@voltro/sql-mysql 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -39,6 +39,173 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.35.0] — 2026-08-13
+
+### ⚠ BREAKING
+
+- **@voltro/runtime, @voltro/cli, @voltro/plugin-clickhouse, @voltro/plugin-duckdb, @voltro/plugin-analytics-postgres** — The analytics CDC-mirror's version is derived from the CHANGE under `changeScope: 'fleet'` (postgres CDC, mysql binlog) — warehouse baseline plus the change's per-key position in the totally-ordered fleet stream — instead of each replica's own clock. An N-replica deployment still issues N duplicate writes per change (every replica observes the whole stream; that is the transport), but they are now BYTE-IDENTICAL — same row image, same version — so the sinks' existing guards (ClickHouse `ReplacingMergeTree(version)`, DuckDB/postgres `excluded.version > version`) dedupe them for free, with no leader election and no clock anywhere. This closes the real defect behind the N× cost: under clock skew larger than the gap between two changes to one row, a peer's duplicate of the OLDER image could take the higher version and win in the warehouse permanently and silently. A replica joining mid-stream seeds each key's numbering from the warehouse's own high-water mark via the new REQUIRED `AnalyticsMirrorImpl.maxVersion` read (all shipped warehouse sinks implement it; tombstoned deletes keep their version so the read answers after a delete — a custom sink follows the codemod note). The once-per-boot `changeScope=fleet` warning that named this cost is REMOVED — the hazard it named is gone. Local-scope stores keep the hybrid-clock version unchanged. New tunable: `VOLTRO_ANALYTICS_MIRROR_VERSION_STATE_LIMIT` bounds the per-key version state (default 100000; least-recently-changed keys re-seed from the warehouse on their next change).
+- **@voltro/cli** — The declared framework table set no longer reads a runtime flag. `CDC`, `VOLTRO_UNDO` and `VOLTRO_TRACING_PERSIST` each moved it before this release; `app.config.ts` gained `schema: { traces?, undo? }` to declare the two that still need a decision.
+
+  A consumer measured two fingerprints from one source tree, one database and one `NODE_ENV`, differing only in `CDC`. Their Helm chart gives the pre-upgrade migrate Job its own `env:` list — `NODE_ENV`, `DB_*`, the obvious migration inputs — while `CDC: "0"` lives in the pods' block, because change data capture is obviously a runtime concern. Nothing about the name reads as schema-affecting, so it was in none of their three overlays' jobs. The declared set is what the schema fingerprint hashes, so that is a GREEN migrate job followed by every pod refusing to boot. Latent for months, and it would have fired on their next deploy.
+
+  Counting the family after their report found three, not one — measured on a mariadb app at `NODE_ENV=production`, each flag flipped alone: `CDC=0` removed `_voltro_cdc_offsets`, `VOLTRO_UNDO=on` added `_voltro_undo_log`, `VOLTRO_TRACING_PERSIST=all` added `_voltro_traces`. All three are the kind of value an operator puts on the pods and not on the job, and only one of them had been noticed.
+
+  `NODE_ENV` had already produced this exact failure in 0.34.0 and was fixed by making one decider resolve it for every command. That fix does not generalise here: a job legitimately does not carry an observability flag, so there is nothing to agree on. The rule is therefore stated rather than patched — **the declared set may depend only on inputs every process in one deployment computes identically** (the source tree, `app.config.ts`, the dialect, and `NODE_ENV`), and `declaredSchemaGates.test.ts` sweeps every `VOLTRO_*` / `CDC` / `DB_*` name the framework reads anywhere in `packages/*/src` and fails if any of them moves the set. Derived rather than listed, because a test naming the three known offenders only re-checks what someone already remembered — which is how the two unreported ones survived.
+
+  The three got two different answers, deliberately. `CDC` left the derivation entirely: `_voltro_cdc_offsets` follows the DIALECT now, so a mariadb or mssql app declares it whether or not that process drives CDC. The cost is one empty offsets table and it is the same trade `impliesScheduleTables` already makes in writing. `VOLTRO_UNDO` and `VOLTRO_TRACING_PERSIST` could not simply be dropped — both can legitimately turn a table on in production, and a declared set that ignored them would leave capture writing to a table nobody created — so they keep their runtime meaning and lose their declaring power. Turning capture OFF still needs no declaration and never will; turning it ON without one is refused at boot, on both boot paths, with the config field named.
+
+  The `prod-mismatch` refusal also stopped being two hashes and a command. It prints which of the three decided tables THIS process declared and from which input, because the ledger stores no table set to diff against and the command it used to recommend was the one the operator had just run successfully. That half matters beyond the framework's own tables: a plugin's `extendSchema.tables` is app code and can read anything, so the rule above cannot be enforced for it.
+
+  **`voltro update` carries you across this** — codemod `0.35.0/05_declared-schema-drops-runtime-flags`.
+- **@voltro/protocol, @voltro/runtime, @voltro/cli, @voltro/devtools-ui** — A declared event must decide who may listen — the boot gate now covers `defineEvent`, closing SEC-1's sibling. `defineEvent`'s `guards:` was optional and `bindEvent` skipped an empty list, so under `security.defaultDeny` an event with NO access declaration was silently subscribable by anyone who could open the socket, while the identical shape was already refused for every procedure.
+
+  `defineEvent` now accepts `openAccess: '<reason>'` — mutually exclusive with `guards:`, reason string required — exactly as the four procedure definers do. The erased `{ open }` decision rides the same `guards` array every enforcement path reads; `bindEvent` treats it as "no check" (an open event pays what an unguarded one pays: nothing), and `eventToRpc` no longer unions `ScopeError` into the wire contract for an event that cannot produce a denial.
+
+  **Breaking for `security.defaultDeny` apps (the default):** an app with a `*.event.ts` declaring neither `guards:` nor `openAccess:` now refuses to boot under `voltro dev` and `voltro serve`, naming every undecided event — the same message, from the same gate, procedures get. `voltro doctor` lists the same set. Migration: give each event a decision (`guards: [{ scope: '…' }]` or `openAccess: '<why anyone may listen>'`); an app that wants the old default-allow declares `security: { defaultDeny: false }` once, in `app.config.ts`. Plugin-declared events are not judged — the gate reads the app's own discovered files only.
+
+  The events inspect snapshot (and the devtools Events panel) now counts only ENFORCEABLE guards and carries the `openAccess` reason, so a deliberately open event renders as "open access" instead of as "1 guard" over an event anyone may subscribe to.
+
+  **`voltro update` carries you across this** — codemod `0.35.0/01_event-access-decision`.
+- **@voltro/plugin-ai-flows** — **The breaking half, first:** `RunStepStatus` gained `'skipped'`. A sixth member means an exhaustive switch over it stops compiling and a status-keyed lookup has a hole — so a manual codemod fires on any app that names the type or its literals. Everything else here is additive (optional fields, new exports, one nullable column that rides the declarative differ).
+
+  Flows can now BRANCH, FAN OUT, and no longer chain without a bound. Three additions, and the third is a defect fix wearing a feature's clothes.
+
+  **`when:` — a conditional step.** A step runs only if its condition holds against the run context; a false condition SKIPS the step rather than failing it, so it produces no output and anything referencing it sees an absent value. The run timeline carries the rendered reason (`{{mode}} equals "full"`), because a step that silently vanished is indistinguishable from a step nobody declared.
+
+  The condition is STRUCTURED data (`{ ref, op, value }`), not an expression string, and that is three decisions in one. A flow can be authored as a stored row a user edits in a browser — an expression there is an evaluator running user-authored source on the server. The visual editor can offer a dropdown over a structure and cannot over a string it would have to parse. And `validateFlow` already walks every reference, so a structured `ref` joins that check for free: a typo'd condition would otherwise evaluate absent, take the false branch, and skip its step on every run, forever, with nothing logged.
+
+  Truthiness here deliberately differs from JavaScript's: `0` and `''` are TRUTHY. A step gated on a generated count or string means "did the producer run", not "is it non-zero" — the second is `{ op: 'neq', value: 0 }`, sayable when meant.
+
+  **`group:` — concurrent steps.** Consecutive steps sharing a group name run at the same time, each keeping its own durable step, so a replay resolves every branch from the journal exactly as it would sequentially. Kept as a flat field rather than a nested `parallel([...])` because the durable step name, the run timeline and a `human` step's signal name are all INDEX-keyed — nesting would re-index every flow already running.
+
+  Three rules, all enforced at registration: grouped steps cannot read each other's outputs (they have no order between them), a group must be contiguous (a name that stops and resumes would run as two sequential fan-outs), and a `human` review cannot join a group (it suspends the whole run). Context writes are applied after the whole segment in AUTHORED order — applying them as branches land would make the run context depend on scheduling, which a durable replay must never do.
+
+  **A chain is bounded — this half is a fix.** `chainTo` carried exactly one guard, a flow could not chain to itself, so `A → B → A` and any deep chain were unbounded: each hop starts a child run with a fresh idempotency key, so nothing collapsed it and nothing was counting the hops. A run now carries the chain that led to it ON THE PAYLOAD — deliberately not reconstructed from the run rows, because a guard whose evidence comes from a query is a guard that permits the loop whenever the query fails. A chain is refused on a cycle, or at `maxChainDepth` (default 5; `aiFlowsPlugin({ maxChainDepth })` or `VOLTRO_AI_FLOW_MAX_CHAIN_DEPTH`), and the refusal lands on the run row's new `chainRefusal` column naming the path. The parent run still SUCCEEDS: a refused follow-up is a configuration problem, not a reason to destroy a completed result.
+
+  All three are driven through the REAL durable executor in tests, not just their pure helpers — a primitive that is correct and reaches nothing is the defect class this package's own segmentation module exists to prevent.
+- **@voltro/protocol, @voltro/runtime, @voltro/cli, @voltro/ai, @voltro/plugin-billing, @voltro/plugin-flags, @voltro/plugin-governance, @voltro/plugin-notifications, @voltro/plugin-presence, @voltro/plugin-storage** — Every first-party plugin rpc route now declares an access decision (`guards:` or `openAccess: '<reason>'`), and `security.defaultDeny` is enforced in the DISPATCH spine as defense in depth behind the boot gate: a descriptor that reaches the wire with no decision (a third-party plugin route, an embedder's hand-bound descriptor) is refused per-request with a typed `ScopeError` before the transaction / external I/O. Twelve previously-open routes now require a scope: `billing.startCheckout` / `portalUrl` / `previewChange` / `changePlan` / `changeSeats` / `invoices` → `billing:manage`; `billing.reportUsage` → `billing:report`; `governance.export` / `erase` → `admin:full` (already enforced in-handler, now declared); `storage.mintUploadUrl` / `ingestUrl` → `storage:manage`; `storage.listRefs` → `storage:browse`. Migration: grant the scope to the role/subjects that legitimately hold each capability (rbac role, `resolveScopes`, api-key scopes) — the codemod lists every route and the open-by-design surfaces that did NOT change. `PluginRpcRoute` gains `guards`/`openAccess` fields, carried through the route lift into the enforced descriptor; the synthesized agent/undo/connections built-ins declare `openAccess` so they keep serving under default-deny.
+
+### Added
+
+- **@voltro/workflow, @voltro/cli** — `awaitSignal` now logs a one-time hint (once per workflow, never per poll) when its declared `timeoutMs` exceeds a threshold, naming `awaitSignalSuspending` — the drop-in variant that SUSPENDS the run and frees the worker slot for human-approval-length waits (WF-11). Threshold: `workflows: { suspendSignalHintMs }` in `app.config.ts` (default 5 minutes), env override `VOLTRO_WORKFLOW_SUSPEND_HINT_MS`. A hint only — the framework never swaps the variant under a run, because the two journal differently and a silent swap mid-history is a replay trap.
+- **@voltro/data-transfer, @voltro/sql-postgres, @voltro/cli** — The logical importer bulk-loads postgres targets via `COPY … FROM STDIN` (PERF-13). `voltro data import` engages it automatically wherever plain-INSERT semantics provably hold — `--mode replace`, or the default `upsert` into a table that is empty at import time (the fresh-target shape of every cross-dialect migration) — and never under `--atomic`. A refused COPY batch is atomic (nothing landed), so the importer replays exactly that batch through the per-row path with held-row / deferred-FK semantics intact. MEASURED on a 7-column table (text/int/bool/jsonb/timestamptz), 50 000 rows, local postgres: row-by-row 12.8 s (~3.9 k rows/s) vs COPY 0.59 s (~84.6 k rows/s) — **21.7×**. New seams: `ImportOptions.copyLoader` / `copyBatchSize` (default 5000) in `@voltro/data-transfer`, and `makePgCopySession` / `encodeCopyRow` in `@voltro/sql-postgres` (a submittable CopyIn query over the existing `pg` driver — no new dependency). Other dialects keep the per-row writes.
+- **@voltro/cli** — `voltro probe access` asks a RUNNING app whether its declared access is actually enforced — the question none of the existing checks ask.
+
+  `voltro check`, the boot access gate and `security.defaultDeny` all verify that a decision was DECLARED. None of them verifies that the declaration REFUSES anyone. That distinction is not hypothetical here: the dispatch spine and the boot gate were separate for several releases, a procedure filtered out of the rpc group while still bound in the handler map served silently on one path and crashed the other, and `check` itself counted a decided-open route as guarded. Every one was the declaration and the behaviour disagreeing, found by reading rather than by asking.
+
+  It calls every guarded procedure with NO credentials and reports three verdicts: `refused` (enforcement works), `admitted` (the finding), and `inconclusive` — the call failed for a reason that is not an access refusal, usually payload validation running before the guard. `inconclusive` is never counted as a pass; `--strict` fails on it, which is what CI wants.
+
+  It probes ANONYMOUSLY on purpose. That is strictly weaker than scope-by-scope differentiation and strictly safer: the alternative puts credential minting into a command that can be pointed at production. Procedures declared `openAccess:` are skipped — probing them would report every deliberately-public route as a finding and bury the real ones, which is the same signal-to-noise failure `kind: 'open'` was added to the wire to fix.
+
+  `fetchJson` gained an explicit `anonymous` option for this one caller; it is an opt-out, never a default, and both directions are pinned by a test — a bearer attached here would make every result meaningless while still printing green.
+
+  **Validated against a live app, and it took two corrections to get there.** The first version sent a readable request id, which the transport converts with `BigInt(id)` — so every probe came back as a Defect before any guard ran, and every app looked broken. The second read a top-level `_tag` off an object while `POST /rpc` answers an ARRAY of envelopes, so a correctly-refused call scored as `admitted`. Both versions had a green unit suite, because the fixtures asserted the shape the code assumed. The fixtures are now copied from a real transcript.
+- **@voltro/cli, @voltro/runtime** — `app.config.ts` gained `reactive: { deliveryConcurrency, rawReadTrackingLimit }` — the delivery-loop tunables were env-only, which left a number the framework picks on the project's behalf undeclarable in the one file that carries every other tunable.
+
+  Resolution stays inside the Dispatcher constructor (`resolveReactiveConfig`), so neither boot path can drift, and the env vars still win over the declared value: an operator acting on a running deployment outranks the project file. The threading itself is source-pinned across all three files (`dev.ts`, `serveCommand.ts`, `serveApi.ts`) because the serve side is a two-file relay and the union is where an option goes missing invisibly.
+- **@voltro/cli, @voltro/database** — Data residency is DECLARABLE and wired. `tenancy.residency` in `app.config.ts` opens one store per servable region on both boot paths and routes every request to its tenant's home region — or refuses it.
+
+  The primitives have existed for two rounds (`setResidencyConfig`, `residentPlacement`, `bindResidentStore`), exported and tested, with **zero callers**. A user could reach them, but nothing in the framework did: there was no way to declare residency and no request ever consulted it. That gap was pinned by a test walking every workspace source, which went red on this change and asked for the module header to be corrected — it now names its consumers instead of asserting it has none, so a SECOND unreviewed caller still fails.
+
+  ```ts
+  tenancy: {
+    isolation: 'namespace',
+    residency: {
+      servableRegions: ['eu-west'],
+      regionUrlEnv: { 'eu-west': 'DB_URL_EU', 'us-east': 'DB_URL_US' },
+      homes: [{ tenantId: 'acme', region: 'eu-west' }],
+    },
+  }
+  ```
+
+  `regionUrlEnv` names an env VAR, not a URL — a connection string is a secret and `app.config.ts` is committed. Everything else about a region's store (pool bounds, TLS, `search_path`, timeouts) is inherited from the primary connection, so a region cannot silently run with different limits than its deployment.
+
+  **Every failure is a refusal, never a fallback**, because a residency system that degrades to a default store violates residency at exactly the moment something is misconfigured. Unresolvable tenant, unmapped home, or a home region this deployment does not serve are all typed refusals; the last one names the region so a gateway can route it.
+
+  Four declarations are refused at BOOT rather than warned about: residency without `isolation: 'namespace'` (the region keeps regions apart, the namespace keeps tenants apart — one without the other is not isolation), a servable region with no env-var name, one whose env var is unset, and a tenant mapped to two regions.
+
+  Two boundaries worth knowing:
+
+  - `ctx.storeForTenant(id)` resolves residency for THAT tenant, not the caller's, so a handler acting on another tenant reaches that tenant's region or is refused. Background work (schedules, workflows) runs with no tenant and must use it — `ctx.store` there is the primary store. - A transaction is never re-routed. A caller-supplied store is used as given; it already went through residency to exist, and moving writes off the connection holding the lock is a worse failure than the one residency prevents.
+
+  Homes resolve once at boot (an array, or a function reading your own table), so adding a tenant home needs a restart — chosen over a cache with a staleness window on a decision whose whole value is that it is never wrong.
+- **@voltro/runtime, @voltro/cli** — `voltro schedule backfill <name> --from <iso> --to <iso> [--yes] [--limit N]` and `POST /_voltro/inspect/schedules/:name/backfill` (WF-14) — fire every cron occurrence of a schedule over an explicit range, sequentially, each recorded against its own cron-derived `scheduledAt` with `trigger: 'manual'`. Fills the gap boot backfill (walks from the last recorded run only) and cluster-cron catch-up (capped at one day) leave open. Bounded and confirmable: above 25 occurrences it refuses without `--yes` (printing the count), above the per-request cap (default 1 000, `--limit` up to a hard ceiling of 10 000) it refuses outright, firing nothing — never a silent prefix. Wired on both boot paths through one shared hook.
+- **@voltro/devtools-ui, @voltro/plugin-search** — The Search dashboard panel now RENDERS the drift surface REL-1 shipped server-side and no dashboard showed (the additive-JSON silent-drift shape the 4-layer rule exists for): per-index `dropped` / `pendingDrift` / `drifted` / last-drift badges, the repair queue itself (`GET /drift` — oldest first, with attempt counts and the engine's last error), and a **Resync now** action (`POST /resync`) gated on the new `canResyncSearch` capability (its own flag — a resync re-reads only the drifted rows; a reindex re-reads the whole table). Landed across all four layers in one change set: shared `SearchPage` + wire types + capability + EN/DE strings here; HTTP fetchers + page wiring in voltro-devtools; tenant-scoped `apps.inspectSearchDrift` / `apps.inspectSearchResync` proxies + hooks + page wiring in voltro-cloud (the indexes proxy schema carries the new fields as OPTIONAL, so a customer app from before the drift ledger still decodes). `search.query` also now carries an explicit access decision (`openAccess`, with the tenant-scoping rationale in source) instead of the undecided SEC-1 shape.
+- **@voltro/cli** — Workflow wakes over the change stream (WF-8): on a fleet where remote changes reach the change spine (Postgres LISTEN/NOTIFY CDC — the common broker-less multi-replica deployment), a remote replica's `signal-sent` event, start context, or run transition now triggers an immediate, coalesced `pollStorage` on every replica, so cross-replica signal/step latency stops being bounded by the 10 s storage poll. Honest subset by design: the cluster engine has no per-run wake seam, so the change event wakes the poll early rather than replacing it — the poll tick stays the safety net. Local-origin changes never wake (a replica waking on its own recorder rows would be a poll storm). Wired by the same `makeWorkflowWake` builder on both boot paths.
+- **@voltro/runtime, @voltro/workflow, @voltro/cli** — `ctx.workflows.start(name, payload, { at: Date })` — delayed one-off starts (WF-13). The start is parked as a durable `_voltro_workflow_pending` row (`mode: 'delayed'`) and fired by the coordinated drainer when `at` arrives, so it survives restarts and fires on whichever replica drains. At `at` it becomes an ordinary ARRIVAL: declared flow control (debounce, singleton, rateLimit, …) judges it as of that moment — `at` never bypasses a control. The handle reports `status: 'queued'` with `deferral: { mode: 'delayed', dueAt }`. An `at` in the past starts immediately; `{ at, wait: true }` is refused. `at` is an absolute instant by design (no `delay` spelling): a delay is ambiguous about its epoch and every queue system answers it differently, while an instant composes with the schedule/backfill surfaces.
+- **@voltro/workflow, @voltro/cli** — `workflows: { recording: 'coarse' }` in `app.config.ts` (env override `VOLTRO_WORKFLOW_RECORDING`) — turns off the two fire-and-forget per-step writes to `_voltro_workflow_run_steps` (WF-10) for hot high-step workflows. Run rows, run events (signals/timers/cancels/stall reports) and the cluster engine's durable journal are unaffected — replay and redrive work exactly as before; the cost is an empty step timeline for runs recorded under coarse. Measured before it was built (`packages/cli/scripts/admission-throughput.mjs`): the recorder costs exactly 2 store writes per step, off the step's critical path — which is why the knob is a skip, not a batcher.
+- **@voltro/workflow, @voltro/cli** — `workflow({ schedule })` — the workflow-side cron declaration (WF-12), with Temporal Schedules' overlap vocabulary about the RUN: `onOverlap: 'skip' | 'buffer' | 'cancelOther'`. Pure sugar over the shipped scheduler: at boot it lowers into a real schedule named `workflow:<name>` (same coordinated claims, run rows, Schedules panel, `voltro schedule` verbs). The synthesised firing awaits the workflow run to completion, which is what makes skip/buffer bind on the run's duration; `cancelOther` cancels only the still-running run this schedule itself started. The firing watchdog (`schedule.maxRuntime`) defaults to 24 h here. Cron and timezone are validated at definition time.
+
+### Changed
+
+- **@voltro/plugin-clickhouse** — `clickhouseAnalytics` now BATCHES `track()` inserts by default (PERF-11) — 20 events / 5 s, plugin-posthog's conservative numbers — instead of one HTTP insert (and one MergeTree part) per event. What changes observably for an app that never set `batch`: a successful `track()` now means "buffered", not "ClickHouse accepted the row"; events become readable up to 5 s after they were tracked; a flush failure drops that batch with a warning (a hard crash loses whatever is still buffered — graceful shutdown drains via `dispose`). Opt OUT with `batch: false` to restore one immediate, confirmed insert per event; `batch: { maxSize, flushIntervalMs }` tunes the window. No compile break — `batch` widened to `ClickhouseBatchOptions | false`, and the previous opt-in spelling keeps working (its defaults are now 20/5000 rather than 1000/5000).
+- **@voltro/database, @voltro/cli, @voltro/workflow** — The migration advisory lock is now scoped to the configured schema (`DB_SCHEMA`) instead of one framework-wide constant. A postgres advisory lock is database-scoped and MySQL `GET_LOCK` is server-wide, so two apps sharing one database in different schemas used to serialize each other's migrations and defer each other's boot-time trigger repair — with a log line blaming "another instance". Now: postgres derives a stable 64-bit key from the schema name (FNV-1a 64 of `voltro_migration_lock:<schema>`, sign bit cleared; collisions across schemas are possible and only reintroduce serialization, never a race); mysql/mariadb/mssql suffix the lock NAME with the schema (hashed past MySQL's 64-char `GET_LOCK` cap). Every taker moved together in this change — the declarative applier, the file-based runner, the boot auto-migrate, the CLI's reactive-trigger boot repair, and the workflow cluster first-boot gate (its own distinct key, same derivation). On mysql/mariadb, where `GET_LOCK` is server-wide and `DB_SCHEMA` is not a connection pin, setting `DB_SCHEMA` to your database name is how two apps on one server un-share the lock.
+
+  **Rolling-deploy story.** An app WITHOUT `DB_SCHEMA` (or with `DB_SCHEMA=public`) keeps the EXACT pre-change lock key and name — old and new replicas contend on the same lock throughout the rollout; nothing to do. An app WITH a non-default `DB_SCHEMA` changes its lock key when it lands this version: during that one rollout window, old-generation and new-generation replicas do not mutually exclude their DDL. The boot auto-migrate DDL is idempotent (`IF NOT EXISTS`-shaped), so the practical exposure is the known postgres `CREATE TABLE IF NOT EXISTS` catalog race — worst case one replica's boot fails and restarts. Avoid running `voltro db apply` concurrently with THAT rollout; after it, everything contends on the schema-scoped key.
+- **@voltro/plugin-search** — `POST /reindex` now STREAMS the source table (keyset-paginated `streamTable`) and upserts one bounded page at a time instead of loading the whole table into memory — the old shape was an OOM on exactly the tables big enough to need a reindex (PERF-12). The page size is a new tunable, `searchPlugin({ sync: { reindexBatchSize } })` (default 1000), and the `/indexes` panel reports it as part of the policy in force. `backfillIndex` keeps its plain-array signature for small explicit seeds. Additive surface only: a new optional `SearchSyncOptions` knob + a new `SYNC_DEFAULTS` key — no existing call site changes meaning.
+- **@voltro/plugin-search** — Sync-stat counters no longer pay a read+CAS against the OLTP primary on EVERY indexed-table write (PERF-14). Counts buffer in memory and flush per window — `searchPlugin({ sync: { statsFlushIntervalMs } })` (default 5000 ms; `0` restores the per-event durable write) with an early flush at `statsFlushMaxBuffered` (default 1000) pending counts. Mirrors the runtime's api-key usage buffer, SHUTDOWN included: plugin deactivate drains the tail on both boot paths, so a graceful deploy loses nothing; a hard crash loses at most the current window of counters (never a change — the drift ledger stays the durable record). `GET /indexes` drains the buffer before reading, so the panel stays truthful mid-window. `StatsStore` gained a delta-applying `add` (the flush target); both shipped impls carry it and nothing consumes user-provided `StatsStore` implementations.
+- **@voltro/database, @voltro/plugin-webhooks, @voltro/testing, @voltro/voltro, @voltro/workflow** — Golden churn from this round's signature WIDENINGS, classified per package:
+
+  - **@voltro/database** — every migration entry point (`applySchema`, `runMigrate`, `runFrameworkBootstrap`, `applyNamespacedSchema`, `provisionTenantNamespace`, the lock functions) gained a trailing OPTIONAL parameter (`SchemaApplyOptions` / `MigrationLockScope`) for the schema-scoped lock and the dialect retry predicate. Every existing call compiles unchanged; omitting the parameter is exactly the old behavior. - **@voltro/workflow / @voltro/testing / @voltro/voltro** — the same widenings re-exported through the aggregates, plus `PresenceWrite`-adjacent type surface already classified in this release's presence entry. - **@voltro/plugin-webhooks** — `deliverWebhookWorkflow`'s payload type inference had COLLAPSED to `AnyStructSchema | Struct<Fields>`, which made `execute`'s requirements `any` for every consumer: there was no type contract in force to break, only one that silently did not exist. It now infers the real payload struct. The export's only callers are the framework's own boot paths (it exists for cluster-runner registration); an app that passed a wrong-shaped payload under `any` now gets the compile error it should always have had — which is the fix, not collateral.
+
+### Fixed
+
+- **@voltro/cli, @voltro/protocol** — `voltro doctor`, the boot refusal, and `GuardSpec.resource`'s own doc comment now name the per-resource form of an access decision. All three listed two ways to decide and there are three.
+
+  A consumer with 565 undecided procedures set `security: { defaultDeny: false }` across their app, and their reasoning was correct at every step from what they were shown. Their authority is per-team — a viewer in one team, an admin in another — so a subject-global `guards: [{ scope }]` would state a check they do not perform, and the boot refusal warns against exactly that ("reaching for a scope every caller already holds satisfies the gate, reads as protection, and enforces nothing"). `openAccess:` would be untrue. Both offered forms were rightly rejected, so they turned the gate off and kept enforcing in handlers.
+
+  The form that fits them — `guards: [{ action, resourceType, resource }]`, backed by `defineResourcePolicy` and a tuple source registered over their own tables — has shipped for several releases, is wired on both boot paths, fails closed without a resolver, and is documented under Authentication → Authorization. They looked: they read `GuardSpec.resource`, whose doc comment described the resolver as "a future ReBAC / `accessPolicy()` resolver". That sentence was written before the ReBAC path shipped and never updated, and it is the only thing a reader of that type has. A doc comment that says "future" about something built is not a small inaccuracy — it argued a careful team out of a security gate.
+
+  An enumeration inside a refusal is read as exhaustive, and the more careful the reader, the more thoroughly they act on it. `accessDecisionForms.test.ts` pins all three forms in all three places, including the `defaultDeny: false` branch — an app that has already given up is precisely the audience that needs to learn there was a third option.
+- **@voltro/protocol, @voltro/database, @voltro/runtime, @voltro/plugin-broadcast, @voltro/sql-postgres, @voltro/sql-mysql, @voltro/sql-sqlite, @voltro/sql-mssql** — A reactivity-channel publish now says where it came from — `origin: 'inline'`, because it happened in THIS process — instead of borrowing the `'injected'` stamp its transport seam applies by default. Two defects came out of that one mislabel, both silent:
+
+  - **A channel published synchronously from inside a change listener never left the replica.** `plugin-broadcast` suppresses re-publishes while it is injecting, and the bracket was coarse: it dropped EVERY emission made in that window, not just the event it had injected. So `onChange` → `publishReactivity` woke the local node and no peer ever heard it — no error, no log. The one plugin doing cross-replica fan-out (presence) escaped only because it re-publishes from its own transport callback. The guard now suppresses by provenance, so a local publish made inside the bracket travels like any other. - **A replica could not tell its own channel publish from a peer's.** Both arrived `'injected'`, so a listener fanning a channel onward had nothing to key on and needed a boolean per channel to avoid an echo. `origin` answers it now.
+
+  Two supporting changes, each with its own failure mode:
+
+  - `origin` no longer survives the wire. It describes how an event reached THIS process, so the receiving replica strips what the sender serialised and stamps its own. Without this the guard fails OPEN — measured, an arrival still claiming `'inline'` amplified one publish into 163 events and killed the test worker. - The transport-origin stamp has one definition (`externalChangeEvent`, `@voltro/database`) instead of five hand copies across the memory store and the four dialect stores. `injectOriginParity.test.ts` fails if any store grows its own again — a store that hand-stamps would override a caller's stated origin, and the visible result is a channel that stops crossing replicas on that dialect only.
+
+  `DataStore.injectExternalChange` keeps its shape: an event that states no origin is still stamped `'injected'`. A store passed to `plugin-broadcast` that does not stamp at all (the interface is structural) is detected by identity and falls back to the old coarse suppression rather than amplifying.
+- **@voltro/cli, @voltro/devtools-ui** — `voltro check` no longer mistakes a deliberate `openAccess:` mutation for an unguarded one — and no longer mistakes it for a guarded one either. The manifest serialises the decision as a `kind: 'open'` guard entry carrying the reason string; `toInput` now translates it into `openAccess` on the graph procedure with `hasGuards: false` (nothing IS checked), and the `rbac/unguarded-mutation` rule skips a procedure whose author already "confirmed it is intentionally public" — the rule's own fix text. Previously the open entry was counted as a guard, so the finding disappeared for the wrong reason: the open mutation read as protected.
+
+  `@voltro/devtools-ui` gains the hand copy of the `SerialisedGuard` wire union (it is deliberately dependency-free, so it cannot import the CLI's), renders an access badge on the RPC page — guard count, or "open access" with the reason in the tooltip — and the copy is pinned from the owning side by `serialisedGuardParity.test.ts`, in the style of `migrationOpKindParity`.
+- **@voltro/cli** — `ctx.query` in a loader rejects an `error` event instead of returning it as the query's rows.
+
+  A consumer put a guard with an unheld scope on a query and called it over HTTP with a valid user JWT. The batch came back 200 with an `error` chunk carrying a `ScopeError` and an `Exit: Success` after it. Both are correct — the transport worked and the guard worked — but `buildLoaderQuery` unwrapped exactly ONE member of the three-member `subscriptionEvent` union and passed the other two through as data. The loader returned the error OBJECT, it went into the SSR seed, and the component called `.map()` on it: `TypeError: kept.map is not a function`, on 135 pages, for every user.
+
+  The `.catch(() => null)` in our own documented loader pattern could not fire, because nothing was thrown. Neither could `seedPagePreloads`' `onError`, for the same reason. The same rejection over the live socket sets `error` and leaves data empty, so the two transports were saying different things about one event.
+
+  The unwrap is exhaustive now: `snapshot` yields its rows, `error` rejects with the typed error attached (as `cause` and `voltroError`, so an app can still branch on `ScopeError` rather than parse a string), and a first-event `delta` — structurally impossible today — throws naming itself a framework bug rather than handing a loader an id-keyed patch. `buildLoaderQuery` has one implementation shared by `voltro dev` and `voltro start`, so the fix covers the production path the report did not measure.
+
+  The HTTP 200 is unchanged, and the reporter is right that it should be: the batch transport did succeed.
+- **@voltro/database, @voltro/cli** — The schema apply (`applySchema` / boot auto-migrate / framework bootstrap) now consults the dialect's own transient-failure predicate instead of dying on the first `SQLITE_BUSY`. The gap was located in `@voltro/sql-turso`: `busy_timeout` cannot retry the deferred-upgrade lock class, the store path already honoured the dialect's `retryFilter`, and the migration applier never consulted it — so a DDL statement that met the schema lock failed on the first attempt while every equivalent DML statement would have been retried. The CLI threads each loaded dialect's `retryFilter` through the new `SchemaApplyOptions`; retries are bounded (`VOLTRO_MIGRATION_DDL_RETRIES`, default 4, exponential backoff with jitter) and only ever re-run statements that are safe to re-run: per-statement on the per-operation dialects (sqlite/turso/mysql/mariadb, `IF NOT EXISTS`-shaped or covered by the duplicate-index tolerance), whole-transaction on postgres/mssql, whose retryable classes (deadlock victim, serialization failure) roll the transaction back cleanly. No `retryFilter` threaded means no retry — exactly the previous behavior. The declarative plan applier (`applyPlan`) is deliberately unchanged: its operations are not uniformly idempotent, and partial failure there is owned by the resume ledger.
+- **@voltro/web, @voltro/client** — The web first load no longer ships `msgpackr` — 190.5 → 180.6 KB gz (−9.9 KB, 5.1% of the whole first load) for every app, measured on the zero-procedure fixture and re-pinned into `bundle-budget.json`.
+
+  It shipped because `@effect/rpc`'s RpcSerialization module top-level-imports msgpackr while every Voltro path selects `layerJson`, and msgpackr declares no `sideEffects` flag — so no bundler was allowed to drop it. The fix is a dependency patch adding `sideEffects: false`, declared at BOTH workspace roots (the @effect/cluster patch rule: a meta-root `pnpm install` must apply it too, or the two installs fight over node_modules). An app that genuinely calls `makeMsgPack` keeps the library — the flag only permits dropping it when unused.
+
+  The bundle-budget gate's slack floor is what keeps this fixed: the budget is re-pinned to the new number, so quietly re-inflating past it fails CI.
+- **@voltro/cli, @voltro/database** — Under `tenantIsolation: 'namespace'`, a tenant's namespace is now PROVISIONED on its first use — schema DDL plus the `onTenantCreate` seed lifecycle, memoised per namespace per process.
+
+  Neither ever happened: `provisionTenantNamespace` — documented as "the entry point the CLI / runtime use, eager at migrate time or lazily on first use" — had zero callers in the entire codebase, `withNamespace` returns a pure view, and so a fresh tenant's first request died on "relation does not exist" while the `onTenantCreate` seeds (recorded as wired) fired only from tests that called the function directly. Found by the claimed-wirings checker the moment it learned to read active-voice claims.
+
+  Both boot paths build the provisioner from one builder; the namespace view's async methods await the memoised ensure (one resolved-promise await after the first settle), sync members stay sync, and the method classification is a DERIVED guard — a new `DataStore` method fails the test until someone decides whether it must await provisioning. A failed provision is surfaced and forgotten, never cached: one transient DDL failure must not become a permanently broken tenant on a replica. Verified end to end on live postgres, control included: the raw view still fails against a fresh namespace, the provisioned one creates the schema and fires the lifecycle exactly once.
+
+  Eager provisioning stays the app's move (call `provisionTenantNamespace` from a seed or startup over your own tenant table) — the framework has no tenant registry to enumerate, and the docs now say so instead of implying otherwise.
+- **@voltro/runtime, @voltro/cli, @voltro/testing** — `setRowFilter`'s registration moved from a module-local variable to a `globalThis` cell, and a scoped store that receives no filter while one is registered now throws instead of serving unfiltered rows.
+
+  A consumer measured four read paths returning every row of the tenant to every employee — 19/19 contracts, 231/231 time-entry requests, 6/6 user settings, 4637/4637 shifts — on both HTTP and WebSocket, with `row filter registered` in the boot log and 27 green tests. One of those paths was the only thing keeping `userSettings.update` safe, so every user could edit every other user's settings.
+
+  Their exclusion work was exhaustive and right at every step: the load succeeded, `predicateFor` returned predicates for the right tables, nothing was `unconstrained`, no handler bypassed the store, and a `setRowFilter` + `makeTestContext` pair reproduced CORRECT filtering. That left them concluding the remaining variable was the store — memory in the green reproduction, postgres in the red deployment.
+
+  It is not the store, and the correction is the transferable part: their reproduction ran inside ONE module instance and production does not necessarily. `ROW_FILTER` was a module-local `let`, so an app's `*.startup.tsx` and the framework's serve pipeline write and read different variables whenever they hold different copies of `@voltro/runtime` — the serve bundle inlines the framework while app modules stay external, and strict pnpm resolves one version into two physical directories when two importers have different peer contexts. The pipeline reads `undefined`, correctly interprets it as "this app registered no filter", and serves everything.
+
+  `@voltro/database`'s `coreTablesRegistry` carries this exact fix with a comment describing this exact failure, for a value whose worst case is a crash at boot. This one's worst case is silent data exposure and it did not have it.
+
+  The second half answers the reporter's second ask directly: a filter that cannot be applied must fail loudly rather than pass quietly. `undefined` and "we could not tell" had collapsed into one value, and the doc comment on that option already asserted they must not. Every deliberately unfiltered path — system sweeps, `runAsSystem`, change-stream subscribers, the seeding store in a test — now passes `NO_ROW_FILTER` explicitly, because "this app has no filter" and "this path is unfiltered on purpose" are different claims and only the second is a decision somebody made.
+- **@voltro/cli** — A bare `voltro serve` under docker compose now drains on SIGTERM — in-flight requests complete against a fully-alive app, the listener refuses new work, live WebSockets are ended cleanly, and the process exits on its own, well inside `VOLTRO_SHUTDOWN_GRACE_MS`. No preStop hook or endpoint removal required. Two real defects closed (both measured against a live server): a single connected WebSocket wedged `nodeServer.close()` — node's `closeAllConnections()`/`closeIdleConnections()` cannot end an upgraded socket while `close()` still waits on it — so EVERY shutdown with a connected web client ran to the 10s deadline cut and the steps queued behind the close (the store's connection-pool close included) silently never ran; and the shutdown hook deactivated plugins and drained the analytics mirror BEFORE the request drain, so a request finishing during shutdown hit dead services and its writes were never mirrored. The drain is bounded: in-flight requests get 60% of the shutdown grace (floor 500ms), stragglers are then destroyed, and idle keep-alive sockets are swept continuously so a finished response never delays exit. The stale `serveApi` comment claiming `NodeRuntime.runMain` owns SIGTERM (and pointing at a k8s preStop hook as the fix) is rewritten to describe the drain that actually runs. Verify against a real serve with `node scripts/serve-drain-check.mjs`.
+
+---
+
 ## [0.34.0] — 2026-08-12
 
 ### ⚠ BREAKING

package/dist/index.js

@@ -1,32 +1,32 @@
 import { MysqlClient as e } from "@effect/sql-mysql2";
 import { Config as t, Effect as n, Layer as r, ManagedRuntime as i, Option as a, Redacted as o, Schedule as s } from "effect";
-import { CDC_OFFSETS_TABLE as c, DEFAULT_ACQUIRE_TIMEOUT_MS as l, EagerCardinalityError as u, _voltroCdcOffsetsTable as d, attachEagerLoads as f, attributionFields as p, attributionKey as m, beginLocalWrite as h, bulkInsertLimitsFor as g, chunkRowsForInsert as _, compileEagerJson as v, compilePredicate as y, compileRawFragment as b, compileSelect as x, decodeRowsFromSchema as S, encodeRowForSchema as C, endLocalWrite as w, hasEagerLoads as T, isTableReactive as E, makeEagerFallbackReporter as D, observeDbOp as O, qualifyTable as ee, raiseChangeListenerCeiling as k, recordsTable as te, registerPendingAttribution as ne, requireTable as re, resolveEchoAttribution as ie, runStoreTransaction as ae, runWriteRecorders as oe, stampGeneratedId as A, stampGeneratedIds as se, withCapturedAttribution as j } from "@voltro/database";
-import { EventEmitter as M } from "node:events";
-import { createLogger as N } from "@voltro/logger";
-import { SqlClient as P, TransactionConnection as F } from "@effect/sql/SqlClient";
+import { CDC_OFFSETS_TABLE as c, DEFAULT_ACQUIRE_TIMEOUT_MS as l, EagerCardinalityError as u, _voltroCdcOffsetsTable as d, attachEagerLoads as f, attributionFields as p, attributionKey as m, beginLocalWrite as h, bulkInsertLimitsFor as g, chunkRowsForInsert as _, compileEagerJson as v, compilePredicate as y, compileRawFragment as b, compileSelect as x, decodeRowsFromSchema as S, encodeRowForSchema as C, endLocalWrite as w, externalChangeEvent as T, hasEagerLoads as E, isTableReactive as D, makeEagerFallbackReporter as ee, observeDbOp as O, qualifyTable as te, raiseChangeListenerCeiling as ne, recordsTable as re, registerPendingAttribution as ie, requireTable as k, resolveEchoAttribution as A, runStoreTransaction as j, runWriteRecorders as ae, stampGeneratedId as M, stampGeneratedIds as oe, withCapturedAttribution as N } from "@voltro/database";
+import { EventEmitter as se } from "node:events";
+import { createLogger as P } from "@voltro/logger";
+import { SqlClient as F, TransactionConnection as I } from "@effect/sql/SqlClient";
 //#region src/sqlLayer.ts
 var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	let t = e.acquireTimeoutMs ?? l;
 	return t > 0 ? t : void 0;
-}, I = (e) => {
+}, L = (e) => {
 	let t = e.acquireQueueLimit;
 	return t !== void 0 && t > 0 ? t : void 0;
-}, L = (e) => {
-	let t = e.ssl === void 0 ? void 0 : ce(e.ssl), n = le(e), r = I(e);
+}, R = (e) => {
+	let t = e.ssl === void 0 ? void 0 : ce(e.ssl), n = le(e), r = L(e);
 	return {
 		...t === void 0 ? {} : { ssl: t },
 		...n === void 0 ? {} : { connectTimeout: n },
 		...r === void 0 ? {} : { queueLimit: r }
 	};
-}, R = (n) => e.layerConfig({
+}, z = (n) => e.layerConfig({
 	host: t.succeed(n.host),
 	port: t.succeed(n.port),
 	username: t.succeed(n.username),
 	password: t.succeed(o.make(n.password)),
 	database: t.succeed(n.database),
-	poolConfig: t.succeed(L(n)),
+	poolConfig: t.succeed(R(n)),
 	...n.maxConnections === void 0 ? {} : { maxConnections: t.succeed(n.maxConnections) }
-}), z = (e) => {
+}), B = (e) => {
 	let t = e.get("sslmode");
 	if (t !== null) {
 		if (t === "require") return !0;
@@ -39,13 +39,13 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		if (n === "false" || n === "0") return !1;
 		throw Error(`DB_URL '?ssl=${n}' is not supported by the mysql/mariadb dialect — use 'true'/'1' or 'false'/'0'.`);
 	}
-}, B = (e) => {
+}, V = (e) => {
 	let t = {
 		...e.acquireTimeoutMs === void 0 ? {} : { acquireTimeoutMs: e.acquireTimeoutMs },
 		...e.acquireQueueLimit === void 0 ? {} : { acquireQueueLimit: e.acquireQueueLimit }
 	};
 	if (e.url) {
-		let n = new URL(e.url), r = e.ssl ?? z(n.searchParams);
+		let n = new URL(e.url), r = e.ssl ?? B(n.searchParams);
 		return {
 			host: n.hostname || "localhost",
 			port: n.port ? Number(n.port) : 3306,
@@ -67,21 +67,21 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		...e.ssl === void 0 ? {} : { ssl: e.ssl },
 		...t
 	};
-}, V = (e) => R(B(e)), H = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, U = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !H(e.primary, e.reader) ? "idle-caught-up" : "reconnect", W = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), ue = (e) => {
+}, H = (e) => z(V(e)), U = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, W = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !U(e.primary, e.reader) ? "idle-caught-up" : "reconnect", ue = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), de = (e) => {
 	let t = e instanceof Error ? e.message : String(e ?? "");
 	return /Table\s+[^\s.]+\.(\S+)\s+schema changed between binlog event and metadata fetch/.exec(t)?.[1] ?? null;
-}, G = "\n  SELECT DISTINCT s.TABLE_NAME AS tableName\n  FROM information_schema.STATISTICS s\n  JOIN information_schema.COLUMNS c\n    ON c.TABLE_SCHEMA = s.TABLE_SCHEMA\n   AND c.TABLE_NAME  = s.TABLE_NAME\n   AND c.COLUMN_NAME = s.COLUMN_NAME\n  WHERE s.TABLE_SCHEMA = DATABASE()\n    AND s.NON_UNIQUE = 0\n    AND s.SUB_PART IS NULL\n    AND c.DATA_TYPE IN ('text','tinytext','mediumtext','longtext','blob','tinyblob','mediumblob','longblob')\n", K = (e) => `cdc: table '${e}' is EXCLUDED from binlog capture — its row image carries a hidden column the reader cannot account for. Cause: a UNIQUE constraint on an UNBOUNDED text column, which MariaDB backs with a HASH long-unique index; that index adds a hidden DB_ROW_HASH_n column to the row, present in the binlog and absent from information_schema.COLUMNS. Remedy: bound the column — text().maxLength(n) — so the constraint becomes an ordinary B-tree index with no hidden column. ALTER TABLE FORCE does NOT help: the rebuild recreates the index and the hidden column. Until then, cross-instance change events for this table are lost; own-node reactivity is unaffected (writes still emit inline).`, de = 5 * 6e4, fe = 3, pe = (e, t) => {
-	let n = [...e.filter((e) => t - e < de), t];
+}, fe = "\n  SELECT DISTINCT s.TABLE_NAME AS tableName\n  FROM information_schema.STATISTICS s\n  JOIN information_schema.COLUMNS c\n    ON c.TABLE_SCHEMA = s.TABLE_SCHEMA\n   AND c.TABLE_NAME  = s.TABLE_NAME\n   AND c.COLUMN_NAME = s.COLUMN_NAME\n  WHERE s.TABLE_SCHEMA = DATABASE()\n    AND s.NON_UNIQUE = 0\n    AND s.SUB_PART IS NULL\n    AND c.DATA_TYPE IN ('text','tinytext','mediumtext','longtext','blob','tinyblob','mediumblob','longblob')\n", G = (e) => `cdc: table '${e}' is EXCLUDED from binlog capture — its row image carries a hidden column the reader cannot account for. Cause: a UNIQUE constraint on an UNBOUNDED text column, which MariaDB backs with a HASH long-unique index; that index adds a hidden DB_ROW_HASH_n column to the row, present in the binlog and absent from information_schema.COLUMNS. Remedy: bound the column — text().maxLength(n) — so the constraint becomes an ordinary B-tree index with no hidden column. ALTER TABLE FORCE does NOT help: the rebuild recreates the index and the hidden column. Until then, cross-instance change events for this table are lost; own-node reactivity is unaffected (writes still emit inline).`, pe = 5 * 6e4, me = 3, he = (e, t) => {
+	let n = [...e.filter((e) => t - e < pe), t];
 	return {
-		verdict: n.length >= fe ? "persistent" : "backlog",
+		verdict: n.length >= me ? "persistent" : "backlog",
 		hits: n
 	};
-}, me = /* @__PURE__ */ new Set([
+}, ge = /* @__PURE__ */ new Set([
 	"writerows",
 	"updaterows",
 	"deleterows"
-]), he = /\b(alter|rename|drop|create)\s+(table|column)?/i, q = (e) => new Promise((t) => setTimeout(t, e)), J = async (e) => {
-	let t = N({ scope: `voltro:${e.variant}:cdc` }), n;
+]), _e = /\b(alter|rename|drop|create)\s+(table|column)?/i, K = (e) => new Promise((t) => setTimeout(t, e)), q = async (e) => {
+	let t = P({ scope: `voltro:${e.variant}:cdc` }), n;
 	try {
 		n = (await import("@vlasky/zongji")).default;
 	} catch (t) {
@@ -96,14 +96,14 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			o = n.binlogName;
 			return;
 		}
-		if (r === "query" && n.query && he.test(n.query)) {
+		if (r === "query" && n.query && _e.test(n.query)) {
 			l && (l.tableMap = {});
 			return;
 		}
 		if (n.nextPosition && o && (s = {
 			filename: o,
 			position: n.nextPosition
-		}, e.onPosition?.(s)), !me.has(r)) return;
+		}, e.onPosition?.(s)), !ge.has(r)) return;
 		let u = n.tableMap[n.tableId];
 		if (!u || u.parentSchema !== a) return;
 		let d = u.tableName;
@@ -181,11 +181,11 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 					try {
 						l?.stop();
 					} catch {}
-					if (d++, await q(Math.min(3e4, 500 * 2 ** Math.min(d, 6))), u) return;
-					let i = s, a = C(n), c = !a && W(n), f = !1;
+					if (d++, await K(Math.min(3e4, 500 * 2 ** Math.min(d, 6))), u) return;
+					let i = s, a = C(n), c = !a && ue(n), f = !1;
 					if (c) {
-						let e = ue(n), i = e ?? "<unknown>", { verdict: a, hits: o } = pe(m.get(i) ?? [], Date.now());
-						m.set(i, o), f = a === "persistent", f && !h.has(i) && (h.add(i), e !== null && r.add(e), t.error(K(i)));
+						let e = de(n), i = e ?? "<unknown>", { verdict: a, hits: o } = he(m.get(i) ?? [], Date.now());
+						m.set(i, o), f = a === "persistent", f && !h.has(i) && (h.add(i), e !== null && r.add(e), t.error(G(i)));
 					}
 					(a || c) && (f || t.warn(c ? "cdc: un-replayable backlog event (schema moved past it) — jumping to current end + self-heal" : "cdc: binlog gap (purged/failover) — jumping to current end + self-heal"), i = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null, o = i?.filename ?? null, f || e.onResync?.());
 					try {
@@ -209,14 +209,14 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 				l?.stop();
 			} catch {}
 			let n = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null;
-			o = n?.filename ?? null, e.onResync?.(), await q(500), await w(n);
+			o = n?.filename ?? null, e.onResync?.(), await K(500), await w(n);
 		} else throw n;
 	}
 	let E = async () => {
 		if (u || p || Date.now() - f < _) return;
 		let n = null;
 		if (e.resolveStartPosition && (n = await e.resolveStartPosition().catch(() => null)), u || p) return;
-		let r = U({
+		let r = W({
 			msSinceProgress: Date.now() - f,
 			stallThresholdMs: _,
 			primary: n,
@@ -245,7 +245,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		},
 		currentPosition: () => s
 	};
-}, ge = /* @__PURE__ */ new Set(["1213", "1205"]), _e = (e) => {
+}, ve = /* @__PURE__ */ new Set(["1213", "1205"]), ye = (e) => {
 	let t = e;
 	for (let e = 0; e < 5 && typeof t == "object" && t; e++) {
 		let e = t.errno;
@@ -254,31 +254,31 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		if (typeof n == "string") return n;
 		t = t.cause;
 	}
-}, Y = (e) => {
-	let t = _e(e);
-	return t !== void 0 && ge.has(t);
-}, X = (e) => Y(e) ? "retry" : "noRetry", Z = (e) => {
+}, J = (e) => {
+	let t = ye(e);
+	return t !== void 0 && ve.has(t);
+}, Y = (e) => J(e) ? "retry" : "noRetry", X = (e) => {
 	if (e == null) return "null";
 	let t = typeof e;
 	if (t === "bigint") return `${e}n`;
 	if (t !== "object") return JSON.stringify(e);
 	if (e instanceof Date) return `"${e.toISOString()}"`;
-	if (Array.isArray(e)) return `[${e.map(Z).join(",")}]`;
+	if (Array.isArray(e)) return `[${e.map(X).join(",")}]`;
 	let n = e;
-	return `{${Object.keys(n).sort().map((e) => `${JSON.stringify(e)}:${Z(n[e])}`).join(",")}}`;
-}, ve = (e) => {
-	let t = Z(e), n = 2166136261;
+	return `{${Object.keys(n).sort().map((e) => `${JSON.stringify(e)}:${X(n[e])}`).join(",")}}`;
+}, be = (e) => {
+	let t = X(e), n = 2166136261;
 	for (let e = 0; e < t.length; e++) n ^= t.charCodeAt(e), n = Math.imul(n, 16777619);
 	return (n >>> 0).toString(36);
-}, ye = (e, t) => {
+}, xe = (e, t) => {
 	let n = setTimeout(e, t);
 	typeof n.unref == "function" && n.unref();
-}, be = class {
+}, Se = class {
 	variant;
 	ttlMs;
 	schedule;
 	seen = /* @__PURE__ */ new Map();
-	constructor(e, t = 6e4, n = ye) {
+	constructor(e, t = 6e4, n = xe) {
 		this.variant = e, this.ttlMs = t, this.schedule = n;
 	}
 	key(e) {
@@ -292,7 +292,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		} catch {
 			r = t;
 		}
-		return `${e.table} ${e.op} ${String(n)} ${ve(r)}`;
+		return `${e.table} ${e.op} ${String(n)} ${be(r)}`;
 	}
 	admit(e) {
 		let t = this.key(e);
@@ -307,16 +307,16 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	get pending() {
 		return this.seen.size;
 	}
-}, xe = /* @__PURE__ */ new Set([
+}, Z = /* @__PURE__ */ new Set([
 	1022,
 	1062,
 	1586
 ]), Q = async (e) => {
-	let t = e.variant ?? "mysql", n = N({ scope: `voltro:${t}` }), a = e.changeStrategy ?? "inline", o = a;
+	let t = e.variant ?? "mysql", n = P({ scope: `voltro:${t}` }), a = e.changeStrategy ?? "inline", o = a;
 	a === "cdc" && !e.cdcConfig && (n.warn("changeStrategy='cdc' requires cdcConfig (serverId + connection); falling back to 'inline'."), o = "inline");
-	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), l = new Se(await c.runPromise(P), c, t, o);
+	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), l = new Ce(await c.runPromise(F), c, t, o);
 	return o === "cdc" && e.cdcConfig && await l.startCdcConsumer(e.cdcConfig), l;
-}, Se = class e {
+}, Ce = class e {
 	sql;
 	runtime;
 	variant;
@@ -333,13 +333,13 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	cdcGate;
 	reportEagerFallback;
 	constructor(e, t, n, r = "inline", i = null, a, o) {
-		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = N({ scope: `voltro:${n}` }), this.reportEagerFallback = D(this.log), this.emitter = a ?? new M(), k(this.emitter), this.cdcGate = o ?? new be(n);
+		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = P({ scope: `voltro:${n}` }), this.reportEagerFallback = ee(this.log), this.emitter = a ?? new se(), ne(this.emitter), this.cdcGate = o ?? new Se(n);
 	}
 	withNamespace(t) {
 		return t === this.namespace ? this : new e(this.sql, this.runtime, this.variant, this.changeStrategy, t, this.emitter, this.cdcGate);
 	}
 	nsT(e) {
-		return ee(this.namespace, e);
+		return te(this.namespace, e);
 	}
 	get dialectId() {
 		return this.variant;
@@ -351,7 +351,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		};
 	}
 	async executeQuery(e, t, r) {
-		let i = x(e, this.sql, this.namespace), a = t ? n.provideService(i, F, t) : i;
+		let i = x(e, this.sql, this.namespace), a = t ? n.provideService(i, I, t) : i;
 		return S(await O(this.variant, "select", () => this.runtime.runPromise(a)), e.table, this.variant);
 	}
 	get supportsInsertReturning() {
@@ -364,10 +364,10 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		return !1;
 	}
 	async executeInsert(e, t, r, i, a) {
-		t = A(e, t);
+		t = M(e, t);
 		let o = this.sql;
 		if (this.supportsInsertReturning) {
-			let s = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(C(t, e))} RETURNING *`, c = r ? n.provideService(s, F, r) : s, l = (await this.runtime.runPromise(c))[0];
+			let s = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(C(t, e))} RETURNING *`, c = r ? n.provideService(s, I, r) : s, l = (await this.runtime.runPromise(c))[0];
 			if (!l) throw Error(`MysqlStore.insert: no row returned for table '${e}'`);
 			return await this.routeEvent({
 				table: e,
@@ -386,9 +386,9 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 				new: t
 			}, i, r, a), t;
 		}
-		let l = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)}`, u = r ? n.provideService(l, F, r) : l;
+		let l = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)}`, u = r ? n.provideService(l, I, r) : l;
 		await this.runtime.runPromise(u);
-		let d = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${c}`, f = r ? n.provideService(d, F, r) : d, p = (await this.runtime.runPromise(f))[0];
+		let d = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${c}`, f = r ? n.provideService(d, I, r) : d, p = (await this.runtime.runPromise(f))[0];
 		if (!p) throw Error(`MysqlStore.insert: row not found post-insert in '${e}'`);
 		return await this.routeEvent({
 			table: e,
@@ -401,16 +401,16 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		let i = this.sql;
 		return this.runPinned(r, (r) => n.gen(this, function* () {
 			let a = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(t)}`;
-			yield* n.provideService(a, F, r);
-			let o = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("lastId")}`, F, r))[0]?.lastId;
-			return o === void 0 || Number(o) === 0 ? yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`)) : (yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} = ${o}`, F, r))[0] || (yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: row not found post-insert in '${e}'`)));
+			yield* n.provideService(a, I, r);
+			let o = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("lastId")}`, I, r))[0]?.lastId;
+			return o === void 0 || Number(o) === 0 ? yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`)) : (yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} = ${o}`, I, r))[0] || (yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: row not found post-insert in '${e}'`)));
 		}), "insert");
 	}
 	async runPinned(e, t, r) {
 		if (e) return this.runtime.runPromise(t(e));
 		this.inflightTxns++;
 		try {
-			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(F), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error("MysqlStore.insert: TransactionConnection missing.")) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(Y)), o = e.pipe(n.retry(i), n.withSpan("store.insert", { attributes: {
+			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(I), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error("MysqlStore.insert: TransactionConnection missing.")) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), o = e.pipe(n.retry(i), n.withSpan("store.insert", { attributes: {
 				"db.system": this.variant,
 				"db.operation": r
 			} }));
@@ -420,16 +420,16 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		}
 	}
 	async executeInsertMany(e, t, r, i, a) {
-		if (t = se(e, t), t.length === 0) return [];
+		if (t = oe(e, t), t.length === 0) return [];
 		let o = this.sql, s = _(t.map((t) => C(t, e)), g(this.variant));
 		if (this.supportsInsertReturning) {
 			let t = (t) => o`INSERT INTO ${o(this.nsT(e))} ${o.insert(t)} RETURNING *`, c;
 			if (s.length === 1) {
-				let e = t(s[0]), i = r ? n.provideService(e, F, r) : e;
+				let e = t(s[0]), i = r ? n.provideService(e, I, r) : e;
 				c = await this.runtime.runPromise(i);
 			} else if (r) {
 				let e = [];
-				for (let i of s) e.push(...await this.runtime.runPromise(n.provideService(t(i), F, r)));
+				for (let i of s) e.push(...await this.runtime.runPromise(n.provideService(t(i), I, r)));
 				c = e;
 			} else c = await this.runtime.runPromise(o.withTransaction(n.map(n.forEach(s, t, { concurrency: 1 }), (e) => e.flat())));
 			for (let t of c) await this.routeEvent({
@@ -454,16 +454,16 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		if (c.some((e) => e === void 0)) throw Error("MysqlStore.insertMany: rows mix client-supplied and missing 'id's — supply an id for every row or none (AUTO_INCREMENT recovery).");
 		let l = (t) => o`INSERT INTO ${o(this.nsT(e))} ${o.insert(t)}`;
 		if (s.length === 1) {
-			let e = r ? n.provideService(l(s[0]), F, r) : l(s[0]);
+			let e = r ? n.provideService(l(s[0]), I, r) : l(s[0]);
 			await this.runtime.runPromise(e);
-		} else if (r) for (let e of s) await this.runtime.runPromise(n.provideService(l(e), F, r));
+		} else if (r) for (let e of s) await this.runtime.runPromise(n.provideService(l(e), I, r));
 		else await this.runtime.runPromise(o.withTransaction(n.forEach(s, l, {
 			concurrency: 1,
 			discard: !0
 		})));
 		let u = _(c.map((e) => ({ id: e })), g(this.variant)), d = [];
 		for (let t of u) {
-			let i = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} IN ${o.in(t.map((e) => e.id))}`, a = r ? n.provideService(i, F, r) : i;
+			let i = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} IN ${o.in(t.map((e) => e.id))}`, a = r ? n.provideService(i, I, r) : i;
 			d.push(...await this.runtime.runPromise(a));
 		}
 		let f = new Map(d.map((e) => [e.id, e])), p = c.map((e) => f.get(e)).filter((e) => e !== void 0);
@@ -481,19 +481,19 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			let a = [];
 			for (let o of t) {
 				let t = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(o)}`;
-				yield* n.provideService(t, F, r);
-				let s = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("firstId")}`, F, r))[0]?.firstId;
+				yield* n.provideService(t, I, r);
+				let s = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("firstId")}`, I, r))[0]?.firstId;
 				if (s === void 0 || Number(s) === 0) return yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insertMany: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`));
-				let c = Number(s), l = yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} BETWEEN ${c} AND ${c + o.length - 1} ORDER BY ${i("id")} ASC`, F, r);
+				let c = Number(s), l = yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} BETWEEN ${c} AND ${c + o.length - 1} ORDER BY ${i("id")} ASC`, I, r);
 				a.push(...l);
 			}
 			return a;
 		}), "insert");
 	}
 	async executePatchJson(e, t, r, i, a, o, s) {
-		let c = this.sql, l = r.split("."), u = l[0], d = l.slice(1), f = JSON.stringify(i ?? null), p = d.length === 0 ? "$" : `$.${d.join(".")}`, m = c`UPDATE ${c(this.nsT(e))} SET ${c(u)} = JSON_SET(COALESCE(${c(u)}, '{}'), ${p}, CAST(${f} AS JSON)) WHERE ${c("id")} = ${t}`, h = a ? n.provideService(m, F, a) : m, g = await this.runtime.runPromise(h);
+		let c = this.sql, l = r.split("."), u = l[0], d = l.slice(1), f = JSON.stringify(i ?? null), p = d.length === 0 ? "$" : `$.${d.join(".")}`, m = c`UPDATE ${c(this.nsT(e))} SET ${c(u)} = JSON_SET(COALESCE(${c(u)}, '{}'), ${p}, CAST(${f} AS JSON)) WHERE ${c("id")} = ${t}`, h = a ? n.provideService(m, I, a) : m, g = await this.runtime.runPromise(h);
 		if (g && typeof g.affectedRows == "number" && g.affectedRows === 0) return null;
-		let _ = c`SELECT * FROM ${c(this.nsT(e))} WHERE ${c("id")} = ${t}`, v = a ? n.provideService(_, F, a) : _, y = (await this.runtime.runPromise(v))[0];
+		let _ = c`SELECT * FROM ${c(this.nsT(e))} WHERE ${c("id")} = ${t}`, v = a ? n.provideService(_, I, a) : _, y = (await this.runtime.runPromise(v))[0];
 		return y ? (await this.routeEvent({
 			table: e,
 			op: "update",
@@ -504,7 +504,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	async executeUpdate(e, t, r, i, a, o) {
 		let s = this.sql;
 		if (this.supportsUpdateReturning) {
-			let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(C(r, e))} WHERE ${s("id")} = ${t} RETURNING *`, l = i ? n.provideService(c, F, i) : c, u = (await this.runtime.runPromise(l))[0];
+			let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(C(r, e))} WHERE ${s("id")} = ${t} RETURNING *`, l = i ? n.provideService(c, I, i) : c, u = (await this.runtime.runPromise(l))[0];
 			return u ? (await this.routeEvent({
 				table: e,
 				op: "update",
@@ -512,9 +512,9 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 				new: u
 			}, a, i, o), u) : null;
 		}
-		let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(C(r, e))} WHERE ${s("id")} = ${t}`, l = i ? n.provideService(c, F, i) : c, u = await this.runtime.runPromise(l);
+		let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(C(r, e))} WHERE ${s("id")} = ${t}`, l = i ? n.provideService(c, I, i) : c, u = await this.runtime.runPromise(l);
 		if (u && typeof u.affectedRows == "number" && u.affectedRows === 0) return null;
-		let d = s`SELECT * FROM ${s(this.nsT(e))} WHERE ${s("id")} = ${t}`, f = i ? n.provideService(d, F, i) : d, p = (await this.runtime.runPromise(f))[0];
+		let d = s`SELECT * FROM ${s(this.nsT(e))} WHERE ${s("id")} = ${t}`, f = i ? n.provideService(d, I, i) : d, p = (await this.runtime.runPromise(f))[0];
 		return p ? (await this.routeEvent({
 			table: e,
 			op: "update",
@@ -525,7 +525,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	async executeDelete(e, t, r, i, a) {
 		let o = this.sql;
 		if (this.supportsDeleteReturning) {
-			let s = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t} RETURNING *`, c = r ? n.provideService(s, F, r) : s, l = (await this.runtime.runPromise(c))[0];
+			let s = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t} RETURNING *`, c = r ? n.provideService(s, I, r) : s, l = (await this.runtime.runPromise(c))[0];
 			return l ? (await this.routeEvent({
 				table: e,
 				op: "delete",
@@ -533,9 +533,9 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 				new: null
 			}, i, r, a), !0) : !1;
 		}
-		let s = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, c = r ? n.provideService(s, F, r) : s, l = (await this.runtime.runPromise(c))[0];
+		let s = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, c = r ? n.provideService(s, I, r) : s, l = (await this.runtime.runPromise(c))[0];
 		if (!l) return !1;
-		let u = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, d = r ? n.provideService(u, F, r) : u;
+		let u = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, d = r ? n.provideService(u, I, r) : u;
 		return await this.runtime.runPromise(d), await this.routeEvent({
 			table: e,
 			op: "delete",
@@ -545,17 +545,17 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	}
 	async appendInTxn(e, t, r) {
 		let i = this.sql, a = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(C(t, e))}`;
-		await this.runtime.runPromise(r ? n.provideService(a, F, r) : a);
+		await this.runtime.runPromise(r ? n.provideService(a, I, r) : a);
 	}
 	async maxInTxn(e, t, r, i) {
-		let a = this.sql, o = Object.entries(r).map(([e, t]) => a`${a(e)} = ${t}`), s = a`SELECT MAX(${a(t)}) AS ${a("m")} FROM ${a(this.nsT(e))} WHERE ${a.and(o)}`, c = (await this.runtime.runPromise(i ? n.provideService(s, F, i) : s))[0]?.m;
+		let a = this.sql, o = Object.entries(r).map(([e, t]) => a`${a(e)} = ${t}`), s = a`SELECT MAX(${a(t)}) AS ${a("m")} FROM ${a(this.nsT(e))} WHERE ${a.and(o)}`, c = (await this.runtime.runPromise(i ? n.provideService(s, I, i) : s))[0]?.m;
 		return c == null ? null : Number(c);
 	}
 	async routeEvent(e, t, n = null, r) {
 		if (e = {
 			...p(r),
 			...e
-		}, te(e.table) && await oe({
+		}, re(e.table) && await ae({
 			append: (e, t) => this.appendInTxn(e, t, n),
 			maxOf: (e, t, r) => this.maxInTxn(e, t, r, n)
 		}, {
@@ -567,7 +567,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			subjectId: e.subjectId
 		}), this.changeStrategy === "cdc") {
 			let t = (e.op === "delete" ? e.old : e.new)?.id;
-			t != null && ne(m(e.table, e.op, t), {
+			t != null && ie(m(e.table, e.op, t), {
 				...e.traceId === void 0 ? {} : { traceId: e.traceId },
 				...e.subjectId === void 0 ? {} : { subjectId: e.subjectId }
 			});
@@ -598,10 +598,10 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			}
 			return await this.executeUpdate(e, o.id, a, r, i) ?? o;
 		}
-		return j((n) => this.executeInsert(e, t, r, i, n));
+		return N((n) => this.executeInsert(e, t, r, i, n));
 	}
 	async executeMariadbUpsert(e, t, r, i, a, o) {
-		let s = this.sql, c = C(t, e), l = Object.keys(c).filter((e) => c[e] !== void 0), u = r.update === void 0 ? l.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, d = u.length > 0 ? s.csv(u.map((e) => s`${s(e)} = VALUES(${s(e)})`)) : s`${s(r.conflictColumns[0])} = VALUES(${s(r.conflictColumns[0])})`, f = s`INSERT INTO ${s(this.nsT(e))} ${s.insert(c)} ON DUPLICATE KEY UPDATE ${d} RETURNING *`, p = i ? n.provideService(f, F, i) : f, m = (await this.runtime.runPromise(p))[0];
+		let s = this.sql, c = C(t, e), l = Object.keys(c).filter((e) => c[e] !== void 0), u = r.update === void 0 ? l.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, d = u.length > 0 ? s.csv(u.map((e) => s`${s(e)} = VALUES(${s(e)})`)) : s`${s(r.conflictColumns[0])} = VALUES(${s(r.conflictColumns[0])})`, f = s`INSERT INTO ${s(this.nsT(e))} ${s.insert(c)} ON DUPLICATE KEY UPDATE ${d} RETURNING *`, p = i ? n.provideService(f, I, i) : f, m = (await this.runtime.runPromise(p))[0];
 		if (!m) throw Error(`MysqlStore.upsert: no row returned for table '${e}'`);
 		let h = t.id !== void 0 && t.id === m.id ? "insert" : "update";
 		return await this.routeEvent({
@@ -612,27 +612,27 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		}, a, i, o), m;
 	}
 	async executeInsertIgnore(e, t, r, i, a, o) {
-		if (t = A(e, t), this.variant === "mariadb") {
-			let s = this.sql, c = s`INSERT IGNORE INTO ${s(this.nsT(e))} ${s.insert(C(t, e))} RETURNING *`, l = i ? n.provideService(c, F, i) : c, u = (await this.runtime.runPromise(l))[0];
+		if (t = M(e, t), this.variant === "mariadb") {
+			let s = this.sql, c = s`INSERT IGNORE INTO ${s(this.nsT(e))} ${s.insert(C(t, e))} RETURNING *`, l = i ? n.provideService(c, I, i) : c, u = (await this.runtime.runPromise(l))[0];
 			if (u) return await this.routeEvent({
 				table: e,
 				op: "insert",
 				old: null,
 				new: u
 			}, a, i, o), u;
-			let d = await this.readWarnings(i), f = d.find((e) => !xe.has(e.code));
+			let d = await this.readWarnings(i), f = d.find((e) => !Z.has(e.code));
 			if (f !== void 0) throw Error(`MysqlStore.insertIgnore: the insert into '${e}' was REJECTED, not skipped as a conflict. INSERT IGNORE downgrades every error to a warning, and the warning was: [${f.code}] ${f.message}. Nothing was written and nothing conflicted — fix the cause above.`);
 			let p = await this.findByConflict(e, t, r.conflictColumns, i);
 			if (p) return p;
 			let m = d[0];
 			throw Error(`MysqlStore.insertIgnore: the insert was skipped as a conflict, but no existing row matches conflictColumns [${r.conflictColumns.join(", ")}] on '${e}'. ` + (m === void 0 ? "The warning could not be read on this connection, so the constraint that fired is unknown — it may be a second unique index, or the primary key under another name. " : `The constraint that actually fired: [${m.code}] ${m.message}. `) + "insertIgnore models ONE conflict target: name the columns of the constraint that actually collides, or handle the violation yourself.");
 		}
-		return await this.findByConflict(e, t, r.conflictColumns, i) || j((n) => this.executeInsert(e, t, i, a, n));
+		return await this.findByConflict(e, t, r.conflictColumns, i) || N((n) => this.executeInsert(e, t, i, a, n));
 	}
 	async findUndecodableCdcTables(e) {
 		if (this.variant !== "mariadb") return [];
 		try {
-			let t = (await this.runtime.runPromise(this.sql.unsafe(G))).map((e) => String(e.tableName ?? e.TABLE_NAME ?? "")).filter((e) => e !== "");
+			let t = (await this.runtime.runPromise(this.sql.unsafe(fe))).map((e) => String(e.tableName ?? e.TABLE_NAME ?? "")).filter((e) => e !== "");
 			return e === void 0 ? t : t.filter((t) => e.includes(t));
 		} catch (e) {
 			return this.log.debug(`cdc: could not probe for undecodable tables — ${e?.message ?? String(e)}`), [];
@@ -642,7 +642,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		if (e === null) return [];
 		try {
 			let t = this.sql`SHOW WARNINGS`;
-			return (await this.runtime.runPromise(n.provideService(t, F, e))).map((e) => ({
+			return (await this.runtime.runPromise(n.provideService(t, I, e))).map((e) => ({
 				code: Number(e.Code ?? e.code ?? 0),
 				message: String(e.Message ?? e.message ?? "")
 			}));
@@ -652,7 +652,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	}
 	async findByConflict(e, t, r, i) {
 		if (r.length === 0) return;
-		let a = this.sql, o = r.map((e) => a`${a(e)} = ${t[e]}`), s = a`SELECT * FROM ${a(this.nsT(e))} WHERE ${a.and(o)} LIMIT 1`, c = i ? n.provideService(s, F, i) : s;
+		let a = this.sql, o = r.map((e) => a`${a(e)} = ${t[e]}`), s = a`SELECT * FROM ${a(this.nsT(e))} WHERE ${a.and(o)} LIMIT 1`, c = i ? n.provideService(s, I, i) : s;
 		return (await this.runtime.runPromise(c))[0];
 	}
 	query(e) {
@@ -663,10 +663,10 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		return O(this.variant, "raw", () => this.runtime.runPromise(n));
 	}
 	async runWithEager(e, t) {
-		if (!T(e)) return this.executeQuery(e, t);
+		if (!E(e)) return this.executeQuery(e, t);
 		let r = this.variant === "mariadb" ? "mariadb" : "mysql", i = this.namespace === null ? v(e, this.sql, r) : null;
 		if (i !== null) try {
-			let e = t ? n.provideService(i.fragment, F, t) : i.fragment, r = await O(this.variant, "select", () => this.runtime.runPromise(e));
+			let e = t ? n.provideService(i.fragment, I, t) : i.fragment, r = await O(this.variant, "select", () => this.runtime.runPromise(e));
 			return i.decode(r);
 		} catch (t) {
 			if (t instanceof u) throw t;
@@ -682,17 +682,17 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			table: e.table,
 			reason: "not-compilable"
 		});
-		return f(await this.executeQuery(e, t), e.eager, e.sourceTable ?? re(e.table), (e) => this.executeQuery(e, t));
+		return f(await this.executeQuery(e, t), e.eager, e.sourceTable ?? k(e.table), (e) => this.executeQuery(e, t));
 	}
 	getInternalRunWithEager() {
 		return this.runWithEager.bind(this);
 	}
 	async localWrite(e, t, n) {
 		return O(this.variant, e, async () => {
-			if (this.changeStrategy !== "cdc") return j(n);
+			if (this.changeStrategy !== "cdc") return N(n);
 			h(t);
 			try {
-				return await j(n);
+				return await N(n);
 			} finally {
 				w(t);
 			}
@@ -733,15 +733,15 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		let i = this.sql, o = y(r.where, i, this.namespace);
 		this.changeStrategy === "cdc" && h(e), this.inflightTxns++;
 		try {
-			let r = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(F), (r) => {
+			let r = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(I), (r) => {
 				if (a.isNone(r)) return n.fail(/* @__PURE__ */ Error("MysqlStore.updateMany: TransactionConnection missing."));
 				let s = r.value, c = i`SELECT id FROM ${i(this.nsT(e))} WHERE ${o} FOR UPDATE`, l = i`UPDATE ${i(this.nsT(e))} SET ${i.update(C(t, e))} WHERE ${o}`;
-				return n.flatMap(n.provideService(c, F, s), (t) => {
+				return n.flatMap(n.provideService(c, I, s), (t) => {
 					if (t.length === 0) return n.succeed([]);
 					let r = t.map((e) => e.id), a = i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} IN ${i.in(r)}`;
-					return n.flatMap(n.provideService(l, F, s), () => n.provideService(a, F, s));
+					return n.flatMap(n.provideService(l, I, s), () => n.provideService(a, I, s));
 				});
-			}))), c = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(Y)), l = r.pipe(n.retry(c), n.withSpan("store.updateMany", { attributes: {
+			}))), c = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), l = r.pipe(n.retry(c), n.withSpan("store.updateMany", { attributes: {
 				"db.system": this.variant,
 				"db.operation": "update"
 			} })), u = await this.runtime.runPromise(l);
@@ -772,11 +772,11 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		}
 		this.changeStrategy === "cdc" && h(e), this.inflightTxns++;
 		try {
-			let t = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(F), (t) => {
+			let t = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(I), (t) => {
 				if (a.isNone(t)) return n.fail(/* @__PURE__ */ Error("MysqlStore.deleteMany: TransactionConnection missing."));
 				let o = t.value, s = r`SELECT * FROM ${r(this.nsT(e))} WHERE ${i} FOR UPDATE`, c = r`DELETE FROM ${r(this.nsT(e))} WHERE ${i}`;
-				return n.flatMap(n.provideService(s, F, o), (e) => e.length === 0 ? n.succeed(e) : n.as(n.provideService(c, F, o), e));
-			}))), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(Y)), c = t.pipe(n.retry(o), n.withSpan("store.deleteMany", { attributes: {
+				return n.flatMap(n.provideService(s, I, o), (e) => e.length === 0 ? n.succeed(e) : n.as(n.provideService(c, I, o), e));
+			}))), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), c = t.pipe(n.retry(o), n.withSpan("store.deleteMany", { attributes: {
 				"db.system": this.variant,
 				"db.operation": "delete"
 			} })), l = await this.runtime.runPromise(c);
@@ -794,14 +794,14 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		}
 	}
 	emitChange(e) {
-		E(e.table) && (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || this.emitter.emit("change", e));
+		D(e.table) && (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || this.emitter.emit("change", e));
 	}
 	async startCdcConsumer(e) {
 		if (this.cdcHandle) return;
 		await this.assertBinlogConfig(), this.cdcReplicaId = e.replicaId;
 		let t = await this.readCdcOffset(e.replicaId) ?? await this.resolveBinlogEnd(), n = await this.findUndecodableCdcTables(e.includeTables);
-		for (let e of n) this.log.error(K(e));
-		this.cdcHandle = await J({
+		for (let e of n) this.log.error(G(e));
+		this.cdcHandle = await q({
 			connection: e.connection,
 			serverId: e.serverId,
 			variant: this.variant,
@@ -919,10 +919,10 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	async transactional(e) {
 		this.inflightTxns++;
 		try {
-			return await ae({
+			return await j({
 				...this.txnSpec("MysqlStore.transactional"),
 				work: e,
-				makeView: (e, t) => new Ce(this, e, t)
+				makeView: (e, t) => new we(this, e, t)
 			});
 		} finally {
 			this.inflightTxns--;
@@ -934,7 +934,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			dialect: this.variant === "mariadb" ? "mariadb" : "mysql",
 			withTransaction: (e) => this.sql.withTransaction(e),
 			runPromiseExit: (e) => this.runtime.runPromiseExit(e),
-			isRetryable: Y,
+			isRetryable: J,
 			span: {
 				name: "store.transactional",
 				attributes: {
@@ -953,14 +953,10 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		return this.changeStrategy === "cdc" ? "fleet" : "local";
 	}
 	injectExternalChange(e) {
-		if (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || !E(e.table)) return;
+		if (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || !D(e.table)) return;
 		let t = (e.op === "delete" ? e.old : e.new)?.id;
-		ie(e.table, e.op, t, (t) => {
-			this.emitter.emit("change", {
-				...t,
-				...e,
-				origin: "injected"
-			});
+		A(e.table, e.op, t, (t) => {
+			this.emitter.emit("change", T(e, t));
 		});
 	}
 	run(e) {
@@ -984,7 +980,7 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 	async ping() {
 		await this.runtime.runPromise(this.sql`SELECT 1`);
 	}
-}, Ce = class {
+}, we = class {
 	parent;
 	txn;
 	attr;
@@ -1057,12 +1053,12 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 			this.events.length = 0;
 		}
 	}
-}, $ = (e) => e.__mysqlReplicationFriend ?? null, we = () => ({
+}, $ = (e) => e.__mysqlReplicationFriend ?? null, Te = () => ({
 	async capturePrimaryPosition(e) {
 		let t = $(e);
 		if (t === null) throw Error("mysqlReplicationAdapter: primary is not a MysqlStore (missing __mysqlReplicationFriend).");
 		return t.runEffect(n.gen(function* () {
-			let e = yield* P, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
+			let e = yield* F, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
 			return typeof r == "string" ? r : yield* n.die("mysql/mariadb did not return a GTID set");
 		}));
 	},
@@ -1070,31 +1066,31 @@ var ce = (e) => e ? { rejectUnauthorized: !1 } : void 0, le = (e) => {
 		let t = $(e);
 		if (t === null) throw Error("mysqlReplicationAdapter: replica is not a MysqlStore.");
 		return t.runEffect(n.gen(function* () {
-			let e = yield* P, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
+			let e = yield* F, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
 			return typeof r == "string" ? r : yield* n.die("mysql/mariadb replica did not return a GTID set");
 		}));
 	},
 	compare(e, t) {
 		return "behind";
 	}
-}), Te = {
+}), Ee = {
 	id: "mysql",
-	makeSqlLayer: (e) => V(e),
+	makeSqlLayer: (e) => H(e),
 	makeStore: (e) => Q({
 		...e,
 		variant: "mysql"
 	}),
 	compileContains: (e, t, n) => n`${e} LIKE ${`%${t.replace(/[\\%_]/g, (e) => `\\${e}`)}%`} ESCAPE '\\'`,
-	retryFilter: X
-}, Ee = {
+	retryFilter: Y
+}, De = {
 	id: "mariadb",
-	makeSqlLayer: (e) => V(e),
+	makeSqlLayer: (e) => H(e),
 	makeStore: (e) => Q({
 		...e,
 		variant: "mariadb"
 	}),
 	compileContains: (e, t, n) => n`${e} LIKE ${`%${t.replace(/[\\%_]/g, (e) => `\\${e}`)}%`} ESCAPE '\\'`,
-	retryFilter: X
+	retryFilter: Y
 };
 //#endregion
-export { c as CDC_OFFSETS_TABLE, e as MysqlClient, d as _voltroCdcOffsetsTable, B as connectionFromConfig, R as makeMysqlSqlLayer, V as makeMysqlSqlLayerFromConfig, Q as makeMysqlStore, Ee as mariadbDialect, Te as mysqlDialect, we as mysqlReplicationAdapter, X as mysqlRetryFilter, J as startBinlogCdc };
+export { c as CDC_OFFSETS_TABLE, e as MysqlClient, d as _voltroCdcOffsetsTable, V as connectionFromConfig, z as makeMysqlSqlLayer, H as makeMysqlSqlLayerFromConfig, Q as makeMysqlStore, De as mariadbDialect, Ee as mysqlDialect, Te as mysqlReplicationAdapter, Y as mysqlRetryFilter, q as startBinlogCdc };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/sql-mysql",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "MySQL/MariaDB dialect adapter for Voltro's cross-dialect DataStore (mariadb binlog CDC; mysql inline reactivity).",
   "keywords": [
     "voltro",
@@ -35,8 +35,8 @@
   "dependencies": {
     "@effect/sql": "^0.52.0",
     "@effect/sql-mysql2": "^0.53.0",
-    "@voltro/database": "0.34.0",
-    "@voltro/logger": "0.34.0"
+    "@voltro/database": "0.35.0",
+    "@voltro/logger": "0.35.0"
   },
   "optionalDependencies": {
     "@vlasky/zongji": "^0.9.0"