@pramen/server 0.0.61 → 0.0.63

package/dist/durable-object.js

@@ -144,7 +144,7 @@ export class PramenDOBase extends DurableObject {
         const db = new Db(this.driver, { acl: this.acl, identity: { roles: ["admin"] }, system: true, partition: this.partition, schema: this.app.schema, suppressTriggers: true }, this.app.schema);
         for (const fn of fns) {
             try {
-                await this.driver.transaction(() => Promise.resolve(fn({ db, driver: this.driver, schema: this.app.schema, partition: this.partition })));
+                await this.driver.transaction(() => Promise.resolve(fn({ db, driver: this.driver, schema: this.app.schema, partition: this.partition, env: this.envBag })));
             }
             catch (e) {
                 console.error(`[pramen] bootstrap failed (partition=${this.partition}):`, e);

package/dist/pramen.d.ts

@@ -60,7 +60,7 @@ export type { Env, DoEnv };
  * use the D1 store with deferred tasks. */
 export declare function createPramen(app: PramenApp): {
     fetch: (request: Request, env: Env, ctx: ExecutionContext) => Promise<Response>;
-    scheduled: (event: unknown, env: Env) => Promise<void>;
+    scheduled: (event: unknown, env: Env, ctx: ExecutionContext) => Promise<void>;
     queue: (batch: QueueBatch, env: Env) => Promise<void>;
     PramenDO: ReturnType<typeof pramenDO>;
 };

package/dist/runtime/boot.d.ts

@@ -0,0 +1,37 @@
+import type { Driver } from "./driver";
+export interface SharedBootOpts {
+    /** How long a still-unsettled boot may go without progress before it counts as orphaned. */
+    staleMs: number;
+    /** Clock, injectable for tests. */
+    now?: () => number;
+    /** Called when a boot is judged orphaned and replaced, with how long it had been idle. */
+    onOrphaned?: (idleMs: number) => void;
+}
+/** The boot body. Call `progress()` whenever the boot does observable work — see
+ * `observeDriver` for the standard way to get that for free. */
+export type BootFn = (progress: () => void) => Promise<void>;
+export declare class SharedBoot {
+    private readonly opts;
+    private current;
+    private readonly now;
+    constructor(opts: SharedBootOpts);
+    /** Await the shared boot, starting one if none is live (or the live one looks orphaned).
+     *
+     * `run` is only invoked when THIS call has to start a boot. `keepAlive` is the calling
+     * invocation's lifetime extender (`ctx.waitUntil`); it is handed the boot's promise so
+     * the boot survives the caller disconnecting. A rejected boot rejects every awaiter and
+     * clears the memo, so the next call retries — fail closed, as before. */
+    ensure(run: BootFn, keepAlive?: (p: Promise<unknown>) => void): Promise<void>;
+    /** Whether a boot has completed in this isolate — for diagnostics only. */
+    isDone(): boolean;
+    private isStale;
+    private start;
+    /** Resolves `true` when the boot settles (rejects if it rejected), `false` once it has
+     * gone `staleMs` without progress — the timer re-arms from the latest progress instant,
+     * so a boot that keeps working is never reported stale. */
+    private settledBeforeStale;
+}
+/** Wrap a Driver so every statement it runs reports progress — the boot's liveness signal.
+ * `batch` is forwarded only when the wrapped driver has it, because the migrator decides
+ * between an atomic batch and sequential exec by its presence. */
+export declare function observeDriver(driver: Driver, progress: () => void): Driver;

package/dist/runtime/boot.js

@@ -0,0 +1,157 @@
+// SharedBoot — a once-per-isolate boot that many invocations await, made safe to share.
+//
+// The D1 store boots in the Worker: migrate → data migrations → outbox table → bootstrap,
+// run by whichever request arrives first in a fresh isolate and memoized as ONE promise the
+// rest await (running it per request would re-diff the schema on every call). That memo
+// is the bug behind GitHub #51, and the reason is a Workers runtime rule, not pramen code:
+// async work belongs to the INVOCATION that started it. When that invocation ends — the
+// caller gives up and disconnects, which is exactly what a proxy with a 15 s ceiling does
+// to the legitimately slow first request after a deploy carrying a table rebuild — its
+// pending I/O is canceled, and a promise chained on canceled I/O never settles. Not
+// rejected: never settles. So the `.catch` that was meant to clear the memo never runs,
+// and every later fetch in that isolate awaits a promise that cannot resolve, for as long
+// as its own caller allows, at 0 ms CPU. Crons stayed healthy in the report because they
+// landed in a different isolate; the ~54 % was the share of traffic routed to the wedged
+// one; a redeploy "fixed" it by discarding every isolate.
+//
+// Two defenses, and both are needed:
+//
+//  1. The STARTER extends its invocation over the boot with `ctx.waitUntil`, so the client
+//     disconnecting no longer cancels the boot's I/O. That closes the reported case. It is
+//     not sufficient on its own: waitUntil is capped (30 s after the response or the
+//     disconnect), and there is no rule that says a promise's owner is the only way it can
+//     be orphaned.
+//  2. AWAITERS never trust a shared boot unconditionally. The boot reports PROGRESS (every
+//     statement the driver runs), and a boot that has made none for `staleMs` while still
+//     unsettled is treated as orphaned: the next awaiter — arriving, or one already waiting
+//     — starts a fresh boot in its own invocation and awaits that instead. An isolate can
+//     therefore be wedged for at most `staleMs`, never for its lifetime. Every step of the
+//     boot tolerates a second runner (that is the cross-isolate reality on D1 already: the
+//     migration ledger is lease-claimed, migrate is a diff, bootstrap is an upsert), so a
+//     false positive costs a redundant boot, not correctness — which is why the threshold is
+//     measured from the last STATEMENT and not from the boot's start: a boot that is slow
+//     but alive keeps making progress.
+//
+// Platform-agnostic on purpose (no `cloudflare:workers`): `keepAlive` is whatever the host
+// offers to extend an invocation, and `now` is injectable for tests.
+export class SharedBoot {
+    opts;
+    current;
+    now;
+    constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now ?? Date.now;
+    }
+    /** Await the shared boot, starting one if none is live (or the live one looks orphaned).
+     *
+     * `run` is only invoked when THIS call has to start a boot. `keepAlive` is the calling
+     * invocation's lifetime extender (`ctx.waitUntil`); it is handed the boot's promise so
+     * the boot survives the caller disconnecting. A rejected boot rejects every awaiter and
+     * clears the memo, so the next call retries — fail closed, as before. */
+    async ensure(run, keepAlive) {
+        let boot = this.current;
+        // The STARTER awaits its own boot outright: the boot runs in its invocation, so if
+        // the starter is alive to watch, so is the boot — and if the invocation is canceled,
+        // this await dies with it. A starter that also watched would restart its own
+        // (dead-for-everyone-else) boot every window, endlessly.
+        if (!boot || this.isStale(boot))
+            return this.start(run, keepAlive, boot).promise;
+        for (;;) {
+            if (boot.done)
+                return;
+            // Wait, but wake when the boot WOULD count as stale, and re-check: progress since
+            // means it is alive and we keep waiting; none means it is orphaned.
+            if (await this.settledBeforeStale(boot))
+                return;
+            // Someone else may already have replaced it — join theirs rather than start a third.
+            const live = this.current;
+            if (live && live !== boot && !this.isStale(live)) {
+                boot = live;
+                continue;
+            }
+            return this.start(run, keepAlive, boot).promise;
+        }
+    }
+    /** Whether a boot has completed in this isolate — for diagnostics only. */
+    isDone() {
+        return this.current?.done === true;
+    }
+    isStale(boot) {
+        return !boot.done && this.now() - boot.lastProgressAt >= this.opts.staleMs;
+    }
+    start(run, keepAlive, replacing) {
+        if (replacing)
+            this.opts.onOrphaned?.(this.now() - replacing.lastProgressAt);
+        const record = { promise: Promise.resolve(), lastProgressAt: this.now(), done: false };
+        const progress = () => {
+            record.lastProgressAt = this.now();
+        };
+        // Through a resolved promise so a synchronous throw in `run` is a rejection, not an
+        // exception escaping `ensure` with the memo half-installed.
+        record.promise = Promise.resolve()
+            .then(() => run(progress))
+            .then(() => {
+            record.done = true;
+        }, (e) => {
+            // Only forget the memo if it is still THIS boot: a replacement started meanwhile
+            // must not be discarded because its predecessor finally failed.
+            if (this.current === record)
+                this.current = undefined;
+            throw e;
+        });
+        // Every awaiter attaches its own handler; this one just keeps the host from reporting
+        // an unhandled rejection when a boot fails with nobody awaiting the stored promise.
+        record.promise.catch(() => { });
+        keepAlive?.(record.promise.catch(() => { }));
+        this.current = record;
+        return record;
+    }
+    /** Resolves `true` when the boot settles (rejects if it rejected), `false` once it has
+     * gone `staleMs` without progress — the timer re-arms from the latest progress instant,
+     * so a boot that keeps working is never reported stale. */
+    settledBeforeStale(boot) {
+        return new Promise((resolve, reject) => {
+            let timer;
+            const arm = () => {
+                const wait = Math.max(0, boot.lastProgressAt + this.opts.staleMs - this.now());
+                timer = setTimeout(() => (this.isStale(boot) ? resolve(false) : arm()), wait);
+            };
+            const disarm = () => {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            };
+            arm();
+            boot.promise.then(() => {
+                disarm();
+                resolve(true);
+            }, (e) => {
+                disarm();
+                reject(e);
+            });
+        });
+    }
+}
+/** Wrap a Driver so every statement it runs reports progress — the boot's liveness signal.
+ * `batch` is forwarded only when the wrapped driver has it, because the migrator decides
+ * between an atomic batch and sequential exec by its presence. */
+export function observeDriver(driver, progress) {
+    const observed = {
+        dialect: driver.dialect,
+        exec: async (sql, params) => {
+            progress();
+            const rows = await driver.exec(sql, params);
+            progress();
+            return rows;
+        },
+        transaction: (fn) => driver.transaction(fn),
+    };
+    if (driver.batch) {
+        const batch = driver.batch.bind(driver);
+        observed.batch = async (statements) => {
+            progress();
+            await batch(statements);
+            progress();
+        };
+    }
+    return observed;
+}

package/dist/runtime/data-migrations.js

@@ -23,7 +23,7 @@
 // that inserts a pending row, or steals one whose lease has expired, or does nothing — and
 // the migration runs only if that statement won the row. On the DO this is merely bookkeeping
 // order inside one transaction. On D1 it is what makes the once-only contract hold at all:
-// there is no single writer and no interactive transaction, `d1Ready` is per-isolate, so two
+// there is no single writer and no interactive transaction, the boot memo is per-isolate, so two
 // cold isolates racing a `SET n = n * 2` backfill would each read an empty ledger, each run
 // it, and quadruple the data. The conflicting upsert is the lock.
 //

package/dist/runtime/mail.d.ts

@@ -49,11 +49,9 @@ export declare class CloudflareEmailAdapter implements MailAdapter {
 }
 /** Mailgun — an HTTP transport, for when Cloudflare Email Sending cannot be used.
  *
- * Worth the key for one reason: Cloudflare will only send from a domain that is a zone
- * in the same account, and some accounts additionally refuse any recipient that is not a
- * verified destination in Email Routing ("destination address is not a verified
- * address"). That is workable for a handful of operators and hopeless for real users.
- * Mailgun asks the domain be verified once, then delivers to anyone.
+ * Worth the key for one reason: Cloudflare will only send from a domain that is a zone in
+ * the same account. Mailgun asks the domain be verified once with Mailgun instead, so the
+ * sender need not be a domain this account owns.
  *
  * A non-2xx THROWS, deliberately: `ctx.mail.send` is normally called from a task, and a
  * throw is what makes the outbox retry and then dead-letter visibly. Swallowing the

package/dist/runtime/mail.js

@@ -6,10 +6,9 @@
 //   await ctx.mail.send({ to: "u@x.com", subject: "Welcome", text: "…" });
 //
 // Two real transports. Cloudflare Email Sending (the `send_email`/`EMAIL` binding) needs
-// no API keys, but it can only send FROM a domain that is a zone in the same account,
-// and on some accounts only TO addresses verified in Email Routing — which rules it out
-// whenever the recipients are ordinary people. Mailgun is the way out of both: an HTTP
-// API, any recipient, at the cost of a key. Configure it and it wins.
+// no API keys, but it can only send FROM a domain that is a zone in the same account.
+// Mailgun is the way out of that: an HTTP API, a domain verified once with Mailgun
+// rather than owned by the account, at the cost of a key. Configure it and it wins.
 //
 // With neither configured (local/dev), mail is captured instead of sent — to KV (so an
 // e2e/dashboard can read the "inbox") or in-memory — so handlers work unchanged
@@ -56,11 +55,9 @@ export class CloudflareEmailAdapter {
 }
 /** Mailgun — an HTTP transport, for when Cloudflare Email Sending cannot be used.
  *
- * Worth the key for one reason: Cloudflare will only send from a domain that is a zone
- * in the same account, and some accounts additionally refuse any recipient that is not a
- * verified destination in Email Routing ("destination address is not a verified
- * address"). That is workable for a handful of operators and hopeless for real users.
- * Mailgun asks the domain be verified once, then delivers to anyone.
+ * Worth the key for one reason: Cloudflare will only send from a domain that is a zone in
+ * the same account. Mailgun asks the domain be verified once with Mailgun instead, so the
+ * sender need not be a domain this account owns.
  *
  * A non-2xx THROWS, deliberately: `ctx.mail.send` is normally called from a task, and a
  * throw is what makes the outbox retry and then dead-letter visibly. Swallowing the

package/dist/sdk/handlers.d.ts

@@ -67,6 +67,12 @@ export interface BootstrapContext<S extends SchemaDef = SchemaDef> {
     /** The partition being booted. On the DO path bootstrap runs ONLY for the default
      * partition (reference data lives there); on the D1 path it is always the default. */
     readonly partition: string;
+    /** The Worker/DO environment — bindings, vars and secrets, as a handler's `ctx.env` sees
+     * it. Reference data is not always unconditional: a seed that belongs in local dev and
+     * nowhere else (a demo account with a known password) has to be able to READ the flag that
+     * says which it is, and a boot-time reconciler has no request to carry one. Without this
+     * the only gates available were "always" and "never". */
+    readonly env: EnvBag;
 }
 /** An idempotent reconcile run once after `migrate()` on each boot (a DO's first fetch, or a
  * Worker/D1 isolate init). It MUST be safe to run repeatedly — upsert by a stable key, never

package/dist/worker.d.ts

@@ -60,6 +60,13 @@ export declare function useD1Store(opts: {
     isLive: boolean;
     defaultStore: string | undefined;
 }): boolean;
+/** How long the D1 boot may go without completing a statement before an awaiter treats it
+ * as orphaned and starts its own (GitHub #51). 30 s is the platform's `waitUntil` cap after
+ * a response or a disconnect — the point past which a boot's starter can no longer be
+ * keeping it alive — and comfortably above any single D1 statement a bounded migration
+ * should issue. Measured from the last STATEMENT, not from the boot's start, so a slow but
+ * live boot (a table rebuild followed by a backfill) is never mistaken for a dead one. */
+export declare const D1_BOOT_STALE_MS = 30000;
 /** Should we warn that no Cron trigger seems to be wired?
  *
  * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
@@ -91,6 +98,6 @@ export declare function callPrivileged(env: Env, opts: {
  * compiled-ACL + one-time migration) is per-app, held in this closure. */
 export declare function makeWorker(app: PramenApp): {
     fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
-    scheduled(_event: unknown, env: Env): Promise<void>;
+    scheduled(_event: unknown, env: Env, ctx: ExecutionContext): Promise<void>;
     queue(batch: QueueBatch, env: Env): Promise<void>;
 };

package/dist/worker.js

@@ -11,6 +11,7 @@ import { createMail } from "./runtime/mail";
 import { createQueue } from "./runtime/queue";
 import { dispatchQueueBatch } from "./runtime/queue-consumer";
 import { migrate } from "./runtime/migrate";
+import { SharedBoot, observeDriver } from "./runtime/boot";
 import { compileAcl } from "./runtime/acl";
 import { Db } from "./runtime/db";
 import { D1Driver } from "./runtime/driver";
@@ -44,6 +45,13 @@ export function useD1Store(opts) {
         return false;
     return opts.defaultStore === "d1";
 }
+/** How long the D1 boot may go without completing a statement before an awaiter treats it
+ * as orphaned and starts its own (GitHub #51). 30 s is the platform's `waitUntil` cap after
+ * a response or a disconnect — the point past which a boot's starter can no longer be
+ * keeping it alive — and comfortably above any single D1 statement a bounded migration
+ * should issue. Measured from the last STATEMENT, not from the boot's start, so a slow but
+ * live boot (a table rebuild followed by a backfill) is never mistaken for a dead one. */
+export const D1_BOOT_STALE_MS = 30_000;
 /** Should we warn that no Cron trigger seems to be wired?
  *
  * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
@@ -156,14 +164,14 @@ export function makeWorker(app) {
     // runBootstrap(), run once per isolate after migration. D1 is a single shared store (no
     // partition split), so every reconciler runs under the default partition. SYSTEM-scoped
     // Db (ACL bypassed), triggers suppressed; a failing reconciler is logged, never fatal.
-    const runBootstrapD1 = async (driver) => {
+    const runBootstrapD1 = async (driver, env) => {
         const fns = app.bootstrap;
         if (!fns?.length)
             return;
         const db = new Db(driver, { acl: d1Acl, identity: { roles: ["admin"] }, system: true, schema: app.schema, suppressTriggers: true }, app.schema);
         for (const fn of fns) {
             try {
-                await driver.transaction(() => Promise.resolve(fn({ db, driver, schema: app.schema, partition: DEFAULT_PARTITION })));
+                await driver.transaction(() => Promise.resolve(fn({ db, driver, schema: app.schema, partition: DEFAULT_PARTITION, env: envBag(env) })));
             }
             catch (e) {
                 console.error("[pramen] bootstrap failed (d1):", e);
@@ -177,14 +185,14 @@ export function makeWorker(app) {
     // here and would otherwise be permanently unrunnable on this store. Each is still recorded
     // under its OWN declared partition key, so a ledger read is comparable across stores.
     //
-    // Errors are NOT swallowed (unlike runBootstrapD1): the .catch in ensureD1Migrated clears
-    // `d1Ready`, so a failed migration fails this request and is retried on the next one —
-    // the same fail-closed contract as the DO path.
+    // Errors are NOT swallowed (unlike runBootstrapD1): a rejected boot clears the shared
+    // memo (`SharedBoot`), so a failed migration fails this request and is retried on the
+    // next one — the same fail-closed contract as the DO path.
     //
     // ATOMICITY CAVEAT: D1's `transaction(fn)` is `fn()` (no interactive transactions), so
     // here the claim and the work do NOT commit together. The runner claims the ledger row
     // before running (which is what keeps two cold isolates from both applying the same
-    // backfill — `d1Ready` is per-isolate and there is no single writer) and releases it on a
+    // backfill — the boot memo is per-isolate and there is no single writer) and releases it on a
     // throw, so a failed migration leaves partial writes and re-runs. Write SQL that tolerates
     // that (`WHERE col IS NULL`) when the D1 store is in play.
     const runDataMigrationsD1 = async (driver) => {
@@ -206,7 +214,6 @@ export function makeWorker(app) {
         }
         return knownPartitionsCache;
     };
-    let d1Ready;
     /** Run one handler against the D1 store, in the Worker. The request path and the
      * PRIVILEGED path (routes, which have no ctx.db) both come through here, so the two
      * cannot drift on migration, bootstrap, the multi-tenant guard or the outbox drain.
@@ -224,7 +231,7 @@ export function makeWorker(app) {
         }
         const driver = new D1Driver(env.DB, { start: opts.start });
         const files = createFiles({ tenant: opts.tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
-        await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+        await ensureD1Migrated(driver, env, ctx);
         let dispatched;
         try {
             dispatched = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, envBag(env), { acl: d1Acl, identity: opts.identity, tenant: opts.tenant, store: "d1" }, opts.name, opts.input);
@@ -245,23 +252,38 @@ export function makeWorker(app) {
         const { result, enqueued } = dispatched;
         // Drain in the request tail so an enqueued task does not wait for the next Cron tick.
         if (enqueued > 0 && ctx)
-            ctx.waitUntil(drainD1(env));
+            ctx.waitUntil(drainD1(env, "request", ctx));
         return { driver, result: result };
     };
-    const ensureD1Migrated = (driver, allowDestructive) => {
-        if (!d1Ready) {
-            d1Ready = migrate(driver, app.schema, { allowDestructive })
-                .then(() => runDataMigrationsD1(driver)) // imperative, recorded backfills (fail closed)
-                .then(() => ensureOutbox(driver)) // the deferred-tasks table also lives in D1
-                .then(() => runBootstrapD1(driver)) // converge code-defined reference data
-                .then(() => undefined)
-                .catch((e) => {
-                d1Ready = undefined;
-                throw e;
-            });
-        }
-        return d1Ready;
-    };
+    // The D1 store's once-per-isolate boot, shared by every invocation that touches D1. It
+    // is a SharedBoot rather than a bare memoized promise because of GitHub #51: the first
+    // request after a deploy carrying a table rebuild legitimately ran past the caller's
+    // 15 s ceiling, the caller disconnected, the Workers runtime canceled that invocation's
+    // pending I/O — and a promise chained on canceled I/O never settles. Not rejects: never
+    // settles. The memo then wedged every later fetch in that isolate for its lifetime
+    // (0 ms CPU, no logs, "canceled" at whatever timeout the caller had), while crons in
+    // another isolate stayed healthy. See `runtime/boot.ts` for the two defenses.
+    const d1Boot = new SharedBoot({
+        staleMs: D1_BOOT_STALE_MS,
+        onOrphaned: (idleMs) => console.warn(`pramen: the D1 store's boot in this isolate made no progress for ${Math.round(idleMs / 1000)}s and is being restarted. ` +
+            `The invocation that started it was most likely canceled (its caller disconnected) before the boot finished.`),
+    });
+    /** Boot the D1 store (migrate → data migrations → outbox → bootstrap) once per isolate.
+     * `ctx` is the CALLING invocation's context: when this call is the one that starts the
+     * boot, the boot is put under its `waitUntil` so a disconnecting caller cannot cancel a
+     * boot everyone else is waiting on. Pass it from every entry that has one. */
+    // Takes `env` rather than the one flag it used to read off it: `runBootstrapD1` now hands
+    // the environment to each reconciler (see `BootstrapContext.env`), and three call sites
+    // each re-deriving `PRAMEN_ALLOW_DESTRUCTIVE === "true"` was already one place too many for
+    // a flag whose whole job is to gate data loss.
+    const ensureD1Migrated = (driver, env, ctx) => d1Boot.ensure((progress) => {
+        const d = observeDriver(driver, progress);
+        return migrate(d, app.schema, { allowDestructive: env.PRAMEN_ALLOW_DESTRUCTIVE === "true" })
+            .then(() => runDataMigrationsD1(d)) // imperative, recorded backfills (fail closed)
+            .then(() => ensureOutbox(d)) // the deferred-tasks table also lives in D1
+            .then(() => runBootstrapD1(d, env)) // converge code-defined reference data
+            .then(() => undefined);
+    }, ctx ? (p) => ctx.waitUntil(p) : undefined);
     // A privileged, system-scoped context for running task handlers on the D1 (Worker)
     // path — mirrors the DO's taskCtx. No live socket, so no DO; drained by a Cron / the
     // /admin/tasks/drain route, never a DO alarm.
@@ -281,7 +303,7 @@ export function makeWorker(app) {
     // already said it looks missing. See `shouldWarnMissingCron`.
     let cronSeen = false;
     let warnedNoCron = false;
-    const drainD1 = async (env, source = "request") => {
+    const drainD1 = async (env, source = "request", ctx) => {
         if (!env.DB)
             throw new Error("D1 store is not configured");
         if (source === "cron")
@@ -289,7 +311,7 @@ export function makeWorker(app) {
         // The drain reads due tasks then writes their status — pin the primary so it sees
         // and updates current outbox state (not a lagging replica).
         const driver = new D1Driver(env.DB, { start: "first-primary" });
-        await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+        await ensureD1Migrated(driver, env, ctx);
         const result = await drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
         if (source === "request" && shouldWarnMissingCron({ cronSeen, warned: warnedNoCron, nextRunAt: result.nextRunAt, now: Date.now() })) {
             warnedNoCron = true;
@@ -301,12 +323,12 @@ export function makeWorker(app) {
         }
         return result;
     };
-    const listD1Tasks = async (env, status, limit) => {
+    const listD1Tasks = async (env, ctx, status, limit) => {
         if (!env.DB)
             throw new Error("D1 store is not configured");
         // Inspection listing — pin the primary so it reflects current outbox state.
         const driver = new D1Driver(env.DB, { start: "first-primary" });
-        await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+        await ensureD1Migrated(driver, env, ctx);
         return listTasks(driver, { status, limit });
     };
     /** Read the data-migration ledger straight from D1 in the Worker (there is no DO on this
@@ -509,7 +531,7 @@ export function makeWorker(app) {
                     return forbidden("tasks");
                 if (request.headers.get("x-pramen-store") === "d1") {
                     try {
-                        return withCors(json({ ok: true, result: await drainD1(env, "admin") }), cors);
+                        return withCors(json({ ok: true, result: await drainD1(env, "admin", ctx) }), cors);
                     }
                     catch (err) {
                         const { status, body } = toResponse(err);
@@ -535,7 +557,7 @@ export function makeWorker(app) {
                 const limit = Number(url.searchParams.get("limit")) || undefined;
                 if (request.headers.get("x-pramen-store") === "d1") {
                     try {
-                        return withCors(json({ ok: true, result: await listD1Tasks(env, status, limit) }), cors);
+                        return withCors(json({ ok: true, result: await listD1Tasks(env, ctx, status, limit) }), cors);
                     }
                     catch (err) {
                         const { status: s, body } = toResponse(err);
@@ -665,9 +687,9 @@ export function makeWorker(app) {
         },
         // Cron Trigger entry: drains the D1 outbox (the DO path self-drains via an alarm,
         // so it needs no cron). Wire a `[triggers] crons` in wrangler/oblaka to call this.
-        async scheduled(_event, env) {
+        async scheduled(_event, env, ctx) {
             if (env.DB)
-                await drainD1(env, "cron");
+                await drainD1(env, "cron", ctx);
         },
         // Cloudflare Queues consumer entry: routes a batch to the matching `app.queues`
         // handler (ACK on success / RETRY on throw, per message). A consumer is Worker-level

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pramen/server",
-  "version": "0.0.61",
+  "version": "0.0.63",
   "description": "pramen server runtime \u2014 schema, ACL, ORM, live queries, files, and the createPramen(app) factory for Cloudflare Workers + Durable Objects.",
   "license": "MIT",
   "repository": {

package/src/durable-object.ts

@@ -199,7 +199,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     );
     for (const fn of fns) {
       try {
-        await this.driver.transaction(() => Promise.resolve(fn({ db, driver: this.driver, schema: this.app.schema, partition: this.partition })));
+        await this.driver.transaction(() => Promise.resolve(fn({ db, driver: this.driver, schema: this.app.schema, partition: this.partition, env: this.envBag })));
       } catch (e) {
         console.error(`[pramen] bootstrap failed (partition=${this.partition}):`, e);
       }

package/src/pramen.ts

@@ -75,7 +75,7 @@ export type { Env, DoEnv };
  * use the D1 store with deferred tasks. */
 export function createPramen(app: PramenApp): {
   fetch: (request: Request, env: Env, ctx: ExecutionContext) => Promise<Response>;
-  scheduled: (event: unknown, env: Env) => Promise<void>;
+  scheduled: (event: unknown, env: Env, ctx: ExecutionContext) => Promise<void>;
   queue: (batch: QueueBatch, env: Env) => Promise<void>;
   PramenDO: ReturnType<typeof pramenDO>;
 } {

package/src/runtime/boot.ts

@@ -0,0 +1,184 @@
+// SharedBoot — a once-per-isolate boot that many invocations await, made safe to share.
+//
+// The D1 store boots in the Worker: migrate → data migrations → outbox table → bootstrap,
+// run by whichever request arrives first in a fresh isolate and memoized as ONE promise the
+// rest await (running it per request would re-diff the schema on every call). That memo
+// is the bug behind GitHub #51, and the reason is a Workers runtime rule, not pramen code:
+// async work belongs to the INVOCATION that started it. When that invocation ends — the
+// caller gives up and disconnects, which is exactly what a proxy with a 15 s ceiling does
+// to the legitimately slow first request after a deploy carrying a table rebuild — its
+// pending I/O is canceled, and a promise chained on canceled I/O never settles. Not
+// rejected: never settles. So the `.catch` that was meant to clear the memo never runs,
+// and every later fetch in that isolate awaits a promise that cannot resolve, for as long
+// as its own caller allows, at 0 ms CPU. Crons stayed healthy in the report because they
+// landed in a different isolate; the ~54 % was the share of traffic routed to the wedged
+// one; a redeploy "fixed" it by discarding every isolate.
+//
+// Two defenses, and both are needed:
+//
+//  1. The STARTER extends its invocation over the boot with `ctx.waitUntil`, so the client
+//     disconnecting no longer cancels the boot's I/O. That closes the reported case. It is
+//     not sufficient on its own: waitUntil is capped (30 s after the response or the
+//     disconnect), and there is no rule that says a promise's owner is the only way it can
+//     be orphaned.
+//  2. AWAITERS never trust a shared boot unconditionally. The boot reports PROGRESS (every
+//     statement the driver runs), and a boot that has made none for `staleMs` while still
+//     unsettled is treated as orphaned: the next awaiter — arriving, or one already waiting
+//     — starts a fresh boot in its own invocation and awaits that instead. An isolate can
+//     therefore be wedged for at most `staleMs`, never for its lifetime. Every step of the
+//     boot tolerates a second runner (that is the cross-isolate reality on D1 already: the
+//     migration ledger is lease-claimed, migrate is a diff, bootstrap is an upsert), so a
+//     false positive costs a redundant boot, not correctness — which is why the threshold is
+//     measured from the last STATEMENT and not from the boot's start: a boot that is slow
+//     but alive keeps making progress.
+//
+// Platform-agnostic on purpose (no `cloudflare:workers`): `keepAlive` is whatever the host
+// offers to extend an invocation, and `now` is injectable for tests.
+
+import type { Driver } from "./driver";
+
+export interface SharedBootOpts {
+  /** How long a still-unsettled boot may go without progress before it counts as orphaned. */
+  staleMs: number;
+  /** Clock, injectable for tests. */
+  now?: () => number;
+  /** Called when a boot is judged orphaned and replaced, with how long it had been idle. */
+  onOrphaned?: (idleMs: number) => void;
+}
+
+interface BootRecord {
+  promise: Promise<void>;
+  lastProgressAt: number;
+  done: boolean;
+}
+
+/** The boot body. Call `progress()` whenever the boot does observable work — see
+ * `observeDriver` for the standard way to get that for free. */
+export type BootFn = (progress: () => void) => Promise<void>;
+
+export class SharedBoot {
+  private current: BootRecord | undefined;
+  private readonly now: () => number;
+
+  constructor(private readonly opts: SharedBootOpts) {
+    this.now = opts.now ?? Date.now;
+  }
+
+  /** Await the shared boot, starting one if none is live (or the live one looks orphaned).
+   *
+   * `run` is only invoked when THIS call has to start a boot. `keepAlive` is the calling
+   * invocation's lifetime extender (`ctx.waitUntil`); it is handed the boot's promise so
+   * the boot survives the caller disconnecting. A rejected boot rejects every awaiter and
+   * clears the memo, so the next call retries — fail closed, as before. */
+  async ensure(run: BootFn, keepAlive?: (p: Promise<unknown>) => void): Promise<void> {
+    let boot = this.current;
+    // The STARTER awaits its own boot outright: the boot runs in its invocation, so if
+    // the starter is alive to watch, so is the boot — and if the invocation is canceled,
+    // this await dies with it. A starter that also watched would restart its own
+    // (dead-for-everyone-else) boot every window, endlessly.
+    if (!boot || this.isStale(boot)) return this.start(run, keepAlive, boot).promise;
+    for (;;) {
+      if (boot.done) return;
+      // Wait, but wake when the boot WOULD count as stale, and re-check: progress since
+      // means it is alive and we keep waiting; none means it is orphaned.
+      if (await this.settledBeforeStale(boot)) return;
+      // Someone else may already have replaced it — join theirs rather than start a third.
+      const live = this.current;
+      if (live && live !== boot && !this.isStale(live)) {
+        boot = live;
+        continue;
+      }
+      return this.start(run, keepAlive, boot).promise;
+    }
+  }
+
+  /** Whether a boot has completed in this isolate — for diagnostics only. */
+  isDone(): boolean {
+    return this.current?.done === true;
+  }
+
+  private isStale(boot: BootRecord): boolean {
+    return !boot.done && this.now() - boot.lastProgressAt >= this.opts.staleMs;
+  }
+
+  private start(run: BootFn, keepAlive: ((p: Promise<unknown>) => void) | undefined, replacing: BootRecord | undefined): BootRecord {
+    if (replacing) this.opts.onOrphaned?.(this.now() - replacing.lastProgressAt);
+    const record: BootRecord = { promise: Promise.resolve(), lastProgressAt: this.now(), done: false };
+    const progress = (): void => {
+      record.lastProgressAt = this.now();
+    };
+    // Through a resolved promise so a synchronous throw in `run` is a rejection, not an
+    // exception escaping `ensure` with the memo half-installed.
+    record.promise = Promise.resolve()
+      .then(() => run(progress))
+      .then(
+      () => {
+        record.done = true;
+      },
+      (e: unknown) => {
+        // Only forget the memo if it is still THIS boot: a replacement started meanwhile
+        // must not be discarded because its predecessor finally failed.
+        if (this.current === record) this.current = undefined;
+        throw e;
+      },
+    );
+    // Every awaiter attaches its own handler; this one just keeps the host from reporting
+    // an unhandled rejection when a boot fails with nobody awaiting the stored promise.
+    record.promise.catch(() => {});
+    keepAlive?.(record.promise.catch(() => {}));
+    this.current = record;
+    return record;
+  }
+
+  /** Resolves `true` when the boot settles (rejects if it rejected), `false` once it has
+   * gone `staleMs` without progress — the timer re-arms from the latest progress instant,
+   * so a boot that keeps working is never reported stale. */
+  private settledBeforeStale(boot: BootRecord): Promise<boolean> {
+    return new Promise<boolean>((resolve, reject) => {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const arm = (): void => {
+        const wait = Math.max(0, boot.lastProgressAt + this.opts.staleMs - this.now());
+        timer = setTimeout(() => (this.isStale(boot) ? resolve(false) : arm()), wait);
+      };
+      const disarm = (): void => {
+        if (timer !== undefined) clearTimeout(timer);
+      };
+      arm();
+      boot.promise.then(
+        () => {
+          disarm();
+          resolve(true);
+        },
+        (e: unknown) => {
+          disarm();
+          reject(e);
+        },
+      );
+    });
+  }
+}
+
+/** Wrap a Driver so every statement it runs reports progress — the boot's liveness signal.
+ * `batch` is forwarded only when the wrapped driver has it, because the migrator decides
+ * between an atomic batch and sequential exec by its presence. */
+export function observeDriver(driver: Driver, progress: () => void): Driver {
+  const observed: Driver = {
+    dialect: driver.dialect,
+    exec: async (sql, params) => {
+      progress();
+      const rows = await driver.exec(sql, params);
+      progress();
+      return rows;
+    },
+    transaction: (fn) => driver.transaction(fn),
+  };
+  if (driver.batch) {
+    const batch = driver.batch.bind(driver);
+    observed.batch = async (statements) => {
+      progress();
+      await batch(statements);
+      progress();
+    };
+  }
+  return observed;
+}

package/src/runtime/data-migrations.ts

@@ -23,7 +23,7 @@
 // that inserts a pending row, or steals one whose lease has expired, or does nothing — and
 // the migration runs only if that statement won the row. On the DO this is merely bookkeeping
 // order inside one transaction. On D1 it is what makes the once-only contract hold at all:
-// there is no single writer and no interactive transaction, `d1Ready` is per-isolate, so two
+// there is no single writer and no interactive transaction, the boot memo is per-isolate, so two
 // cold isolates racing a `SET n = n * 2` backfill would each read an empty ledger, each run
 // it, and quadruple the data. The conflicting upsert is the lock.
 //

package/src/runtime/mail.ts

@@ -6,10 +6,9 @@
 //   await ctx.mail.send({ to: "u@x.com", subject: "Welcome", text: "…" });
 //
 // Two real transports. Cloudflare Email Sending (the `send_email`/`EMAIL` binding) needs
-// no API keys, but it can only send FROM a domain that is a zone in the same account,
-// and on some accounts only TO addresses verified in Email Routing — which rules it out
-// whenever the recipients are ordinary people. Mailgun is the way out of both: an HTTP
-// API, any recipient, at the cost of a key. Configure it and it wins.
+// no API keys, but it can only send FROM a domain that is a zone in the same account.
+// Mailgun is the way out of that: an HTTP API, a domain verified once with Mailgun
+// rather than owned by the account, at the cost of a key. Configure it and it wins.
 //
 // With neither configured (local/dev), mail is captured instead of sent — to KV (so an
 // e2e/dashboard can read the "inbox") or in-memory — so handlers work unchanged
@@ -90,11 +89,9 @@ export class CloudflareEmailAdapter implements MailAdapter {
 
 /** Mailgun — an HTTP transport, for when Cloudflare Email Sending cannot be used.
  *
- * Worth the key for one reason: Cloudflare will only send from a domain that is a zone
- * in the same account, and some accounts additionally refuse any recipient that is not a
- * verified destination in Email Routing ("destination address is not a verified
- * address"). That is workable for a handful of operators and hopeless for real users.
- * Mailgun asks the domain be verified once, then delivers to anyone.
+ * Worth the key for one reason: Cloudflare will only send from a domain that is a zone in
+ * the same account. Mailgun asks the domain be verified once with Mailgun instead, so the
+ * sender need not be a domain this account owns.
  *
  * A non-2xx THROWS, deliberately: `ctx.mail.send` is normally called from a task, and a
  * throw is what makes the outbox retry and then dead-letter visibly. Swallowing the

package/src/sdk/handlers.ts

@@ -74,6 +74,12 @@ export interface BootstrapContext<S extends SchemaDef = SchemaDef> {
   /** The partition being booted. On the DO path bootstrap runs ONLY for the default
    * partition (reference data lives there); on the D1 path it is always the default. */
   readonly partition: string;
+  /** The Worker/DO environment — bindings, vars and secrets, as a handler's `ctx.env` sees
+   * it. Reference data is not always unconditional: a seed that belongs in local dev and
+   * nowhere else (a demo account with a known password) has to be able to READ the flag that
+   * says which it is, and a boot-time reconciler has no request to carry one. Without this
+   * the only gates available were "always" and "never". */
+  readonly env: EnvBag;
 }
 
 /** An idempotent reconcile run once after `migrate()` on each boot (a DO's first fetch, or a

package/src/worker.ts

@@ -14,6 +14,7 @@ import { createMail } from "./runtime/mail";
 import { createQueue, type QueueProducerBinding } from "./runtime/queue";
 import { dispatchQueueBatch, type QueueBatch, type QueueContext } from "./runtime/queue-consumer";
 import { migrate } from "./runtime/migrate";
+import { SharedBoot, observeDriver } from "./runtime/boot";
 import { compileAcl } from "./runtime/acl";
 import { Db } from "./runtime/db";
 import { D1Driver, type D1SessionStart, type Driver } from "./runtime/driver";
@@ -101,6 +102,14 @@ export function useD1Store(opts: { storeHeader: string | null; isLive: boolean;
   return opts.defaultStore === "d1";
 }
 
+/** How long the D1 boot may go without completing a statement before an awaiter treats it
+ * as orphaned and starts its own (GitHub #51). 30 s is the platform's `waitUntil` cap after
+ * a response or a disconnect — the point past which a boot's starter can no longer be
+ * keeping it alive — and comfortably above any single D1 statement a bounded migration
+ * should issue. Measured from the last STATEMENT, not from the boot's start, so a slow but
+ * live boot (a table rebuild followed by a backfill) is never mistaken for a dead one. */
+export const D1_BOOT_STALE_MS = 30_000;
+
 /** Should we warn that no Cron trigger seems to be wired?
  *
  * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
@@ -222,13 +231,13 @@ export function makeWorker(app: PramenApp) {
   // runBootstrap(), run once per isolate after migration. D1 is a single shared store (no
   // partition split), so every reconciler runs under the default partition. SYSTEM-scoped
   // Db (ACL bypassed), triggers suppressed; a failing reconciler is logged, never fatal.
-  const runBootstrapD1 = async (driver: Driver): Promise<void> => {
+  const runBootstrapD1 = async (driver: Driver, env: Env): Promise<void> => {
     const fns = app.bootstrap;
     if (!fns?.length) return;
     const db = new Db(driver, { acl: d1Acl, identity: { roles: ["admin"] }, system: true, schema: app.schema, suppressTriggers: true }, app.schema);
     for (const fn of fns) {
       try {
-        await driver.transaction(() => Promise.resolve(fn({ db, driver, schema: app.schema, partition: DEFAULT_PARTITION })));
+        await driver.transaction(() => Promise.resolve(fn({ db, driver, schema: app.schema, partition: DEFAULT_PARTITION, env: envBag(env) })));
       } catch (e) {
         console.error("[pramen] bootstrap failed (d1):", e);
       }
@@ -242,14 +251,14 @@ export function makeWorker(app: PramenApp) {
   // here and would otherwise be permanently unrunnable on this store. Each is still recorded
   // under its OWN declared partition key, so a ledger read is comparable across stores.
   //
-  // Errors are NOT swallowed (unlike runBootstrapD1): the .catch in ensureD1Migrated clears
-  // `d1Ready`, so a failed migration fails this request and is retried on the next one —
-  // the same fail-closed contract as the DO path.
+  // Errors are NOT swallowed (unlike runBootstrapD1): a rejected boot clears the shared
+  // memo (`SharedBoot`), so a failed migration fails this request and is retried on the
+  // next one — the same fail-closed contract as the DO path.
   //
   // ATOMICITY CAVEAT: D1's `transaction(fn)` is `fn()` (no interactive transactions), so
   // here the claim and the work do NOT commit together. The runner claims the ledger row
   // before running (which is what keeps two cold isolates from both applying the same
-  // backfill — `d1Ready` is per-isolate and there is no single writer) and releases it on a
+  // backfill — the boot memo is per-isolate and there is no single writer) and releases it on a
   // throw, so a failed migration leaves partial writes and re-runs. Write SQL that tolerates
   // that (`WHERE col IS NULL`) when the D1 store is in play.
   const runDataMigrationsD1 = async (driver: Driver): Promise<void> => {
@@ -272,7 +281,6 @@ export function makeWorker(app: PramenApp) {
     return knownPartitionsCache;
   };
 
-  let d1Ready: Promise<void> | undefined;
   /** Run one handler against the D1 store, in the Worker. The request path and the
    * PRIVILEGED path (routes, which have no ctx.db) both come through here, so the two
    * cannot drift on migration, bootstrap, the multi-tenant guard or the outbox drain.
@@ -293,7 +301,7 @@ export function makeWorker(app: PramenApp) {
     }
     const driver = new D1Driver(env.DB, { start: opts.start });
     const files = createFiles({ tenant: opts.tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
-    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+    await ensureD1Migrated(driver, env, ctx);
     let dispatched;
     try {
       dispatched = await dispatch(
@@ -324,24 +332,47 @@ export function makeWorker(app: PramenApp) {
     }
     const { result, enqueued } = dispatched;
     // Drain in the request tail so an enqueued task does not wait for the next Cron tick.
-    if (enqueued > 0 && ctx) ctx.waitUntil(drainD1(env));
+    if (enqueued > 0 && ctx) ctx.waitUntil(drainD1(env, "request", ctx));
     return { driver, result: result as JsonValue };
   };
 
-  const ensureD1Migrated = (driver: Driver, allowDestructive: boolean): Promise<void> => {
-    if (!d1Ready) {
-      d1Ready = migrate(driver, app.schema, { allowDestructive })
-        .then(() => runDataMigrationsD1(driver)) // imperative, recorded backfills (fail closed)
-        .then(() => ensureOutbox(driver)) // the deferred-tasks table also lives in D1
-        .then(() => runBootstrapD1(driver)) // converge code-defined reference data
-        .then(() => undefined)
-        .catch((e) => {
-          d1Ready = undefined;
-          throw e;
-        });
-    }
-    return d1Ready;
-  };
+  // The D1 store's once-per-isolate boot, shared by every invocation that touches D1. It
+  // is a SharedBoot rather than a bare memoized promise because of GitHub #51: the first
+  // request after a deploy carrying a table rebuild legitimately ran past the caller's
+  // 15 s ceiling, the caller disconnected, the Workers runtime canceled that invocation's
+  // pending I/O — and a promise chained on canceled I/O never settles. Not rejects: never
+  // settles. The memo then wedged every later fetch in that isolate for its lifetime
+  // (0 ms CPU, no logs, "canceled" at whatever timeout the caller had), while crons in
+  // another isolate stayed healthy. See `runtime/boot.ts` for the two defenses.
+  const d1Boot = new SharedBoot({
+    staleMs: D1_BOOT_STALE_MS,
+    onOrphaned: (idleMs) =>
+      console.warn(
+        `pramen: the D1 store's boot in this isolate made no progress for ${Math.round(idleMs / 1000)}s and is being restarted. ` +
+          `The invocation that started it was most likely canceled (its caller disconnected) before the boot finished.`,
+      ),
+  });
+
+  /** Boot the D1 store (migrate → data migrations → outbox → bootstrap) once per isolate.
+   * `ctx` is the CALLING invocation's context: when this call is the one that starts the
+   * boot, the boot is put under its `waitUntil` so a disconnecting caller cannot cancel a
+   * boot everyone else is waiting on. Pass it from every entry that has one. */
+  // Takes `env` rather than the one flag it used to read off it: `runBootstrapD1` now hands
+  // the environment to each reconciler (see `BootstrapContext.env`), and three call sites
+  // each re-deriving `PRAMEN_ALLOW_DESTRUCTIVE === "true"` was already one place too many for
+  // a flag whose whole job is to gate data loss.
+  const ensureD1Migrated = (driver: Driver, env: Env, ctx?: ExecutionContext): Promise<void> =>
+    d1Boot.ensure(
+      (progress) => {
+        const d = observeDriver(driver, progress);
+        return migrate(d, app.schema, { allowDestructive: env.PRAMEN_ALLOW_DESTRUCTIVE === "true" })
+          .then(() => runDataMigrationsD1(d)) // imperative, recorded backfills (fail closed)
+          .then(() => ensureOutbox(d)) // the deferred-tasks table also lives in D1
+          .then(() => runBootstrapD1(d, env)) // converge code-defined reference data
+          .then(() => undefined);
+      },
+      ctx ? (p) => ctx.waitUntil(p) : undefined,
+    );
 
   // A privileged, system-scoped context for running task handlers on the D1 (Worker)
   // path — mirrors the DO's taskCtx. No live socket, so no DO; drained by a Cron / the
@@ -364,13 +395,13 @@ export function makeWorker(app: PramenApp) {
   let cronSeen = false;
   let warnedNoCron = false;
 
-  const drainD1 = async (env: Env, source: "request" | "cron" | "admin" = "request"): Promise<unknown> => {
+  const drainD1 = async (env: Env, source: "request" | "cron" | "admin" = "request", ctx?: ExecutionContext): Promise<unknown> => {
     if (!env.DB) throw new Error("D1 store is not configured");
     if (source === "cron") cronSeen = true;
     // The drain reads due tasks then writes their status — pin the primary so it sees
     // and updates current outbox state (not a lagging replica).
     const driver = new D1Driver(env.DB, { start: "first-primary" });
-    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+    await ensureD1Migrated(driver, env, ctx);
     const result = await drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
     if (source === "request" && shouldWarnMissingCron({ cronSeen, warned: warnedNoCron, nextRunAt: result.nextRunAt, now: Date.now() })) {
       warnedNoCron = true;
@@ -385,11 +416,11 @@ export function makeWorker(app: PramenApp) {
     return result;
   };
 
-  const listD1Tasks = async (env: Env, status?: string, limit?: number): Promise<unknown> => {
+  const listD1Tasks = async (env: Env, ctx: ExecutionContext, status?: string, limit?: number): Promise<unknown> => {
     if (!env.DB) throw new Error("D1 store is not configured");
     // Inspection listing — pin the primary so it reflects current outbox state.
     const driver = new D1Driver(env.DB, { start: "first-primary" });
-    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+    await ensureD1Migrated(driver, env, ctx);
     return listTasks(driver, { status, limit });
   };
 
@@ -596,7 +627,7 @@ export function makeWorker(app: PramenApp) {
       if (!isAdmin(identity)) return forbidden("tasks");
       if (request.headers.get("x-pramen-store") === "d1") {
         try {
-          return withCors(json({ ok: true, result: await drainD1(env, "admin") }), cors);
+          return withCors(json({ ok: true, result: await drainD1(env, "admin", ctx) }), cors);
         } catch (err) {
           const { status, body } = toResponse(err);
           return withCors(json(body, status), cors);
@@ -623,7 +654,7 @@ export function makeWorker(app: PramenApp) {
       const limit = Number(url.searchParams.get("limit")) || undefined;
       if (request.headers.get("x-pramen-store") === "d1") {
         try {
-          return withCors(json({ ok: true, result: await listD1Tasks(env, status, limit) }), cors);
+          return withCors(json({ ok: true, result: await listD1Tasks(env, ctx, status, limit) }), cors);
         } catch (err) {
           const { status: s, body } = toResponse(err);
           return withCors(json(body, s), cors);
@@ -763,8 +794,8 @@ export function makeWorker(app: PramenApp) {
 
     // Cron Trigger entry: drains the D1 outbox (the DO path self-drains via an alarm,
     // so it needs no cron). Wire a `[triggers] crons` in wrangler/oblaka to call this.
-    async scheduled(_event: unknown, env: Env): Promise<void> {
-      if (env.DB) await drainD1(env, "cron");
+    async scheduled(_event: unknown, env: Env, ctx: ExecutionContext): Promise<void> {
+      if (env.DB) await drainD1(env, "cron", ctx);
     },
 
     // Cloudflare Queues consumer entry: routes a batch to the matching `app.queues`