@voltro/workflow 0.69.1 → 0.71.0

package/dist/index.d.ts

@@ -20,9 +20,34 @@ import { WorkflowAccessOptions } from '@voltro/protocol';
 import { WorkflowEngine } from '@effect/workflow';
 import { Workflow as workflowModule } from '@effect/workflow';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
+import { WorkflowQueuedCancellationResult } from '@voltro/protocol';
+
+/** Dispatch an already committed admission using the same attempt/ACK boundary
+ * as the drainer. Returning requires durable acceptance, not just a prepared ID.
+ * A concurrent recovery may have supplied that acceptance. */
+export declare const acceptAdmissionSubmission: (deps: AdmissionDrainDeps, submission: AdmissionSubmission, control: ResolvedFlowControl, keys: ReturnType<typeof resolveAdmissionKeys>, now: number) => Promise<string>;
+
+/** Resident, database-only acceptance boundary. Allocate the request identity
+ * before entering the admission transaction. Acceptance does not change the run
+ * and does not prove that an engine observed the request. */
+export declare const acceptWorkflowControlInTransaction: (tx: Store, input: Omit<WorkflowControlRequest, "dispatchAttempts" | "result" | "owner" | "resumeJournal">) => Promise<WorkflowControlRequest>;
+
+/** Persist an observed engine acceptance together with the lease linkage.
+ * A lost acknowledgement can be retried, but cannot remap a submission to a
+ * different execution. No engine call belongs inside this transaction. */
+export declare const acknowledgeAdmissionSubmission: (store: Pick<DataStore, "insertIgnoreWithOutcome" | "transactional">, id: string, accepted: {
+    readonly executionId: string;
+    readonly runId: string | null;
+}) => Promise<AdmissionSubmission>;
 
 /** The narrow slice of `DataStore` flow control needs. */
 export declare interface AdmissionDataStore {
+    /** Native arbitration, preserved by every resident transaction adapter. */
+    readonly insertIgnoreWithOutcome: DataStore['insertIgnoreWithOutcome'];
+    /** Host schema codecs: queue rows carry encoded values, controls and the
+     * engine consume decoded payloads. Absent for a JSON-only low-level host. */
+    readonly encodeWorkflowPayload?: (workflowName: string, payload: unknown) => unknown;
+    readonly decodeWorkflowPayload?: (workflowName: string, payload: unknown) => unknown;
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
     insert(table: string, row: Row): Promise<Row>;
     update(table: string, primaryKey: string, patch: Readonly<Record<string, unknown>>): Promise<Row | null>;
@@ -65,7 +90,20 @@ export declare type AdmissionDecision = {
 };
 
 export declare interface AdmissionDrainDeps {
+    /** Cross-store capacity check after resident commit and before engine I/O.
+     * Replays must reuse this submission's durable permit. False is ordinary
+     * waiting, not a rejected or failed engine attempt. Never call inside SQL. */
+    readonly acquireSubmissionCapacity?: (submission: AdmissionSubmission) => Promise<boolean>;
+    /** Derive the declared engine key without starting work. Called outside SQL
+     * transactions, only when the durable submission has no prepared identity. */
+    readonly resolveExecutionId: (workflowName: string, payload: unknown) => Promise<string>;
     readonly store: AdmissionDataStore;
+    /** Host-wide pauses plus resident pauses, read outside resident transactions.
+     * The resident transaction may add a newer local pause, never clear this set. */
+    readonly readPauses?: () => Promise<ReadonlySet<string>>;
+    /** Own the shared admission transaction. Callback is database-only and may
+     * replay; it must serialize with direct arrivals in this resident store. */
+    readonly transaction: <A>(work: (tx: AdmissionDataStore) => Promise<A>) => Promise<A>;
     /** Resolved flow control per workflow name. A name missing from this map has
      *  no controls, so any pending row under it is an orphan — see `drainTick`. */
     readonly controls: ReadonlyMap<string, ResolvedFlowControl>;
@@ -81,7 +119,7 @@ export declare interface AdmissionDrainDeps {
      * with nothing running. That shipped; the CLI's implementation passes an
      * `admitted` marker that skips the gate.
      */
-    readonly startAdmitted: (workflowName: string, payload: unknown, callerContext: unknown) => Promise<AdmittedStart>;
+    readonly startAdmitted: (workflowName: string, payload: unknown, callerContext: unknown, preparedExecutionId?: string) => Promise<AdmittedStart>;
     /**
      * Cancel a run through the durable run-state boundary — engine interrupt,
      * terminal row, event, and child cleanup — used by singleton eviction and
@@ -108,6 +146,9 @@ export declare interface AdmissionDrainDeps {
      * a failure that does not clear, which is no longer transient in any sense a
      * retry can help. Signalled to `onFailure` once and retained, exactly like a
      * permanent payload failure; `voltro workflows flow retry` re-arms it.
+     * Unacknowledged submissions instead persist an automatic-retry stop with
+     * acceptance unknown: no abandonment report and no concurrency release.
+     * Pending-intent retry commands do not reconcile those submissions.
      */
     readonly deadLetterAfterAttempts?: number | false;
     readonly onAbandoned: (input: {
@@ -135,8 +176,8 @@ export declare interface AdmissionDrainDeps {
      * lastError climb on the row) instead of a silent abandon.
      */
     readonly registeredWorkflows?: ReadonlySet<string>;
-    /** Classify a start failure that retrying the SAME stored payload cannot
-     *  repair. The CLI wires `WorkflowPayloadError`; unknown engine/store errors
+    /** Classify an input rejection guaranteed to happen BEFORE engine I/O, not
+     * merely an error retrying cannot repair. The CLI wires `WorkflowPayloadError`; unknown engine/store errors
      *  stay on the retry path because abandoning transient work is worse than a
      *  visible retry. */
     readonly isPermanentStartError?: (cause: unknown) => boolean;
@@ -185,6 +226,8 @@ export declare interface AdmissionState {
         readonly firstSeenAt: number;
     };
     readonly singletonHolder?: AdmissionIncumbent;
+    /** A reservation exists but its execution identity is not confirmed yet. */
+    readonly singletonUnacknowledged?: boolean;
     /** Runs in flight under `concurrencyKey` (leases held, not yet released). */
     readonly inFlight?: number;
     /** Admission timestamps inside the throttle / rate-limit window,
@@ -193,6 +236,11 @@ export declare interface AdmissionState {
     readonly recentAdmissions?: ReadonlyArray<number>;
 }
 
+/** Immutable engine input, stored beside its resident queue. Payload is schema
+ * encoded. A retry must use this value, not reconstruct it from current defaults
+ * or a batch that has accumulated additional items. */
+export declare type AdmissionSubmission = typeof SubmissionSchema.Type;
+
 /** What the caller learns about a start that went through flow control. */
 export declare type AdmissionVerdict = {
     /** Start it now. The ledger row is already written; call `linkExecution`
@@ -266,11 +314,9 @@ export declare interface AdmitStartInput {
      * `true` when the caller is BLOCKING for the result (`ctx.workflows.run`, or
      * `start({ wait: true })`).
      *
-     * A deferring control has no coherent answer for such a caller — there is no
-     * result to return for a start that was collapsed into a future run — so the
-     * facade rejects that combination before calling in here. This flag is
-     * carried so the ledger records WHY a run bypassed the queue, not to change
-     * the decision.
+     * Observation does not change admission. A deferred caller follows its
+     * durable receipt until an execution is accepted or non-execution settles.
+     * This flag annotates immediate ledger entries; it never bypasses a control.
      */
     readonly waiting: boolean;
 }
@@ -488,6 +534,470 @@ export declare interface AwaitUpdateOptions<A, B = A> {
     readonly timeoutMs?: number;
 }
 
+/** Persist BEFORE calling the engine. Failed acknowledgements and process
+ * death must leave evidence that an earlier call could have been accepted.
+ * Return null when this source is no longer dispatchable. Database-only;
+ * the returned attempt number fences a later permanent-rejection decision. */
+export declare const beginAdmissionSubmissionDispatchInTransaction: (tx: Pick<DataStore, "query" | "update">, id: string, now: number) => Promise<AdmissionSubmission | null>;
+
+/** Persist the attempt before engine I/O. A worker dying after this commit
+ * leaves ambiguity, not evidence of rejection. Re-read the resident generation
+ * on every attempt; an old control request cannot target a replacement body.
+ * The caller must still use an engine operation fenced to this generation:
+ * this transaction cannot fence an unqualified interrupt after it commits. */
+export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id: string) => Promise<{
+    kind: "settled";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+    run?: never;
+} | {
+    kind: "unknown";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+    run?: never;
+} | {
+    kind: "superseded";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+    run?: never;
+} | {
+    kind: "already-terminal";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+    run: Readonly<Record<string, unknown>>;
+} | {
+    kind: "dispatch";
+    request: {
+        dispatchAttempts: number;
+        id: string;
+        cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        requestedAt: number;
+        executionId: string;
+        runId: string;
+        workflowName: string;
+        operation: "resume" | "cancel" | "terminate";
+        generation: string;
+        owner: {
+            readonly tenantId: string | null;
+        } | null;
+        resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+    };
+    run?: never;
+}>;
+
+/** Database-only capture while holding the resident admission/entry lock.
+ * observe reads the journal; it must never wake/reset the engine. Missing
+ * journal evidence waits without inventing a binding. After commit, every
+ * dispatch uses this immutable observation, including after a lost ACK. */
+export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: string, observe: (target: {
+    readonly workflowName: string;
+    readonly executionId: string;
+    readonly requestId: string;
+    readonly restartToken: string | null;
+}) => Promise<unknown>) => Promise<{
+    kind: "settled";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+} | {
+    kind: "unknown";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+} | {
+    kind: "superseded";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+} | {
+    kind: "not-suspended";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+} | {
+    kind: "bound";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+} | {
+    kind: "waiting-journal";
+    request: {
+        readonly id: string;
+        readonly cause?: {
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly reason: string;
+        } | null | undefined;
+        readonly result: {
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly kind: "confirmed" | "already-terminal";
+            readonly errorMessage: string | null;
+            readonly output: unknown;
+            readonly errorTag: string | null;
+            readonly completedAt: number;
+        } | {
+            readonly status: "running";
+            readonly kind: "confirmed";
+            readonly generation: string;
+            readonly enteredAt: number;
+        } | null;
+        readonly requestedAt: number;
+        readonly executionId: string;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly operation: "resume" | "cancel" | "terminate";
+        readonly generation: string;
+        readonly owner: {
+            readonly tenantId: string | null;
+        } | null;
+        readonly resumeJournal: {
+            readonly requestId: string;
+            readonly replyId: string;
+            readonly restartToken: string | null;
+        } | null;
+        readonly dispatchAttempts: number;
+    };
+}>;
+
+/** Bind only still-pending receipts in the SAME transaction that takes the
+ * queue rows. Previously bound receipts may name a reused debounce slot and
+ * must never be reassigned. Page by state transition, not OFFSET: every updated
+ * row leaves the next read, so a large collapsed burst cannot lose a page. */
+export declare const bindWorkflowStartReceipts: (tx: Pick<DataStore, "query" | "update">, submissionId: string) => Promise<number>;
+
 export declare const BUDGET_HOLDS_TABLE = "_voltro_budget_holds";
 
 /** Raised into the workflow when a hold outlived its ceiling. */
@@ -594,19 +1104,12 @@ export declare interface CancelOnSweepDeps {
     readonly store: CancelOnDataStore;
     /** Cancel a live run. MUST be idempotent — the boundary instant is re-read
      *  every tick, so a cancel can legitimately be issued twice. */
-    readonly cancelRun: (input: {
+    readonly cancelRun: (input: CancelDecision & {
         readonly workflowName: string;
-        readonly runId: string;
-        readonly executionId: string;
-        readonly reason: string;
-        readonly event: string;
     }) => Promise<void>;
     /** Discard a queued admission intent. Also idempotent. */
-    readonly discardIntent: (input: {
+    readonly discardIntent: (input: DiscardDecision & {
         readonly workflowName: string;
-        readonly intentId: string;
-        readonly reason: string;
-        readonly event: string;
     }) => Promise<void>;
     readonly now?: () => number;
     readonly log?: {
@@ -674,18 +1177,17 @@ export declare interface CancelProblem {
     readonly detail: string;
 }
 
-export declare const closeWorkflowChildrenForParent: (options: CloseWorkflowChildrenForParentOptions) => Promise<ReadonlyArray<WorkflowParentCloseDecision>>;
+/** Database-only acceptance and observation under the caller's resident
+ * admission transaction. The caller supplies authorized tenant identity. */
+export declare const cancelQueuedWorkflowStartInTransaction: (tx: AdmissionDataStore, input: ResidentQueuedCancellationTarget & {
+    readonly now: number;
+    readonly cause?: NonNullable<WorkflowControlRequest["cause"]>;
+}) => Promise<WorkflowQueuedCancellationResult>;
 
-export declare interface CloseWorkflowChildrenForParentOptions {
-    readonly store: WorkflowParentCloseStore;
-    readonly parentExecutionId: string;
-    readonly parentStatus: WorkflowParentCloseStatus;
-    readonly recorder?: WorkflowRunRecorderService;
-    readonly emit?: WorkflowParentCloseEmitter['emit'];
-    readonly log?: WorkflowParentCloseLogger;
-    readonly limit?: number;
-    readonly interruptChild: (workflowName: string, executionId: string, policy: Exclude<WorkflowParentClosePolicy, 'abandon'>) => Promise<void>;
-}
+/** A clean suspension already ended the application body. Settle only its
+ * generation-bound cancellation, under the same lock that owns reentry.
+ * A late engine wake will observe cancelled and cannot construct a new body. */
+export declare const cancelSuspendedWorkflowRunInTransaction: (tx: AdmissionDataStore, owner: WorkflowRunGeneration, now: number) => Promise<boolean>;
 
 /** The engine's own re-read rule: an unprocessed message whose `last_read` is
  *  older than this is re-delivered by the shard's owner on its next poll. A
@@ -711,6 +1213,25 @@ export declare interface ClusterDiagnosticsOps {
     readonly shardLockHolders: (shardIds: ReadonlyArray<string>) => Effect.Effect<ReadonlyArray<ShardLockHolder>>;
     /** The runner table — every address that registered, with its heartbeat. */
     readonly runners: () => Effect.Effect<ReadonlyArray<ClusterRunner>>;
+    /**
+     * Delete the unprocessed messages addressed to one entity — the ONE write on
+     * this service. A run that ended outside the engine (cancelled by a sweep or
+     * an operator, parked as failed) leaves its unanswered requests behind: the
+     * `activity` a killed executor never replied to, the `run` itself if it was
+     * never processed. Every runner that acquires the shard re-reads them for the
+     * re-read window, forever, and an `activity` request for a run that does not
+     * execute waits on a latch that never opens. Nothing consumes them; deleting
+     * is what the engine's own reset does for one request. Returns how many.
+     *
+     * `unreadForMs`: only messages a runner last read at least this long ago —
+     * the guard for the sweep, which must not take a request an operator's
+     * redrive cleared a moment ago and a runner has just re-read.
+     */
+    readonly discardMessages: (input: {
+        readonly entityType: string;
+        readonly entityId: string;
+        readonly unreadForMs?: number;
+    }) => Effect.Effect<number>;
 }
 
 export declare interface ClusterMessageState {
@@ -782,6 +1303,17 @@ export declare interface CompleteSuspendingSignalInput {
     readonly store?: WorkflowMessageStore;
 }
 
+/** Complete an executing body only after its actual exit. Suspended cancellation
+ * is owned by the entry transaction, not by this caller-facing helper. */
+export declare const completeWorkflowRunGenerationInTransaction: (tx: AdmissionDataStore, input: WorkflowRunCompletion) => Promise<{
+    readonly kind: "superseded" | "not-running";
+} | {
+    readonly kind: "committed";
+    readonly row: Row;
+    readonly failureId: string | null;
+    readonly terminalEvent: Row;
+}>;
+
 /** FiberRef carrying the active workflow's executionId — set by
  *  `wrapWithRunRecording` on every workflow body entry, read by a
  *  child workflow's recorder to populate
@@ -936,7 +1468,7 @@ export declare const DEFAULT_SUSPEND_HINT_MS: number;
 /** 24 h — see {@link WorkflowScheduleDeclaration.maxRuntime}. */
 export declare const DEFAULT_WORKFLOW_SCHEDULE_MAX_RUNTIME_MS: number;
 
-export declare type DeferMode = DeferringControl | 'paused';
+export declare type DeferMode = DeferringControl | 'paused' | 'singleton';
 
 /**
  * Controls that can DEFER a start rather than answer it immediately.
@@ -986,11 +1518,15 @@ export declare interface DiscardDecision {
  * button, a `cancelOn` event) go through here so neither can be the one that
  * leaves no trace.
  *
- * The row is written BEFORE the delete: the other order leaves a window where
- * the start is gone and nothing says why, which is precisely the state being
- * ruled out. A duplicate ledger row from a retry is a far cheaper failure.
+ * Audit, queued caller settlement and deletion share the resident admission
+ * transaction. A failed write retains the source; competing discard/drain
+ * operations cannot both consume the same queued input.
  */
-export declare const discardIntent: (store: AdmissionDataStore, intentId: string, reason: string, now: number) => Promise<boolean>;
+export declare const discardIntent: (store: Pick<DataStore, "insertIgnoreWithOutcome" | "transactional">, intentId: string, reason: string, now: number) => Promise<boolean>;
+
+/** Database-only discard under the resident admission lock. Audit, unbound
+ * caller settlement and source deletion must commit or roll back together. */
+export declare const discardIntentInTransaction: (store: AdmissionDataStore, intentId: string, reason: string, now: number) => Promise<boolean>;
 
 /** A row of `_voltro_workflow_events` — a published DOMAIN event. */
 export declare interface DomainEventRow {
@@ -1014,7 +1550,7 @@ export declare interface DrainOutcome {
     readonly expired: number;
     readonly evicted: number;
     readonly failed: number;
-    /** Pending intents moved out of the live drain set this tick. */
+    /** Pending intents or rejected submissions removed from the live dispatch set. */
     readonly deadLettered: number;
     /** Runs cancelled by `timeouts.finish` on this tick. */
     readonly timedOut: number;
@@ -1056,6 +1592,9 @@ export declare const drainTick: (deps: AdmissionDrainDeps, options?: DrainTickOp
 
 declare interface DrainTickOptions {
     readonly batchSize?: number;
+    /** Host has a change-channel-backed belief that the pending queue is empty.
+     * Submission recovery still runs; pending rows and submissions are not one queue. */
+    readonly skipPending?: boolean;
 }
 
 /**
@@ -1080,6 +1619,27 @@ export { durableQueueModule }
 
 export { durableRateLimiterModule }
 
+/** Establish the body-entry owner before running application code. Existing
+ * execution identity retains its run ID and original input; return the previous
+ * snapshot so crash/version guards decide from the state they actually replaced.
+ * Both row creation and re-entry execute under the resident admission lock. */
+export declare const enterWorkflowRunGenerationInTransaction: (tx: AdmissionDataStore, input: {
+    readonly workflowName: string;
+    readonly executionId: string;
+    readonly generation: string;
+    readonly initialRow: Row;
+    readonly now: number;
+    readonly delivery?: {
+        readonly requestId: string;
+        readonly restartToken: string | null;
+    } | null;
+}) => Promise<{
+    readonly kind: "created" | "entered" | "replayed" | "cancelled" | "already-cancelled";
+    readonly row: Row;
+    readonly previous: Row | undefined;
+    readonly terminalEvent?: Row;
+}>;
+
 /**
  * Read the state and decide — the ONE composition both callers use.
  *
@@ -1102,6 +1662,42 @@ declare interface EvaluateInput {
 
 export declare const EVENTS_TABLE = "_voltro_workflow_events";
 
+/** Submit under an identity the durable owner already chose and persisted.
+ * Does not derive the key again, reserve capacity, or persist caller context.
+ * Call only AFTER those responsibilities have committed, outside their
+ * transaction. Reusing an ID requires the same immutable encoded input.
+ * By default returns the accepted execution ID. With discard:false, waits for
+ * the typed body result under that same ID and preserves its failure channel.
+ * Record acceptance before joining; body completion is a separate event.
+ * Ordinary starts do not opt into this capability automatically. */
+export declare const executePreparedWorkflow: <Payload extends Schema.Schema.Any, Success extends Schema.Schema.Any, Error extends Schema.Schema.All, Discard extends boolean = true>(definition: {
+    readonly payloadSchema: Payload;
+    readonly successSchema: Success;
+    readonly errorSchema: Error;
+}, payload: Payload["Type"], executionId: string, options?: {
+    readonly discard: Discard;
+}) => Effect.Effect<Discard extends true ? string : Success["Type"], Error["Type"], WorkflowEngine.WorkflowEngine | Payload["Context"] | Success["Context"] | Error["Context"]>;
+
+declare const FailureRecordSchema: Schema.Struct<{
+    id: typeof Schema.String;
+    workflowName: typeof Schema.String;
+    tenantId: Schema.NullOr<typeof Schema.String>;
+    sourceId: typeof Schema.String;
+    sourceKind: Schema.Literal<["submission", "intent", "run"]>;
+    handler: Schema.NullOr<typeof Schema.String>;
+    callerContext: typeof Schema.Unknown;
+    report: Schema.Struct<{
+        workflow: typeof Schema.String;
+        payload: typeof Schema.Unknown;
+        errorTag: Schema.NullOr<typeof Schema.String>;
+        errorMessage: Schema.NullOr<typeof Schema.String>;
+        runId: Schema.NullOr<typeof Schema.String>;
+        executionId: Schema.NullOr<typeof Schema.String>;
+        reason: typeof Schema.String;
+        failedAt: typeof Schema.Number;
+    }>;
+}>;
+
 /** Raised when a user-supplied key function throws. Named separately because
  *  the alternative — letting it escape — surfaces as an opaque failure inside
  *  `start()` with no hint that the app's own lambda produced it. */
@@ -1135,6 +1731,12 @@ export declare const getWorkflowSchedule: (value: unknown) => ResolvedWorkflowSc
 
 export declare const getWorkflowVersionMetadata: (value: unknown) => WorkflowVersionMetadata;
 
+/** Transfer a stored incident to the existing durable arrival queue. Must share
+ * the resident admission transaction with its source transition when creating
+ * a report. No engine I/O; a queued receipt is not handler acceptance.
+ * The handler's declared controls apply when the arrival is drained. */
+export declare const handoffWorkflowFailureInTransaction: (tx: AdmissionDataStore, reportId: string, now: number) => Promise<WorkflowFailureHandoff>;
+
 /** `true` when this workflow declares at least one `cancelOn` entry — i.e. when
  *  the cancellation sweep has anything to do for it. */
 export declare const hasCancelOn: (control: ResolvedFlowControl | undefined) => boolean;
@@ -1340,6 +1942,13 @@ declare type NormaliseWorkflowMessages<M extends WorkflowMessageSchemas | undefi
  *  `patch()` then reports the PRE-patch branch. */
 export declare const normaliseWorkflowPatches: (value: unknown) => ReadonlyArray<string> | undefined;
 
+/** Record a failed submit/ack attempt on its durable owner, not a consumed
+ * pending row. Missing acknowledgement does NOT prove that the engine rejected
+ * the call; this record deliberately makes no terminal-execution claim.
+ * Call inside the owning admission transaction. A reached attempt limit stops
+ * automatic retry but retains the lease and receipt for reconciliation. */
+export declare const noteAdmissionSubmissionFailure: (tx: Pick<DataStore, "query" | "update">, id: string, error: string, now: number, maxAttempts?: number | false) => Promise<AdmissionSubmission>;
+
 export declare const noteIntentAttempt: (store: AdmissionDataStore, intent: PendingIntent, error: string, now: number) => Promise<void>;
 
 /**
@@ -1369,8 +1978,8 @@ export declare interface ParkDelayedStartInput {
     readonly tenantId: string | null;
     readonly queuedAppVersion?: string | null;
     readonly queuedSchemaFingerprint?: string | null;
-    /** Epoch ms the start becomes an ARRIVAL. Must be in the future — the facade
-     *  starts a past-`at` immediately and never calls in here. */
+    /** Epoch ms the start becomes an ARRIVAL. A transaction may enqueue for now;
+     * the row is invisible to other connections until the business commit. */
     readonly at: number;
     readonly now: number;
 }
@@ -1436,6 +2045,10 @@ declare type PayloadSchemaOf<P> = P extends Schema.Struct.Fields ? Schema.Struct
 
 export declare const PENDING_TABLE = "_voltro_workflow_pending";
 
+/** Bounded recovery window. Only completed queue transfers may be dispatched;
+ * a bare reservation does not prove that its selected rows were consumed. */
+export declare const pendingAdmissionSubmissions: (store: Pick<DataStore, "query">, limit: number, afterId?: string) => Promise<ReadonlyArray<AdmissionSubmission>>;
+
 /** Every hold currently parked — the operator's view, and the poller's input. */
 export declare const pendingBudgetHolds: (store: DataStore, options?: {
     readonly budget?: string;
@@ -1492,6 +2105,17 @@ export declare interface PendingIntent {
  */
 export declare const pendingSlotId: (workflowName: string, mode: string, controlKey: string) => string;
 
+export declare interface PendingSubmissionInput {
+    readonly id: string;
+    readonly workflowName: string;
+    readonly tenantId: string | null;
+    readonly intentIds: ReadonlyArray<string>;
+    readonly now: number;
+    /** Pure schema/control preparation from the rows read INSIDE the transaction.
+     * May run again after a database conflict. No engine or provider I/O. */
+    readonly prepare: (intents: ReadonlyArray<PendingIntent>) => Omit<ReserveAdmissionSubmissionInput, 'id' | 'tenantId' | 'intentIds' | 'now'>;
+}
+
 /**
  * The same read, plus the answer to "when is the next one due".
  *
@@ -1533,6 +2157,10 @@ declare interface PersistDeferInput {
     readonly existingId?: string;
 }
 
+/** Internal database-only constructor for an admission already recorded in the
+ * same transaction. Never re-evaluate capacity against that admission's lease. */
+declare const persistReservedSubmission: (tx: Pick<DataStore, "insert">, input: Pick<AdmissionSubmission, "id" | "workflowName" | "tenantId" | "ledgerId" | "payload" | "callerContext" | "intentIds" | "eviction">) => Promise<AdmissionSubmission>;
+
 /**
  * Which runs and intents a batch of events cancels.
  *
@@ -1546,16 +2174,20 @@ export declare const planCancellations: (input: CancelOnPlanInput) => CancelOnPl
 /**
  * The stored spelling of a concurrency key, pool-aware.
  *
- * `\u0000` separators, because the prefix must be unforgeable BY ACCIDENT: an
- * app's key function returning a string that collides with a pooled spelling
- * would silently count that run into another pool's budget. No app key
- * legitimately contains NUL, and a key function constructing this exact shape
- * on purpose is sabotage, not a typo. Kept human-readable (not hashed) so a
- * ledger row's key still SAYS which pool it held — "why was this dropped" must
- * stay answerable by looking.
+ * JSON tuples escape control characters (PostgreSQL text rejects NUL) and
+ * preserve component boundaries. Encode unpooled keys too: a raw application
+ * key must never impersonate a pooled tuple. Null identifies an unpooled key,
+ * independently of every possible string-valued pool name.
  */
 export declare const pooledConcurrencyKey: (pool: string | undefined, rawKey: string) => string;
 
+/** Bind the proposed application-derived execution identity before any engine
+ * call. Compute the proposal outside this database-only transaction; after a
+ * conflict, the first committed identity wins, never the retry's new proposal.
+ * A previous unbound dispatch is uncertain and cannot safely acquire a new ID.
+ * This records intent, not engine acceptance, and does not release capacity. */
+export declare const prepareAdmissionSubmissionExecutionInTransaction: (tx: Pick<DataStore, "query" | "update">, id: string, proposedExecutionId: string) => Promise<AdmissionSubmission>;
+
 /** Enqueue work and await the durable queue worker's result. */
 export declare const processQueue: typeof durableQueueModule.process;
 
@@ -1570,6 +2202,10 @@ export declare const processQueue: typeof durableQueueModule.process;
  */
 export declare const pruneAdmissions: (store: AdmissionDataStore, olderThan: Date, limit?: number) => Promise<number>;
 
+/** Resident entry consumes these requests. Public acceptance and recovery are
+ * not wired yet. A persisted submission target is intent, not cancellation. */
+export declare const queuedCancellationRequestsTable: SchemaTable;
+
 /** Start a durable queue worker layer with bounded concurrency.
  *
  *  `DurableQueue.worker` is itself generic (`<Payload, Success, Error, R>`), so
@@ -1592,6 +2228,8 @@ export declare const rateLimit: typeof durableRateLimiterModule.rateLimit;
  */
 export declare const readAdmissionState: (input: ReadStateInput) => Promise<AdmissionState>;
 
+export declare const readAdmissionSubmission: (tx: Pick<DataStore, "query">, id: string) => Promise<AdmissionSubmission | undefined>;
+
 /**
  * Every workflow name currently paused.
  *
@@ -1607,6 +2245,10 @@ export declare const readAdmissionState: (input: ReadStateInput) => Promise<Admi
  */
 export declare const readPausedWorkflows: (store: AdmissionDataStore) => Promise<ReadonlySet<string>>;
 
+/** Observe the original request without accepting, dispatching or repairing it.
+ * It remains readable after the source receipt has been removed. */
+export declare const readQueuedWorkflowCancellationInTransaction: (tx: Pick<AdmissionDataStore, "query">, input: ResidentQueuedCancellationTarget) => Promise<WorkflowQueuedCancellationResult>;
+
 declare interface ReadStateInput {
     readonly store: AdmissionDataStore;
     readonly control: ResolvedFlowControl;
@@ -1618,6 +2260,48 @@ declare interface ReadStateInput {
 /** Read the stored position for a sweep consumer. */
 export declare const readWatermark: (store: CancelOnDataStore, name: string) => Promise<Date | undefined>;
 
+export declare const readWorkflowControlInTransaction: (tx: Pick<Store, "query">, id: string) => Promise<WorkflowControlRequest | undefined>;
+
+/** Strict read: a damaged record is not an absent report. */
+export declare const readWorkflowFailureRecord: (tx: Pick<DataStore, "query">, id: string) => Promise<WorkflowFailureRecord | undefined>;
+
+/** Strict lookup shared by receipt owners; a malformed receipt is not absent. */
+export declare const readWorkflowStartReceipt: (store: Pick<DataStore, "query">, id: string) => Promise<WorkflowStartReceipt | undefined>;
+
+declare const ReceiptSchema: Schema.filter<Schema.Struct<{
+    id: typeof Schema.String;
+    workflowName: typeof Schema.String;
+    tenantId: Schema.NullOr<typeof Schema.String>;
+    pendingId: typeof Schema.String;
+    submissionId: Schema.NullOr<typeof Schema.String>;
+    terminal: Schema.NullOr<Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["dropped"]>;
+        at: typeof Schema.Number;
+        retryAfterMs: typeof Schema.Number;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["skipped"]>;
+        at: typeof Schema.Number;
+        executionId: typeof Schema.String;
+        runId: typeof Schema.String;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["superseded"]>;
+        at: typeof Schema.Number;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["cancelled"]>;
+        at: typeof Schema.Number;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["abandoned"]>;
+        at: typeof Schema.Number;
+        failureId: typeof Schema.NonEmptyString;
+    }>]>>;
+}>>;
+
+/** Reconcile under the resident admission lock. Only a terminal pre-admission
+ * drop/skip/supersession or proven pre-engine rejection permits a new arrival. Preserve every previous receipt and
+ * the immutable report. Unknown or stopped engine acceptance never creates a
+ * second submission. This is acceptance, not completion or provider delivery. */
+export declare const reconcileWorkflowFailureInTransaction: (tx: AdmissionDataStore, reportId: string, now: number) => Promise<WorkflowFailureDelivery>;
+
 /**
  * Append one ledger row. Also the lease, when the outcome is `admitted`.
  *
@@ -1683,6 +2367,27 @@ export declare interface RecordedStepShape {
     readonly stepName: string;
 }
 
+/** Database-only: call inside the resident admission transaction, together
+ * with the source's terminal transition. Never notify the handler from here.
+ * Replaying an identity keeps the first report AND recipient, even after a
+ * deployment changes the handler or a new attempt supplies a later timestamp. */
+export declare const recordWorkflowFailureInTransaction: (tx: Pick<DataStore, "query" | "insert">, input: WorkflowFailureRecord) => Promise<WorkflowFailureRecord>;
+
+/** Call inside the transaction that persists the pending start. The caller
+ * allocates id once, before any retryable callback. pendingId is a reusable
+ * queue slot; id is this caller's durable receipt and must not be that slot. */
+export declare const recordWorkflowStartReceipt: (tx: Pick<DataStore, "insertIgnoreWithOutcome">, input: Omit<WorkflowStartReceipt, "submissionId" | "terminal">) => Promise<WorkflowStartReceipt>;
+
+/** Record proven pre-engine rejection together with its source and lease.
+ * Attempt 0 means local validation before any engine call. Attempt 1 means the
+ * first call returned a failure the host guarantees occurs before engine I/O.
+ * A prior or competing attempt makes acceptance unknown, not rejected. */
+export declare const rejectAdmissionSubmissionInTransaction: (tx: AdmissionDataStore, id: string, attempt: number, failure: {
+    readonly handler: string | null;
+    readonly errorMessage: string;
+    readonly now: number;
+}) => Promise<WorkflowFailureRecord | undefined>;
+
 /**
  * Resume every run parked on `budget`.
  *
@@ -1753,9 +2458,83 @@ export declare interface ReplayShapeTracker {
  */
 export declare const reportNondeterminism: (findings: ReadonlyArray<NondeterminismFinding>) => Effect.Effect<void>;
 
+declare const RequestSchema: Schema.Struct<{
+    id: Schema.filter<typeof Schema.String>;
+    runId: Schema.filter<typeof Schema.String>;
+    workflowName: Schema.filter<typeof Schema.String>;
+    executionId: Schema.filter<typeof Schema.String>;
+    generation: Schema.filter<typeof Schema.String>;
+    operation: Schema.Literal<["cancel", "terminate", "resume"]>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    /** Null means no proven owner, not a null-tenant owner. */
+    owner: Schema.NullOr<Schema.Struct<{
+        tenantId: Schema.NullOr<typeof Schema.String>;
+    }>>;
+    cause: Schema.optional<Schema.NullOr<Schema.Struct<{
+        reason: typeof Schema.NonEmptyString;
+        detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    }>>>;
+    dispatchAttempts: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    resumeJournal: Schema.NullOr<Schema.Struct<{
+        requestId: Schema.filter<typeof Schema.String>;
+        replyId: Schema.filter<typeof Schema.String>;
+        restartToken: Schema.NullOr<typeof Schema.NonEmptyString>;
+    }>>;
+    result: Schema.NullOr<Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["confirmed", "already-terminal"]>;
+        status: Schema.Literal<["succeeded", "failed", "cancelled"]>;
+        completedAt: Schema.filter<typeof Schema.Number>;
+        output: typeof Schema.Unknown;
+        errorTag: Schema.NullOr<typeof Schema.String>;
+        errorMessage: Schema.NullOr<typeof Schema.String>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["confirmed"]>;
+        status: Schema.Literal<["running"]>;
+        enteredAt: Schema.filter<typeof Schema.Number>;
+        generation: Schema.filter<typeof Schema.String>;
+    }>]>>;
+}>;
+
+/** Reserve once, before engine I/O. The identity lookup precedes admission:
+ * otherwise a retry would wait forever for the slot its own submission holds.
+ * This primitive only persists a reservation; queue consumption and durable
+ * engine acknowledgement belong to the submission dispatcher. */
+export declare const reserveAdmissionSubmission: (store: Pick<DataStore, "insertIgnoreWithOutcome" | "transactional">, input: ReserveAdmissionSubmissionInput) => Promise<ReserveAdmissionSubmissionResult>;
+
+export declare interface ReserveAdmissionSubmissionInput {
+    /** Stable identity of this submission, independent of the process attempting it. */
+    readonly id: string;
+    readonly control: ResolvedFlowControl;
+    /** Decoded input used only to resolve the flow-control keys. */
+    readonly keyPayload: unknown;
+    /** Schema-encoded complete engine input, including the selected batch items. */
+    readonly encodedPayload: unknown;
+    readonly callerContext: unknown;
+    readonly intentIds: ReadonlyArray<string>;
+    readonly tenantId: string | null;
+    readonly paused: boolean;
+    readonly now: number;
+    readonly firstSeenAt: number;
+    readonly collapsed: number;
+    readonly mode: string | null;
+}
+
+export declare type ReserveAdmissionSubmissionResult = {
+    readonly kind: 'reserved';
+    readonly submission: AdmissionSubmission;
+    readonly reused: boolean;
+} | {
+    readonly kind: 'not-admitted';
+    readonly decision: Exclude<AdmissionDecision, {
+        kind: 'admit';
+    }>;
+};
+
 /** Test seam: forget which (workflow, signal) pairs have been hinted. */
 export declare const resetSuspendHintsForTest: () => void;
 
+export declare type ResidentQueuedCancellationTarget = typeof Target.Type;
+
 /** Resolve every declared key against one payload. Pure; throws only
  *  {@link FlowControlKeyError}. */
 export declare const resolveAdmissionKeys: (control: ResolvedFlowControl, payload: unknown) => AdmissionKeys;
@@ -1859,6 +2638,15 @@ export declare const resolveSuspendHintMs: () => number;
 
 export declare const resolveWorkflowMessageRun: (store: WorkflowMessageStore, target: WorkflowMessageTarget) => Promise<WorkflowResolvedRun>;
 
+/** Read inside the resident admission transaction. A prepared identity is not
+ * an acceptance acknowledgement; an absent or contradictory owner is not a
+ * pending start. Tenant authority is supplied by the caller, never the receipt. */
+export declare const resolveWorkflowStartReceipt: (tx: Pick<DataStore, "query">, input: {
+    readonly receiptId: string;
+    readonly workflowName: string;
+    readonly tenantId: string | null;
+}) => Promise<WorkflowStartResolution>;
+
 export declare const resumeWorkflow: (store: AdmissionDataStore, workflowName: string) => Promise<boolean>;
 
 /** Re-arm one dead-lettered intent after an operator has deployed a schema or
@@ -1902,7 +2690,14 @@ export declare interface ShardLockHolder {
     /** Who holds it: `pid <n> from <client>` for a postgres advisory lock, the
      *  runner address for a row lease. */
     readonly holder: string;
-    /** `true` when the holder is THIS runner's own lock session/address. */
+    /**
+     * `true` when THIS runner holds the shard — the engine's own answer
+     * (`Sharding.hasShardId`), never a guess from a connection. The first
+     * version compared the holder's pid with `pg_backend_pid()` of the query
+     * that asked, and the pool hands every query a different backend than the
+     * lock session, so a runner's own 300 locks read as a stranger's — and the
+     * report's lever, ending the holder's session, would have ended the runner.
+     */
     readonly own: boolean;
     readonly since: Date | null;
     readonly detail?: Record<string, unknown>;
@@ -1948,11 +2743,27 @@ export declare const sleepUntil: (options: {
     readonly until: Date | number;
 }) => Effect.Effect<void, never, never>;
 
+/** Database-only recovery step. The saved cursor and child control requests
+ * commit together. A receipt belongs to the first observed child generation;
+ * replay must never retarget it from a replacement row. Only a complete scan
+ * observing no open bound children completes the closure. Entry checks remain
+ * active after completion, so late children cannot escape this scan. */
+export declare const stageWorkflowParentClosureInTransaction: (tx: AdmissionDataStore, closureId: string, now?: number) => Promise<{
+    readonly scanned: number;
+    readonly controls: number;
+    readonly wrapped: boolean;
+}>;
+
 /** The narrow store slice this needs. Structural, like `CancelOnDataStore`. */
 export declare interface StalenessDataStore {
     query(descriptor: QueryDescriptor): Promise<ReadonlyArray<Row>>;
 }
 
+export declare interface StalenessRunCursor {
+    readonly startedAt: Date;
+    readonly runId: string;
+}
+
 export declare interface StalenessSweepDeps {
     readonly store: StalenessDataStore;
     /**
@@ -1988,6 +2799,9 @@ export declare interface StalenessSweepOptions {
     readonly stallAfterMs?: number;
     readonly runPage?: number;
     readonly eventLookback?: number;
+    /** Continue one physical store's oldest-first census. Omit after exhaustion
+     * to revisit runs which have since made progress or become stale again. */
+    readonly afterRun?: StalenessRunCursor;
 }
 
 export declare interface StalenessSweepResult {
@@ -2001,14 +2815,16 @@ export declare interface StalenessSweepResult {
     readonly alreadyReported: number;
     /** Excluded because they are inside a durable timer that has not come due. */
     readonly waitingOnTimer: number;
-    /** The candidate page filled up: more live old runs exist and the next tick
-     *  will reach them. Reported rather than inferred — the counts alone cannot
-     *  distinguish it from "nothing else was old". */
+    /** The candidate page filled up: another page must be checked before the
+     * census can claim exhaustion. That next page may be empty. */
     readonly sawFullRunPage: boolean;
     readonly failures: ReadonlyArray<{
         readonly subject: string;
         readonly detail: string;
     }>;
+    /** Present when the candidate page filled. Keep per physical store, not per
+     * replica or workflow. A failed candidate read does not advance the cursor. */
+    readonly nextRun?: StalenessRunCursor;
 }
 
 export declare interface StalledRun {
@@ -2149,6 +2965,34 @@ export declare interface StepRetryPolicy {
     readonly note?: string;
 }
 
+declare type Store = Pick<DataStore, 'query' | 'insert' | 'update'>;
+
+declare const SubmissionSchema: Schema.Struct<{
+    id: typeof Schema.String;
+    workflowName: typeof Schema.String;
+    tenantId: Schema.NullOr<typeof Schema.String>;
+    ledgerId: typeof Schema.String;
+    preparedExecutionId: Schema.NullOr<typeof Schema.String>;
+    executionId: Schema.NullOr<typeof Schema.String>;
+    runId: Schema.NullOr<typeof Schema.String>;
+    receiptsBound: typeof Schema.Boolean;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    failureId: Schema.NullOr<typeof Schema.String>;
+    retry: Schema.Struct<{
+        attempts: typeof Schema.Int;
+        after: typeof Schema.Number;
+        lastError: Schema.NullOr<typeof Schema.String>;
+        stoppedAt: Schema.NullOr<typeof Schema.Number>;
+    }>;
+    payload: typeof Schema.Unknown;
+    callerContext: typeof Schema.Unknown;
+    intentIds: Schema.Array$<typeof Schema.String>;
+    eviction: Schema.NullOr<Schema.Struct<{
+        executionId: typeof Schema.String;
+        runId: typeof Schema.String;
+    }>>;
+}>;
+
 /**
  * Park the run until the budget has headroom.
  *
@@ -2243,6 +3087,50 @@ export declare const sweepCancelOn: (deps: CancelOnSweepDeps, options: CancelOnS
  */
 export declare const sweepStalledRuns: (deps: StalenessSweepDeps, options?: StalenessSweepOptions) => Promise<StalenessSweepResult>;
 
+/** Transfer an arrival already admitted under THIS transaction. Unlike a due
+ * queue drain, a size-closing batch may consume inputs before their timeout.
+ * The caller supplies the encoded payload derived under this same lock. */
+export declare const takeAdmittedSubmissionInTransaction: (tx: AdmissionDataStore, input: Parameters<typeof persistReservedSubmission>[1]) => Promise<{
+    readonly id: string;
+    readonly tenantId: string | null;
+    readonly retry: {
+        readonly lastError: string | null;
+        readonly attempts: number;
+        readonly after: number;
+        readonly stoppedAt: number | null;
+    };
+    readonly payload: unknown;
+    readonly executionId: string | null;
+    readonly runId: string | null;
+    readonly failureId: string | null;
+    readonly workflowName: string;
+    readonly dispatchAttempts: number;
+    readonly callerContext: unknown;
+    readonly intentIds: readonly string[];
+    readonly ledgerId: string;
+    readonly receiptsBound: boolean;
+    readonly preparedExecutionId: string | null;
+    readonly eviction: {
+        readonly executionId: string;
+        readonly runId: string;
+    } | null;
+}>;
+
+/** Resident queue takeover. A competing transfer that already consumed any
+ * selected row invalidates the selection, rather than silently starting a
+ * smaller batch. Existing submission identity wins before looking at reusable
+ * queue slots; a retry cannot consume a later debounce burst. */
+export declare const takePendingAdmissionSubmission: (store: Pick<DataStore, "insertIgnoreWithOutcome" | "transactional">, input: PendingSubmissionInput) => Promise<ReserveAdmissionSubmissionResult | {
+    readonly kind: "selection-unavailable";
+}>;
+
+declare const Target: Schema.Struct<{
+    requestId: typeof Schema.NonEmptyString;
+    receiptId: typeof Schema.NonEmptyString;
+    workflowName: typeof Schema.NonEmptyString;
+    tenantId: Schema.NullOr<typeof Schema.String>;
+}>;
+
 export declare const truncateWorkflowValue: (value: unknown, bytes?: number) => unknown;
 
 export declare interface UnreadMessage extends ClusterMessageState {
@@ -2283,6 +3171,10 @@ export declare const validateWorkflowSchedule: (workflowName: string, declaratio
  */
 export declare const _voltroBudgetHoldsTable: TableLike;
 
+/** One coordination row per physical admission ledger, not per tenant/pool.
+ * Contains no payload or caller identity. Held only during database decisions. */
+export declare const _voltroWorkflowAdmissionLocksTable: SchemaTable;
+
 /**
  * `_voltro_workflow_admissions` — append-only ledger, and the lease register.
  *
@@ -2292,6 +3184,19 @@ export declare const _voltroBudgetHoldsTable: TableLike;
  */
 export declare const _voltroWorkflowAdmissionsTable: SchemaTable;
 
+/** Resident control identity and attempted delivery, distinct from the run's
+ * outcome. An attempted interrupt is not a confirmed cancellation. */
+export declare const _voltroWorkflowControlRequestsTable: SchemaTable;
+
+/** Resident, immutable incidents. Persistence is not handler delivery; the
+ * delivery lifecycle must not overwrite the report or its original recipient. */
+export declare const _voltroWorkflowFailureReportsTable: SchemaTable;
+
+/** Durable child-close work, committed with its parent generation's terminal
+ * outcome. Also prevents body re-entry after run-history retention. No payload
+ * or caller credentials; never cascade from runs or expire completed scans. */
+export declare const _voltroWorkflowParentClosuresTable: SchemaTable;
+
 /**
  * `_voltro_workflow_pauses` — one row per PAUSED workflow. Absent ⇒ running.
  *
@@ -2324,10 +3229,24 @@ export declare const _voltroWorkflowRunStepsTable: SchemaTable;
 
 export declare const _voltroWorkflowStartContextsTable: TableLike;
 
+/** A caller's identity survives removal and later reuse of a debounce slot. */
+export declare const _voltroWorkflowStartReceiptsTable: SchemaTable;
+
+/** Immutable engine submissions live in the same physical store as their queue
+ * payloads. A reservation retry reads this row instead of taking another lease. */
+export declare const _voltroWorkflowSubmissionsTable: SchemaTable;
+
 export declare const _voltroWorkflowWatermarksTable: SchemaTable;
 
 export declare const WATERMARKS_TABLE = "_voltro_workflow_watermarks";
 
+/** Serialize database-only admission decisions. Never call the engine or a
+ * provider from work: the store can replay it after a transaction conflict.
+ * Bootstrap is outside the transaction so a MySQL consistent read performed
+ * by insertIgnore cannot establish a stale snapshot before the locking read.
+ * The nonce write also makes optimistic memory transactions conflict. */
+export declare const withAdmissionTransaction: <A>(store: Pick<DataStore, "insertIgnoreWithOutcome" | "transactional">, work: (tx: DataStore) => Promise<A>) => Promise<A>;
+
 /**
  * Add compensating (rollback) logic to a top-level effect in a workflow
  * body. The finalizer runs if the WHOLE workflow later fails — use it for
@@ -2538,6 +3457,8 @@ export declare interface WorkflowConcurrency<Payload> {
     readonly pool?: string;
 }
 
+export declare type WorkflowControlRequest = typeof RequestSchema.Type;
+
 /**
  * Collapse a burst of starts into ONE run, `period` after the last one.
  *
@@ -2570,6 +3491,21 @@ export declare interface WorkflowDebounce<Payload> {
 }
 
 export declare interface WorkflowExecuteRecordingOptions extends WorkflowRunRecorderOptions {
+    readonly store: WorkflowRecordingStore & Required<Pick<WorkflowRecordingStore, 'query'>>;
+    /** Encode the full decoded workflow input before storing its durable run
+     * payload. Hosts omitting this callback accept JSON-only inputs. Never use
+     * the batch-item schema here: the body receives the complete batch. */
+    readonly encodePayload?: (payload: unknown) => unknown;
+    /** Same resident store as `store`, under the shared admission lock. The
+     * database-only callback may replay; never run application code inside it. */
+    readonly transaction: <T>(work: (tx: AdmissionDataStore) => Promise<T>) => Promise<T>;
+    /** Bound identity for durable failure delivery. Omitted by standalone hosts
+     * without a failure handler; framework boot paths provide the resolved caller. */
+    readonly failureContext?: {
+        readonly handler: string | null;
+        readonly callerContext: unknown;
+        readonly tenantId: string | null;
+    };
     readonly name: string;
     readonly subject?: unknown;
     readonly source?: string | null;
@@ -2578,6 +3514,7 @@ export declare interface WorkflowExecuteRecordingOptions extends WorkflowRunReco
     readonly workflowCompatibleVersions?: ReadonlyArray<string> | null;
     readonly workflowPatches?: ReadonlyArray<string> | null;
     readonly parentExecutionId?: string | null;
+    readonly parentGeneration?: string | null;
     readonly parentClosePolicy?: WorkflowParentClosePolicy | null;
     readonly onParentClose?: (input: {
         readonly workflowName: string;
@@ -2587,30 +3524,15 @@ export declare interface WorkflowExecuteRecordingOptions extends WorkflowRunReco
     }) => Promise<void>;
     readonly recorder?: WorkflowRunRecorderService;
     readonly pluginWorkflowStepLayer?: Layer.Layer<any, never, never>;
-    /**
-     * A run reached a TERMINAL state — supplied by the CLI wiring so this package
-     * needs no knowledge of flow control.
-     *
-     * It exists to free the run's admission lease. That lease is what a
-     * `concurrency` limit counts, so a terminal transition that does not release
-     * it does not error, log, or fail a test — the limit simply admits one fewer
-     * run, permanently, and then one fewer again. A deployment that slowly stops
-     * doing work with nothing pointing at why.
-     *
-     * Called on success AND on failure, and DELIBERATELY not on suspend: a
-     * suspended run is still holding the resource it was admitted for.
-     *
-     * On a failure it also carries the payload and the error, so the caller
-     * can raise the workflow's `onFailure` — the one route into that signal
-     * that produces a `failed` row, and the one that was not wired: the
-     * flow-control paths (an expired start, a finish timeout, a dead-lettered
-     * intent) notified, and a body that failed did not.
-     */
+    /** Observation after a committed terminal transition, never an admission or
+     * failure-delivery writer. The resident transaction already records the
+     * failure arrival and releases capacity. Not called for superseded results
+     * or failed commits; callback failure cannot undo a committed outcome. */
     readonly onTerminal?: (input: {
         readonly workflowName: string;
         readonly executionId: string;
         readonly runId?: string;
-        readonly status: 'succeeded' | 'failed';
+        readonly status: 'succeeded' | 'failed' | 'cancelled';
         /** The run's payload — present on `failed`, for the failure report. */
         readonly payload?: unknown;
         readonly errorTag?: string | null;
@@ -2649,6 +3571,28 @@ export declare interface WorkflowExecuteRecordingOptions extends WorkflowRunReco
     readonly replayShapeLimit?: number;
 }
 
+export declare type WorkflowFailureDelivery = WorkflowFailureHandoff | {
+    readonly kind: 'accepted';
+    readonly executionId: string;
+} | {
+    readonly kind: 'cancelled';
+    readonly receiptId: string;
+};
+
+export declare type WorkflowFailureHandoff = {
+    readonly kind: 'unconfigured';
+} | {
+    readonly kind: 'queued';
+    readonly receiptId: string;
+    readonly intentId: string;
+};
+
+/** Low-level persistence foundation. A record proves the failure was recorded,
+ * not that its handler accepted or completed it. Payload must be schema-encoded.
+ * The source's owner allocates one identity before entering a retryable
+ * transaction; reusable debounce slots are not permanent incident identities. */
+export declare type WorkflowFailureRecord = typeof FailureRecordSchema.Type;
+
 /**
  * What an `onFailure` workflow receives. Declare it as that workflow's
  * `payload` schema — the framework validates against it like any other start,
@@ -2852,33 +3796,8 @@ export declare interface WorkflowMessageTarget {
 
 export { workflowModule }
 
-export declare interface WorkflowParentCloseDecision {
-    readonly runId: string;
-    readonly workflowName: string;
-    readonly executionId: string;
-    readonly policy: WorkflowParentClosePolicy | null;
-    readonly action: 'cancelled' | 'abandoned' | 'skipped' | 'failed';
-    readonly reason?: string;
-}
-
-export declare interface WorkflowParentCloseEmitter {
-    emit(channel: 'workflowRuns' | 'workflowSteps' | 'workflowEvents', event: {
-        readonly op: 'insert' | 'update';
-        readonly row: Record<string, unknown>;
-    }): void;
-}
-
-export declare interface WorkflowParentCloseLogger {
-    warn(message: string, fields?: Record<string, unknown>): void;
-}
-
 export declare type WorkflowParentCloseStatus = 'succeeded' | 'failed' | 'cancelled';
 
-export declare interface WorkflowParentCloseStore {
-    query(descriptor: QueryDescriptor): Promise<ReadonlyArray<unknown>>;
-    update(table: string, id: string, patch: unknown): Promise<unknown | null>;
-}
-
 /** Everything `Workflow.make` accepts for `payload`: a struct Schema, or bare
  *  `Fields`. Both stay supported — a key lambda must not silently degrade to
  *  `any` because the workflow spelled its payload the shorter way. */
@@ -2925,6 +3844,28 @@ export declare interface WorkflowResolvedRun {
     readonly tag?: string;
 }
 
+export declare interface WorkflowRunCompletion {
+    readonly owner: WorkflowRunGeneration;
+    readonly now: number;
+    readonly durationMs: number;
+    readonly outcome: {
+        readonly status: 'succeeded';
+        readonly output: unknown;
+    }
+    /** Only a confirmed exit of this body generation. A void interrupt reply
+    * is not confirmation and must never be passed as this outcome. */
+    | {
+        readonly status: 'cancelled';
+    } | {
+        readonly status: 'failed';
+        readonly errorTag: string | null;
+        readonly errorMessage: string | null;
+        readonly handler: string | null;
+        readonly callerContext: unknown;
+        readonly tenantId: string | null;
+    };
+}
+
 /**
  * Closed enumeration of event types the framework knows how to emit.
  * Kept here (not in `runEventsTable.ts`) so callers in the recorder
@@ -2938,7 +3879,10 @@ export declare type WorkflowRunEventType = 'run-started' | 'run-suspended' | 'ru
 *  `payload` carries `{ reason, activitiesReset }` — how many failed step
 *  attempts were reset so they re-execute (completed steps replay). Distinct
 *  from `run-resumed`, which continues a *suspended* run. */
-| 'run-redriven' | 'run-cancelled' | 'run-succeeded' | 'run-failed'
+| 'run-redriven' | 'run-cancelled'
+/** Durable receipt settlement, including the original control cause. This
+* is not a second run transition or proof that a late request caused it. */
+| 'control-settled' | 'run-succeeded' | 'run-failed'
 /** Emitted when `sleep({ name, duration })` enters the wait — `payload`
 *  carries `{ name, durationMs, scheduledWakeAt }`. The dashboard
 *  Gantt renders these as a hatched bar in the timeline so a
@@ -2998,13 +3942,22 @@ export declare type WorkflowRunEventType = 'run-started' | 'run-suspended' | 'ru
 *  lastProgressAt, reason }`. Diagnostic only — the run is untouched. */
 | 'run-stalled';
 
+export declare interface WorkflowRunGeneration {
+    readonly runId: string;
+    readonly workflowName: string;
+    readonly executionId: string;
+    /** Allocate once before entering the replayable transaction. Not a timestamp
+     * or a reclaim counter: both may repeat across distinct body entries. */
+    readonly generation: string;
+}
+
 /** A workflow run's TERMINAL outcome, handed to the metrics hook. Kept local to
  *  this package (structurally matching `@voltro/runtime`'s `WorkflowRunRecord`) so
  *  the workflow package stays free of a `@voltro/runtime` dependency — the CLI
  *  wiring supplies a `recordRun` that forwards to `recordWorkflowRun`. */
 declare interface WorkflowRunOutcome {
     readonly name: string;
-    readonly status: 'succeeded' | 'failed';
+    readonly status: 'succeeded' | 'failed' | 'cancelled';
     readonly durationMs: number;
     /** UNIX seconds — set only on success (drives the last-success gauge). */
     readonly completedAtSec?: number;
@@ -3223,6 +4176,21 @@ export declare interface WorkflowSingleton<Payload> {
     readonly mode: 'skip' | 'cancel';
 }
 
+export declare type WorkflowStartReceipt = typeof ReceiptSchema.Type;
+
+export declare type WorkflowStartResolution = {
+    readonly kind: 'pending';
+} | {
+    readonly kind: 'accepted';
+    readonly executionId: string;
+} | {
+    readonly kind: 'terminal';
+    readonly outcome: NonNullable<WorkflowStartReceipt['terminal']>;
+} | {
+    readonly kind: 'rejected';
+    readonly failureId: string;
+};
+
 /**
  * Per-step plugin interceptor. Plugins can wrap every `step()`
  * (== `Activity.make`) invocation with observability, suppress /
@@ -3378,7 +4346,7 @@ export declare interface WorkflowWorkerLayerBrand {
 
 export declare const WorkflowWorkerLayerTypeId: unique symbol;
 
-export declare const wrapWorkflowExecuteWithRunRecording: (options: WorkflowExecuteRecordingOptions, userExecute: (payload: unknown, executionId: string) => Effect.Effect<unknown, unknown, never>) => (payload: unknown, executionId: string) => Effect.Effect<unknown, unknown, never>;
+export declare const wrapWorkflowExecuteWithRunRecording: (options: WorkflowExecuteRecordingOptions, userExecute: (payload: unknown, executionId: string, generation: string) => Effect.Effect<unknown, unknown, never>) => (payload: unknown, executionId: string) => Effect.Effect<unknown, unknown, never>;
 
 /**
  * Advance the stored position.