Skip to content

Workers and Recovery ​

Durable workers lease commands.

WorkflowWorkerSupervisor combines bounded recovery, timer expiry, operation work, and spawned-workflow reconciliation. Start one with a globally unique workerId on every replica.

Roles ​

  1. API / decider — start runs, respond to work, send events, drive replay.
  2. Operation worker — lease commands, run handlers, write results.
  3. Timer / recovery — fire timers, expire work, reclaim leases, resume interrupted decisions.
  4. Spawn reconciler — create child runs once and complete parent spawn commands.

Fencing ​

  • Only the current claimGeneration owner may complete a command.
  • Heartbeats must be shorter than the lease.
  • FOR UPDATE SKIP LOCKED claims work without blocking other workers.
  • A late completion after reaudience is rejected.

Recovery Inbox ​

Creating a run or recording a new fact sets decision_pending. A successful decision clears it. Workflows waiting for an operation, event, timer, work response, or child run stay blocked without consuming recovery capacity.

Operator Actions ​

Retry, redrive, and cancel are audited. They record actor, reason, and timestamp. The inspector exposes the same actions.

See Also ​