inspect feed. */
@@ -5283,7 +5279,7 @@ export declare type ExperimentMetricKind = ExperimentMetric['kind'];
 export declare class ExperimentRegistry extends ExperimentRegistry_base {
 }
 
-declare const ExperimentRegistry_base: Context.TagClass<ExperimentRegistry, "@voltro/ExperimentRegistry", ExperimentRegistryApi>;
+declare const ExperimentRegistry_base: Context.ServiceClass<ExperimentRegistry, "@voltro/ExperimentRegistry", ExperimentRegistryApi>;
 
 export declare interface ExperimentRegistryApi {
     /** Snapshot every registered experiment's current result — the inspect feed. */
@@ -5373,6 +5369,12 @@ export declare interface ExperimentVariantSpec {
     readonly weight?: number;
 }
 
+export declare const exponentialBoundaries: (options: {
+    readonly start: number;
+    readonly factor: number;
+    readonly count: number;
+}) => ReadonlyArray<number>;
+
 /**
  * How far AHEAD of now an external trigger's stated instant may be.
  *
@@ -5461,12 +5463,12 @@ export declare type ExternalTriggerOutcome =
 export { extractDbCause }
 
 /** The literal `_tag`s of a failure type. `any` contributes none (nothing can
- *  be proven about it); `UnknownException` — Effect's wrapper for a failure it
+ *  be proven about it); `UnknownError` — Effect's wrapper for a failure it
  *  could not type, e.g. `Effect.tryPromise` without `catch` — counts as
  *  untagged, which is what it means. */
 declare type FailureTag<E> = 0 extends (1 & E) ? never : E extends {
     readonly _tag: infer T;
-} ? T extends 'UnknownException' ? never : T extends string ? T : never : never;
+} ? T extends 'UnknownError' ? never : T extends string ? T : never : never;
 
 export declare interface FieldChange {
     readonly from: unknown;
@@ -5667,14 +5669,9 @@ export declare interface FluentStoreBackend {
  * rbac role-derived scopes) via `hasEffectiveScope` — so `admin:full` sees every
  * such column, exactly as it satisfies every guard.
  *
- * SUBJECT-INDEPENDENCE is deliberate and load-bearing: when the table declares
- * NO `.readableBy(...)` column, this returns exactly `serverOnlyColumnNames` —
- * the same set for every subject — so the Dispatcher's per-subscriber strip
- * collapses to Part A's behaviour and its read/diff memo still shares one array
- * across all subscribers of a change. Only a table that actually carries a
- * `.readableBy(...)` column pays the per-subject cost (different subjects get
- * different stripped arrays, the same accepted cost `.serverOnly()` already has
- * whenever it strips anything).
+ * With no `.readableBy(...)` metadata every subject resolves the same column
+ * list. The dispatch-local strip memo can then share ordinary stripped rows;
+ * this helper itself neither clones rows nor caches mutable metadata or scopes.
  *
  * An unknown / unregistered table forbids nothing (returns `[]`) rather than
  * throwing — same posture as `serverOnlyColumnNames`.
@@ -5744,7 +5741,7 @@ export declare const frameworkDeviceStrategy: (service: DeviceServiceShape, opts
 }) => AuthStrategy;
 
 /** Define a gauge (set with `setMetric`). */
-export declare const gauge: (name: string, description?: string) => Metric.Metric.Gauge<number>;
+export declare const gauge: (name: string, description?: string) => Metric.Gauge<number>;
 
 /** Generate a fresh token `<prefix><40-char-base64url>`. */
 export declare const generateApiKeyToken: (prefix?: string) => string;
@@ -5855,7 +5852,7 @@ export declare interface HealthConfigInput {
 }
 
 /** Define a histogram. `boundaries` default to the framework duration buckets. */
-export declare const histogramMetric: (name: string, boundaries?: MetricBoundaries.MetricBoundaries, description?: string) => Metric.Metric.Histogram<number>;
+export declare const histogramMetric: (name: string, boundaries?: ReadonlyArray<number>, description?: string) => Metric.Histogram<number>;
 
 /**
  * Full-lineage provenance from versioning history rows (oldest-first input).
@@ -5892,7 +5889,7 @@ export declare interface HttpSecretsOptions {
 
 /**
  * WS-rpc idempotency store + TTL, passed to `bindMutation` as a closure param by
- * the boot path (`serveApi`/`dev`) — NOT a service. @effect/rpc runs a handler in
+ * the boot path (`serveApi`/`dev`) — NOT a service. effect/rpc runs a handler in
  * a NARROWED context (only the middleware `provides` + declared deps), so a plain
  * merged service is invisible to `Effect.serviceOption` inside the handler; the
  * store+ttl are boot-time constants the bind site already holds, so a closure is
@@ -5952,6 +5949,7 @@ export declare class IndexedMatcher implements Matcher {
     private readonly columnByTable;
     private readonly rangeByTable;
     private readonly tupleByTable;
+    private readonly compositeByTable;
     private readonly unindexedByTable;
     private readonly subscriptions;
     register(sub: SubscriptionRecord): void;
@@ -6460,7 +6458,7 @@ export declare interface KvFacade {
      *  the backend `KvStore` (R = never), so both boot paths hand it to handlers
      *  as `Layer.succeed(Kv, service)` — enabling `yield* Kv` in Effect handlers
      *  exactly like `Layer.succeed(Cache, cacheService)` does for the cache. */
-    readonly service: Kv;
+    readonly service: Effect.Success<typeof Kv>;
     /** The resolved backend kind — for boot logging. */
     readonly backend: 'database' | 'redis' | 'memory';
     /** Tear down the managed runtime (closes a pooled redis connection). */
@@ -6514,6 +6512,12 @@ export declare interface LevelReactionDefinition extends ReactionBase {
     readonly guards?: Omit<ReactionGuards, 'dedupeKey'>;
 }
 
+export declare const linearBoundaries: (options: {
+    readonly start: number;
+    readonly width: number;
+    readonly count: number;
+}) => ReadonlyArray<number>;
+
 export declare class LinearScanMatcher implements Matcher {
     private readonly byTable;
     register(sub: SubscriptionRecord): void;
@@ -6721,9 +6725,9 @@ export declare const makeAsyncKv: ({ store, env }: KvFacadeOptions) => Promise<K
  *     (a no-op for a connection that never re-authenticated);
  *  2. run the FULL chain on the result — strategies, session revocation,
  *     `resolveScopes`, the scope cache;
- *  3. record what the strategy verified about the credential's lifetime, so
- *     `ConnectionInfo.credentialExpiresAt` reports the token's own `exp` rather
- *     than a cookie derivation that only ever saw one auth shape.
+ *  3. pass the verified lifetime through call-local Effect context, so parallel
+ *     calls and explicitly unbounded credentials cannot inherit another call's
+ *     expiry. Compose the group's pair with `withRpcAuthMiddleware`.
  *
  * Step 1 is the only thing a re-authenticated connection gets. It changes WHICH
  * credential is presented and nothing about how it is judged.
@@ -6868,7 +6872,7 @@ export declare const makeListConnectionsExecutor: (deps: ConnectionBuiltinDeps)
  * round-trip it — a guard for exotic schemas; for a value the handler actually
  * produced, `encodeUnknownSync` never throws. `undefined` schema → no codec.
  */
-export declare const makeMutationOutputCodec: (outputSchema: Schema.Schema.AnyNoContext | undefined) => MutationOutputCodec<unknown> | undefined;
+export declare const makeMutationOutputCodec: (outputSchema: Schema.Top | undefined) => MutationOutputCodec<unknown> | undefined;
 
 /**
  * Build the shared mutation runner. Used by BOTH the rpc WS handler and
@@ -6958,16 +6962,13 @@ export declare const makeQueryFinalizer: (options: QueryFinalizeOptions) => ((de
  * the socket keeps delivering rows the subject may no longer read until
  * the client happens to disconnect.
  *
- * So every delivery re-runs the same `checkGuardsEffect` the subscribe-time
- * gate ran — including the async resource-scope resolver, which is where a
- * per-row/per-team revocation actually shows up. Returns `null` when the
- * subject still passes, or the typed `ScopeError` that denied it.
- *
- * Returns a closure that always resolves `null` when the descriptor carries
- * no guards AND default-deny is off, so the caller needs no branch and an
- * unguarded query pays only a resolved promise. Under `defaultDeny` an
- * UNDECIDED descriptor resolves the same typed refusal on every delivery —
- * fail closed on the re-check too, not only at subscribe.
+ * Each delivery refreshes the original authentication chain, subject guards,
+ * dynamic role grants, and resource guards before emitting data. Configured
+ * authentication/scope caches retain their documented invalidation windows.
+ * A revoked credential or grant ends the subscription with a typed refusal.
+ * The original principal and tenant remain fixed; changing either requires a
+ * new subscription. Even unguarded descriptors refresh authentication, while
+ * default-deny keeps rejecting descriptors without a declared access policy.
  */
 export declare const makeQueryReauthorizer: (query: MutationLike, input: unknown, defaultDeny?: boolean) => (subject: Subject) => () => Promise<unknown>;
 
@@ -7321,10 +7322,9 @@ export declare const mergeCookieHeader: (existing: string | undefined, patch: Re
  */
 export declare const mergeFleetObservations: <T>(rows: ReadonlyArray<ReplicaObservationRow>, members: ReadonlyArray<FleetMember>, staleAfterMs?: number) => FleetMergeResult<T>;
 
-export { MetricBoundaries }
-
 export declare interface MetricBucketPoint {
-    /** Upper bound (Prometheus `le`); `Infinity` for the catch-all bucket. */
+    /** Upper bound (Prometheus `le`). Effect 4 reports the declared boundaries only;
+     *  the catch-all is the sample's `count` (the Prometheus exporter writes `+Inf` from it). */
     readonly le: number;
     /** Cumulative count ≤ le. */
     readonly count: number;
@@ -7456,6 +7456,10 @@ export declare interface MutationOutputCodec<Output> {
 }
 
 export declare interface MutationRunnerDeps {
+    readonly outcomeOutbox?: (request: ServeRequestContext) => OutboxEnqueueFacade | undefined;
+    /** A failure aborts the business transaction; transient contention replays
+     * executor and hook together. Never perform external I/O here. */
+    readonly beforeMutationCommit?: ServeMutationCommitHook | undefined;
     readonly store: TransactionalStore;
     /** Select and provision the request's physical store before opening its
      * transaction. Resolved once, including across retries and post-commit folds. */
@@ -7478,6 +7482,7 @@ export declare interface MutationRunnerDeps {
     /** Build the per-call `AppContext` bound to the transactional `tx`. */
     readonly buildContext: (request: ServeRequestContext, tx: unknown, lifecycle?: MutationLifecycle) => {
         readonly store: unknown;
+        readonly outbox?: OutboxEnqueueFacade;
     };
     /** Run an Effect-returning executor with the per-request store layer. */
     readonly runEffect: (effect: Effect.Effect<unknown, unknown, never>, store: unknown) => Promise<unknown>;
@@ -7818,12 +7823,10 @@ export declare class OptimisticLockError extends OptimisticLockError_base {
     get message(): string;
 }
 
-declare const OptimisticLockError_base: Schema.TaggedErrorClass<OptimisticLockError, "OptimisticLockError", {
-    readonly _tag: Schema.tag<"OptimisticLockError">;
-} & {
-    table: typeof Schema.String;
-    expected: typeof Schema.Number;
-}>;
+declare const OptimisticLockError_base: Schema.Class<OptimisticLockError, Schema.TaggedStruct<"OptimisticLockError", {
+    readonly table: Schema.String;
+    readonly expected: Schema.Number;
+}>, YieldableError>;
 
 export declare interface OrchestratorTickDeps {
     readonly store: DataStore;
@@ -7893,7 +7896,7 @@ export declare interface OriginGuardConfig {
 export declare type OriginGuardMode = 'off' | 'same-origin';
 
 /**
- * Map an `import('@effect/opentelemetry')` rejection to what the reader needs.
+ * Map an `import('@effect/opentelemetry/NodeSdk')` rejection to what the reader needs.
  *
  * Exported so the branch is testable without uninstalling the package. Only a
  * module-NOT-FOUND becomes the install instruction: anything else is a real
@@ -8009,14 +8012,14 @@ export declare const outboxAttemptsTable: TableLike;
  *  twice because of us or because of them" becomes unanswerable. */
 export declare type OutboxAttemptTrigger = 'automatic' | 'manual';
 
-export declare interface OutboxFacade {
-    /**
-     * Persist the intent to run `effect` after this transaction commits.
-     *
-     * Returns the outbox row id, which doubles as the delivery id a client can
-     * watch to render external-side-effect progress ("saving… syncing… synced").
-     */
-    enqueue(effect: string, payload: Record<string, unknown>, options?: EnqueueOptions): Promise<string>;
+/** Declared-event publication for an outbox attempt, scoped to its queued tenant.
+ * This service provides no request subject or store access. */
+export declare class OutboxEventPublisher extends OutboxEventPublisher_base {
+}
+
+declare const OutboxEventPublisher_base: Context.ServiceClass<OutboxEventPublisher, "@voltro/OutboxEventPublisher", EventPublisher>;
+
+export declare interface OutboxFacade extends OutboxEnqueueFacade {
     /**
      * Re-arm one entry for delivery NOW, on purpose, attributed to the caller.
      *
@@ -8061,25 +8064,9 @@ export declare interface OutboxFacadeDeps {
     readonly now?: () => Date;
 }
 
-export declare interface OutboxHandlerContext {
-    /** Stable identity of this delivery intent, preserved across retries. */
-    readonly outboxId: string;
-    /** Caller-supplied enqueue key, or null. Unlike outboxId this can be reused
-     * for a distinct intent after an earlier intent has been delivered. */
-    readonly idempotencyKey: string | null;
-    readonly payload: Record<string, unknown>;
-    readonly attempt: number;
-    readonly subjectId: string | null;
-    readonly tenantId: string | null;
-    readonly traceId: string | null;
-}
+export { OutboxHandlerContext }
 
-export declare interface OutboxHandlerDefinition<R = never> {
-    readonly effect: string;
-    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
-    /** Give up after this many attempts, then dead-letter. Default 8. */
-    readonly maxAttempts?: number;
-}
+export { OutboxHandlerDefinition }
 
 /** What the pump hands events to — the `emit` of a `Stream.asyncScoped`. */
 export declare interface OutboxSink<T> {
@@ -8155,7 +8142,7 @@ export declare interface PatConnectionDefinition extends ConnectionDefinitionCom
  * validity — but `voltro doctor`'s static `workflows.start` audit calls the same
  * function, so the two cannot disagree about what a payload requires.
  */
-export declare const payloadPropertyNames: (schema: Schema.Schema.Any) => {
+export declare const payloadPropertyNames: (schema: Schema.Top) => {
     readonly required: ReadonlyArray<string>;
     readonly optional: ReadonlyArray<string>;
 };
@@ -8249,11 +8236,7 @@ export declare interface PluginRefRule {
 }
 
 /** The store surface the enforcement needs. */
-export declare interface PluginRefStore {
-    query: (descriptor: unknown) => Promise<ReadonlyArray<Record<string, unknown>>>;
-    update: (table: string, id: string, patch: Record<string, unknown>) => Promise<unknown>;
-    delete: (table: string, id: string) => Promise<unknown>;
-}
+export declare type PluginRefStore = Pick<DataStore, 'updateMany' | 'deleteMany'>;
 
 /** The signature a plugin sees on its bind-ctx. */
 export declare type PluginScheduleCoordinated = (name: string, intervalMs: number, effect: CoordinatedEffect, options?: CoordinatedTaskOptions) => CoordinatedScheduleHandle;
@@ -8443,7 +8426,7 @@ export declare interface PublicDevice {
  * Returns the assigned serial so a caller (and the tests) can observe ordering
  * without reaching into the bus.
  */
-export declare const publishEvent: <Name extends string, Key extends Schema.Schema.Any, Payload extends Schema.Schema.Any>(ctx: EventPublishContext, descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>) => Effect.Effect<{
+export declare const publishEvent: <Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(ctx: EventPublishContext, descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>) => Effect.Effect<{
     readonly n: number;
     readonly deferred: boolean;
 }, EventPublishError>;
@@ -8474,7 +8457,7 @@ export declare interface PumpOptions {
  * computed). The three used to carry the same loop inline; a diagnostic added
  * to one of them would have been absent from the other two.
  *
- * **The stall diagnostic.** `@effect/rpc` delivers a stream as `Chunk`
+ * **The stall diagnostic.** `effect/rpc` delivers a stream as `Chunk`
  * messages and waits for the client's `Ack` of each before writing the next.
  * The typed client acknowledges by itself; a hand-rolled socket client that
  * only listens receives exactly one Chunk per subscription — the snapshot — and
@@ -8703,6 +8686,17 @@ export declare type ReactionOp = 'insert' | 'update' | 'delete';
 
 export declare type ReactionOutcome = 'acted' | 'skipped-op' | 'skipped-when' | 'skipped-dedupe' | 'skipped-ratelimit' | 'skipped-budget';
 
+/**
+ * The DURABLE rate key for one firing: reaction, partition, and time bucket.
+ *
+ * A fixed window keeps one durable bucket cursor and unique slot claims,
+ * rather than retaining every event timestamp. The transaction-owned cursor
+ * avoids probing every previously occupied slot; the UNIQUE remains the final
+ * arbiter. JSON encoding preserves arbitrary names/partitions without NUL in
+ * SQL text. Up to 2× the limit may fire across a bucket boundary.
+ */
+export declare const reactionRateBucketKey: (reactionName: string, partition: string, windowMs: number, now: number) => string;
+
 /**
  * A per-key sliding-window rate limiter — IN-MEMORY, PER PROCESS.
  *
@@ -8712,10 +8706,11 @@ export declare type ReactionOutcome = 'acted' | 'skipped-op' | 'skipped-when' |
  * the runner logs once when it falls back, because "my limit is 3× what I
  * declared" is not something anyone discovers by reading config.
  *
- * Prefer {@link ReactionRunDeps.claimRateSlot}.
+ * Prefer {@link ReactionRunDeps.claimRate}.
  */
 export declare class ReactionRateLimiter {
     private readonly hits;
+    private sweep;
     allow(key: string, limit: number, windowMs: number, now: number): boolean;
 }
 
@@ -8746,13 +8741,13 @@ export declare interface ReactionRunDeps {
      *  requireAiBudget). Only consulted when `guards.costBudgetUsd` is set. */
     readonly checkBudget?: (tenantId: string | null, budgetUsd: number) => boolean | Promise<boolean>;
     /**
-     * Atomically claim ONE rate slot. `true` = we got it and may fire.
+     * Atomically reserve ONE slot in a rate bucket. `true` = we may fire.
      *
      * Injected by the serve layer over the shared store, so the cap holds across
      * replicas. Absent → the runner falls back to {@link ReactionRateLimiter},
      * which is per-process and therefore N× on N replicas.
      */
-    readonly claimRateSlot?: (key: string) => Promise<boolean>;
+    readonly claimRate?: (key: string, limit: number, expiresAt: Date) => Promise<boolean>;
     readonly rateLimiter?: ReactionRateLimiter;
     readonly now?: () => number;
 }
@@ -8799,7 +8794,7 @@ export declare interface ReactiveConfigInput {
         readonly oversizedEventBytes?: number;
         /** How long a delivery may sit unaccepted by the transport before the
          *  server says so — a WARN naming the subscription and the missing
-         *  `@effect/rpc` `Ack`, plus `voltro_subscription_stalled_total`.
+         *  `effect/rpc` `Ack`, plus `voltro_subscription_stalled_total`.
          *  Default 5_000 ms. */
         readonly stallWarnAfterMs?: number;
     };
@@ -9314,13 +9309,13 @@ export declare interface RegistryTableLike {
      * registry indexes this so the MutationStore can look it up in
      * O(1) per write without touching the original Table object.
      */
-    readonly insertSchema?: Schema.Schema.Any;
+    readonly insertSchema?: Schema.Top;
     /**
      * Optional `effect/Schema` the framework decodes a patch against
      * BEFORE every UPDATE. Set via `table().validatePatch(schema)`
      * (already `Schema.partial`-wrapped by the table builder).
      */
-    readonly validatePatchSchema?: Schema.Schema.Any;
+    readonly validatePatchSchema?: Schema.Top;
 }
 
 /** Rebuild checkable guards from the row. The stored resource id becomes a
@@ -9537,22 +9532,22 @@ export declare interface ReplicatedDataStoreOptions {
 }
 
 declare const Request_2: Schema.Struct<{
-    id: Schema.filter<Schema.filter<typeof Schema.String>>;
-    name: Schema.filter<Schema.filter<typeof Schema.String>>;
-    from: typeof Schema.DateFromSelf;
-    to: typeof Schema.DateFromSelf;
-    occurrences: Schema.Array$<Schema.filter<typeof Schema.Number>>;
-    status: Schema.Literal<["queued", "running", "completed", "interrupted"]>;
-    owner: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.String>>>;
-    createdAt: typeof Schema.DateFromSelf;
-    updatedAt: typeof Schema.DateFromSelf;
-    cursor: Schema.filter<Schema.filter<typeof Schema.Number>>;
-    activeIndex: Schema.NullOr<Schema.filter<Schema.filter<typeof Schema.Number>>>;
-    results: Schema.Array$<Schema.Struct<{
-        runId: Schema.filter<Schema.filter<typeof Schema.String>>;
-        status: Schema.Literal<["succeeded", "failed", "skipped", "missed"]>;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly from: Schema.Date;
+    readonly to: Schema.Date;
+    readonly occurrences: Schema.$Array<Schema.Number>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "completed", "interrupted"]>;
+    readonly owner: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+    readonly cursor: Schema.Number;
+    readonly activeIndex: Schema.NullOr<Schema.Number>;
+    readonly results: Schema.$Array<Schema.Struct<{
+        readonly runId: Schema.String;
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "skipped", "missed"]>;
     }>>;
-    error: Schema.NullOr<typeof Schema.String>;
+    readonly error: Schema.NullOr<Schema.String>;
 }>;
 
 export declare interface ResendOptions {
@@ -9708,7 +9703,9 @@ export declare interface ResolvedDevice {
  * Walk a query descriptor's eager-load tree and return the FULL set
  * of tables whose changes could affect the resolved snapshot.
  *
- * - For a query without `eager`, returns just `{ descriptor.table }`.
+ * - Includes explicitly declared invalidation sources (`dependentTables`),
+ *   independently of SQL predicates and projections.
+ * - A plain query with no additional sources returns `{ descriptor.table }`.
  * - For each one()/many() relation, adds the target table.
  * - For each manyToMany() relation, adds the through-table AND the
  *   target table (writes to either can shift the resolved set).
@@ -10094,13 +10091,6 @@ export declare interface RevalidationMessage {
 
 export declare type RevalidationPublisher = (message: RevalidationMessage) => Promise<void>;
 
-/**
- * Reverse ONE recorded event over an in-memory row-set (to step BACK across it):
- *   - insert → the row was added, so remove it (by new.id).
- *   - update → restore the row to its `old` image (by id).
- *   - delete → the row was removed, so add `old` back.
- * Pure. Applied newest-first to walk from "now" to a past point.
- */
 export declare const reverseEventOverRows: (rows: ReadonlyArray<Row_2>, e: TimelineEvent) => ReadonlyArray<Row_2>;
 
 /** The ids that were visible before but are not now — what a live-revocation
@@ -10268,16 +10258,15 @@ export declare interface RowFilter<Ctx = unknown> {
  * the fix, rather than degrading to an unfiltered or empty answer.
  */
 export declare class RowFilterDeclarationViolated extends RowFilterDeclarationViolated_base {
+    get message(): string;
 }
 
-declare const RowFilterDeclarationViolated_base: Schema.TaggedErrorClass<RowFilterDeclarationViolated, "RowFilterDeclarationViolated", {
-    readonly _tag: Schema.tag<"RowFilterDeclarationViolated">;
-} & {
+declare const RowFilterDeclarationViolated_base: Schema.Class<RowFilterDeclarationViolated, Schema.TaggedStruct<"RowFilterDeclarationViolated", {
     /** The table the predicate narrowed. */
-    table: typeof Schema.String;
+    readonly table: Schema.String;
     /** The declared set, for the message. */
-    declared: Schema.Array$<typeof Schema.String>;
-}>;
+    readonly declared: Schema.$Array<Schema.String>;
+}>, YieldableError>;
 
 /**
  * Could the registered filter narrow ANY of `tables`?
@@ -10325,12 +10314,10 @@ export declare type RowFilterScope = (table: string) => Predicate | undefined;
 export declare class RowFilterUnavailable extends RowFilterUnavailable_base {
 }
 
-declare const RowFilterUnavailable_base: Schema.TaggedErrorClass<RowFilterUnavailable, "RowFilterUnavailable", {
-    readonly _tag: Schema.tag<"RowFilterUnavailable">;
-} & {
+declare const RowFilterUnavailable_base: Schema.Class<RowFilterUnavailable, Schema.TaggedStruct<"RowFilterUnavailable", {
     /** `String(originalError)` — the last failure after retries were exhausted. */
-    cause: typeof Schema.String;
-}>;
+    readonly cause: Schema.String;
+}>, YieldableError>;
 
 /** One `_voltro_row_history` row, structurally (from @voltro/plugin-row-history). */
 export declare interface RowHistoryEntry {
@@ -10365,7 +10352,7 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly handlersLayer: Layer.Layer<Rpc.ToHandler<Rpcs>>;
     /** Optional handlers layer dedicated to the one-shot HTTP rpc surface
      *  (`POST /rpc`, used by SSR web-router loaders). The HTTP JSON protocol
-     *  BUFFERS the whole response (the @effect/rpc client `await`s `r.json()`),
+     *  BUFFERS the whole response (the effect/rpc client `await`s `r.json()`),
      *  so a reactive query's never-ending stream would hang the request. The
      *  caller supplies a variant here whose query handlers complete after the
      *  FIRST snapshot (`Stream.take(1)`); the WS `handlersLayer` keeps the live
@@ -10608,11 +10595,11 @@ export declare const runOrchestratorTick: (deps: OrchestratorTickDeps) => Promis
 
 /**
  * Run a fully-provided handler Effect to a Promise, REJECTING WITH THE RAW
- * typed failure value — NOT Effect's opaque `FiberFailure` wrapper.
+ * typed failure value — the value itself, never a runtime envelope.
  *
  * Why this exists: the rpc encoder matches a rejected handler's thrown value
- * against the descriptor's `error:` schema. `Effect.runPromise` rejects with a
- * `FiberFailure` that wraps the cause, so a typed `Effect.fail(MyTaggedError)`
+ * against the descriptor's `error:` schema. a runtime that rejected with
+ * an envelope around the cause made a typed `Effect.fail(MyTaggedError)`
  * from an Effect-form mutation/action NEVER matches the schema and dumps on the
  * wire as a `Die`/`ExitEncoded` defect instead of the declared tagged error
  * (the async-handler path already throws the raw value, so it worked there —
@@ -10645,7 +10632,7 @@ export declare interface RuntimeContext {
     readonly subject: Subject;
     /** Trace identifier — the active span's W3C trace id (32 hex) when
      *  tracing is active; a per-call uuid otherwise. Shared across the
-     *  whole frontend→api→api chain via `@effect/rpc` + `traceparent`. */
+     *  whole frontend→api→api chain via `effect/rpc` + `traceparent`. */
     readonly traceId: string;
     /** The active span's id (16 hex), when tracing is active. Used to
      *  build the outbound `traceparent` header for cross-api hops. */
@@ -11011,7 +10998,7 @@ export declare interface SchedulerDeps {
     readonly onRunEvent?: (op: 'insert' | 'update', row: Record<string, unknown>) => void;
     /** When `false`, the engine registers schedules (so `fireNow` +
      *  `fireFromCluster` work) but does NOT arm in-app timers. Used by
-     *  `cluster` coordination, where `@effect/cluster`'s `ClusterCron`
+     *  `cluster` coordination, where `effect/cluster`'s `ClusterCron`
      *  drives the clock + guarantees once-only — the in-app timer would
      *  double-fire. Default `true`. */
     readonly armSelf?: boolean;
@@ -11087,7 +11074,7 @@ export declare interface SchedulerHandle {
     /** One run's terminal-or-not state, for a caller polling an accepted trigger
      *  to completion. `undefined` when no such run exists. */
     runStatus(runId: string): Promise<ScheduleRunStatus | undefined>;
-    /** Fire from a cluster-cron tick. `@effect/cluster` has already
+    /** Fire from a cluster-cron tick. `effect/cluster` has already
      *  guaranteed exactly-once across the fleet (this runner owns the
      *  shard), so we bypass the in-app coordinator + record the run
      *  with `coordinationOutcome: 'cluster'`. Overlap policy still
@@ -11232,9 +11219,9 @@ export declare interface SchemaInfo {
         readonly fields: ReadonlyArray<string>;
     }>;
     /** Optional pre-INSERT row decoder (from `table().validate(...)`). */
-    readonly insertSchema?: Schema.Schema.Any;
+    readonly insertSchema?: Schema.Top;
     /** Optional pre-UPDATE partial-patch decoder (from `table().validatePatch(...)`). */
-    readonly validatePatchSchema?: Schema.Schema.Any;
+    readonly validatePatchSchema?: Schema.Top;
     /**
      * Resolved id-scheme for the table's primary-key column. `undefined`
      * for tables that have no `id`-typed column — a natural or composite
@@ -11262,7 +11249,7 @@ export declare interface SchemaInfo {
  * the common composition nodes so a column nested under `{ refs: [{ … }] }` or
  * behind a `NullOr` is still seen. Cycle-guarded via a seen-set on Suspend.
  */
-export declare const schemaPropertyNames: (schema: Schema.Schema.Any) => ReadonlySet<string>;
+export declare const schemaPropertyNames: (schema: Schema.Top) => ReadonlySet<string>;
 
 export declare interface SchemaRegistry {
     readonly tables: ReadonlyMap<string, SchemaInfo>;
@@ -11341,7 +11328,7 @@ export declare interface SchemaRegistry {
      * INSERT — a decode failure becomes a `TableValidationFailed`
      * typed error on the mutation's error channel.
      */
-    insertSchema(table: string): Schema.Schema.Any | undefined;
+    insertSchema(table: string): Schema.Top | undefined;
     /**
      * Optional pre-UPDATE partial-patch decoder for a table. `undefined`
      * when the table didn't ship `.validatePatch(schema)`. The
@@ -11349,7 +11336,7 @@ export declare interface SchemaRegistry {
      * the underlying UPDATE — a decode failure becomes a
      * `TableValidationFailed` typed error on the mutation's error channel.
      */
-    validatePatchSchema(table: string): Schema.Schema.Any | undefined;
+    validatePatchSchema(table: string): Schema.Top | undefined;
 }
 
 declare interface ScopeCtx {
@@ -11509,6 +11496,16 @@ export declare type SerializedGuard = {
  */
 export declare const serializeGuards: (guards: ReadonlyArray<AnyGuardSpec>, input: unknown) => ReadonlyArray<SerializedGuard>;
 
+/** Required plugin work executed on the actual transaction connection. */
+export declare type ServeMutationCommitHook = (context: Parameters<ServeRpcInterceptor>[1] & {
+    readonly kind: 'mutation';
+    readonly store: DataStore;
+    readonly output: unknown;
+    readonly outbox?: OutboxEnqueueFacade;
+    readonly startedAt?: number;
+    readonly durationMs?: number;
+}) => Effect.Effect<void, unknown>;
+
 export declare interface ServeRequestContext {
     readonly subject: unknown;
     readonly traceId: string;
@@ -11572,6 +11569,7 @@ export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown,
     readonly input: unknown;
     readonly subject: unknown;
     readonly traceId: string;
+    readonly enqueueOutcome?: OutboxEnqueueFacade['enqueue'];
     readonly spanId?: string;
     /**
      * The declared write-target TABLE names of this mutation/action, derived
@@ -13339,6 +13337,14 @@ export declare type WhereOp = '=' | '!=' | '<>' | '>' | '>=' | '<' | '<=' | 'in'
 
 export declare const withRowFilter: <R extends ServeRequestContext>(request: R) => Promise<R>;
 
+/**
+ * Add the shared RPC auth pair once to an undecorated group. Authentication
+ * runs before ConnectionInfo captures this call's verified credential lifetime.
+ * Groups already carrying either middleware are refused: Effect preserves Set
+ * insertion order, so appending a duplicate cannot repair an existing order.
+ */
+export declare const withRpcAuthMiddleware: <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) => RpcGroup.RpcGroup<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof ConnectionInfoMiddleware>, typeof AuthMiddleware>>;
+
 /**
  * Run `body` against a request that carries a resolved row-filter scope.
  *
@@ -13441,9 +13447,9 @@ export declare interface WorkflowControlTarget extends WorkflowControlOptions {
 
 export declare interface WorkflowDefinitionLike {
     readonly name: string;
-    readonly payloadSchema: Schema.Schema.Any;
-    readonly successSchema: Schema.Schema.Any;
-    readonly errorSchema: Schema.Schema.All;
+    readonly payloadSchema: Schema.Top;
+    readonly successSchema: Schema.Top;
+    readonly errorSchema: Schema.Top;
     execute(payload: never, options?: {
         readonly discard?: boolean;
     }): Effect.Effect<unknown, unknown, unknown>;
@@ -13509,6 +13515,15 @@ export declare interface WorkflowEventTriggerResult {
     readonly reason?: string;
 }
 
+export declare interface WorkflowExecutionRefusal {
+    readonly workflowName: string;
+    readonly executionId: string;
+    readonly payload: unknown;
+    readonly cause: Cause.Cause<unknown>;
+    /** Restored identity and host-owned placement; no resolved permissions. */
+    readonly callerContext: WorkflowCallerContext;
+}
+
 export declare interface WorkflowFacadeOptions {
     readonly cancelQueued?: (input: WorkflowQueuedControlTarget & {
         readonly callerContext: WorkflowCallerContext | undefined;
@@ -13650,13 +13665,18 @@ export declare interface WorkflowLayerOptions<Context> {
      * whose business logic said no.
      */
     readonly resolveAuthority?: (identity: unknown) => Promise<unknown>;
+    /** Record a known caller's refusal through the host's ordinary resident run
+     * recorder. Called before application context/body construction. The failed
+     * attempt stays failed, even if this hook completes successfully. Missing
+     * caller identity cannot fabricate a tenant or a first-run record. */
+    readonly onExecutionRefusal?: (refusal: WorkflowExecutionRefusal) => Effect.Effect<unknown, unknown, unknown>;
     /**
      * Told when an execution is refused BEFORE its body — the start context
      * could not be resolved, the identity was missing, the authority or row
      * filter resolver rejected. The engine already fails the attempt; what a
-     * discarded start does NOT do is tell anyone, and a run refused here has no
-     * row yet, so nothing else can. Measured: an acknowledged start whose
-     * resident context was filed under another id died with a debug-level
+     * discarded start does NOT do is tell anyone. A first start may have no
+     * row yet; a resumed run may still have a running row. Measured: an
+     * acknowledged start whose resident context was filed under another id died with a debug-level
      * "Fiber terminated" and nothing else. Hosts wire this to an error log.
      */
     readonly reportExecutionRefusal?: (refusal: {
@@ -13968,15 +13988,13 @@ export declare interface WorkflowStartLike {
 export declare class WorkflowStartNotExecuted extends WorkflowStartNotExecuted_base {
 }
 
-declare const WorkflowStartNotExecuted_base: Schema.TaggedErrorClass<WorkflowStartNotExecuted, "WorkflowStartNotExecuted", {
-    readonly _tag: Schema.tag<"WorkflowStartNotExecuted">;
-} & {
-    workflowName: typeof Schema.String;
-    handleId: typeof Schema.String;
-    reason: Schema.Literal<["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
-    failureId: Schema.NullOr<typeof Schema.String>;
-    incumbentExecutionId: Schema.NullOr<typeof Schema.String>;
-}>;
+declare const WorkflowStartNotExecuted_base: Schema.Class<WorkflowStartNotExecuted, Schema.TaggedStruct<"WorkflowStartNotExecuted", {
+    readonly workflowName: Schema.String;
+    readonly handleId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["dropped", "skipped", "superseded", "cancelled", "abandoned", "rejected"]>;
+    readonly failureId: Schema.NullOr<Schema.String>;
+    readonly incumbentExecutionId: Schema.NullOr<Schema.String>;
+}>, Cause.YieldableError>;
 
 /**
  * What a start handle has become, read once and without waiting.
@@ -14037,6 +14055,7 @@ export declare interface WorkflowStartOptions {
 }
 
 export declare interface WorkflowStartRunnerDeps {
+    readonly outcomeOutbox?: MutationRunnerDeps['outcomeOutbox'];
     /** Composed plugin workflow-interceptor (`interceptWorkflow`). */
     readonly interceptor?: ServeRpcInterceptor;
     readonly recordMetric?: MutationRunnerDeps['recordMetric'];