@sproutboat/runtime 0.44.0 → 0.46.0

package/src/transport-embedded.js

@@ -27,6 +27,7 @@ Porffor.c`
 #include <string.h>
 #include <strings.h>
 #include <sys/time.h>
+#include <time.h>
 #include <pthread.h>
 #include <bearssl.h>
 
@@ -65,6 +66,11 @@ extern int sqlite3_extended_errcode(sqlite3*);
 extern int sqlite3_error_offset(sqlite3*);
 extern const char* sqlite3_sql(sqlite3_stmt*);
 extern int sqlite3_total_changes(sqlite3*);
+extern int sqlite3_get_autocommit(sqlite3*);
+extern int sqlite3_db_status(sqlite3*, int, int*, int*, int);
+extern int sqlite3_db_release_memory(sqlite3*);
+extern long long sqlite3_soft_heap_limit64(long long);
+extern long long sqlite3_memory_used(void);
 
 // baronunread/sproutboat#176 — defined in render.js, alongside
 // porf_native_fetch_read_value (which every inline-C block below already
@@ -79,7 +85,7 @@ extern int porf_native_fetch_read_raw_bytes(jsval value, const char** out_buf, s
 // SQLITE_STATIC: "this buffer is yours to read and outlives the statement".
 // Worth using for an object body — the alternative is sqlite copying it.
 #define SB_SQLITE_STATIC ((void*)0)
-#define SB_MAX_DB 16
+#define SB_MAX_DB 64
 
 static sqlite3* sb_dbs[SB_MAX_DB];
 static char sb_db_names[SB_MAX_DB][256];
@@ -1173,8 +1179,9 @@ static int sb_ltx_opted(const char *path) {
 }
 // END LTX NATIVE
 
-// One handle per path, opened once and kept for the process lifetime — the same
-// lifetime the broker gives a Database. Returns an index, or -1.
+// One handle per path, kept open until the slot is needed (Durable Object SQL) or for the process lifetime
+// (everything else). Returns an index, or -1.
+// BEGIN DB TABLE NATIVE: also compiled directly by the handle-table regression (packages/runtime/test/native-db-table.ts).
 // Create every parent directory of path, like mkdir -p. A standalone binary
 // has no launcher to prepare its data directory, and sqlite3_open creates files
 // but never the directories above them.
@@ -1191,13 +1198,31 @@ static void sb_mkdirs(const char* path) {
   }
 }
 
-// Durable Objects SQL (storage.sql): one database per object, under "/do-sql/". At most
-// SB_DO_SQL_OPEN of them stay open; the one used longest ago is closed for the next.
-#define SB_DO_SQL_OPEN 8
+// Durable Objects SQL (storage.sql): one database per object, under "/do-sql/". At most sb_do_sql_open of them
+// stay open (8 until the memory limit is known, then clamp(T / 160 KiB, 8, 48); 48 with no limit); the one used
+// longest ago, and not inside a transaction, is closed for the next. A Durable Object instance leaving memory closes
+// its handle at once (op do.sql.close).
+static int sb_do_sql_open = 8;
 static unsigned long sb_db_used[SB_MAX_DB];
 static unsigned long sb_db_tick = 0;
+static int sb_db_last = -1;
 static int sb_is_do_sql(const char* path) { return strstr(path, "/do-sql/") != 0; }
-static void sb_db_evict(int idx);
+static int sb_db_close(int idx);
+
+// SQLite page caches (plan 016 section 5 as plan 018 phase 1 delivers it). Every database starts at 256 KiB. T is the
+// target for all of them together: SB_MEMORY_LIMIT / 8 (4 MiB at 32 MiB), none without a limit. Each database may
+// grow, on evidence, to min(2 MiB, T / open databases); when a new one opens and the sizes no longer fit under T the
+// stalest ones go back to their share. SB_SQLITE_CACHE_MB, when set, is the old fixed size and turns all of this off.
+#define SB_CACHE_START_KB 256
+#define SB_CACHE_MIN_KB 64
+#define SB_CACHE_MAX_KB 2048
+static long sb_cache_target_kb = 0;
+static int sb_cache_fixed_kb = 0;
+static int sb_cache_kb[SB_MAX_DB];
+static unsigned long sb_db_calls[SB_MAX_DB];
+static long sb_db_changes0[SB_MAX_DB];
+static unsigned long sb_stat_closes, sb_stat_busy, sb_stat_ckpt_fail, sb_stat_grow, sb_stat_shrink, sb_stat_opens;
+static long sb_stat_open_us_last, sb_stat_open_us_max;
 
 // SQLite allocates 20 pages in one block for every page cache it creates, and a statement that
 // builds a temporary table (INSERT ... RETURNING, a sort) creates one: an 88 KiB mmap and munmap
@@ -1209,33 +1234,113 @@ static void sb_sqlite_boot(void) {
   if (sb_sqlite_booted) return;
   sb_sqlite_booted = 1;
   sqlite3_config(7 /* SQLITE_CONFIG_PAGECACHE */, (void*)0, 0, 0);
+  const char* mb = getenv("SB_SQLITE_CACHE_MB");
+  long mib = mb && *mb ? strtol(mb, 0, 10) : 0;
+  if (mib >= 1 && mib <= 4096) sb_cache_fixed_kb = (int)(mib * 1024);
+  const char* limit = getenv("SB_MEMORY_LIMIT");
+  unsigned long long bytes = limit && *limit ? strtoull(limit, 0, 10) : 0;
+  if (bytes >= 8ull << 20) {
+    sb_cache_target_kb = (long)(bytes / 8 / 1024);
+    long slots = sb_cache_target_kb / 160;
+    sb_do_sql_open = slots < 8 ? 8 : slots > 48 ? 48 : (int)slots;
+    // SQLite frees cache pages of every database before it goes over T; one statement that needs more still succeeds.
+    sqlite3_soft_heap_limit64((long long)(bytes / 8));
+  } else sb_do_sql_open = 48;
+}
+static int sb_open_dbs(void) {
+  int n = 0;
+  for (int i = 0; i < sb_db_count; i++) if (sb_dbs[i]) n++;
+  return n;
+}
+// The most one database may hold now: min(2 MiB, T / open databases), and never under 64 KiB.
+static int sb_cache_share_kb(void) {
+  if (!sb_cache_target_kb) return SB_CACHE_MAX_KB;
+  int open = sb_open_dbs();
+  long share = sb_cache_target_kb / (open ? open : 1);
+  return share < SB_CACHE_MIN_KB ? SB_CACHE_MIN_KB : share > SB_CACHE_MAX_KB ? SB_CACHE_MAX_KB : (int)share;
+}
+static void sb_cache_set(int idx, int kb) {
+  char pragma[48];
+  snprintf(pragma, sizeof(pragma), "PRAGMA cache_size=-%d", kb);
+  sqlite3_exec(sb_dbs[idx], pragma, 0, 0, 0);
+  sb_cache_kb[idx] = kb;
+}
+// After a database opens: while the sizes together are over T, the stalest database above its share goes back to it.
+static void sb_cache_rebalance(int keep) {
+  if (!sb_cache_target_kb || sb_cache_fixed_kb) return;
+  for (;;) {
+    long sum = 0;
+    int share = sb_cache_share_kb(), victim = -1;
+    for (int i = 0; i < sb_db_count; i++) {
+      if (!sb_dbs[i]) continue;
+      sum += sb_cache_kb[i];
+      if (i != keep && sb_cache_kb[i] > share && (victim < 0 || sb_db_used[i] < sb_db_used[victim])) victim = i;
+    }
+    if (sum <= sb_cache_target_kb || victim < 0) return;
+    sb_cache_set(victim, share);
+    sqlite3_exec(sb_dbs[victim], "PRAGMA shrink_memory", 0, 0, 0);
+    sb_stat_shrink++;
+  }
+}
+// Every 64th use of a database: over 90% full and over 10% misses since the last look doubles its cache, up to its share.
+static void sb_cache_tune(int idx) {
+  if (sb_cache_fixed_kb || sb_cache_kb[idx] >= SB_CACHE_MAX_KB) return;
+  int used = 0, hit = 0, miss = 0, high = 0;
+  sqlite3_db_status(sb_dbs[idx], 1 /* CACHE_USED */, &used, &high, 0);
+  sqlite3_db_status(sb_dbs[idx], 7 /* CACHE_HIT */, &hit, &high, 1);
+  sqlite3_db_status(sb_dbs[idx], 8 /* CACHE_MISS */, &miss, &high, 1);
+  if ((long long)used * 10 < (long long)sb_cache_kb[idx] * 1024 * 9 || (long long)miss * 10 <= (long long)(hit + miss)) return;
+  int share = sb_cache_share_kb(), next = sb_cache_kb[idx] * 2;
+  if (next > share) next = share;
+  if (next <= sb_cache_kb[idx]) return;
+  sb_cache_set(idx, next);
+  sb_stat_grow++;
+  sb_cache_rebalance(idx);
+}
+static void sb_db_touch(int i) {
+  sb_db_used[i] = ++sb_db_tick;
+  sb_db_last = i;
+  if ((++sb_db_calls[i] & 63) == 0) sb_cache_tune(i);
+}
+static long sb_now_us(void) {
+  struct timespec t;
+  clock_gettime(CLOCK_MONOTONIC, &t);
+  return (long)t.tv_sec * 1000000L + t.tv_nsec / 1000;
 }
 static int sb_db_for(const char* path) {
+  if (sb_db_last >= 0 && sb_dbs[sb_db_last] && strcmp(sb_db_names[sb_db_last], path) == 0) {
+    sb_db_touch(sb_db_last);
+    return sb_ltx_states[sb_db_last].failed ? -1 : sb_db_last;
+  }
   for (int i = 0; i < sb_db_count; i++) {
     if (sb_dbs[i] && strcmp(sb_db_names[i], path) == 0) {
-      sb_db_used[i] = ++sb_db_tick;
+      sb_db_touch(i);
       return sb_ltx_states[i].failed ? -1 : i;
     }
   }
   sb_sqlite_boot();
+  const long t0 = sb_now_us();
   const int do_sql = sb_is_do_sql(path);
   // A name that would not fit could never be found again.
   if (do_sql && strlen(path) >= sizeof(sb_db_names[0])) return -1;
   int replicated = do_sql ? 0 : sb_ltx_opted(path), lock = -1;
   if (replicated < 0 || (replicated && strlen(path) >= sizeof(sb_db_names[0]))) return -1;
-  // A Durable Object SQL database reuses the slot of the one used longest ago once
-  // SB_DO_SQL_OPEN are open; any other database takes one when every slot is in use.
-  int slot = sb_db_count, lru = -1, open_do_sql = 0;
+  // A closed slot is reused first. A Durable Object SQL database takes the slot of the one used longest ago
+  // (outside a transaction) once sb_do_sql_open are open; any other database does the same when every slot is in use.
+  int slot = -1, lru = -1, open_do_sql = 0;
   for (int i = 0; i < sb_db_count; i++) {
-    if (!sb_dbs[i] || !sb_is_do_sql(sb_db_names[i])) continue;
+    if (!sb_dbs[i]) { if (slot < 0) slot = i; continue; }
+    if (!sb_is_do_sql(sb_db_names[i])) continue;
     open_do_sql++;
-    if (lru < 0 || sb_db_used[i] < sb_db_used[lru]) lru = i;
+    if (sqlite3_get_autocommit(sb_dbs[i]) && (lru < 0 || sb_db_used[i] < sb_db_used[lru])) lru = i;
   }
-  if (lru >= 0 && !replicated && ((do_sql && open_do_sql >= SB_DO_SQL_OPEN) || sb_db_count >= SB_MAX_DB)) {
-    sb_db_evict(lru);
+  if (slot < 0 && sb_db_count < SB_MAX_DB) slot = sb_db_count;
+  if (!replicated && ((do_sql && open_do_sql >= sb_do_sql_open) || slot < 0)) {
+    // Every candidate inside a transaction, or none open: the new database cannot be opened now.
+    if (lru < 0 || sb_db_close(lru)) return -1;
     slot = lru;
   }
-  if (slot >= SB_MAX_DB) return -1;
+  if (slot < 0) return -1;
   sqlite3* db = 0;
   sb_mkdirs(path);
   if (replicated) {
@@ -1266,16 +1371,18 @@ static int sb_db_for(const char* path) {
   // The transport itself only reads the variable, so a host that embeds it (sproutd, the broker) stays
   // in shared mode unless it is set. A standalone binary sets it to 1 at startup (patch.ts, the shim's
   // constructor) unless the operator has set it, so SB_SQLITE_EXCLUSIVE=0 opts a standalone binary out.
-  // SB_SQLITE_CACHE_MB sizes each database's page cache in MiB (default 2, about -2000 KiB).
+  // The page cache: see the sizing comment above; SB_SQLITE_CACHE_MB is a fixed size in MiB.
   {
     const char* excl = getenv("SB_SQLITE_EXCLUSIVE");
     if (excl && excl[0] == '1' && !excl[1] && !replicated) sqlite3_exec(db, "PRAGMA locking_mode=EXCLUSIVE", 0, 0, 0);
-    char cache[64];
-    const char* mb = getenv("SB_SQLITE_CACHE_MB");
-    long mib = mb && *mb ? strtol(mb, 0, 10) : 0;
-    if (mib >= 1 && mib <= 4096) snprintf(cache, sizeof(cache), "PRAGMA cache_size=-%ld", mib * 1024);
-    else snprintf(cache, sizeof(cache), "PRAGMA cache_size=-2000");
-    sqlite3_exec(db, cache, 0, 0, 0);
+  }
+  sb_dbs[slot] = db;
+  snprintf(sb_db_names[slot], 256, "%s", path);
+  if (slot >= sb_db_count) sb_db_count = slot + 1;  // before the sizing below, which counts open databases
+  {
+    const int share = sb_cache_share_kb();
+    const int kb = sb_cache_fixed_kb ? sb_cache_fixed_kb : (SB_CACHE_START_KB < share ? SB_CACHE_START_KB : share);
+    sb_cache_set(slot, kb);
   }
   sqlite3_exec(db,
     "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA busy_timeout=5000;"
@@ -1283,9 +1390,10 @@ static int sb_db_for(const char* path) {
     0, 0, 0);
   // Durable Object SQLite enforces foreign keys, as in workerd.
   if (do_sql) sqlite3_exec(db, "PRAGMA foreign_keys=ON", 0, 0, 0);
+  sb_db_changes0[slot] = sqlite3_total_changes(db);
+  sb_db_calls[slot] = 0;
   sb_db_used[slot] = ++sb_db_tick;
-  sb_dbs[slot] = db;
-  snprintf(sb_db_names[slot], 256, "%s", path);
+  sb_db_last = slot;
   if (replicated && sb_ltx_start(slot, db, path, lock)) {
     sb_ltx_states[slot].failed = 1;
     fprintf(stderr, "LTX initialization failed for %s\n", path);
@@ -1293,10 +1401,12 @@ static int sb_db_for(const char* path) {
     if (sb_ltx_states[slot].read_fd >= 0) close(sb_ltx_states[slot].read_fd);
     sb_ltx_states[slot].read_fd = -1;
     sb_dbs[slot] = 0;
-    if (slot == sb_db_count) sb_db_count++;
     close(lock); return -1;
   }
-  if (slot == sb_db_count) sb_db_count++;
+  sb_stat_opens++;
+  sb_cache_rebalance(slot);
+  sb_stat_open_us_last = sb_now_us() - t0;
+  if (sb_stat_open_us_last > sb_stat_open_us_max) sb_stat_open_us_max = sb_stat_open_us_last;
   return slot;
 }
 
@@ -1308,7 +1418,7 @@ static int sb_db_for(const char* path) {
 // ponytail: FIFO eviction over 32 slots, linear scan, no lock (the runtime
 // serves one turn at a time). Move to LRU + a hash if a real app keeps >32 hot
 // statements per db, or if execution ever overlaps. Entries are never finalized
-// on shutdown — sb_db_for never closes a handle, the process owns it for life.
+// on shutdown; sb_db_close finalizes a database's entries when its handle goes.
 #define SB_STMT_CACHE 32
 typedef struct { char* sql; sqlite3_stmt* st; } sb_cached_stmt;
 static sb_cached_stmt sb_stmt_cache[SB_MAX_DB][SB_STMT_CACHE];
@@ -1336,9 +1446,18 @@ static sqlite3_stmt* sb_stmt_get(int idx, sqlite3* db, const char* sql) {
   return st;
 }
 
-// Close a Durable Object SQL database to reuse its slot: its cached statements first.
+// The one place a handle is closed: the slot LRU, a Durable Object instance leaving memory (do.sql.close), and later
+// a capturing handle (plan 013 phase D extends it at the two marked steps and removes the LRU's capture guard; it must not
+// add a second close path). The order is a contract:
 static unsigned char sb_quota_frozen[SB_MAX_DB];
-static void sb_db_evict(int idx) {
+// Returns 0 when the handle is closed (or was not open), -1 when it is left open: a statement outlives its call
+// (SQLITE_BUSY: counted, never sqlite3_close_v2), or the connection is inside a transaction.
+static int sb_db_close(int idx) {
+  sqlite3* db = sb_dbs[idx];
+  if (!db) return 0;
+  // A savepoint or transaction held across calls: closing would roll it back silently.
+  if (!sqlite3_get_autocommit(db)) return -1;
+  // 1. finalize the slot's cached statements;
   for (int i = 0; i < SB_STMT_CACHE; i++) {
     if (sb_stmt_cache[idx][i].st) sqlite3_finalize(sb_stmt_cache[idx][i].st);
     free(sb_stmt_cache[idx][i].sql);
@@ -1346,11 +1465,61 @@ static void sb_db_evict(int idx) {
     sb_stmt_cache[idx][i].sql = 0;
   }
   sb_stmt_fifo[idx] = 0;
-  sqlite3_close(sb_dbs[idx]);
+  // 2. (phase D inserts: unhook capture, write what is pending)
+  // 3. if the connection wrote since it was opened, a TRUNCATE checkpoint and its result. With synchronous=NORMAL this is
+  //    the fsync that makes the data durable on the local disk. A read-only open skips it; sqlite3_close below still
+  //    checkpoints a WAL that holds schema changes (they do not count as changes), as it does for the last connection.
+  if (sqlite3_total_changes(db) != sb_db_changes0[idx]) {
+    int frames = 0, done = 0;
+    if (sqlite3_wal_checkpoint_v2(db, "main", 3 /* TRUNCATE */, &frames, &done)) sb_stat_ckpt_fail++;
+  }
+  // 4. (phase D inserts: the clean position record)
+  // 5. sqlite3_close must return SQLITE_OK. SQLITE_BUSY means a leaked statement: the slot stays open.
+  if (sqlite3_close(db)) {
+    sb_stat_busy++;
+    return -1;
+  }
+  // 6. only then close any raw descriptor on the same inode (capture's read_fd and lock): fcntl locks belong to the
+  //    process, so closing a descriptor of the file while the SQLite handle is open would drop SQLite's locks. Object
+  //    SQL has none; the order is written so that phase D cannot get it wrong.
+  // 7. clear the slot.
+  if (sb_ltx_states[idx].db) memset(&sb_ltx_states[idx], 0, sizeof(sb_ltx_states[idx]));
   sb_dbs[idx] = 0;
   sb_db_names[idx][0] = 0;
   sb_quota_frozen[idx] = 0;
+  sb_cache_kb[idx] = 0;
+  sb_db_calls[idx] = 0;
+  if (sb_db_last == idx) sb_db_last = -1;
+  sb_stat_closes++;
+  return 0;
+}
+// do.sql.close: the handle of one path. 0: not open, 1: closed, -1: left open.
+static int sb_db_close_path(const char* path) {
+  for (int i = 0; i < sb_db_count; i++)
+    if (sb_dbs[i] && strcmp(sb_db_names[i], path) == 0) return sb_db_close(i) ? -1 : 1;
+  return 0;
+}
+// Hands SQLite's cached pages back, from every open database; returns the bytes SQLite memory fell by.
+static long long sb_db_release_all(void) {
+  long long before = sqlite3_memory_used();
+  for (int i = 0; i < sb_db_count; i++) if (sb_dbs[i]) sqlite3_db_release_memory(sb_dbs[i]);
+  return before - sqlite3_memory_used();
+}
+// The handle table's counters as one JSON line, for the host note (plan 018) and the tests.
+static int sb_db_stats(char* out, size_t cap) {
+  int open = 0, open_do = 0;
+  long cache_kb = 0;
+  for (int i = 0; i < sb_db_count; i++) {
+    if (!sb_dbs[i]) continue;
+    open++;
+    cache_kb += sb_cache_kb[i];
+    if (sb_is_do_sql(sb_db_names[i])) open_do++;
+  }
+  return snprintf(out, cap,
+    "{\"open\":%d,\"doOpen\":%d,\"doSlots\":%d,\"cacheKb\":%ld,\"targetKb\":%ld,\"memUsed\":%lld,\"opens\":%lu,\"closes\":%lu,\"busy\":%lu,\"ckptFail\":%lu,\"grow\":%lu,\"shrink\":%lu,\"openUsLast\":%ld,\"openUsMax\":%ld}",
+    open, open_do, sb_do_sql_open, cache_kb, sb_cache_target_kb, sqlite3_memory_used(), sb_stat_opens, sb_stat_closes, sb_stat_busy, sb_stat_ckpt_fail, sb_stat_grow, sb_stat_shrink, sb_stat_open_us_last, sb_stat_open_us_max);
 }
+// END DB TABLE NATIVE
 
 // --- a growable output buffer, for building the reply JSON ------------------
 typedef struct { char* p; size_t len; size_t cap; } sb_buf;
@@ -1879,6 +2048,22 @@ static u32 sb_r2_get_c(const char* path, const char* bucket, const char* key, co
   return out;
 }
 
+// Reads at most CAP bytes at OFFSET of an object's file into OUT, and nothing else of it: a range read
+// (R2 get with a range) and each chunk of a streamed body come through here, so an object of any size is
+// never in memory whole. Returns the byte count (short at the end of the object), or -1 when the file
+// cannot be read. The file is named by the object's generation, which a put never rewrites.
+static long sb_r2_read_into_c(const char* path, const char* bucket, const char* key, const char* generation, size_t offset, char* out, size_t cap) {
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key, generation);
+  FILE* f = fopen(blobpath, "rb");
+  if (!f) return -1;
+  if (offset && fseek(f, (long)offset, SEEK_SET) != 0) { fclose(f); return -1; }
+  size_t rd = cap ? fread(out, 1, cap, f) : 0;
+  int bad = ferror(f);
+  fclose(f);
+  return bad ? -1 : (long)rd;
+}
+
 // Best-effort: a metadata row deleted with no blob file (or vice versa) is
 // still a correct end state, so a missing file here is not an error.
 static void sb_r2_delete_blob(const char* path, const char* bucket, const char* key, const char* generation) {
@@ -2119,6 +2304,95 @@ size_t sb_r2_transfer_download_read(sb_r2_transfer_ctx* ctx, size_t offset, char
 }
 void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx->file) fclose(ctx->file); free(ctx); } }
 
+// A host whose workers serve transfer tickets themselves (sproutd: the frontend forwards /__sb/r2/transfer/...
+// like any request, with its body streamed) drives the same context from JavaScript, one step at a time.
+// The contexts live here, in a small table (a handle is its index plus one), so JavaScript never holds a
+// pointer; a handle is released by finishing, aborting or closing it. An upload step moves what the request
+// body has buffered (at most 1 MiB, in 64 KiB pieces from the stack) into the object's temporary file, and a
+// download read fills a Uint8Array from the object's file: object bytes are never strings or JSON.
+#define SB_XFER_MAX 16
+static sb_r2_transfer_ctx* sb_xfer[SB_XFER_MAX];
+static int sb_xfer_hold(sb_r2_transfer_ctx* ctx) {
+  for (int i = 0; i < SB_XFER_MAX; i++) if (!sb_xfer[i]) { sb_xfer[i] = ctx; return i + 1; }
+  return 0;
+}
+static sb_r2_transfer_ctx* sb_xfer_get(int handle) {
+  return handle >= 1 && handle <= SB_XFER_MAX ? sb_xfer[handle - 1] : 0;
+}
+extern long long sb_reqbody_poll(unsigned int);
+extern size_t sb_reqbody_take(unsigned int, char*, size_t);
+// Claims an upload ticket: the HTTP status (0: claimed, HANDLE set).
+static int sb_xfer_upload_open(const char* bucket, const char* token, size_t declared, int* handle) {
+  sb_r2_transfer_ctx* ctx = 0;
+  *handle = 0;
+  int status = sb_r2_transfer_open(bucket, token, declared, &ctx);
+  if (status != 0 || !ctx) return status ? status : 500;
+  *handle = sb_xfer_hold(ctx);
+  if (!*handle) { sb_r2_transfer_abort(ctx); return 503; }
+  return 0;
+}
+// One step of an upload from request body BODY: 'd' some bytes moved (*arg), 'w' none yet (wait for the
+// body's timer), 'e' the body ended (finish), 'f' the body failed (the client went away, abort), 's' a
+// status refused them (*arg; the ticket is released). A step stops after 1 MiB so other requests run.
+static char sb_xfer_upload_step(int handle, unsigned int body, long* arg) {
+  sb_r2_transfer_ctx* ctx = sb_xfer_get(handle);
+  *arg = 0;
+  if (!ctx) { *arg = 500; return 's'; }
+  char piece[65536];
+  long moved = 0;
+  while (moved < (1 << 20)) {
+    long long ready = sb_reqbody_poll(body);
+    if (ready == -1) { *arg = moved; return moved ? 'd' : 'e'; }
+    if (ready == -2) { *arg = moved; return moved ? 'd' : 'f'; }
+    if (ready == 0) { *arg = moved; return moved ? 'd' : 'w'; }
+    size_t n = sb_reqbody_take(body, piece, sizeof(piece));
+    if (!n) { *arg = moved; return moved ? 'd' : 'w'; }
+    int status = sb_r2_transfer_write(ctx, piece, n);
+    if (status != 0) { sb_r2_transfer_abort(ctx); sb_xfer[handle - 1] = 0; *arg = status; return 's'; }
+    moved += (long)n;
+  }
+  *arg = moved;
+  return 'd';
+}
+// A body that arrived whole (a request of a host that buffers it): written in one go.
+static int sb_xfer_upload_write(int handle, const char* bytes, size_t length) {
+  sb_r2_transfer_ctx* ctx = sb_xfer_get(handle);
+  if (!ctx) return 500;
+  int status = sb_r2_transfer_write(ctx, bytes, length);
+  if (status != 0) { sb_r2_transfer_abort(ctx); sb_xfer[handle - 1] = 0; }
+  return status;
+}
+static int sb_xfer_finish(int handle) {
+  sb_r2_transfer_ctx* ctx = sb_xfer_get(handle);
+  if (!ctx) return 500;
+  sb_xfer[handle - 1] = 0;
+  return sb_r2_transfer_finish(ctx);
+}
+static void sb_xfer_close(int handle) {
+  sb_r2_transfer_ctx* ctx = sb_xfer_get(handle);
+  if (!ctx) return;
+  sb_xfer[handle - 1] = 0;
+  sb_r2_transfer_abort(ctx);
+}
+// Claims a download ticket: the HTTP status (0: claimed, HANDLE, *size and *etag set).
+static int sb_xfer_download_open(const char* bucket, const char* token, int* handle, size_t* size, char* etag, size_t etag_cap) {
+  sb_r2_transfer_ctx* ctx = 0;
+  *handle = 0;
+  int status = sb_r2_transfer_download_open(bucket, token, &ctx);
+  if (status != 0 || !ctx) return status ? status : 500;
+  *handle = sb_xfer_hold(ctx);
+  if (!*handle) { sb_r2_transfer_download_close(ctx); return 503; }
+  *size = sb_r2_transfer_download_size(ctx);
+  snprintf(etag, etag_cap, "%s", sb_r2_transfer_download_etag(ctx));
+  return 0;
+}
+static void sb_xfer_download_close(int handle) {
+  sb_r2_transfer_ctx* ctx = sb_xfer_get(handle);
+  if (!ctx) return;
+  sb_xfer[handle - 1] = 0;
+  sb_r2_transfer_download_close(ctx);
+}
+
 // LTX capture (#141) failed after SQLite committed: the write is in the database but not in
 // the replication log, and the database refuses writes until the process restarts. Said as
 // such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
@@ -2127,7 +2401,7 @@ void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx
 // every write is refused (a same-size UPDATE or a DELETE still adds an LTX file to the
 // spool, which counts toward the quota). Reads and transaction control still run.
 #define SB_QUOTA_FULL "storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota"
-// sb_quota_frozen (per database slot) is declared with sb_db_evict, which clears it.
+// sb_quota_frozen (per database slot) is declared with sb_db_close, which clears it.
 static int sb_db_capture_failed(const char* path) {
   for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
   return 0;
@@ -2444,6 +2718,7 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
 
 // The storage quota (docs: an app's data directory is capped): bytes in regular files under
 // dir, symlinks not followed. Bounded by depth; an unreadable entry counts as 0.
+static long sb_dir_files;  // regular files counted by the last walk (the quota scan's interval grows with it)
 static long long sb_dir_bytes(const char* dir, int depth) {
   DIR* d = opendir(dir);
   if (!d || depth > 16) { if (d) closedir(d); return 0; }
@@ -2455,7 +2730,7 @@ static long long sb_dir_bytes(const char* dir, int depth) {
     if (snprintf(path, sizeof(path), "%s/%s", dir, e->d_name) >= (int)sizeof(path)) continue;
     struct stat st;
     if (lstat(path, &st)) continue;
-    if (S_ISREG(st.st_mode)) total += (long long)st.st_size;
+    if (S_ISREG(st.st_mode)) { total += (long long)st.st_size; sb_dir_files++; }
     else if (S_ISDIR(st.st_mode)) total += sb_dir_bytes(path, depth + 1);
   }
   closedir(d);
@@ -4342,6 +4617,112 @@ function __sbR2GetRaw(path, bucket, key, blobId) {
   return res;
 }
 
+// R2 get without the whole object: fills VIEW (a fresh Uint8Array) with the bytes at OFFSET of the object's
+// file. Returns how many it read (fewer at the end of the object), or -1 when the file cannot be read.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbR2ReadInto(path, bucket, key, blobId, offset, view) {
+  let got = -1;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+
+    const char* __bk; size_t __bkl; char* __bko = 0;
+    porf_native_fetch_read_value(bucket, &__bk, &__bkl, &__bko);
+    char* __bucket = (char*)malloc(__bkl + 1); memcpy(__bucket, __bk, __bkl); __bucket[__bkl] = 0;
+    if (__bko) free(__bko);
+
+    const char* __k; size_t __kl; char* __ko = 0;
+    porf_native_fetch_read_value(key, &__k, &__kl, &__ko);
+    char* __key = (char*)malloc(__kl + 1); memcpy(__key, __k, __kl); __key[__kl] = 0;
+    if (__ko) free(__ko);
+
+    const char* __g; size_t __gl; char* __go = 0;
+    porf_native_fetch_read_value(blobId, &__g, &__gl, &__go);
+    char* __generation = (char*)malloc(__gl + 1); memcpy(__generation, __g, __gl); __generation[__gl] = 0;
+    if (__go) free(__go);
+
+    long __n = -1;
+    if (view.type == 81 && offset.type == 1 && offset.val >= 0) {
+      const u32 __ta = (u32)view.val;
+      const int32_t __len = *(int32_t*)(MEM + __ta);
+      const u32 __at = *(u32*)(MEM + __ta + 4) + 4;
+      if (__len >= 0) __n = sb_r2_read_into_c(__path, __bucket, __key, __generation, (size_t)offset.val, (char*)(MEM + __at), (size_t)__len);
+    }
+    free(__path); free(__bucket); free(__key); free(__generation);
+    got = (f64)__n;
+  `;
+  return got;
+}
+
+// Transfer tickets served by the worker (see sb_xfer_* above). op: "u" claim an upload ticket (a = bucket, b = token,
+// n = the declared length; "0 HANDLE" or "STATUS"), "s" a step of the upload from body id n ("d BYTES", "w", "e", "f"
+// or "s STATUS"), "b" write the bytestring in a (a buffered body; the status), "f" finish ("STATUS"), "x" release the
+// handle in n, "d" claim a download ticket ("0 HANDLE SIZE ETAG" or "STATUS"), "r" read the object's file at offset n
+// into the Uint8Array in view (handle in a; the count), "c" release a download handle. Returns a short string.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbR2XferOp(op, a, b, n, view) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __o; size_t __ol; char* __oo = 0;
+    porf_native_fetch_read_value(op, &__o, &__ol, &__oo);
+    char __op = __ol ? __o[0] : 0;
+    if (__oo) free(__oo);
+
+    const char* __a; size_t __al; char* __ao = 0;
+    porf_native_fetch_read_value(a, &__a, &__al, &__ao);
+    char* __as = (char*)malloc(__al + 1); memcpy(__as, __a, __al); __as[__al] = 0;
+    if (__ao) free(__ao);
+    const char* __b; size_t __bl; char* __bo = 0;
+    porf_native_fetch_read_value(b, &__b, &__bl, &__bo);
+    char* __bs = (char*)malloc(__bl + 1); memcpy(__bs, __b, __bl); __bs[__bl] = 0;
+    if (__bo) free(__bo);
+
+    const double __n = n.type == 1 ? n.val : 0;
+    const int __handle = (int)strtol(__as, 0, 10);
+    char __r[160]; __r[0] = 0;
+    if (__op == 'u') {
+      int __h = 0;
+      int __s = sb_xfer_upload_open(__as, __bs, (size_t)__n, &__h);
+      if (__s == 0) snprintf(__r, sizeof(__r), "0 %d", __h); else snprintf(__r, sizeof(__r), "%d", __s);
+    } else if (__op == 's') {
+      long __moved = 0;
+      char __k = sb_xfer_upload_step(__handle, (unsigned int)__n, &__moved);
+      snprintf(__r, sizeof(__r), "%c %ld", __k, __moved);
+    } else if (__op == 'b') {
+      const char* __d = 0; size_t __dl = 0;
+      int __s = 500;
+      if (porf_native_fetch_read_raw_bytes(b, &__d, &__dl) == 0) __s = sb_xfer_upload_write(__handle, __d, __dl);
+      snprintf(__r, sizeof(__r), "%d", __s);
+    } else if (__op == 'f') snprintf(__r, sizeof(__r), "%d", sb_xfer_finish(__handle));
+    else if (__op == 'x') sb_xfer_close((int)__n);
+    else if (__op == 'd') {
+      int __h = 0; size_t __size = 0; char __etag[80]; __etag[0] = 0;
+      int __s = sb_xfer_download_open(__as, __bs, &__h, &__size, __etag, sizeof(__etag));
+      if (__s == 0) snprintf(__r, sizeof(__r), "0 %d %zu %s", __h, __size, __etag); else snprintf(__r, sizeof(__r), "%d", __s);
+    } else if (__op == 'r') {
+      long __got = -1;
+      sb_r2_transfer_ctx* __ctx = sb_xfer_get(__handle);
+      if (__ctx && view.type == 81) {
+        const u32 __ta = (u32)view.val;
+        const int32_t __len = *(int32_t*)(MEM + __ta);
+        const u32 __at = *(u32*)(MEM + __ta + 4) + 4;
+        if (__len >= 0) __got = (long)sb_r2_transfer_download_read(__ctx, (size_t)__n, (char*)(MEM + __at), (size_t)__len);
+      }
+      snprintf(__r, sizeof(__r), "%ld", __got);
+    } else if (__op == 'c') sb_xfer_download_close((int)__n);
+    free(__as); free(__bs);
+    out = porf_box((f64)porf_native_fetch_alloc_bytestring(__r, strlen(__r)), 195);
+  `;
+  return out;
+}
+// This transport's workers serve transfer tickets themselves, on a host that forwards the path (sproutd); a
+// standalone executable's native server answers them before JavaScript runs, and never gets here.
+__sbR2TransferOn = true;
+
 // R2 delete: also removes the object's own file, not just the metadata row
 // (#56 — sb_r2_delete_blob is best-effort, a missing file is not an error).
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
@@ -4399,7 +4780,7 @@ function __sbSqlScriptRaw(path, sql) {
   return res;
 }
 
-// The bytes under a directory, as a decimal string (sb_dir_bytes).
+// The bytes under a directory and the number of regular files, as "BYTES FILES" (sb_dir_bytes).
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbDirBytesRaw(dir) {
   let res = "";
@@ -4409,13 +4790,50 @@ function __sbDirBytesRaw(dir) {
     porf_native_fetch_read_value(dir, &__d, &__dl, &__do);
     char* __dir = (char*)malloc(__dl + 1); memcpy(__dir, __d, __dl); __dir[__dl] = 0;
     if (__do) free(__do);
-    char __n[32]; int __k = snprintf(__n, sizeof(__n), "%lld", sb_dir_bytes(__dir, 0));
+    char __n[64]; sb_dir_files = 0; long long __b = sb_dir_bytes(__dir, 0); int __k = snprintf(__n, sizeof(__n), "%lld %ld", __b, sb_dir_files);
     free(__dir);
     res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
   `;
   return res;
 }
 
+// Closes the handle of one database path (sb_db_close_path): 1 closed, 0 not open, -1 left open.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbDbCloseRaw(path) {
+  let status = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    status = (f64)sb_db_close_path(__path);
+    free(__path);
+  `;
+  return status;
+}
+
+// The handle table's counters, one JSON line (sb_db_stats).
+function __sbDbStatsRaw() {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    char __n[512]; int __k = sb_db_stats(__n, sizeof(__n));
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
+// Hands SQLite's cached pages back (sb_db_release_all); returns the bytes released.
+function __sbDbReleaseRaw() {
+  let freed = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    freed = (f64)sb_db_release_all();
+  `;
+  return freed;
+}
+
 // "captured" of __sbD1DbRaw as a number: no text made in C and parsed here, on every D1 query.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbD1Captured_(path) {
@@ -4761,6 +5179,9 @@ function __sbDir() {
 var __sbQuotaMax = -1;
 var __sbQuotaUsed = 0;
 var __sbQuotaAt = -1;
+// Milliseconds between scans of the data directory: one lstat per file, so 1 s per 1,000 files and at most 10 s (7 ms of
+// walking at 5,000 files, 20 ms at 15,000, measured). Writes can overshoot the quota by up to that long.
+var __sbQuotaEvery = 1000;
 function __sbQuotaLimit() {
   if (__sbQuotaMax < 0) {
     const v = Number(__sbEnv("SB_STORAGE_MAX_BYTES"));
@@ -4770,8 +5191,10 @@ function __sbQuotaLimit() {
 }
 function __sbQuotaFull() {
   const now = Date.now();
-  if (__sbQuotaAt < 0 || now - __sbQuotaAt >= 1000) {
-    __sbQuotaUsed = Number(__sbDirBytesRaw(__sbDir())) || 0;
+  if (__sbQuotaAt < 0 || now - __sbQuotaAt >= __sbQuotaEvery) {
+    const scan = String(__sbDirBytesRaw(__sbDir())).split(" ");
+    __sbQuotaUsed = Number(scan[0]) || 0;
+    __sbQuotaEvery = Math.min(10000, Math.max(1000, Math.ceil((Number(scan[1]) || 0) / 1000) * 1000));
     __sbQuotaAt = now;
   }
   return __sbQuotaUsed >= __sbQuotaLimit();
@@ -5128,10 +5551,8 @@ function __sbEmbeddedDispatch(msg) {
     let path = String(msg.path || "/");
     if (path.charAt(0) !== "/") path = "/" + path;
     const redirects = (bundle.manifest && bundle.manifest.redirects) || [];
-    for (let i = 0; i < redirects.length; i++) {
-      const location = __sbAssetRedirect(redirects[i], path);
-      if (location !== null) return { ok: true, found: false, status: redirects[i].status, location };
-    }
+    const redirect = __sbFindAssetRedirect(redirects, path);
+    if (redirect !== null) return { ok: true, found: false, status: redirect.status, location: redirect.location };
 
     let key = null;
     if (path.charAt(path.length - 1) === "/") {
@@ -5294,7 +5715,7 @@ function __sbEmbeddedDispatch(msg) {
   // run like a strict D1 query (BLOBs as hex, D1_ERROR text the shim rewords).
   if (op === "do.sql") {
     const path = __sbDOSqlPath(msg.cls, msg.file);
-    // Its handle may have been closed and reopened since (SB_DO_SQL_OPEN), which drops the
+    // Its handle may have been closed and reopened since (the slot LRU, an eviction), which drops the
     // size cap: set it again.
     delete __sbD1Capped[path];
     __sbD1Quota(path);
@@ -5303,6 +5724,16 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, columns: r.cols, rows: r.rows, meta: { changes: r.changes } };
   }
 
+  // A Durable Object instance leaving memory closes its SQLite handle (plan 018): the last connection checkpoints, so the
+  // evicted object is one clean file. A no-op when it is not open; closed: -1 means a transaction or a statement kept it open.
+  if (op === "do.sql.close") {
+    const path = __sbDOSqlPath(msg.cls, msg.file);
+    return { ok: true, closed: __sbDbCloseRaw(path) };
+  }
+
+  if (op === "do.stats") return { ok: true, stats: JSON.parse(__sbDbStatsRaw()) };
+  if (op === "do.release") return { ok: true, freed: __sbDbReleaseRaw() };
+
   if (op === "d1.backup") {
     const src = __sbD1Path(String(msg.db));
     // A caller-supplied name must be a plain basename; anything else falls back
@@ -5955,6 +6386,19 @@ globalThis.__sbR2Get = function (bucket, key) {
   };
 };
 
+// The object's metadata and where its bytes are, without the bytes: get() reads them as the caller asks for them
+// (range windows and a body stream), through __sbR2ReadRange.
+globalThis.__sbR2Open = function (bucket, key) {
+  const meta = __sbEmbeddedDispatch({ op: "r2.head", bucket, key });
+  if (!meta.found) return { found: false };
+  return { found: true, object: meta.object, blobId: String(meta.blobId || "") };
+};
+
+// Fills the Uint8Array VIEW with the object's bytes from OFFSET; the count read, or -1.
+globalThis.__sbR2ReadRange = function (bucket, key, blobId, offset, view) {
+  return __sbR2ReadInto(__sbStore(), String(bucket), String(key), String(blobId), offset, view);
+};
+
 globalThis.__sbR2MultipartPut = function (bucket, key, uploadId, partNumber, body) {
   __sbQuotaCheck("R2 uploadPart()");
   __sbEnsureSchema();
@@ -6173,7 +6617,7 @@ async function __sbQueuePass(handlers, queues) {
     // From 2026-11-05 a consumer that runs past the 30 s lease keeps its messages: the lease
     // is renewed while it runs, so they are not delivered a second time or lose their ack.
     const beat = __sbQueuesFixed()
-      ? setInterval(() => {
+      ? __sbSetInterval(() => {
           __sbSql(store, "UPDATE mq SET visible_at=? WHERE queue=? AND claim_token=? AND visible_at>?", [Date.now() + 30000, name, claim, Date.now()]);
         }, 10000)
       : null;
@@ -6183,7 +6627,7 @@ async function __sbQueuePass(handlers, queues) {
       if (result && __sbIsFn(result.then)) result = await result;
       if (__sbTasks.length) await __sbDrainWaitUntil(__sbTasks);
     } finally {
-      if (beat !== null) clearInterval(beat);
+      if (beat !== null) __sbClearInterval(beat);
     }
     __sbQueueSettle(store, name, claim, result);
   }
@@ -6296,6 +6740,9 @@ async function __sbAlarmPass() {
     __sbSql(store, "ROLLBACK", []);
     throw error;
   }
+  // From the eviction date the claimed batch runs at once (each alarm through its own object's gate; one alarm() per object at a
+  // time is the gate and the single row), the claim is renewed while it runs, and the row's attempts reach alarm().
+  if (__sbDOEvictOn()) return __sbAlarmRunBatch(store, claim, due.rows);
   for (let i = 0; i < due.rows.length; i++) {
     const cls = due.rows[i][0];
     const id = due.rows[i][1];
@@ -6334,6 +6781,46 @@ async function __sbAlarmPass() {
   }
 }
 
+async function __sbAlarmRunBatch(store, claim, rows) {
+  const beat = __sbSetInterval(() => {
+    __sbSql(store, "UPDATE do_alarm_delivery SET expires=? WHERE token=? AND expires>?", [Date.now() + 30000, claim, Date.now()]);
+  }, 10000);
+  try {
+    const runs = [];
+    for (let i = 0; i < rows.length; i++) runs.push(__sbAlarmDeliver(store, claim, rows[i]));
+    for (let i = 0; i < runs.length; i++) await runs[i];
+  } finally {
+    __sbClearInterval(beat);
+  }
+}
+
+// One claimed alarm: construct the object if it is evicted (its constructor runs before alarm()), run alarm() through its gate, and
+// settle the delivery row. A call that could not get a slot within the wait is not a failed attempt: the row is released uncounted.
+async function __sbAlarmDeliver(store, claim, row) {
+  const cls = row[0];
+  const id = row[1];
+  try {
+    await __sbDORun(cls, id, undefined, (instance) => (__sbIsFn(instance.alarm) ? __sbDOAlarmCall(instance, cls, id, row[2], row[3]) : undefined), true);
+    __sbSql(store, "DELETE FROM do_alarm_delivery WHERE cls=? AND id=? AND token=? AND expires>?", [cls, id, claim, Date.now()]);
+  } catch (error) {
+    if (error && error.overloaded === true) {
+      __sbSql(store, "UPDATE do_alarm_delivery SET expires=?, attempts=attempts-1 WHERE cls=? AND id=? AND token=? AND expires>?", [
+        Date.now() + 1000,
+        cls,
+        id,
+        claim,
+        Date.now(),
+      ]);
+      return;
+    }
+    const scheduled = __sbSql(store, "SELECT 1 FROM do_alarm WHERE cls=? AND id=?", [cls, id]);
+    if (scheduled.rows.length)
+      __sbSql(store, "DELETE FROM do_alarm_delivery WHERE cls=? AND id=? AND token=? AND expires>?", [cls, id, claim, Date.now()]);
+    else
+      __sbSql(store, "UPDATE do_alarm_delivery SET expires=? WHERE cls=? AND id=? AND token=? AND expires>?", [Date.now() + 5000, cls, id, claim, Date.now()]);
+  }
+}
+
 // B22: on a host that delivers triggers (sproutd), what this worker consumes. Set by
 // __sbStartLocalTriggers; null when the host does not drive this worker's triggers.
 var __sbLocal = null;
@@ -6420,7 +6907,7 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
   }
 
   if (scheduled) {
-    setInterval(async function () {
+    __sbSetInterval(async function () {
       const now = new Date();
       const stamp =
         now.getUTCFullYear() +
@@ -6460,7 +6947,7 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
     }, 15000);
   }
 
-  if (queues.length > 0) setInterval(() => __sbQueuePass(handlers, queues), 500);
+  if (queues.length > 0) __sbSetInterval(() => __sbQueuePass(handlers, queues), 500);
 
-  if (dos.length > 0) setInterval(() => __sbAlarmPass(), 500);
+  if (dos.length > 0) __sbSetInterval(() => __sbAlarmPass(), 500);
 };