@voltro/workflow 0.84.0 → 0.86.0

package/dist/index.d.ts

@@ -2,28 +2,28 @@ import { Cause } from 'effect';
 import { ColumnBuilder } from '@voltro/database';
 import { Context } from 'effect';
 import { DataStore } from '@voltro/database';
-import { DurableClock as durableClock } from '@effect/workflow';
-import { DurableQueue as durableQueueModule } from '@effect/workflow';
-import { DurableRateLimiter as durableRateLimiterModule } from '@effect/workflow';
+import { DurableClock as durableClock } from 'effect/workflow';
+import { DurableQueue as durableQueueModule } from 'effect/workflow';
 import { Duration } from 'effect';
 import { Effect } from 'effect';
-import { FiberRef } from 'effect';
 import { FieldBinding } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
 import { FieldDefinitions } from '@voltro/database';
 import { Layer } from 'effect';
-import { ParseResult } from 'effect';
+import { Predicate } from '@voltro/database';
 import { QueryDescriptor } from '@voltro/database';
+import { RateLimiter } from 'effect/persistence';
 import { Row } from '@voltro/database';
 import { Schema } from 'effect';
 import { SchemaTable } from '@voltro/database';
-import { Activity as stepModule } from '@effect/workflow';
+import { Activity as stepModule } from 'effect/workflow';
 import { Subject } from '@voltro/protocol';
 import { Table } from '@voltro/database';
 import { TableLike } from '@voltro/database';
 import { WorkflowAccessOptions } from '@voltro/protocol';
-import { WorkflowEngine } from '@effect/workflow';
-import { Workflow as workflowModule } from '@effect/workflow';
+import { WorkflowEngine } from 'effect/workflow';
+import { WorkflowInstance } from 'effect/workflow/WorkflowEngine';
+import { Workflow as workflowModule } from 'effect/workflow';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
 import { WorkflowQueuedCancellationResult } from '@voltro/protocol';
 import { WorkflowRestartObservation } from '@voltro/protocol';
@@ -96,8 +96,8 @@ export declare type AdmissionDecision = {
     readonly deadlineAt?: number;
     /** `'replace'` — one pending row per key, newest payload wins (debounce).
      *  `'append'`  — one row per item, they accumulate (batch).
-     *  `'hold'`    — the row already exists and only its `dueAt` moves
-     *                (throttle / concurrency / paused re-checks). */
+     *  `'hold'`    — retain the existing row; persist only a changed future
+     *                deadline (throttle / concurrency / paused re-checks). */
     readonly collapse: 'replace' | 'append' | 'hold';
     readonly keys: AdmissionKeys;
 } | {
@@ -220,6 +220,11 @@ export declare interface AdmissionKeys {
     readonly priority: number;
 }
 
+/** Unknown acceptance cannot expire into proof of spare capacity. Only an
+ * acknowledged execution uses the ordinary crash backstop. Share this rule
+ * between admission decisions and read-only capacity observations. */
+export declare const admissionLeaseHeldPredicate: (now: number) => Predicate;
+
 export declare const ADMISSIONS_TABLE = "_voltro_workflow_admissions";
 
 /** What the store observed for these keys. Every field optional: the store only
@@ -257,6 +262,31 @@ export declare interface AdmissionState {
  * or a batch that has accumulated additional items. */
 export declare type AdmissionSubmission = typeof SubmissionSchema.Type;
 
+export declare type AdmissionSubmissionRetryInspection = {
+    readonly kind: 'eligible';
+    readonly submissionId: string;
+    readonly expected: AdmissionSubmissionRetryToken;
+} | {
+    readonly kind: 'refused';
+    readonly submissionId: string;
+    readonly reason: AdmissionSubmissionRetryRefusal;
+};
+
+export declare type AdmissionSubmissionRetryRefusal = 'missing-submission' | 'incomplete-transfer' | 'accepted' | 'rejected' | 'prepared-execution' | 'dispatch-attempted' | 'not-stopped' | 'changed-retry' | 'missing-lease' | 'foreign-lease' | 'released-lease' | 'bound-lease';
+
+export declare type AdmissionSubmissionRetryResult = {
+    readonly kind: 'retried' | 'already-retried';
+    readonly submissionId: string;
+    readonly expected: AdmissionSubmissionRetryToken;
+} | Extract<AdmissionSubmissionRetryInspection, {
+    kind: 'refused';
+}>;
+
+export declare interface AdmissionSubmissionRetryToken {
+    readonly attempts: number;
+    readonly stoppedAt: number;
+}
+
 /** What the caller learns about a start that went through flow control. */
 export declare type AdmissionVerdict = {
     /** Start it now. The ledger row is already written; call `linkExecution`
@@ -384,7 +414,7 @@ export declare const attachPreparedWorkflowExecution: (definition: object, execu
  * Journaled like every other activity: once it has matched, a replay returns the
  * matched event from the journal without re-reading anything.
  */
-export declare const awaitEvent: <A>(ctx: AwaitEventCtx, options: AwaitEventOptions<A>) => Effect.Effect<A, Cause.UnknownException | ParseResult.ParseError>;
+export declare const awaitEvent: <A>(ctx: AwaitEventCtx, options: AwaitEventOptions<A>) => Effect.Effect<A, Cause.UnknownError | Schema.SchemaError>;
 
 /** The slice of `ctx.store` this needs — the same shape `awaitSignal` takes, so
  *  a full `AppContext` store is assignable without a cast. */
@@ -406,7 +436,7 @@ export declare interface AwaitEventOptions<A> {
     /** Parsed against the event's payload. A parse failure fails the activity
      *  rather than matching — a correlated event whose SHAPE is wrong is a bug in
      *  the publisher, and silently skipping it would hide that. */
-    readonly schema: Schema.Schema<A, any>;
+    readonly schema: Schema.Codec<A, any>;
     /**
      * Does this event belong to this run?
      *
@@ -463,7 +493,7 @@ export declare interface AwaitEventOptions<A> {
  * From the dashboard, click "Send signal" on the run row and pick
  * `approval` with a JSON body matching the schema.
  */
-export declare const awaitSignal: <A>(ctx: AwaitSignalCtx, options: AwaitSignalOptions<A>) => Effect.Effect<A, Cause.UnknownException | ParseResult.ParseError>;
+export declare const awaitSignal: <A>(ctx: AwaitSignalCtx, options: AwaitSignalOptions<A>) => Effect.Effect<A, Cause.UnknownError | Schema.SchemaError>;
 
 /** The slice of `ctx.store` awaitSignal needs — just `query`, typed against
  *  the real `QueryDescriptor` so a full `AppContext` store (`DataStore`) is
@@ -484,7 +514,7 @@ export declare interface AwaitSignalOptions<A> {
     /** Schema the incoming payload is parsed against. Parse failures
      *  fail the activity with a typed error (the schema's ParseError);
      *  fix the sender's payload shape and re-send. */
-    readonly schema: Schema.Schema<A, any>;
+    readonly schema: Schema.Codec<A, any>;
     /** Initial poll interval in milliseconds. Default 200 ms — gives
      *  sub-second wake for fresh signals. Subsequent polls back off
      *  exponentially up to `maxPollIntervalMs`. */
@@ -518,7 +548,7 @@ export declare interface AwaitSignalOptions<A> {
  * interchangeable in a body); the suspending variant reads the durable
  * deferred, not `ctx.store`.
  */
-export declare const awaitSignalSuspending: <A>(ctx: AwaitSignalCtx, options: AwaitSignalSuspendingOptions<A>) => Effect.Effect<A, ParseResult.ParseError>;
+export declare const awaitSignalSuspending: <A>(ctx: AwaitSignalCtx, options: AwaitSignalSuspendingOptions<A>) => Effect.Effect<A, Schema.SchemaError>;
 
 export declare interface AwaitSignalSuspendingOptions<A> {
     /** Caller-chosen signal name. The external completer targets this exact
@@ -526,7 +556,7 @@ export declare interface AwaitSignalSuspendingOptions<A> {
     readonly name: string;
     /** Schema the incoming payload is decoded against. A decode failure fails
      *  the workflow with the schema's `ParseError`. */
-    readonly schema: Schema.Schema<A, any>;
+    readonly schema: Schema.Codec<A, any>;
     /** Max time to wait before failing the workflow. Default 24 h. The timeout
      *  is itself durable (a raced `DurableClock`), so a long wait frees the
      *  runner too. Pass `Number.POSITIVE_INFINITY` for an unbounded wait. */
@@ -547,8 +577,8 @@ export declare interface AwaitUpdateCtx {
 
 export declare interface AwaitUpdateOptions<A, B = A> {
     readonly name: string;
-    readonly schema: Schema.Schema<A, any>;
-    readonly success?: Schema.Schema<B, any>;
+    readonly schema: Schema.Codec<A, any>;
+    readonly success?: Schema.Codec<B, any>;
     readonly handle?: (payload: A) => Effect.Effect<B, unknown, never>;
     readonly pollIntervalMs?: number;
     readonly maxPollIntervalMs?: number;
@@ -557,6 +587,9 @@ export declare interface AwaitUpdateOptions<A, B = A> {
 
 /** Persist BEFORE calling the engine. Failed acknowledgements and process
  * death must leave evidence that an earlier call could have been accepted.
+ * The first dispatch starts the original finite lease interval: time spent
+ * waiting before engine I/O must not consume the running crash backstop.
+ * Later attempts retain that first deadline, including after a lost ACK.
  * Return null when this source is no longer dispatchable. Database-only;
  * the returned attempt number fences a later permanent-rejection decision. */
 export declare const beginAdmissionSubmissionDispatchInTransaction: (tx: Pick<DataStore, "query" | "update">, id: string, now: number) => Promise<AdmissionSubmission | null>;
@@ -570,31 +603,25 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
     kind: "settled";
     request: {
         readonly id: string;
-        readonly cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -604,37 +631,37 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        readonly cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
     run?: never;
 } | {
     kind: "unknown";
     request: {
         readonly id: string;
-        readonly cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -644,37 +671,37 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        readonly cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
     run?: never;
 } | {
     kind: "superseded";
     request: {
         readonly id: string;
-        readonly cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -684,37 +711,37 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        readonly cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
     run?: never;
 } | {
     kind: "already-terminal";
     request: {
         readonly id: string;
-        readonly cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -724,6 +751,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        readonly cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
     run: Readonly<Record<string, unknown>>;
 } | {
@@ -731,31 +764,25 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
     request: {
         dispatchAttempts: number;
         id: string;
-        cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        operation: "resume" | "cancel" | "terminate";
         generation: string;
         runId: string;
         requestedAt: number;
         executionId: string;
         workflowName: string;
-        operation: "resume" | "cancel" | "terminate";
         owner: {
             readonly tenantId: string | null;
         } | null;
@@ -764,6 +791,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
     run?: never;
 }>;
@@ -781,31 +814,25 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
     kind: "settled";
     request: {
         readonly id: string;
-        readonly cause?: {
-            readonly detail?: {
-                readonly [x: string]: unknown;
-            } | undefined;
-            readonly reason: string;
-        } | null | undefined;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -815,36 +842,36 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-    };
-} | {
-    kind: "unknown";
-    request: {
-        readonly id: string;
         readonly cause?: {
+            readonly reason: string;
             readonly detail?: {
                 readonly [x: string]: unknown;
             } | undefined;
-            readonly reason: string;
         } | null | undefined;
+    };
+} | {
+    kind: "unknown";
+    request: {
+        readonly id: string;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -854,36 +881,36 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-    };
-} | {
-    kind: "superseded";
-    request: {
-        readonly id: string;
         readonly cause?: {
+            readonly reason: string;
             readonly detail?: {
                 readonly [x: string]: unknown;
             } | undefined;
-            readonly reason: string;
         } | null | undefined;
+    };
+} | {
+    kind: "superseded";
+    request: {
+        readonly id: string;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -893,36 +920,36 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-    };
-} | {
-    kind: "not-suspended";
-    request: {
-        readonly id: string;
         readonly cause?: {
+            readonly reason: string;
             readonly detail?: {
                 readonly [x: string]: unknown;
             } | undefined;
-            readonly reason: string;
         } | null | undefined;
+    };
+} | {
+    kind: "not-suspended";
+    request: {
+        readonly id: string;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -932,36 +959,36 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-    };
-} | {
-    kind: "bound";
-    request: {
-        readonly id: string;
         readonly cause?: {
+            readonly reason: string;
             readonly detail?: {
                 readonly [x: string]: unknown;
             } | undefined;
-            readonly reason: string;
         } | null | undefined;
+    };
+} | {
+    kind: "bound";
+    request: {
+        readonly id: string;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -971,36 +998,36 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-    };
-} | {
-    kind: "waiting-journal";
-    request: {
-        readonly id: string;
         readonly cause?: {
+            readonly reason: string;
             readonly detail?: {
                 readonly [x: string]: unknown;
             } | undefined;
-            readonly reason: string;
         } | null | undefined;
+    };
+} | {
+    kind: "waiting-journal";
+    request: {
+        readonly id: string;
         readonly result: {
-            readonly status: "failed" | "cancelled" | "succeeded";
             readonly kind: "confirmed" | "already-terminal";
+            readonly status: "failed" | "cancelled" | "succeeded";
+            readonly completedAt: number;
             readonly output: unknown;
-            readonly errorMessage: string | null;
             readonly errorTag: string | null;
-            readonly completedAt: number;
+            readonly errorMessage: string | null;
         } | {
-            readonly status: "running";
             readonly kind: "confirmed";
-            readonly generation: string;
+            readonly status: "running";
             readonly enteredAt: number;
+            readonly generation: string;
         } | null;
+        readonly operation: "resume" | "cancel" | "terminate";
         readonly generation: string;
         readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
         readonly workflowName: string;
-        readonly operation: "resume" | "cancel" | "terminate";
         readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
@@ -1010,6 +1037,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
+        readonly cause?: {
+            readonly reason: string;
+            readonly detail?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+        } | null | undefined;
     };
 }>;
 
@@ -1115,7 +1148,7 @@ export declare interface CancelOnPlanInput {
     /** The workflow's own payload schema. When absent the stored payload is
      *  handed to `match` as-is — correct for JSON-shaped payloads and the honest
      *  fallback when a definition cannot be resolved. */
-    readonly payloadSchema?: Schema.Schema.Any | undefined;
+    readonly payloadSchema?: Schema.Top | undefined;
     readonly events: ReadonlyArray<DomainEventRow>;
     readonly runs: ReadonlyArray<CancellableRun>;
     readonly intents: ReadonlyArray<CancellableIntent>;
@@ -1178,7 +1211,7 @@ export declare interface CancelOnSweepResult {
 export declare interface CancelOnWorkflow {
     readonly workflowName: string;
     readonly entries: ReadonlyArray<ResolvedCancelOn>;
-    readonly payloadSchema?: Schema.Schema.Any | undefined;
+    readonly payloadSchema?: Schema.Top | undefined;
 }
 
 /**
@@ -1218,7 +1251,7 @@ export declare const CLUSTER_REREAD_WINDOW_MS: number;
 export declare class ClusterDiagnostics extends ClusterDiagnostics_base {
 }
 
-declare const ClusterDiagnostics_base: Context.TagClass<ClusterDiagnostics, "@voltro/workflow/ClusterDiagnostics", ClusterDiagnosticsOps>;
+declare const ClusterDiagnostics_base: Context.ServiceClass<ClusterDiagnostics, "@voltro/workflow/ClusterDiagnostics", ClusterDiagnosticsOps>;
 
 export declare interface ClusterDiagnosticsOps {
     /** This runner's advertised address — what keys its locks and its runner row. */
@@ -1307,7 +1340,7 @@ export declare const comparePendingOrder: (a: {
  */
 export declare const completeSuspendingSignal: (input: CompleteSuspendingSignalInput) => Effect.Effect<{
     readonly completed: boolean;
-}, Cause.UnknownException, WorkflowEngine.WorkflowEngine>;
+}, Cause.UnknownError, WorkflowEngine.WorkflowEngine>;
 
 /** Input to {@link completeSuspendingSignal}. */
 export declare interface CompleteSuspendingSignalInput {
@@ -1342,7 +1375,7 @@ export declare const completeWorkflowRunGenerationInTransaction: (tx: AdmissionD
  *  from `CurrentWorkflowRunId` (which is the runs-row primary key)
  *  because the natural durable id used by other workflows is the
  *  engine-assigned executionId, not our row id. */
-export declare const CurrentWorkflowExecutionId: FiberRef.FiberRef<string | undefined>;
+export declare const CurrentWorkflowExecutionId: Context.Reference<string | undefined>;
 
 /**
  * FiberRef carrying the patch markers that were declared on the workflow at the
@@ -1355,7 +1388,7 @@ export declare const CurrentWorkflowExecutionId: FiberRef.FiberRef<string | unde
  * Empty outside a recorded workflow body, so `patch()` is `false` there — the
  * safe direction: an un-recorded context gets the PRE-patch branch.
  */
-export declare const CurrentWorkflowPatches: FiberRef.FiberRef<readonly string[]>;
+export declare const CurrentWorkflowPatches: Context.Reference<readonly string[]>;
 
 /**
  * The tracker for the CURRENT body entry, or `undefined` when there is nothing
@@ -1365,12 +1398,12 @@ export declare const CurrentWorkflowPatches: FiberRef.FiberRef<readonly string[]
  * whose row already exists). A first entry has no prior shape, so the whole
  * mechanism costs one `FiberRef` read per step and nothing else.
  */
-export declare const CurrentWorkflowReplayShape: FiberRef.FiberRef<ReplayShapeTracker | undefined>;
+export declare const CurrentWorkflowReplayShape: Context.Reference<ReplayShapeTracker | undefined>;
 
 /** FiberRef carrying the active workflow run's id. The outer
  *  `wrapWithRunRecording` in dev.ts sets it via
- *  `Effect.locally(CurrentWorkflowRunId, runId)`. */
-export declare const CurrentWorkflowRunId: FiberRef.FiberRef<string | undefined>;
+ *  `Effect.provideService(CurrentWorkflowRunId, runId)`. */
+export declare const CurrentWorkflowRunId: Context.Reference<string | undefined>;
 
 /**
  * FiberRef carrying the name of the `step()` whose body is running — set by
@@ -1382,7 +1415,7 @@ export declare const CurrentWorkflowRunId: FiberRef.FiberRef<string | undefined>
  * and `(executionId, step, call)` is the identity that makes the second send a
  * replay. Read through `currentWorkflowStep`, never directly.
  */
-export declare const CurrentWorkflowStep: FiberRef.FiberRef<string | undefined>;
+export declare const CurrentWorkflowStep: Context.Reference<string | undefined>;
 
 /**
  * The step this fiber is running inside, with its durable execution — or
@@ -1536,8 +1569,8 @@ export declare const deferringControlsOf: (control: ResolvedFlowControl | undefi
 export declare const deleteIntent: (store: AdmissionDataStore, id: string) => Promise<boolean>;
 
 declare const Delivery: Schema.Struct<{
-    requestId: typeof Schema.NonEmptyString;
-    restartToken: Schema.NullOr<typeof Schema.NonEmptyString>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly restartToken: Schema.NullOr<Schema.NonEmptyString>;
 }>;
 
 /**
@@ -1661,14 +1694,12 @@ export declare const dueIntents: (store: AdmissionDataStore, now: number, limit:
 export { durableClock }
 
 /** Define a durable queue for concurrency-controlled side work. */
-export declare const durableQueue: typeof durableQueueModule.make & (<Options extends Parameters<typeof durableQueueModule.make>[0] & {
+export declare const durableQueue: <Payload extends Schema.Top | Schema.Struct.Fields, Success extends Schema.Top = typeof Schema.Void, Error extends Schema.Top = typeof Schema.Never>(options: Parameters<typeof durableQueueModule.make<Payload, Success, Error>>[0] & {
     readonly encrypted?: boolean;
-}>(options: Options) => ReturnType<typeof durableQueueModule.make>);
+}) => ReturnType<typeof durableQueueModule.make<Payload, Success, Error>>;
 
 export { durableQueueModule }
 
-export { durableRateLimiterModule }
-
 /** Establish the body-entry owner before running application code. Existing
  * execution identity retains its run ID and original input; return the previous
  * snapshot so crash/version guards decide from the state they actually replaced.
@@ -1723,31 +1754,33 @@ declare type Execute = (payload: unknown, executionId: string, discard: boolean)
  * the typed body result under that same ID and preserves its failure channel.
  * Record acceptance before joining; body completion is a separate event.
  * Ordinary starts do not opt into this capability automatically. */
-export declare const executePreparedWorkflow: <Payload extends Schema.Schema.Any, Success extends Schema.Schema.Any, Error extends Schema.Schema.All, Discard extends boolean = true>(definition: {
+export declare const executePreparedWorkflow: <Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, Discard extends boolean = true>(definition: {
     readonly payloadSchema: Payload;
     readonly successSchema: Success;
     readonly errorSchema: Error;
 }, payload: Payload["Type"], executionId: string, options?: {
     readonly discard: Discard;
-}) => Effect.Effect<Discard extends true ? string : Success["Type"], Error["Type"], WorkflowEngine.WorkflowEngine | Payload["Context"] | Success["Context"] | Error["Context"]>;
+}) => Effect.Effect<Discard extends true ? string : Success["Type"], Error["Type"], WorkflowEngine.WorkflowEngine | Payload["DecodingServices"] | Success["DecodingServices"] | Error["DecodingServices"]>;
+
+export declare const failureMessage: (error: unknown) => string;
 
 declare const FailureRecordSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    tenantId: Schema.NullOr<typeof Schema.String>;
-    sourceId: typeof Schema.String;
-    sourceKind: Schema.Literal<["submission", "intent", "run"]>;
-    handler: Schema.NullOr<typeof Schema.String>;
-    callerContext: typeof Schema.Unknown;
-    report: Schema.Struct<{
-        workflow: typeof Schema.String;
-        payload: typeof Schema.Unknown;
-        errorTag: Schema.NullOr<typeof Schema.String>;
-        errorMessage: Schema.NullOr<typeof Schema.String>;
-        runId: Schema.NullOr<typeof Schema.String>;
-        executionId: Schema.NullOr<typeof Schema.String>;
-        reason: typeof Schema.String;
-        failedAt: typeof Schema.Number;
+    readonly id: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly tenantId: Schema.NullOr<Schema.String>;
+    readonly sourceId: Schema.String;
+    readonly sourceKind: Schema.Literals<readonly ["submission", "intent", "run"]>;
+    readonly handler: Schema.NullOr<Schema.String>;
+    readonly callerContext: Schema.Unknown;
+    readonly report: Schema.Struct<{
+        readonly workflow: Schema.String;
+        readonly payload: Schema.Unknown;
+        readonly errorTag: Schema.NullOr<Schema.String>;
+        readonly errorMessage: Schema.NullOr<Schema.String>;
+        readonly runId: Schema.NullOr<Schema.String>;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly reason: Schema.String;
+        readonly failedAt: Schema.Number;
     }>;
 }>;
 
@@ -1763,7 +1796,7 @@ export declare class FlowControlKeyError extends Error {
 /** A duration in any shape Effect accepts: `'15 minutes'`, `900_000`,
  *  `Duration.minutes(15)`. Same input type `sleep({ duration })` takes, so
  *  there is one duration vocabulary in the whole workflow surface. */
-export declare type FlowDuration = Duration.DurationInput;
+export declare type FlowDuration = Duration.Input;
 
 /** Try to read the current workflow execution id. Returns undefined
  *  when called outside a recorded workflow body. */
@@ -1824,7 +1857,10 @@ export declare interface InMemoryRecorder {
     readonly readEvents: () => ReadonlyArray<RecordedEvent>;
 }
 
-export declare const inMemoryWorkflowEngineLayer: Layer.Layer<WorkflowEngine.WorkflowEngine>;
+/** `rateLimit()` counts on the `RateLimiter` service; in memory it is per process. */
+export declare const inMemoryWorkflowEngineLayer: Layer.Layer<WorkflowEngine.WorkflowEngine | RateLimiter.RateLimiter>;
+
+export declare const inspectAdmissionSubmissionRetry: (tx: Pick<DataStore, "query">, id: string) => Promise<AdmissionSubmissionRetryInspection>;
 
 export declare interface InspectedStep {
     readonly name: string;
@@ -1879,6 +1915,10 @@ export declare interface InspectStore {
  */
 export declare const inspectWorkflow: (idOrExecutionId: string, store: InspectStore) => Promise<InspectedWorkflow | null>;
 
+/** A value that can carry definition metadata: a workflow definition is a
+ *  callable in v4 (`Workflow.make` returns a function), a queue is an object. */
+export declare const isCarrier: (value: unknown) => value is object;
+
 /**
  * Has an admitted run outlived `timeouts.finish`?
  *
@@ -2007,7 +2047,7 @@ export declare type NondeterminismKind = 'unreached-step' | 'extra-step-occurren
 declare type NormaliseWorkflowMessages<M extends WorkflowMessageSchemas | undefined> = {
     readonly signals: M extends {
         readonly signals: infer Signals;
-    } ? NonNullable<Signals> & Readonly<Record<string, Schema.Schema.Any>> : {};
+    } ? NonNullable<Signals> & Readonly<Record<string, Schema.Top>> : {};
     readonly updates: M extends {
         readonly updates: infer Updates;
     } ? NonNullable<Updates> & Readonly<Record<string, WorkflowMessagePairSchemas>> : {};
@@ -2023,8 +2063,12 @@ export declare const normaliseWorkflowPatches: (value: unknown) => ReadonlyArray
  * pending row. Missing acknowledgement does NOT prove that the engine rejected
  * the call; this record deliberately makes no terminal-execution claim.
  * Call inside the owning admission transaction. A reached attempt limit stops
- * automatic retry but retains the lease and receipt for reconciliation. */
-export declare const noteAdmissionSubmissionFailure: (tx: Pick<DataStore, "query" | "update">, id: string, error: string, now: number, maxAttempts?: number | false) => Promise<AdmissionSubmission>;
+ * automatic retry but retains the lease and receipt for reconciliation.
+ * Pass the attempt's observed `retry.recovery?.attempts ?? 0`: an older
+ * in-flight failure must not consume an operator's newly granted budget.
+ * Omission means the original, unrecovered epoch; it cannot change a recovered
+ * submission. An actual dispatch adopts the epoch returned by its begin call. */
+export declare const noteAdmissionSubmissionFailure: (tx: Pick<DataStore, "query" | "update">, id: string, error: string, now: number, maxAttempts?: number | false, expectedRecoveryAttempts?: number) => Promise<AdmissionSubmission>;
 
 export declare const noteIntentAttempt: (store: AdmissionDataStore, intent: PendingIntent, error: string, now: number) => Promise<void>;
 
@@ -2126,7 +2170,7 @@ export declare interface ParkDelayedStartInput {
  * however many times it replays and whatever the deployed code says — which is
  * the property that makes the branch deterministic across a redeploy.
  *
- * Under `@effect/workflow` the naive implementation does the opposite: an
+ * Under `effect/workflow` the naive implementation does the opposite: an
  * activity that is ABSENT from an old run's journal EXECUTES on replay (the
  * journal is keyed name/attempt), so a marker journaled by an activity would
  * answer `true` for exactly the old runs it must answer `false` for. Reading
@@ -2328,8 +2372,26 @@ export declare const queuedCancellationRequestsTable: SchemaTable;
  *  inferred type) is what emits in the `.d.ts`, so it stays portable. */
 export declare const queueWorker: typeof durableQueueModule.worker;
 
-/** Durable rate limiter activity. Delays through the workflow clock. */
-export declare const rateLimit: typeof durableRateLimiterModule.rateLimit;
+/**
+ * Durable rate limit. Consumes from the shared limiter; when the window is
+ * exhausted the wait is a durable clock sleep under `name`, so a deploy or a
+ * worker crash does not lose the delay and a replay does not consume twice.
+ */
+export declare const rateLimit: (options: RateLimitOptions) => Effect.Effect<void, RateLimiter.RateLimiterError, RateLimiter.RateLimiter | WorkflowEngine.WorkflowEngine | WorkflowEngine.WorkflowInstance>;
+
+/** What `rateLimit` admits: one unit of work under `limit` per `window` for
+ *  `key`, counted by the `RateLimiter` service the boot provides. */
+export declare interface RateLimitOptions {
+    /** Names this ADMISSION within the run: the decision is journaled under it, so a
+     *  replay reads it back instead of consuming again. Two calls with the same name
+     *  in one run share one decision — give each call its own (`send/${i}` in a loop). */
+    readonly name: string;
+    readonly window: Duration.Input;
+    readonly limit: number;
+    readonly key: string;
+    readonly algorithm?: 'fixed-window' | 'token-bucket' | undefined;
+    readonly tokens?: number | undefined;
+}
 
 /**
  * Read exactly the state the declared controls need — no more.
@@ -2389,26 +2451,13 @@ declare const readWorkflowRestartCommandInTransaction: (tx: AdmissionDataStore,
     readonly selection: WorkflowRestartSelection;
 }) => Promise<{
     readonly id: string;
-    readonly tenantId: string | null;
-    readonly token: string;
-    readonly generation: string;
     readonly runId: string;
-    readonly requestedAt: Date;
-    readonly executionId: string;
     readonly workflowName: string;
-    readonly selection: {
-        readonly kind: "failed-steps";
-    } | {
-        readonly kind: "from-step";
-        readonly stepName: string;
-    };
-    readonly dispatchAttempts: number;
-    readonly enteredGeneration: string | null;
+    readonly executionId: string;
+    readonly generation: string;
+    readonly token: string;
     readonly ledgerId: string;
-    readonly eviction: {
-        readonly runId: string;
-        readonly executionId: string;
-    } | null;
+    readonly tenantId: string | null;
     readonly delivery: {
         readonly requestId: string;
         readonly restartToken: string | null;
@@ -2417,6 +2466,19 @@ declare const readWorkflowRestartCommandInTransaction: (tx: AdmissionDataStore,
         readonly requestId: string;
         readonly replyId: string;
     }[];
+    readonly selection: {
+        readonly kind: "failed-steps";
+    } | {
+        readonly kind: "from-step";
+        readonly stepName: string;
+    };
+    readonly eviction: {
+        readonly executionId: string;
+        readonly runId: string;
+    } | null;
+    readonly requestedAt: Date;
+    readonly dispatchAttempts: number;
+    readonly enteredGeneration: string | null;
 } | undefined>;
 
 /** Read-only reconciliation. No observation of engine replies, admission,
@@ -2436,34 +2498,34 @@ export declare const readWorkflowStartRequest: (store: Pick<DataStore, "query">,
     readonly requestFingerprint: string;
 }) => Promise<WorkflowStartReceipt | undefined>;
 
-declare const ReceiptSchema: Schema.filter<Schema.Struct<{
-    id: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    tenantId: Schema.NullOr<typeof Schema.String>;
-    pendingId: typeof Schema.String;
-    submissionId: Schema.NullOr<typeof Schema.String>;
-    terminal: Schema.NullOr<Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["dropped"]>;
-        at: typeof Schema.Number;
-        retryAfterMs: typeof Schema.Number;
+declare const ReceiptSchema: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly tenantId: Schema.NullOr<Schema.String>;
+    readonly pendingId: Schema.String;
+    readonly submissionId: Schema.NullOr<Schema.String>;
+    readonly terminal: Schema.NullOr<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"dropped">;
+        readonly at: Schema.Number;
+        readonly retryAfterMs: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["skipped"]>;
-        at: typeof Schema.Number;
-        executionId: typeof Schema.String;
-        runId: typeof Schema.String;
+        readonly kind: Schema.Literal<"skipped">;
+        readonly at: Schema.Number;
+        readonly executionId: Schema.String;
+        readonly runId: Schema.String;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["superseded"]>;
-        at: typeof Schema.Number;
+        readonly kind: Schema.Literal<"superseded">;
+        readonly at: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["cancelled"]>;
-        at: typeof Schema.Number;
+        readonly kind: Schema.Literal<"cancelled">;
+        readonly at: Schema.Number;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["abandoned"]>;
-        at: typeof Schema.Number;
-        failureId: typeof Schema.NonEmptyString;
+        readonly kind: Schema.Literal<"abandoned">;
+        readonly at: Schema.Number;
+        readonly failureId: Schema.NonEmptyString;
     }>]>>;
-    requestFingerprint: Schema.optional<Schema.NullOr<Schema.filter<typeof Schema.String>>>;
-}>>;
+    readonly requestFingerprint: Schema.optional<Schema.NullOr<Schema.String>>;
+}>;
 
 /** Reconcile under the resident admission lock. Only a terminal pre-admission
  * drop/skip/supersession or proven pre-engine rejection permits a new arrival. Preserve every previous receipt and
@@ -2536,6 +2598,17 @@ export declare interface RecordedStepShape {
     readonly stepName: string;
 }
 
+/** Record a known caller's pre-body refusal without replay/version/crash guards
+ * treating the refused attempt as application execution. Entry and completion
+ * use the ordinary resident transactions, delivery identity and generation
+ * fences; an unknown identity cannot create a run. The original failure is
+ * returned to the engine after its terminal record commits. */
+export declare const recordWorkflowExecutionRefusal: (options: WorkflowExecutionRefusalRecordingOptions, input: {
+    readonly executionId: string;
+    readonly payload: unknown;
+    readonly cause: Cause.Cause<unknown>;
+}) => Effect.Effect<never, unknown, WorkflowInstance>;
+
 /** Database-only: call inside the resident admission transaction, together
  * with the source's terminal transition. Never notify the handler from here.
  * Replaying an identity keeps the first report AND recipient, even after a
@@ -2550,12 +2623,14 @@ export declare const recordWorkflowStartReceipt: (tx: Pick<DataStore, "insertIgn
 /** Record proven pre-engine rejection together with its source and lease.
  * Attempt 0 means local validation before any engine call. Attempt 1 means the
  * first call returned a failure the host guarantees occurs before engine I/O.
- * A prior or competing attempt makes acceptance unknown, not rejected. */
+ * A prior or competing attempt makes acceptance unknown, not rejected.
+ * Pass the same observed recovery epoch as failure bookkeeping: an older
+ * pre-engine error cannot reject an explicitly recovered submission. */
 export declare const rejectAdmissionSubmissionInTransaction: (tx: AdmissionDataStore, id: string, attempt: number, failure: {
     readonly handler: string | null;
     readonly errorMessage: string;
     readonly now: number;
-}) => Promise<WorkflowFailureRecord | undefined>;
+}, expectedRecoveryAttempts?: number) => Promise<WorkflowFailureRecord | undefined>;
 
 /**
  * Resume every run parked on `budget`.
@@ -2618,8 +2693,8 @@ export declare interface ReplayShapeTracker {
 }
 
 declare const Reply: Schema.Struct<{
-    requestId: typeof Schema.NonEmptyString;
-    replyId: typeof Schema.NonEmptyString;
+    readonly requestId: Schema.NonEmptyString;
+    readonly replyId: Schema.NonEmptyString;
 }>;
 
 /**
@@ -2633,39 +2708,39 @@ declare const Reply: Schema.Struct<{
 export declare const reportNondeterminism: (findings: ReadonlyArray<NondeterminismFinding>) => Effect.Effect<void>;
 
 declare const RequestSchema: Schema.Struct<{
-    id: Schema.filter<typeof Schema.String>;
-    runId: Schema.filter<typeof Schema.String>;
-    workflowName: Schema.filter<typeof Schema.String>;
-    executionId: Schema.filter<typeof Schema.String>;
-    generation: Schema.filter<typeof Schema.String>;
-    operation: Schema.Literal<["cancel", "terminate", "resume"]>;
-    requestedAt: Schema.filter<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly executionId: Schema.String;
+    readonly generation: Schema.String;
+    readonly operation: Schema.Literals<readonly ["cancel", "terminate", "resume"]>;
+    readonly requestedAt: Schema.Number;
     /** Null means no proven owner, not a null-tenant owner. */
-    owner: Schema.NullOr<Schema.Struct<{
-        tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly owner: Schema.NullOr<Schema.Struct<{
+        readonly tenantId: Schema.NullOr<Schema.String>;
     }>>;
-    cause: Schema.optional<Schema.NullOr<Schema.Struct<{
-        reason: typeof Schema.NonEmptyString;
-        detail: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly cause: Schema.optional<Schema.NullOr<Schema.Struct<{
+        readonly reason: Schema.NonEmptyString;
+        readonly detail: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>>;
-    dispatchAttempts: Schema.filter<Schema.filter<typeof Schema.Number>>;
-    resumeJournal: Schema.NullOr<Schema.Struct<{
-        requestId: Schema.filter<typeof Schema.String>;
-        replyId: Schema.filter<typeof Schema.String>;
-        restartToken: Schema.NullOr<typeof Schema.NonEmptyString>;
+    readonly dispatchAttempts: Schema.Number;
+    readonly resumeJournal: Schema.NullOr<Schema.Struct<{
+        readonly requestId: Schema.String;
+        readonly replyId: Schema.String;
+        readonly restartToken: Schema.NullOr<Schema.NonEmptyString>;
     }>>;
-    result: Schema.NullOr<Schema.Union<[Schema.Struct<{
-        kind: Schema.Literal<["confirmed", "already-terminal"]>;
-        status: Schema.Literal<["succeeded", "failed", "cancelled"]>;
-        completedAt: Schema.filter<typeof Schema.Number>;
-        output: typeof Schema.Unknown;
-        errorTag: Schema.NullOr<typeof Schema.String>;
-        errorMessage: Schema.NullOr<typeof Schema.String>;
+    readonly result: Schema.NullOr<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["confirmed", "already-terminal"]>;
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly completedAt: Schema.Number;
+        readonly output: Schema.Unknown;
+        readonly errorTag: Schema.NullOr<Schema.String>;
+        readonly errorMessage: Schema.NullOr<Schema.String>;
     }>, Schema.Struct<{
-        kind: Schema.Literal<["confirmed"]>;
-        status: Schema.Literal<["running"]>;
-        enteredAt: Schema.filter<typeof Schema.Number>;
-        generation: Schema.filter<typeof Schema.String>;
+        readonly kind: Schema.Literal<"confirmed">;
+        readonly status: Schema.Literal<"running">;
+        readonly enteredAt: Schema.Number;
+        readonly generation: Schema.String;
     }>]>>;
 }>;
 
@@ -2727,26 +2802,13 @@ export declare const reserveWorkflowRestartInTransaction: (tx: AdmissionDataStor
     kind: "reserved";
     request: {
         readonly id: string;
-        readonly tenantId: string | null;
-        readonly token: string;
-        readonly generation: string;
         readonly runId: string;
-        readonly requestedAt: Date;
-        readonly executionId: string;
         readonly workflowName: string;
-        readonly selection: {
-            readonly kind: "failed-steps";
-        } | {
-            readonly kind: "from-step";
-            readonly stepName: string;
-        };
-        readonly dispatchAttempts: number;
-        readonly enteredGeneration: string | null;
+        readonly executionId: string;
+        readonly generation: string;
+        readonly token: string;
         readonly ledgerId: string;
-        readonly eviction: {
-            readonly runId: string;
-            readonly executionId: string;
-        } | null;
+        readonly tenantId: string | null;
         readonly delivery: {
             readonly requestId: string;
             readonly restartToken: string | null;
@@ -2755,6 +2817,19 @@ export declare const reserveWorkflowRestartInTransaction: (tx: AdmissionDataStor
             readonly requestId: string;
             readonly replyId: string;
         }[];
+        readonly selection: {
+            readonly kind: "failed-steps";
+        } | {
+            readonly kind: "from-step";
+            readonly stepName: string;
+        };
+        readonly eviction: {
+            readonly executionId: string;
+            readonly runId: string;
+        } | null;
+        readonly requestedAt: Date;
+        readonly dispatchAttempts: number;
+        readonly enteredGeneration: string | null;
     };
     reused: boolean;
     decision?: never;
@@ -2801,7 +2876,7 @@ export declare const resolveAdmissionKeys: (control: ResolvedFlowControl, payloa
  *  event at all". */
 export declare interface ResolvedCancelOn {
     readonly event: string;
-    readonly schema: Schema.Schema.Any;
+    readonly schema: Schema.Top;
     readonly match: (event: unknown, payload: unknown) => boolean;
     readonly withinMs?: number;
     readonly reason: string;
@@ -2905,6 +2980,12 @@ export declare const resolveWorkflowStartReceipt: (tx: Pick<DataStore, "query">,
 
 export declare const resumeWorkflow: (store: AdmissionDataStore, workflowName: string) => Promise<boolean>;
 
+/** Call under the SAME resident admission transaction as preparation, dispatch,
+ * cancellation and ACK. The preview is advisory; this locked reread decides.
+ * Keep lifetime attempts monotonic and retain the consumed stop token so a lost
+ * response can be retried without resuming a later exhausted retry budget. */
+export declare const retryAdmissionSubmissionInTransaction: (tx: Pick<DataStore, "query" | "update">, id: string, expected: AdmissionSubmissionRetryToken, now: number) => Promise<AdmissionSubmissionRetryResult>;
+
 /** Re-arm one dead-lettered intent after an operator has deployed a schema or
  * handler fix. The payload and its queue-time provenance stay untouched; only
  * the terminal classification and retry history are reset. */
@@ -2917,11 +2998,11 @@ export declare const retryDeadLetterIntent: (store: AdmissionDataStore, intentId
  */
 export declare const sealJournalValue: (value: unknown, what: string, binding?: FieldBinding) => unknown;
 
-declare const Selection: Schema.Union<[Schema.Struct<{
-    kind: Schema.Literal<["failed-steps"]>;
+declare const Selection: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"failed-steps">;
 }>, Schema.Struct<{
-    kind: Schema.Literal<["from-step"]>;
-    stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    readonly kind: Schema.Literal<"from-step">;
+    readonly stepName: Schema.NonEmptyString;
 }>]>;
 
 export declare const sendWorkflowSignal: (input: {
@@ -3141,7 +3222,7 @@ export declare type StallReason =
 *  returns, or a runner that vanished without the reclaim path noticing. */
 | 'no-progress';
 
-export declare const step: <R, Success extends Schema.Schema.Any = typeof Schema.Void, Error extends Schema.Schema.All = typeof Schema.Never>(options: StepOptions<R, Success, Error>) => ReturnType<typeof stepModule.make<R, Success, Error>>;
+export declare const step: <R, Success extends Schema.Top = typeof Schema.Void, Error extends Schema.Top = typeof Schema.Never>(options: StepOptions<R, Success, Error>) => ReturnType<typeof stepModule.make<R, Success, Error>>;
 
 /** The address the step journal's values are sealed to (`encrypted` via the
  *  recorder's `encryptStepPayload`). ONE definition, shared with the CLI. */
@@ -3164,7 +3245,7 @@ export { stepModule }
 /**
  * Define a checkpointed step (activity) inside a workflow body.
  *
- * Wraps `@effect/workflow`'s `Activity.make` to record every
+ * Wraps `effect/workflow`'s `Activity.make` to record every
  * invocation in `_voltro_workflow_run_steps`. The wrapping is
  * transparent — accepts everything `Activity.make` accepts, plus an
  * optional `input` field whose value is persisted to the step row
@@ -3183,7 +3264,7 @@ export { stepModule }
  * Without the recorder service in scope (unit tests, etc.) the input
  * is dropped and the wrap is a no-op.
  */
-declare type StepOptions<R, Success extends Schema.Schema.Any, Error extends Schema.Schema.All> = {
+declare type StepOptions<R, Success extends Schema.Top, Error extends Schema.Top> = {
     readonly name: string;
     readonly success?: Success | undefined;
     readonly error?: Error | undefined;
@@ -3249,29 +3330,36 @@ export declare interface StepRetryPolicy {
 
 declare type Store = Pick<DataStore, 'query' | 'insert' | 'update'>;
 
+export declare const SUBMISSIONS_TABLE = "_voltro_workflow_submissions";
+
 declare const SubmissionSchema: Schema.Struct<{
-    id: typeof Schema.String;
-    workflowName: typeof Schema.String;
-    tenantId: Schema.NullOr<typeof Schema.String>;
-    ledgerId: typeof Schema.String;
-    preparedExecutionId: Schema.NullOr<typeof Schema.String>;
-    executionId: Schema.NullOr<typeof Schema.String>;
-    runId: Schema.NullOr<typeof Schema.String>;
-    receiptsBound: typeof Schema.Boolean;
-    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
-    failureId: Schema.NullOr<typeof Schema.String>;
-    retry: Schema.Struct<{
-        attempts: typeof Schema.Int;
-        after: typeof Schema.Number;
-        lastError: Schema.NullOr<typeof Schema.String>;
-        stoppedAt: Schema.NullOr<typeof Schema.Number>;
+    readonly id: Schema.String;
+    readonly workflowName: Schema.String;
+    readonly tenantId: Schema.NullOr<Schema.String>;
+    readonly ledgerId: Schema.String;
+    readonly preparedExecutionId: Schema.NullOr<Schema.String>;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly runId: Schema.NullOr<Schema.String>;
+    readonly receiptsBound: Schema.Boolean;
+    readonly dispatchAttempts: Schema.Number;
+    readonly failureId: Schema.NullOr<Schema.String>;
+    readonly retry: Schema.Struct<{
+        readonly attempts: Schema.Int;
+        readonly after: Schema.Number;
+        readonly lastError: Schema.NullOr<Schema.String>;
+        readonly stoppedAt: Schema.NullOr<Schema.Number>;
+        readonly recovery: Schema.optional<Schema.Struct<{
+            readonly attempts: Schema.Int;
+            readonly stoppedAt: Schema.Number;
+            readonly retriedAt: Schema.Number;
+        }>>;
     }>;
-    payload: typeof Schema.Unknown;
-    callerContext: typeof Schema.Unknown;
-    intentIds: Schema.Array$<typeof Schema.String>;
-    eviction: Schema.NullOr<Schema.Struct<{
-        executionId: typeof Schema.String;
-        runId: typeof Schema.String;
+    readonly payload: Schema.Unknown;
+    readonly callerContext: Schema.Unknown;
+    readonly intentIds: Schema.$Array<Schema.String>;
+    readonly eviction: Schema.NullOr<Schema.Struct<{
+        readonly executionId: Schema.String;
+        readonly runId: Schema.String;
     }>>;
 }>;
 
@@ -3349,10 +3437,7 @@ export declare interface SuspendHintInput {
  */
 export declare const suspendingSignalDeferredName: (workflowName: string, signalName: string) => string;
 
-export declare class SuspensionUnavailable extends SuspensionUnavailable_base {
-}
-
-declare const SuspensionUnavailable_base: Context.ReferenceClass<SuspensionUnavailable, "@voltro/workflow/SuspensionUnavailable", string | undefined>;
+export declare const SuspensionUnavailable: Context.Reference<string | undefined>;
 
 /**
  * One cancellation tick. Never throws.
@@ -3379,27 +3464,32 @@ export declare const sweepStalledRuns: (deps: StalenessSweepDeps, options?: Stal
  * The caller supplies the encoded payload derived under this same lock. */
 export declare const takeAdmittedSubmissionInTransaction: (tx: AdmissionDataStore, input: Parameters<typeof persistReservedSubmission>[1]) => Promise<{
     readonly id: string;
+    readonly workflowName: string;
     readonly tenantId: string | null;
+    readonly ledgerId: string;
+    readonly preparedExecutionId: string | null;
+    readonly executionId: string | null;
+    readonly runId: string | null;
+    readonly receiptsBound: boolean;
+    readonly dispatchAttempts: number;
+    readonly failureId: string | null;
     readonly retry: {
         readonly lastError: string | null;
         readonly attempts: number;
-        readonly after: number;
         readonly stoppedAt: number | null;
+        readonly after: number;
+        readonly recovery?: {
+            readonly attempts: number;
+            readonly stoppedAt: number;
+            readonly retriedAt: number;
+        } | undefined;
     };
     readonly payload: unknown;
-    readonly runId: string | null;
-    readonly executionId: string | null;
-    readonly failureId: string | null;
-    readonly workflowName: string;
-    readonly dispatchAttempts: number;
     readonly callerContext: unknown;
     readonly intentIds: readonly string[];
-    readonly ledgerId: string;
-    readonly receiptsBound: boolean;
-    readonly preparedExecutionId: string | null;
     readonly eviction: {
-        readonly runId: string;
         readonly executionId: string;
+        readonly runId: string;
     } | null;
 }>;
 
@@ -3412,10 +3502,10 @@ export declare const takePendingAdmissionSubmission: (store: Pick<DataStore, "in
 }>;
 
 declare const Target: Schema.Struct<{
-    requestId: typeof Schema.NonEmptyString;
-    receiptId: typeof Schema.NonEmptyString;
-    workflowName: typeof Schema.NonEmptyString;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly requestId: Schema.NonEmptyString;
+    readonly receiptId: Schema.NonEmptyString;
+    readonly workflowName: Schema.NonEmptyString;
+    readonly tenantId: Schema.NullOr<Schema.String>;
 }>;
 
 export declare const truncateWorkflowValue: (value: unknown, bytes?: number) => unknown;
@@ -3569,9 +3659,9 @@ export declare const withdrawWorkflowRestartInTransaction: (tx: AdmissionDataSto
     kind: "withdrawn";
     withdrawal: {
         readonly id: string;
-        readonly tenantId: string | null;
         readonly runId: string;
         readonly workflowName: string;
+        readonly tenantId: string | null;
         readonly selection: {
             readonly kind: "failed-steps";
         } | {
@@ -3586,26 +3676,13 @@ export declare const withdrawWorkflowRestartInTransaction: (tx: AdmissionDataSto
     kind: "reserved";
     request: {
         readonly id: string;
-        readonly tenantId: string | null;
-        readonly token: string;
-        readonly generation: string;
         readonly runId: string;
-        readonly requestedAt: Date;
-        readonly executionId: string;
         readonly workflowName: string;
-        readonly selection: {
-            readonly kind: "failed-steps";
-        } | {
-            readonly kind: "from-step";
-            readonly stepName: string;
-        };
-        readonly dispatchAttempts: number;
-        readonly enteredGeneration: string | null;
+        readonly executionId: string;
+        readonly generation: string;
+        readonly token: string;
         readonly ledgerId: string;
-        readonly eviction: {
-            readonly runId: string;
-            readonly executionId: string;
-        } | null;
+        readonly tenantId: string | null;
         readonly delivery: {
             readonly requestId: string;
             readonly restartToken: string | null;
@@ -3614,6 +3691,19 @@ export declare const withdrawWorkflowRestartInTransaction: (tx: AdmissionDataSto
             readonly requestId: string;
             readonly replyId: string;
         }[];
+        readonly selection: {
+            readonly kind: "failed-steps";
+        } | {
+            readonly kind: "from-step";
+            readonly stepName: string;
+        };
+        readonly eviction: {
+            readonly executionId: string;
+            readonly runId: string;
+        } | null;
+        readonly requestedAt: Date;
+        readonly dispatchAttempts: number;
+        readonly enteredGeneration: string | null;
     };
     withdrawal?: never;
     reused?: never;
@@ -3631,7 +3721,9 @@ export declare const workflow: WorkflowFn;
  */
 export declare const WORKFLOW_JOURNAL_BINDING: FieldBinding;
 
-declare type WorkflowBaseOptions = Parameters<WorkflowMake>[0];
+declare type WorkflowBaseOptions = Parameters<WorkflowMake>[1] & {
+    readonly name: Parameters<WorkflowMake>[0];
+};
 
 /**
  * Collect many starts into ONE run over an array of items.
@@ -3690,7 +3782,7 @@ export declare interface WorkflowBatch<Item> {
  * }],
  * ```
  */
-export declare interface WorkflowCancelOn<EventSchema extends Schema.Schema.Any, Payload> {
+export declare interface WorkflowCancelOn<EventSchema extends Schema.Top, Payload> {
     /** The event NAME, exactly as `ctx.events.publish` writes it. */
     readonly event: string;
     /** Decoded before `match` sees it, so the predicate reads the domain type
@@ -3724,7 +3816,7 @@ export declare interface WorkflowCancelOn<EventSchema extends Schema.Schema.Any,
  *  the per-entry-inferred {@link WorkflowCancelOnList}; this is what survives
  *  erasure, and it is deliberately not the public spelling. */
 export declare interface WorkflowCancelOnDeclared {
-    readonly cancelOn?: ReadonlyArray<WorkflowCancelOn<Schema.Schema.Any, never>>;
+    readonly cancelOn?: ReadonlyArray<WorkflowCancelOn<Schema.Top, never>>;
 }
 
 /** The `cancelOn` array as declared, with each entry's event type inferred
@@ -3732,7 +3824,7 @@ export declare interface WorkflowCancelOnDeclared {
  *  per-entry inference work — a plain `ReadonlyArray<WorkflowCancelOn<…>>`
  *  collapses every entry's event to the constraint (`any`), which is how the
  *  predicate silently stops being checked. */
-export declare type WorkflowCancelOnList<Cancels extends ReadonlyArray<Schema.Schema.Any>, Payload> = {
+export declare type WorkflowCancelOnList<Cancels extends ReadonlyArray<Schema.Top>, Payload> = {
     readonly [I in keyof Cancels]: WorkflowCancelOn<Cancels[I], Payload>;
 };
 
@@ -3887,6 +3979,8 @@ export declare interface WorkflowExecuteRecordingOptions extends WorkflowRunReco
     readonly replayShapeLimit?: number;
 }
 
+export declare type WorkflowExecutionRefusalRecordingOptions = WorkflowExecuteRecordingOptions & Required<Pick<WorkflowExecuteRecordingOptions, 'subject' | 'failureContext'>>;
+
 export declare type WorkflowFailureDelivery = WorkflowFailureHandoff | {
     readonly kind: 'accepted';
     readonly executionId: string;
@@ -4043,7 +4137,7 @@ export declare const WorkflowFlowControlProperty = "__voltroWorkflowFlowControl"
  * meaning anything if this ever regresses to `any` — which is precisely what
  * all three failed attempts did.
  */
-declare type WorkflowFn = <const Name extends string, Payload extends WorkflowPayloadInput, Success extends Schema.Schema.Any = typeof Schema.Void, Error extends Schema.Schema.All = typeof Schema.Never, const Messages extends WorkflowMessageSchemas | undefined = undefined, Cancels extends ReadonlyArray<Schema.Schema.Any> = readonly []>(options: {
+declare type WorkflowFn = <const Name extends string, Payload extends WorkflowPayloadInput, Success extends Schema.Top = typeof Schema.Void, Error extends Schema.Top = typeof Schema.Never, const Messages extends WorkflowMessageSchemas | undefined = undefined, Cancels extends ReadonlyArray<Schema.Top> = readonly []>(options: {
     readonly name: Name;
     readonly payload: Payload;
     readonly idempotencyKey: (payload: DecodedPayload<Payload>) => string;
@@ -4061,13 +4155,15 @@ declare type WorkflowFn = <const Name extends string, Payload extends WorkflowPa
     readonly schedule?: WorkflowScheduleDeclaration<DecodedPayload<Payload>>;
 } & Omit<WorkflowBaseOptions, 'name' | 'payload' | 'idempotencyKey' | 'success' | 'error'> & WorkflowVersionOptions & {
     readonly messages?: Messages;
-} & WorkflowFlowControl<DecodedPayload<Payload>> & WorkflowAccessOptions<DecodedPayload<Payload>>) => workflowModule.Workflow<Name, PayloadSchemaOf<Payload>, Success, Error> & WorkflowMessagesCarrier<NormaliseWorkflowMessages<Messages>>;
+} & WorkflowFlowControl<DecodedPayload<Payload>> & WorkflowAccessOptions<DecodedPayload<Payload>>) => workflowModule.Workflow<Name, PayloadSchemaOf<Payload>, Success, Error> & {
+    readonly name: Name;
+} & WorkflowMessagesCarrier<NormaliseWorkflowMessages<Messages>>;
 
 declare type WorkflowMake = typeof workflowModule.make;
 
 export declare interface WorkflowMessagePairSchemas {
-    readonly payload: Schema.Schema.Any;
-    readonly success: Schema.Schema.Any;
+    readonly payload: Schema.Top;
+    readonly success: Schema.Top;
 }
 
 export declare interface WorkflowMessagesCarrier<M extends WorkflowMessagesMetadata = WorkflowMessagesMetadata> {
@@ -4085,12 +4181,12 @@ export declare interface WorkflowMessagesCarrier<M extends WorkflowMessagesMetad
  * and updates (synchronous, with a result) are the channels that exist.
  */
 export declare interface WorkflowMessageSchemas {
-    readonly signals?: Readonly<Record<string, Schema.Schema.Any>>;
+    readonly signals?: Readonly<Record<string, Schema.Top>>;
     readonly updates?: Readonly<Record<string, WorkflowMessagePairSchemas>>;
 }
 
 export declare interface WorkflowMessagesMetadata {
-    readonly signals: Readonly<Record<string, Schema.Schema.Any>>;
+    readonly signals: Readonly<Record<string, Schema.Top>>;
     readonly updates: Readonly<Record<string, WorkflowMessagePairSchemas>>;
 }
 
@@ -4308,7 +4404,7 @@ declare interface WorkflowRunOutcome {
 export declare class WorkflowRunRecorder extends WorkflowRunRecorder_base {
 }
 
-declare const WorkflowRunRecorder_base: Context.TagClass<WorkflowRunRecorder, "@voltro/WorkflowRunRecorder", WorkflowRunRecorderService>;
+declare const WorkflowRunRecorder_base: Context.ServiceClass<WorkflowRunRecorder, "@voltro/WorkflowRunRecorder", WorkflowRunRecorderService>;
 
 export declare interface WorkflowRunRecorderOptions {
     readonly store: WorkflowRecordingStore;
@@ -4541,7 +4637,7 @@ export declare type WorkflowStartResolution = {
  * Receives the user's `execute` Effect + a `WorkflowStepContext`
  * carrying `{ runId, stepName, attempt }`. Returns a wrapped Effect.
  * A FAIL inside the interceptor abort the step the same way a fail
- * in the user effect would — including triggering @effect/workflow's
+ * in the user effect would — including triggering effect/workflow's
  * retry policy.
  */
 export declare interface WorkflowStepContext {
@@ -4567,7 +4663,7 @@ export declare interface WorkflowStepInterceptorService {
 export declare class WorkflowStepInterceptorTag extends WorkflowStepInterceptorTag_base {
 }
 
-declare const WorkflowStepInterceptorTag_base: Context.TagClass<WorkflowStepInterceptorTag, "@voltro/WorkflowStepInterceptor", WorkflowStepInterceptorService>;
+declare const WorkflowStepInterceptorTag_base: Context.ServiceClass<WorkflowStepInterceptorTag, "@voltro/WorkflowStepInterceptor", WorkflowStepInterceptorService>;
 
 /**
  * Smooth throughput: excess starts QUEUE and are admitted as capacity frees up.
@@ -4650,7 +4746,7 @@ export declare interface WorkflowVersionOptions {
      * suspended-on-failure run shows up under `--status suspended`, NOT in the
      * dead-letter view — it is recoverable, not dead.
      *
-     * Maps to `@effect/workflow`'s `SuspendOnFailure` annotation.
+     * Maps to `effect/workflow`'s `SuspendOnFailure` annotation.
      */
     readonly suspendOnFailure?: boolean;
 }