@greatwait/contracts 0.1.0-alpha.4 → 0.1.0-alpha.5

package/dist/partition.d.ts

@@ -53,7 +53,7 @@ export declare const SINGLE_SHARD = "0";
  * produced by two constants drifting apart. The test-gap audit named exactly
  * that, and the fix is one declaration rather than a test comparing two.
  *
- * Thirty-two is one D1 batch's worth of work and a few kilobytes of response.
+ * Thirty-two is one control-plane batch's worth of work and a few kilobytes of response.
  * The caller comes back for the rest, and `RetainedProjections.pending` is how
  * it knows to.
  */
@@ -93,8 +93,8 @@ export declare const MAX_PARTITION_SHARDS = 8;
  * only under a precondition, and that is the most important thing to know about
  * it.** A schedule's shard is derived from its identifier. Before W2-06 that was
  * the only answer, so raising the count stranded every schedule already stored.
- * Now the shard a schedule was actually stored in is *recorded* in the D1
- * directory, and `resolveSchedule` falls back to it whenever the derived
+ * Now the shard a schedule was actually stored in is *recorded* in the
+ * control-plane directory, and `resolveSchedule` falls back to it whenever the derived
  * partition has nothing — so a schedule created under an older count keeps
  * working, because its route was written down rather than recomputed.
  *
@@ -295,7 +295,7 @@ export interface DrainProjectionsQuery {
  *
  * **Nothing is deleted here.** The intents stay until `settleProjections` says
  * the control plane has them, which is acceptance criterion 1: an intent
- * survives a drain whose D1 write never landed, and a partition that has never
+ * survives a drain whose control-plane write never landed, and a partition that has never
  * been initialized answers an empty drain rather than a refusal — a shard nobody
  * has written to owes the directory nothing.
  */
@@ -304,9 +304,10 @@ export type DrainProjectionsOutcome = PartitionRefused | RetainedProjections;
  * Retire the intents the control plane accepted, and postpone the rest.
  *
  * Both halves in one call rather than two, because a drain has exactly one of
- * these outcomes and the failing half must not need a healthy D1 to be recorded:
- * the deferral is what stops a control-plane outage from making every subsequent
- * request pay a D1 timeout for the same intent.
+ * these outcomes and the failing half must not need a healthy control plane
+ * to be recorded: the deferral is what stops a control-plane outage from
+ * making every subsequent request pay a control-plane timeout for the same
+ * intent.
  */
 export interface SettleProjectionsCommand {
     /** Intents the control plane has durably applied, or cannot route. */
@@ -470,7 +471,7 @@ export interface CreateScheduleCommand {
     readonly partitionKey?: string;
     /**
      * Authenticated encrypted customer JSON. The plaintext never crosses this
-     * seam and is never stored in a D1 projection.
+     * seam and is never stored in a control-plane projection.
      */
     readonly payloadEnvelope?: string;
     /** UTF-8 byte length of the plaintext JSON, before encryption. */
@@ -479,7 +480,7 @@ export interface CreateScheduleCommand {
      * The verified endpoint URL captured for durable host routing.
      *
      * This is internal metadata, not a public response field. The Host Executor
-     * re-reads the D1 endpoint row before signing and reroutes if the URL has
+     * re-reads the control-plane endpoint row before signing and reroutes if the URL has
      * changed. It does not resolve or revalidate the address: that boundary was
      * removed by FXO-1566 and FXO-1581, and this comment claimed it afterwards.
      */
@@ -700,6 +701,8 @@ export interface ForecastQuery {
     readonly authority: Authority;
     readonly bucketMs: number;
     readonly fromMs: number;
+    /** Omit named-key cells when the public caller only needs totals/classes. */
+    readonly includePartitionKeys?: boolean;
     readonly toMs: number;
 }
 /** One bucket, as one partition sees it. */
@@ -709,6 +712,8 @@ export interface ForecastPartitionBucket {
     readonly count: number;
     /** Occurrences here that are the next firing of their schedule. */
     readonly nextFireCount: number;
+    /** Named-key counts folded into the public remainder after exact ranking. */
+    readonly omittedPartitionKeyCount?: number;
     /**
      * Named customer keys and their counts, ascending by key.
      *
@@ -748,6 +753,9 @@ export type ForecastOutcome = PartitionRefused | {
      */
     readonly asOfMs?: number;
     readonly buckets: readonly ForecastPartitionBucket[];
+    /** Operator work budget that prevented a complete answer, never a count. */
+    readonly exhaustedBudget?: string;
+    readonly coverage?: import("./forecast.js").ForecastCoverage;
     /**
      * The instant this answer actually reached, when it is not the one asked
      * for.

package/dist/partition.js

@@ -51,7 +51,7 @@ export const SINGLE_SHARD = "0";
  * produced by two constants drifting apart. The test-gap audit named exactly
  * that, and the fix is one declaration rather than a test comparing two.
  *
- * Thirty-two is one D1 batch's worth of work and a few kilobytes of response.
+ * Thirty-two is one control-plane batch's worth of work and a few kilobytes of response.
  * The caller comes back for the rest, and `RetainedProjections.pending` is how
  * it knows to.
  */
@@ -110,8 +110,8 @@ function fnv1a32(input) {
  * only under a precondition, and that is the most important thing to know about
  * it.** A schedule's shard is derived from its identifier. Before W2-06 that was
  * the only answer, so raising the count stranded every schedule already stored.
- * Now the shard a schedule was actually stored in is *recorded* in the D1
- * directory, and `resolveSchedule` falls back to it whenever the derived
+ * Now the shard a schedule was actually stored in is *recorded* in the
+ * control-plane directory, and `resolveSchedule` falls back to it whenever the derived
  * partition has nothing — so a schedule created under an older count keeps
  * working, because its route was written down rather than recomputed.
  *

package/dist/problems.d.ts

@@ -12,12 +12,13 @@ import { z } from "./zod.js";
  * `code` is the contract. `title` and `detail` are prose and may change without
  * being a breaking change; clients must never branch on them.
  */
-export declare const PROBLEM_CATEGORIES: readonly ["authentication", "authorization", "conflict", "invalid-request", "not-found", "rate-limited", "unavailable"];
+export declare const PROBLEM_CATEGORIES: readonly ["authentication", "authorization", "conflict", "invalid-request", "not-configured", "not-found", "rate-limited", "unavailable"];
 export declare const problemCategorySchema: import("zod").ZodEnum<{
     authentication: "authentication";
     authorization: "authorization";
     conflict: "conflict";
     "invalid-request": "invalid-request";
+    "not-configured": "not-configured";
     "not-found": "not-found";
     "rate-limited": "rate-limited";
     unavailable: "unavailable";
@@ -32,6 +33,14 @@ export declare const PROBLEM_CODES: {
         readonly category: "authentication";
         readonly status: 401;
     };
+    readonly billing_not_ready: {
+        readonly category: "unavailable";
+        readonly status: 503;
+    };
+    readonly capability_not_configured: {
+        readonly category: "not-configured";
+        readonly status: 503;
+    };
     readonly credential_expired: {
         readonly category: "authentication";
         readonly status: 401;
@@ -96,6 +105,8 @@ export declare const PROBLEM_CODES: {
 export type ProblemCode = keyof typeof PROBLEM_CODES;
 export declare const problemCodeSchema: import("zod").ZodEnum<{
     authentication_required: "authentication_required";
+    billing_not_ready: "billing_not_ready";
+    capability_not_configured: "capability_not_configured";
     credential_expired: "credential_expired";
     credential_revoked: "credential_revoked";
     idempotency_key_reused: "idempotency_key_reused";
@@ -112,7 +123,17 @@ export declare const problemCodeSchema: import("zod").ZodEnum<{
     test_to_live_escalation: "test_to_live_escalation";
     version_conflict: "version_conflict";
 }>;
-/** Whether repeating the identical request could succeed later. */
+/**
+ * Whether repeating the identical request could succeed later.
+ *
+ * **Two 5xx categories, opposite answers, and that is the point.**
+ * `unavailable` is something that has gone wrong and will come back;
+ * `not-configured` is something that was never turned on and will not turn
+ * itself on. Reading the status alone cannot tell them apart, which is how a
+ * permanent refusal came to be published to customers as retryable — in the
+ * SDK's `retryable`, in the CLI's exit class, and as a "Try again" control the
+ * dashboard offered for a condition no amount of trying clears.
+ */
 export declare function isRetryable(code: ProblemCode): boolean;
 export declare const fieldErrorSchema: import("zod").ZodObject<{
     pointer: import("zod").ZodString;
@@ -122,6 +143,8 @@ export type FieldError = z.infer<typeof fieldErrorSchema>;
 export declare const problemSchema: import("zod").ZodObject<{
     code: import("zod").ZodEnum<{
         authentication_required: "authentication_required";
+        billing_not_ready: "billing_not_ready";
+        capability_not_configured: "capability_not_configured";
         credential_expired: "credential_expired";
         credential_revoked: "credential_revoked";
         idempotency_key_reused: "idempotency_key_reused";

package/dist/problems.js

@@ -17,6 +17,14 @@ export const PROBLEM_CATEGORIES = [
     "authorization",
     "conflict",
     "invalid-request",
+    // **A capability this deployment was never given, which is not an outage.**
+    // Separate from `unavailable` for one reason: `isRetryable` is a function of
+    // the category, and these two answer the retry question oppositely. An
+    // outage clears by itself and repeating is the right move; an unconfigured
+    // capability clears when somebody changes configuration and never otherwise,
+    // so telling a client "the identical request is safe to repeat" is false and
+    // it is false forever. Both are 5xx because the caller's request was fine.
+    "not-configured",
     "not-found",
     "rate-limited",
     "unavailable",
@@ -34,6 +42,36 @@ export const PROBLEM_CODES = {
     // now. One code for both would make a missed rotation window indistinguishable
     // from a security event, and the client's remedy differs — rotate again
     // versus find out who revoked it.
+    // **"Still being set up" is not "broken", and a first screen should not say
+    // the second when it means the first.** An organization's billing account row
+    // is written by a projection that runs every minute rather than synchronously
+    // at sign-up, so a member who creates their project immediately can read
+    // billing before the row exists. That used to answer `service_unavailable`,
+    // which the dashboard renders as "The service is not answering right now" —
+    // the sentence W9-06 blocked the invited cohort over, and the one a new member
+    // met on first contact.
+    //
+    // Deliberately still `unavailable`, and therefore still retryable: repeating
+    // the request is exactly the right move, and it succeeds within about a
+    // minute. What changes is what the reader is told, not what a client does.
+    billing_not_ready: { category: "unavailable", status: 503 },
+    // **The environment was never given this capability.** A configuration fact,
+    // not a fault and not a fluctuation: the Worker holds no provider, no secret
+    // or no binding for the thing being asked about, and it will hold none until
+    // somebody deploys different configuration.
+    //
+    // It exists because `service_unavailable` was carrying both meanings, and
+    // the retry answer differs between them. W9-06 blocked the invited cohort
+    // over billing panels that said "The service is not answering right now" for
+    // capabilities production had deliberately not turned on; W9-08 found the
+    // other half still live — the same refusal reaching a customer as
+    // `retryable`, and the CLI printing "The identical request is safe to
+    // repeat" about a condition no repetition can clear.
+    //
+    // Deliberately **not** `billing_not_ready`, which is the opposite case: that
+    // one is provisioning already in flight, finishes on its own within a
+    // minute, and is correctly retryable.
+    capability_not_configured: { category: "not-configured", status: 503 },
     credential_expired: { category: "authentication", status: 401 },
     credential_revoked: { category: "authentication", status: 401 },
     idempotency_key_reused: { category: "conflict", status: 409 },
@@ -61,7 +99,17 @@ export const PROBLEM_CODES = {
     version_conflict: { category: "conflict", status: 409 },
 };
 export const problemCodeSchema = z.enum(Object.keys(PROBLEM_CODES));
-/** Whether repeating the identical request could succeed later. */
+/**
+ * Whether repeating the identical request could succeed later.
+ *
+ * **Two 5xx categories, opposite answers, and that is the point.**
+ * `unavailable` is something that has gone wrong and will come back;
+ * `not-configured` is something that was never turned on and will not turn
+ * itself on. Reading the status alone cannot tell them apart, which is how a
+ * permanent refusal came to be published to customers as retryable — in the
+ * SDK's `retryable`, in the CLI's exit class, and as a "Try again" control the
+ * dashboard offered for a condition no amount of trying clears.
+ */
 export function isRetryable(code) {
     const category = PROBLEM_CODES[code].category;
     return category === "rate-limited" || category === "unavailable";

package/dist/protocol.d.ts

@@ -10,11 +10,11 @@ import type { FieldError } from "./problems.js";
  * scheduling book changes constantly. The cursor is opaque: clients pass back
  * exactly what they were given.
  */
-export declare const PAGE_SIZE: {
-    readonly default: 25;
-    readonly max: 100;
-    readonly min: 1;
-};
+export declare const PAGE_SIZE: Readonly<{
+    default: 25;
+    max: 100;
+    min: 1;
+}>;
 export declare const pageRequestSchema: import("zod").ZodObject<{
     cursor: import("zod").ZodOptional<import("zod").ZodString>;
     limit: import("zod").ZodDefault<import("zod").ZodNumber>;

package/dist/protocol.js

@@ -1,4 +1,5 @@
 import { z } from "./zod.js";
+import { PUBLIC_PAGE_SIZE } from "./configuration-bounds.js";
 import { endpointIdSchema, environmentIdSchema, organizationIdSchema, projectIdSchema, } from "./identifiers.js";
 import { timestampSchema } from "./time.js";
 /**
@@ -13,7 +14,7 @@ import { timestampSchema } from "./time.js";
  * scheduling book changes constantly. The cursor is opaque: clients pass back
  * exactly what they were given.
  */
-export const PAGE_SIZE = { default: 25, max: 100, min: 1 };
+export const PAGE_SIZE = PUBLIC_PAGE_SIZE;
 export const pageRequestSchema = z.object({
     cursor: z.string().min(1).optional(),
     limit: z

package/dist/scheduling-records.d.ts

@@ -129,7 +129,9 @@ export declare const portableOccurrenceRecordSchema: import("zod").ZodObject<{
 export type PortableOccurrenceRecord = z.infer<typeof portableOccurrenceRecordSchema>;
 export declare const portableAttemptRecordSchema: import("zod").ZodObject<{
     id: import("zod").ZodString;
+    localReceiptRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
     occurrence: import("zod").ZodString;
+    rescues: import("zod").ZodOptional<import("zod").ZodInt>;
     remediation: import("zod").ZodOptional<import("zod").ZodEnum<{
         none: "none";
         review_retry_policy: "review_retry_policy";
@@ -188,6 +190,7 @@ export declare const portableAttemptRecordSchema: import("zod").ZodObject<{
         network_ambiguous: "network_ambiguous";
         payload_unavailable: "payload_unavailable";
     }>>;
+    dispatchRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
     durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
     authority: import("zod").ZodObject<{
         environment: import("zod").ZodString;
@@ -229,7 +232,9 @@ export type PortableEncryptedPayloadRecord = z.infer<typeof portableEncryptedPay
 export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<{
     attempts: import("zod").ZodArray<import("zod").ZodObject<{
         id: import("zod").ZodString;
+        localReceiptRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         occurrence: import("zod").ZodString;
+        rescues: import("zod").ZodOptional<import("zod").ZodInt>;
         remediation: import("zod").ZodOptional<import("zod").ZodEnum<{
             none: "none";
             review_retry_policy: "review_retry_policy";
@@ -288,6 +293,7 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
             network_ambiguous: "network_ambiguous";
             payload_unavailable: "payload_unavailable";
         }>>;
+        dispatchRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
         authority: import("zod").ZodObject<{
             environment: import("zod").ZodString;

package/dist/scheduling.d.ts

@@ -42,6 +42,33 @@ export declare const scheduleStatusSchema: import("zod").ZodEnum<{
     cancelled: "cancelled";
 }>;
 export type ScheduleStatus = z.infer<typeof scheduleStatusSchema>;
+/**
+ * The statuses a schedule never leaves, and from which it never fires again on
+ * its own.
+ *
+ * **"Never fires again on its own" rather than "never delivers again", and the
+ * distinction is real.** A member can still press Redeliver on a completed
+ * occurrence, and the repository admits that for a `completed` schedule as well
+ * as an `active` one. What is terminal here is the schedule's own timetable, not
+ * every possible future delivery.
+ *
+ * Exported for the same reason as {@link TERMINAL_OCCURRENCE_STATES}: so a
+ * caller enumerates them rather than writing the list out and quietly missing
+ * one if another is ever added. Three places had already written it out — the
+ * `archivedAt` validator in `scheduling-records.ts`, the dashboard's schedule
+ * controls, and the dashboard's pending-action rules — and the third had missed
+ * it entirely, which is the defect this list was extracted for.
+ */
+export declare const TERMINAL_SCHEDULE_STATUSES: readonly ["cancelled", "completed"];
+/**
+ * Whether this schedule has finished, either on its own or because somebody
+ * stopped it.
+ *
+ * `paused` is deliberately not terminal: it is reversible, so a paused schedule
+ * pointed at a broken destination is still a problem worth telling somebody
+ * about.
+ */
+export declare function isTerminalScheduleStatus(status: ScheduleStatus): boolean;
 /**
  * How promptly an occurrence expects to be dispatched.
  *
@@ -738,7 +765,7 @@ export type Schedule = z.infer<typeof scheduleSchema>;
  * A page of schedules.
  *
  * Items are schedules rather than schedule *views*. A cross-partition listing is
- * served from the D1 projection W2-06 built, and that projection holds a route
+ * served from the control-plane projection W2-06 built, and that projection holds a route
  * and a summary rather than every partition's live occurrence — so a page that
  * promised an occurrence would either lie about its freshness or force the
  * listing back through every partition it spans. Detail is where the occurrence
@@ -895,7 +922,9 @@ export declare const attemptFailureSnippetSchema: import("zod").ZodObject<{
 export type AttemptFailureSnippet = z.infer<typeof attemptFailureSnippetSchema>;
 export declare const attemptSchema: import("zod").ZodObject<{
     id: import("zod").ZodString;
+    localReceiptRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
     occurrence: import("zod").ZodString;
+    rescues: import("zod").ZodOptional<import("zod").ZodInt>;
     remediation: import("zod").ZodOptional<import("zod").ZodEnum<{
         none: "none";
         review_retry_policy: "review_retry_policy";
@@ -954,6 +983,7 @@ export declare const attemptSchema: import("zod").ZodObject<{
         network_ambiguous: "network_ambiguous";
         payload_unavailable: "payload_unavailable";
     }>>;
+    dispatchRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
     durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
 }, import("zod/v4/core").$strip>;
 export type Attempt = z.infer<typeof attemptSchema>;
@@ -1074,7 +1104,9 @@ export type OccurrenceView = z.infer<typeof occurrenceViewSchema>;
 export declare const attemptPageSchema: import("zod").ZodObject<{
     data: import("zod").ZodArray<import("zod").ZodObject<{
         id: import("zod").ZodString;
+        localReceiptRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         occurrence: import("zod").ZodString;
+        rescues: import("zod").ZodOptional<import("zod").ZodInt>;
         remediation: import("zod").ZodOptional<import("zod").ZodEnum<{
             none: "none";
             review_retry_policy: "review_retry_policy";
@@ -1133,6 +1165,7 @@ export declare const attemptPageSchema: import("zod").ZodObject<{
             network_ambiguous: "network_ambiguous";
             payload_unavailable: "payload_unavailable";
         }>>;
+        dispatchRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
     }, import("zod/v4/core").$strip>>;
     nextCursor: import("zod").ZodOptional<import("zod").ZodString>;
@@ -1145,7 +1178,9 @@ export type AttemptPage = z.infer<typeof attemptPageSchema>;
 export declare const attemptViewSchema: import("zod").ZodObject<{
     attempt: import("zod").ZodObject<{
         id: import("zod").ZodString;
+        localReceiptRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         occurrence: import("zod").ZodString;
+        rescues: import("zod").ZodOptional<import("zod").ZodInt>;
         remediation: import("zod").ZodOptional<import("zod").ZodEnum<{
             none: "none";
             review_retry_policy: "review_retry_policy";
@@ -1204,6 +1239,7 @@ export declare const attemptViewSchema: import("zod").ZodObject<{
             network_ambiguous: "network_ambiguous";
             payload_unavailable: "payload_unavailable";
         }>>;
+        dispatchRecoveries: import("zod").ZodOptional<import("zod").ZodInt>;
         durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
     }, import("zod/v4/core").$strip>;
     freshness: import("zod").ZodObject<{

package/dist/scheduling.js

@@ -1,3 +1,4 @@
+import { FIXED_INTERVAL_MIN_SECONDS, FIXED_INTERVAL_MAX_SECONDS, MAX_INLINE_PAYLOAD_BYTES, } from "./configuration-bounds.js";
 import { z } from "./zod.js";
 import { attemptIdSchema, deliveryIdSchema, endpointIdSchema, occurrenceIdSchema, scheduleIdSchema, } from "./identifiers.js";
 import { CALLBACK_ATTEMPT_DIAGNOSTICS } from "./delivery.js";
@@ -46,6 +47,38 @@ export const SCHEDULE_STATUSES = [
     "completed",
 ];
 export const scheduleStatusSchema = z.enum(SCHEDULE_STATUSES);
+/**
+ * The statuses a schedule never leaves, and from which it never fires again on
+ * its own.
+ *
+ * **"Never fires again on its own" rather than "never delivers again", and the
+ * distinction is real.** A member can still press Redeliver on a completed
+ * occurrence, and the repository admits that for a `completed` schedule as well
+ * as an `active` one. What is terminal here is the schedule's own timetable, not
+ * every possible future delivery.
+ *
+ * Exported for the same reason as {@link TERMINAL_OCCURRENCE_STATES}: so a
+ * caller enumerates them rather than writing the list out and quietly missing
+ * one if another is ever added. Three places had already written it out — the
+ * `archivedAt` validator in `scheduling-records.ts`, the dashboard's schedule
+ * controls, and the dashboard's pending-action rules — and the third had missed
+ * it entirely, which is the defect this list was extracted for.
+ */
+export const TERMINAL_SCHEDULE_STATUSES = [
+    "cancelled",
+    "completed",
+];
+/**
+ * Whether this schedule has finished, either on its own or because somebody
+ * stopped it.
+ *
+ * `paused` is deliberately not terminal: it is reversible, so a paused schedule
+ * pointed at a broken destination is still a problem worth telling somebody
+ * about.
+ */
+export function isTerminalScheduleStatus(status) {
+    return TERMINAL_SCHEDULE_STATUSES.includes(status);
+}
 /**
  * How promptly an occurrence expects to be dispatched.
  *
@@ -598,7 +631,7 @@ export const SCHEDULING_BOUNDS = {
      * Widening a bound is additive by `classifyChange` and narrowing it is
      * breaking, so this direction is the safe one to move in.
      */
-    everySecondsMax: 365 * 24 * 60 * 60,
+    everySecondsMax: FIXED_INTERVAL_MAX_SECONDS,
     /**
      * The shortest fixed interval a recurring schedule may ask for, in seconds.
      *
@@ -610,7 +643,7 @@ export const SCHEDULING_BOUNDS = {
      * `classifyChange` and narrowing it is breaking, which is the direction to be
      * conservative in.
      */
-    everySecondsMin: 60,
+    everySecondsMin: FIXED_INTERVAL_MIN_SECONDS,
     /**
      * How long an idempotency receipt is honoured. A client retrying a create for
      * longer than a day is not retrying, it is making a new request; keeping
@@ -662,7 +695,7 @@ export const SCHEDULING_BOUNDS = {
      * command-shaped payloads this product is for, and refuses the ones that are
      * really a file transfer.
      */
-    payloadBytes: 65_536,
+    payloadBytes: MAX_INLINE_PAYLOAD_BYTES,
     /**
      * How soon a one-shot has to be for `realtime` to be the class it gets by
      * default, in seconds.
@@ -908,7 +941,7 @@ export const scheduleSchema = z.object({
  * A page of schedules.
  *
  * Items are schedules rather than schedule *views*. A cross-partition listing is
- * served from the D1 projection W2-06 built, and that projection holds a route
+ * served from the control-plane projection W2-06 built, and that projection holds a route
  * and a summary rather than every partition's live occurrence — so a page that
  * promised an occurrence would either lie about its freshness or force the
  * listing back through every partition it spans. Detail is where the occurrence
@@ -1037,6 +1070,12 @@ export const attemptSchema = z
     delivery: deliveryIdSchema,
     /** Safe classifier code; absent when durable evidence predates diagnostics. */
     diagnostic: attemptDiagnosticSchema.optional(),
+    /**
+     * Instrumented re-drives of the same dispatching occurrence under a new
+     * dispatch epoch. Includes deliberate admission deferrals; this is not a
+     * count of database failures or callback sends. Absent on older responses.
+     */
+    dispatchRecoveries: z.int().nonnegative().optional(),
     /** Executor-observed elapsed time; absent when no durable timing survived. */
     durationMs: z
         .number()
@@ -1046,7 +1085,24 @@ export const attemptSchema = z
         .optional(),
     ...timingEvidenceShape,
     id: attemptIdSchema,
+    /**
+     * Instrumented send authorizations granted after a later local alarm
+     * replayed the original wake receipt. Preserves the attempt and delivery
+     * identity; excludes synchronous receipt hedges and repeated authorization
+     * acknowledgements. A grant does not prove a callback left. Absent on
+     * older responses.
+     */
+    localReceiptRecoveries: z.int().nonnegative().optional(),
     occurrence: occurrenceIdSchema,
+    /**
+     * How many times the watchdog took this attempt's send back and sent it
+     * again: the send was authorized, and its outcome was never recorded
+     * before its lease expired. Each re-send uses this attempt's `delivery` id,
+     * so the receiver may have got the attempt more than once. `state` is the
+     * outcome that was recorded. The timing evidence is the earliest send
+     * known to have left. Absent when nothing was re-sent.
+     */
+    rescues: z.int().positive().optional(),
     /** Stable next-action code paired with a diagnostic when one is known. */
     remediation: attemptRemediationSchema.optional(),
     /**

package/dist/usage.js

@@ -1,4 +1,5 @@
 import { z } from "./zod.js";
+import { MAX_USAGE_WINDOW_DAYS } from "./configuration-bounds.js";
 import { timestampSchema } from "./time.js";
 /**
  * A legacy operational aggregate of terminal occurrences.
@@ -67,7 +68,7 @@ export const USAGE_BOUNDS = {
      * never older than that. It is a contract ceiling rather than a plan one: a
      * plan may bring it closer and may never push it out.
      */
-    maxWindowDays: 366,
+    maxWindowDays: MAX_USAGE_WINDOW_DAYS,
 };
 /** How a terminal occurrence ended. The four retained terminal states. */
 export const BILLABLE_TERMINAL_STATES = [
@@ -202,26 +203,10 @@ export const usageSchema = z
      */
     freshness: z.object({ kind: z.literal("authoritative") }),
     /**
-     * How much of this deployment's daily attempt allowance has been spent.
-     *
-     * **Because nothing else could say it, and something had to.** The runtime
-     * refuses admission once an organization has made
-     * `dailyAttemptCeiling` attempts in a UTC day, and defers every schedule to
-     * the next day boundary rather than failing them. Nothing lost, nothing
-     * failed — and nothing running either, for up to a day, on a product whose
-     * whole job is to run things. The operator found his own account in that
-     * state during the W4-10 walk and no screen anywhere named it: the runs
-     * read "Delivering", the dashboard had no action waiting, and the only
-     * visible trace was an unremarkable number on the billing panel.
-     *
-     * The disposition, the ceiling and the count all lived inside
-     * `DialerWorker` and `EntitlementPolicy`; neither ever left
-     * `packages/application`, and `days` above counts settled *occurrences*
-     * rather than attempts, so it could not be derived either.
-     *
-     * Absent when this deployment sets no ceiling, which is the honest shape
-     * for "there is no allowance to be near the end of" — a surface must not
-     * render a limit nobody has.
+     * Legacy daily-allowance projection, retained for installed clients and
+     * mixed-version responses. W0-15 retires the daily quota; current authority
+     * readers omit this optional object rather than querying an obsolete count.
+     * Older servers can still explain parked work to compatible dashboards.
      */
     plan: z
         .object({

package/generated/v1/examples/attempts.list.response.json

@@ -5,12 +5,14 @@
       "classifiedAt": "2026-07-28T15:00:00.071Z",
       "delivery": "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
       "diagnostic": "http_retryable",
+      "dispatchRecoveries": 0,
       "durationMs": 71,
       "firstAttemptLatenessMs": 0,
       "firstAttemptStartedAt": "2026-07-28T15:00:00.000Z",
       "timingEligibility": "eligible",
       "timingPolicyVersion": "payg-v1",
       "id": "att_01h8xyz9k2m4n6p8r0t2v4w6y8",
+      "localReceiptRecoveries": 0,
       "occurrence": "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
       "remediation": "review_retry_policy",
       "responseStatus": 503,

package/generated/v1/examples/attempts.read.response.json

@@ -4,12 +4,14 @@
     "classifiedAt": "2026-07-28T15:02:00.000Z",
     "delivery": "dlv_11h8xyz9k2m4n6p8r0t2v4w6y8",
     "diagnostic": "network_ambiguous",
+    "dispatchRecoveries": 2,
     "durationMs": 10000,
     "firstAttemptLatenessMs": 0,
     "firstAttemptStartedAt": "2026-07-28T15:00:00.000Z",
     "timingEligibility": "eligible",
     "timingPolicyVersion": "payg-v1",
     "id": "att_11h8xyz9k2m4n6p8r0t2v4w6y8",
+    "localReceiptRecoveries": 1,
     "occurrence": "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
     "remediation": "review_before_redelivery",
     "startedAt": "2026-07-28T15:01:50.000Z",