@effect-agent/platform-cloudflare 0.1.0-beta.42 → 0.1.0-beta.45

package/src/alarm.ts

@@ -1,5 +1,4 @@
 import {
-  type ResolvedBinding,
   DurableAgentRuntime,
   SubmissionLedger,
   type DurableBindingFailure,
@@ -98,6 +97,7 @@ export class DurableAlarmService extends Context.Service<
          * on top of the already-committed pre-armed alarm.
          */
         const runningPasses = yield* Ref.make(0);
+
         const scheduled = Effect.tryPromise({
           try: () => ctx.storage.getAlarm(),
           catch: alarmFailure("get alarm"),
@@ -106,11 +106,13 @@ export class DurableAlarmService extends Context.Service<
             deadline === null ? Option.none<number>() : Option.some(deadline),
           ),
         );
+
         const scheduleAt = (epochMillis: number) =>
           Effect.tryPromise({
             try: () => ctx.storage.setAlarm(epochMillis),
             catch: alarmFailure("set alarm"),
           });
+
         const ensureScheduledBy = (epochMillis: number) =>
           scheduled.pipe(
             Effect.flatMap((existing) =>
@@ -119,21 +121,26 @@ export class DurableAlarmService extends Context.Service<
                 : scheduleAt(epochMillis),
             ),
           );
+
         const armNow = Clock.currentTimeMillis.pipe(
           Effect.flatMap((now) => ensureScheduledBy(now)),
         );
+
         const scheduleNow = Ref.get(runningPasses).pipe(
           Effect.flatMap((passes) => (passes > 0 ? Effect.void : armNow)),
         );
+
         const withWakesDeferred = <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
           Ref.update(runningPasses, (passes) => passes + 1).pipe(
             Effect.andThen(body),
             Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)),
           );
+
         const cancel = Effect.tryPromise({
           try: () => ctx.storage.deleteAlarm(),
           catch: alarmFailure("delete alarm"),
         });
+
         return DurableAlarmService.of({
           scheduled,
           scheduleAt,
@@ -221,6 +228,7 @@ const readMaintenanceState = async (
   transaction: DurableObjectTransaction,
 ): Promise<{ readonly state: ThreadMaintenanceState; readonly initialized: boolean }> => {
   const encoded = await transaction.get(MAINTENANCE_STATE_KEY);
+
   return encoded === undefined
     ? { state: initialMaintenanceState(), initialized: false }
     : { state: decodeMaintenanceState(encoded), initialized: true };
@@ -231,6 +239,7 @@ const ensureTransactionAlarmBy = async (
   deadline: number,
 ): Promise<void> => {
   const scheduled = await transaction.getAlarm();
+
   if (scheduled === null || scheduled > deadline) {
     await transaction.setAlarm(deadline);
   }
@@ -241,6 +250,7 @@ const stableExternalWait = (
   reports: ReadonlyMap<string, RecoveryReport>,
 ): boolean => {
   const decision = reports.get(snapshot.submissionId)?.decision._tag;
+
   // An accepted abort still owes cleanup/settlement even if its claim was deferred this pass.
   if (decision === "SettleAborted") return false;
   switch (snapshot.state) {
@@ -299,9 +309,7 @@ export class ThreadMaintenance extends Context.Service<
     ) => Effect.Effect<A, E | DurableAlarmError, R>;
   }
 >()("@effect-agent/platform-cloudflare/ThreadMaintenance") {
-  static readonly layer = (
-    bindings: ReadonlyArray<ResolvedBinding>,
-  ): Layer.Layer<
+  static readonly layer: Layer.Layer<
     ThreadMaintenance,
     never,
     | DurableAgentRuntime
@@ -311,258 +319,285 @@ export class ThreadMaintenance extends Context.Service<
     | CloudflareDurableRuntimeConfig
     | ThreadObjectIdentity
     | DurableObjectContext
-  > =>
-    Layer.effect(ThreadMaintenance)(
-      Effect.gen(function* () {
-        const runtime = yield* DurableAgentRuntime;
-        const ledger = yield* SubmissionLedger;
-        const alarm = yield* DurableAlarmService;
-        const config = yield* CloudflareDurableRuntimeConfig;
-        const identity = yield* ThreadObjectIdentity;
-        const { ctx } = yield* DurableObjectContext;
-        const failpoint = yield* ThreadMaintenanceFailpoint;
+  > = Layer.effect(ThreadMaintenance)(
+    Effect.gen(function* () {
+      const runtime = yield* DurableAgentRuntime;
+      const ledger = yield* SubmissionLedger;
+      const alarm = yield* DurableAlarmService;
+      const config = yield* CloudflareDurableRuntimeConfig;
+      const identity = yield* ThreadObjectIdentity;
+      const { ctx } = yield* DurableObjectContext;
+      const failpoint = yield* ThreadMaintenanceFailpoint;
 
-        /**
-         * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
-         * restarts at zero and merely re-arms sooner than a long-lived one would have.
-         */
-        const stalls = yield* Ref.make(0);
-        /**
-         * Incarnation-local mutation count guarded with the generation transactions below. It is
-         * deliberately not durable: after eviction every begun mutation has stopped, while its
-         * pre-armed dirty generation remains durable for recovery. The short gate never spans the
-         * caller's mutation or cross-Object I/O.
-         */
-        const activeMutations = yield* Ref.make(0);
-        const generationGate = yield* Semaphore.make(1);
-        // At-least-once deliveries are idempotent, but overlapping pass bodies could otherwise
-        // acknowledge state while a sibling pass is still mutating it. Port/RPC mutations do not
-        // take this permit, so cross-Object I/O cannot deadlock the maintenance serialization.
-        const maintenancePassGate = yield* Semaphore.make(1);
-        const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
-
-        const runTransaction = <A>(
-          operation: string,
-          transaction: () => Promise<A>,
-        ): Effect.Effect<A, DurableAlarmError> =>
-          Effect.tryPromise({
-            try: transaction,
-            catch: alarmFailure(operation),
-          });
+      /**
+       * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
+       * restarts at zero and merely re-arms sooner than a long-lived one would have.
+       */
+      const stalls = yield* Ref.make(0);
+      /**
+       * Incarnation-local mutation count guarded with the generation transactions below. It is
+       * deliberately not durable: after eviction every begun mutation has stopped, while its
+       * pre-armed dirty generation remains durable for recovery. The short gate never spans the
+       * caller's mutation or cross-Object I/O.
+       */
+      const activeMutations = yield* Ref.make(0);
+      const generationGate = yield* Semaphore.make(1);
+      // At-least-once deliveries are idempotent, but overlapping pass bodies could otherwise
+      // acknowledge state while a sibling pass is still mutating it. Port/RPC mutations do not
+      // take this permit, so cross-Object I/O cannot deadlock the maintenance serialization.
+      const maintenancePassGate = yield* Semaphore.make(1);
+      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
 
-        const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* () {
-          yield* failpoint.hit("maintenance:dirty:before");
-          const now = yield* Clock.currentTimeMillis;
-          yield* runTransaction("advance maintenance generation", () =>
-            ctx.storage.transaction(async (transaction) => {
-              const { state } = await readMaintenanceState(transaction);
-              const next = ThreadMaintenanceState.make({
-                ...state,
-                dirty: state.dirty + 1n,
-              });
-              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
-              // The earliest configured retry bounds a newly actionable mutation without relying
-              // on its best-effort immediate wake hint.
-              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-            }),
-          );
-          yield* failpoint.hit("maintenance:dirty:after");
-          yield* Ref.update(activeMutations, (active) => active + 1);
+      const runTransaction = <A>(
+        operation: string,
+        transaction: () => Promise<A>,
+      ): Effect.Effect<A, DurableAlarmError> =>
+        Effect.tryPromise({
+          try: transaction,
+          catch: alarmFailure(operation),
         });
 
-        const endMutation = generationGate.withPermit(
-          Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
+      const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* () {
+        yield* failpoint.hit("maintenance:dirty:before");
+        const now = yield* Clock.currentTimeMillis;
+
+        yield* runTransaction("advance maintenance generation", () =>
+          ctx.storage.transaction(async (transaction) => {
+            const { state } = await readMaintenanceState(transaction);
+
+            const next = ThreadMaintenanceState.make({
+              ...state,
+              dirty: state.dirty + 1n,
+            });
+
+            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+            // The earliest configured retry bounds a newly actionable mutation without relying
+            // on its best-effort immediate wake hint.
+            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+          }),
         );
+        yield* failpoint.hit("maintenance:dirty:after");
+        yield* Ref.update(activeMutations, (active) => active + 1);
+      });
 
-        const withMutation = <A, E, R>(
-          body: Effect.Effect<A, E, R>,
-        ): Effect.Effect<A, E | DurableAlarmError, R> =>
-          Effect.acquireUseRelease(
-            generationGate.withPermit(beginMutation()),
-            () =>
-              failpoint.hit("maintenance:mutation:armed").pipe(
-                Effect.andThen(body),
-                Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
-              ),
-            () => endMutation,
-          );
+      const endMutation = generationGate.withPermit(
+        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
+      );
 
-        const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
-          yield* failpoint.hit("maintenance:ensure:before");
-          const now = yield* Clock.currentTimeMillis;
-          yield* runTransaction("ensure maintenance alarm", () =>
-            ctx.storage.transaction(async (transaction) => {
-              const { state, initialized } = await readMaintenanceState(transaction);
-              if (!initialized) {
-                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-              }
-              if (state.dirty > state.processed) {
-                await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
-              }
-            }),
-          );
-          yield* failpoint.hit("maintenance:ensure:after");
-        });
+      const withMutation = <A, E, R>(
+        body: Effect.Effect<A, E, R>,
+      ): Effect.Effect<A, E | DurableAlarmError, R> =>
+        Effect.acquireUseRelease(
+          generationGate.withPermit(beginMutation()),
+          () =>
+            failpoint.hit("maintenance:mutation:armed").pipe(
+              Effect.andThen(body),
+              Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
+            ),
+          () => endMutation,
+        );
 
-        const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* () {
-          yield* failpoint.hit("maintenance:begin:before");
-          const now = yield* Clock.currentTimeMillis;
-          const result = yield* runTransaction("begin maintenance pass", () =>
-            ctx.storage.transaction(async (transaction) => {
-              const { state, initialized } = await readMaintenanceState(transaction);
-              if (!initialized) {
-                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-              }
-              if (state.processed >= state.dirty) {
-                await transaction.deleteAlarm();
-                return { _tag: "CaughtUp" as const, nonterminal: state.nonterminal };
-              }
-              // Pre-arm the earliest retry before recovery. A successful finish may move this slot
-              // LATER to its bounded backoff, which does not cancel the running handler.
-              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-              return { _tag: "Actionable" as const, generation: state.dirty };
-            }),
-          );
-          yield* failpoint.hit("maintenance:begin:after");
-          return result;
-        });
+      const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
+        yield* failpoint.hit("maintenance:ensure:before");
+        const now = yield* Clock.currentTimeMillis;
 
-        const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (
-          progressed: boolean,
-        ) {
-          const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>
-            progressed ? 0 : count + 1,
-          );
-          if (progressed) return config.alarmBackoffBase;
-          const exponent = Math.min(priorStalls, 30);
-          const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
-          const jitter = yield* Random.next;
-          // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever
-          // waiting longer than the deterministic bound.
-          const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);
-          return Math.min(jittered, config.wakeScanInterval);
-        });
+        yield* runTransaction("ensure maintenance alarm", () =>
+          ctx.storage.transaction(async (transaction) => {
+            const { state, initialized } = await readMaintenanceState(transaction);
 
-        const pass = Effect.fn("ThreadMaintenance.pass")(function* (): Effect.fn.Return<
-          MaintenancePassReport,
-          MaintenancePassFailure
-        > {
-          const annotate = (report: MaintenancePassReport) =>
-            Effect.annotateCurrentSpan({
-              phase: report.phase,
-              recovered: report.recovered,
-              settled: report.settled,
-              nonterminal: report.nonterminal,
-              alarm: report.alarm,
-            }).pipe(Effect.as(report));
-
-          const started = yield* generationGate.withPermit(
-            Effect.gen(function* () {
-              const activeAtStart = yield* Ref.get(activeMutations);
-              const generation = yield* beginPass();
-              return { ...generation, activeAtStart };
-            }),
-          );
-          if (started._tag === "CaughtUp") {
-            return yield* annotate(
-              MaintenancePassReport.make({
-                phase: "caught-up",
-                recovered: 0,
-                settled: 0,
-                nonterminal: started.nonterminal,
-                alarm: "cleared",
-              }),
-            );
-          }
-          // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).
-          const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;
-          // Step 3 — one bounded drain pass over this Object's own lane.
-          const settlements = yield* runtime.processThreadResolved(identity.threadId, bindings);
-          // Observe residual state before acknowledging this exact pass-start generation.
-          const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
-          const reports = new Map(recovered.map((report) => [report.submissionId, report]));
-          const head = remaining[0];
-          const headWaiting = head !== undefined && stableExternalWait(head, reports);
-          const autonomous = remaining.some((snapshot, index) => {
-            // FIFO followers cannot execute through a stable external wait. Only plain queued
-            // input is dormant here; admission repairs and accepted aborts still need a pass.
-            if (
-              index > 0 &&
-              headWaiting &&
-              snapshot.state === "ready" &&
-              reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
-            )
-              return false;
-            return !stableExternalWait(snapshot, reports);
-          });
-          const progressed =
-            settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
-          const delay = autonomous ? yield* rearmDelay(progressed) : 0;
-          const now = yield* Clock.currentTimeMillis;
-          yield* failpoint.hit("maintenance:finish:before");
-          const alarmDisposition = yield* generationGate.withPermit(
-            Effect.gen(function* () {
-              const active = yield* Ref.get(activeMutations);
-              return yield* runTransaction("finish maintenance pass", () =>
-                ctx.storage.transaction(async (transaction) => {
-                  const { state } = await readMaintenanceState(transaction);
-                  // Autonomous work and in-flight mutations intentionally leave the observed
-                  // generation dirty. Otherwise acknowledge only the pass-start generation.
-                  const processed =
-                    autonomous || started.activeAtStart > 0 || active > 0
-                      ? state.processed
-                      : state.processed > started.generation
-                        ? state.processed
-                        : started.generation;
-                  const next = ThreadMaintenanceState.make({
-                    ...state,
-                    processed,
-                    nonterminal: remaining.length,
-                  });
-                  await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
-                  if (autonomous) {
-                    // Replace the crash-fallback slot with this pass's bounded backoff. The target
-                    // is never earlier than the begin-pass fallback, so workerd does not cancel
-                    // this running alarm handler before its report/span can complete.
-                    await transaction.setAlarm(now + delay);
-                    return "rearmed" as const;
-                  }
-                  if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
-                    // A mutation overlapped this pass's observation window or raced
-                    // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;
-                    // unseen effects are never acknowledged. Do not accelerate that future alarm
-                    // from inside the current handler: workerd cancels a running handler when it
-                    // writes an earlier slot.
-                    await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
-                    return "rearmed" as const;
-                  }
-                  await transaction.deleteAlarm();
-                  return "cleared" as const;
-                }),
-              );
-            }),
-          );
-          yield* failpoint.hit("maintenance:finish:after");
-          if (alarmDisposition === "cleared") {
-            yield* Ref.set(stalls, 0);
-          }
+            if (!initialized) {
+              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+            }
+            if (state.dirty > state.processed) {
+              await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+            }
+          }),
+        );
+        yield* failpoint.hit("maintenance:ensure:after");
+      });
+
+      const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* () {
+        yield* failpoint.hit("maintenance:begin:before");
+        const now = yield* Clock.currentTimeMillis;
+
+        const result = yield* runTransaction("begin maintenance pass", () =>
+          ctx.storage.transaction(async (transaction) => {
+            const { state, initialized } = await readMaintenanceState(transaction);
+
+            if (!initialized) {
+              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+            }
+            if (state.processed >= state.dirty) {
+              await transaction.deleteAlarm();
+
+              return { _tag: "CaughtUp" as const, nonterminal: state.nonterminal };
+            }
+            // Pre-arm the earliest retry before recovery. A successful finish may move this slot
+            // LATER to its bounded backoff, which does not cancel the running handler.
+            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+
+            return { _tag: "Actionable" as const, generation: state.dirty };
+          }),
+        );
+
+        yield* failpoint.hit("maintenance:begin:after");
+
+        return result;
+      });
+
+      const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (progressed: boolean) {
+        const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>
+          progressed ? 0 : count + 1,
+        );
+
+        if (progressed) return config.alarmBackoffBase;
+        const exponent = Math.min(priorStalls, 30);
+        const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
+        const jitter = yield* Random.next;
+        // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever
+        // waiting longer than the deterministic bound.
+        const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);
+
+        return Math.min(jittered, config.wakeScanInterval);
+      });
+
+      const pass = Effect.fn("ThreadMaintenance.pass")(function* (): Effect.fn.Return<
+        MaintenancePassReport,
+        MaintenancePassFailure
+      > {
+        const annotate = (report: MaintenancePassReport) =>
+          Effect.annotateCurrentSpan({
+            phase: report.phase,
+            recovered: report.recovered,
+            settled: report.settled,
+            nonterminal: report.nonterminal,
+            alarm: report.alarm,
+          }).pipe(Effect.as(report));
+
+        const started = yield* generationGate.withPermit(
+          Effect.gen(function* () {
+            const activeAtStart = yield* Ref.get(activeMutations);
+            const generation = yield* beginPass();
+
+            return { ...generation, activeAtStart };
+          }),
+        );
+
+        if (started._tag === "CaughtUp") {
           return yield* annotate(
             MaintenancePassReport.make({
-              phase: "actionable",
-              recovered: recovered.length,
-              settled: settlements.length,
-              nonterminal: remaining.length,
-              alarm: alarmDisposition,
+              phase: "caught-up",
+              recovered: 0,
+              settled: 0,
+              nonterminal: started.nonterminal,
+              alarm: "cleared",
             }),
           );
-        });
+        }
+        // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).
+        const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;
+        // Step 3 — one bounded drain pass over this Object's own lane.
+        const settlements = yield* runtime.processThreadResolved(identity.threadId);
+        // Observe residual state before acknowledging this exact pass-start generation.
+        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+        const reports = new Map(recovered.map((report) => [report.submissionId, report]));
+        const head = remaining[0];
+        const headWaiting = head !== undefined && stableExternalWait(head, reports);
 
-        return ThreadMaintenance.of({
-          // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.
-          pass: alarm.withWakesDeferred(maintenancePassGate.withPermit(pass())),
-          ensureAlarm: ensureAlarm(),
-          withMutation,
+        const autonomous = remaining.some((snapshot, index) => {
+          // FIFO followers cannot execute through a stable external wait. Only plain queued
+          // input is dormant here; admission repairs and accepted aborts still need a pass.
+          if (
+            index > 0 &&
+            headWaiting &&
+            snapshot.state === "ready" &&
+            reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
+          )
+            return false;
+
+          return !stableExternalWait(snapshot, reports);
         });
-      }),
-    );
+
+        const progressed =
+          settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
+
+        const delay = autonomous ? yield* rearmDelay(progressed) : 0;
+        const now = yield* Clock.currentTimeMillis;
+
+        yield* failpoint.hit("maintenance:finish:before");
+
+        const alarmDisposition = yield* generationGate.withPermit(
+          Effect.gen(function* () {
+            const active = yield* Ref.get(activeMutations);
+
+            return yield* runTransaction("finish maintenance pass", () =>
+              ctx.storage.transaction(async (transaction) => {
+                const { state } = await readMaintenanceState(transaction);
+
+                // Autonomous work and in-flight mutations intentionally leave the observed
+                // generation dirty. Otherwise acknowledge only the pass-start generation.
+                const processed =
+                  autonomous || started.activeAtStart > 0 || active > 0
+                    ? state.processed
+                    : state.processed > started.generation
+                      ? state.processed
+                      : started.generation;
+
+                const next = ThreadMaintenanceState.make({
+                  ...state,
+                  processed,
+                  nonterminal: remaining.length,
+                });
+
+                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+                if (autonomous) {
+                  // Replace the crash-fallback slot with this pass's bounded backoff. The target
+                  // is never earlier than the begin-pass fallback, so workerd does not cancel
+                  // this running alarm handler before its report/span can complete.
+                  await transaction.setAlarm(now + delay);
+
+                  return "rearmed" as const;
+                }
+                if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
+                  // A mutation overlapped this pass's observation window or raced
+                  // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;
+                  // unseen effects are never acknowledged. Do not accelerate that future alarm
+                  // from inside the current handler: workerd cancels a running handler when it
+                  // writes an earlier slot.
+                  await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+
+                  return "rearmed" as const;
+                }
+                await transaction.deleteAlarm();
+
+                return "cleared" as const;
+              }),
+            );
+          }),
+        );
+
+        yield* failpoint.hit("maintenance:finish:after");
+        if (alarmDisposition === "cleared") {
+          yield* Ref.set(stalls, 0);
+        }
+
+        return yield* annotate(
+          MaintenancePassReport.make({
+            phase: "actionable",
+            recovered: recovered.length,
+            settled: settlements.length,
+            nonterminal: remaining.length,
+            alarm: alarmDisposition,
+          }),
+        );
+      });
+
+      return ThreadMaintenance.of({
+        // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.
+        pass: alarm.withWakesDeferred(maintenancePassGate.withPermit(pass())),
+        ensureAlarm: ensureAlarm(),
+        withMutation,
+      });
+    }),
+  );
 }

package/src/bindings.ts

@@ -91,12 +91,15 @@ export const threadNamespaceFromEnv = Effect.fn("threadNamespaceFromEnv")(functi
       message: "The Worker environment is not an object; no bindings are available.",
     });
   }
+
   const candidate = yield* Effect.try({
     try: () => {
       const value: unknown = Reflect.get(env, binding);
+
       if (!Predicate.isObjectKeyword(value)) return undefined;
       const idFromName: unknown = Reflect.get(value, "idFromName");
       const get: unknown = Reflect.get(value, "get");
+
       return typeof idFromName === "function" && typeof get === "function" ? value : undefined;
     },
     catch: () =>
@@ -105,11 +108,13 @@ export const threadNamespaceFromEnv = Effect.fn("threadNamespaceFromEnv")(functi
         message: `env.${binding} could not be inspected as a DurableObjectNamespace binding.`,
       }),
   });
+
   if (candidate !== undefined) {
     // The structural probe above is the entire runtime contract this package relies on;
     // the assertion records that `idFromName`/`get` name a DurableObjectNamespace.
     return candidate as unknown as DurableObjectNamespace<ThreadObjectRpc>;
   }
+
   return yield* CloudflareBindingError.make({
     binding,
     message: