@lostgradient/weft 0.10.0 → 0.12.0

package/dist/client/http-operations.js

@@ -6,6 +6,9 @@ function isJsonRpcFailure(value) {
 function isJsonRpcSuccess(value) {
   return typeof value === "object" && value !== null && "result" in value;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 export function httpClientCatalogTransport(baseUrl, headers) {
   const endpoint = `${baseUrl}/jsonrpc`;
   return async (operationName, input) => {
@@ -27,7 +30,10 @@ export function httpClientCatalogTransport(baseUrl, headers) {
     }
     if (isJsonRpcFailure(body)) {
       const { message, data } = body.error, httpStatus = typeof data?.httpStatus === "number" ? data.httpStatus : response.status, faultCode = isFaultCode(data?.weftCode) ? data.weftCode : void 0;
-      throw new HttpClientError(httpStatus, message, { faultCode });
+      throw new HttpClientError(httpStatus, message, {
+        faultCode,
+        data: isRecord(data) ? data : void 0
+      });
     }
     if (isJsonRpcSuccess(body))
       return body.result;

package/dist/client/http-request.d.ts

@@ -67,7 +67,11 @@ export declare function resolveHttpClientConnection(options: HttpClientOptions):
  * the wire fault `code` is surfaced as {@link HttpClientError.faultCode} and a
  * derived {@link HttpClientError.category} so callers can branch programmatically
  * instead of string-matching `message`. Both are `undefined` when the body is a
- * plain `{ error: string }` or carries no recognized code.
+ * plain `{ error: string }` or carries no recognized code. The fault's typed
+ * `data` payload (e.g. `InvalidParams`'s `issues`, `NotFound`/`Conflict`'s
+ * `resource`/`identifier`) is surfaced verbatim as {@link HttpClientError.data}
+ * when the body carries a structured `data` object; `undefined` otherwise —
+ * including for a masked `EngineFailure`, whose flat body carries no `data`.
  *
  * @example
  * ```ts
@@ -110,9 +114,27 @@ export declare class HttpClientError extends WeftError<'HttpClientError'> {
      * carried only the coarse {@link faultCode} (most faults) or no structured body.
      */
     readonly weftCode?: WeftErrorCode | undefined;
+    /**
+     * The fault's wire `data` payload, when the response carried a structured
+     * body (`{ error: { data } }` for REST, `error.data` for JSON-RPC). Shape is
+     * fault-code-dependent — see {@link FaultCode} and the server's
+     * `OperationFault` per-code `data` union for what each code carries (e.g.
+     * `InvalidParams.data.issues`, `NotFound.data.resource`). `undefined` for
+     * plain-string error bodies, bodies with no `data` field, or a `data` field
+     * that is not a JSON object.
+     *
+     * Over JSON-RPC-over-HTTP this is the raw envelope `error.data` verbatim
+     * (see `httpClientCatalogTransport` in `http-operations.ts`), so it also
+     * carries the envelope's own `weftCode` (the coarse {@link FaultCode}, not
+     * a fine-grained {@link WeftErrorCode}) and `httpStatus` keys alongside the
+     * per-code payload — those two are not part of the `OperationFault` data
+     * union.
+     */
+    readonly data?: Readonly<Record<string, unknown>> | undefined;
     constructor(status: number, message: string, options?: {
         faultCode?: FaultCode | undefined;
         weftCode?: WeftErrorCode | undefined;
+        data?: Readonly<Record<string, unknown>> | undefined;
     });
 }
 export declare function request<T>(baseUrl: string, path: string, baseHeaders: Record<string, string>, options?: RequestInit): Promise<T>;

package/dist/client/http-request.js

@@ -17,12 +17,14 @@ export class HttpClientError extends WeftError {
   faultCode;
   category;
   weftCode;
+  data;
   constructor(status, message, options) {
     super("HttpClientError", message);
     this.status = status;
     this.faultCode = options?.faultCode;
     this.category = options?.faultCode === void 0 ? void 0 : failureCategoryForFaultCode(options.faultCode);
     this.weftCode = options?.weftCode;
+    this.data = options?.data;
   }
 }
 function buildRequestHeaders(baseHeaders, options) {
@@ -53,11 +55,18 @@ function weftCodeFromData(data) {
   const candidate = data.weftCode;
   return isWeftErrorCode(candidate) ? candidate : void 0;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function parseErrorBody(response) {
   try {
     const body = await response.json();
     if (isStructuredErrorBody(body)) {
-      const { code, message, data } = body.error, weftCode = weftCodeFromData(data), base = weftCode === void 0 ? { message } : { message, weftCode };
+      const { code, message, data } = body.error, weftCode = weftCodeFromData(data), base = { message };
+      if (weftCode !== void 0)
+        base.weftCode = weftCode;
+      if (isRecord(data))
+        base.data = data;
       return isFaultCode(code) ? { ...base, faultCode: code } : base;
     }
     if (isFlatErrorBody(body) && body.error) {
@@ -74,8 +83,8 @@ export async function request(baseUrl, path, baseHeaders, options) {
   if (response.status === 404 && (!options?.method || options.method === "GET"))
     return null;
   if (!response.ok) {
-    const { message, faultCode, weftCode } = await parseErrorBody(response);
-    throw new HttpClientError(response.status, message, { faultCode, weftCode });
+    const { message, faultCode, weftCode, data } = await parseErrorBody(response);
+    throw new HttpClientError(response.status, message, { faultCode, weftCode, data });
   }
   if (response.status === 204)
     return;

package/dist/client/index.d.ts

@@ -7,6 +7,8 @@
  *
  * @module client/index
  */
+export { isWeftError, isWeftErrorCode, isWeftErrorLike, isWeftFault, WeftError, } from '../core/weft-error.ts';
+export type { WeftErrorCode } from '../core/weft-error.ts';
 export type { WorkflowEventStreamOptions, WorkflowEventTransport } from './event-stream-options.ts';
 export type { WorkflowEventTail } from './event-tail.ts';
 export { HttpClient } from './http-client.ts';

package/dist/client/index.js

@@ -1,2 +1,9 @@
+export {
+  isWeftError,
+  isWeftErrorCode,
+  isWeftErrorLike,
+  isWeftFault,
+  WeftError
+} from "../core/weft-error.js";
 export { HttpClient } from "./http-client.js";
 export { HttpClientError } from "./http-request.js";

package/dist/connection.d.ts

@@ -14,6 +14,14 @@
  * A profile token is only applied when neither an explicit `server` option nor
  * `WEFT_ADDR` redirected the request to a different destination.
  *
+ * This module is imported from `@lostgradient/weft/client` (browser-reachable),
+ * so it must stay statically free of `node:*` and Bun-only imports. Environment
+ * variables go through {@link readEnvironmentVariable}; `~/.weft/config` and the
+ * run lockfile are read through {@link tryLoadNodeBuiltin}, which resolves
+ * `node:fs`/`node:fs/promises` via `process.getBuiltinModule` instead of a
+ * static import. Both return `undefined` outside Bun/Node, so a browser caller
+ * that supplies explicit `server`/`token` never touches either.
+ *
  * @module connection
  */
 /**

package/dist/connection.js

@@ -1,5 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
-import { mkdir, rm } from "node:fs/promises";
+import { isBunRuntime, readEnvironmentVariable, tryLoadNodeBuiltin } from "./runtime/portable.js";
 export const DEFAULT_WEFT_ADDRESS = "http://localhost:7233";
 
 export class ConnectionConfigurationError extends Error {
@@ -9,7 +8,7 @@ export class ConnectionConfigurationError extends Error {
   }
 }
 export function resolveConnection(options = {}) {
-  const context = resolveConnectionContext(options), server = resolveServerString(context), fallbackProfile = profileForToken(context, server), token = resolveToken(options.token ?? Bun.env.WEFT_TOKEN, fallbackProfile);
+  const context = resolveConnectionContext(options), server = resolveServerString(context), fallbackProfile = profileForToken(context, server), token = resolveToken(options.token ?? readEnvironmentVariable("WEFT_TOKEN"), fallbackProfile);
   return {
     server: parseServerUrl(server),
     ...token === void 0 ? {} : { token }
@@ -26,7 +25,7 @@ function parseServerUrl(server) {
 function profileForToken(context, resolvedServer) {
   if (context.profile === void 0)
     return;
-  if (!(context.options.server !== void 0 || Bun.env.WEFT_ADDR !== void 0))
+  if (!(context.options.server !== void 0 || readEnvironmentVariable("WEFT_ADDR") !== void 0))
     return context.profile;
   const profileServer = context.profile.server;
   if (profileServer === void 0)
@@ -44,7 +43,7 @@ function sameDestination(a, b) {
   return left.origin === right.origin && left.pathname.replace(/\/+$/, "") === right.pathname.replace(/\/+$/, "");
 }
 function resolveConnectionContext(options) {
-  const configuration = readWeftConfiguration(), profileName = options.profile ?? Bun.env.WEFT_PROFILE ?? configuration.defaultProfile, profile = profileName === void 0 ? void 0 : configuration.profiles?.[profileName], runLockfile = options.includeRunLockfile === !1 ? void 0 : readRunLockfile();
+  const configuration = readWeftConfiguration(), profileName = options.profile ?? readEnvironmentVariable("WEFT_PROFILE") ?? configuration.defaultProfile, profile = profileName === void 0 ? void 0 : configuration.profiles?.[profileName], runLockfile = options.includeRunLockfile === !1 ? void 0 : readRunLockfile();
   return {
     options,
     ...profile === void 0 ? {} : { profile },
@@ -52,12 +51,26 @@ function resolveConnectionContext(options) {
   };
 }
 function resolveServerString(context) {
-  return context.options.server ?? Bun.env.WEFT_ADDR ?? context.profile?.server ?? context.runLockfile?.server ?? context.runLockfile?.url ?? DEFAULT_WEFT_ADDRESS;
+  return context.options.server ?? readEnvironmentVariable("WEFT_ADDR") ?? context.profile?.server ?? context.runLockfile?.server ?? context.runLockfile?.url ?? DEFAULT_WEFT_ADDRESS;
+}
+function loadFsModule() {
+  return tryLoadNodeBuiltin("node:fs");
+}
+function loadFsPromisesModule() {
+  return tryLoadNodeBuiltin("node:fs/promises");
 }
 export async function writeRunLockfile(server) {
-  await mkdir(weftHome(), { recursive: !0 });
-  await Bun.write(runLockfilePath(), `${JSON.stringify({ server }, null, 2)}
-`);
+  const fsPromises = loadFsPromisesModule();
+  if (fsPromises === void 0)
+    throw Error("writeRunLockfile requires Bun or Node 22.5+ (process.getBuiltinModule); not available in this runtime.");
+  await fsPromises.mkdir(weftHome(), { recursive: !0 });
+  const contents = `${JSON.stringify({ server }, null, 2)}
+`;
+  if (isBunRuntime()) {
+    await Bun.write(runLockfilePath(), contents);
+    return;
+  }
+  await fsPromises.writeFile(runLockfilePath(), contents, "utf8");
 }
 export async function removeRunLockfile(server) {
   const lockfile = readRunLockfile();
@@ -65,15 +78,23 @@ export async function removeRunLockfile(server) {
     return;
   if ((lockfile.server ?? lockfile.url) !== server)
     return;
-  await rm(runLockfilePath(), { force: !0 });
+  const fsPromises = loadFsPromisesModule();
+  if (fsPromises === void 0)
+    return;
+  await fsPromises.rm(runLockfilePath(), { force: !0 });
 }
 function readWeftConfiguration() {
+  if (!isBunRuntime())
+    return {};
+  const fs = loadFsModule();
+  if (fs === void 0)
+    return {};
   const path = configurationPath();
-  if (!existsSync(path))
+  if (!fs.existsSync(path))
     return {};
   let parsed;
   try {
-    parsed = Bun.TOML.parse(readFileSync(path, "utf8"));
+    parsed = Bun.TOML.parse(fs.readFileSync(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new ConnectionConfigurationError(`Failed to read connection configuration at ${path}: ${message}`);
@@ -81,10 +102,13 @@ function readWeftConfiguration() {
   return normalizeConfiguration(parsed);
 }
 function readRunLockfile() {
+  const fs = loadFsModule();
+  if (fs === void 0)
+    return;
   const path = runLockfilePath();
-  if (!existsSync(path))
+  if (!fs.existsSync(path))
     return;
-  const text = readFileSync(path, "utf8").trim();
+  const text = fs.readFileSync(path, "utf8").trim();
   if (text === "")
     return;
   try {
@@ -137,11 +161,11 @@ function normalizeRunLockfile(value) {
 function resolveToken(token, profile) {
   const directToken = token ?? profile?.token;
   if (directToken?.startsWith("env:"))
-    return Bun.env[directToken.slice(4)];
+    return readEnvironmentVariable(directToken.slice(4));
   if (directToken !== void 0)
     return directToken;
   if (profile?.tokenEnv !== void 0)
-    return Bun.env[profile.tokenEnv];
+    return readEnvironmentVariable(profile.tokenEnv);
   return;
 }
 function configurationPath() {
@@ -151,7 +175,7 @@ function runLockfilePath() {
   return `${weftHome()}/run`;
 }
 function weftHome() {
-  return Bun.env.WEFT_HOME ?? `${Bun.env.HOME ?? "."}/.weft`;
+  return readEnvironmentVariable("WEFT_HOME") ?? `${readEnvironmentVariable("HOME") ?? "."}/.weft`;
 }
 function stringValue(value) {
   return typeof value === "string" && value !== "" ? value : void 0;

package/dist/core/checkpoint/serialization.js

@@ -29,7 +29,7 @@ export function validateCheckpointShape(value) {
   validateAccumulatedResultReplayWatermark(record);
   validateWorkerReplaySignatures(record);
   validateWorkerReplayFailures(record);
-  dropLegacyPendingSignals(record);
+  dropRetiredPendingSignals(record);
   assertRecordField(record, "searchAttributes");
   assertStringField(record, "version");
   assertNumberField(record, "createdAt");
@@ -148,7 +148,7 @@ function validateAccumulatedResultReplayWatermark(record) {
   if (typeof watermark !== "number" || !Number.isSafeInteger(watermark) || watermark < 0)
     throw Error('Invalid checkpoint: invalid "accumulatedResultReplayWatermark" (expected non-negative safe integer)');
 }
-function dropLegacyPendingSignals(record) {
+function dropRetiredPendingSignals(record) {
   delete record.pendingSignals;
 }
 function assertCurrentSchemaVersion(record) {

package/dist/core/engine/callback-creators-core.js

@@ -77,7 +77,8 @@ export function createLifecycleCallbacks(engine) {
     enforceHistoryCircuitBreaker: (workflowId) => terminateWorkflow(getInternals(engine), workflowId, "timed-out", createTerminationCallbacks(engine), HISTORY_CIRCUIT_BREAKER_REASON),
     failWorkflowForUnavailableServices: (workflowId, error) => failWorkflow(getInternals(engine), workflowId, error, createTerminationCallbacks(engine), "system"),
     failWorkflowForRecoveryHook: (workflowId, error) => failWorkflow(getInternals(engine), workflowId, error, createTerminationCallbacks(engine), "system"),
-    failWorkflowForCheckpointDecodeError: (workflowId, error) => failWorkflow(getInternals(engine), workflowId, error, createTerminationCallbacks(engine), "system")
+    failWorkflowForCheckpointDecodeError: (workflowId, error) => failWorkflow(getInternals(engine), workflowId, error, createTerminationCallbacks(engine), "system"),
+    failWorkflowForVersionMismatch: (workflowId, error) => failWorkflow(getInternals(engine), workflowId, error, createTerminationCallbacks(engine), "system")
   };
 }
 export function createTerminationCallbacksWith(engine, handleScheduledWorkflowTerminal) {

package/dist/core/engine/disposal.js

@@ -1,6 +1,7 @@
 import { disposeEngineCleanupInterval } from "./engine-runtime-helpers.js";
 import { EngineDisposedError } from "./errors.js";
 import { disposeQueuedInlineWorkflowStarts } from "./inline-launch-queue.js";
+import { rejectAllSleepTimerAcknowledgements } from "./sleep-timer-acknowledgements.js";
 export function disposeEngine(internals) {
   internals.disposed = !0;
   internals.alertManager?.[Symbol.dispose]();
@@ -30,6 +31,7 @@ export function disposeEngine(internals) {
   internals.handleCache.clear();
   for (const waiter of internals.resultResolvers.values())
     waiter.reject(new EngineDisposedError);
+  rejectAllSleepTimerAcknowledgements(internals, new EngineDisposedError);
   internals.resultResolvers.clear();
   internals.updateWaiters.clear();
   internals.updateWaitersByWorkflow.clear();
@@ -46,6 +48,8 @@ export function disposeEngine(internals) {
   internals.pendingWebhooks.clear();
   internals.sleepResolvers.clear();
   internals.sleepResolversByWorkflow.clear();
+  internals.sleepTimerAcknowledgementWaiters.clear();
+  internals.durableInlineOperations.clear();
   internals.sleepTimersFiredWithoutResolver.clear();
   internals.checkpoints.clear();
   internals.pendingExecutionStateOwnerId = void 0;

package/dist/core/engine/engine-leak-warnings.d.ts

@@ -15,6 +15,8 @@ export type EngineCleanupIntervalDisposalTracker = {
     testToken: symbol | undefined;
 };
 export declare const engineCleanupIntervalFinalizer: FinalizationRegistry<EngineCleanupIntervalDisposalTracker>;
+/** Test-only hook for the finalizer callback's synchronous warning gate. */
+export declare function finalizeEngineCleanupIntervalTrackerForTesting(tracker: EngineCleanupIntervalDisposalTracker): void;
 export declare function shouldEmitEngineLeakWarning(): boolean;
 /** Test-only override for the engine leak-warning environment gate. */
 export declare function setEngineLeakWarningOverrideForTesting(value: boolean | undefined): void;

package/dist/core/engine/engine-leak-warnings.js

@@ -1,6 +1,6 @@
 let engineLeakWarningOverrideForTesting, engineLeakCollectionCountForTesting = 0, nextEngineLeakWarningTokenForTesting;
 const engineLeakWarningTokensForTesting = new Set;
-export const engineCleanupIntervalFinalizer = new FinalizationRegistry((tracker) => {
+function finalizeEngineCleanupIntervalTracker(tracker) {
   engineLeakCollectionCountForTesting++;
   if (tracker.cleanupInterval !== null) {
     clearInterval(tracker.cleanupInterval);
@@ -15,7 +15,13 @@ export const engineCleanupIntervalFinalizer = new FinalizationRegistry((tracker)
       engineLeakWarningTokensForTesting.add(tracker.testToken);
     process.emitWarning("WeftEngineLeakWarning: A Weft Engine was garbage-collected without calling [Symbol.dispose](). Use `using`, `await using`, or call engine[Symbol.dispose]() to clear background timers and release runtime resources.");
   }
+}
+export const engineCleanupIntervalFinalizer = new FinalizationRegistry((tracker) => {
+  finalizeEngineCleanupIntervalTracker(tracker);
 });
+export function finalizeEngineCleanupIntervalTrackerForTesting(tracker) {
+  finalizeEngineCleanupIntervalTracker(tracker);
+}
 export function shouldEmitEngineLeakWarning() {
   if (engineLeakWarningOverrideForTesting !== void 0)
     return engineLeakWarningOverrideForTesting;

package/dist/core/engine/index.d.ts

@@ -220,9 +220,12 @@ export declare class Engine<TWorkflows extends object = DefaultWorkflowRegistry,
      * (signal-with-start). With an absent target, the workflow record and the
      * first signal commit in one batch and the freshly-launched run consumes the
      * signal on its first drive. A non-terminal target (running, pending, or
-     * suspended) is signalled through the normal signal path; a terminal target
-     * throws {@link StartOrSignalConflictError} unless
-     * `options.onTerminalConflict: 'start-new'` is supplied with an explicit
+     * suspended) is signalled through a workflow-serialized signal path. If
+     * terminal completion wins that handoff, the target is treated as terminal:
+     * the default path throws {@link StartOrSignalConflictError}, while
+     * `options.onTerminalConflict: 'start-new'` transfers the signal to the
+     * replacement run. A terminal target throws {@link StartOrSignalConflictError}
+     * unless `options.onTerminalConflict: 'start-new'` is supplied with an explicit
      * workflow id and deterministic `signal.signalId`.
      *
      * Concurrent callers converge on one workflow and one delivered signal. Pass
@@ -368,6 +371,12 @@ export declare class Engine<TWorkflows extends object = DefaultWorkflowRegistry,
      * deploys or explicit operator storage repair.
      * When set, unknown workflow types are skipped and reported through
      * {@link WorkflowRecoverySkippedEvent}.
+     *
+     * A recovered workflow whose persisted version metadata no longer matches
+     * its registered `WorkflowDefinition.version` is isolated per
+     * {@link RecoverAllOptions.versionMismatchPolicy} (default `'fail-run'`):
+     * only that workflow fails, and `recoverAll()` continues recovering its
+     * siblings in the same call.
      */
     recoverAll(options?: RecoverAllOptions): Promise<WorkflowHandle[]>;
     /**
@@ -487,3 +496,40 @@ export declare class Engine<TWorkflows extends object = DefaultWorkflowRegistry,
      */
     fireTimer(entry: TimerEntry): Promise<void>;
 }
+/**
+ * `Engine` with its two chained-builder registration methods removed —
+ * `register` and `registerWorkflows`, whose return type is itself
+ * `Engine<NarrowedRegistry>` (see `register()`'s JSDoc: registering returns
+ * "this same engine with the definition added to its phantom type
+ * registry"). That self-reference is what makes `Engine` invariant in its
+ * registry generics: a concretely narrowed `Engine<Concrete>` (e.g. from
+ * `Engine.create({ workflows })`) is not structurally assignable to the
+ * plain default `Engine<DefaultWorkflowRegistry>`, even though every other
+ * member — including `start` and `startOrSignal`, whose *parameter* types
+ * (not return types) reference `TWorkflows` but never produce another
+ * `Engine<T>` — is not part of that recursive comparison.
+ *
+ * `start` and `startOrSignal` are deliberately KEPT (not omitted): hosted
+ * transports genuinely call them at runtime (REST/JSON-RPC workflow starts,
+ * MCP tool invocations) via `runtimeWorkflowEngine()`'s registry-erased
+ * dynamic-name overload, so a value satisfying this type must still provide
+ * them — a duck-typed engine substitute lacking `start` correctly fails to
+ * satisfy `RegistryAgnosticEngine` (see this type's `.test-d.ts` coverage).
+ *
+ * Host-facing options that accept an already-constructed `Engine` without
+ * needing the two chained-builder registration methods — `serve({ engine })`,
+ * the Service Worker helpers, the MCP session/HTTP/stdio surfaces — use this
+ * type instead of the bare default `Engine`, so both `new Engine({ storage })`
+ * and `Engine.create({ workflows })` are accepted without a call-site cast.
+ * See #708.
+ *
+ * (`Engine<object, object>` looks like the obvious fix — the widest legal
+ * instantiation of the registry generics — but TypeScript's structural check
+ * on `register()`'s self-referential return type does not reliably resolve
+ * that relationship: it can pass or fail for the identical `Engine<A>` /
+ * `Engine<B>` pair depending on unrelated compilation context, such as other
+ * files in the same program. Removing the registry-typed members entirely,
+ * rather than widening their generic arguments, avoids the recursive
+ * comparison altogether.)
+ */
+export type RegistryAgnosticEngine = Omit<Engine, 'register' | 'registerWorkflows'>;

package/dist/core/engine/index.js

@@ -74,7 +74,11 @@ import {
   shouldStartEngineScheduler,
   validateEngineCreateBackgroundTaskOptions
 } from "./engine-runtime-helpers.js";
-import { EngineCreateNameMismatchError, EngineDisposedError } from "./errors.js";
+import {
+  EngineCreateNameMismatchError,
+  EngineDisposedError,
+  StartOrSignalConflictError
+} from "./errors.js";
 import { assertLeaseHeldForEngineWork, commitFencedEngineWrite } from "./fenced-write.js";
 import { recordFinalizerState } from "./finalizer-state.js";
 import {
@@ -145,7 +149,11 @@ import {
   createSecondInstanceDetector
 } from "./second-instance-detector.js";
 import { signal as signalWorkflow } from "./signals.js";
-import { loadScheduleState, loadWorkflowState } from "./storage-io.js";
+import {
+  loadScheduleState,
+  loadWorkflowState,
+  runSerializedWorkflowStateWrite
+} from "./storage-io.js";
 import {
   feedOperationResult,
   getComposedWorkflowInterceptor,
@@ -163,6 +171,7 @@ import {
   submitCoordinatedUpdate as submitCoordinatedUpdateFromInternals,
   update as updateFromInternals
 } from "./updates.js";
+import { isTerminalWorkflowStatus } from "./validation.js";
 import { coerceScheduleId } from "./validation/schedule.js";
 import {
   replayWorkflowFeed,
@@ -280,6 +289,8 @@ export class Engine extends EventTarget {
     getInternals(this).updateWaitersByWorkflow = new Map;
     getInternals(this).sleepResolvers = new Map;
     getInternals(this).sleepResolversByWorkflow = new Map;
+    getInternals(this).sleepTimerAcknowledgementWaiters = new Map;
+    getInternals(this).durableInlineOperations = new Map;
     getInternals(this).sleepTimersFiredWithoutResolver = new Map;
     getInternals(this).interceptors = resolveEngineInterceptors(options);
     getInternals(this).composedWorkflowInterceptor = void 0;
@@ -568,7 +579,12 @@ export class Engine extends EventTarget {
   #createStartOrSignalCallbacks() {
     return {
       ...this.#createLifecycleCallbacks(),
-      signalExistingWorkflow: (workflowId, signalName, payload, signalId) => this.signal(workflowId, signalName, payload, { signalId })
+      signalExistingWorkflow: (workflowId, signalName, payload, signalId) => runSerializedWorkflowStateWrite(getInternals(this), workflowId, async () => {
+        const state = await loadWorkflowState(getInternals(this), workflowId);
+        if (state && isTerminalWorkflowStatus(state.status))
+          throw new StartOrSignalConflictError(workflowId, state.status);
+        await this.signal(workflowId, signalName, payload, { signalId });
+      })
     };
   }
   getHandle(workflowId) {

package/dist/core/engine/inline-parking.js

@@ -2,6 +2,10 @@ import { hasExposedAccessors, hasUpdateHandlers } from "../context/context-prese
 import {
   resumeWorkflowFromStorage as resumeWorkflowFromStorageFromLifecycle
 } from "./lifecycle.js";
+import {
+  recordDurableInlineOperation,
+  rejectSleepTimerAcknowledgements
+} from "./sleep-timer-acknowledgements.js";
 import {
   completeWorkflow as completeWorkflowFromTermination,
   failWorkflow as failWorkflowFromTermination
@@ -53,7 +57,7 @@ export async function getParkedWorkflowResumeDisposition(internals, workflowId,
     return "corrupt";
   return "resumable";
 }
-export async function handleStrategyMessage(internals, message, callbacks) {
+async function dispatchStrategyMessage(internals, message, callbacks) {
   switch (message.type) {
     case "completed":
       await completeWorkflowFromTermination(internals, message.workflowId, message.result, callbacks.createTerminationCallbacks());
@@ -68,6 +72,7 @@ export async function handleStrategyMessage(internals, message, callbacks) {
     case "checkpoint": {
       const operation = callbacks.translateOperationRequest(message.operationRequest);
       await callbacks.persistCheckpoint(message.workflowId, operation, message.checkpoint);
+      recordDurableInlineOperation(internals, message.workflowId, operation);
       callbacks.validateDevelopmentCheckpoint(message.workflowId);
       if (await callbacks.evaluateConstraints(message.workflowId))
         break;
@@ -85,3 +90,11 @@ export async function handleStrategyMessage(internals, message, callbacks) {
     }
   }
 }
+export async function handleStrategyMessage(internals, message, callbacks) {
+  try {
+    await dispatchStrategyMessage(internals, message, callbacks);
+  } catch (error) {
+    rejectSleepTimerAcknowledgements(internals, message.workflowId, error);
+    throw error;
+  }
+}

package/dist/core/engine/internals.d.ts

@@ -22,6 +22,7 @@ import type { AlertManager } from '../../alerting/alert-manager.ts';
 import type { Storage as WeftStorage } from '../../storage/interface.ts';
 import type { ActivityWorkerDispatcher } from '../../workers/activity-worker-dispatcher.ts';
 import type { ActivityRegistry } from '../activity-registry.ts';
+import type { ContextOperationRequest } from '../context.ts';
 import type { EventHeadRecord } from '../event-log.ts';
 import type { ExecutionStrategy } from '../execution-strategy.ts';
 import type { InlineExecutionStrategy } from '../inline-execution-strategy.ts';
@@ -39,6 +40,17 @@ import type { WorkflowFeedListener } from './index.ts';
 import type { LeaseManager } from './lease-manager.ts';
 import type { ScheduleHandleEngine } from './schedule-handle.ts';
 import type { SecondInstanceDetector } from './second-instance-detector.ts';
+export type SleepTimerAcknowledgementWaiter = {
+    fireAt: number;
+    operationId: string;
+    reject: (error: Error) => void;
+    resolve: () => void;
+};
+export type DurableInlineOperation = {
+    operationId: string;
+    scheduledFireAt?: number;
+    type: ContextOperationRequest['type'];
+};
 type EngineRuntime = WorkflowHandleEngine & ScheduleHandleEngine & {
     start(type: string, input: unknown, options?: StartWorkflowOptions): Promise<WorkflowHandle>;
 };
@@ -102,6 +114,15 @@ export interface EngineInternals {
         fireAt: number;
     }>;
     sleepResolversByWorkflow: Map<string, Set<string>>;
+    /**
+     * Fired sleep timers awaiting proof that the awakened inline workflow reached
+     * its next durable checkpoint or terminal state. External schedulers must not
+     * delete a timer before these waiters settle, or a Service Worker eviction can
+     * lose the only durable wake-up between resolver settlement and checkpointing.
+     */
+    sleepTimerAcknowledgementWaiters: Map<string, Set<SleepTimerAcknowledgementWaiter>>;
+    /** Most recently persisted inline operation, used to reject stale sleep-timer callbacks. */
+    durableInlineOperations: Map<string, DurableInlineOperation>;
     /**
      * Per-workflow maps of `operationId` → fired timer `fireAt` for sleep timers
      * the scheduler tick fired before the resolver was registered. Keyed by

package/dist/core/engine/lifecycle/shared.d.ts

@@ -57,6 +57,22 @@ export type RecoverAllOptions = {
      * recovery continues with its siblings.
      */
     onRecoveredWorkflow?: (info: RecoveredWorkflowInfo) => void | Promise<void>;
+    /**
+     * Policy for a recovered workflow whose stored {@link WorkflowVersionTuple}
+     * (or legacy checkpoint `version`) no longer matches the registered
+     * {@link WorkflowDefinition.version}. The mismatch is detected before
+     * `resolveWorkflowServices` and `onRecoveredWorkflow` run for that workflow,
+     * so a mismatched run never re-provides services or invokes the hook.
+     *
+     * - `'fail-run'` (default): fail only the mismatched run to a terminal
+     *   `failed` state with a `system` failure category carrying the
+     *   {@link VersionMismatchError} message, then continue recovering its
+     *   siblings. The run never advances user workflow code.
+     * - `'throw'`: preserve the pre-#702 behavior — rethrow the
+     *   {@link VersionMismatchError} out of `recoverAll()` immediately, aborting
+     *   recovery for every workflow not yet processed in this batch.
+     */
+    versionMismatchPolicy?: 'fail-run' | 'throw';
 };
 export type LifecycleCallbacks = {
     dispatchEvent: (event: Event) => void;
@@ -97,6 +113,15 @@ export type LifecycleCallbacks = {
      * other workflows from the same storage backend.
      */
     failWorkflowForCheckpointDecodeError: (workflowId: string, error: Error) => Promise<void>;
+    /**
+     * Force a recovered workflow to a terminal `failed` state because its
+     * persisted version metadata no longer matches the registered
+     * `WorkflowDefinition.version` (a {@link VersionMismatchError}). Fails just
+     * this run with a `system` failure category so `recoverAll()` can continue
+     * recovering other workflows under the default `'fail-run'`
+     * {@link RecoverAllOptions.versionMismatchPolicy}.
+     */
+    failWorkflowForVersionMismatch: (workflowId: string, error: Error) => Promise<void>;
 };
 /**
  * Pre-replay history circuit breaker. Called at every restore-from-checkpoint