@ewhauser/world-celld 0.3.0 → 0.3.2

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { a as cleanupTombstone, c as globalRunIndexKey, d as workflowRunIndexKey, f as compact, h as parse, i as TOMBSTONE_KEY, l as hookMarkerKey, m as rpcStringify, n as HOOK_MARKER_PREFIX, o as correlationIndexKey, p as rpcParse, r as INDEX_MARKER_PREFIX, s as expiredRead, t as CLEANUP_RECORD_KEY, u as indexMarkerKey } from "./retention-bLY1vcOu.js";
+import { A as validateStreamReadRequest, E as encodeStreamReadResult, O as encodeStreamWriteResult, S as STREAM_BATCH_CONTENT_TYPE, c as HOOK_CLAIM_LEASE_MS, d as MAX_QUEUE_DELIVERY_TIMEOUT_MS, f as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, g as MAX_STREAM_CHUNK_BYTES, h as MAX_STREAM_BATCH_BYTES, i as parse, j as validateStreamWriteChunks, k as normalizeStreamError, l as LIFECYCLE_COMPACTION_RETRY_MS, m as QUEUE_INFLIGHT_GRACE_MS, n as rpcParse, o as createWorkflowIndex, p as QUEUE_FENCE_GRACE_MS, r as rpcStringify, t as compact, v as MAX_STREAM_LONG_POLL_MS, w as decodeStreamWriteBatch, y as MAX_STREAM_READ_BYTES } from "./util-ya3V_FTA.js";
 import { EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
 import http from "node:http";
 //#region src/testing/fake-cell.ts
@@ -33,40 +33,109 @@ var FakeStorage = class {
 	clock;
 	data = /* @__PURE__ */ new Map();
 	alarmAt = null;
+	getManyCalls = [];
+	operationCounts = {
+		get: 0,
+		getMany: 0,
+		list: 0,
+		put: 0,
+		putMany: 0,
+		delete: 0,
+		deleteMany: 0,
+		transaction: 0
+	};
+	transactionTail = Promise.resolve();
+	transactionDelayMs = 0;
+	/** Deterministic query-shape instrumentation for storage scaling tests. */
+	listCalls = [];
+	operationCalls = [];
 	mutationFailure;
 	constructor(clock = () => Date.now()) {
 		this.clock = clock;
 	}
-	async get(key) {
-		return this.data.get(key);
-	}
-	async put(key, value) {
-		this.maybeFailMutation({
+	async get(keyOrKeys) {
+		if (Array.isArray(keyOrKeys)) {
+			this.operationCounts.getMany += 1;
+			this.getManyCalls.push([...keyOrKeys]);
+			this.recordStorageCall("get", keyOrKeys, false);
+			return new Map(keyOrKeys.filter((key) => this.data.has(key)).map((key) => [key, this.data.get(key)]));
+		}
+		this.operationCounts.get += 1;
+		this.recordStorageCall("get", [keyOrKeys], false);
+		return this.data.get(keyOrKeys);
+	}
+	async put(keyOrEntries, value) {
+		if (typeof keyOrEntries === "string") {
+			this.operationCounts.put += 1;
+			this.maybeFailMutation({
+				operation: "put",
+				key: keyOrEntries,
+				value
+			});
+			this.recordStorageCall("put", [keyOrEntries], false);
+			this.data.set(keyOrEntries, structuredClone(value));
+			return;
+		}
+		this.operationCounts.putMany += 1;
+		for (const [key, entryValue] of Object.entries(keyOrEntries)) this.maybeFailMutation({
 			operation: "put",
 			key,
-			value
+			value: entryValue
 		});
-		this.data.set(key, structuredClone(value));
-	}
-	async delete(key) {
-		this.maybeFailMutation({
+		this.recordStorageCall("put", Object.keys(keyOrEntries), false);
+		for (const [key, entryValue] of Object.entries(keyOrEntries)) this.data.set(key, structuredClone(entryValue));
+	}
+	async delete(keyOrKeys) {
+		if (typeof keyOrKeys === "string") {
+			this.operationCounts.delete += 1;
+			this.maybeFailMutation({
+				operation: "delete",
+				key: keyOrKeys
+			});
+			this.recordStorageCall("delete", [keyOrKeys], false);
+			return this.data.delete(keyOrKeys);
+		}
+		this.operationCounts.deleteMany += 1;
+		for (const key of keyOrKeys) this.maybeFailMutation({
 			operation: "delete",
 			key
 		});
-		return this.data.delete(key);
+		this.recordStorageCall("delete", keyOrKeys, false);
+		let deleted = 0;
+		for (const key of keyOrKeys) if (this.data.delete(key)) deleted += 1;
+		return deleted;
 	}
 	async deleteAll() {
 		this.data.clear();
 	}
 	async list(options = {}) {
+		this.operationCounts.list += 1;
 		const keys = applyListOptions(Array.from(this.data.keys()), options);
+		this.recordList(options, keys.length, false);
 		return new Map(keys.map((k) => [k, this.data.get(k)]));
 	}
 	async transaction(cb) {
-		const txn = new FakeTransaction(this);
-		const result = await cb(txn);
-		txn.commit();
-		return result;
+		this.operationCounts.transaction += 1;
+		let release;
+		const previous = this.transactionTail;
+		this.transactionTail = new Promise((resolve) => {
+			release = resolve;
+		});
+		await previous;
+		try {
+			if (this.transactionDelayMs > 0) await new Promise((resolve) => setTimeout(resolve, this.transactionDelayMs));
+			const txn = new FakeTransaction(this);
+			const result = await cb(txn);
+			txn.commit();
+			return result;
+		} finally {
+			release();
+		}
+	}
+	/** Add deterministic per-transaction work for contention benchmarks. */
+	setTransactionDelay(ms) {
+		if (!Number.isFinite(ms) || ms < 0) throw new Error("transaction delay must be non-negative");
+		this.transactionDelayMs = ms;
 	}
 	async getAlarm() {
 		return this.alarmAt;
@@ -80,6 +149,24 @@ var FakeStorage = class {
 	now() {
 		return this.clock();
 	}
+	resetOperationCounts() {
+		for (const key of Object.keys(this.operationCounts)) this.operationCounts[key] = 0;
+		this.getManyCalls.length = 0;
+		this.operationCalls.length = 0;
+	}
+	/** @internal Used by FakeTransaction to count the same platform operations. */
+	recordOperation(operation) {
+		this.operationCounts[operation] += 1;
+	}
+	/** @internal Shared with FakeTransaction for deterministic key tracing. */
+	recordStorageCall(operation, keys, transactional) {
+		this.operationCalls.push({
+			operation,
+			keys: [...keys],
+			transactional,
+			synchronous: false
+		});
+	}
 	/** Inject one matching write failure, including writes inside transactions. */
 	failNextMutation(predicate, error = /* @__PURE__ */ new Error("injected fake storage mutation failure")) {
 		this.mutationFailure = {
@@ -94,6 +181,14 @@ var FakeStorage = class {
 		this.mutationFailure = void 0;
 		throw error;
 	}
+	/** @internal Shared with FakeTransaction for deterministic query tracing. */
+	recordList(options, resultSize, transactional) {
+		this.listCalls.push({
+			options: { ...options },
+			resultSize,
+			transactional
+		});
+	}
 };
 var FakeTransaction = class {
 	storage;
@@ -103,21 +198,64 @@ var FakeTransaction = class {
 	constructor(storage) {
 		this.storage = storage;
 	}
-	async get(key) {
+	async get(keyOrKeys) {
+		if (Array.isArray(keyOrKeys)) {
+			this.storage.recordOperation("getMany");
+			this.storage.getManyCalls.push([...keyOrKeys]);
+			this.storage.recordStorageCall("get", keyOrKeys, true);
+			const result = /* @__PURE__ */ new Map();
+			for (const key of keyOrKeys) {
+				if (this.deleted.has(key)) continue;
+				if (this.staged.has(key)) result.set(key, this.staged.get(key));
+				else if (this.storage.data.has(key)) result.set(key, this.storage.data.get(key));
+			}
+			return result;
+		}
+		this.storage.recordOperation("get");
+		const key = keyOrKeys;
+		this.storage.recordStorageCall("get", [key], true);
 		if (this.deleted.has(key)) return void 0;
 		if (this.staged.has(key)) return this.staged.get(key);
 		return this.storage.data.get(key);
 	}
-	async put(key, value) {
-		this.storage.maybeFailMutation({
+	async put(keyOrEntries, value) {
+		if (typeof keyOrEntries === "string") {
+			this.storage.recordOperation("put");
+			this.storage.maybeFailMutation({
+				operation: "put",
+				key: keyOrEntries,
+				value
+			});
+			this.storage.recordStorageCall("put", [keyOrEntries], true);
+			this.deleted.delete(keyOrEntries);
+			this.staged.set(keyOrEntries, structuredClone(value));
+			return;
+		}
+		this.storage.recordOperation("putMany");
+		for (const [key, entryValue] of Object.entries(keyOrEntries)) this.storage.maybeFailMutation({
 			operation: "put",
 			key,
-			value
+			value: entryValue
 		});
-		this.deleted.delete(key);
-		this.staged.set(key, structuredClone(value));
+		this.storage.recordStorageCall("put", Object.keys(keyOrEntries), true);
+		for (const [key, entryValue] of Object.entries(keyOrEntries)) {
+			this.deleted.delete(key);
+			this.staged.set(key, structuredClone(entryValue));
+		}
+	}
+	async delete(keyOrKeys) {
+		if (typeof keyOrKeys === "string") {
+			this.storage.recordOperation("delete");
+			this.storage.recordStorageCall("delete", [keyOrKeys], true);
+			return this.deleteOne(keyOrKeys);
+		}
+		this.storage.recordOperation("deleteMany");
+		this.storage.recordStorageCall("delete", keyOrKeys, true);
+		let deleted = 0;
+		for (const key of keyOrKeys) if (this.deleteOne(key)) deleted += 1;
+		return deleted;
 	}
-	async delete(key) {
+	deleteOne(key) {
 		this.storage.maybeFailMutation({
 			operation: "delete",
 			key
@@ -128,10 +266,12 @@ var FakeTransaction = class {
 		return existed;
 	}
 	async list(options = {}) {
+		this.storage.recordOperation("list");
 		const merged = new Map(this.storage.data);
 		for (const key of this.deleted) merged.delete(key);
 		for (const [key, value] of this.staged) merged.set(key, value);
 		const keys = applyListOptions(Array.from(merged.keys()), options);
+		this.storage.recordList(options, keys.length, true);
 		return new Map(keys.map((k) => [k, merged.get(k)]));
 	}
 	async getAlarm() {
@@ -175,28 +315,31 @@ var FakeFleet = class {
 			get: (id) => this.cell(bindingKey, id.toString()).instance
 		};
 	}
+	instantiate(bindingKey, name, storage, pendingWaits) {
+		const CellCtor = this.classes[bindingKey];
+		if (!CellCtor) throw new Error(`no cell class registered for binding: ${bindingKey}`);
+		return new CellCtor({
+			storage,
+			id: {
+				toString: () => name,
+				name
+			},
+			waitUntil(promise) {
+				pendingWaits.push(promise);
+			},
+			async blockConcurrencyWhile(cb) {
+				return cb();
+			}
+		}, this.cellEnv);
+	}
 	cell(bindingKey, name) {
 		const key = `${bindingKey}\0${name}`;
 		let slot = this.cells.get(key);
 		if (!slot) {
-			const CellCtor = this.classes[bindingKey];
-			if (!CellCtor) throw new Error(`no cell class registered for binding: ${bindingKey}`);
 			const storage = new FakeStorage(() => this.now);
 			const pendingWaits = [];
 			slot = {
-				instance: new CellCtor({
-					storage,
-					id: {
-						toString: () => name,
-						name
-					},
-					waitUntil(promise) {
-						pendingWaits.push(promise);
-					},
-					async blockConcurrencyWhile(cb) {
-						return cb();
-					}
-				}, this.cellEnv),
+				instance: this.instantiate(bindingKey, name, storage, pendingWaits),
 				storage,
 				pendingWaits,
 				alarmRetryCount: 0,
@@ -206,6 +349,12 @@ var FakeFleet = class {
 		}
 		return slot;
 	}
+	/** Recreate one in-memory DO instance while preserving its durable storage. */
+	restartCell(bindingKey, name) {
+		const slot = this.cell(bindingKey, name);
+		slot.instance = this.instantiate(bindingKey, name, slot.storage, slot.pendingWaits);
+		return slot.instance;
+	}
 	advance(ms) {
 		this.now += ms;
 	}
@@ -292,18 +441,28 @@ async function authenticate(request, secret) {
 * Routes:
 *   GET  /v1/health                              — liveness + spec version (unauthenticated)
 *   POST /v1/rpc/{binding}/{name}/{method}       — DO RPC (bearer auth)
+*   POST /v1/index/{domain}/{method}             — cohesive index operation
+*   GET  /v1/streams/{name}/chunks               — bounded binary long-poll read
+*   POST /v1/streams/{name}/chunks               — bounded binary batch append
 *
-* The RPC body is an rpc-codec-encoded JSON array of arguments; the response
-* body is the rpc-codec-encoded return value. Only whitelisted methods
-* dispatch — everything else (including fetch/alarm) is unreachable.
+* Generic RPC bodies use the tagged JSON codec. Stream chunk bodies use the
+* compact binary stream protocol. Only whitelisted routes/methods dispatch.
 */
 const WORLD_NAME = "world-celld";
 const WORLD_VERSION = "0.1.0";
+function workflowIndex(env) {
+	return createWorkflowIndex({
+		runCatalog: env.WORKFLOW_RUN_CATALOG,
+		hookTokens: env.WORKFLOW_HOOK_TOKENS,
+		hookIds: env.WORKFLOW_HOOK_IDS
+	});
+}
 const BINDINGS = {
 	runs: {
 		env: "WORKFLOW_DB",
 		methods: /* @__PURE__ */ new Set([
 			"applyEvent",
+			"getLifecycleStatus",
 			"getRun",
 			"getStep",
 			"getEvent",
@@ -313,16 +472,15 @@ const BINDINGS = {
 			"getCleanupStatus",
 			"scheduleCleanup",
 			"cleanupNow",
-			"rearmCleanup"
+			"rearmCleanup",
+			"resolveHookTokenClaim"
 		])
 	},
 	streams: {
 		env: "WORKFLOW_STREAMS",
 		methods: /* @__PURE__ */ new Set([
-			"writeChunk",
 			"closeStream",
-			"getChunks",
-			"getInfo",
+			"failStream",
 			"registerStream",
 			"listStreams",
 			"expireRegistry",
@@ -330,20 +488,13 @@ const BINDINGS = {
 			"expireStream"
 		])
 	},
-	index: {
-		env: "WORKFLOW_INDEX",
-		methods: /* @__PURE__ */ new Set([
-			"get",
-			"put",
-			"delete",
-			"putOwned",
-			"expireRun",
-			"list",
-			"reserveHookToken",
-			"finalizeHookIndexes",
-			"releaseHookToken",
-			"deleteHookIndexes"
-		])
+	"hook-tokens": {
+		env: "WORKFLOW_HOOK_TOKENS",
+		methods: /* @__PURE__ */ new Set(["get"])
+	},
+	"hook-ids": {
+		env: "WORKFLOW_HOOK_IDS",
+		methods: /* @__PURE__ */ new Set(["get"])
 	},
 	queue: {
 		env: "WORKFLOW_QUEUE",
@@ -354,12 +505,14 @@ const BINDINGS = {
 			"redriveDeadLetter",
 			"purgeDeadLetters",
 			"rearmAlarm",
-			"expireRun"
+			"expireRun",
+			"acknowledgeExpireRun"
 		])
 	}
 };
 /** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
 const MAX_BODY_BYTES = 33554432;
+const MAX_STREAM_WRITE_BODY_BYTES = MAX_STREAM_BATCH_BYTES + 1024;
 function errorResponse(status, name, message) {
 	return Response.json({ error: {
 		name,
@@ -388,6 +541,49 @@ async function readBoundedBody(request) {
 		reader.releaseLock();
 	}
 }
+async function readBoundedBytes(request, maxBytes) {
+	if (!request.body) return /* @__PURE__ */ new Uint8Array();
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel("stream body exceeds configured limit").catch(() => void 0);
+				return null;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return body;
+}
+function parseBoundedInteger(url, name, minimum, maximum) {
+	const raw = url.searchParams.get(name);
+	const value = raw === null ? NaN : Number(raw);
+	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+		const error = /* @__PURE__ */ new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
+		error.name = "StreamProtocolError";
+		throw error;
+	}
+	return value;
+}
+function streamResponse(body) {
+	return new Response(body, {
+		status: 200,
+		headers: { "content-type": STREAM_BATCH_CONTENT_TYPE }
+	});
+}
 function createRouter(env) {
 	return async (request) => {
 		const url = new URL(request.url);
@@ -399,9 +595,83 @@ function createRouter(env) {
 			version: WORLD_VERSION,
 			specVersion: SPEC_VERSION_CURRENT
 		});
-		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
 		const auth = await authenticate(request, env.WORLD_SECRET);
 		if (!auth.ok) return auth.response;
+		if (parts[1] === "index" && parts.length === 4) {
+			if (request.method !== "POST") return errorResponse(405, "MethodNotAllowed", "expected POST");
+			if (Number(request.headers.get("content-length") ?? "0") > MAX_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+			let args;
+			try {
+				const text = await readBoundedBody(request);
+				if (text === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+				const parsed = rpcParse(text);
+				if (!Array.isArray(parsed)) return errorResponse(400, "BadRequest", "body must be an argument array");
+				args = parsed;
+			} catch {
+				return errorResponse(400, "BadRequest", "malformed rpc body");
+			}
+			try {
+				const index = workflowIndex(env);
+				let result;
+				const operation = `${parts[2]}.${parts[3]}`;
+				if (operation === "runs.list") result = await index.listRuns(args[0]);
+				else if (operation === "runs.commit") result = await index.commitRun(args[0], args[1], args[2]);
+				else if (operation === "runs.expire") result = await index.expireRun(args[0]);
+				else if (operation === "hooks.reserve") result = await index.reserveHook(args[0], args[1]);
+				else if (operation === "hooks.finalize") result = await index.finalizeHookIndexes(args[0], args[1], args[2], args[3], args[4]);
+				else if (operation === "hooks.release-reservation") result = await index.releaseHookReservation(args[0], args[1], args[2]);
+				else if (operation === "hooks.release") result = await index.releaseHookIndexes(args[0]);
+				else return errorResponse(404, "NotFound", `unknown index operation: ${operation}`);
+				return new Response(rpcStringify(result ?? null), {
+					status: 200,
+					headers: { "content-type": "application/json" }
+				});
+			} catch (error) {
+				const err = error;
+				return Response.json({ error: {
+					name: err?.name ?? "Error",
+					message: err?.message ?? String(error),
+					status: typeof err?.status === "number" ? err.status : void 0
+				} }, { status: 500 });
+			}
+		}
+		if (parts[1] === "streams" && parts.length === 4 && parts[3] === "chunks") {
+			const namespace = env.WORKFLOW_STREAMS;
+			if (!namespace) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_STREAMS");
+			const name = decodeURIComponent(parts[2]);
+			const runId = url.searchParams.get("runId");
+			if (!runId) return errorResponse(400, "BadRequest", "runId is required");
+			const stub = namespace.get(namespace.idFromName(name));
+			try {
+				if (request.method === "POST") {
+					if (!request.headers.get("content-type")?.startsWith("application/vnd.world-celld.stream-batch.v1")) return errorResponse(415, "UnsupportedMediaType", STREAM_BATCH_CONTENT_TYPE);
+					if (Number(request.headers.get("content-length") ?? "0") > MAX_STREAM_WRITE_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_STREAM_WRITE_BODY_BYTES} bytes`);
+					const body = await readBoundedBytes(request, MAX_STREAM_WRITE_BODY_BYTES);
+					if (body === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_STREAM_WRITE_BODY_BYTES} bytes`);
+					const result = await stub.writeChunks(runId, decodeStreamWriteBatch(body));
+					return streamResponse(encodeStreamWriteResult(result));
+				}
+				if (request.method === "GET") {
+					const result = await stub.readChunks({
+						runId,
+						startIndex: parseBoundedInteger(url, "startIndex", 0, 2147483647),
+						maxChunks: parseBoundedInteger(url, "maxChunks", 0, 32),
+						maxBytes: parseBoundedInteger(url, "maxBytes", MAX_STREAM_CHUNK_BYTES, MAX_STREAM_READ_BYTES),
+						waitMs: parseBoundedInteger(url, "waitMs", 0, MAX_STREAM_LONG_POLL_MS)
+					}, request.signal);
+					return streamResponse(encodeStreamReadResult(result));
+				}
+				return errorResponse(405, "MethodNotAllowed", "expected GET or POST");
+			} catch (error) {
+				const err = error;
+				return Response.json({ error: {
+					name: err?.name ?? "Error",
+					message: err?.message ?? String(error),
+					status: typeof err?.status === "number" ? err.status : void 0
+				} }, { status: err?.name === "StreamProtocolError" ? 400 : 500 });
+			}
+		}
+		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
 		if (request.method !== "POST" || parts.length !== 5) return errorResponse(404, "NotFound", "expected POST /v1/rpc/{binding}/{name}/{method}");
 		const [, , bindingKey, encodedName, method] = parts;
 		const binding = BINDINGS[bindingKey];
@@ -457,162 +727,367 @@ var DurableObject = class {
 	}
 };
 //#endregion
-//#region src/worker/durable-objects/IndexDO.ts
+//#region src/worker/durable-objects/hook-index-shared.ts
 function sameOwner(left, right) {
 	return left.runId === right.runId && left.hookId === right.hookId;
 }
-function ownerFromHook(raw) {
+function ownerFromSerializedHook(raw) {
 	const hook = parse(raw);
 	return {
 		runId: hook.runId,
 		hookId: hook.hookId
 	};
 }
-/**
-* Global index cell, replacing the Workers KV namespace world-cloudflare
-* uses for run listing and hook token/id lookup.
-*
-* A single cell (named `index`) serializes every read and write. Hook-token
-* reservation, publication, and release use storage transactions so
-* concurrent runs cannot both acquire the same token.
-*
-* The RPC surface matches the storage-layer KVNamespace interface bit-for-bit
-* (including MockKVNamespace's pagination contract: cursor = last returned
-* key, `list_complete` reflects whether further keys exist), so the vendored
-* storage.ts works against it unchanged.
-*/
-var IndexDO = class extends DurableObject {
-	async get(key) {
-		return await this.ctx.storage.get(key) ?? null;
+function indexKey(prefix, value) {
+	return `${prefix}:${encodeURIComponent(value)}`;
+}
+async function runIsActive(env, runId) {
+	const namespace = env.WORKFLOW_DB;
+	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_DB binding");
+	return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "active";
+}
+//#endregion
+//#region src/worker/durable-objects/HookIdDO.ts
+const MAX_RELEASE_BATCH$1 = 64;
+const CLAIM_DEADLINE_PREFIX$1 = "claim-deadline:";
+function pad$3(ms) {
+	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
+}
+function recordKey$1(hookId) {
+	return indexKey("hookid", hookId);
+}
+function claimKey$1(hookId) {
+	return indexKey("claim", hookId);
+}
+function claimDeadlineKey$1(hookId, expiresAt) {
+	return `${CLAIM_DEADLINE_PREFIX$1}${pad$3(expiresAt)}:${encodeURIComponent(hookId)}`;
+}
+/** Hook-ID ownership and lookup shard; every hook ID has one transaction domain. */
+var HookIdDO = class extends DurableObject {
+	now() {
+		return typeof this.env.clock === "function" ? this.env.clock() : Date.now();
 	}
-	async put(key, value) {
-		await this.ctx.storage.put(key, value);
+	async get(hookId) {
+		const raw = await this.ctx.storage.get(recordKey$1(hookId));
+		if (!raw) return null;
+		const owner = ownerFromSerializedHook(raw);
+		return await runIsActive(this.env, owner.runId) ? raw : null;
 	}
-	/** Publish a derived index only while its owning run is not expired. */
-	async putOwned(runId, key, value) {
+	async reserve(hookId, owner, proposedClaimId) {
 		return await this.ctx.storage.transaction(async (txn) => {
-			if (await txn.get(`expired:${runId}`) !== void 0) return { stored: false };
-			await txn.put(key, value);
+			const record = recordKey$1(hookId);
+			const claim = claimKey$1(hookId);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0) return {
+				claimed: false,
+				holder: ownerFromSerializedHook(indexed)
+			};
+			let existing = values.get(claim);
+			const now = this.now();
+			if (existing && existing.expiresAt <= now) {
+				await txn.delete([claim, existing.deadlineKey]);
+				existing = void 0;
+			}
+			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+				claimed: false,
+				holder: existing.owner
+			};
+			if (existing === void 0 || existing.claimId !== proposedClaimId) {
+				if (existing) await txn.delete(existing.deadlineKey);
+				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+				const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
+				await txn.put(claim, {
+					owner,
+					claimId: proposedClaimId,
+					reservedAt: now,
+					expiresAt,
+					deadlineKey
+				});
+				await txn.put(deadlineKey, {
+					hookId,
+					claimId: proposedClaimId,
+					expiresAt
+				});
+				await this.armAtMost(txn, expiresAt);
+				return {
+					claimed: true,
+					claimId: proposedClaimId
+				};
+			}
+			return {
+				claimed: true,
+				claimId: existing.claimId
+			};
+		});
+	}
+	async publish(hookId, serializedHook, owner, claimId) {
+		if (!await runIsActive(this.env, owner.runId)) {
+			await this.releaseBatch([{
+				hookId,
+				owner
+			}]);
+			return { stored: false };
+		}
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey$1(hookId);
+			const claim = claimKey$1(hookId);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook id ${hookId} is owned by another hook`);
+			const existingClaim = values.get(claim);
+			if (existingClaim && existingClaim.expiresAt <= this.now()) {
+				await txn.delete([claim, existingClaim.deadlineKey]);
+				return { stored: false };
+			}
+			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook id ${hookId} is reserved by another hook`);
+			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook id ${hookId} has no active reservation`);
+			await txn.put(record, serializedHook);
+			if (existingClaim !== void 0) await txn.delete([claim, existingClaim.deadlineKey]);
 			return { stored: true };
 		});
 	}
-	async delete(key) {
-		await this.ctx.storage.delete(key);
+	async releaseClaim(hookId, owner, claimId) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = claimKey$1(hookId);
+			const claim = await txn.get(key);
+			if (claim && sameOwner(claim.owner, owner) && claim.claimId === claimId) await txn.delete([key, claim.deadlineKey]);
+		});
 	}
-	async list(options) {
-		const prefix = options?.prefix ?? "";
-		const limit = options?.limit ?? 1e3;
-		const entries = await this.ctx.storage.list({
-			prefix,
-			...options?.reverse ? {
-				reverse: true,
-				end: options.cursor
-			} : { startAfter: options?.cursor },
-			limit: limit + 1
+	async releaseBatch(hooks) {
+		if (hooks.length > MAX_RELEASE_BATCH$1) throw new Error("Hook id release batch is too large");
+		if (hooks.length === 0) return { deleted: 0 };
+		return await this.ctx.storage.transaction(async (txn) => {
+			const keys = hooks.flatMap(({ hookId }) => [recordKey$1(hookId), claimKey$1(hookId)]);
+			const values = await txn.get(keys);
+			const deletes = [];
+			const deadlineDeletes = [];
+			for (const { hookId, owner } of hooks) {
+				const record = recordKey$1(hookId);
+				const claim = claimKey$1(hookId);
+				const indexed = values.get(record);
+				const existingClaim = values.get(claim);
+				if (indexed !== void 0 && sameOwner(ownerFromSerializedHook(indexed), owner)) deletes.push(record);
+				if (existingClaim !== void 0 && sameOwner(existingClaim.owner, owner)) {
+					deletes.push(claim);
+					deadlineDeletes.push(existingClaim.deadlineKey);
+				}
+			}
+			const deleted = deletes.length === 0 ? 0 : await txn.delete(deletes);
+			if (deadlineDeletes.length > 0) await txn.delete(deadlineDeletes);
+			return { deleted };
 		});
-		const names = Array.from(entries.keys());
-		const page = names.slice(0, limit);
-		const listComplete = names.length <= limit;
-		return {
-			keys: page.map((name) => ({ name })),
-			list_complete: listComplete,
-			cursor: listComplete ? void 0 : page.at(-1)
-		};
 	}
-	async reserveHookToken(token, owner) {
-		return this.ctx.storage.transaction(async (txn) => {
-			const indexedHook = await txn.get(`hook:${token}`);
-			if (indexedHook !== void 0) return {
+	async alarm() {
+		try {
+			await this.compactClaims();
+		} catch {
+			await this.ctx.storage.setAlarm(this.now() + LIFECYCLE_COMPACTION_RETRY_MS);
+		}
+	}
+	async armAtMost(storage, at) {
+		const current = await storage.getAlarm();
+		if (current === null || at < current) await storage.setAlarm(at);
+	}
+	async compactClaims() {
+		const now = this.now();
+		await this.ctx.storage.transaction(async (txn) => {
+			const due = await txn.list({
+				prefix: CLAIM_DEADLINE_PREFIX$1,
+				end: `${CLAIM_DEADLINE_PREFIX$1}${pad$3(now + 1)}`,
+				limit: 129
+			});
+			const page = Array.from(due).slice(0, 128);
+			const claims = await txn.get(page.map(([, item]) => claimKey$1(item.hookId)));
+			const deletes = page.flatMap(([deadline, item]) => {
+				const key = claimKey$1(item.hookId);
+				const claim = claims.get(key);
+				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
+			});
+			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
+			if (due.size > 128) {
+				await txn.setAlarm(now + 1);
+				return;
+			}
+			const nextAt = (await txn.list({
+				prefix: CLAIM_DEADLINE_PREFIX$1,
+				limit: 1
+			})).values().next().value?.expiresAt;
+			if (nextAt === void 0) await txn.deleteAlarm();
+			else await txn.setAlarm(Math.max(now + 1, nextAt));
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/HookTokenDO.ts
+const MAX_RELEASE_BATCH = 64;
+const CLAIM_DEADLINE_PREFIX = "claim-deadline:";
+function pad$2(ms) {
+	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
+}
+function recordKey(token) {
+	return indexKey("hook", token);
+}
+function claimKey(token) {
+	return indexKey("claim", token);
+}
+function claimDeadlineKey(token, expiresAt) {
+	return `${CLAIM_DEADLINE_PREFIX}${pad$2(expiresAt)}:${encodeURIComponent(token)}`;
+}
+/** Token-ownership shard. A token hashes to exactly one shard and transaction domain. */
+var HookTokenDO = class extends DurableObject {
+	now() {
+		return typeof this.env.clock === "function" ? this.env.clock() : Date.now();
+	}
+	async get(token) {
+		const raw = await this.ctx.storage.get(recordKey(token));
+		if (!raw) return null;
+		const owner = ownerFromSerializedHook(raw);
+		return await runIsActive(this.env, owner.runId) ? raw : null;
+	}
+	async reserve(token, owner, proposedClaimId) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey(token);
+			const claim = claimKey(token);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0) return {
 				claimed: false,
-				holder: ownerFromHook(indexedHook)
+				holder: ownerFromSerializedHook(indexed)
 			};
-			const claimKey = `hookclaim:${token}`;
-			const claim = await txn.get(claimKey);
-			if (claim !== void 0 && !sameOwner(claim.owner, owner)) return {
+			let existing = values.get(claim);
+			const now = this.now();
+			if (existing && existing.expiresAt <= now) {
+				await txn.delete([claim, existing.deadlineKey]);
+				existing = void 0;
+			}
+			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
 				claimed: false,
-				holder: claim.owner
+				holder: existing.owner
+			};
+			if (existing === void 0) {
+				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+				const deadlineKey = claimDeadlineKey(token, expiresAt);
+				await txn.put(claim, {
+					owner,
+					claimId: proposedClaimId,
+					reservedAt: now,
+					expiresAt,
+					deadlineKey
+				});
+				await txn.put(deadlineKey, {
+					token,
+					claimId: proposedClaimId,
+					expiresAt
+				});
+				await this.armAtMost(txn, expiresAt);
+				return {
+					claimed: true,
+					claimId: proposedClaimId
+				};
+			}
+			return {
+				claimed: true,
+				claimId: existing.claimId
 			};
-			await txn.put(claimKey, {
-				owner,
-				reservedAt: Date.now()
-			});
-			return { claimed: true };
 		});
 	}
-	async finalizeHookIndexes(token, hookId, serializedHook, owner) {
-		await this.ctx.storage.transaction(async (txn) => {
-			if (await txn.get(`expired:${owner.runId}`) !== void 0) {
-				const claim = await txn.get(`hookclaim:${token}`);
-				if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(`hookclaim:${token}`);
-				return;
+	async finalize(token, serializedHook, owner, claimId) {
+		if (!await runIsActive(this.env, owner.runId)) {
+			await this.releaseBatch([{
+				token,
+				owner
+			}]);
+			return { stored: false };
+		}
+		return await this.ctx.storage.transaction(async (txn) => {
+			const record = recordKey(token);
+			const claim = claimKey(token);
+			const values = await txn.get([record, claim]);
+			const indexed = values.get(record);
+			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
+			const existingClaim = values.get(claim);
+			if (existingClaim && existingClaim.expiresAt <= this.now()) {
+				await txn.delete([claim, existingClaim.deadlineKey]);
+				return { stored: false };
 			}
-			const indexedHook = await txn.get(`hook:${token}`);
-			if (indexedHook !== void 0 && !sameOwner(ownerFromHook(indexedHook), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
-			const claim = await txn.get(`hookclaim:${token}`);
-			if (claim !== void 0 && !sameOwner(claim.owner, owner)) throw new Error(`Hook token ${token} is reserved by another hook`);
-			await txn.put(`hook:${token}`, serializedHook);
-			await txn.put(`hookid:${hookId}`, serializedHook);
-			if (claim !== void 0) await txn.delete(`hookclaim:${token}`);
+			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook token ${token} is reserved by another hook`);
+			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook token ${token} has no active reservation`);
+			await txn.put(record, serializedHook);
+			if (existingClaim !== void 0) await txn.delete([claim, existingClaim.deadlineKey]);
+			return { stored: true };
 		});
 	}
-	async releaseHookToken(token, owner) {
+	async releaseClaim(token, owner, claimId) {
 		await this.ctx.storage.transaction(async (txn) => {
-			const key = `hookclaim:${token}`;
+			const key = claimKey(token);
 			const claim = await txn.get(key);
-			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(key);
+			if (claim && sameOwner(claim.owner, owner) && claim.claimId === claimId) await txn.delete([key, claim.deadlineKey]);
 		});
 	}
-	async deleteHookIndexes(token, hookId, owner) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const tokenKey = `hook:${token}`;
-			const idKey = `hookid:${hookId}`;
-			const claimKey = `hookclaim:${token}`;
-			const [byToken, byId, claim] = await Promise.all([
-				txn.get(tokenKey),
-				txn.get(idKey),
-				txn.get(claimKey)
-			]);
-			if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) await txn.delete(tokenKey);
-			if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) await txn.delete(idKey);
-			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(claimKey);
-		});
-	}
-	/**
-	* Fence a run and remove all of its known derived indexes atomically.
-	* Once the fence exists, putOwned() and hook finalization cannot resurrect
-	* entries from a delayed request.
-	*/
-	async expireRun(request) {
+	async releaseBatch(hooks) {
+		if (hooks.length > MAX_RELEASE_BATCH) throw new Error("Hook token release batch is too large");
+		if (hooks.length === 0) return { deleted: 0 };
 		return await this.ctx.storage.transaction(async (txn) => {
-			await txn.put(`expired:${request.runId}`, request.expiredAt);
-			let deleted = 0;
-			for (const key of new Set(request.keys)) if (await txn.delete(key)) deleted++;
-			for (const hook of request.hooks) {
-				const owner = {
-					runId: request.runId,
-					hookId: hook.hookId
-				};
-				const tokenKey = `hook:${hook.token}`;
-				const idKey = `hookid:${hook.hookId}`;
-				const claimKey = `hookclaim:${hook.token}`;
-				const [byToken, byId, claim] = await Promise.all([
-					txn.get(tokenKey),
-					txn.get(idKey),
-					txn.get(claimKey)
-				]);
-				if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) {
-					if (await txn.delete(tokenKey)) deleted++;
-				}
-				if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) {
-					if (await txn.delete(idKey)) deleted++;
-				}
-				if (claim !== void 0 && sameOwner(claim.owner, owner)) {
-					if (await txn.delete(claimKey)) deleted++;
+			const keys = hooks.flatMap(({ token }) => [recordKey(token), claimKey(token)]);
+			const values = await txn.get(keys);
+			const deletes = [];
+			const deadlineDeletes = [];
+			for (const { token, owner } of hooks) {
+				const record = recordKey(token);
+				const claim = claimKey(token);
+				const indexed = values.get(record);
+				const existingClaim = values.get(claim);
+				if (indexed !== void 0 && sameOwner(ownerFromSerializedHook(indexed), owner)) deletes.push(record);
+				if (existingClaim !== void 0 && sameOwner(existingClaim.owner, owner)) {
+					deletes.push(claim);
+					deadlineDeletes.push(existingClaim.deadlineKey);
 				}
 			}
+			const deleted = deletes.length === 0 ? 0 : await txn.delete(deletes);
+			if (deadlineDeletes.length > 0) await txn.delete(deadlineDeletes);
 			return { deleted };
 		});
 	}
+	async alarm() {
+		try {
+			await this.compactClaims();
+		} catch {
+			await this.ctx.storage.setAlarm(this.now() + LIFECYCLE_COMPACTION_RETRY_MS);
+		}
+	}
+	async armAtMost(storage, at) {
+		const current = await storage.getAlarm();
+		if (current === null || at < current) await storage.setAlarm(at);
+	}
+	async compactClaims() {
+		const now = this.now();
+		await this.ctx.storage.transaction(async (txn) => {
+			const due = await txn.list({
+				prefix: CLAIM_DEADLINE_PREFIX,
+				end: `${CLAIM_DEADLINE_PREFIX}${pad$2(now + 1)}`,
+				limit: 129
+			});
+			const page = Array.from(due).slice(0, 128);
+			const claims = await txn.get(page.map(([, item]) => claimKey(item.token)));
+			const deletes = page.flatMap(([deadline, item]) => {
+				const key = claimKey(item.token);
+				const claim = claims.get(key);
+				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
+			});
+			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
+			if (due.size > 128) {
+				await txn.setAlarm(now + 1);
+				return;
+			}
+			const nextAt = (await txn.list({
+				prefix: CLAIM_DEADLINE_PREFIX,
+				limit: 1
+			})).values().next().value?.expiresAt;
+			if (nextAt === void 0) await txn.deleteAlarm();
+			else await txn.setAlarm(Math.max(now + 1, nextAt));
+		});
+	}
 };
 //#endregion
 //#region src/worker/durable-objects/QueueDO.ts
@@ -625,15 +1100,26 @@ const PERMANENT_STATUSES = /* @__PURE__ */ new Set([
 const DEFAULT_MAX_ATTEMPTS = 5;
 const DEFAULT_MAX_INFLIGHT = 5;
 const DEFAULT_DELIVERY_TIMEOUT_MS = 3e5;
-/** Grace period past the delivery timeout before a claim counts as lost. */
-const INFLIGHT_GRACE_MS = 3e4;
 /** Move overdue alarms to a new timestamp so celld observes a fresh edge. */
 const MIN_ALARM_DELAY_MS = 1;
-function pad(ms) {
+/** Bound expiry recovery so one alarm cannot monopolize the cell. */
+const EXPIRED_INFLIGHT_BATCH = 128;
+const STORAGE_BATCH_SIZE$2 = 128;
+const EXPIRE_RUN_REFERENCE_BATCH = 64;
+const PURGE_DEAD_LETTER_BATCH = 128;
+const INFLIGHT_DEADLINE_PREFIX = "inflight-deadline:";
+const EXPIRED_RUN_GC_PREFIX = "expired-run-gc:";
+function pad$1(ms) {
 	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
 }
 function dueKey(atMs, messageId) {
-	return `due:${pad(atMs)}:${messageId}`;
+	return `due:${pad$1(atMs)}:${messageId}`;
+}
+function inflightKey(deadlineMs, messageId) {
+	return `${INFLIGHT_DEADLINE_PREFIX}${pad$1(deadlineMs)}:${messageId}`;
+}
+function deadlineFromInflightKey(key) {
+	return Number.parseInt(key.slice(18, 31), 10);
 }
 function runReferenceKey(runId, messageId) {
 	return `run:${runId}:${messageId}`;
@@ -641,9 +1127,40 @@ function runReferenceKey(runId, messageId) {
 function expiredRunKey(runId) {
 	return `expired-run:${runId}`;
 }
+function expiredRunGcKey(runId, compactAt) {
+	return `${EXPIRED_RUN_GC_PREFIX}${pad$1(compactAt)}:${encodeURIComponent(runId)}`;
+}
+function boundedLimit$1(value, fallback, maximum) {
+	if (value === void 0 || !Number.isFinite(value)) return fallback;
+	return Math.max(1, Math.min(maximum, Math.floor(value)));
+}
+async function getMany$1(storage, keys) {
+	const result = /* @__PURE__ */ new Map();
+	for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$2) {
+		const page = await storage.get(keys.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+		for (const [key, value] of page) result.set(key, value);
+	}
+	return result;
+}
+async function putMany(storage, entries) {
+	const all = Array.from(entries);
+	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE$2) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE$2)));
+}
+async function deleteMany$1(storage, keys) {
+	let deleted = 0;
+	const unique = Array.from(new Set(keys));
+	for (let offset = 0; offset < unique.length; offset += STORAGE_BATCH_SIZE$2) deleted += await storage.delete(unique.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+	return deleted;
+}
 function backoffSeconds(attempt) {
 	return Math.min(60, 2 ** attempt);
 }
+async function cancelUnusedResponseBody(response) {
+	try {
+		await response.body?.cancel();
+	} catch {}
+}
+const MAX_QUEUE_INFLIGHT = 128;
 var QueueDO = class extends DurableObject {
 	#now() {
 		const clock = this.env?.clock;
@@ -658,15 +1175,34 @@ var QueueDO = class extends DurableObject {
 		const parsed = raw ? Number.parseInt(raw, 10) : NaN;
 		return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 	}
+	#maxInflight() {
+		const configured = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		if (configured > MAX_QUEUE_INFLIGHT) throw new Error(`QUEUE_MAX_INFLIGHT must be at most ${MAX_QUEUE_INFLIGHT}`);
+		return configured;
+	}
+	#deliveryTimeoutMs() {
+		const configured = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+		if (configured > 3e5) throw new Error(`QUEUE_DELIVERY_TIMEOUT_MS must be at most ${MAX_QUEUE_DELIVERY_TIMEOUT_MS}`);
+		return configured;
+	}
+	async #authoritativeRunExpired(runId) {
+		const namespace = this.env?.WORKFLOW_DB;
+		if (!namespace) throw new Error("world-celld queue missing WORKFLOW_DB binding");
+		return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "expired";
+	}
+	async #withRunMutation(runId, onExpired, onAllowed) {
+		const expired = await this.#authoritativeRunExpired(runId);
+		return await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(expiredRunKey(runId)) || expired) return await onExpired(txn);
+			return await onAllowed(txn);
+		});
+	}
 	async enqueue(request) {
+		this.#maxInflight();
+		this.#deliveryTimeoutMs();
 		const storage = this.ctx.storage;
 		const now = this.#now();
-		return await storage.transaction(async (txn) => {
-			if (request.runId && await txn.get(expiredRunKey(request.runId)) !== void 0) return {
-				ok: false,
-				code: "RUN_EXPIRED",
-				message: `Workflow run "${request.runId}" has expired`
-			};
+		const persist = async (txn) => {
 			const pinned = await txn.get("cfg");
 			if (!pinned) await txn.put("cfg", {
 				queueShards: request.config.queueShards,
@@ -718,7 +1254,12 @@ var QueueDO = class extends DurableObject {
 				messageId: row.messageId,
 				deduped: false
 			};
-		});
+		};
+		return request.runId ? await this.#withRunMutation(request.runId, async () => ({
+			ok: false,
+			code: "RUN_EXPIRED",
+			message: `Workflow run "${request.runId}" has expired`
+		}), persist) : await storage.transaction(persist);
 	}
 	async alarm() {
 		let claimed = [];
@@ -732,8 +1273,11 @@ var QueueDO = class extends DurableObject {
 		};
 		if (typeof this.ctx.blockConcurrencyWhile === "function") await this.ctx.blockConcurrencyWhile(attempt);
 		else await attempt();
-		if (failure !== null) throw failure;
-		for (const row of claimed) this.ctx.waitUntil(this.#deliver(row));
+		if (failure !== null) {
+			await this.ctx.storage.setAlarm(this.#now() + LIFECYCLE_COMPACTION_RETRY_MS);
+			throw failure;
+		}
+		for (const claim of claimed) this.ctx.waitUntil(this.#deliver(claim));
 	}
 	/**
 	* Storage-only: recover lost inflight claims, claim due messages up to the
@@ -742,49 +1286,83 @@ var QueueDO = class extends DurableObject {
 	async #claimPhase() {
 		const storage = this.ctx.storage;
 		const now = this.#now();
-		const maxInflight = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		const maxInflight = this.#maxInflight();
 		return await storage.transaction(async (txn) => {
-			const inflight = await txn.list({ prefix: "inflight:" });
-			let inflightCount = 0;
-			for (const [key, deadline] of inflight) if (deadline <= now) {
-				const messageId = key.slice(9);
-				await txn.delete(key);
-				const row = await txn.get(`msg:${messageId}`);
+			if (await this.#compactExpiredRunFences(txn, now)) {
+				await txn.setAlarm(now + MIN_ALARM_DELAY_MS);
+				return [];
+			}
+			const expiredPage = await txn.list({
+				prefix: INFLIGHT_DEADLINE_PREFIX,
+				end: `${INFLIGHT_DEADLINE_PREFIX}${pad$1(now + 1)}`,
+				limit: 129
+			});
+			const expired = Array.from(expiredPage.entries()).slice(0, EXPIRED_INFLIGHT_BATCH);
+			const expiredRows = await getMany$1(txn, expired.map(([, messageId]) => `msg:${messageId}`));
+			await deleteMany$1(txn, expired.map(([key]) => key));
+			const recoveryWrites = [];
+			for (const [, messageId] of expired) {
+				const row = expiredRows.get(`msg:${messageId}`);
 				if (row) {
 					const scheduleKey = dueKey(now, messageId);
-					await txn.put(scheduleKey, messageId);
-					if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+					recoveryWrites.push([scheduleKey, messageId]);
+					if (row.runId) recoveryWrites.push([runReferenceKey(row.runId, row.messageId), {
 						messageId: row.messageId,
 						dueKey: scheduleKey,
 						idempotencyKey: row.idempotencyKey
-					});
+					}]);
 				}
-			} else inflightCount++;
+			}
+			await putMany(txn, recoveryWrites);
+			if (expiredPage.size > EXPIRED_INFLIGHT_BATCH) {
+				await txn.setAlarm(now + MIN_ALARM_DELAY_MS);
+				return [];
+			}
+			const inflightCount = (await txn.list({
+				prefix: INFLIGHT_DEADLINE_PREFIX,
+				limit: maxInflight
+			})).size;
 			const rows = [];
 			if (inflightCount < maxInflight) {
 				const due = await txn.list({
 					prefix: "due:",
-					end: `due:${pad(now + 1)}`,
+					end: `due:${pad$1(now + 1)}`,
 					limit: maxInflight - inflightCount
 				});
-				const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
-				for (const [key, messageId] of due) {
-					await txn.delete(key);
-					const row = await txn.get(`msg:${messageId}`);
+				const timeoutMs = this.#deliveryTimeoutMs();
+				const dueRows = await getMany$1(txn, Array.from(due.values(), (messageId) => `msg:${messageId}`));
+				await deleteMany$1(txn, Array.from(due.keys()));
+				const claimWrites = [];
+				for (const [, messageId] of due) {
+					const row = dueRows.get(`msg:${messageId}`);
 					if (!row) continue;
-					await txn.put(`inflight:${messageId}`, now + timeoutMs + INFLIGHT_GRACE_MS);
-					rows.push(row);
+					const claimKey = inflightKey(now + timeoutMs + QUEUE_INFLIGHT_GRACE_MS, messageId);
+					claimWrites.push([claimKey, messageId]);
+					if (row.runId) claimWrites.push([runReferenceKey(row.runId, row.messageId), {
+						messageId: row.messageId,
+						inflightKey: claimKey,
+						idempotencyKey: row.idempotencyKey
+					}]);
+					rows.push({
+						row,
+						inflightKey: claimKey
+					});
 				}
+				await putMany(txn, claimWrites);
 			}
 			await this.#scheduleNextAlarm(txn, now);
 			return rows;
 		});
 	}
-	async #deliver(row) {
+	async #deliver({ row, inflightKey: claimKey }) {
 		const storage = this.ctx.storage;
-		const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+		const timeoutMs = this.#deliveryTimeoutMs();
 		const callbackSecret = this.env?.WORKFLOW_CALLBACK_SECRET;
 		const url = `${row.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/${row.pathname}`;
+		if (row.runId && await this.#authoritativeRunExpired(row.runId)) {
+			await storage.transaction((txn) => this.#dropExpiredMessage(txn, row, claimKey, this.#now()));
+			return;
+		}
 		let response = null;
 		let transportError = null;
 		try {
@@ -804,47 +1382,44 @@ var QueueDO = class extends DurableObject {
 			transportError = error;
 		}
 		const now = this.#now();
-		if (response?.ok) await this.#ack(row);
-		else if (response && response.status === 503) {
+		if (response?.ok) {
+			await cancelUnusedResponseBody(response);
+			await this.#ack(row, claimKey);
+		} else if (response && response.status === 503) {
 			let timeoutSeconds;
 			try {
 				timeoutSeconds = (await response.json())?.timeoutSeconds;
 			} catch {
 				timeoutSeconds = void 0;
 			}
-			if (typeof timeoutSeconds === "number") await storage.transaction(async (txn) => {
-				if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
-					await txn.delete(`msg:${row.messageId}`);
-					await txn.delete(`inflight:${row.messageId}`);
-					await txn.delete(runReferenceKey(row.runId, row.messageId));
-					if (row.idempotencyKey) {
-						const dedupKey = `key:${row.idempotencyKey}`;
-						if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
-					}
+			if (typeof timeoutSeconds === "number") {
+				const reschedule = async (txn) => {
+					if (!await txn.delete(claimKey)) return;
+					const scheduleKey = dueKey(now + timeoutSeconds * 1e3, row.messageId);
+					await txn.put(scheduleKey, row.messageId);
+					if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+						messageId: row.messageId,
+						dueKey: scheduleKey,
+						idempotencyKey: row.idempotencyKey
+					});
 					await this.#scheduleNextAlarm(txn, now);
-					return;
-				}
-				await txn.delete(`inflight:${row.messageId}`);
-				const scheduleKey = dueKey(now + timeoutSeconds * 1e3, row.messageId);
-				await txn.put(scheduleKey, row.messageId);
-				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-					messageId: row.messageId,
-					dueKey: scheduleKey,
-					idempotencyKey: row.idempotencyKey
-				});
-				await this.#scheduleNextAlarm(txn, now);
-			});
-			else await this.#retry(row, "HTTP 503");
-		} else if (response && PERMANENT_STATUSES.has(response.status)) await this.#ack(row);
-		else {
+				};
+				if (row.runId) await this.#withRunMutation(row.runId, (txn) => this.#dropExpiredMessage(txn, row, claimKey, now), reschedule);
+				else await storage.transaction(reschedule);
+			} else await this.#retry(row, claimKey, "HTTP 503");
+		} else if (response && PERMANENT_STATUSES.has(response.status)) {
+			await cancelUnusedResponseBody(response);
+			await this.#ack(row, claimKey);
+		} else {
 			const reason = response ? `HTTP ${response.status}` : `transport error: ${String(transportError)}`;
-			await this.#retry(row, reason);
+			if (response) await cancelUnusedResponseBody(response);
+			await this.#retry(row, claimKey, reason);
 		}
 	}
-	async #ack(row) {
+	async #ack(row, claimKey) {
 		await this.ctx.storage.transaction(async (txn) => {
+			if (!await txn.delete(claimKey)) return;
 			await txn.delete(`msg:${row.messageId}`);
-			await txn.delete(`inflight:${row.messageId}`);
 			if (row.idempotencyKey) {
 				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
 			}
@@ -852,24 +1427,23 @@ var QueueDO = class extends DurableObject {
 			await this.#scheduleNextAlarm(txn, this.#now());
 		});
 	}
-	async #retry(row, reason) {
+	async #dropExpiredMessage(txn, row, claimKey, now) {
+		if (!await txn.delete(claimKey)) return;
+		await txn.delete(`msg:${row.messageId}`);
+		if (row.runId) await txn.delete(runReferenceKey(row.runId, row.messageId));
+		if (row.idempotencyKey) {
+			const dedupKey = `key:${row.idempotencyKey}`;
+			if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
+		}
+		await this.#scheduleNextAlarm(txn, now);
+	}
+	async #retry(row, claimKey, reason) {
 		const storage = this.ctx.storage;
 		const now = this.#now();
 		const maxAttempts = this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
 		const attempt = row.attempt + 1;
-		await storage.transaction(async (txn) => {
-			if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
-				await txn.delete(`msg:${row.messageId}`);
-				await txn.delete(`inflight:${row.messageId}`);
-				await txn.delete(runReferenceKey(row.runId, row.messageId));
-				if (row.idempotencyKey) {
-					const dedupKey = `key:${row.idempotencyKey}`;
-					if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
-				}
-				await this.#scheduleNextAlarm(txn, now);
-				return;
-			}
-			await txn.delete(`inflight:${row.messageId}`);
+		const persistRetry = async (txn) => {
+			if (!await txn.delete(claimKey)) return;
 			if (attempt >= maxAttempts) {
 				const dead = {
 					...row,
@@ -877,7 +1451,7 @@ var QueueDO = class extends DurableObject {
 					lastError: reason,
 					failedAt: now
 				};
-				const deadKey = `dlq:${pad(now)}:${row.messageId}`;
+				const deadKey = `dlq:${pad$1(now)}:${row.messageId}`;
 				await txn.put(deadKey, dead);
 				await txn.delete(`msg:${row.messageId}`);
 				if (row.idempotencyKey) {
@@ -905,7 +1479,32 @@ var QueueDO = class extends DurableObject {
 				idempotencyKey: row.idempotencyKey
 			});
 			await this.#scheduleNextAlarm(txn, now);
+		};
+		if (row.runId) await this.#withRunMutation(row.runId, (txn) => this.#dropExpiredMessage(txn, row, claimKey, now), persistRetry);
+		else await storage.transaction(persistRetry);
+	}
+	/** Return true when another due compaction page must run immediately. */
+	async #compactExpiredRunFences(txn, now) {
+		const due = await txn.list({
+			prefix: EXPIRED_RUN_GC_PREFIX,
+			end: `${EXPIRED_RUN_GC_PREFIX}${pad$1(now + 1)}`,
+			limit: 129
 		});
+		const page = Array.from(due).slice(0, 128);
+		if (page.length === 0) return false;
+		const markerKeys = page.map(([, item]) => expiredRunKey(item.runId));
+		const markers = await getMany$1(txn, markerKeys);
+		const deletes = [];
+		for (let index = 0; index < page.length; index++) {
+			const [gcKey, item] = page[index];
+			const markerKey = markerKeys[index];
+			const marker = markers.get(markerKey);
+			deletes.push(gcKey);
+			if (marker?.compactAt !== item.compactAt) continue;
+			deletes.push(markerKey);
+		}
+		await deleteMany$1(txn, deletes);
+		return due.size > 128;
 	}
 	/** Arm the alarm no later than `atMs` (durable backoff never throws). */
 	async #armAlarmAtMost(storage, atMs, now) {
@@ -929,8 +1528,19 @@ var QueueDO = class extends DurableObject {
 			limit: 1
 		});
 		for (const key of due.keys()) next = Number.parseInt(key.slice(4, 17), 10);
-		const inflight = await storage.list({ prefix: "inflight:" });
-		for (const deadline of inflight.values()) if (next === null || deadline < next) next = deadline;
+		const inflight = await storage.list({
+			prefix: INFLIGHT_DEADLINE_PREFIX,
+			limit: 1
+		});
+		for (const key of inflight.keys()) {
+			const deadline = deadlineFromInflightKey(key);
+			if (next === null || deadline < next) next = deadline;
+		}
+		const expiryGc = await storage.list({
+			prefix: EXPIRED_RUN_GC_PREFIX,
+			limit: 1
+		});
+		for (const item of expiryGc.values()) if (next === null || item.compactAt < next) next = item.compactAt;
 		if (next !== null) await storage.setAlarm(next <= now ? now + MIN_ALARM_DELAY_MS : next);
 		else await storage.deleteAlarm();
 	}
@@ -938,7 +1548,7 @@ var QueueDO = class extends DurableObject {
 		const storage = this.ctx.storage;
 		const [due, inflight, dlq, alarmAt] = await Promise.all([
 			storage.list({ prefix: "due:" }),
-			storage.list({ prefix: "inflight:" }),
+			storage.list({ prefix: INFLIGHT_DEADLINE_PREFIX }),
 			storage.list({ prefix: "dlq:" }),
 			storage.getAlarm()
 		]);
@@ -969,47 +1579,55 @@ var QueueDO = class extends DurableObject {
 	async redriveDeadLetter(messageId) {
 		const storage = this.ctx.storage;
 		const now = this.#now();
-		return await storage.transaction(async (txn) => {
-			const dlq = await txn.list({ prefix: "dlq:" });
-			for (const [key, dead] of dlq) {
-				if (dead.messageId !== messageId) continue;
-				const { failedAt: _failedAt, ...rest } = dead;
-				const row = {
-					...rest,
-					attempt: 0,
-					lastError: void 0
-				};
-				if (row.idempotencyKey) {
-					const dedupKey = `key:${row.idempotencyKey}`;
-					const holder = await txn.get(dedupKey);
-					if (holder && holder !== row.messageId && await txn.get(`msg:${holder}`)) return { ok: false };
-					if (holder && holder !== row.messageId) await txn.delete(dedupKey);
-					await txn.put(dedupKey, row.messageId);
-				}
-				await txn.put(`msg:${row.messageId}`, row);
-				const scheduleKey = dueKey(now, row.messageId);
-				await txn.put(scheduleKey, row.messageId);
-				await txn.delete(key);
-				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-					messageId: row.messageId,
-					dueKey: scheduleKey,
-					idempotencyKey: row.idempotencyKey
-				});
-				await this.#armAlarmAtMost(txn, now, now);
-				return { ok: true };
+		const found = Array.from(await storage.list({ prefix: "dlq:" })).find(([, dead]) => dead.messageId === messageId);
+		if (!found) return { ok: false };
+		const [deadKey, candidate] = found;
+		const redrive = async (txn) => {
+			const dead = await txn.get(deadKey);
+			if (!dead || dead.messageId !== messageId) return { ok: false };
+			const { failedAt: _failedAt, ...rest } = dead;
+			const row = {
+				...rest,
+				attempt: 0,
+				lastError: void 0
+			};
+			if (row.idempotencyKey) {
+				const dedupKey = `key:${row.idempotencyKey}`;
+				const holder = await txn.get(dedupKey);
+				if (holder && holder !== row.messageId && await txn.get(`msg:${holder}`)) return { ok: false };
+				if (holder && holder !== row.messageId) await txn.delete(dedupKey);
+				await txn.put(dedupKey, row.messageId);
 			}
+			await txn.put(`msg:${row.messageId}`, row);
+			const scheduleKey = dueKey(now, row.messageId);
+			await txn.put(scheduleKey, row.messageId);
+			await txn.delete(deadKey);
+			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+				messageId: row.messageId,
+				dueKey: scheduleKey,
+				idempotencyKey: row.idempotencyKey
+			});
+			await this.#armAlarmAtMost(txn, now, now);
+			return { ok: true };
+		};
+		const rejectExpired = async (txn) => {
+			if ((await txn.get(deadKey))?.messageId === messageId) await txn.delete([deadKey, runReferenceKey(candidate.runId, messageId)]);
 			return { ok: false };
-		});
+		};
+		return candidate.runId ? await this.#withRunMutation(candidate.runId, rejectExpired, redrive) : await storage.transaction(redrive);
 	}
 	async purgeDeadLetters() {
 		return await this.ctx.storage.transaction(async (txn) => {
-			const dlq = await txn.list({ prefix: "dlq:" });
-			for (const [key, value] of dlq) {
-				await txn.delete(key);
-				const dead = value;
-				if (dead.runId) await txn.delete(runReferenceKey(dead.runId, dead.messageId));
-			}
-			return { purged: dlq.size };
+			const entries = await txn.list({
+				prefix: "dlq:",
+				limit: 129
+			});
+			const page = Array.from(entries).slice(0, PURGE_DEAD_LETTER_BATCH);
+			await deleteMany$1(txn, page.flatMap(([key, dead]) => [key, ...dead.runId ? [runReferenceKey(dead.runId, dead.messageId)] : []]));
+			return {
+				purged: page.length,
+				hasMore: entries.size > PURGE_DEAD_LETTER_BATCH
+			};
 		});
 	}
 	/**
@@ -1021,140 +1639,450 @@ var QueueDO = class extends DurableObject {
 		return { alarmAt: await this.ctx.storage.getAlarm() };
 	}
 	/** Fence a run and purge every live, inflight, and dead-letter message it owns. */
-	async expireRun(runId, expiredAt) {
-		return { deleted: await this.ctx.storage.transaction(async (txn) => {
+	async expireRun(runId, expiredAt, options) {
+		const storage = this.ctx.storage;
+		const limit = boundedLimit$1(options?.limit, EXPIRE_RUN_REFERENCE_BATCH, EXPIRE_RUN_REFERENCE_BATCH);
+		return await storage.transaction(async (txn) => {
 			const existing = await txn.get(expiredRunKey(runId));
-			const references = await txn.list({ prefix: `run:${runId}:` });
+			const references = await txn.list({
+				prefix: `run:${runId}:`,
+				limit: limit + 1
+			});
+			const page = Array.from(references).slice(0, limit);
+			const dedupHolders = await getMany$1(txn, page.flatMap(([, reference]) => reference.idempotencyKey ? [`key:${reference.idempotencyKey}`] : []));
+			const keys = [];
 			let count = existing?.deleted ?? 0;
-			for (const [key, reference] of references) {
-				await txn.delete(`msg:${reference.messageId}`);
-				await txn.delete(`inflight:${reference.messageId}`);
-				if (reference.dueKey) await txn.delete(reference.dueKey);
-				if (reference.dlqKey) await txn.delete(reference.dlqKey);
+			for (const [key, reference] of page) {
+				keys.push(`msg:${reference.messageId}`, key);
+				if (reference.inflightKey) keys.push(reference.inflightKey);
+				if (reference.dueKey) keys.push(reference.dueKey);
+				if (reference.dlqKey) keys.push(reference.dlqKey);
 				if (reference.idempotencyKey) {
 					const dedupKey = `key:${reference.idempotencyKey}`;
-					if (await txn.get(dedupKey) === reference.messageId) await txn.delete(dedupKey);
+					if (dedupHolders.get(dedupKey) === reference.messageId) keys.push(dedupKey);
 				}
-				await txn.delete(key);
 				count++;
 			}
+			await deleteMany$1(txn, keys);
+			const done = references.size <= limit;
+			const markerExpiredAt = existing?.expiredAt ?? expiredAt;
 			await txn.put(expiredRunKey(runId), {
-				expiredAt,
-				deleted: count
+				expiredAt: markerExpiredAt,
+				deleted: count,
+				compactAt: existing?.compactAt ?? null
 			});
 			await this.#scheduleNextAlarm(txn, this.#now());
-			return count;
-		}) };
+			return done ? {
+				deleted: count,
+				done: true,
+				receipt: {
+					expiredAt: markerExpiredAt,
+					deleted: count
+				}
+			} : {
+				deleted: count,
+				done: false
+			};
+		});
+	}
+	/** Acknowledge a final cleanup receipt before making its marker compactable. */
+	async acknowledgeExpireRun(runId, receipt) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const key = expiredRunKey(runId);
+			const marker = await txn.get(key);
+			if (!marker) return { acknowledged: true };
+			if (marker.expiredAt !== receipt.expiredAt || marker.deleted !== receipt.deleted) return { acknowledged: false };
+			if (marker.compactAt === null) {
+				const compactAt = this.#now() + QUEUE_FENCE_GRACE_MS;
+				await txn.put(key, {
+					...marker,
+					compactAt
+				});
+				await txn.put(expiredRunGcKey(runId, compactAt), {
+					runId,
+					compactAt
+				});
+			}
+			await this.#scheduleNextAlarm(txn, this.#now());
+			return { acknowledged: true };
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/RunCatalogDO.ts
+const MAX_INDEX_LIST_SIZE = 1001;
+const EXPIRY_GC_PREFIX = "expiry-gc:";
+function pad(ms) {
+	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
+}
+function expiredKey(runId) {
+	return `expired:${runId}`;
+}
+function expiryGcKey(runId, compactAt) {
+	return `${EXPIRY_GC_PREFIX}${pad(compactAt)}:${encodeURIComponent(runId)}`;
+}
+/** One of a fixed set of run-catalog shards, routed by the stable run ID hash. */
+var RunCatalogDO = class extends DurableObject {
+	now() {
+		const clock = this.env?.clock;
+		return typeof clock === "function" ? clock() : Date.now();
+	}
+	async upsertRun(runId, keys, serializedMetadata, publicationExpiresAt) {
+		if (keys.length !== 2) throw new Error("Run catalog commit requires exactly two keys");
+		return await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(expiredKey(runId)) !== void 0) return { stored: false };
+			const now = this.now();
+			if (!Number.isSafeInteger(publicationExpiresAt) || publicationExpiresAt <= now || publicationExpiresAt > now + 1200900) return { stored: false };
+			await txn.put(Object.fromEntries(keys.map((key) => [key, serializedMetadata])));
+			return { stored: true };
+		});
+	}
+	async list(options = {}) {
+		const suppliedLimit = options.limit;
+		const limit = Math.min(MAX_INDEX_LIST_SIZE, Math.max(1, typeof suppliedLimit === "number" && Number.isFinite(suppliedLimit) ? Math.floor(suppliedLimit) : MAX_INDEX_LIST_SIZE));
+		const entries = await this.ctx.storage.list({
+			prefix: options.prefix ?? "",
+			...options.reverse ? {
+				reverse: true,
+				end: options.cursor
+			} : { startAfter: options.cursor },
+			limit: limit + 1
+		});
+		const page = Array.from(entries).slice(0, limit);
+		const listComplete = entries.size <= limit;
+		return {
+			keys: page.map(([name, value]) => ({
+				name,
+				value
+			})),
+			list_complete: listComplete,
+			cursor: listComplete ? void 0 : page.at(-1)?.[0]
+		};
+	}
+	async expireRun(runId, keys, expiredAt) {
+		if (keys.length !== 2) throw new Error("Run catalog expiry requires exactly two keys");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const marker = expiredKey(runId);
+			const compactAt = (await txn.get(marker))?.compactAt ?? this.now() + 1200900;
+			await txn.put(marker, {
+				expiredAt,
+				compactAt
+			});
+			await txn.put(expiryGcKey(runId, compactAt), {
+				runId,
+				compactAt
+			});
+			await this.armAtMost(txn, compactAt);
+			return { deleted: await txn.delete(keys) };
+		});
+	}
+	async alarm() {
+		try {
+			await this.compactExpiryFences();
+		} catch {
+			await this.ctx.storage.setAlarm(this.now() + LIFECYCLE_COMPACTION_RETRY_MS);
+		}
+	}
+	async armAtMost(storage, at) {
+		const current = await storage.getAlarm();
+		if (current === null || at < current) await storage.setAlarm(at);
+	}
+	async compactExpiryFences() {
+		const now = this.now();
+		await this.ctx.storage.transaction(async (txn) => {
+			const due = await txn.list({
+				prefix: EXPIRY_GC_PREFIX,
+				end: `${EXPIRY_GC_PREFIX}${pad(now + 1)}`,
+				limit: 129
+			});
+			const page = Array.from(due).slice(0, 128);
+			const markerKeys = page.map(([, item]) => expiredKey(item.runId));
+			const markers = await txn.get(markerKeys);
+			const deletes = page.flatMap(([key, item], index) => {
+				return markers.get(markerKeys[index])?.compactAt === item.compactAt ? [key, markerKeys[index]] : [key];
+			});
+			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
+			if (due.size > 128) {
+				await txn.setAlarm(now + 1);
+				return;
+			}
+			const nextAt = (await txn.list({
+				prefix: EXPIRY_GC_PREFIX,
+				limit: 1
+			})).values().next().value?.compactAt;
+			if (nextAt === void 0) await txn.deleteAlarm();
+			else await txn.setAlarm(Math.max(now + 1, nextAt));
+		});
 	}
 };
 //#endregion
 //#region src/worker/durable-objects/StreamDO.ts
 const META_KEY = "meta";
 const CHUNK_KEY_PREFIX = "chunk:";
+const CHUNK_SIZE_KEY_PREFIX = "chunk-size:";
 /** Registry keys used when this DO instance acts as a per-run stream index. */
 const STREAM_REGISTRY_PREFIX = "stream:";
 const REGISTRY_OWNER_KEY = "registry:owner";
 const REGISTRY_EXPIRED_KEY = "registry:expired";
-/**
-* Zero-pad chunk indexes so `storage.list({ prefix })` returns chunks in
-* write order. 12 digits comfortably exceeds any realistic chunk count.
-*/
+/** Each chunk occupies a payload key and a size key; one delete accepts at most 128 keys. */
+const DEFAULT_EXPIRE_CHUNK_LIMIT = 64;
+const MAX_EXPIRE_CHUNK_LIMIT = 64;
+/** Bound storage deletion work as well as item count; one oversized chunk still makes progress. */
+const DEFAULT_EXPIRE_BYTE_LIMIT = 16777216;
+const MAX_EXPIRE_BYTE_LIMIT = DEFAULT_EXPIRE_BYTE_LIMIT;
+function boundedLimit(value, fallback, maximum) {
+	if (value === void 0 || !Number.isFinite(value)) return fallback;
+	return Math.max(1, Math.min(maximum, Math.floor(value)));
+}
+function emptyMeta() {
+	return {
+		count: 0,
+		state: "open"
+	};
+}
+function validateMeta(meta) {
+	if (!Number.isSafeInteger(meta.count) || meta.count < 0 || meta.count > 2147483647 || ![
+		"open",
+		"closed",
+		"errored",
+		"expired"
+	].includes(meta.state)) throw new Error("Invalid persisted stream metadata");
+	if (meta.state === "errored" && !meta.error) throw new Error("Invalid persisted stream error metadata");
+	return meta;
+}
+/** Zero-padding keeps storage.list() results in stream offset order. */
 function chunkKey(index) {
 	return `${CHUNK_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
 }
+function chunkSizeKey(index) {
+	return `${CHUNK_SIZE_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
+}
+function indexFromChunkSizeKey(key) {
+	const suffix = key.slice(11);
+	const index = Number(suffix);
+	if (!/^\d{12}$/.test(suffix) || !Number.isSafeInteger(index) || index < 0) throw new Error(`Invalid persisted stream chunk size key "${key}"`);
+	return index;
+}
+function validateChunkSize(size, index) {
+	if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > 1048576) throw new Error(`Invalid persisted stream chunk size at index ${index}`);
+	return size;
+}
+function compactChunk(chunk) {
+	return chunk.byteOffset === 0 && chunk.byteLength === chunk.buffer.byteLength ? chunk : new Uint8Array(chunk);
+}
+function abortReason(signal) {
+	return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
 /**
 * Durable Object backing workflow streams.
 *
-* Two roles, selected by the DO name:
-* - `stream:<name>`: chunk storage for a single stream. A monotonic
-*   per-stream counter (maintained transactionally inside the DO) assigns
-*   each chunk its index; one chunk per storage key.
-* - `run-streams:<runId>`: registry of stream names owned by a run,
-*   powering `listStreamsByRunId`.
+* Stream cells persist binary chunks under monotonic offset keys. Public
+* reads are bounded long polls, and writes append a bounded ordered batch in
+* one storage transaction. Per-run registry cells retain their existing role.
 */
 var StreamDO = class extends DurableObject {
+	meta;
+	metaLoad;
+	mutationTail = Promise.resolve();
+	changeVersion = 0;
+	waiters = /* @__PURE__ */ new Set();
 	async getMeta() {
-		return await this.ctx.storage.get(META_KEY) ?? {
-			count: 0,
-			closed: false
-		};
+		if (this.meta) return this.meta;
+		this.metaLoad ??= this.ctx.storage.get(META_KEY).then((meta) => {
+			const loaded = meta ? validateMeta(meta) : emptyMeta();
+			this.meta = loaded;
+			return loaded;
+		});
+		try {
+			return await this.metaLoad;
+		} catch (error) {
+			this.metaLoad = void 0;
+			throw error;
+		}
 	}
 	assertOwner(meta, runId) {
-		if (meta.expiredAt !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
+		if (!runId) throw new Error("Stream runId is required");
 		if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
 	}
-	/**
-	* Append a chunk. The index is allocated inside the transaction, so
-	* concurrent writers can never collide or skip.
-	*/
-	async writeChunk(runId, data) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
-			};
-			this.assertOwner(meta, runId);
-			if (meta.closed) throw new Error("Cannot write to a closed stream");
-			const index = meta.count;
-			await txn.put(chunkKey(index), data);
-			await txn.put(META_KEY, {
-				count: index + 1,
-				closed: false,
-				ownerRunId: runId
+	assertWritable(meta, runId) {
+		this.assertOwner(meta, runId);
+		if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+		if (meta.state === "closed") throw new Error("Cannot write to a closed stream");
+		if (meta.state === "errored") throw new Error("Cannot write to an errored stream");
+	}
+	runMutation(operation) {
+		const result = this.mutationTail.then(operation, operation);
+		this.mutationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	wakeReaders() {
+		this.changeVersion += 1;
+		for (const waiter of Array.from(this.waiters)) waiter.resolve("change");
+	}
+	waitForChange(observedVersion, waitMs, signal) {
+		if (signal?.aborted) return Promise.reject(abortReason(signal));
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const waiter = {
+				timer: setTimeout(() => finish("timeout"), waitMs),
+				signal,
+				resolve: (reason) => finish(reason)
+			};
+			const cleanup = () => {
+				clearTimeout(waiter.timer);
+				this.waiters.delete(waiter);
+				if (waiter.signal && waiter.onAbort) waiter.signal.removeEventListener("abort", waiter.onAbort);
+			};
+			const finish = (reason) => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				resolve(reason);
+			};
+			waiter.onAbort = () => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				reject(abortReason(signal));
+			};
+			this.waiters.add(waiter);
+			signal?.addEventListener("abort", waiter.onAbort, { once: true });
+			if (this.changeVersion !== observedVersion) finish("change");
+		});
+	}
+	async readSnapshot(request, timedOut) {
+		const meta = await this.getMeta();
+		this.assertOwner(meta, request.runId);
+		const available = meta.state === "expired" ? 0 : Math.max(0, Math.min(request.maxChunks, meta.count - request.startIndex));
+		const chunks = [];
+		if (available > 0) {
+			const indexes = Array.from({ length: available }, (_, offset) => request.startIndex + offset);
+			const sizeKeys = indexes.map(chunkSizeKey);
+			const storedSizes = await this.ctx.storage.get(sizeKeys);
+			const selectedIndexes = [];
+			const selectedSizes = [];
+			let bytes = 0;
+			for (const index of indexes) {
+				const size = validateChunkSize(storedSizes.get(chunkSizeKey(index)), index);
+				if (bytes + size > request.maxBytes) break;
+				selectedIndexes.push(index);
+				selectedSizes.push(size);
+				bytes += size;
+			}
+			const payloadKeys = selectedIndexes.map(chunkKey);
+			const storedChunks = await this.ctx.storage.get(payloadKeys);
+			for (let offset = 0; offset < payloadKeys.length; offset++) {
+				const chunk = storedChunks.get(payloadKeys[offset]);
+				if (!(chunk instanceof Uint8Array) || chunk.byteLength !== selectedSizes[offset]) throw new Error(`Invalid persisted stream chunk at index ${selectedIndexes[offset]}`);
+				chunks.push(chunk);
+			}
+		}
+		return {
+			startIndex: request.startIndex,
+			tailIndex: meta.count - 1,
+			chunks,
+			state: meta.state,
+			timedOut,
+			error: meta.error
+		};
+	}
+	/** Append one bounded binary batch with contiguous indexes. */
+	async writeChunks(runId, chunks) {
+		validateStreamWriteChunks(chunks);
+		const storedChunks = chunks.map(compactChunk);
+		return await this.runMutation(async () => {
+			const committed = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertWritable(meta, runId);
+				const startIndex = meta.count;
+				if (startIndex + chunks.length > 2147483647) throw new Error("Stream offset limit exceeded");
+				const nextMeta = {
+					count: startIndex + chunks.length,
+					state: "open",
+					ownerRunId: runId
+				};
+				const entries = { [META_KEY]: nextMeta };
+				for (let offset = 0; offset < storedChunks.length; offset++) {
+					const index = startIndex + offset;
+					entries[chunkKey(index)] = storedChunks[offset];
+					entries[chunkSizeKey(index)] = storedChunks[offset].byteLength;
+				}
+				await txn.put(entries);
+				return {
+					meta: nextMeta,
+					result: {
+						startIndex,
+						count: chunks.length,
+						tailIndex: nextMeta.count - 1
+					}
+				};
 			});
-			return index;
+			this.meta = committed.meta;
+			this.metaLoad = Promise.resolve(committed.meta);
+			this.wakeReaders();
+			return committed.result;
 		});
 	}
 	/**
-	* Close the stream (idempotent). Readers observe `done: true` once all
-	* previously written chunks have been consumed.
+	* Return available binary chunks and terminal metadata in one bounded
+	* operation, waiting at most waitMs when the requested offset is idle.
 	*/
+	async readChunks(request, signal) {
+		validateStreamReadRequest(request);
+		const observedVersion = this.changeVersion;
+		const immediate = await this.readSnapshot(request, false);
+		if (immediate.chunks.length > 0 || immediate.state !== "open" || request.waitMs === 0 || request.maxChunks === 0) return immediate;
+		const reason = await this.waitForChange(observedVersion, request.waitMs, signal);
+		return await this.readSnapshot(request, reason === "timeout");
+	}
+	/** Close idempotently; the first terminal state wins. */
 	async closeStream(runId) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
-			};
-			this.assertOwner(meta, runId);
-			await txn.put(META_KEY, {
-				...meta,
-				ownerRunId: runId,
-				closed: true
+		await this.runMutation(async () => {
+			const nextMeta = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+				if (meta.state !== "open") return meta;
+				const closed = {
+					...meta,
+					ownerRunId: runId,
+					state: "closed"
+				};
+				await txn.put(META_KEY, closed);
+				return closed;
 			});
+			this.meta = nextMeta;
+			this.metaLoad = Promise.resolve(nextMeta);
+			this.wakeReaders();
 		});
 	}
-	/**
-	* Read up to `limit` chunks starting at `startIndex` (0-based, inclusive).
-	*/
-	async getChunks(params) {
-		const meta = await this.getMeta();
-		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
-		const start = Math.max(0, params.startIndex);
-		const entries = await this.ctx.storage.list({
-			prefix: CHUNK_KEY_PREFIX,
-			start: chunkKey(start),
-			limit: params.limit
+	/** Persist a terminal stream failure and wake every pending reader. */
+	async failStream(runId, error) {
+		const normalized = normalizeStreamError(error);
+		await this.runMutation(async () => {
+			const nextMeta = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				if (meta.state === "expired") throw new Error(`Workflow run "${runId}" has expired`);
+				if (meta.state !== "open") return meta;
+				const failed = {
+					...meta,
+					ownerRunId: runId,
+					state: "errored",
+					error: normalized
+				};
+				await txn.put(META_KEY, failed);
+				return failed;
+			});
+			this.meta = nextMeta;
+			this.metaLoad = Promise.resolve(nextMeta);
+			this.wakeReaders();
 		});
-		return {
-			chunks: Array.from(entries.values()),
-			done: meta.closed,
-			tailIndex: meta.count - 1
-		};
-	}
-	/**
-	* Lightweight stream metadata: last chunk index and completion flag.
-	*/
-	async getInfo() {
-		const meta = await this.getMeta();
-		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
-		return {
-			tailIndex: meta.count - 1,
-			done: meta.closed
-		};
 	}
-	/**
-	* Register a stream name against this per-run registry instance.
-	*/
+	/** Register a stream name against this per-run registry instance. */
 	async registerStream(runId, name) {
 		await this.ctx.storage.transaction(async (txn) => {
 			if (await txn.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
@@ -1164,57 +2092,124 @@ var StreamDO = class extends DurableObject {
 			await txn.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
 		});
 	}
-	/**
-	* List stream names registered against this per-run registry instance.
-	*/
 	async listStreams() {
 		if (await this.ctx.storage.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error("Workflow run streams have expired");
 		const entries = await this.ctx.storage.list({ prefix: STREAM_REGISTRY_PREFIX });
 		return Array.from(entries.keys()).map((key) => key.slice(7));
 	}
 	/** Fence a run's registry before any stream cells are removed. */
-	async expireRegistry(runId, expiredAt) {
+	async expireRegistry(runId, expiredAt, options) {
+		const limit = boundedLimit(options?.limit, 16, 128);
 		return await this.ctx.storage.transaction(async (txn) => {
-			const owner = await txn.get(REGISTRY_OWNER_KEY);
+			const state = await txn.get([REGISTRY_OWNER_KEY, REGISTRY_EXPIRED_KEY]);
+			const owner = state.get(REGISTRY_OWNER_KEY);
 			if (owner !== void 0 && owner !== runId) throw new Error(`Stream registry is owned by workflow run "${owner}"`);
-			await txn.put(REGISTRY_OWNER_KEY, runId);
-			await txn.put(REGISTRY_EXPIRED_KEY, expiredAt);
-			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
+			const expiry = state.get(REGISTRY_EXPIRED_KEY);
+			await txn.put({
+				[REGISTRY_OWNER_KEY]: runId,
+				[REGISTRY_EXPIRED_KEY]: expiry ?? {
+					expiredAt,
+					deleted: 0
+				}
+			});
+			const entries = await txn.list({
+				prefix: STREAM_REGISTRY_PREFIX,
+				limit
+			});
 			return { streams: Array.from(entries.keys()).map((key) => key.slice(7)) };
 		});
 	}
-	/** Remove the registry payload after every referenced stream was fenced. */
-	async finalizeRegistry(runId) {
-		await this.ctx.storage.transaction(async (txn) => {
-			const owner = await txn.get(REGISTRY_OWNER_KEY);
-			const expiredAt = await txn.get(REGISTRY_EXPIRED_KEY);
-			if (owner !== runId || expiredAt === void 0) throw new Error(`Stream registry for workflow run "${runId}" is not expired`);
-			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
-			for (const key of entries.keys()) await txn.delete(key);
-		});
-	}
-	/** Delete stream payload while leaving a small ownership tombstone. */
-	async expireStream(runId, expiredAt) {
+	/** Remove completed registry entries in a bounded, retry-safe batch. */
+	async finalizeRegistry(runId, streams) {
 		return await this.ctx.storage.transaction(async (txn) => {
-			const meta = await txn.get(META_KEY) ?? {
-				count: 0,
-				closed: false
-			};
-			if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
-			const chunks = await txn.list({ prefix: CHUNK_KEY_PREFIX });
-			for (const key of chunks.keys()) await txn.delete(key);
-			await txn.put(META_KEY, {
-				count: 0,
-				closed: true,
-				ownerRunId: runId,
-				expiredAt
+			const state = await txn.get([REGISTRY_OWNER_KEY, REGISTRY_EXPIRED_KEY]);
+			const owner = state.get(REGISTRY_OWNER_KEY);
+			const expiry = state.get(REGISTRY_EXPIRED_KEY);
+			if (owner !== runId || expiry === void 0) throw new Error(`Stream registry for workflow run "${runId}" is not expired`);
+			const keys = Array.from(new Set(streams.map((name) => `${STREAM_REGISTRY_PREFIX}${name}`)));
+			const removed = keys.length === 0 ? 0 : await txn.delete(keys);
+			const deleted = expiry.deleted + removed;
+			await txn.put(REGISTRY_EXPIRED_KEY, {
+				...expiry,
+				deleted
 			});
 			return {
-				deleted: true,
-				chunks: chunks.size
+				deleted,
+				done: (await txn.list({
+					prefix: STREAM_REGISTRY_PREFIX,
+					limit: 1
+				})).size === 0
 			};
 		});
 	}
+	/**
+	* Fence the stream and delete one bounded page. Listing size keys avoids
+	* loading payloads, and the transaction makes a crash retry resume safely.
+	*/
+	async expireStream(runId, expiredAt, options) {
+		const limit = boundedLimit(options?.limit, DEFAULT_EXPIRE_CHUNK_LIMIT, MAX_EXPIRE_CHUNK_LIMIT);
+		const byteLimit = boundedLimit(options?.byteLimit, DEFAULT_EXPIRE_BYTE_LIMIT, MAX_EXPIRE_BYTE_LIMIT);
+		return await this.runMutation(async () => {
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const stored = await txn.get(META_KEY);
+				const meta = stored ? validateMeta(stored) : emptyMeta();
+				this.assertOwner(meta, runId);
+				const firstFence = meta.state !== "expired";
+				if (meta.state === "expired" && meta.payloadDeleted) return {
+					meta,
+					result: {
+						deleted: false,
+						chunks: 0,
+						bytes: 0,
+						done: true
+					}
+				};
+				const candidates = await txn.list({
+					prefix: CHUNK_SIZE_KEY_PREFIX,
+					limit: limit + 1
+				});
+				const page = [];
+				let bytes = 0;
+				for (const [key, storedSize] of Array.from(candidates).slice(0, limit)) {
+					const index = indexFromChunkSizeKey(key);
+					const size = validateChunkSize(storedSize, index);
+					if (page.length > 0 && bytes + size > byteLimit) break;
+					page.push({
+						index,
+						size
+					});
+					bytes += size;
+				}
+				const keys = page.flatMap(({ index }) => [chunkKey(index), chunkSizeKey(index)]);
+				if (keys.length > 0) await txn.delete(keys);
+				const done = candidates.size === page.length;
+				const nextMeta = {
+					...meta,
+					count: done ? 0 : meta.count,
+					ownerRunId: runId,
+					state: "expired",
+					error: void 0,
+					expiredAt: meta.expiredAt ?? expiredAt,
+					expiredChunkCount: meta.expiredChunkCount ?? meta.count,
+					payloadDeleted: done
+				};
+				await txn.put(META_KEY, nextMeta);
+				return {
+					meta: nextMeta,
+					result: {
+						deleted: firstFence,
+						chunks: page.length,
+						bytes,
+						done
+					}
+				};
+			});
+			this.meta = result.meta;
+			this.metaLoad = Promise.resolve(result.meta);
+			this.wakeReaders();
+			return result.result;
+		});
+	}
 };
 //#endregion
 //#region src/apply-event.ts
@@ -1234,10 +2229,36 @@ const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
 * rejected as a duplicate instead of resurrecting the hook.
 */
 const HOOK_EVENT_MARKER_PREFIX = "hookevent:";
+/** Durable repair record for idempotent post-commit hook-index release. */
+const HOOK_RELEASE_MARKER_PREFIX = "hookreleased:";
+/** Exact ambiguous reservations canceled by a serialized RunDO resolution. */
+const HOOK_CLAIM_CANCELLATION_PREFIX = "hookclaimcancelled:";
 /** Workflow-authored attr_set correlation claims. */
 const ATTRIBUTE_EVENT_MARKER_PREFIX = "attrevent:";
 /** Durable lazy-hook resume claims, scoped by the containing run DO. */
 const HOOK_RESUME_CLAIM_PREFIX = "hookresume:";
+const STORAGE_BATCH_SIZE$1 = 128;
+const MAX_ENTITY_PAGE_SIZE = 1e3;
+async function getMany(store, keys) {
+	if (store.getMany) {
+		const result = /* @__PURE__ */ new Map();
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) {
+			const page = await store.getMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
+			for (const entry of page) result.set(...entry);
+		}
+		return result;
+	}
+	const values = await Promise.all(keys.map((key) => store.get(key)));
+	return new Map(keys.flatMap((key, index) => values[index] === void 0 ? [] : [[key, values[index]]]));
+}
+async function deleteMany(store, keys) {
+	if (store.deleteMany) {
+		let deleted = 0;
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) deleted += await store.deleteMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
+		return deleted;
+	}
+	return (await Promise.all(keys.map((key) => store.delete(key)))).filter(Boolean).length;
+}
 function failure(code, message, extra) {
 	return {
 		ok: false,
@@ -1246,6 +2267,9 @@ function failure(code, message, extra) {
 		...extra
 	};
 }
+function hookClaimCancellationKey(claimId) {
+	return `${HOOK_CLAIM_CANCELLATION_PREFIX}${encodeURIComponent(claimId)}`;
+}
 function readStringProp(value, key) {
 	if (value !== null && typeof value === "object") {
 		const prop = value[key];
@@ -1301,7 +2325,9 @@ function creationIndexKey(prefix, createdAt, id) {
 * requested ordering.
 */
 async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
-	const { limit, cursor, sortOrder = "asc" } = params;
+	const requestedLimit = Number.isFinite(params.limit) ? Math.floor(params.limit) : 1;
+	const limit = Math.min(MAX_ENTITY_PAGE_SIZE, Math.max(1, requestedLimit));
+	const { cursor, sortOrder = "asc" } = params;
 	const entries = await store.list(sortOrder === "desc" ? {
 		prefix: indexPrefix,
 		reverse: true,
@@ -1313,11 +2339,12 @@ async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
 		startAfter: cursor ? `${indexPrefix}${cursor}` : void 0
 	});
 	const page = Array.from(entries.entries()).slice(0, limit);
-	const data = [];
-	for (const [, id] of page) {
-		const item = await store.get(`${entityPrefix}${id}`);
-		if (item !== void 0) data.push(item);
-	}
+	const entityKeys = page.map(([, id]) => `${entityPrefix}${id}`);
+	const entities = await getMany(store, entityKeys);
+	const data = entityKeys.flatMap((key) => {
+		const item = entities.get(key);
+		return item === void 0 ? [] : [item];
+	});
 	const hasMore = entries.size > limit;
 	const lastKey = page.at(-1)?.[0];
 	return {
@@ -1328,22 +2355,26 @@ async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
 }
 /** Delete all hook entities for the run, returning the released tokens. */
 async function releaseAllHooks(store) {
+	if (store.deferTerminalCleanup) return [];
 	const hooks = await store.list({ prefix: HOOK_KEY_PREFIX });
 	const released = [];
+	const keys = [];
 	for (const hook of hooks.values()) {
-		await store.delete(`${HOOK_KEY_PREFIX}${hook.hookId}`);
-		await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+		keys.push(`${HOOK_KEY_PREFIX}${hook.hookId}`);
+		keys.push(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
 		released.push({
 			hookId: hook.hookId,
 			token: hook.token
 		});
 	}
+	await deleteMany(store, keys);
 	return released;
 }
 /** Delete all persisted waits once their owning run becomes terminal. */
 async function releaseAllWaits(store) {
+	if (store.deferTerminalCleanup) return;
 	const waits = await store.list({ prefix: WAIT_KEY_PREFIX });
-	for (const key of waits.keys()) await store.delete(key);
+	await deleteMany(store, Array.from(waits.keys()));
 }
 async function applyEvent(store, ctx) {
 	const { runId, data, now } = ctx;
@@ -1463,7 +2494,16 @@ async function applyEvent(store, ctx) {
 		}
 	}
 	if ((data.eventType === "hook_disposed" || data.eventType === "hook_received") && data.correlationId) {
-		if (!await store.get(`hook:${data.correlationId}`)) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+		if (!await store.get(`hook:${data.correlationId}`)) {
+			if (data.eventType === "hook_disposed") {
+				const released = await store.get(`${HOOK_RELEASE_MARKER_PREFIX}${data.correlationId}`);
+				if (released) return {
+					ok: true,
+					releasedHooks: [released]
+				};
+			}
+			return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+		}
 	}
 	if (!skipRunValidation && data.eventType !== "run_started" && !currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
 	switch (data.eventType) {
@@ -1799,6 +2839,7 @@ async function applyEvent(store, ctx) {
 			const holder = ctx.tokenHolder ?? null;
 			const markerKey = `${HOOK_EVENT_MARKER_PREFIX}${hookId}`;
 			const hookKey = `${HOOK_KEY_PREFIX}${hookId}`;
+			if (ctx.hookClaimId && await store.get(hookClaimCancellationKey(ctx.hookClaimId)) !== void 0) return failure("HOOK_CLAIM_CANCELLED", `Hook reservation for "${hookId}" was canceled before commit`);
 			if (holder && (holder.runId !== runId || holder.hookId !== hookId)) {
 				const event = buildEvent({
 					eventType: "hook_conflict",
@@ -1858,6 +2899,10 @@ async function applyEvent(store, ctx) {
 			if (!hook) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
 			await store.delete(hookKey);
 			await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+			await store.put(`${HOOK_RELEASE_MARKER_PREFIX}${hook.hookId}`, {
+				hookId: hook.hookId,
+				token: hook.token
+			});
 			const event = buildEvent({ ...data });
 			await putEvent(event);
 			return {
@@ -1972,10 +3017,63 @@ async function finalizeEventPage(store, outcome, params) {
 	};
 }
 //#endregion
+//#region src/retention.ts
+const CLEANUP_RECORD_KEY = "retention:cleanup";
+const TOMBSTONE_KEY = "retention:tombstone";
+const HOOK_MARKER_PREFIX = "retention:hook:";
+const TERMINAL_CLEANUP_KEY = "terminal:cleanup";
+function sortableTimestamp(date) {
+	return date.getTime().toString().padStart(13, "0");
+}
+function workflowRunIndexKey(run) {
+	return `run:${run.workflowName}:${sortableTimestamp(run.createdAt)}:${run.runId}`;
+}
+function globalRunIndexKey(run) {
+	return `runall:${sortableTimestamp(run.createdAt)}:${run.runId}`;
+}
+function hookMarkerKey(reference) {
+	return `${HOOK_MARKER_PREFIX}${encodeURIComponent(reference.hookId)}:${encodeURIComponent(reference.token)}`;
+}
+function cleanupTombstone(record, now) {
+	const cleanup = {
+		...record,
+		phase: "tombstoned",
+		tombstonedAt: now
+	};
+	return {
+		version: 1,
+		runId: record.runId,
+		terminalStatus: record.terminalStatus,
+		completedAt: record.completedAt,
+		expiredAt: record.dueAt,
+		tombstonedAt: now,
+		cleanup
+	};
+}
+function cleanupFromTombstone(tombstone) {
+	return tombstone.cleanup;
+}
+function expiredRead(tombstone) {
+	return {
+		ok: false,
+		code: "RUN_EXPIRED",
+		message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`,
+		tombstone
+	};
+}
+//#endregion
 //#region src/worker/durable-objects/WorkflowRunDO.ts
-const PAYLOAD_DELETE_BATCH = 256;
-const STREAM_DELETE_CONCURRENCY = 16;
+const STORAGE_BATCH_SIZE = 128;
+const PAYLOAD_DELETE_BATCH = STORAGE_BATCH_SIZE;
+const HOOK_MARKER_PAGE_SIZE = 64;
+const TERMINAL_HOOK_PAGE_SIZE = 64;
+const TERMINAL_WAIT_PAGE_SIZE = STORAGE_BATCH_SIZE;
+const STREAMS_PER_CLEANUP_PAGE = 16;
+const STREAM_CHUNKS_PER_CLEANUP_PAGE = STORAGE_BATCH_SIZE;
+const STREAM_BYTES_PER_CLEANUP_PAGE = 16777216;
+const QUEUE_REFERENCES_PER_CLEANUP_PAGE = 64;
 const CLEANUP_RETRY_MAX_MS = 36e5;
+const CLEANUP_PROGRESS_KEY = "retention:progress";
 /**
 * Adapt DO storage (or a transaction) to the {@link EventStore} interface
 * shared with the test mocks. No casts: the methods line up structurally,
@@ -1984,11 +3082,21 @@ const CLEANUP_RETRY_MAX_MS = 36e5;
 function storeFrom(storage) {
 	return {
 		get: (key) => storage.get(key),
+		getMany: (keys) => storage.get(keys),
 		put: (key, value) => storage.put(key, value),
 		delete: (key) => storage.delete(key),
-		list: (options) => storage.list(options)
+		deleteMany: (keys) => storage.delete(keys),
+		list: (options) => storage.list(options),
+		deferTerminalCleanup: true
 	};
 }
+function hookCreationIndexKey(hook) {
+	return `${HOOK_CREATED_KEY_PREFIX}${hook.createdAt.toISOString()}:${hook.hookId}`;
+}
+async function putStorageEntries(storage, entries) {
+	const all = Array.from(entries);
+	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE)));
+}
 /**
 * Durable Object for managing a single workflow run's state.
 *
@@ -2004,26 +3112,51 @@ var WorkflowRunDO = class extends DurableObject {
 		const clock = this.env?.clock;
 		return typeof clock === "function" ? clock() : Date.now();
 	}
-	async expiredTombstone(storage, now = this.now()) {
-		const tombstone = await storage.get(TOMBSTONE_KEY);
+	tombstoneFrom(values, now = this.now()) {
+		const tombstone = values.get(TOMBSTONE_KEY);
 		if (tombstone) return tombstone;
-		const cleanup = await storage.get(CLEANUP_RECORD_KEY);
+		const cleanup = values.get(CLEANUP_RECORD_KEY);
 		if (!cleanup || cleanup.phase === "retained" && cleanup.dueAt.getTime() > now) return null;
 		return cleanupTombstone(cleanup, cleanup.tombstonedAt ?? cleanup.dueAt);
 	}
-	async read(reader) {
-		const tombstone = await this.expiredTombstone(this.ctx.storage);
-		if (tombstone) return expiredRead(tombstone);
+	async retentionState(storage, now = this.now()) {
+		const values = await storage.get([TOMBSTONE_KEY, CLEANUP_RECORD_KEY]);
 		return {
-			ok: true,
-			value: await reader()
+			cleanup: values.get(CLEANUP_RECORD_KEY),
+			tombstone: this.tombstoneFrom(values, now)
 		};
 	}
+	async read(reader) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return expiredRead(tombstone);
+			return {
+				ok: true,
+				value: await reader(txn)
+			};
+		});
+	}
+	async readKey(key) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([
+				TOMBSTONE_KEY,
+				CLEANUP_RECORD_KEY,
+				key
+			]);
+			const tombstone = this.tombstoneFrom(values);
+			if (tombstone) return expiredRead(tombstone);
+			return {
+				ok: true,
+				value: values.get(key) ?? null
+			};
+		});
+	}
 	/** Apply an event and capture all retention metadata in the same transaction. */
 	async applyEvent(request) {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const now = new Date(this.now());
-			const tombstone = await this.expiredTombstone(txn, now.getTime());
+			const retention = await this.retentionState(txn, now.getTime());
+			const { tombstone } = retention;
 			if (tombstone) return {
 				ok: false,
 				code: "RUN_EXPIRED",
@@ -2037,20 +3170,12 @@ var WorkflowRunDO = class extends DurableObject {
 			});
 			if (!outcome.ok) return outcome;
 			await txn.put("event_sequence", eventSequence);
-			if (outcome.event?.correlationId) {
-				const key = correlationIndexKey(outcome.event.correlationId, outcome.event.createdAt, outcome.event.eventId, request.runId);
-				await txn.put(indexMarkerKey(key), key);
-			}
-			if (outcome.hookToIndex) {
-				const reference = {
-					hookId: outcome.hookToIndex.hookId,
-					token: outcome.hookToIndex.token
-				};
-				await txn.put(hookMarkerKey(reference), reference);
-			}
-			for (const reference of outcome.releasedHooks) await txn.put(hookMarkerKey(reference), reference);
+			await putStorageEntries(txn, (outcome.hookToIndex ? [{
+				hookId: outcome.hookToIndex.hookId,
+				token: outcome.hookToIndex.token
+			}, ...outcome.releasedHooks] : outcome.releasedHooks).map((reference) => [hookMarkerKey(reference), reference]));
 			const retentionMs = request.cleanup?.retentionMs ?? 0;
-			if (retentionMs > 0 && outcome.run && isTerminalWorkflowRunStatus(outcome.run.status) && !await txn.get("retention:cleanup")) {
+			if (retentionMs > 0 && outcome.run && isTerminalWorkflowRunStatus(outcome.run.status) && !retention.cleanup) {
 				const terminalRun = outcome.run;
 				const dueAt = new Date(terminalRun.completedAt.getTime() + retentionMs);
 				const run = WorkflowRunSchema.parse({
@@ -2067,6 +3192,7 @@ var WorkflowRunDO = class extends DurableObject {
 					dueAt,
 					queueShards: request.cleanup?.queueShards ?? 1,
 					phase: "retained",
+					generation: 0,
 					attempts: 0,
 					deletedPayloadKeys: 0,
 					deletedStreams: 0,
@@ -2077,50 +3203,103 @@ var WorkflowRunDO = class extends DurableObject {
 				await txn.setAlarm(dueAt);
 				outcome.run = run;
 			}
+			if (outcome.run && isTerminalWorkflowRunStatus(outcome.run.status)) {
+				if (!await txn.get("terminal:cleanup")) await txn.put(TERMINAL_CLEANUP_KEY, {
+					version: 1,
+					runId: outcome.run.runId,
+					phase: "hooks",
+					generation: 0,
+					attempts: 0
+				});
+				await txn.setAlarm(this.now() + 1);
+			}
+			if (outcome.run) outcome.indexPublicationExpiresAt = now.getTime() + MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS;
 			return finalizeEventPage(storeFrom(txn), outcome, request.params);
 		});
 	}
+	/**
+	* Resolve an ambiguous hook-creation RPC in the same serialization domain as
+	* applyEvent. If the hook is absent, the exact reservation is durably fenced
+	* before the caller releases its token and hook-ID claims.
+	*/
+	async resolveHookTokenClaim(request) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return { committed: false };
+			if ((await txn.get(`hook:${request.hookId}`))?.token === request.token) return { committed: true };
+			await txn.put(hookClaimCancellationKey(request.claimId), {
+				hookId: request.hookId,
+				token: request.token,
+				canceledAt: this.now()
+			});
+			return { committed: false };
+		});
+	}
 	async getRun() {
-		return this.read(async () => await this.ctx.storage.get("run") ?? null);
+		return this.readKey("run");
+	}
+	/** Single authoritative lifecycle answer used after derivative compaction. */
+	async getLifecycleStatus() {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([
+				TOMBSTONE_KEY,
+				CLEANUP_RECORD_KEY,
+				"run"
+			]);
+			if (this.tombstoneFrom(values)) return "expired";
+			const run = values.get("run");
+			if (!run) return "missing";
+			return isTerminalWorkflowRunStatus(run.status) ? "terminal" : "active";
+		});
 	}
 	async getStep(stepId) {
-		return this.read(async () => await this.ctx.storage.get(`step:${stepId}`) ?? null);
+		return this.readKey(`${STEP_KEY_PREFIX}${stepId}`);
 	}
 	async listSteps(params) {
-		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
+		return this.read((txn) => listByCreationTime(storeFrom(txn), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
 			limit: params?.limit ?? 20,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
 		}));
 	}
 	async getEvent(eventId) {
-		return this.read(async () => await this.ctx.storage.get(`event:${eventId}`) ?? null);
+		return this.readKey(`${EVENT_KEY_PREFIX}${eventId}`);
 	}
 	async listEvents(params) {
-		return this.read(() => listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
+		return this.read((txn) => listByPrefix(storeFrom(txn), EVENT_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
 		}, (event) => event.eventId));
 	}
 	async listHooks(params) {
-		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
+		return this.read((txn) => listByCreationTime(storeFrom(txn), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
 		}));
 	}
 	async getCleanupStatus() {
-		return await this.ctx.storage.get("retention:cleanup") ?? null;
+		const values = await this.ctx.storage.get([CLEANUP_RECORD_KEY, TOMBSTONE_KEY]);
+		const cleanup = values.get(CLEANUP_RECORD_KEY);
+		if (cleanup) return cleanup;
+		const tombstone = values.get(TOMBSTONE_KEY);
+		return tombstone ? cleanupFromTombstone(tombstone) : null;
 	}
 	/** Explicitly schedule an existing terminal run, used for opt-in backfills. */
 	async scheduleCleanup(request) {
 		if (request.retentionMs <= 0) return this.getCleanupStatus();
 		return await this.ctx.storage.transaction(async (txn) => {
-			const existing = await txn.get(CLEANUP_RECORD_KEY);
+			const values = await txn.get([
+				CLEANUP_RECORD_KEY,
+				TOMBSTONE_KEY,
+				TERMINAL_CLEANUP_KEY,
+				"run"
+			]);
+			const existing = values.get(CLEANUP_RECORD_KEY);
 			if (existing) return existing;
-			if (await txn.get("retention:tombstone")) return null;
-			const current = await txn.get("run");
+			if (values.get("retention:tombstone")) return null;
+			const current = values.get("run");
 			if (!current || !isTerminalWorkflowRunStatus(current.status)) return null;
 			const terminalRun = current;
 			const dueAt = new Date(terminalRun.completedAt.getTime() + request.retentionMs);
@@ -2138,6 +3317,7 @@ var WorkflowRunDO = class extends DurableObject {
 				dueAt,
 				queueShards: request.queueShards,
 				phase: "retained",
+				generation: 0,
 				attempts: 0,
 				deletedPayloadKeys: 0,
 				deletedStreams: 0,
@@ -2145,7 +3325,7 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 			await txn.put("run", run);
 			await txn.put(CLEANUP_RECORD_KEY, cleanup);
-			await txn.setAlarm(dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
+			await txn.setAlarm(values.get("terminal:cleanup") || dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
 			return cleanup;
 		});
 	}
@@ -2165,159 +3345,388 @@ var WorkflowRunDO = class extends DurableObject {
 			}));
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
-				dueAt
+				dueAt,
+				generation: cleanup.generation + 1
 			});
 			await txn.setAlarm(this.now() + 1);
 		});
-		try {
-			await this.executeCleanup();
-		} catch (error) {
-			await this.recordCleanupFailure(error);
-		}
+		await this.executeScheduledCleanupPage();
 		return this.getCleanupStatus();
 	}
 	async rearmCleanup() {
-		const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
-		if (!cleanup) return null;
-		if (cleanup.phase === "tombstoned") await this.ctx.storage.deleteAlarm();
+		const values = await this.ctx.storage.get([CLEANUP_RECORD_KEY, TERMINAL_CLEANUP_KEY]);
+		const cleanup = values.get(CLEANUP_RECORD_KEY);
+		if (values.get("terminal:cleanup")) await this.ctx.storage.setAlarm(this.now() + 1);
+		else if (!cleanup || cleanup.phase === "tombstoned") await this.ctx.storage.deleteAlarm();
 		else await this.ctx.storage.setAlarm(Math.max(this.now() + 1, cleanup.dueAt.getTime()));
-		return cleanup;
+		return cleanup ?? null;
 	}
 	async alarm() {
-		try {
-			await this.executeCleanup();
-		} catch (error) {
-			await this.recordCleanupFailure(error);
-		}
+		await this.executeScheduledCleanupPage();
 	}
 	namespace(name) {
 		const namespace = this.env?.[name];
 		if (!namespace || typeof namespace === "function") throw new Error(`world-celld retention missing binding ${name}`);
 		return namespace;
 	}
-	async setCleanupPhase(expected, next, updates = {}) {
+	workflowIndex() {
+		return createWorkflowIndex({
+			runCatalog: this.namespace("WORKFLOW_RUN_CATALOG"),
+			hookTokens: this.namespace("WORKFLOW_HOOK_TOKENS"),
+			hookIds: this.namespace("WORKFLOW_HOOK_IDS")
+		});
+	}
+	async setCleanupPhase(expected, next, updates = {}, continueAt) {
 		await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
-			if (!cleanup || cleanup.phase !== expected) return;
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation) return;
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
 				...updates,
 				phase: next,
+				generation: cleanup.generation + 1,
 				attempts: 0,
 				lastError: void 0
 			});
+			if (continueAt !== void 0) await txn.setAlarm(continueAt);
 		});
 	}
-	async executeCleanup() {
-		for (;;) {
-			const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
-			if (!cleanup) {
-				await this.ctx.storage.deleteAlarm();
-				return;
+	async executeScheduledCleanupPage() {
+		const terminalCleanup = await this.ctx.storage.get(TERMINAL_CLEANUP_KEY);
+		if (terminalCleanup) {
+			try {
+				await this.executeTerminalCleanup(terminalCleanup);
+			} catch (error) {
+				await this.recordTerminalCleanupFailure(error, terminalCleanup);
 			}
-			if (cleanup.phase === "tombstoned") {
-				await this.ctx.storage.deleteAlarm();
+			return;
+		}
+		const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
+		if (!cleanup || cleanup.phase === "tombstoned") {
+			await this.ctx.storage.deleteAlarm();
+			return;
+		}
+		try {
+			await this.executeCleanup(cleanup);
+		} catch (error) {
+			await this.recordCleanupFailure(error, cleanup);
+		}
+	}
+	async executeCleanup(cleanup) {
+		if (cleanup.phase === "retained") {
+			if (cleanup.dueAt.getTime() > this.now()) {
+				await this.ctx.storage.setAlarm(cleanup.dueAt);
 				return;
 			}
-			if (cleanup.phase === "retained") {
-				if (cleanup.dueAt.getTime() > this.now()) {
-					await this.ctx.storage.setAlarm(cleanup.dueAt);
-					return;
-				}
-				await this.setCleanupPhase("retained", "index");
-				continue;
-			}
-			if (cleanup.phase === "index") {
-				const [indexMarkers, hookMarkers] = await Promise.all([this.ctx.storage.list({ prefix: INDEX_MARKER_PREFIX }), this.ctx.storage.list({ prefix: HOOK_MARKER_PREFIX })]);
-				const indexNamespace = this.namespace("WORKFLOW_INDEX");
-				await indexNamespace.get(indexNamespace.idFromName("index")).expireRun({
-					runId: cleanup.runId,
-					keys: [
-						workflowRunIndexKey(cleanup),
-						globalRunIndexKey(cleanup),
-						...indexMarkers.values()
-					],
-					hooks: Array.from(hookMarkers.values()),
-					expiredAt: cleanup.dueAt.getTime()
+			await this.setCleanupPhase(cleanup, "index", {}, this.now() + 1);
+			return;
+		}
+		if (cleanup.phase === "index") {
+			await this.deleteIndexPage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "streams") {
+			await this.deleteStreamPage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "queues") {
+			await this.deleteQueuePage(cleanup);
+			return;
+		}
+		if (cleanup.phase === "payload") await this.deletePayloadBatch();
+	}
+	async executeTerminalCleanup(cleanup) {
+		if (cleanup.phase === "hooks") await this.deleteTerminalHookPage(cleanup);
+		else if (cleanup.phase === "markers") await this.deleteTerminalHookMarkerPage(cleanup);
+		else await this.deleteTerminalWaitPage(cleanup);
+	}
+	async deleteTerminalHookPage(cleanup) {
+		const entries = await this.ctx.storage.list({
+			prefix: HOOK_KEY_PREFIX,
+			limit: 65
+		});
+		const page = Array.from(entries.values()).slice(0, TERMINAL_HOOK_PAGE_SIZE);
+		await this.workflowIndex().releaseHookIndexes({
+			runId: cleanup.runId,
+			hooks: page.map((hook) => ({
+				hookId: hook.hookId,
+				token: hook.token
+			}))
+		});
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const keys = page.flatMap((hook) => [`${HOOK_KEY_PREFIX}${hook.hookId}`, hookCreationIndexKey(hook)]);
+			if (keys.length > 0) await txn.delete(keys);
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...current,
+				phase: entries.size <= TERMINAL_HOOK_PAGE_SIZE ? "markers" : "hooks",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteTerminalHookMarkerPage(cleanup) {
+		const entries = await this.ctx.storage.list({
+			prefix: HOOK_MARKER_PREFIX,
+			limit: 65
+		});
+		const page = Array.from(entries).slice(0, HOOK_MARKER_PAGE_SIZE);
+		await this.workflowIndex().releaseHookIndexes({
+			runId: cleanup.runId,
+			hooks: page.map(([, reference]) => reference)
+		});
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const keys = page.map(([key]) => key);
+			if (keys.length > 0) await txn.delete(keys);
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...current,
+				phase: entries.size <= HOOK_MARKER_PAGE_SIZE ? "waits" : "markers",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteTerminalWaitPage(cleanup) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!current || current.phase !== cleanup.phase || current.generation !== cleanup.generation) return;
+			const entries = await txn.list({
+				prefix: WAIT_KEY_PREFIX,
+				limit: 129
+			});
+			const keys = Array.from(entries.keys()).slice(0, TERMINAL_WAIT_PAGE_SIZE);
+			if (keys.length > 0) await txn.delete(keys);
+			if (entries.size > TERMINAL_WAIT_PAGE_SIZE) {
+				await txn.put(TERMINAL_CLEANUP_KEY, {
+					...current,
+					generation: current.generation + 1,
+					attempts: 0,
+					lastError: void 0
 				});
-				await this.setCleanupPhase("index", "streams");
-				continue;
+				await txn.setAlarm(this.now() + 1);
+				return;
 			}
-			if (cleanup.phase === "streams") {
-				const streamsNamespace = this.namespace("WORKFLOW_STREAMS");
-				const registry = streamsNamespace.get(streamsNamespace.idFromName(`run-streams:${cleanup.runId}`));
-				const { streams } = await registry.expireRegistry(cleanup.runId, cleanup.dueAt.getTime());
-				let deletedStreams = streams.length === 0 ? cleanup.deletedStreams : 0;
-				for (let offset = 0; offset < streams.length; offset += STREAM_DELETE_CONCURRENCY) {
-					const batch = streams.slice(offset, offset + STREAM_DELETE_CONCURRENCY);
-					const results = await Promise.all(batch.map((name) => {
-						return streamsNamespace.get(streamsNamespace.idFromName(`stream:${name}`)).expireStream(cleanup.runId, cleanup.dueAt.getTime());
-					}));
-					deletedStreams += results.filter((result) => result.deleted).length;
-				}
-				await this.ctx.storage.transaction(async (txn) => {
-					const current = await txn.get(CLEANUP_RECORD_KEY);
-					if (current?.phase === "streams") await txn.put(CLEANUP_RECORD_KEY, {
-						...current,
-						deletedStreams
-					});
+			await txn.delete(TERMINAL_CLEANUP_KEY);
+			const retention = await txn.get(CLEANUP_RECORD_KEY);
+			if (retention && retention.phase !== "tombstoned") await txn.setAlarm(Math.max(this.now() + 1, retention.dueAt.getTime()));
+			else await txn.deleteAlarm();
+		});
+	}
+	async deleteIndexPage(cleanup) {
+		const hookEntries = await this.ctx.storage.list({
+			prefix: HOOK_MARKER_PREFIX,
+			limit: 65
+		});
+		const hookMarkers = Array.from(hookEntries).slice(0, HOOK_MARKER_PAGE_SIZE);
+		await this.workflowIndex().expireRun({
+			runId: cleanup.runId,
+			keys: [workflowRunIndexKey(cleanup), globalRunIndexKey(cleanup)],
+			hooks: hookMarkers.map(([, value]) => value),
+			expiredAt: cleanup.dueAt.getTime()
+		});
+		const markerKeys = hookMarkers.map(([key]) => key);
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "index" || current.generation !== cleanup.generation) return;
+			if (markerKeys.length > 0) await txn.delete(markerKeys);
+			if (hookEntries.size <= HOOK_MARKER_PAGE_SIZE) await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				phase: "streams",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			else await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteStreamPage(cleanup) {
+		const streamsNamespace = this.namespace("WORKFLOW_STREAMS");
+		const registry = streamsNamespace.get(streamsNamespace.idFromName(`run-streams:${cleanup.runId}`));
+		const { streams } = await registry.expireRegistry(cleanup.runId, cleanup.dueAt.getTime(), { limit: STREAMS_PER_CLEANUP_PAGE });
+		const completed = [];
+		let remainingChunks = STREAM_CHUNKS_PER_CLEANUP_PAGE;
+		let remainingBytes = STREAM_BYTES_PER_CLEANUP_PAGE;
+		for (const name of streams) {
+			if (remainingChunks <= 0 || remainingBytes <= 0) break;
+			const result = await streamsNamespace.get(streamsNamespace.idFromName(`stream:${name}`)).expireStream(cleanup.runId, cleanup.dueAt.getTime(), {
+				limit: remainingChunks,
+				byteLimit: remainingBytes
+			});
+			remainingChunks -= result.chunks;
+			remainingBytes -= result.bytes;
+			if (result.done) completed.push(name);
+		}
+		const registryResult = await registry.finalizeRegistry(cleanup.runId, completed);
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "streams" || current.generation !== cleanup.generation) return;
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				deletedStreams: registryResult.deleted,
+				phase: registryResult.done ? "queues" : "streams",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+	}
+	async deleteQueuePage(cleanup) {
+		const queues = this.namespace("WORKFLOW_QUEUE");
+		const progress = await this.ctx.storage.get(CLEANUP_PROGRESS_KEY) ?? {
+			queueShard: 0,
+			queueShardDeleted: 0
+		};
+		if (progress.pendingAck) {
+			const { queueShard, receipt } = progress.pendingAck;
+			if (!(await queues.get(queues.idFromName(`q:${queueShard}`)).acknowledgeExpireRun(cleanup.runId, receipt)).acknowledged) throw new Error(`queue shard ${queueShard} rejected expiry receipt for ${cleanup.runId}`);
+			await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(CLEANUP_RECORD_KEY);
+				if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
+				const persisted = await txn.get(CLEANUP_PROGRESS_KEY);
+				if (persisted?.pendingAck?.queueShard !== queueShard || persisted.pendingAck.receipt.expiredAt !== receipt.expiredAt || persisted.pendingAck.receipt.deleted !== receipt.deleted) return;
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...current,
+					generation: current.generation + 1,
+					attempts: 0,
+					lastError: void 0
 				});
-				await registry.finalizeRegistry(cleanup.runId);
-				await this.setCleanupPhase("streams", "queues");
-				continue;
-			}
-			if (cleanup.phase === "queues") {
-				const queues = this.namespace("WORKFLOW_QUEUE");
-				let deletedQueueMessages = 0;
-				for (let shard = 0; shard < cleanup.queueShards; shard++) {
-					const result = await queues.get(queues.idFromName(`q:${shard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime());
-					deletedQueueMessages += result.deleted;
-				}
-				await this.setCleanupPhase("queues", "payload", { deletedQueueMessages });
-				continue;
-			}
-			if (cleanup.phase === "payload") {
-				if (!await this.deletePayloadBatch()) return;
-			}
+				await txn.put(CLEANUP_PROGRESS_KEY, {
+					queueShard: queueShard + 1,
+					queueShardDeleted: 0
+				});
+				await txn.setAlarm(this.now() + 1);
+			});
+			return;
+		}
+		if (progress.queueShard < cleanup.queueShards) {
+			const requestedShard = progress.queueShard;
+			const result = await queues.get(queues.idFromName(`q:${requestedShard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime(), { limit: QUEUE_REFERENCES_PER_CLEANUP_PAGE });
+			await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(CLEANUP_RECORD_KEY);
+				if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
+				const persisted = await txn.get(CLEANUP_PROGRESS_KEY) ?? {
+					queueShard: 0,
+					queueShardDeleted: 0
+				};
+				if (persisted.queueShard !== requestedShard || persisted.pendingAck) return;
+				if (result.deleted < persisted.queueShardDeleted) throw new Error(`queue shard ${requestedShard} regressed expiry receipt for ${cleanup.runId}`);
+				const delta = result.deleted - persisted.queueShardDeleted;
+				const next = result.done ? {
+					queueShard: requestedShard,
+					queueShardDeleted: result.deleted,
+					pendingAck: {
+						queueShard: requestedShard,
+						receipt: result.receipt
+					}
+				} : {
+					queueShard: requestedShard,
+					queueShardDeleted: result.deleted
+				};
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...current,
+					deletedQueueMessages: current.deletedQueueMessages + delta,
+					generation: current.generation + 1,
+					attempts: 0,
+					lastError: void 0
+				});
+				await txn.put(CLEANUP_PROGRESS_KEY, next);
+				await txn.setAlarm(this.now() + 1);
+			});
+			return;
 		}
+		await this.ctx.storage.transaction(async (txn) => {
+			const current = await txn.get(CLEANUP_RECORD_KEY);
+			if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
+			const persisted = await txn.get(CLEANUP_PROGRESS_KEY) ?? {
+				queueShard: 0,
+				queueShardDeleted: 0
+			};
+			if (persisted.queueShard >= current.queueShards && !persisted.pendingAck) {
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...current,
+					phase: "payload",
+					generation: current.generation + 1
+				});
+				await txn.delete(CLEANUP_PROGRESS_KEY);
+				await txn.setAlarm(this.now() + 1);
+			}
+		});
 	}
 	async deletePayloadBatch() {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
 			if (!cleanup || cleanup.phase !== "payload") return true;
-			const entries = await txn.list({ limit: 259 });
+			const entries = await txn.list({
+				limit: 131,
+				noCache: true
+			});
 			const keys = Array.from(entries.keys()).filter((key) => key !== "retention:cleanup" && key !== "retention:tombstone").slice(0, PAYLOAD_DELETE_BATCH);
 			const now = new Date(this.now());
 			await txn.put(TOMBSTONE_KEY, cleanupTombstone(cleanup, now));
-			for (const key of keys) await txn.delete(key);
+			if (keys.length > 0) await txn.delete(keys);
 			if (keys.length > 0) {
 				await txn.put(CLEANUP_RECORD_KEY, {
 					...cleanup,
 					deletedPayloadKeys: cleanup.deletedPayloadKeys + keys.length,
+					generation: cleanup.generation + 1,
 					lastError: void 0
 				});
 				await txn.setAlarm(this.now() + 1);
 				return false;
 			}
-			await txn.put(CLEANUP_RECORD_KEY, {
+			const completed = {
 				...cleanup,
 				phase: "tombstoned",
+				generation: cleanup.generation + 1,
 				attempts: 0,
 				lastError: void 0,
 				tombstonedAt: now
-			});
+			};
+			await txn.put(TOMBSTONE_KEY, cleanupTombstone(completed, now));
+			await txn.delete(CLEANUP_RECORD_KEY);
 			await txn.deleteAlarm();
 			return true;
 		});
 	}
-	async recordCleanupFailure(error) {
+	async recordCleanupFailure(error, expected) {
 		await this.ctx.storage.transaction(async (txn) => {
 			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
-			if (!cleanup || cleanup.phase === "tombstoned") return;
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation || cleanup.phase === "tombstoned") return;
 			const attempts = cleanup.attempts + 1;
 			const delay = Math.min(CLEANUP_RETRY_MAX_MS, 1e3 * 2 ** Math.min(attempts - 1, 12));
 			await txn.put(CLEANUP_RECORD_KEY, {
 				...cleanup,
+				generation: cleanup.generation + 1,
+				attempts,
+				lastError: error instanceof Error ? error.message : String(error),
+				lastAttemptAt: new Date(this.now())
+			});
+			await txn.setAlarm(this.now() + delay);
+		});
+	}
+	async recordTerminalCleanupFailure(error, expected) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(TERMINAL_CLEANUP_KEY);
+			if (!cleanup || cleanup.phase !== expected.phase || cleanup.generation !== expected.generation) return;
+			const attempts = cleanup.attempts + 1;
+			const delay = Math.min(CLEANUP_RETRY_MAX_MS, 1e3 * 2 ** Math.min(attempts - 1, 12));
+			await txn.put(TERMINAL_CLEANUP_KEY, {
+				...cleanup,
+				generation: cleanup.generation + 1,
 				attempts,
 				lastError: error instanceof Error ? error.message : String(error),
 				lastAttemptAt: new Date(this.now())
@@ -2352,7 +3761,9 @@ async function startHarness(options = {}) {
 	const fleet = new FakeFleet({
 		runs: WorkflowRunDO,
 		streams: StreamDO,
-		index: IndexDO,
+		"run-catalog": RunCatalogDO,
+		"hook-tokens": HookTokenDO,
+		"hook-ids": HookIdDO,
 		queue: QueueDO,
 		...options.extraClasses
 	}, cellEnv);
@@ -2360,17 +3771,30 @@ async function startHarness(options = {}) {
 	Object.assign(cellEnv, {
 		WORKFLOW_DB: fleet.namespace("runs"),
 		WORKFLOW_STREAMS: fleet.namespace("streams"),
-		WORKFLOW_INDEX: fleet.namespace("index"),
+		WORKFLOW_RUN_CATALOG: fleet.namespace("run-catalog"),
+		WORKFLOW_HOOK_TOKENS: fleet.namespace("hook-tokens"),
+		WORKFLOW_HOOK_IDS: fleet.namespace("hook-ids"),
 		WORKFLOW_QUEUE: fleet.namespace("queue")
 	});
 	const router = createRouter({
 		WORKFLOW_DB: fleet.namespace("runs"),
 		WORKFLOW_STREAMS: fleet.namespace("streams"),
-		WORKFLOW_INDEX: fleet.namespace("index"),
+		WORKFLOW_RUN_CATALOG: fleet.namespace("run-catalog"),
+		WORKFLOW_HOOK_TOKENS: fleet.namespace("hook-tokens"),
+		WORKFLOW_HOOK_IDS: fleet.namespace("hook-ids"),
 		WORKFLOW_QUEUE: fleet.namespace("queue"),
 		WORLD_SECRET: options.secret
 	});
 	const server = http.createServer(async (req, res) => {
+		const requestAbort = new AbortController();
+		const abortRequest = () => {
+			if (!requestAbort.signal.aborted) requestAbort.abort(new DOMException("HTTP client disconnected", "AbortError"));
+		};
+		const abortOnPrematureClose = () => {
+			if (!res.writableEnded) abortRequest();
+		};
+		req.once("aborted", abortRequest);
+		res.once("close", abortOnPrematureClose);
 		try {
 			const chunks = [];
 			for await (const chunk of req) chunks.push(chunk);
@@ -2378,17 +3802,23 @@ async function startHarness(options = {}) {
 			const request = new Request(`http://127.0.0.1${req.url ?? "/"}`, {
 				method: req.method,
 				headers: req.headers,
-				body: req.method === "GET" || req.method === "HEAD" || body.length === 0 ? null : body
+				body: req.method === "GET" || req.method === "HEAD" || body.length === 0 ? null : body,
+				signal: requestAbort.signal
 			});
 			const response = await router(request);
+			if (requestAbort.signal.aborted || res.destroyed) return;
 			res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
 			res.end(Buffer.from(await response.arrayBuffer()));
 		} catch (error) {
+			if (requestAbort.signal.aborted || res.destroyed) return;
 			res.writeHead(500, { "content-type": "application/json" });
 			res.end(JSON.stringify({ error: {
 				name: "HarnessError",
 				message: String(error)
 			} }));
+		} finally {
+			req.off("aborted", abortRequest);
+			res.off("close", abortOnPrematureClose);
 		}
 	});
 	await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));