@ewhauser/world-celld 0.3.0 → 0.3.1

package/dist/worker.js

@@ -96,6 +96,342 @@ function rpcStringify(value) {
 function rpcParse(text) {
 	return JSON.parse(text, rpcReviver);
 }
+const INDEX_PROTOCOL_VERSION = "v1";
+const HOOK_RELEASE_BATCH = 64;
+/** Stable FNV-1a routing hash. Collisions share a shard but never a storage key. */
+function stableIndexHash(value) {
+	let hash = 2166136261;
+	for (const byte of new TextEncoder().encode(value)) {
+		hash ^= byte;
+		hash = Math.imul(hash, 16777619);
+	}
+	return hash >>> 0;
+}
+function shardName(domain, value, cardinality) {
+	const width = Math.max(2, (cardinality - 1).toString(16).length);
+	const shard = stableIndexHash(value) % cardinality;
+	return `${domain}:${INDEX_PROTOCOL_VERSION}:${shard.toString(16).padStart(width, "0")}`;
+}
+function runCatalogShardName(runId) {
+	return shardName("run-catalog", runId, 16);
+}
+function hookTokenShardName(token) {
+	return shardName("hook-token", token, 32);
+}
+function hookIdShardName(hookId) {
+	return shardName("hook-id", hookId, 32);
+}
+function runFenceCellName(runId) {
+	return `run-fence:${INDEX_PROTOCOL_VERSION}:${runId}`;
+}
+function allRunCatalogShardNames() {
+	return Array.from({ length: 16 }, (_, shard) => `run-catalog:${INDEX_PROTOCOL_VERSION}:${shard.toString(16).padStart(2, "0")}`);
+}
+function stub(namespace, name) {
+	return namespace.get(namespace.idFromName(name));
+}
+function runKeys(run) {
+	const timestamp = run.createdAt.getTime().toString().padStart(13, "0");
+	return [`run:${run.workflowName}:${timestamp}:${run.runId}`, `runall:${timestamp}:${run.runId}`];
+}
+function groupByShard(values, route) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const value of values) {
+		const name = route(value);
+		const group = groups.get(name);
+		if (group) group.push(value);
+		else groups.set(name, [value]);
+	}
+	return groups;
+}
+function sameOwner$1(left, right) {
+	return left.runId === right.runId && left.hookId === right.hookId;
+}
+function compareBytes(left, right) {
+	const length = Math.min(left.byteLength, right.byteLength);
+	for (let index = 0; index < length; index++) {
+		const difference = left[index] - right[index];
+		if (difference !== 0) return difference;
+	}
+	return left.byteLength - right.byteLength;
+}
+async function inBatches(values, operation) {
+	let deleted = 0;
+	for (let offset = 0; offset < values.length; offset += HOOK_RELEASE_BATCH) deleted += (await operation(values.slice(offset, offset + HOOK_RELEASE_BATCH))).deleted;
+	return deleted;
+}
+function createWorkflowIndex(bindings) {
+	const fence = (runId) => stub(bindings.runFences, runFenceCellName(runId));
+	const releaseHooks = async (request, fencedAt) => {
+		const tokenGroups = groupByShard(request.hooks, (hook) => hookTokenShardName(hook.token));
+		const idGroups = groupByShard(request.hooks, (hook) => hookIdShardName(hook.hookId));
+		const releases = [];
+		for (const [name, hooks] of tokenGroups) {
+			const target = stub(bindings.hookTokens, name);
+			releases.push(inBatches(hooks.map((hook) => ({
+				token: hook.token,
+				owner: {
+					runId: request.runId,
+					hookId: hook.hookId
+				}
+			})), (batch) => target.releaseBatch(batch, fencedAt, request.terminal)));
+		}
+		for (const [name, hooks] of idGroups) {
+			const target = stub(bindings.hookIds, name);
+			releases.push(inBatches(hooks.map((hook) => ({
+				hookId: hook.hookId,
+				owner: {
+					runId: request.runId,
+					hookId: hook.hookId
+				}
+			})), (batch) => target.releaseBatch(batch, fencedAt, request.terminal)));
+		}
+		return (await Promise.all(releases)).reduce((total, count) => total + count, 0);
+	};
+	return {
+		async commitRun(run, serializedMetadata) {
+			if (isTerminalWorkflowRunStatus(run.status)) await fence(run.runId).fenceTerminal(Date.now());
+			return await stub(bindings.runCatalog, runCatalogShardName(run.runId)).upsertRun(run.runId, runKeys(run), serializedMetadata);
+		},
+		async listRuns(options) {
+			const suppliedLimit = options?.limit;
+			const limit = Math.min(1e3, Math.max(1, typeof suppliedLimit === "number" && Number.isFinite(suppliedLimit) ? Math.floor(suppliedLimit) : 1e3));
+			const pages = await Promise.all(allRunCatalogShardNames().map((name) => stub(bindings.runCatalog, name).list({
+				...options,
+				limit: limit + 1
+			})));
+			const encoder = new TextEncoder();
+			const candidates = pages.flatMap((shardPage) => shardPage.keys.map((entry) => ({
+				entry,
+				encodedName: encoder.encode(entry.name)
+			}))).toSorted((left, right) => {
+				const compared = compareBytes(left.encodedName, right.encodedName);
+				return options?.reverse ? -compared : compared;
+			});
+			const page = candidates.slice(0, limit).map(({ entry }) => entry);
+			const listComplete = candidates.length <= limit && pages.every((entry) => entry.list_complete);
+			return {
+				keys: page,
+				list_complete: listComplete,
+				cursor: listComplete ? void 0 : page.at(-1)?.name
+			};
+		},
+		getHookByToken(token) {
+			return stub(bindings.hookTokens, hookTokenShardName(token)).get(token);
+		},
+		getHookById(hookId) {
+			return stub(bindings.hookIds, hookIdShardName(hookId)).get(hookId);
+		},
+		async reserveHook(token, owner) {
+			const proposedClaimId = crypto.randomUUID();
+			const tokenTarget = stub(bindings.hookTokens, hookTokenShardName(token));
+			const tokenClaim = await tokenTarget.reserve(token, owner, proposedClaimId);
+			if (!tokenClaim.claimed && !sameOwner$1(tokenClaim.holder, owner)) return {
+				admitted: false,
+				holder: tokenClaim.holder
+			};
+			const tokenClaimId = tokenClaim.claimed ? tokenClaim.claimId : void 0;
+			const hookIdTarget = stub(bindings.hookIds, hookIdShardName(owner.hookId));
+			const sharedClaimId = tokenClaimId ?? proposedClaimId;
+			let hookIdClaim;
+			try {
+				hookIdClaim = await hookIdTarget.reserve(owner.hookId, owner, sharedClaimId);
+			} catch (error) {
+				await Promise.allSettled([...tokenClaimId ? [tokenTarget.releaseClaim(token, owner, tokenClaimId)] : [], hookIdTarget.releaseClaim(owner.hookId, owner, sharedClaimId)]);
+				throw error;
+			}
+			if (!hookIdClaim.claimed) {
+				if (tokenClaimId) await tokenTarget.releaseClaim(token, owner, tokenClaimId);
+				return {
+					admitted: false,
+					holder: hookIdClaim.holder
+				};
+			}
+			return {
+				admitted: true,
+				reservation: {
+					claimId: `${tokenClaimId ?? "-"}:${hookIdClaim.claimId}`,
+					tokenClaimId,
+					hookIdClaimId: hookIdClaim.claimId
+				}
+			};
+		},
+		async finalizeHookIndexes(token, hookId, serializedHook, owner, reservation) {
+			if (!(await stub(bindings.hookTokens, hookTokenShardName(token)).finalize(token, serializedHook, owner, reservation?.tokenClaimId)).stored) return;
+			await stub(bindings.hookIds, hookIdShardName(hookId)).publish(hookId, serializedHook, owner, reservation?.hookIdClaimId);
+		},
+		async releaseHookReservation(token, owner, reservation) {
+			const releases = [];
+			if (reservation.tokenClaimId) releases.push(stub(bindings.hookTokens, hookTokenShardName(token)).releaseClaim(token, owner, reservation.tokenClaimId));
+			if (reservation.hookIdClaimId) releases.push(stub(bindings.hookIds, hookIdShardName(owner.hookId)).releaseClaim(owner.hookId, owner, reservation.hookIdClaimId));
+			await Promise.all(releases);
+		},
+		async releaseHookIndexes(request) {
+			if (request.terminal) await fence(request.runId).fenceTerminal(Date.now());
+			return { deleted: await releaseHooks(request, Date.now()) };
+		},
+		async expireRun(request) {
+			await fence(request.runId).fenceExpired(request.expiredAt);
+			const [catalog, hookDeletes] = await Promise.all([stub(bindings.runCatalog, runCatalogShardName(request.runId)).expireRun(request.runId, request.keys, request.expiredAt), releaseHooks({
+				runId: request.runId,
+				hooks: request.hooks,
+				terminal: true
+			}, request.expiredAt)]);
+			return { deleted: catalog.deleted + hookDeletes };
+		}
+	};
+}
+//#endregion
+//#region src/stream-protocol.ts
+/**
+* Hard-cutover stream protocol shared by the client, Worker router, and
+* StreamDO. Chunk payloads use a compact binary envelope on the public HTTP
+* boundary and Uint8Array values on the DO/storage boundary.
+*/
+const STREAM_BATCH_CONTENT_TYPE = "application/vnd.world-celld.stream-batch.v1";
+/** A chunk remains below the 2 MiB SQLite-backed DO key/value limit. */
+const MAX_STREAM_CHUNK_BYTES = 1048576;
+/** Keeps serialized RPC bodies well below the 32 MiB Workers RPC limit. */
+const MAX_STREAM_BATCH_BYTES = 8388608;
+const MAX_STREAM_READ_BYTES = 8388608;
+const MAX_STREAM_ERROR_BYTES = 16384;
+/** Must remain below the default 30 second fleet request deadline. */
+const MAX_STREAM_LONG_POLL_MS = 2e4;
+const WRITE_MAGIC = 1464030039;
+const WRITE_ACK_MAGIC = 1464030017;
+const READ_MAGIC = 1464030034;
+const PROTOCOL_VERSION = 1;
+const WRITE_HEADER_BYTES = 8;
+const WRITE_ACK_BYTES = 16;
+const READ_HEADER_BYTES = 28;
+const STATE_TO_WIRE = {
+	open: 0,
+	closed: 1,
+	errored: 2,
+	expired: 3
+};
+function protocolError(message) {
+	const error = /* @__PURE__ */ new Error(`world-celld: invalid stream protocol: ${message}`);
+	error.name = "StreamProtocolError";
+	return error;
+}
+function requireSafeIndex(value, field) {
+	if (!Number.isSafeInteger(value) || value < -1 || value > 2147483647) throw protocolError(`${field} is out of range`);
+}
+function validateStreamWriteChunks(chunks) {
+	if (chunks.length === 0) throw protocolError("batch must contain at least one chunk");
+	if (chunks.length > 32) throw protocolError(`batch exceeds 32 chunks`);
+	let totalBytes = 0;
+	for (const chunk of chunks) {
+		if (!(chunk instanceof Uint8Array)) throw protocolError("chunk is not binary data");
+		if (chunk.byteLength > 1048576) throw protocolError(`chunk exceeds ${MAX_STREAM_CHUNK_BYTES} bytes`);
+		totalBytes += chunk.byteLength;
+		if (totalBytes > 8388608) throw protocolError(`batch exceeds ${MAX_STREAM_BATCH_BYTES} bytes`);
+	}
+	return totalBytes;
+}
+function validateStreamReadRequest(request) {
+	if (!request.runId) throw protocolError("runId is required");
+	if (!Number.isSafeInteger(request.startIndex) || request.startIndex < 0) throw protocolError("startIndex must be a non-negative safe integer");
+	if (!Number.isSafeInteger(request.maxChunks) || request.maxChunks < 0 || request.maxChunks > 32) throw protocolError(`maxChunks must be between 0 and 32`);
+	if (!Number.isSafeInteger(request.maxBytes) || request.maxBytes < 1048576 || request.maxBytes > 8388608) throw protocolError(`maxBytes must be between ${MAX_STREAM_CHUNK_BYTES} and ${MAX_STREAM_READ_BYTES}`);
+	if (!Number.isSafeInteger(request.waitMs) || request.waitMs < 0 || request.waitMs > 2e4) throw protocolError(`waitMs must be between 0 and ${MAX_STREAM_LONG_POLL_MS}`);
+}
+function decodeStreamWriteBatch(encoded) {
+	if (encoded.byteLength < WRITE_HEADER_BYTES) throw protocolError("truncated write header");
+	const view = new DataView(encoded.buffer, encoded.byteOffset, encoded.byteLength);
+	if (view.getUint32(0) !== WRITE_MAGIC) throw protocolError("bad write magic");
+	if (view.getUint16(4) !== PROTOCOL_VERSION) throw protocolError("unsupported write version");
+	const count = view.getUint16(6);
+	const chunks = [];
+	let offset = WRITE_HEADER_BYTES;
+	for (let index = 0; index < count; index++) {
+		if (offset + 4 > encoded.byteLength) throw protocolError("truncated chunk length");
+		const length = view.getUint32(offset);
+		offset += 4;
+		if (offset + length > encoded.byteLength) throw protocolError("truncated chunk data");
+		chunks.push(new Uint8Array(encoded.subarray(offset, offset + length)));
+		offset += length;
+	}
+	if (offset !== encoded.byteLength) throw protocolError("trailing write data");
+	validateStreamWriteChunks(chunks);
+	return chunks;
+}
+function encodeStreamWriteResult(result) {
+	requireSafeIndex(result.startIndex, "startIndex");
+	requireSafeIndex(result.tailIndex, "tailIndex");
+	if (!Number.isSafeInteger(result.count) || result.count < 1 || result.count > 32) throw protocolError("write count is out of range");
+	const encoded = new Uint8Array(WRITE_ACK_BYTES);
+	const view = new DataView(encoded.buffer);
+	view.setUint32(0, WRITE_ACK_MAGIC);
+	view.setUint16(4, PROTOCOL_VERSION);
+	view.setUint16(6, result.count);
+	view.setInt32(8, result.startIndex);
+	view.setInt32(12, result.tailIndex);
+	return encoded;
+}
+function encodeStreamReadResult(result) {
+	requireSafeIndex(result.startIndex, "startIndex");
+	requireSafeIndex(result.tailIndex, "tailIndex");
+	let chunkBytes = 0;
+	for (const chunk of result.chunks) chunkBytes += 4 + chunk.byteLength;
+	if (result.chunks.length > 32 || chunkBytes > 8388736) throw protocolError("read result exceeds configured bounds");
+	const encoder = new TextEncoder();
+	const errorName = result.error ? encoder.encode(result.error.name) : /* @__PURE__ */ new Uint8Array();
+	const errorMessage = result.error ? encoder.encode(result.error.message) : /* @__PURE__ */ new Uint8Array();
+	if (errorName.byteLength + errorMessage.byteLength > 16384) throw protocolError(`stream error exceeds ${MAX_STREAM_ERROR_BYTES} bytes`);
+	const encoded = new Uint8Array(READ_HEADER_BYTES + chunkBytes + errorName.byteLength + errorMessage.byteLength);
+	const view = new DataView(encoded.buffer);
+	view.setUint32(0, READ_MAGIC);
+	view.setUint8(4, PROTOCOL_VERSION);
+	const state = STATE_TO_WIRE[result.state];
+	if (state === void 0) throw protocolError("unknown stream state");
+	view.setUint8(5, state);
+	view.setUint8(6, result.timedOut ? 1 : 0);
+	view.setUint8(7, 0);
+	view.setInt32(8, result.startIndex);
+	view.setInt32(12, result.tailIndex);
+	view.setUint32(16, result.chunks.length);
+	view.setUint32(20, errorName.byteLength);
+	view.setUint32(24, errorMessage.byteLength);
+	let offset = READ_HEADER_BYTES;
+	for (const chunk of result.chunks) {
+		view.setUint32(offset, chunk.byteLength);
+		offset += 4;
+		encoded.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	encoded.set(errorName, offset);
+	offset += errorName.byteLength;
+	encoded.set(errorMessage, offset);
+	return encoded;
+}
+function normalizeStreamError(error) {
+	let normalized;
+	if (error instanceof Error) normalized = {
+		name: error.name || "Error",
+		message: error.message
+	};
+	else if (typeof error === "string") normalized = {
+		name: "Error",
+		message: error
+	};
+	else if (error && typeof error === "object" && typeof error.name === "string" && typeof error.message === "string") normalized = {
+		name: error.name,
+		message: error.message
+	};
+	else normalized = {
+		name: "Error",
+		message: String(error)
+	};
+	normalized.name = normalized.name.slice(0, 1024);
+	normalized.message = normalized.message.slice(0, 4096);
+	while (new TextEncoder().encode(normalized.name).byteLength + new TextEncoder().encode(normalized.message).byteLength > MAX_STREAM_ERROR_BYTES) {
+		normalized.message = normalized.message.slice(0, Math.max(0, normalized.message.length - 256));
+		if (normalized.message.length === 0) normalized.name = normalized.name.slice(0, Math.max(0, normalized.name.length - 256));
+	}
+	return normalized;
+}
 //#endregion
 //#region src/worker/auth.ts
 /**
@@ -145,13 +481,23 @@ async function authenticate(request, secret) {
 * Routes:
 *   GET  /v1/health                              — liveness + spec version (unauthenticated)
 *   POST /v1/rpc/{binding}/{name}/{method}       — DO RPC (bearer auth)
+*   POST /v1/index/{domain}/{method}             — cohesive index operation
+*   GET  /v1/streams/{name}/chunks               — bounded binary long-poll read
+*   POST /v1/streams/{name}/chunks               — bounded binary batch append
 *
-* The RPC body is an rpc-codec-encoded JSON array of arguments; the response
-* body is the rpc-codec-encoded return value. Only whitelisted methods
-* dispatch — everything else (including fetch/alarm) is unreachable.
+* Generic RPC bodies use the tagged JSON codec. Stream chunk bodies use the
+* compact binary stream protocol. Only whitelisted routes/methods dispatch.
 */
 const WORLD_NAME = "world-celld";
 const WORLD_VERSION = "0.1.0";
+function workflowIndex(env) {
+	return createWorkflowIndex({
+		runCatalog: env.WORKFLOW_RUN_CATALOG,
+		runFences: env.WORKFLOW_RUN_FENCES,
+		hookTokens: env.WORKFLOW_HOOK_TOKENS,
+		hookIds: env.WORKFLOW_HOOK_IDS
+	});
+}
 const BINDINGS = {
 	runs: {
 		env: "WORKFLOW_DB",
@@ -166,16 +512,15 @@ const BINDINGS = {
 			"getCleanupStatus",
 			"scheduleCleanup",
 			"cleanupNow",
-			"rearmCleanup"
+			"rearmCleanup",
+			"resolveHookTokenClaim"
 		])
 	},
 	streams: {
 		env: "WORKFLOW_STREAMS",
 		methods: /* @__PURE__ */ new Set([
-			"writeChunk",
 			"closeStream",
-			"getChunks",
-			"getInfo",
+			"failStream",
 			"registerStream",
 			"listStreams",
 			"expireRegistry",
@@ -183,20 +528,13 @@ const BINDINGS = {
 			"expireStream"
 		])
 	},
-	index: {
-		env: "WORKFLOW_INDEX",
-		methods: /* @__PURE__ */ new Set([
-			"get",
-			"put",
-			"delete",
-			"putOwned",
-			"expireRun",
-			"list",
-			"reserveHookToken",
-			"finalizeHookIndexes",
-			"releaseHookToken",
-			"deleteHookIndexes"
-		])
+	"hook-tokens": {
+		env: "WORKFLOW_HOOK_TOKENS",
+		methods: /* @__PURE__ */ new Set(["get"])
+	},
+	"hook-ids": {
+		env: "WORKFLOW_HOOK_IDS",
+		methods: /* @__PURE__ */ new Set(["get"])
 	},
 	queue: {
 		env: "WORKFLOW_QUEUE",
@@ -213,6 +551,7 @@ const BINDINGS = {
 };
 /** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
 const MAX_BODY_BYTES = 33554432;
+const MAX_STREAM_WRITE_BODY_BYTES = 8389632;
 function errorResponse(status, name, message) {
 	return Response.json({ error: {
 		name,
@@ -241,6 +580,49 @@ async function readBoundedBody(request) {
 		reader.releaseLock();
 	}
 }
+async function readBoundedBytes(request, maxBytes) {
+	if (!request.body) return /* @__PURE__ */ new Uint8Array();
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel("stream body exceeds configured limit").catch(() => void 0);
+				return null;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return body;
+}
+function parseBoundedInteger(url, name, minimum, maximum) {
+	const raw = url.searchParams.get(name);
+	const value = raw === null ? NaN : Number(raw);
+	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+		const error = /* @__PURE__ */ new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
+		error.name = "StreamProtocolError";
+		throw error;
+	}
+	return value;
+}
+function streamResponse(body) {
+	return new Response(body, {
+		status: 200,
+		headers: { "content-type": STREAM_BATCH_CONTENT_TYPE }
+	});
+}
 function createRouter(env) {
 	return async (request) => {
 		const url = new URL(request.url);
@@ -252,9 +634,79 @@ function createRouter(env) {
 			version: WORLD_VERSION,
 			specVersion: SPEC_VERSION_CURRENT
 		});
-		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
 		const auth = await authenticate(request, env.WORLD_SECRET);
 		if (!auth.ok) return auth.response;
+		if (parts[1] === "index" && parts.length === 4) {
+			if (request.method !== "POST") return errorResponse(405, "MethodNotAllowed", "expected POST");
+			if (Number(request.headers.get("content-length") ?? "0") > MAX_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+			let args;
+			try {
+				const text = await readBoundedBody(request);
+				if (text === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+				const parsed = rpcParse(text);
+				if (!Array.isArray(parsed)) return errorResponse(400, "BadRequest", "body must be an argument array");
+				args = parsed;
+			} catch {
+				return errorResponse(400, "BadRequest", "malformed rpc body");
+			}
+			try {
+				const index = workflowIndex(env);
+				let result;
+				const operation = `${parts[2]}.${parts[3]}`;
+				if (operation === "runs.list") result = await index.listRuns(args[0]);
+				else if (operation === "runs.commit") result = await index.commitRun(args[0], args[1]);
+				else if (operation === "runs.expire") result = await index.expireRun(args[0]);
+				else if (operation === "hooks.reserve") result = await index.reserveHook(args[0], args[1]);
+				else if (operation === "hooks.finalize") result = await index.finalizeHookIndexes(args[0], args[1], args[2], args[3], args[4]);
+				else if (operation === "hooks.release-reservation") result = await index.releaseHookReservation(args[0], args[1], args[2]);
+				else if (operation === "hooks.release") result = await index.releaseHookIndexes(args[0]);
+				else return errorResponse(404, "NotFound", `unknown index operation: ${operation}`);
+				return new Response(rpcStringify(result ?? null), {
+					status: 200,
+					headers: { "content-type": "application/json" }
+				});
+			} catch (error) {
+				const err = error;
+				return Response.json({ error: {
+					name: err?.name ?? "Error",
+					message: err?.message ?? String(error),
+					status: typeof err?.status === "number" ? err.status : void 0
+				} }, { status: 500 });
+			}
+		}
+		if (parts[1] === "streams" && parts.length === 4 && parts[3] === "chunks") {
+			const namespace = env.WORKFLOW_STREAMS;
+			if (!namespace) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_STREAMS");
+			const name = decodeURIComponent(parts[2]);
+			const runId = url.searchParams.get("runId");
+			if (!runId) return errorResponse(400, "BadRequest", "runId is required");
+			const stub = namespace.get(namespace.idFromName(name));
+			try {
+				if (request.method === "POST") {
+					if (!request.headers.get("content-type")?.startsWith("application/vnd.world-celld.stream-batch.v1")) return errorResponse(415, "UnsupportedMediaType", STREAM_BATCH_CONTENT_TYPE);
+					if (Number(request.headers.get("content-length") ?? "0") > MAX_STREAM_WRITE_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_STREAM_WRITE_BODY_BYTES} bytes`);
+					const body = await readBoundedBytes(request, MAX_STREAM_WRITE_BODY_BYTES);
+					if (body === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_STREAM_WRITE_BODY_BYTES} bytes`);
+					return streamResponse(encodeStreamWriteResult(await stub.writeChunks(runId, decodeStreamWriteBatch(body))));
+				}
+				if (request.method === "GET") return streamResponse(encodeStreamReadResult(await stub.readChunks({
+					runId,
+					startIndex: parseBoundedInteger(url, "startIndex", 0, 2147483647),
+					maxChunks: parseBoundedInteger(url, "maxChunks", 0, 32),
+					maxBytes: parseBoundedInteger(url, "maxBytes", MAX_STREAM_CHUNK_BYTES, MAX_STREAM_READ_BYTES),
+					waitMs: parseBoundedInteger(url, "waitMs", 0, MAX_STREAM_LONG_POLL_MS)
+				}, request.signal)));
+				return errorResponse(405, "MethodNotAllowed", "expected GET or POST");
+			} catch (error) {
+				const err = error;
+				return Response.json({ error: {
+					name: err?.name ?? "Error",
+					message: err?.message ?? String(error),
+					status: typeof err?.status === "number" ? err.status : void 0
+				} }, { status: err?.name === "StreamProtocolError" ? 400 : 500 });
+			}
+		}
+		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
 		if (request.method !== "POST" || parts.length !== 5) return errorResponse(404, "NotFound", "expected POST /v1/rpc/{binding}/{name}/{method}");
 		const [, , bindingKey, encodedName, method] = parts;
 		const binding = BINDINGS[bindingKey];
@@ -299,160 +751,242 @@ function compact(obj) {
 	return value;
 }
 //#endregion
-//#region src/worker/durable-objects/IndexDO.ts
+//#region src/worker/durable-objects/hook-index-shared.ts
 function sameOwner(left, right) {
 	return left.runId === right.runId && left.hookId === right.hookId;
 }
-function ownerFromHook(raw) {
+function ownerFromSerializedHook(raw) {
 	const hook = parse(raw);
 	return {
 		runId: hook.runId,
 		hookId: hook.hookId
 	};
 }
-/**
-* Global index cell, replacing the Workers KV namespace world-cloudflare
-* uses for run listing and hook token/id lookup.
-*
-* A single cell (named `index`) serializes every read and write. Hook-token
-* reservation, publication, and release use storage transactions so
-* concurrent runs cannot both acquire the same token.
-*
-* The RPC surface matches the storage-layer KVNamespace interface bit-for-bit
-* (including MockKVNamespace's pagination contract: cursor = last returned
-* key, `list_complete` reflects whether further keys exist), so the vendored
-* storage.ts works against it unchanged.
-*/
-var IndexDO = class extends DurableObject {
-	async get(key) {
-		return await this.ctx.storage.get(key) ?? null;
-	}
-	async put(key, value) {
-		await this.ctx.storage.put(key, value);
+function indexKey(prefix, value) {
+	return `${prefix}:${encodeURIComponent(value)}`;
+}
+/** Compact shard-local fence for every hook owned by one terminal or expired run. */
+function shardRunFenceKey(runId) {
+	return `runfence:${encodeURIComponent(runId)}`;
+}
+async function runIsActive(env, runId) {
+	const namespace = env.WORKFLOW_RUN_FENCES;
+	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_RUN_FENCES binding");
+	return await namespace.get(namespace.idFromName(runFenceCellName(runId))).getStatus() === "active";
+}
+//#endregion
+//#region src/worker/durable-objects/HookIdDO.ts
+const MAX_RELEASE_BATCH$1 = 64;
+function recordKey$1(hookId) {
+	return indexKey("hookid", hookId);
+}
+function claimKey$1(hookId) {
+	return indexKey("claim", hookId);
+}
+/** Hook-ID ownership and lookup shard; every hook ID has one transaction domain. */
+var HookIdDO = class extends DurableObject {
+	async get(hookId) {
+		const raw = await this.ctx.storage.get(recordKey$1(hookId));
+		if (!raw) return null;
+		const owner = ownerFromSerializedHook(raw);
+		return await runIsActive(this.env, owner.runId) ? raw : null;
+	}
+	async reserve(hookId, owner, proposedClaimId) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey$1(hookId);
+			const claim = claimKey$1(hookId);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0) return {
+				claimed: false,
+				holder: ownerFromSerializedHook(indexed)
+			};
+			const existing = values.get(claim);
+			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+				claimed: false,
+				holder: existing.owner
+			};
+			if (existing === void 0 || existing.claimId !== proposedClaimId) {
+				await txn.put(claim, {
+					owner,
+					claimId: proposedClaimId,
+					reservedAt: Date.now()
+				});
+				return {
+					claimed: true,
+					claimId: proposedClaimId
+				};
+			}
+			return {
+				claimed: true,
+				claimId: existing.claimId
+			};
+		});
 	}
-	/** Publish a derived index only while its owning run is not expired. */
-	async putOwned(runId, key, value) {
+	async publish(hookId, serializedHook, owner, claimId) {
+		if (!await runIsActive(this.env, owner.runId)) {
+			await this.releaseBatch([{
+				hookId,
+				owner
+			}], Date.now(), true);
+			return { stored: false };
+		}
 		return await this.ctx.storage.transaction(async (txn) => {
-			if (await txn.get(`expired:${runId}`) !== void 0) return { stored: false };
-			await txn.put(key, value);
+			const record = recordKey$1(hookId);
+			const claim = claimKey$1(hookId);
+			const runFence = shardRunFenceKey(owner.runId);
+			const values = await txn.get([
+				record,
+				claim,
+				runFence
+			]);
+			if (values.has(runFence)) {
+				const existingClaim = values.get(claim);
+				if (existingClaim && sameOwner(existingClaim.owner, owner)) await txn.delete(claim);
+				return { stored: false };
+			}
+			const indexed = values.get(record);
+			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook id ${hookId} is owned by another hook`);
+			const existingClaim = values.get(claim);
+			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook id ${hookId} is reserved by another hook`);
+			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook id ${hookId} has no active reservation`);
+			await txn.put(record, serializedHook);
+			if (existingClaim !== void 0) await txn.delete(claim);
 			return { stored: true };
 		});
 	}
-	async delete(key) {
-		await this.ctx.storage.delete(key);
+	async releaseClaim(hookId, owner, claimId) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = claimKey$1(hookId);
+			const claim = await txn.get(key);
+			if (claim && sameOwner(claim.owner, owner) && claim.claimId === claimId) await txn.delete(key);
+		});
 	}
-	async list(options) {
-		const prefix = options?.prefix ?? "";
-		const limit = options?.limit ?? 1e3;
-		const entries = await this.ctx.storage.list({
-			prefix,
-			...options?.reverse ? {
-				reverse: true,
-				end: options.cursor
-			} : { startAfter: options?.cursor },
-			limit: limit + 1
+	async releaseBatch(hooks, fencedAt, runFenced) {
+		if (hooks.length > MAX_RELEASE_BATCH$1) throw new Error("Hook id release batch is too large");
+		if (hooks.length === 0) return { deleted: 0 };
+		return await this.ctx.storage.transaction(async (txn) => {
+			const keys = hooks.flatMap(({ hookId }) => [recordKey$1(hookId), claimKey$1(hookId)]);
+			const values = await txn.get(keys);
+			const deletes = [];
+			for (const { hookId, owner } of hooks) {
+				const record = recordKey$1(hookId);
+				const claim = claimKey$1(hookId);
+				const indexed = values.get(record);
+				const existingClaim = values.get(claim);
+				if (indexed !== void 0 && sameOwner(ownerFromSerializedHook(indexed), owner)) deletes.push(record);
+				if (existingClaim !== void 0 && sameOwner(existingClaim.owner, owner)) deletes.push(claim);
+			}
+			if (runFenced) await txn.put(shardRunFenceKey(hooks[0].owner.runId), fencedAt);
+			return { deleted: deletes.length === 0 ? 0 : await txn.delete(deletes) };
 		});
-		const names = Array.from(entries.keys());
-		const page = names.slice(0, limit);
-		const listComplete = names.length <= limit;
-		return {
-			keys: page.map((name) => ({ name })),
-			list_complete: listComplete,
-			cursor: listComplete ? void 0 : page.at(-1)
-		};
 	}
-	async reserveHookToken(token, owner) {
-		return this.ctx.storage.transaction(async (txn) => {
-			const indexedHook = await txn.get(`hook:${token}`);
-			if (indexedHook !== void 0) return {
+};
+//#endregion
+//#region src/worker/durable-objects/HookTokenDO.ts
+const MAX_RELEASE_BATCH = 64;
+function recordKey(token) {
+	return indexKey("hook", token);
+}
+function claimKey(token) {
+	return indexKey("claim", token);
+}
+/** Token-ownership shard. A token hashes to exactly one shard and transaction domain. */
+var HookTokenDO = class extends DurableObject {
+	async get(token) {
+		const raw = await this.ctx.storage.get(recordKey(token));
+		if (!raw) return null;
+		const owner = ownerFromSerializedHook(raw);
+		return await runIsActive(this.env, owner.runId) ? raw : null;
+	}
+	async reserve(token, owner, proposedClaimId) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey(token);
+			const claim = claimKey(token);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0) return {
 				claimed: false,
-				holder: ownerFromHook(indexedHook)
+				holder: ownerFromSerializedHook(indexed)
 			};
-			const claimKey = `hookclaim:${token}`;
-			const claim = await txn.get(claimKey);
-			if (claim !== void 0 && !sameOwner(claim.owner, owner)) return {
+			const existing = values.get(claim);
+			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
 				claimed: false,
-				holder: claim.owner
+				holder: existing.owner
+			};
+			if (existing === void 0) {
+				await txn.put(claim, {
+					owner,
+					claimId: proposedClaimId,
+					reservedAt: Date.now()
+				});
+				return {
+					claimed: true,
+					claimId: proposedClaimId
+				};
+			}
+			return {
+				claimed: true,
+				claimId: existing.claimId
 			};
-			await txn.put(claimKey, {
-				owner,
-				reservedAt: Date.now()
-			});
-			return { claimed: true };
 		});
 	}
-	async finalizeHookIndexes(token, hookId, serializedHook, owner) {
-		await this.ctx.storage.transaction(async (txn) => {
-			if (await txn.get(`expired:${owner.runId}`) !== void 0) {
-				const claim = await txn.get(`hookclaim:${token}`);
-				if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(`hookclaim:${token}`);
-				return;
+	async finalize(token, serializedHook, owner, claimId) {
+		if (!await runIsActive(this.env, owner.runId)) {
+			await this.releaseBatch([{
+				token,
+				owner
+			}], Date.now(), true);
+			return { stored: false };
+		}
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey(token);
+			const claim = claimKey(token);
+			const runFence = shardRunFenceKey(owner.runId);
+			const values = await txn.get([
+				record,
+				claim,
+				runFence
+			]);
+			if (values.has(runFence)) {
+				const existingClaim = values.get(claim);
+				if (existingClaim && sameOwner(existingClaim.owner, owner)) await txn.delete(claim);
+				return { stored: false };
 			}
-			const indexedHook = await txn.get(`hook:${token}`);
-			if (indexedHook !== void 0 && !sameOwner(ownerFromHook(indexedHook), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
-			const claim = await txn.get(`hookclaim:${token}`);
-			if (claim !== void 0 && !sameOwner(claim.owner, owner)) throw new Error(`Hook token ${token} is reserved by another hook`);
-			await txn.put(`hook:${token}`, serializedHook);
-			await txn.put(`hookid:${hookId}`, serializedHook);
-			if (claim !== void 0) await txn.delete(`hookclaim:${token}`);
+			const indexed = values.get(record);
+			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
+			const existingClaim = values.get(claim);
+			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook token ${token} is reserved by another hook`);
+			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook token ${token} has no active reservation`);
+			await txn.put(record, serializedHook);
+			if (existingClaim !== void 0) await txn.delete(claim);
+			return { stored: true };
 		});
 	}
-	async releaseHookToken(token, owner) {
+	async releaseClaim(token, owner, claimId) {
 		await this.ctx.storage.transaction(async (txn) => {
-			const key = `hookclaim:${token}`;
+			const key = claimKey(token);
 			const claim = await txn.get(key);
-			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(key);
+			if (claim && sameOwner(claim.owner, owner) && claim.claimId === claimId) await txn.delete(key);
 		});
 	}
-	async deleteHookIndexes(token, hookId, owner) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const tokenKey = `hook:${token}`;
-			const idKey = `hookid:${hookId}`;
-			const claimKey = `hookclaim:${token}`;
-			const [byToken, byId, claim] = await Promise.all([
-				txn.get(tokenKey),
-				txn.get(idKey),
-				txn.get(claimKey)
-			]);
-			if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) await txn.delete(tokenKey);
-			if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) await txn.delete(idKey);
-			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(claimKey);
-		});
-	}
-	/**
-	* Fence a run and remove all of its known derived indexes atomically.
-	* Once the fence exists, putOwned() and hook finalization cannot resurrect
-	* entries from a delayed request.
-	*/
-	async expireRun(request) {
+	async releaseBatch(hooks, fencedAt, runFenced) {
+		if (hooks.length > MAX_RELEASE_BATCH) throw new Error("Hook token release batch is too large");
+		if (hooks.length === 0) return { deleted: 0 };
 		return await this.ctx.storage.transaction(async (txn) => {
-			await txn.put(`expired:${request.runId}`, request.expiredAt);
-			let deleted = 0;
-			for (const key of new Set(request.keys)) if (await txn.delete(key)) deleted++;
-			for (const hook of request.hooks) {
-				const owner = {
-					runId: request.runId,
-					hookId: hook.hookId
-				};
-				const tokenKey = `hook:${hook.token}`;
-				const idKey = `hookid:${hook.hookId}`;
-				const claimKey = `hookclaim:${hook.token}`;
-				const [byToken, byId, claim] = await Promise.all([
-					txn.get(tokenKey),
-					txn.get(idKey),
-					txn.get(claimKey)
-				]);
-				if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) {
-					if (await txn.delete(tokenKey)) deleted++;
-				}
-				if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) {
-					if (await txn.delete(idKey)) deleted++;
-				}
-				if (claim !== void 0 && sameOwner(claim.owner, owner)) {
-					if (await txn.delete(claimKey)) deleted++;
-				}
+			const keys = hooks.flatMap(({ token }) => [recordKey(token), claimKey(token)]);
+			const values = await txn.get(keys);
+			const deletes = [];
+			for (const { token, owner } of hooks) {
+				const record = recordKey(token);
+				const claim = claimKey(token);
+				const indexed = values.get(record);
+				const existingClaim = values.get(claim);
+				if (indexed !== void 0 && sameOwner(ownerFromSerializedHook(indexed), owner)) deletes.push(record);
+				if (existingClaim !== void 0 && sameOwner(existingClaim.owner, owner)) deletes.push(claim);
 			}
-			return { deleted };
+			if (runFenced) await txn.put(shardRunFenceKey(hooks[0].owner.runId), fencedAt);
+			return { deleted: deletes.length === 0 ? 0 : await txn.delete(deletes) };
 		});
 	}
 };
@@ -471,21 +1005,61 @@ const DEFAULT_DELIVERY_TIMEOUT_MS = 3e5;
 const INFLIGHT_GRACE_MS = 3e4;
 /** Move overdue alarms to a new timestamp so celld observes a fresh edge. */
 const MIN_ALARM_DELAY_MS = 1;
+/** Bound expiry recovery so one alarm cannot monopolize the cell. */
+const EXPIRED_INFLIGHT_BATCH = 128;
+const STORAGE_BATCH_SIZE$2 = 128;
+const EXPIRE_RUN_REFERENCE_BATCH = 64;
+const PURGE_DEAD_LETTER_BATCH = 128;
+const INFLIGHT_DEADLINE_PREFIX = "inflight-deadline:";
 function pad(ms) {
 	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
 }
 function dueKey(atMs, messageId) {
 	return `due:${pad(atMs)}:${messageId}`;
 }
+function inflightKey(deadlineMs, messageId) {
+	return `${INFLIGHT_DEADLINE_PREFIX}${pad(deadlineMs)}:${messageId}`;
+}
+function deadlineFromInflightKey(key) {
+	return Number.parseInt(key.slice(18, 31), 10);
+}
 function runReferenceKey(runId, messageId) {
 	return `run:${runId}:${messageId}`;
 }
 function expiredRunKey(runId) {
 	return `expired-run:${runId}`;
 }
+function boundedLimit$1(value, fallback, maximum) {
+	if (value === void 0 || !Number.isFinite(value)) return fallback;
+	return Math.max(1, Math.min(maximum, Math.floor(value)));
+}
+async function getMany$1(storage, keys) {
+	const result = /* @__PURE__ */ new Map();
+	for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$2) {
+		const page = await storage.get(keys.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+		for (const [key, value] of page) result.set(key, value);
+	}
+	return result;
+}
+async function putMany(storage, entries) {
+	const all = Array.from(entries);
+	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE$2) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE$2)));
+}
+async function deleteMany$1(storage, keys) {
+	let deleted = 0;
+	const unique = Array.from(new Set(keys));
+	for (let offset = 0; offset < unique.length; offset += STORAGE_BATCH_SIZE$2) deleted += await storage.delete(unique.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+	return deleted;
+}
 function backoffSeconds(attempt) {
 	return Math.min(60, 2 ** attempt);
 }
+async function cancelUnusedResponseBody(response) {
+	try {
+		await response.body?.cancel();
+	} catch {}
+}
+const MAX_QUEUE_INFLIGHT = 128;
 var QueueDO = class extends DurableObject {
 	#now() {
 		const clock = this.env?.clock;
@@ -500,7 +1074,13 @@ var QueueDO = class extends DurableObject {
 		const parsed = raw ? Number.parseInt(raw, 10) : NaN;
 		return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 	}
+	#maxInflight() {
+		const configured = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		if (configured > MAX_QUEUE_INFLIGHT) throw new Error(`QUEUE_MAX_INFLIGHT must be at most ${MAX_QUEUE_INFLIGHT}`);
+		return configured;
+	}
 	async enqueue(request) {
+		this.#maxInflight();
 		const storage = this.ctx.storage;
 		const now = this.#now();
 		return await storage.transaction(async (txn) => {
@@ -575,7 +1155,7 @@ var QueueDO = class extends DurableObject {
 		if (typeof this.ctx.blockConcurrencyWhile === "function") await this.ctx.blockConcurrencyWhile(attempt);
 		else await attempt();
 		if (failure !== null) throw failure;
-		for (const row of claimed) this.ctx.waitUntil(this.#deliver(row));
+		for (const claim of claimed) this.ctx.waitUntil(this.#deliver(claim));
 	}
 	/**
 	* Storage-only: recover lost inflight claims, claim due messages up to the
@@ -584,24 +1164,38 @@ var QueueDO = class extends DurableObject {
 	async #claimPhase() {
 		const storage = this.ctx.storage;
 		const now = this.#now();
-		const maxInflight = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		const maxInflight = this.#maxInflight();
 		return await storage.transaction(async (txn) => {
-			const inflight = await txn.list({ prefix: "inflight:" });
-			let inflightCount = 0;
-			for (const [key, deadline] of inflight) if (deadline <= now) {
-				const messageId = key.slice(9);
-				await txn.delete(key);
-				const row = await txn.get(`msg:${messageId}`);
+			const expiredPage = await txn.list({
+				prefix: INFLIGHT_DEADLINE_PREFIX,
+				end: `${INFLIGHT_DEADLINE_PREFIX}${pad(now + 1)}`,
+				limit: 129
+			});
+			const expired = Array.from(expiredPage.entries()).slice(0, EXPIRED_INFLIGHT_BATCH);
+			const expiredRows = await getMany$1(txn, expired.map(([, messageId]) => `msg:${messageId}`));
+			await deleteMany$1(txn, expired.map(([key]) => key));
+			const recoveryWrites = [];
+			for (const [, messageId] of expired) {
+				const row = expiredRows.get(`msg:${messageId}`);
 				if (row) {
 					const scheduleKey = dueKey(now, messageId);
-					await txn.put(scheduleKey, messageId);
-					if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+					recoveryWrites.push([scheduleKey, messageId]);
+					if (row.runId) recoveryWrites.push([runReferenceKey(row.runId, row.messageId), {
 						messageId: row.messageId,
 						dueKey: scheduleKey,
 						idempotencyKey: row.idempotencyKey
-					});
+					}]);
 				}
-			} else inflightCount++;
+			}
+			await putMany(txn, recoveryWrites);
+			if (expiredPage.size > EXPIRED_INFLIGHT_BATCH) {
+				await txn.setAlarm(now + MIN_ALARM_DELAY_MS);
+				return [];
+			}
+			const inflightCount = (await txn.list({
+				prefix: INFLIGHT_DEADLINE_PREFIX,
+				limit: maxInflight
+			})).size;
 			const rows = [];
 			if (inflightCount < maxInflight) {
 				const due = await txn.list({
@@ -610,19 +1204,31 @@ var QueueDO = class extends DurableObject {
 					limit: maxInflight - inflightCount
 				});
 				const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
-				for (const [key, messageId] of due) {
-					await txn.delete(key);
-					const row = await txn.get(`msg:${messageId}`);
+				const dueRows = await getMany$1(txn, Array.from(due.values(), (messageId) => `msg:${messageId}`));
+				await deleteMany$1(txn, Array.from(due.keys()));
+				const claimWrites = [];
+				for (const [, messageId] of due) {
+					const row = dueRows.get(`msg:${messageId}`);
 					if (!row) continue;
-					await txn.put(`inflight:${messageId}`, now + timeoutMs + INFLIGHT_GRACE_MS);
-					rows.push(row);
+					const claimKey = inflightKey(now + timeoutMs + INFLIGHT_GRACE_MS, messageId);
+					claimWrites.push([claimKey, messageId]);
+					if (row.runId) claimWrites.push([runReferenceKey(row.runId, row.messageId), {
+						messageId: row.messageId,
+						inflightKey: claimKey,
+						idempotencyKey: row.idempotencyKey
+					}]);
+					rows.push({
+						row,
+						inflightKey: claimKey
+					});
 				}
+				await putMany(txn, claimWrites);
 			}
 			await this.#scheduleNextAlarm(txn, now);
 			return rows;
 		});
 	}
-	async #deliver(row) {
+	async #deliver({ row, inflightKey: claimKey }) {
 		const storage = this.ctx.storage;
 		const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
 		const callbackSecret = this.env?.WORKFLOW_CALLBACK_SECRET;
@@ -646,8 +1252,10 @@ var QueueDO = class extends DurableObject {
 			transportError = error;
 		}
 		const now = this.#now();
-		if (response?.ok) await this.#ack(row);
-		else if (response && response.status === 503) {
+		if (response?.ok) {
+			await cancelUnusedResponseBody(response);
+			await this.#ack(row, claimKey);
+		} else if (response && response.status === 503) {
 			let timeoutSeconds;
 			try {
 				timeoutSeconds = (await response.json())?.timeoutSeconds;
@@ -655,9 +1263,9 @@ var QueueDO = class extends DurableObject {
 				timeoutSeconds = void 0;
 			}
 			if (typeof timeoutSeconds === "number") await storage.transaction(async (txn) => {
+				if (!await txn.delete(claimKey)) return;
 				if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
 					await txn.delete(`msg:${row.messageId}`);
-					await txn.delete(`inflight:${row.messageId}`);
 					await txn.delete(runReferenceKey(row.runId, row.messageId));
 					if (row.idempotencyKey) {
 						const dedupKey = `key:${row.idempotencyKey}`;
@@ -666,7 +1274,6 @@ var QueueDO = class extends DurableObject {
 					await this.#scheduleNextAlarm(txn, now);
 					return;
 				}
-				await txn.delete(`inflight:${row.messageId}`);
 				const scheduleKey = dueKey(now + timeoutSeconds * 1e3, row.messageId);
 				await txn.put(scheduleKey, row.messageId);
 				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
@@ -676,17 +1283,20 @@ var QueueDO = class extends DurableObject {
 				});
 				await this.#scheduleNextAlarm(txn, now);
 			});
-			else await this.#retry(row, "HTTP 503");
-		} else if (response && PERMANENT_STATUSES.has(response.status)) await this.#ack(row);
-		else {
+			else await this.#retry(row, claimKey, "HTTP 503");
+		} else if (response && PERMANENT_STATUSES.has(response.status)) {
+			await cancelUnusedResponseBody(response);
+			await this.#ack(row, claimKey);
+		} else {
 			const reason = response ? `HTTP ${response.status}` : `transport error: ${String(transportError)}`;
-			await this.#retry(row, reason);
+			if (response) await cancelUnusedResponseBody(response);
+			await this.#retry(row, claimKey, reason);
 		}
 	}
-	async #ack(row) {
+	async #ack(row, claimKey) {
 		await this.ctx.storage.transaction(async (txn) => {
+			if (!await txn.delete(claimKey)) return;
 			await txn.delete(`msg:${row.messageId}`);
-			await txn.delete(`inflight:${row.messageId}`);
 			if (row.idempotencyKey) {
 				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
 			}
@@ -694,15 +1304,15 @@ var QueueDO = class extends DurableObject {
 			await this.#scheduleNextAlarm(txn, this.#now());
 		});
 	}
-	async #retry(row, reason) {
+	async #retry(row, claimKey, reason) {
 		const storage = this.ctx.storage;
 		const now = this.#now();
 		const maxAttempts = this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
 		const attempt = row.attempt + 1;
 		await storage.transaction(async (txn) => {
+			if (!await txn.delete(claimKey)) return;
 			if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
 				await txn.delete(`msg:${row.messageId}`);
-				await txn.delete(`inflight:${row.messageId}`);
 				await txn.delete(runReferenceKey(row.runId, row.messageId));
 				if (row.idempotencyKey) {
 					const dedupKey = `key:${row.idempotencyKey}`;
@@ -711,7 +1321,6 @@ var QueueDO = class extends DurableObject {
 				await this.#scheduleNextAlarm(txn, now);
 				return;
 			}
-			await txn.delete(`inflight:${row.messageId}`);
 			if (attempt >= maxAttempts) {
 				const dead = {
 					...row,
@@ -771,8 +1380,14 @@ var QueueDO = class extends DurableObject {
 			limit: 1
 		});
 		for (const key of due.keys()) next = Number.parseInt(key.slice(4, 17), 10);
-		const inflight = await storage.list({ prefix: "inflight:" });
-		for (const deadline of inflight.values()) if (next === null || deadline < next) next = deadline;
+		const inflight = await storage.list({
+			prefix: INFLIGHT_DEADLINE_PREFIX,
+			limit: 1
+		});
+		for (const key of inflight.keys()) {
+			const deadline = deadlineFromInflightKey(key);
+			if (next === null || deadline < next) next = deadline;
+		}
 		if (next !== null) await storage.setAlarm(next <= now ? now + MIN_ALARM_DELAY_MS : next);
 		else await storage.deleteAlarm();
 	}
@@ -780,7 +1395,7 @@ var QueueDO = class extends DurableObject {
 		const storage = this.ctx.storage;
 		const [due, inflight, dlq, alarmAt] = await Promise.all([
 			storage.list({ prefix: "due:" }),
-			storage.list({ prefix: "inflight:" }),
+			storage.list({ prefix: INFLIGHT_DEADLINE_PREFIX }),
 			storage.list({ prefix: "dlq:" }),
 			storage.getAlarm()
 		]);
@@ -845,13 +1460,16 @@ var QueueDO = class extends DurableObject {
 	}
 	async purgeDeadLetters() {
 		return await this.ctx.storage.transaction(async (txn) => {
-			const dlq = await txn.list({ prefix: "dlq:" });
-			for (const [key, value] of dlq) {
-				await txn.delete(key);
-				const dead = value;
-				if (dead.runId) await txn.delete(runReferenceKey(dead.runId, dead.messageId));
-			}
-			return { purged: dlq.size };
+			const entries = await txn.list({
+				prefix: "dlq:",
+				limit: 129
+			});
+			const page = Array.from(entries).slice(0, PURGE_DEAD_LETTER_BATCH);
+			await deleteMany$1(txn, page.flatMap(([key, dead]) => [key, ...dead.runId ? [runReferenceKey(dead.runId, dead.messageId)] : []]));
+			return {
+				purged: page.length,
+				hasMore: entries.size > PURGE_DEAD_LETTER_BATCH
+			};
 		});
 	}
 	/**
@@ -863,140 +1481,384 @@ var QueueDO = class extends DurableObject {
 		return { alarmAt: await this.ctx.storage.getAlarm() };
 	}
 	/** Fence a run and purge every live, inflight, and dead-letter message it owns. */
-	async expireRun(runId, expiredAt) {
-		return { deleted: await this.ctx.storage.transaction(async (txn) => {
+	async expireRun(runId, expiredAt, options) {
+		const storage = this.ctx.storage;
+		const limit = boundedLimit$1(options?.limit, EXPIRE_RUN_REFERENCE_BATCH, EXPIRE_RUN_REFERENCE_BATCH);
+		return await storage.transaction(async (txn) => {
 			const existing = await txn.get(expiredRunKey(runId));
-			const references = await txn.list({ prefix: `run:${runId}:` });
+			const references = await txn.list({
+				prefix: `run:${runId}:`,
+				limit: limit + 1
+			});
+			const page = Array.from(references).slice(0, limit);
+			const dedupHolders = await getMany$1(txn, page.flatMap(([, reference]) => reference.idempotencyKey ? [`key:${reference.idempotencyKey}`] : []));
+			const keys = [];
 			let count = existing?.deleted ?? 0;
-			for (const [key, reference] of references) {
-				await txn.delete(`msg:${reference.messageId}`);
-				await txn.delete(`inflight:${reference.messageId}`);
-				if (reference.dueKey) await txn.delete(reference.dueKey);
-				if (reference.dlqKey) await txn.delete(reference.dlqKey);
+			for (const [key, reference] of page) {
+				keys.push(`msg:${reference.messageId}`, key);
+				if (reference.inflightKey) keys.push(reference.inflightKey);
+				if (reference.dueKey) keys.push(reference.dueKey);
+				if (reference.dlqKey) keys.push(reference.dlqKey);
 				if (reference.idempotencyKey) {
 					const dedupKey = `key:${reference.idempotencyKey}`;
-					if (await txn.get(dedupKey) === reference.messageId) await txn.delete(dedupKey);
+					if (dedupHolders.get(dedupKey) === reference.messageId) keys.push(dedupKey);
 				}
-				await txn.delete(key);
 				count++;
 			}
+			await deleteMany$1(txn, keys);
 			await txn.put(expiredRunKey(runId), {
 				expiredAt,
 				deleted: count
 			});
 			await this.#scheduleNextAlarm(txn, this.#now());
-			return count;
-		}) };
+			return {
+				deleted: count,
+				done: references.size <= limit
+			};
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/RunCatalogDO.ts
+const MAX_INDEX_LIST_SIZE = 1001;
+/** One of a fixed set of run-catalog shards, routed by the stable run ID hash. */
+var RunCatalogDO = class extends DurableObject {
+	async upsertRun(runId, keys, serializedMetadata) {
+		if (keys.length !== 2) throw new Error("Run catalog commit requires exactly two keys");
+		return await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(`expired:${runId}`) !== void 0) return { stored: false };
+			await txn.put(Object.fromEntries(keys.map((key) => [key, serializedMetadata])));
+			return { stored: true };
+		});
+	}
+	async list(options = {}) {
+		const suppliedLimit = options.limit;
+		const limit = Math.min(MAX_INDEX_LIST_SIZE, Math.max(1, typeof suppliedLimit === "number" && Number.isFinite(suppliedLimit) ? Math.floor(suppliedLimit) : MAX_INDEX_LIST_SIZE));
+		const entries = await this.ctx.storage.list({
+			prefix: options.prefix ?? "",
+			...options.reverse ? {
+				reverse: true,
+				end: options.cursor
+			} : { startAfter: options.cursor },
+			limit: limit + 1
+		});
+		const page = Array.from(entries).slice(0, limit);
+		const listComplete = entries.size <= limit;
+		return {
+			keys: page.map(([name, value]) => ({
+				name,
+				value
+			})),
+			list_complete: listComplete,
+			cursor: listComplete ? void 0 : page.at(-1)?.[0]
+		};
+	}
+	async expireRun(runId, keys, expiredAt) {
+		if (keys.length !== 2) throw new Error("Run catalog expiry requires exactly two keys");
+		return await this.ctx.storage.transaction(async (txn) => {
+			await txn.put(`expired:${runId}`, expiredAt);
+			return { deleted: await txn.delete(keys) };
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/RunFenceDO.ts
+/** Per-run lifecycle fence used by hook shards without a global lookup cell. */
+var RunFenceDO = class extends DurableObject {
+	async getStatus() {
+		return (await this.ctx.storage.get("fence"))?.status ?? "active";
+	}
+	async fenceTerminal(at) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get("fence");
+			if (current) return current.status;
+			await txn.put("fence", {
+				status: "terminal",
+				at
+			});
+			return "terminal";
+		});
+	}
+	async fenceExpired(at) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get("fence");
+			if (current?.status === "expired") return current.status;
+			await txn.put("fence", {
+				status: "expired",
+				at
+			});
+			return "expired";
+		});
 	}
 };
 //#endregion
 //#region src/worker/durable-objects/StreamDO.ts
 const META_KEY = "meta";
 const CHUNK_KEY_PREFIX = "chunk:";
+const CHUNK_SIZE_KEY_PREFIX = "chunk-size:";
 /** Registry keys used when this DO instance acts as a per-run stream index. */
 const STREAM_REGISTRY_PREFIX = "stream:";
 const REGISTRY_OWNER_KEY = "registry:owner";
 const REGISTRY_EXPIRED_KEY = "registry:expired";
-/**
-* Zero-pad chunk indexes so `storage.list({ prefix })` returns chunks in
-* write order. 12 digits comfortably exceeds any realistic chunk count.
-*/
+/** Each chunk occupies a payload key and a size key; one delete accepts at most 128 keys. */
+const DEFAULT_EXPIRE_CHUNK_LIMIT = 64;
+const MAX_EXPIRE_CHUNK_LIMIT = 64;
+/** Bound storage deletion work as well as item count; one oversized chunk still makes progress. */
+const DEFAULT_EXPIRE_BYTE_LIMIT = 16777216;
+const MAX_EXPIRE_BYTE_LIMIT = DEFAULT_EXPIRE_BYTE_LIMIT;
+function boundedLimit(value, fallback, maximum) {
+	if (value === void 0 || !Number.isFinite(value)) return fallback;
+	return Math.max(1, Math.min(maximum, Math.floor(value)));
+}
+function emptyMeta() {
+	return {
+		count: 0,
+		state: "open"
+	};
+}
+function validateMeta(meta) {
+	if (!Number.isSafeInteger(meta.count) || meta.count < 0 || meta.count > 2147483647 || ![
+		"open",
+		"closed",
+		"errored",
+		"expired"
+	].includes(meta.state)) throw new Error("Invalid persisted stream metadata");
+	if (meta.state === "errored" && !meta.error) throw new Error("Invalid persisted stream error metadata");
+	return meta;
+}
+/** Zero-padding keeps storage.list() results in stream offset order. */
 function chunkKey(index) {
 	return `${CHUNK_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
 }
+function chunkSizeKey(index) {
+	return `${CHUNK_SIZE_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
+}
+function indexFromChunkSizeKey(key) {
+	const suffix = key.slice(11);
+	const index = Number(suffix);
+	if (!/^\d{12}$/.test(suffix) || !Number.isSafeInteger(index) || index < 0) throw new Error(`Invalid persisted stream chunk size key "${key}"`);
+	return index;
+}
+function validateChunkSize(size, index) {
+	if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > 1048576) throw new Error(`Invalid persisted stream chunk size at index ${index}`);
+	return size;
+}
+function compactChunk(chunk) {
+	return chunk.byteOffset === 0 && chunk.byteLength === chunk.buffer.byteLength ? chunk : new Uint8Array(chunk);
+}
+function abortReason(signal) {
+	return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
 /**
 * Durable Object backing workflow streams.
 *
-* Two roles, selected by the DO name:
-* - `stream:<name>`: chunk storage for a single stream. A monotonic
-*   per-stream counter (maintained transactionally inside the DO) assigns
-*   each chunk its index; one chunk per storage key.
-* - `run-streams:<runId>`: registry of stream names owned by a run,
-*   powering `listStreamsByRunId`.
+* Stream cells persist binary chunks under monotonic offset keys. Public
+* reads are bounded long polls, and writes append a bounded ordered batch in
+* one storage transaction. Per-run registry cells retain their existing role.
 */
 var StreamDO = class extends DurableObject {
+	meta;
+	metaLoad;
+	mutationTail = Promise.resolve();
+	changeVersion = 0;
+	waiters = /* @__PURE__ */ new Set();
 	async getMeta() {
-		return await this.ctx.storage.get(META_KEY) ?? {
-			count: 0,
-			closed: false
-		};
+		if (this.meta) return this.meta;
+		this.metaLoad ??= this.ctx.storage.get(META_KEY).then((meta) => {
+			const loaded = meta ? validateMeta(meta) : emptyMeta();
+			this.meta = loaded;
+			return loaded;
+		});
+		try {
+			return await this.metaLoad;
+		} catch (error) {
+			this.metaLoad = void 0;
+			throw error;
+		}
 	}
 	assertOwner(meta, runId) {
-		if (meta.expiredAt !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
+		if (!runId) throw new Error("Stream runId is required");
 		if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
 	}
-	/**
-	* Append a chunk. The index is allocated inside the transaction, so
-	* concurrent writers can never collide or skip.
-	*/
-	async writeChunk(runId, data) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
+	assertWritable(meta, runId) {
+		this.assertOwner(meta, runId);
+		if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+		if (meta.state === "closed") throw new Error("Cannot write to a closed stream");
+		if (meta.state === "errored") throw new Error("Cannot write to an errored stream");
+	}
+	runMutation(operation) {
+		const result = this.mutationTail.then(operation, operation);
+		this.mutationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	wakeReaders() {
+		this.changeVersion += 1;
+		for (const waiter of Array.from(this.waiters)) waiter.resolve("change");
+	}
+	waitForChange(observedVersion, waitMs, signal) {
+		if (signal?.aborted) return Promise.reject(abortReason(signal));
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const waiter = {
+				timer: setTimeout(() => finish("timeout"), waitMs),
+				signal,
+				resolve: (reason) => finish(reason)
 			};
-			this.assertOwner(meta, runId);
-			if (meta.closed) throw new Error("Cannot write to a closed stream");
-			const index = meta.count;
-			await txn.put(chunkKey(index), data);
-			await txn.put(META_KEY, {
-				count: index + 1,
-				closed: false,
-				ownerRunId: runId
+			const cleanup = () => {
+				clearTimeout(waiter.timer);
+				this.waiters.delete(waiter);
+				if (waiter.signal && waiter.onAbort) waiter.signal.removeEventListener("abort", waiter.onAbort);
+			};
+			const finish = (reason) => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				resolve(reason);
+			};
+			waiter.onAbort = () => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				reject(abortReason(signal));
+			};
+			this.waiters.add(waiter);
+			signal?.addEventListener("abort", waiter.onAbort, { once: true });
+			if (this.changeVersion !== observedVersion) finish("change");
+		});
+	}
+	async readSnapshot(request, timedOut) {
+		const meta = await this.getMeta();
+		this.assertOwner(meta, request.runId);
+		const available = meta.state === "expired" ? 0 : Math.max(0, Math.min(request.maxChunks, meta.count - request.startIndex));
+		const chunks = [];
+		if (available > 0) {
+			const indexes = Array.from({ length: available }, (_, offset) => request.startIndex + offset);
+			const sizeKeys = indexes.map(chunkSizeKey);
+			const storedSizes = await this.ctx.storage.get(sizeKeys);
+			const selectedIndexes = [];
+			const selectedSizes = [];
+			let bytes = 0;
+			for (const index of indexes) {
+				const size = validateChunkSize(storedSizes.get(chunkSizeKey(index)), index);
+				if (bytes + size > request.maxBytes) break;
+				selectedIndexes.push(index);
+				selectedSizes.push(size);
+				bytes += size;
+			}
+			const payloadKeys = selectedIndexes.map(chunkKey);
+			const storedChunks = await this.ctx.storage.get(payloadKeys);
+			for (let offset = 0; offset < payloadKeys.length; offset++) {
+				const chunk = storedChunks.get(payloadKeys[offset]);
+				if (!(chunk instanceof Uint8Array) || chunk.byteLength !== selectedSizes[offset]) throw new Error(`Invalid persisted stream chunk at index ${selectedIndexes[offset]}`);
+				chunks.push(chunk);
+			}
+		}
+		return {
+			startIndex: request.startIndex,
+			tailIndex: meta.count - 1,
+			chunks,
+			state: meta.state,
+			timedOut,
+			error: meta.error
+		};
+	}
+	/** Append one bounded binary batch with contiguous indexes. */
+	async writeChunks(runId, chunks) {
+		validateStreamWriteChunks(chunks);
+		const storedChunks = chunks.map(compactChunk);
+		return await this.runMutation(async () => {
+			const committed = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertWritable(meta, runId);
+				const startIndex = meta.count;
+				if (startIndex + chunks.length > 2147483647) throw new Error("Stream offset limit exceeded");
+				const nextMeta = {
+					count: startIndex + chunks.length,
+					state: "open",
+					ownerRunId: runId
+				};
+				const entries = { [META_KEY]: nextMeta };
+				for (let offset = 0; offset < storedChunks.length; offset++) {
+					const index = startIndex + offset;
+					entries[chunkKey(index)] = storedChunks[offset];
+					entries[chunkSizeKey(index)] = storedChunks[offset].byteLength;
+				}
+				await txn.put(entries);
+				return {
+					meta: nextMeta,
+					result: {
+						startIndex,
+						count: chunks.length,
+						tailIndex: nextMeta.count - 1
+					}
+				};
 			});
-			return index;
+			this.meta = committed.meta;
+			this.metaLoad = Promise.resolve(committed.meta);
+			this.wakeReaders();
+			return committed.result;
 		});
 	}
 	/**
-	* Close the stream (idempotent). Readers observe `done: true` once all
-	* previously written chunks have been consumed.
+	* Return available binary chunks and terminal metadata in one bounded
+	* operation, waiting at most waitMs when the requested offset is idle.
 	*/
+	async readChunks(request, signal) {
+		validateStreamReadRequest(request);
+		const observedVersion = this.changeVersion;
+		const immediate = await this.readSnapshot(request, false);
+		if (immediate.chunks.length > 0 || immediate.state !== "open" || request.waitMs === 0 || request.maxChunks === 0) return immediate;
+		const reason = await this.waitForChange(observedVersion, request.waitMs, signal);
+		return await this.readSnapshot(request, reason === "timeout");
+	}
+	/** Close idempotently; the first terminal state wins. */
 	async closeStream(runId) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
-			};
-			this.assertOwner(meta, runId);
-			await txn.put(META_KEY, {
-				...meta,
-				ownerRunId: runId,
-				closed: true
+		await this.runMutation(async () => {
+			const nextMeta = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+				if (meta.state !== "open") return meta;
+				const closed = {
+					...meta,
+					ownerRunId: runId,
+					state: "closed"
+				};
+				await txn.put(META_KEY, closed);
+				return closed;
 			});
+			this.meta = nextMeta;
+			this.metaLoad = Promise.resolve(nextMeta);
+			this.wakeReaders();
 		});
 	}
-	/**
-	* Read up to `limit` chunks starting at `startIndex` (0-based, inclusive).
-	*/
-	async getChunks(params) {
-		const meta = await this.getMeta();
-		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
-		const start = Math.max(0, params.startIndex);
-		const entries = await this.ctx.storage.list({
-			prefix: CHUNK_KEY_PREFIX,
-			start: chunkKey(start),
-			limit: params.limit
+	/** Persist a terminal stream failure and wake every pending reader. */
+	async failStream(runId, error) {
+		const normalized = normalizeStreamError(error);
+		await this.runMutation(async () => {
+			const nextMeta = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+				if (meta.state !== "open") return meta;
+				const failed = {
+					...meta,
+					ownerRunId: runId,
+					state: "errored",
+					error: normalized
+				};
+				await txn.put(META_KEY, failed);
+				return failed;
+			});
+			this.meta = nextMeta;
+			this.metaLoad = Promise.resolve(nextMeta);
+			this.wakeReaders();
 		});
-		return {
-			chunks: Array.from(entries.values()),
-			done: meta.closed,
-			tailIndex: meta.count - 1
-		};
 	}
-	/**
-	* Lightweight stream metadata: last chunk index and completion flag.
-	*/
-	async getInfo() {
-		const meta = await this.getMeta();
-		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
-		return {
-			tailIndex: meta.count - 1,
-			done: meta.closed
-		};
-	}
-	/**
-	* Register a stream name against this per-run registry instance.
-	*/
+	/** Register a stream name against this per-run registry instance. */
 	async registerStream(runId, name) {
 		await this.ctx.storage.transaction(async (txn) => {
 			if (await txn.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
@@ -1006,57 +1868,124 @@ var StreamDO = class extends DurableObject {
 			await txn.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
 		});
 	}
-	/**
-	* List stream names registered against this per-run registry instance.
-	*/
 	async listStreams() {
 		if (await this.ctx.storage.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error("Workflow run streams have expired");
 		const entries = await this.ctx.storage.list({ prefix: STREAM_REGISTRY_PREFIX });
 		return Array.from(entries.keys()).map((key) => key.slice(7));
 	}
 	/** Fence a run's registry before any stream cells are removed. */
-	async expireRegistry(runId, expiredAt) {
+	async expireRegistry(runId, expiredAt, options) {
+		const limit = boundedLimit(options?.limit, 16, 128);
 		return await this.ctx.storage.transaction(async (txn) => {
-			const owner = await txn.get(REGISTRY_OWNER_KEY);
+			const state = await txn.get([REGISTRY_OWNER_KEY, REGISTRY_EXPIRED_KEY]);
+			const owner = state.get(REGISTRY_OWNER_KEY);
 			if (owner !== void 0 && owner !== runId) throw new Error(`Stream registry is owned by workflow run "${owner}"`);
-			await txn.put(REGISTRY_OWNER_KEY, runId);
-			await txn.put(REGISTRY_EXPIRED_KEY, expiredAt);
-			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
+			const expiry = state.get(REGISTRY_EXPIRED_KEY);
+			await txn.put({
+				[REGISTRY_OWNER_KEY]: runId,
+				[REGISTRY_EXPIRED_KEY]: expiry ?? {
+					expiredAt,
+					deleted: 0
+				}
+			});
+			const entries = await txn.list({
+				prefix: STREAM_REGISTRY_PREFIX,
+				limit
+			});
 			return { streams: Array.from(entries.keys()).map((key) => key.slice(7)) };
 		});
 	}
-	/** Remove the registry payload after every referenced stream was fenced. */
-	async finalizeRegistry(runId) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const owner = await txn.get(REGISTRY_OWNER_KEY);
-			const expiredAt = await txn.get(REGISTRY_EXPIRED_KEY);
-			if (owner !== runId || expiredAt === void 0) throw new Error(`Stream registry for workflow run "${runId}" is not expired`);
-			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
-			for (const key of entries.keys()) await txn.delete(key);
-		});
-	}
-	/** Delete stream payload while leaving a small ownership tombstone. */
-	async expireStream(runId, expiredAt) {
+	/** Remove completed registry entries in a bounded, retry-safe batch. */
+	async finalizeRegistry(runId, streams) {
 		return await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
-			};
-			if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
-			const chunks = await txn.list({ prefix: CHUNK_KEY_PREFIX });
-			for (const key of chunks.keys()) await txn.delete(key);
-			await txn.put(META_KEY, {
-				count: 0,
-				closed: true,
-				ownerRunId: runId,
-				expiredAt
+			const state = await txn.get([REGISTRY_OWNER_KEY, REGISTRY_EXPIRED_KEY]);
+			const owner = state.get(REGISTRY_OWNER_KEY);
+			const expiry = state.get(REGISTRY_EXPIRED_KEY);
+			if (owner !== runId || expiry === void 0) throw new Error(`Stream registry for workflow run "${runId}" is not expired`);
+			const keys = Array.from(new Set(streams.map((name) => `${STREAM_REGISTRY_PREFIX}${name}`)));
+			const removed = keys.length === 0 ? 0 : await txn.delete(keys);
+			const deleted = expiry.deleted + removed;
+			await txn.put(REGISTRY_EXPIRED_KEY, {
+				...expiry,
+				deleted
 			});
 			return {
-				deleted: true,
-				chunks: chunks.size
+				deleted,
+				done: (await txn.list({
+					prefix: STREAM_REGISTRY_PREFIX,
+					limit: 1
+				})).size === 0
 			};
 		});
 	}
+	/**
+	* Fence the stream and delete one bounded page. Listing size keys avoids
+	* loading payloads, and the transaction makes a crash retry resume safely.
+	*/
+	async expireStream(runId, expiredAt, options) {
+		const limit = boundedLimit(options?.limit, DEFAULT_EXPIRE_CHUNK_LIMIT, MAX_EXPIRE_CHUNK_LIMIT);
+		const byteLimit = boundedLimit(options?.byteLimit, DEFAULT_EXPIRE_BYTE_LIMIT, MAX_EXPIRE_BYTE_LIMIT);
+		return await this.runMutation(async () => {
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				const firstFence = meta.state !== "expired";
+				if (meta.state === "expired" && meta.payloadDeleted) return {
+					meta,
+					result: {
+						deleted: false,
+						chunks: 0,
+						bytes: 0,
+						done: true
+					}
+				};
+				const candidates = await txn.list({
+					prefix: CHUNK_SIZE_KEY_PREFIX,
+					limit: limit + 1
+				});
+				const page = [];
+				let bytes = 0;
+				for (const [key, storedSize] of Array.from(candidates).slice(0, limit)) {
+					const index = indexFromChunkSizeKey(key);
+					const size = validateChunkSize(storedSize, index);
+					if (page.length > 0 && bytes + size > byteLimit) break;
+					page.push({
+						index,
+						size
+					});
+					bytes += size;
+				}
+				const keys = page.flatMap(({ index }) => [chunkKey(index), chunkSizeKey(index)]);
+				if (keys.length > 0) await txn.delete(keys);
+				const done = candidates.size === page.length;
+				const nextMeta = {
+					...meta,
+					count: done ? 0 : meta.count,
+					ownerRunId: runId,
+					state: "expired",
+					error: void 0,
+					expiredAt: meta.expiredAt ?? expiredAt,
+					expiredChunkCount: meta.expiredChunkCount ?? meta.count,
+					payloadDeleted: done
+				};
+				await txn.put(META_KEY, nextMeta);
+				return {
+					meta: nextMeta,
+					result: {
+						deleted: firstFence,
+						chunks: page.length,
+						bytes,
+						done
+					}
+				};
+			});
+			this.meta = result.meta;
+			this.metaLoad = Promise.resolve(result.meta);
+			this.wakeReaders();
+			return result.result;
+		});
+	}
 };
 //#endregion
 //#region src/apply-event.ts
@@ -1076,10 +2005,36 @@ const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
 * rejected as a duplicate instead of resurrecting the hook.
 */
 const HOOK_EVENT_MARKER_PREFIX = "hookevent:";
+/** Durable repair record for idempotent post-commit hook-index release. */
+const HOOK_RELEASE_MARKER_PREFIX = "hookreleased:";
+/** Exact ambiguous reservations canceled by a serialized RunDO resolution. */
+const HOOK_CLAIM_CANCELLATION_PREFIX = "hookclaimcancelled:";
 /** Workflow-authored attr_set correlation claims. */
 const ATTRIBUTE_EVENT_MARKER_PREFIX = "attrevent:";
 /** Durable lazy-hook resume claims, scoped by the containing run DO. */
 const HOOK_RESUME_CLAIM_PREFIX = "hookresume:";
+const STORAGE_BATCH_SIZE$1 = 128;
+const MAX_ENTITY_PAGE_SIZE = 1e3;
+async function getMany(store, keys) {
+	if (store.getMany) {
+		const result = /* @__PURE__ */ new Map();
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) {
+			const page = await store.getMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
+			for (const entry of page) result.set(...entry);
+		}
+		return result;
+	}
+	const values = await Promise.all(keys.map((key) => store.get(key)));
+	return new Map(keys.flatMap((key, index) => values[index] === void 0 ? [] : [[key, values[index]]]));
+}
+async function deleteMany(store, keys) {
+	if (store.deleteMany) {
+		let deleted = 0;
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) deleted += await store.deleteMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
+		return deleted;
+	}
+	return (await Promise.all(keys.map((key) => store.delete(key)))).filter(Boolean).length;
+}
 function failure(code, message, extra) {
 	return {
 		ok: false,
@@ -1088,6 +2043,9 @@ function failure(code, message, extra) {
 		...extra
 	};
 }
+function hookClaimCancellationKey(claimId) {
+	return `${HOOK_CLAIM_CANCELLATION_PREFIX}${encodeURIComponent(claimId)}`;
+}
 function readStringProp(value, key) {
 	if (value !== null && typeof value === "object") {
 		const prop = value[key];
@@ -1143,7 +2101,9 @@ function creationIndexKey(prefix, createdAt, id) {
 * requested ordering.
 */
 async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
-	const { limit, cursor, sortOrder = "asc" } = params;
+	const requestedLimit = Number.isFinite(params.limit) ? Math.floor(params.limit) : 1;
+	const limit = Math.min(MAX_ENTITY_PAGE_SIZE, Math.max(1, requestedLimit));
+	const { cursor, sortOrder = "asc" } = params;
 	const entries = await store.list(sortOrder === "desc" ? {
 		prefix: indexPrefix,
 		reverse: true,
@@ -1155,11 +2115,12 @@ async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
 		startAfter: cursor ? `${indexPrefix}${cursor}` : void 0
 	});
 	const page = Array.from(entries.entries()).slice(0, limit);
-	const data = [];
-	for (const [, id] of page) {
-		const item = await store.get(`${entityPrefix}${id}`);
-		if (item !== void 0) data.push(item);
-	}
+	const entityKeys = page.map(([, id]) => `${entityPrefix}${id}`);
+	const entities = await getMany(store, entityKeys);
+	const data = entityKeys.flatMap((key) => {
+		const item = entities.get(key);
+		return item === void 0 ? [] : [item];
+	});
 	const hasMore = entries.size > limit;
 	const lastKey = page.at(-1)?.[0];
 	return {
@@ -1170,22 +2131,26 @@ async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
 }
 /** Delete all hook entities for the run, returning the released tokens. */
 async function releaseAllHooks(store) {
+	if (store.deferTerminalCleanup) return [];
 	const hooks = await store.list({ prefix: HOOK_KEY_PREFIX });
 	const released = [];
+	const keys = [];
 	for (const hook of hooks.values()) {
-		await store.delete(`${HOOK_KEY_PREFIX}${hook.hookId}`);
-		await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+		keys.push(`${HOOK_KEY_PREFIX}${hook.hookId}`);
+		keys.push(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
 		released.push({
 			hookId: hook.hookId,
 			token: hook.token
 		});
 	}
+	await deleteMany(store, keys);
 	return released;
 }
 /** Delete all persisted waits once their owning run becomes terminal. */
 async function releaseAllWaits(store) {
+	if (store.deferTerminalCleanup) return;
 	const waits = await store.list({ prefix: WAIT_KEY_PREFIX });
-	for (const key of waits.keys()) await store.delete(key);
+	await deleteMany(store, Array.from(waits.keys()));
 }
 async function applyEvent(store, ctx) {
 	const { runId, data, now } = ctx;
@@ -1305,7 +2270,16 @@ async function applyEvent(store, ctx) {
 		}
 	}
 	if ((data.eventType === "hook_disposed" || data.eventType === "hook_received") && data.correlationId) {
-		if (!await store.get(`hook:${data.correlationId}`)) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+		if (!await store.get(`hook:${data.correlationId}`)) {
+			if (data.eventType === "hook_disposed") {
+				const released = await store.get(`${HOOK_RELEASE_MARKER_PREFIX}${data.correlationId}`);
+				if (released) return {
+					ok: true,
+					releasedHooks: [released]
+				};
+			}
+			return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+		}
 	}
 	if (!skipRunValidation && data.eventType !== "run_started" && !currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
 	switch (data.eventType) {
@@ -1641,6 +2615,7 @@ async function applyEvent(store, ctx) {
 			const holder = ctx.tokenHolder ?? null;
 			const markerKey = `${HOOK_EVENT_MARKER_PREFIX}${hookId}`;
 			const hookKey = `${HOOK_KEY_PREFIX}${hookId}`;
+			if (ctx.hookClaimId && await store.get(hookClaimCancellationKey(ctx.hookClaimId)) !== void 0) return failure("HOOK_CLAIM_CANCELLED", `Hook reservation for "${hookId}" was canceled before commit`);
 			if (holder && (holder.runId !== runId || holder.hookId !== hookId)) {
 				const event = buildEvent({
 					eventType: "hook_conflict",
@@ -1700,6 +2675,10 @@ async function applyEvent(store, ctx) {
 			if (!hook) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
 			await store.delete(hookKey);
 			await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+			await store.put(`${HOOK_RELEASE_MARKER_PREFIX}${hook.hookId}`, {
+				hookId: hook.hookId,
+				token: hook.token
+			});
 			const event = buildEvent({ ...data });
 			await putEvent(event);
 			return {
@@ -1817,8 +2796,8 @@ async function finalizeEventPage(store, outcome, params) {
 //#region src/retention.ts
 const CLEANUP_RECORD_KEY = "retention:cleanup";
 const TOMBSTONE_KEY = "retention:tombstone";
-const INDEX_MARKER_PREFIX = "retention:index:";
 const HOOK_MARKER_PREFIX = "retention:hook:";
+const TERMINAL_CLEANUP_KEY = "terminal:cleanup";
 function sortableTimestamp(date) {
 	return date.getTime().toString().padStart(13, "0");
 }
@@ -1828,12 +2807,6 @@ function workflowRunIndexKey(run) {
 function globalRunIndexKey(run) {
 	return `runall:${sortableTimestamp(run.createdAt)}:${run.runId}`;
 }
-function correlationIndexKey(correlationId, createdAt, eventId, runId) {
-	return `correlation:${encodeURIComponent(correlationId)}:${sortableTimestamp(createdAt)}:${eventId}:${runId}`;
-}
-function indexMarkerKey(indexKey) {
-	return `${INDEX_MARKER_PREFIX}${encodeURIComponent(indexKey)}`;
-}
 function hookMarkerKey(reference) {
 	return `${HOOK_MARKER_PREFIX}${encodeURIComponent(reference.hookId)}:${encodeURIComponent(reference.token)}`;
 }
@@ -1857,9 +2830,18 @@ function expiredRead(tombstone) {
 }
 //#endregion
 //#region src/worker/durable-objects/WorkflowRunDO.ts
-const PAYLOAD_DELETE_BATCH = 256;
-const STREAM_DELETE_CONCURRENCY = 16;
+const STORAGE_BATCH_SIZE = 128;
+const PAYLOAD_DELETE_BATCH = STORAGE_BATCH_SIZE;
+const HOOK_MARKER_PAGE_SIZE = 64;
+const TERMINAL_HOOK_PAGE_SIZE = 64;
+const TERMINAL_WAIT_PAGE_SIZE = STORAGE_BATCH_SIZE;
+const STREAMS_PER_CLEANUP_PAGE = 16;
+const STREAM_CHUNKS_PER_CLEANUP_PAGE = STORAGE_BATCH_SIZE;
+const STREAM_BYTES_PER_CLEANUP_PAGE = 16777216;
+const QUEUE_REFERENCES_PER_CLEANUP_PAGE = 64;
+const QUEUE_SHARDS_PER_CLEANUP_PAGE = 8;
 const CLEANUP_RETRY_MAX_MS = 36e5;
+const CLEANUP_PROGRESS_KEY = "retention:progress";
 /**
 * Adapt DO storage (or a transaction) to the {@link EventStore} interface
 * shared with the test mocks. No casts: the methods line up structurally,
@@ -1868,11 +2850,21 @@ const CLEANUP_RETRY_MAX_MS = 36e5;
 function storeFrom(storage) {
 	return {
 		get: (key) => storage.get(key),
+		getMany: (keys) => storage.get(keys),
 		put: (key, value) => storage.put(key, value),
 		delete: (key) => storage.delete(key),
-		list: (options) => storage.list(options)
+		deleteMany: (keys) => storage.delete(keys),
+		list: (options) => storage.list(options),
+		deferTerminalCleanup: true
 	};
 }
+function hookCreationIndexKey(hook) {
+	return `${HOOK_CREATED_KEY_PREFIX}${hook.createdAt.toISOString()}:${hook.hookId}`;
+}
+async function putStorageEntries(storage, entries) {
+	const all = Array.from(entries);
+	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE)));
+}
 /**
 * Durable Object for managing a single workflow run's state.
 *
@@ -1888,26 +2880,51 @@ var WorkflowRunDO = class extends DurableObject {
 		const clock = this.env?.clock;
 		return typeof clock === "function" ? clock() : Date.now();
 	}
-	async expiredTombstone(storage, now = this.now()) {
-		const tombstone = await storage.get(TOMBSTONE_KEY);
+	tombstoneFrom(values, now = this.now()) {
+		const tombstone = values.get(TOMBSTONE_KEY);
 		if (tombstone) return tombstone;
-		const cleanup = await storage.get(CLEANUP_RECORD_KEY);
+		const cleanup = values.get(CLEANUP_RECORD_KEY);
 		if (!cleanup || cleanup.phase === "retained" && cleanup.dueAt.getTime() > now) return null;
 		return cleanupTombstone(cleanup, cleanup.tombstonedAt ?? cleanup.dueAt);
 	}
-	async read(reader) {
-		const tombstone = await this.expiredTombstone(this.ctx.storage);
-		if (tombstone) return expiredRead(tombstone);
+	async retentionState(storage, now = this.now()) {
+		const values = await storage.get([TOMBSTONE_KEY, CLEANUP_RECORD_KEY]);
 		return {
-			ok: true,
-			value: await reader()
+			cleanup: values.get(CLEANUP_RECORD_KEY),
+			tombstone: this.tombstoneFrom(values, now)
 		};
 	}
+	async read(reader) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return expiredRead(tombstone);
+			return {
+				ok: true,
+				value: await reader(txn)
+			};
+		});
+	}
+	async readKey(key) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([
+				TOMBSTONE_KEY,
+				CLEANUP_RECORD_KEY,
+				key
+			]);
+			const tombstone = this.tombstoneFrom(values);
+			if (tombstone) return expiredRead(tombstone);
+			return {
+				ok: true,
+				value: values.get(key) ?? null
+			};
+		});
+	}
 	/** Apply an event and capture all retention metadata in the same transaction. */
 	async applyEvent(request) {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const now = new Date(this.now());
-			const tombstone = await this.expiredTombstone(txn, now.getTime());
+			const retention = await this.retentionState(txn, now.getTime());
+			const { tombstone } = retention;
 			if (tombstone) return {
 				ok: false,
 				code: "RUN_EXPIRED",
@@ -1921,20 +2938,12 @@ var WorkflowRunDO = class extends DurableObject {
 			});
 			if (!outcome.ok) return outcome;
 			await txn.put("event_sequence", eventSequence);
-			if (outcome.event?.correlationId) {
-				const key = correlationIndexKey(outcome.event.correlationId, outcome.event.createdAt, outcome.event.eventId, request.runId);
-				await txn.put(indexMarkerKey(key), key);
-			}
-			if (outcome.hookToIndex) {
-				const reference = {
-					hookId: outcome.hookToIndex.hookId,
-					token: outcome.hookToIndex.token
-				};
-				await txn.put(hookMarkerKey(reference), reference);
-			}
-			for (const reference of outcome.releasedHooks) await txn.put(hookMarkerKey(reference), reference);
+			await putStorageEntries(txn, (outcome.hookToIndex ? [{
+				hookId: outcome.hookToIndex.hookId,
+				token: outcome.hookToIndex.token
+			}, ...outcome.releasedHooks] : outcome.releasedHooks).map((reference) => [hookMarkerKey(reference), reference]));
 			const retentionMs = request.cleanup?.retentionMs ?? 0;
-			if (retentionMs > 0 && outcome.run && isTerminalWorkflowRunStatus(outcome.run.status) && !await txn.get("retention:cleanup")) {
+			if (retentionMs > 0 && outcome.run && isTerminalWorkflowRunStatus(outcome.run.status) && !retention.cleanup) {
 				const terminalRun = outcome.run;
 				const dueAt = new Date(terminalRun.completedAt.getTime() + retentionMs);
 				const run = WorkflowRunSchema.parse({
@@ -1951,6 +2960,7 @@ var WorkflowRunDO = class extends DurableObject {
 					dueAt,
 					queueShards: request.cleanup?.queueShards ?? 1,
 					phase: "retained",
+					generation: 0,
 					attempts: 0,
 					deletedPayloadKeys: 0,
 					deletedStreams: 0,
@@ -1961,34 +2971,60 @@ var WorkflowRunDO = class extends DurableObject {
 				await txn.setAlarm(dueAt);
 				outcome.run = run;
 			}
+			if (outcome.run && isTerminalWorkflowRunStatus(outcome.run.status)) {
+				if (!await txn.get("terminal:cleanup")) await txn.put(TERMINAL_CLEANUP_KEY, {
+					version: 1,
+					runId: outcome.run.runId,
+					phase: "hooks",
+					generation: 0,
+					attempts: 0
+				});
+				await txn.setAlarm(this.now() + 1);
+			}
 			return finalizeEventPage(storeFrom(txn), outcome, request.params);
 		});
 	}
+	/**
+	* Resolve an ambiguous hook-creation RPC in the same serialization domain as
+	* applyEvent. If the hook is absent, the exact reservation is durably fenced
+	* before the caller releases its token and hook-ID claims.
+	*/
+	async resolveHookTokenClaim(request) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			if ((await txn.get(`hook:${request.hookId}`))?.token === request.token) return { committed: true };
+			await txn.put(hookClaimCancellationKey(request.claimId), {
+				hookId: request.hookId,
+				token: request.token,
+				canceledAt: this.now()
+			});
+			return { committed: false };
+		});
+	}
 	async getRun() {
-		return this.read(async () => await this.ctx.storage.get("run") ?? null);
+		return this.readKey("run");
 	}
 	async getStep(stepId) {
-		return this.read(async () => await this.ctx.storage.get(`step:${stepId}`) ?? null);
+		return this.readKey(`${STEP_KEY_PREFIX}${stepId}`);
 	}
 	async listSteps(params) {
-		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
+		return this.read((txn) => listByCreationTime(storeFrom(txn), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
 			limit: params?.limit ?? 20,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
 		}));
 	}
 	async getEvent(eventId) {
-		return this.read(async () => await this.ctx.storage.get(`event:${eventId}`) ?? null);
+		return this.readKey(`${EVENT_KEY_PREFIX}${eventId}`);
 	}
 	async listEvents(params) {
-		return this.read(() => listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
+		return this.read((txn) => listByPrefix(storeFrom(txn), EVENT_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
 		}, (event) => event.eventId));
 	}
 	async listHooks(params) {
-		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
+		return this.read((txn) => listByCreationTime(storeFrom(txn), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
@@ -2001,10 +3037,16 @@ var WorkflowRunDO = class extends DurableObject {
 	async scheduleCleanup(request) {
 		if (request.retentionMs <= 0) return this.getCleanupStatus();
 		return await this.ctx.storage.transaction(async (txn) => {
-			const existing = await txn.get(CLEANUP_RECORD_KEY);
+			const values = await txn.get([
+				CLEANUP_RECORD_KEY,
+				TOMBSTONE_KEY,
+				TERMINAL_CLEANUP_KEY,
+				"run"
+			]);
+			const existing = values.get(CLEANUP_RECORD_KEY);
 			if (existing) return existing;
-			if (await txn.get("retention:tombstone")) return null;
-			const current = await txn.get("run");
+			if (values.get("retention:tombstone")) return null;
+			const current = values.get("run");
 			if (!current || !isTerminalWorkflowRunStatus(current.status)) return null;
 			const terminalRun = current;
 			const dueAt = new Date(terminalRun.completedAt.getTime() + request.retentionMs);
@@ -2022,6 +3064,7 @@ var WorkflowRunDO = class extends DurableObject {
 				dueAt,
 				queueShards: request.queueShards,
 				phase: "retained",
+				generation: 0,
 				attempts: 0,
 				deletedPayloadKeys: 0,
 				deletedStreams: 0,
@@ -2029,7 +3072,7 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 			await txn.put("run", run);
 			await txn.put(CLEANUP_RECORD_KEY, cleanup);
-			await txn.setAlarm(dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
+			await txn.setAlarm(values.get("terminal:cleanup") || dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
 			return cleanup;
 		});
 	}
@@ -2049,135 +3092,334 @@ var WorkflowRunDO = class extends DurableObject {
 			}));
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
-				dueAt
+				dueAt,
+				generation: cleanup.generation + 1
 			});
 			await txn.setAlarm(this.now() + 1);
 		});
-		try {
-			await this.executeCleanup();
-		} catch (error) {
-			await this.recordCleanupFailure(error);
-		}
+		await this.executeScheduledCleanupPage();
 		return this.getCleanupStatus();
 	}
 	async rearmCleanup() {
-		const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
-		if (!cleanup) return null;
-		if (cleanup.phase === "tombstoned") await this.ctx.storage.deleteAlarm();
+		const values = await this.ctx.storage.get([CLEANUP_RECORD_KEY, TERMINAL_CLEANUP_KEY]);
+		const cleanup = values.get(CLEANUP_RECORD_KEY);
+		if (values.get("terminal:cleanup")) await this.ctx.storage.setAlarm(this.now() + 1);
+		else if (!cleanup || cleanup.phase === "tombstoned") await this.ctx.storage.deleteAlarm();
 		else await this.ctx.storage.setAlarm(Math.max(this.now() + 1, cleanup.dueAt.getTime()));
-		return cleanup;
+		return cleanup ?? null;
 	}
 	async alarm() {
-		try {
-			await this.executeCleanup();
-		} catch (error) {
-			await this.recordCleanupFailure(error);
-		}
+		await this.executeScheduledCleanupPage();
 	}
 	namespace(name) {
 		const namespace = this.env?.[name];
 		if (!namespace || typeof namespace === "function") throw new Error(`world-celld retention missing binding ${name}`);
 		return namespace;
 	}
-	async setCleanupPhase(expected, next, updates = {}) {
+	workflowIndex() {
+		return createWorkflowIndex({
+			runCatalog: this.namespace("WORKFLOW_RUN_CATALOG"),
+			runFences: this.namespace("WORKFLOW_RUN_FENCES"),
+			hookTokens: this.namespace("WORKFLOW_HOOK_TOKENS"),
+			hookIds: this.namespace("WORKFLOW_HOOK_IDS")
+		});
+	}
+	async setCleanupPhase(expected, next, updates = {}, continueAt) {
 		await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
-			if (!cleanup || cleanup.phase !== expected) return;
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation) return;
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
 				...updates,
 				phase: next,
+				generation: cleanup.generation + 1,
 				attempts: 0,
 				lastError: void 0
 			});
+			if (continueAt !== void 0) await txn.setAlarm(continueAt);
 		});
 	}
-	async executeCleanup() {
-		for (;;) {
-			const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
-			if (!cleanup) {
-				await this.ctx.storage.deleteAlarm();
-				return;
+	async executeScheduledCleanupPage() {
+		const terminalCleanup = await this.ctx.storage.get(TERMINAL_CLEANUP_KEY);
+		if (terminalCleanup) {
+			try {
+				await this.executeTerminalCleanup(terminalCleanup);
+			} catch (error) {
+				await this.recordTerminalCleanupFailure(error, terminalCleanup);
 			}
-			if (cleanup.phase === "tombstoned") {
-				await this.ctx.storage.deleteAlarm();
+			return;
+		}
+		const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
+		if (!cleanup || cleanup.phase === "tombstoned") {
+			await this.ctx.storage.deleteAlarm();
+			return;
+		}
+		try {
+			await this.executeCleanup(cleanup);
+		} catch (error) {
+			await this.recordCleanupFailure(error, cleanup);
+		}
+	}
+	async executeCleanup(cleanup) {
+		if (cleanup.phase === "retained") {
+			if (cleanup.dueAt.getTime() > this.now()) {
+				await this.ctx.storage.setAlarm(cleanup.dueAt);
 				return;
 			}
-			if (cleanup.phase === "retained") {
-				if (cleanup.dueAt.getTime() > this.now()) {
-					await this.ctx.storage.setAlarm(cleanup.dueAt);
-					return;
-				}
-				await this.setCleanupPhase("retained", "index");
-				continue;
-			}
-			if (cleanup.phase === "index") {
-				const [indexMarkers, hookMarkers] = await Promise.all([this.ctx.storage.list({ prefix: INDEX_MARKER_PREFIX }), this.ctx.storage.list({ prefix: HOOK_MARKER_PREFIX })]);
-				const indexNamespace = this.namespace("WORKFLOW_INDEX");
-				await indexNamespace.get(indexNamespace.idFromName("index")).expireRun({
-					runId: cleanup.runId,
-					keys: [
-						workflowRunIndexKey(cleanup),
-						globalRunIndexKey(cleanup),
-						...indexMarkers.values()
-					],
-					hooks: Array.from(hookMarkers.values()),
-					expiredAt: cleanup.dueAt.getTime()
+			await this.setCleanupPhase(cleanup, "index", {}, this.now() + 1);
+			return;
+		}
+		if (cleanup.phase === "index") {
+			await this.deleteIndexPage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "streams") {
+			await this.deleteStreamPage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "queues") {
+			await this.deleteQueuePage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "payload") await this.deletePayloadBatch();
+	}
+	async executeTerminalCleanup(cleanup) {
+		if (cleanup.phase === "hooks") await this.deleteTerminalHookPage(cleanup);
+		else if (cleanup.phase === "markers") await this.deleteTerminalHookMarkerPage(cleanup);
+		else await this.deleteTerminalWaitPage(cleanup);
+	}
+	async deleteTerminalHookPage(cleanup) {
+		const entries = await this.ctx.storage.list({
+			prefix: HOOK_KEY_PREFIX,
+			limit: 65
+		});
+		const page = Array.from(entries.values()).slice(0, TERMINAL_HOOK_PAGE_SIZE);
+		await this.workflowIndex().releaseHookIndexes({
+			runId: cleanup.runId,
+			hooks: page.map((hook) => ({
+				hookId: hook.hookId,
+				token: hook.token
+			})),
+			terminal: true
+		});
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const keys = page.flatMap((hook) => [`${HOOK_KEY_PREFIX}${hook.hookId}`, hookCreationIndexKey(hook)]);
+			if (keys.length > 0) await txn.delete(keys);
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...current,
+				phase: entries.size <= TERMINAL_HOOK_PAGE_SIZE ? "markers" : "hooks",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteTerminalHookMarkerPage(cleanup) {
+		const entries = await this.ctx.storage.list({
+			prefix: HOOK_MARKER_PREFIX,
+			limit: 65
+		});
+		const page = Array.from(entries).slice(0, HOOK_MARKER_PAGE_SIZE);
+		await this.workflowIndex().releaseHookIndexes({
+			runId: cleanup.runId,
+			hooks: page.map(([, reference]) => reference),
+			terminal: true
+		});
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const keys = page.map(([key]) => key);
+			if (keys.length > 0) await txn.delete(keys);
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...current,
+				phase: entries.size <= HOOK_MARKER_PAGE_SIZE ? "waits" : "markers",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteTerminalWaitPage(cleanup) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const entries = await txn.list({
+				prefix: WAIT_KEY_PREFIX,
+				limit: 129
+			});
+			const keys = Array.from(entries.keys()).slice(0, TERMINAL_WAIT_PAGE_SIZE);
+			if (keys.length > 0) await txn.delete(keys);
+			if (entries.size > TERMINAL_WAIT_PAGE_SIZE) {
+				await txn.put(TERMINAL_CLEANUP_KEY, {
+					...current,
+					generation: current.generation + 1,
+					attempts: 0,
+					lastError: void 0
 				});
-				await this.setCleanupPhase("index", "streams");
-				continue;
+				await txn.setAlarm(this.now() + 1);
+				return;
 			}
-			if (cleanup.phase === "streams") {
-				const streamsNamespace = this.namespace("WORKFLOW_STREAMS");
-				const registry = streamsNamespace.get(streamsNamespace.idFromName(`run-streams:${cleanup.runId}`));
-				const { streams } = await registry.expireRegistry(cleanup.runId, cleanup.dueAt.getTime());
-				let deletedStreams = streams.length === 0 ? cleanup.deletedStreams : 0;
-				for (let offset = 0; offset < streams.length; offset += STREAM_DELETE_CONCURRENCY) {
-					const batch = streams.slice(offset, offset + STREAM_DELETE_CONCURRENCY);
-					const results = await Promise.all(batch.map((name) => {
-						return streamsNamespace.get(streamsNamespace.idFromName(`stream:${name}`)).expireStream(cleanup.runId, cleanup.dueAt.getTime());
-					}));
-					deletedStreams += results.filter((result) => result.deleted).length;
-				}
-				await this.ctx.storage.transaction(async (txn) => {
-					const current = await txn.get(CLEANUP_RECORD_KEY);
-					if (current?.phase === "streams") await txn.put(CLEANUP_RECORD_KEY, {
-						...current,
-						deletedStreams
-					});
+			await txn.delete(TERMINAL_CLEANUP_KEY);
+			const retention = await txn.get(CLEANUP_RECORD_KEY);
+			if (retention && retention.phase !== "tombstoned") await txn.setAlarm(Math.max(this.now() + 1, retention.dueAt.getTime()));
+			else await txn.deleteAlarm();
+		});
+	}
+	async deleteIndexPage(cleanup) {
+		const hookEntries = await this.ctx.storage.list({
+			prefix: HOOK_MARKER_PREFIX,
+			limit: 65
+		});
+		const hookMarkers = Array.from(hookEntries).slice(0, HOOK_MARKER_PAGE_SIZE);
+		await this.workflowIndex().expireRun({
+			runId: cleanup.runId,
+			keys: [workflowRunIndexKey(cleanup), globalRunIndexKey(cleanup)],
+			hooks: hookMarkers.map(([, value]) => value),
+			expiredAt: cleanup.dueAt.getTime()
+		});
+		const markerKeys = hookMarkers.map(([key]) => key);
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "index" || current.generation !== cleanup.generation) return;
+			if (markerKeys.length > 0) await txn.delete(markerKeys);
+			if (hookEntries.size <= HOOK_MARKER_PAGE_SIZE) await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				phase: "streams",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			else await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteStreamPage(cleanup) {
+		const streamsNamespace = this.namespace("WORKFLOW_STREAMS");
+		const registry = streamsNamespace.get(streamsNamespace.idFromName(`run-streams:${cleanup.runId}`));
+		const { streams } = await registry.expireRegistry(cleanup.runId, cleanup.dueAt.getTime(), { limit: STREAMS_PER_CLEANUP_PAGE });
+		const completed = [];
+		let remainingChunks = STREAM_CHUNKS_PER_CLEANUP_PAGE;
+		let remainingBytes = STREAM_BYTES_PER_CLEANUP_PAGE;
+		for (const name of streams) {
+			if (remainingChunks <= 0 || remainingBytes <= 0) break;
+			const result = await streamsNamespace.get(streamsNamespace.idFromName(`stream:${name}`)).expireStream(cleanup.runId, cleanup.dueAt.getTime(), {
+				limit: remainingChunks,
+				byteLimit: remainingBytes
+			});
+			remainingChunks -= result.chunks;
+			remainingBytes -= result.bytes;
+			if (result.done) completed.push(name);
+		}
+		const registryResult = await registry.finalizeRegistry(cleanup.runId, completed);
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "streams" || current.generation !== cleanup.generation) return;
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				deletedStreams: registryResult.deleted,
+				phase: registryResult.done ? "queues" : "streams",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteQueuePage(cleanup) {
+		const queues = this.namespace("WORKFLOW_QUEUE");
+		let progress = await this.ctx.storage.get(CLEANUP_PROGRESS_KEY) ?? {
+			queueShard: 0,
+			queueShardDeleted: 0
+		};
+		let remainingShards = QUEUE_SHARDS_PER_CLEANUP_PAGE;
+		let expectedGeneration = cleanup.generation;
+		while (progress.queueShard < cleanup.queueShards && remainingShards-- > 0) {
+			const requestedShard = progress.queueShard;
+			const result = await queues.get(queues.idFromName(`q:${requestedShard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime(), { limit: QUEUE_REFERENCES_PER_CLEANUP_PAGE });
+			const reconciled = await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(CLEANUP_RECORD_KEY);
+				if (current?.phase !== "queues") return null;
+				if (current.generation !== expectedGeneration) return { stale: true };
+				const persisted = await txn.get(CLEANUP_PROGRESS_KEY) ?? {
+					queueShard: 0,
+					queueShardDeleted: 0
+				};
+				if (persisted.queueShard !== requestedShard) return { stale: true };
+				if (result.deleted < persisted.queueShardDeleted) return { stale: true };
+				const next = result.done ? {
+					queueShard: persisted.queueShard + 1,
+					queueShardDeleted: 0
+				} : {
+					...persisted,
+					queueShardDeleted: result.deleted
+				};
+				const delta = result.deleted - persisted.queueShardDeleted;
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...current,
+					deletedQueueMessages: current.deletedQueueMessages + delta,
+					generation: current.generation + 1,
+					attempts: 0,
+					lastError: void 0
 				});
-				await registry.finalizeRegistry(cleanup.runId);
-				await this.setCleanupPhase("streams", "queues");
-				continue;
-			}
-			if (cleanup.phase === "queues") {
-				const queues = this.namespace("WORKFLOW_QUEUE");
-				let deletedQueueMessages = 0;
-				for (let shard = 0; shard < cleanup.queueShards; shard++) {
-					const result = await queues.get(queues.idFromName(`q:${shard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime());
-					deletedQueueMessages += result.deleted;
-				}
-				await this.setCleanupPhase("queues", "payload", { deletedQueueMessages });
-				continue;
-			}
-			if (cleanup.phase === "payload") {
-				if (!await this.deletePayloadBatch()) return;
-			}
+				await txn.put(CLEANUP_PROGRESS_KEY, next);
+				await txn.setAlarm(this.now() + 1);
+				return {
+					stale: false,
+					progress: next,
+					generation: current.generation + 1,
+					applied: result.done || next.queueShard !== persisted.queueShard || next.queueShardDeleted !== persisted.queueShardDeleted
+				};
+			});
+			if (!reconciled) return;
+			if (reconciled.stale) return;
+			progress = reconciled.progress;
+			expectedGeneration = reconciled.generation;
+			if (!reconciled.applied && progress.queueShard === requestedShard) break;
+			if (!result.done && progress.queueShard === requestedShard) break;
 		}
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "queues") return;
+			if ((await txn.get(CLEANUP_PROGRESS_KEY) ?? {
+				queueShard: 0,
+				queueShardDeleted: 0
+			}).queueShard >= current.queueShards) {
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...current,
+					phase: "payload",
+					generation: current.generation + 1
+				});
+				await txn.delete(CLEANUP_PROGRESS_KEY);
+				await txn.setAlarm(this.now() + 1);
+			}
+		});
 	}
 	async deletePayloadBatch() {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
 			if (!cleanup || cleanup.phase !== "payload") return true;
-			const entries = await txn.list({ limit: 259 });
+			const entries = await txn.list({
+				limit: 131,
+				noCache: true
+			});
 			const keys = Array.from(entries.keys()).filter((key) => key !== "retention:cleanup" && key !== "retention:tombstone").slice(0, PAYLOAD_DELETE_BATCH);
 			const now = new Date(this.now());
 			await txn.put(TOMBSTONE_KEY, cleanupTombstone(cleanup, now));
-			for (const key of keys) await txn.delete(key);
+			if (keys.length > 0) await txn.delete(keys);
 			if (keys.length > 0) {
 				await txn.put(CLEANUP_RECORD_KEY, {
 					...cleanup,
 					deletedPayloadKeys: cleanup.deletedPayloadKeys + keys.length,
+					generation: cleanup.generation + 1,
 					lastError: void 0
 				});
 				await txn.setAlarm(this.now() + 1);
@@ -2186,6 +3428,7 @@ var WorkflowRunDO = class extends DurableObject {
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
 				phase: "tombstoned",
+				generation: cleanup.generation + 1,
 				attempts: 0,
 				lastError: void 0,
 				tombstonedAt: now
@@ -2194,14 +3437,31 @@ var WorkflowRunDO = class extends DurableObject {
 			return true;
 		});
 	}
-	async recordCleanupFailure(error) {
+	async recordCleanupFailure(error, expected) {
 		await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
-			if (!cleanup || cleanup.phase === "tombstoned") return;
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation || cleanup.phase === "tombstoned") return;
 			const attempts = cleanup.attempts + 1;
 			const delay = Math.min(CLEANUP_RETRY_MAX_MS, 1e3 * 2 ** Math.min(attempts - 1, 12));
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
+				generation: cleanup.generation + 1,
+				attempts,
+				lastError: error instanceof Error ? error.message : String(error),
+				lastAttemptAt: new Date(this.now())
+			});
+			await txn.setAlarm(this.now() + delay);
+		});
+	}
+	async recordTerminalCleanupFailure(error, expected) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation) return;
+			const attempts = cleanup.attempts + 1;
+			const delay = Math.min(CLEANUP_RETRY_MAX_MS, 1e3 * 2 ** Math.min(attempts - 1, 12));
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...cleanup,
+				generation: cleanup.generation + 1,
 				attempts,
 				lastError: error instanceof Error ? error.message : String(error),
 				lastAttemptAt: new Date(this.now())
@@ -2236,6 +3496,6 @@ var worker_default = { async fetch(request, env) {
 	return createRouter(env)(request);
 } };
 //#endregion
-export { IndexDO, QueueDO, StreamDO, WorkflowRunDO, createRouter, worker_default as default };
+export { HookIdDO, HookTokenDO, QueueDO, RunCatalogDO, RunFenceDO, StreamDO, WorkflowRunDO, createRouter, worker_default as default };
 
 //# sourceMappingURL=worker.js.map