@voltro/runtime 0.85.0 → 0.87.0

package/dist/index.d.ts

@@ -1,11 +1,31 @@
+import { AggregateQuery } from '@voltro/kv/analytics';
+import { AnalyticsBucket } from '@voltro/kv/analytics';
+import { AnalyticsCapabilityNotSupported } from '@voltro/kv/analytics';
+import { AnalyticsError } from '@voltro/kv/analytics';
+import { AnalyticsEvent } from '@voltro/kv/analytics';
+import { AnalyticsFailure } from '@voltro/kv/analytics';
+import { AnalyticsMetric } from '@voltro/kv/analytics';
+import { AnalyticsMirrorImpl } from '@voltro/kv/analytics';
+import { AnalyticsMirrorRemove } from '@voltro/kv/analytics';
+import { AnalyticsMirrorUpsert } from '@voltro/kv/analytics';
+import { AnalyticsSinkImpl } from '@voltro/kv/analytics';
+import { AnalyticsSinkInfo } from '@voltro/kv/analytics';
+import { AnalyticsTopEntry } from '@voltro/kv/analytics';
 import { AnyApprovalPolicy } from '@voltro/protocol';
 import { AnyCheckSpec } from '@voltro/protocol';
 import { AnyGuardSpec } from '@voltro/protocol';
+import { ApiRoleWindowAssessment } from '@voltro/protocol';
+import { ApiWorkload } from '@voltro/protocol';
 import { AuthMiddleware } from '@voltro/protocol';
 import { AuthStrategy } from '@voltro/protocol';
+import { canonicalJson } from '@voltro/protocol';
 import { CaughtUpVerdict } from '@voltro/database';
 import { Cause } from 'effect';
 import { ChangeEvent } from '@voltro/database';
+import { CircuitBreaker } from '@voltro/shared';
+import { CircuitBreakerOptions } from '@voltro/shared';
+import { CircuitOpen } from '@voltro/shared';
+import { CircuitState } from '@voltro/shared';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
 import { ColumnBuilder } from '@voltro/database';
@@ -28,8 +48,9 @@ import { DeclaredAccess } from '@voltro/protocol';
 import { DialectId } from '@voltro/database';
 import { DialectReplicationAdapter } from '@voltro/database';
 import { Duplex } from 'node:stream';
-import { Duration } from 'effect';
 import { Effect } from 'effect';
+import { EnqueueOptions } from '@voltro/protocol';
+import { EventClientPolicy } from '@voltro/protocol';
 import { EventDeliverySemantics } from '@voltro/protocol';
 import { EventDescriptor } from '@voltro/protocol';
 import { EventKeyInvalid } from '@voltro/protocol';
@@ -54,6 +75,7 @@ import { InferRow } from '@voltro/database';
 import { InMemoryMetricExporter } from '@opentelemetry/sdk-metrics';
 import { InMemorySpanExporter } from '@opentelemetry/sdk-trace-base';
 import { InsertIgnoreResult } from '@voltro/database';
+import { InsertManyOptions } from '@voltro/database';
 import { InspectedStep } from '@voltro/workflow';
 import { InspectedWorkflow } from '@voltro/workflow';
 import { InspectStore } from '@voltro/workflow';
@@ -61,6 +83,7 @@ import { inspectWorkflow } from '@voltro/workflow';
 import { isForeignKeyViolation } from '@voltro/database';
 import { isQueryTimeout } from '@voltro/database';
 import { Kv } from '@voltro/kv';
+import { KvError } from '@voltro/kv';
 import { KvStoreShape } from '@voltro/kv';
 import { Layer } from 'effect';
 import { listRetentionConflicts } from '@voltro/database';
@@ -68,21 +91,31 @@ import { listRetentions } from '@voltro/database';
 import { Membership } from '@voltro/protocol';
 import { Metric } from 'effect';
 import { MetricReader } from '@opentelemetry/sdk-metrics';
+import { MirrorVersion } from '@voltro/kv/analytics';
 import { MutationIdempotencyScope } from '@voltro/protocol';
+import { newTraceId } from '@voltro/shared';
 import { NoRowFound } from '@voltro/protocol';
 import { NoSuchResource } from '@voltro/protocol';
+import { Option } from 'effect';
+import { OutboxEnqueueFacade } from '@voltro/protocol';
+import { OutboxHandlerContext } from '@voltro/protocol';
+import { OutboxHandlerDefinition } from '@voltro/protocol';
 import { PendingApproval } from '@voltro/protocol';
 import { PluginHttpRoute } from '@voltro/protocol';
 import { PluginHttpRouteByteStream } from '@voltro/protocol';
 import { PluginRefOrphanPolicy } from '@voltro/database';
 import { Predicate } from '@voltro/database';
 import { ProcedureWireError } from '@voltro/protocol';
+import { PropertyFilter } from '@voltro/kv/analytics';
 import { PublicApiSpec } from '@voltro/protocol';
 import { Query } from '@voltro/database';
 import { QueryDescriptor } from '@voltro/database';
-import { Redis } from 'ioredis';
+import { RedisPubSub } from '@voltro/kv/connection';
 import { registerRetention } from '@voltro/database';
+import { RequestedTenantRefused } from '@voltro/protocol';
 import { ResourceMissing } from '@voltro/protocol';
+import { RespClient } from '@voltro/kv/connection';
+import { RespConnections } from '@voltro/kv/connection';
 import { RestRouteDescriptor } from '@voltro/protocol/rest';
 import { RetentionConflict } from '@voltro/database';
 import { RetentionSource } from '@voltro/database';
@@ -94,6 +127,7 @@ import { RowPatch } from '@voltro/protocol';
 import { Rpc } from 'effect/rpc';
 import { RpcGroup } from 'effect/rpc';
 import { RpcInterceptor } from '@voltro/protocol';
+import { RpcReplayAuthorityBinding } from '@voltro/protocol';
 import { RuleReadStore } from '@voltro/database';
 import { Sampler } from '@opentelemetry/sdk-trace-base';
 import { Schedule } from 'effect';
@@ -105,6 +139,9 @@ import { ServerResponse } from 'node:http';
 import { SpanProcessor } from '@opentelemetry/sdk-trace-base';
 import { spawn } from 'node:child_process';
 import { SqlClient } from 'effect/sql';
+import { SqlError } from 'effect/sql/SqlError';
+import { SsrfPolicy } from '@voltro/protocol';
+import { ssrfReason } from '@voltro/protocol';
 import { StoredTableShape } from '@voltro/database';
 import { StoreError } from '@voltro/protocol';
 import { StoreOperationFailed } from '@voltro/protocol';
@@ -125,6 +162,10 @@ import { TenantRowNotFound } from '@voltro/protocol';
 import { TenantScopeViolation } from '@voltro/protocol';
 import { tenantSelectionId } from '@voltro/database';
 import { TenantSelectionStore } from '@voltro/protocol';
+import { TimeBucket } from '@voltro/kv/analytics';
+import { TimeRange } from '@voltro/kv/analytics';
+import { TimeseriesQuery } from '@voltro/kv/analytics';
+import { TopNQuery } from '@voltro/kv/analytics';
 import { Tracer } from 'effect';
 import { Unauthenticated } from '@voltro/protocol';
 import { UpsertOptions } from '@voltro/database';
@@ -167,6 +208,9 @@ declare const AccessDenied_base: Schema.Class<AccessDenied, Schema.TaggedStruct<
 export declare const actingUserId: (subject: StoreMiddlewareContext["subject"]) => string | null;
 
 export declare interface ActionRunnerDeps {
+    /** Measures only the synchronous executor entry, never an awaited result. */
+    readonly measureSync?: <A>(run: () => A) => A;
+    readonly outcomeOutbox?: MutationRunnerDeps['outcomeOutbox'];
     /** Build the per-call `AppContext` — NO transactional tx (actions do
      *  external I/O and run outside a txn deliberately). */
     readonly buildContext: (request: ServeRequestContext) => {
@@ -177,8 +221,23 @@ export declare interface ActionRunnerDeps {
     readonly recordMetric?: MutationRunnerDeps['recordMetric'];
     /** See {@link MutationRunnerDeps.defaultDeny} — same flag, same refusal. */
     readonly defaultDeny?: boolean;
+    /** See {@link MutationRunnerDeps.settleCacheInvalidations} — an action's
+     *  writes are the writer's too. */
+    readonly settleCacheInvalidations?: () => Promise<void>;
 }
 
+/**
+ * Make a key active NOW, without waiting for every live process to hold it —
+ * for a key replacing a leaked one, where waiting is the larger risk. The
+ * processes that lack it are returned: they cannot read what is sealed under
+ * it until they are redeployed with it, and each says so on its heartbeat.
+ */
+export declare const activateFieldKeyNow: (store: DataStore, keyId: string, holder?: Pick<FieldKeyHolder, "now">) => Promise<{
+    readonly from: string | undefined;
+    readonly to: string;
+    readonly lacking: ReadonlyArray<string>;
+}>;
+
 /**
  * Live activity counters the runtime exposes to the idle detector. All
  * return the CURRENT count (0 = quiescent on that axis).
@@ -449,20 +508,7 @@ declare const AggregateNotFound_base: Schema.Class<AggregateNotFound, Schema.Tag
     readonly name: Schema.String;
 }>, YieldableError>;
 
-export declare interface AggregateQuery {
-    readonly event: string;
-    readonly filter?: PropertyFilter;
-    readonly metric: AnalyticsMetric;
-    readonly range: TimeRange;
-    /**
-     * Restrict the read to one tenant's events. `useAnalytics()` injects the
-     * caller's `subject.tenantId` automatically, so handler code never sets
-     * this; a sink that honours it (e.g. analytics-postgres) then AND-filters
-     * by tenant so a query can't read across tenants. `null`/absent = unscoped
-     * (system/cross-tenant read).
-     */
-    readonly tenantId?: string | null;
-}
+export { AggregateQuery }
 
 export declare interface AggregateReadOptions {
     /**
@@ -471,11 +517,14 @@ export declare interface AggregateReadOptions {
      * Without it an aggregate can only ever be "the one global roll-up", so every
      * tenant-/team-/year-scoped roll-up (most real ones) has to stay client-side.
      * A row matches when EVERY entry matches: a scalar compares by strict
-     * equality, an array means "one of" (an IN set).
+     * equality, an array means "one of" (an IN set), and an object of `gte` /
+     * `gt` / `lte` / `lt` is a range on that column (a `Date` bound compares
+     * with `Date` and ISO-string values by instant; `null` never matches).
      *
      * ```ts
      * yield* handle.read({ where: { teamId, year: 2026 } })
      * yield* handle.read({ where: { status: ['open', 'blocked'] } })
+     * yield* handle.read({ where: { teamId, day: { gte: from, lte: to } } })
      * ```
      *
      * Deliberately DATA, not a predicate function: it stays serializable, so the
@@ -500,15 +549,9 @@ export declare interface AggregateReadOptions {
  *   - Interval string (`'5m'`, `'1h'`, `'24h'`): the canonical
  *     simple case.
  *   - Cron expression `{ cron: '0 2 * * *', timezone: 'UTC' }`: for
- *     business-hours / off-peak refresh windows. **Defer to v2** —
- *     emitted from the spec but not yet honoured by the runner.
+ *     business-hours / off-peak refresh windows, in the specified timezone.
  *   - On-change debounced `{ interval: '1h', onChange: ['matches'],
- *     debounceMs: 30_000 }`: near-realtime, source-table-driven. **Defer
- *     to v2** — same status.
- *
- * v1 supports interval only. The other shapes are accepted so consumers
- * can declare them today + see them honoured when v2 lands without
- * touching the spec.
+ *     debounceMs: 30_000 }`: near-realtime, source-table-driven.
  */
 export declare type AggregateRefreshPolicy = string | {
     readonly interval?: string;
@@ -557,71 +600,17 @@ declare const AggregateStale_base: Schema.Class<AggregateStale, Schema.TaggedStr
     readonly maxAgeMs: Schema.Number;
 }>, YieldableError>;
 
-export declare interface AnalyticsBucket {
-    readonly bucketStart: Date;
-    readonly value: number;
-}
+export { AnalyticsBucket }
 
-/**
- * The sink doesn't implement this capability. PostHog returns this
- * for `aggregate`/`timeseries`/`topN`. Callers typically
- * `Effect.catchTag('AnalyticsCapabilityNotSupported', ...)` to fall
- * back to a different sink or report the missing feature.
- */
-export declare class AnalyticsCapabilityNotSupported extends AnalyticsCapabilityNotSupported_base {
-}
-
-declare const AnalyticsCapabilityNotSupported_base: Schema.Class<AnalyticsCapabilityNotSupported, Schema.TaggedStruct<"AnalyticsCapabilityNotSupported", {
-    readonly provider: Schema.String;
-    readonly capability: Schema.String;
-}>, YieldableError>;
-
-/**
- * The underlying sink raised an error. `cause` is stringified for
- * round-trip safety across the rpc boundary.
- */
-export declare class AnalyticsError extends AnalyticsError_base {
-}
+export { AnalyticsCapabilityNotSupported }
 
-declare const AnalyticsError_base: Schema.Class<AnalyticsError, Schema.TaggedStruct<"AnalyticsError", {
-    readonly provider: Schema.String;
-    readonly operation: Schema.String;
-    readonly cause: Schema.String;
-}>, YieldableError>;
+export { AnalyticsError }
 
-/**
- * One analytics event. `properties` must be JSON-serialisable —
- * individual sinks validate at write time (Postgres stores as JSONB;
- * ClickHouse encodes as a JSON string; PostHog forwards verbatim).
- */
-export declare interface AnalyticsEvent {
-    /** Event name (e.g. `'match_completed'`, `'page_viewed'`). */
-    readonly name: string;
-    /** Subject id (typically `ctx.request.subject.id`) — anonymous when null. */
-    readonly subjectId?: string | null;
-    /**
-     * Owning tenant. Normally you DON'T set this by hand — `useAnalytics()`
-     * stamps it from the caller's `subject.tenantId` so every event is
-     * tenant-attributable + every read is tenant-scoped (the multi-tenant
-     * isolation default). Set it explicitly only for a cross-tenant system
-     * write. `null` = no tenant (system/anonymous).
-     */
-    readonly tenantId?: string | null;
-    /** Property bag. Values must be JSON-serialisable. */
-    readonly properties: Readonly<Record<string, unknown>>;
-    /** When the event occurred. Defaults to server-now when omitted. */
-    readonly occurredAt?: Date;
-}
+export { AnalyticsEvent }
 
-export declare type AnalyticsFailure = AnalyticsError | AnalyticsCapabilityNotSupported;
+export { AnalyticsFailure }
 
-/** Metric to compute. `count` = row count, `unique` = distinct subjectId,
- *  `sum` / `avg` = numeric aggregation on a property field. */
-export declare type AnalyticsMetric = 'count' | 'unique' | {
-    readonly sum: string;
-} | {
-    readonly avg: string;
-};
+export { AnalyticsMetric }
 
 export declare interface AnalyticsMirrorHandle {
     /** Tables actually being mirrored (the sink's `mirror.tables`). Empty
@@ -643,68 +632,9 @@ export declare interface AnalyticsMirrorHandle {
     readonly stats: () => AnalyticsMirrorStats;
 }
 
-/**
- * Optional CDC-mirror capability. A sink that declares `mirror` opts in
- * to receiving the main DataStore's reactive-table changes, so
- * analytical queries can JOIN warehouse events against live user data
- * (`SELECT … FROM voltro_events e JOIN users u ON …`).
- *
- * The framework subscribes to `DataStore.onChange` once at boot, filters
- * to the tables the sink lists in `tables`, and routes each change here.
- * Inserts/updates `upsert` by primary key; deletes `remove`. Every call
- * MUST be idempotent — the same change may be re-delivered after a
- * reconnect, and the upsert is keyed on `primaryKey` so re-applying a
- * row is a no-op-equivalent overwrite.
- *
- * Idempotent is not enough on its own: re-delivery can also arrive OUT
- * OF ORDER, so both methods additionally receive a {@link MirrorVersion}
- * and MUST ignore a write whose version is not greater than the version
- * already stored for that key (ClickHouse gets this from
- * `ReplacingMergeTree(version)`; DuckDB from an `ON CONFLICT … WHERE
- * excluded.version > version` guard).
- */
-export declare interface AnalyticsMirrorImpl {
-    /** Reactive tables this sink mirrors. The framework only forwards
-     *  changes whose `table` is in this set. */
-    readonly tables: ReadonlyArray<string>;
-    /** Primary-key column the sink upserts/deletes by. Defaults to `'id'`
-     *  when omitted. */
-    readonly primaryKey?: string;
-    /** Apply an insert/update. Idempotent upsert keyed on `primaryKey`,
-     *  version-guarded by `write.version`. */
-    readonly upsert: (write: AnalyticsMirrorUpsert) => Effect.Effect<void, AnalyticsFailure>;
-    /** Apply a delete. Idempotent — removing an absent key is a no-op —
-     *  and version-guarded by `write.version`. */
-    readonly remove: (write: AnalyticsMirrorRemove) => Effect.Effect<void, AnalyticsFailure>;
-    /**
-     * The highest version this sink has PERSISTED for one key — `null` when
-     * the key has never been written (a tombstoned key still reports its
-     * tombstone's version; both warehouse sinks keep tombstones for exactly
-     * this reason).
-     *
-     * This is the fleet-scope seed read: a replica that joins mid-stream has
-     * no per-key history of its own, so before its first write to a key it
-     * asks the warehouse where the fleet already is and continues from
-     * there. Without it a joiner would restart the key's versions low and
-     * every write it produced would be silently rejected by the sink's own
-     * `version >` guard. Called at most once per key per process (off the
-     * commit path, inside the per-key drain worker), never per change.
-     */
-    readonly maxVersion: (input: {
-        readonly table: string;
-        readonly primaryKeyValue: unknown;
-    }) => Effect.Effect<MirrorVersion | null, AnalyticsFailure>;
-}
+export { AnalyticsMirrorImpl }
 
-/** One delete to apply to the mirror. */
-export declare interface AnalyticsMirrorRemove {
-    readonly table: string;
-    /** Primary-key value of the removed row. */
-    readonly primaryKeyValue: unknown;
-    /** See {@link MirrorVersion}. A delete is ordered against upserts of
-     *  the same key by exactly this number. */
-    readonly version: MirrorVersion;
-}
+export { AnalyticsMirrorRemove }
 
 /** Counters a caller (boot log, inspect endpoint, test) can read. */
 export declare interface AnalyticsMirrorStats {
@@ -765,15 +695,7 @@ export declare interface AnalyticsMirrorTunables {
     readonly versionStateLimit: number;
 }
 
-/** One insert/update to apply to the mirror. */
-export declare interface AnalyticsMirrorUpsert {
-    readonly table: string;
-    /** Post-image of the changed row. */
-    readonly row: Readonly<Record<string, unknown>>;
-    /** See {@link MirrorVersion} — persist it, compare against it, never
-     *  replace it with a local clock reading. */
-    readonly version: MirrorVersion;
-}
+export { AnalyticsMirrorUpsert }
 
 /**
  * Context.Tag the framework provides at runtime. Handlers grab it via
@@ -787,50 +709,14 @@ export declare class AnalyticsSink extends AnalyticsSink_base {
 
 declare const AnalyticsSink_base: Context.ServiceClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
 
-/**
- * The runtime contract every analytics provider implements. Plugins
- * build a value of this shape inside their factory function and the
- * framework wires it under `AnalyticsSink` for handler code to consume.
- */
-export declare interface AnalyticsSinkImpl {
-    readonly info: AnalyticsSinkInfo;
-    readonly track: (event: AnalyticsEvent) => Effect.Effect<void, AnalyticsFailure>;
-    readonly aggregate: (query: AggregateQuery) => Effect.Effect<number, AnalyticsFailure>;
-    readonly timeseries: (query: TimeseriesQuery) => Effect.Effect<ReadonlyArray<AnalyticsBucket>, AnalyticsFailure>;
-    readonly topN: (query: TopNQuery) => Effect.Effect<ReadonlyArray<AnalyticsTopEntry>, AnalyticsFailure>;
-    /**
-     * Present when the sink mirrors reactive tables (opt-in via the
-     * plugin's `mirrorTables` config). Absent → no mirroring; the
-     * framework skips wiring `DataStore.onChange` for this sink.
-     */
-    readonly mirror?: AnalyticsMirrorImpl;
-}
+export { AnalyticsSinkImpl }
 
-/**
- * Per-sink metadata surfaced via the manifest endpoint + dashboard.
- * Lets the operator see at a glance which provider is wired + what
- * it supports without grepping app.config.ts.
- */
-export declare interface AnalyticsSinkInfo {
-    readonly provider: string;
-    readonly capabilities: {
-        readonly track: boolean;
-        readonly aggregate: boolean;
-        readonly timeseries: boolean;
-        readonly topN: boolean;
-        /** True when the sink mirrors reactive tables into the warehouse so
-         *  analytical queries can JOIN events against live user data. */
-        readonly mirror: boolean;
-    };
-    /** Optional plugin-supplied detail (`{ ingestBufferDepth: 42 }`,
-     *  `{ url: 'https://eu.posthog.com' }`, etc.) — surfaced verbatim. */
-    readonly detail?: Readonly<Record<string, unknown>>;
-}
+export { AnalyticsSinkInfo }
 
 /**
  * What a plugin factory returns at app.config.ts time. The framework
  * boot path reads `apiConfig.analytics` (an `AnalyticsSinkSpec`), calls
- * `spec.build(sqlClient)` to materialise the `AnalyticsSinkImpl`, and
+ * the dependency-specific `spec.build` to materialise the `AnalyticsSinkImpl`, and
  * provides it under the `AnalyticsSink` Tag.
  *
  * Specs can declare `tables` to merge into the framework's schema
@@ -839,16 +725,10 @@ export declare interface AnalyticsSinkInfo {
  * sink is wired but BEFORE rpc routes open (handshakes, dependency
  * pings, batch-buffer warmups).
  */
-export declare interface AnalyticsSinkSpec {
+declare interface AnalyticsSinkLifecycle {
     /** Discriminator surfaced in boot logs + inspect ('postgres-analytics',
      *  'duckdb', 'clickhouse', 'tinybird', 'posthog', 'compose', 'noop'). */
     readonly kind: string;
-    /**
-     * Materialise the sink at boot. Receives the framework's SqlClient
-     * (bound to the main DataStore by default). Plugins that don't need
-     * SqlClient ignore the argument.
-     */
-    readonly build: (sqlClient: SqlClient.SqlClient) => AnalyticsSinkImpl;
     /** Optional schema tables the framework should create on first boot.
      *  Erased to `unknown` — the framework only forwards them to the
      *  schema applier, which accepts opaque table descriptors. */
@@ -871,10 +751,16 @@ export declare interface AnalyticsSinkSpec {
     readonly dispose?: (impl: AnalyticsSinkImpl) => Effect.Effect<void, never>;
 }
 
-export declare interface AnalyticsTopEntry {
-    readonly key: string;
-    readonly value: number;
-}
+/** Explicit SQL dependency: independent sinks boot without an application SQL store. */
+export declare type AnalyticsSinkSpec = AnalyticsSinkLifecycle & ({
+    readonly sql: 'required';
+    readonly build: (sqlClient: SqlClient.SqlClient) => AnalyticsSinkImpl;
+} | {
+    readonly sql: 'none';
+    readonly build: () => AnalyticsSinkImpl;
+});
+
+export { AnalyticsTopEntry }
 
 /**
  * Answer one probe.
@@ -914,6 +800,12 @@ export declare const API_CSP = "default-src 'none'; frame-ancestors 'none'; base
 
 export declare const API_KEYS_TABLE = "_voltro_api_keys";
 
+export declare const API_ROLE_BUCKET_MS: number;
+
+export declare const API_ROLE_WINDOW_MS: number;
+
+export declare const API_ROLE_WORKLOAD_BUCKETS_TABLE = "_voltro_api_role_workload_buckets";
+
 /** Caller side: the token this app presents to the api it binds as `name`. */
 export declare const apiBindingTokenEnv: (name: string) => string;
 
@@ -1097,6 +989,29 @@ export declare interface ApiKeyUsageDelta {
     readonly lastUsedAt: number;
 }
 
+/** A process can select multiple roles. Attribute once to the canonical role set,
+ * never once per role (which would multiply the observed loop time). */
+export declare const apiRoleMetricLabel: (roles: ReadonlyArray<string>) => string;
+
+export { ApiRoleWindowAssessment }
+
+/** Persist one finalized five-minute interval per process incarnation. Seconds
+ * are exclusive active-loop increments, NOT cumulative counter snapshots. */
+export declare interface ApiRoleWorkloadBucket {
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly from: number;
+    readonly until: number;
+    /** Only actual continuous observation can set this true. */
+    readonly continuous: boolean;
+    /** Each required workload must have explicit complete coverage and a value. */
+    readonly workloads: Readonly<Partial<Record<ApiWorkload, {
+        readonly coverage: 'partial' | 'complete';
+        readonly seconds: number;
+    }>>>;
+}
+
 /**
  * Typed authorization slice on `ctx.access` — the ergonomic, cast-free face of
  * the caller's EFFECTIVE scope set (raw subject scopes ∪ rbac role-derived
@@ -1112,7 +1027,9 @@ export declare interface AppAccess {
     readonly hasAny: (scopes: ReadonlyArray<string>) => boolean;
     /** Effect guard — fails with a typed `ScopeError` when the caller lacks
      *  `scope`. `yield* ctx.access.require('notes:write')` at the top of a
-     *  handler mirrors a descriptor `guards:` entry for in-body branching. */
+     *  handler mirrors a descriptor `guards:` entry for in-body branching.
+     *  Reauthenticates bound authority when the Effect executes. Authentication
+     *  or authority-source failures abort rather than becoming scope decisions. */
     readonly require: (scope: string) => Effect.Effect<void, ScopeError>;
     /** The caller's effective scope set (live — reflects rbac resolution). */
     readonly scopes: ReadonlyArray<string>;
@@ -1508,6 +1425,18 @@ export declare const assertWebhookRoutesDeclareVerification: (routes: ReadonlyMa
     readonly handle: unknown;
 }> | undefined) => void;
 
+/** Last 24 COMPLETED hours in five-minute buckets (at most five minutes behind
+ * now). Never interpolate a partial boundary bucket or merge process restarts.
+ * Doctor and panels consume this same decision; unknown work is never zero. */
+export declare const assessApiRoleWorkloadWindow: (input: {
+    readonly now: number;
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly requiredWorkloads: ReadonlyArray<ApiWorkload>;
+    readonly buckets: ReadonlyArray<ApiRoleWorkloadBucket>;
+}) => ApiRoleWindowAssessment;
+
 /**
  * Assign a subject to a variant — STABLE (same subject ⇒ same variant, always)
  * and BALANCED (proportions converge to the weights over many subjects). The
@@ -1798,7 +1727,7 @@ export declare const bindConnectionCredential: (clientId: number, credential: Co
  * interrupt registry subscriptions use — so one reconnect policy, one devtools
  * view, one connection lifecycle for both primitives.
  */
-export declare const bindEvent: (input: BindEventInput) => Stream.Stream<EventStreamEvent<unknown>, ScopeError | Unauthenticated | NoSuchResource, SubjectService | ConnectionInfo>;
+export declare const bindEvent: (input: BindEventInput) => Stream.Stream<EventStreamEvent<unknown>, ScopeError | Unauthenticated | RequestedTenantRefused | NoSuchResource, SubjectService | ConnectionInfo>;
 
 export declare interface BindEventInput {
     readonly bus: EventBus;
@@ -1818,9 +1747,12 @@ export declare interface BindEventInput {
      * this bridge must treat it as "no check", not as a guard.
      */
     readonly guards?: DeclaredAccess<unknown> | undefined;
+    /** The descriptor requirement and captured app policy must match exactly. */
+    readonly requiredClientPolicy?: string;
+    readonly clientPolicy?: EventClientPolicy;
 }
 
-export declare const bindMutation: <Input, Output, E = never>(execute: (input: Input, context: RuntimeContext) => Output | Promise<Output> | Effect.Effect<Output, E, never>, input: Input, spanName?: string, codec?: MutationOutputCodec<unknown>, idempotency?: IdempotencyBinding, 
+export declare const bindMutation: <Input, Output, E = never>(execute: (input: Input, context: RuntimeContext) => Output | Promise<Output> | Effect.Effect<Output, E, never>, input: Input, spanName?: string, codec?: MutationCodec<unknown>, idempotency?: IdempotencyBinding, 
 /**
  * This procedure's DECLARED error union (`descriptor.error`).
  *
@@ -1872,7 +1804,12 @@ guards?: ReadonlyArray<unknown> | undefined,
  *  (`{ scope: 'x:read', from: 'id' }`) can see which resource was asked for.
  *  Passed explicitly rather than read off RuntimeContext, which does not
  *  carry it. */
-guardInput?: unknown) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
+guardInput?: unknown, 
+/** Plugin admission wraps construction once; element guards remain live. */
+admission?: {
+    readonly tag: string;
+    readonly interceptor?: ServeRpcInterceptor | undefined;
+}) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
 
 /**
  * Build a `Stream<SubscriptionEvent<T>>` that an effect/rpc streaming
@@ -1959,6 +1896,16 @@ export declare interface BootListener {
      *  Installed by the boot path when its store exists, which is after the
      *  bind; an app-declared `health.readiness` replaces the whole check. */
     readonly setDependencyPing: (ping: () => Promise<boolean>) => void;
+    /** Required local runtime conditions, independent of app dependency policy.
+     * Checks must be synchronous and cheap. Release removes only this registration. */
+    /** Enable structured API health using captured role/workload identities. */
+    readonly setRoleHealth: (identity: {
+        readonly roles: ReadonlyArray<string>;
+        readonly workloads: ReadonlyArray<string>;
+    }) => void;
+    readonly addReadinessGate: (name: string, check: () => boolean) => () => void;
+    /** Required local progress conditions. App liveness cannot bypass these gates. */
+    readonly addLivenessGate: (name: string, check: () => boolean) => () => void;
     /** Close the socket. Resolves once node reports the listener closed. */
     readonly close: () => Promise<void>;
 }
@@ -2053,6 +2000,40 @@ export declare const buildTracingLayer: (options?: TracingOptions) => Promise<Tr
  *  hit on every read. `now` injectable for tests. */
 export declare const cachedBackend: (backend: SecretsBackend, ttlMs?: number, now?: () => number) => SecretsBackend;
 
+export declare const cachedComputedCall: (args: CachedComputedCallArgs) => Effect.Effect<CachedComputedResult, unknown, never>;
+
+declare interface CachedComputedCallArgs {
+    readonly cache: ComputedQueryCacheDeps;
+    readonly policy: ComputedQueryCachePolicy;
+    readonly key: string;
+    readonly name: string;
+    readonly sources: ReadonlyArray<string>;
+    readonly output: Schema.Top | undefined;
+    readonly subject: object;
+    readonly rowFilter: RowFilterScope | undefined;
+    readonly ctx: object;
+    readonly signal?: AbortSignal;
+    /** Run the handler to a value against the OBSERVED context and subject. */
+    readonly execute: (observedCtx: object, observedSubject: object) => Promise<unknown>;
+    /** The handler returned a descriptor — the snapshot cache owns that query. */
+    readonly onDescriptor: () => void;
+    readonly isDescriptor: (value: unknown) => boolean;
+    readonly unwrap: (value: unknown) => unknown;
+}
+
+/**
+ * Serve one computed call through the cache: a hit, or the handler run under
+ * observation and its result kept — or not — by `decideComputedStore`. The
+ * caller authorizes BEFORE and re-authorizes the delivered value AFTER; this
+ * function only decides what the cache does.
+ */
+/** A cached call's value, and the tables a live query built from it must also
+ *  recompute on (read by the handler, not named in `source:`). */
+declare interface CachedComputedResult {
+    readonly value: unknown;
+    readonly dependencies: ReadonlyArray<string>;
+}
+
 /** One leak: a query caching ONE entry across every caller while reading a
  *  table whose rows are scoped per tenant. */
 export declare interface CacheScopeLeak {
@@ -2125,13 +2106,7 @@ export declare interface CandidateShape {
 export declare const canonicalInputKey: (input: unknown) => string;
 
 /* Excluded from this release type: canonicalize */
-
-/**
- * Canonical JSON — object keys sorted recursively, so two structurally equal
- * inputs that differ only in key order digest identically. A retry from a
- * different client build must not mint a second approval.
- */
-export declare const canonicalJson: (value: unknown) => string;
+export { canonicalJson }
 
 export { CaughtUpVerdict }
 
@@ -2151,6 +2126,29 @@ export declare interface CdcDelta {
     readonly new?: Row_3 | null;
 }
 
+/** What a cell's envelopes can be bound to. */
+export declare interface CellContext {
+    readonly table: string;
+    readonly column: string;
+    /** The cell's row: its primary key, and every other column (for ids a copy carries). */
+    readonly rowId: unknown;
+    readonly row: Readonly<Record<string, unknown>>;
+    /** Every `.encrypted()` column the app declares, by table. */
+    readonly declared: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Declared renames (`declaredRenames`): the old names a value of this cell may still be bound to. */
+    readonly renames?: ReadonlyMap<string, DeclaredRename>;
+}
+
+/** What a cell's re-key did. */
+export declare interface CellRekey {
+    /** The cell's new text — equal to the input when nothing changed. */
+    readonly text: string;
+    readonly rekeyed: number;
+    readonly current: number;
+    /** Envelopes no candidate address opened — left as they are. */
+    readonly unresolved: number;
+}
+
 export { ChangeEvent }
 
 /** A mutation invocation's full change-set — the unit of undo. */
@@ -2166,50 +2164,24 @@ export declare interface ChangeSet {
     readonly crossesAction?: boolean;
 }
 
-export declare interface CircuitBreaker {
-    /** Run an effect through the breaker. OPEN ⇒ fails fast with CircuitOpen. */
-    <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | CircuitOpen, R>;
-    /** Current state — reads the Ref. */
-    readonly state: Effect.Effect<CircuitState>;
-    /** Force the breaker back to closed (clears counters). */
-    readonly reset: Effect.Effect<void>;
-}
-
-export declare const CircuitBreaker: {
-    /** Construct a breaker. Effect-returning because it allocates a Ref. */
-    readonly make: (options: CircuitBreakerOptions) => Effect.Effect<CircuitBreaker>;
-};
-
-export declare interface CircuitBreakerOptions {
-    /** Consecutive failures before the breaker opens. */
-    readonly failureThreshold: number;
-    /** Wait before transitioning open → half-open (Duration or string). */
-    readonly resetTimeout: Duration.Input;
-    /** Successes required in half-open before closing again. Default 1. */
-    readonly halfOpenSuccessThreshold?: number;
-    /** Predicate: does this error count toward the threshold? Default: all
-     *  typed failures count. Interruptions NEVER count (they're not a
-     *  downstream failure — the caller went away). */
-    readonly isFailure?: (error: unknown) => boolean;
-    /** Optional name for inspect / metrics + dashboard surfacing. */
-    readonly name?: string;
-}
-
 /**
- * Tagged error the breaker fails with while OPEN. Declarable on a
- * mutation / workflow `error:` schema so it marshals typed to the client.
+ * The same checks as {@link verifyFieldKeyring}, writing nothing — for a dry
+ * run. Answers which key the database records as active (`undefined` before
+ * the first boot recorded any) and which one would wait for the fleet.
  */
-export declare class CircuitOpen extends CircuitOpen_base {
-}
+export declare const checkFieldKeyring: (store: DataStore, keyring: FieldKeyring, tables: Iterable<unknown>) => Promise<{
+    readonly active: string | undefined;
+    readonly requested?: string;
+    readonly notes: ReadonlyArray<string>;
+}>;
 
-declare const CircuitOpen_base: Schema.Class<CircuitOpen, Schema.TaggedStruct<"CircuitOpen", {
-    /** Breaker name (the `name` option, or `'circuit'` when unnamed). */
-    readonly name: Schema.String;
-    /** Best-effort ms until the breaker next admits a probe call. */
-    readonly retryAfterMs: Schema.Number;
-}>, Cause.YieldableError>;
+export { CircuitBreaker }
+
+export { CircuitBreakerOptions }
+
+export { CircuitOpen }
 
-export declare type CircuitState = 'closed' | 'open' | 'half-open';
+export { CircuitState }
 
 /** How many bucket widths of predecessors a won claim leaves behind. */
 export declare const CLAIM_RETENTION_BUCKETS = 64;
@@ -2382,7 +2354,7 @@ export declare interface CompleteOAuthResult {
 /**
  * Combine multiple analytics specs into one composite spec at
  * app.config.ts time. The framework's boot path materialises each
- * child spec (calls `child.build(sqlClient)`) and wires them through
+ * child spec with its declared SQL dependency and wires them through
  * `composeAnalyticsSinks` so they behave as one logical sink.
  *
  * `track()` fans out to every child; reads route to the first child
@@ -2390,12 +2362,12 @@ export declare interface CompleteOAuthResult {
  *
  * Tables contributed by ANY child get merged. `initialize` effects
  * run sequentially in declaration order; `dispose` effects (teardown)
- * fan out to every child that declares one — only present on the
+ * await each child in reverse order — only present on the
  * composite when at least one child does.
  *
  *   analytics: composeAnalytics([
  *     postgresAnalytics(),                // primary: handles reads
- *     posthogAnalytics({ apiKey: '…' }),  // forwards track() too
+ *     posthogAnalytics({ apiKey: process.env.POSTHOG_API_KEY! }),
  *   ])
  */
 export declare const composeAnalytics: (specs: ReadonlyArray<AnalyticsSinkSpec>) => AnalyticsSinkSpec;
@@ -2439,6 +2411,44 @@ export declare interface CompressionOptions {
     readonly minBytes?: number;
 }
 
+/** Why a call is not looked up at all. */
+declare type ComputedCacheBypass = 'input-not-encodable' | 'no-tenant' | 'anonymous-subject';
+
+/**
+ * The entry one call belongs to — or why it has none.
+ *
+ * Every part is something a different answer could hang on: the query and the
+ * build that runs it (a redis cache outlives a deploy, and two releases share
+ * it during a rolling one), the output shape, the ENCODED input (so a `Date`,
+ * a `bigint` or a branded id keys by its wire form, and two spellings of one
+ * input share an entry), the scope's caller part, and the row-filter
+ * visibility the caller's reads of the declared tables resolve to.
+ */
+export declare const computedCacheKey: (args: ComputedCacheKeyInput) => {
+    readonly key: string;
+} | {
+    readonly bypass: ComputedCacheBypass;
+};
+
+declare interface ComputedCacheKeyInput {
+    readonly name: string;
+    /** The running build — see `codeIdentity` on the boot side. */
+    readonly codeIdentity: string;
+    readonly output: Schema.Top | undefined;
+    readonly input: Schema.Top | undefined;
+    readonly decodedInput: unknown;
+    readonly scope: ComputedCacheScope;
+    readonly subject: {
+        readonly id?: string | null | undefined;
+        readonly type?: string | undefined;
+        readonly tenantId?: string | null | undefined;
+    };
+    readonly rowFilter: RowFilterScope | undefined;
+    readonly declaredSources: ReadonlyArray<string>;
+}
+
+declare type ComputedCacheScope = 'subject' | 'tenant' | 'global';
+
 declare interface ComputedQuery {
     readonly __voltroComputed: true;
     /** The initial computed value — emitted verbatim as the first snapshot. */
@@ -2452,6 +2462,56 @@ declare interface ComputedQuery {
     readonly recompute: () => Promise<unknown>;
 }
 
+/** Is capture on? The request store builder wraps its store when it is. */
+export declare const computedQueryCacheCaptureInstalled: () => boolean;
+
+/**
+ * The cache a COMPUTED query's handler invocation is served through. Both boot
+ * paths build it over the app's `Cache` (`wrapDynamic`), and so does
+ * `@voltro/testing`'s `invoke`; absent ⇒ computed queries are never cached.
+ */
+export declare interface ComputedQueryCacheDeps {
+    readonly wrapDynamic: <A, E>(key: string, options: {
+        readonly ttlMs: number;
+        readonly swrMs?: number | undefined;
+        readonly leaseMs?: number | undefined;
+        readonly label: string;
+    }, compute: Effect.Effect<{
+        readonly value: A;
+        readonly store?: {
+            readonly stored: unknown;
+            readonly tags: ReadonlyArray<string>;
+        } | undefined;
+        readonly notApplicable?: boolean | undefined;
+    }, E, never>, read: (stored: unknown) => Effect.Effect<Option.Option<A>>) => Effect.Effect<{
+        readonly value: A;
+        readonly served: 'hit' | 'stale' | 'miss';
+    }, E, never>;
+    /** Parse the declared `cache:` (same parser as the descriptor path). */
+    readonly policyFor: (cache: {
+        readonly ttl: number | string;
+        readonly swr?: number | string | undefined;
+        readonly scope: ComputedCacheScope;
+        readonly volatile?: boolean | undefined;
+    }) => ComputedQueryCachePolicy | undefined;
+    /** The running build — part of every key, so a deploy never reads another
+     *  release's entries out of a shared cache. */
+    readonly codeIdentity: string;
+    readonly maxEntryBytes: number;
+    /** Cluster single-flight lease, when the backend supports one. */
+    readonly leaseMs?: number | undefined;
+    /** Once-per-(query, reason) notice that a result was not kept. */
+    readonly notice: (query: string, reason: string, message: string) => void;
+}
+
+/** A computed query's resolved cache policy — ms, parsed by the boot path. */
+export declare interface ComputedQueryCachePolicy {
+    readonly ttlMs: number;
+    readonly swrMs: number | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile: boolean;
+}
+
 export declare const CONNECTION_GRANTS_TABLE = "_voltro_connection_grants";
 
 /** What a declaration can learn about the account it just connected. Optional
@@ -2584,6 +2644,7 @@ export { ConstraintViolation }
 export declare type CoordinatedEffect = () => void | CoordinatedTickOutcome | Promise<void | CoordinatedTickOutcome>;
 
 export declare interface CoordinatedScheduleDeps {
+    readonly externalTasks?: ExternalizedTaskRegistry;
     /** The exactly-once gate. `singleCoordinator` for one-process
      *  deployments; `makeAdvisoryLockCoordinator(store, replicaId)` for
      *  multi-instance SQL stores. Injected so this stays testable with a
@@ -2674,8 +2735,9 @@ export declare interface CoordinatedScheduleDiagnostics {
 }
 
 export declare interface CoordinatedScheduleHandle {
-    /** Stop the periodic task. Idempotent. */
-    readonly stop: () => void;
+    /** Stop admission immediately; await the returned completion before releasing
+     * storage. Includes timer and external-trigger claims/effects. Idempotent. */
+    readonly stop: () => void | Promise<void>;
     /** The task name (for logging / dedup diagnostics). */
     readonly name: string;
     /**
@@ -3377,6 +3439,9 @@ export declare const decideApprovalInvocation: (input: {
     readonly status: "approved" | "rejected";
 }>;
 
+/** The app's `.encrypted()` columns, by table. */
+export declare const declaredEncryptedColumns: (declared: Iterable<unknown>) => ReadonlyMap<string, ReadonlySet<string>>;
+
 /**
  * `unknown` when the executor's failures are all declared; otherwise a type the
  * handler cannot satisfy, whose one property spells out the undeclared tag(s)
@@ -3389,6 +3454,27 @@ UndeclaredErrorTags<D, R>
     readonly undeclaredFailure: `'${UndeclaredErrorTags<D, R>}' is not in this procedure's wire union — add it to the descriptor's \`error:\`, register it through a plugin's \`errorSchemas\`, or map it away (Effect.orDie for a defect)`;
 };
 
+/** A declared rename of a table with sealed columns: the names its values may still be bound to. */
+export declare interface DeclaredRename {
+    readonly previousTable?: string;
+    /** New column name → the name it was renamed from. */
+    readonly columns: ReadonlyMap<string, string>;
+}
+
+/**
+ * The renames the app declares on tables with `.encrypted()` columns —
+ * `table('new').renamedFrom('old')`, a column's `.renamedFrom('old')`. A rename
+ * is catalog-only, so the rows keep values bound to the old names; the re-key
+ * opens them there and seals them under the new ones.
+ */
+export declare const declaredRenames: (declared: Iterable<unknown>) => ReadonlyMap<string, DeclaredRename>;
+
+/** Decode a stored snapshot; `undefined` for anything this version did not
+ *  write (an entry from another build reads as a miss). */
+export declare const decodeSnapshotValue: (stored: unknown) => {
+    readonly value: unknown;
+} | undefined;
+
 /**
  * Decrypt a value produced by `encryptField` or by an `.encrypted()` column —
  * one encoding, so that sentence is now true in both directions.
@@ -3954,7 +4040,13 @@ export declare class Dispatcher {
     private readonly subscriptionRegistry;
     private readonly matcher;
     private readonly subscriptions;
-    private readonly unsubscribeChange;
+    private unsubscribeChange;
+    private closed;
+    private readonly operations;
+    /** Register synchronously, before user code or the first await can run. */
+    private beginOperation;
+    /** Includes pending initial reads, not only already-visible subscriptions. */
+    private readonly interests;
     /**
      * Reverse index: tableName → set of subscription ids whose
      * dependent-table set INCLUDES that table. A change event on table
@@ -3980,12 +4072,18 @@ export declare class Dispatcher {
     /** Query labels already warned about for an undeclared raw read, so a hot
      *  subscription logs once rather than once per subscriber. */
     private readonly rawReadWarned;
+    /** The cache fence each written-through read observed before it started. */
+    private readonly readFences;
     private changeEpoch;
     private readonly committedReads;
     /** The CRDT-managed columns of `table` (empty when it has none) — what a
      *  subscription's backpressure outbox folds incrementally. */
     crdtColumnsFor(table: string): ReadonlySet<string>;
     constructor(deps: DispatcherDependencies);
+    private measureLoop;
+    private retainInterest;
+    /** One idempotent terminal path for setup failures, revocation and disconnect. */
+    private removeInterest;
     /**
      * REL-14 — a raw read that nothing can invalidate, said out loud.
      *
@@ -4056,6 +4154,9 @@ export declare class Dispatcher {
      * grant comes back.
      */
     private revokeSubscription;
+    /** Remove once, including a pending retry and its active metric. In-flight
+     *  async reads check identity again before emitting or scheduling anything. */
+    private removeComputed;
     /** `revokeSubscription` for the computed path. Same reasoning. */
     private revokeComputed;
     /**
@@ -4066,13 +4167,10 @@ export declare class Dispatcher {
      * Returns an `unsubscribe` the caller MUST invoke on teardown.
      */
     subscribeComputed(computed: ComputedQuery, emit: (event: SubscriptionEvent<unknown>) => void, context: RuntimeContext, label?: string): Promise<() => void>;
-    /** Re-run a computed subscription's handler; emit a fresh snapshot iff
-     *  the value changed. A computed value is an arbitrary payload (a scalar,
-     *  an aggregate object, a non-id-keyed array) — it has no id-keyed row
-     *  set to diff, so an update ships the full value as a `snapshot`, which
-     *  the client materialises as a wholesale base replacement. Best-effort:
-     *  a recompute throw is logged, not propagated, so one failing query
-     *  can't wedge the change stream. */
+    /** Serialize computed reads. A source change during a pending read asks for
+     *  one more read before delivery; an older result cannot overtake newer data.
+     *  Ordinary failures are visible in-band and retry independently of changes.
+     *  Access withdrawal stays terminal and never enters the retry lane. */
     private recomputeComputed;
     /** Live snapshot of all fingerprinted subscriptions — used by the
      *  `/_voltro/inspect/subscriptions` endpoint and DevTools. */
@@ -4087,6 +4185,9 @@ export declare class Dispatcher {
     onSubscriptionsChange(listener: () => void): () => void;
     /** Tear down the change-event listener. Call on server shutdown. */
     close(): void;
+    /** Close admission immediately, then join reads and deliveries before the
+     * owner disposes the store. Do not await this from inside a query callback. */
+    closeAndDrain(): Promise<void>;
     /**
      * Re-run EVERY live subscription, because this replica proved it missed
      * changes it can never recover.
@@ -4112,6 +4213,8 @@ export declare class Dispatcher {
 }
 
 export declare interface DispatcherDependencies {
+    /** Active synchronous live-change work only; asynchronous reads are not timed. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly store: DataStore;
     /** CRDT columns per table (schemaRegistry.crdtColumns). Feeds the
      *  downstream lane: crdt cells diff as incremental mergeCells ops.
@@ -4157,6 +4260,8 @@ export declare interface DispatcherDependencies {
 export declare const DORMANCY_WAKEUP_TENANT = "default";
 
 export declare interface DrainDeps<R = never> {
+    /** Active synchronous handler entry only; never await a Promise inside this measurement. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly store: Pick<DataStore, 'query' | 'update' | 'updateMany' | 'insert' | 'delete'>;
     readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition<R>>;
     /** Execute with the application's services. Required by drainOutbox when R
@@ -4235,7 +4340,7 @@ export declare interface DrainResult {
     readonly dead: number;
     readonly skipped: number;
     /**
-     * How many rows this pass had to look at. `0` means the queue is EMPTY, which
+     * How many rows this pass had to look at. `0` means the eligible queue is EMPTY, which
      * a caller cannot otherwise tell from "everything delivered" — both leave
      * `delivered` at whatever it was, and only one of them means the poll has
      * nothing left to do.
@@ -4287,7 +4392,7 @@ export declare interface EffectInsertIgnoreOutcomeStore {
 
 /** The minimal Effect-store surface `insertManyRowsEffect` needs. */
 export declare interface EffectInsertManyStore {
-    readonly insertMany: (table: string, rows: ReadonlyArray<Row>) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
+    readonly insertMany: (table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
 }
 
 /** The minimal Effect-store surface `insertRowEffect` needs. */
@@ -4311,7 +4416,7 @@ export declare interface EffectStoreOps {
      *  hand-built descriptor. */
     readonly query: <R = Row>(descriptor: QueryDescriptor<R>) => Effect.Effect<ReadonlyArray<R>, StoreError>;
     readonly insert: (table: string, row: Row) => Effect.Effect<Row, StoreError>;
-    readonly insertMany: (table: string, rows: ReadonlyArray<Row>) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
+    readonly insertMany: (table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
     readonly patchJson: (table: string, primaryKey: string, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>) => Effect.Effect<Row | null, StoreError>;
     readonly update: (table: string, primaryKey: string, patch: Readonly<Record<string, unknown>>) => Effect.Effect<Row | null, StoreError>;
     readonly updateMany: (table: string, patch: Readonly<Record<string, unknown>>, options: {
@@ -4398,6 +4503,10 @@ export declare const emptySchemaRegistry: SchemaRegistry;
  *  should be observed are constructed — `observeStore` decides once, per store. */
 export declare const enableGraphObservation: () => void;
 
+/** Encode a snapshot for the cache. Throws on a value with no faithful form —
+ *  the caller does not store it then. */
+export declare const encodeSnapshotValue: (value: unknown) => unknown;
+
 /**
  * Encrypt a value with the registered field cipher, in the SAME encoding an
  * `.encrypted()` column uses. Throws if no cipher is registered.
@@ -4429,15 +4538,22 @@ export declare const enforceApproval: (input: {
     readonly traceId?: string | undefined;
 }) => Promise<void>;
 
-export declare interface EnqueueOptions {
-    /** Drop this enqueue if an undelivered row already carries the same key. */
-    readonly idempotencyKey?: string;
-    /** Override the handler's `maxAttempts` for this one effect. */
-    readonly maxAttempts?: number;
-    /** Delay the first attempt (ms from now). */
-    readonly delayMs?: number;
+/** One connected engine SDK, as it named itself in `x-voltro-sdk`. It proves nothing and grants nothing. */
+export declare interface EngineClient {
+    readonly id: string;
+    /** `csharp`, `unity`, `godot` or `unreal`. */
+    readonly target: string;
+    readonly version: string;
+    /** SHA-256 of the API surface the SDK was generated from, or null when it did not say. */
+    readonly surface: string | null;
+    readonly connectedAt: number;
 }
 
+/** The engine SDKs connected to this process now, oldest first. */
+export declare const engineClientsSnapshot: () => ReadonlyArray<EngineClient>;
+
+export { EnqueueOptions }
+
 /**
  * Attribute the reads that FOLLOW, in this execution context, to `procedure`.
  *
@@ -5410,6 +5526,12 @@ export declare const externalizedTask: (name: string) => ExternalizedTask | unde
 
 export declare const externalizedTaskNames: () => ReadonlyArray<string>;
 
+export declare interface ExternalizedTaskRegistry {
+    readonly register: (task: ExternalizedTask) => () => void;
+    readonly get: (name: string) => ExternalizedTask | undefined;
+    readonly names: () => ReadonlyArray<string>;
+}
+
 /** Build an Effect `ExternalSpan` parent from a `traceparent` header so
  *  inbound HTTP work continues the caller's trace. Returns undefined
  *  when the header is missing/invalid (no parent → a fresh root span). */
@@ -5473,11 +5595,251 @@ declare type FailureTag<E> = 0 extends (1 & E) ? never : E extends {
     readonly _tag: infer T;
 } ? T extends 'UnknownError' ? never : T extends string ? T : never : never;
 
+export declare const FIELD_ENCRYPTION_ACTIVE_ENV = "VOLTRO_FIELD_ENCRYPTION_ACTIVE";
+
+export declare const FIELD_ENCRYPTION_KEY_ENV = "VOLTRO_FIELD_ENCRYPTION_KEY";
+
+export declare const FIELD_ENCRYPTION_KEYS_ENV = "VOLTRO_FIELD_ENCRYPTION_KEYS";
+
+export declare const FIELD_ENCRYPTION_PREVIOUS_KEY_ENV = "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS";
+
+export declare const FIELD_KEY_HEARTBEAT_MS = 10000;
+
+/** The table of leases on field-encryption keys. */
+export declare const FIELD_KEY_HOLDERS_TABLE = "_voltro_field_key_holders";
+
+export declare const FIELD_KEY_LEASE_MS = 30000;
+
+/** The table of the last field-key count and re-key. */
+export declare const FIELD_KEY_REPORTS_TABLE = "_voltro_field_key_reports";
+
+/** The environment names a keyring is read from, for a resolver that fetches them. */
+export declare const FIELD_KEYRING_ENV_NAMES: readonly ["VOLTRO_FIELD_ENCRYPTION_KEYS", "VOLTRO_FIELD_ENCRYPTION_ACTIVE", "VOLTRO_FIELD_ENCRYPTION_KEY", "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"];
+
+/** The table recording each field-encryption key id's state and canary. */
+export declare const FIELD_KEYS_TABLE = "_voltro_field_keys";
+
 export declare interface FieldChange {
     readonly from: unknown;
     readonly to: unknown;
 }
 
+/** What this process opened since it started, per key and location — the Governance panel's view. */
+export declare const fieldDecryptSnapshot: () => ReadonlyArray<{
+    readonly key: string;
+    readonly location: string;
+    readonly ok: number;
+    readonly failed: number;
+}>;
+
+/** The last `voltro secret status`: sealed values per key id, over all and per location. */
+export declare interface FieldKeyCountReport {
+    readonly totals: Readonly<Record<string, number>>;
+    readonly unnamed: number;
+    readonly plaintext: number;
+    readonly unreadable: number;
+    readonly locations: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly byKey: Readonly<Record<string, number>>;
+        readonly unnamed: number;
+        readonly plaintext: number;
+    }>;
+}
+
+/** One key of a keyring: its id and its secret (a passphrase, or 64 hex). */
+export declare interface FieldKeyEntry {
+    readonly id: string;
+    readonly secret: string;
+}
+
+/** What one heartbeat found. `unheld`: the database's active key is one this
+ *  process does not hold — it missed its lease while the fleet moved on. */
+export declare interface FieldKeyHeartbeat {
+    readonly active: string;
+    readonly activated?: {
+        readonly from: string | undefined;
+        readonly to: string;
+    };
+    readonly waiting?: FieldKeyWaiting;
+    readonly unheld: boolean;
+}
+
+/** A process's lease. `now` is for tests; the lease is how long a process that
+ *  stopped heartbeating is still waited for. */
+export declare interface FieldKeyHolder {
+    readonly holderId: string;
+    readonly leaseMs?: number;
+    readonly now?: () => number;
+}
+
+export declare interface FieldKeyHolderHandle {
+    /** Stop heartbeating, wait for a beat in flight, and give up the lease. */
+    readonly stop: () => Promise<void>;
+}
+
+/** A holder id for this process. */
+export declare const fieldKeyHolderId: () => string;
+
+/** One process's lease, as recorded — `expiresAt` in the past means it no longer counts. */
+export declare interface FieldKeyHolderRecord {
+    readonly holderId: string;
+    readonly keyIds: ReadonlyArray<string>;
+    readonly activeKeyId: string;
+    readonly heartbeatAt: Date;
+    readonly expiresAt: Date;
+}
+
+export declare interface FieldKeyHolderRow {
+    readonly holderId: string;
+    readonly keyIds: ReadonlyArray<string>;
+    readonly activeKeyId: string;
+    readonly expiresAt: string;
+}
+
+/**
+ * The id a key gets when the operator does not name one: `k` + 10 hex
+ * characters of an HMAC over the derived key. Stable for a given key, short
+ * enough to ride in every envelope, and not the key — the fingerprint is keyed
+ * by the key itself, so it says nothing about it to someone without it.
+ */
+export declare const fieldKeyIdOf: (secret: string) => string;
+
+/** The last `voltro secret rekey` (also run by `rotate`): what moved, what is left, and whether the active key alone opens everything. */
+export declare interface FieldKeyRekeyReport {
+    readonly active: string;
+    readonly rekeyed: number;
+    readonly left: number;
+    readonly verified: boolean;
+}
+
+export declare interface FieldKeyReports {
+    readonly status?: {
+        readonly reportedAt: Date;
+        readonly report: FieldKeyCountReport;
+    };
+    readonly rekey?: {
+        readonly reportedAt: Date;
+        readonly report: FieldKeyRekeyReport;
+    };
+}
+
+/** A field cipher over several keys, each with an id — what `makeFieldKeyring` returns. */
+export declare interface FieldKeyring extends FieldCipher {
+    /** The key new values are sealed under — the configured active key until
+     *  {@link FieldKeyring.activate} names another one the keyring holds. */
+    readonly activeKeyId: string;
+    /** The active key the configuration names. The database may keep another
+     *  active until every live process holds this one (`verifyFieldKeyring`). */
+    readonly requestedKeyId: string;
+    /** Every id the keyring holds, the configured active key first. */
+    readonly keyIds: ReadonlyArray<string>;
+    /** Each held key's fingerprint ({@link fieldKeyIdOf} — an HMAC of the key, never
+     *  the key), by id: what the boot line and the Governance panel show. */
+    readonly fingerprints: Readonly<Record<string, string>>;
+    /** Seal under one named key, whichever is active (a key's canary). */
+    readonly sealWith: (keyId: string, plaintext: string, binding?: FieldBinding) => string;
+    /** Does the named key open this value? `false` for a key the keyring does not hold. */
+    readonly opensWith: (keyId: string, ciphertext: string, binding?: FieldBinding) => boolean;
+    /** Seal new values under another held key — the database, not the
+     *  environment, decides which key is active (`verifyFieldKeyring`). */
+    readonly activate: (keyId: string) => void;
+}
+
+/** The keys a process holds, and the one new values are sealed under. */
+export declare interface FieldKeyringConfig {
+    readonly active: string;
+    readonly keys: ReadonlyArray<FieldKeyEntry>;
+}
+
+/** A keyring configuration that cannot be used — named, never containing a key. */
+export declare class FieldKeyringConfigError extends Error {
+    readonly _tag = "FieldKeyringConfigError";
+    constructor(message: string);
+}
+
+/** The boot cannot use this keyring with this database — the message names
+ *  ids, columns and the way out, never a key. */
+export declare class FieldKeyringRefusal extends Error {
+    readonly _tag = "FieldKeyringRefusal";
+    constructor(message: string);
+}
+
+/** What a boot's check found and recorded. */
+export declare interface FieldKeyringVerification {
+    /** The key new values are sealed under, as the database records it. */
+    readonly active: string;
+    /** Ids this boot recorded for the first time. */
+    readonly registered: ReadonlyArray<string>;
+    /** Set when this boot made another key active. */
+    readonly activated?: {
+        readonly from: string | undefined;
+        readonly to: string;
+    };
+    /** A requested key that is not active yet, and the live processes that lack it. */
+    readonly waiting?: FieldKeyWaiting;
+    /** Things worth a log line, never a refusal. */
+    readonly notes: ReadonlyArray<string>;
+}
+
+/** One recorded key id — its state and canary, never its key. */
+export declare interface FieldKeyRow {
+    readonly keyId: string;
+    readonly state: FieldKeyState;
+    readonly canary: string;
+    readonly registeredAt: Date | null;
+    readonly activatedAt: Date | null;
+    readonly replacedAt: Date | null;
+    readonly retiredAt: Date | null;
+    readonly requestedAt: Date | null;
+}
+
+/** A key's state. `pending`: held, never active. `active`: new values are sealed
+ *  under it — exactly one. `decrypt-only`: was active, replaced; values may still
+ *  be sealed under it. `retired`: nothing is sealed under it any more. */
+export declare type FieldKeyState = 'pending' | 'active' | 'decrypt-only' | 'retired';
+
+export declare interface FieldKeyStateRow {
+    readonly keyId: string;
+    readonly state: string;
+    readonly activatedAt: string | null;
+    readonly requestedAt: string | null;
+}
+
+export declare interface FieldKeyStatus {
+    /** The recorded keys and their states — empty before the first boot recorded any. */
+    readonly keys: ReadonlyArray<FieldKeyStateRow>;
+    /** Every process that holds a lease, live or not (`expiresAt` says which). */
+    readonly holders: ReadonlyArray<FieldKeyHolderRow>;
+    readonly locations: ReadonlyArray<SealedLocation>;
+    /** Envelopes per key id, over every location. */
+    readonly totals: Readonly<Record<string, number>>;
+    readonly unnamed: number;
+    readonly plaintext: number;
+    /** Columns that could not be read — listed, never silently left out of the counts. */
+    readonly unreadable: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * Count every sealed value in the database by the key it names. `declared` are
+ * the app's tables: their `.encrypted()` columns are always reported (with
+ * plaintext counted), the rest only where envelopes were found.
+ */
+export declare const fieldKeyStatus: (dialect: DialectId, declared: Iterable<unknown>) => Effect.Effect<{
+    keys: FieldKeyStateRow[];
+    holders: FieldKeyHolderRow[];
+    locations: SealedLocation[];
+    totals: Record<string, number>;
+    unreadable: UnreadableColumn[];
+    unnamed: number;
+    plaintext: number;
+}, SqlError, SqlClient.SqlClient>;
+
+export declare interface FieldKeyWaiting {
+    readonly keyId: string;
+    readonly holders: ReadonlyArray<string>;
+}
+
 /**
  * Canonical fingerprint over `(table, predicate, indexHint?)`. The
  * optional `indexHint` participates so two subscriptions with the same
@@ -5854,6 +6216,13 @@ export declare interface HealthConfigInput {
     readonly readiness?: () => boolean | Promise<boolean>;
 }
 
+/**
+ * One heartbeat: renew this process's lease, complete a requested activation
+ * once every live holder holds the key, and seal under the database's active
+ * key from now on. Any holder can complete an activation another one requested.
+ */
+export declare const heartbeatFieldKeys: (store: DataStore, keyring: FieldKeyring, holder: FieldKeyHolder) => Promise<FieldKeyHeartbeat>;
+
 /** Define a histogram. `boundaries` default to the framework duration buckets. */
 export declare const histogramMetric: (name: string, boundaries?: ReadonlyArray<number>, description?: string) => Metric.Histogram<number>;
 
@@ -5995,9 +6364,10 @@ export declare class InMemoryDataStore implements DataStore {
      * to tell apart from "no such table".
      */
     storedTables(): ReadonlyArray<StoredTableShape>;
+    integrityQuery(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     insert(table: string, row: Row): Promise<Row>;
-    insertMany(table: string, rows: ReadonlyArray<Row>): Promise<ReadonlyArray<Row>>;
+    insertMany(table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions): Promise<ReadonlyArray<Row>>;
     patchJson(table: string, primaryKey: RowKey, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>): Promise<Row | null>;
     update(table: string, primaryKey: RowKey, patch: Readonly<Record<string, unknown>>): Promise<Row | null>;
     delete(table: string, primaryKey: RowKey): Promise<boolean>;
@@ -6029,8 +6399,9 @@ export declare const insertIgnoreRowOutcomeEffect: <T extends AnyWritableTable>(
     readonly outcome: "inserted" | "ignored";
 }, StoreError>;
 
-/** `insertRowEffect`'s batch — every element checked against `InferInsertRow<T>`. */
-export declare const insertManyRowsEffect: <T extends AnyWritableTable>(store: EffectInsertManyStore, table: T, rows: ReadonlyArray<InferInsertRow<T>>) => Effect.Effect<ReadonlyArray<InferRow<T>>, StoreError>;
+/** `insertRowEffect`'s batch — every element checked against `InferInsertRow<T>`.
+ *  `{ returning: 'none' }` resolves to `[]` without reading the rows back. */
+export declare const insertManyRowsEffect: <T extends AnyWritableTable>(store: EffectInsertManyStore, table: T, rows: ReadonlyArray<InferInsertRow<T>>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<InferRow<T>>, StoreError>;
 
 /**
  * Insert a row, typed against the table, on the Effect channel.
@@ -6135,6 +6506,10 @@ export { inspectWorkflow }
 
 export declare const installApprovalGate: (gate: ApprovalGateApi) => void;
 
+/** Turn on read capture for cached computes — called at boot when any query
+ *  declares `cache:`. Until then the request store is not wrapped for it. */
+export declare const installComputedQueryCacheCapture: () => void;
+
 /**
  * Install the resolver that answers `guards: [{ action, resourceType }]`.
  *
@@ -6238,6 +6613,9 @@ export declare const isExpectationDefinition: (value: unknown) => value is Expec
 
 export declare const isExperimentDefinition: (value: unknown) => value is ExperimentDefinition;
 
+/** Is this cipher a keyring (ids, per-key seal and open), not a bare cipher? */
+export declare const isFieldKeyring: (cipher: FieldCipher | undefined) => cipher is FieldKeyring;
+
 export { isForeignKeyViolation }
 
 /**
@@ -6464,7 +6842,7 @@ export declare interface KvFacade {
     readonly service: Effect.Success<typeof Kv>;
     /** The resolved backend kind — for boot logging. */
     readonly backend: 'database' | 'redis' | 'memory';
-    /** Tear down the managed runtime (closes a pooled redis connection). */
+    /** Release this consumer runtime; an injected registry retains its pools. */
     readonly dispose: () => Promise<void>;
 }
 
@@ -6473,6 +6851,10 @@ export declare interface KvFacadeOptions {
     readonly store: DataStore;
     /** Defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
+    readonly backend?: 'database' | 'redis' | 'memory';
+    readonly connectionName?: string;
+    readonly keyPrefix?: string;
+    readonly connections?: RespConnections;
 }
 
 /**
@@ -6594,6 +6976,27 @@ export declare interface LocalityAwareOptions {
  */
 export declare const localityAwareSelector: (options: LocalityAwareOptions) => ReplicaSelector;
 
+/** One location's outcome. */
+export declare interface LocationRekey {
+    readonly table: string;
+    readonly column: string;
+    readonly cells: number;
+    readonly rekeyed: number;
+    readonly current: number;
+    readonly unresolved: number;
+    /** Cells the app changed between the read and the write — run again. */
+    readonly changedMeanwhile: number;
+    /** Values that need a re-key in a table with no single-column primary key to address the cell by. */
+    readonly unaddressable: number;
+}
+
+/** Read the current key row within its expected tenant under a write fence.
+ * Supply an existing transaction after the application's organization/account
+ * fences and keep it through the protected write. Null matches unassigned
+ * keys only. The internal row uses the normal store codec; never return it in
+ * a public response. This is not bearer verification or an authorization grant. */
+export declare const lockApiKeyById: (store: DataStore, id: string, tenantId: string | null) => Promise<ApiKeyRow | null>;
+
 export declare interface LogTraceContext {
     readonly traceId: string;
     readonly spanId?: string;
@@ -6665,7 +7068,7 @@ log?: SchedulerLogger) => Coordinator;
  * tampered / wrong-key value AND on a bound value read at another address —
  * both surface as a read error, never silent corruption.
  */
-export declare const makeAesCipher: (key: Buffer) => FieldCipher;
+export declare const makeAesCipher: (key: Buffer, keyId?: string) => FieldCipher;
 
 export declare const makeApiKeyService: (store: ApiKeyStore, opts?: {
     prefix?: string;
@@ -6693,6 +7096,61 @@ export declare const makeApiKeyUsageFlusher: (store: ApiKeyStore) => (id: string
     readonly lastUsedAt: number;
 }) => Promise<void>;
 
+/** In-memory, bounded finalized-bucket queue. Current instrumentation is partial;
+ * this collector cannot certify complete workload coverage merely from uptime. */
+export declare const makeApiRoleBucketSampler: (input: {
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly workloads: ReadonlyArray<ApiWorkload>;
+    readonly epochNow: number;
+    readonly monotonicNow: number;
+}) => {
+    record(segment: {
+        readonly workload: ApiWorkload;
+        readonly from: number;
+        readonly until: number;
+    }): void;
+    /** Heartbeat every30s. Delays >60s or clock skew >1s conservatively invalidate
+     * affected intervals; never spread elapsed request time across buckets. */
+    advance(monotonicNow: number, epochNow: number): void;
+    pending(): ReadonlyArray<ApiRoleWorkloadBucket>;
+    acknowledge(from: number): void;
+    status: () => {
+        pendingBuckets: number;
+        droppedBuckets: number;
+        rejectedSegments: number;
+    };
+};
+
+/** Measures only the synchronous execution of a callback, including throws.
+ * Returning a Promise measures its construction, not its awaited lifetime.
+ * Each resumed async callback must be instrumented separately. No wall-time
+ * request duration may be fed into this counter as a substitute for loop time.
+ * Nested calls on this recorder suspend their parent, so time is exclusive. */
+export declare const makeApiRoleWorkloadMetrics: (roles: ReadonlyArray<string>, options?: {
+    readonly now?: () => number;
+    readonly onSegment?: (segment: {
+        readonly workload: ApiWorkload;
+        readonly from: number;
+        readonly until: number;
+    }) => void;
+}) => {
+    role: string;
+    observationErrors: () => number;
+    /** Effect4's tracer context surrounds each synchronous primitive, including
+     * the first, resumed and inherited child work. Preserve the existing tracer;
+     * Promise callbacks outside evaluation still use measureSync explicitly. */
+    observeEffect<A, E, R>(effect: Effect.Effect<A, E, R>, workload: ApiWorkload): Effect.Effect<A, E, R>;
+    measureSync<A>(workload: ApiWorkload, run: () => A): A;
+    /** Local totals, not a 24-hour history or evidence of full instrumentation. */
+    snapshot(): ReadonlyArray<{
+        readonly role: string;
+        readonly workload: ApiWorkload;
+        readonly seconds: number;
+    }>;
+};
+
 /** Build the `ctx.access` slice for a subject. Reads the effective-scope seam
  *  LIVE (via getters/closures) so a scope rbac resolves after context
  *  construction is still reflected. Used by the shared AppContext builder AND
@@ -6716,7 +7174,7 @@ export declare interface MakeApprovalGateOptions {
 
 /** Build the `ctx.kv` facade. `KV_BACKEND` picks the backend; unknown values
  *  fall back to `database`. */
-export declare const makeAsyncKv: ({ store, env }: KvFacadeOptions) => Promise<KvFacade>;
+export declare const makeAsyncKv: ({ store, env, backend: configuredBackend, connectionName, keyPrefix, connections }: KvFacadeOptions) => Promise<KvFacade>;
 
 /**
  * The `AuthMiddleware` + `ConnectionInfoMiddleware` pair every rpc surface
@@ -6728,9 +7186,9 @@ export declare const makeAsyncKv: ({ store, env }: KvFacadeOptions) => Promise<K
  *     (a no-op for a connection that never re-authenticated);
  *  2. run the FULL chain on the result — strategies, session revocation,
  *     `resolveScopes`, the scope cache;
- *  3. record what the strategy verified about the credential's lifetime, so
- *     `ConnectionInfo.credentialExpiresAt` reports the token's own `exp` rather
- *     than a cookie derivation that only ever saw one auth shape.
+ *  3. pass the verified lifetime through call-local Effect context, so parallel
+ *     calls and explicitly unbounded credentials cannot inherit another call's
+ *     expiry. Compose the group's pair with `withRpcAuthMiddleware`.
  *
  * Step 1 is the only thing a re-authenticated connection gets. It changes WHICH
  * credential is presented and nothing about how it is judged.
@@ -6835,19 +7293,45 @@ export declare const makeEventPublisher: (ctx: EventPublishContext) => EventPubl
 
 export declare const makeEventsFacade: (options: EventsFacadeOptions) => EventsAppContext;
 
+/** Pass one instance to a host's scheduler factories and trigger route. */
+export declare const makeExternalizedTaskRegistry: () => ExternalizedTaskRegistry;
+
 /**
  * Derive a key from a passphrase and build the cipher — with the keys a
- * ROTATION retires, when there are any.
+ * ROTATION retires, when there are any. Ids are derived from the keys
+ * (`fieldKeyIdOf`); a previous key equal to the current one is skipped.
  *
- * Writes use the current key; reads try the current one, then each previous
- * one. GCM authenticates, so a wrong key fails its tag rather than producing
- * garbage, and trying them in turn is safe. Without this, a key change made
- * every value written before it unreadable — measured: every sleeping or
- * suspended run of an `encrypted: true` workflow failed its replay with
- * `MalformedMessage`, and every `.encrypted()` column read failed.
+ * Writes use the current key; reads open a value by the key it names, or by
+ * trying the current one, then each previous one. GCM authenticates, so a
+ * wrong key fails its tag rather than producing garbage. Without this, a key
+ * change made every value written before it unreadable — measured: every
+ * sleeping or suspended run of an `encrypted: true` workflow failed its replay
+ * with `MalformedMessage`, and every `.encrypted()` column read failed.
  */
 export declare const makeFieldCipher: (passphrase: string, previous?: ReadonlyArray<string>) => FieldCipher;
 
+/**
+ * A cipher over a keyring: new values are sealed under the active key and name
+ * it; a value is opened by the key it names (a lookup), and one written before
+ * values named their key by trying each key, the active one first.
+ *
+ * A named key that is not in the keyring is a refusal that names it, so an
+ * operator reads "sealed under k2026a, which this process does not hold"
+ * instead of a GCM failure. A named key that does not open the value (an id
+ * that was altered) falls back to trying the others — the id is a hint, GCM is
+ * the authority.
+ */
+export declare const makeFieldKeyring: (config: FieldKeyringConfig, options?: {
+    /**
+     * Refuse to seal until {@link FieldKeyring.activate} has run — the boot's
+     * keyring sets this, so nothing is sealed under the configured key before
+     * the database has said which key is active. A value sealed under a key the
+     * fleet has not accepted is one a replica on the previous configuration
+     * cannot read.
+     */
+    readonly sealOnlyOnceActivated?: boolean;
+}) => FieldKeyring;
+
 /** Build the fluent `select` / `update` / `delete` entry functions over a
  *  backend + scope. Wired into `wrapStoreWithMixinBehaviour` so they hang
  *  off `ctx.store` alongside the keyed `query`/`insert`/`update`/`delete`. */
@@ -6870,12 +7354,18 @@ export declare const makeLazyWorkflowFacade: (resolve: () => WorkflowsAppContext
 export declare const makeListConnectionsExecutor: (deps: ConnectionBuiltinDeps) => (_input: Record<string, never>, ctx: ConnectionExecutorCtx) => Promise<ReadonlyArray<ConnectionState_2>>;
 
 /**
- * Build the replay codec from a mutation's `descriptor.output` Schema (call it at
- * the bind site). Both directions fall back to the raw value if the Schema can't
- * round-trip it — a guard for exotic schemas; for a value the handler actually
- * produced, `encodeUnknownSync` never throws. `undefined` schema → no codec.
+ * Build one input/output contract from both declared schemas. Refuse incompatible
+ * values with payload-free errors; never return or log an old raw response
+ * when the current output contract cannot decode it. Input is captured from its schema before keyed acquisition.
  */
-export declare const makeMutationOutputCodec: (outputSchema: Schema.Top | undefined) => MutationOutputCodec<unknown> | undefined;
+export declare const makeMutationCodec: (inputSchema: Schema.Top, outputSchema: Schema.Top, admit: MutationCodec<unknown>["admit"]) => MutationCodec<unknown>;
+
+/** Current admission for a keyed unary call, including its cached result.
+ * Pure refresher binding is separate from business interceptors/executors. */
+export declare const makeMutationReplayAdmission: (procedure: MutationLike, kind: "mutation" | "action", options?: {
+    readonly defaultDeny?: boolean;
+    readonly bindReplayAuthority?: RpcReplayAuthorityBinding | undefined;
+}) => ((input: unknown, request: ServeRequestContext) => Promise<void>);
 
 /**
  * Build the shared mutation runner. Used by BOTH the rpc WS handler and
@@ -6949,7 +7439,7 @@ export declare const makeOutboxFacade: (deps: OutboxFacadeDeps) => OutboxFacade;
  */
 export declare const makeProcessAdapter: (supervisor: AppSupervisor) => WakeAdapter;
 
-export declare const makeQueryDescriptorProducer: <D>(deps: QueryProducerDeps<D>) => (query: MutationLike, input: unknown) => (requestContext: ServeRequestContext) => D | ComputedQuery | Effect.Effect<D | ComputedQuery, unknown, never>;
+export declare const makeQueryDescriptorProducer: <D>(deps: QueryProducerDeps<D>, workloadOverride?: "rpc" | "subscriptions") => (query: MutationLike, input: unknown) => (requestContext: ServeRequestContext) => ComputedQuery | D | Effect.Effect<ComputedQuery | D, unknown, never>;
 
 export declare const makeQueryFinalizer: (options: QueryFinalizeOptions) => ((descriptor: QueryDescriptor, subject: {
     readonly tenantId?: string | null;
@@ -6965,16 +7455,13 @@ export declare const makeQueryFinalizer: (options: QueryFinalizeOptions) => ((de
  * the socket keeps delivering rows the subject may no longer read until
  * the client happens to disconnect.
  *
- * So every delivery re-runs the same `checkGuardsEffect` the subscribe-time
- * gate ran — including the async resource-scope resolver, which is where a
- * per-row/per-team revocation actually shows up. Returns `null` when the
- * subject still passes, or the typed `ScopeError` that denied it.
- *
- * Returns a closure that always resolves `null` when the descriptor carries
- * no guards AND default-deny is off, so the caller needs no branch and an
- * unguarded query pays only a resolved promise. Under `defaultDeny` an
- * UNDECIDED descriptor resolves the same typed refusal on every delivery —
- * fail closed on the re-check too, not only at subscribe.
+ * Each delivery refreshes the original authentication chain, subject guards,
+ * dynamic role grants, and resource guards before emitting data. Configured
+ * authentication/scope caches retain their documented invalidation windows.
+ * A revoked credential or grant ends the subscription with a typed refusal.
+ * The original principal and tenant remain fixed; changing either requires a
+ * new subscription. Even unguarded descriptors refresh authentication, while
+ * default-deny keeps rejecting descriptors without a declared access policy.
  */
 export declare const makeQueryReauthorizer: (query: MutationLike, input: unknown, defaultDeny?: boolean) => (subject: Subject) => () => Promise<unknown>;
 
@@ -7391,35 +7878,22 @@ export declare const MIN_LEVEL_RESYNC_MS = 30000;
 /** Mint a fresh service token. `voltro dev` and `voltro secret generate` call this. */
 export declare const mintServiceToken: () => string;
 
-/**
- * Ordering token for one mirrored write.
- *
- * **The sink MUST persist this and MUST NOT invent its own.** It is
- * assigned by the framework at the moment the change leaves the store's
- * change channel — i.e. in COMMIT order — so a write with a lower
- * version is, by construction, an older image of that row. Stamping a
- * version at sink-call time instead (a `Date.now()` inside `upsert`)
- * makes a late-arriving STALE image outrank the fresh one and win
- * permanently; that is the bug this type exists to make unrepresentable.
- *
- * How the number is derived depends on the store's `changeScope`:
- *
- *   - `'local'` (one process observes each change): a hybrid clock —
- *     wall-clock microseconds forced strictly upward, so it orders within
- *     a millisecond and keeps increasing across a restart.
- *   - `'fleet'` (every replica observes every change): derived from the
- *     CHANGE, not from the receiving process — the warehouse's own max
- *     version for the key (read once via {@link AnalyticsMirrorImpl.maxVersion})
- *     plus the change's per-key position in the totally-ordered fleet
- *     stream. N replicas mirroring the same change therefore stamp the
- *     SAME number, and the sink's version guard dedupes the N duplicate
- *     writes for free — no leader, no clock, no skew hazard.
- */
-export declare type MirrorVersion = number;
+export { MirrorVersion }
 
 /** The error `.one()` throws: the factory's, or the framework's `NoRowFound`. */
 export declare const missingRowError: (info: NoRowFoundInfo, onMissing: OnMissingRow | undefined) => unknown;
 
+/**
+ * Store encoded wire output and decode it against the current output contract.
+ * A failed codec never falls back to an unvalidated raw response.
+ */
+export declare interface MutationCodec<Output> {
+    readonly input: Schema.Top;
+    readonly admit: (input: unknown, context: RuntimeContext) => Promise<void>;
+    readonly encode: (output: Output) => unknown;
+    readonly decode: (stored: unknown) => Output;
+}
+
 export declare interface MutationLifecycle {
     readonly afterCommit: (work: () => Promise<unknown>) => void;
     /** Already selected physical, namespace-bound nontransactional store.
@@ -7431,8 +7905,16 @@ export declare interface MutationLifecycle {
 export declare interface MutationLike {
     readonly descriptor: {
         readonly name: string;
+        readonly undo?: {
+            readonly capture: false;
+            readonly reason: string;
+        } | undefined;
         readonly source?: string | ReadonlyArray<string> | undefined;
         readonly guards?: ReadonlyArray<AnyCheckSpec> | undefined;
+        /** Query only — read by the computed-query cache (`computedQueryCache.ts`). */
+        readonly cache?: QueryCacheLike | undefined;
+        readonly input?: Schema.Top | undefined;
+        readonly output?: Schema.Top | undefined;
         /** The second-human control (mutation/action only). Enforced by
          *  `enforceApprovalGate`, immediately after `enforceGuards`. */
         readonly requiresApproval?: AnyApprovalPolicy | undefined;
@@ -7447,21 +7929,20 @@ export declare interface MutationLike {
     executor(input: unknown, ctx: unknown): unknown;
 }
 
-/**
- * Encode/decode a mutation's output for idempotent replay. On a FRESH call the
- * WIRE form (`encode`) is stored, so a later replay `decode`s it back to the exact
- * Output the handler would have returned and the rpc layer re-encodes it
- * identically. Storing the DECODED Output directly would corrupt `Date`/etc.
- * fields through the store's JSON round-trip (encode there expects a `Date`, not
- * the ISO string a round-trip produced). Built from `descriptor.output` at the
- * call site; both fns fall back to the raw value if the Schema can't round-trip.
- */
-export declare interface MutationOutputCodec<Output> {
-    readonly encode: (output: Output) => unknown;
-    readonly decode: (stored: unknown) => Output;
-}
-
 export declare interface MutationRunnerDeps {
+    /** Measures only the synchronous executor entry, never an awaited result. */
+    readonly measureSync?: <A>(run: () => A) => A;
+    readonly outcomeOutbox?: (request: ServeRequestContext) => OutboxEnqueueFacade | undefined;
+    /** A failure aborts the business transaction; transient contention replays
+     * executor and hook together. Never perform external I/O here. */
+    readonly beforeMutationCommit?: ServeMutationCommitHook | undefined;
+    /**
+     * Resolves once the cache invalidations this process started have reached
+     * the cache. Awaited after commit, BEFORE the mutation answers — without it
+     * the writer's next read raced its own invalidation and was served the
+     * pre-write entry. Both boot paths pass `wireCacheInvalidation`'s `settled`.
+     */
+    readonly settleCacheInvalidations?: () => Promise<void>;
     readonly store: TransactionalStore;
     /** Select and provision the request's physical store before opening its
      * transaction. Resolved once, including across retries and post-commit folds. */
@@ -7484,6 +7965,7 @@ export declare interface MutationRunnerDeps {
     /** Build the per-call `AppContext` bound to the transactional `tx`. */
     readonly buildContext: (request: ServeRequestContext, tx: unknown, lifecycle?: MutationLifecycle) => {
         readonly store: unknown;
+        readonly outbox?: OutboxEnqueueFacade;
     };
     /** Run an Effect-returning executor with the per-request store layer. */
     readonly runEffect: (effect: Effect.Effect<unknown, unknown, never>, store: unknown) => Promise<unknown>;
@@ -7525,6 +8007,19 @@ export declare interface MutationStore extends DataStore {
     hardDelete(table: string, primaryKey: RowKey): Promise<boolean>;
 }
 
+/**
+ * The encoding a body of `size` bytes would be compressed with — `undefined`
+ * unless (enabled ∧ type compressible ∧ size ≥ threshold ∧ the client accepts
+ * an encoding). Lets a caller that has not read the body yet (a static file
+ * known only by `stat`) take the same decision `maybeCompress` takes.
+ */
+export declare const negotiatedCompression: (input: {
+    readonly size: number;
+    readonly contentType: string | undefined;
+    readonly acceptEncoding: string | undefined;
+    readonly options?: CompressionOptions | undefined;
+}) => NegotiatedEncoding | undefined;
+
 export declare type NegotiatedEncoding = 'br' | 'gzip';
 
 /** Pick the encoding the client accepts — brotli preferred, gzip second,
@@ -7532,24 +8027,7 @@ export declare type NegotiatedEncoding = 'br' | 'gzip';
  *  (a client sending both accepts both). */
 export declare const negotiateEncoding: (acceptEncoding: string | undefined) => NegotiatedEncoding | undefined;
 
-/**
- * A fresh trace id for work that has NO incoming span to continue — a webhook
- * delivery, a schedule firing, a devtools invoke, a REST or gRPC entry point.
- *
- * 128 random bits as 32 lowercase hex, the shape `TRACEPARENT_RE` above accepts
- * and the shape a collector, a log pipeline or `voltro traces` can join on.
- *
- * The reason this exists as ONE function: every entry point that minted its own
- * had drifted somewhere different, and three of the shapes were not ids at all.
- * `incoming:<webhookId>`, `reaction:<workflow>` and the literal
- * `'webhooks:trigger'` are CONSTANTS — they were the caller's `source` label
- * copied into the id field, so every delivery a process ever handled shared one
- * trace and the waterfall merged unrelated work. `public-`/`grpc-`/`rest-` plus
- * eight base36 characters carried ~41 bits, which collides long before a busy
- * day is over. The entry-point kind is not lost by fixing this: it lives in the
- * `source` field beside the id, which is where it was already being written.
- */
-export declare const newTraceId: () => string;
+export { newTraceId }
 
 /**
  * The backoff curve, extracted so it can be asserted directly — a schedule
@@ -7666,6 +8144,14 @@ export declare interface NoRowFoundInfo {
     readonly found: number;
 }
 
+/** Record a non-table input of the cached compute in flight, if any. Called by
+ *  the framework surfaces that reach outside the database. */
+export declare const noteCacheVolatile: (reason: string) => void;
+
+/** Note that the query in flight depends on `table` without reading it
+ *  through `ctx.store`. */
+export declare const noteDependency: (table: string) => void;
+
 /** Note one read against the in-flight procedure. No scope → nothing happens. */
 export declare const noteRead: (descriptor: QueryDescriptor) => void;
 
@@ -7695,6 +8181,45 @@ export declare interface Notification {
     readonly newMatched: boolean;
 }
 
+/** What a cross-environment restore did to the sealed values it cannot read. */
+export declare interface NullSealedReport {
+    readonly nulled: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }>;
+    readonly unreadable: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }>;
+    /** Recorded key ids removed: they came with the restored data and this environment does not hold them. */
+    readonly forgottenKeys: ReadonlyArray<string>;
+    readonly unreadableColumns: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * After restoring another environment's database: write NULL for every whole
+ * sealed value no configured key opens — the source ciphertext is useless here
+ * and users re-enter it — count the sealed copies inside other values (they
+ * cannot be nulled), and forget the restored key records and leases this
+ * environment does not hold, so the next boot records its own keys.
+ */
+export declare const nullUnreadableSealedValues: (dialect: DialectId, keyring: FieldKeyring | undefined, declared: Iterable<unknown>) => Effect.Effect<{
+    nulled: {
+        table: string;
+        column: string;
+        count: number;
+    }[];
+    unreadable: {
+        table: string;
+        column: string;
+        count: number;
+    }[];
+    forgottenKeys: string[];
+    unreadableColumns: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 export declare interface OAuth2ConnectionDefinition extends ConnectionDefinitionCommon {
     readonly kind: 'oauth2';
     readonly authorizeUrl: string;
@@ -7735,6 +8260,17 @@ export declare type OAuthClientCredential = string | (() => string);
 
 export declare const oauthCredentialValue: (credential: OAuthClientCredential) => string;
 
+/** Preserve the caller's environment, Exit and cancellation. Observation is
+ * installed before the body's first primitive; it creates no detached runtime. */
+export declare const observeApiRoleEffect: <A, E>(effect: Effect.Effect<A, E, never>, metrics: ReturnType<typeof makeApiRoleWorkloadMetrics>, workload: ApiWorkload) => Effect.Effect<A, E, never>;
+
+/**
+ * Test seam: a ConnectionInfo layer that hands every request's headers to
+ * `observe` and reports only the client id. It never authenticates and is not a
+ * boot path; it lives here so ConnectionInfo keeps one construction site.
+ */
+export declare const observeConnectionHeaders: (observe: (headers: Readonly<Record<string, string | undefined>>, clientId: number) => void) => Layer.Layer<ConnectionInfoMiddleware>;
+
 /** One recorded `(procedure → table, op)` edge. */
 export declare interface ObservedEdge {
     readonly tag: string;
@@ -7818,6 +8354,16 @@ export declare type OnMissingRow = (info: NoRowFoundInfo) => unknown;
  */
 export declare const onProcessShutdown: (hook: () => void | Promise<void>) => (() => void);
 
+/**
+ * Open every envelope in one cell with `keyring` — each under the address it
+ * was sealed under, found the same way a re-key finds it. A keyring holding the
+ * active key alone answers "does anything still need another key?".
+ */
+export declare const openCell: (text: string, keyring: FieldKeyring, context: CellContext) => {
+    readonly opened: number;
+    readonly unopened: number;
+};
+
 /** Thrown by `.expectVersion(n).set(...)` when the optimistic-lock guard
  *  matched no row (the row was concurrently updated or deleted). */
 export declare class OptimisticLockError extends OptimisticLockError_base {
@@ -8013,14 +8559,14 @@ export declare const outboxAttemptsTable: TableLike;
  *  twice because of us or because of them" becomes unanswerable. */
 export declare type OutboxAttemptTrigger = 'automatic' | 'manual';
 
-export declare interface OutboxFacade {
-    /**
-     * Persist the intent to run `effect` after this transaction commits.
-     *
-     * Returns the outbox row id, which doubles as the delivery id a client can
-     * watch to render external-side-effect progress ("saving… syncing… synced").
-     */
-    enqueue(effect: string, payload: Record<string, unknown>, options?: EnqueueOptions): Promise<string>;
+/** Declared-event publication for an outbox attempt, scoped to its queued tenant.
+ * This service provides no request subject or store access. */
+export declare class OutboxEventPublisher extends OutboxEventPublisher_base {
+}
+
+declare const OutboxEventPublisher_base: Context.ServiceClass<OutboxEventPublisher, "@voltro/OutboxEventPublisher", EventPublisher>;
+
+export declare interface OutboxFacade extends OutboxEnqueueFacade {
     /**
      * Re-arm one entry for delivery NOW, on purpose, attributed to the caller.
      *
@@ -8065,25 +8611,9 @@ export declare interface OutboxFacadeDeps {
     readonly now?: () => Date;
 }
 
-export declare interface OutboxHandlerContext {
-    /** Stable identity of this delivery intent, preserved across retries. */
-    readonly outboxId: string;
-    /** Caller-supplied enqueue key, or null. Unlike outboxId this can be reused
-     * for a distinct intent after an earlier intent has been delivered. */
-    readonly idempotencyKey: string | null;
-    readonly payload: Record<string, unknown>;
-    readonly attempt: number;
-    readonly subjectId: string | null;
-    readonly tenantId: string | null;
-    readonly traceId: string | null;
-}
+export { OutboxHandlerContext }
 
-export declare interface OutboxHandlerDefinition<R = never> {
-    readonly effect: string;
-    readonly handler: (ctx: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
-    /** Give up after this many attempts, then dead-letter. Default 8. */
-    readonly maxAttempts?: number;
-}
+export { OutboxHandlerDefinition }
 
 /** What the pump hands events to — the `emit` of a `Stream.asyncScoped`. */
 export declare interface OutboxSink<T> {
@@ -8129,6 +8659,9 @@ export declare interface PairInput {
  */
 export declare const parseApprovalInterval: (spec: string) => number | null;
 
+/** `unity/0.1.0; surface=<64 hex>` → its parts; anything else is not an engine SDK. */
+export declare const parseEngineSdkHeader: (value: string) => Omit<EngineClient, "id" | "connectedAt"> | null;
+
 /** Parse a `traceparent` header. Returns null when malformed or when
  *  the all-zero invalid ids are present (per the spec those are
  *  treated as "no parent"). */
@@ -8333,8 +8866,7 @@ export declare type ProbeKind = 'liveness' | 'readiness' | 'startup';
  *  columns, which have no wire representation at all. */
 export declare const projectConnectionState: (definition: ConnectionDefinition, row: AnyRow_2 | undefined) => ConnectionState_2;
 
-/** Exact-match property filter. Values are AND'd. */
-export declare type PropertyFilter = Readonly<Record<string, string | number | boolean | null>>;
+export { PropertyFilter }
 
 export declare interface ProvenanceActor {
     readonly id: string | null;
@@ -8488,8 +9020,25 @@ export declare interface PumpOptions {
  */
 export declare const pumpOutbox: <T>(outbox: SubscriptionOutbox<T>, sink: OutboxSink<T>, label: string, options?: PumpOptions) => Promise<void>;
 
+/** A query's declared `cache:` block, structurally — see `QueryCacheConfig`. */
+export declare interface QueryCacheLike {
+    readonly ttl: number | string;
+    readonly swr?: number | string | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile?: boolean | undefined;
+}
+
+/** A query's declared `cache:`, parsed — `undefined` when the ttl does not
+ *  parse (the cache is then off for that query; `voltro doctor` says so). */
+export declare const queryCachePolicy: (cache: {
+    readonly ttl: number | string;
+    readonly swr?: number | string | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile?: boolean | undefined;
+}) => ComputedQueryCachePolicy | undefined;
+
 /**
- * The two scopes, composed once, for every path that finalises a descriptor.
+ * The read scopes, composed once, for every path that finalises a descriptor.
  *
  * **The primitives above were extracted so there is "no second copy that could
  * drift" — and then the COMPOSITION became the second copy.** `voltro dev`
@@ -8515,6 +9064,8 @@ export declare const pumpOutbox: <T>(outbox: SubscriptionOutbox<T>, sink: Outbox
 export declare interface QueryFinalizeOptions {
     readonly tenantScopedTables: ReadonlySet<string>;
     readonly softDeleteScopedTables: ReadonlySet<string>;
+    /** Tables carrying expires(); hosts derive this set from the schema registry. */
+    readonly expiresScopedTables?: ReadonlySet<string>;
     readonly observe?: {
         /** Before scoping — sees what the handler asked for. */
         readonly beforeScope?: (descriptor: QueryDescriptor, subject: {
@@ -8532,6 +9083,9 @@ export declare type QueryLike<R = Row_7> = QueryDescriptor<R> | {
 };
 
 export declare interface QueryProducerDeps<D> {
+    readonly workloadMetrics?: ReturnType<typeof makeApiRoleWorkloadMetrics>;
+    /** See {@link ComputedQueryCacheDeps}. */
+    readonly computedCache?: ComputedQueryCacheDeps;
     readonly buildContext: (request: ServeRequestContext) => {
         readonly store: unknown;
     };
@@ -8844,6 +9398,19 @@ export declare interface ReactiveSocketTunables {
  *  (unit tests, a bare library use). */
 export declare const reactiveSocketTunables: () => ReactiveSocketTunables;
 
+/** Bounded exact-incarnation read. Corruption/read failure is raised, never
+ * flattened to no observations. Membership expiry does not delete this history. */
+export declare const readApiRoleWorkloadWindow: (store: DataStore, input: {
+    readonly now: number;
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly requiredWorkloads: ReadonlyArray<ApiWorkload>;
+}) => Promise<{
+    buckets: ApiRoleWorkloadBucket[];
+    assessment: ApiRoleWindowAssessment;
+}>;
+
 export declare interface ReadClassification {
     /** Tables whose ROWS can reach the caller: the queried table and its joins. */
     readonly composed: ReadonlySet<string>;
@@ -8851,6 +9418,14 @@ export declare interface ReadClassification {
     readonly restricting: ReadonlySet<string>;
 }
 
+/** Every recorded lease, live or not. */
+export declare const readFieldKeyHolders: (store: DataStore) => Promise<ReadonlyArray<FieldKeyHolderRecord>>;
+
+export declare const readFieldKeyReports: (store: DataStore) => Promise<FieldKeyReports>;
+
+/** The recorded keys, without decrypting anything. */
+export declare const readFieldKeys: (store: DataStore) => Promise<ReadonlyArray<FieldKeyRow>>;
+
 /** First-or-null for a boot DataStore or a query-only tuple source. It invokes
  * the supplied query path, preserving that path's filters and codecs. A raw
  * driver remains raw; this helper does not add request scoping. */
@@ -8990,6 +9565,12 @@ export declare const recordExternalMissed: (name: string, count?: number) => voi
 
 export declare const recordExternalTrigger: (name: string, outcome: "accepted" | "duplicate" | "noOccurrence" | "ahead" | "notExternal" | "unknownSchedule") => void;
 
+/** One open of a sealed value. `key` opened it (`ok`) or was named by it (`failed`). */
+export declare const recordFieldDecrypt: (key: string, location: string, outcome: "ok" | "failed") => void;
+
+/** Record the last count or re-key — one row per kind, replaced each time. */
+export declare const recordFieldKeyReport: <K extends keyof FieldKeyReports>(store: DataStore, kind: K, report: NonNullable<FieldKeyReports[K]>["report"], at?: Date) => Promise<void>;
+
 /**
  * Record one emitted event into the identity's ring. Snapshots RESET the ring
  * (the snapshot's revision becomes the new replay base — a client holding an
@@ -9120,76 +9701,32 @@ export declare const redactColumns: <R extends Row>(rows: ReadonlyArray<R>, reda
 /** Blank sensitive-looking columns. Returns a new object; null passes through. */
 export declare const redactRow: (row: Row_2 | null | undefined) => Row_2 | null;
 
-/**
- * Options for `redisRywPositionStore`. The store needs TWO Redis
- * connections because `SUBSCRIBE` puts a client in a mode where only
- * (P)SUB / UNSUB / PING / QUIT are valid — sharing one client across
- * writes and the subscribe loop would deadlock. Pass the same client
- * for both unless you've separated them yourself.
- */
+/** Registry-owned command facade and one borrowed Pub/Sub consumer. */
 export declare interface RedisRywOptions {
-    /**
-     * Connection used for SET / DEL / GET fallback writes. Stays in
-     * normal command mode.
-     */
-    readonly client: Redis;
-    /**
-     * Separate connection dedicated to the SUBSCRIBE loop. Pass a fresh
-     * `client.duplicate()` of the main connection; the store does NOT
-     * duplicate internally because callers may want to manage the
-     * subscription connection's lifecycle separately.
-     */
-    readonly subscriber: Redis;
-    /**
-     * Redis key prefix — every entry stores under `${keyPrefix}:<subjectKey>`.
-     * Defaults to `'voltro:ryw'`. Override to namespace per-app when
-     * multiple deployments share a Redis.
-     */
-    readonly keyPrefix?: string;
-    /**
-     * Pub/sub channel name. Defaults to `${keyPrefix}:bus`. All nodes
-     * sharing an RYW state MUST agree on this name.
-     */
+    readonly client: RespClient;
+    readonly pubsub: RedisPubSub;
+    /** Application/environment namespace. Required; never shared implicitly. */
+    readonly keyPrefix: string;
+    /** Defaults to `${keyPrefix}:bus`; all participating processes must agree. */
     readonly channel?: string;
-    /** Clock injection for tests. Defaults to `Date.now`. */
     readonly now?: () => number;
-    /**
-     * Called when a Redis-side error occurs (publish/setex/subscribe
-     * failure). RYW degrades gracefully — local writes still succeed,
-     * other instances just won't see this node's writes until the next
-     * one. Hook for observability; default is a console.warn.
-     */
+    /** Local writes survive remote failures. Failed mutations are never replayed. */
     readonly onError?: (error: unknown, op: 'set' | 'delete' | 'subscribe' | 'parse') => void;
 }
 
+export declare interface RedisRywPositionStore extends RywPositionStore {
+    /** Drain accepted writes and release this consumer, leaving shared sockets open. */
+    readonly close: () => Promise<void>;
+}
+
 /**
- * Build a Redis-backed RYW store. Cross-instance coherent within one
- * round-trip; sync read path against a local mirror that the
- * SUBSCRIBE loop keeps warm. Lifecycle:
- *
- *   - on `set(key, entry)`:
- *       1. write to local map (immediate, sync)
- *       2. fire-and-forget SETEX in Redis with millisecond TTL
- *       3. fire-and-forget PUBLISH on the channel — peers update
- *          their local mirror without round-tripping Redis again
- *   - on `delete(key)`:
- *       1. remove from local map
- *       2. fire-and-forget DEL + PUBLISH
- *   - on `get(key)`:
- *       1. read from local map; lazy-evict if expired
- *
- * The SUBSCRIBE loop receives self-publishes (Redis sends them back
- * to the sender). Each entry carries a `senderId`; the local node
- * filters out its own broadcasts so we don't double-apply.
- *
- * On boot the local mirror is EMPTY. A read for a subject whose write
- * happened on a peer node before this node started will miss the
- * mirror — but `ReplicatedDataStore` falls back to primary on
- * "no position", so the worst-case is "one extra primary read on the
- * very first request that touches a peer-written subject". After that
- * read, this node's own writes propagate normally.
+ * Subscribe before returning. Reads consult only the process-local mirror.
+ * Writes update it synchronously, then enqueue PSETEX/DEL followed by PUBLISH.
+ * Pub/Sub is eventual and cannot replay lost messages or rebuild a new mirror.
+ * A missing position still follows replica routing under fallback and wait;
+ * neither policy establishes cross-process read-your-writes before delivery.
  */
-export declare const redisRywPositionStore: (options: RedisRywOptions) => RywPositionStore;
+export declare const redisRywPositionStore: (options: RedisRywOptions) => Effect.Effect<RedisRywPositionStore, KvError>;
 
 /** `__voltro.undo.redo` — re-apply a previously-undone invocation's forward
  *  changes. Idempotent if not currently undone. */
@@ -9243,7 +9780,15 @@ export declare const registerConnectionStream: (clientId: number, interrupt: ()
  */
 export declare const registerDefaultTupleSource: (source: TupleSource) => boolean;
 
-export declare const registerExternalizedTask: (task: ExternalizedTask) => void;
+/** Process-level callers share the same map even across duplicated modules. */
+export declare const registerExternalizedTask: (task: ExternalizedTask) => (() => void);
+
+/**
+ * Record a key ahead of the deploy that brings it, as `pending`, with its
+ * canary — so the first boot that holds it verifies its material, and the
+ * configuration without it still boots (nothing is sealed under a pending key).
+ */
+export declare const registerFieldKey: (store: DataStore, keyring: FieldKeyring, keyId: string) => Promise<void>;
 
 export { registerRetention }
 
@@ -9340,6 +9885,37 @@ export declare interface RegistryTableLike {
  *  request was. */
 export declare const rehydrateGuards: (serialized: ReadonlyArray<SerializedGuard>) => ReadonlyArray<AnyGuardSpec>;
 
+/**
+ * Re-seal every envelope in one cell that is not under the active key, or
+ * names no key, under the active key and the address it was sealed under.
+ */
+export declare const rekeyCell: (text: string, keyring: FieldKeyring, context: CellContext) => CellRekey;
+
+export declare interface RekeyReport {
+    readonly active: string;
+    readonly locations: ReadonlyArray<LocationRekey>;
+    readonly unreadable: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * Re-key every discovered location under the keyring's active key. With
+ * `dryRun`, count what would change and write nothing.
+ */
+export declare const rekeySealedValues: (dialect: DialectId, keyring: FieldKeyring, declared: Iterable<unknown>, options?: {
+    readonly dryRun?: boolean;
+    readonly onProgress?: (location: LocationRekey) => void;
+    /** Runs between reading a cell and writing it back — where another writer may change it. */
+    readonly beforeWrite?: (cell: {
+        readonly table: string;
+        readonly column: string;
+        readonly rowId: unknown;
+    }) => Effect.Effect<void, unknown, SqlClient.SqlClient>;
+}) => Effect.Effect<{
+    active: string;
+    locations: LocationRekey[];
+    unreadable: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 /** The store slice `applyDeclaredRelations` needs. `columns` is the junction's
  *  DERIVED reference pair — the truth the descriptor's declaration is checked
  *  against before anything is written. */
@@ -9362,6 +9938,9 @@ export declare interface RelationTuple {
     readonly resourceId: string;
 }
 
+/** Give up this process's lease — on shutdown, so nobody waits for it. */
+export declare const releaseFieldKeyHolder: (store: DataStore, holderId: string) => Promise<void>;
+
 /**
  * Release a claim back to `pending` (CAS `fired → pending`) — used when
  * the wake failed, so the next poll retries it (at-least-once wake). The
@@ -9452,6 +10031,7 @@ export declare interface ReplicaSelector {
 }
 
 export declare class ReplicatedDataStore implements DataStore {
+    readonly integrityQuery?: NonNullable<DataStore['integrityQuery']>;
     private readonly primary;
     private readonly replicas;
     private readonly adapter;
@@ -9463,12 +10043,13 @@ export declare class ReplicatedDataStore implements DataStore {
     private readonly health;
     private readonly recordRouting?;
     private readonly now;
+    private closing;
     constructor(options: ReplicatedDataStoreOptions);
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     private routeToReplica;
     private routeWaitMode;
     insert(table: string, row: Row): Promise<Row>;
-    insertMany(table: string, rows: ReadonlyArray<Row>): Promise<ReadonlyArray<Row>>;
+    insertMany(table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions): Promise<ReadonlyArray<Row>>;
     patchJson(table: string, primaryKey: string, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>): Promise<Row | null>;
     update(table: string, primaryKey: string, patch: Readonly<Record<string, unknown>>): Promise<Row | null>;
     delete(table: string, primaryKey: string): Promise<boolean>;
@@ -9493,6 +10074,8 @@ export declare class ReplicatedDataStore implements DataStore {
     injectExternalChange(event: ChangeEvent): void;
     /** Forwarded from the primary — see DataStore.changeScope. */
     get changeScope(): 'local' | 'fleet';
+    /** Drain the RYW consumer before closing every SQL pool; repeated close is shared. */
+    close(gracePeriodMs?: number): Promise<void>;
     private stampPostWrite;
     private emitRouting;
 }
@@ -9574,8 +10157,8 @@ export declare interface ResendOptions {
     readonly attempts?: number;
 }
 
-/** Exported for tests — the warn-once set is process-global by design. */
-export declare const resetComputedQueryCacheWarnings: () => void;
+/** Test seam: back to the boot default. */
+export declare const resetComputedQueryCacheCaptureForTests: () => void;
 
 /** Test/dev-only — clear ALL per-connection state. Don't call from app code. */
 export declare const _resetConnectionCredentialsForTest: () => void;
@@ -9586,6 +10169,9 @@ export declare const resetDetachedForTest: () => void;
 /** Test seams for the tag-cache guard — the cache is module-private otherwise. */
 export declare const resetEventMetricTagCacheForTests: () => void;
 
+/** Test seam. */
+export declare const resetFieldDecryptCountsForTests: () => void;
+
 /** Drop everything recorded. For tests; not called by the runtime. */
 export declare const resetObservedGraph: () => void;
 
@@ -9720,7 +10306,9 @@ export declare interface ResolvedDevice {
  * Walk a query descriptor's eager-load tree and return the FULL set
  * of tables whose changes could affect the resolved snapshot.
  *
- * - For a query without `eager`, returns just `{ descriptor.table }`.
+ * - Includes explicitly declared invalidation sources (`dependentTables`),
+ *   independently of SQL predicates and projections.
+ * - A plain query with no additional sources returns `{ descriptor.table }`.
  * - For each one()/many() relation, adds the target table.
  * - For each manyToMany() relation, adds the through-table AND the
  *   target table (writes to either can shift the resolved set).
@@ -9787,6 +10375,15 @@ export declare interface ResolvedWorkflowCallerContext extends WorkflowCallerCon
     readonly rowFilter: RowFilterScope;
 }
 
+/**
+ * The keyring an environment configures, or `undefined` when it configures no
+ * key at all. Refuses (`FieldKeyringConfigError`, never containing key material)
+ * an unknown or missing active id, a duplicate id, one key under two ids,
+ * `KEY` equal to `_PREVIOUS`, and a `KEY`/`_PREVIOUS` set beside `KEYS` that
+ * `KEYS` does not contain.
+ */
+export declare const resolveFieldKeyring: (env: Readonly<Record<string, string | undefined>>) => FieldKeyringConfig | undefined;
+
 /**
  * Resolve the app's health block against the boot path's own readiness flag.
  *
@@ -10057,6 +10654,15 @@ export { RetentionSpec }
 
 export { retentionTtlMsFromEnv }
 
+/**
+ * Retire a key: nothing may be sealed under it again, and a configuration may
+ * drop it — the boot no longer asks for it. Refused for the active key, a key
+ * nobody recorded, and a key a live process still seals new values under (it
+ * has not adopted the new key yet). Whether VALUES are still sealed under it is
+ * the caller's question to answer first (`voltro secret retire` counts them).
+ */
+export declare const retireFieldKey: (store: DataStore, keyId: string, holder?: Pick<FieldKeyHolder, "now">) => Promise<void>;
+
 /**
  * Drop the ISR cache entries for a path on every `voltro start` replica.
  *
@@ -10364,6 +10970,8 @@ export declare interface RpcConnection {
 
 export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly group: RpcGroup.RpcGroup<Rpcs>;
+    /** Executable RPC surfaces for this replica; omitted retains both transports. */
+    readonly workloadAdmission?: RpcWorkloadAdmission;
     readonly handlersLayer: Layer.Layer<Rpc.ToHandler<Rpcs>>;
     /** Optional handlers layer dedicated to the one-shot HTTP rpc surface
      *  (`POST /rpc`, used by SSR web-router loaders). The HTTP JSON protocol
@@ -10559,6 +11167,14 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly security?: TransportSecurityOptions;
 }
 
+export declare interface RpcWorkloadAdmission {
+    readonly rpc: boolean;
+    readonly subscriptions: boolean;
+    /** Event streams are independent of live query subscriptions. */
+    readonly events?: boolean;
+    readonly routes?: ReadonlyArray<string>;
+}
+
 /**
  * Rules that apply to one change, or an empty list.
  *
@@ -10643,6 +11259,10 @@ export declare const runSingleNodeOrchestrator: (opts: SingleNodeOrchestratorOpt
 export declare const RUNTIME_NAME: "framework-runtime";
 
 export declare interface RuntimeContext {
+    /** Effective incoming Cookie header for server-side signature verification.
+     * Unverified private input; never return, log or persist it. Optional for
+     * internal callers and cookie-less requests. */
+    readonly cookieHeader?: string;
     /** Subscription / call subject — user, API key, service account, or anonymous. */
     readonly subject: Subject;
     /** Trace identifier — the active span's W3C trace id (32 hex) when
@@ -10776,6 +11396,8 @@ export declare interface RywPositionStore {
     delete(subjectKey: string): void;
     /** Approximate size for observability + tests. */
     size(): number;
+    /** Release consumer resources when this store owns any. */
+    readonly close?: () => Promise<void>;
 }
 
 /**
@@ -10948,6 +11570,8 @@ export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<v
 export declare type ScheduleOverlapPolicy = 'skip' | 'queue' | 'parallel';
 
 export declare interface SchedulerDeps {
+    /** Active synchronous handler entry only; never await a Promise inside this measurement. */
+    readonly measureSync?: <A>(run: () => A) => A;
     /** App-owned service environment; the signal interrupts Effect work on timeout. */
     readonly runEffect?: (effect: Extract<ReturnType<ScheduleHandler>, Effect.Effect<unknown, unknown, unknown>>, signal: AbortSignal) => Promise<unknown>;
     readonly store: DataStore;
@@ -11059,6 +11683,8 @@ export declare interface SchedulerDeps {
 }
 
 export declare interface SchedulerHandle {
+    /** Completed startup and shutdown has not begun; not a successful-job claim. */
+    isRunning(): boolean;
     /** Fire a schedule immediately, bypassing the cron clock + the
      *  coordinator. Waits for handler completion and returns the recorded run id. */
     fireNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
@@ -11364,6 +11990,22 @@ declare interface ScopeCtx {
 /** The scope strings a UI shows ("ask someone with …"). */
 export declare const scopeStringsOf: (serialized: ReadonlyArray<SerializedGuard>) => ReadonlyArray<string>;
 
+/** One column that holds envelopes, and what is under which key in it. */
+export declare interface SealedLocation {
+    readonly table: string;
+    readonly column: string;
+    /** The app declares it `.encrypted()` (a whole cell is one value), rather than a place found holding envelopes. */
+    readonly declared: boolean;
+    /** Cells holding at least one envelope. */
+    readonly cells: number;
+    /** Envelopes, counted per key id. */
+    readonly byKey: Readonly<Record<string, number>>;
+    /** Envelopes written before envelopes named their key. */
+    readonly unnamed: number;
+    /** Declared `.encrypted()` only: non-null cells that are not an envelope. */
+    readonly plaintext: number;
+}
+
 export declare interface SecretsBackend {
     /** Resolve a secret by key. `undefined` when absent. */
     readonly get: (key: string) => Promise<string | undefined>;
@@ -11503,6 +12145,8 @@ export declare type SerializedGuard = {
     readonly resource: string | null;
 } | {
     readonly kind: 'authenticated';
+} | {
+    readonly kind: 'upgraded';
 };
 
 /**
@@ -11511,7 +12155,25 @@ export declare type SerializedGuard = {
  */
 export declare const serializeGuards: (guards: ReadonlyArray<AnyGuardSpec>, input: unknown) => ReadonlyArray<SerializedGuard>;
 
+/** Required plugin work executed on the actual transaction connection. */
+export declare type ServeMutationCommitHook = (context: Parameters<ServeRpcInterceptor>[1] & {
+    readonly kind: 'mutation';
+    readonly store: DataStore;
+    readonly output: unknown;
+    readonly outbox?: OutboxEnqueueFacade;
+    readonly startedAt?: number;
+    readonly durationMs?: number;
+}) => Effect.Effect<void, unknown>;
+
 export declare interface ServeRequestContext {
+    /** Listener-owned identity; used only for measurement attribution here. */
+    readonly connection?: {
+        readonly transport: 'http' | 'websocket';
+    };
+    /** Effective incoming Cookie header for server-side signature verification.
+     * Unverified private input; never return, log or persist it. Optional for
+     * internal callers and cookie-less requests. */
+    readonly cookieHeader?: string;
     readonly subject: unknown;
     readonly traceId: string;
     readonly spanId?: string;
@@ -11570,10 +12232,11 @@ export declare const serverOnlyLeaks: (query: AuditableQuery, serverOnlyByTable:
 /** A plugin interceptor — wraps the base run Effect (Effect-native chain). */
 export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown, never>, meta: {
     readonly tag: string;
-    readonly kind: 'mutation' | 'action' | 'query' | 'workflow';
+    readonly kind: 'mutation' | 'action' | 'query' | 'workflow' | 'stream';
     readonly input: unknown;
     readonly subject: unknown;
     readonly traceId: string;
+    readonly enqueueOutcome?: OutboxEnqueueFacade['enqueue'];
     readonly spanId?: string;
     /**
      * The declared write-target TABLE names of this mutation/action, derived
@@ -11785,8 +12448,14 @@ export declare interface SingleNodeOrchestratorOptions {
 export declare interface SnapshotCache {
     readonly wrap: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, compute: () => Promise<ReadonlyArray<Row>>) => Promise<ReadonlyArray<Row>>;
     /** Write-through from the live recompute, so the cache is never staler
-     *  than the freshest live subscriber. Fire-and-forget. */
-    readonly put: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, rows: ReadonlyArray<Row>) => void;
+     *  than the freshest live subscriber. Fire-and-forget. `fence` is the
+     *  cache's invalidation position observed BEFORE the rows were read: a
+     *  later invalidation of any tag voids the write, so an earlier, slower
+     *  read can never overwrite a later one. */
+    readonly put: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, rows: ReadonlyArray<Row>, fence: number) => void;
+    /** The cache's invalidation position — observed before a read whose rows
+     *  will be written through. */
+    readonly fence: () => Promise<number>;
 }
 
 /**
@@ -11798,6 +12467,8 @@ export declare interface SnapshotCacheBinding {
     readonly key: string;
     readonly ttlMs: number;
     readonly swrMs: number | undefined;
+    /** The query name its counters are kept under (`queryStats`, metrics). */
+    readonly label?: string | undefined;
 }
 
 /**
@@ -11809,6 +12480,20 @@ export declare const snapshotCrdt: (store: CrdtHistoryStore, cell: CrdtCellRef &
     readonly createdBy?: string;
 }) => Promise<CrdtVersion | undefined>;
 
+/**
+ * The entry a READ belongs to: the rpc layer's scoped key plus the descriptor
+ * actually read.
+ *
+ * The rpc key names the query, its input and the scope (subject / tenant /
+ * global) — but not what the caller may SEE. A registered row filter makes two
+ * colleagues of one tenant read different rows through the same `'tenant'` key,
+ * and keying by the rpc key alone served the first colleague's filtered rows to
+ * the next one. The read descriptor carries every predicate the caller's
+ * visibility added, so two readers share an entry exactly when they read the
+ * same thing.
+ */
+export declare const snapshotEntryFor: (binding: SnapshotCacheBinding, read: QueryDescriptor) => SnapshotCacheBinding;
+
 /** Snapshot the whole registry, normalized to `MetricSample[]` — plus the
  *  socket-backpressure counters (`subscriptionSocketMetrics.ts`), appended
  *  HERE so every reader (Prometheus exporter, inspect Metrics panel) sees
@@ -11846,32 +12531,23 @@ export declare class SsrfBlockedError extends Error {
  */
 export declare const ssrfGuardHttpClientLayer: (policy?: SsrfPolicy) => Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
 
-export declare interface SsrfPolicy {
-    /**
-     * Hosts that bypass the guard. An entry may be an exact hostname
-     * (`billing.internal`), a suffix wildcard (`*.svc.cluster.local`), or a
-     * host:port (`127.0.0.1:8787`) when only one port should be reachable.
-     *
-     * This is the one escape hatch, and it is deliberately per-HOST rather than a
-     * boolean: "we call one internal service" and "we do not check URLs" are very
-     * different postures, and a boolean cannot tell them apart six months later.
-     */
-    readonly allowHosts?: ReadonlyArray<string>;
-    /** Max redirect hops to follow. Each one is revalidated. Default 5. */
-    readonly maxRedirects?: number;
-}
+export { SsrfPolicy }
+
+export { ssrfReason }
 
 /**
- * Decide whether a URL may be fetched. Returns `null` when allowed, else the
- * reason. Fails CLOSED: a URL that will not parse is blocked.
- *
- * DNS is deliberately NOT resolved — this is a synchronous check on the literal
- * target, so a hostname that RESOLVES to a private address (DNS rebinding) is not
- * caught here. Blocking the direct-IP vector is the high-severity, cheap half;
- * rebinding needs network-layer egress control and is called out in the docs
- * rather than silently implied.
+ * Heartbeat every {@link FIELD_KEY_HEARTBEAT_MS} for as long as the process
+ * runs. Logs a transition once — a key that became active, a key still waiting
+ * and for whom, an active key this process does not hold — never every beat.
  */
-export declare const ssrfReason: (rawUrl: string, policy?: SsrfPolicy) => string | null;
+export declare const startFieldKeyHolder: (store: DataStore, keyring: FieldKeyring, holder: FieldKeyHolder & {
+    readonly intervalMs?: number;
+    readonly log: {
+        readonly info: (message: string) => void;
+        readonly warn: (message: string) => void;
+        readonly error: (message: string) => void;
+    };
+}) => FieldKeyHolderHandle;
 
 /**
  * Start the rpc-based runtime server on Node. Composes:
@@ -12101,6 +12777,12 @@ export declare interface SubscriberDefinition {
     readonly table: string;
     /** Default `'any'`. */
     readonly on?: SubscribeOp | ReadonlyArray<Exclude<SubscribeOp, 'any'>>;
+    /** Bind this invocation's event publisher to the trusted committed row's
+     * tenant. No client input is available here. Omitted keeps system/global
+     * publication. This does not change ctx.store's system identity or turn a
+     * best-effort subscriber into durable delivery. Invalid results refuse the
+     * handler rather than publishing into the global partition. */
+    readonly eventTenant?: (event: SubscribeEvent) => string | null;
     /**
      * Run the handler ONCE PER CHANGE across the whole fleet, instead of once on
      * every replica that sees it.
@@ -12450,7 +13132,7 @@ export declare const tenantSelectionStore: (getStore: () => DataStore | undefine
  *  a page. */
 export declare const TERMINAL_RUN_STATUSES: ReadonlySet<string>;
 
-export declare type TimeBucket = 'minute' | 'hour' | 'day' | 'week' | 'month';
+export { TimeBucket }
 
 export declare interface TimelineEvent {
     /** Preserves the store's warning that images are not original commit images. */
@@ -12516,29 +13198,11 @@ export declare class TimelineRecorder {
     replay(table: string, asOfSeq: number, currentRows: ReadonlyArray<Row_2>): ReadonlyArray<Row_2>;
 }
 
-/** Time window. `to` defaults to now. */
-export declare interface TimeRange {
-    readonly from: Date;
-    readonly to?: Date;
-}
+export { TimeRange }
 
-export declare interface TimeseriesQuery extends AggregateQuery {
-    readonly bucket: TimeBucket;
-}
+export { TimeseriesQuery }
 
-export declare interface TopNQuery {
-    readonly event: string;
-    /** Property to group by (must be a string-valued property). */
-    readonly groupBy: string;
-    readonly metric: 'count' | {
-        readonly sum: string;
-    };
-    readonly n: number;
-    readonly range: TimeRange;
-    readonly filter?: PropertyFilter;
-    /** Tenant scope — injected by `useAnalytics()`; see {@link AggregateQuery.tenantId}. */
-    readonly tenantId?: string | null;
-}
+export { TopNQuery }
 
 /** A row a mutation wrote, carried to rule evaluation. `row` is the POST-WRITE
  *  state (insert result / update result). */
@@ -12990,7 +13654,11 @@ export declare class UndoStack<E> {
  */
 export declare const undoSurfaceEnabled: (env?: Record<string, string | undefined>) => boolean;
 
-export declare const unregisterExternalizedTask: (name: string) => void;
+export declare interface UnreadableColumn {
+    readonly table: string;
+    readonly column: string;
+    readonly reason: string;
+}
 
 /** One `source:` entry that resolves to no declared table. */
 export declare interface UnresolvedSource {
@@ -13003,6 +13671,8 @@ export declare interface UnresolvedSource {
     /** True when the name is in the `channel:` namespace: it named a reactivity
      *  channel nobody declared, which is a different repair from a stale table. */
     readonly channel: boolean;
+    /** Intentionally optional integration observation, retained in source. */
+    readonly optional?: true;
 }
 
 /**
@@ -13014,6 +13684,7 @@ export declare interface UnresolvedSource {
 export declare const unresolvedSources: (procedures: ReadonlyArray<{
     readonly name: string;
     readonly source: string | ReadonlyArray<string> | undefined;
+    readonly optionalSource?: ReadonlyArray<string>;
 }>, declared: ReadonlySet<string>) => ReadonlyArray<UnresolvedSource>;
 
 /** Thrown at boot; the message is the whole point, so it names the path and the
@@ -13095,6 +13766,27 @@ export declare type VerificationDeclared<T> = T & {
     readonly [WEBHOOK_VERIFICATION_PROPERTY]: WebhookVerification;
 };
 
+/**
+ * Check the keyring against the database and record what is new; make the
+ * database's active key the keyring's. Throws {@link FieldKeyringRefusal} when
+ * the keyring cannot read this database's data.
+ *
+ * `tables` are the app's declared tables: a few sealed values per
+ * `.encrypted()` column are opened as a sample, and nothing else is read.
+ */
+export declare const verifyFieldKeyring: (store: DataStore, keyring: FieldKeyring, tables: Iterable<unknown>, holder?: FieldKeyHolder) => Promise<FieldKeyringVerification>;
+
+/** Every location's envelopes, opened with `keyring` — after a re-key, a keyring with the active key alone. */
+export declare const verifySealedValues: (dialect: DialectId, keyring: FieldKeyring, declared: Iterable<unknown>) => Effect.Effect<{
+    opened: number;
+    unopened: {
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }[];
+    unreadable: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 /** The pure core of live revocation: given a subject + action + a row-set,
  *  return ONLY the rows the subject may still see. The reactive matcher calls
  *  this on a permission-changing write and diffs against the prior visible set;
@@ -13172,6 +13864,19 @@ export declare const _voltroConnectionsTable: TableLike;
 
 export declare const _voltroCrdtVersionsTable: TableLike;
 
+/** The leases: which process holds which keys, and until when it counts —
+ *  rewritten by every heartbeat, so not reactive. */
+export declare const _voltroFieldKeyHoldersTable: TableLike;
+
+/** The last count and the last re-key `voltro secret status` / `rekey` / `rotate`
+ *  ran — what the Governance panel shows as a rotation's progress, since the
+ *  app itself never scans every sealed value. Counts and locations, never a value. */
+export declare const _voltroFieldKeyReportsTable: TableLike;
+
+/** Each field-encryption key id's state and canary — a framework table, created for every app.
+ *  Declared by its literal name: the data-transfer classification guard reads declarations. */
+export declare const _voltroFieldKeysTable: TableLike;
+
 /** `_voltro_rebac_tuples` — the relationship tuples `can()` reads. One row =
  *  "`subjectId` has `relation` on `<resourceType>:<resourceId>`". Grant by
  *  inserting; revoke by deleting (a delete is the live-revocation trigger). */
@@ -13341,6 +14046,14 @@ export declare type WhereOp = '=' | '!=' | '<>' | '>' | '>=' | '<' | '<=' | 'in'
 
 export declare const withRowFilter: <R extends ServeRequestContext>(request: R) => Promise<R>;
 
+/**
+ * Add the shared RPC auth pair once to an undecorated group. Authentication
+ * runs before ConnectionInfo captures this call's verified credential lifetime.
+ * Groups already carrying either middleware are refused: Effect preserves Set
+ * insertion order, so appending a duplicate cannot repair an existing order.
+ */
+export declare const withRpcAuthMiddleware: <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) => RpcGroup.RpcGroup<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof ConnectionInfoMiddleware>, typeof AuthMiddleware>>;
+
 /**
  * Run `body` against a request that carries a resolved row-filter scope.
  *
@@ -13511,6 +14224,15 @@ export declare interface WorkflowEventTriggerResult {
     readonly reason?: string;
 }
 
+export declare interface WorkflowExecutionRefusal {
+    readonly workflowName: string;
+    readonly executionId: string;
+    readonly payload: unknown;
+    readonly cause: Cause.Cause<unknown>;
+    /** Restored identity and host-owned placement; no resolved permissions. */
+    readonly callerContext: WorkflowCallerContext;
+}
+
 export declare interface WorkflowFacadeOptions {
     readonly cancelQueued?: (input: WorkflowQueuedControlTarget & {
         readonly callerContext: WorkflowCallerContext | undefined;
@@ -13652,13 +14374,18 @@ export declare interface WorkflowLayerOptions<Context> {
      * whose business logic said no.
      */
     readonly resolveAuthority?: (identity: unknown) => Promise<unknown>;
+    /** Record a known caller's refusal through the host's ordinary resident run
+     * recorder. Called before application context/body construction. The failed
+     * attempt stays failed, even if this hook completes successfully. Missing
+     * caller identity cannot fabricate a tenant or a first-run record. */
+    readonly onExecutionRefusal?: (refusal: WorkflowExecutionRefusal) => Effect.Effect<unknown, unknown, unknown>;
     /**
      * Told when an execution is refused BEFORE its body — the start context
      * could not be resolved, the identity was missing, the authority or row
      * filter resolver rejected. The engine already fails the attempt; what a
-     * discarded start does NOT do is tell anyone, and a run refused here has no
-     * row yet, so nothing else can. Measured: an acknowledged start whose
-     * resident context was filed under another id died with a debug-level
+     * discarded start does NOT do is tell anyone. A first start may have no
+     * row yet; a resumed run may still have a running row. Measured: an
+     * acknowledged start whose resident context was filed under another id died with a debug-level
      * "Fiber terminated" and nothing else. Hosts wire this to an error log.
      */
     readonly reportExecutionRefusal?: (refusal: {
@@ -13899,7 +14626,7 @@ export declare interface WorkflowsAppContext {
      *  execution, or never to run — read once, without waiting. A queued handle
      *  is resolved through its durable receipt, so the answer survives the
      *  process that recorded the handle. */
-    readStart(handle: WorkflowRunHandle, options?: Pick<WorkflowWaitOptions, 'callerContext'>): Promise<WorkflowStartObservation>;
+    readStart(handle: WorkflowRunHandle, options?: WorkflowRunOptions): Promise<WorkflowStartObservation>;
     /**
      * Set on the facade a mutation TRANSACTION hands out: every start it records
      * is provisional until the transaction commits, so nothing about a start can
@@ -14037,6 +14764,7 @@ export declare interface WorkflowStartOptions {
 }
 
 export declare interface WorkflowStartRunnerDeps {
+    readonly outcomeOutbox?: MutationRunnerDeps['outcomeOutbox'];
     /** Composed plugin workflow-interceptor (`interceptWorkflow`). */
     readonly interceptor?: ServeRpcInterceptor;
     readonly recordMetric?: MutationRunnerDeps['recordMetric'];
@@ -14081,6 +14809,10 @@ export declare const wrapStoreWithBootCodec: (underlying: DataStore, dialectId:
 
 export declare const wrapStoreWithMixinBehaviour: (rawUnderlying: DataStore, ctx: StoreMiddlewareContext) => FluentStore;
 
+/** Writer errors propagate to the publisher, which owns retry/logging. A failed
+ * history write must not be mistaken for a successfully recorded zero bucket. */
+export declare const writeApiRoleWorkloadBucket: (store: DataStore, bucket: ApiRoleWorkloadBucket) => Promise<void>;
+
 export declare const writeReplicaObservation: (store: DataStore, kind: ReplicaObservationKind, payload: unknown) => Promise<void>;
 
 export { }