tag:voltro.dev,2026:changelog 2026-10-07T00:00:00Z tag:voltro.dev,2026:release/0.84.0 2026-10-07T00:00:00Z

BREAKING: CRDT documents hard-compact into epochs without losing or doubling edits BREAKING: Last-write-wins orders by hybrid logical clock stamps BREAKING: Retry Inspect creation with a stable request identity BREAKING: outboxPersistence keeps one queue per signed-in subject BREAKING: Reject stale release confirmations across replicas BREAKING: SQLite decimal columns use exact fixed-point storage BREAKING: Direct storage metadata counter rows use decimal strings Added: The query mirror plugs into the api mount and derives what to mirror Added: queryOnce is importable without the React hooks Added: Compose baselines support optional production environment variables Added: A conformance suite makes any CRDT backend a drop-in Added: CRDT documents migrate their content when the editor schema changes Added: A CRDT panel shows documents approaching their limits in both dashboards Added: Loro ships as a second CRDT backend Added: crdtSealed() columns keep collaborative content end-to-end encrypted Added: Sealed CRDT versions restore on the client, and the CRDT hooks gain restore() Added: Collaborative undo for useCrdtText and a converging crdtCounter() column Added: CRDT cells keep a version history that can be restored Added: The server bounds and validates what a client writes into a CRDT column Added: useLocalQuery filters and sorts the device's replica of a table, offline Added: Use guarded source capture for MySQL and MariaDB Timeline Added: useOutbox({ api }) is an offline write lane with previews that survive a reload Added: Expose reviewed offline SQLite decimal conversion Changed: CRDT sync retries on its own clock and follows the api's transport Changed: CRDT edits upload as increments, so large documents stay editable Fixed: Accept final agentic flow results on strict structured-output providers Fixed: Commit release state and audit events atomically Fixed: Roll back failed SQLite-family table rewrites atomically Fixed: Share binlog CDC control queries and report both owned connections Fixed: Keep binlog reconnects within their connection budget Fixed: SQL readiness answers when connection acquisition stalls Fixed: Browser loader integration retains callable client declarations Fixed: Retain browser-loader query declarations Fixed: Changelog package filters include every affected package Fixed: New string columns respect the store charset before table conversion Fixed: Foreign-key operations wait for table creation and charset conversion Fixed: Compose baselines support workspaces without a web app Fixed: Compose dependency volumes remain distinct for every package path Fixed: Compose baselines refuse malformed apps and generated-variable collisions Fixed: Compose prepares workspace dependencies before development startup Fixed: Resolve content loaders in compiled server bundles Fixed: CRDT folds stay lossless across replicas Fixed: Keep CRDT inspection bounded and recover from invalid reads Fixed: Keep CTE references local in tenant namespace queries Fixed: Refresh dashboard app reachability independently Fixed: Recover independent app overview observations Fixed: Preserve RPC drafts during temporary definition read failures Fixed: Shared table updates observe every known replica Fixed: Dashboard live streams recover through known fleet entry points Fixed: Unconfirmed data cell saves show recovery context Fixed: Data cell save state survives read outages Fixed: Local data drafts survive app-metadata outages Fixed: Treat database-generated columns as read-only in the data explorer Fixed: Inline data drafts survive temporary read failures Fixed: Resolve database command roots without treating migration IDs as paths Fixed: Match decimal relation keys across column scales Fixed: Preserve encoded decimal schema identity Fixed: Failed deploy undo reports every completed schema reversal Fixed: Soft-drop deploy undo preserves rows without blocking parent restoration Fixed: Reduce repeated binding resolution in Doctor source scans Fixed: Reduce overhead for immediate event publication Fixed: Gateway BYOK costs follow nested routing receipts Fixed: Keep global logs stable while pausing and reconnecting Fixed: Isolate global metrics observations and recover failed sources Fixed: Keep inspect creation receipts in their own deployment Fixed: Count inspected rows without loading every matching ID Fixed: Loro apps run under voltro dev, and the collab template can switch to Loro Fixed: Exact bigint sums and extrema in the memory store Fixed: Install SQL Server driver dependencies in standalone workspaces Fixed: Stop reporting SQL Server CDC retries after reader shutdown Fixed: SQL Server deploy prepares workflow storage before serving Fixed: Preserve exact SQL Server decimal row values Fixed: Await SQL Server cancellation before pooled connection reuse Fixed: Use native SQL Server renames for retained schema snapshots Fixed: Retire SQL Server Timeline capture within atomic schema deployments Fixed: Reject orphan Timeline capture before SQL Server migrations Fixed: SQL Server writes work with Timeline capture triggers Fixed: Read MySQL bulk inserts back through explicit primary keys Fixed: Recover single MySQL inserts by their declared primary key Fixed: An empty agent inventory disables planner delegation Fixed: Keep workspace Radix hooks on one React instance during prerender Fixed: Distinguish uncertain record saves and deletions Fixed: Reject mismatched decimal storage in typed readers Fixed: Recheck observed release channel state before confirmation Fixed: Validate release forms and isolate pending target actions Fixed: Validate release inspect actions before execution Fixed: Rendered-page styles, font caching and accessible code content Fixed: Wake queued schedules when completion arrives during a turn check Fixed: Expand integer columns without destructive migration authorization Fixed: Require patched image processing dependencies Fixed: Scope SQL callback upserts to their complete conflict keys Fixed: SQL Server accepts Uint8Array binary parameters without conversion errors Fixed: Connect SQL Server Timeline to shared capture hosts and migrations Fixed: Reuse prepared SQL Server Timeline contracts without schema DDL rights Fixed: Scope SQLite callback upserts to their conflict keys Fixed: Execute recursive tree queries on SQLite and libSQL Fixed: Match SQLite write conditions and keys to their column codecs Fixed: SQLite set operations preserve branch queries and pagination Fixed: SQLite replica rebalancing keeps database traffic responsive Fixed: Answer missing enumerated static paths with 404 Fixed: Storage metadata supports files and tenant usage beyond 2 GiB Fixed: Explain storage encoding changes in rollout guidance Fixed: Storage statistics preserve tenant and visibility groups on SQL stores Fixed: Preserve native timestamp precision in predicate bindings Fixed: Release native libSQL locks after failed statements Fixed: Keep decimal parity checks aligned with the migrated schema Fixed: Carry the declared store charset into Timeline cluster preparation Fixed: Keep Timeline data visible on narrow screens Fixed: Keep native Timeline restores inside their target database Fixed: Timeline explains protected values and adapts event colors to the theme Fixed: Share native Turso namespace attachments across pool connections Fixed: Enable supported generated columns on Turso backends Fixed: Manual upgrade notes include tracked SQL scripts Fixed: Verify physical decimal compatibility independently of automatic migration Internal: Declare the SQLite dependency of the media replay fixture Internal: Numeric formatting bounds excessive precision Internal: Verify completed client mounting and offline transport loss Internal: Normalize generated Atom headline whitespace Internal: Classify owned migration and statement-local DDL sites Internal: Preserve CLI resource isolation during development Internal: Align codemod metadata with the complete registry Internal: Keep cold-start reference measurements separate Internal: Preserve collection runner diagnostics and isolate process checks Internal: Acquire the Compose env audit image when missing Internal: Keep CRDT replica test workers outside shipped-source coverage Internal: Validate exact decimal conversion sources Internal: Preserve ungrouped aliased rows in exact decimal queries Internal: Route encoded decimal eager reads through schema-aware queries Internal: Bound exact decimal result decoding plans Internal: Route explicitly encoded SQLite decimal query results Internal: Connect physical decimal metadata to SQLite row codecs Internal: Flatten exact decimal window CTE composition Internal: Compose exact decimal queries through derived CTE sources Internal: Preserve exact decimal values at derived source boundaries Internal: Verify an exact SQLite decimal physical schema and validation boundary Internal: Compose exact decimal compound queries across SQLite clients Internal: Compose exact decimal membership and existence subqueries Internal: Keep framework table metadata bound to first-party source Internal: Execute real Helm chart rendering in CI Internal: Verify media prompt changes across process restart Internal: Resolve Timeline tests from their dedicated SQL Server fixture Internal: Native restore coverage shares SQL Server fixture configuration Internal: Run native SQL tests with the declared fixture and capability lanes Internal: Preserve scheduled validation evidence across concurrent updates Internal: Match the production deploy fixture pool to SQL workflow startup Internal: Protect retained decimal-conversion witnesses Internal: Share dedicated SQL Server test fixture credentials Internal: Indexed source maps use bounded section offsets Internal: Prepare a bounded SQL Server Timeline capture plan Internal: Prepare SQL Server Timeline physical catalog validation Internal: Fence SQL Server Timeline reads against concurrent table resets Internal: Prepare SQL Server Timeline continuity checks Internal: Prepare guarded SQL Server Timeline source reads Internal: Compose SQL Server Timeline installation and namespace discovery Internal: Prepare SQL Server Timeline journal frames Internal: Preserve migration lock scope in SQL Server Timeline sessions Internal: Prepare SQL Server Timeline observer admission Internal: Prepare SQL Server Timeline observer acknowledgements and retention Internal: Prepare persisted SQL Server Timeline activation contracts Internal: Persist and retire SQL Server Timeline capture plans Internal: Prepare a coherent SQL Server Timeline read boundary Internal: Prepare scoped SQL Server Timeline recorder sessions Internal: Prepare schema-aware SQL Server Timeline images Internal: Compose guarded SQL Server Timeline schema preparation Internal: Rediscover SQL Server Timeline activation after session invalidation Internal: Prepare SQL Server Timeline snapshot projection Internal: Guard SQL Server Timeline storage adoption Internal: Validate SQL Server Timeline application-table prerequisites Internal: Validate SQL Server Timeline trigger ownership

tag:voltro.dev,2026:release/0.83.1 2026-10-04T00:00:00Z

Added: The devtools capsule can be dragged anywhere and snaps into place Added: Devtools push keeps dialogs beside the console; the console gets its own window Added: Embeddings through the AI Gateway Added: Gateway media responses are read under a byte budget Added: Offloaded calls refuse where the run cannot park, before submitting Fixed: Agentic flow steps always end, and say which agent and media they used Fixed: A boot that meets a held migration lock still converges reactive triggers Fixed: A declared charset converts tables before new tables reference them Fixed: A failed db apply removes the framework tables it created Fixed: gatewayCostUsd counts what a BYOK call costs at the provider Fixed: A boot waits for a migration that is still running instead of giving up Fixed: Every package declares the packages its built code imports Fixed: The mail and rate-limit database stores pass the boot permission audit Fixed: An interrupted PostgreSQL query no longer takes a pool connection with it Fixed: The mail plugin's nodemailer range installs with npm Fixed: Readiness runs its database ping under voltro dev too Fixed: Mail and rate-limit store tables from before 0.83.0 migrate on upgrade Fixed: Two 0.83.0 upgrade notes stay silent for projects they do not reach Fixed: A workflow runner whose pool serves nothing gives its shards up

tag:voltro.dev,2026:release/0.83.0 2026-10-03T00:00:00Z

BREAKING: Aggregate materializations live in declared framework tables BREAKING: The analytics mirror's tables are declared, never created by the sink BREAKING: CMS review decisions follow a persisted sequence BREAKING: Update custom dashboard inspection adapters BREAKING: Mail's 'postgres' stores are tables of the app's own schema BREAKING: The rate limiter's shared store is a table of the app's schema BREAKING: The web process's ISR cache and replica tables are api framework tables Added: VOLTRO_INSPECT_TRUSTED_CLIENTS lends inspect access to named client networks Added: Read complete migration history entries on demand Added: Subscribers get ctx.outbox when the app declares an outbox handler Changed: A plugin's raw SqlClient is for declared tables, never for DDL Fixed: The MySQL / MariaDB binlog reader connects with the app's TLS Fixed: Cluster snapshots reflect current SQL dialect capabilities Fixed: Record failed cron seeds as failed scheduler runs Fixed: Dashboard shows the effective scheduler coordinator Fixed: Bind workflow recovery to its original gateway Fixed: Preserve data-editor drafts and recover linked-row lookups Fixed: Data explorer table inventory recovery Fixed: Keep database status labels readable in both themes Fixed: Distinguish database loading and errors from empty results Fixed: A deploy undo keeps half-precision vectors and generated columns Fixed: A deploy undo keeps a numeric primary key numeric Fixed: Preserve bigint precision in direct queries and typed joins Fixed: Keep embedded replica snapshots readable during primary outages Fixed: Compare columns explicitly and keep memory joins reactive Fixed: Full-text indexes no longer keep a plan from reaching zero operations Fixed: Exclude copied agent guides from development restart watching Fixed: Publish usable IPv6 Inspect replica addresses Fixed: Recover reads from a silent Inspect entry point Fixed: Embedded libSQL replicas start without an unsupported journal pragma Fixed: Release late libSQL transaction handles after cancellation Fixed: Preserve large integers in libSQL results Fixed: Enable journal Timeline capture for libSQL application hosts Fixed: Report migration failures without promising a whole-plan rollback Fixed: MySQL declares durable CDC cursor storage Fixed: The devtools overlay asks each inspect source once in a StrictMode app Fixed: A page's meta tag replaces the shell's of the same name Fixed: Published type declarations no longer carry the framework's type tests Fixed: Coordinate remote Turso workflow replicas through SQL row leases Fixed: Restore drills refuse unreadable migration ledgers Fixed: Retain isolated runtime workers and native platform bindings Fixed: Prepare schema-change seeds before development auto-migration Fixed: voltro serve boots after a deploy that ends with an after-schema migration Fixed: Exclude SQL Server system schemas from tenant seed targets Fixed: Honor explicit SQLite schedule coordination in production Fixed: voltro start serves the web manifest and common assets with their real type Fixed: Bound Timeline session operations and lease release Fixed: PostgreSQL Timeline recording no longer starves the connection pool Fixed: Timeline selection follows available recorded tables Fixed: Match the Timeline scrubber to the dashboard theme Fixed: Native Turso pools start reliably on a shared database file Fixed: Finish native Turso statements before interruption cleanup Fixed: voltro update lists the reads and rpc-failure renders earlier notes missed Fixed: Preserve workflow start identities across retries and replicas Internal: Keep dashboard acceptance checks executable after integration Internal: Re-pin measured server artifacts after dashboard integration Internal: Prepare exact SQLite decimal reads and comparisons Internal: Add scoped ownership for the internal libSQL worker Internal: Migration ledger checks share the race-safe source walker Internal: Guard libSQL file timeline snapshot concurrency Internal: Guard internal MySQL Timeline frames against physical table replacement Internal: Persist MySQL Timeline generation ownership through migration recovery Internal: Compose a guarded MySQL Timeline source snapshot Internal: Prove MySQL and MariaDB Timeline journal lifecycle Internal: Register MySQL Timeline observers behind a bounded writer barrier Internal: Prove MySQL and MariaDB Timeline observer retention Internal: Preserve MySQL Timeline pruning evidence and frame locks Internal: Prove MySQL and MariaDB Timeline snapshot frames Internal: Run workflow partition checks with the prepared test images

tag:voltro.dev,2026:release/0.82.0 2026-10-01T00:00:00Z

BREAKING: Aggregate extrema infer source-column results and counts return numbers BREAKING: `auth.anonymous` decides what an unauthenticated caller is; serve requires it BREAKING: Billing checks who may pay and where checkout returns; checkouts name a customer BREAKING: Billing owns the Stripe account, reconcile and production gate; adds cancel hook BREAKING: Billing cancels, resumes and reconciles at the provider; failed onEvent retries BREAKING: CMS documents have locale variants, with a read-time fallback BREAKING: CMS drafts keep every save as an immutable revision BREAKING: Experiments carry a hypothesis and an optional guardrail BREAKING: The CMS kernel is Effect-native, in one form BREAKING: CMS publishing records reference edges, and cms.usedBy answers from what is live BREAKING: CMS rich text is a structured document with typed images and links BREAKING: CMS content names its site, environment and locale on every write and read BREAKING: CMS publish, unpublish and archive run in the caller's transaction BREAKING: A declared `utf8mb4` reaches every table the framework creates BREAKING: Deferred media polls, retries and expired leases no longer wait for a write BREAKING: defineExecutor checks the failure channel against the procedure's error union BREAKING: `voltro db encrypt-column` reads the key the app runs with BREAKING: An encrypted workflow's step journal is encrypted — it was not since 0.71.0 BREAKING: Inference jobs retain their original enqueue timestamp BREAKING: Inspect proxies lend their tokens only to this machine or a signed-in session BREAKING: Restore only the exact snapshots recorded by a migration plan BREAKING: Snapshot restore acts on confirmed, uniquely owned snapshot sets BREAKING: Migration squashing previews the selection and requires its confirmation token BREAKING: A resource guard can answer "no such resource" with a typed NoSuchResource BREAKING: A failed subscription or loader read hands over the declared error itself BREAKING: `workflow({ encrypted })` seals every durable copy of a run's data BREAKING: Add durable workflow restart commands and read-only receipts BREAKING: Distinguish permanently withdrawn restart requests BREAKING: Use durable restart requests from workflow contexts Added: `voltro build api --target executable` — the api as one Node binary Added: Release artefacts go into the api's own storage Added: authRoutesPlugin({ admit }) decides who may join a tenant Added: authRoutesPlugin keeps users in the app's own database Added: voltro transfer: a signed bundle for a network with no route out Added: voltro update --channel Added: CMS: addresses outside a tree Added: A monthly AI budget per workspace Added: AI operations and per-workspace AI settings Added: Audiences: who a page variant is for, decided on the server Added: CMS assets can be blocked or expire, and nothing referencing them goes live Added: Blueprints bring a team Added: CMS project blueprints Added: CMS bulk operations with a dry run and a result per item Added: Bulk: set one field on many drafts Added: A CMS change feed a consumer can resume Added: CMS pages can be composed from typed components Added: CMS components that need consent are withheld until the reader grants it Added: ContentForm renderBlockAside — something inside each rich-text block Added: ContentForm renderFieldAside — something beside each field Added: ContentForm fieldLabel — fields labelled for people, not by their code names Added: ContentForm strings — the form's own controls in the editor's language Added: richDocumentFromContentful: import a Contentful rich-text document Added: Two editors type in the same field Added: Undo and redo in the editor, with named steps Added: Copy a site's content into an empty environment, and compare two Added: Experiments: two versions of a live page, readers split and counted Added: CMS: agent-tool exposure along the page tree Added: Field widgets name their fields Added: Extensions can list a type's drafts Added: Extensions can read a revision Added: Extensions: rollback, revoke and bound secrets Added: Extension settings from the manifest Added: Extensions: manifest, consent, upgrade, uninstall and a sandbox Added: fieldDiffs — how each changed field changed, as a word diff Added: fieldVersions lists the values one CMS field held across revisions Added: Content form: lists of values and per-field widgets Added: A glossary per workspace Added: CMS: gone addresses and removable redirects Added: CMS saves can pin the revision the editor saw, and restore an earlier one Added: richDocumentFromHtml imports HTML as a rich document and reports what won't fit Added: addRedirect keeps pre-import addresses; richDocumentFromHtml places images Added: CMS page-tree fields a page inherits from its ancestors, optionally locked Added: CMS content queries page by id with a cursor Added: Nested lists: a kind per depth; Contentful lists nest Added: CMS releases publish several pinned revisions together, on a schedule or now Added: Rich text: nested lists Added: CMS page templates with required components, a fixed first one and limits Added: CMS content types can form a page tree with routes resolved per locale Added: CMS preview links share a draft until they expire or are revoked Added: Promote chosen documents from one environment to another as one release Added: Repeating live windows Added: CMS: quality exceptions, duplicates, vocabularies, adopting a winner Added: A failed CMS release says what to fix and can be retried Added: A field can be left empty in a draft and still be required to publish Added: CMS content types can require an approved revision before publishing Added: Review left to the workspace Added: A published CMS page that moves keeps answering at its old address Added: A collaborative save carries the editor's own texts Added: schedulePublish with null cancels a CMS schedule Added: Scheduled take-down — scheduleUnpublish and unpublishDue Added: Content types can be searched through the database's own full-text index Added: CMS sitemap and language alternates from the published page trees Added: CMS documents get an owner, a review cycle and a content health report Added: Invite to a workspace's team by hand Added: CMS translations record their source revision; translationStatus flags outdated Added: Rich text underline Added: Count what a tenant holds, and refuse a create past a limit Added: Visual editing: the page beside the form Added: Rich text edited as it looks Added: XLIFF 2.1 translation exchange Added: Comments on a text passage Added: `voltro compliance generate` and the plugin `privacy` declaration Added: Full-text search by word beginnings — matching(…, { prefix: true }) Added: voltro db deploy runs before-schema files, the plan and after-schema files Added: `defineNotification` — one declaration rendered into every channel Added: `desktop-app` template and `voltro desktop` — a Tauri window around the web app Added: The desktop workflow signs Windows installers on Linux with jsign Added: The devtools overlay's Desktop panel Added: `@voltro/desktop/electron` — the Electron adapter on the shell core Added: The desktop Local Stack — the api as the window's sidecar Added: `@voltro/desktop` — the desktop shell contract, Tauri 2 adapter first Added: `<UpdatePrompt />` — the desktop app updates itself Added: Desktop windows get the shell adapter — platform script and boot report Added: The dev inspect proxy reads an api at the origin VOLTRO_API_ORIGIN_<NAME> names Added: `voltro doctor --pwa` — the installability preflight as findings Added: voltro e2e — e2e.readyTimeoutMs for apis that boot cold in more than a minute Added: errorMessage() gives the text of a failure value; web Sentry names it by its tag Added: On-device SQL for local-first on React Native Added: The field-encryption key can be rotated without losing data Added: `voltro desktop ci` and `voltro mobile ci` workflows accept a `runner` input Added: LAN dev pairing — `voltro mobile pair` and the `voltro-dev://pair` link Added: Libsql read transactions Added: licenseStatus() says where the installation stands with its license Added: The Local Stack sidecar takes an env — secrets travel as env, not files Added: Mail and billing declare where their data leaves the installation Added: Lettermint, broadcast mail and a webhook the mail plugin mounts Added: Record exact soft-drop snapshot identities in migration operations Added: The mobile workflow uploads store builds with `eas submit` Added: `voltro mobile ci` — OTA into the release feed, store builds on EAS Added: Native login for cookie-less clients through the system browser Added: Durable notification dispatch through the outbox Added: voltro plan close | impact Added: voltro plan lint | status | next Added: voltro plan evidence add Added: One platform contract for browser, PWA, React Native and desktop shells Added: Plugins declare where data leaves; voltro compliance generate writes egress.json Added: mailPlugin() hands out its service Added: `@voltro/plugin-releases` — the self-hosted update server for your apps Added: `apnsTransport` and `fcmTransport` — the credential-gated last hop Added: PWA Background Sync — the outbox drained by the worker with the tab closed Added: The devtools overlay's PWA panel Added: `voltro pwa twa|audit` — the Play wrapper manifest and a static audit Added: Any web app becomes installable with a `pwa` block Added: rbac role resolvers read the store the plugin is bound to at boot Added: Release retention — `keep` newest releases per channel, a TTL for the event log Added: `releases.registerApp` — an app target registered at runtime Added: REST routes and publicApi projections declare how a CDN may cache them Added: Rich push — `image` and `actions` from `render`, mapped by every push transport Added: `defineBackgroundSyncTask` — background sync bound to the OS Added: seo.sitemap: 'external' — robots.txt names a sitemap another app serves Added: A session can be presented on the `x-voltro-session` header Added: Sessions an app mints itself can be revoked Added: Storage image transforms crop around a focal point Added: ingestUrl takes an access policy, like put Added: StorageService.setVisibility — an object goes public or private after the fact Added: A transform that serves the original says why Added: storagePlugin uploadAccess and StorageService.signedUrl Added: `voltro deploy screenshots` and the store screenshot presets Added: Full-text search runs on turso (LIKE fallback) Added: Turso read transactions hold a snapshot without the write lock Added: The server names an undeclared failure tag and how to declare it Added: Loaders can answer 410 Gone Added: A web app can proxy a path to one of its bound apis by name Added: useHydrated Added: useWebMcpTool — a page offers an agent in the browser its actions (WebMCP) Added: listTargets names each target's filter Added: Keep accepted workflow starts visible before run recording Added: Observe workflow delivery failures before run recording Added: Inspect can observe durable queued workflow start receipts Added: Read persisted workflow delivery replies without replaying execution Added: WorkosProfile says whether WorkOS verified the email Added: WorkOS sign-in returns its session, workosLogoutUrl ends it Changed: CMS dialect-parity suite covers turso; the search table needs FTS Changed: CMS search finds word beginnings Changed: An encrypted workflow's error text is sealed and stays in the process Changed: The notifications inbox is live Changed: Stale sources block plan closure; passes record the tool version Changed: A port variable Kubernetes set is named as such Changed: `UpdatePrompt` installs a found update by itself Fixed: Clarify agent tool call limit scope Fixed: Aggregate interval replica coordination Fixed: Aggregate sql commit atomicity Fixed: Aggregate sql replica reads Fixed: Ai flow code inspect catalog Fixed: Ai flow definition source labels Fixed: Ai flow replica detail retention Fixed: Analytics replica call labels Fixed: Analytics sqlite timestamps Fixed: Api http overview telemetry Fixed: Migration squashing updates history atomically under the migration lock Fixed: The audit docs say what the interceptor records — mutations and actions Fixed: Sign-up no longer joins a tenant the request names Fixed: Automatic seed inspection targets Fixed: A `batch:` workflow accepts its payload in the field form Fixed: Billing routes answer only members and keep provider text off the wire Fixed: Hand-reported usage is flushed, and subscription invoices resolve their tenant Fixed: Billing inspector usage counter meaning Fixed: Metered Stripe usage reaches the invoice through the customer's meter events Fixed: Budget hold unique conflict key Fixed: Validate budget panel snapshots and allow read recovery Fixed: Budget suspension policy clarity Fixed: voltro check reads the app's scope vocabulary and leaves plugin routes alone Fixed: voltro data export records its run, as the admin endpoint's export does Fixed: The gRPC transport requires a patched @grpc/grpc-js Fixed: voltro cloud scan registers mobile and desktop apps Fixed: The CMS kernel installs and runs on mysql and mariadb too Fixed: ContentForm applies a widget's late change to the current form value Fixed: CMS Schema.Number refuses fractions at save; Schema.Fraction takes them Fixed: slugify keeps umlauts and accented letters Fixed: Content health and translation status read in batches Fixed: CMS unique fields no longer stop a postgres or SQLite boot Fixed: ContentForm renders custom widgets as components, so they may use hooks Fixed: Comment inspector detail metadata Fixed: plugin-comments no longer makes voltro check flag an app's own scopes Fixed: Comments inspector navigation state Fixed: A compressed response keeps the route's own Vary Fixed: Connected process inspection without fleet discovery Fixed: ContentForm labels are bound to their controls Fixed: CRDT increments fold at every stage — no reader keeps only the last one Fixed: useCrdtText setText takes the text the field showed Fixed: Dashboard cluster coordination counts Fixed: Dashboard cluster read states Fixed: Dashboard dev configured apps Fixed: Dashboard events read states Fixed: Dashboard fleet read states Fixed: Keep dashboard inspection readable after an entry replica fails Fixed: Dashboard logs read states Fixed: Dashboard migration action feedback Fixed: Dashboard migration comparison stale results Fixed: Dashboard migration comparison url Fixed: Dashboard numeric filter validation Fixed: Dashboard overview replay cursors Fixed: The dashboard registry endpoint no longer hands inspect tokens to the browser Fixed: Dashboard schema choice filters Fixed: Dashboard soft drop inventory Fixed: Dashboard timeline expired selection Fixed: Dashboard timeline read states Fixed: Dashboard timeline replay window Fixed: Dashboard trace deep link query Fixed: Dashboard traces read states Fixed: Retry, cancel and resume reach every local app — from the dashboard and the CLI Fixed: Data explorer search clear focus Fixed: Data filter list drafts Fixed: Data reference keyboard focus Fixed: Keep derived observations and restart fences in their source environment Fixed: A logical backup restores into a freshly deployed database Fixed: Data viewer page size links Fixed: sqlite: full-text indexes are created — trigger bodies are no longer split Fixed: voltro db branch leaves Timeline capture storage out of the branch Fixed: db files runs after-schema files only once the plan is empty; db migrate is loud Fixed: `voltro db plan` / `db apply` work for an app with no tables of its own Fixed: voltro deploy screenshots reads the app directory after valued flags Fixed: The desktop workflow notarizes from the App Store Connect key's content Fixed: voltro desktop says when a build step was killed rather than failing Fixed: voltro dev: a restarted dev server no longer outlives its terminal Fixed: The devtools overlay stops asking a refusing inspect surface and says why Fixed: voltro doctor in a web app checks voltro start's build, not api service edges Fixed: Environment inspection preserves diagnostic text Fixed: Environment unset state label Fixed: Keep invalid event observations out of live dashboard state Fixed: Keep event inspection readable across languages and narrow screens Fixed: The api executable serves from its bundle root, whatever its caller's cwd Fixed: Prepare file migration resources only when execution is allowed Fixed: Flags durable initialization after store binding Fixed: Validate flag observations and unconfirmed toggle replies Fixed: Flags toggle write scope Fixed: Migrations the 0.78.0 upgrade edited no longer warn on every boot Fixed: Reactive framework queues receive PostgreSQL change triggers Fixed: Governance incomplete erasure feedback Fixed: Hop-mode trusted proxies believe x-forwarded-proto Fixed: Inference queues expose complete counts and independent pages Fixed: Inference queue exposes loading and inactive states Fixed: Inspect access distinguishes server credentials from browser overrides Fixed: Inspect access always reports failed credential saves Fixed: Inspect namespace inventory Fixed: Inspect rpc input schema validation Fixed: Inspect seed namespace isolation Fixed: An interrupted `voltro` command no longer exits 0 Fixed: A loader's notFound() renders the nearest not-found.tsx inside its layouts Fixed: Local dashboard rollback availability Fixed: Unsent edits survive a reload Fixed: The Local Stack reads readiness from the sidecar's own "ready" line Fixed: Localized seed cards Fixed: Log cause and structured details Fixed: Log snapshot freshness Fixed: Log snapshot manual refresh Fixed: Recover safely from malformed dashboard log snapshots Fixed: `--json` keeps stdout for the document on every command Fixed: voltro-mcp reads the inspect observation envelope and lists app tools again Fixed: Confirm Meilisearch writes before reporting search repair success Fixed: Memory decimal extrema use exact numerical ordering Fixed: The in-memory store answers full-text searches instead of returning every row Fixed: Validate invocation and registry metrics before rendering Fixed: Metric tables support keyboard scrolling Fixed: Boot and db apply finalize interrupted migration runs, keeping their ids Fixed: Dev and serve hosts restore exact-plan snapshots through Inspect Fixed: Retain completed operations in resumed migration history Fixed: Transactional migration batches commit operation records with their DDL Fixed: Moderation retained review pagination Fixed: voltro data restore works on SQL Server, over an existing database Fixed: Preserve numeric parameters on SQL Server Fixed: `voltro serve` starts on SQL Server — its schema check read the ledger via LIMIT Fixed: A PostgreSQL native restore no longer fails on the tables the backup leaves out Fixed: Notification delivery endpoint details Fixed: Notification inbox selection survives reconnect Fixed: Offline seed schema codecs Fixed: An outbox handler's maxAttempts is applied Fixed: Outbox inspection response validation Fixed: Outbox resend replica admission Fixed: Changing a composite unique's columns no longer breaks a postgres migration Fixed: A full-text index exists on tables the migration planner creates Fixed: `@voltro/plugin-auth/native` ships the client's types Fixed: Plugin-registered errors reach mutations and actions typed on both boot paths Fixed: A plugin's `extendSchema.migrations` run on MySQL and MariaDB Fixed: Plugin panel state during read failures Fixed: Postgres historical date bindings Fixed: Capture PostgreSQL changes independently of notification delivery Fixed: Production data explorer readonly Fixed: Production inspect data live updates Fixed: SQL spans remain in production request traces Fixed: Bytes survive a live delta Fixed: The service worker answers the version question on the message port Fixed: Load queue consumers from compiled app modules Fixed: Distinguish queue loading and malformed observations from empty state Fixed: Keep queue tables readable and keyboard accessible Fixed: plugin-rbac and plugin-auth can be installed together Fixed: `--target <url>` names the remote api for release and desktop publish Fixed: Release actions from the dashboard carry a real trace id Fixed: The releases plugin seeds its targets once the store is bound, so an api boots Fixed: A defineRestRoute handler may return sse() or bytes() without a cast Fixed: Rollback rejects unapplied target Fixed: Route details page links Fixed: A plugin route's session cookie survives beside a second cookie Fixed: Route tree search Fixed: RPC inspector isolates loading, search and credential changes Fixed: Rpc invocation target isolation Fixed: create-project prompts take their defaults without a terminal, and say so Fixed: Schedule action target guidance Fixed: Compare external schedule observations without false overdue warnings Fixed: A schedule Effect may require plugin services — its runner provides them Fixed: Browse older schedule firings in the dashboard Fixed: Keep relative schedule firing times visible and current Fixed: Preserve recent schedule activity during history retention Fixed: Keep manual schedule feedback scoped to its selected replica Fixed: Persist SQLite schema ownership with driver-compatible timestamps Fixed: Prepare schema resources after locked plan validation Fixed: Seed inspection replica targets Fixed: An app that calls another boots from a pruned serve bundle Fixed: The serve bundle is `require()`-able — no top-level await in the inlined graph Fixed: Serve inspect rpc execution Fixed: voltro serve <app> serves the named app from any directory Fixed: Server route parameter matching Fixed: Shared database seed inspection Fixed: Shared inspect framework action routing Fixed: Short suspending wait timers Fixed: Sqlite bigint related row precision Fixed: Sqlite bigint row precision Fixed: Serialize SQLite migration jobs across local processes Fixed: Sqlite namespace index qualification Fixed: Sqlite numeric affinity introspection Fixed: Sqlite numeric primary key introspection Fixed: Capture external SQLite changes in dashboard time travel Fixed: Sqlite workflow journal ownership Fixed: Persist step migration receipts through the configured SQL store Fixed: StorageService.ingestUrl refuses internal addresses, the URL and every redirect Fixed: A stream's wire contract declares the access refusals its guards raise Fixed: Subscription delivery traces in production Fixed: Temporal filter sql bindings Fixed: makeTestContext binds its plugins to the test store, as boot does Fixed: ctx.webhooks records a defineEvent emit under its name Fixed: ctx.webhooks answers listTargets in unit tests Fixed: Invalidate timeline history after proven change-stream gaps Fixed: Timeline idle write activation gap Fixed: Ignore migration tombstones in Timeline capture Fixed: Timeline native turso boot Fixed: Distinguish SQL Server net changes from replayable row history Fixed: Preserve incomplete CDC image metadata in timeline recording Fixed: Two replicas booting on one PostgreSQL schema no longer deadlock Fixed: Bind timeline replay positions to their recorder history Fixed: Invalidate incomplete timeline history after recording failures Fixed: Reject timeline replay when required row images are missing Fixed: Timeline retained image retirement Fixed: Apply schema privacy to timeline capture and historical responses Fixed: Timeline shared boot route Fixed: Read timeline replay pages in one store transaction Fixed: Timeline trigger catalog formatting Fixed: Timeline visible source position Fixed: Trace views validate snapshots before rendering Fixed: Trace waterfall details and keyboard navigation Fixed: Durable traces skip bare storage roots Fixed: The generated TypeScript client type-checks in Node ESM projects (NodeNext) Fixed: Workflows on Turso keep running when two engine transactions collide Fixed: The undeclared-table note lists only tables the app does not declare Fixed: WATCH=0 turns off file watching for web apps too Fixed: Web dashboards report measured request windows Fixed: Improve webhook keyboard navigation and action feedback Fixed: Validate webhook observations before rendering management controls Fixed: Workflow admission reports unavailable reads Fixed: Preserve terminal outcomes for skipped bulk cancellations Fixed: Withdraw unreserved skipped bulk restart requests durably Fixed: Resolve skipped bulk retry requests without losing recovery evidence Fixed: Admission overview excludes original starts from the collapsed counter Fixed: Distinguish missing workflow metrics from zero Fixed: Preserve workflow definitions with explicit replica evidence Fixed: Event and replay dialogs keep keyboard focus and prevent duplicate sends Fixed: Workflow event replay retains every delivery outcome Fixed: Serialize competing retries of queued workflow intents Fixed: Preserve long workflow queue waits in admission records Fixed: Workflow message dialogs retain pending requests and unconfirmed signals Fixed: Reliable workflow signal confirmation and accessible message fields Fixed: Preserve workflow panel snapshots during read failures Fixed: Complete parent and child workflow navigation Fixed: Workflow snapshots distinguish unavailable reads from empty results Fixed: Workflow recovery remains accessible without a run snapshot Fixed: Keep workflow start available and explain unconsumed signals Fixed: Read retained restart receipts after their original run is removed Fixed: Workflow payload retry explains saved-request conflicts and uncertain responses Fixed: Read retained retry receipts after the original run is removed Fixed: Workflow run views show elapsed time across suspension Fixed: A workflow run that ends failed writes a log line, under `voltro serve` too Fixed: Use the shared checkbox for workflow run selection Fixed: `makeWorkflowRunner` runs an encrypted workflow without a key Fixed: Workflow start dialogs support keyboard navigation and safe dismissal Fixed: Workflow start forms use the connected gateway schema Fixed: Workflow statistics use consistent time-window boundaries Fixed: Workflow timelines include children that outlive their parent Fixed: Workflow timeline labels adapt to available plot width Fixed: Workflow timeline unrecorded endings Fixed: Preserve saved workflow views when browser storage cannot be read Internal: Add internal SQLite timeline capture migration primitives Internal: Typecheck shared migration fixtures in the Turso test suite Internal: Connect reserved workflow restart deliveries to recorded entry Internal: Bind internal restart dispatch to the workflow engine journal Internal: Persist internal restart withdrawal fences Internal: Keep SQLite workflow migration tests in the dialect package

tag:voltro.dev,2026:release/0.81.0 2026-09-25T00:00:00Z

BREAKING: The compose baseline gives each api app its own database BREAKING: A crashed process blocks its idempotency key for 30 seconds, not a day BREAKING: Each api app owns its database schema; a second app on it refuses to boot BREAKING: ReactionDefinition is the union of the table form and the query form BREAKING: Store calls on a table the app does not declare now fail Added: A plugin can bring app-shaped building blocks with `sources` Added: A reaction can watch the rows of a live query, including another app's Added: Apps of one project call each other through typed service procedures Added: startTestApps boots several apps of one project, each service edge wired Added: makeTestApp requests carry the caller's address Fixed: Codegen removes an rpc group the app no longer has procedures for Fixed: The auto-launched dashboard binds `VOLTRO_DASHBOARD_PORT` Fixed: The db pool boot line counts a connection outside the pool once Fixed: A declared `utf8mb4` store reaches the workflow engine's tables Fixed: The MySQL/MariaDB pool keeps its connections instead of reconnecting Fixed: Workflows started by a reaction or an incoming webhook start again Fixed: The first boot on an empty database no longer warns about replica observations Fixed: A 405 on a shared REST path names every method the path serves Fixed: A large REST surface no longer holds the boot for seconds registering routes Fixed: The testing guide's tsconfig example no longer sets baseUrl Fixed: voltro update lists a note's code and config lines before prose

tag:voltro.dev,2026:release/0.80.0 2026-09-24T00:00:00Z

BREAKING: The inspect stream's replica selection is decided before the response BREAKING: `JiraService.listBoards` finds boards by project, name and type BREAKING: A loader has `ctx.query` in the browser, so a clicked-to page keeps its title BREAKING: No framework loading spinner; useNavigation() exposes navigation state BREAKING: DB_MAX_CONNECTIONS is what the whole process holds, not the size of each pool Added: security.clientAddressHeader reads a proxy's single-address header Added: Rate-limit rules can key on the caller's address Changed: Server-side rpc calls carry the visitor's address Fixed: The boot's database connection line names the dialect in use Fixed: The dashboard's live streams share one browser connection Fixed: `meta` keeps the rendered language after hydration without a locale cookie Fixed: The first `voltro dev` on a fresh SQL Server database boots with CDC on Fixed: Replica observations of ended processes are deleted after a day Fixed: A live stream for an ended replica is refused instead of reconnecting forever Fixed: A controlled workflow start without an acknowledgement returns its receipt

tag:voltro.dev,2026:release/0.79.1 2026-09-24T00:00:00Z

Changed: A charset conversion blocked by a soft-drop snapshot names the reclaim Changed: The devtools capsule morphs into a status and back Changed: The devtools console animates out the way it came in Fixed: Probes are answered while a large app's modules load at boot Fixed: `voltro update` notes are not silenced by a comment naming the option Fixed: `voltro update` notes search the whole workspace, not only the app Fixed: Correction: a compose baseline from before 0.79.0 needs `voltro baseline sync` Fixed: `db apply` undo converts tables back and says exactly what still differs Fixed: The compose dev image starts pnpm 11 and later as the non-root user Fixed: The closed devtools capsule glows again Fixed: `db gc-snapshots` drops snapshots that reference each other, and works on MySQL Fixed: `voltro update` lists the lines a manual note is about Fixed: MariaDB: a charset, type or nullability change keeps the column's CHECK Fixed: `voltro serve` checks pending file migrations from its bundle, not from source Fixed: `voltro update --wait` says what the registry answered, per package

tag:voltro.dev,2026:release/0.79.0 2026-09-23T00:00:00Z

BREAKING: Probes answer on the app port from the first moment, on every command BREAKING: A rejected credential is refused on the default tenant policy too Added: A 1366 over a 4-byte character says which config field fixes it Added: The store's character set is declared once and every table follows it Added: The plan and the doctor name tables whose text cannot hold what json can Fixed: A handler's own `Unauthenticated` reaches the client typed, on any procedure Fixed: `voltro build` walks an api app's module closure once, not once per handler file Fixed: The file-migration `phase` rewrite reaches aliased, held and nested specs Fixed: A subscription refused in-band reaches the error bus and the refresh policy Fixed: `voltro support collect` no longer fails on a temporary directory under src/ Fixed: Tenant namespaces on MySQL / MariaDB provision without USE and take the charset Fixed: `voltro update` moves the `@voltro/*` pins in `pnpm-workspace.yaml` too Fixed: `voltro update --wait` waits up to 45 minutes, longer than a release holds

tag:voltro.dev,2026:release/0.78.0 2026-09-22T00:00:00Z

BREAKING: A file migration declares whether it runs before or after the schema apply Added: A migrate run names a skip the same run makes permanent Fixed: `latest` waits for the whole release, the dashboard included Fixed: A migration body guarding on `schema.tableExists` runs in a database-free test Fixed: A storage change no longer reads as `text → text` in a migration plan Fixed: TypeScript 7 removed thirteen tsconfig options, not the three we named Fixed: Workflow submission rows carry one identity shape again

tag:voltro.dev,2026:release/0.77.1 2026-09-22T00:00:00Z

Fixed: A built page no longer claims it was generated by `voltro dev`

tag:voltro.dev,2026:release/0.77.0 2026-09-22T00:00:00Z

BREAKING: Flow run rows record a cancellation request as `cancelling` until confirmed Added: An `@source` glob that matches no file is now reported Fixed: A failing admission placement no longer holds the drain at one tick per second Fixed: A file migration body runs under test without a database Fixed: `voltro data restore` accepts an empty target and names a takeable remedy Fixed: Rolling-deploy advisory skips tables the same plan creates Fixed: The precompiled serve bundle boots with a trace exporter on Fixed: A store failure carries the sentence that explains it Fixed: A boot missing `@effect/opentelemetry` refuses once and names its cause Fixed: TypeScript 7 upgrade note: typed ESLint alias pair and removed tsconfig options Internal: A release moves `latest` only once every tarball is downloadable

tag:voltro.dev,2026:release/0.76.0 2026-09-21T00:00:00Z

BREAKING: Align i18n peers and generated projects with current dependency majors BREAKING: Persist explicit workflow retry intents and return durable observations BREAKING: Flow cancellation preserves engine acknowledgements and completed results BREAKING: Signed private-file links bind to their storage mount BREAKING: Budget refusals stay typed and zero checks require headroom BREAKING: WebSocket gateways cancel pending setup and bound outbound writes BREAKING: Bulk workflow CLI commits require a saved preview plan Added: Explain workflow admission polling with live diagnostics Added: Compose durable admission bindings atomically Added: Storage upload input carries an optional operation identity Added: Dispatch binary Inspect uploads before text decoding Added: Add single-replica targeting for Inspect actions Added: Plugin inspection lists data-change, observability and surface hooks Added: Authenticated server-owned realtime voice and text sessions Added: Inspect upload tickets accept a durable operation identity Added: Streaming transcription with explicit raw-audio and partial-result contracts Added: Restore database read shapes in JSON date fixtures Added: Describe durable retry observations without conflating acceptance and completion Changed: Dashboard analytics activity measures real sink operations Changed: Dashboard uploads resume under a persisted operation identity Changed: Expectation observations carry the full declarative rule Changed: Plugin badges report activation, not live health Changed: Clarify terminal stream events versus the persisted done flag Changed: Distinguish stale workflow observations from dead runners Fixed: Agent tool panels hide stale snapshots and explain disabled surfaces Fixed: Handle aggregate dashboard refresh failures and duplicate submissions Fixed: Report manual aggregate refresh failures and skipped runs Fixed: Aggregate inspection and refresh reach serve through the shared router Fixed: AI flow inspection reads carry a process observation scope Fixed: AI run details stay closable while their request is pending Fixed: Analytics inspection behaves the same in development and serve Fixed: Await asynchronous schedule Inspect snapshots before serialization Fixed: Cache hit percentages follow the selected dashboard locale Fixed: Reverse-ETL health and dead-letter reads keep their replica identity Fixed: Reverse-ETL retries refresh sink health before another attempt Fixed: Comment threads offer read recovery without losing the search Fixed: Aggregate refresh indicators stay hidden during pending or failed reads Fixed: Analytics panels separate loading, failed reads and missing data Fixed: Small compute-budget amounts survive dashboard formatting Fixed: Experiment rates read as percentages and differences as percentage points Fixed: Inspect credential badges follow current access observations Fixed: The inspect credential form admits one save at a time Fixed: Plugin hooks count towards the cumulative invocation metrics Fixed: Route boundaries resolve in root-to-page inheritance order Fixed: The route inventory distinguishes loading, failure and an empty result Fixed: Missing invocation latency reads as unknown instead of zero Fixed: Keep streamed loader handoff scripts out of client recovery renders Fixed: Identify tasks in development claim-change logs Fixed: Actions get their own Devtools scope and pending calls stay first Fixed: Devtools panels keep consistent spacing in narrow docks Fixed: Trace inspection keeps selected records and exposes recorded span details Fixed: Doctor distinguishes query results from per-row reads Fixed: Environment inspection stops returning declared defaults and examples Fixed: The environment panel separates loading, errors and empty declarations Fixed: Expectations re-read current rows when a change omits a row image Fixed: Expectation null rates and freshness carry their units Fixed: Running experiments refresh from current rows on incomplete changes Fixed: Apply flag audit filters before the result limit Fixed: Reconcile unconfirmed flag toggles before allowing another change Fixed: Prevent duplicate flag toggles before the next dashboard render Fixed: Commit durable flag toggles and audit entries atomically Fixed: Preserve explicitly supplied gateway media dimensions Fixed: Custom consent-store reads accept explicit replica requests Fixed: Governance exports, erasures and sweeps run one at a time Fixed: Subject export and erasure bodies are validated before data access Fixed: Offloaded inference recovery retains paid tasks and pending signals Fixed: Retain a single replica target in dashboard download tickets Fixed: Any defined inspect error counts as a failed section read Fixed: Bind Inspect upload tickets to the issuing replica Fixed: Inspection headers hide stale timestamps while a read is pending Fixed: Migration rewrite guards retain full timestamp precision Fixed: Migration inspection plans against the active database dialect Fixed: Migration inspection and db drift share the planner live-table scope Fixed: Refuse known undersized migration pools before taking the lock Fixed: Moderation decisions reconcile against a fresh queue read Fixed: Malformed moderation decision bodies are rejected before lookup Fixed: Finite durable waits suspend inside activities Fixed: Notification, comment and billing panels declare process scopes Fixed: Queue search covers policies, activity and produced counts Fixed: Queue topics count under their literal names Fixed: Replica panels survive a temporary fleet inventory outage Fixed: Resumable uploads enforce size limits before buffering chunk bodies Fixed: Workflow retry intents are classified as environment-local Fixed: Keep schedule inspection usable when snapshots are malformed Fixed: Schema convergence reports unavailable without a live SQL connection Fixed: Serialize dashboard search maintenance actions and reload their status Fixed: Search maintenance requests are validated before any data access Fixed: Search index status and drift reads declare a process scope Fixed: Production logs delivered row changes at debug level, like development Fixed: Migration history reads use SQL Server pagination syntax Fixed: An uncertain storage upload can be checked without resending bytes Fixed: Preserve storage reads in replica selection Fixed: Preserve gateway charges when structured output is rejected Fixed: Honor both turn and SDK cancellation in tool calls Fixed: Recent traces prioritize application activity over routine housekeeping Fixed: Database spans retain their request context across runtime boundaries Fixed: Native bundle dependencies resolve through transitive driver packages Fixed: Expired credentials retain their typed RPC failure Fixed: Webhook tables and counts hide after a failed snapshot read Fixed: Invalid webhook commands differ from missing deliveries and failures Fixed: Webhook snapshots project explicit fields instead of database rows Fixed: Failed webhook reads surface instead of reporting empty activity Fixed: Undeclared webhook storage is distinct from a failed database read Fixed: Refuse webhook management actions for missing target IDs Fixed: Mint compatible webhook signing secrets for subscriptions and rotation Fixed: Preserve webhook subscription drafts during connection failures Fixed: Bind durable admission requests to their original payload Internal: Resolve standard library declarations through the JavaScript compiler Internal: Verify durable workflow retry recovery across process crashes

tag:voltro.dev,2026:release/0.75.0 2026-09-19T00:00:00Z

BREAKING: A storage object shared through an `operationId` is held by per-caller claims BREAKING: A workflow declares who may drive a run — `controls:` BREAKING: A usage receipt recorded twice with different values is a typed conflict BREAKING: Preserve workflow bulk cancellation receipts through the dashboard Added: A paid media step keeps its usage and its charge, even when it fails after Added: Inspect individual outcomes of stored schedule backfills Added: Generated media is stored with the owner, visibility and tags you give it Added: Read individual schedule firings by identity Added: Stream storage uploads through the local dashboard Added: `registerMediaTaskProvider` — media jobs through a provider with a task handle Added: `tx.savepoint()` works on every dialect and on the store a handler holds Added: Upload files from the shared storage inspector Fixed: A payload the client refuses to encode is printed with the field it names Fixed: VOLTRO_DESTRUCTIVE_OK no longer takes credit for drops it never covered Fixed: A table whose key is spelled `(id)` can be written by id again Fixed: `voltro doctor` no longer calls a retry loop an N+1 Fixed: A failed AI call says why — the driver code joins the message Fixed: Prepare a new backfill without submitting it Fixed: Preserve timestamp precision in the data editor Fixed: Keep record edits isolated from incoming live snapshots Fixed: A first production deploy no longer refuses over a table the apply created Fixed: The bulk-write rule sees the typed write helpers, which are now documented Fixed: A project with a file migration can be applied to an empty database Fixed: Two processes no longer run the same file migration Fixed: Delete inspected rows atomically against their selected snapshots Fixed: Reject stale data editor updates atomically Fixed: The migration pool refusal names the variable it actually reads Fixed: Offloaded calls carry their provider name to the dispatcher Fixed: Keep Radix primitives on the web dev server React instance Fixed: Storage object claims are not carried between environments Fixed: No production warning about anonymous tenants when one is configured Fixed: The junction-FK check no longer asks a dropped column for a reference Fixed: The pre-apply question no longer promises a rollback the dialect cannot do Fixed: `transactional()` no longer resolves over a transaction the database ended Fixed: An app whose workflows are all internal no longer reports a false mismatch Fixed: Bind dashboard bulk actions to previewed workflow runs Fixed: Report declined bulk workflow recovery actions accurately Fixed: Refuse false recovery success for an unchanged retry identity Fixed: Retain operator cancellation causes in control receipts Fixed: Workflow controls ask the same access question as the workflow read feeds Fixed: Show complete bulk workflow recovery failures Fixed: Resolve workflow retry through the original run owner Fixed: Keep workflow selection confirmation bound to reviewed runs

tag:voltro.dev,2026:release/0.74.0 2026-09-18T00:00:00Z

Added: An app can assert it still agrees with the framework Fixed: A file migration records the body that ran, so a later edit to it is visible Fixed: A new unique column arrives with its unique, and a part-applied schema says so Fixed: Change-trigger drift is measured against the name postgres stores Fixed: voltro db status reports both migration conventions Fixed: A migration's truncate tolerates a missing table and emits no per-row event Internal: A test's fixture probe cannot outlive its test

tag:voltro.dev,2026:release/0.73.0 2026-09-17T00:00:00Z

Added: Typed writes on the Effect channel — the row check and StoreError compose Fixed: A module that re-exports the generated route builder is not a hand-roll Fixed: The migration codemod no longer re-indents the body it rewrites Fixed: voltro serve refuses a serve bundle built by a different framework version Fixed: A workflow step can reach the store under the test runner Fixed: The AI usage receipt key no longer refuses to migrate an existing ledger

tag:voltro.dev,2026:release/0.72.0 2026-09-16T00:00:00Z

BREAKING: A failure report is written where the failure is decided, never by a callback BREAKING: A file migration is transactional by default; raw SQL is the escape hatch BREAKING: Flow resolvers see the owner and planner provider; media slots carry a type BREAKING: A rejected credential is refused; the anonymous tenant is the server's choice BREAKING: The devtools overlay is a searchable console that docks like a browser's Added: A deploy killed mid-way is undone by the next one Added: Device identity beside API keys — pairing, exchange, rotation, replay Added: A file migration gets the typed store, schema operations and data helpers Added: A media job is a durable step with its own identity; the queue is fenced Added: A plugin can offer capabilities to the framework — first, media persistence Added: A put that names its operation is resumable, and its delete is durable Added: A start handle can be read without waiting Added: Tenant selection is a Subject primitive, for any credential Added: A text or object generation takes an abort signal, and its tools see it Added: VOLTRO_WEB_PORT and VOLTRO_API_PORT override the port per app kind Added: A workflow run is a page, with a timeline that has a time axis Added: Send a declared event, start a run for a tenant, act on ticked runs Added: The console's Workflows scope follows the inspect stream instead of polling Added: The devtools console has a Workflows scope Added: The devtools console captures console warnings, errors and uncaught exceptions Added: Inspect describes each workflow; stats carry latency and per-step figures Added: The workflow sparkline follows the time preset, with a tooltip per bucket Added: Workflow stats take a window in minutes and buckets in seconds Added: The UserStore is nine roles; postgresUserStore maps identity onto your table Added: Pause at the workflow, send events, bulk over ticked runs, explain a run Added: The workflows page shows the declaration, attention, step figures, presets Changed: A connection credential may be a thunk; a throwing connection file refuses boot Changed: A deploy is all-or-nothing on every dialect Changed: A flow step says where its cost came from, and the run says how complete Changed: The lift advice names the one way it can change behaviour Changed: A pending flow run follows what its start became Changed: An AI usage row is a receipt, written once per request attempt Changed: readControl is wired in dev and serve; the 0.71.0 "pending" note is superseded Changed: The admission recovery warning names its reason and is written once Changed: The inference dispatcher finds media persistence among the plugins Changed: Zero-valued video parameters reach the gateway; aspectRatio accepts adaptive Fixed: A bounded, indexed text column keeps its declared width on SQL Server Fixed: A CHECK added to a framework-owned table is rolling-deploy safe Fixed: Corrected upgrade note for insert-ignore outcomes; diagnostic type exported Fixed: A decimal's precision and scale are read, compared and applied Fixed: A declared index on a reference column survives introspection on Turso Fixed: The field guards answer on every dialect — and two answers were wrong Fixed: Deploy-ledger and storage-operation rows stay out of a cross-environment bundle Fixed: A dropped column that holds a foreign key drops the constraint first Fixed: An invalid flow text parameter is refused by field name Fixed: A JS backfill receives the whole row, decoded through the column codecs Fixed: A migration says it needs two connections instead of timing out on a pool of one Fixed: A native enum column can be created at all Fixed: The loser of two concurrent AI budget releases gets already-released Fixed: A blocked column drop carries its foreign-key drop, so an unblock admits both Fixed: A signal or update whose row did not land is refused, not receipted Fixed: A soft-drop snapshot table no longer moves the schema fingerprint Fixed: A `source:` finding names the procedure that actually read the table Fixed: A spatial column's SRID and subtype are part of the schema Fixed: A table rebuild survives on Turso Cloud and embedded replicas Fixed: A workflow start runs under the execution id it was remembered under Fixed: A vector's dimension is a schema change, not a silent deadlock Fixed: A width change on a text primary key is planned, not silently dropped Fixed: A value added to a native enum reaches the database Fixed: An array's element type is part of the schema Fixed: A table with an array or raw column can be migrated at all Fixed: An expression index hashes the way it is planned Fixed: An external api `url` without a path reaches the api's WebSocket Fixed: An HNSW index converges when pgvector lives outside the public schema Fixed: The id column kind carries the storage it was inferred over Fixed: Switching an index to an expression index is planned, not a deadlock Fixed: An operator workflow start carries the system subject Fixed: Cancelling a flow run closes the row and the execution together Fixed: `voltro dev` boots an app that has a wire-reachable workflow Fixed: Every wire rpc carries the plugin error union, on both boot paths Fixed: Image generation survives gateway metadata without images, and takes maxRetries Fixed: `@effect/experimental` is declared where `@effect/sql` needs it as a peer Fixed: The in-memory store compares a Date against its ISO text by instant Fixed: voltro migrate / db apply create the vector and postgis extensions Fixed: The flow cadence tick skips start reconciliation inside a transaction Fixed: The change-trigger drift report names the schema, channel and count it compared Fixed: The workflow built-ins declare their access and answer for the caller Fixed: Every table the workflow drainer reads is created by the migrator Fixed: `useWebhooks` names the two file conventions that wire the service Internal: A composite key separator is written as an escape, not a raw control byte

tag:voltro.dev,2026:release/0.71.1 2026-09-14T00:00:00Z

Added: The doctor flags a declared error thrown where the channel discards it Added: `storageInstanceName()` — the value an upload ticket has to carry Fixed: The doctor recognises a call that carries explicit type arguments Fixed: A replaced connection setup reports superseded instead of inactive Fixed: A form rule reads the handler, not the combinator's plumbing Fixed: A text column declared as the sole primary key no longer blocks every migration Fixed: The built-in `actors` columns carry their own exposure class Fixed: `store-effect-lift` is silent where the failure channel is pinned

tag:voltro.dev,2026:release/0.71.0 2026-09-14T00:00:00Z

BREAKING: Provider grounding survives every step of an agent's tool loop BREAKING: `AppContext.transaction(work)` bounds store writes and start intents BREAKING: Commit workflow intent discard with its audit and caller outcome BREAKING: Event publication awaits its durable audience before fan-out BREAKING: AI budget reservations bind to tenant, amount and window BREAKING: URL ingestion checks the byte limit before it buffers the response BREAKING: A cadence request ID carries tenant identity BREAKING: Flow media inputs resolve uploads and earlier outputs by artifact BREAKING: A human review answers the workflow's computed execution ID BREAKING: Flow launch and retry return a `FlowStartReceipt` BREAKING: Deterministic flow steps honour `maxTokens`, `temperature` and options BREAKING: A policy guard may select its permission from validated input BREAKING: Workflow Inspect cancel and resume return an observable control receipt BREAKING: A JSON column write encodes a string as a value, not as SQL input BREAKING: Image and video generation carry references, masks and cancellation BREAKING: `insertIgnoreWithOutcome` reports the native insert decision BREAKING: An outbox handler's Effect runs with app and plugin services BREAKING: Durable events go to the store the request already selected BREAKING: External schedule triggers move endpoint, credential and response shape BREAKING: A structured decode failure keeps its model, usage and cost BREAKING: `generateText` takes a `messages` history and returns `sources` BREAKING: A mutation's workflow start is an intent in the business transaction BREAKING: An execution ID keeps its first caller identity and parent binding BREAKING: `readControl(...)` observes a receipt without submitting another BREAKING: Cancel and resume return a control result, not a manufactured snapshot BREAKING: Replace deferred-result rejection with workflow receipt observation BREAKING: A direct start persists its submission before dispatch BREAKING: An executing body interrupts its own fiber on a control request BREAKING: Journal replay resolves every activity before it resets a reply BREAKING: `closeWorkflowChildrenForParent` gives way to a resident intent BREAKING: `parentGeneration` survives queueing, storage and both boot paths BREAKING: A queued submission binds its engine identity before dispatch BREAKING: Separate queued workflow cancellation from execution controls BREAKING: Expose queued workflow cancellation over RPC BREAKING: Wait follows a queued receipt to confirmed engine execution BREAKING: A replaced debounce payload settles its receipts as superseded BREAKING: An interruption is cancelled only once the body returns BREAKING: Execution recording commits the entry generation before app code BREAKING: A proven pre-engine rejection queues its report atomically BREAKING: A removed queue declaration abandons its receipts with a report BREAKING: Cancel and resume return `WorkflowControlResult`, not a boolean BREAKING: A queued handle's `id` is a durable caller receipt BREAKING: A queued start-timeout preserves its payload and receipts BREAKING: A suspended generation settles cancellation before replacement BREAKING: Terminal run events commit with the generation-owned transition BREAKING: Report observed workflow completion on waited handles Added: The trigger endpoint answers immediately and the run is polled to completion Added: A dependency-free runtime for a generated TypeScript client Added: `publicApi.resource` derives a projection's method and path Added: An external schedule nobody triggered is recorded as missed Added: A template for a public API and the client a partner programs against Added: `voltro build api --target typescript` generates a publishable client Added: `voltro check --public-api` names what a change breaks for a consumer Added: API-client collections for Postman, Bruno, Insomnia and Hoppscotch Added: voltro schedule-manifest --check, and a trigger verb for humans Added: Inspect AI run details on demand Added: Authorize native dashboard file downloads Added: Retry dead reverse-ETL deliveries from the dashboard Added: Search and page the complete comment thread inventory Added: Inspect comment thread contents on demand Added: Expose the shared dashboard confirmation panel Added: Share pending-safe confirmation dialogs across dashboards Added: Inspect one replica or combine selected replicas Added: Search and inspect RPC schemas in both dashboards Added: Execute RPC procedures with explicit context Added: Search and page the full storage reference inventory Added: Embeddings accept native `providerOptions` and validate dimensions Added: Flow agents accept resolved `tools` and `maxSteps` Added: Stream binary plugin inspect responses Added: The namespace directory is readable over inspect Added: `readMaybeOne(store, query)` for boot and query-only stores Added: An admission stores the pool, key and limit it resolved Added: Accept and inspect stored schedule backfill requests Added: Store and execute scheduler backfill requests Added: The queue backlog of a schedule is measurable Added: `useSchemaFormBinding` shares the form engine without an API tag Added: Download stored files from dashboard inspectors Added: Expose storage object deletion through inspect Added: Authorize inspected storage uploads through signed tickets Added: Preserve native storage streams for downloads Added: `acquireSubmissionCapacity` runs between resident commit and engine Added: Refresh one active subscription query with useRefreshSubscription Added: `voltro doctor` fails a `publicApi.example` that cannot decode Added: The framework's own periodic tasks can be externalised, or say why not Added: The OpenAPI document carries servers, contact and an example per body Added: `voltro update --wait` installs once the registry serves every package Added: Share the browser-safe terminal admission outcome schema Added: Confirmed cancellation and capacity release settle atomically Added: Workflow control options carry an optional cause Added: A resident control request persists its cause with acceptance Added: The resident `_voltro_workflow_control_requests` table Added: `reserveAdmissionSubmission` and the resident submission table Added: Bind resume dispatch to the workflow engine journal Added: A failure report links to one durable arrival-queue receipt Added: Resident immutable failure-report storage with transactional replay Added: Generation-bound control results commit with body completion Added: Inspect resident workflow queue samples across physical placements Added: Bind queue inspection and intent actions to an explicit physical placement Added: `executePreparedWorkflow` submits an already-chosen execution ID Added: `executePreparedWorkflow` can await the typed body result Added: Describe queued cancellation evidence without fabricated executions Added: A facade host may own cancellation and resume acceptance Added: A resume is confirmed at clean suspended body entry Added: `runnerGeneration` storage and transaction-only entry primitives Added: The dispatcher can start a prepared execution through the facade Added: `resolveWorkflowStartReceipt` for resident admission adapters Added: A submission binds a prepared engine identity before dispatch Changed: A six-field cron on an external trigger is refused where it is written Changed: Schedule manifests are Helm-shaped and admissible in a restricted namespace Changed: A queued firing starts on the event, not on the next poll Changed: The changelog is published, filterable, and readable by a machine Fixed: A generated collection fails when the server answers 500 Fixed: A link to a file under `public/` reaches the file, not the router Fixed: A `Record` of dates speaks the REST profile like every other field Fixed: A rejected credential answers 401, `openAccess` included Fixed: An external firing is identified by the cron expression, not the caller's clock Fixed: An external trigger cannot claim an occurrence before it is due Fixed: An explicit primary key no longer collides with the id() key on apply Fixed: Approval endpoints bind only where a descriptor declares them Fixed: Compose baselines render the project's own pnpm version Fixed: Dev discovers connection files before the registry, and says what booted Fixed: `cancelOn` keeps the planner's event id through cancellation Fixed: A failed `cancelOn` delivery keeps its event window Fixed: `cancelOn` retries reuse one control request identity Fixed: A column rename keeps the shape change that rides with it Fixed: Prevent duplicate dashboard action submissions Fixed: Distinguish unavailable cache metrics from zero traffic Fixed: Keep all declared column types visible in the data explorer Fixed: Confirm database actions and show mutation results Fixed: Require database status before operator actions Fixed: Load replica comparisons on demand Fixed: Preserve exact decimal values in the data explorer Fixed: Correct notification inspection and recipient switching Fixed: Validate integer and vector edits before writing Fixed: Separate queue consumer policies from topic counters Fixed: Preserve unreachable replica diagnostics in the inspector Fixed: Keep RPC execution within the visible selection Fixed: Download files from aliased storage instances Fixed: Keep storage grants authoritative after operator actions Fixed: Stream local dashboard inspect responses Fixed: Carry vector dimensions into the data explorer Fixed: Reliable webhook management feedback Fixed: Show workflow operation errors on the affected run Fixed: Keep replica selection across workflow drill-downs Fixed: `db plan --against` refuses an incomplete remote observation Fixed: Every controlled direct workflow arrival leaves a receipt Fixed: Doctor tells a real N+1 from a nullable, a memo or a singleton Fixed: Tenant-to-namespace ownership is persisted before any DDL Fixed: A flow's agent resolver receives the durable run, not the caller Fixed: Cadence counts only running receipts as a fresh start Fixed: One cadence candidate commits its row, intent and receipt together Fixed: A cadence admission handle is kept in the run's `workflowStart` Fixed: `launchFlow` commits through `ctx.transaction` outside a mutation too Fixed: `retryFlow` validates, queues and records in one transaction Fixed: A flow refuses a missing workflow runtime before writing run state Fixed: `gatewayCostUsd` accepts only an explicit finite, non-negative charge Fixed: An explicit seed of 0 survives gateway serialization Fixed: Migration snapshots retain HNSW operator classes and build parameters Fixed: `generateVideo` bounds a decoded inline video before it allocates Fixed: Structured output is validated against its JSON Schema, not just parsed Fixed: Compare decimal values exactly in memory queries Fixed: A memory transaction validates its snapshot revisions before commit Fixed: A failed rollback no longer replaces the DDL error that caused it Fixed: A JSON-validation check is no longer read as an enum Fixed: SQL Server JSON columns accept scalars, and outdated checks reconcile Fixed: A SQL Server column rename preserves its dependent CHECK constraints Fixed: A MERGE upsert's recorder runs on the write's own connection Fixed: SQL Server change images and patch results decode exactly once Fixed: Mutation dispatch picks the tenant's store before the transaction opens Fixed: MySQL native JSON is not parsed a second time Fixed: A `LIKE` check is no longer read as an enum membership Fixed: PostgreSQL `vector` columns accept number arrays on every write path Fixed: Prometheus says at boot whether its endpoint is locked or open Fixed: A queued blocking call cannot execute past admission Fixed: Remove replica observations during graceful shutdown Fixed: `/me` does not match `/me/` or `/ME`, and the docs now say so Fixed: REST projections decode a body by Content-Type, and refuse it redacted Fixed: A resumable producer persists a sanitized terminal error Fixed: An adopted firing keeps the trigger and outcome its own row recorded Fixed: Boot backfill no longer misses a gap on a fleet with many schedules Fixed: A fleet booting together records each missed slot once Fixed: Show schedule firing history when filtering by name Fixed: Acknowledge dashboard schedule starts before handler completion Fixed: Adopting a stranded queued firing is bounded by the schedule's own cadence Fixed: A queued firing survives the replica that was holding it Fixed: `onOverlap: 'queue'` serializes across replicas, not just in one process Fixed: A queued firing of a deleted schedule is cleared at boot Fixed: Retention no longer deletes a firing's place in the queue Fixed: Narrowing a subject keeps the application audit actor Fixed: The API serve bundle no longer carries the WOFF2 font codec Fixed: Every scheduling knob reaches the production server Fixed: SQLite write results decode through the registered column schema Fixed: `WebBuildOptions` is exported for a typed build block Fixed: `voltro codegen <web-app>` writes route builders without a dev boot Fixed: Aggregate the complete storage reference inventory Fixed: Validate storage inspector grant actions Fixed: Give named storage instances distinct HTTP mounts Fixed: An orphan sweep deletes only on a confirmed absence Fixed: Bind storage upload tickets to their issuing instance Fixed: A stored cadence carries its row tenant into the transaction Fixed: The tenant namespace directory no longer drifts on every boot Fixed: A tenant-scoped subject gains no admin authority Fixed: A terminal run refuses body re-entry Fixed: A generated client refuses a directory it did not write Fixed: Dev and start share one HTTP rewrite arithmetic Fixed: External schedule triggers get an endpoint that exists, and their own token Fixed: Tool cancellation interrupts the running Effect body Fixed: A tenantless system context selects no default database Fixed: Workflow admission revisits healthy queues when discovery stalls Fixed: A delayed admitted start transfers its input in one transaction Fixed: A failed batch drain postpones the whole selection, not the first input Fixed: Observe accepted queue executions for blocking runtime starts Fixed: A control host accepts a caller-owned `requestId` for retries Fixed: Cancellation reports true only for a confirmed observation Fixed: A confirmed cancellation stays confirmed after the body finishes Fixed: A clean suspended body is cancelled under its generation lock Fixed: An executing body validates a control request before interrupting Fixed: A control receipt keeps the tenant its run generation proved Fixed: Control receipts are readable through `useWorkflow().readControl()` Fixed: Control settlement writes a `control-settled` run event Fixed: Control results and snapshots share browser-safe protocol schemas Fixed: A delayed start persists its submission before engine I/O Fixed: A deferred arrival forwards its caller receipts atomically Fixed: A dropped `onFailure` start is not acknowledged as accepted Fixed: A rejected failure delivery does not notify its own `onFailure` Fixed: Route host workflow controls through resident receipts Fixed: Route inspect workflow messages through the resident facade Fixed: Inspect resume reports `resumed` only for a confirmed result Fixed: The staleness diagnostic no longer deletes on age alone Fixed: Resolve physical workflow ownership before operator row access Fixed: Operator suspend refuses instead of faking a suspended run Fixed: A terminal generation persists its parent-close intent Fixed: A vanished child row is a failed decision, not a cancellation Fixed: Parent close visits every child page, not the first thousand Fixed: Parent-closure intents recover through the admission drain Fixed: Parent-close staging commits child receipts with its cursor Fixed: Parent closure waits for an accepted child control to settle Fixed: A child run retains `parentGeneration` beside its parent ID Fixed: Route workflow admission and recovery to resident stores Fixed: A queued start keeps caller identity, tenant, trace and parent Fixed: A replay's own outcome survives `redrive` and `resume-from-step` Fixed: A class-based recording store keeps its method receiver Fixed: Recover accepted controls across resident workflow stores Fixed: Resident workflows validate their cluster delivery identity on entry Fixed: Keep workflow finish scans resident and exhaustive Fixed: Workflow history Inspect reads honour the run's declared placement Fixed: Visit resident workflow journals and record stalls in their owning store Fixed: Bind queued cancellation to its resident request Fixed: Read queued workflow receipts in their resident placement Fixed: Reconcile lost workflow start acknowledgements from resident execution evidence Fixed: Return the engine execution identity from workflow retry Fixed: Cancel and resume hooks accept a caller-owned control intent Fixed: Run recording encodes the declared input before entry Fixed: Concurrency keys are JSON tuples, which PostgreSQL accepts Fixed: Suspension checks the current runner generation Fixed: Body completion releases a reservation despite a lost ack Fixed: An unrecorded control submission stays unknown Fixed: A version rejection commits failure, arrival and release together Fixed: A generated package directory does not restart the dev boot Internal: The primary-key width guard recognises fixed-width admission UUIDs Internal: Six cadence admission regressions pinned against the real store Internal: Tenant cadence rollback and intent ownership under real residency Internal: The cadence tenant-placement failure, characterised end to end Internal: A flow launch and its admission roll back together Internal: Durable, replay-safe global pool permits on a shared coordinator Internal: Resolve library output checks against the actual build root Internal: Bounded namespace discovery on the shared residency binding Internal: Terminal-entry fencing and operator redrive, characterised end to end Internal: Internal storage object-lifecycle and quota persistence substrate Internal: The doctor's exit expression keeps its flag order Internal: Cancel and resume outcomes pinned against the real engine Internal: Capture a cluster workflow delivery's request identity at the boundary Internal: A request-ID-only reset can remove a newer terminal reply Internal: Persist workflow execution routing separately from resident caller context Internal: A transaction boundary for resetting an exact set of journal replies Internal: Start context, failure report and queue handoff under retry Internal: Verify workflow start acknowledgement recovery through engine and recorder Internal: Locate queued receipts across registered workflow placements Internal: Admission-pool ownership checked against real memory stores Internal: Preserve queued cancellation outcomes at the resident transaction boundary Internal: Persist queued cancellation targets atomically with queue decisions Internal: Pin recovery fairness and shutdown completion Internal: Enumerate workflow recovery placements in bounded pages Internal: The shared resident workflow control host Internal: Resident workflow release recovers across hard process death Internal: Isolate restart admission from original workflow start acknowledgement Internal: Compose resident resume binding with exact journal dispatch Internal: An execution-only resume can wake a later suspension Internal: Verify resident resume through the running host Internal: Persist original suspension observations on resident controls Internal: Verify resident resume recovery after process death Internal: Workflow start recovery across process death at submission Internal: Verify suspension reply fencing with a real cluster runner Internal: Read exact workflow suspension observations from the journal Internal: Add an ownership-checked suspension reset boundary

tag:voltro.dev,2026:release/0.70.0 2026-09-11T00:00:00Z

BREAKING: The DevTools dashboard has a lock of its own: `VOLTRO_DASHBOARD_TOKEN`. A deployed dashboard that holds other apps' inspect tokens in `VOLTRO_DASHBOARD_APPS` re Added: The `publicApi` surface speaks a REST profile, chosen once in the api's `app.config.ts` (`publicApi: { profile }`) and overridable per descriptor (`publicApi.fo Added: `makeTestContext({ fieldEncryptionKey })` registers the field cipher for `.encrypted()` columns under test. Setting `VOLTRO_FIELD_ENCRYPTION_KEY` — in `process. Added: `insertIgnoreWithOutcome` on the framework store (and on `yield* EffectStore` plus the `tx` view), with the typed helper `insertIgnoreRowOutcome`: `{ row, outco Added: `defineMutation({ serialize: { key, maxPending? } })` — calls of one mutation to the SAME resource run in invocation order on the client, for every caller of th Added: API `fonts:` declarations now package validated native-readable fonts and relocatable Fontconfig artifacts during build. Dev, serve and direct production entrie Added: Every mounted API version has an OpenAPI document of its own — `/openapi/v2.json` beside `/openapi.json`, or `?version=v2` — the same spec filtered to that vers Added: `onProcedureSurface` — a plugin hook told the app's wire-reachable rpc procedures (every query, mutation, action and stream discovery found, minus `internal`) o Added: A `publicApi` projection documents itself completely: `tags` from the rpc tag's prefix (`teams.list` → `teams`; `publicApi.tags` overrides) with a top-level `ta Fixed: A `publicApi.path` segment that names no input field refuses the boot, naming the descriptor and the segment (`descriptor 'bookings.get' — path '/v1/bookings/:u Fixed: A plugin route answers the path it declared, byte for byte: the dispatcher refuses a request whose path is not the route's own — case-folded twins and a bare tr Fixed: A run that ended outside the engine no longer leaves its unanswered requests in the cluster journal. Cancelling a run (`timeouts.finish`, `cancelOn`, the operat Fixed: `voltro db encrypt-column <table>.<column> .` accepts the app directory every other `db` command takes as its last argument — accepted and not needed, the conne Fixed: Every API key has its `actors` row after the first boot on this version. Both boot paths plant, after the schema is applied, one row per `_voltro_api_keys.id` t Fixed: Idempotent WebSocket mutations acquire and finalize their claims safely across request interruption. A closed socket cannot orphan a claim acquired by a still p Fixed: Docker deployments retain optional native platform bindings until runtime tracing, and the pruner traces both conditional import and require entries so relocate Fixed: `own` on a shard-lock holder in the stall report and the `workflow.cluster` warning is now the engine's own account (`Sharding.hasShardId`), and a holder that i Fixed: Production HTTP proxies release upstream resources when the browser abandons an unfinished response, including SSE, and propagate truncated upstream responses a Fixed: `publicApi.rateLimit` on a descriptor is that endpoint's own rule for calls through the `/v1` projection — ahead of the plugin's `rules` and `default`, one buck Fixed: The retention sweep arms its policies on the `_voltro_workflow_*` tables only where the workflow engine that creates those tables is composed. An api with no `* Fixed: SMTP replies are classified by SMTP rules instead of HTTP rules: 4xx replies remain retryable, permanent 5xx rejections do not trigger automatic retries (RFC 53 Fixed: The workflow engine's boot check for its cluster tables asks whether a table exists with a query that succeeds either way (`to_regclass` on postgres, `informati Fixed: `voltro dev` acquires the workflow runtime as a boot step, as `voltro serve` always has — `workflow runtime ready — N entity type(s) registered` on both paths, Fixed: `voltro baseline sync` writes its `docker/Caddyfile` with tabs, the way `caddy fmt` writes it. Caddy warned on every proxy start that the file "is not formatted Fixed: `redisStore({ url })` binds its client on the first `consume` when nobody activated it — from `url` or the env it reads at activation — so a limit holds in the Fixed: A `src/pages/[locale]/…` route renders in the locale it matched, on both web boot paths: `voltro start` and `voltro dev` hand the matched `[locale]` parameter t Fixed: A rate-limited call on the `/v1` projection answers `429` with `Retry-After` and the `RateLimit-Limit` / `RateLimit-Remaining` / `RateLimit-Reset` headers, the

tag:voltro.dev,2026:release/0.69.1 2026-09-11T00:00:00Z

Added: `voltro dev` and `voltro build` refuse a published artefact. A publish step writes `.framework/dist/.voltro-artifact.json` into a package that ships its build a Added: `voltro db plan` names the tables on which the live and the declared fingerprint part — in the JSON record, and on a TTY for an empty plan. Added: The client diagnostics snapshot carries `runtime` — per api, what the runtime resolved to (`scheduler`, `generation`) — outside the event ring. Added: `openapiPlugin` documents the app's own REST surface as the framework mounts it — every `restRoutes` descriptor and every `publicApi` projection — without the a Added: A `run-stalled` report on the durable engine carries the engine's view of the run — its journal messages, whether each was processed and last read, and who hold Added: `EffectStoreOps.upsertWithOutcome` — the Effect form of `upsertRowOutcome`, on `yield* EffectStore` and on the `tx` view `transactional` hands out. Changed: `voltro test` exits 1 when it executed no test, on every invocation — a bare `voltro test` included. Changed: `ApiKeyStore.ensureActor` receives the `issue()` input, and the built-in `apiKeys:` wiring takes an `ensureActor` of your own. Changed: A `GET` projection coerces the query string toward the descriptor's input before decoding: `?limit=5` reaches a `Schema.Number` as `5`, `?archived=true` a `Sche Changed: `voltro dashboard` has no dev fallback any more. A dashboard tree without a build used to be served by `voltro dev` — right for the monorepo source layout, and Changed: A declared snapshot and the live snapshot of a database the planner has converged on hash the SAME — the fingerprint canonicalises by the planner's own equivale Changed: A production `voltro start` no longer reads `src/`. `voltro build` writes the route tree beside the SSR bundle (`dist/server/pagesTree.json`, the same walk the Changed: `voltro start` drains on SIGTERM the way `voltro serve` does: readiness flips to `503`, the long-lived inspect streams are ended (their client reconnects), the Fixed: `voltro agents-md` finds the project's `@voltro/cli` under the app it was run from, not only at the workspace root. Fixed: `voltro update` prints the backfill for API keys issued before 0.69.0 to the apps that have them. Fixed: `onFailure` fires for a run whose body failed — the route the documentation listed first and the one that was not wired. Fixed: A `publicApi` projection — and every hand-written `restRoutes` entry — now runs under the app's row filter. Both boot paths built the REST request's context fro Fixed: `timeouts.finish` cancels at the deadline plus at most one drain tick — not at whatever start next happened to wake an idle drainer. Fixed: The `helm` baseline (`voltro baseline set helm`) probed `/healthz` on the api and `/` on the web — the first answers 404 on every Voltro boot path, so an api po Fixed: `/_voltro/inspect/stream` under `voltro serve` no longer refuses a non-loopback `Host`. The DNS-rebinding host guard is a `voltro dev` measure — the dev api bin Fixed: `voltro dev` stops, with exit code `3`, when the project's installed `@voltro/cli` is no longer the one it is running — instead of restarting on the old one and Fixed: `voltro update` puts every `package.json` it bumped back, byte for byte, when the install fails without ever fetching the target version. Fixed: `voltro logs` and the dev log buffer keep the error a record was written with. `log.error(message, fields, err)` under `voltro serve` printed `cause` on stdout;

tag:voltro.dev,2026:release/0.69.0 2026-09-10T00:00:00Z

BREAKING: A typed store error now reaches the caller as itself instead of being re-wrapped as `StoreOperationFailed`. BREAKING: Issuing an API key now plants its `actors` row, and `ApiKeyStore` gained a required `ensureActor`. BREAKING: `ai`, `@ai-sdk/provider`, `@ai-sdk/gateway` and `stripe` are peer dependencies now — and `@voltro/plugin-comments` stops shipping its own `effect`. BREAKING: The self-service upload routes refuse a caller with no identity, unless the app declares `storagePlugin({ anonymousUploads: true })`. BREAKING: `releaseMigrationLock` is gone; `acquireMigrationLock` returns the release. BREAKING: `workflowToRpc` preserves the literal workflow name and the payload schema, so a workflow no longer widens the generated client. Added: `upsertRowOutcome(store, table, row, options)` — the upsert, plus whether it INSERTED or UPDATED. Added: `VOLTRO_DASHBOARD=on` — the counterpart `off` never had. Added: Show automatic data synchronization as a connection status, highlight changed cells and new visible rows, and briefly retain confirmed deleted rows in red. Quer Added: Cloud and local Devtools now share `SignalWorkspace`, `SignalWorkspaceHeader` and `AppInspectorHeader`: one masthead, background, heading rhythm and app identit Added: `insertManyRows(store, table, rows)` — `insertRow`'s batch, typed on the element. Fixed: An auth strategy that declares a `claimsBearerPrefix` is now asked BEFORE strategies that declare none, for a token carrying that prefix. Fixed: `voltro build` fails when the SSR bundle it just wrote cannot be imported — and `build: { ssrExternal: [...] }` is the exit that `ssr.noExternal: true` did not Fixed: Keep the dashboard masthead, tabs and inspector context compact so working tables start higher in the viewport. Group the app return link, identity, address and Fixed: Use the shared styled Checkbox for dashboard filters, workflow confirmations, inspect access and schema-driven checkbox forms, matching Cloud configuration cont Fixed: The auto-launched dashboard died 85 ms after it was announced, silently. Fixed: The recommended dashboard install line contradicted the stability contract. Fixed: An interrupted dashboard build made the launcher choose the one mode that cannot run in it — and then said nothing when the child died. Fixed: Rework the shared data explorer around compact resizable columns, debounced search, explicit filter application, accessible record editing and searchable refere Fixed: Resize the data explorer's table list independently, read complete table names in delayed themed tooltips, and resize columns with visible pointer/keyboard hand Fixed: Resolve local dashboard stream credentials for the inspected app in both dev and production, matching snapshot reads, and flush the development stream handshake Fixed: Make inspector tasks directly discoverable through a grouped sidebar, replace flat route cards with a shared expandable route explorer, and keep Data explorer v Fixed: A `title` annotation on a schema field now becomes the field's label — where the title is one somebody wrote. Fixed: `voltro update` no longer rewrites a package.json that does not consume the framework. Fixed: `input/uncapped-array` is silent on `internal: true`, and `raw-fetch` is silent on a `fetch` an SDK asked for as an option. Internal: The migration lock is released by its bracket and nowhere else.

tag:voltro.dev,2026:release/0.68.0 2026-09-09T00:00:00Z

BREAKING: The shared inspect pages now show reverse-ETL dead letters and replica handoff health, flag kill-switch history, and governance subject-graph limitations. Migra BREAKING: Outbox resends record an independent request timestamp, so manual attempts without an actor ID remain manual. Re-arming uses a conditional store update to refus Added: `Dialog` accepts a typed native dialog ref for `showModal()` and `close()`. Its props retain all `DialogHTMLAttributes<HTMLDialogElement>` and add React's nativ Added: Inspect declared rate-limit rules, RPC and HTTP decisions, SQL binding and fail-open observations in both dashboards, with explicit plugin-instance selection an Added: `voltro dev` tells you when the api client a page loaded is not the one the server binds, naming the procedures that disagree. Added: Shared Signal opener classes unify responsive headlines, sublines and CTA rows across the Framework landing, Cloud landing and Docs index, including secondary-l Added: `ctx.asSubject(subject)` and `ctx.asTenant(tenantId)` return a re-scoped test context instead of passing one to a block — for a test with two actors alive at on Fixed: Server bundles no longer wrap every closure in an `Object.defineProperty`. Fixed: `voltro build` on a web app now generates the rpc groups of the apis it imports. Fixed: `voltro dev` re-bundles the browser's api client when a shared file a descriptor IMPORTS changes, not only when a descriptor file itself does. Fixed: `useConnectionStatus` no longer causes a React hydration mismatch on an SSR page. Fixed: Three things `voltro dev` did silently. Fixed: `voltro db …` now honours the `store` an app declares. Fixed: The fleet view no longer reports a LIVE replica as departed. Fixed: A 403 on the no-JS `/form/*` path now leaves a record saying which of the three refusal reasons fired. Fixed: The dashboard proxy sent its OWN inspect token to every app it opened. Fixed: The local dashboard JSON proxy forwards the separate inspect write credential on action requests in both development and production. Explicit read credentials a Fixed: `voltro e2e` reported a spec whose process was KILLED as passed. Fixed: Mail inspection declares recent-send buffers as process-local and template lists as declarations, so dashboards retain replica identity and completeness instead Fixed: Closing an intercepting-route overlay returns focus to whatever opened it. Fixed: Production now mounts plugin inspect endpoints through the same authenticated dispatcher as development. Plugin JSON GET endpoints can declare process, shared-s Fixed: Keep plugin operation targets, permissions and failures explicit in both dashboards. Confirm retention, subject erasure, search reindex/repair and moderation de Fixed: Resolve dashboard plugin reads and writes against the selected effective instance. Distinguish failed reads from empty lists, show bounded storage and notificat Fixed: The default `Referrer-Policy` made the framework refuse its own no-JS forms. Fixed: The shared token stylesheet now supplies light/dark success, warning and info colors and their Tailwind utilities, so Callout status treatments render consisten Fixed: Signal header actions use the navigation's resting border contrast, 16px icon size and text line height so equally sized controls also align visually. Fixed: `voltro --help` stopped advertising a subcommand that was removed on purpose, and `voltro support --help` answers as help. Fixed: `voltro test` no longer turns a TYPE-ONLY `tsconfig` `paths` mapping into a runtime alias. An app that maps `"react": ["./node_modules/@types/react"]` — the usu Internal: A build check drives the schema cross-check in a real Chromium — a real `fetch` to the derived capabilities URL, a real console, the real `buildApiRuntime`. Internal: Synchronize the published dashboard-inspection codemod manifest and the development inspect-door regression with shared routing. Measure Redis delivery only aft Internal: `documentHidden` in the subscription cache reads `document` through `globalThis` with a local structural type, the way `formBinding` already does, instead of `t

tag:voltro.dev,2026:release/0.67.0 2026-09-07T00:00:00Z

BREAKING: Confirmed optimistic writes now reconcile against a token-bound post-ACK primary snapshot, never an unrelated delta, changed row or timeout. Matching snapshots BREAKING: `voltro support sentry <eventId>` is removed. It wrapped `sentry-cli sourcemaps explain`, which sentry-cli 3 dropped in favour of Sentry's in-product source-map BREAKING: `voltro test` runs on vitest 5, and `@voltro/workflow` names `vitest ^5.0.0` as its peer. Migration: set `vitest` and `@vitest/coverage-v8` to `^5.0.0` together Added: Add the opt-in Signal brand stylesheet, accessible `SignalHeader` and pausable `SignalField` with reduced-motion and visibility handling. Development and produc Changed: Dependency refresh: Effect 3.22.1 with the matching `@effect/*` patch releases (`@effect/cluster` 0.60.2, `@effect/sql-mssql` 0.54.0, `@effect/platform` 0.97.1, Fixed: The tunable readers that take `env = process.env` (`resolveEagerFallbackWarnIntervalMs`, `resolveWorkflowRecordingMode`, `readPollCeilingMs`, and the `Schedulin Fixed: The subscription recovery watchdog knows when it was throttled. A browser delays timers in a hidden tab, so the stall timer could fire long after it was due, re Fixed: Web middleware is precompiled into the server production output and rooted by runtime pruning, preserving its behavior in source-free Docker deployments. Missin

tag:voltro.dev,2026:release/0.66.1 2026-09-06T00:00:00Z

Fixed: API serve and web start bundles preserve esbuild's caught-import handling: a missing `require()` inside `try/catch` or a caught dynamic import can use its sourc

tag:voltro.dev,2026:release/0.66.0 2026-09-06T00:00:00Z

BREAKING: Socket reconnects retry immediately, then after 500 ms with factor 1.5 and a 5 s cap; configure `web.api.recovery.retry: { initialMs, thenMs, factor, maxMs }` b BREAKING: `id({ scheme: 'numeric' })` declares the numeric row key it always emitted. The builder was typed `ColumnBuilder<string, 'id'>` for every scheme and the row dec Added: Add typed `useConnectionSetup(tag)` and `useMutation(tag).withConnectionSetup(handle)` for acknowledged connection-local setup before initial writes and replay. Added: Generated production Compose stacks run declared boot-lifecycle seeds in the migration job, after the reviewed schema plan has applied. Seeding is therefore one Added: Mutations can declare `idempotencyScope: 'connection'` for native WebSocket side effects: repeat keys deduplicate within that server-owned connection but execut Added: `ctx.connectionState` keeps server-owned, structured-cloneable values for one native RPC connection: mutations defer writes/deletes to the existing commit queue Added: `store.update(table, key, patch)`, `delete`, `patchJson` and `hardDelete` take EITHER an id string or the columns that identify the row: Added: `voltro create-project` can add multiple independently cloud-bound projects to one workspace. `add-app --to` and `cloud project link --project` select a target Added: `.primaryKey(['memberId'])` accepts a single explicit natural or reference column as well as a composite set. It previously refused one field and pointed the ca Added: `reference(target, { storage: 'numeric' })` declares a foreign key to a table whose primary key is numeric, without disguising it as a plain integer column: row Added: Custom REST handlers receive the per-request application context as `ctx.app`. Development, production `serve` and `makeTestApp` bind the same surface, so a RES Added: Typed REST handlers can shape their own response. `response(body, { status, headers })` selects a status and headers, including repeated values such as the seve Added: Upserts accept `updateValues` for additional conflict-only assignments without modifying the INSERT row or changing native column-list upserts into read/compute Fixed: Keep a transport-interrupted mutation pending through repeated native `MutationInFlight` replies while its original replay window still permits it. Preserve one Fixed: `useOutbox` drains online enqueues and restored writes, joins concurrent replay calls, includes writes appended during an acknowledgement, and stops at every fa Fixed: Keep late failures from ended physical mutation attempts from marking a healed replacement socket disconnected. Native mutation error events record `affectsTran Fixed: Request-scoped stores evaluate column `.onUpdate()` before validation and encryption for keyed/bulk updates, soft deletes, upsert conflicts and JSON patches. `p Fixed: A generated multi-project Compose stack probes each API's declared port. The generator added one but probed the neighbouring web app's port instead, so an API c Fixed: Production serve/start and SSR bundles now resolve dependencies with the bundler's actual import/require conditions. Installed ESM-only transitive packages no l Fixed: `voltro doctor`'s `cron/bucket-on-wall-clock` follows value references into relative app helpers, including renamed imports, namespace members and re-exports. A Fixed: `placeholdersOf` is now exported from `@voltro/i18n`'s public entry, including the built JavaScript and declarations. The 0.64.0 changelog promised that export, Fixed: `InMemoryDataStore` keeps seeded rows from tables that deliberately have no `id` column — natural and composite primary keys — and inserts into those tables no Fixed: File-backed libsql connections enable WAL at startup so readers from completed interactive transactions do not block subsequent writers' commits. Remote transpo Fixed: The in-memory store now applies registered schema literal defaults (including timestamp `now`, JSON and arrays) and implicit nullable values on insert, includin Fixed: Bind Date parameters as `DateTime2` and strings as `NVarChar`, matching the schema before values reach SQL Server. This preserves milliseconds, dates before 175 Fixed: Every trace id now comes from one function, `newTraceId()` in `@voltro/runtime` — 128 random bits as 32 hex, the shape a `traceparent` parser, a collector and ` Fixed: Declarative migrations now retain partial-index predicates and partial uniqueness on new and existing tables, introspect native filters on PostgreSQL/SQLite/SQL Fixed: Production workspace WebSocket proxies preserve the browser's Host header, so the native same-origin guard accepts legitimate requests behind internal Docker or Fixed: REST descriptors reject undeclared descendant paths before decoding, resolving identity or executing their handler, instead of accidentally serving parent data Fixed: Isolate connection credentials across HTTP/WebSocket protocols and listeners, and deliver every disconnect to both runtime cleanup and the RPC core. Executors r Fixed: `voltro prune-runtime` now preserves package-resolution metadata for rooted native dependencies, so packages such as `argon2` remain importable in pruned produc Fixed: SQLite-family raw stores now encode registered JSON and array columns on every row-write path, including insertMany, updateMany, callback upserts and conflict-o Fixed: Declared events published by a mutation under `invoke` now use the transaction's commit queue, including subject/tenant re-scopes; rollback and deadlock replay Fixed: Apply the shared page-safe security-header policy to both web listeners, including streaming, assets and errors, with `security.headers` configuration and route Internal: Building the CLI package now gives its declaration-rollup process a bounded 6144 MiB heap, and packing delegates to the same build script. The seven-entry rollu Internal: The local verification run now plans tests across all packages and both CLI projects, rather than reading shard files that were never written. Missing filters o