@effect-agent/platform-cloudflare 0.1.0-beta.51 → 0.1.0-beta.53

package/src/Alarm.ts

@@ -6,6 +6,7 @@ import {
 } from "@effect-agent/thread/DurableAgentRuntime";
 import { SubmissionLedger, type SubmissionSnapshot } from "@effect-agent/thread/SubmissionLedger";
 import {
+  Cause,
   Clock,
   Context,
   DateTime,
@@ -157,7 +158,7 @@ export class DurableAlarmService extends Context.Service<
 export class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(
   "@effect-agent/platform-cloudflare/MaintenancePassReport",
 )({
-  /** `caught-up` is generation-only; `actionable` ran recovery and at most one head Attempt. */
+  /** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */
   phase: Schema.Literals(["caught-up", "actionable"]),
   /** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */
   recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
@@ -196,6 +197,53 @@ export class ThreadMaintenanceFailpoint extends Context.Service<
   static readonly layer = Layer.succeed(this)({ hit: () => Effect.void });
 }
 
+/**
+ * Durable host publication of canonical records and ledger approval/abort/resolution intents.
+ * The host owns schema-versioned cursors, destination idempotency and acknowledgement. Delivery
+ * is at least once. Hooks must not write the alarm slot or mutate the supplied raw source ports.
+ *
+ * `invalidate`, `prepareGeneration` and `pendingDeadline` must be bounded local operations.
+ * `prepareGeneration` durably invalidates a scan only when its generation changes; repeated
+ * calls must preserve partial scan progress. It runs with no source mutation in flight.
+ * `drain` performs bounded delivery and persists retries before returning. A pending deadline
+ * defers runtime recovery/Attempts, allowing committed host publications to drain first.
+ * Unexpected hook failures leave the prearmed generation for retry. Hooks acquire per-call
+ * resources with Effect.scoped; Layer construction owns incarnation resources (eviction need
+ * not run finalizers). Do not hold a local hook behind network I/O or call back into producers.
+ */
+export interface ThreadPublicationService {
+  readonly invalidate: Effect.Effect<void, DurableAlarmError>;
+  readonly prepareGeneration: (generation: bigint) => Effect.Effect<void, DurableAlarmError>;
+  readonly drain: Effect.Effect<void, DurableAlarmError>;
+  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;
+}
+
+/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */
+export class ThreadPublication extends Context.Service<
+  ThreadPublication,
+  ThreadPublicationService
+>()("@effect-agent/platform-cloudflare/ThreadPublication") {
+  static readonly layer = Layer.succeed(this)({
+    invalidate: Effect.void,
+    prepareGeneration: () => Effect.void,
+    drain: Effect.void,
+    pendingDeadline: Effect.succeed(Option.none()),
+  });
+}
+
+/** @internal A committed source operation must not become a failed operation because delivery failed. */
+export const publishCommitted = Effect.gen(function* () {
+  const publication = yield* ThreadPublication;
+
+  yield* publication.invalidate.pipe(Effect.andThen(publication.drain));
+}).pipe(
+  Effect.catchCause((cause) =>
+    Cause.hasInterrupts(cause)
+      ? Effect.interrupt
+      : Effect.logError("Thread publication deferred after source commit", cause),
+  ),
+);
+
 const MaintenanceGeneration = Schema.BigIntFromString.check(
   Schema.isGreaterThanOrEqualToBigInt(0n),
 );
@@ -271,6 +319,84 @@ const stableExternalWait = (
   }
 };
 
+/**
+ * Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.
+ * `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance
+ * Layers must reuse that instance; a second gate cannot observe the native producers' activity.
+ */
+export class ThreadMutationGate extends Context.Service<
+  ThreadMutationGate,
+  {
+    readonly withMutation: <A, E, R>(
+      body: Effect.Effect<A, E, R>,
+    ) => Effect.Effect<A, E | DurableAlarmError, R>;
+    readonly withSnapshot: <A, E, R>(
+      body: (active: number) => Effect.Effect<A, E, R>,
+    ) => Effect.Effect<A, E, R>;
+  }
+>()("@effect-agent/platform-cloudflare/internal/ThreadMutationGate") {
+  static readonly layer = Layer.effect(this)(
+    Effect.gen(function* () {
+      const { ctx } = yield* DurableObjectContext;
+      const config = yield* CloudflareDurableRuntimeConfig;
+      const failpoint = yield* ThreadMaintenanceFailpoint;
+      // A fresh incarnation has no live mutations; durable generations survive eviction.
+      const activeMutations = yield* Ref.make(0);
+      const generationGate = yield* Semaphore.make(1);
+      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+
+      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>
+        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });
+
+      const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* () {
+        yield* failpoint.hit("maintenance:dirty:before");
+        const now = yield* Clock.currentTimeMillis;
+
+        yield* runTransaction("advance maintenance generation", () =>
+          ctx.storage.transaction(async (transaction) => {
+            const { state } = await readMaintenanceState(transaction);
+
+            const next = ThreadMaintenanceState.make({
+              ...state,
+              dirty: state.dirty + 1n,
+            });
+
+            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+            // The earliest configured retry bounds a newly actionable mutation without relying
+            // on its best-effort immediate wake hint.
+            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+          }),
+        );
+        yield* failpoint.hit("maintenance:dirty:after");
+        yield* Ref.update(activeMutations, (active) => active + 1);
+      });
+
+      const endMutation = generationGate.withPermit(
+        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
+      );
+
+      const withMutation = <A, E, R>(
+        body: Effect.Effect<A, E, R>,
+      ): Effect.Effect<A, E | DurableAlarmError, R> =>
+        Effect.acquireUseRelease(
+          generationGate.withPermit(beginMutation()),
+          () =>
+            failpoint.hit("maintenance:mutation:armed").pipe(
+              Effect.andThen(body),
+              Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
+            ),
+          () => endMutation,
+        );
+
+      return ThreadMutationGate.of({
+        withMutation,
+        withSnapshot: (body) =>
+          generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body)),
+      });
+    }),
+  );
+}
+
 export type MaintenancePassFailure =
   | DurableWorkerFailure
   | DurableBindingFailure
@@ -313,6 +439,8 @@ export class ThreadMaintenance extends Context.Service<
   static readonly layer: Layer.Layer<
     ThreadMaintenance,
     never,
+    | ThreadMutationGate
+    | ThreadPublication
     | DurableAgentRuntime
     | SubmissionLedger
     | DurableAlarmService
@@ -335,68 +463,13 @@ export class ThreadMaintenance extends Context.Service<
        * restarts at zero and merely re-arms sooner than a long-lived one would have.
        */
       const stalls = yield* Ref.make(0);
-      /**
-       * Incarnation-local mutation count guarded with the generation transactions below. It is
-       * deliberately not durable: after eviction every begun mutation has stopped, while its
-       * pre-armed dirty generation remains durable for recovery. The short gate never spans the
-       * caller's mutation or cross-Object I/O.
-       */
-      const activeMutations = yield* Ref.make(0);
-      const generationGate = yield* Semaphore.make(1);
-      // At-least-once deliveries are idempotent, but overlapping pass bodies could otherwise
-      // acknowledge state while a sibling pass is still mutating it. Port/RPC mutations do not
-      // take this permit, so cross-Object I/O cannot deadlock the maintenance serialization.
+      const mutations = yield* ThreadMutationGate;
+      const publication = yield* ThreadPublication;
       const maintenancePassGate = yield* Semaphore.make(1);
       const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
 
-      const runTransaction = <A>(
-        operation: string,
-        transaction: () => Promise<A>,
-      ): Effect.Effect<A, DurableAlarmError> =>
-        Effect.tryPromise({
-          try: transaction,
-          catch: alarmFailure(operation),
-        });
-
-      const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* () {
-        yield* failpoint.hit("maintenance:dirty:before");
-        const now = yield* Clock.currentTimeMillis;
-
-        yield* runTransaction("advance maintenance generation", () =>
-          ctx.storage.transaction(async (transaction) => {
-            const { state } = await readMaintenanceState(transaction);
-
-            const next = ThreadMaintenanceState.make({
-              ...state,
-              dirty: state.dirty + 1n,
-            });
-
-            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
-            // The earliest configured retry bounds a newly actionable mutation without relying
-            // on its best-effort immediate wake hint.
-            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-          }),
-        );
-        yield* failpoint.hit("maintenance:dirty:after");
-        yield* Ref.update(activeMutations, (active) => active + 1);
-      });
-
-      const endMutation = generationGate.withPermit(
-        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),
-      );
-
-      const withMutation = <A, E, R>(
-        body: Effect.Effect<A, E, R>,
-      ): Effect.Effect<A, E | DurableAlarmError, R> =>
-        Effect.acquireUseRelease(
-          generationGate.withPermit(beginMutation()),
-          () =>
-            failpoint.hit("maintenance:mutation:armed").pipe(
-              Effect.andThen(body),
-              Effect.tap(() => failpoint.hit("maintenance:mutation:finished")),
-            ),
-          () => endMutation,
-        );
+      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>
+        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });
 
       const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
         yield* failpoint.hit("maintenance:ensure:before");
@@ -414,6 +487,18 @@ export class ThreadMaintenance extends Context.Service<
             }
           }),
         );
+        const deadline = yield* publication.pendingDeadline;
+
+        if (Option.isSome(deadline)) {
+          yield* runTransaction("ensure publication alarm", () =>
+            ctx.storage.transaction((transaction) =>
+              ensureTransactionAlarmBy(
+                transaction,
+                Math.max(now + minimumAlarmDelay, deadline.value),
+              ),
+            ),
+          );
+        }
         yield* failpoint.hit("maintenance:ensure:after");
       });
 
@@ -429,7 +514,8 @@ export class ThreadMaintenance extends Context.Service<
               await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
             }
             if (state.processed >= state.dirty) {
-              await transaction.deleteAlarm();
+              // Prearm even a publication-only pass before invoking any host hook.
+              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
 
               return { _tag: "CaughtUp" as const, nonterminal: state.nonterminal };
             }
@@ -437,7 +523,11 @@ export class ThreadMaintenance extends Context.Service<
             // LATER to its bounded backoff, which does not cancel the running handler.
             await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
 
-            return { _tag: "Actionable" as const, generation: state.dirty };
+            return {
+              _tag: "Actionable" as const,
+              generation: state.dirty,
+              nonterminal: state.nonterminal,
+            };
           }),
         );
 
@@ -474,23 +564,74 @@ export class ThreadMaintenance extends Context.Service<
             alarm: report.alarm,
           }).pipe(Effect.as(report));
 
-        const started = yield* generationGate.withPermit(
+        const started = yield* mutations.withSnapshot((activeAtStart) =>
           Effect.gen(function* () {
-            const activeAtStart = yield* Ref.get(activeMutations);
             const generation = yield* beginPass();
 
+            if (generation._tag === "Actionable" && activeAtStart === 0) {
+              // The gate excludes a producer starting between the snapshot and certification.
+              yield* publication.prepareGeneration(generation.generation);
+            }
+
             return { ...generation, activeAtStart };
           }),
         );
 
-        if (started._tag === "CaughtUp") {
+        const deadline = yield* publication.pendingDeadline;
+
+        if (
+          started._tag === "Actionable" ||
+          (Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis))
+        ) {
+          yield* publication.drain;
+        }
+        const pending = yield* publication.pendingDeadline;
+
+        if (started._tag === "CaughtUp" || Option.isSome(pending)) {
+          yield* failpoint.hit("maintenance:finish:before");
+
+          const disposition = yield* mutations.withSnapshot((active) =>
+            Effect.gen(function* () {
+              // Re-read under the producer gate: a concurrent append/host mutation cannot be
+              // cleared using a stale empty deadline. Dirty generations bound all producer races.
+              const latest = yield* publication.pendingDeadline;
+              const now = yield* Clock.currentTimeMillis;
+
+              return yield* runTransaction("finish publication pass", () =>
+                ctx.storage.transaction(async (transaction) => {
+                  const { state } = await readMaintenanceState(transaction);
+
+                  const nativeDeadline =
+                    active > 0 || state.dirty > state.processed
+                      ? now + config.wakeScanInterval
+                      : Infinity;
+
+                  const next = Option.isSome(latest)
+                    ? Math.min(nativeDeadline, latest.value)
+                    : nativeDeadline;
+
+                  if (Number.isFinite(next)) {
+                    await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
+
+                    return "rearmed" as const;
+                  }
+                  await transaction.deleteAlarm();
+
+                  return "cleared" as const;
+                }),
+              );
+            }),
+          );
+
+          yield* failpoint.hit("maintenance:finish:after");
+
           return yield* annotate(
             MaintenancePassReport.make({
               phase: "caught-up",
               recovered: 0,
               settled: 0,
               nonterminal: started.nonterminal,
-              alarm: "cleared",
+              alarm: disposition,
             }),
           );
         }
@@ -528,9 +669,9 @@ export class ThreadMaintenance extends Context.Service<
 
         yield* failpoint.hit("maintenance:finish:before");
 
-        const alarmDisposition = yield* generationGate.withPermit(
+        const alarmDisposition = yield* mutations.withSnapshot((active) =>
           Effect.gen(function* () {
-            const active = yield* Ref.get(activeMutations);
+            const publicationDeadline = yield* publication.pendingDeadline;
 
             return yield* runTransaction("finish maintenance pass", () =>
               ctx.storage.transaction(async (transaction) => {
@@ -556,7 +697,14 @@ export class ThreadMaintenance extends Context.Service<
                   // Replace the crash-fallback slot with this pass's bounded backoff. The target
                   // is never earlier than the begin-pass fallback, so workerd does not cancel
                   // this running alarm handler before its report/span can complete.
-                  await transaction.setAlarm(now + delay);
+                  await transaction.setAlarm(
+                    Option.isSome(publicationDeadline)
+                      ? Math.max(
+                          now + minimumAlarmDelay,
+                          Math.min(now + delay, publicationDeadline.value),
+                        )
+                      : now + delay,
+                  );
 
                   return "rearmed" as const;
                 }
@@ -566,7 +714,22 @@ export class ThreadMaintenance extends Context.Service<
                   // unseen effects are never acknowledged. Do not accelerate that future alarm
                   // from inside the current handler: workerd cancels a running handler when it
                   // writes an earlier slot.
-                  await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+                  await ensureTransactionAlarmBy(
+                    transaction,
+                    Option.isSome(publicationDeadline)
+                      ? Math.max(
+                          now + minimumAlarmDelay,
+                          Math.min(now + config.wakeScanInterval, publicationDeadline.value),
+                        )
+                      : now + config.wakeScanInterval,
+                  );
+
+                  return "rearmed" as const;
+                }
+                if (Option.isSome(publicationDeadline)) {
+                  await transaction.setAlarm(
+                    Math.max(now + minimumAlarmDelay, publicationDeadline.value),
+                  );
 
                   return "rearmed" as const;
                 }
@@ -615,8 +778,15 @@ export class ThreadMaintenance extends Context.Service<
               }),
           }),
         ),
-        ensureAlarm: ensureAlarm(),
-        withMutation,
+        ensureAlarm: mutations.withSnapshot(() => ensureAlarm()),
+        withMutation: (body) =>
+          mutations.withMutation(
+            body.pipe(
+              Effect.tap(() =>
+                publishCommitted.pipe(Effect.provideService(ThreadPublication, publication)),
+              ),
+            ),
+          ),
       });
     }),
   );

package/src/CloudflareSubscriptions.ts

@@ -65,11 +65,17 @@ export class SubscriptionAlarmExtensionError extends Schema.TaggedError<Subscrip
   { code: Schema.NonEmptyString.check(Schema.isMaxLength(128)) },
 ) {}
 
-export interface SubscriptionPartitionAlarmHandler {
+/** Native partition services supplied at alarm invocation, after the host Layer is built. */
+export type SubscriptionPartitionAlarmServices =
+  | Subscriptions
+  | SubscriptionIntake
+  | SubscriptionDriver;
+
+export interface SubscriptionPartitionAlarmHandler<R = SubscriptionPartitionAlarmServices> {
   readonly tag: string;
   readonly handle: (
     event: DurableObjectAlarm.DurableObjectAlarmEvent,
-  ) => Effect.Effect<void, SubscriptionAlarmProtocolError | SubscriptionAlarmExtensionError>;
+  ) => Effect.Effect<void, SubscriptionAlarmProtocolError | SubscriptionAlarmExtensionError, R>;
 }
 
 /** Host-only handlers; the framework reserves its namespace and rejects every unknown tag. */
@@ -79,7 +85,8 @@ export const SubscriptionPartitionAlarmExtension = Context.Reference<{
   defaultValue: () => ({ handlers: [] }),
 });
 
-/** Capture host services once; each invocation owns its codec/handler Scope and timeout.
+/** Capture host services once, deferring native partition services to invocation.
+ * Each invocation owns its codec/handler Scope and timeout.
  * Callback failures stay typed. Defects and interruption reach the native alarm multiplexer.
  * The host owns durable idempotency, prearming and external-effect uncertainty.
  */
@@ -95,9 +102,17 @@ export const makeSubscriptionPartitionAlarmHandler = Effect.fn(
     },
   ) => Effect.Effect<void, SubscriptionAlarmExtensionError, R>;
 }): Effect.fn.Return<
-  SubscriptionPartitionAlarmHandler,
+  SubscriptionPartitionAlarmHandler<
+    Exclude<
+      Exclude<R | Payload["DecodingServices"], Scope.Scope>,
+      Exclude<
+        Exclude<R | Payload["DecodingServices"], Scope.Scope | SubscriptionPartitionAlarmServices>,
+        SubscriptionPartitionAlarmServices
+      >
+    >
+  >,
   SubscriptionAlarmProtocolError,
-  Exclude<R | Payload["DecodingServices"], Scope.Scope>
+  Exclude<R | Payload["DecodingServices"], Scope.Scope | SubscriptionPartitionAlarmServices>
 > {
   if (
     options.tag.length === 0 ||
@@ -110,7 +125,11 @@ export const makeSubscriptionPartitionAlarmHandler = Effect.fn(
     return yield* SubscriptionAlarmProtocolError.make({
       message: "Invalid ancillary alarm tag or timeout",
     });
-  const services = yield* Effect.context<Exclude<R | Payload["DecodingServices"], Scope.Scope>>();
+
+  // Context capture includes unrequested services too; never retain a host override of native work.
+  const services = (yield* Effect.context<
+    Exclude<R | Payload["DecodingServices"], Scope.Scope | SubscriptionPartitionAlarmServices>
+  >()).pipe(Context.omit(Subscriptions, SubscriptionIntake, SubscriptionDriver));
 
   return {
     tag: options.tag,

package/src/ThreadObject.ts

@@ -103,6 +103,7 @@ import { ProgressWaitRegistry } from "./internal/progress-wait.ts";
 export {
   layer,
   layerConfig,
+  type ThreadPublicationOptions as PublicationOptions,
   type CloudflareDurableRuntimeOptions as RuntimeOptions,
   type CloudflareDurableRuntimeServices as Services,
   type CloudflareDurableRuntimeInitializationError as InitializationError,

package/src/internal/layers.ts

@@ -47,8 +47,8 @@ import {
   type OperationAuthorizerService,
 } from "@effect-agent/thread/OperationAuthorizer";
 import { ProducerId } from "@effect-agent/thread/Records";
-import { type SubmissionLedger } from "@effect-agent/thread/SubmissionLedger";
-import { type ThreadStore } from "@effect-agent/thread/ThreadStore";
+import { LedgerError, SubmissionLedger } from "@effect-agent/thread/SubmissionLedger";
+import { ThreadStoreError, ThreadStore } from "@effect-agent/thread/ThreadStore";
 import { ToolReconciler } from "@effect-agent/thread/ToolReconciler";
 import { type WakeScheduler } from "@effect-agent/thread/WakeScheduler";
 import { BrowserCrypto } from "@effect/platform-browser";
@@ -58,6 +58,9 @@ import { Context, Duration, Effect, Layer, Schema } from "effect";
 
 import {
   ThreadMaintenance,
+  ThreadMutationGate,
+  ThreadPublication,
+  publishCommitted,
   ThreadMaintenanceFailpoint,
   DurableAlarmService,
   type ThreadMaintenanceFailpointHandler,
@@ -168,6 +171,8 @@ export type CloudflareDurableRuntimeServices =
   | WakeScheduler
   | DurableAlarmService
   | ThreadMaintenance
+  | ThreadMutationGate
+  | ThreadPublication
   | ThreadObjectPorts
   | ProgressWaitRegistry;
 
@@ -311,15 +316,33 @@ export const layerConfig = (
     }),
   );
 
+export interface ThreadPublicationOptions<E = never, R = never> {
+  /**
+   * Optional host outbox consumer, built once per incarnation with RAW LOCAL ThreadStore and
+   * SubmissionLedger services. Yield DurableObjectContext and ThreadObjectIdentity for native
+   * bindings and identity. Initialization is local-only, inside the constructor gate; setup
+   * errors and additional requirements remain in the returned Layer. Layer.effect owns Scope.
+   * Canonical appends and durable approval, abort and unknown-resolution intents invalidate
+   * publication after commit. Custom host facts must use ThreadMaintenance.withMutation.
+   */
+  readonly publication?: Layer.Layer<ThreadPublication, E, R>;
+}
+
 /**
  * Register typed Agents and version declarations. Hashing and dependency capture happen in
  * this Layer's Scope, after application Layers have been provided. Every Agent's instruction,
  * Tool, Schema, and model requirements remain visible until satisfied by Layer composition.
  * Use Layer.unwrap for registration values that need effectful application setup.
  */
-export const layer = <const Entries extends ReadonlyArray<AgentRegistration>>(
+export const layer = <const Entries extends ReadonlyArray<AgentRegistration>, E = never, R = never>(
   registrations: Entries,
-) => Layer.unwrap(Effect.map(compileRegistrations(registrations), layerFromBindings));
+  options: ThreadPublicationOptions<E, R> = {},
+) =>
+  Layer.unwrap(
+    Effect.map(compileRegistrations(registrations), (bindings) =>
+      layerFromBindings(bindings, options),
+    ),
+  );
 
 /**
  * Assemble the durable runtime from already-resolved Agent Bindings.
@@ -327,12 +350,16 @@ export const layer = <const Entries extends ReadonlyArray<AgentRegistration>>(
  * Supply host services through `ThreadObject.make` or `ThreadObject.layerConfig` and
  * the Durable Object context and namespace Layers when composing a custom host.
  */
-export const layerFromBindings = (
+export const layerFromBindings = <E = never, R = never>(
   bindings: ReadonlyArray<ResolvedBinding>,
+  options: ThreadPublicationOptions<E, R> = {},
 ): Layer.Layer<
   CloudflareDurableRuntimeServices,
-  DoStorageInitializationError,
-  DurableObjectContext | ThreadObjectNamespace | CloudflareBootstrapServices
+  DoStorageInitializationError | E,
+  | DurableObjectContext
+  | ThreadObjectNamespace
+  | CloudflareBootstrapServices
+  | Exclude<R, ThreadStore | SubmissionLedger>
 > =>
   Layer.unwrap(
     Effect.gen(function* () {
@@ -355,10 +382,67 @@ export const layerFromBindings = (
 
       // The same local ports serve routed decorators and owner-side RPC execution.
       // The RPC executor must never receive routed ports and bounce requests between Objects.
-      const localPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(
+      const rawLocalPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(
         Layer.provide(infrastructure),
       );
 
+      const publication = (options.publication ?? ThreadPublication.layer).pipe(
+        Layer.provide(rawLocalPorts),
+      );
+
+      const localPorts =
+        options.publication === undefined
+          ? rawLocalPorts
+          : Layer.effectContext(
+              Effect.gen(function* () {
+                const store = yield* ThreadStore;
+                const ledger = yield* SubmissionLedger;
+                const mutations = yield* ThreadMutationGate;
+                const publish = yield* Effect.context<ThreadPublication>();
+                const afterCommit = publishCommitted.pipe(Effect.provide(publish));
+
+                // Every runtime-owned producer prearms too: a crash between commit and invalidation
+                // leaves a NEW, uncertified generation. Source errors keep their native port types.
+                const observedStore = ThreadStore.of({
+                  ...store,
+                  append: (request) =>
+                    mutations
+                      .withMutation(store.append(request).pipe(Effect.tap(() => afterCommit)))
+                      .pipe(
+                        Effect.catchTag("DurableAlarmError", (cause) =>
+                          ThreadStoreError.make({
+                            operation: "prearm publication append",
+                            message: cause.message,
+                            cause,
+                          }),
+                        ),
+                      ),
+                });
+
+                const observeIntent = <A, Failure>(body: Effect.Effect<A, Failure>) =>
+                  mutations.withMutation(body.pipe(Effect.tap(() => afterCommit))).pipe(
+                    Effect.catchTag("DurableAlarmError", (cause) =>
+                      LedgerError.make({
+                        operation: "prearm publication intent",
+                        message: "The publication generation could not be armed",
+                        cause,
+                      }),
+                    ),
+                  );
+
+                return Context.make(ThreadStore, observedStore).pipe(
+                  Context.add(SubmissionLedger, {
+                    ...ledger,
+                    recordApprovalDecision: (request) =>
+                      observeIntent(ledger.recordApprovalDecision(request)),
+                    requestAbort: (request) => observeIntent(ledger.requestAbort(request)),
+                    recordUnknownResolution: (request) =>
+                      observeIntent(ledger.recordUnknownResolution(request)),
+                  }),
+                );
+              }),
+            ).pipe(Layer.provide(rawLocalPorts));
+
       const portsEndpointLayer = Layer.effect(ThreadObjectPorts)(
         Effect.gen(function* () {
           const local = yield* Effect.context<SubmissionLedger | ThreadStore>();
@@ -386,6 +470,6 @@ export const layerFromBindings = (
         runtimeStack,
         ThreadMaintenance.layer.pipe(Layer.provide(runtimeStack)),
         portsEndpointLayer,
-      );
+      ).pipe(Layer.provideMerge(publication), Layer.provideMerge(ThreadMutationGate.layer));
     }),
   );

package/src/protected-browser/binding.ts

@@ -107,7 +107,8 @@ export const browserRunProtectedBindingLayer = (options: {
 
             const acquired = await puppeteer.acquire(binding, {
               recording: false,
-              keep_alive: Math.max(10_000, policy.maxElapsedMillis),
+              // Provider inactivity timeout, independent of the finite total pass deadline.
+              keep_alive: Math.min(600_000, Math.max(10_000, policy.maxElapsedMillis)),
             });
 
             sessionId = Redacted.make(