@ewhauser/world-celld 0.8.0 → 0.9.0

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { A as isPositiveSafeInteger, E as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, F as MAX_STREAM_CHUNK_BYTES, H as STREAM_CHUNK_LIMIT_HEADER, J as encodeStreamWriteResult, K as encodeStreamReadResult, L as MAX_STREAM_LONG_POLL_MS, P as MAX_STREAM_BATCH_BYTES, Q as validateStreamWriteChunks, R as MAX_STREAM_READ_BYTES, S as LIFECYCLE_COMPACTION_RETRY_MS, V as STREAM_BATCH_CONTENT_TYPE, W as decodeStreamWriteBatch, X as normalizeStreamError, Z as validateStreamReadRequest, a as isInlineRunBody, c as queueOrphanName, d as validateNativeQueueEnvelope, f as validateNativeQueueSendOptions, g as parse, h as rpcStringify, i as QUEUE_PAYLOAD_REGISTRY_PREFIX, j as isRecord$1, k as isNonNegativeSafeInteger, l as queuePayloadObjectKey, m as rpcParse, n as listRunsPage, p as compact, r as NATIVE_QUEUE_MAX_MESSAGE_BYTES, s as queueClaimName, t as MAX_RUN_LIST_LIMIT, u as queuePayloadRegistryKey, v as createWorkflowIndex, x as HOOK_CLAIM_LEASE_MS, y as runIndexMetadata } from "./run-list-C987PkJ2.js";
+import { $ as normalizeStreamError, B as MAX_STREAM_LONG_POLL_MS, C as HOOK_CLAIM_LEASE_MS, F as queueDelayDeadline, G as STREAM_CHUNK_LIMIT_HEADER, L as MAX_STREAM_BATCH_BYTES, M as isNonNegativeSafeInteger, N as isPositiveSafeInteger, O as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, P as isRecord$1, R as MAX_STREAM_CHUNK_BYTES, V as MAX_STREAM_READ_BYTES, W as STREAM_BATCH_CONTENT_TYPE, Y as encodeStreamReadResult, Z as encodeStreamWriteResult, _ as rpcStringify, a as QUEUE_PUBLICATION_LEASE_MS, b as createWorkflowIndex, c as nativeQueueDelaySeconds, d as queuePayloadObjectKey, et as validateStreamReadRequest, f as queuePayloadRegistryKey, g as rpcParse, h as compact, i as QUEUE_PAYLOAD_REGISTRY_PREFIX, k as QUEUE_CLAIM_STALE_MS, l as queueClaimName, m as validateNativeQueueSendOptions, n as listRunsPage, o as QUEUE_RESERVATION_GRACE_MS, p as validateNativeQueueEnvelope, q as decodeStreamWriteBatch, r as NATIVE_QUEUE_MAX_MESSAGE_BYTES, s as isInlineRunBody, t as MAX_RUN_LIST_LIMIT, tt as validateStreamWriteChunks, u as queueOrphanName, v as parse, w as LIFECYCLE_COMPACTION_RETRY_MS, x as runIndexMetadata } from "./run-list-C4B4SBYW.js";
 import { CreateEventSchema, EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
 import http from "node:http";
 //#region src/testing/fake-cell.ts
@@ -546,8 +546,8 @@ function readStringProp(value, key) {
 	}
 }
 /**
-* Map a failure eventData.error (which may be a string, an Error-shaped
-* object, or anything else) to the structured error stored on entities.
+* Map a run failure eventData.error (which may be a string, an Error-shaped
+* object, or anything else) to the structured error stored on runs.
 * Matches upstream: string errors keep their text, errorCode is preserved.
 */
 function toStructuredError(error, opts) {
@@ -1023,14 +1023,17 @@ async function applyEvent(store, ctx) {
 			}
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
 			if (step.retryAfter && step.retryAfter.getTime() > now.getTime()) return failure("TOO_EARLY", `Cannot start step "${data.correlationId}": retryAfter timestamp has not been reached yet`, { retryAfterSeconds: Math.ceil((step.retryAfter.getTime() - now.getTime()) / 1e3) });
-			const updated = StepSchema.parse(compact({
-				...step,
-				status: "running",
-				startedAt: step.startedAt ?? now,
-				attempt: step.attempt + 1,
-				retryAfter: void 0,
-				updatedAt: now
-			}));
+			const updated = StepSchema.parse({
+				...compact({
+					...step,
+					status: "running",
+					startedAt: step.startedAt ?? now,
+					attempt: step.attempt + 1,
+					retryAfter: void 0,
+					updatedAt: now
+				}),
+				error: step.error
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1045,13 +1048,16 @@ async function applyEvent(store, ctx) {
 		case "step_completed": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
-				...step,
-				status: "completed",
-				output: data.eventData.result,
-				completedAt: now,
-				updatedAt: now
-			}));
+			const updated = StepSchema.parse({
+				...compact({
+					...step,
+					status: "completed",
+					output: data.eventData.result,
+					completedAt: now,
+					updatedAt: now
+				}),
+				error: step.error
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1065,13 +1071,13 @@ async function applyEvent(store, ctx) {
 		case "step_failed": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
+			const updated = StepSchema.parse({
 				...step,
 				status: "failed",
-				error: toStructuredError(data.eventData.error),
+				error: data.eventData.error,
 				completedAt: now,
 				updatedAt: now
-			}));
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1085,13 +1091,13 @@ async function applyEvent(store, ctx) {
 		case "step_retrying": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
+			const updated = StepSchema.parse({
 				...step,
 				status: "pending",
-				error: toStructuredError(data.eventData.error),
+				error: data.eventData.error,
 				retryAfter: data.eventData.retryAfter ? new Date(data.eventData.retryAfter) : void 0,
 				updatedAt: now
-			}));
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1127,7 +1133,7 @@ async function applyEvent(store, ctx) {
 			}
 			if (await store.get(markerKey) !== void 0) {
 				const existingHook = await store.get(hookKey);
-				if (existingHook && !holder) return {
+				if (existingHook && !holder && existingHook.token === token) return {
 					ok: true,
 					hook: existingHook,
 					hookToIndex: existingHook,
@@ -1355,6 +1361,11 @@ async function authenticate(request, secret) {
 }
 //#endregion
 //#region src/worker/queue-claims.ts
+/**
+* Idempotency claims for Queue messages. A claim lives either in its own
+* claim cell (named by queue and idempotency key) or, for run-bearing
+* messages whose envelope says so, as an entry in the run's own cell.
+*/
 function cellQueueClaim(cell) {
 	return {
 		claim: (messageId, staleMs) => cell.claimInflight({
@@ -1363,6 +1374,11 @@ function cellQueueClaim(cell) {
 		}),
 		hold: (params) => cell.holdInflight(params),
 		release: (messageId) => cell.releaseInflight(messageId),
+		abandonReservation: (messageId) => cell.abandonQueueMessageReservation(messageId),
+		confirmPublication: (messageId, expiresAt) => cell.confirmQueueMessagePublication({
+			messageId,
+			expiresAt
+		}),
 		complete: (messageId) => cell.completeQueueMessage(messageId)
 	};
 }
@@ -1387,12 +1403,27 @@ function runQueueClaim(run, claimName) {
 			claimName,
 			messageId
 		}),
+		abandonReservation: (messageId) => run.abandonRunQueueMessageReservation({
+			claimName,
+			messageId
+		}),
+		confirmPublication: (messageId, expiresAt) => run.confirmRunQueueMessagePublication({
+			claimName,
+			messageId,
+			expiresAt
+		}),
 		complete: (messageId) => run.completeRunQueueMessage({
 			claimName,
 			messageId
 		})
 	};
 }
+/** The claim a delivered envelope was reserved under, if it has an idempotency key. */
+function deliveryQueueClaim(envelope, runStub) {
+	if (!envelope.idempotencyKey) return void 0;
+	const claimName = queueClaimName(envelope.queueName, envelope.idempotencyKey);
+	return envelope.claimScope === "run" && envelope.runId ? runQueueClaim(runStub(envelope.runId), claimName) : cellQueueClaim(runStub(claimName));
+}
 //#endregion
 //#region src/worker/index-validation.ts
 function invalid(message) {
@@ -1708,7 +1739,8 @@ const BINDINGS = {
 			"scheduleCleanup",
 			"cleanupNow",
 			"rearmCleanup",
-			"resolveHookTokenClaim"
+			"resolveHookTokenClaim",
+			"resolveExpiredHookClaim"
 		])
 	},
 	streams: {
@@ -1735,7 +1767,6 @@ const BINDINGS = {
 /** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
 const MAX_BODY_BYTES = 33554432;
 const MAX_STREAM_WRITE_BODY_BYTES = MAX_STREAM_BATCH_BYTES + 2048 + 1024;
-const QUEUE_ORPHAN_GRACE_MS = 432e6;
 function errorResponse(status, name, message) {
 	return Response.json({ error: {
 		name,
@@ -1888,6 +1919,7 @@ function createRouter(env) {
 				} catch (error) {
 					return errorResponse(400, "BadRequest", error.message);
 				}
+				let enqueueClaim;
 				try {
 					const namespace = env.WORKFLOW_DB;
 					const payloadStore = env.WORKFLOW_QUEUE_PAYLOADS;
@@ -1904,26 +1936,26 @@ function createRouter(env) {
 					});
 					if (new TextEncoder().encode(sized).byteLength > 128e3) return errorResponse(413, "PayloadTooLarge", `native queue envelope exceeds ${NATIVE_QUEUE_MAX_MESSAGE_BYTES} bytes`);
 					const now = Date.now();
-					const reservationExpiresAt = Math.max(now, envelope.notBefore ?? now) + QUEUE_ORPHAN_GRACE_MS;
+					const reservationExpiresAt = Math.max(now, envelope.notBefore ?? now) + QUEUE_RESERVATION_GRACE_MS;
 					const run = envelope.runId ? namespace.get(namespace.idFromName(envelope.runId)) : void 0;
-					let claim;
 					let admission;
 					if (envelope.idempotencyKey) {
 						const claimName = queueClaimName(envelope.queueName, envelope.idempotencyKey);
 						let scope = run && envelope.runId ? runClaimScopes.get(envelope.runId) : "cell";
 						let reservation;
 						if (run && envelope.runId && scope !== "cell") {
+							enqueueClaim = runQueueClaim(run, claimName);
 							const reserved = await run.reserveRunQueueMessage({
 								claimName,
 								messageId: envelope.messageId,
-								expiresAt: reservationExpiresAt
+								expiresAt: now + QUEUE_PUBLICATION_LEASE_MS,
+								publicationPending: true
 							});
 							if (!reserved.ok) return errorResponse(410, "RunExpiredError", reserved.message);
 							scope = reserved.scope;
 							rememberRunClaimScope(envelope.runId, reserved.scope);
 							if (reserved.scope === "run") {
 								reservation = reserved;
-								claim = runQueueClaim(run, claimName);
 								brokerEnvelope = {
 									...brokerEnvelope,
 									claimScope: "run"
@@ -1935,27 +1967,34 @@ function createRouter(env) {
 						}
 						if (!reservation) {
 							const cell = namespace.get(namespace.idFromName(claimName));
+							enqueueClaim = cellQueueClaim(cell);
 							reservation = await cell.reserveQueueMessage({
 								messageId: envelope.messageId,
-								expiresAt: reservationExpiresAt
+								expiresAt: now + QUEUE_PUBLICATION_LEASE_MS,
+								publicationPending: true
+							});
+						}
+						if (!reservation.admitted) {
+							if (reservation.publicationPending) return errorResponse(503, "QueuePublicationPending", "the reserved Queue message has not been confirmed by the broker; retry publication");
+							return new Response(rpcStringify({ messageId: reservation.messageId }), {
+								status: 200,
+								headers: { "content-type": "application/json" }
 							});
-							claim = cellQueueClaim(cell);
 						}
-						if (!reservation.admitted) return new Response(rpcStringify({ messageId: reservation.messageId }), {
-							status: 200,
-							headers: { "content-type": "application/json" }
-						});
 					} else if (inlineRunBody && run) admission = run.getQueueAdmission();
 					const encoded = JSON.stringify(brokerEnvelope);
 					if (admission) {
 						const admitted = await admission;
 						if (!admitted.ok) {
-							await claim?.complete(envelope.messageId);
+							await enqueueClaim?.complete(envelope.messageId);
 							return errorResponse(410, "RunExpiredError", admitted.message);
 						}
 					}
 					if (run && envelope.runId && payloadKey) {
-						if (!payloadStore) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE_PAYLOADS");
+						if (!payloadStore) {
+							await enqueueClaim?.abandonReservation(envelope.messageId);
+							return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE_PAYLOADS");
+						}
 						const orphanExpiresAt = reservationExpiresAt;
 						const registered = await run.registerQueuePayload({
 							messageId: envelope.messageId,
@@ -1963,7 +2002,7 @@ function createRouter(env) {
 							orphanExpiresAt
 						});
 						if (!registered.ok) {
-							await claim?.complete(envelope.messageId);
+							await enqueueClaim?.complete(envelope.messageId);
 							return errorResponse(410, "RunExpiredError", registered.message);
 						}
 						const orphan = namespace.get(namespace.idFromName(queueOrphanName(envelope.messageId)));
@@ -1976,30 +2015,18 @@ function createRouter(env) {
 							});
 						} catch (error) {
 							await run.unregisterQueuePayload(envelope.messageId);
-							await claim?.complete(envelope.messageId);
-							throw error;
-						}
-						try {
-							await payloadStore.write(payloadKey, envelope.body, {
-								runId: envelope.runId,
-								messageId: envelope.messageId
-							});
-						} catch (error) {
-							await claim?.complete(envelope.messageId);
-							throw error;
-						}
-						let finalized;
-						try {
-							finalized = await run.finalizeQueuePayload(envelope.messageId);
-						} catch (error) {
-							await claim?.complete(envelope.messageId);
 							throw error;
 						}
+						await payloadStore.write(payloadKey, envelope.body, {
+							runId: envelope.runId,
+							messageId: envelope.messageId
+						});
+						const finalized = await run.finalizeQueuePayload(envelope.messageId);
 						if (!finalized.ok) {
 							await payloadStore.delete(payloadKey);
 							await run.unregisterQueuePayload(envelope.messageId);
 							await orphan.cancelQueuePayloadOrphan(envelope.messageId);
-							await claim?.complete(envelope.messageId);
+							await enqueueClaim?.complete(envelope.messageId);
 							return errorResponse(410, "RunExpiredError", finalized.message);
 						}
 					}
@@ -2007,11 +2034,17 @@ function createRouter(env) {
 						contentType: "text",
 						...options
 					});
+					await enqueueClaim?.confirmPublication(envelope.messageId, reservationExpiresAt);
 					return new Response(rpcStringify({ messageId: envelope.messageId }), {
 						status: 200,
 						headers: { "content-type": "application/json" }
 					});
 				} catch (error) {
+					try {
+						await enqueueClaim?.abandonReservation(envelope.messageId);
+					} catch (cleanupError) {
+						console.error("world-celld could not abandon a failed Queue reservation", cleanupError);
+					}
 					const err = error;
 					return errorResponse(500, err.name ?? "Error", err.message ?? String(error));
 				}
@@ -2244,6 +2277,16 @@ async function runIsActive(env, runId) {
 	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_DB binding");
 	return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "active";
 }
+/** Resolve a stale shard reservation in its authoritative event writer. */
+async function resolveExpiredHookClaim(env, owner, claimId, token) {
+	const namespace = env.WORKFLOW_DB;
+	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_DB binding");
+	return await namespace.get(namespace.idFromName(owner.runId)).resolveExpiredHookClaim({
+		hookId: owner.hookId,
+		claimId,
+		token
+	});
+}
 //#endregion
 //#region src/worker/durable-objects/HookIdDO.ts
 const MAX_RELEASE_BATCH$1 = 64;
@@ -2272,52 +2315,69 @@ var HookIdDO = class extends DurableObject {
 		return await runIsActive(this.env, owner.runId) ? raw : null;
 	}
 	async reserve(hookId, owner, proposedClaimId) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const record = recordKey$1(hookId);
-			const claim = claimKey$1(hookId);
-			const values = await txn.get([record, claim]);
-			const indexed = values.get(record);
-			if (indexed !== void 0) return {
-				claimed: false,
-				holder: ownerFromSerializedHook(indexed)
-			};
-			let existing = values.get(claim);
-			const now = this.now();
-			if (existing && existing.expiresAt <= now) {
-				await txn.delete([claim, existing.deadlineKey]);
-				existing = void 0;
-			}
-			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
-				claimed: false,
-				holder: existing.owner
-			};
-			if (existing === void 0 || existing.claimId !== proposedClaimId) {
-				if (existing) await txn.delete(existing.deadlineKey);
-				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
-				const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
-				await txn.put(claim, {
-					owner,
-					claimId: proposedClaimId,
-					reservedAt: now,
-					expiresAt,
-					deadlineKey
-				});
-				await txn.put(deadlineKey, {
-					hookId,
-					claimId: proposedClaimId,
-					expiresAt
-				});
-				await this.armAtMost(txn, expiresAt);
+		for (;;) {
+			const observed = await this.ctx.storage.get(claimKey$1(hookId));
+			const expired = observed && observed.expiresAt <= this.now() ? observed : void 0;
+			const committed = expired ? await resolveExpiredHookClaim(this.env, expired.owner, expired.claimId) : void 0;
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const record = recordKey$1(hookId);
+				const claim = claimKey$1(hookId);
+				const values = await txn.get([record, claim]);
+				const indexed = values.get(record);
+				if (indexed !== void 0) return {
+					claimed: false,
+					holder: ownerFromSerializedHook(indexed)
+				};
+				let existing = values.get(claim);
+				const now = this.now();
+				if (existing && existing.expiresAt <= now) {
+					if (existing.claimId !== expired?.claimId || existing.expiresAt !== expired.expiresAt) return null;
+					if (committed) {
+						await this.renewClaim(txn, hookId, existing, now);
+						return sameOwner(existing.owner, owner) ? {
+							claimed: true,
+							claimId: existing.claimId
+						} : {
+							claimed: false,
+							holder: existing.owner
+						};
+					}
+					await txn.delete([claim, existing.deadlineKey]);
+					existing = void 0;
+				}
+				if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+					claimed: false,
+					holder: existing.owner
+				};
+				if (existing === void 0 || existing.claimId !== proposedClaimId) {
+					if (existing) await txn.delete(existing.deadlineKey);
+					const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+					const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
+					await txn.put(claim, {
+						owner,
+						claimId: proposedClaimId,
+						reservedAt: now,
+						expiresAt,
+						deadlineKey
+					});
+					await txn.put(deadlineKey, {
+						hookId,
+						claimId: proposedClaimId,
+						expiresAt
+					});
+					await this.armAtMost(txn, expiresAt);
+					return {
+						claimed: true,
+						claimId: proposedClaimId
+					};
+				}
 				return {
 					claimed: true,
-					claimId: proposedClaimId
+					claimId: existing.claimId
 				};
-			}
-			return {
-				claimed: true,
-				claimId: existing.claimId
-			};
-		});
+			});
+			if (result) return result;
+		}
 	}
 	async publish(hookId, serializedHook, owner, claimId) {
 		if (!await runIsActive(this.env, owner.runId)) {
@@ -2334,10 +2394,7 @@ var HookIdDO = class extends DurableObject {
 			const indexed = values.get(record);
 			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook id ${hookId} is owned by another hook`);
 			const existingClaim = values.get(claim);
-			if (existingClaim && existingClaim.expiresAt <= this.now()) {
-				await txn.delete([claim, existingClaim.deadlineKey]);
-				return { stored: false };
-			}
+			if (existingClaim && existingClaim.expiresAt <= this.now()) throw new Error(`Hook id ${hookId} reservation expired`);
 			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook id ${hookId} is reserved by another hook`);
 			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook id ${hookId} has no active reservation`);
 			await txn.put(record, serializedHook);
@@ -2387,21 +2444,51 @@ var HookIdDO = class extends DurableObject {
 		const current = await storage.getAlarm();
 		if (current === null || at < current) await storage.setAlarm(at);
 	}
+	async renewClaim(txn, hookId, claim, now) {
+		const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+		const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
+		await txn.delete(claim.deadlineKey);
+		await txn.put(claimKey$1(hookId), {
+			...claim,
+			expiresAt,
+			deadlineKey
+		});
+		await txn.put(deadlineKey, {
+			hookId,
+			claimId: claim.claimId,
+			expiresAt
+		});
+		await this.armAtMost(txn, expiresAt);
+	}
 	async compactClaims() {
 		const now = this.now();
+		const due = await this.ctx.storage.list({
+			prefix: CLAIM_DEADLINE_PREFIX$1,
+			end: `${CLAIM_DEADLINE_PREFIX$1}${pad$2(now + 1)}`,
+			limit: 129
+		});
+		const page = Array.from(due).slice(0, 128);
+		const observed = await this.ctx.storage.get(page.map(([, item]) => claimKey$1(item.hookId)));
+		const committed = /* @__PURE__ */ new Map();
+		await Promise.all(page.map(async ([, item]) => {
+			const claim = observed.get(claimKey$1(item.hookId));
+			if (!claim || claim.claimId !== item.claimId || claim.expiresAt > now) return;
+			const hook = await resolveExpiredHookClaim(this.env, claim.owner, claim.claimId);
+			committed.set(claimKey$1(item.hookId), hook !== null);
+		}));
 		await this.ctx.storage.transaction(async (txn) => {
-			const due = await txn.list({
-				prefix: CLAIM_DEADLINE_PREFIX$1,
-				end: `${CLAIM_DEADLINE_PREFIX$1}${pad$2(now + 1)}`,
-				limit: 129
-			});
-			const page = Array.from(due).slice(0, 128);
 			const claims = await txn.get(page.map(([, item]) => claimKey$1(item.hookId)));
-			const deletes = page.flatMap(([deadline, item]) => {
+			const deletes = [];
+			for (const [deadline, item] of page) {
 				const key = claimKey$1(item.hookId);
 				const claim = claims.get(key);
-				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
-			});
+				const snapshot = observed.get(key);
+				if (claim?.claimId !== item.claimId || claim.expiresAt > now) deletes.push(deadline);
+				else if (claim.claimId === snapshot?.claimId && claim.expiresAt === snapshot.expiresAt) {
+					if (committed.get(key)) await this.renewClaim(txn, item.hookId, claim, now);
+					else deletes.push(deadline, key);
+				}
+			}
 			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
 			if (due.size > 128) {
 				await txn.setAlarm(now + 1);
@@ -2444,51 +2531,68 @@ var HookTokenDO = class extends DurableObject {
 		return await runIsActive(this.env, owner.runId) ? raw : null;
 	}
 	async reserve(token, owner, proposedClaimId) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const record = recordKey(token);
-			const claim = claimKey(token);
-			const values = await txn.get([record, claim]);
-			const indexed = values.get(record);
-			if (indexed !== void 0) return {
-				claimed: false,
-				holder: ownerFromSerializedHook(indexed)
-			};
-			let existing = values.get(claim);
-			const now = this.now();
-			if (existing && existing.expiresAt <= now) {
-				await txn.delete([claim, existing.deadlineKey]);
-				existing = void 0;
-			}
-			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
-				claimed: false,
-				holder: existing.owner
-			};
-			if (existing === void 0) {
-				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
-				const deadlineKey = claimDeadlineKey(token, expiresAt);
-				await txn.put(claim, {
-					owner,
-					claimId: proposedClaimId,
-					reservedAt: now,
-					expiresAt,
-					deadlineKey
-				});
-				await txn.put(deadlineKey, {
-					token,
-					claimId: proposedClaimId,
-					expiresAt
-				});
-				await this.armAtMost(txn, expiresAt);
+		for (;;) {
+			const observed = await this.ctx.storage.get(claimKey(token));
+			const expired = observed && observed.expiresAt <= this.now() ? observed : void 0;
+			const committed = expired ? await resolveExpiredHookClaim(this.env, expired.owner, expired.claimId, token) : void 0;
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const record = recordKey(token);
+				const claim = claimKey(token);
+				const values = await txn.get([record, claim]);
+				const indexed = values.get(record);
+				if (indexed !== void 0) return {
+					claimed: false,
+					holder: ownerFromSerializedHook(indexed)
+				};
+				let existing = values.get(claim);
+				const now = this.now();
+				if (existing && existing.expiresAt <= now) {
+					if (existing.claimId !== expired?.claimId || existing.expiresAt !== expired.expiresAt) return null;
+					if (committed) {
+						await this.renewClaim(txn, token, existing, now);
+						return sameOwner(existing.owner, owner) ? {
+							claimed: true,
+							claimId: existing.claimId
+						} : {
+							claimed: false,
+							holder: existing.owner
+						};
+					}
+					await txn.delete([claim, existing.deadlineKey]);
+					existing = void 0;
+				}
+				if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+					claimed: false,
+					holder: existing.owner
+				};
+				if (existing === void 0) {
+					const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+					const deadlineKey = claimDeadlineKey(token, expiresAt);
+					await txn.put(claim, {
+						owner,
+						claimId: proposedClaimId,
+						reservedAt: now,
+						expiresAt,
+						deadlineKey
+					});
+					await txn.put(deadlineKey, {
+						token,
+						claimId: proposedClaimId,
+						expiresAt
+					});
+					await this.armAtMost(txn, expiresAt);
+					return {
+						claimed: true,
+						claimId: proposedClaimId
+					};
+				}
 				return {
 					claimed: true,
-					claimId: proposedClaimId
+					claimId: existing.claimId
 				};
-			}
-			return {
-				claimed: true,
-				claimId: existing.claimId
-			};
-		});
+			});
+			if (result) return result;
+		}
 	}
 	async finalize(token, serializedHook, owner, claimId) {
 		if (!await runIsActive(this.env, owner.runId)) {
@@ -2505,10 +2609,7 @@ var HookTokenDO = class extends DurableObject {
 			const indexed = values.get(record);
 			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
 			const existingClaim = values.get(claim);
-			if (existingClaim && existingClaim.expiresAt <= this.now()) {
-				await txn.delete([claim, existingClaim.deadlineKey]);
-				return { stored: false };
-			}
+			if (existingClaim && existingClaim.expiresAt <= this.now()) throw new Error(`Hook token ${token} reservation expired`);
 			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook token ${token} is reserved by another hook`);
 			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook token ${token} has no active reservation`);
 			await txn.put(record, serializedHook);
@@ -2558,21 +2659,51 @@ var HookTokenDO = class extends DurableObject {
 		const current = await storage.getAlarm();
 		if (current === null || at < current) await storage.setAlarm(at);
 	}
+	async renewClaim(txn, token, claim, now) {
+		const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+		const deadlineKey = claimDeadlineKey(token, expiresAt);
+		await txn.delete(claim.deadlineKey);
+		await txn.put(claimKey(token), {
+			...claim,
+			expiresAt,
+			deadlineKey
+		});
+		await txn.put(deadlineKey, {
+			token,
+			claimId: claim.claimId,
+			expiresAt
+		});
+		await this.armAtMost(txn, expiresAt);
+	}
 	async compactClaims() {
 		const now = this.now();
+		const due = await this.ctx.storage.list({
+			prefix: CLAIM_DEADLINE_PREFIX,
+			end: `${CLAIM_DEADLINE_PREFIX}${pad$1(now + 1)}`,
+			limit: 129
+		});
+		const page = Array.from(due).slice(0, 128);
+		const observed = await this.ctx.storage.get(page.map(([, item]) => claimKey(item.token)));
+		const committed = /* @__PURE__ */ new Map();
+		await Promise.all(page.map(async ([, item]) => {
+			const claim = observed.get(claimKey(item.token));
+			if (!claim || claim.claimId !== item.claimId || claim.expiresAt > now) return;
+			const hook = await resolveExpiredHookClaim(this.env, claim.owner, claim.claimId, item.token);
+			committed.set(claimKey(item.token), hook !== null);
+		}));
 		await this.ctx.storage.transaction(async (txn) => {
-			const due = await txn.list({
-				prefix: CLAIM_DEADLINE_PREFIX,
-				end: `${CLAIM_DEADLINE_PREFIX}${pad$1(now + 1)}`,
-				limit: 129
-			});
-			const page = Array.from(due).slice(0, 128);
 			const claims = await txn.get(page.map(([, item]) => claimKey(item.token)));
-			const deletes = page.flatMap(([deadline, item]) => {
+			const deletes = [];
+			for (const [deadline, item] of page) {
 				const key = claimKey(item.token);
 				const claim = claims.get(key);
-				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
-			});
+				const snapshot = observed.get(key);
+				if (claim?.claimId !== item.claimId || claim.expiresAt > now) deletes.push(deadline);
+				else if (claim.claimId === snapshot?.claimId && claim.expiresAt === snapshot.expiresAt) {
+					if (committed.get(key)) await this.renewClaim(txn, item.token, claim, now);
+					else deletes.push(deadline, key);
+				}
+			}
 			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
 			if (due.size > 128) {
 				await txn.setAlarm(now + 1);
@@ -3049,6 +3180,15 @@ var StreamDO = class extends DurableObject {
 				size: validateSegmentSize(entry[1], start)
 			});
 		}
+		let covered = startIndex;
+		for (let index = 0; index < planned.length; index++) {
+			const { start, size } = planned[index];
+			if (start > covered) throw new Error(`Missing persisted stream segment at index ${covered}`);
+			if (index > 0 && start !== covered) throw new Error(`Overlapping persisted stream segment at index ${start}`);
+			if (start + size.count <= covered) throw new Error(`Missing persisted stream segment at index ${covered}`);
+			covered = start + size.count;
+		}
+		if (covered < endIndex) throw new Error(`Missing persisted stream segment at index ${covered}`);
 		const selected = [];
 		let plannedBytes = 0;
 		for (const segment of planned) {
@@ -3659,6 +3799,28 @@ var WorkflowRunDO = class extends DurableObject {
 	async getRun() {
 		return this.readKey("run");
 	}
+	/** Fence both supported event-claim forms before an expired shard claim is released. */
+	async resolveExpiredHookClaim(request) {
+		if (typeof request?.hookId !== "string" || request.hookId.length === 0 || typeof request.claimId !== "string" || request.claimId.length === 0 || request.token !== void 0 && typeof request.token !== "string") throw new TypeError("world-celld expired hook claim resolution is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return null;
+			const run = await txn.get("run");
+			if (run && isTerminalWorkflowRunStatus(run.status)) return null;
+			const hook = await txn.get(`${HOOK_KEY_PREFIX}${request.hookId}`);
+			if (hook && (request.token === void 0 || hook.token === request.token)) return hook;
+			const cancellation = {
+				hookId: request.hookId,
+				token: request.token,
+				canceledAt: this.now()
+			};
+			await txn.put({
+				[hookClaimCancellationKey(`${request.claimId}:${request.claimId}`)]: cancellation,
+				[hookClaimCancellationKey(`-:${request.claimId}`)]: cancellation
+			});
+			return null;
+		});
+	}
 	/** Single authoritative lifecycle answer used after derivative compaction. */
 	async getLifecycleStatus() {
 		return await this.ctx.storage.transaction(async (txn) => {
@@ -4290,7 +4452,7 @@ var WorkflowRunDO = class extends DurableObject {
 	* the run expiry check.
 	*/
 	async reserveRunQueueMessage(params) {
-		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld run queue reservation is invalid");
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt) || params.publicationPending !== void 0 && typeof params.publicationPending !== "boolean") throw new TypeError("world-celld run queue reservation is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
 			const key = runQueueClaimKey(params.claimName);
 			const values = await txn.get([
@@ -4310,17 +4472,19 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 			const state = values.get(key) ?? {};
 			const existing = state.reservation;
-			if (existing && existing.expiresAt > this.now() && existing.messageId !== params.messageId) return {
+			if (existing && existing.expiresAt > this.now() && (existing.messageId !== params.messageId || params.publicationPending)) return {
 				ok: true,
 				scope: "run",
 				admitted: false,
-				messageId: existing.messageId
+				messageId: existing.messageId,
+				...existing.publicationPending ? { publicationPending: true } : {}
 			};
 			await txn.put(key, {
 				...state,
 				reservation: {
 					messageId: params.messageId,
-					expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt)
+					expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt),
+					...params.publicationPending ? { publicationPending: true } : {}
 				}
 			});
 			return {
@@ -4331,6 +4495,21 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 		});
 	}
+	async confirmRunQueueMessagePublication(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld run queue publication confirmation is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (state?.reservation?.messageId !== params.messageId) return;
+			await txn.put(key, {
+				...state,
+				reservation: {
+					messageId: params.messageId,
+					expiresAt: Math.max(state.reservation.expiresAt, params.expiresAt)
+				}
+			});
+		});
+	}
 	/** Delivery-side run expiry check and in-flight claim in one transaction. */
 	async claimRunQueueMessage(params) {
 		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isPositiveSafeInteger(params.staleMs)) throw new TypeError("world-celld run queue claim is invalid");
@@ -4342,9 +4521,19 @@ var WorkflowRunDO = class extends DurableObject {
 				key
 			]);
 			if (this.tombstoneFrom(values)) return { expired: true };
-			const state = values.get(key) ?? {};
-			const existing = state.claim;
+			let state = values.get(key) ?? {};
 			const now = this.now();
+			if (state.reservation?.publicationPending && state.reservation.messageId === params.messageId) {
+				state = {
+					...state,
+					reservation: {
+						messageId: params.messageId,
+						expiresAt: Math.max(state.reservation.expiresAt, now + QUEUE_RESERVATION_GRACE_MS)
+					}
+				};
+				await txn.put(key, state);
+			}
+			const existing = state.claim;
 			if (existing && existing.expiresAt > now) {
 				if (existing.messageId !== params.messageId) return {
 					expired: false,
@@ -4416,6 +4605,18 @@ var WorkflowRunDO = class extends DurableObject {
 			else await txn.delete(key);
 		});
 	}
+	/** Failed enqueue cleanup must preserve delivery already accepted by the broker. */
+	async abandonRunQueueMessageReservation(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0) throw new TypeError("world-celld run queue reservation abandonment is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (state?.reservation?.messageId !== params.messageId) return;
+			const { reservation: _abandoned, ...rest } = state;
+			if (rest.claim) await txn.put(key, rest);
+			else await txn.delete(key);
+		});
+	}
 	async registerQueuePayload(registration) {
 		if (!registration || typeof registration.messageId !== "string" || registration.messageId.length === 0 || typeof registration.key !== "string" || registration.key.length === 0 || !isNonNegativeSafeInteger(registration.orphanExpiresAt)) throw new TypeError("world-celld queue payload registration is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
@@ -4472,22 +4673,24 @@ var WorkflowRunDO = class extends DurableObject {
 		});
 	}
 	async reserveQueueMessage(params) {
-		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld queue message reservation is invalid");
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt) || params.publicationPending !== void 0 && typeof params.publicationPending !== "boolean") throw new TypeError("world-celld queue message reservation is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
 			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
 			const existing = values.get(QUEUE_RESERVATION_KEY);
 			const claim = values.get("claim");
 			const now = this.now();
-			if (existing && existing.expiresAt > now && existing.messageId !== params.messageId) {
+			if (existing && existing.expiresAt > now && (existing.messageId !== params.messageId || params.publicationPending)) {
 				await txn.setAlarm(Math.min(existing.expiresAt, claim?.expiresAt ?? existing.expiresAt));
 				return {
 					admitted: false,
-					messageId: existing.messageId
+					messageId: existing.messageId,
+					...existing.publicationPending ? { publicationPending: true } : {}
 				};
 			}
 			const reservation = {
 				messageId: params.messageId,
-				expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt)
+				expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt),
+				...params.publicationPending ? { publicationPending: true } : {}
 			};
 			await txn.put(QUEUE_RESERVATION_KEY, reservation);
 			await txn.setAlarm(Math.min(reservation.expiresAt, claim?.expiresAt ?? reservation.expiresAt));
@@ -4497,6 +4700,20 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 		});
 	}
+	async confirmQueueMessagePublication(params) {
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld queue publication confirmation is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			const existing = values.get(QUEUE_RESERVATION_KEY);
+			if (existing?.messageId !== params.messageId) return;
+			const reservation = {
+				messageId: params.messageId,
+				expiresAt: Math.max(existing.expiresAt, params.expiresAt)
+			};
+			await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			await txn.setAlarm(Math.min(reservation.expiresAt, values.get("claim")?.expiresAt ?? reservation.expiresAt));
+		});
+	}
 	async completeQueueMessage(messageId) {
 		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue messageId must be a non-empty string");
 		await this.ctx.storage.transaction(async (txn) => {
@@ -4516,13 +4733,32 @@ var WorkflowRunDO = class extends DurableObject {
 			else await txn.deleteAlarm();
 		});
 	}
+	/** Abandon the enqueue reservation without releasing an active delivery claim. */
+	async abandonQueueMessageReservation(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue reservation messageId must be a non-empty string");
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			if (values.get(QUEUE_RESERVATION_KEY)?.messageId !== messageId) return;
+			await txn.delete(QUEUE_RESERVATION_KEY);
+			const claim = values.get("claim");
+			if (claim) await txn.setAlarm(claim.expiresAt);
+			else await txn.deleteAlarm();
+		});
+	}
 	async claimInflight(params) {
 		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isPositiveSafeInteger(params.staleMs)) throw new TypeError("world-celld queue claim is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
 			const values = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
 			const existing = values.get("claim");
-			const reservation = values.get(QUEUE_RESERVATION_KEY);
+			let reservation = values.get(QUEUE_RESERVATION_KEY);
 			const now = this.now();
+			if (reservation?.publicationPending && reservation.messageId === params.messageId) {
+				reservation = {
+					messageId: params.messageId,
+					expiresAt: Math.max(reservation.expiresAt, now + QUEUE_RESERVATION_GRACE_MS)
+				};
+				await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			}
 			if (existing && existing.expiresAt > now) {
 				if (existing.messageId !== params.messageId) return { claimed: false };
 				if (existing.retryAt === void 0 || existing.retryAt > now) return {
@@ -4576,6 +4812,146 @@ var WorkflowRunDO = class extends DurableObject {
 	}
 };
 //#endregion
+//#region src/worker/queue-delivery.ts
+/** Internal delivery contract. No Request/Response objects cross the RPC boundary. */
+const MAX_QUEUE_DELIVERY_RESPONSE_BYTES = 65536;
+const QUEUE_ORPHAN_GRACE_MS = 432e6;
+const PERMANENT_QUEUE_STATUSES = /* @__PURE__ */ new Set([
+	404,
+	409,
+	410,
+	422
+]);
+async function readResponseText(response) {
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let text = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_QUEUE_DELIVERY_RESPONSE_BYTES) {
+				await reader.cancel("queue delivery response is too large").catch(() => void 0);
+				throw new Error("workflow queue handler response exceeds configured limit");
+			}
+			text += decoder.decode(value, { stream: true });
+		}
+		return text + decoder.decode();
+	} finally {
+		reader.releaseLock();
+	}
+}
+/** Validate at the service boundary; callers cannot bypass auth via RPC. */
+async function deliverQueueMessage(env, secret, input, attempt) {
+	if (!env.WORLD_SECRET) throw new Error("WORLD_SECRET is not configured");
+	if (typeof secret !== "string" || !secret || !await timingSafeEqual(secret, env.WORLD_SECRET)) throw new Error("Unauthorized Queue delivery");
+	const envelope = validateNativeQueueEnvelope(input);
+	if (!Number.isSafeInteger(attempt) || attempt < 1) throw new TypeError("queue delivery attempt must be a positive safe integer");
+	if (!env.WORKFLOW_DB) throw new Error("missing binding: WORKFLOW_DB");
+	const namespace = env.WORKFLOW_DB;
+	const payloadStore = env.WORKFLOW_QUEUE_PAYLOADS;
+	const runStub = (name) => namespace.get(namespace.idFromName(name));
+	const claim = deliveryQueueClaim(envelope, runStub);
+	let claimed = false;
+	async function releaseClaim() {
+		if (claimed) await claim.release(envelope.messageId);
+	}
+	async function unregisterPayload() {
+		if (envelope.runId) {
+			await runStub(envelope.runId).unregisterQueuePayload(envelope.messageId);
+			await runStub(queueOrphanName(envelope.messageId)).cancelQueuePayloadOrphan(envelope.messageId);
+		}
+	}
+	try {
+		let admission;
+		if (envelope.runId && !envelope.payloadKey && envelope.claimScope !== "run") {
+			admission = runStub(envelope.runId).getQueueAdmission();
+			admission.catch(() => void 0);
+		}
+		if (claim) {
+			const result = await claim.claim(envelope.messageId, QUEUE_CLAIM_STALE_MS);
+			if (result.expired) return { kind: "complete" };
+			if (!result.claimed) {
+				const now = Date.now();
+				if (result.retryAt !== void 0 && result.retryAt > now) return {
+					kind: "suspend",
+					timeoutSeconds: Math.max(1, Math.ceil((result.retryAt - now) / 1e3))
+				};
+				return { kind: "complete" };
+			}
+			claimed = true;
+		}
+		if (admission && !(await admission).ok) {
+			await claim?.complete(envelope.messageId);
+			return { kind: "complete" };
+		}
+		let body = envelope.body;
+		if (envelope.payloadKey) {
+			if (!payloadStore) throw new Error("missing binding: WORKFLOW_QUEUE_PAYLOADS");
+			body = await payloadStore.read(envelope.payloadKey) ?? void 0;
+			if (body === void 0) {
+				await unregisterPayload();
+				await claim?.complete(envelope.messageId);
+				return { kind: "complete" };
+			}
+		}
+		const headers = {
+			"content-type": "application/json",
+			"x-vqs-queue-name": envelope.queueName,
+			"x-vqs-message-id": envelope.messageId,
+			"x-vqs-message-attempt": String(attempt)
+		};
+		if (env.WORKFLOW_CALLBACK_SECRET) headers["x-workflow-callback-secret"] = env.WORKFLOW_CALLBACK_SECRET;
+		const callback = await fetch(`${envelope.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/flow`, {
+			method: "POST",
+			headers,
+			body,
+			signal: AbortSignal.timeout(3e5)
+		});
+		if (callback.ok || PERMANENT_QUEUE_STATUSES.has(callback.status)) {
+			await callback.body?.cancel().catch(() => void 0);
+			if (envelope.payloadKey) {
+				await payloadStore.delete(envelope.payloadKey);
+				await unregisterPayload();
+			}
+			await claim?.complete(envelope.messageId);
+			return { kind: "complete" };
+		}
+		if (callback.status === 503) {
+			const responseBody = await readResponseText(callback);
+			const timeoutSeconds = JSON.parse(responseBody).timeoutSeconds;
+			const notBefore = queueDelayDeadline(Date.now(), timeoutSeconds, 1, QUEUE_CLAIM_STALE_MS);
+			if (notBefore === null) throw new Error("workflow queue suspension deadline is invalid");
+			if (envelope.payloadKey && envelope.runId) await runStub(queueOrphanName(envelope.messageId)).scheduleQueuePayloadOrphan({
+				messageId: envelope.messageId,
+				runId: envelope.runId,
+				key: envelope.payloadKey,
+				expiresAt: notBefore + QUEUE_ORPHAN_GRACE_MS
+			});
+			if (claim) await claim.hold({
+				messageId: envelope.messageId,
+				retryAt: notBefore,
+				expiresAt: notBefore + QUEUE_CLAIM_STALE_MS,
+				reservationExpiresAt: notBefore + QUEUE_ORPHAN_GRACE_MS
+			});
+			return {
+				kind: "suspend",
+				timeoutSeconds
+			};
+		}
+		await callback.body?.cancel().catch(() => void 0);
+		await releaseClaim();
+		claimed = false;
+		return { kind: "retry" };
+	} catch (error) {
+		await releaseClaim();
+		throw error;
+	}
+}
+//#endregion
 //#region src/testing/http-harness.ts
 /**
 * Boots the real worker router over real cell classes (on FakeFleet state)
@@ -4584,6 +4960,7 @@ var WorkflowRunDO = class extends DurableObject {
 async function startHarness(options = {}) {
 	const cellEnv = { ...options.cellEnv };
 	const queueMessages = [];
+	const queuePublications = [];
 	const queuePayloads = /* @__PURE__ */ new Map();
 	const queuePayloadBucket = {
 		async put(key, value) {
@@ -4597,8 +4974,12 @@ async function startHarness(options = {}) {
 			for (const key of Array.isArray(keys) ? keys : [keys]) queuePayloads.delete(key);
 		}
 	};
-	const nativeQueue = { async send(body) {
+	const nativeQueue = { async send(body, sendOptions) {
 		queueMessages.push(body);
+		queuePublications.push({
+			body,
+			delaySeconds: sendOptions?.delaySeconds ?? 0
+		});
 	} };
 	const fleet = new FakeFleet({
 		runs: WorkflowRunDO,
@@ -4617,7 +4998,7 @@ async function startHarness(options = {}) {
 		WORKFLOW_HOOK_IDS: fleet.namespace("hook-ids"),
 		WORKFLOW_QUEUE_PAYLOADS: queuePayloadBucket
 	});
-	const router = createRouter({
+	const env = {
 		WORKFLOW_DB: fleet.namespace("runs"),
 		WORKFLOW_STREAMS: fleet.namespace("streams"),
 		WORKFLOW_RUN_CATALOG: fleet.namespace("run-catalog"),
@@ -4626,7 +5007,8 @@ async function startHarness(options = {}) {
 		WORKFLOW_QUEUE: nativeQueue,
 		WORKFLOW_QUEUE_PAYLOADS: createQueuePayloadStore(queuePayloadBucket),
 		WORLD_SECRET: options.secret
-	});
+	};
+	const router = createRouter(env);
 	const server = http.createServer(async (req, res) => {
 		const requestAbort = new AbortController();
 		const abortRequest = () => {
@@ -4669,7 +5051,9 @@ async function startHarness(options = {}) {
 		url: `http://127.0.0.1:${port}`,
 		fleet,
 		queueMessages,
+		queuePublications,
 		queuePayloads,
+		deliverQueueMessage: (secret, envelope, attempt) => deliverQueueMessage(env, secret, envelope, attempt),
 		close: () => new Promise((resolve, reject) => {
 			server.close((err) => err ? reject(err) : resolve());
 			server.closeAllConnections();
@@ -4677,11 +5061,148 @@ async function startHarness(options = {}) {
 	};
 }
 //#endregion
+//#region src/worker/queue-consumer.ts
+function backoffSeconds(attempt) {
+	return Math.min(60, 2 ** Math.min(attempt, 30));
+}
+async function republish(env, envelope, now = Date.now()) {
+	await env.WORKFLOW_QUEUE.send(JSON.stringify(envelope), {
+		contentType: "text",
+		delaySeconds: nativeQueueDelaySeconds(envelope.notBefore, now)
+	});
+}
+async function consume(message, env) {
+	let envelope;
+	try {
+		if (typeof message.body !== "string") throw new TypeError("native Queue message body must be text");
+		envelope = validateNativeQueueEnvelope(JSON.parse(message.body));
+	} catch (error) {
+		console.error("world-celld native Queue rejected malformed broker message", error);
+		message.retry({ delaySeconds: backoffSeconds(message.attempts) });
+		return;
+	}
+	const now = Date.now();
+	if (envelope.notBefore !== void 0 && envelope.notBefore > now) {
+		try {
+			await republish(env, envelope, now);
+			message.ack();
+		} catch (error) {
+			console.error("world-celld native Queue failed to continue a long delay", error);
+			message.retry({ delaySeconds: backoffSeconds(message.attempts) });
+		}
+		return;
+	}
+	const attempt = (envelope.deliveryFailures ?? 0) + message.attempts;
+	if (!env.WORLD_SECRET) {
+		console.error("world-celld Queue consumer missing WORLD_SECRET");
+		message.retry({ delaySeconds: backoffSeconds(attempt) });
+		return;
+	}
+	let response;
+	try {
+		response = await env.WORLD_SERVICE.deliver(env.WORLD_SECRET, envelope, attempt);
+	} catch (error) {
+		console.error("world-celld Queue consumer could not reach the world service", error);
+		message.retry({ delaySeconds: backoffSeconds(attempt) });
+		return;
+	}
+	if (response?.kind === "complete") {
+		message.ack();
+		return;
+	}
+	if (response?.kind === "suspend") try {
+		const notBefore = queueDelayDeadline(Date.now(), response.timeoutSeconds, 1, QUEUE_CLAIM_STALE_MS);
+		const suspensionCount = (envelope.suspensionCount ?? 0) + 1;
+		if (notBefore !== null && suspensionCount <= 256) {
+			await republish(env, {
+				...envelope,
+				notBefore,
+				deliveryFailures: attempt - 1,
+				suspensionCount
+			});
+			message.ack();
+			return;
+		}
+	} catch (error) {
+		console.error("world-celld Queue consumer received an invalid suspension response", error);
+	}
+	message.retry({ delaySeconds: backoffSeconds(attempt) });
+}
+var queue_consumer_default = { async queue(batch, env) {
+	await Promise.all(batch.messages.map((message) => consume(message, env)));
+} };
+//#endregion
 //#region src/testing/index.ts
 /** Alarm-pump interval for the dev fleet (real time). */
 const PUMP_INTERVAL_MS = 25;
 async function startDevFleet(options = {}) {
 	const harness = await startHarness(options);
+	const pending = [];
+	const deliveries = /* @__PURE__ */ new Set();
+	let publicationCursor = 0;
+	let stopped = false;
+	const queueEnv = {
+		WORKFLOW_QUEUE: { async send(body, sendOptions) {
+			harness.queueMessages.push(body);
+			harness.queuePublications.push({
+				body,
+				delaySeconds: sendOptions?.delaySeconds ?? 0
+			});
+		} },
+		WORLD_SERVICE: { deliver: (secret, envelope, attempt) => harness.deliverQueueMessage(secret, envelope, attempt) },
+		WORLD_SECRET: options.secret
+	};
+	function dispatch(message) {
+		let settled = false;
+		const delivery = queue_consumer_default.queue({ messages: [{
+			body: message.body,
+			attempts: message.attempts,
+			ack() {
+				settled = true;
+			},
+			retry(retryOptions) {
+				settled = true;
+				if (!stopped) pending.push({
+					body: message.body,
+					attempts: message.attempts + 1,
+					dueAt: Date.now() + (retryOptions?.delaySeconds ?? 0) * 1e3
+				});
+			}
+		}] }, queueEnv).then(() => {
+			if (!settled) {
+				console.error("[world-celld dev fleet] Queue delivery was not settled");
+				if (!stopped) pending.push({
+					body: message.body,
+					attempts: message.attempts + 1,
+					dueAt: Date.now() + 1e3
+				});
+			}
+		}).catch((error) => {
+			console.error("[world-celld dev fleet] Queue consumer failed", error);
+			if (!settled && !stopped) pending.push({
+				body: message.body,
+				attempts: message.attempts + 1,
+				dueAt: Date.now() + 1e3
+			});
+		});
+		deliveries.add(delivery);
+		delivery.finally(() => deliveries.delete(delivery));
+	}
+	const queuePump = setInterval(() => {
+		if (stopped) return;
+		while (publicationCursor < harness.queuePublications.length) {
+			const publication = harness.queuePublications[publicationCursor++];
+			pending.push({
+				body: publication.body,
+				attempts: 1,
+				dueAt: Date.now() + publication.delaySeconds * 1e3
+			});
+		}
+		const now = Date.now();
+		for (let index = 0; index < pending.length;) if (pending[index].dueAt <= now) dispatch(pending.splice(index, 1)[0]);
+		else index++;
+	}, PUMP_INTERVAL_MS);
+	queuePump.unref?.();
 	let pumping = false;
 	const pump = setInterval(async () => {
 		if (pumping) return;
@@ -4699,7 +5220,10 @@ async function startDevFleet(options = {}) {
 	return {
 		...harness,
 		async stop() {
+			stopped = true;
+			clearInterval(queuePump);
 			clearInterval(pump);
+			await Promise.allSettled(deliveries);
 			await harness.close();
 		}
 	};