From afcffd6b522ee6b4d8e7288d00b57da17a0433d7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 22 Aug 2026 13:16:42 +0000
Subject: [PATCH] release: version packages

---
 .changeset/calm-logs-report.md      |  5 --
 .changeset/fair-bees-invoke.md      |  6 --
 .changeset/proud-signals-inspect.md | 10 ----
 .changeset/quiet-threads-persist.md | 69 ----------------------
 .changeset/silver-cooks-smile.md    |  5 --
 .changeset/silver-hounds-listen.md  | 12 ----
 .changeset/tidy-hounds-clean.md     |  7 ---
 .changeset/young-taxis-agree.md     |  7 ---
 packages/agent-starter/CHANGELOG.md | 23 ++++++++
 packages/agent-starter/package.json |  2 +-
 packages/breakwater/CHANGELOG.md    | 22 +++++++
 packages/breakwater/package.json    |  2 +-
 packages/fleet-control/CHANGELOG.md | 14 +++++
 packages/fleet-control/package.json |  2 +-
 packages/flowsafe/CHANGELOG.md      | 89 +++++++++++++++++++++++++++++
 packages/flowsafe/package.json      |  2 +-
 packages/showcase/CHANGELOG.md      | 21 +++++++
 packages/showcase/package.json      |  2 +-
 18 files changed, 174 insertions(+), 126 deletions(-)
 delete mode 100644 .changeset/calm-logs-report.md
 delete mode 100644 .changeset/fair-bees-invoke.md
 delete mode 100644 .changeset/proud-signals-inspect.md
 delete mode 100644 .changeset/quiet-threads-persist.md
 delete mode 100644 .changeset/silver-cooks-smile.md
 delete mode 100644 .changeset/silver-hounds-listen.md
 delete mode 100644 .changeset/tidy-hounds-clean.md
 delete mode 100644 .changeset/young-taxis-agree.md

diff --git a/.changeset/calm-logs-report.md b/.changeset/calm-logs-report.md
deleted file mode 100644
index 3963535..0000000
--- a/.changeset/calm-logs-report.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@proofoftech/flowsafe': patch
----
-
-Signal-provider delivery-error log events now carry the same `terminal` flag as their delivery-rejected siblings, so a dropped-forever throw is distinguishable from a deferred one without re-deriving the classification.
diff --git a/.changeset/fair-bees-invoke.md b/.changeset/fair-bees-invoke.md
deleted file mode 100644
index 971e77d..0000000
--- a/.changeset/fair-bees-invoke.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@proofoftech/breakwater': minor
-'anchorage-agent-starter': patch
----
-
-Add a supported connector invocation boundary for trusted hosts and workflows. Direct calls now preserve Mastra validation and Breakwater grants without fabricated tool contexts, and validation failures expose no rejected values or schema messages.
diff --git a/.changeset/proud-signals-inspect.md b/.changeset/proud-signals-inspect.md
deleted file mode 100644
index 6e160d9..0000000
--- a/.changeset/proud-signals-inspect.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-'@proofoftech/breakwater': minor
-'@proofoftech/flowsafe': minor
----
-
-Add an optional content-policy boundary for agent signals. Breakwater exposes `createContentPolicyGate()`, a reusable opaque input-policy gate for host code outside Mastra's processor chain, and FlowSafe's thread signal routes accept a structural `contentPolicy` callback that inspects Mastra's canonical escaped XML before delivery, persistence, wake, or run start — covering direct ingestion, providers, schedules, and notification dispatch. Denial is terminal and evaluator failure stays recoverable on every lane; neither exposes policy names, reasons, content, or causes.
-
-Signal attributes whose keys are not XML names are now dropped when a signal is ingested, and a schedule whose stored target cannot be rendered settles a terminal discard receipt instead of failing every later tick with the same broken target.
-
-Provider deliveries now distinguish a terminal refusal from one the deployment could not decide: an undecided webhook is answered with 503 so the sender redelivers, and every delivery carries a dedupe key derived from the signed bytes and the subscription so a redelivery coalesces into a still-pending notification instead of duplicating it. Webhook and poll results report `denied`, `failed`, and `deferred` counts.
diff --git a/.changeset/quiet-threads-persist.md b/.changeset/quiet-threads-persist.md
deleted file mode 100644
index c532f5d..0000000
--- a/.changeset/quiet-threads-persist.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-'@proofoftech/flowsafe': minor
----
-
-Signal delivery through a Flowsafe durable agent no longer starts an unowned
-run below the host seam; an unbranded agent on an active thread keeps core's own
-behavior as a degraded configuration.
-
-This changes the public signal contract:
-
-- `/signal/queue` persists in both active and idle states. Success now returns
-  `decision.action: 'persist'` without a `runId`; active-thread auto-drain is
-  removed, so the message surfaces on the next host-started turn.
-- `/signal/state` now applies the queue route's owner gates and can return
-  `principal-mismatch` or `persistence-forbidden`.
-- `/signal/notification` creates the notification record for every accepted
-  provider delivery. Owners receive core's `{ record, decision, ... }` result
-  under the top-level `record` field, with the signal-routing decision exposed
-  separately as `delivery` when core returns one. Non-owners receive a flat
-  `NotificationRecord` under `record` plus
-  `delivery: { action: 'deferred', reason: 'dispatcher' }`; they never send a
-  signal directly. Low-priority owner notifications use summarize-later and
-  have no immediate `delivery`.
-- Unbranded agents return `degraded: 'not-runtime-driven'` from successful,
-  non-skipped state and owner-notification responses, regardless of thread state.
-  Skipped state and an early `memory-unavailable` state response carry no marker.
-- `/signal/message`, `/signal`, `/signal/schedule`, and
-  `/signal/notifications/dispatch` now persist on a stale-active-id fall-through
-  instead of waking. A forbidden fallback returns `persistence-forbidden`; a
-  memory-less fallback returns `memory-unavailable`. The notification dispatch
-  lane counts either discard as failed and performs no persisted write. A
-  non-owner `/signal` request for `ifActive: 'persist'` degrades to `discard`
-  for active delivery: when the thread was active, the response is
-  `persistence-forbidden` without a `signalId` because the gate refused and
-  nothing was delivered; when the thread was idle, the caller's own `ifIdle`
-  outcome is returned unchanged with `signalId`. Owners still forward
-  `persist`. Non-owner active deliveries carry non-rendered metadata so a
-  completion drain cannot preserve a leftover through the terminal path.
-- Persist outcomes return a `memory-unavailable` discard decision when the
-  resolved agent has no memory, after the content gate. A default or
-  `ifIdle: 'persist'` message or signal is delivered into an active run without
-  memory; an active persist that no memory could write answers
-  `memory-unavailable`. A persist-behavior `/signal/schedule` fire instead
-  settles a canonical `discard` receipt with `outcome: 'discarded'` and no
-  reason, where it previously settled `persisted`.
-  Owner `/signal/notification` is the other exception: its model-visible memory
-  write is best-effort because the inbox record is already durable. The shipped
-  starter host does not configure agent memory, so its other persist outcomes
-  return `memory-unavailable` until the host adds memory configuration.
-- Non-owner `/signal/notification` ingestion now requires notification storage
-  and returns `409` without it. Those rows bypass the agent's delivery policy and
-  readiness hook; the host must run `createNotificationDispatchTick()` to
-  deliver them. The starter runs it every 60 seconds, giving up to one tick of
-  latency. A host without the tick records but never delivers them; the spike
-  has no tick and its provider probes assert only the inbox row.
-- The durable-agent runner terminally fails every run that was not registered
-  through `streamUntilPersisted()`. Direct `stream()` resolves to a failed
-  output; direct `generate()` rejects. `stream()`, `generate()`, `prepare()`, and
-  `streamUntilPersisted()` synchronously refuse a live id, and `prepare(X)`
-  keeps `X` live until cleanup. `streamUntilPersisted()` also refuses
-  `untilIdle`. If the runner's two terminal-publication attempts and core's own
-  fire-and-forget attempt all fail, the output never closes and the thread stays
-  active until eviction or a new host start.
-- The public `signals/router.ts` state and notification channels carry these new
-  response shapes.
-
-Migrate run starts to the host routes or `streamUntilPersisted()`. Treat queue
-success as `{ action: 'persist' }` without a `runId`, and read queued messages on
-the next host-started turn.
diff --git a/.changeset/silver-cooks-smile.md b/.changeset/silver-cooks-smile.md
deleted file mode 100644
index a995f17..0000000
--- a/.changeset/silver-cooks-smile.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@proofoftech/flowsafe': patch
----
-
-Export deployment identity headers from the protocol leaf so external candidates do not import the Durable Object runner barrel.
diff --git a/.changeset/silver-hounds-listen.md b/.changeset/silver-hounds-listen.md
deleted file mode 100644
index da08913..0000000
--- a/.changeset/silver-hounds-listen.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-'@proofoftech/breakwater': minor
-'@proofoftech/flowsafe': minor
-'anchorage-agent-starter': patch
-'showcase': patch
----
-
-Require `@mastra/core` 1.53.0 exactly (previously 1.50.0). The peer is exact, so every consumer must move to 1.53.0 as well; this is breaking for consumers pinned to 1.50.0. 1.53.0 is the newest release whose published output still bundles for Cloudflare Workers and Vite: 1.54.0 through 1.60.0 inline Node-only dynamic imports (`execa`, `@ast-grep/napi`) that fail to bundle (mastra-ai/mastra#20638). `@mastra/cloudflare-d1` stays at 1.1.1. FlowSafe's `@proofoftech/breakwater` peer floor rises to `>=0.13.0` in step, that being the first Breakwater release built against the same core.
-
-FlowSafe's durable agent runner now refuses every inherited entry point that can drive execution outside `RunnerRuntime`, mint a run id below the caller, or hand back runs the caller does not own: the run-recovery entry points 1.53.0 adds to `DurableAgent` (`recover`, `recoverActiveRuns`, `listActiveRuns`); the resume family (`resume`, `resumeStream`, `resumeGenerate`, `approveToolCall`, `declineToolCall`, `approveToolCallGenerate`, `declineToolCallGenerate`), which since 1.53.0 rehydrate from snapshot storage on a run-registry miss; the agent-level discovery member `listSuspendedRuns`; the network family (`network`, `resumeNetwork`, `approveNetworkToolCall`, `declineNetworkToolCall`), which drives the multi-agent loop's own workflow on the default engine; the AI SDK v4 legacy pair (`generateLegacy`, `streamLegacy`), which runs the agent's tools while skipping the authorization check every supported entry point calls; and `sendToolApproval`, whose continuation branch starts a run under a generated run id rather than resuming. `deleteRunSnapshots` is refused on a separate ground: the snapshot rows it deletes belong to deployment-scoped retention rather than to any caller. Nineteen entry points in all. That leaves `resumeViaRuntime` as the only resume path and the guarded `stream`/`generate`/`prepare` as the only execution entry points. Surface tripwires now classify every `DurableAgent` prototype member and every inherited `Agent` member, so a future peer bump surfaces new entry points on either.
-
-This is a behavior change for any consumer that called those methods on a FlowSafe durable agent: they now throw instead of executing. Their TYPE signatures narrow too — the overridden members return `Promise<never>`, and the generic overloads several of them carried (`network`, `generateLegacy`, `streamLegacy`, `sendToolApproval`) collapse to a single refusing signature, so a call that no longer type-checks is the intended signal rather than a regression. Nothing in the supported agent-host surface reaches them — route clients through the agent-host run routes.
diff --git a/.changeset/tidy-hounds-clean.md b/.changeset/tidy-hounds-clean.md
deleted file mode 100644
index 7da5556..0000000
--- a/.changeset/tidy-hounds-clean.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@proofoftech/breakwater': patch
-'@proofoftech/fleet-control': patch
-'@proofoftech/flowsafe': patch
----
-
-Clean generated output at the packaging boundary so deleted source modules cannot remain in published tarballs.
diff --git a/.changeset/young-taxis-agree.md b/.changeset/young-taxis-agree.md
deleted file mode 100644
index 2bc4881..0000000
--- a/.changeset/young-taxis-agree.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@proofoftech/breakwater': patch
-'@proofoftech/flowsafe': patch
-'anchorage-agent-starter': patch
----
-
-Align the package and documented Node.js runtime floor with the required `@mastra/core` peer dependency.
diff --git a/packages/agent-starter/CHANGELOG.md b/packages/agent-starter/CHANGELOG.md
index 7fbc5fc..3daeef8 100644
--- a/packages/agent-starter/CHANGELOG.md
+++ b/packages/agent-starter/CHANGELOG.md
@@ -1,5 +1,28 @@
 # anchorage-agent-starter
 
+## 0.0.15
+
+### Patch Changes
+
+- b85a872: Add a supported connector invocation boundary for trusted hosts and workflows. Direct calls now preserve Mastra validation and Breakwater grants without fabricated tool contexts, and validation failures expose no rejected values or schema messages.
+- 8f4daae: Require `@mastra/core` 1.53.0 exactly (previously 1.50.0). The peer is exact, so every consumer must move to 1.53.0 as well; this is breaking for consumers pinned to 1.50.0. 1.53.0 is the newest release whose published output still bundles for Cloudflare Workers and Vite: 1.54.0 through 1.60.0 inline Node-only dynamic imports (`execa`, `@ast-grep/napi`) that fail to bundle (mastra-ai/mastra#20638). `@mastra/cloudflare-d1` stays at 1.1.1. FlowSafe's `@proofoftech/breakwater` peer floor rises to `>=0.13.0` in step, that being the first Breakwater release built against the same core.
+
+  FlowSafe's durable agent runner now refuses every inherited entry point that can drive execution outside `RunnerRuntime`, mint a run id below the caller, or hand back runs the caller does not own: the run-recovery entry points 1.53.0 adds to `DurableAgent` (`recover`, `recoverActiveRuns`, `listActiveRuns`); the resume family (`resume`, `resumeStream`, `resumeGenerate`, `approveToolCall`, `declineToolCall`, `approveToolCallGenerate`, `declineToolCallGenerate`), which since 1.53.0 rehydrate from snapshot storage on a run-registry miss; the agent-level discovery member `listSuspendedRuns`; the network family (`network`, `resumeNetwork`, `approveNetworkToolCall`, `declineNetworkToolCall`), which drives the multi-agent loop's own workflow on the default engine; the AI SDK v4 legacy pair (`generateLegacy`, `streamLegacy`), which runs the agent's tools while skipping the authorization check every supported entry point calls; and `sendToolApproval`, whose continuation branch starts a run under a generated run id rather than resuming. `deleteRunSnapshots` is refused on a separate ground: the snapshot rows it deletes belong to deployment-scoped retention rather than to any caller. Nineteen entry points in all. That leaves `resumeViaRuntime` as the only resume path and the guarded `stream`/`generate`/`prepare` as the only execution entry points. Surface tripwires now classify every `DurableAgent` prototype member and every inherited `Agent` member, so a future peer bump surfaces new entry points on either.
+
+  This is a behavior change for any consumer that called those methods on a FlowSafe durable agent: they now throw instead of executing. Their TYPE signatures narrow too — the overridden members return `Promise<never>`, and the generic overloads several of them carried (`network`, `generateLegacy`, `streamLegacy`, `sendToolApproval`) collapse to a single refusing signature, so a call that no longer type-checks is the intended signal rather than a regression. Nothing in the supported agent-host surface reaches them — route clients through the agent-host run routes.
+
+- 5cbe01d: Align the package and documented Node.js runtime floor with the required `@mastra/core` peer dependency.
+- Updated dependencies [80a801c]
+- Updated dependencies [b85a872]
+- Updated dependencies [fa0d11d]
+- Updated dependencies [0447466]
+- Updated dependencies [da6a0aa]
+- Updated dependencies [8f4daae]
+- Updated dependencies [66c19f1]
+- Updated dependencies [5cbe01d]
+  - @proofoftech/flowsafe@0.19.0
+  - @proofoftech/breakwater@0.13.0
+
 ## 0.0.14
 
 ### Patch Changes
diff --git a/packages/agent-starter/package.json b/packages/agent-starter/package.json
index 4e2bf99..4ce5470 100644
--- a/packages/agent-starter/package.json
+++ b/packages/agent-starter/package.json
@@ -1,6 +1,6 @@
 {
   "name": "anchorage-agent-starter",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "private": true,
   "description": "Production-shaped Cloudflare Workers starter for durable, approval-gated Anchorage agents",
   "type": "module",
diff --git a/packages/breakwater/CHANGELOG.md b/packages/breakwater/CHANGELOG.md
index eb82399..8a64756 100644
--- a/packages/breakwater/CHANGELOG.md
+++ b/packages/breakwater/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @proofoftech/breakwater
 
+## 0.13.0
+
+### Minor Changes
+
+- b85a872: Add a supported connector invocation boundary for trusted hosts and workflows. Direct calls now preserve Mastra validation and Breakwater grants without fabricated tool contexts, and validation failures expose no rejected values or schema messages.
+- fa0d11d: Add an optional content-policy boundary for agent signals. Breakwater exposes `createContentPolicyGate()`, a reusable opaque input-policy gate for host code outside Mastra's processor chain, and FlowSafe's thread signal routes accept a structural `contentPolicy` callback that inspects Mastra's canonical escaped XML before delivery, persistence, wake, or run start — covering direct ingestion, providers, schedules, and notification dispatch. Denial is terminal and evaluator failure stays recoverable on every lane; neither exposes policy names, reasons, content, or causes.
+
+  Signal attributes whose keys are not XML names are now dropped when a signal is ingested, and a schedule whose stored target cannot be rendered settles a terminal discard receipt instead of failing every later tick with the same broken target.
+
+  Provider deliveries now distinguish a terminal refusal from one the deployment could not decide: an undecided webhook is answered with 503 so the sender redelivers, and every delivery carries a dedupe key derived from the signed bytes and the subscription so a redelivery coalesces into a still-pending notification instead of duplicating it. Webhook and poll results report `denied`, `failed`, and `deferred` counts.
+
+- 8f4daae: Require `@mastra/core` 1.53.0 exactly (previously 1.50.0). The peer is exact, so every consumer must move to 1.53.0 as well; this is breaking for consumers pinned to 1.50.0. 1.53.0 is the newest release whose published output still bundles for Cloudflare Workers and Vite: 1.54.0 through 1.60.0 inline Node-only dynamic imports (`execa`, `@ast-grep/napi`) that fail to bundle (mastra-ai/mastra#20638). `@mastra/cloudflare-d1` stays at 1.1.1. FlowSafe's `@proofoftech/breakwater` peer floor rises to `>=0.13.0` in step, that being the first Breakwater release built against the same core.
+
+  FlowSafe's durable agent runner now refuses every inherited entry point that can drive execution outside `RunnerRuntime`, mint a run id below the caller, or hand back runs the caller does not own: the run-recovery entry points 1.53.0 adds to `DurableAgent` (`recover`, `recoverActiveRuns`, `listActiveRuns`); the resume family (`resume`, `resumeStream`, `resumeGenerate`, `approveToolCall`, `declineToolCall`, `approveToolCallGenerate`, `declineToolCallGenerate`), which since 1.53.0 rehydrate from snapshot storage on a run-registry miss; the agent-level discovery member `listSuspendedRuns`; the network family (`network`, `resumeNetwork`, `approveNetworkToolCall`, `declineNetworkToolCall`), which drives the multi-agent loop's own workflow on the default engine; the AI SDK v4 legacy pair (`generateLegacy`, `streamLegacy`), which runs the agent's tools while skipping the authorization check every supported entry point calls; and `sendToolApproval`, whose continuation branch starts a run under a generated run id rather than resuming. `deleteRunSnapshots` is refused on a separate ground: the snapshot rows it deletes belong to deployment-scoped retention rather than to any caller. Nineteen entry points in all. That leaves `resumeViaRuntime` as the only resume path and the guarded `stream`/`generate`/`prepare` as the only execution entry points. Surface tripwires now classify every `DurableAgent` prototype member and every inherited `Agent` member, so a future peer bump surfaces new entry points on either.
+
+  This is a behavior change for any consumer that called those methods on a FlowSafe durable agent: they now throw instead of executing. Their TYPE signatures narrow too — the overridden members return `Promise<never>`, and the generic overloads several of them carried (`network`, `generateLegacy`, `streamLegacy`, `sendToolApproval`) collapse to a single refusing signature, so a call that no longer type-checks is the intended signal rather than a regression. Nothing in the supported agent-host surface reaches them — route clients through the agent-host run routes.
+
+### Patch Changes
+
+- 66c19f1: Clean generated output at the packaging boundary so deleted source modules cannot remain in published tarballs.
+- 5cbe01d: Align the package and documented Node.js runtime floor with the required `@mastra/core` peer dependency.
+
 ## 0.12.0
 
 ### Minor Changes
diff --git a/packages/breakwater/package.json b/packages/breakwater/package.json
index 3a75b20..eeecb3b 100644
--- a/packages/breakwater/package.json
+++ b/packages/breakwater/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@proofoftech/breakwater",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "publishConfig": {
     "access": "public"
   },
diff --git a/packages/fleet-control/CHANGELOG.md b/packages/fleet-control/CHANGELOG.md
index 9394e2e..98481da 100644
--- a/packages/fleet-control/CHANGELOG.md
+++ b/packages/fleet-control/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @proofoftech/fleet-control
 
+## 0.3.4
+
+### Patch Changes
+
+- 66c19f1: Clean generated output at the packaging boundary so deleted source modules cannot remain in published tarballs.
+- Updated dependencies [80a801c]
+- Updated dependencies [fa0d11d]
+- Updated dependencies [0447466]
+- Updated dependencies [da6a0aa]
+- Updated dependencies [8f4daae]
+- Updated dependencies [66c19f1]
+- Updated dependencies [5cbe01d]
+  - @proofoftech/flowsafe@0.19.0
+
 ## 0.3.3
 
 ### Patch Changes
diff --git a/packages/fleet-control/package.json b/packages/fleet-control/package.json
index f0309bc..cd3c651 100644
--- a/packages/fleet-control/package.json
+++ b/packages/fleet-control/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@proofoftech/fleet-control",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "publishConfig": {
     "access": "public"
   },
diff --git a/packages/flowsafe/CHANGELOG.md b/packages/flowsafe/CHANGELOG.md
index bf73071..e527475 100644
--- a/packages/flowsafe/CHANGELOG.md
+++ b/packages/flowsafe/CHANGELOG.md
@@ -1,5 +1,94 @@
 # @proofoftech/flowsafe
 
+## 0.19.0
+
+### Minor Changes
+
+- fa0d11d: Add an optional content-policy boundary for agent signals. Breakwater exposes `createContentPolicyGate()`, a reusable opaque input-policy gate for host code outside Mastra's processor chain, and FlowSafe's thread signal routes accept a structural `contentPolicy` callback that inspects Mastra's canonical escaped XML before delivery, persistence, wake, or run start — covering direct ingestion, providers, schedules, and notification dispatch. Denial is terminal and evaluator failure stays recoverable on every lane; neither exposes policy names, reasons, content, or causes.
+
+  Signal attributes whose keys are not XML names are now dropped when a signal is ingested, and a schedule whose stored target cannot be rendered settles a terminal discard receipt instead of failing every later tick with the same broken target.
+
+  Provider deliveries now distinguish a terminal refusal from one the deployment could not decide: an undecided webhook is answered with 503 so the sender redelivers, and every delivery carries a dedupe key derived from the signed bytes and the subscription so a redelivery coalesces into a still-pending notification instead of duplicating it. Webhook and poll results report `denied`, `failed`, and `deferred` counts.
+
+- 0447466: Signal delivery through a Flowsafe durable agent no longer starts an unowned
+  run below the host seam; an unbranded agent on an active thread keeps core's own
+  behavior as a degraded configuration.
+
+  This changes the public signal contract:
+
+  - `/signal/queue` persists in both active and idle states. Success now returns
+    `decision.action: 'persist'` without a `runId`; active-thread auto-drain is
+    removed, so the message surfaces on the next host-started turn.
+  - `/signal/state` now applies the queue route's owner gates and can return
+    `principal-mismatch` or `persistence-forbidden`.
+  - `/signal/notification` creates the notification record for every accepted
+    provider delivery. Owners receive core's `{ record, decision, ... }` result
+    under the top-level `record` field, with the signal-routing decision exposed
+    separately as `delivery` when core returns one. Non-owners receive a flat
+    `NotificationRecord` under `record` plus
+    `delivery: { action: 'deferred', reason: 'dispatcher' }`; they never send a
+    signal directly. Low-priority owner notifications use summarize-later and
+    have no immediate `delivery`.
+  - Unbranded agents return `degraded: 'not-runtime-driven'` from successful,
+    non-skipped state and owner-notification responses, regardless of thread state.
+    Skipped state and an early `memory-unavailable` state response carry no marker.
+  - `/signal/message`, `/signal`, `/signal/schedule`, and
+    `/signal/notifications/dispatch` now persist on a stale-active-id fall-through
+    instead of waking. A forbidden fallback returns `persistence-forbidden`; a
+    memory-less fallback returns `memory-unavailable`. The notification dispatch
+    lane counts either discard as failed and performs no persisted write. A
+    non-owner `/signal` request for `ifActive: 'persist'` degrades to `discard`
+    for active delivery: when the thread was active, the response is
+    `persistence-forbidden` without a `signalId` because the gate refused and
+    nothing was delivered; when the thread was idle, the caller's own `ifIdle`
+    outcome is returned unchanged with `signalId`. Owners still forward
+    `persist`. Non-owner active deliveries carry non-rendered metadata so a
+    completion drain cannot preserve a leftover through the terminal path.
+  - Persist outcomes return a `memory-unavailable` discard decision when the
+    resolved agent has no memory, after the content gate. A default or
+    `ifIdle: 'persist'` message or signal is delivered into an active run without
+    memory; an active persist that no memory could write answers
+    `memory-unavailable`. A persist-behavior `/signal/schedule` fire instead
+    settles a canonical `discard` receipt with `outcome: 'discarded'` and no
+    reason, where it previously settled `persisted`.
+    Owner `/signal/notification` is the other exception: its model-visible memory
+    write is best-effort because the inbox record is already durable. The shipped
+    starter host does not configure agent memory, so its other persist outcomes
+    return `memory-unavailable` until the host adds memory configuration.
+  - Non-owner `/signal/notification` ingestion now requires notification storage
+    and returns `409` without it. Those rows bypass the agent's delivery policy and
+    readiness hook; the host must run `createNotificationDispatchTick()` to
+    deliver them. The starter runs it every 60 seconds, giving up to one tick of
+    latency. A host without the tick records but never delivers them; the spike
+    has no tick and its provider probes assert only the inbox row.
+  - The durable-agent runner terminally fails every run that was not registered
+    through `streamUntilPersisted()`. Direct `stream()` resolves to a failed
+    output; direct `generate()` rejects. `stream()`, `generate()`, `prepare()`, and
+    `streamUntilPersisted()` synchronously refuse a live id, and `prepare(X)`
+    keeps `X` live until cleanup. `streamUntilPersisted()` also refuses
+    `untilIdle`. If the runner's two terminal-publication attempts and core's own
+    fire-and-forget attempt all fail, the output never closes and the thread stays
+    active until eviction or a new host start.
+  - The public `signals/router.ts` state and notification channels carry these new
+    response shapes.
+
+  Migrate run starts to the host routes or `streamUntilPersisted()`. Treat queue
+  success as `{ action: 'persist' }` without a `runId`, and read queued messages on
+  the next host-started turn.
+
+- 8f4daae: Require `@mastra/core` 1.53.0 exactly (previously 1.50.0). The peer is exact, so every consumer must move to 1.53.0 as well; this is breaking for consumers pinned to 1.50.0. 1.53.0 is the newest release whose published output still bundles for Cloudflare Workers and Vite: 1.54.0 through 1.60.0 inline Node-only dynamic imports (`execa`, `@ast-grep/napi`) that fail to bundle (mastra-ai/mastra#20638). `@mastra/cloudflare-d1` stays at 1.1.1. FlowSafe's `@proofoftech/breakwater` peer floor rises to `>=0.13.0` in step, that being the first Breakwater release built against the same core.
+
+  FlowSafe's durable agent runner now refuses every inherited entry point that can drive execution outside `RunnerRuntime`, mint a run id below the caller, or hand back runs the caller does not own: the run-recovery entry points 1.53.0 adds to `DurableAgent` (`recover`, `recoverActiveRuns`, `listActiveRuns`); the resume family (`resume`, `resumeStream`, `resumeGenerate`, `approveToolCall`, `declineToolCall`, `approveToolCallGenerate`, `declineToolCallGenerate`), which since 1.53.0 rehydrate from snapshot storage on a run-registry miss; the agent-level discovery member `listSuspendedRuns`; the network family (`network`, `resumeNetwork`, `approveNetworkToolCall`, `declineNetworkToolCall`), which drives the multi-agent loop's own workflow on the default engine; the AI SDK v4 legacy pair (`generateLegacy`, `streamLegacy`), which runs the agent's tools while skipping the authorization check every supported entry point calls; and `sendToolApproval`, whose continuation branch starts a run under a generated run id rather than resuming. `deleteRunSnapshots` is refused on a separate ground: the snapshot rows it deletes belong to deployment-scoped retention rather than to any caller. Nineteen entry points in all. That leaves `resumeViaRuntime` as the only resume path and the guarded `stream`/`generate`/`prepare` as the only execution entry points. Surface tripwires now classify every `DurableAgent` prototype member and every inherited `Agent` member, so a future peer bump surfaces new entry points on either.
+
+  This is a behavior change for any consumer that called those methods on a FlowSafe durable agent: they now throw instead of executing. Their TYPE signatures narrow too — the overridden members return `Promise<never>`, and the generic overloads several of them carried (`network`, `generateLegacy`, `streamLegacy`, `sendToolApproval`) collapse to a single refusing signature, so a call that no longer type-checks is the intended signal rather than a regression. Nothing in the supported agent-host surface reaches them — route clients through the agent-host run routes.
+
+### Patch Changes
+
+- 80a801c: Signal-provider delivery-error log events now carry the same `terminal` flag as their delivery-rejected siblings, so a dropped-forever throw is distinguishable from a deferred one without re-deriving the classification.
+- da6a0aa: Export deployment identity headers from the protocol leaf so external candidates do not import the Durable Object runner barrel.
+- 66c19f1: Clean generated output at the packaging boundary so deleted source modules cannot remain in published tarballs.
+- 5cbe01d: Align the package and documented Node.js runtime floor with the required `@mastra/core` peer dependency.
+
 ## 0.18.0
 
 ### Minor Changes
diff --git a/packages/flowsafe/package.json b/packages/flowsafe/package.json
index 48afa94..4dc66da 100644
--- a/packages/flowsafe/package.json
+++ b/packages/flowsafe/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@proofoftech/flowsafe",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "publishConfig": {
     "access": "public"
   },
diff --git a/packages/showcase/CHANGELOG.md b/packages/showcase/CHANGELOG.md
index 2a700ba..a8bc334 100644
--- a/packages/showcase/CHANGELOG.md
+++ b/packages/showcase/CHANGELOG.md
@@ -1,5 +1,26 @@
 # showcase
 
+## 0.0.21
+
+### Patch Changes
+
+- 8f4daae: Require `@mastra/core` 1.53.0 exactly (previously 1.50.0). The peer is exact, so every consumer must move to 1.53.0 as well; this is breaking for consumers pinned to 1.50.0. 1.53.0 is the newest release whose published output still bundles for Cloudflare Workers and Vite: 1.54.0 through 1.60.0 inline Node-only dynamic imports (`execa`, `@ast-grep/napi`) that fail to bundle (mastra-ai/mastra#20638). `@mastra/cloudflare-d1` stays at 1.1.1. FlowSafe's `@proofoftech/breakwater` peer floor rises to `>=0.13.0` in step, that being the first Breakwater release built against the same core.
+
+  FlowSafe's durable agent runner now refuses every inherited entry point that can drive execution outside `RunnerRuntime`, mint a run id below the caller, or hand back runs the caller does not own: the run-recovery entry points 1.53.0 adds to `DurableAgent` (`recover`, `recoverActiveRuns`, `listActiveRuns`); the resume family (`resume`, `resumeStream`, `resumeGenerate`, `approveToolCall`, `declineToolCall`, `approveToolCallGenerate`, `declineToolCallGenerate`), which since 1.53.0 rehydrate from snapshot storage on a run-registry miss; the agent-level discovery member `listSuspendedRuns`; the network family (`network`, `resumeNetwork`, `approveNetworkToolCall`, `declineNetworkToolCall`), which drives the multi-agent loop's own workflow on the default engine; the AI SDK v4 legacy pair (`generateLegacy`, `streamLegacy`), which runs the agent's tools while skipping the authorization check every supported entry point calls; and `sendToolApproval`, whose continuation branch starts a run under a generated run id rather than resuming. `deleteRunSnapshots` is refused on a separate ground: the snapshot rows it deletes belong to deployment-scoped retention rather than to any caller. Nineteen entry points in all. That leaves `resumeViaRuntime` as the only resume path and the guarded `stream`/`generate`/`prepare` as the only execution entry points. Surface tripwires now classify every `DurableAgent` prototype member and every inherited `Agent` member, so a future peer bump surfaces new entry points on either.
+
+  This is a behavior change for any consumer that called those methods on a FlowSafe durable agent: they now throw instead of executing. Their TYPE signatures narrow too — the overridden members return `Promise<never>`, and the generic overloads several of them carried (`network`, `generateLegacy`, `streamLegacy`, `sendToolApproval`) collapse to a single refusing signature, so a call that no longer type-checks is the intended signal rather than a regression. Nothing in the supported agent-host surface reaches them — route clients through the agent-host run routes.
+
+- Updated dependencies [80a801c]
+- Updated dependencies [b85a872]
+- Updated dependencies [fa0d11d]
+- Updated dependencies [0447466]
+- Updated dependencies [da6a0aa]
+- Updated dependencies [8f4daae]
+- Updated dependencies [66c19f1]
+- Updated dependencies [5cbe01d]
+  - @proofoftech/flowsafe@0.19.0
+  - @proofoftech/breakwater@0.13.0
+
 ## 0.0.20
 
 ### Patch Changes
diff --git a/packages/showcase/package.json b/packages/showcase/package.json
index 8b0476f..94999f3 100644
--- a/packages/showcase/package.json
+++ b/packages/showcase/package.json
@@ -1,6 +1,6 @@
 {
   "name": "showcase",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "private": true,
   "description": "Anchorage showcase — six runnable workflows and seven guardrail scenarios behind one React frontend",
   "type": "module",