@voltro/runtime 0.86.0 → 0.87.0

package/dist/index.d.ts

@@ -1,11 +1,31 @@
+import { AggregateQuery } from '@voltro/kv/analytics';
+import { AnalyticsBucket } from '@voltro/kv/analytics';
+import { AnalyticsCapabilityNotSupported } from '@voltro/kv/analytics';
+import { AnalyticsError } from '@voltro/kv/analytics';
+import { AnalyticsEvent } from '@voltro/kv/analytics';
+import { AnalyticsFailure } from '@voltro/kv/analytics';
+import { AnalyticsMetric } from '@voltro/kv/analytics';
+import { AnalyticsMirrorImpl } from '@voltro/kv/analytics';
+import { AnalyticsMirrorRemove } from '@voltro/kv/analytics';
+import { AnalyticsMirrorUpsert } from '@voltro/kv/analytics';
+import { AnalyticsSinkImpl } from '@voltro/kv/analytics';
+import { AnalyticsSinkInfo } from '@voltro/kv/analytics';
+import { AnalyticsTopEntry } from '@voltro/kv/analytics';
 import { AnyApprovalPolicy } from '@voltro/protocol';
 import { AnyCheckSpec } from '@voltro/protocol';
 import { AnyGuardSpec } from '@voltro/protocol';
+import { ApiRoleWindowAssessment } from '@voltro/protocol';
+import { ApiWorkload } from '@voltro/protocol';
 import { AuthMiddleware } from '@voltro/protocol';
 import { AuthStrategy } from '@voltro/protocol';
+import { canonicalJson } from '@voltro/protocol';
 import { CaughtUpVerdict } from '@voltro/database';
 import { Cause } from 'effect';
 import { ChangeEvent } from '@voltro/database';
+import { CircuitBreaker } from '@voltro/shared';
+import { CircuitBreakerOptions } from '@voltro/shared';
+import { CircuitOpen } from '@voltro/shared';
+import { CircuitState } from '@voltro/shared';
 import { classifyConstraintViolation } from '@voltro/database';
 import { clearRetentions } from '@voltro/database';
 import { ColumnBuilder } from '@voltro/database';
@@ -28,9 +48,9 @@ import { DeclaredAccess } from '@voltro/protocol';
 import { DialectId } from '@voltro/database';
 import { DialectReplicationAdapter } from '@voltro/database';
 import { Duplex } from 'node:stream';
-import { Duration } from 'effect';
 import { Effect } from 'effect';
 import { EnqueueOptions } from '@voltro/protocol';
+import { EventClientPolicy } from '@voltro/protocol';
 import { EventDeliverySemantics } from '@voltro/protocol';
 import { EventDescriptor } from '@voltro/protocol';
 import { EventKeyInvalid } from '@voltro/protocol';
@@ -55,6 +75,7 @@ import { InferRow } from '@voltro/database';
 import { InMemoryMetricExporter } from '@opentelemetry/sdk-metrics';
 import { InMemorySpanExporter } from '@opentelemetry/sdk-trace-base';
 import { InsertIgnoreResult } from '@voltro/database';
+import { InsertManyOptions } from '@voltro/database';
 import { InspectedStep } from '@voltro/workflow';
 import { InspectedWorkflow } from '@voltro/workflow';
 import { InspectStore } from '@voltro/workflow';
@@ -62,6 +83,7 @@ import { inspectWorkflow } from '@voltro/workflow';
 import { isForeignKeyViolation } from '@voltro/database';
 import { isQueryTimeout } from '@voltro/database';
 import { Kv } from '@voltro/kv';
+import { KvError } from '@voltro/kv';
 import { KvStoreShape } from '@voltro/kv';
 import { Layer } from 'effect';
 import { listRetentionConflicts } from '@voltro/database';
@@ -69,9 +91,12 @@ import { listRetentions } from '@voltro/database';
 import { Membership } from '@voltro/protocol';
 import { Metric } from 'effect';
 import { MetricReader } from '@opentelemetry/sdk-metrics';
+import { MirrorVersion } from '@voltro/kv/analytics';
 import { MutationIdempotencyScope } from '@voltro/protocol';
+import { newTraceId } from '@voltro/shared';
 import { NoRowFound } from '@voltro/protocol';
 import { NoSuchResource } from '@voltro/protocol';
+import { Option } from 'effect';
 import { OutboxEnqueueFacade } from '@voltro/protocol';
 import { OutboxHandlerContext } from '@voltro/protocol';
 import { OutboxHandlerDefinition } from '@voltro/protocol';
@@ -81,13 +106,16 @@ import { PluginHttpRouteByteStream } from '@voltro/protocol';
 import { PluginRefOrphanPolicy } from '@voltro/database';
 import { Predicate } from '@voltro/database';
 import { ProcedureWireError } from '@voltro/protocol';
+import { PropertyFilter } from '@voltro/kv/analytics';
 import { PublicApiSpec } from '@voltro/protocol';
 import { Query } from '@voltro/database';
 import { QueryDescriptor } from '@voltro/database';
-import { Redis } from 'ioredis';
+import { RedisPubSub } from '@voltro/kv/connection';
 import { registerRetention } from '@voltro/database';
 import { RequestedTenantRefused } from '@voltro/protocol';
 import { ResourceMissing } from '@voltro/protocol';
+import { RespClient } from '@voltro/kv/connection';
+import { RespConnections } from '@voltro/kv/connection';
 import { RestRouteDescriptor } from '@voltro/protocol/rest';
 import { RetentionConflict } from '@voltro/database';
 import { RetentionSource } from '@voltro/database';
@@ -99,6 +127,7 @@ import { RowPatch } from '@voltro/protocol';
 import { Rpc } from 'effect/rpc';
 import { RpcGroup } from 'effect/rpc';
 import { RpcInterceptor } from '@voltro/protocol';
+import { RpcReplayAuthorityBinding } from '@voltro/protocol';
 import { RuleReadStore } from '@voltro/database';
 import { Sampler } from '@opentelemetry/sdk-trace-base';
 import { Schedule } from 'effect';
@@ -110,6 +139,9 @@ import { ServerResponse } from 'node:http';
 import { SpanProcessor } from '@opentelemetry/sdk-trace-base';
 import { spawn } from 'node:child_process';
 import { SqlClient } from 'effect/sql';
+import { SqlError } from 'effect/sql/SqlError';
+import { SsrfPolicy } from '@voltro/protocol';
+import { ssrfReason } from '@voltro/protocol';
 import { StoredTableShape } from '@voltro/database';
 import { StoreError } from '@voltro/protocol';
 import { StoreOperationFailed } from '@voltro/protocol';
@@ -130,6 +162,10 @@ import { TenantRowNotFound } from '@voltro/protocol';
 import { TenantScopeViolation } from '@voltro/protocol';
 import { tenantSelectionId } from '@voltro/database';
 import { TenantSelectionStore } from '@voltro/protocol';
+import { TimeBucket } from '@voltro/kv/analytics';
+import { TimeRange } from '@voltro/kv/analytics';
+import { TimeseriesQuery } from '@voltro/kv/analytics';
+import { TopNQuery } from '@voltro/kv/analytics';
 import { Tracer } from 'effect';
 import { Unauthenticated } from '@voltro/protocol';
 import { UpsertOptions } from '@voltro/database';
@@ -172,6 +208,8 @@ declare const AccessDenied_base: Schema.Class<AccessDenied, Schema.TaggedStruct<
 export declare const actingUserId: (subject: StoreMiddlewareContext["subject"]) => string | null;
 
 export declare interface ActionRunnerDeps {
+    /** Measures only the synchronous executor entry, never an awaited result. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly outcomeOutbox?: MutationRunnerDeps['outcomeOutbox'];
     /** Build the per-call `AppContext` — NO transactional tx (actions do
      *  external I/O and run outside a txn deliberately). */
@@ -183,8 +221,23 @@ export declare interface ActionRunnerDeps {
     readonly recordMetric?: MutationRunnerDeps['recordMetric'];
     /** See {@link MutationRunnerDeps.defaultDeny} — same flag, same refusal. */
     readonly defaultDeny?: boolean;
+    /** See {@link MutationRunnerDeps.settleCacheInvalidations} — an action's
+     *  writes are the writer's too. */
+    readonly settleCacheInvalidations?: () => Promise<void>;
 }
 
+/**
+ * Make a key active NOW, without waiting for every live process to hold it —
+ * for a key replacing a leaked one, where waiting is the larger risk. The
+ * processes that lack it are returned: they cannot read what is sealed under
+ * it until they are redeployed with it, and each says so on its heartbeat.
+ */
+export declare const activateFieldKeyNow: (store: DataStore, keyId: string, holder?: Pick<FieldKeyHolder, "now">) => Promise<{
+    readonly from: string | undefined;
+    readonly to: string;
+    readonly lacking: ReadonlyArray<string>;
+}>;
+
 /**
  * Live activity counters the runtime exposes to the idle detector. All
  * return the CURRENT count (0 = quiescent on that axis).
@@ -455,20 +508,7 @@ declare const AggregateNotFound_base: Schema.Class<AggregateNotFound, Schema.Tag
     readonly name: Schema.String;
 }>, YieldableError>;
 
-export declare interface AggregateQuery {
-    readonly event: string;
-    readonly filter?: PropertyFilter;
-    readonly metric: AnalyticsMetric;
-    readonly range: TimeRange;
-    /**
-     * Restrict the read to one tenant's events. `useAnalytics()` injects the
-     * caller's `subject.tenantId` automatically, so handler code never sets
-     * this; a sink that honours it (e.g. analytics-postgres) then AND-filters
-     * by tenant so a query can't read across tenants. `null`/absent = unscoped
-     * (system/cross-tenant read).
-     */
-    readonly tenantId?: string | null;
-}
+export { AggregateQuery }
 
 export declare interface AggregateReadOptions {
     /**
@@ -477,11 +517,14 @@ export declare interface AggregateReadOptions {
      * Without it an aggregate can only ever be "the one global roll-up", so every
      * tenant-/team-/year-scoped roll-up (most real ones) has to stay client-side.
      * A row matches when EVERY entry matches: a scalar compares by strict
-     * equality, an array means "one of" (an IN set).
+     * equality, an array means "one of" (an IN set), and an object of `gte` /
+     * `gt` / `lte` / `lt` is a range on that column (a `Date` bound compares
+     * with `Date` and ISO-string values by instant; `null` never matches).
      *
      * ```ts
      * yield* handle.read({ where: { teamId, year: 2026 } })
      * yield* handle.read({ where: { status: ['open', 'blocked'] } })
+     * yield* handle.read({ where: { teamId, day: { gte: from, lte: to } } })
      * ```
      *
      * Deliberately DATA, not a predicate function: it stays serializable, so the
@@ -557,71 +600,17 @@ declare const AggregateStale_base: Schema.Class<AggregateStale, Schema.TaggedStr
     readonly maxAgeMs: Schema.Number;
 }>, YieldableError>;
 
-export declare interface AnalyticsBucket {
-    readonly bucketStart: Date;
-    readonly value: number;
-}
+export { AnalyticsBucket }
 
-/**
- * The sink doesn't implement this capability. PostHog returns this
- * for `aggregate`/`timeseries`/`topN`. Callers typically
- * `Effect.catchTag('AnalyticsCapabilityNotSupported', ...)` to fall
- * back to a different sink or report the missing feature.
- */
-export declare class AnalyticsCapabilityNotSupported extends AnalyticsCapabilityNotSupported_base {
-}
+export { AnalyticsCapabilityNotSupported }
 
-declare const AnalyticsCapabilityNotSupported_base: Schema.Class<AnalyticsCapabilityNotSupported, Schema.TaggedStruct<"AnalyticsCapabilityNotSupported", {
-    readonly provider: Schema.String;
-    readonly capability: Schema.String;
-}>, YieldableError>;
+export { AnalyticsError }
 
-/**
- * The underlying sink raised an error. `cause` is stringified for
- * round-trip safety across the rpc boundary.
- */
-export declare class AnalyticsError extends AnalyticsError_base {
-}
+export { AnalyticsEvent }
 
-declare const AnalyticsError_base: Schema.Class<AnalyticsError, Schema.TaggedStruct<"AnalyticsError", {
-    readonly provider: Schema.String;
-    readonly operation: Schema.String;
-    readonly cause: Schema.String;
-}>, YieldableError>;
+export { AnalyticsFailure }
 
-/**
- * One analytics event. `properties` must be JSON-serialisable —
- * individual sinks validate at write time (Postgres stores as JSONB;
- * ClickHouse encodes as a JSON string; PostHog forwards verbatim).
- */
-export declare interface AnalyticsEvent {
-    /** Event name (e.g. `'match_completed'`, `'page_viewed'`). */
-    readonly name: string;
-    /** Subject id (typically `ctx.request.subject.id`) — anonymous when null. */
-    readonly subjectId?: string | null;
-    /**
-     * Owning tenant. Normally you DON'T set this by hand — `useAnalytics()`
-     * stamps it from the caller's `subject.tenantId` so every event is
-     * tenant-attributable + every read is tenant-scoped (the multi-tenant
-     * isolation default). Set it explicitly only for a cross-tenant system
-     * write. `null` = no tenant (system/anonymous).
-     */
-    readonly tenantId?: string | null;
-    /** Property bag. Values must be JSON-serialisable. */
-    readonly properties: Readonly<Record<string, unknown>>;
-    /** When the event occurred. Defaults to server-now when omitted. */
-    readonly occurredAt?: Date;
-}
-
-export declare type AnalyticsFailure = AnalyticsError | AnalyticsCapabilityNotSupported;
-
-/** Metric to compute. `count` = row count, `unique` = distinct subjectId,
- *  `sum` / `avg` = numeric aggregation on a property field. */
-export declare type AnalyticsMetric = 'count' | 'unique' | {
-    readonly sum: string;
-} | {
-    readonly avg: string;
-};
+export { AnalyticsMetric }
 
 export declare interface AnalyticsMirrorHandle {
     /** Tables actually being mirrored (the sink's `mirror.tables`). Empty
@@ -643,68 +632,9 @@ export declare interface AnalyticsMirrorHandle {
     readonly stats: () => AnalyticsMirrorStats;
 }
 
-/**
- * Optional CDC-mirror capability. A sink that declares `mirror` opts in
- * to receiving the main DataStore's reactive-table changes, so
- * analytical queries can JOIN warehouse events against live user data
- * (`SELECT … FROM voltro_events e JOIN users u ON …`).
- *
- * The framework subscribes to `DataStore.onChange` once at boot, filters
- * to the tables the sink lists in `tables`, and routes each change here.
- * Inserts/updates `upsert` by primary key; deletes `remove`. Every call
- * MUST be idempotent — the same change may be re-delivered after a
- * reconnect, and the upsert is keyed on `primaryKey` so re-applying a
- * row is a no-op-equivalent overwrite.
- *
- * Idempotent is not enough on its own: re-delivery can also arrive OUT
- * OF ORDER, so both methods additionally receive a {@link MirrorVersion}
- * and MUST ignore a write whose version is not greater than the version
- * already stored for that key (ClickHouse gets this from
- * `ReplacingMergeTree(version)`; DuckDB from an `ON CONFLICT … WHERE
- * excluded.version > version` guard).
- */
-export declare interface AnalyticsMirrorImpl {
-    /** Reactive tables this sink mirrors. The framework only forwards
-     *  changes whose `table` is in this set. */
-    readonly tables: ReadonlyArray<string>;
-    /** Primary-key column the sink upserts/deletes by. Defaults to `'id'`
-     *  when omitted. */
-    readonly primaryKey?: string;
-    /** Apply an insert/update. Idempotent upsert keyed on `primaryKey`,
-     *  version-guarded by `write.version`. */
-    readonly upsert: (write: AnalyticsMirrorUpsert) => Effect.Effect<void, AnalyticsFailure>;
-    /** Apply a delete. Idempotent — removing an absent key is a no-op —
-     *  and version-guarded by `write.version`. */
-    readonly remove: (write: AnalyticsMirrorRemove) => Effect.Effect<void, AnalyticsFailure>;
-    /**
-     * The highest version this sink has PERSISTED for one key — `null` when
-     * the key has never been written (a tombstoned key still reports its
-     * tombstone's version; both warehouse sinks keep tombstones for exactly
-     * this reason).
-     *
-     * This is the fleet-scope seed read: a replica that joins mid-stream has
-     * no per-key history of its own, so before its first write to a key it
-     * asks the warehouse where the fleet already is and continues from
-     * there. Without it a joiner would restart the key's versions low and
-     * every write it produced would be silently rejected by the sink's own
-     * `version >` guard. Called at most once per key per process (off the
-     * commit path, inside the per-key drain worker), never per change.
-     */
-    readonly maxVersion: (input: {
-        readonly table: string;
-        readonly primaryKeyValue: unknown;
-    }) => Effect.Effect<MirrorVersion | null, AnalyticsFailure>;
-}
+export { AnalyticsMirrorImpl }
 
-/** One delete to apply to the mirror. */
-export declare interface AnalyticsMirrorRemove {
-    readonly table: string;
-    /** Primary-key value of the removed row. */
-    readonly primaryKeyValue: unknown;
-    /** See {@link MirrorVersion}. A delete is ordered against upserts of
-     *  the same key by exactly this number. */
-    readonly version: MirrorVersion;
-}
+export { AnalyticsMirrorRemove }
 
 /** Counters a caller (boot log, inspect endpoint, test) can read. */
 export declare interface AnalyticsMirrorStats {
@@ -765,15 +695,7 @@ export declare interface AnalyticsMirrorTunables {
     readonly versionStateLimit: number;
 }
 
-/** One insert/update to apply to the mirror. */
-export declare interface AnalyticsMirrorUpsert {
-    readonly table: string;
-    /** Post-image of the changed row. */
-    readonly row: Readonly<Record<string, unknown>>;
-    /** See {@link MirrorVersion} — persist it, compare against it, never
-     *  replace it with a local clock reading. */
-    readonly version: MirrorVersion;
-}
+export { AnalyticsMirrorUpsert }
 
 /**
  * Context.Tag the framework provides at runtime. Handlers grab it via
@@ -787,50 +709,14 @@ export declare class AnalyticsSink extends AnalyticsSink_base {
 
 declare const AnalyticsSink_base: Context.ServiceClass<AnalyticsSink, "@voltro/AnalyticsSink", AnalyticsSinkImpl>;
 
-/**
- * The runtime contract every analytics provider implements. Plugins
- * build a value of this shape inside their factory function and the
- * framework wires it under `AnalyticsSink` for handler code to consume.
- */
-export declare interface AnalyticsSinkImpl {
-    readonly info: AnalyticsSinkInfo;
-    readonly track: (event: AnalyticsEvent) => Effect.Effect<void, AnalyticsFailure>;
-    readonly aggregate: (query: AggregateQuery) => Effect.Effect<number, AnalyticsFailure>;
-    readonly timeseries: (query: TimeseriesQuery) => Effect.Effect<ReadonlyArray<AnalyticsBucket>, AnalyticsFailure>;
-    readonly topN: (query: TopNQuery) => Effect.Effect<ReadonlyArray<AnalyticsTopEntry>, AnalyticsFailure>;
-    /**
-     * Present when the sink mirrors reactive tables (opt-in via the
-     * plugin's `mirrorTables` config). Absent → no mirroring; the
-     * framework skips wiring `DataStore.onChange` for this sink.
-     */
-    readonly mirror?: AnalyticsMirrorImpl;
-}
+export { AnalyticsSinkImpl }
 
-/**
- * Per-sink metadata surfaced via the manifest endpoint + dashboard.
- * Lets the operator see at a glance which provider is wired + what
- * it supports without grepping app.config.ts.
- */
-export declare interface AnalyticsSinkInfo {
-    readonly provider: string;
-    readonly capabilities: {
-        readonly track: boolean;
-        readonly aggregate: boolean;
-        readonly timeseries: boolean;
-        readonly topN: boolean;
-        /** True when the sink mirrors reactive tables into the warehouse so
-         *  analytical queries can JOIN events against live user data. */
-        readonly mirror: boolean;
-    };
-    /** Optional plugin-supplied detail (`{ ingestBufferDepth: 42 }`,
-     *  `{ url: 'https://eu.posthog.com' }`, etc.) — surfaced verbatim. */
-    readonly detail?: Readonly<Record<string, unknown>>;
-}
+export { AnalyticsSinkInfo }
 
 /**
  * What a plugin factory returns at app.config.ts time. The framework
  * boot path reads `apiConfig.analytics` (an `AnalyticsSinkSpec`), calls
- * `spec.build(sqlClient)` to materialise the `AnalyticsSinkImpl`, and
+ * the dependency-specific `spec.build` to materialise the `AnalyticsSinkImpl`, and
  * provides it under the `AnalyticsSink` Tag.
  *
  * Specs can declare `tables` to merge into the framework's schema
@@ -839,16 +725,10 @@ export declare interface AnalyticsSinkInfo {
  * sink is wired but BEFORE rpc routes open (handshakes, dependency
  * pings, batch-buffer warmups).
  */
-export declare interface AnalyticsSinkSpec {
+declare interface AnalyticsSinkLifecycle {
     /** Discriminator surfaced in boot logs + inspect ('postgres-analytics',
      *  'duckdb', 'clickhouse', 'tinybird', 'posthog', 'compose', 'noop'). */
     readonly kind: string;
-    /**
-     * Materialise the sink at boot. Receives the framework's SqlClient
-     * (bound to the main DataStore by default). Plugins that don't need
-     * SqlClient ignore the argument.
-     */
-    readonly build: (sqlClient: SqlClient.SqlClient) => AnalyticsSinkImpl;
     /** Optional schema tables the framework should create on first boot.
      *  Erased to `unknown` — the framework only forwards them to the
      *  schema applier, which accepts opaque table descriptors. */
@@ -871,10 +751,16 @@ export declare interface AnalyticsSinkSpec {
     readonly dispose?: (impl: AnalyticsSinkImpl) => Effect.Effect<void, never>;
 }
 
-export declare interface AnalyticsTopEntry {
-    readonly key: string;
-    readonly value: number;
-}
+/** Explicit SQL dependency: independent sinks boot without an application SQL store. */
+export declare type AnalyticsSinkSpec = AnalyticsSinkLifecycle & ({
+    readonly sql: 'required';
+    readonly build: (sqlClient: SqlClient.SqlClient) => AnalyticsSinkImpl;
+} | {
+    readonly sql: 'none';
+    readonly build: () => AnalyticsSinkImpl;
+});
+
+export { AnalyticsTopEntry }
 
 /**
  * Answer one probe.
@@ -914,6 +800,12 @@ export declare const API_CSP = "default-src 'none'; frame-ancestors 'none'; base
 
 export declare const API_KEYS_TABLE = "_voltro_api_keys";
 
+export declare const API_ROLE_BUCKET_MS: number;
+
+export declare const API_ROLE_WINDOW_MS: number;
+
+export declare const API_ROLE_WORKLOAD_BUCKETS_TABLE = "_voltro_api_role_workload_buckets";
+
 /** Caller side: the token this app presents to the api it binds as `name`. */
 export declare const apiBindingTokenEnv: (name: string) => string;
 
@@ -1097,6 +989,29 @@ export declare interface ApiKeyUsageDelta {
     readonly lastUsedAt: number;
 }
 
+/** A process can select multiple roles. Attribute once to the canonical role set,
+ * never once per role (which would multiply the observed loop time). */
+export declare const apiRoleMetricLabel: (roles: ReadonlyArray<string>) => string;
+
+export { ApiRoleWindowAssessment }
+
+/** Persist one finalized five-minute interval per process incarnation. Seconds
+ * are exclusive active-loop increments, NOT cumulative counter snapshots. */
+export declare interface ApiRoleWorkloadBucket {
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly from: number;
+    readonly until: number;
+    /** Only actual continuous observation can set this true. */
+    readonly continuous: boolean;
+    /** Each required workload must have explicit complete coverage and a value. */
+    readonly workloads: Readonly<Partial<Record<ApiWorkload, {
+        readonly coverage: 'partial' | 'complete';
+        readonly seconds: number;
+    }>>>;
+}
+
 /**
  * Typed authorization slice on `ctx.access` — the ergonomic, cast-free face of
  * the caller's EFFECTIVE scope set (raw subject scopes ∪ rbac role-derived
@@ -1510,6 +1425,18 @@ export declare const assertWebhookRoutesDeclareVerification: (routes: ReadonlyMa
     readonly handle: unknown;
 }> | undefined) => void;
 
+/** Last 24 COMPLETED hours in five-minute buckets (at most five minutes behind
+ * now). Never interpolate a partial boundary bucket or merge process restarts.
+ * Doctor and panels consume this same decision; unknown work is never zero. */
+export declare const assessApiRoleWorkloadWindow: (input: {
+    readonly now: number;
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly requiredWorkloads: ReadonlyArray<ApiWorkload>;
+    readonly buckets: ReadonlyArray<ApiRoleWorkloadBucket>;
+}) => ApiRoleWindowAssessment;
+
 /**
  * Assign a subject to a variant — STABLE (same subject ⇒ same variant, always)
  * and BALANCED (proportions converge to the weights over many subjects). The
@@ -1820,9 +1747,12 @@ export declare interface BindEventInput {
      * this bridge must treat it as "no check", not as a guard.
      */
     readonly guards?: DeclaredAccess<unknown> | undefined;
+    /** The descriptor requirement and captured app policy must match exactly. */
+    readonly requiredClientPolicy?: string;
+    readonly clientPolicy?: EventClientPolicy;
 }
 
-export declare const bindMutation: <Input, Output, E = never>(execute: (input: Input, context: RuntimeContext) => Output | Promise<Output> | Effect.Effect<Output, E, never>, input: Input, spanName?: string, codec?: MutationOutputCodec<unknown>, idempotency?: IdempotencyBinding, 
+export declare const bindMutation: <Input, Output, E = never>(execute: (input: Input, context: RuntimeContext) => Output | Promise<Output> | Effect.Effect<Output, E, never>, input: Input, spanName?: string, codec?: MutationCodec<unknown>, idempotency?: IdempotencyBinding, 
 /**
  * This procedure's DECLARED error union (`descriptor.error`).
  *
@@ -1874,7 +1804,12 @@ guards?: ReadonlyArray<unknown> | undefined,
  *  (`{ scope: 'x:read', from: 'id' }`) can see which resource was asked for.
  *  Passed explicitly rather than read off RuntimeContext, which does not
  *  carry it. */
-guardInput?: unknown) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
+guardInput?: unknown, 
+/** Plugin admission wraps construction once; element guards remain live. */
+admission?: {
+    readonly tag: string;
+    readonly interceptor?: ServeRpcInterceptor | undefined;
+}) => Stream.Stream<Element, Err, SubjectService | ConnectionInfo>;
 
 /**
  * Build a `Stream<SubscriptionEvent<T>>` that an effect/rpc streaming
@@ -1961,6 +1896,16 @@ export declare interface BootListener {
      *  Installed by the boot path when its store exists, which is after the
      *  bind; an app-declared `health.readiness` replaces the whole check. */
     readonly setDependencyPing: (ping: () => Promise<boolean>) => void;
+    /** Required local runtime conditions, independent of app dependency policy.
+     * Checks must be synchronous and cheap. Release removes only this registration. */
+    /** Enable structured API health using captured role/workload identities. */
+    readonly setRoleHealth: (identity: {
+        readonly roles: ReadonlyArray<string>;
+        readonly workloads: ReadonlyArray<string>;
+    }) => void;
+    readonly addReadinessGate: (name: string, check: () => boolean) => () => void;
+    /** Required local progress conditions. App liveness cannot bypass these gates. */
+    readonly addLivenessGate: (name: string, check: () => boolean) => () => void;
     /** Close the socket. Resolves once node reports the listener closed. */
     readonly close: () => Promise<void>;
 }
@@ -2055,6 +2000,40 @@ export declare const buildTracingLayer: (options?: TracingOptions) => Promise<Tr
  *  hit on every read. `now` injectable for tests. */
 export declare const cachedBackend: (backend: SecretsBackend, ttlMs?: number, now?: () => number) => SecretsBackend;
 
+export declare const cachedComputedCall: (args: CachedComputedCallArgs) => Effect.Effect<CachedComputedResult, unknown, never>;
+
+declare interface CachedComputedCallArgs {
+    readonly cache: ComputedQueryCacheDeps;
+    readonly policy: ComputedQueryCachePolicy;
+    readonly key: string;
+    readonly name: string;
+    readonly sources: ReadonlyArray<string>;
+    readonly output: Schema.Top | undefined;
+    readonly subject: object;
+    readonly rowFilter: RowFilterScope | undefined;
+    readonly ctx: object;
+    readonly signal?: AbortSignal;
+    /** Run the handler to a value against the OBSERVED context and subject. */
+    readonly execute: (observedCtx: object, observedSubject: object) => Promise<unknown>;
+    /** The handler returned a descriptor — the snapshot cache owns that query. */
+    readonly onDescriptor: () => void;
+    readonly isDescriptor: (value: unknown) => boolean;
+    readonly unwrap: (value: unknown) => unknown;
+}
+
+/**
+ * Serve one computed call through the cache: a hit, or the handler run under
+ * observation and its result kept — or not — by `decideComputedStore`. The
+ * caller authorizes BEFORE and re-authorizes the delivered value AFTER; this
+ * function only decides what the cache does.
+ */
+/** A cached call's value, and the tables a live query built from it must also
+ *  recompute on (read by the handler, not named in `source:`). */
+declare interface CachedComputedResult {
+    readonly value: unknown;
+    readonly dependencies: ReadonlyArray<string>;
+}
+
 /** One leak: a query caching ONE entry across every caller while reading a
  *  table whose rows are scoped per tenant. */
 export declare interface CacheScopeLeak {
@@ -2127,15 +2106,7 @@ export declare interface CandidateShape {
 export declare const canonicalInputKey: (input: unknown) => string;
 
 /* Excluded from this release type: canonicalize */
-
-/**
- * Canonical JSON — object keys sorted recursively, so two structurally equal
- * inputs that differ only in key order digest identically. A retry from a
- * different client build must not mint a second approval.
- * Preserve own JSON fields such as `__proto__`; a prototype setter must never
- * discard part of the content that an approval identity binds.
- */
-export declare const canonicalJson: (value: unknown) => string;
+export { canonicalJson }
 
 export { CaughtUpVerdict }
 
@@ -2155,6 +2126,29 @@ export declare interface CdcDelta {
     readonly new?: Row_3 | null;
 }
 
+/** What a cell's envelopes can be bound to. */
+export declare interface CellContext {
+    readonly table: string;
+    readonly column: string;
+    /** The cell's row: its primary key, and every other column (for ids a copy carries). */
+    readonly rowId: unknown;
+    readonly row: Readonly<Record<string, unknown>>;
+    /** Every `.encrypted()` column the app declares, by table. */
+    readonly declared: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Declared renames (`declaredRenames`): the old names a value of this cell may still be bound to. */
+    readonly renames?: ReadonlyMap<string, DeclaredRename>;
+}
+
+/** What a cell's re-key did. */
+export declare interface CellRekey {
+    /** The cell's new text — equal to the input when nothing changed. */
+    readonly text: string;
+    readonly rekeyed: number;
+    readonly current: number;
+    /** Envelopes no candidate address opened — left as they are. */
+    readonly unresolved: number;
+}
+
 export { ChangeEvent }
 
 /** A mutation invocation's full change-set — the unit of undo. */
@@ -2170,50 +2164,24 @@ export declare interface ChangeSet {
     readonly crossesAction?: boolean;
 }
 
-export declare interface CircuitBreaker {
-    /** Run an effect through the breaker. OPEN ⇒ fails fast with CircuitOpen. */
-    <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | CircuitOpen, R>;
-    /** Current state — reads the Ref. */
-    readonly state: Effect.Effect<CircuitState>;
-    /** Force the breaker back to closed (clears counters). */
-    readonly reset: Effect.Effect<void>;
-}
-
-export declare const CircuitBreaker: {
-    /** Construct a breaker. Effect-returning because it allocates a Ref. */
-    readonly make: (options: CircuitBreakerOptions) => Effect.Effect<CircuitBreaker>;
-};
-
-export declare interface CircuitBreakerOptions {
-    /** Consecutive failures before the breaker opens. */
-    readonly failureThreshold: number;
-    /** Wait before transitioning open → half-open (Duration or string). */
-    readonly resetTimeout: Duration.Input;
-    /** Successes required in half-open before closing again. Default 1. */
-    readonly halfOpenSuccessThreshold?: number;
-    /** Predicate: does this error count toward the threshold? Default: all
-     *  typed failures count. Interruptions NEVER count (they're not a
-     *  downstream failure — the caller went away). */
-    readonly isFailure?: (error: unknown) => boolean;
-    /** Optional name for inspect / metrics + dashboard surfacing. */
-    readonly name?: string;
-}
-
 /**
- * Tagged error the breaker fails with while OPEN. Declarable on a
- * mutation / workflow `error:` schema so it marshals typed to the client.
+ * The same checks as {@link verifyFieldKeyring}, writing nothing — for a dry
+ * run. Answers which key the database records as active (`undefined` before
+ * the first boot recorded any) and which one would wait for the fleet.
  */
-export declare class CircuitOpen extends CircuitOpen_base {
-}
+export declare const checkFieldKeyring: (store: DataStore, keyring: FieldKeyring, tables: Iterable<unknown>) => Promise<{
+    readonly active: string | undefined;
+    readonly requested?: string;
+    readonly notes: ReadonlyArray<string>;
+}>;
 
-declare const CircuitOpen_base: Schema.Class<CircuitOpen, Schema.TaggedStruct<"CircuitOpen", {
-    /** Breaker name (the `name` option, or `'circuit'` when unnamed). */
-    readonly name: Schema.String;
-    /** Best-effort ms until the breaker next admits a probe call. */
-    readonly retryAfterMs: Schema.Number;
-}>, Cause.YieldableError>;
+export { CircuitBreaker }
+
+export { CircuitBreakerOptions }
+
+export { CircuitOpen }
 
-export declare type CircuitState = 'closed' | 'open' | 'half-open';
+export { CircuitState }
 
 /** How many bucket widths of predecessors a won claim leaves behind. */
 export declare const CLAIM_RETENTION_BUCKETS = 64;
@@ -2386,7 +2354,7 @@ export declare interface CompleteOAuthResult {
 /**
  * Combine multiple analytics specs into one composite spec at
  * app.config.ts time. The framework's boot path materialises each
- * child spec (calls `child.build(sqlClient)`) and wires them through
+ * child spec with its declared SQL dependency and wires them through
  * `composeAnalyticsSinks` so they behave as one logical sink.
  *
  * `track()` fans out to every child; reads route to the first child
@@ -2394,12 +2362,12 @@ export declare interface CompleteOAuthResult {
  *
  * Tables contributed by ANY child get merged. `initialize` effects
  * run sequentially in declaration order; `dispose` effects (teardown)
- * fan out to every child that declares one — only present on the
+ * await each child in reverse order — only present on the
  * composite when at least one child does.
  *
  *   analytics: composeAnalytics([
  *     postgresAnalytics(),                // primary: handles reads
- *     posthogAnalytics({ apiKey: '…' }),  // forwards track() too
+ *     posthogAnalytics({ apiKey: process.env.POSTHOG_API_KEY! }),
  *   ])
  */
 export declare const composeAnalytics: (specs: ReadonlyArray<AnalyticsSinkSpec>) => AnalyticsSinkSpec;
@@ -2443,6 +2411,44 @@ export declare interface CompressionOptions {
     readonly minBytes?: number;
 }
 
+/** Why a call is not looked up at all. */
+declare type ComputedCacheBypass = 'input-not-encodable' | 'no-tenant' | 'anonymous-subject';
+
+/**
+ * The entry one call belongs to — or why it has none.
+ *
+ * Every part is something a different answer could hang on: the query and the
+ * build that runs it (a redis cache outlives a deploy, and two releases share
+ * it during a rolling one), the output shape, the ENCODED input (so a `Date`,
+ * a `bigint` or a branded id keys by its wire form, and two spellings of one
+ * input share an entry), the scope's caller part, and the row-filter
+ * visibility the caller's reads of the declared tables resolve to.
+ */
+export declare const computedCacheKey: (args: ComputedCacheKeyInput) => {
+    readonly key: string;
+} | {
+    readonly bypass: ComputedCacheBypass;
+};
+
+declare interface ComputedCacheKeyInput {
+    readonly name: string;
+    /** The running build — see `codeIdentity` on the boot side. */
+    readonly codeIdentity: string;
+    readonly output: Schema.Top | undefined;
+    readonly input: Schema.Top | undefined;
+    readonly decodedInput: unknown;
+    readonly scope: ComputedCacheScope;
+    readonly subject: {
+        readonly id?: string | null | undefined;
+        readonly type?: string | undefined;
+        readonly tenantId?: string | null | undefined;
+    };
+    readonly rowFilter: RowFilterScope | undefined;
+    readonly declaredSources: ReadonlyArray<string>;
+}
+
+declare type ComputedCacheScope = 'subject' | 'tenant' | 'global';
+
 declare interface ComputedQuery {
     readonly __voltroComputed: true;
     /** The initial computed value — emitted verbatim as the first snapshot. */
@@ -2456,6 +2462,56 @@ declare interface ComputedQuery {
     readonly recompute: () => Promise<unknown>;
 }
 
+/** Is capture on? The request store builder wraps its store when it is. */
+export declare const computedQueryCacheCaptureInstalled: () => boolean;
+
+/**
+ * The cache a COMPUTED query's handler invocation is served through. Both boot
+ * paths build it over the app's `Cache` (`wrapDynamic`), and so does
+ * `@voltro/testing`'s `invoke`; absent ⇒ computed queries are never cached.
+ */
+export declare interface ComputedQueryCacheDeps {
+    readonly wrapDynamic: <A, E>(key: string, options: {
+        readonly ttlMs: number;
+        readonly swrMs?: number | undefined;
+        readonly leaseMs?: number | undefined;
+        readonly label: string;
+    }, compute: Effect.Effect<{
+        readonly value: A;
+        readonly store?: {
+            readonly stored: unknown;
+            readonly tags: ReadonlyArray<string>;
+        } | undefined;
+        readonly notApplicable?: boolean | undefined;
+    }, E, never>, read: (stored: unknown) => Effect.Effect<Option.Option<A>>) => Effect.Effect<{
+        readonly value: A;
+        readonly served: 'hit' | 'stale' | 'miss';
+    }, E, never>;
+    /** Parse the declared `cache:` (same parser as the descriptor path). */
+    readonly policyFor: (cache: {
+        readonly ttl: number | string;
+        readonly swr?: number | string | undefined;
+        readonly scope: ComputedCacheScope;
+        readonly volatile?: boolean | undefined;
+    }) => ComputedQueryCachePolicy | undefined;
+    /** The running build — part of every key, so a deploy never reads another
+     *  release's entries out of a shared cache. */
+    readonly codeIdentity: string;
+    readonly maxEntryBytes: number;
+    /** Cluster single-flight lease, when the backend supports one. */
+    readonly leaseMs?: number | undefined;
+    /** Once-per-(query, reason) notice that a result was not kept. */
+    readonly notice: (query: string, reason: string, message: string) => void;
+}
+
+/** A computed query's resolved cache policy — ms, parsed by the boot path. */
+export declare interface ComputedQueryCachePolicy {
+    readonly ttlMs: number;
+    readonly swrMs: number | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile: boolean;
+}
+
 export declare const CONNECTION_GRANTS_TABLE = "_voltro_connection_grants";
 
 /** What a declaration can learn about the account it just connected. Optional
@@ -2588,6 +2644,7 @@ export { ConstraintViolation }
 export declare type CoordinatedEffect = () => void | CoordinatedTickOutcome | Promise<void | CoordinatedTickOutcome>;
 
 export declare interface CoordinatedScheduleDeps {
+    readonly externalTasks?: ExternalizedTaskRegistry;
     /** The exactly-once gate. `singleCoordinator` for one-process
      *  deployments; `makeAdvisoryLockCoordinator(store, replicaId)` for
      *  multi-instance SQL stores. Injected so this stays testable with a
@@ -2678,8 +2735,9 @@ export declare interface CoordinatedScheduleDiagnostics {
 }
 
 export declare interface CoordinatedScheduleHandle {
-    /** Stop the periodic task. Idempotent. */
-    readonly stop: () => void;
+    /** Stop admission immediately; await the returned completion before releasing
+     * storage. Includes timer and external-trigger claims/effects. Idempotent. */
+    readonly stop: () => void | Promise<void>;
     /** The task name (for logging / dedup diagnostics). */
     readonly name: string;
     /**
@@ -3381,6 +3439,9 @@ export declare const decideApprovalInvocation: (input: {
     readonly status: "approved" | "rejected";
 }>;
 
+/** The app's `.encrypted()` columns, by table. */
+export declare const declaredEncryptedColumns: (declared: Iterable<unknown>) => ReadonlyMap<string, ReadonlySet<string>>;
+
 /**
  * `unknown` when the executor's failures are all declared; otherwise a type the
  * handler cannot satisfy, whose one property spells out the undeclared tag(s)
@@ -3393,6 +3454,27 @@ UndeclaredErrorTags<D, R>
     readonly undeclaredFailure: `'${UndeclaredErrorTags<D, R>}' is not in this procedure's wire union — add it to the descriptor's \`error:\`, register it through a plugin's \`errorSchemas\`, or map it away (Effect.orDie for a defect)`;
 };
 
+/** A declared rename of a table with sealed columns: the names its values may still be bound to. */
+export declare interface DeclaredRename {
+    readonly previousTable?: string;
+    /** New column name → the name it was renamed from. */
+    readonly columns: ReadonlyMap<string, string>;
+}
+
+/**
+ * The renames the app declares on tables with `.encrypted()` columns —
+ * `table('new').renamedFrom('old')`, a column's `.renamedFrom('old')`. A rename
+ * is catalog-only, so the rows keep values bound to the old names; the re-key
+ * opens them there and seals them under the new ones.
+ */
+export declare const declaredRenames: (declared: Iterable<unknown>) => ReadonlyMap<string, DeclaredRename>;
+
+/** Decode a stored snapshot; `undefined` for anything this version did not
+ *  write (an entry from another build reads as a miss). */
+export declare const decodeSnapshotValue: (stored: unknown) => {
+    readonly value: unknown;
+} | undefined;
+
 /**
  * Decrypt a value produced by `encryptField` or by an `.encrypted()` column —
  * one encoding, so that sentence is now true in both directions.
@@ -3958,7 +4040,13 @@ export declare class Dispatcher {
     private readonly subscriptionRegistry;
     private readonly matcher;
     private readonly subscriptions;
-    private readonly unsubscribeChange;
+    private unsubscribeChange;
+    private closed;
+    private readonly operations;
+    /** Register synchronously, before user code or the first await can run. */
+    private beginOperation;
+    /** Includes pending initial reads, not only already-visible subscriptions. */
+    private readonly interests;
     /**
      * Reverse index: tableName → set of subscription ids whose
      * dependent-table set INCLUDES that table. A change event on table
@@ -3984,12 +4072,18 @@ export declare class Dispatcher {
     /** Query labels already warned about for an undeclared raw read, so a hot
      *  subscription logs once rather than once per subscriber. */
     private readonly rawReadWarned;
+    /** The cache fence each written-through read observed before it started. */
+    private readonly readFences;
     private changeEpoch;
     private readonly committedReads;
     /** The CRDT-managed columns of `table` (empty when it has none) — what a
      *  subscription's backpressure outbox folds incrementally. */
     crdtColumnsFor(table: string): ReadonlySet<string>;
     constructor(deps: DispatcherDependencies);
+    private measureLoop;
+    private retainInterest;
+    /** One idempotent terminal path for setup failures, revocation and disconnect. */
+    private removeInterest;
     /**
      * REL-14 — a raw read that nothing can invalidate, said out loud.
      *
@@ -4091,6 +4185,9 @@ export declare class Dispatcher {
     onSubscriptionsChange(listener: () => void): () => void;
     /** Tear down the change-event listener. Call on server shutdown. */
     close(): void;
+    /** Close admission immediately, then join reads and deliveries before the
+     * owner disposes the store. Do not await this from inside a query callback. */
+    closeAndDrain(): Promise<void>;
     /**
      * Re-run EVERY live subscription, because this replica proved it missed
      * changes it can never recover.
@@ -4116,6 +4213,8 @@ export declare class Dispatcher {
 }
 
 export declare interface DispatcherDependencies {
+    /** Active synchronous live-change work only; asynchronous reads are not timed. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly store: DataStore;
     /** CRDT columns per table (schemaRegistry.crdtColumns). Feeds the
      *  downstream lane: crdt cells diff as incremental mergeCells ops.
@@ -4161,6 +4260,8 @@ export declare interface DispatcherDependencies {
 export declare const DORMANCY_WAKEUP_TENANT = "default";
 
 export declare interface DrainDeps<R = never> {
+    /** Active synchronous handler entry only; never await a Promise inside this measurement. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly store: Pick<DataStore, 'query' | 'update' | 'updateMany' | 'insert' | 'delete'>;
     readonly handlers: ReadonlyMap<string, OutboxHandlerDefinition<R>>;
     /** Execute with the application's services. Required by drainOutbox when R
@@ -4291,7 +4392,7 @@ export declare interface EffectInsertIgnoreOutcomeStore {
 
 /** The minimal Effect-store surface `insertManyRowsEffect` needs. */
 export declare interface EffectInsertManyStore {
-    readonly insertMany: (table: string, rows: ReadonlyArray<Row>) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
+    readonly insertMany: (table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
 }
 
 /** The minimal Effect-store surface `insertRowEffect` needs. */
@@ -4315,7 +4416,7 @@ export declare interface EffectStoreOps {
      *  hand-built descriptor. */
     readonly query: <R = Row>(descriptor: QueryDescriptor<R>) => Effect.Effect<ReadonlyArray<R>, StoreError>;
     readonly insert: (table: string, row: Row) => Effect.Effect<Row, StoreError>;
-    readonly insertMany: (table: string, rows: ReadonlyArray<Row>) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
+    readonly insertMany: (table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<Row>, StoreError>;
     readonly patchJson: (table: string, primaryKey: string, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>) => Effect.Effect<Row | null, StoreError>;
     readonly update: (table: string, primaryKey: string, patch: Readonly<Record<string, unknown>>) => Effect.Effect<Row | null, StoreError>;
     readonly updateMany: (table: string, patch: Readonly<Record<string, unknown>>, options: {
@@ -4402,6 +4503,10 @@ export declare const emptySchemaRegistry: SchemaRegistry;
  *  should be observed are constructed — `observeStore` decides once, per store. */
 export declare const enableGraphObservation: () => void;
 
+/** Encode a snapshot for the cache. Throws on a value with no faithful form —
+ *  the caller does not store it then. */
+export declare const encodeSnapshotValue: (value: unknown) => unknown;
+
 /**
  * Encrypt a value with the registered field cipher, in the SAME encoding an
  * `.encrypted()` column uses. Throws if no cipher is registered.
@@ -4433,6 +4538,20 @@ export declare const enforceApproval: (input: {
     readonly traceId?: string | undefined;
 }) => Promise<void>;
 
+/** One connected engine SDK, as it named itself in `x-voltro-sdk`. It proves nothing and grants nothing. */
+export declare interface EngineClient {
+    readonly id: string;
+    /** `csharp`, `unity`, `godot` or `unreal`. */
+    readonly target: string;
+    readonly version: string;
+    /** SHA-256 of the API surface the SDK was generated from, or null when it did not say. */
+    readonly surface: string | null;
+    readonly connectedAt: number;
+}
+
+/** The engine SDKs connected to this process now, oldest first. */
+export declare const engineClientsSnapshot: () => ReadonlyArray<EngineClient>;
+
 export { EnqueueOptions }
 
 /**
@@ -5407,6 +5526,12 @@ export declare const externalizedTask: (name: string) => ExternalizedTask | unde
 
 export declare const externalizedTaskNames: () => ReadonlyArray<string>;
 
+export declare interface ExternalizedTaskRegistry {
+    readonly register: (task: ExternalizedTask) => () => void;
+    readonly get: (name: string) => ExternalizedTask | undefined;
+    readonly names: () => ReadonlyArray<string>;
+}
+
 /** Build an Effect `ExternalSpan` parent from a `traceparent` header so
  *  inbound HTTP work continues the caller's trace. Returns undefined
  *  when the header is missing/invalid (no parent → a fresh root span). */
@@ -5470,11 +5595,251 @@ declare type FailureTag<E> = 0 extends (1 & E) ? never : E extends {
     readonly _tag: infer T;
 } ? T extends 'UnknownError' ? never : T extends string ? T : never : never;
 
+export declare const FIELD_ENCRYPTION_ACTIVE_ENV = "VOLTRO_FIELD_ENCRYPTION_ACTIVE";
+
+export declare const FIELD_ENCRYPTION_KEY_ENV = "VOLTRO_FIELD_ENCRYPTION_KEY";
+
+export declare const FIELD_ENCRYPTION_KEYS_ENV = "VOLTRO_FIELD_ENCRYPTION_KEYS";
+
+export declare const FIELD_ENCRYPTION_PREVIOUS_KEY_ENV = "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS";
+
+export declare const FIELD_KEY_HEARTBEAT_MS = 10000;
+
+/** The table of leases on field-encryption keys. */
+export declare const FIELD_KEY_HOLDERS_TABLE = "_voltro_field_key_holders";
+
+export declare const FIELD_KEY_LEASE_MS = 30000;
+
+/** The table of the last field-key count and re-key. */
+export declare const FIELD_KEY_REPORTS_TABLE = "_voltro_field_key_reports";
+
+/** The environment names a keyring is read from, for a resolver that fetches them. */
+export declare const FIELD_KEYRING_ENV_NAMES: readonly ["VOLTRO_FIELD_ENCRYPTION_KEYS", "VOLTRO_FIELD_ENCRYPTION_ACTIVE", "VOLTRO_FIELD_ENCRYPTION_KEY", "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"];
+
+/** The table recording each field-encryption key id's state and canary. */
+export declare const FIELD_KEYS_TABLE = "_voltro_field_keys";
+
 export declare interface FieldChange {
     readonly from: unknown;
     readonly to: unknown;
 }
 
+/** What this process opened since it started, per key and location — the Governance panel's view. */
+export declare const fieldDecryptSnapshot: () => ReadonlyArray<{
+    readonly key: string;
+    readonly location: string;
+    readonly ok: number;
+    readonly failed: number;
+}>;
+
+/** The last `voltro secret status`: sealed values per key id, over all and per location. */
+export declare interface FieldKeyCountReport {
+    readonly totals: Readonly<Record<string, number>>;
+    readonly unnamed: number;
+    readonly plaintext: number;
+    readonly unreadable: number;
+    readonly locations: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly byKey: Readonly<Record<string, number>>;
+        readonly unnamed: number;
+        readonly plaintext: number;
+    }>;
+}
+
+/** One key of a keyring: its id and its secret (a passphrase, or 64 hex). */
+export declare interface FieldKeyEntry {
+    readonly id: string;
+    readonly secret: string;
+}
+
+/** What one heartbeat found. `unheld`: the database's active key is one this
+ *  process does not hold — it missed its lease while the fleet moved on. */
+export declare interface FieldKeyHeartbeat {
+    readonly active: string;
+    readonly activated?: {
+        readonly from: string | undefined;
+        readonly to: string;
+    };
+    readonly waiting?: FieldKeyWaiting;
+    readonly unheld: boolean;
+}
+
+/** A process's lease. `now` is for tests; the lease is how long a process that
+ *  stopped heartbeating is still waited for. */
+export declare interface FieldKeyHolder {
+    readonly holderId: string;
+    readonly leaseMs?: number;
+    readonly now?: () => number;
+}
+
+export declare interface FieldKeyHolderHandle {
+    /** Stop heartbeating, wait for a beat in flight, and give up the lease. */
+    readonly stop: () => Promise<void>;
+}
+
+/** A holder id for this process. */
+export declare const fieldKeyHolderId: () => string;
+
+/** One process's lease, as recorded — `expiresAt` in the past means it no longer counts. */
+export declare interface FieldKeyHolderRecord {
+    readonly holderId: string;
+    readonly keyIds: ReadonlyArray<string>;
+    readonly activeKeyId: string;
+    readonly heartbeatAt: Date;
+    readonly expiresAt: Date;
+}
+
+export declare interface FieldKeyHolderRow {
+    readonly holderId: string;
+    readonly keyIds: ReadonlyArray<string>;
+    readonly activeKeyId: string;
+    readonly expiresAt: string;
+}
+
+/**
+ * The id a key gets when the operator does not name one: `k` + 10 hex
+ * characters of an HMAC over the derived key. Stable for a given key, short
+ * enough to ride in every envelope, and not the key — the fingerprint is keyed
+ * by the key itself, so it says nothing about it to someone without it.
+ */
+export declare const fieldKeyIdOf: (secret: string) => string;
+
+/** The last `voltro secret rekey` (also run by `rotate`): what moved, what is left, and whether the active key alone opens everything. */
+export declare interface FieldKeyRekeyReport {
+    readonly active: string;
+    readonly rekeyed: number;
+    readonly left: number;
+    readonly verified: boolean;
+}
+
+export declare interface FieldKeyReports {
+    readonly status?: {
+        readonly reportedAt: Date;
+        readonly report: FieldKeyCountReport;
+    };
+    readonly rekey?: {
+        readonly reportedAt: Date;
+        readonly report: FieldKeyRekeyReport;
+    };
+}
+
+/** A field cipher over several keys, each with an id — what `makeFieldKeyring` returns. */
+export declare interface FieldKeyring extends FieldCipher {
+    /** The key new values are sealed under — the configured active key until
+     *  {@link FieldKeyring.activate} names another one the keyring holds. */
+    readonly activeKeyId: string;
+    /** The active key the configuration names. The database may keep another
+     *  active until every live process holds this one (`verifyFieldKeyring`). */
+    readonly requestedKeyId: string;
+    /** Every id the keyring holds, the configured active key first. */
+    readonly keyIds: ReadonlyArray<string>;
+    /** Each held key's fingerprint ({@link fieldKeyIdOf} — an HMAC of the key, never
+     *  the key), by id: what the boot line and the Governance panel show. */
+    readonly fingerprints: Readonly<Record<string, string>>;
+    /** Seal under one named key, whichever is active (a key's canary). */
+    readonly sealWith: (keyId: string, plaintext: string, binding?: FieldBinding) => string;
+    /** Does the named key open this value? `false` for a key the keyring does not hold. */
+    readonly opensWith: (keyId: string, ciphertext: string, binding?: FieldBinding) => boolean;
+    /** Seal new values under another held key — the database, not the
+     *  environment, decides which key is active (`verifyFieldKeyring`). */
+    readonly activate: (keyId: string) => void;
+}
+
+/** The keys a process holds, and the one new values are sealed under. */
+export declare interface FieldKeyringConfig {
+    readonly active: string;
+    readonly keys: ReadonlyArray<FieldKeyEntry>;
+}
+
+/** A keyring configuration that cannot be used — named, never containing a key. */
+export declare class FieldKeyringConfigError extends Error {
+    readonly _tag = "FieldKeyringConfigError";
+    constructor(message: string);
+}
+
+/** The boot cannot use this keyring with this database — the message names
+ *  ids, columns and the way out, never a key. */
+export declare class FieldKeyringRefusal extends Error {
+    readonly _tag = "FieldKeyringRefusal";
+    constructor(message: string);
+}
+
+/** What a boot's check found and recorded. */
+export declare interface FieldKeyringVerification {
+    /** The key new values are sealed under, as the database records it. */
+    readonly active: string;
+    /** Ids this boot recorded for the first time. */
+    readonly registered: ReadonlyArray<string>;
+    /** Set when this boot made another key active. */
+    readonly activated?: {
+        readonly from: string | undefined;
+        readonly to: string;
+    };
+    /** A requested key that is not active yet, and the live processes that lack it. */
+    readonly waiting?: FieldKeyWaiting;
+    /** Things worth a log line, never a refusal. */
+    readonly notes: ReadonlyArray<string>;
+}
+
+/** One recorded key id — its state and canary, never its key. */
+export declare interface FieldKeyRow {
+    readonly keyId: string;
+    readonly state: FieldKeyState;
+    readonly canary: string;
+    readonly registeredAt: Date | null;
+    readonly activatedAt: Date | null;
+    readonly replacedAt: Date | null;
+    readonly retiredAt: Date | null;
+    readonly requestedAt: Date | null;
+}
+
+/** A key's state. `pending`: held, never active. `active`: new values are sealed
+ *  under it — exactly one. `decrypt-only`: was active, replaced; values may still
+ *  be sealed under it. `retired`: nothing is sealed under it any more. */
+export declare type FieldKeyState = 'pending' | 'active' | 'decrypt-only' | 'retired';
+
+export declare interface FieldKeyStateRow {
+    readonly keyId: string;
+    readonly state: string;
+    readonly activatedAt: string | null;
+    readonly requestedAt: string | null;
+}
+
+export declare interface FieldKeyStatus {
+    /** The recorded keys and their states — empty before the first boot recorded any. */
+    readonly keys: ReadonlyArray<FieldKeyStateRow>;
+    /** Every process that holds a lease, live or not (`expiresAt` says which). */
+    readonly holders: ReadonlyArray<FieldKeyHolderRow>;
+    readonly locations: ReadonlyArray<SealedLocation>;
+    /** Envelopes per key id, over every location. */
+    readonly totals: Readonly<Record<string, number>>;
+    readonly unnamed: number;
+    readonly plaintext: number;
+    /** Columns that could not be read — listed, never silently left out of the counts. */
+    readonly unreadable: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * Count every sealed value in the database by the key it names. `declared` are
+ * the app's tables: their `.encrypted()` columns are always reported (with
+ * plaintext counted), the rest only where envelopes were found.
+ */
+export declare const fieldKeyStatus: (dialect: DialectId, declared: Iterable<unknown>) => Effect.Effect<{
+    keys: FieldKeyStateRow[];
+    holders: FieldKeyHolderRow[];
+    locations: SealedLocation[];
+    totals: Record<string, number>;
+    unreadable: UnreadableColumn[];
+    unnamed: number;
+    plaintext: number;
+}, SqlError, SqlClient.SqlClient>;
+
+export declare interface FieldKeyWaiting {
+    readonly keyId: string;
+    readonly holders: ReadonlyArray<string>;
+}
+
 /**
  * Canonical fingerprint over `(table, predicate, indexHint?)`. The
  * optional `indexHint` participates so two subscriptions with the same
@@ -5851,6 +6216,13 @@ export declare interface HealthConfigInput {
     readonly readiness?: () => boolean | Promise<boolean>;
 }
 
+/**
+ * One heartbeat: renew this process's lease, complete a requested activation
+ * once every live holder holds the key, and seal under the database's active
+ * key from now on. Any holder can complete an activation another one requested.
+ */
+export declare const heartbeatFieldKeys: (store: DataStore, keyring: FieldKeyring, holder: FieldKeyHolder) => Promise<FieldKeyHeartbeat>;
+
 /** Define a histogram. `boundaries` default to the framework duration buckets. */
 export declare const histogramMetric: (name: string, boundaries?: ReadonlyArray<number>, description?: string) => Metric.Histogram<number>;
 
@@ -5992,9 +6364,10 @@ export declare class InMemoryDataStore implements DataStore {
      * to tell apart from "no such table".
      */
     storedTables(): ReadonlyArray<StoredTableShape>;
+    integrityQuery(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     insert(table: string, row: Row): Promise<Row>;
-    insertMany(table: string, rows: ReadonlyArray<Row>): Promise<ReadonlyArray<Row>>;
+    insertMany(table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions): Promise<ReadonlyArray<Row>>;
     patchJson(table: string, primaryKey: RowKey, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>): Promise<Row | null>;
     update(table: string, primaryKey: RowKey, patch: Readonly<Record<string, unknown>>): Promise<Row | null>;
     delete(table: string, primaryKey: RowKey): Promise<boolean>;
@@ -6026,8 +6399,9 @@ export declare const insertIgnoreRowOutcomeEffect: <T extends AnyWritableTable>(
     readonly outcome: "inserted" | "ignored";
 }, StoreError>;
 
-/** `insertRowEffect`'s batch — every element checked against `InferInsertRow<T>`. */
-export declare const insertManyRowsEffect: <T extends AnyWritableTable>(store: EffectInsertManyStore, table: T, rows: ReadonlyArray<InferInsertRow<T>>) => Effect.Effect<ReadonlyArray<InferRow<T>>, StoreError>;
+/** `insertRowEffect`'s batch — every element checked against `InferInsertRow<T>`.
+ *  `{ returning: 'none' }` resolves to `[]` without reading the rows back. */
+export declare const insertManyRowsEffect: <T extends AnyWritableTable>(store: EffectInsertManyStore, table: T, rows: ReadonlyArray<InferInsertRow<T>>, options?: InsertManyOptions) => Effect.Effect<ReadonlyArray<InferRow<T>>, StoreError>;
 
 /**
  * Insert a row, typed against the table, on the Effect channel.
@@ -6132,6 +6506,10 @@ export { inspectWorkflow }
 
 export declare const installApprovalGate: (gate: ApprovalGateApi) => void;
 
+/** Turn on read capture for cached computes — called at boot when any query
+ *  declares `cache:`. Until then the request store is not wrapped for it. */
+export declare const installComputedQueryCacheCapture: () => void;
+
 /**
  * Install the resolver that answers `guards: [{ action, resourceType }]`.
  *
@@ -6235,6 +6613,9 @@ export declare const isExpectationDefinition: (value: unknown) => value is Expec
 
 export declare const isExperimentDefinition: (value: unknown) => value is ExperimentDefinition;
 
+/** Is this cipher a keyring (ids, per-key seal and open), not a bare cipher? */
+export declare const isFieldKeyring: (cipher: FieldCipher | undefined) => cipher is FieldKeyring;
+
 export { isForeignKeyViolation }
 
 /**
@@ -6461,7 +6842,7 @@ export declare interface KvFacade {
     readonly service: Effect.Success<typeof Kv>;
     /** The resolved backend kind — for boot logging. */
     readonly backend: 'database' | 'redis' | 'memory';
-    /** Tear down the managed runtime (closes a pooled redis connection). */
+    /** Release this consumer runtime; an injected registry retains its pools. */
     readonly dispose: () => Promise<void>;
 }
 
@@ -6470,6 +6851,10 @@ export declare interface KvFacadeOptions {
     readonly store: DataStore;
     /** Defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
+    readonly backend?: 'database' | 'redis' | 'memory';
+    readonly connectionName?: string;
+    readonly keyPrefix?: string;
+    readonly connections?: RespConnections;
 }
 
 /**
@@ -6591,6 +6976,27 @@ export declare interface LocalityAwareOptions {
  */
 export declare const localityAwareSelector: (options: LocalityAwareOptions) => ReplicaSelector;
 
+/** One location's outcome. */
+export declare interface LocationRekey {
+    readonly table: string;
+    readonly column: string;
+    readonly cells: number;
+    readonly rekeyed: number;
+    readonly current: number;
+    readonly unresolved: number;
+    /** Cells the app changed between the read and the write — run again. */
+    readonly changedMeanwhile: number;
+    /** Values that need a re-key in a table with no single-column primary key to address the cell by. */
+    readonly unaddressable: number;
+}
+
+/** Read the current key row within its expected tenant under a write fence.
+ * Supply an existing transaction after the application's organization/account
+ * fences and keep it through the protected write. Null matches unassigned
+ * keys only. The internal row uses the normal store codec; never return it in
+ * a public response. This is not bearer verification or an authorization grant. */
+export declare const lockApiKeyById: (store: DataStore, id: string, tenantId: string | null) => Promise<ApiKeyRow | null>;
+
 export declare interface LogTraceContext {
     readonly traceId: string;
     readonly spanId?: string;
@@ -6662,7 +7068,7 @@ log?: SchedulerLogger) => Coordinator;
  * tampered / wrong-key value AND on a bound value read at another address —
  * both surface as a read error, never silent corruption.
  */
-export declare const makeAesCipher: (key: Buffer) => FieldCipher;
+export declare const makeAesCipher: (key: Buffer, keyId?: string) => FieldCipher;
 
 export declare const makeApiKeyService: (store: ApiKeyStore, opts?: {
     prefix?: string;
@@ -6690,6 +7096,61 @@ export declare const makeApiKeyUsageFlusher: (store: ApiKeyStore) => (id: string
     readonly lastUsedAt: number;
 }) => Promise<void>;
 
+/** In-memory, bounded finalized-bucket queue. Current instrumentation is partial;
+ * this collector cannot certify complete workload coverage merely from uptime. */
+export declare const makeApiRoleBucketSampler: (input: {
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly workloads: ReadonlyArray<ApiWorkload>;
+    readonly epochNow: number;
+    readonly monotonicNow: number;
+}) => {
+    record(segment: {
+        readonly workload: ApiWorkload;
+        readonly from: number;
+        readonly until: number;
+    }): void;
+    /** Heartbeat every30s. Delays >60s or clock skew >1s conservatively invalidate
+     * affected intervals; never spread elapsed request time across buckets. */
+    advance(monotonicNow: number, epochNow: number): void;
+    pending(): ReadonlyArray<ApiRoleWorkloadBucket>;
+    acknowledge(from: number): void;
+    status: () => {
+        pendingBuckets: number;
+        droppedBuckets: number;
+        rejectedSegments: number;
+    };
+};
+
+/** Measures only the synchronous execution of a callback, including throws.
+ * Returning a Promise measures its construction, not its awaited lifetime.
+ * Each resumed async callback must be instrumented separately. No wall-time
+ * request duration may be fed into this counter as a substitute for loop time.
+ * Nested calls on this recorder suspend their parent, so time is exclusive. */
+export declare const makeApiRoleWorkloadMetrics: (roles: ReadonlyArray<string>, options?: {
+    readonly now?: () => number;
+    readonly onSegment?: (segment: {
+        readonly workload: ApiWorkload;
+        readonly from: number;
+        readonly until: number;
+    }) => void;
+}) => {
+    role: string;
+    observationErrors: () => number;
+    /** Effect4's tracer context surrounds each synchronous primitive, including
+     * the first, resumed and inherited child work. Preserve the existing tracer;
+     * Promise callbacks outside evaluation still use measureSync explicitly. */
+    observeEffect<A, E, R>(effect: Effect.Effect<A, E, R>, workload: ApiWorkload): Effect.Effect<A, E, R>;
+    measureSync<A>(workload: ApiWorkload, run: () => A): A;
+    /** Local totals, not a 24-hour history or evidence of full instrumentation. */
+    snapshot(): ReadonlyArray<{
+        readonly role: string;
+        readonly workload: ApiWorkload;
+        readonly seconds: number;
+    }>;
+};
+
 /** Build the `ctx.access` slice for a subject. Reads the effective-scope seam
  *  LIVE (via getters/closures) so a scope rbac resolves after context
  *  construction is still reflected. Used by the shared AppContext builder AND
@@ -6713,7 +7174,7 @@ export declare interface MakeApprovalGateOptions {
 
 /** Build the `ctx.kv` facade. `KV_BACKEND` picks the backend; unknown values
  *  fall back to `database`. */
-export declare const makeAsyncKv: ({ store, env }: KvFacadeOptions) => Promise<KvFacade>;
+export declare const makeAsyncKv: ({ store, env, backend: configuredBackend, connectionName, keyPrefix, connections }: KvFacadeOptions) => Promise<KvFacade>;
 
 /**
  * The `AuthMiddleware` + `ConnectionInfoMiddleware` pair every rpc surface
@@ -6832,19 +7293,45 @@ export declare const makeEventPublisher: (ctx: EventPublishContext) => EventPubl
 
 export declare const makeEventsFacade: (options: EventsFacadeOptions) => EventsAppContext;
 
+/** Pass one instance to a host's scheduler factories and trigger route. */
+export declare const makeExternalizedTaskRegistry: () => ExternalizedTaskRegistry;
+
 /**
  * Derive a key from a passphrase and build the cipher — with the keys a
- * ROTATION retires, when there are any.
+ * ROTATION retires, when there are any. Ids are derived from the keys
+ * (`fieldKeyIdOf`); a previous key equal to the current one is skipped.
  *
- * Writes use the current key; reads try the current one, then each previous
- * one. GCM authenticates, so a wrong key fails its tag rather than producing
- * garbage, and trying them in turn is safe. Without this, a key change made
- * every value written before it unreadable — measured: every sleeping or
- * suspended run of an `encrypted: true` workflow failed its replay with
- * `MalformedMessage`, and every `.encrypted()` column read failed.
+ * Writes use the current key; reads open a value by the key it names, or by
+ * trying the current one, then each previous one. GCM authenticates, so a
+ * wrong key fails its tag rather than producing garbage. Without this, a key
+ * change made every value written before it unreadable — measured: every
+ * sleeping or suspended run of an `encrypted: true` workflow failed its replay
+ * with `MalformedMessage`, and every `.encrypted()` column read failed.
  */
 export declare const makeFieldCipher: (passphrase: string, previous?: ReadonlyArray<string>) => FieldCipher;
 
+/**
+ * A cipher over a keyring: new values are sealed under the active key and name
+ * it; a value is opened by the key it names (a lookup), and one written before
+ * values named their key by trying each key, the active one first.
+ *
+ * A named key that is not in the keyring is a refusal that names it, so an
+ * operator reads "sealed under k2026a, which this process does not hold"
+ * instead of a GCM failure. A named key that does not open the value (an id
+ * that was altered) falls back to trying the others — the id is a hint, GCM is
+ * the authority.
+ */
+export declare const makeFieldKeyring: (config: FieldKeyringConfig, options?: {
+    /**
+     * Refuse to seal until {@link FieldKeyring.activate} has run — the boot's
+     * keyring sets this, so nothing is sealed under the configured key before
+     * the database has said which key is active. A value sealed under a key the
+     * fleet has not accepted is one a replica on the previous configuration
+     * cannot read.
+     */
+    readonly sealOnlyOnceActivated?: boolean;
+}) => FieldKeyring;
+
 /** Build the fluent `select` / `update` / `delete` entry functions over a
  *  backend + scope. Wired into `wrapStoreWithMixinBehaviour` so they hang
  *  off `ctx.store` alongside the keyed `query`/`insert`/`update`/`delete`. */
@@ -6867,12 +7354,18 @@ export declare const makeLazyWorkflowFacade: (resolve: () => WorkflowsAppContext
 export declare const makeListConnectionsExecutor: (deps: ConnectionBuiltinDeps) => (_input: Record<string, never>, ctx: ConnectionExecutorCtx) => Promise<ReadonlyArray<ConnectionState_2>>;
 
 /**
- * Build the replay codec from a mutation's `descriptor.output` Schema (call it at
- * the bind site). Both directions fall back to the raw value if the Schema can't
- * round-trip it — a guard for exotic schemas; for a value the handler actually
- * produced, `encodeUnknownSync` never throws. `undefined` schema → no codec.
+ * Build one input/output contract from both declared schemas. Refuse incompatible
+ * values with payload-free errors; never return or log an old raw response
+ * when the current output contract cannot decode it. Input is captured from its schema before keyed acquisition.
  */
-export declare const makeMutationOutputCodec: (outputSchema: Schema.Top | undefined) => MutationOutputCodec<unknown> | undefined;
+export declare const makeMutationCodec: (inputSchema: Schema.Top, outputSchema: Schema.Top, admit: MutationCodec<unknown>["admit"]) => MutationCodec<unknown>;
+
+/** Current admission for a keyed unary call, including its cached result.
+ * Pure refresher binding is separate from business interceptors/executors. */
+export declare const makeMutationReplayAdmission: (procedure: MutationLike, kind: "mutation" | "action", options?: {
+    readonly defaultDeny?: boolean;
+    readonly bindReplayAuthority?: RpcReplayAuthorityBinding | undefined;
+}) => ((input: unknown, request: ServeRequestContext) => Promise<void>);
 
 /**
  * Build the shared mutation runner. Used by BOTH the rpc WS handler and
@@ -6946,7 +7439,7 @@ export declare const makeOutboxFacade: (deps: OutboxFacadeDeps) => OutboxFacade;
  */
 export declare const makeProcessAdapter: (supervisor: AppSupervisor) => WakeAdapter;
 
-export declare const makeQueryDescriptorProducer: <D>(deps: QueryProducerDeps<D>) => (query: MutationLike, input: unknown) => (requestContext: ServeRequestContext) => D | ComputedQuery | Effect.Effect<D | ComputedQuery, unknown, never>;
+export declare const makeQueryDescriptorProducer: <D>(deps: QueryProducerDeps<D>, workloadOverride?: "rpc" | "subscriptions") => (query: MutationLike, input: unknown) => (requestContext: ServeRequestContext) => ComputedQuery | D | Effect.Effect<ComputedQuery | D, unknown, never>;
 
 export declare const makeQueryFinalizer: (options: QueryFinalizeOptions) => ((descriptor: QueryDescriptor, subject: {
     readonly tenantId?: string | null;
@@ -7385,35 +7878,22 @@ export declare const MIN_LEVEL_RESYNC_MS = 30000;
 /** Mint a fresh service token. `voltro dev` and `voltro secret generate` call this. */
 export declare const mintServiceToken: () => string;
 
-/**
- * Ordering token for one mirrored write.
- *
- * **The sink MUST persist this and MUST NOT invent its own.** It is
- * assigned by the framework at the moment the change leaves the store's
- * change channel — i.e. in COMMIT order — so a write with a lower
- * version is, by construction, an older image of that row. Stamping a
- * version at sink-call time instead (a `Date.now()` inside `upsert`)
- * makes a late-arriving STALE image outrank the fresh one and win
- * permanently; that is the bug this type exists to make unrepresentable.
- *
- * How the number is derived depends on the store's `changeScope`:
- *
- *   - `'local'` (one process observes each change): a hybrid clock —
- *     wall-clock microseconds forced strictly upward, so it orders within
- *     a millisecond and keeps increasing across a restart.
- *   - `'fleet'` (every replica observes every change): derived from the
- *     CHANGE, not from the receiving process — the warehouse's own max
- *     version for the key (read once via {@link AnalyticsMirrorImpl.maxVersion})
- *     plus the change's per-key position in the totally-ordered fleet
- *     stream. N replicas mirroring the same change therefore stamp the
- *     SAME number, and the sink's version guard dedupes the N duplicate
- *     writes for free — no leader, no clock, no skew hazard.
- */
-export declare type MirrorVersion = number;
+export { MirrorVersion }
 
 /** The error `.one()` throws: the factory's, or the framework's `NoRowFound`. */
 export declare const missingRowError: (info: NoRowFoundInfo, onMissing: OnMissingRow | undefined) => unknown;
 
+/**
+ * Store encoded wire output and decode it against the current output contract.
+ * A failed codec never falls back to an unvalidated raw response.
+ */
+export declare interface MutationCodec<Output> {
+    readonly input: Schema.Top;
+    readonly admit: (input: unknown, context: RuntimeContext) => Promise<void>;
+    readonly encode: (output: Output) => unknown;
+    readonly decode: (stored: unknown) => Output;
+}
+
 export declare interface MutationLifecycle {
     readonly afterCommit: (work: () => Promise<unknown>) => void;
     /** Already selected physical, namespace-bound nontransactional store.
@@ -7425,8 +7905,16 @@ export declare interface MutationLifecycle {
 export declare interface MutationLike {
     readonly descriptor: {
         readonly name: string;
+        readonly undo?: {
+            readonly capture: false;
+            readonly reason: string;
+        } | undefined;
         readonly source?: string | ReadonlyArray<string> | undefined;
         readonly guards?: ReadonlyArray<AnyCheckSpec> | undefined;
+        /** Query only — read by the computed-query cache (`computedQueryCache.ts`). */
+        readonly cache?: QueryCacheLike | undefined;
+        readonly input?: Schema.Top | undefined;
+        readonly output?: Schema.Top | undefined;
         /** The second-human control (mutation/action only). Enforced by
          *  `enforceApprovalGate`, immediately after `enforceGuards`. */
         readonly requiresApproval?: AnyApprovalPolicy | undefined;
@@ -7441,25 +7929,20 @@ export declare interface MutationLike {
     executor(input: unknown, ctx: unknown): unknown;
 }
 
-/**
- * Encode/decode a mutation's output for idempotent replay. On a FRESH call the
- * WIRE form (`encode`) is stored, so a later replay `decode`s it back to the exact
- * Output the handler would have returned and the rpc layer re-encodes it
- * identically. Storing the DECODED Output directly would corrupt `Date`/etc.
- * fields through the store's JSON round-trip (encode there expects a `Date`, not
- * the ISO string a round-trip produced). Built from `descriptor.output` at the
- * call site; both fns fall back to the raw value if the Schema can't round-trip.
- */
-export declare interface MutationOutputCodec<Output> {
-    readonly encode: (output: Output) => unknown;
-    readonly decode: (stored: unknown) => Output;
-}
-
 export declare interface MutationRunnerDeps {
+    /** Measures only the synchronous executor entry, never an awaited result. */
+    readonly measureSync?: <A>(run: () => A) => A;
     readonly outcomeOutbox?: (request: ServeRequestContext) => OutboxEnqueueFacade | undefined;
     /** A failure aborts the business transaction; transient contention replays
      * executor and hook together. Never perform external I/O here. */
     readonly beforeMutationCommit?: ServeMutationCommitHook | undefined;
+    /**
+     * Resolves once the cache invalidations this process started have reached
+     * the cache. Awaited after commit, BEFORE the mutation answers — without it
+     * the writer's next read raced its own invalidation and was served the
+     * pre-write entry. Both boot paths pass `wireCacheInvalidation`'s `settled`.
+     */
+    readonly settleCacheInvalidations?: () => Promise<void>;
     readonly store: TransactionalStore;
     /** Select and provision the request's physical store before opening its
      * transaction. Resolved once, including across retries and post-commit folds. */
@@ -7524,6 +8007,19 @@ export declare interface MutationStore extends DataStore {
     hardDelete(table: string, primaryKey: RowKey): Promise<boolean>;
 }
 
+/**
+ * The encoding a body of `size` bytes would be compressed with — `undefined`
+ * unless (enabled ∧ type compressible ∧ size ≥ threshold ∧ the client accepts
+ * an encoding). Lets a caller that has not read the body yet (a static file
+ * known only by `stat`) take the same decision `maybeCompress` takes.
+ */
+export declare const negotiatedCompression: (input: {
+    readonly size: number;
+    readonly contentType: string | undefined;
+    readonly acceptEncoding: string | undefined;
+    readonly options?: CompressionOptions | undefined;
+}) => NegotiatedEncoding | undefined;
+
 export declare type NegotiatedEncoding = 'br' | 'gzip';
 
 /** Pick the encoding the client accepts — brotli preferred, gzip second,
@@ -7531,24 +8027,7 @@ export declare type NegotiatedEncoding = 'br' | 'gzip';
  *  (a client sending both accepts both). */
 export declare const negotiateEncoding: (acceptEncoding: string | undefined) => NegotiatedEncoding | undefined;
 
-/**
- * A fresh trace id for work that has NO incoming span to continue — a webhook
- * delivery, a schedule firing, a devtools invoke, a REST or gRPC entry point.
- *
- * 128 random bits as 32 lowercase hex, the shape `TRACEPARENT_RE` above accepts
- * and the shape a collector, a log pipeline or `voltro traces` can join on.
- *
- * The reason this exists as ONE function: every entry point that minted its own
- * had drifted somewhere different, and three of the shapes were not ids at all.
- * `incoming:<webhookId>`, `reaction:<workflow>` and the literal
- * `'webhooks:trigger'` are CONSTANTS — they were the caller's `source` label
- * copied into the id field, so every delivery a process ever handled shared one
- * trace and the waterfall merged unrelated work. `public-`/`grpc-`/`rest-` plus
- * eight base36 characters carried ~41 bits, which collides long before a busy
- * day is over. The entry-point kind is not lost by fixing this: it lives in the
- * `source` field beside the id, which is where it was already being written.
- */
-export declare const newTraceId: () => string;
+export { newTraceId }
 
 /**
  * The backoff curve, extracted so it can be asserted directly — a schedule
@@ -7665,6 +8144,14 @@ export declare interface NoRowFoundInfo {
     readonly found: number;
 }
 
+/** Record a non-table input of the cached compute in flight, if any. Called by
+ *  the framework surfaces that reach outside the database. */
+export declare const noteCacheVolatile: (reason: string) => void;
+
+/** Note that the query in flight depends on `table` without reading it
+ *  through `ctx.store`. */
+export declare const noteDependency: (table: string) => void;
+
 /** Note one read against the in-flight procedure. No scope → nothing happens. */
 export declare const noteRead: (descriptor: QueryDescriptor) => void;
 
@@ -7694,6 +8181,45 @@ export declare interface Notification {
     readonly newMatched: boolean;
 }
 
+/** What a cross-environment restore did to the sealed values it cannot read. */
+export declare interface NullSealedReport {
+    readonly nulled: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }>;
+    readonly unreadable: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }>;
+    /** Recorded key ids removed: they came with the restored data and this environment does not hold them. */
+    readonly forgottenKeys: ReadonlyArray<string>;
+    readonly unreadableColumns: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * After restoring another environment's database: write NULL for every whole
+ * sealed value no configured key opens — the source ciphertext is useless here
+ * and users re-enter it — count the sealed copies inside other values (they
+ * cannot be nulled), and forget the restored key records and leases this
+ * environment does not hold, so the next boot records its own keys.
+ */
+export declare const nullUnreadableSealedValues: (dialect: DialectId, keyring: FieldKeyring | undefined, declared: Iterable<unknown>) => Effect.Effect<{
+    nulled: {
+        table: string;
+        column: string;
+        count: number;
+    }[];
+    unreadable: {
+        table: string;
+        column: string;
+        count: number;
+    }[];
+    forgottenKeys: string[];
+    unreadableColumns: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 export declare interface OAuth2ConnectionDefinition extends ConnectionDefinitionCommon {
     readonly kind: 'oauth2';
     readonly authorizeUrl: string;
@@ -7734,6 +8260,17 @@ export declare type OAuthClientCredential = string | (() => string);
 
 export declare const oauthCredentialValue: (credential: OAuthClientCredential) => string;
 
+/** Preserve the caller's environment, Exit and cancellation. Observation is
+ * installed before the body's first primitive; it creates no detached runtime. */
+export declare const observeApiRoleEffect: <A, E>(effect: Effect.Effect<A, E, never>, metrics: ReturnType<typeof makeApiRoleWorkloadMetrics>, workload: ApiWorkload) => Effect.Effect<A, E, never>;
+
+/**
+ * Test seam: a ConnectionInfo layer that hands every request's headers to
+ * `observe` and reports only the client id. It never authenticates and is not a
+ * boot path; it lives here so ConnectionInfo keeps one construction site.
+ */
+export declare const observeConnectionHeaders: (observe: (headers: Readonly<Record<string, string | undefined>>, clientId: number) => void) => Layer.Layer<ConnectionInfoMiddleware>;
+
 /** One recorded `(procedure → table, op)` edge. */
 export declare interface ObservedEdge {
     readonly tag: string;
@@ -7817,6 +8354,16 @@ export declare type OnMissingRow = (info: NoRowFoundInfo) => unknown;
  */
 export declare const onProcessShutdown: (hook: () => void | Promise<void>) => (() => void);
 
+/**
+ * Open every envelope in one cell with `keyring` — each under the address it
+ * was sealed under, found the same way a re-key finds it. A keyring holding the
+ * active key alone answers "does anything still need another key?".
+ */
+export declare const openCell: (text: string, keyring: FieldKeyring, context: CellContext) => {
+    readonly opened: number;
+    readonly unopened: number;
+};
+
 /** Thrown by `.expectVersion(n).set(...)` when the optimistic-lock guard
  *  matched no row (the row was concurrently updated or deleted). */
 export declare class OptimisticLockError extends OptimisticLockError_base {
@@ -8112,6 +8659,9 @@ export declare interface PairInput {
  */
 export declare const parseApprovalInterval: (spec: string) => number | null;
 
+/** `unity/0.1.0; surface=<64 hex>` → its parts; anything else is not an engine SDK. */
+export declare const parseEngineSdkHeader: (value: string) => Omit<EngineClient, "id" | "connectedAt"> | null;
+
 /** Parse a `traceparent` header. Returns null when malformed or when
  *  the all-zero invalid ids are present (per the spec those are
  *  treated as "no parent"). */
@@ -8316,8 +8866,7 @@ export declare type ProbeKind = 'liveness' | 'readiness' | 'startup';
  *  columns, which have no wire representation at all. */
 export declare const projectConnectionState: (definition: ConnectionDefinition, row: AnyRow_2 | undefined) => ConnectionState_2;
 
-/** Exact-match property filter. Values are AND'd. */
-export declare type PropertyFilter = Readonly<Record<string, string | number | boolean | null>>;
+export { PropertyFilter }
 
 export declare interface ProvenanceActor {
     readonly id: string | null;
@@ -8471,8 +9020,25 @@ export declare interface PumpOptions {
  */
 export declare const pumpOutbox: <T>(outbox: SubscriptionOutbox<T>, sink: OutboxSink<T>, label: string, options?: PumpOptions) => Promise<void>;
 
+/** A query's declared `cache:` block, structurally — see `QueryCacheConfig`. */
+export declare interface QueryCacheLike {
+    readonly ttl: number | string;
+    readonly swr?: number | string | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile?: boolean | undefined;
+}
+
+/** A query's declared `cache:`, parsed — `undefined` when the ttl does not
+ *  parse (the cache is then off for that query; `voltro doctor` says so). */
+export declare const queryCachePolicy: (cache: {
+    readonly ttl: number | string;
+    readonly swr?: number | string | undefined;
+    readonly scope: ComputedCacheScope;
+    readonly volatile?: boolean | undefined;
+}) => ComputedQueryCachePolicy | undefined;
+
 /**
- * The two scopes, composed once, for every path that finalises a descriptor.
+ * The read scopes, composed once, for every path that finalises a descriptor.
  *
  * **The primitives above were extracted so there is "no second copy that could
  * drift" — and then the COMPOSITION became the second copy.** `voltro dev`
@@ -8498,6 +9064,8 @@ export declare const pumpOutbox: <T>(outbox: SubscriptionOutbox<T>, sink: Outbox
 export declare interface QueryFinalizeOptions {
     readonly tenantScopedTables: ReadonlySet<string>;
     readonly softDeleteScopedTables: ReadonlySet<string>;
+    /** Tables carrying expires(); hosts derive this set from the schema registry. */
+    readonly expiresScopedTables?: ReadonlySet<string>;
     readonly observe?: {
         /** Before scoping — sees what the handler asked for. */
         readonly beforeScope?: (descriptor: QueryDescriptor, subject: {
@@ -8515,6 +9083,9 @@ export declare type QueryLike<R = Row_7> = QueryDescriptor<R> | {
 };
 
 export declare interface QueryProducerDeps<D> {
+    readonly workloadMetrics?: ReturnType<typeof makeApiRoleWorkloadMetrics>;
+    /** See {@link ComputedQueryCacheDeps}. */
+    readonly computedCache?: ComputedQueryCacheDeps;
     readonly buildContext: (request: ServeRequestContext) => {
         readonly store: unknown;
     };
@@ -8827,6 +9398,19 @@ export declare interface ReactiveSocketTunables {
  *  (unit tests, a bare library use). */
 export declare const reactiveSocketTunables: () => ReactiveSocketTunables;
 
+/** Bounded exact-incarnation read. Corruption/read failure is raised, never
+ * flattened to no observations. Membership expiry does not delete this history. */
+export declare const readApiRoleWorkloadWindow: (store: DataStore, input: {
+    readonly now: number;
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly requiredWorkloads: ReadonlyArray<ApiWorkload>;
+}) => Promise<{
+    buckets: ApiRoleWorkloadBucket[];
+    assessment: ApiRoleWindowAssessment;
+}>;
+
 export declare interface ReadClassification {
     /** Tables whose ROWS can reach the caller: the queried table and its joins. */
     readonly composed: ReadonlySet<string>;
@@ -8834,6 +9418,14 @@ export declare interface ReadClassification {
     readonly restricting: ReadonlySet<string>;
 }
 
+/** Every recorded lease, live or not. */
+export declare const readFieldKeyHolders: (store: DataStore) => Promise<ReadonlyArray<FieldKeyHolderRecord>>;
+
+export declare const readFieldKeyReports: (store: DataStore) => Promise<FieldKeyReports>;
+
+/** The recorded keys, without decrypting anything. */
+export declare const readFieldKeys: (store: DataStore) => Promise<ReadonlyArray<FieldKeyRow>>;
+
 /** First-or-null for a boot DataStore or a query-only tuple source. It invokes
  * the supplied query path, preserving that path's filters and codecs. A raw
  * driver remains raw; this helper does not add request scoping. */
@@ -8973,6 +9565,12 @@ export declare const recordExternalMissed: (name: string, count?: number) => voi
 
 export declare const recordExternalTrigger: (name: string, outcome: "accepted" | "duplicate" | "noOccurrence" | "ahead" | "notExternal" | "unknownSchedule") => void;
 
+/** One open of a sealed value. `key` opened it (`ok`) or was named by it (`failed`). */
+export declare const recordFieldDecrypt: (key: string, location: string, outcome: "ok" | "failed") => void;
+
+/** Record the last count or re-key — one row per kind, replaced each time. */
+export declare const recordFieldKeyReport: <K extends keyof FieldKeyReports>(store: DataStore, kind: K, report: NonNullable<FieldKeyReports[K]>["report"], at?: Date) => Promise<void>;
+
 /**
  * Record one emitted event into the identity's ring. Snapshots RESET the ring
  * (the snapshot's revision becomes the new replay base — a client holding an
@@ -9103,76 +9701,32 @@ export declare const redactColumns: <R extends Row>(rows: ReadonlyArray<R>, reda
 /** Blank sensitive-looking columns. Returns a new object; null passes through. */
 export declare const redactRow: (row: Row_2 | null | undefined) => Row_2 | null;
 
-/**
- * Options for `redisRywPositionStore`. The store needs TWO Redis
- * connections because `SUBSCRIBE` puts a client in a mode where only
- * (P)SUB / UNSUB / PING / QUIT are valid — sharing one client across
- * writes and the subscribe loop would deadlock. Pass the same client
- * for both unless you've separated them yourself.
- */
+/** Registry-owned command facade and one borrowed Pub/Sub consumer. */
 export declare interface RedisRywOptions {
-    /**
-     * Connection used for SET / DEL / GET fallback writes. Stays in
-     * normal command mode.
-     */
-    readonly client: Redis;
-    /**
-     * Separate connection dedicated to the SUBSCRIBE loop. Pass a fresh
-     * `client.duplicate()` of the main connection; the store does NOT
-     * duplicate internally because callers may want to manage the
-     * subscription connection's lifecycle separately.
-     */
-    readonly subscriber: Redis;
-    /**
-     * Redis key prefix — every entry stores under `${keyPrefix}:<subjectKey>`.
-     * Defaults to `'voltro:ryw'`. Override to namespace per-app when
-     * multiple deployments share a Redis.
-     */
-    readonly keyPrefix?: string;
-    /**
-     * Pub/sub channel name. Defaults to `${keyPrefix}:bus`. All nodes
-     * sharing an RYW state MUST agree on this name.
-     */
+    readonly client: RespClient;
+    readonly pubsub: RedisPubSub;
+    /** Application/environment namespace. Required; never shared implicitly. */
+    readonly keyPrefix: string;
+    /** Defaults to `${keyPrefix}:bus`; all participating processes must agree. */
     readonly channel?: string;
-    /** Clock injection for tests. Defaults to `Date.now`. */
     readonly now?: () => number;
-    /**
-     * Called when a Redis-side error occurs (publish/setex/subscribe
-     * failure). RYW degrades gracefully — local writes still succeed,
-     * other instances just won't see this node's writes until the next
-     * one. Hook for observability; default is a console.warn.
-     */
+    /** Local writes survive remote failures. Failed mutations are never replayed. */
     readonly onError?: (error: unknown, op: 'set' | 'delete' | 'subscribe' | 'parse') => void;
 }
 
+export declare interface RedisRywPositionStore extends RywPositionStore {
+    /** Drain accepted writes and release this consumer, leaving shared sockets open. */
+    readonly close: () => Promise<void>;
+}
+
 /**
- * Build a Redis-backed RYW store. Cross-instance coherent within one
- * round-trip; sync read path against a local mirror that the
- * SUBSCRIBE loop keeps warm. Lifecycle:
- *
- *   - on `set(key, entry)`:
- *       1. write to local map (immediate, sync)
- *       2. fire-and-forget SETEX in Redis with millisecond TTL
- *       3. fire-and-forget PUBLISH on the channel — peers update
- *          their local mirror without round-tripping Redis again
- *   - on `delete(key)`:
- *       1. remove from local map
- *       2. fire-and-forget DEL + PUBLISH
- *   - on `get(key)`:
- *       1. read from local map; lazy-evict if expired
- *
- * The SUBSCRIBE loop receives self-publishes (Redis sends them back
- * to the sender). Each entry carries a `senderId`; the local node
- * filters out its own broadcasts so we don't double-apply.
- *
- * On boot the local mirror is EMPTY. A read for a subject whose write
- * happened on a peer node before this node started will miss the
- * mirror — but `ReplicatedDataStore` falls back to primary on
- * "no position", so the worst-case is "one extra primary read on the
- * very first request that touches a peer-written subject". After that
- * read, this node's own writes propagate normally.
+ * Subscribe before returning. Reads consult only the process-local mirror.
+ * Writes update it synchronously, then enqueue PSETEX/DEL followed by PUBLISH.
+ * Pub/Sub is eventual and cannot replay lost messages or rebuild a new mirror.
+ * A missing position still follows replica routing under fallback and wait;
+ * neither policy establishes cross-process read-your-writes before delivery.
  */
-export declare const redisRywPositionStore: (options: RedisRywOptions) => RywPositionStore;
+export declare const redisRywPositionStore: (options: RedisRywOptions) => Effect.Effect<RedisRywPositionStore, KvError>;
 
 /** `__voltro.undo.redo` — re-apply a previously-undone invocation's forward
  *  changes. Idempotent if not currently undone. */
@@ -9226,7 +9780,15 @@ export declare const registerConnectionStream: (clientId: number, interrupt: ()
  */
 export declare const registerDefaultTupleSource: (source: TupleSource) => boolean;
 
-export declare const registerExternalizedTask: (task: ExternalizedTask) => void;
+/** Process-level callers share the same map even across duplicated modules. */
+export declare const registerExternalizedTask: (task: ExternalizedTask) => (() => void);
+
+/**
+ * Record a key ahead of the deploy that brings it, as `pending`, with its
+ * canary — so the first boot that holds it verifies its material, and the
+ * configuration without it still boots (nothing is sealed under a pending key).
+ */
+export declare const registerFieldKey: (store: DataStore, keyring: FieldKeyring, keyId: string) => Promise<void>;
 
 export { registerRetention }
 
@@ -9323,6 +9885,37 @@ export declare interface RegistryTableLike {
  *  request was. */
 export declare const rehydrateGuards: (serialized: ReadonlyArray<SerializedGuard>) => ReadonlyArray<AnyGuardSpec>;
 
+/**
+ * Re-seal every envelope in one cell that is not under the active key, or
+ * names no key, under the active key and the address it was sealed under.
+ */
+export declare const rekeyCell: (text: string, keyring: FieldKeyring, context: CellContext) => CellRekey;
+
+export declare interface RekeyReport {
+    readonly active: string;
+    readonly locations: ReadonlyArray<LocationRekey>;
+    readonly unreadable: ReadonlyArray<UnreadableColumn>;
+}
+
+/**
+ * Re-key every discovered location under the keyring's active key. With
+ * `dryRun`, count what would change and write nothing.
+ */
+export declare const rekeySealedValues: (dialect: DialectId, keyring: FieldKeyring, declared: Iterable<unknown>, options?: {
+    readonly dryRun?: boolean;
+    readonly onProgress?: (location: LocationRekey) => void;
+    /** Runs between reading a cell and writing it back — where another writer may change it. */
+    readonly beforeWrite?: (cell: {
+        readonly table: string;
+        readonly column: string;
+        readonly rowId: unknown;
+    }) => Effect.Effect<void, unknown, SqlClient.SqlClient>;
+}) => Effect.Effect<{
+    active: string;
+    locations: LocationRekey[];
+    unreadable: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 /** The store slice `applyDeclaredRelations` needs. `columns` is the junction's
  *  DERIVED reference pair — the truth the descriptor's declaration is checked
  *  against before anything is written. */
@@ -9345,6 +9938,9 @@ export declare interface RelationTuple {
     readonly resourceId: string;
 }
 
+/** Give up this process's lease — on shutdown, so nobody waits for it. */
+export declare const releaseFieldKeyHolder: (store: DataStore, holderId: string) => Promise<void>;
+
 /**
  * Release a claim back to `pending` (CAS `fired → pending`) — used when
  * the wake failed, so the next poll retries it (at-least-once wake). The
@@ -9435,6 +10031,7 @@ export declare interface ReplicaSelector {
 }
 
 export declare class ReplicatedDataStore implements DataStore {
+    readonly integrityQuery?: NonNullable<DataStore['integrityQuery']>;
     private readonly primary;
     private readonly replicas;
     private readonly adapter;
@@ -9446,12 +10043,13 @@ export declare class ReplicatedDataStore implements DataStore {
     private readonly health;
     private readonly recordRouting?;
     private readonly now;
+    private closing;
     constructor(options: ReplicatedDataStoreOptions);
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     private routeToReplica;
     private routeWaitMode;
     insert(table: string, row: Row): Promise<Row>;
-    insertMany(table: string, rows: ReadonlyArray<Row>): Promise<ReadonlyArray<Row>>;
+    insertMany(table: string, rows: ReadonlyArray<Row>, options?: InsertManyOptions): Promise<ReadonlyArray<Row>>;
     patchJson(table: string, primaryKey: string, path: string, value: unknown, additionalPatch?: Readonly<Record<string, unknown>>): Promise<Row | null>;
     update(table: string, primaryKey: string, patch: Readonly<Record<string, unknown>>): Promise<Row | null>;
     delete(table: string, primaryKey: string): Promise<boolean>;
@@ -9476,6 +10074,8 @@ export declare class ReplicatedDataStore implements DataStore {
     injectExternalChange(event: ChangeEvent): void;
     /** Forwarded from the primary — see DataStore.changeScope. */
     get changeScope(): 'local' | 'fleet';
+    /** Drain the RYW consumer before closing every SQL pool; repeated close is shared. */
+    close(gracePeriodMs?: number): Promise<void>;
     private stampPostWrite;
     private emitRouting;
 }
@@ -9557,8 +10157,8 @@ export declare interface ResendOptions {
     readonly attempts?: number;
 }
 
-/** Exported for tests — the warn-once set is process-global by design. */
-export declare const resetComputedQueryCacheWarnings: () => void;
+/** Test seam: back to the boot default. */
+export declare const resetComputedQueryCacheCaptureForTests: () => void;
 
 /** Test/dev-only — clear ALL per-connection state. Don't call from app code. */
 export declare const _resetConnectionCredentialsForTest: () => void;
@@ -9569,6 +10169,9 @@ export declare const resetDetachedForTest: () => void;
 /** Test seams for the tag-cache guard — the cache is module-private otherwise. */
 export declare const resetEventMetricTagCacheForTests: () => void;
 
+/** Test seam. */
+export declare const resetFieldDecryptCountsForTests: () => void;
+
 /** Drop everything recorded. For tests; not called by the runtime. */
 export declare const resetObservedGraph: () => void;
 
@@ -9772,6 +10375,15 @@ export declare interface ResolvedWorkflowCallerContext extends WorkflowCallerCon
     readonly rowFilter: RowFilterScope;
 }
 
+/**
+ * The keyring an environment configures, or `undefined` when it configures no
+ * key at all. Refuses (`FieldKeyringConfigError`, never containing key material)
+ * an unknown or missing active id, a duplicate id, one key under two ids,
+ * `KEY` equal to `_PREVIOUS`, and a `KEY`/`_PREVIOUS` set beside `KEYS` that
+ * `KEYS` does not contain.
+ */
+export declare const resolveFieldKeyring: (env: Readonly<Record<string, string | undefined>>) => FieldKeyringConfig | undefined;
+
 /**
  * Resolve the app's health block against the boot path's own readiness flag.
  *
@@ -10042,6 +10654,15 @@ export { RetentionSpec }
 
 export { retentionTtlMsFromEnv }
 
+/**
+ * Retire a key: nothing may be sealed under it again, and a configuration may
+ * drop it — the boot no longer asks for it. Refused for the active key, a key
+ * nobody recorded, and a key a live process still seals new values under (it
+ * has not adopted the new key yet). Whether VALUES are still sealed under it is
+ * the caller's question to answer first (`voltro secret retire` counts them).
+ */
+export declare const retireFieldKey: (store: DataStore, keyId: string, holder?: Pick<FieldKeyHolder, "now">) => Promise<void>;
+
 /**
  * Drop the ISR cache entries for a path on every `voltro start` replica.
  *
@@ -10349,6 +10970,8 @@ export declare interface RpcConnection {
 
 export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly group: RpcGroup.RpcGroup<Rpcs>;
+    /** Executable RPC surfaces for this replica; omitted retains both transports. */
+    readonly workloadAdmission?: RpcWorkloadAdmission;
     readonly handlersLayer: Layer.Layer<Rpc.ToHandler<Rpcs>>;
     /** Optional handlers layer dedicated to the one-shot HTTP rpc surface
      *  (`POST /rpc`, used by SSR web-router loaders). The HTTP JSON protocol
@@ -10544,6 +11167,14 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
     readonly security?: TransportSecurityOptions;
 }
 
+export declare interface RpcWorkloadAdmission {
+    readonly rpc: boolean;
+    readonly subscriptions: boolean;
+    /** Event streams are independent of live query subscriptions. */
+    readonly events?: boolean;
+    readonly routes?: ReadonlyArray<string>;
+}
+
 /**
  * Rules that apply to one change, or an empty list.
  *
@@ -10628,6 +11259,10 @@ export declare const runSingleNodeOrchestrator: (opts: SingleNodeOrchestratorOpt
 export declare const RUNTIME_NAME: "framework-runtime";
 
 export declare interface RuntimeContext {
+    /** Effective incoming Cookie header for server-side signature verification.
+     * Unverified private input; never return, log or persist it. Optional for
+     * internal callers and cookie-less requests. */
+    readonly cookieHeader?: string;
     /** Subscription / call subject — user, API key, service account, or anonymous. */
     readonly subject: Subject;
     /** Trace identifier — the active span's W3C trace id (32 hex) when
@@ -10761,6 +11396,8 @@ export declare interface RywPositionStore {
     delete(subjectKey: string): void;
     /** Approximate size for observability + tests. */
     size(): number;
+    /** Release consumer resources when this store owns any. */
+    readonly close?: () => Promise<void>;
 }
 
 /**
@@ -10933,6 +11570,8 @@ export declare type ScheduleHandler = (ctx: ScheduleContext) => void | Promise<v
 export declare type ScheduleOverlapPolicy = 'skip' | 'queue' | 'parallel';
 
 export declare interface SchedulerDeps {
+    /** Active synchronous handler entry only; never await a Promise inside this measurement. */
+    readonly measureSync?: <A>(run: () => A) => A;
     /** App-owned service environment; the signal interrupts Effect work on timeout. */
     readonly runEffect?: (effect: Extract<ReturnType<ScheduleHandler>, Effect.Effect<unknown, unknown, unknown>>, signal: AbortSignal) => Promise<unknown>;
     readonly store: DataStore;
@@ -11044,6 +11683,8 @@ export declare interface SchedulerDeps {
 }
 
 export declare interface SchedulerHandle {
+    /** Completed startup and shutdown has not begun; not a successful-job claim. */
+    isRunning(): boolean;
     /** Fire a schedule immediately, bypassing the cron clock + the
      *  coordinator. Waits for handler completion and returns the recorded run id. */
     fireNow(name: string, trigger: ScheduleTrigger | 'manual'): Promise<string | undefined>;
@@ -11349,6 +11990,22 @@ declare interface ScopeCtx {
 /** The scope strings a UI shows ("ask someone with …"). */
 export declare const scopeStringsOf: (serialized: ReadonlyArray<SerializedGuard>) => ReadonlyArray<string>;
 
+/** One column that holds envelopes, and what is under which key in it. */
+export declare interface SealedLocation {
+    readonly table: string;
+    readonly column: string;
+    /** The app declares it `.encrypted()` (a whole cell is one value), rather than a place found holding envelopes. */
+    readonly declared: boolean;
+    /** Cells holding at least one envelope. */
+    readonly cells: number;
+    /** Envelopes, counted per key id. */
+    readonly byKey: Readonly<Record<string, number>>;
+    /** Envelopes written before envelopes named their key. */
+    readonly unnamed: number;
+    /** Declared `.encrypted()` only: non-null cells that are not an envelope. */
+    readonly plaintext: number;
+}
+
 export declare interface SecretsBackend {
     /** Resolve a secret by key. `undefined` when absent. */
     readonly get: (key: string) => Promise<string | undefined>;
@@ -11488,6 +12145,8 @@ export declare type SerializedGuard = {
     readonly resource: string | null;
 } | {
     readonly kind: 'authenticated';
+} | {
+    readonly kind: 'upgraded';
 };
 
 /**
@@ -11507,6 +12166,14 @@ export declare type ServeMutationCommitHook = (context: Parameters<ServeRpcInter
 }) => Effect.Effect<void, unknown>;
 
 export declare interface ServeRequestContext {
+    /** Listener-owned identity; used only for measurement attribution here. */
+    readonly connection?: {
+        readonly transport: 'http' | 'websocket';
+    };
+    /** Effective incoming Cookie header for server-side signature verification.
+     * Unverified private input; never return, log or persist it. Optional for
+     * internal callers and cookie-less requests. */
+    readonly cookieHeader?: string;
     readonly subject: unknown;
     readonly traceId: string;
     readonly spanId?: string;
@@ -11565,7 +12232,7 @@ export declare const serverOnlyLeaks: (query: AuditableQuery, serverOnlyByTable:
 /** A plugin interceptor — wraps the base run Effect (Effect-native chain). */
 export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown, never>, meta: {
     readonly tag: string;
-    readonly kind: 'mutation' | 'action' | 'query' | 'workflow';
+    readonly kind: 'mutation' | 'action' | 'query' | 'workflow' | 'stream';
     readonly input: unknown;
     readonly subject: unknown;
     readonly traceId: string;
@@ -11781,8 +12448,14 @@ export declare interface SingleNodeOrchestratorOptions {
 export declare interface SnapshotCache {
     readonly wrap: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, compute: () => Promise<ReadonlyArray<Row>>) => Promise<ReadonlyArray<Row>>;
     /** Write-through from the live recompute, so the cache is never staler
-     *  than the freshest live subscriber. Fire-and-forget. */
-    readonly put: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, rows: ReadonlyArray<Row>) => void;
+     *  than the freshest live subscriber. Fire-and-forget. `fence` is the
+     *  cache's invalidation position observed BEFORE the rows were read: a
+     *  later invalidation of any tag voids the write, so an earlier, slower
+     *  read can never overwrite a later one. */
+    readonly put: (binding: SnapshotCacheBinding, tags: ReadonlyArray<string>, rows: ReadonlyArray<Row>, fence: number) => void;
+    /** The cache's invalidation position — observed before a read whose rows
+     *  will be written through. */
+    readonly fence: () => Promise<number>;
 }
 
 /**
@@ -11794,6 +12467,8 @@ export declare interface SnapshotCacheBinding {
     readonly key: string;
     readonly ttlMs: number;
     readonly swrMs: number | undefined;
+    /** The query name its counters are kept under (`queryStats`, metrics). */
+    readonly label?: string | undefined;
 }
 
 /**
@@ -11805,6 +12480,20 @@ export declare const snapshotCrdt: (store: CrdtHistoryStore, cell: CrdtCellRef &
     readonly createdBy?: string;
 }) => Promise<CrdtVersion | undefined>;
 
+/**
+ * The entry a READ belongs to: the rpc layer's scoped key plus the descriptor
+ * actually read.
+ *
+ * The rpc key names the query, its input and the scope (subject / tenant /
+ * global) — but not what the caller may SEE. A registered row filter makes two
+ * colleagues of one tenant read different rows through the same `'tenant'` key,
+ * and keying by the rpc key alone served the first colleague's filtered rows to
+ * the next one. The read descriptor carries every predicate the caller's
+ * visibility added, so two readers share an entry exactly when they read the
+ * same thing.
+ */
+export declare const snapshotEntryFor: (binding: SnapshotCacheBinding, read: QueryDescriptor) => SnapshotCacheBinding;
+
 /** Snapshot the whole registry, normalized to `MetricSample[]` — plus the
  *  socket-backpressure counters (`subscriptionSocketMetrics.ts`), appended
  *  HERE so every reader (Prometheus exporter, inspect Metrics panel) sees
@@ -11842,32 +12531,23 @@ export declare class SsrfBlockedError extends Error {
  */
 export declare const ssrfGuardHttpClientLayer: (policy?: SsrfPolicy) => Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
 
-export declare interface SsrfPolicy {
-    /**
-     * Hosts that bypass the guard. An entry may be an exact hostname
-     * (`billing.internal`), a suffix wildcard (`*.svc.cluster.local`), or a
-     * host:port (`127.0.0.1:8787`) when only one port should be reachable.
-     *
-     * This is the one escape hatch, and it is deliberately per-HOST rather than a
-     * boolean: "we call one internal service" and "we do not check URLs" are very
-     * different postures, and a boolean cannot tell them apart six months later.
-     */
-    readonly allowHosts?: ReadonlyArray<string>;
-    /** Max redirect hops to follow. Each one is revalidated. Default 5. */
-    readonly maxRedirects?: number;
-}
+export { SsrfPolicy }
+
+export { ssrfReason }
 
 /**
- * Decide whether a URL may be fetched. Returns `null` when allowed, else the
- * reason. Fails CLOSED: a URL that will not parse is blocked.
- *
- * DNS is deliberately NOT resolved — this is a synchronous check on the literal
- * target, so a hostname that RESOLVES to a private address (DNS rebinding) is not
- * caught here. Blocking the direct-IP vector is the high-severity, cheap half;
- * rebinding needs network-layer egress control and is called out in the docs
- * rather than silently implied.
+ * Heartbeat every {@link FIELD_KEY_HEARTBEAT_MS} for as long as the process
+ * runs. Logs a transition once — a key that became active, a key still waiting
+ * and for whom, an active key this process does not hold — never every beat.
  */
-export declare const ssrfReason: (rawUrl: string, policy?: SsrfPolicy) => string | null;
+export declare const startFieldKeyHolder: (store: DataStore, keyring: FieldKeyring, holder: FieldKeyHolder & {
+    readonly intervalMs?: number;
+    readonly log: {
+        readonly info: (message: string) => void;
+        readonly warn: (message: string) => void;
+        readonly error: (message: string) => void;
+    };
+}) => FieldKeyHolderHandle;
 
 /**
  * Start the rpc-based runtime server on Node. Composes:
@@ -12097,6 +12777,12 @@ export declare interface SubscriberDefinition {
     readonly table: string;
     /** Default `'any'`. */
     readonly on?: SubscribeOp | ReadonlyArray<Exclude<SubscribeOp, 'any'>>;
+    /** Bind this invocation's event publisher to the trusted committed row's
+     * tenant. No client input is available here. Omitted keeps system/global
+     * publication. This does not change ctx.store's system identity or turn a
+     * best-effort subscriber into durable delivery. Invalid results refuse the
+     * handler rather than publishing into the global partition. */
+    readonly eventTenant?: (event: SubscribeEvent) => string | null;
     /**
      * Run the handler ONCE PER CHANGE across the whole fleet, instead of once on
      * every replica that sees it.
@@ -12446,7 +13132,7 @@ export declare const tenantSelectionStore: (getStore: () => DataStore | undefine
  *  a page. */
 export declare const TERMINAL_RUN_STATUSES: ReadonlySet<string>;
 
-export declare type TimeBucket = 'minute' | 'hour' | 'day' | 'week' | 'month';
+export { TimeBucket }
 
 export declare interface TimelineEvent {
     /** Preserves the store's warning that images are not original commit images. */
@@ -12512,29 +13198,11 @@ export declare class TimelineRecorder {
     replay(table: string, asOfSeq: number, currentRows: ReadonlyArray<Row_2>): ReadonlyArray<Row_2>;
 }
 
-/** Time window. `to` defaults to now. */
-export declare interface TimeRange {
-    readonly from: Date;
-    readonly to?: Date;
-}
+export { TimeRange }
 
-export declare interface TimeseriesQuery extends AggregateQuery {
-    readonly bucket: TimeBucket;
-}
+export { TimeseriesQuery }
 
-export declare interface TopNQuery {
-    readonly event: string;
-    /** Property to group by (must be a string-valued property). */
-    readonly groupBy: string;
-    readonly metric: 'count' | {
-        readonly sum: string;
-    };
-    readonly n: number;
-    readonly range: TimeRange;
-    readonly filter?: PropertyFilter;
-    /** Tenant scope — injected by `useAnalytics()`; see {@link AggregateQuery.tenantId}. */
-    readonly tenantId?: string | null;
-}
+export { TopNQuery }
 
 /** A row a mutation wrote, carried to rule evaluation. `row` is the POST-WRITE
  *  state (insert result / update result). */
@@ -12986,7 +13654,11 @@ export declare class UndoStack<E> {
  */
 export declare const undoSurfaceEnabled: (env?: Record<string, string | undefined>) => boolean;
 
-export declare const unregisterExternalizedTask: (name: string) => void;
+export declare interface UnreadableColumn {
+    readonly table: string;
+    readonly column: string;
+    readonly reason: string;
+}
 
 /** One `source:` entry that resolves to no declared table. */
 export declare interface UnresolvedSource {
@@ -12999,6 +13671,8 @@ export declare interface UnresolvedSource {
     /** True when the name is in the `channel:` namespace: it named a reactivity
      *  channel nobody declared, which is a different repair from a stale table. */
     readonly channel: boolean;
+    /** Intentionally optional integration observation, retained in source. */
+    readonly optional?: true;
 }
 
 /**
@@ -13010,6 +13684,7 @@ export declare interface UnresolvedSource {
 export declare const unresolvedSources: (procedures: ReadonlyArray<{
     readonly name: string;
     readonly source: string | ReadonlyArray<string> | undefined;
+    readonly optionalSource?: ReadonlyArray<string>;
 }>, declared: ReadonlySet<string>) => ReadonlyArray<UnresolvedSource>;
 
 /** Thrown at boot; the message is the whole point, so it names the path and the
@@ -13091,6 +13766,27 @@ export declare type VerificationDeclared<T> = T & {
     readonly [WEBHOOK_VERIFICATION_PROPERTY]: WebhookVerification;
 };
 
+/**
+ * Check the keyring against the database and record what is new; make the
+ * database's active key the keyring's. Throws {@link FieldKeyringRefusal} when
+ * the keyring cannot read this database's data.
+ *
+ * `tables` are the app's declared tables: a few sealed values per
+ * `.encrypted()` column are opened as a sample, and nothing else is read.
+ */
+export declare const verifyFieldKeyring: (store: DataStore, keyring: FieldKeyring, tables: Iterable<unknown>, holder?: FieldKeyHolder) => Promise<FieldKeyringVerification>;
+
+/** Every location's envelopes, opened with `keyring` — after a re-key, a keyring with the active key alone. */
+export declare const verifySealedValues: (dialect: DialectId, keyring: FieldKeyring, declared: Iterable<unknown>) => Effect.Effect<{
+    opened: number;
+    unopened: {
+        readonly table: string;
+        readonly column: string;
+        readonly count: number;
+    }[];
+    unreadable: UnreadableColumn[];
+}, SqlError, SqlClient.SqlClient>;
+
 /** The pure core of live revocation: given a subject + action + a row-set,
  *  return ONLY the rows the subject may still see. The reactive matcher calls
  *  this on a permission-changing write and diffs against the prior visible set;
@@ -13168,6 +13864,19 @@ export declare const _voltroConnectionsTable: TableLike;
 
 export declare const _voltroCrdtVersionsTable: TableLike;
 
+/** The leases: which process holds which keys, and until when it counts —
+ *  rewritten by every heartbeat, so not reactive. */
+export declare const _voltroFieldKeyHoldersTable: TableLike;
+
+/** The last count and the last re-key `voltro secret status` / `rekey` / `rotate`
+ *  ran — what the Governance panel shows as a rotation's progress, since the
+ *  app itself never scans every sealed value. Counts and locations, never a value. */
+export declare const _voltroFieldKeyReportsTable: TableLike;
+
+/** Each field-encryption key id's state and canary — a framework table, created for every app.
+ *  Declared by its literal name: the data-transfer classification guard reads declarations. */
+export declare const _voltroFieldKeysTable: TableLike;
+
 /** `_voltro_rebac_tuples` — the relationship tuples `can()` reads. One row =
  *  "`subjectId` has `relation` on `<resourceType>:<resourceId>`". Grant by
  *  inserting; revoke by deleting (a delete is the live-revocation trigger). */
@@ -13917,7 +14626,7 @@ export declare interface WorkflowsAppContext {
      *  execution, or never to run — read once, without waiting. A queued handle
      *  is resolved through its durable receipt, so the answer survives the
      *  process that recorded the handle. */
-    readStart(handle: WorkflowRunHandle, options?: Pick<WorkflowWaitOptions, 'callerContext'>): Promise<WorkflowStartObservation>;
+    readStart(handle: WorkflowRunHandle, options?: WorkflowRunOptions): Promise<WorkflowStartObservation>;
     /**
      * Set on the facade a mutation TRANSACTION hands out: every start it records
      * is provisional until the transaction commits, so nothing about a start can
@@ -14100,6 +14809,10 @@ export declare const wrapStoreWithBootCodec: (underlying: DataStore, dialectId:
 
 export declare const wrapStoreWithMixinBehaviour: (rawUnderlying: DataStore, ctx: StoreMiddlewareContext) => FluentStore;
 
+/** Writer errors propagate to the publisher, which owns retry/logging. A failed
+ * history write must not be mistaken for a successfully recorded zero bucket. */
+export declare const writeApiRoleWorkloadBucket: (store: DataStore, bucket: ApiRoleWorkloadBucket) => Promise<void>;
+
 export declare const writeReplicaObservation: (store: DataStore, kind: ReplicaObservationKind, payload: unknown) => Promise<void>;
 
 export { }