@effect-agent/platform-cloudflare 0.1.0-beta.38 → 0.1.0-beta.40

package/src/alarm.ts

@@ -1,12 +1,12 @@
 import {
-  AgentBindingResolver,
+  type ResolvedBinding,
   DurableAgentRuntime,
   SubmissionLedger,
   type DurableBindingFailure,
   type DurableWorkerFailure,
   type RecoveryReport,
   type SubmissionSnapshot,
-} from "@effect-agent/session";
+} from "@effect-agent/thread";
 import {
   Clock,
   Context,
@@ -20,7 +20,7 @@ import {
   Stream,
 } from "effect";
 
-import { ConversationObjectIdentity, DurableObjectContext } from "./bindings.ts";
+import { ThreadObjectIdentity, DurableObjectContext } from "./bindings.ts";
 import { safeCauseMessage } from "./boundary.ts";
 import { CloudflareDurableRuntimeConfig } from "./config.ts";
 
@@ -163,7 +163,7 @@ export class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(
 }) {}
 
 /** Fault boundaries around every maintenance-owned durable mutation. */
-export type ConversationMaintenanceFailpointLocation =
+export type ThreadMaintenanceFailpointLocation =
   | "maintenance:dirty:before"
   | "maintenance:dirty:after"
   | "maintenance:mutation:armed"
@@ -175,17 +175,17 @@ export type ConversationMaintenanceFailpointLocation =
   | "maintenance:finish:before"
   | "maintenance:finish:after";
 
-export type ConversationMaintenanceFailpointHandler = (
-  location: ConversationMaintenanceFailpointLocation,
+export type ThreadMaintenanceFailpointHandler = (
+  location: ThreadMaintenanceFailpointLocation,
 ) => Effect.Effect<void>;
 
 /** Test-only fault authority; production uses the inert layer. */
-export class ConversationMaintenanceFailpoint extends Context.Service<
-  ConversationMaintenanceFailpoint,
+export class ThreadMaintenanceFailpoint extends Context.Service<
+  ThreadMaintenanceFailpoint,
   {
-    readonly hit: ConversationMaintenanceFailpointHandler;
+    readonly hit: ThreadMaintenanceFailpointHandler;
   }
->()("@effect-agent/platform-cloudflare/ConversationMaintenanceFailpoint") {
+>()("@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint") {
   static readonly layer = Layer.succeed(this)({ hit: () => Effect.void });
 }
 
@@ -194,8 +194,8 @@ const MaintenanceGeneration = Schema.BigIntFromString.check(
 );
 
 /** Versioned, platform-private maintenance state stored through Durable Object KV. */
-class ConversationMaintenanceState extends Schema.Class<ConversationMaintenanceState>(
-  "@effect-agent/platform-cloudflare/ConversationMaintenanceState",
+class ThreadMaintenanceState extends Schema.Class<ThreadMaintenanceState>(
+  "@effect-agent/platform-cloudflare/ThreadMaintenanceState",
 )({
   schemaVersion: Schema.Literal(1),
   dirty: MaintenanceGeneration,
@@ -203,12 +203,12 @@ class ConversationMaintenanceState extends Schema.Class<ConversationMaintenanceS
   nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 }) {}
 
-const MAINTENANCE_STATE_KEY = "effect-agent:conversation-maintenance:v1";
-const decodeMaintenanceState = Schema.decodeUnknownSync(ConversationMaintenanceState);
-const encodeMaintenanceState = Schema.encodeSync(ConversationMaintenanceState);
+const MAINTENANCE_STATE_KEY = "effect-agent:thread-maintenance:v1";
+const decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);
+const encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);
 
-const initialMaintenanceState = (): ConversationMaintenanceState =>
-  ConversationMaintenanceState.make({
+const initialMaintenanceState = (): ThreadMaintenanceState =>
+  ThreadMaintenanceState.make({
     schemaVersion: 1,
     // Bootstrap Objects created by the pre-generation release without scanning the ledger in
     // the constructor. One useful pass classifies and acknowledges any existing obligation.
@@ -219,7 +219,7 @@ const initialMaintenanceState = (): ConversationMaintenanceState =>
 
 const readMaintenanceState = async (
   transaction: DurableObjectTransaction,
-): Promise<{ readonly state: ConversationMaintenanceState; readonly initialized: boolean }> => {
+): Promise<{ readonly state: ThreadMaintenanceState; readonly initialized: boolean }> => {
   const encoded = await transaction.get(MAINTENANCE_STATE_KEY);
   return encoded === undefined
     ? { state: initialMaintenanceState(), initialized: false }
@@ -279,8 +279,8 @@ export type MaintenancePassFailure =
  * 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
  *    recovery states leave their generation dirty and retain bounded backoff rearming.
  */
-export class ConversationMaintenance extends Context.Service<
-  ConversationMaintenance,
+export class ThreadMaintenance extends Context.Service<
+  ThreadMaintenance,
   {
     /** One idempotent maintenance pass; failures propagate so workerd retries the alarm. */
     readonly pass: Effect.Effect<MaintenancePassReport, MaintenancePassFailure>;
@@ -298,272 +298,271 @@ export class ConversationMaintenance extends Context.Service<
       body: Effect.Effect<A, E, R>,
     ) => Effect.Effect<A, E | DurableAlarmError, R>;
   }
->()("@effect-agent/platform-cloudflare/ConversationMaintenance") {
-  static readonly layer: Layer.Layer<
-    ConversationMaintenance,
+>()("@effect-agent/platform-cloudflare/ThreadMaintenance") {
+  static readonly layer = (
+    bindings: ReadonlyArray<ResolvedBinding>,
+  ): Layer.Layer<
+    ThreadMaintenance,
     never,
     | DurableAgentRuntime
-    | AgentBindingResolver
     | SubmissionLedger
     | DurableAlarmService
-    | ConversationMaintenanceFailpoint
+    | ThreadMaintenanceFailpoint
     | CloudflareDurableRuntimeConfig
-    | ConversationObjectIdentity
+    | ThreadObjectIdentity
     | DurableObjectContext
-  > = Layer.effect(ConversationMaintenance)(
-    Effect.gen(function* () {
-      const runtime = yield* DurableAgentRuntime;
-      const resolver = yield* AgentBindingResolver;
-      const ledger = yield* SubmissionLedger;
-      const alarm = yield* DurableAlarmService;
-      const config = yield* CloudflareDurableRuntimeConfig;
-      const identity = yield* ConversationObjectIdentity;
-      const { ctx } = yield* DurableObjectContext;
-      const failpoint = yield* ConversationMaintenanceFailpoint;
+  > =>
+    Layer.effect(ThreadMaintenance)(
+      Effect.gen(function* () {
+        const runtime = yield* DurableAgentRuntime;
+        const ledger = yield* SubmissionLedger;
+        const alarm = yield* DurableAlarmService;
+        const config = yield* CloudflareDurableRuntimeConfig;
+        const identity = yield* ThreadObjectIdentity;
+        const { ctx } = yield* DurableObjectContext;
+        const failpoint = yield* ThreadMaintenanceFailpoint;
+
+        /**
+         * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
+         * restarts at zero and merely re-arms sooner than a long-lived one would have.
+         */
+        const stalls = yield* Ref.make(0);
+        /**
+         * Incarnation-local mutation count guarded with the generation transactions below. It is
+         * deliberately not durable: after eviction every begun mutation has stopped, while its
+         * pre-armed dirty generation remains durable for recovery. The short gate never spans the
+         * caller's mutation or cross-Object I/O.
+         */
+        const activeMutations = yield* Ref.make(0);
+        const generationGate = yield* Semaphore.make(1);
+        // At-least-once deliveries are idempotent, but overlapping pass bodies could otherwise
+        // acknowledge state while a sibling pass is still mutating it. Port/RPC mutations do not
+        // take this permit, so cross-Object I/O cannot deadlock the maintenance serialization.
+        const maintenancePassGate = yield* Semaphore.make(1);
+        const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
 
-      /**
-       * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
-       * restarts at zero and merely re-arms sooner than a long-lived one would have.
-       */
-      const stalls = yield* Ref.make(0);
-      /**
-       * Incarnation-local mutation count guarded with the generation transactions below. It is
-       * deliberately not durable: after eviction every begun mutation has stopped, while its
-       * pre-armed dirty generation remains durable for recovery. The short gate never spans the
-       * caller's mutation or cross-Object I/O.
-       */
-      const activeMutations = yield* Ref.make(0);
-      const generationGate = yield* Semaphore.make(1);
-      // At-least-once deliveries are idempotent, but overlapping pass bodies could otherwise
-      // acknowledge state while a sibling pass is still mutating it. Port/RPC mutations do not
-      // take this permit, so cross-Object I/O cannot deadlock the maintenance serialization.
-      const maintenancePassGate = yield* Semaphore.make(1);
-      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+        const runTransaction = <A>(
+          operation: string,
+          transaction: () => Promise<A>,
+        ): Effect.Effect<A, DurableAlarmError> =>
+          Effect.tryPromise({
+            try: transaction,
+            catch: alarmFailure(operation),
+          });
 
-      const runTransaction = <A>(
-        operation: string,
-        transaction: () => Promise<A>,
-      ): Effect.Effect<A, DurableAlarmError> =>
-        Effect.tryPromise({
-          try: transaction,
-          catch: alarmFailure(operation),
+        const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* () {
+          yield* failpoint.hit("maintenance:dirty:before");
+          const now = yield* Clock.currentTimeMillis;
+          yield* runTransaction("advance maintenance generation", () =>
+            ctx.storage.transaction(async (transaction) => {
+              const { state } = await readMaintenanceState(transaction);
+              const next = ThreadMaintenanceState.make({
+                ...state,
+                dirty: state.dirty + 1n,
+              });
+              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+              // The earliest configured retry bounds a newly actionable mutation without relying
+              // on its best-effort immediate wake hint.
+              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+            }),
+          );
+          yield* failpoint.hit("maintenance:dirty:after");
+          yield* Ref.update(activeMutations, (active) => active + 1);
         });
 
-      const beginMutation = Effect.fn("ConversationMaintenance.beginMutation")(function* () {
-        yield* failpoint.hit("maintenance:dirty:before");
-        const now = yield* Clock.currentTimeMillis;
-        yield* runTransaction("advance maintenance generation", () =>
-          ctx.storage.transaction(async (transaction) => {
-            const { state } = await readMaintenanceState(transaction);
-            const next = ConversationMaintenanceState.make({
-              ...state,
-              dirty: state.dirty + 1n,
-            });
-            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
-            // The earliest configured retry bounds a newly actionable mutation without relying
-            // on its best-effort immediate wake hint.
-            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-          }),
+        const endMutation = generationGate.withPermit(
+          Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
         );
-        yield* failpoint.hit("maintenance:dirty:after");
-        yield* Ref.update(activeMutations, (active) => active + 1);
-      });
-
-      const endMutation = generationGate.withPermit(
-        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
-      );
 
-      const withMutation = <A, E, R>(
-        body: Effect.Effect<A, E, R>,
-      ): Effect.Effect<A, E | DurableAlarmError, R> =>
-        Effect.acquireUseRelease(
-          generationGate.withPermit(beginMutation()),
-          () =>
-            failpoint.hit("maintenance:mutation:armed").pipe(
-              Effect.andThen(body),
-              Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
-            ),
-          () => endMutation,
-        );
+        const withMutation = <A, E, R>(
+          body: Effect.Effect<A, E, R>,
+        ): Effect.Effect<A, E | DurableAlarmError, R> =>
+          Effect.acquireUseRelease(
+            generationGate.withPermit(beginMutation()),
+            () =>
+              failpoint.hit("maintenance:mutation:armed").pipe(
+                Effect.andThen(body),
+                Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
+              ),
+            () => endMutation,
+          );
 
-      const ensureAlarm = Effect.fn("ConversationMaintenance.ensureAlarm")(function* () {
-        yield* failpoint.hit("maintenance:ensure:before");
-        const now = yield* Clock.currentTimeMillis;
-        yield* runTransaction("ensure maintenance alarm", () =>
-          ctx.storage.transaction(async (transaction) => {
-            const { state, initialized } = await readMaintenanceState(transaction);
-            if (!initialized) {
-              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-            }
-            if (state.dirty > state.processed) {
-              await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
-            }
-          }),
-        );
-        yield* failpoint.hit("maintenance:ensure:after");
-      });
+        const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
+          yield* failpoint.hit("maintenance:ensure:before");
+          const now = yield* Clock.currentTimeMillis;
+          yield* runTransaction("ensure maintenance alarm", () =>
+            ctx.storage.transaction(async (transaction) => {
+              const { state, initialized } = await readMaintenanceState(transaction);
+              if (!initialized) {
+                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+              }
+              if (state.dirty > state.processed) {
+                await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+              }
+            }),
+          );
+          yield* failpoint.hit("maintenance:ensure:after");
+        });
 
-      const beginPass = Effect.fn("ConversationMaintenance.beginPass")(function* () {
-        yield* failpoint.hit("maintenance:begin:before");
-        const now = yield* Clock.currentTimeMillis;
-        const result = yield* runTransaction("begin maintenance pass", () =>
-          ctx.storage.transaction(async (transaction) => {
-            const { state, initialized } = await readMaintenanceState(transaction);
-            if (!initialized) {
-              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-            }
-            if (state.processed >= state.dirty) {
-              await transaction.deleteAlarm();
-              return { _tag: "CaughtUp" as const, nonterminal: state.nonterminal };
-            }
-            // Pre-arm the earliest retry before recovery. A successful finish may move this slot
-            // LATER to its bounded backoff, which does not cancel the running handler.
-            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-            return { _tag: "Actionable" as const, generation: state.dirty };
-          }),
-        );
-        yield* failpoint.hit("maintenance:begin:after");
-        return result;
-      });
+        const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* () {
+          yield* failpoint.hit("maintenance:begin:before");
+          const now = yield* Clock.currentTimeMillis;
+          const result = yield* runTransaction("begin maintenance pass", () =>
+            ctx.storage.transaction(async (transaction) => {
+              const { state, initialized } = await readMaintenanceState(transaction);
+              if (!initialized) {
+                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+              }
+              if (state.processed >= state.dirty) {
+                await transaction.deleteAlarm();
+                return { _tag: "CaughtUp" as const, nonterminal: state.nonterminal };
+              }
+              // Pre-arm the earliest retry before recovery. A successful finish may move this slot
+              // LATER to its bounded backoff, which does not cancel the running handler.
+              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+              return { _tag: "Actionable" as const, generation: state.dirty };
+            }),
+          );
+          yield* failpoint.hit("maintenance:begin:after");
+          return result;
+        });
 
-      const rearmDelay = Effect.fn("ConversationMaintenance.rearmDelay")(function* (
-        progressed: boolean,
-      ) {
-        const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>
-          progressed ? 0 : count + 1,
-        );
-        if (progressed) return config.alarmBackoffBase;
-        const exponent = Math.min(priorStalls, 30);
-        const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
-        const jitter = yield* Random.next;
-        // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever
-        // waiting longer than the deterministic bound.
-        const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);
-        return Math.min(jittered, config.wakeScanInterval);
-      });
+        const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (
+          progressed: boolean,
+        ) {
+          const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>
+            progressed ? 0 : count + 1,
+          );
+          if (progressed) return config.alarmBackoffBase;
+          const exponent = Math.min(priorStalls, 30);
+          const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
+          const jitter = yield* Random.next;
+          // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever
+          // waiting longer than the deterministic bound.
+          const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);
+          return Math.min(jittered, config.wakeScanInterval);
+        });
 
-      const pass = Effect.fn("ConversationMaintenance.pass")(function* (): Effect.fn.Return<
-        MaintenancePassReport,
-        MaintenancePassFailure
-      > {
-        const annotate = (report: MaintenancePassReport) =>
-          Effect.annotateCurrentSpan({
-            phase: report.phase,
-            recovered: report.recovered,
-            settled: report.settled,
-            nonterminal: report.nonterminal,
-            alarm: report.alarm,
-          }).pipe(Effect.as(report));
+        const pass = Effect.fn("ThreadMaintenance.pass")(function* (): Effect.fn.Return<
+          MaintenancePassReport,
+          MaintenancePassFailure
+        > {
+          const annotate = (report: MaintenancePassReport) =>
+            Effect.annotateCurrentSpan({
+              phase: report.phase,
+              recovered: report.recovered,
+              settled: report.settled,
+              nonterminal: report.nonterminal,
+              alarm: report.alarm,
+            }).pipe(Effect.as(report));
 
-        const started = yield* generationGate.withPermit(
-          Effect.gen(function* () {
-            const activeAtStart = yield* Ref.get(activeMutations);
-            const generation = yield* beginPass();
-            return { ...generation, activeAtStart };
-          }),
-        );
-        if (started._tag === "CaughtUp") {
+          const started = yield* generationGate.withPermit(
+            Effect.gen(function* () {
+              const activeAtStart = yield* Ref.get(activeMutations);
+              const generation = yield* beginPass();
+              return { ...generation, activeAtStart };
+            }),
+          );
+          if (started._tag === "CaughtUp") {
+            return yield* annotate(
+              MaintenancePassReport.make({
+                phase: "caught-up",
+                recovered: 0,
+                settled: 0,
+                nonterminal: started.nonterminal,
+                alarm: "cleared",
+              }),
+            );
+          }
+          // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).
+          const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;
+          // Step 3 — one bounded drain pass over this Object's own lane.
+          const settlements = yield* runtime.processThreadResolved(identity.threadId, bindings);
+          // Observe residual state before acknowledging this exact pass-start generation.
+          const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+          const reports = new Map(recovered.map((report) => [report.submissionId, report]));
+          const head = remaining[0];
+          const headWaiting = head !== undefined && stableExternalWait(head, reports);
+          const autonomous = remaining.some((snapshot, index) => {
+            // FIFO followers cannot execute through a stable external wait. Only plain queued
+            // input is dormant here; admission repairs and accepted aborts still need a pass.
+            if (
+              index > 0 &&
+              headWaiting &&
+              snapshot.state === "ready" &&
+              reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
+            )
+              return false;
+            return !stableExternalWait(snapshot, reports);
+          });
+          const progressed =
+            settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
+          const delay = autonomous ? yield* rearmDelay(progressed) : 0;
+          const now = yield* Clock.currentTimeMillis;
+          yield* failpoint.hit("maintenance:finish:before");
+          const alarmDisposition = yield* generationGate.withPermit(
+            Effect.gen(function* () {
+              const active = yield* Ref.get(activeMutations);
+              return yield* runTransaction("finish maintenance pass", () =>
+                ctx.storage.transaction(async (transaction) => {
+                  const { state } = await readMaintenanceState(transaction);
+                  // Autonomous work and in-flight mutations intentionally leave the observed
+                  // generation dirty. Otherwise acknowledge only the pass-start generation.
+                  const processed =
+                    autonomous || started.activeAtStart > 0 || active > 0
+                      ? state.processed
+                      : state.processed > started.generation
+                        ? state.processed
+                        : started.generation;
+                  const next = ThreadMaintenanceState.make({
+                    ...state,
+                    processed,
+                    nonterminal: remaining.length,
+                  });
+                  await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+                  if (autonomous) {
+                    // Replace the crash-fallback slot with this pass's bounded backoff. The target
+                    // is never earlier than the begin-pass fallback, so workerd does not cancel
+                    // this running alarm handler before its report/span can complete.
+                    await transaction.setAlarm(now + delay);
+                    return "rearmed" as const;
+                  }
+                  if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
+                    // A mutation overlapped this pass's observation window or raced
+                    // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;
+                    // unseen effects are never acknowledged. Do not accelerate that future alarm
+                    // from inside the current handler: workerd cancels a running handler when it
+                    // writes an earlier slot.
+                    await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+                    return "rearmed" as const;
+                  }
+                  await transaction.deleteAlarm();
+                  return "cleared" as const;
+                }),
+              );
+            }),
+          );
+          yield* failpoint.hit("maintenance:finish:after");
+          if (alarmDisposition === "cleared") {
+            yield* Ref.set(stalls, 0);
+          }
           return yield* annotate(
             MaintenancePassReport.make({
-              phase: "caught-up",
-              recovered: 0,
-              settled: 0,
-              nonterminal: started.nonterminal,
-              alarm: "cleared",
+              phase: "actionable",
+              recovered: recovered.length,
+              settled: settlements.length,
+              nonterminal: remaining.length,
+              alarm: alarmDisposition,
             }),
           );
-        }
-        // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).
-        const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;
-        // Step 3 — one bounded drain pass over this Object's own lane.
-        const settlements = yield* runtime
-          .processConversationResolved(identity.conversationId)
-          .pipe(Effect.provideService(AgentBindingResolver, resolver));
-        // Observe residual state before acknowledging this exact pass-start generation.
-        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
-        const reports = new Map(recovered.map((report) => [report.submissionId, report]));
-        const head = remaining[0];
-        const headWaiting = head !== undefined && stableExternalWait(head, reports);
-        const autonomous = remaining.some((snapshot, index) => {
-          // FIFO followers cannot execute through a stable external wait. Only plain queued
-          // input is dormant here; admission repairs and accepted aborts still need a pass.
-          if (
-            index > 0 &&
-            headWaiting &&
-            snapshot.state === "ready" &&
-            reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
-          )
-            return false;
-          return !stableExternalWait(snapshot, reports);
         });
-        const progressed =
-          settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
-        const delay = autonomous ? yield* rearmDelay(progressed) : 0;
-        const now = yield* Clock.currentTimeMillis;
-        yield* failpoint.hit("maintenance:finish:before");
-        const alarmDisposition = yield* generationGate.withPermit(
-          Effect.gen(function* () {
-            const active = yield* Ref.get(activeMutations);
-            return yield* runTransaction("finish maintenance pass", () =>
-              ctx.storage.transaction(async (transaction) => {
-                const { state } = await readMaintenanceState(transaction);
-                // Autonomous work and in-flight mutations intentionally leave the observed
-                // generation dirty. Otherwise acknowledge only the pass-start generation.
-                const processed =
-                  autonomous || started.activeAtStart > 0 || active > 0
-                    ? state.processed
-                    : state.processed > started.generation
-                      ? state.processed
-                      : started.generation;
-                const next = ConversationMaintenanceState.make({
-                  ...state,
-                  processed,
-                  nonterminal: remaining.length,
-                });
-                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
-                if (autonomous) {
-                  // Replace the crash-fallback slot with this pass's bounded backoff. The target
-                  // is never earlier than the begin-pass fallback, so workerd does not cancel
-                  // this running alarm handler before its report/span can complete.
-                  await transaction.setAlarm(now + delay);
-                  return "rearmed" as const;
-                }
-                if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
-                  // A mutation overlapped this pass's observation window or raced
-                  // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;
-                  // unseen effects are never acknowledged. Do not accelerate that future alarm
-                  // from inside the current handler: workerd cancels a running handler when it
-                  // writes an earlier slot.
-                  await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
-                  return "rearmed" as const;
-                }
-                await transaction.deleteAlarm();
-                return "cleared" as const;
-              }),
-            );
-          }),
-        );
-        yield* failpoint.hit("maintenance:finish:after");
-        if (alarmDisposition === "cleared") {
-          yield* Ref.set(stalls, 0);
-        }
-        return yield* annotate(
-          MaintenancePassReport.make({
-            phase: "actionable",
-            recovered: recovered.length,
-            settled: settlements.length,
-            nonterminal: remaining.length,
-            alarm: alarmDisposition,
-          }),
-        );
-      });
 
-      return ConversationMaintenance.of({
-        // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.
-        pass: alarm.withWakesDeferred(maintenancePassGate.withPermit(pass())),
-        ensureAlarm: ensureAlarm(),
-        withMutation,
-      });
-    }),
-  );
+        return ThreadMaintenance.of({
+          // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.
+          pass: alarm.withWakesDeferred(maintenancePassGate.withPermit(pass())),
+          ensureAlarm: ensureAlarm(),
+          withMutation,
+        });
+      }),
+    );
 }