@statewalker/cellb 0.0.0-stage → 0.1.0

package/vendor/celld/queues.js

@@ -0,0 +1,1656 @@
+// GENERATED by scripts/vendor-celld.mjs from denoland/celld@8702f6d186c77698dbfb30cf29e3b1922a88f008 crates/celld/js/harness.js
+// (Apache-2.0): the Queues section and __celld.__dispatchEntrypointQueue, unchanged, wrapped as
+// queueService(host). Do not edit.
+export function queueService(host) {
+  const { __cell, __queue_policy, __queue_dispatch, __queue_alarm_set_wait, __sc_encode, __sc_decode,
+    __cellSweepBatch, __dispatchEntrypointMethodInCurrentEvent } = host;
+  const $$btoa = host.btoa;
+  const __d = host.debug ?? (() => {});
+  const classes = {};
+  const __runtimeClass = (name, cls) => { classes[name] = cls; };
+  const __celld = {};
+// A queue batch owns mutable settlement state only while its handler runs.
+// Keeping a batch alive after dispatch must not keep authority to settle its
+// lease, because that lease can have expired and been handed out again.
+__celld.__dispatchEntrypointQueue = async (name, incoming) => {
+  let active = true;
+  let ackAll = false;
+  const explicitAcks = new Set();
+  const retries = new Map();
+  const retryBatch = { retry: false, delaySeconds: undefined };
+  const checkActive = () => {
+    if (!active)
+      throw new Error("Queue event methods cannot be called after the handler returns.");
+  };
+  const retryDelay = (options) => {
+    const value = options?.delaySeconds;
+    if (value === undefined) return undefined;
+    if (!Number.isInteger(value) || value < -0x8000_0000 || value > 0x7fff_ffff)
+      throw new TypeError("delaySeconds must be a 32-bit integer");
+    return value;
+  };
+  const decode = (message) => {
+    switch (message.contentType) {
+      case "text": return new TextDecoder().decode(message.body);
+      case "bytes": return message.body;
+      case "json": return JSON.parse(new TextDecoder().decode(message.body));
+      case "v8": return __sc_decode(message.body);
+      default: throw new TypeError(`Unknown queue content type: ${message.contentType}`);
+    }
+  };
+  const messages = incoming.messages.map((message) => ({
+    id: message.id,
+    timestamp: new Date(message.timestamp),
+    body: decode(message),
+    attempts: message.attempts,
+    ack() {
+      checkActive();
+      if (ackAll || retryBatch.retry || retries.has(message.id)) return;
+      explicitAcks.add(message.id);
+    },
+    retry(options) {
+      checkActive();
+      if (ackAll || explicitAcks.has(message.id)) return;
+      const delaySeconds = retryDelay(options);
+      if (delaySeconds !== undefined || !retries.has(message.id))
+        retries.set(message.id, delaySeconds);
+    },
+  }));
+  const oldest = incoming.metrics.oldestMessageTimestamp;
+  const batch = {
+    queue: incoming.queue,
+    messages,
+    metadata: {
+      metrics: {
+        backlogCount: incoming.metrics.backlogCount,
+        backlogBytes: incoming.metrics.backlogBytes,
+        oldestMessageTimestamp: oldest === undefined ? undefined : new Date(oldest),
+      },
+    },
+    ackAll() {
+      checkActive();
+      if (!retryBatch.retry) ackAll = true;
+    },
+    retryAll(options) {
+      checkActive();
+      if (ackAll) return;
+      retryBatch.retry = true;
+      const delaySeconds = retryDelay(options);
+      if (delaySeconds !== undefined) retryBatch.delaySeconds = delaySeconds;
+    },
+  };
+  let outcome = "ok";
+  let errorText;
+  try {
+    await __dispatchEntrypointMethodInCurrentEvent(name, "queue", batch);
+  } catch (error) {
+    // A handler exception retries the batch but keeps explicit acks that the
+    // handler made before it threw. The caller needs both facts together.
+    outcome = "exception";
+    try {
+      errorText = String(error);
+    } catch {
+      errorText = "queue handler rejected";
+    }
+  } finally {
+    active = false;
+  }
+  return {
+    outcome,
+    error: errorText,
+    ackAll,
+    retryBatch,
+    explicitAcks: [...explicitAcks],
+    retryMessages: [...retries].map(([msgId, delaySeconds]) => ({
+      msgId,
+      delaySeconds,
+    })),
+  };
+};
+
+// ---- Queues --------------------------------------------------------------
+// A Queue is one runtime-supplied Durable Object. The producer binding writes
+// bytes and a content tag through RPC, and the cell owns the durable order,
+// deadlines, leases, and alarms. `celld_logic::queue` owns every transition
+// that can invalidate a lease or choose a deadline; this code supplies SQL and
+// the Cloudflare-compatible presentation.
+
+const __QUEUE_MESSAGES = "__queue_messages";
+const __QUEUE_META = "__queue_meta";
+const __QUEUE_STATS = "__queue_stats";
+const __QUEUE_TRANSFER_RECEIPTS = "__queue_transfer_receipts";
+const __queueEncoder = new TextEncoder();
+
+// Independent send() calls share the same economics as sendBatch() without
+// changing the public promise boundary. The first call opens a four-millisecond
+// owner-local group by default; later cell events append their already-copied
+// entries, and park on their own promise. One event commits the bounded group,
+// and every response still trails that commit through the ordinary output
+// gate. The three caps bound heap retention and keep the persisted transaction
+// inside the public sendBatch limits.
+const __QUEUE_PRODUCER_GROUP_CALLS = 64;
+const __QUEUE_PRODUCER_GROUP_MESSAGES = 100;
+const __QUEUE_PRODUCER_GROUP_BYTES = 256_000;
+
+const __queueError = (message) => new Error("QUEUE_ERROR: " + String(message));
+// A Queue message id is a UUIDv7 (RFC 9562): 48 bits of enqueue time, a
+// 12-bit sequence inside that millisecond, and 62 random bits. It keeps the
+// UUID shape a consumer can parse, and it sorts in enqueue order, so the
+// UNIQUE index on `id` appends. A random v4 id made every grouped send
+// transaction dirty one index leaf per message (about 1.6 WAL frames per
+// 64-byte message) and turned every passive checkpoint into a random write
+// across the whole backlog, which is what made a deep Queue's checkpoint
+// cost grow with its backlog. The sequence never moves backwards inside one
+// process, so a clock step only widens the gap between consecutive ids.
+let __queueIdMs = 0;
+let __queueIdSeq = 0;
+function __queueMessageId(now) {
+  if (now > __queueIdMs) {
+    __queueIdMs = now;
+    __queueIdSeq = 0;
+  } else {
+    __queueIdSeq += 1;
+    if (__queueIdSeq > 0xfff) {
+      __queueIdMs += 1;
+      __queueIdSeq = 0;
+    }
+  }
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  const ms = __queueIdMs;
+  bytes[0] = Math.floor(ms / 0x10000000000) & 0xff;
+  bytes[1] = Math.floor(ms / 0x100000000) & 0xff;
+  bytes[2] = (ms >>> 24) & 0xff;
+  bytes[3] = (ms >>> 16) & 0xff;
+  bytes[4] = (ms >>> 8) & 0xff;
+  bytes[5] = ms & 0xff;
+  bytes[6] = 0x70 | (__queueIdSeq >> 8);
+  bytes[7] = __queueIdSeq & 0xff;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  let hex = "";
+  for (let i = 0; i < 16; i++) hex += bytes[i].toString(16).padStart(2, "0");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${
+    hex.slice(16, 20)
+  }-${hex.slice(20)}`;
+}
+const __queueLimits = () => __cell.queueLimits;
+const __queuePolicy = (request) =>
+  JSON.parse(__queue_policy(JSON.stringify(request)));
+
+const __queueDelay = (value, fallback = 0) => {
+  if (value === undefined || value === null) return fallback;
+  const seconds = Number(value);
+  if (!Number.isInteger(seconds) || seconds < 0 ||
+      seconds > __queueLimits().maxDelaySeconds) {
+    throw __queueError(
+      `delaySeconds must be an integer from 0 to ${__queueLimits().maxDelaySeconds}`,
+    );
+  }
+  return seconds;
+};
+
+const __queueBytes = (value) => {
+  if (value instanceof ArrayBuffer) {
+    return new Uint8Array(value.slice(0));
+  }
+  if (ArrayBuffer.isView(value)) {
+    return new Uint8Array(
+      value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength),
+    );
+  }
+  throw __queueError("a bytes message must be an ArrayBuffer or a typed array");
+};
+
+// Encode before entering the cell. The copy makes `sendBatch()` immune to a
+// caller resizing or reusing a backing buffer while the durable write awaits.
+const __queueEncode = (body, requestedType) => {
+  const contentType = requestedType ??
+    (__cell.compat.queueJsonMessages ? "json" : "v8");
+  let bytes;
+  switch (contentType) {
+    case "text":
+      bytes = __queueEncoder.encode(String(body));
+      break;
+    case "bytes":
+      bytes = __queueBytes(body);
+      break;
+    case "json": {
+      let json;
+      try {
+        json = JSON.stringify(body);
+      } catch (error) {
+        throw __queueError("the JSON message body cannot be serialized", error);
+      }
+      if (json === undefined) {
+        throw __queueError("the JSON message body cannot be undefined");
+      }
+      bytes = __queueEncoder.encode(json);
+      break;
+    }
+    case "v8":
+      try {
+        bytes = __sc_encode(body);
+      } catch (error) {
+        throw __queueError("the message body cannot be cloned", error);
+      }
+      break;
+    default:
+      throw __queueError(
+        `contentType must be "text", "bytes", "json", or "v8", got ${JSON.stringify(contentType)}`,
+      );
+  }
+  if (bytes.byteLength > __queueLimits().maxMessageBytes) {
+    throw __queueError(
+      `a message is at most ${__queueLimits().maxMessageBytes} bytes, got ${bytes.byteLength}`,
+    );
+  }
+  return { body: bytes, contentType, size: bytes.byteLength };
+};
+
+// A lease-scoped read must seek, not walk the backlog. The plan is the only
+// evidence that says which, and it is cheap to ask for, so a gated test seam
+// reads it from the shipped query rather than from a copy that can drift.
+const __queueReportLeaseLookupPlan = (sql, query, leaseId) => {
+  if (typeof __test_queue_lease_lookup_plan !== "function") return;
+  const plan = sql.exec(`EXPLAIN QUERY PLAN ${query}`, leaseId)
+    .toArray()
+    .map((row) => row.detail)
+    .join("; ");
+  __test_queue_lease_lookup_plan(plan);
+};
+
+const __queueMetricsView = (metrics) => ({
+  backlogCount: metrics.backlogCount,
+  backlogBytes: metrics.backlogBytes,
+  oldestMessageTimestamp: metrics.oldestMessageTimestamp === null ||
+      metrics.oldestMessageTimestamp === undefined
+    ? undefined
+    : new Date(metrics.oldestMessageTimestamp),
+});
+
+class __QueueCell {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.queue = ctx.id.name;
+    this._ready = false;
+    this._producerGroup = null;
+  }
+
+  _open() {
+    if (this._ready) return this.ctx.storage.sql;
+    const sql = this.ctx.storage.sql;
+    sql.exec(
+      `CREATE TABLE IF NOT EXISTS ${__QUEUE_MESSAGES} (
+         seq INTEGER PRIMARY KEY AUTOINCREMENT,
+         id TEXT NOT NULL UNIQUE,
+         body BLOB NOT NULL,
+         content_type TEXT NOT NULL,
+         size INTEGER NOT NULL,
+         enqueued_at INTEGER NOT NULL,
+         visible_at INTEGER NOT NULL,
+         attempts INTEGER NOT NULL DEFAULT 0,
+         lease_id TEXT,
+         lease_generation INTEGER NOT NULL DEFAULT 0,
+         leased_until INTEGER,
+         purge_on_settle INTEGER NOT NULL DEFAULT 0,
+         dlq_target TEXT,
+         dlq_transfer_id TEXT,
+         transfer_kind TEXT,
+         dead_letter_source TEXT,
+         CHECK ((dlq_target IS NULL AND transfer_kind IS NULL)
+             OR (dlq_target IS NOT NULL
+                 AND transfer_kind IN ('dead-letter', 'redrive')))
+       )`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_visible
+         ON ${__QUEUE_MESSAGES} (visible_at, seq)`,
+    );
+    // Rearming is on every producer acknowledgement and settlement. Each
+    // scheduling lookup must therefore stop at one deadline or one batch;
+    // an aggregate over the backlog makes a large Queue quadratic to fill.
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_ready
+         ON ${__QUEUE_MESSAGES} (visible_at, seq)
+         WHERE purge_on_settle = 0 AND dlq_target IS NULL
+           AND lease_id IS NULL`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_enqueued
+         ON ${__QUEUE_MESSAGES} (enqueued_at, seq)`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_retained
+         ON ${__QUEUE_MESSAGES} (enqueued_at, seq)
+         WHERE purge_on_settle = 0 AND dlq_target IS NULL`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_lease
+         ON ${__QUEUE_MESSAGES} (leased_until, seq)
+         WHERE lease_id IS NOT NULL`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_moving
+         ON ${__QUEUE_MESSAGES} (seq)
+         WHERE dlq_target IS NOT NULL`,
+    );
+    // Dispatch and settlement both select a whole batch by its lease. Without
+    // this index SQLite answers them by walking every row: the dispatch
+    // readback scans `_visible` and the settlement scan walks the table, so
+    // each delivered batch costs two passes over the backlog. The `_lease`
+    // index cannot serve them because it is keyed on `leased_until`.
+    // The partial predicate keeps only leased rows, which `max_concurrency`
+    // times `max_batch_size` bounds, and an inserted message has a null
+    // `lease_id`, so `send` pays nothing for it.
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_lease_batch
+         ON ${__QUEUE_MESSAGES} (lease_id, visible_at, seq)
+         WHERE lease_id IS NOT NULL`,
+    );
+    // The live-row index catches an impossible duplicate while a received
+    // message remains queued. The receipt below is the durable deduplication
+    // record after a consumer or purge removes that message.
+    sql.exec(
+      `CREATE UNIQUE INDEX IF NOT EXISTS ${__QUEUE_MESSAGES}_dlq_transfer
+         ON ${__QUEUE_MESSAGES} (dlq_transfer_id)
+         WHERE dlq_transfer_id IS NOT NULL AND dlq_target IS NULL`,
+    );
+    sql.exec(
+      `CREATE TABLE IF NOT EXISTS ${__QUEUE_META} (
+         name TEXT PRIMARY KEY,
+         value TEXT NOT NULL
+       ) WITHOUT ROWID`,
+    );
+    // The producer result and operator metrics are on hot paths. SQLite
+    // triggers keep the three values in the same transaction as every row
+    // transition, so a caller cannot observe a new message with old totals.
+    sql.exec(
+      `CREATE TABLE IF NOT EXISTS ${__QUEUE_STATS} (
+         id INTEGER PRIMARY KEY CHECK (id = 1),
+         stored_count INTEGER NOT NULL,
+         backlog_count INTEGER NOT NULL,
+         backlog_bytes INTEGER NOT NULL,
+         oldest_message_timestamp INTEGER
+       )`,
+    );
+    sql.exec(
+      `INSERT INTO ${__QUEUE_STATS}
+         (id, stored_count, backlog_count, backlog_bytes,
+          oldest_message_timestamp)
+       SELECT 1,
+              COUNT(*),
+              COALESCE(SUM(purge_on_settle = 0), 0),
+              COALESCE(SUM(CASE WHEN purge_on_settle = 0 THEN size ELSE 0 END), 0),
+              MIN(CASE WHEN purge_on_settle = 0 THEN enqueued_at END)
+         FROM ${__QUEUE_MESSAGES}
+        WHERE true
+       ON CONFLICT(id) DO NOTHING`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stored_insert
+       AFTER INSERT ON ${__QUEUE_MESSAGES}
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET stored_count = stored_count + 1
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stored_delete
+       AFTER DELETE ON ${__QUEUE_MESSAGES}
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET stored_count = stored_count - 1
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stats_insert
+       AFTER INSERT ON ${__QUEUE_MESSAGES}
+       WHEN new.purge_on_settle = 0
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET backlog_count = backlog_count + 1,
+                backlog_bytes = backlog_bytes + new.size,
+                oldest_message_timestamp = CASE
+                  WHEN oldest_message_timestamp IS NULL
+                    OR new.enqueued_at < oldest_message_timestamp
+                  THEN new.enqueued_at ELSE oldest_message_timestamp END
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stats_delete
+       AFTER DELETE ON ${__QUEUE_MESSAGES}
+       WHEN old.purge_on_settle = 0
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET backlog_count = backlog_count - 1,
+                backlog_bytes = backlog_bytes - old.size,
+                oldest_message_timestamp = CASE
+                  WHEN backlog_count <= 1 THEN NULL
+                  WHEN oldest_message_timestamp = old.enqueued_at
+                  THEN (SELECT MIN(enqueued_at) FROM ${__QUEUE_MESSAGES}
+                         WHERE purge_on_settle = 0)
+                  ELSE oldest_message_timestamp END
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stats_exclude
+       AFTER UPDATE OF purge_on_settle ON ${__QUEUE_MESSAGES}
+       WHEN old.purge_on_settle = 0 AND new.purge_on_settle != 0
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET backlog_count = backlog_count - 1,
+                backlog_bytes = backlog_bytes - old.size,
+                oldest_message_timestamp = CASE
+                  WHEN backlog_count <= 1 THEN NULL
+                  WHEN oldest_message_timestamp = old.enqueued_at
+                  THEN (SELECT MIN(enqueued_at) FROM ${__QUEUE_MESSAGES}
+                         WHERE purge_on_settle = 0)
+                  ELSE oldest_message_timestamp END
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TRIGGER IF NOT EXISTS ${__QUEUE_MESSAGES}_stats_include
+       AFTER UPDATE OF purge_on_settle ON ${__QUEUE_MESSAGES}
+       WHEN old.purge_on_settle != 0 AND new.purge_on_settle = 0
+       BEGIN
+         UPDATE ${__QUEUE_STATS}
+            SET backlog_count = backlog_count + 1,
+                backlog_bytes = backlog_bytes + new.size,
+                oldest_message_timestamp = CASE
+                  WHEN oldest_message_timestamp IS NULL
+                    OR new.enqueued_at < oldest_message_timestamp
+                  THEN new.enqueued_at ELSE oldest_message_timestamp END
+          WHERE id = 1;
+       END`,
+    );
+    sql.exec(
+      `CREATE TABLE IF NOT EXISTS ${__QUEUE_TRANSFER_RECEIPTS} (
+         transfer_id TEXT PRIMARY KEY,
+         message_id TEXT NOT NULL,
+         dead_letter_source TEXT,
+         expires_at INTEGER NOT NULL
+       ) WITHOUT ROWID`,
+    );
+    sql.exec(
+      `CREATE INDEX IF NOT EXISTS ${__QUEUE_TRANSFER_RECEIPTS}_expires
+         ON ${__QUEUE_TRANSFER_RECEIPTS} (expires_at, transfer_id)`,
+    );
+    this._ready = true;
+    return sql;
+  }
+
+  _meta(name) {
+    return this._open().exec(
+      `SELECT value FROM ${__QUEUE_META} WHERE name = ?`, name,
+    ).toArray()[0]?.value;
+  }
+
+  _setMeta(name, value) {
+    if (value === null || value === undefined) {
+      this._open().exec(`DELETE FROM ${__QUEUE_META} WHERE name = ?`, name);
+      return;
+    }
+    this._open().exec(
+      `INSERT INTO ${__QUEUE_META} (name, value) VALUES (?, ?)
+       ON CONFLICT(name) DO UPDATE SET value = excluded.value`,
+      name,
+      String(value),
+    );
+  }
+
+  _paused() {
+    return this._meta("paused") === "1";
+  }
+
+  _metrics(now = Date.now(), waitingOnly = false) {
+    const expiresBefore = now - __queueLimits().retentionMs;
+    const sql = this._open();
+    const stats = sql.exec(
+      `SELECT backlog_count, backlog_bytes, oldest_message_timestamp
+         FROM ${__QUEUE_STATS} WHERE id = 1`,
+    ).toArray()[0];
+    // Retention is a clock transition, not a row transition. Until the
+    // bounded sweep catches up, use the exact query only at that boundary;
+    // the normal hot path remains one materialized row at every depth.
+    if (stats.oldest_message_timestamp !== null &&
+        stats.oldest_message_timestamp <= expiresBefore) {
+      const row = sql.exec(
+        `SELECT COUNT(*) AS backlog_count,
+                COALESCE(SUM(size), 0) AS backlog_bytes,
+                MIN(enqueued_at) AS oldest_message_timestamp
+           FROM ${__QUEUE_MESSAGES}
+          WHERE purge_on_settle = 0 AND enqueued_at > ?
+            AND (? = 0 OR (lease_id IS NULL AND dlq_target IS NULL
+                           AND visible_at <= ?))`,
+        expiresBefore,
+        waitingOnly ? 1 : 0,
+        now,
+      ).toArray()[0];
+      return {
+        backlogCount: row.backlog_count,
+        backlogBytes: row.backlog_bytes,
+        oldestMessageTimestamp: row.oldest_message_timestamp ?? null,
+      };
+    }
+    if (!waitingOnly) {
+      if (typeof __test_queue_metrics_materialized === "function") {
+        __test_queue_metrics_materialized();
+      }
+      return {
+        backlogCount: stats.backlog_count,
+        backlogBytes: stats.backlog_bytes,
+        oldestMessageTimestamp: stats.oldest_message_timestamp ?? null,
+      };
+    }
+    const blocked = sql.exec(
+      `SELECT COALESCE(SUM(blocked_count), 0) AS blocked_count,
+              COALESCE(SUM(blocked_bytes), 0) AS blocked_bytes
+         FROM (
+           SELECT COUNT(*) AS blocked_count,
+                  COALESCE(SUM(size), 0) AS blocked_bytes
+             FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_lease
+            WHERE purge_on_settle = 0 AND lease_id IS NOT NULL
+           UNION ALL
+           SELECT COUNT(*) AS blocked_count,
+                  COALESCE(SUM(size), 0) AS blocked_bytes
+             FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_moving
+            WHERE purge_on_settle = 0 AND dlq_target IS NOT NULL
+           UNION ALL
+           SELECT COUNT(*) AS blocked_count,
+                  COALESCE(SUM(size), 0) AS blocked_bytes
+             FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_ready
+            WHERE purge_on_settle = 0 AND dlq_target IS NULL
+              AND lease_id IS NULL AND visible_at > ?
+         )`,
+      now,
+    ).toArray()[0];
+    const unleasedOldest = sql.exec(
+      `SELECT enqueued_at
+         FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_retained
+        WHERE purge_on_settle = 0 AND dlq_target IS NULL
+          AND lease_id IS NULL AND visible_at <= ?
+        ORDER BY enqueued_at, seq
+        LIMIT 1`,
+      now,
+    ).toArray()[0]?.enqueued_at ?? null;
+    return {
+      backlogCount: stats.backlog_count - blocked.blocked_count,
+      backlogBytes: stats.backlog_bytes - blocked.blocked_bytes,
+      oldestMessageTimestamp: unleasedOldest,
+    };
+  }
+
+  async _rearm(now = Date.now(), waitForWake = false) {
+    const sql = this._open();
+    const consumer = __cell.queueConsumers?.[this.queue];
+    const paused = this._paused();
+    const active = sql.exec(
+      `SELECT COUNT(DISTINCT lease_id) AS count
+         FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_lease
+        WHERE lease_id IS NOT NULL AND leased_until > ?`,
+      now,
+    ).toArray()[0].count;
+    const concurrency = consumer
+      ? consumer.maxConcurrency ?? __queueLimits().maxConcurrency
+      : 0;
+    const hasCapacity = !paused && consumer !== undefined && __queuePolicy({
+      op: "capacity",
+      active,
+      maximum: concurrency,
+    });
+    // We need only enough ready rows to distinguish a partial batch from a
+    // full one. The two indexed arms cover a new row and an expired lease,
+    // and the outer LIMIT keeps the work independent of backlog depth.
+    let ready = [];
+    if (hasCapacity) {
+      const visibleReady = sql.exec(
+        `SELECT visible_at AS ready_at, seq
+           FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_ready
+          WHERE purge_on_settle = 0 AND dlq_target IS NULL
+            AND lease_id IS NULL AND visible_at <= ?
+          ORDER BY visible_at, seq
+          LIMIT ?`,
+        now,
+        consumer.maxBatchSize,
+      ).toArray();
+      const expiredReady = sql.exec(
+        `SELECT leased_until AS ready_at, seq
+           FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_lease
+          WHERE purge_on_settle = 0 AND dlq_target IS NULL
+            AND lease_id IS NOT NULL AND leased_until <= ?
+          ORDER BY leased_until, seq
+          LIMIT ?`,
+        now,
+        consumer.maxBatchSize,
+      ).toArray();
+      ready = [...visibleReady, ...expiredReady]
+        .sort((left, right) => left.ready_at - right.ready_at || left.seq - right.seq)
+        .slice(0, consumer.maxBatchSize);
+    }
+    if (typeof __test_queue_rearm_bounded === "function") {
+      __test_queue_rearm_bounded(
+        ready.length <= (consumer?.maxBatchSize ?? 0),
+        ready.length > 0,
+      );
+    }
+    const earliestVisible = hasCapacity
+      ? sql.exec(
+        `SELECT visible_at
+           FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_ready
+          WHERE purge_on_settle = 0 AND dlq_target IS NULL
+            AND lease_id IS NULL AND visible_at > ?
+          ORDER BY visible_at, seq
+          LIMIT 1`,
+        now,
+      ).toArray()[0]?.visible_at ?? null
+      : null;
+    const earliestLeaseExpiry = paused
+      ? null
+      : sql.exec(
+        `SELECT leased_until
+           FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_lease
+          WHERE lease_id IS NOT NULL
+          ORDER BY leased_until
+          LIMIT 1`,
+      ).toArray()[0]?.leased_until ?? null;
+    const nextSweep = sql.exec(
+      `SELECT enqueued_at + ? AS next_sweep
+         FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_retained
+        WHERE dlq_target IS NULL AND purge_on_settle = 0
+        ORDER BY enqueued_at, seq
+        LIMIT 1`,
+      __queueLimits().retentionMs,
+    ).toArray()[0]?.next_sweep ?? null;
+    const dlqPending = sql.exec(
+      `SELECT 1 AS pending
+         FROM ${__QUEUE_MESSAGES} INDEXED BY ${__QUEUE_MESSAGES}_moving
+        WHERE dlq_target IS NOT NULL
+        LIMIT 1`,
+    ).toArray().length !== 0;
+    const receiptSweep = sql.exec(
+      `SELECT expires_at AS next_sweep
+         FROM ${__QUEUE_TRANSFER_RECEIPTS}
+        ORDER BY expires_at, transfer_id
+        LIMIT 1`,
+    ).toArray()[0]?.next_sweep ?? null;
+    // A queue without an attached consumer only wakes to reclaim retention.
+    // Consumer attachment will nudge the cell when the fleet catalog gains a
+    // registration; spinning on an already-visible row cannot make progress.
+    let batchDeadline = null;
+    if (ready.length > 0) {
+      batchDeadline = ready.length >= consumer.maxBatchSize
+        ? now
+        : ready[0].ready_at + consumer.maxBatchTimeoutMs;
+    }
+    if (dlqPending) {
+      batchDeadline = batchDeadline === null ? now : Math.min(batchDeadline, now);
+    }
+    const sweepDeadlines = [nextSweep, receiptSweep]
+      .filter((deadline) => deadline !== null && deadline !== undefined);
+    const armAt = __queuePolicy({
+      op: "rearm",
+      now,
+      batchDeadline,
+      earliestVisible,
+      // A live handler can settle after delivery pauses. Do not reclaim its
+      // lease while paused; resume re-arms the expired deadline immediately
+      // and only then can a new generation replace it.
+      earliestLeaseExpiry,
+      nextSweep: sweepDeadlines.length === 0 ? null : Math.min(...sweepDeadlines),
+    });
+    if (armAt !== null && !Number.isFinite(armAt)) {
+      throw __queueError("the Queue sweep deadline is invalid");
+    }
+    if (armAt === null) await this.ctx.storage.deleteAlarm();
+    else if (waitForWake) {
+      await __queue_alarm_set_wait(this.ctx.storage._scope, armAt);
+    } else await this.ctx.storage.setAlarm(armAt);
+  }
+
+  _newProducerGroup() {
+    const group = {
+      calls: [],
+      entries: [],
+      bytes: 0,
+      flushing: false,
+      timer: null,
+    };
+    this._producerGroup = group;
+    group.timer = setTimeout(() => {
+      void this._flushProducerGroup(group);
+    }, __queueLimits().producerGroupMs);
+    return group;
+  }
+
+  async _flushProducerGroup(group) {
+    if (group.flushing) return;
+    group.flushing = true;
+    if (this._producerGroup === group) this._producerGroup = null;
+    if (group.timer !== null) {
+      clearTimeout(group.timer);
+      group.timer = null;
+    }
+
+    const now = Date.now();
+    try {
+      const sql = this._open();
+      this.ctx.storage.transactionSync(() => {
+        for (const entry of group.entries) {
+          sql.exec(
+            `INSERT INTO ${__QUEUE_MESSAGES}
+               (id, body, content_type, size, enqueued_at, visible_at)
+             VALUES (?, ?, ?, ?, ?, ?)`,
+            __queueMessageId(now),
+            entry.body,
+            entry.contentType,
+            entry.size,
+            now,
+            now + entry.delaySeconds * 1000,
+          );
+        }
+      });
+      await this._rearm(now, true);
+      const metrics = this._metrics(now);
+      if (typeof __test_queue_producer_group === "function") {
+        __test_queue_producer_group(group.calls.length, group.entries.length);
+      }
+      for (const call of group.calls) call.resolve(metrics);
+    } catch (error) {
+      for (const call of group.calls) call.reject(error);
+    }
+  }
+
+  __queueSend({ entries }) {
+    const bytes = entries.reduce((total, entry) => total + entry.size, 0);
+    return new Promise((resolve, reject) => {
+      let group = this._producerGroup;
+      if (group !== null &&
+          (group.calls.length + 1 > __QUEUE_PRODUCER_GROUP_CALLS ||
+            group.entries.length + entries.length > __QUEUE_PRODUCER_GROUP_MESSAGES ||
+            group.bytes + bytes > __QUEUE_PRODUCER_GROUP_BYTES)) {
+        void this._flushProducerGroup(group);
+        group = null;
+      }
+      if (group === null) group = this._newProducerGroup();
+      group.calls.push({ resolve, reject });
+      group.entries.push(...entries);
+      group.bytes += bytes;
+      if (group.calls.length === __QUEUE_PRODUCER_GROUP_CALLS ||
+          group.entries.length === __QUEUE_PRODUCER_GROUP_MESSAGES ||
+          group.bytes === __QUEUE_PRODUCER_GROUP_BYTES) {
+        void this._flushProducerGroup(group);
+      }
+    });
+  }
+
+  __queueMetrics() {
+    return this._metrics();
+  }
+
+  // Retention decides visibility through `_metrics` immediately, while this
+  // bounded sweep only reclaims space. A live lease is marked instead of
+  // deleted, so its handler can finish but settlement or expiry removes it
+  // without a redelivery.
+  _sweep(now) {
+    const sql = this._open();
+    const cutoff = now - __queueLimits().retentionMs;
+    const messages = __cellSweepBatch(
+      this.ctx.storage,
+      (limit) => sql.exec(
+        `SELECT seq, lease_id, leased_until FROM ${__QUEUE_MESSAGES}
+          WHERE enqueued_at <= ?
+            AND (purge_on_settle = 0
+              OR lease_id IS NULL OR leased_until <= ?)
+          ORDER BY enqueued_at, seq
+          LIMIT ?`,
+        cutoff,
+        now,
+        limit,
+      ).toArray(),
+      (row) => {
+        if (row.lease_id !== null && row.leased_until > now) {
+          sql.exec(
+            `UPDATE ${__QUEUE_MESSAGES} SET purge_on_settle = 1 WHERE seq = ?`,
+            row.seq,
+          );
+        } else {
+          sql.exec(`DELETE FROM ${__QUEUE_MESSAGES} WHERE seq = ?`, row.seq);
+        }
+      },
+      __queueLimits().sweepBatchRows,
+    );
+    const remaining = __queueLimits().sweepBatchRows - messages;
+    if (remaining === 0) return messages;
+    const receipts = __cellSweepBatch(
+      this.ctx.storage,
+      (limit) => sql.exec(
+        `SELECT transfer_id FROM ${__QUEUE_TRANSFER_RECEIPTS}
+          WHERE expires_at <= ?
+          ORDER BY expires_at, transfer_id
+          LIMIT ?`,
+        now,
+        limit,
+      ).toArray(),
+      (row) => {
+        sql.exec(
+          `DELETE FROM ${__QUEUE_TRANSFER_RECEIPTS} WHERE transfer_id = ?`,
+          row.transfer_id,
+        );
+      },
+      remaining,
+    );
+    return messages + receipts;
+  }
+
+  _candidateRows(now, limit) {
+    return this._open().exec(
+      `SELECT seq, id, body, content_type, size, enqueued_at, visible_at,
+              attempts, lease_id, lease_generation, leased_until,
+              purge_on_settle
+         FROM ${__QUEUE_MESSAGES}
+        WHERE dlq_target IS NULL AND ((purge_on_settle = 1
+                 AND (lease_id IS NULL OR leased_until <= ?))
+           OR (purge_on_settle = 0 AND visible_at <= ?
+                 AND (lease_id IS NULL OR leased_until <= ?)))
+        ORDER BY visible_at, seq
+        LIMIT ?`,
+      now,
+      now,
+      now,
+      limit,
+    ).toArray();
+  }
+
+  async _leaseBatch(now, consumer) {
+    const sql = this._open();
+    const active = sql.exec(
+      `SELECT COUNT(DISTINCT lease_id) AS count
+         FROM ${__QUEUE_MESSAGES}
+        WHERE lease_id IS NOT NULL AND leased_until > ?`,
+      now,
+    ).toArray()[0].count;
+    const concurrency = consumer.maxConcurrency ?? __queueLimits().maxConcurrency;
+    if (!__queuePolicy({ op: "capacity", active, maximum: concurrency })) return null;
+
+    // Read extra rows so expired purge markers cannot hide a deliverable
+    // batch. Policy chooses at most `maxBatchSize` rows and returns every
+    // purge deletion that precedes them in this bounded scan.
+    const rows = this._candidateRows(now, consumer.maxBatchSize + 256);
+    const deliverable = rows.filter((row) => row.purge_on_settle === 0);
+    if (deliverable.length === 0) {
+      if (rows.length > 0) {
+        this.ctx.storage.transactionSync(() => {
+          for (const row of rows) {
+            sql.exec(`DELETE FROM ${__QUEUE_MESSAGES} WHERE seq = ?`, row.seq);
+          }
+        });
+      }
+      return null;
+    }
+    const readySince = Math.min(...deliverable.map((row) =>
+      row.lease_id === null ? row.visible_at : row.leased_until
+    ));
+    if (deliverable.length < consumer.maxBatchSize &&
+        readySince + consumer.maxBatchTimeoutMs > now) {
+      return null;
+    }
+
+    const plan = __queuePolicy({
+      op: "batch",
+      now,
+      maxBatchSize: consumer.maxBatchSize,
+      rows: rows.map((row) => ({
+        seq: row.seq,
+        visibleAt: row.visible_at,
+        leaseGeneration: String(row.lease_generation),
+        leasedUntil: row.leased_until,
+        purgeOnSettle: row.purge_on_settle !== 0,
+      })),
+    });
+    if (plan.leases.length === 0 && plan.deletePurged.length === 0) return null;
+    const rowBySeq = new Map(rows.map((row) => [row.seq, row]));
+    const reclaimed = plan.leases.filter((lease) => lease.reclaimed);
+    const expiryPolicy = __queuePolicy({
+      op: "expiry",
+      now,
+      entries: reclaimed.map((lease) => {
+        const row = rowBySeq.get(lease.seq);
+        return {
+          priorFailures: row.attempts,
+          maxRetries: consumer.maxRetries,
+          configuredSeconds: consumer.retryDelaySeconds ?? null,
+          purgeOnSettle: row.purge_on_settle !== 0,
+        };
+      }),
+    });
+    const expiryBySeq = new Map(
+      reclaimed.map((lease, index) => [lease.seq, expiryPolicy[index]]),
+    );
+    const installs = plan.leases.filter((lease) => {
+      const expiry = expiryBySeq.get(lease.seq);
+      return expiry === undefined ||
+        (expiry.action.kind === "retry" && expiry.action.at <= now);
+    });
+    const exhaustedTransfers = new Map(
+      reclaimed
+        .filter((lease) =>
+          expiryBySeq.get(lease.seq).action.kind === "exhausted" &&
+          consumer.deadLetterQueue !== undefined
+        )
+        .map((lease) => [lease.seq, crypto.randomUUID()]),
+    );
+    const leaseId = crypto.randomUUID();
+    const leasedUntil = Math.min(
+      Number.MAX_SAFE_INTEGER,
+      now + __cell.queueLeaseDurationMs,
+    );
+    this.ctx.storage.transactionSync(() => {
+      for (const seq of plan.deletePurged) {
+        sql.exec(
+          `DELETE FROM ${__QUEUE_MESSAGES}
+            WHERE seq = ? AND purge_on_settle = 1
+              AND (lease_id IS NULL OR leased_until <= ?)`,
+          seq,
+          now,
+        );
+      }
+      for (const lease of reclaimed) {
+        const expiry = expiryBySeq.get(lease.seq);
+        if (expiry.action.kind === "delete-purged") {
+          sql.exec(
+            `DELETE FROM ${__QUEUE_MESSAGES}
+              WHERE seq = ? AND leased_until <= ?`,
+            lease.seq,
+            now,
+          );
+        } else if (expiry.action.kind === "exhausted") {
+          if (consumer.deadLetterQueue === undefined) {
+            sql.exec(
+              `DELETE FROM ${__QUEUE_MESSAGES}
+                WHERE seq = ? AND leased_until <= ?`,
+              lease.seq,
+              now,
+            );
+          } else {
+            sql.exec(
+              `UPDATE ${__QUEUE_MESSAGES}
+                  SET attempts = ?, lease_id = NULL, leased_until = NULL,
+                      dlq_target = ?, dlq_transfer_id = ?,
+                      transfer_kind = 'dead-letter'
+                WHERE seq = ? AND leased_until <= ?`,
+              expiry.attempt,
+              consumer.deadLetterQueue,
+              exhaustedTransfers.get(lease.seq),
+              lease.seq,
+              now,
+            );
+          }
+        } else if (expiry.action.at > now) {
+          sql.exec(
+            `UPDATE ${__QUEUE_MESSAGES}
+                SET attempts = ?, visible_at = ?, lease_id = NULL,
+                    leased_until = NULL
+              WHERE seq = ? AND leased_until <= ?`,
+            expiry.attempt,
+            expiry.action.at,
+            lease.seq,
+            now,
+          );
+        }
+      }
+      for (const lease of installs) {
+        const generation = Number(lease.generation);
+        if (!Number.isSafeInteger(generation)) {
+          throw __queueError(`message ${lease.seq} exhausted its safe lease generation`);
+        }
+        sql.exec(
+          `UPDATE ${__QUEUE_MESSAGES}
+              SET lease_id = ?, lease_generation = ?, leased_until = ?,
+                  attempts = attempts + ?
+            WHERE seq = ? AND lease_generation = ?
+              AND (lease_id IS NULL OR leased_until <= ?)`,
+          leaseId,
+          generation,
+          leasedUntil,
+          lease.reclaimed ? 1 : 0,
+          lease.seq,
+          generation - 1,
+          now,
+        );
+      }
+    });
+    if (installs.length === 0) return null;
+    const leasedQuery =
+      `SELECT seq, id, body, content_type, enqueued_at, attempts,
+              lease_generation
+         FROM ${__QUEUE_MESSAGES}
+        WHERE lease_id = ?
+        ORDER BY visible_at, seq`;
+    __queueReportLeaseLookupPlan(sql, leasedQuery, leaseId);
+    const leased = sql.exec(leasedQuery, leaseId).toArray();
+    if (leased.length !== installs.length) {
+      throw __queueError("the Queue lease transaction changed fewer rows than its plan");
+    }
+    return {
+      leaseId,
+      leases: leased.map((row) => ({
+        message_id: row.id,
+        seq: row.seq,
+        generation: row.lease_generation,
+      })),
+      messages: leased.map((row) => ({
+        id: row.id,
+        timestampMs: row.enqueued_at,
+        // SQLite answers a BLOB as an ArrayBuffer. The raw base64 op accepts
+        // typed views, so normalize here; otherwise it encodes the text
+        // "[object ArrayBuffer]" and every consumer decoder sees corrupt data.
+        bodyBase64: $$btoa(
+          row.body instanceof Uint8Array ? row.body : new Uint8Array(row.body),
+        ),
+        contentType: row.content_type,
+        attempts: row.attempts + 1,
+      })),
+      // Miniflare removes every dispatched batch from its backlog before it
+      // invokes the consumer. Exclude every lease here for the same contract;
+      // the operator aggregate still includes durable in-flight messages.
+      metrics: this._metrics(now, true),
+    };
+  }
+
+  // The target deduplicates the stable transfer identity. The source can
+  // therefore repeat this call after a stop between the target commit and the
+  // source delete without creating a second message.
+  async __queueDlqAcceptBatch({ transfers }) {
+    if (!Array.isArray(transfers) || transfers.length === 0 ||
+        transfers.length > __queueLimits().maxBatchMessages) {
+      throw __queueError("a Queue transfer batch has an invalid size");
+    }
+    for (const transfer of transfers) {
+      if (transfer.deadLetterSource !== null &&
+          typeof transfer.deadLetterSource !== "string") {
+        throw __queueError("a Queue transfer has an invalid dead-letter source");
+      }
+    }
+    const now = Date.now();
+    const sql = this._open();
+    this.ctx.storage.transactionSync(() => {
+      for (const { transferId, entry, deadLetterSource } of transfers) {
+        const accepted = sql.exec(
+          `SELECT message_id, dead_letter_source
+             FROM ${__QUEUE_TRANSFER_RECEIPTS}
+            WHERE transfer_id = ?`,
+          transferId,
+        ).toArray()[0];
+        if (accepted !== undefined && (accepted.message_id !== entry.id ||
+            accepted.dead_letter_source !== deadLetterSource)) {
+          throw __queueError("a DLQ transfer collided with another message identity");
+        }
+        if (accepted !== undefined) continue;
+        sql.exec(
+          `INSERT INTO ${__QUEUE_TRANSFER_RECEIPTS}
+             (transfer_id, message_id, dead_letter_source, expires_at)
+           VALUES (?, ?, ?, ?)`,
+          transferId,
+          entry.id,
+          deadLetterSource,
+          now + __queueLimits().retentionMs,
+        );
+        sql.exec(
+          `INSERT INTO ${__QUEUE_MESSAGES}
+             (id, body, content_type, size, enqueued_at, visible_at,
+              attempts, dlq_transfer_id, dead_letter_source)
+           VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)`,
+          entry.id,
+          entry.body,
+          entry.contentType,
+          entry.size,
+          now,
+          now,
+          transferId,
+          deadLetterSource,
+        );
+      }
+    });
+    await this._rearm(now);
+    return this._metrics(now);
+  }
+
+  async _driveDlq(limit = 100) {
+    const now = Date.now();
+    const pending = this._open().exec(
+      `SELECT seq, id, body, content_type, size, dlq_target, dlq_transfer_id,
+              transfer_kind
+         FROM ${__QUEUE_MESSAGES}
+        WHERE dlq_target IS NOT NULL
+          AND enqueued_at > ?
+        ORDER BY seq
+        LIMIT ?`,
+      now - __queueLimits().retentionMs,
+      limit,
+    ).toArray();
+    const groups = new Map();
+    for (const row of pending) {
+      let group = groups.get(row.dlq_target);
+      if (group === undefined) groups.set(row.dlq_target, group = []);
+      group.push(row);
+    }
+    for (const [targetName, rows] of groups) {
+      const target = __cell.makeNamespace("__Queue").getByName(targetName);
+      await target.__queueDlqAcceptBatch({
+        transfers: rows.map((row) => ({
+          transferId: row.dlq_transfer_id,
+          // A dead-letter transfer records where redrive returns the message.
+          // A redrive returns it to ordinary queue state, so the source marker
+          // must not follow it and make a later redrive bounce it backwards.
+          deadLetterSource: row.transfer_kind === "dead-letter" ? this.queue : null,
+          entry: {
+            id: row.id,
+            body: row.body,
+            contentType: row.content_type,
+            size: row.size,
+          },
+        })),
+      });
+      if (typeof __test_queue_dlq_accepted === "function") {
+        __test_queue_dlq_accepted();
+      }
+      // The target committed every receipt before this reply. Delete the
+      // corresponding source marks together; a stop before this transaction
+      // leaves the whole group replayable through those stable receipts.
+      this.ctx.storage.transactionSync(() => {
+        for (const row of rows) {
+          this._open().exec(
+            `DELETE FROM ${__QUEUE_MESSAGES}
+              WHERE seq = ? AND dlq_target = ? AND dlq_transfer_id = ?
+                AND transfer_kind = ?`,
+            row.seq,
+            row.dlq_target,
+            row.dlq_transfer_id,
+            row.transfer_kind,
+          );
+        }
+      });
+    }
+    return pending.length;
+  }
+
+  async alarm() {
+    const now = Date.now();
+    try {
+      await this._driveDlq();
+    } catch (error) {
+      // The durable source mark is the retry record. An alarm stays armed at
+      // `now`, and the target's transfer identity makes a replay idempotent.
+      console.error("Queue DLQ transfer failed:", error);
+    }
+    const swept = this._sweep(now);
+    const consumer = this._paused()
+      ? undefined
+      : __cell.queueConsumers?.[this.queue];
+    // Install every lease that the configured concurrency admits before the
+    // first consumer can settle. One lease per alarm serialized full batches
+    // because the next alarm depended on a later scheduler turn, so a queue
+    // with maxConcurrency > 1 still used only one handler under backlog.
+    // `_leaseBatch` counts the durable lease IDs on every iteration, which
+    // makes the configured concurrency the structural bound for this loop.
+    const batches = [];
+    if (consumer !== undefined) {
+      while (true) {
+        const batch = await this._leaseBatch(now, consumer);
+        if (batch === null) break;
+        batches.push(batch);
+      }
+    }
+    try {
+      // `_leaseBatch` can exhaust an expired lease and create a new durable
+      // DLQ mark. Drive that mark in the same wake; the first call above is
+      // for a mark recovered from an earlier stopped process.
+      await this._driveDlq();
+    } catch (error) {
+      console.error("Queue DLQ transfer failed:", error);
+    }
+    await this._rearm(now);
+    if (swept >= __queueLimits().sweepBatchRows && batches.length === 0) {
+      await this.ctx.storage.setAlarm(now + 1);
+      return;
+    }
+    for (const batch of batches) {
+      // This await covers only the output-gated handoff to the host. The
+      // consumer runs after this alarm returns, and settlement comes back as
+      // an independent cell event. All admitted leases are durable before the
+      // first handoff, so a fast settlement cannot make this turn exceed the
+      // configured concurrency.
+      await __queue_dispatch(
+        consumer.script,
+        this.queue,
+        JSON.stringify(batch),
+      );
+    }
+  }
+
+  _matchingLease(body) {
+    if (typeof body.leaseId !== "string" || !Array.isArray(body.leases)) return null;
+    const matchQuery =
+      `SELECT seq, id, attempts, lease_generation, purge_on_settle
+         FROM ${__QUEUE_MESSAGES}
+        WHERE lease_id = ?
+        ORDER BY seq`;
+    __queueReportLeaseLookupPlan(this._open(), matchQuery, body.leaseId);
+    const rows = this._open().exec(matchQuery, body.leaseId).toArray();
+    for (const lease of body.leases) {
+      if (typeof lease?.message_id !== "string" ||
+          !Number.isSafeInteger(lease.seq) ||
+          !Number.isSafeInteger(lease.generation)) return null;
+    }
+    const matches = __queuePolicy({
+      op: "settlement",
+      current: rows.map((row) => ({
+        seq: String(row.seq),
+        messageId: row.id,
+        generation: String(row.lease_generation),
+      })),
+      submitted: body.leases.map((lease) => ({
+        seq: String(lease.seq),
+        messageId: lease.message_id,
+        generation: String(lease.generation),
+      })),
+    });
+    return matches ? rows : null;
+  }
+
+  async _settle(body) {
+    const rows = this._matchingLease(body);
+    if (rows === null) return false;
+    const consumer = __cell.queueConsumers?.[this.queue];
+    if (consumer === undefined) return false;
+    const explicitAcks = new Set(body.explicitAcks ?? []);
+    const retryMessages = new Map(
+      (body.retryMessages ?? []).map((retry) => [retry.msgId, retry.delaySeconds]),
+    );
+    const retryBatch = body.retryBatch?.retry === true;
+    const batchDelay = body.retryBatch?.delaySeconds;
+    const exception = body.outcome === "exception";
+    // An explicit ack-all survives a later handler exception, so it must
+    // override every batch-level and message-level retry signal.
+    const ackAll = body.ackAll === true;
+    const decisions = rows.map((row) => {
+      const retry = !ackAll && !explicitAcks.has(row.id) && (
+        retryMessages.has(row.id) || retryBatch || exception
+      );
+      return { row, retry };
+    });
+    const retrying = decisions.filter((decision) =>
+      decision.retry && decision.row.purge_on_settle === 0
+    );
+    const retryPolicy = __queuePolicy({
+      op: "retries",
+      now: Date.now(),
+      entries: retrying.map(({ row }) => ({
+        attempt: row.attempts + 1,
+        maxRetries: consumer.maxRetries,
+        explicitSeconds: retryMessages.has(row.id)
+          ? retryMessages.get(row.id)
+          : retryBatch ? batchDelay : null,
+        configuredSeconds: consumer.retryDelaySeconds ?? null,
+      })),
+    });
+    const retryById = new Map(
+      retrying.map(({ row }, index) => [row.id, retryPolicy[index]]),
+    );
+    const dlqTransferById = new Map(
+      retrying
+        .filter(({ row }) =>
+          retryById.get(row.id).exhausted && consumer.deadLetterQueue !== undefined
+        )
+        .map(({ row }) => [row.id, crypto.randomUUID()]),
+    );
+    const sql = this._open();
+    this.ctx.storage.transactionSync(() => {
+      for (const { row, retry } of decisions) {
+        const policy = retryById.get(row.id);
+        if (row.purge_on_settle !== 0 || !retry ||
+            (policy.exhausted && consumer.deadLetterQueue === undefined)) {
+          sql.exec(
+            `DELETE FROM ${__QUEUE_MESSAGES}
+              WHERE seq = ? AND lease_id = ? AND lease_generation = ?`,
+            row.seq,
+            body.leaseId,
+            row.lease_generation,
+          );
+          continue;
+        }
+        if (policy.exhausted) {
+          sql.exec(
+            `UPDATE ${__QUEUE_MESSAGES}
+                SET attempts = attempts + 1, lease_id = NULL,
+                    leased_until = NULL, dlq_target = ?, dlq_transfer_id = ?,
+                    transfer_kind = 'dead-letter'
+              WHERE seq = ? AND lease_id = ? AND lease_generation = ?`,
+            consumer.deadLetterQueue,
+            dlqTransferById.get(row.id),
+            row.seq,
+            body.leaseId,
+            row.lease_generation,
+          );
+          continue;
+        }
+        sql.exec(
+          `UPDATE ${__QUEUE_MESSAGES}
+              SET attempts = attempts + 1, visible_at = ?,
+                  lease_id = NULL, leased_until = NULL
+            WHERE seq = ? AND lease_id = ? AND lease_generation = ?`,
+          policy.at,
+          row.seq,
+          body.leaseId,
+          row.lease_generation,
+        );
+      }
+    });
+    try {
+      await this._driveDlq();
+    } catch (error) {
+      // Settlement is durable once the source mark commits. A failed transfer
+      // is alarm work now, not a reason to put the message back in delivery.
+      console.error("Queue DLQ transfer deferred:", error);
+    }
+    await this._rearm();
+    return true;
+  }
+
+  async _purge() {
+    const now = Date.now();
+    const sql = this._open();
+    let deleted = 0;
+    let leased = 0;
+    this.ctx.storage.transactionSync(() => {
+      let after = 0;
+      while (true) {
+        // Purge is necessarily proportional to the stored backlog, but its
+        // policy envelope stays bounded instead of materializing the Queue in
+        // V8 or Rust. One SQLite transaction keeps the visibility change
+        // atomic across all chunks.
+        const rows = sql.exec(
+          `SELECT seq, lease_id, leased_until FROM ${__QUEUE_MESSAGES}
+            WHERE seq > ?
+            ORDER BY seq
+            LIMIT 256`,
+          after,
+        ).toArray();
+        if (rows.length === 0) break;
+        after = rows[rows.length - 1].seq;
+        const plan = __queuePolicy({
+          op: "purge",
+          now,
+          rows: rows.map((row) => ({
+            seq: String(row.seq),
+            leaseIdPresent: row.lease_id !== null,
+            leasedUntil: row.leased_until,
+          })),
+        });
+        for (const seq of plan.delete) {
+          sql.exec(
+            `DELETE FROM ${__QUEUE_MESSAGES}
+              WHERE seq = ?
+                AND (lease_id IS NULL OR leased_until IS NULL OR leased_until <= ?)`,
+            Number(seq),
+            now,
+          );
+          deleted += 1;
+        }
+        for (const seq of plan.markForSettle) {
+          sql.exec(
+            `UPDATE ${__QUEUE_MESSAGES} SET purge_on_settle = 1
+              WHERE seq = ? AND lease_id IS NOT NULL AND leased_until > ?`,
+            Number(seq),
+            now,
+          );
+          leased += 1;
+        }
+      }
+    });
+    await this._rearm(now);
+    return { deleted, leased, metrics: this._metrics(now) };
+  }
+
+  async _setPaused(paused) {
+    this._setMeta("paused", paused ? "1" : null);
+    await this._rearm();
+    return { paused, ...this._metrics() };
+  }
+
+  _operatorLimit(value, fallback) {
+    const limit = value ?? fallback;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      throw __queueError("limit must be an integer from 1 through 100");
+    }
+    return limit;
+  }
+
+  _peek(limit) {
+    const now = Date.now();
+    const cutoff = now - __queueLimits().retentionMs;
+    const rows = this._open().exec(
+      `SELECT id, body, content_type, size, enqueued_at, visible_at, attempts,
+              lease_id, leased_until, purge_on_settle, dlq_target,
+              dead_letter_source
+         FROM ${__QUEUE_MESSAGES}
+        WHERE enqueued_at > ?
+        ORDER BY visible_at, seq
+        LIMIT ?`,
+      cutoff,
+      limit,
+    ).toArray();
+    return {
+      messages: rows.map((row) => ({
+        id: row.id,
+        bodyBase64: $$btoa(
+          row.body instanceof Uint8Array ? row.body : new Uint8Array(row.body),
+        ),
+        contentType: row.content_type,
+        size: row.size,
+        enqueuedAt: row.enqueued_at,
+        visibleAt: row.visible_at,
+        attempts: row.attempts,
+        state: row.dlq_target !== null
+          ? "moving"
+          : row.purge_on_settle !== 0
+          ? "purging"
+          : row.lease_id !== null && row.leased_until > now
+          ? "leased"
+          : row.visible_at <= now
+          ? "visible"
+          : "delayed",
+        leasedUntil: row.lease_id !== null && row.leased_until > now
+          ? row.leased_until
+          : null,
+        transferTarget: row.dlq_target,
+        deadLetterSource: row.dead_letter_source,
+      })),
+    };
+  }
+
+  async _redrive(limit) {
+    // Finish an interrupted move before selecting more work. A transfer mark
+    // is durable, so selecting it a second time would invent another identity
+    // where replaying the existing identity is sufficient.
+    await this._driveDlq(100);
+    const now = Date.now();
+    const cutoff = now - __queueLimits().retentionMs;
+    const candidates = this._open().exec(
+      `SELECT seq, dead_letter_source
+         FROM ${__QUEUE_MESSAGES}
+        WHERE dead_letter_source IS NOT NULL
+          AND dlq_target IS NULL
+          AND purge_on_settle = 0
+          AND enqueued_at > ?
+          AND (lease_id IS NULL OR leased_until <= ?)
+        ORDER BY visible_at, seq
+        LIMIT ?`,
+      cutoff,
+      now,
+      limit,
+    ).toArray();
+    const transfers = candidates.map((row) => ({
+      ...row,
+      transferId: crypto.randomUUID(),
+    }));
+    this.ctx.storage.transactionSync(() => {
+      for (const transfer of transfers) {
+        this._open().exec(
+          `UPDATE ${__QUEUE_MESSAGES}
+              SET dlq_target = ?, dlq_transfer_id = ?, transfer_kind = 'redrive',
+                  lease_id = NULL, leased_until = NULL
+            WHERE seq = ? AND dead_letter_source = ? AND dlq_target IS NULL
+              AND purge_on_settle = 0
+              AND (lease_id IS NULL OR leased_until <= ?)`,
+          transfer.dead_letter_source,
+          transfer.transferId,
+          transfer.seq,
+          transfer.dead_letter_source,
+          now,
+        );
+      }
+    });
+    // Arm before the cross-cell call. If the process stops after the durable
+    // mark, the alarm replays the same transfer identity.
+    await this._rearm(now);
+    await this._driveDlq(100);
+    await this._rearm();
+    return { redriven: transfers.length, metrics: this._metrics() };
+  }
+
+  async fetch(request) {
+    const path = new URL(request.url).pathname;
+    if (request.method !== "POST") {
+      return new Response("Queue route not found", { status: 404 });
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return new Response("invalid Queue request", { status: 400 });
+    }
+    try {
+      if (path === "/__qSettle") {
+        return await this._settle(body)
+          ? new Response(null, { status: 204 })
+          : new Response("stale Queue settlement", { status: 409 });
+      }
+      if (body.op === "info") {
+        const metrics = this._metrics();
+        const stored = this._open().exec(
+          `SELECT stored_count FROM ${__QUEUE_STATS} WHERE id = 1`,
+        ).toArray()[0].stored_count;
+        return Response.json({ result: { ...metrics, stored, paused: this._paused() } });
+      }
+      if (body.op === "purge") {
+        return Response.json({ result: await this._purge() });
+      }
+      if (body.op === "pause") {
+        return Response.json({ result: await this._setPaused(true) });
+      }
+      if (body.op === "resume") {
+        return Response.json({ result: await this._setPaused(false) });
+      }
+      if (body.op === "peek") {
+        return Response.json({
+          result: this._peek(this._operatorLimit(body.limit, 10)),
+        });
+      }
+      if (body.op === "redrive") {
+        return Response.json({
+          result: await this._redrive(this._operatorLimit(body.limit, 100)),
+        });
+      }
+      return Response.json(
+        { error: `QUEUE_ERROR: unknown operation ${JSON.stringify(body.op)}` },
+        { status: 400 },
+      );
+    } catch (error) {
+      return Response.json(
+        { error: String(error?.message ?? error) },
+        { status: 400 },
+      );
+    }
+  }
+}
+
+__runtimeClass("__Queue", __QueueCell);
+
+class Queue {
+  constructor(queue, cellName, deliveryDelay) {
+    Object.defineProperties(this, {
+      _queue: { value: queue },
+      _cellName: { value: cellName },
+      _deliveryDelay: { value: deliveryDelay },
+    });
+  }
+
+  get _stub() {
+    return __cell.makeNamespace("__Queue").getByName(this._cellName);
+  }
+
+  async _send(entries) {
+    const metrics = await this._stub.__queueSend({ entries });
+    return { metadata: { metrics: __queueMetricsView(metrics) } };
+  }
+
+  send(body, options = {}) {
+    const encoded = __queueEncode(body, options.contentType);
+    return this._send([{
+      ...encoded,
+      delaySeconds: __queueDelay(options.delaySeconds, this._deliveryDelay),
+    }]);
+  }
+
+  sendBatch(messages, options = {}) {
+    if (messages === null || messages === undefined ||
+        typeof messages[Symbol.iterator] !== "function") {
+      throw __queueError("sendBatch() needs an iterable of messages");
+    }
+    const entries = [];
+    let bytes = 0;
+    const batchDelay = __queueDelay(options.delaySeconds, this._deliveryDelay);
+    for (const message of messages) {
+      if (entries.length >= __queueLimits().maxBatchMessages) {
+        throw __queueError(
+          `a batch has at most ${__queueLimits().maxBatchMessages} messages`,
+        );
+      }
+      if (message === null || typeof message !== "object" || !("body" in message)) {
+        throw __queueError("each batch entry needs a body");
+      }
+      const encoded = __queueEncode(message.body, message.contentType);
+      bytes += encoded.size;
+      if (bytes > __queueLimits().maxBatchBytes) {
+        throw __queueError(
+          `a batch is at most ${__queueLimits().maxBatchBytes} bytes, got ${bytes}`,
+        );
+      }
+      entries.push({
+        ...encoded,
+        delaySeconds: __queueDelay(message.delaySeconds, batchDelay),
+      });
+    }
+    if (entries.length === 0) {
+      throw __queueError("sendBatch() needs at least one message");
+    }
+    return this._send(entries);
+  }
+
+  async metrics() {
+    return __queueMetricsView(await this._stub.__queueMetrics());
+  }
+}
+
+__celld.__makeQueue = (queue, cellName, deliveryDelay) =>
+  new Queue(queue, cellName, deliveryDelay);
+
+
+  return { QueueCell: classes.__Queue, makeQueue: __celld.__makeQueue, dispatchQueue: __celld.__dispatchEntrypointQueue };
+}