Durable outbox egress

Outbox egress is an optional OutboxPlatformHostStore capability in @fabricorg/platform-host. appendEventWithOutbox writes the canonical AssetEvent and delivery record together. PostgreSQL uses one statement inside the application-provided transaction; the memory adapter mirrors ordering and leases for deterministic tests. A memory store may enable governed Host outbox egress only when constructed with an explicit MemoryPlatformHostTransactionProvider whose snapshot and restore functions cover its domain database; otherwise transactionalOutbox is false and Host configuration fails closed. When outbox egress is enabled, a transaction-scoped event requires transactionWithEvents and its appendEventWithOutbox operation before handler execution.

runOutboxRelayCycle leases pending records, publishes, checkpoints, retries with backoff, and dead-letters poisoned messages. Delivery is at least once: a publisher crash after send but before checkpoint may republish the same immutable event ID, which consumers use as the deduplication key. The bus envelope separately carries event type and schema version, tenant/space, ledger sequence, correlation/causation, timestamps, producer module version, trace context, payload classification, and consistency. The canonical event remains audit truth; outbox rows are delivery state only.

Event payloads must already obey Platform redaction requirements. Payload classification labels handling expectations but does not redact secrets. Adapter and compliance lifecycle events are excluded from bus egress by default because their audit payloads may contain request, response, policy, or vendor data. shouldPublish can opt an event in only after the application has made that payload safe for the external bus; canonical storage is unaffected.