Bumps attempts and leaves the row 'pending'; only deadLetter may flip the status. A
non-existent row is left untouched.
Optionaloptions: CallOptionsGrabs up to limit pending rows oldest-first, each locked so a concurrent worker picks
different ones. An 'applied' or 'dead' row is terminal and never re-claimed.
Optionaloptions: CallOptionsSets status 'dead' so claimInbound never returns it again, recording reason for
operators; a non-existent or already-terminal row is left untouched.
Optionaloptions: CallOptionsDedupes on entry.key, so a redelivered provider event is applied at most once.
Optionaloptions: CallOptionsCalled inside the apply's transaction, so a rolled-back apply leaves the row 'pending'; a non-existent or already-terminal row is left untouched.
Optionaloptions: CallOptionsFlips up to limit oldest 'dead' rows back to 'pending', resetting attempts to 0 and
clearing reason, and returns the revived rows. 'applied' rows never revive. Only queue
state changes, never the ledger: a revived row still applies through the normal drain under
its idempotency key, so a wrong revive costs work, not money.
Optionaloptions: CallOptions
A transactional inbox: the inbound mirror of OutboxStore. A verified provider event, mapped to the Operation it should apply, saves in the same transaction as the ingress that claimed it; a recorded event is eventually applied or dead-lettered.