PostgreSql

Returns the supplied transaction's open connection after validating its physical store target.

Reuses the default schema manager's connection for the compatible runtime observation, halving pool acquisitions on the full health path while preserving custom-manager composition.

Preserves the legacy Boolean/exception admission behavior for internal callers and compatibility tests.

Attempts store admission and returns typed pre-execution causes without parsing legacy exception messages.

Creates or verifies this process generation while holding the worker row lock.

Reads metadata, the optional worker generation, and due facts from one statement snapshot and one result row.

Reads the one-row runtime observation through an existing compatible status connection.

Validates the complete one-row provider result before any public snapshot is constructed.

Reads authoritative database time for a schema-only incompatibility assessment.

Reads authoritative database time through an existing compatible status connection.

Creates a refusal that has no legacy exception.

Creates a typed outcome that retains the original legacy exception.

Reads and validates the exact native authority for a caller-transaction handoff, without changing protocol state.

Samples the clock already used by the matching legacy or opted-in admission path.

Returns lease expiry before an elapsed or permanently observed opted-in deadline.

Accepts a Flow child Work with an immutable activity identity while retaining the ordinary Work protocol. The caller owns the surrounding transaction and must register the parent wait before commit.

Renews the active lease held by a fenced Work claim.

Validates schema compatibility and the optional store identity in the exact caller transaction.

Validates schema removal after the successful existence probe without relying on timing.

Preserves the PostgreSQL failure that exposed a missing schema without copying its server text.

Holds the migration fence and checks the active epoch before scoped provider operations.

Checks the active epoch after the caller has acquired the shared migration fence.

Acquires the shared migration fence before schema, store and epoch reads in a caller transaction.

Revalidates the store after permit commit and atomically consumes exact invocation admission once.

Distinguishes an independently lost lease from the immutable deadline cap.

Maintains eligibility separately from payload-free discovery; closed projections are excluded.

Adds a positive duration only after bounding it by a representable UTC cap.

Appends exact old-fence evidence once, retaining codec/digest/classification/retention metadata.

Records only closed values after authoritative refusal; listener failure cannot change truth.

Returns timing facts only for an opt-in row, locking rows in separate commands before sampling.

Projects immutable timing facts from the same Work statement snapshot used for authorized inspection.

Decodes the accepted policy column group; unknown versions fail closed.

Samples the volatile authoritative clock only after callers acquire required locks.

Persists first closure without clearing it or altering a command's revision projection.

Projects closed public problem precedence; ambiguous effects take precedence over timing.

Closed safety-specific suspension for an admitted outcome that remains unknown.

Inserts immutable trace evidence into the caller-owned Flow mutation transaction.

Attaches inserted trace evidence to every Flow record created by the same committed transition.

Queues maintenance without waiting for database work.

Stops scheduled maintenance during host shutdown.

Runs the sole private admission and execution state machine shared by both public projections.

Classifies only a failure that occurred before the execution boundary.

Makes one fresh, bounded ownership-scoped cleanup attempt without replacing the original outcome.

Deactivates invocation authority as soon as the executor exits, independently of lease maintenance.

Schedules opt-in lease maintenance without adding beyond its current authoritative lease bound.

Reads installed migration metadata without modifying the database.

Generates deterministic SQL for migrations newer than the exact reviewed fromVersion .

Applies pending migrations while holding the package session advisory lock.

Fails when the installed schema cannot be used without changing it.

Activates the first non-empty store recovery epoch exactly once.

Atomically rotates the recovery epoch when the expected epoch remains active.

Registers PostgreSQL durable clients, schema validation, health, drain, and the bounded pump without starting a background worker or applying migrations.

Rejects partial or visibly split opt-in admission overrides before package services are added.

Adds the one critical continuous worker loop after passive PostgreSQL durable registration.

Adds the separately authorized verified Flow-retention client after PostgreSQL durable storage registration.

Creates the canonical SHA-256 digest of one child-effect suspension descriptor.

Executes a non-query control-plane command.

Executes a non-query control-plane operation and maps only package-owned deadline cancellation.

Executes a scalar control-plane command.

Executes and completely projects a control-plane reader while its deadline remains active.

Gets deadline evidence recorded for the original exception.

Reports whether the command's linked token propagated cancellation from this exact caller token.

Records package-owned deadline evidence while retaining the original exception object.

Executes one control-plane operation through the inherited command-timeout sidecar.

Returns an allowlisted unavailable or incompatible classification, otherwise the propagate result.

Maps a schema compatibility value to its stable public problem code.

Gets the canonical descriptor for an existing schema-compatibility health/admission code.

Gets the canonical descriptor for a known code; unknown application codes remain unclassified.

Returns a known internal health/admission code through its canonical descriptor.

Creates a completed outcome with the exact provider result.

Creates a typed refusal, optionally retaining the exact legacy exception.

Creates an unavailable result while retaining the original provider exception.

Creates an incompatible result while retaining the exact legacy exception.

Marks an exception without changing its type, message, token, inner exception, or stack.

Gets whether terminal finalization, rather than the active pass token, produced this failure.

Gets whether the sole application execution boundary produced this failure.

Marks the original exception without wrapping it or changing its legacy projection.

Consumes whether ownership-scoped cleanup is required before this attempt projects the failure.

Maps stable manifest-create procedure rejections before attempting to read a persisted manifest.

Maps one stable lifecycle procedure response into the public retention mutation result.

Observes a committed Flow protocol barrier.

Claims and processes up to the requested number of eligible Schedule dispatch rows.

Projects one persisted Work state or rejects an unknown value as corruption.

Formats one supported provider-safety value for persistence.

Parses one persisted provider-safety value or rejects corruption.

Formats one supported payload classification for persistence.

Parses one persisted payload classification or rejects corruption.

Invokes one prepared provider operation and returns its encoded exit fact.

Returns whether a runtime operation may safely reuse this manager's status connection.

Opens a schema-status connection while preserving the status-acquisition observation seams.

Reads schema status through an existing connection so a compatible runtime observation can reuse one pool acquisition without changing the migration-fence transaction boundary.

Reads schema compatibility and migration checksums inside a caller-owned transaction.

Reads the authoritative schema status for the non-mutating doctor with bounded migration-history capture.

Validates schema compatibility on the connection and transaction that already hold runtime admission's migration fence.

Returns whether a new pass may start without acquiring or reserving any separate release handle.

Rejects future admissions without waiting for or cancelling an in-flight pass.

Allows future admissions after a controlled drain rollback or recovery decision.

Checks immutable retry eligibility without granting authority or executing a projection.

Requeues a pending coalesced Schedule occurrence after its Work target becomes terminal.

Adds the immutable selection arrays to a Work-discovery command without rebuilding them for every poll.

Adds the single critical host adapter that continuously invokes the bounded runtime pump.

Safe permanent admission refusal, or null; current-slot admission does not consume a new slot.

Checks the exact current attempt and lease without trusting the caller's snapshot or clock.

Runs one application authorization and conditional handoff write under current native fences.

Writes one durable acceptance without taking ownership of the transaction.

Enters authority only around executor invocation after permit commit and existing admission.

Restores caller scope with an intentional cleanup barrier; a failure requires caller recovery.

Releases an established savepoint with an intentional cleanup barrier; owns no outer transaction.

Restores effective scope including the empty/no-scope state; never changes the role or session defaults.

Calculates the execution window left after finalization and cleanup reserves are protected.

Reports whether package-owned evidence proves that the provider command deadline elapsed.