@effect-agent/platform-cloudflare 0.1.0-beta.13 → 0.1.0-beta.131

package/dist/Alarm.mjs

@@ -0,0 +1,947 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { DurableObjectContext } from "./CloudflareBindings.mjs";
+import { AuxiliaryDispatchMillis, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.mjs";
+import { r as safeCauseMessage } from "./boundary-BguazVkh.mjs";
+import { Cause, Clock, Context, DateTime, Deferred, Effect, Exit, Fiber, Layer, Option, Random, Ref, Result, Schema, Scope, Semaphore, Stream, Struct } from "effect";
+import "effect-agent/agent-registration";
+import { DurableAgentRuntime, DurableRuntimeConfig, RecoveryBlocked, RecoveryFailure, RecoverySweepResult, isolateRecovery } from "effect-agent/durable-agent-runtime";
+import { SubmissionId, ThreadId } from "effect-agent/identifiers";
+import { OperationAuthorizationRequest, OperationAuthorizer } from "effect-agent/operation-authorizer";
+import { AbortIntentRequest, SubmissionLedger } from "effect-agent/submission-ledger";
+import { ThreadProjectionMaintenance, drainDue } from "effect-agent/thread-projection-maintenance";
+import { WakeScheduler } from "effect-agent/wake-scheduler";
+import { DurableObjectStorage } from "effect-cf";
+import { SqlClient } from "effect/unstable/sql/SqlClient";
+//#region src/Alarm.ts
+var Alarm_exports = /* @__PURE__ */ __exportAll({
+	DurableAlarmError: () => DurableAlarmError,
+	DurableAlarmService: () => DurableAlarmService,
+	MaintenancePassReport: () => MaintenancePassReport,
+	ThreadHostMaintenance: () => ThreadHostMaintenance,
+	ThreadMaintenance: () => ThreadMaintenance,
+	ThreadMaintenanceFailpoint: () => ThreadMaintenanceFailpoint,
+	ThreadMessageDelivery: () => ThreadMessageDelivery,
+	ThreadMutationGate: () => ThreadMutationGate,
+	ThreadPublication: () => ThreadPublication,
+	ThreadRecoveryFault: () => ThreadRecoveryFault,
+	publishCommitted: () => publishCommitted
+});
+/**
+* The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
+* alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement
+* and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
+* the slot always holds the EARLIEST deadline any caller asked for.
+*
+* The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable
+* maintenance generation and a committed alarm. Stable externally-driven waits may be
+* nonterminal without retaining an alarm; their resolving mutation advances the generation and
+* restores the alarm atomically.
+*/
+/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
+var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
+	operation: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
+	operation,
+	message: safeCauseMessage(cause, "The Cloudflare alarm API failed without a diagnostic"),
+	cause
+});
+const makeStorageEffect = Effect.map(SqlClient, (sql) => (operation, execute) => Effect.flatMap(Effect.serviceOption(sql.transactionService), (current) => {
+	const body = Effect.uninterruptible(execute);
+	return current._tag === "Some" ? body : Effect.scoped(Effect.andThen(sql.reserve.pipe(Effect.mapError(alarmFailure(operation))), body));
+}));
+const makeStorageOperation = Effect.map(makeStorageEffect, (run) => (operation, execute) => run(operation, Effect.tryPromise({
+	try: execute,
+	catch: alarmFailure(operation)
+})));
+/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */
+var DurableAlarmService = class DurableAlarmService extends Context.Service()("@effect-agent/platform-cloudflare/DurableAlarmService") {
+	static layer = Layer.effect(DurableAlarmService)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		/**
+		* In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
+		* running pass, and a deferred wake lost to eviction was only ever a promptness hint
+		* on top of the already-committed pre-armed alarm.
+		*/
+		const runningPasses = yield* Ref.make(0);
+		const storageOperation = yield* makeStorageOperation;
+		const scheduled = storageOperation("get alarm", () => ctx.storage.getAlarm()).pipe(Effect.map((deadline) => deadline === null ? Option.none() : Option.some(deadline)));
+		const scheduleAt = (epochMillis) => storageOperation("set alarm", () => ctx.storage.setAlarm(epochMillis));
+		const ensureScheduledBy = (epochMillis) => storageOperation("ensure alarm", () => ctx.storage.transaction(async (transaction) => {
+			const existing = await transaction.getAlarm();
+			if (existing === null || existing > epochMillis) await transaction.setAlarm(epochMillis);
+		}));
+		const armNow = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => ensureScheduledBy(now)));
+		const scheduleNow = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Effect.void : armNow));
+		const withWakesDeferred = (body) => Ref.update(runningPasses, (passes) => passes + 1).pipe(Effect.andThen(body), Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)));
+		const cancel = storageOperation("delete alarm", () => ctx.storage.deleteAlarm());
+		return DurableAlarmService.of({
+			scheduled,
+			scheduleAt,
+			ensureScheduledBy,
+			scheduleNow,
+			withWakesDeferred,
+			cancel
+		});
+	}));
+};
+/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
+var MaintenancePassReport = class extends Schema.Class("@effect-agent/platform-cloudflare/MaintenancePassReport")({
+	/** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */
+	phase: Schema.Literals(["caught-up", "actionable"]),
+	/** Recovery decisions and Thread faults observed during this event. */
+	recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Head Attempts settled during the event. Joined input may settle with each head. */
+	settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */
+	alarm: Schema.Literals(["rearmed", "cleared"])
+}) {};
+/** Test-only fault authority; production uses the inert layer. */
+var ThreadMaintenanceFailpoint = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint") {
+	static layer = Layer.succeed(this)({ hit: () => Effect.void });
+};
+/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */
+var ThreadPublication = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadPublication") {
+	static layer = Layer.succeed(this)({
+		invalidate: Effect.void,
+		prepareGeneration: () => Effect.void,
+		drain: Effect.void,
+		pendingDeadline: Effect.succeed(Option.none())
+	});
+};
+/**
+* Host-assembled native message recovery. Preparation is a bounded local selection; the
+* driver bounds each actual Claim and persists its timeout/retry before `run` returns.
+* The alarm must not add a timer starting at selection: Claim setup and retry commits belong
+* to the driver. The prepared allowance decides only whether a wave fits this event.
+*/
+const ThreadMessageDelivery = Context.Reference("@effect-agent/platform-cloudflare/ThreadMessageDelivery", { defaultValue: () => ({
+	prepare: Effect.succeed({
+		timeoutMillis: 1,
+		run: Effect.void
+	}),
+	pendingDeadline: Effect.succeed(Option.none())
+}) });
+/** Independent lanes share the existing alarm; compose hosts by concatenating their lanes. */
+const ThreadHostMaintenance = Context.Reference("@effect-agent/platform-cloudflare/ThreadHostMaintenance", { defaultValue: () => ({ lanes: [] }) });
+const earliestDeadline = (left, right) => Option.isSome(left) ? Option.isSome(right) ? Option.some(Math.min(left.value, right.value)) : left : right;
+/** @internal A committed source operation must not become a failed operation because delivery failed. */
+const publishCommitted = Effect.gen(function* () {
+	const publication = yield* ThreadPublication;
+	yield* publication.invalidate.pipe(Effect.andThen(publication.drain));
+}).pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logError("Thread publication deferred after source commit", cause)));
+const MaintenanceGeneration = Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n));
+var BindingRetry = class extends Schema.Class("BindingRetry")({
+	threadId: ThreadId,
+	submissionId: SubmissionId,
+	attempts: Schema.Natural,
+	notBefore: Schema.Finite,
+	reportedAt: Schema.Finite
+}) {};
+/**
+* A durable observation of blocked recovery, independent of the execution journal. This is
+* neither a Settlement nor proof that external effects did not happen. A successful recovery
+* sweep clears it; repair must preserve canonical history and the original admission identity.
+*/
+var ThreadRecoveryFault = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadRecoveryFault")({
+	schemaVersion: Schema.Literal(1),
+	threadId: ThreadId,
+	firstFailedAt: Schema.Finite,
+	lastFailedAt: Schema.Finite,
+	/** Earliest automatic recovery retry; new admissions do not erase this deadline. */
+	retryAt: Schema.Finite,
+	/** Saturates at 2^31 - 1; one observation per Thread per recovery sweep. */
+	attempts: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2147483647)),
+	failure: RecoveryFailure
+}) {};
+const recoveryFaultKey = (threadId) => `effect-agent:thread-recovery-fault:v1:${threadId}`;
+const decodeRecoveryFaultValue = Schema.decodeUnknownSync(ThreadRecoveryFault);
+const decodeRecoveryFault = (threadId, encoded) => {
+	const fault = decodeRecoveryFaultValue(encoded);
+	if (fault.threadId !== threadId) throw new Error("Recovery status does not match its Thread key");
+	return fault;
+};
+const encodeRecoveryFault = Schema.encodeSync(ThreadRecoveryFault);
+const nativeDispatchConcurrency = 2;
+var MaintenanceRetry = class extends Schema.Class("MaintenanceRetry")({
+	generation: MaintenanceGeneration,
+	notBefore: Schema.Finite,
+	nativeOnly: Schema.Boolean,
+	stalls: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(30))
+}) {};
+/** Versioned, platform-private maintenance state stored through Durable Object KV. */
+var ThreadMaintenanceState = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadMaintenanceState")({
+	schemaVersion: Schema.Literal(1),
+	dirty: MaintenanceGeneration,
+	processed: MaintenanceGeneration,
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** One physical-owner cursor; old single-lane records need no conversion. */
+	lastServedThreadId: Schema.optionalKey(ThreadId),
+	/** Rotate old recovery independently of dispatch, including after eviction or timeout. */
+	lastRecoveredThreadId: Schema.optionalKey(ThreadId),
+	bindingRetries: Schema.optionalKey(Schema.Array(BindingRetry)),
+	/** Absent on older records. A newer mutation makes this retry obsolete. */
+	retry: Schema.optionalKey(MaintenanceRetry)
+}) {};
+const MAINTENANCE_STATE_KEY = "effect-agent:thread-maintenance:v1";
+const decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);
+const encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);
+const initialMaintenanceState = () => ThreadMaintenanceState.make({
+	schemaVersion: 1,
+	dirty: 1n,
+	processed: 0n,
+	nonterminal: 0
+});
+const readMaintenanceState = async (transaction) => {
+	const encoded = await transaction.get(MAINTENANCE_STATE_KEY);
+	return encoded === void 0 ? {
+		state: initialMaintenanceState(),
+		initialized: false
+	} : {
+		state: decodeMaintenanceState(encoded),
+		initialized: true
+	};
+};
+const ensureTransactionAlarmBy = async (transaction, deadline) => {
+	const scheduled = await transaction.getAlarm();
+	if (scheduled === null || scheduled > deadline) await transaction.setAlarm(deadline);
+};
+const stableExternalWait = (snapshot, reports) => {
+	const report = reports.get(snapshot.submissionId);
+	if (report?.decision._tag === "SettleAborted") return false;
+	switch (snapshot.state) {
+		case "suspended":
+		case "joined": return true;
+		case "unknown": return report?.disposition === "unknown";
+		case "admitted": return reports.get(snapshot.submissionId)?.decision._tag === "AwaitParentEstablishment";
+		case "input-applied":
+		case "joining":
+		case "ready":
+		case "running":
+		case "settled":
+		case "terminalizing": return false;
+	}
+};
+/**
+* Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.
+* `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance
+* Layers must reuse that instance; a second gate cannot observe the native producers' activity.
+*/
+var ThreadMutationGate = class ThreadMutationGate extends Context.Service()("@effect-agent/platform-cloudflare/internal/ThreadMutationGate") {
+	static layer = Layer.effect(this)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const failpoint = yield* ThreadMaintenanceFailpoint;
+		const activeMutations = yield* Ref.make(0);
+		const generationGate = yield* Semaphore.make(1);
+		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+		const runTransaction = yield* makeStorageOperation;
+		const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* (invalidatesRecovery) {
+			yield* failpoint.hit("maintenance:dirty:before");
+			const now = yield* Clock.currentTimeMillis;
+			yield* runTransaction("advance maintenance generation", () => ctx.storage.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				const next = ThreadMaintenanceState.make({
+					...state,
+					dirty: state.dirty + (invalidatesRecovery ? 1n : 0n)
+				});
+				if (invalidatesRecovery || !initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+				await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+			}));
+			yield* failpoint.hit("maintenance:dirty:after");
+			yield* Ref.update(activeMutations, (active) => active + 1);
+		});
+		const endMutation = generationGate.withPermit(Ref.update(activeMutations, (active) => Math.max(0, active - 1)));
+		const withMutation = (body, options) => Effect.acquireUseRelease(generationGate.withPermit(beginMutation(options?.invalidatesRecovery ?? true)), () => failpoint.hit("maintenance:mutation:armed").pipe(Effect.andThen(body), Effect.tap(() => failpoint.hit("maintenance:mutation:finished"))), () => endMutation);
+		return ThreadMutationGate.of({
+			withMutation,
+			withSnapshot: (body) => generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body))
+		});
+	}));
+};
+/**
+* Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).
+*
+* One physical event owns native scheduling, auxiliary delivery and final alarm rearming.
+*
+* 1. Prearm before any work. A caught-up native step uses the O(1) generation record without
+*    recovery, ledger scans or canonical-history reads.
+* 2. Reconcile before each head Attempt, then checkpoint only the observed generation. A racing
+*    producer keeps its generation dirty and immediately eligible. Quiescent native retries
+*    retain their durable backoff.
+* 3. Admit at most two independent Thread Attempts, one active head per Thread.
+*    Keep native and delivery admission open together while finite waves remain active, so
+*    fresh replies and abort controls can progress during unrelated cleanup. Close atomically
+*    at quiescence, or at the original ten-minute yield deadline, then join admitted waves.
+* 4. Native message delivery retains its driver-owned Claim deadline. Host/backfill waves are
+*    bounded independently; incoming native work never restarts or cancels their attempts.
+*    Auxiliary failures are reported after the current native opportunity.
+* 5. Close every event resource before the final gated deadline snapshot and alarm decision.
+*    The whole event retains one fourteen-minute cooperative timeout.
+*/
+var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ThreadMaintenance") {
+	static layer = Layer.effect(ThreadMaintenance)(Effect.gen(function* () {
+		const runtime = yield* DurableAgentRuntime;
+		const recoveryConfig = yield* DurableRuntimeConfig;
+		const ledger = yield* SubmissionLedger;
+		const wakes = yield* WakeScheduler;
+		const alarm = yield* DurableAlarmService;
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const { ctx } = yield* DurableObjectContext;
+		const storage = DurableObjectStorage.fromDurableObjectStorage(ctx.storage);
+		const runStorage = yield* makeStorageEffect;
+		const failpoint = yield* ThreadMaintenanceFailpoint;
+		const mutations = yield* ThreadMutationGate;
+		const publication = yield* ThreadPublication;
+		const projection = yield* ThreadProjectionMaintenance;
+		const messages = yield* ThreadMessageDelivery;
+		const host = yield* ThreadHostMaintenance;
+		const authorizer = yield* OperationAuthorizer;
+		const projectionDeadline = projection.pendingDeadline.pipe(Effect.catchCauseIf((cause) => !Cause.hasInterrupts(cause), (cause) => Effect.logError("Thread projection deadline unavailable", cause).pipe(Effect.as(Option.some(0)))));
+		const pendingDeadline = Effect.gen(function* () {
+			return earliestDeadline(earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline), earliestDeadline(yield* projectionDeadline, (yield* Effect.forEach(host.lanes, (lane) => lane.pendingDeadline)).reduce(earliestDeadline, Option.none())));
+		});
+		const maintenancePassGate = yield* Semaphore.make(1);
+		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+		const runTransaction = yield* makeStorageOperation;
+		const recoveryStatus = Effect.fn("ThreadMaintenance.recoveryStatus")(function* (threadId) {
+			yield* authorizer.authorize(OperationAuthorizationRequest.make({
+				operation: "explain",
+				threadId
+			}));
+			return yield* runTransaction("read Thread recovery status", async () => {
+				const encoded = await ctx.storage.get(recoveryFaultKey(threadId));
+				return encoded === void 0 ? Option.none() : Option.some(decodeRecoveryFault(threadId, encoded));
+			});
+		});
+		const recordRecoveryStatus = Effect.fn("ThreadMaintenance.recordRecoveryStatus")(function* (result) {
+			const threads = /* @__PURE__ */ new Map();
+			for (const report of result.reports) threads.set(report.threadId, void 0);
+			for (const blocked of result.blocked) threads.set(blocked.threadId, blocked.failure);
+			if (threads.size === 0) return /* @__PURE__ */ new Map();
+			const now = yield* Clock.currentTimeMillis;
+			yield* failpoint.hit("maintenance:recovery-status:before");
+			const retained = yield* runTransaction("record Thread recovery status", () => ctx.storage.transaction(async (transaction) => {
+				const changed = [];
+				const newlyBlocked = [];
+				const faults = /* @__PURE__ */ new Map();
+				for (const [threadId, failure] of threads) {
+					const key = recoveryFaultKey(threadId);
+					const encoded = await transaction.get(key);
+					const previous = encoded === void 0 ? void 0 : decodeRecoveryFault(threadId, encoded);
+					if (failure === void 0) {
+						if (previous !== void 0) {
+							await transaction.delete(key);
+							changed.push(threadId);
+						}
+						continue;
+					}
+					const fault = ThreadRecoveryFault.make({
+						schemaVersion: 1,
+						threadId,
+						firstFailedAt: previous?.firstFailedAt ?? now,
+						lastFailedAt: now,
+						attempts: Math.min(2147483647, (previous?.attempts ?? 0) + 1),
+						retryAt: now + Math.min(6e4, 5e3 * 2 ** Math.min(30, previous?.attempts ?? 0)),
+						failure
+					});
+					await transaction.put(key, encodeRecoveryFault(fault));
+					changed.push(threadId);
+					faults.set(threadId, fault);
+					if (previous === void 0) newlyBlocked.push(fault);
+				}
+				return {
+					changed,
+					newlyBlocked,
+					faults
+				};
+			}));
+			yield* failpoint.hit("maintenance:recovery-status:after");
+			for (const threadId of retained.changed) yield* wakes.notify(threadId);
+			for (const fault of retained.newlyBlocked) yield* Effect.logError("Native Thread recovery blocked; accepted work remains pending", fault.failure.reason === "defect" ? Cause.die(fault.failure) : Cause.fail(fault.failure)).pipe(Effect.annotateLogs({ threadId: fault.threadId }));
+			return retained.faults;
+		});
+		const recoverThread = Effect.fn("ThreadMaintenance.recoverThread")(function* (threadId, recovery) {
+			const result = yield* runtime.runRecovery({ threadId });
+			const faults = yield* recordRecoveryStatus(result);
+			for (const report of result.reports) recovery.reports.set(report.submissionId, report);
+			recovery.faults.delete(threadId);
+			for (const [id, fault] of faults) recovery.faults.set(id, fault);
+			recovery.recovered += result.reports.length + result.blocked.length;
+			recovery.repaired ||= result.reports.some((report) => report.disposition === "repaired");
+		});
+		const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
+			yield* failpoint.hit("maintenance:ensure:before");
+			const now = yield* Clock.currentTimeMillis;
+			const retry = yield* runTransaction("ensure maintenance alarm", () => ctx.storage.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				if (state.dirty > state.processed) await ensureTransactionAlarmBy(transaction, state.retry?.generation === state.dirty ? Math.max(now + minimumAlarmDelay, state.retry.notBefore) : now + config.wakeScanInterval);
+				return state.retry?.generation === state.dirty ? state.retry : void 0;
+			}));
+			const deadline = yield* pendingDeadline;
+			if (Option.isSome(deadline)) yield* runTransaction("ensure publication alarm", () => ctx.storage.transaction((transaction) => ensureTransactionAlarmBy(transaction, Math.max(now + minimumAlarmDelay, deadline.value <= now && retry !== void 0 && !retry.nativeOnly ? Math.max(deadline.value, retry.notBefore) : deadline.value))));
+			yield* failpoint.hit("maintenance:ensure:after");
+		});
+		const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* (observed) {
+			yield* failpoint.hit("maintenance:begin:before");
+			const now = yield* Clock.currentTimeMillis;
+			const result = yield* runTransaction("begin maintenance pass", () => ctx.storage.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				observed.generation = state.dirty;
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				const retryAt = state.retry?.generation === state.dirty ? state.retry.notBefore : 0;
+				await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+				if (state.processed >= state.dirty || retryAt > now) return {
+					_tag: "CaughtUp",
+					nonterminal: state.nonterminal
+				};
+				return {
+					_tag: "Actionable",
+					generation: state.dirty,
+					nonterminal: state.nonterminal,
+					stalls: state.retry?.generation === state.dirty ? state.retry.stalls : 0
+				};
+			}));
+			yield* failpoint.hit("maintenance:begin:after");
+			return result;
+		});
+		const backoffDelay = (priorStalls, jitter) => {
+			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** Math.min(priorStalls, 30));
+			return Math.ceil(backoff / 2 + backoff / 2 * jitter);
+		};
+		const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (progressed, priorStalls) {
+			return progressed ? config.alarmBackoffBase : backoffDelay(priorStalls, yield* Random.next);
+		});
+		const rearmFailure = Effect.fn("ThreadMaintenance.rearmFailure")(function* (observed) {
+			const { generation, nativeOnly } = observed;
+			if (generation === void 0) return;
+			yield* failpoint.hit("maintenance:retry:before");
+			yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+				const deadline = yield* pendingDeadline.pipe(Effect.catchCause(() => Effect.succeed(Option.none())));
+				const now = yield* Clock.currentTimeMillis;
+				const jitter = yield* Random.next;
+				yield* runTransaction("back off failed maintenance", () => ctx.storage.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const previous = state.retry?.generation === generation && state.retry.nativeOnly === nativeOnly ? state.retry : void 0;
+					const retry = MaintenanceRetry.make({
+						generation,
+						notBefore: Math.max(previous?.notBefore ?? 0, now + backoffDelay(previous?.stalls ?? 0, jitter)),
+						nativeOnly,
+						stalls: Math.min(30, (previous?.stalls ?? 0) + 1)
+					});
+					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...state,
+						retry
+					})));
+					const nativeDeadline = active > 0 || state.dirty !== generation ? now + minimumAlarmDelay : retry.notBefore;
+					await transaction.setAlarm(Math.max(now + minimumAlarmDelay, Option.isSome(deadline) && (nativeOnly || deadline.value > now) ? Math.min(nativeDeadline, deadline.value) : nativeDeadline));
+				}));
+			}));
+			yield* failpoint.hit("maintenance:retry:after");
+		});
+		const beginNative = Effect.fn("ThreadMaintenance.beginNative")(function* (observed) {
+			return yield* mutations.withSnapshot((activeAtStart) => Effect.gen(function* () {
+				const generation = yield* beginPass(observed);
+				if (generation._tag === "Actionable" && activeAtStart === 0) yield* publication.prepareGeneration(generation.generation);
+				return {
+					...generation,
+					activeAtStart
+				};
+			}));
+		});
+		const attemptSelected = Effect.fn("ThreadMaintenance.attemptSelected")(function* (selected, previousRetries, yieldAfter, recovery) {
+			yield* recoverThread(selected.threadId, recovery);
+			let bindingFailure;
+			const settlement = recovery.faults.has(selected.threadId) ? Option.none() : yield* runtime.processThreadHead(selected.threadId, { yieldAfter }).pipe(Effect.catchTag("BindingUnavailable", (failure) => {
+				bindingFailure = failure;
+				return Effect.succeed(Option.none());
+			}));
+			const previous = previousRetries.find((retry) => retry.submissionId === selected.submissionId);
+			let retry;
+			let reportBindingFailure = false;
+			if (bindingFailure !== void 0) {
+				const now = yield* Clock.currentTimeMillis;
+				const attempts = Math.min(30, (previous?.attempts ?? 0) + 1);
+				reportBindingFailure = previous === void 0 || now - previous.reportedAt >= 9e5;
+				retry = BindingRetry.make({
+					threadId: selected.threadId,
+					submissionId: selected.submissionId,
+					attempts,
+					notBefore: now + Math.min(6e4, 5e3 * 2 ** (attempts - 1)),
+					reportedAt: reportBindingFailure ? now : previous?.reportedAt ?? now
+				});
+			}
+			if (retry !== void 0 || previous !== void 0) {
+				yield* failpoint.hit("maintenance:binding-retry:before");
+				yield* runStorage("record submission binding retry", storage.transaction((transaction) => Effect.gen(function* () {
+					const encoded = yield* transaction.get(MAINTENANCE_STATE_KEY);
+					const state = encoded === void 0 ? initialMaintenanceState() : yield* Schema.decodeUnknownEffect(ThreadMaintenanceState)(encoded);
+					const bindingRetries = [...(state.bindingRetries ?? []).filter((entry) => entry.submissionId !== selected.submissionId), ...retry === void 0 ? [] : [retry]];
+					yield* transaction.put(MAINTENANCE_STATE_KEY, yield* Schema.encodeEffect(ThreadMaintenanceState)(ThreadMaintenanceState.make({
+						...state,
+						bindingRetries
+					})));
+				})).pipe(Effect.mapError(alarmFailure("record submission binding retry"))));
+				yield* failpoint.hit("maintenance:binding-retry:after");
+			}
+			if (bindingFailure !== void 0) yield* reportBindingFailure ? Effect.logError("Thread awaits a current agent binding; original work remains pending", Cause.fail(bindingFailure)) : Effect.logDebug("Thread binding retry remains pending", Cause.fail(bindingFailure));
+			return Option.isSome(settlement) ? 1 : 0;
+		});
+		const advance = Effect.fn("ThreadMaintenance.advance")(function* (started, yieldAfter, observed, recovery, native, dispatch = true, reserved = new Set(native.active.keys())) {
+			const deadline = yield* publication.pendingDeadline;
+			if (started._tag === "Actionable" || Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis)) yield* publication.drain;
+			const pending = yield* publication.pendingDeadline;
+			if (started._tag === "CaughtUp" || Option.isSome(pending)) {
+				const nextAttemptAt = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+					const now = yield* Clock.currentTimeMillis;
+					const { state } = yield* runTransaction("read native maintenance deadline", () => ctx.storage.transaction((transaction) => readMaintenanceState(transaction)));
+					const native = active > 0 || state.dirty > state.processed ? state.retry?.generation === state.dirty && active === 0 ? state.retry.notBefore : now + minimumAlarmDelay : Infinity;
+					const next = Option.isSome(pending) ? pending.value : native;
+					return Number.isFinite(next) ? Math.max(now + minimumAlarmDelay, next) : void 0;
+				}));
+				return {
+					phase: "caught-up",
+					nonterminal: started.nonterminal,
+					nextAttemptAt
+				};
+			}
+			if (native.generation !== started.generation) {
+				native.deferred.clear();
+				native.generation = started.generation;
+			}
+			if (native.active.size > 0 && native.scanGeneration === started.generation) return {
+				phase: "actionable",
+				nonterminal: started.nonterminal,
+				nextAttemptAt: void 0
+			};
+			native.scanGeneration = started.activeAtStart === 0 ? started.generation : void 0;
+			observed.nativeOnly = true;
+			const observation = recovery.observation ??= {
+				generation: started.generation,
+				activeAtStart: started.activeAtStart
+			};
+			const current = yield* Stream.runCollect(ledger.scanNonterminal);
+			const selectionTime = yield* Clock.currentTimeMillis;
+			yield* runTransaction("read Thread recovery deadlines", async () => {
+				for (const threadId of new Set(current.map((row) => row.threadId))) {
+					if (recovery.loaded.has(threadId)) continue;
+					const encoded = await ctx.storage.get(recoveryFaultKey(threadId));
+					if (encoded !== void 0) recovery.faults.set(threadId, decodeRecoveryFault(threadId, encoded));
+					recovery.loaded.add(threadId);
+				}
+			});
+			const reports = recovery.reports;
+			const recoveryFaults = recovery.faults;
+			const waiting = (row) => !recovery.pending.has(row.threadId) && !recoveryFaults.has(row.threadId) && stableExternalWait(row, reports);
+			const heads = /* @__PURE__ */ new Map();
+			for (const row of current) {
+				if (row.state === "unknown" && waiting(row)) continue;
+				if (!heads.has(row.threadId)) heads.set(row.threadId, row);
+			}
+			const stopping = /* @__PURE__ */ new Set();
+			for (const head of heads.values()) {
+				if (head.state !== "ready" || native.active.has(head.threadId) || recovery.pending.has(head.threadId) || recoveryFaults.has(head.threadId)) continue;
+				const intent = yield* isolateRecovery(ledger.readAbortIntent(AbortIntentRequest.make({ submissionId: head.submissionId })), {
+					timeout: recoveryConfig.recoveryTimeout,
+					phase: () => "recovery",
+					operation: "read abort intent"
+				});
+				if (Result.isSuccess(intent)) {
+					if (intent.success !== void 0) stopping.add(head.threadId);
+				} else {
+					const faults = yield* recordRecoveryStatus(RecoverySweepResult.make({
+						reports: [],
+						blocked: [RecoveryBlocked.make({
+							threadId: head.threadId,
+							failure: intent.failure
+						})]
+					}));
+					for (const [threadId, fault] of faults) recoveryFaults.set(threadId, fault);
+					recovery.recovered++;
+				}
+			}
+			const eligible = [...heads.values()].filter((head) => !recovery.pending.has(head.threadId) && !stopping.has(head.threadId) && !recoveryFaults.has(head.threadId) && !waiting(head) && (head.state === "ready" || reports.has(head.submissionId))).map((head) => head.threadId).sort();
+			yield* failpoint.hit("maintenance:select:before");
+			const selection = yield* runTransaction("select maintenance lane", () => ctx.storage.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const retries = (state.bindingRetries ?? []).filter((retry) => heads.get(retry.threadId)?.submissionId === retry.submissionId);
+				const runnable = eligible.filter((threadId) => !reserved.has(threadId) && !native.active.has(threadId) && !native.deferred.has(threadId) && !retries.some((retry) => retry.threadId === threadId && retry.notBefore > selectionTime));
+				const pivot = Math.max(0, runnable.findIndex((threadId) => state.lastServedThreadId === void 0 || threadId > state.lastServedThreadId));
+				const selected = dispatch ? [...runnable.slice(pivot), ...runnable.slice(0, pivot)].slice(0, nativeDispatchConcurrency - reserved.size) : [];
+				const next = selected.at(-1);
+				if (next !== void 0) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+					...state,
+					lastServedThreadId: next
+				})));
+				const backlog = recovery.started ? [] : [...heads.keys()].filter((threadId) => {
+					const fault = recoveryFaults.get(threadId);
+					return !eligible.includes(threadId) && (fault === void 0 || fault.retryAt <= selectionTime);
+				});
+				const after = backlog.filter((threadId) => state.lastRecoveredThreadId === void 0 || threadId > state.lastRecoveredThreadId);
+				const before = backlog.filter((threadId) => state.lastRecoveredThreadId !== void 0 && threadId <= state.lastRecoveredThreadId);
+				return {
+					selected,
+					retries,
+					backlog: [...after, ...before]
+				};
+			}));
+			yield* failpoint.hit("maintenance:select:after");
+			if (!recovery.started) {
+				recovery.started = true;
+				recovery.needsCheckpoint = selection.backlog.length > 0;
+				for (const threadId of selection.backlog) recovery.pending.add(threadId);
+				yield* Deferred.succeed(recovery.queue, selection.backlog);
+			}
+			for (const threadId of selection.selected) {
+				const selected = heads.get(threadId);
+				if (selected === void 0) continue;
+				native.dispatched++;
+				native.active.set(threadId, yield* Effect.forkIn(attemptSelected(selected, selection.retries, yieldAfter, recovery), native.scope));
+			}
+			if (native.active.size > 0) return {
+				phase: "actionable",
+				nonterminal: current.length,
+				nextAttemptAt: void 0,
+				dispatched: selection.selected.length > 0
+			};
+			const retries = selection.retries;
+			const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+			const waitingHeads = /* @__PURE__ */ new Map();
+			const autonomous = remaining.some((snapshot) => {
+				if (snapshot.state === "unknown" && waiting(snapshot)) return false;
+				const headWaiting = waitingHeads.get(snapshot.threadId);
+				if (headWaiting === void 0) waitingHeads.set(snapshot.threadId, waiting(snapshot));
+				if (headWaiting === true && snapshot.state === "ready" && reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput") return false;
+				return !waiting(snapshot);
+			});
+			const progressed = native.progressed || recovery.repaired;
+			const now = yield* Clock.currentTimeMillis;
+			const ordinaryDelay = autonomous ? yield* rearmDelay(progressed, started.stalls) : 0;
+			const nextEligible = [...recoveryFaults.values()].map((fault) => fault.retryAt).concat(eligible.map((threadId) => retries.find((retry) => retry.submissionId === heads.get(threadId)?.submissionId)?.notBefore ?? now));
+			const retryDelay = nextEligible.length === 0 ? 0 : Math.max(0, Math.min(...nextEligible) - now);
+			const delay = Math.max(ordinaryDelay, retryDelay);
+			yield* failpoint.hit("maintenance:checkpoint:before");
+			const nextAttemptAt = yield* mutations.withSnapshot((active) => runTransaction("checkpoint native maintenance", () => ctx.storage.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const mutationOverlap = observation.activeAtStart > 0 || started.activeAtStart > 0 || active > 0;
+				const processed = autonomous || mutationOverlap ? state.processed : state.processed > observation.generation ? state.processed : observation.generation;
+				const canBackoff = !mutationOverlap && state.dirty === started.generation;
+				const next = ThreadMaintenanceState.make({
+					...Struct.omit(state, ["retry"]),
+					processed,
+					nonterminal: remaining.length,
+					bindingRetries: (state.bindingRetries ?? []).filter((retry) => remaining.some((row) => row.submissionId === retry.submissionId)),
+					...autonomous && !progressed && canBackoff ? { retry: MaintenanceRetry.make({
+						generation: started.generation,
+						notBefore: now + delay,
+						nativeOnly: true,
+						stalls: Math.min(30, started.stalls + 1)
+					}) } : {}
+				});
+				await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+				if (autonomous) return now + (canBackoff ? delay : minimumAlarmDelay);
+				return mutationOverlap || next.dirty > next.processed ? now + minimumAlarmDelay : void 0;
+			})));
+			yield* failpoint.hit("maintenance:checkpoint:after");
+			native.deferred.clear();
+			native.progressed = false;
+			native.needsCheckpoint = false;
+			return {
+				phase: "actionable",
+				nonterminal: remaining.length,
+				nextAttemptAt
+			};
+		});
+		const pass = Effect.fn("ThreadMaintenance.pass")(function* (yieldAfter, dispatchUntil, observed) {
+			const notified = (yield* Stream.toPull(wakes.wakes)).pipe(Effect.asVoid, Effect.catch(() => Effect.never));
+			const started = yield* beginNative(observed);
+			const auxiliaryScope = yield* Effect.acquireRelease(Scope.make("parallel"), (scope, exit) => Scope.close(scope, exit));
+			const fork = (work) => Effect.forkIn(work, auxiliaryScope);
+			const lanes = host.lanes.map((lane) => ({
+				...lane,
+				initial: true,
+				check: true,
+				exhausted: false,
+				fiber: void 0
+			}));
+			let messageExhausted = false;
+			let delivery;
+			let failure;
+			const recovery = {
+				queue: yield* Deferred.make(),
+				pending: /* @__PURE__ */ new Set(),
+				loaded: /* @__PURE__ */ new Set(),
+				reports: /* @__PURE__ */ new Map(),
+				faults: /* @__PURE__ */ new Map(),
+				started: false,
+				needsCheckpoint: false,
+				recovered: 0,
+				repaired: false
+			};
+			const recoveryFiber = yield* fork(Effect.gen(function* () {
+				for (const threadId of yield* Deferred.await(recovery.queue)) {
+					yield* failpoint.hit("maintenance:select:before");
+					yield* runTransaction("select old recovery lane", () => ctx.storage.transaction(async (transaction) => {
+						const { state } = await readMaintenanceState(transaction);
+						await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+							...state,
+							lastRecoveredThreadId: threadId
+						})));
+					}));
+					yield* failpoint.hit("maintenance:select:after");
+					yield* recoverThread(threadId, recovery);
+					recovery.pending.delete(threadId);
+					yield* wakes.notify(threadId);
+				}
+			}));
+			const backfill = yield* fork(drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection), Effect.timeoutOption(config.projectionDispatchTimeoutMillis)));
+			let backfillObserved = false;
+			let recoveryObserved = false;
+			const dispatch = {
+				scope: auxiliaryScope,
+				active: /* @__PURE__ */ new Map(),
+				deferred: /* @__PURE__ */ new Set(),
+				dispatched: 0,
+				settled: 0,
+				progressed: false,
+				needsCheckpoint: false
+			};
+			let native = yield* fork(advance(started, yieldAfter, observed, recovery, dispatch));
+			let result = {
+				phase: "caught-up",
+				nonterminal: started.nonterminal,
+				nextAttemptAt: void 0
+			};
+			let phase = result.phase;
+			let nativeCheck = false;
+			const until = DateTime.toEpochMillis(yieldAfter);
+			const dispatchEnd = DateTime.toEpochMillis(dispatchUntil);
+			const checkLanes = () => {
+				for (const lane of lanes) lane.check = true;
+			};
+			while (true) {
+				if (native?.pollUnsafe() !== void 0) {
+					result = yield* Fiber.join(native);
+					native = void 0;
+					if (result.phase === "actionable") phase = "actionable";
+					observed.nativeOnly = dispatch.active.size > 0;
+					if (result.dispatched === true && dispatch.active.size < nativeDispatchConcurrency) {
+						dispatch.scanGeneration = void 0;
+						nativeCheck = true;
+					}
+					recovery.started = true;
+					yield* Deferred.succeed(recovery.queue, []);
+					checkLanes();
+				}
+				for (const [threadId, attempt] of dispatch.active) {
+					const exit = attempt.pollUnsafe();
+					if (exit === void 0) continue;
+					dispatch.active.delete(threadId);
+					dispatch.scanGeneration = void 0;
+					if (Exit.isFailure(exit)) return yield* Effect.failCause(exit.cause);
+					dispatch.settled += exit.value;
+					dispatch.progressed ||= exit.value > 0;
+					dispatch.needsCheckpoint = true;
+					if (exit.value === 0) dispatch.deferred.add(threadId);
+					nativeCheck = true;
+					checkLanes();
+				}
+				if (!recoveryObserved && recoveryFiber.pollUnsafe() !== void 0) {
+					yield* Fiber.join(recoveryFiber);
+					recoveryObserved = true;
+					dispatch.scanGeneration = void 0;
+					nativeCheck ||= recovery.needsCheckpoint;
+				}
+				if (!backfillObserved) {
+					const exit = backfill.pollUnsafe();
+					if (exit !== void 0) {
+						backfillObserved = true;
+						if (Exit.isFailure(exit)) failure ??= exit.cause;
+					}
+				}
+				for (const lane of lanes) {
+					const exit = lane.fiber?.pollUnsafe();
+					if (exit === void 0) continue;
+					lane.fiber = void 0;
+					if (Exit.isFailure(exit)) {
+						failure ??= exit.cause;
+						lane.exhausted = true;
+					} else lane.check ||= exit.value;
+				}
+				const deliveryExit = delivery?.pollUnsafe();
+				if (deliveryExit !== void 0) {
+					delivery = void 0;
+					if (Exit.isFailure(deliveryExit)) {
+						failure ??= deliveryExit.cause;
+						messageExhausted = true;
+					}
+				}
+				const now = yield* Clock.currentTimeMillis;
+				if (now >= until) break;
+				for (const lane of lanes) {
+					if (lane.fiber !== void 0 || lane.exhausted || !lane.check) continue;
+					lane.check = false;
+					lane.fiber = yield* fork(Effect.gen(function* () {
+						yield* Schema.decodeEffect(AuxiliaryDispatchMillis)(lane.dispatchTimeoutMillis).pipe(Effect.mapError((cause) => DurableAlarmError.make({
+							operation: "host dispatch allowance",
+							message: "Declare an integer whole-wave allowance between 1 and 300000 milliseconds",
+							cause
+						})));
+						if ((yield* Clock.currentTimeMillis) + lane.dispatchTimeoutMillis > dispatchEnd) {
+							lane.exhausted = true;
+							return false;
+						}
+						return yield* Effect.gen(function* () {
+							if (!lane.initial) {
+								const deadline = yield* lane.pendingDeadline;
+								if (Option.isNone(deadline) || deadline.value > (yield* Clock.currentTimeMillis)) return false;
+							}
+							const selectedAt = yield* Clock.currentTimeMillis;
+							if (selectedAt >= until || selectedAt + lane.dispatchTimeoutMillis > dispatchEnd) {
+								lane.exhausted = true;
+								return false;
+							}
+							lane.initial = false;
+							yield* lane.run;
+							return true;
+						}).pipe(Effect.scoped, Effect.timeoutOrElse({
+							duration: lane.dispatchTimeoutMillis,
+							orElse: () => DurableAlarmError.make({
+								operation: "host dispatch allowance",
+								message: "The admitted host wave exceeded its allowance; durable work remains pending"
+							})
+						}));
+					}));
+				}
+				if (delivery === void 0 && !messageExhausted) {
+					const selected = yield* Effect.gen(function* () {
+						const deadline = yield* messages.pendingDeadline;
+						return Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis) ? Option.some(yield* messages.prepare) : Option.none();
+					}).pipe(Effect.exit);
+					if (Exit.isFailure(selected)) {
+						failure ??= selected.cause;
+						messageExhausted = true;
+					} else if (Option.isSome(selected.value)) {
+						const wave = selected.value.value;
+						const selectedAt = yield* Clock.currentTimeMillis;
+						if (selectedAt >= until || selectedAt + wave.timeoutMillis > dispatchEnd) messageExhausted = true;
+						else delivery = yield* fork(wave.run);
+					}
+				}
+				if (native === void 0 && dispatch.active.size === 0 && recoveryObserved && !recovery.needsCheckpoint && backfillObserved && delivery === void 0 && lanes.every((lane) => lane.fiber === void 0)) break;
+				if (native === void 0 && nativeCheck && dispatch.active.size < nativeDispatchConcurrency) {
+					nativeCheck = false;
+					const nativeCheckpoint = dispatch.needsCheckpoint && dispatch.active.size === 0;
+					const checkpoint = recoveryObserved && recovery.needsCheckpoint || nativeCheckpoint;
+					if (checkpoint) recovery.needsCheckpoint = false;
+					const reserved = new Set(dispatch.active.keys());
+					native = yield* fork(Effect.gen(function* () {
+						const awakened = checkpoint ? started : yield* beginNative(observed);
+						return yield* advance(awakened, yieldAfter, observed, recovery, dispatch, !nativeCheckpoint && (!checkpoint || dispatch.settled === 0), reserved);
+					}));
+				}
+				const next = Math.min(native === void 0 ? result.nextAttemptAt ?? Infinity : Infinity, now + config.wakeScanInterval, until);
+				const completing = [
+					...native === void 0 ? [] : [native],
+					...dispatch.active.values(),
+					...recoveryObserved ? [] : [recoveryFiber],
+					...backfillObserved ? [] : [backfill],
+					...delivery === void 0 ? [] : [delivery],
+					...lanes.flatMap((lane) => lane.fiber === void 0 ? [] : [lane.fiber])
+				];
+				if ((yield* Effect.raceAllFirst([...completing.map((fiber) => Fiber.await(fiber).pipe(Effect.as("completed"))), Effect.raceFirst(notified, Effect.sleep(Math.max(0, next - now))).pipe(Effect.as("scan"))])) === "scan") {
+					nativeCheck = true;
+					checkLanes();
+				}
+			}
+			if (native !== void 0) {
+				result = yield* Fiber.join(native);
+				if (result.phase === "actionable") phase = "actionable";
+				observed.nativeOnly = dispatch.active.size > 0;
+				recovery.started = true;
+				yield* Deferred.succeed(recovery.queue, []);
+			}
+			for (const attempt of dispatch.active.values()) {
+				const settled = yield* Fiber.join(attempt);
+				dispatch.settled += settled;
+				dispatch.progressed ||= settled > 0;
+			}
+			dispatch.active.clear();
+			observed.nativeOnly = false;
+			for (const fiber of [
+				recoveryFiber,
+				backfill,
+				...delivery === void 0 ? [] : [delivery],
+				...lanes.flatMap((lane) => lane.fiber === void 0 ? [] : [lane.fiber])
+			]) {
+				const exit = yield* Fiber.await(fiber);
+				if (Exit.isFailure(exit)) failure ??= exit.cause;
+			}
+			if (failure !== void 0) return yield* Effect.failCause(failure);
+			if (recovery.needsCheckpoint || dispatch.dispatched > 0) {
+				result = yield* advance(started, yieldAfter, observed, recovery, dispatch, false);
+				if (result.phase === "actionable") phase = "actionable";
+			}
+			yield* Scope.close(auxiliaryScope, Exit.void);
+			yield* failpoint.hit("maintenance:finish:before");
+			const disposition = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+				const latest = yield* pendingDeadline;
+				const now = yield* Clock.currentTimeMillis;
+				return yield* runTransaction("finish maintenance event", () => ctx.storage.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const native = active > 0 || state.dirty > state.processed ? state.retry?.generation === state.dirty && active === 0 ? Math.max(now + minimumAlarmDelay, state.retry.notBefore) : state.dirty === observed.generation && active === 0 ? result.nextAttemptAt ?? now + config.wakeScanInterval : now + minimumAlarmDelay : Infinity;
+					const next = Option.isSome(latest) ? Math.min(native, latest.value) : native;
+					if (Number.isFinite(next)) {
+						await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
+						return "rearmed";
+					}
+					await transaction.deleteAlarm();
+					return "cleared";
+				}));
+			}));
+			yield* failpoint.hit("maintenance:finish:after");
+			const report = MaintenancePassReport.make({
+				phase,
+				recovered: recovery.recovered,
+				settled: dispatch.settled,
+				nonterminal: result.nonterminal,
+				alarm: disposition
+			});
+			yield* Effect.annotateCurrentSpan({
+				phase: report.phase,
+				recovered: report.recovered,
+				settled: report.settled,
+				nonterminal: report.nonterminal,
+				alarm: report.alarm
+			});
+			return report;
+		});
+		return ThreadMaintenance.of({
+			pass: Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				const yieldAfter = DateTime.makeUnsafe(now + 6e5);
+				const dispatchUntil = DateTime.makeUnsafe(now + 84e4);
+				const observed = { nativeOnly: false };
+				return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(Effect.scoped(pass(yieldAfter, dispatchUntil, observed)).pipe(Effect.onErrorIf(() => true, () => rearmFailure(observed)))));
+			}).pipe(Effect.timeoutOrElse({
+				duration: "14 minutes",
+				orElse: () => DurableAlarmError.make({
+					operation: "maintenance pass deadline",
+					message: "The maintenance event exceeded its 14 minute deadline; durable recovery remains pending"
+				})
+			})),
+			ensureAlarm: mutations.withSnapshot(() => ensureAlarm()),
+			recoveryStatus,
+			withMutation: (body) => mutations.withMutation(body.pipe(Effect.tap(() => publishCommitted.pipe(Effect.provideService(ThreadPublication, publication)))))
+		});
+	}));
+};
+//#endregion
+export { DurableAlarmError, DurableAlarmService, MaintenancePassReport, ThreadHostMaintenance, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, ThreadRecoveryFault, publishCommitted, Alarm_exports as t };
+
+//# sourceMappingURL=Alarm.mjs.map